From 6243d2caddf2b6c1a7af52188bc0131f3c572dcd Mon Sep 17 00:00:00 2001
From: Ariel Shulman <ariel97shulman@gmail.com>
Date: Fri, 28 Aug 2026 17:19:43 +0300
Subject: [PATCH] feat(fixtures): consolidate corpus around a flagship demo
 fork + mutation tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace 14 single-scenario fixtures with a flagship fixture (a fork of the
ora-air demo enriched with a dynamic segment, hand-owned llms.txt, MDX page,
sitemap, gated page, and two MCP servers behind a secret-free auth stub), a
full Pages Router twin, and thin single-axis fixtures (webmcp, next-auth).
21 fixtures become 11; the golden/conformance pipeline needed no changes.

Add scripts/mutation-tests.mjs: multi-build sequences over the flagship
(idempotence, user-edit preservation, orphaned-twin cleanup, additive change,
auth-method flip, manifest drift) — the build-N+1 bugs the one-shot golden
layer can't see. Wired into CI after the dogfood step.

Fix three product bugs the new corpus surfaced:
- the router model now counts MDX pages as routes exactly when next.config
  pageExtensions serves them, so /guide is in the serving manifest instead of
  404-wayfinding for agents
- the stale-twin sweep no longer deletes ax's own 404.md every second build
  (phantom markdownTwins.deleted entry); twin deletions now log per-path
- the raw-mode multiselect no longer garbles on arrow keys: the shared
  readline interface's keypress listeners are suspended during the selector
  (history recall was rewriting earlier answers over the rows), and a
  zero-column PTY no longer truncates every row to nothing

Retarget dogfood-middleware.mjs to the flagship (adds a composed-middleware
probe: withAx's second argument still bot-gates scripted UAs).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml                      |   9 +-
 .gitignore                                    |  24 +-
 README.md                                     |   2 +-
 fixtures/config-overrides/README.md           |  21 -
 fixtures/config-overrides/app/layout.tsx      |  14 -
 fixtures/config-overrides/app/page.tsx        |  11 -
 fixtures/config-overrides/ax.config.ts        |  57 ---
 fixtures/config-overrides/report.golden.json  | 196 --------
 fixtures/discovery/README.md                  |  16 -
 fixtures/discovery/app/layout.tsx             |  31 --
 fixtures/discovery/app/page.tsx               |  12 -
 fixtures/discovery/app/sitemap.ts             |  12 -
 fixtures/discovery/ax.config.ts               |  11 -
 fixtures/discovery/package.json               |  23 -
 fixtures/discovery/public/agents.md           |   9 -
 fixtures/discovery/public/robots.txt          |   9 -
 fixtures/discovery/report.golden.json         | 187 --------
 fixtures/discovery/twins.golden/404.md        |  21 -
 fixtures/discovery/twins.golden/index.md      |  11 -
 fixtures/flagship-pages/README.md             |  28 ++
 fixtures/flagship-pages/ax.config.ts          |  21 +
 .../cards.golden/server-card.json             |  28 ++
 .../cards.golden/server-card/api-mcp.json     |  37 ++
 .../server-card/api-public-mcp.json           |  28 ++
 fixtures/flagship-pages/lib/data/airports.ts  |  35 ++
 fixtures/flagship-pages/lib/data/flights.ts   | 166 +++++++
 fixtures/flagship-pages/lib/data/seatmaps.ts  | 128 +++++
 .../flagship-pages/lib/services/booking.ts    |  89 ++++
 .../flagship-pages/lib/services/payment.ts    |  32 ++
 .../flagship-pages/lib/services/search.ts     |  16 +
 fixtures/flagship-pages/middleware.ts         |  12 +
 .../next-env.d.ts                             |   0
 .../next.config.mjs                           |   0
 .../package.json                              |   3 +-
 fixtures/flagship-pages/pages/404.tsx         |  13 +
 .../pages/_app.tsx                            |   0
 .../pages/_document.tsx                       |   4 +-
 fixtures/flagship-pages/pages/account.tsx     |  19 +
 .../flagship-pages/pages/api/[transport].ts   | 128 +++++
 .../pages/api/public/[transport].ts           |  47 ++
 fixtures/flagship-pages/pages/checkout.tsx    |  18 +
 .../flagship-pages/pages/confirmation.tsx     |  18 +
 .../pages/destinations/[slug].tsx             |  35 ++
 .../pages/destinations/index.tsx              |  51 ++
 fixtures/flagship-pages/pages/index.tsx       |  25 +
 fixtures/flagship-pages/pages/results.tsx     |  18 +
 fixtures/flagship-pages/pages/seats.tsx       |  18 +
 .../report.golden.json                        | 158 ++++---
 .../tsconfig.json                             |   5 +
 .../twins.golden/404.md                       |   9 +-
 fixtures/flagship-pages/twins.golden/auth.md  |  18 +
 .../twins.golden/destinations.md              |  26 ++
 fixtures/flagship-pages/twins.golden/index.md |  13 +
 .../types/webmcp-forms.d.ts                   |   0
 fixtures/flagship/README.md                   |  42 ++
 .../oauth-authorization-server/route.ts       |  36 ++
 .../oauth-protected-resource/route.ts         |  32 ++
 fixtures/flagship/app/account/page.tsx        |  21 +
 .../flagship/app/api/[transport]/route.ts     | 126 +++++
 fixtures/flagship/app/api/book/route.ts       |  35 ++
 fixtures/flagship/app/api/pay/route.ts        |  37 ++
 .../app/api/public/[transport]/route.ts       |  42 ++
 fixtures/flagship/app/api/search/route.ts     |  89 ++++
 fixtures/flagship/app/api/seats/route.ts      |  42 ++
 fixtures/flagship/app/api/session/route.ts    |   6 +
 .../flagship/app/checkout/checkout-client.tsx | 209 +++++++++
 fixtures/flagship/app/checkout/page.tsx       |  15 +
 .../flagship/app/components/AirportSelect.tsx |  96 ++++
 .../flagship/app/components/DateSelect.tsx    |  73 +++
 .../app/components/FareHoldBanner.tsx         |  46 ++
 fixtures/flagship/app/components/Footer.tsx   |  35 ++
 fixtures/flagship/app/components/Header.tsx   |  38 ++
 .../flagship/app/components/PaxSelect.tsx     |  41 ++
 .../flagship/app/components/SearchWidget.tsx  |  84 ++++
 .../flagship/app/components/SliderCaptcha.tsx |  86 ++++
 fixtures/flagship/app/components/StepBar.tsx  |  33 ++
 fixtures/flagship/app/components/format.ts    |  16 +
 .../app/confirmation/confirmation-client.tsx  | 107 +++++
 fixtures/flagship/app/confirmation/page.tsx   |  14 +
 .../flagship/app/destinations/[slug]/page.tsx |  54 +++
 fixtures/flagship/app/destinations/page.tsx   |  55 +++
 fixtures/flagship/app/globals.css             |  88 ++++
 fixtures/flagship/app/guide/page.mdx          |  27 ++
 fixtures/flagship/app/layout.tsx              |  25 +
 fixtures/flagship/app/llms.txt/route.ts       |  41 ++
 .../flagship/app/organization-json-ld.tsx     |  30 ++
 fixtures/flagship/app/page.tsx                |  99 ++++
 fixtures/flagship/app/results/page.tsx        |  14 +
 .../flagship/app/results/results-client.tsx   | 220 +++++++++
 fixtures/flagship/app/seats/page.tsx          |  15 +
 fixtures/flagship/app/seats/seats-client.tsx  | 196 ++++++++
 fixtures/flagship/app/sitemap.ts              |  18 +
 .../flagship/app/state/BookingContext.tsx     | 203 ++++++++
 fixtures/flagship/ax.config.ts                |  29 ++
 .../flagship/cards.golden/server-card.json    |  28 ++
 .../cards.golden/server-card/api-mcp.json     |  38 ++
 .../server-card/api-public-mcp.json           |  28 ++
 fixtures/flagship/lib/data/airports.ts        |  35 ++
 fixtures/flagship/lib/data/flights.ts         | 166 +++++++
 fixtures/flagship/lib/data/seatmaps.ts        | 128 +++++
 fixtures/flagship/lib/services/api-guard.ts   |  21 +
 fixtures/flagship/lib/services/booking.ts     |  89 ++++
 fixtures/flagship/lib/services/payment.ts     |  32 ++
 fixtures/flagship/lib/services/search.ts      |  16 +
 fixtures/flagship/lib/services/session.ts     |  31 ++
 .../mdx-components.tsx                        |   0
 fixtures/flagship/middleware.ts               |  81 ++++
 .../next-env.d.ts                             |   0
 .../{mdx-content => flagship}/next.config.mjs |   0
 .../{mdx-content => flagship}/package.json    |   7 +-
 fixtures/flagship/public/agents.md            |  27 ++
 fixtures/flagship/public/destinations.md      |  26 ++
 fixtures/flagship/public/openapi.json         | 344 ++++++++++++++
 fixtures/flagship/public/robots.txt           |  19 +
 fixtures/flagship/report.golden.json          | 388 +++++++++++++++
 fixtures/{llms-txt => flagship}/tsconfig.json |   5 +
 .../twins.golden/404.md                       |  14 +-
 fixtures/flagship/twins.golden/auth.md        |  19 +
 fixtures/flagship/twins.golden/checkout.md    |  13 +
 .../flagship/twins.golden/confirmation.md     |  13 +
 fixtures/flagship/twins.golden/guide.md       |  34 ++
 fixtures/flagship/twins.golden/index.md       |  92 ++++
 fixtures/flagship/twins.golden/results.md     |  13 +
 fixtures/flagship/twins.golden/seats.md       |  13 +
 fixtures/llms-txt/README.md                   |  15 -
 fixtures/llms-txt/app/llms.txt/route.ts       |  20 -
 fixtures/llms-txt/app/page.tsx                |  11 -
 fixtures/llms-txt/ax.config.ts                |  17 -
 fixtures/llms-txt/package.json                |  23 -
 fixtures/llms-txt/report.golden.json          | 183 --------
 fixtures/llms-txt/twins.golden/404.md         |  22 -
 fixtures/mcp-adapter-gated/README.md          |  18 -
 .../app/[transport]/route.ts                  |  28 --
 fixtures/mcp-adapter-gated/app/layout.tsx     |  14 -
 fixtures/mcp-adapter-gated/app/page.tsx       |  11 -
 fixtures/mcp-adapter-gated/ax.config.ts       |   9 -
 .../cards.golden/server-card.json             |  32 --
 fixtures/mcp-adapter-gated/next-env.d.ts      |   6 -
 fixtures/mcp-adapter-gated/next.config.mjs    |   4 -
 fixtures/mcp-adapter-gated/package.json       |  26 --
 fixtures/mcp-adapter-gated/report.golden.json | 239 ----------
 fixtures/mcp-adapter-gated/tsconfig.json      |   5 -
 .../mcp-adapter-gated/twins.golden/auth.md    |  19 -
 fixtures/mcp-adapter/README.md                |  18 -
 fixtures/mcp-adapter/app/[transport]/route.ts |  19 -
 fixtures/mcp-adapter/app/layout.tsx           |  14 -
 fixtures/mcp-adapter/app/page.tsx             |  11 -
 fixtures/mcp-adapter/ax.config.ts             |  17 -
 .../mcp-adapter/cards.golden/server-card.json |  28 --
 fixtures/mcp-adapter/next-env.d.ts            |   6 -
 fixtures/mcp-adapter/next.config.mjs          |   4 -
 fixtures/mcp-adapter/twins.golden/404.md      |  22 -
 fixtures/mcp-multi-server/README.md           |  21 -
 .../mcp-multi-server/app/api/mcp/route.ts     |  24 -
 .../app/api/public/mcp/route.ts               |  17 -
 fixtures/mcp-multi-server/app/layout.tsx      |  14 -
 fixtures/mcp-multi-server/app/page.tsx        |  12 -
 fixtures/mcp-multi-server/ax.config.ts        |   9 -
 .../cards.golden/server-card.json             |  28 --
 .../cards.golden/server-card/api-mcp.json     |  32 --
 .../server-card/api-public-mcp.json           |  28 --
 fixtures/mcp-multi-server/next-env.d.ts       |   6 -
 fixtures/mcp-multi-server/next.config.mjs     |   4 -
 fixtures/mcp-multi-server/package.json        |  26 --
 fixtures/mcp-multi-server/tsconfig.json       |   5 -
 .../mcp-multi-server/twins.golden/auth.md     |  19 -
 .../mcp-multi-server/twins.golden/index.md    |  11 -
 fixtures/mdx-content/README.md                |  15 -
 fixtures/mdx-content/app/guide/page.mdx       |  24 -
 fixtures/mdx-content/app/layout.tsx           |  14 -
 fixtures/mdx-content/app/page.tsx             |  13 -
 fixtures/mdx-content/app/widget.tsx           |  10 -
 fixtures/mdx-content/app/widgets/page.mdx     |   7 -
 fixtures/mdx-content/next-env.d.ts            |   6 -
 fixtures/mdx-content/report.golden.json       | 203 --------
 fixtures/mdx-content/tsconfig.json            |   5 -
 fixtures/mdx-content/twins.golden/404.md      |  21 -
 fixtures/mdx-content/twins.golden/guide.md    |  29 --
 fixtures/mdx-content/twins.golden/index.md    |  11 -
 fixtures/middleware/README.md                 |  34 --
 fixtures/middleware/app/blog/[slug]/page.tsx  |  13 -
 fixtures/middleware/app/docs/page.tsx         |  15 -
 fixtures/middleware/app/layout.tsx            |  20 -
 fixtures/middleware/app/page.tsx              |  18 -
 fixtures/middleware/app/private/page.tsx      |  20 -
 fixtures/middleware/app/shell/page.tsx        |  10 -
 fixtures/middleware/ax.config.ts              |  13 -
 fixtures/middleware/middleware.ts             |  12 -
 fixtures/middleware/next-env.d.ts             |   6 -
 fixtures/middleware/next.config.mjs           |   4 -
 fixtures/middleware/package.json              |  24 -
 fixtures/middleware/public/docs.md            |   9 -
 fixtures/middleware/report.golden.json        | 199 --------
 fixtures/middleware/tsconfig.json             |   5 -
 fixtures/middleware/twins.golden/404.md       |  23 -
 fixtures/middleware/twins.golden/index.md     |  13 -
 fixtures/next-auth/README.md                  |  11 +
 .../app/api/auth/[...nextauth]/route.ts       |  19 +
 .../{llms-txt => next-auth}/app/layout.tsx    |   4 +-
 fixtures/next-auth/app/page.tsx               |  11 +
 .../{mdx-content => next-auth}/ax.config.ts   |   2 +-
 .../{discovery => next-auth}/next-env.d.ts    |   0
 .../{discovery => next-auth}/next.config.mjs  |   0
 .../package.json                              |   3 +-
 .../report.golden.json                        |  32 +-
 .../tsconfig.json                             |   0
 .../twins.golden/404.md                       |   4 +-
 fixtures/openapi/README.md                    |  13 -
 fixtures/openapi/app/layout.tsx               |  14 -
 fixtures/openapi/app/page.tsx                 |  11 -
 fixtures/openapi/ax.config.ts                 |  17 -
 fixtures/openapi/next-env.d.ts                |   6 -
 fixtures/openapi/next.config.mjs              |   4 -
 fixtures/openapi/public/openapi.json          |  63 ---
 fixtures/openapi/report.golden.json           | 224 ---------
 fixtures/openapi/tsconfig.json                |   5 -
 fixtures/openapi/twins.golden/404.md          |  23 -
 fixtures/openapi/twins.golden/auth.md         |  21 -
 fixtures/pages-bare/README.md                 |   6 -
 fixtures/pages-bare/ax.config.ts              |  11 -
 fixtures/pages-bare/next.config.mjs           |   4 -
 fixtures/pages-bare/package.json              |  23 -
 fixtures/pages-bare/pages/404.tsx             |   5 -
 fixtures/pages-bare/pages/about.tsx           |   8 -
 fixtures/pages-bare/pages/blog/[slug].tsx     |   5 -
 fixtures/pages-bare/pages/index.tsx           |   8 -
 fixtures/pages-bare/report.golden.json        | 187 --------
 fixtures/pages-bare/tsconfig.json             |   5 -
 fixtures/pages-bare/twins.golden/404.md       |  22 -
 fixtures/pages-mcp/README.md                  |   5 -
 fixtures/pages-mcp/ax.config.ts               |  11 -
 .../pages-mcp/cards.golden/server-card.json   |  28 --
 fixtures/pages-mcp/next-env.d.ts              |   6 -
 fixtures/pages-mcp/next.config.mjs            |   4 -
 fixtures/pages-mcp/package.json               |  26 --
 fixtures/pages-mcp/pages/api/[transport].ts   |  30 --
 fixtures/pages-mcp/pages/index.tsx            |   8 -
 fixtures/pages-mcp/report.golden.json         | 205 --------
 fixtures/pages-mcp/tsconfig.json              |   5 -
 fixtures/pages-mcp/twins.golden/404.md        |  22 -
 fixtures/pages-webmcp-declarative/README.md   |   5 -
 .../pages-webmcp-declarative/ax.config.ts     |  11 -
 .../pages-webmcp-declarative/next-env.d.ts    |   6 -
 .../pages-webmcp-declarative/next.config.mjs  |   4 -
 .../pages-webmcp-declarative/package.json     |  23 -
 .../pages-webmcp-declarative/pages/index.tsx  |  21 -
 .../report.golden.json                        | 183 --------
 .../pages-webmcp-declarative/tsconfig.json    |   5 -
 .../twins.golden/404.md                       |  21 -
 fixtures/webmcp-declarative/README.md         |   7 -
 fixtures/webmcp-declarative/app/layout.tsx    |  14 -
 fixtures/webmcp-declarative/app/page.tsx      |  21 -
 fixtures/webmcp-declarative/next-env.d.ts     |   6 -
 fixtures/webmcp-declarative/next.config.mjs   |   4 -
 fixtures/webmcp-declarative/package.json      |  23 -
 fixtures/webmcp-declarative/tsconfig.json     |   5 -
 fixtures/webmcp-imperative/README.md          |   7 -
 fixtures/webmcp-imperative/app/layout.tsx     |  14 -
 fixtures/webmcp-imperative/app/page.tsx       |  11 -
 fixtures/webmcp-imperative/next-env.d.ts      |   6 -
 fixtures/webmcp-imperative/next.config.mjs    |   4 -
 fixtures/webmcp-imperative/package.json       |  21 -
 fixtures/webmcp-imperative/tsconfig.json      |   5 -
 fixtures/webmcp/README.md                     |  18 +
 fixtures/webmcp/app/layout.tsx                |  18 +
 fixtures/webmcp/app/page.tsx                  |  29 ++
 .../app/register-tools.tsx                    |   0
 .../ax.config.ts                              |   2 +-
 fixtures/{llms-txt => webmcp}/next-env.d.ts   |   0
 fixtures/{llms-txt => webmcp}/next.config.mjs |   0
 fixtures/{openapi => webmcp}/package.json     |   2 +-
 .../report.golden.json                        |  51 +-
 fixtures/{discovery => webmcp}/tsconfig.json  |   0
 .../twins.golden/404.md                       |   4 +-
 .../types/webmcp-forms.d.ts                   |   0
 .../types/webmcp.d.ts                         |   0
 package.json                                  |   1 +
 packages/ax/src/app-dir.ts                    |  42 +-
 packages/ax/src/cli.ts                        |   7 +-
 packages/ax/src/generate.ts                   |  14 +-
 packages/ax/src/manifest.ts                   |   8 +-
 packages/ax/src/markdown-twins.ts             |  13 +-
 packages/ax/src/pages-dir.ts                  |  46 +-
 packages/ax/src/prompt.ts                     |  30 +-
 packages/ax/src/router-model.ts               |  33 +-
 packages/ax/test/detect-webmcp.test.ts        |  21 +-
 packages/ax/test/fixtures-integration.test.ts | 345 +++++++-------
 packages/ax/test/markdown-twins.test.ts       |  13 +
 packages/ax/test/router-model.test.ts         |  24 +
 pnpm-lock.yaml                                | 442 +++++-------------
 scripts/dogfood-middleware.mjs                |  70 +--
 scripts/mutation-tests.mjs                    | 404 ++++++++++++++++
 spec/ard/README.md                            |   2 +-
 293 files changed, 6541 insertions(+), 4696 deletions(-)
 delete mode 100644 fixtures/config-overrides/README.md
 delete mode 100644 fixtures/config-overrides/app/layout.tsx
 delete mode 100644 fixtures/config-overrides/app/page.tsx
 delete mode 100644 fixtures/config-overrides/ax.config.ts
 delete mode 100644 fixtures/config-overrides/report.golden.json
 delete mode 100644 fixtures/discovery/README.md
 delete mode 100644 fixtures/discovery/app/layout.tsx
 delete mode 100644 fixtures/discovery/app/page.tsx
 delete mode 100644 fixtures/discovery/app/sitemap.ts
 delete mode 100644 fixtures/discovery/ax.config.ts
 delete mode 100644 fixtures/discovery/package.json
 delete mode 100644 fixtures/discovery/public/agents.md
 delete mode 100644 fixtures/discovery/public/robots.txt
 delete mode 100644 fixtures/discovery/report.golden.json
 delete mode 100644 fixtures/discovery/twins.golden/404.md
 delete mode 100644 fixtures/discovery/twins.golden/index.md
 create mode 100644 fixtures/flagship-pages/README.md
 create mode 100644 fixtures/flagship-pages/ax.config.ts
 create mode 100644 fixtures/flagship-pages/cards.golden/server-card.json
 create mode 100644 fixtures/flagship-pages/cards.golden/server-card/api-mcp.json
 create mode 100644 fixtures/flagship-pages/cards.golden/server-card/api-public-mcp.json
 create mode 100644 fixtures/flagship-pages/lib/data/airports.ts
 create mode 100644 fixtures/flagship-pages/lib/data/flights.ts
 create mode 100644 fixtures/flagship-pages/lib/data/seatmaps.ts
 create mode 100644 fixtures/flagship-pages/lib/services/booking.ts
 create mode 100644 fixtures/flagship-pages/lib/services/payment.ts
 create mode 100644 fixtures/flagship-pages/lib/services/search.ts
 create mode 100644 fixtures/flagship-pages/middleware.ts
 rename fixtures/{pages-bare => flagship-pages}/next-env.d.ts (100%)
 rename fixtures/{config-overrides => flagship-pages}/next.config.mjs (100%)
 rename fixtures/{mcp-adapter => flagship-pages}/package.json (88%)
 create mode 100644 fixtures/flagship-pages/pages/404.tsx
 rename fixtures/{pages-bare => flagship-pages}/pages/_app.tsx (100%)
 rename fixtures/{pages-bare => flagship-pages}/pages/_document.tsx (72%)
 create mode 100644 fixtures/flagship-pages/pages/account.tsx
 create mode 100644 fixtures/flagship-pages/pages/api/[transport].ts
 create mode 100644 fixtures/flagship-pages/pages/api/public/[transport].ts
 create mode 100644 fixtures/flagship-pages/pages/checkout.tsx
 create mode 100644 fixtures/flagship-pages/pages/confirmation.tsx
 create mode 100644 fixtures/flagship-pages/pages/destinations/[slug].tsx
 create mode 100644 fixtures/flagship-pages/pages/destinations/index.tsx
 create mode 100644 fixtures/flagship-pages/pages/index.tsx
 create mode 100644 fixtures/flagship-pages/pages/results.tsx
 create mode 100644 fixtures/flagship-pages/pages/seats.tsx
 rename fixtures/{mcp-multi-server => flagship-pages}/report.golden.json (59%)
 rename fixtures/{mcp-adapter => flagship-pages}/tsconfig.json (68%)
 rename fixtures/{mcp-multi-server => flagship-pages}/twins.golden/404.md (73%)
 create mode 100644 fixtures/flagship-pages/twins.golden/auth.md
 create mode 100644 fixtures/flagship-pages/twins.golden/destinations.md
 create mode 100644 fixtures/flagship-pages/twins.golden/index.md
 rename fixtures/{pages-webmcp-declarative => flagship-pages}/types/webmcp-forms.d.ts (100%)
 create mode 100644 fixtures/flagship/README.md
 create mode 100644 fixtures/flagship/app/.well-known/oauth-authorization-server/route.ts
 create mode 100644 fixtures/flagship/app/.well-known/oauth-protected-resource/route.ts
 create mode 100644 fixtures/flagship/app/account/page.tsx
 create mode 100644 fixtures/flagship/app/api/[transport]/route.ts
 create mode 100644 fixtures/flagship/app/api/book/route.ts
 create mode 100644 fixtures/flagship/app/api/pay/route.ts
 create mode 100644 fixtures/flagship/app/api/public/[transport]/route.ts
 create mode 100644 fixtures/flagship/app/api/search/route.ts
 create mode 100644 fixtures/flagship/app/api/seats/route.ts
 create mode 100644 fixtures/flagship/app/api/session/route.ts
 create mode 100644 fixtures/flagship/app/checkout/checkout-client.tsx
 create mode 100644 fixtures/flagship/app/checkout/page.tsx
 create mode 100644 fixtures/flagship/app/components/AirportSelect.tsx
 create mode 100644 fixtures/flagship/app/components/DateSelect.tsx
 create mode 100644 fixtures/flagship/app/components/FareHoldBanner.tsx
 create mode 100644 fixtures/flagship/app/components/Footer.tsx
 create mode 100644 fixtures/flagship/app/components/Header.tsx
 create mode 100644 fixtures/flagship/app/components/PaxSelect.tsx
 create mode 100644 fixtures/flagship/app/components/SearchWidget.tsx
 create mode 100644 fixtures/flagship/app/components/SliderCaptcha.tsx
 create mode 100644 fixtures/flagship/app/components/StepBar.tsx
 create mode 100644 fixtures/flagship/app/components/format.ts
 create mode 100644 fixtures/flagship/app/confirmation/confirmation-client.tsx
 create mode 100644 fixtures/flagship/app/confirmation/page.tsx
 create mode 100644 fixtures/flagship/app/destinations/[slug]/page.tsx
 create mode 100644 fixtures/flagship/app/destinations/page.tsx
 create mode 100644 fixtures/flagship/app/globals.css
 create mode 100644 fixtures/flagship/app/guide/page.mdx
 create mode 100644 fixtures/flagship/app/layout.tsx
 create mode 100644 fixtures/flagship/app/llms.txt/route.ts
 create mode 100644 fixtures/flagship/app/organization-json-ld.tsx
 create mode 100644 fixtures/flagship/app/page.tsx
 create mode 100644 fixtures/flagship/app/results/page.tsx
 create mode 100644 fixtures/flagship/app/results/results-client.tsx
 create mode 100644 fixtures/flagship/app/seats/page.tsx
 create mode 100644 fixtures/flagship/app/seats/seats-client.tsx
 create mode 100644 fixtures/flagship/app/sitemap.ts
 create mode 100644 fixtures/flagship/app/state/BookingContext.tsx
 create mode 100644 fixtures/flagship/ax.config.ts
 create mode 100644 fixtures/flagship/cards.golden/server-card.json
 create mode 100644 fixtures/flagship/cards.golden/server-card/api-mcp.json
 create mode 100644 fixtures/flagship/cards.golden/server-card/api-public-mcp.json
 create mode 100644 fixtures/flagship/lib/data/airports.ts
 create mode 100644 fixtures/flagship/lib/data/flights.ts
 create mode 100644 fixtures/flagship/lib/data/seatmaps.ts
 create mode 100644 fixtures/flagship/lib/services/api-guard.ts
 create mode 100644 fixtures/flagship/lib/services/booking.ts
 create mode 100644 fixtures/flagship/lib/services/payment.ts
 create mode 100644 fixtures/flagship/lib/services/search.ts
 create mode 100644 fixtures/flagship/lib/services/session.ts
 rename fixtures/{mdx-content => flagship}/mdx-components.tsx (100%)
 create mode 100644 fixtures/flagship/middleware.ts
 rename fixtures/{config-overrides => flagship}/next-env.d.ts (100%)
 rename fixtures/{mdx-content => flagship}/next.config.mjs (100%)
 rename fixtures/{mdx-content => flagship}/package.json (79%)
 create mode 100644 fixtures/flagship/public/agents.md
 create mode 100644 fixtures/flagship/public/destinations.md
 create mode 100644 fixtures/flagship/public/openapi.json
 create mode 100644 fixtures/flagship/public/robots.txt
 create mode 100644 fixtures/flagship/report.golden.json
 rename fixtures/{llms-txt => flagship}/tsconfig.json (68%)
 rename fixtures/{mcp-adapter-gated => flagship}/twins.golden/404.md (51%)
 create mode 100644 fixtures/flagship/twins.golden/auth.md
 create mode 100644 fixtures/flagship/twins.golden/checkout.md
 create mode 100644 fixtures/flagship/twins.golden/confirmation.md
 create mode 100644 fixtures/flagship/twins.golden/guide.md
 create mode 100644 fixtures/flagship/twins.golden/index.md
 create mode 100644 fixtures/flagship/twins.golden/results.md
 create mode 100644 fixtures/flagship/twins.golden/seats.md
 delete mode 100644 fixtures/llms-txt/README.md
 delete mode 100644 fixtures/llms-txt/app/llms.txt/route.ts
 delete mode 100644 fixtures/llms-txt/app/page.tsx
 delete mode 100644 fixtures/llms-txt/ax.config.ts
 delete mode 100644 fixtures/llms-txt/package.json
 delete mode 100644 fixtures/llms-txt/report.golden.json
 delete mode 100644 fixtures/llms-txt/twins.golden/404.md
 delete mode 100644 fixtures/mcp-adapter-gated/README.md
 delete mode 100644 fixtures/mcp-adapter-gated/app/[transport]/route.ts
 delete mode 100644 fixtures/mcp-adapter-gated/app/layout.tsx
 delete mode 100644 fixtures/mcp-adapter-gated/app/page.tsx
 delete mode 100644 fixtures/mcp-adapter-gated/ax.config.ts
 delete mode 100644 fixtures/mcp-adapter-gated/cards.golden/server-card.json
 delete mode 100644 fixtures/mcp-adapter-gated/next-env.d.ts
 delete mode 100644 fixtures/mcp-adapter-gated/next.config.mjs
 delete mode 100644 fixtures/mcp-adapter-gated/package.json
 delete mode 100644 fixtures/mcp-adapter-gated/report.golden.json
 delete mode 100644 fixtures/mcp-adapter-gated/tsconfig.json
 delete mode 100644 fixtures/mcp-adapter-gated/twins.golden/auth.md
 delete mode 100644 fixtures/mcp-adapter/README.md
 delete mode 100644 fixtures/mcp-adapter/app/[transport]/route.ts
 delete mode 100644 fixtures/mcp-adapter/app/layout.tsx
 delete mode 100644 fixtures/mcp-adapter/app/page.tsx
 delete mode 100644 fixtures/mcp-adapter/ax.config.ts
 delete mode 100644 fixtures/mcp-adapter/cards.golden/server-card.json
 delete mode 100644 fixtures/mcp-adapter/next-env.d.ts
 delete mode 100644 fixtures/mcp-adapter/next.config.mjs
 delete mode 100644 fixtures/mcp-adapter/twins.golden/404.md
 delete mode 100644 fixtures/mcp-multi-server/README.md
 delete mode 100644 fixtures/mcp-multi-server/app/api/mcp/route.ts
 delete mode 100644 fixtures/mcp-multi-server/app/api/public/mcp/route.ts
 delete mode 100644 fixtures/mcp-multi-server/app/layout.tsx
 delete mode 100644 fixtures/mcp-multi-server/app/page.tsx
 delete mode 100644 fixtures/mcp-multi-server/ax.config.ts
 delete mode 100644 fixtures/mcp-multi-server/cards.golden/server-card.json
 delete mode 100644 fixtures/mcp-multi-server/cards.golden/server-card/api-mcp.json
 delete mode 100644 fixtures/mcp-multi-server/cards.golden/server-card/api-public-mcp.json
 delete mode 100644 fixtures/mcp-multi-server/next-env.d.ts
 delete mode 100644 fixtures/mcp-multi-server/next.config.mjs
 delete mode 100644 fixtures/mcp-multi-server/package.json
 delete mode 100644 fixtures/mcp-multi-server/tsconfig.json
 delete mode 100644 fixtures/mcp-multi-server/twins.golden/auth.md
 delete mode 100644 fixtures/mcp-multi-server/twins.golden/index.md
 delete mode 100644 fixtures/mdx-content/README.md
 delete mode 100644 fixtures/mdx-content/app/guide/page.mdx
 delete mode 100644 fixtures/mdx-content/app/layout.tsx
 delete mode 100644 fixtures/mdx-content/app/page.tsx
 delete mode 100644 fixtures/mdx-content/app/widget.tsx
 delete mode 100644 fixtures/mdx-content/app/widgets/page.mdx
 delete mode 100644 fixtures/mdx-content/next-env.d.ts
 delete mode 100644 fixtures/mdx-content/report.golden.json
 delete mode 100644 fixtures/mdx-content/tsconfig.json
 delete mode 100644 fixtures/mdx-content/twins.golden/404.md
 delete mode 100644 fixtures/mdx-content/twins.golden/guide.md
 delete mode 100644 fixtures/mdx-content/twins.golden/index.md
 delete mode 100644 fixtures/middleware/README.md
 delete mode 100644 fixtures/middleware/app/blog/[slug]/page.tsx
 delete mode 100644 fixtures/middleware/app/docs/page.tsx
 delete mode 100644 fixtures/middleware/app/layout.tsx
 delete mode 100644 fixtures/middleware/app/page.tsx
 delete mode 100644 fixtures/middleware/app/private/page.tsx
 delete mode 100644 fixtures/middleware/app/shell/page.tsx
 delete mode 100644 fixtures/middleware/ax.config.ts
 delete mode 100644 fixtures/middleware/middleware.ts
 delete mode 100644 fixtures/middleware/next-env.d.ts
 delete mode 100644 fixtures/middleware/next.config.mjs
 delete mode 100644 fixtures/middleware/package.json
 delete mode 100644 fixtures/middleware/public/docs.md
 delete mode 100644 fixtures/middleware/report.golden.json
 delete mode 100644 fixtures/middleware/tsconfig.json
 delete mode 100644 fixtures/middleware/twins.golden/404.md
 delete mode 100644 fixtures/middleware/twins.golden/index.md
 create mode 100644 fixtures/next-auth/README.md
 create mode 100644 fixtures/next-auth/app/api/auth/[...nextauth]/route.ts
 rename fixtures/{llms-txt => next-auth}/app/layout.tsx (66%)
 create mode 100644 fixtures/next-auth/app/page.tsx
 rename fixtures/{mdx-content => next-auth}/ax.config.ts (77%)
 rename fixtures/{discovery => next-auth}/next-env.d.ts (100%)
 rename fixtures/{discovery => next-auth}/next.config.mjs (100%)
 rename fixtures/{config-overrides => next-auth}/package.json (87%)
 rename fixtures/{webmcp-declarative => next-auth}/report.golden.json (94%)
 rename fixtures/{config-overrides => next-auth}/tsconfig.json (100%)
 rename fixtures/{webmcp-declarative => next-auth}/twins.golden/404.md (83%)
 delete mode 100644 fixtures/openapi/README.md
 delete mode 100644 fixtures/openapi/app/layout.tsx
 delete mode 100644 fixtures/openapi/app/page.tsx
 delete mode 100644 fixtures/openapi/ax.config.ts
 delete mode 100644 fixtures/openapi/next-env.d.ts
 delete mode 100644 fixtures/openapi/next.config.mjs
 delete mode 100644 fixtures/openapi/public/openapi.json
 delete mode 100644 fixtures/openapi/report.golden.json
 delete mode 100644 fixtures/openapi/tsconfig.json
 delete mode 100644 fixtures/openapi/twins.golden/404.md
 delete mode 100644 fixtures/openapi/twins.golden/auth.md
 delete mode 100644 fixtures/pages-bare/README.md
 delete mode 100644 fixtures/pages-bare/ax.config.ts
 delete mode 100644 fixtures/pages-bare/next.config.mjs
 delete mode 100644 fixtures/pages-bare/package.json
 delete mode 100644 fixtures/pages-bare/pages/404.tsx
 delete mode 100644 fixtures/pages-bare/pages/about.tsx
 delete mode 100644 fixtures/pages-bare/pages/blog/[slug].tsx
 delete mode 100644 fixtures/pages-bare/pages/index.tsx
 delete mode 100644 fixtures/pages-bare/report.golden.json
 delete mode 100644 fixtures/pages-bare/tsconfig.json
 delete mode 100644 fixtures/pages-bare/twins.golden/404.md
 delete mode 100644 fixtures/pages-mcp/README.md
 delete mode 100644 fixtures/pages-mcp/ax.config.ts
 delete mode 100644 fixtures/pages-mcp/cards.golden/server-card.json
 delete mode 100644 fixtures/pages-mcp/next-env.d.ts
 delete mode 100644 fixtures/pages-mcp/next.config.mjs
 delete mode 100644 fixtures/pages-mcp/package.json
 delete mode 100644 fixtures/pages-mcp/pages/api/[transport].ts
 delete mode 100644 fixtures/pages-mcp/pages/index.tsx
 delete mode 100644 fixtures/pages-mcp/report.golden.json
 delete mode 100644 fixtures/pages-mcp/tsconfig.json
 delete mode 100644 fixtures/pages-mcp/twins.golden/404.md
 delete mode 100644 fixtures/pages-webmcp-declarative/README.md
 delete mode 100644 fixtures/pages-webmcp-declarative/ax.config.ts
 delete mode 100644 fixtures/pages-webmcp-declarative/next-env.d.ts
 delete mode 100644 fixtures/pages-webmcp-declarative/next.config.mjs
 delete mode 100644 fixtures/pages-webmcp-declarative/package.json
 delete mode 100644 fixtures/pages-webmcp-declarative/pages/index.tsx
 delete mode 100644 fixtures/pages-webmcp-declarative/report.golden.json
 delete mode 100644 fixtures/pages-webmcp-declarative/tsconfig.json
 delete mode 100644 fixtures/pages-webmcp-declarative/twins.golden/404.md
 delete mode 100644 fixtures/webmcp-declarative/README.md
 delete mode 100644 fixtures/webmcp-declarative/app/layout.tsx
 delete mode 100644 fixtures/webmcp-declarative/app/page.tsx
 delete mode 100644 fixtures/webmcp-declarative/next-env.d.ts
 delete mode 100644 fixtures/webmcp-declarative/next.config.mjs
 delete mode 100644 fixtures/webmcp-declarative/package.json
 delete mode 100644 fixtures/webmcp-declarative/tsconfig.json
 delete mode 100644 fixtures/webmcp-imperative/README.md
 delete mode 100644 fixtures/webmcp-imperative/app/layout.tsx
 delete mode 100644 fixtures/webmcp-imperative/app/page.tsx
 delete mode 100644 fixtures/webmcp-imperative/next-env.d.ts
 delete mode 100644 fixtures/webmcp-imperative/next.config.mjs
 delete mode 100644 fixtures/webmcp-imperative/package.json
 delete mode 100644 fixtures/webmcp-imperative/tsconfig.json
 create mode 100644 fixtures/webmcp/README.md
 create mode 100644 fixtures/webmcp/app/layout.tsx
 create mode 100644 fixtures/webmcp/app/page.tsx
 rename fixtures/{webmcp-imperative => webmcp}/app/register-tools.tsx (100%)
 rename fixtures/{webmcp-declarative => webmcp}/ax.config.ts (84%)
 rename fixtures/{llms-txt => webmcp}/next-env.d.ts (100%)
 rename fixtures/{llms-txt => webmcp}/next.config.mjs (100%)
 rename fixtures/{openapi => webmcp}/package.json (93%)
 rename fixtures/{mcp-adapter => webmcp}/report.golden.json (91%)
 rename fixtures/{discovery => webmcp}/tsconfig.json (100%)
 rename fixtures/{config-overrides => webmcp}/twins.golden/404.md (86%)
 rename fixtures/{webmcp-declarative => webmcp}/types/webmcp-forms.d.ts (100%)
 rename fixtures/{webmcp-imperative => webmcp}/types/webmcp.d.ts (100%)
 create mode 100644 scripts/mutation-tests.mjs

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4768af1..9eb0cd0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -77,12 +77,19 @@ jobs:
       - name: Verify report snapshots
         run: pnpm reports:verify
 
-      # Dogfood the negotiation middleware over HTTP: `next start` on the built middleware fixture,
+      # Dogfood the negotiation middleware over HTTP: `next start` on the built flagship fixture,
       # then the dual-fetch probes (Ora's markdown-negotiation-vary semantics), the cloaking
       # guards, and the gated/dynamic/unknown-path branches — the Edge bundle serving for real.
       - name: Middleware dual-fetch dogfood
         run: pnpm dogfood:middleware
 
+      # Multi-build mutation tests over the flagship fixture: idempotence, user-edit preservation,
+      # orphaned-twin cleanup, additive change, and manifest drift — each is a copy → build →
+      # mutate → rebuild sequence with targeted delta assertions (the build-N+1 bugs the one-shot
+      # golden layer can't see).
+      - name: Flagship mutation tests
+        run: pnpm mutation:test
+
       # Official ARD conformance tool (vendored from ards-project/ard-spec — spec/ard/README.md)
       # over every catalog the fixture builds just generated. jsonschema enables the tool's strict
       # JSON Schema layer on top of its semantic checks.
diff --git a/.gitignore b/.gitignore
index cbad2d2..29aa527 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,16 +26,11 @@ fixtures/**/public/.well-known/mcp/server-card/
 # Markdown twins + the auth guide ax's postbuild step generates in fixtures — build output. The
 # tracked artifacts are the normalized snapshots under fixtures/*/twins.golden/. Scoped to the
 # exact generated paths so hand-authored fixture markdown (markdown-twins/public/hand.md,
-# discovery/public/agents.md) stays committed; a newly generated file that isn't listed here shows
-# up as untracked, which is the prompt to snapshot and list it.
+# flagship/public/destinations.md) stays committed; a newly generated file that isn't listed here
+# shows up as untracked, which is the prompt to snapshot and list it.
 fixtures/markdown-twins/public/index.md
 fixtures/markdown-twins/public/guides/
 fixtures/markdown-twins/public/live.md
-fixtures/mdx-content/public/index.md
-fixtures/mdx-content/public/guide.md
-fixtures/mcp-multi-server/public/index.md
-fixtures/discovery/public/index.md
-fixtures/middleware/public/index.md
 fixtures/*/public/auth.md
 fixtures/*/public/404.md
 
@@ -52,3 +47,18 @@ fixtures/**/.ora/
 
 # npm pack build artifact (not committed in this repo; the demo repo commits its own copy)
 *.tgz
+
+# Flagship fixture generated twins (its hand-authored twin, public/destinations.md, stays
+# committed; generated per-slug twins under public/destinations/ are covered by the dir entry).
+fixtures/flagship/public/index.md
+fixtures/flagship/public/results.md
+fixtures/flagship/public/checkout.md
+fixtures/flagship/public/seats.md
+fixtures/flagship/public/confirmation.md
+fixtures/flagship/public/guide.md
+fixtures/flagship/public/account.md
+fixtures/flagship/public/destinations/
+
+# flagship-pages fixture generated twins — build output.
+fixtures/flagship-pages/public/index.md
+fixtures/flagship-pages/public/destinations.md
diff --git a/README.md b/README.md
index 4dfb250..bdfc122 100644
--- a/README.md
+++ b/README.md
@@ -181,5 +181,5 @@ actionable message.
 ```
 packages/ax            the plugin / CLI (`@ora-ai/ax`) — the npm package (3 runtime deps: ajv, ajv-formats, jiti)
 spec/                  vendored AI Catalog spec + hand-written JSON Schema + validator oracle
-fixtures/*             minimal-but-real Next.js apps — the test suite, docs examples, and eval corpus
+fixtures/*             real Next.js apps — the flagship (a full demo-app fork) + single-axis fixtures; the test suite, docs examples, and eval corpus
 ```
diff --git a/fixtures/config-overrides/README.md b/fixtures/config-overrides/README.md
deleted file mode 100644
index 7475f3f..0000000
--- a/fixtures/config-overrides/README.md
+++ /dev/null
@@ -1,21 +0,0 @@
-# fixture: config-overrides
-
-A Next.js app that declares catalog config in `ax.config.ts` — the config surface.
-
-**Exercises:**
-
-- **Config loading** — a TypeScript `ax.config.ts` (typed with `AxConfig` imported from the
-  plugin) is discovered and loaded by the postbuild CLI via `jiti`.
-- **Config-declared entries** — `docs` (`text/html`) and `skills` (`application/ai-skill+md`)
-  pointers are emitted into the catalog. (Until zero-config detection applies, these are the only
-  source of entries; the same `identifier`-matching merge layers config over _inferred_ entries.)
-- **`isGated` safety net + re-inclusion** — the config also declares two `/api/auth/**` entries,
-  which the built-in gating floor covers. The config's `isGated` composes `defaultIsGated` with a
-  re-inclusion: `urn:example:auth-status` is un-gated (the matcher returns `false` for it) and
-  survives; `urn:example:auth-internal` stays gated, and since a plain `text/html` pointer has no
-  derivable auth descriptor, ax drops it from the emitted catalog even though it's declared.
-  Demonstrates "precision over recall" and the `isGated` replacement for the old denylist/allowlist.
-
-So the emitted catalog contains exactly three entries: `urn:example:docs`, `urn:example:skills`,
-and `urn:example:auth-status` — asserted in
-`packages/ax/test/fixtures-integration.test.ts`.
diff --git a/fixtures/config-overrides/app/layout.tsx b/fixtures/config-overrides/app/layout.tsx
deleted file mode 100644
index 512749e..0000000
--- a/fixtures/config-overrides/app/layout.tsx
+++ /dev/null
@@ -1,14 +0,0 @@
-import type { ReactNode } from 'react';
-
-export const metadata = {
-  title: 'Config Overrides Fixture',
-  description: 'A Next.js app that declares catalog entries and an isGated policy via ax.config.',
-};
-
-export default function RootLayout({ children }: { children: ReactNode }) {
-  return (
-    <html lang="en">
-      <body>{children}</body>
-    </html>
-  );
-}
diff --git a/fixtures/config-overrides/app/page.tsx b/fixtures/config-overrides/app/page.tsx
deleted file mode 100644
index e866382..0000000
--- a/fixtures/config-overrides/app/page.tsx
+++ /dev/null
@@ -1,11 +0,0 @@
-export default function Home() {
-  return (
-    <main>
-      <h1>Config overrides fixture</h1>
-      <p>
-        Exercises <code>ax.config.ts</code>: config-declared entries plus <code>isGated</code>
-        filtering.
-      </p>
-    </main>
-  );
-}
diff --git a/fixtures/config-overrides/ax.config.ts b/fixtures/config-overrides/ax.config.ts
deleted file mode 100644
index 9345e63..0000000
--- a/fixtures/config-overrides/ax.config.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-import type { AxConfig } from '@ora-ai/ax';
-
-// This is the fixture that documents-and-tests the config surface. Until zero-config artifact
-// detection lands there are no *inferred* entries to override, so here every entry is
-// config-declared; the same `identifier`-matching merge layers these over inferred entries.
-const config: AxConfig = {
-  // `isGated` supersedes the old denylist/allowlist pair. Supplying it replaces the built-in floor
-  // wholesale, so this restates the floor (the built-in `defaultIsGated` gates `/api/auth/**` and
-  // `/api/webhooks/**`) and then re-includes this app's one public auth endpoint by returning
-  // false for it — the job the old allowlist did. A gated entry ax can't describe (a plain
-  // text/html pointer has no derivable auth descriptor) is dropped rather than published.
-  //
-  // The floor is inlined here rather than composed from the exported `defaultIsGated`: this file is
-  // evaluated for real (via jiti) by the test suite, which runs against src without building the
-  // package's dist, so importing a *runtime* value from `@ora-ai/ax` would fail to resolve. The
-  // README shows the `defaultIsGated`-composition form for consumers of the published package.
-  isGated: ({ path }) =>
-    (path.startsWith('/api/auth/') || path.startsWith('/api/webhooks/')) &&
-    path !== '/api/auth/status',
-  entries: [
-    // Ordinary docs/skills pointers — absolute URLs, so they're spec-valid on their own (the
-    // catalog schema requires `url` to be an absolute URI). Identifiers follow the ARD URN format
-    // (`urn:air:<publisher-domain>:<name>`, spec §4.2.1) the emission gate enforces, and every
-    // entry carries the `displayName` the ARD schema requires.
-    {
-      identifier: 'urn:air:example.com:docs',
-      type: 'text/html',
-      displayName: 'API documentation',
-      url: 'https://example.com/docs',
-    },
-    {
-      identifier: 'urn:air:example.com:skills',
-      type: 'application/ai-skill+md',
-      displayName: 'Agent skills',
-      url: 'https://github.com/example/agent-skills',
-    },
-    // Gated by the default floor but re-included by the `isGated` matcher above, so it survives
-    // into the catalog.
-    {
-      identifier: 'urn:air:example.com:auth-status',
-      type: 'text/html',
-      displayName: 'Auth status endpoint',
-      url: 'https://example.com/api/auth/status',
-    },
-    // Gated by the default floor and NOT re-included — ax can't describe its auth, so the safety
-    // net drops it from the catalog even though it's declared here. Demonstrates "precision over
-    // recall".
-    {
-      identifier: 'urn:air:example.com:auth-internal',
-      type: 'text/html',
-      displayName: 'Internal auth endpoint',
-      url: 'https://example.com/api/auth/internal',
-    },
-  ],
-};
-
-export default config;
diff --git a/fixtures/config-overrides/report.golden.json b/fixtures/config-overrides/report.golden.json
deleted file mode 100644
index 9ac8c8e..0000000
--- a/fixtures/config-overrides/report.golden.json
+++ /dev/null
@@ -1,196 +0,0 @@
-{
-  "generatedAt": "<generatedAt>",
-  "basePath": "",
-  "routers": [
-    "app"
-  ],
-  "catalog": {
-    "entryCount": 3,
-    "entries": [
-      {
-        "identifier": "urn:air:example.com:docs",
-        "type": "text/html",
-        "url": "https://example.com/docs",
-        "displayName": "API documentation"
-      },
-      {
-        "identifier": "urn:air:example.com:skills",
-        "type": "application/ai-skill+md",
-        "url": "https://github.com/example/agent-skills",
-        "displayName": "Agent skills"
-      },
-      {
-        "identifier": "urn:air:example.com:auth-status",
-        "type": "text/html",
-        "url": "https://example.com/api/auth/status",
-        "displayName": "Auth status endpoint"
-      }
-    ],
-    "path": "public/.well-known/ai-catalog.json",
-    "target": "static"
-  },
-  "mcp": {
-    "mounts": [],
-    "unreviewedMounts": []
-  },
-  "agent404": {
-    "notFoundPresent": false,
-    "agentAware": false,
-    "pages": [],
-    "markdownGuide": "public/404.md"
-  },
-  "middleware": {
-    "present": false,
-    "wiredToAx": false
-  },
-  "artifacts": {
-    "robotsTxt": {
-      "found": false
-    },
-    "sitemap": {
-      "found": false
-    },
-    "agentsMd": {
-      "found": false
-    },
-    "jsonLd": {
-      "found": false
-    },
-    "llmsTxt": {
-      "found": false
-    },
-    "openapi": {
-      "found": false
-    }
-  },
-  "auth": {
-    "gatedSurfaces": []
-  },
-  "scaffolds": {},
-  "markdownTwins": {
-    "enabled": true,
-    "written": [],
-    "userOwned": [],
-    "skipped": [
-      {
-        "route": "/",
-        "reason": "too-little-text",
-        "detail": "The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker)."
-      }
-    ],
-    "dynamicRouteCount": 0,
-    "deleted": []
-  },
-  "sizes": [
-    {
-      "artifact": "ai-catalog.json",
-      "path": "public/.well-known/ai-catalog.json",
-      "bytes": 658,
-      "chars": 658,
-      "tokens": 165
-    },
-    {
-      "artifact": "404.md",
-      "path": "public/404.md",
-      "bytes": 655,
-      "chars": 649,
-      "tokens": 162
-    }
-  ],
-  "ora": {
-    "checks": [
-      {
-        "id": "ard-catalog",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "agent-discovery-file",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "llms-txt-exists",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "llms-txt-formatting",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "markdown-url-fallback",
-        "artifact": "markdown-twins",
-        "status": "actionable",
-        "note": "No markdown twin could be derived for the homepage (too-little-text): The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker). The report’s markdownTwins.skipped section lists every twin-less route with its reason."
-      },
-      {
-        "id": "markdown-frontmatter",
-        "artifact": "markdown-twins",
-        "status": "actionable",
-        "note": "No markdown twin could be derived for the homepage (too-little-text): The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker). The report’s markdownTwins.skipped section lists every twin-less route with its reason."
-      },
-      {
-        "id": "robots-ai-policy-quality",
-        "artifact": "robots.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "sitemap",
-        "artifact": "sitemap",
-        "status": "actionable"
-      },
-      {
-        "id": "agent-instruction",
-        "artifact": "agents.md",
-        "status": "actionable"
-      },
-      {
-        "id": "json-ld",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "org-schema-completeness",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "openapi-spec",
-        "artifact": "openapi.json",
-        "status": "actionable"
-      },
-      {
-        "id": "mcp-server",
-        "artifact": "mcp-server",
-        "status": "actionable"
-      },
-      {
-        "id": "markdown-negotiation",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      },
-      {
-        "id": "markdown-negotiation-vary",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      }
-    ]
-  },
-  "warnings": [
-    "isGated excluded entry \"urn:air:example.com:auth-internal\" (/api/auth/internal) — it is gated but ax can't derive an auth descriptor for it, so it is not published as an open surface. Declare it in ax.config \"entries\" with an \"auth\" descriptor to list it as gated instead."
-  ],
-  "recommendations": [
-    "No OpenAPI doc found (public/openapi.json) — an OpenAPI doc lets agents understand and call your API without guessing at routes or schemas. ax never generates one; produce it however your API is defined (many schema/validation libraries can emit OpenAPI from your existing route definitions) and commit the result to public/openapi.json.",
-    "No llms.txt found — a short natural-language guide agents read to decide whether your site fits their task, and to find your key pages. Add one at app/llms.txt/route.ts (or public/llms.txt), or set scaffoldLlmsTxt: true in ax.config to have a starter written for you. Pair it with JSON-LD structured data (an Organization block with a sameAs array): llms.txt says what your site is for, JSON-LD identifies it as an entity registries can rank — the two reinforce each other, so add both rather than one alone.",
-    "No sitemap found — add one so agents can discover all public routes. Use the built-in Next.js path (app/sitemap.ts); ax never generates a sitemap itself. Give each entry a <lastmod> date (agents use it to judge freshness), then reference it from robots.txt with a \"Sitemap:\" line.",
-    "No robots.txt found — add one (app/robots.ts or public/robots.txt) that explicitly Allows the reputable AI agents you want to reach, scoped to specific User-agent groups (never \"User-agent: *\"), plus a \"Sitemap:\" line. Note: Next's MetadataRoute.Robots (app/robots.ts) has no field for the \"Agentmap:\" catalog pointer — put that line in a static public/robots.txt. Set scaffoldRobots: true in ax.config to have one written for you.",
-    "No agents.md found — consider adding one (public/agents.md) with when-to-use / when-NOT-to-use guidance for agents. ax won't write its content for you; the companion skill can help author it from your repo.",
-    "No JSON-LD structured data found in your layouts/pages — structured data is how registries and agents disambiguate and rank your site. Add an Organization block in your root layout <head> (<script type=\"application/ld+json\">) with a \"sameAs\" array linking your LinkedIn/GitHub/npm/social profiles (the entity-disambiguation signal registries value), and at least one more schema.org @type beyond Organization — SoftwareApplication or Product for an app/API, or a FAQPage — since covering more types helps registries understand your site more fully. JSON-LD pairs with an llms.txt: llms.txt tells agents what your site is for, JSON-LD identifies it as an entity registries can rank — add both, not one alone. ax won’t author the block (the fields are judgment content); the companion skill can help draft it from your repo.",
-    "No app/not-found.tsx found — agents that hit a missing URL get Next.js’s bare default 404, a dead end that makes them give up or guess. Add a standard 404 page in your own design system (a clear “page not found” and a way back home), and include `<link rel=\"alternate\" type=\"text/markdown\" href=\"/404.md\" />` so agents can hop from it to /404.md — the generated wayfinding guide (real routes + discovery links) this build writes. Rendered in the page’s JSX, React hoists the tag into <head> (App Router); use next/head in the Pages Router.",
-    "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-  ]
-}
diff --git a/fixtures/discovery/README.md b/fixtures/discovery/README.md
deleted file mode 100644
index fd57846..0000000
--- a/fixtures/discovery/README.md
+++ /dev/null
@@ -1,16 +0,0 @@
-# fixture: discovery
-
-An app that already ships the discovery/access artifacts Ora scores: a static `public/robots.txt`
-(scoped AI-agent `Allow` rules plus `Sitemap:` / `Agentmap:` pointers), an idiomatic
-`app/sitemap.ts`, a `public/agents.md`, and an Organization JSON-LD block (with a `sameAs` array) in
-the root layout.
-
-**Exercises:** the Phase 2.4 / 2.7 **detect-and-recommend** path. The plugin detects all four and
-emits advisory recommendations confirming they're present — it never turns them into catalog
-entries, never reimplements a sitemap, never rewrites the robots policy, and never authors the
-JSON-LD. With none of them present it would instead recommend adding each (see `detect-robots` /
-`detect-sitemap` / `detect-agents-md` / `detect-json-ld` tests). Emission stays the default static
-`public/.well-known/ai-catalog.json`; the alternative route-handler target (`emit: 'route'`) is
-covered by `write.test.ts`.
-
-Ships an `ax.config.ts` declaring `siteUrl` so the catalog is deterministic in CI.
diff --git a/fixtures/discovery/app/layout.tsx b/fixtures/discovery/app/layout.tsx
deleted file mode 100644
index 9cdcc30..0000000
--- a/fixtures/discovery/app/layout.tsx
+++ /dev/null
@@ -1,31 +0,0 @@
-import type { ReactNode } from 'react';
-
-export const metadata = {
-  title: 'Discovery Fixture',
-  description: 'An app that already ships robots.txt, a sitemap, and agents.md.',
-};
-
-// An Organization JSON-LD block with a `sameAs` array — the structured-data shape Ora scores
-// (json-ld / org-schema-completeness / json-ld-entity-linking). ax only detects-and-
-// recommends this; the content here is authored by the app, never guessed by the plugin.
-const organizationJsonLd = {
-  '@context': 'https://schema.org',
-  '@type': 'Organization',
-  name: 'Discovery Fixture',
-  url: 'https://discovery-fixture.example.com',
-  sameAs: ['https://github.com/eralabs-ai', 'https://www.linkedin.com/company/example'],
-};
-
-export default function RootLayout({ children }: { children: ReactNode }) {
-  return (
-    <html lang="en">
-      <head>
-        <script
-          type="application/ld+json"
-          dangerouslySetInnerHTML={{ __html: JSON.stringify(organizationJsonLd) }}
-        />
-      </head>
-      <body>{children}</body>
-    </html>
-  );
-}
diff --git a/fixtures/discovery/app/page.tsx b/fixtures/discovery/app/page.tsx
deleted file mode 100644
index e893bec..0000000
--- a/fixtures/discovery/app/page.tsx
+++ /dev/null
@@ -1,12 +0,0 @@
-export default function Home() {
-  return (
-    <main>
-      <h1>Discovery fixture</h1>
-      <p>
-        This app already ships a robots.txt, an app/sitemap.ts, and a public/agents.md. The plugin
-        should detect all three and emit &ldquo;detected&rdquo; recommendations for them — never
-        catalog entries, and never a build failure.
-      </p>
-    </main>
-  );
-}
diff --git a/fixtures/discovery/app/sitemap.ts b/fixtures/discovery/app/sitemap.ts
deleted file mode 100644
index ff735bd..0000000
--- a/fixtures/discovery/app/sitemap.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-import type { MetadataRoute } from 'next';
-
-// The idiomatic Next.js way to emit sitemap.xml. ax detects this file and recommends
-// referencing it from robots.txt — it never generates a sitemap itself.
-export default function sitemap(): MetadataRoute.Sitemap {
-  return [
-    {
-      url: 'https://discovery-fixture.example.com',
-      lastModified: '2026-01-01T00:00:00.000Z',
-    },
-  ];
-}
diff --git a/fixtures/discovery/ax.config.ts b/fixtures/discovery/ax.config.ts
deleted file mode 100644
index 38b1634..0000000
--- a/fixtures/discovery/ax.config.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import type { AxConfig } from '@ora-ai/ax';
-
-// `siteUrl` keeps the fixture deterministic regardless of where it's built (see the openapi
-// fixture's config for the full rationale). This fixture exercises the Phase 2.4 detect-and-recommend
-// artifacts (robots.txt / sitemap / agents.md), which don't need siteUrl themselves — but the emitted
-// catalog's host.identifier and any future URL-bearing entry do.
-const config: AxConfig = {
-  siteUrl: 'https://discovery-fixture.example.com',
-};
-
-export default config;
diff --git a/fixtures/discovery/package.json b/fixtures/discovery/package.json
deleted file mode 100644
index 5213df8..0000000
--- a/fixtures/discovery/package.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "name": "@ax-fixtures/discovery",
-  "version": "0.0.0",
-  "private": true,
-  "scripts": {
-    "build": "next build",
-    "postbuild": "ax --report --yes",
-    "dev": "next dev",
-    "start": "next start"
-  },
-  "dependencies": {
-    "next": "^15.1.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0"
-  },
-  "devDependencies": {
-    "@types/node": "^20.17.12",
-    "@types/react": "^19.0.7",
-    "@types/react-dom": "^19.0.3",
-    "@ora-ai/ax": "workspace:*",
-    "typescript": "^5.7.3"
-  }
-}
diff --git a/fixtures/discovery/public/agents.md b/fixtures/discovery/public/agents.md
deleted file mode 100644
index 78720c0..0000000
--- a/fixtures/discovery/public/agents.md
+++ /dev/null
@@ -1,9 +0,0 @@
-# Agent guidance
-
-## When to use
-
-- Use this site's catalog to discover its OpenAPI doc and MCP server before calling anything.
-
-## When NOT to use
-
-- Do not scrape the HTML UI for data that the API already exposes in a structured form.
diff --git a/fixtures/discovery/public/robots.txt b/fixtures/discovery/public/robots.txt
deleted file mode 100644
index 9d6c2fd..0000000
--- a/fixtures/discovery/public/robots.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-# Scoped to specific agents, never "User-agent: *" for the allow rules.
-User-agent: OAI-SearchBot
-Allow: /
-
-User-agent: ChatGPT-User
-Allow: /
-
-Sitemap: https://discovery-fixture.example.com/sitemap.xml
-Agentmap: https://discovery-fixture.example.com/.well-known/ai-catalog.json
diff --git a/fixtures/discovery/report.golden.json b/fixtures/discovery/report.golden.json
deleted file mode 100644
index fc60af2..0000000
--- a/fixtures/discovery/report.golden.json
+++ /dev/null
@@ -1,187 +0,0 @@
-{
-  "generatedAt": "<generatedAt>",
-  "siteUrl": "https://discovery-fixture.example.com",
-  "basePath": "",
-  "routers": [
-    "app"
-  ],
-  "catalog": {
-    "entryCount": 0,
-    "entries": [],
-    "path": "public/.well-known/ai-catalog.json",
-    "target": "static"
-  },
-  "mcp": {
-    "mounts": [],
-    "unreviewedMounts": []
-  },
-  "agent404": {
-    "notFoundPresent": false,
-    "agentAware": false,
-    "pages": [],
-    "markdownGuide": "public/404.md"
-  },
-  "middleware": {
-    "present": false,
-    "wiredToAx": false
-  },
-  "artifacts": {
-    "robotsTxt": {
-      "found": true,
-      "source": "public/robots.txt"
-    },
-    "sitemap": {
-      "found": true,
-      "source": "app/sitemap.ts"
-    },
-    "agentsMd": {
-      "found": true,
-      "source": "public/agents.md"
-    },
-    "jsonLd": {
-      "found": true,
-      "source": "app/layout.tsx"
-    },
-    "llmsTxt": {
-      "found": false
-    },
-    "openapi": {
-      "found": false
-    }
-  },
-  "auth": {
-    "gatedSurfaces": []
-  },
-  "scaffolds": {},
-  "markdownTwins": {
-    "enabled": true,
-    "written": [
-      {
-        "route": "/",
-        "path": "public/index.md",
-        "tier": 2,
-        "source": "prerender"
-      }
-    ],
-    "userOwned": [],
-    "skipped": [],
-    "dynamicRouteCount": 0,
-    "deleted": []
-  },
-  "sizes": [
-    {
-      "artifact": "ai-catalog.json",
-      "path": "public/.well-known/ai-catalog.json",
-      "bytes": 151,
-      "chars": 151,
-      "tokens": 38
-    },
-    {
-      "artifact": "markdown-twin",
-      "path": "public/index.md",
-      "bytes": 474,
-      "chars": 468,
-      "tokens": 117
-    },
-    {
-      "artifact": "404.md",
-      "path": "public/404.md",
-      "bytes": 722,
-      "chars": 714,
-      "tokens": 179
-    }
-  ],
-  "ora": {
-    "checks": [
-      {
-        "id": "ard-catalog",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "agent-discovery-file",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "llms-txt-exists",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "llms-txt-formatting",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "markdown-url-fallback",
-        "artifact": "markdown-twins",
-        "status": "addressed"
-      },
-      {
-        "id": "markdown-frontmatter",
-        "artifact": "markdown-twins",
-        "status": "addressed"
-      },
-      {
-        "id": "robots-ai-policy-quality",
-        "artifact": "robots.txt",
-        "status": "addressed"
-      },
-      {
-        "id": "sitemap",
-        "artifact": "sitemap",
-        "status": "addressed"
-      },
-      {
-        "id": "agent-instruction",
-        "artifact": "agents.md",
-        "status": "addressed"
-      },
-      {
-        "id": "json-ld",
-        "artifact": "json-ld",
-        "status": "addressed"
-      },
-      {
-        "id": "org-schema-completeness",
-        "artifact": "json-ld",
-        "status": "addressed"
-      },
-      {
-        "id": "openapi-spec",
-        "artifact": "openapi.json",
-        "status": "actionable"
-      },
-      {
-        "id": "mcp-server",
-        "artifact": "mcp-server",
-        "status": "actionable"
-      },
-      {
-        "id": "markdown-negotiation",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      },
-      {
-        "id": "markdown-negotiation-vary",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      }
-    ]
-  },
-  "warnings": [],
-  "recommendations": [
-    "No OpenAPI doc found (public/openapi.json) — an OpenAPI doc lets agents understand and call your API without guessing at routes or schemas. ax never generates one; produce it however your API is defined (many schema/validation libraries can emit OpenAPI from your existing route definitions) and commit the result to public/openapi.json.",
-    "No llms.txt found — a short natural-language guide agents read to decide whether your site fits their task, and to find your key pages. Add one at app/llms.txt/route.ts (or public/llms.txt), or set scaffoldLlmsTxt: true in ax.config to have a starter written for you. Pair it with JSON-LD structured data (an Organization block with a sameAs array): llms.txt says what your site is for, JSON-LD identifies it as an entity registries can rank — the two reinforce each other, so add both rather than one alone.",
-    "sitemap detected (app/sitemap.ts) — make sure robots.txt references it with a \"Sitemap:\" line, that it lists all public routes, and that each entry carries a <lastmod> date so agents can judge how fresh a page is before fetching it.",
-    "robots.txt detected (public/robots.txt) — confirm it explicitly Allows the AI agents you want to reach (scoped to specific User-agent groups, never \"User-agent: *\"), and that it references your sitemap (\"Sitemap:\") and catalog (\"Agentmap:\").",
-    "agents.md detected (public/agents.md) — confirm it has clear when-to-use / when-NOT-to-use guidance for agents.",
-    "JSON-LD structured data detected (app/layout.tsx) — confirm it includes an Organization block with a \"sameAs\" array (LinkedIn/GitHub/npm/socials), a logo, and an address, and at least one more @type beyond Organization (SoftwareApplication/Product, or a FAQPage), so registries can disambiguate and rank your site — covering more schema.org types helps them understand it more fully. Make sure you also have an llms.txt: it and JSON-LD reinforce each other (what your site is for vs. what entity it is).",
-    "Markdown twins exist for your pages — link each HTML page to its twin so crawlers find the machine-readable version. Add this to the page <head> (ax prints the tag; it never edits your layout): <link rel=\"alternate\" type=\"text/markdown\" href=\"https://discovery-fixture.example.com/index.md\" />",
-    "No app/not-found.tsx found — agents that hit a missing URL get Next.js’s bare default 404, a dead end that makes them give up or guess. Add a standard 404 page in your own design system (a clear “page not found” and a way back home), and include `<link rel=\"alternate\" type=\"text/markdown\" href=\"/404.md\" />` so agents can hop from it to /404.md — the generated wayfinding guide (real routes + discovery links) this build writes. Rendered in the page’s JSX, React hoists the tag into <head> (App Router); use next/head in the Pages Router.",
-    "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-  ]
-}
diff --git a/fixtures/discovery/twins.golden/404.md b/fixtures/discovery/twins.golden/404.md
deleted file mode 100644
index e35e749..0000000
--- a/fixtures/discovery/twins.golden/404.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-title: "Page not found — discovery"
-description: "Where to continue when a URL on this site does not exist: discovery links and real routes."
-canonical_url: https://discovery-fixture.example.com/404.md
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# Page not found
-
-The URL you requested does not exist on this site. It may have moved, or it may never have existed —
-requesting it again will keep returning this response. Do not retry; start from the links
-below instead.
-
-## Start here
-
-- [/.well-known/ai-catalog.json](/.well-known/ai-catalog.json) — machine-readable catalog of everything this site offers agents
-
-## Pages that do exist
-
-- [/](/) — markdown: [/index.md](/index.md)
diff --git a/fixtures/discovery/twins.golden/index.md b/fixtures/discovery/twins.golden/index.md
deleted file mode 100644
index 594633f..0000000
--- a/fixtures/discovery/twins.golden/index.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-title: "Discovery Fixture"
-description: "An app that already ships robots.txt, a sitemap, and agents.md."
-canonical_url: https://discovery-fixture.example.com/
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# Discovery fixture
-
-This app already ships a robots.txt, an app/sitemap.ts, and a public/agents.md. The plugin should detect all three and emit “detected” recommendations for them — never catalog entries, and never a build failure.
diff --git a/fixtures/flagship-pages/README.md b/fixtures/flagship-pages/README.md
new file mode 100644
index 0000000..50fed18
--- /dev/null
+++ b/fixtures/flagship-pages/README.md
@@ -0,0 +1,28 @@
+# fixture: flagship-pages
+
+The flagship app's information architecture ported wholesale to the Pages Router — the corpus's
+deep-axis twin. The router model forks everything downstream (route listing, twin sourcing, 404
+convention, MCP mount shape, WebMCP URL resolution), so this fixture re-proves the flagship's
+composition against a Pages-only project rather than isolating one behavior per fixture.
+
+What differs from flagship, deliberately:
+
+- **Routes live under `pages/`** — `/`, `/destinations`, `/destinations/[slug]`
+  (getStaticPaths/getStaticProps), the booking flow, and the gated `/account`; `_app`/`_document`
+  must never be listed, and `pages/404.tsx` is the Pages-Router 404 convention (`report.agent404`).
+- **Both MCP servers mount as catch-all API routes** — `pages/api/[transport].ts` (gated via
+  `withMcpAuth` + the stub verifier, served at `/api/mcp`) and `pages/api/public/[transport].ts`
+  (open, `/api/public/mcp`), each bridging mcp-handler's Web-standard handler to `(req, res)`.
+- **Declarative WebMCP on a Pages route** — the `<form toolname="watch_route">` on
+  `/destinations`, proving file-is-the-route URL resolution for the Pages Router.
+- **Middleware wired to ax** — the plain `withAx({ manifest })` form against a Pages-only
+  manifest.
+- **No MDX, sitemap, JSON-LD, or `.well-known` OAuth documents** — those are App-Router artifact
+  axes already proven in flagship (the Pages Router can't serve `/.well-known/*` documents without
+  rewrites); auth detection here comes from the `withMcpAuth` wrapper plus the config-declared
+  entry.
+
+**Exercises:** the Pages Router fork of the router model end-to-end — route listing and special-file
+exclusion, `pages/404.tsx` detection, Pages-mounted MCP servers (gated + public, multi-card),
+Pages-resolved declarative WebMCP, gating and dynamic prefixes in the serving manifest, and the
+report/twin/card goldens for all of it.
diff --git a/fixtures/flagship-pages/ax.config.ts b/fixtures/flagship-pages/ax.config.ts
new file mode 100644
index 0000000..6d784e8
--- /dev/null
+++ b/fixtures/flagship-pages/ax.config.ts
@@ -0,0 +1,21 @@
+import type { AxConfig } from '@ora-ai/ax';
+
+// The flagship app's information architecture ported to the Pages Router — same siteUrl
+// convention, same gated page, same declared auth for the gated MCP mount. What differs is
+// everything downstream of the router model, which is the point of this fixture.
+const config: AxConfig = {
+  siteUrl: 'https://flagship-pages-fixture.example.com',
+  isGated: ({ path }) =>
+    path.startsWith('/api/auth/') || path.startsWith('/api/webhooks/') || path === '/account',
+  entries: [
+    {
+      identifier: 'urn:air:flagship-pages-fixture.example.com:mcp-server:api-mcp',
+      auth: {
+        status: 'oauth2',
+        docsUrl: 'https://flagship-pages-fixture.example.com/agents.md',
+      },
+    },
+  ],
+};
+
+export default config;
diff --git a/fixtures/flagship-pages/cards.golden/server-card.json b/fixtures/flagship-pages/cards.golden/server-card.json
new file mode 100644
index 0000000..3ebd9fc
--- /dev/null
+++ b/fixtures/flagship-pages/cards.golden/server-card.json
@@ -0,0 +1,28 @@
+{
+  "name": "com.example.flagship-pages-fixture/api-public-mcp",
+  "description": "flagship-pages MCP server at /api/public/mcp",
+  "version": "0.0.0",
+  "serverUrl": "https://flagship-pages-fixture.example.com/api/public/mcp",
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://flagship-pages-fixture.example.com/api/public/mcp"
+    }
+  ],
+  "tools": [
+    {
+      "name": "search_flights"
+    }
+  ],
+  "serverInfo": {
+    "name": "flagship-pages",
+    "version": "0.0.0"
+  },
+  "transport": {
+    "type": "streamable-http",
+    "endpoint": "https://flagship-pages-fixture.example.com/api/public/mcp"
+  },
+  "capabilities": {
+    "tools": {}
+  }
+}
diff --git a/fixtures/flagship-pages/cards.golden/server-card/api-mcp.json b/fixtures/flagship-pages/cards.golden/server-card/api-mcp.json
new file mode 100644
index 0000000..e23d528
--- /dev/null
+++ b/fixtures/flagship-pages/cards.golden/server-card/api-mcp.json
@@ -0,0 +1,37 @@
+{
+  "name": "com.example.flagship-pages-fixture/api-mcp",
+  "description": "flagship-pages MCP server at /api/mcp",
+  "version": "0.0.0",
+  "serverUrl": "https://flagship-pages-fixture.example.com/api/mcp",
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://flagship-pages-fixture.example.com/api/mcp"
+    }
+  ],
+  "tools": [
+    {
+      "name": "get_seat_map"
+    },
+    {
+      "name": "book_flight"
+    },
+    {
+      "name": "pay_booking"
+    }
+  ],
+  "serverInfo": {
+    "name": "flagship-pages",
+    "version": "0.0.0"
+  },
+  "transport": {
+    "type": "streamable-http",
+    "endpoint": "https://flagship-pages-fixture.example.com/api/mcp"
+  },
+  "capabilities": {
+    "tools": {}
+  },
+  "authentication": {
+    "required": true
+  }
+}
diff --git a/fixtures/flagship-pages/cards.golden/server-card/api-public-mcp.json b/fixtures/flagship-pages/cards.golden/server-card/api-public-mcp.json
new file mode 100644
index 0000000..3ebd9fc
--- /dev/null
+++ b/fixtures/flagship-pages/cards.golden/server-card/api-public-mcp.json
@@ -0,0 +1,28 @@
+{
+  "name": "com.example.flagship-pages-fixture/api-public-mcp",
+  "description": "flagship-pages MCP server at /api/public/mcp",
+  "version": "0.0.0",
+  "serverUrl": "https://flagship-pages-fixture.example.com/api/public/mcp",
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://flagship-pages-fixture.example.com/api/public/mcp"
+    }
+  ],
+  "tools": [
+    {
+      "name": "search_flights"
+    }
+  ],
+  "serverInfo": {
+    "name": "flagship-pages",
+    "version": "0.0.0"
+  },
+  "transport": {
+    "type": "streamable-http",
+    "endpoint": "https://flagship-pages-fixture.example.com/api/public/mcp"
+  },
+  "capabilities": {
+    "tools": {}
+  }
+}
diff --git a/fixtures/flagship-pages/lib/data/airports.ts b/fixtures/flagship-pages/lib/data/airports.ts
new file mode 100644
index 0000000..e3ac98c
--- /dev/null
+++ b/fixtures/flagship-pages/lib/data/airports.ts
@@ -0,0 +1,35 @@
+export interface Airport {
+  code: string;
+  city: string;
+  name: string;
+  country: string;
+}
+
+export const AIRPORTS: Airport[] = [
+  {
+    code: 'JFK',
+    city: 'New York',
+    name: 'John F. Kennedy International',
+    country: 'United States',
+  },
+  { code: 'LAX', city: 'Los Angeles', name: 'Los Angeles International', country: 'United States' },
+  {
+    code: 'SFO',
+    city: 'San Francisco',
+    name: 'San Francisco International',
+    country: 'United States',
+  },
+  { code: 'MIA', city: 'Miami', name: 'Miami International', country: 'United States' },
+  { code: 'ORD', city: 'Chicago', name: "O'Hare International", country: 'United States' },
+  { code: 'SEA', city: 'Seattle', name: 'Seattle-Tacoma International', country: 'United States' },
+  { code: 'LHR', city: 'London', name: 'Heathrow', country: 'United Kingdom' },
+  { code: 'CDG', city: 'Paris', name: 'Charles de Gaulle', country: 'France' },
+  { code: 'TLV', city: 'Tel Aviv', name: 'Ben Gurion', country: 'Israel' },
+  { code: 'NRT', city: 'Tokyo', name: 'Narita International', country: 'Japan' },
+  { code: 'SIN', city: 'Singapore', name: 'Changi', country: 'Singapore' },
+  { code: 'DXB', city: 'Dubai', name: 'Dubai International', country: 'United Arab Emirates' },
+];
+
+export function getAirport(code: string): Airport | undefined {
+  return AIRPORTS.find((a) => a.code === code.toUpperCase());
+}
diff --git a/fixtures/flagship-pages/lib/data/flights.ts b/fixtures/flagship-pages/lib/data/flights.ts
new file mode 100644
index 0000000..591daf5
--- /dev/null
+++ b/fixtures/flagship-pages/lib/data/flights.ts
@@ -0,0 +1,166 @@
+import { getAirport } from './airports';
+
+export type AircraftType = 'A320neo' | 'B787-9';
+
+export interface FareOption {
+  classCode: string; // internal fare basis, e.g. Y1, Y2, J1
+  className: string;
+  price: number; // USD
+  perks: string[];
+}
+
+export interface Flight {
+  id: string;
+  flightNumber: string;
+  origin: string;
+  destination: string;
+  date: string; // YYYY-MM-DD
+  departureTime: string; // HH:MM local
+  arrivalTime: string; // HH:MM local
+  durationMinutes: number;
+  aircraft: AircraftType;
+  fares: FareOption[];
+}
+
+// Deterministic PRNG so the same route + date always yields the same flights.
+function hashString(input: string): number {
+  let h = 2166136261;
+  for (let i = 0; i < input.length; i++) {
+    h ^= input.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return h >>> 0;
+}
+
+function mulberry32(seed: number) {
+  let a = seed;
+  return () => {
+    a |= 0;
+    a = (a + 0x6d2b79f5) | 0;
+    let t = Math.imul(a ^ (a >>> 15), 1 | a);
+    t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t;
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+}
+
+// Rough great-circle-ish duration table keyed by unordered pair; fallback derived from seed.
+const ROUTE_MINUTES: Record<string, number> = {
+  'JFK-LAX': 360,
+  'JFK-SFO': 380,
+  'JFK-MIA': 190,
+  'JFK-ORD': 150,
+  'JFK-SEA': 370,
+  'JFK-LHR': 415,
+  'JFK-CDG': 440,
+  'JFK-TLV': 630,
+  'JFK-NRT': 840,
+  'JFK-SIN': 1130,
+  'JFK-DXB': 750,
+  'LAX-SFO': 85,
+  'LAX-MIA': 290,
+  'LAX-ORD': 245,
+  'LAX-SEA': 165,
+  'LAX-LHR': 630,
+  'LAX-CDG': 650,
+  'LAX-TLV': 900,
+  'LAX-NRT': 690,
+  'LAX-SIN': 1050,
+  'LAX-DXB': 960,
+  'SFO-ORD': 255,
+  'SFO-SEA': 130,
+  'SFO-MIA': 320,
+  'SFO-LHR': 620,
+  'SFO-NRT': 660,
+  'LHR-CDG': 80,
+  'LHR-TLV': 290,
+  'LHR-DXB': 410,
+  'CDG-TLV': 270,
+  'TLV-DXB': 200,
+  'SIN-NRT': 420,
+  'SIN-DXB': 450,
+  'NRT-DXB': 660,
+  'ORD-MIA': 185,
+  'ORD-SEA': 250,
+  'SEA-MIA': 340,
+  'MIA-LHR': 520,
+  'ORD-LHR': 470,
+  'SEA-NRT': 630,
+  'MIA-CDG': 540,
+};
+
+function routeMinutes(origin: string, destination: string, rand: () => number): number {
+  const key = [origin, destination].sort().join('-');
+  return ROUTE_MINUTES[key] ?? 120 + Math.floor(rand() * 600);
+}
+
+function pad(n: number): string {
+  return n.toString().padStart(2, '0');
+}
+
+function minutesToClock(totalMinutes: number): string {
+  const m = ((totalMinutes % 1440) + 1440) % 1440;
+  return `${pad(Math.floor(m / 60))}:${pad(m % 60)}`;
+}
+
+export function generateFlights(origin: string, destination: string, date: string): Flight[] {
+  const o = getAirport(origin);
+  const d = getAirport(destination);
+  if (!o || !d || o.code === d.code) return [];
+
+  const seed = hashString(`${o.code}|${d.code}|${date}`);
+  const rand = mulberry32(seed);
+  const count = 5 + Math.floor(rand() * 4); // 5-8 flights
+  const duration = routeMinutes(o.code, d.code, rand);
+  const longHaul = duration > 420;
+
+  const flights: Flight[] = [];
+  for (let i = 0; i < count; i++) {
+    const depMinutes = 355 + Math.floor(i * (1080 / count) + rand() * 60); // spread 06:00-23:00
+    const jitteredDuration = duration + Math.floor(rand() * 30) - 15;
+    const aircraft: AircraftType = longHaul || rand() > 0.7 ? 'B787-9' : 'A320neo';
+    const flightNumber = `MR ${100 + Math.floor(rand() * 880)}`;
+    const basePrice = Math.round((60 + duration * 0.55) * (0.85 + rand() * 0.5));
+
+    flights.push({
+      id: `${o.code}${d.code}${date.replaceAll('-', '')}${pad(i)}`,
+      flightNumber,
+      origin: o.code,
+      destination: d.code,
+      date,
+      departureTime: minutesToClock(depMinutes),
+      arrivalTime: minutesToClock(depMinutes + jitteredDuration),
+      durationMinutes: jitteredDuration,
+      aircraft,
+      fares: [
+        {
+          classCode: 'Y1',
+          className: 'Economy Light',
+          price: basePrice,
+          perks: ['Carry-on bag', 'Seat assigned at check-in'],
+        },
+        {
+          classCode: 'Y2',
+          className: 'Economy Flex',
+          price: Math.round(basePrice * 1.45),
+          perks: ['Carry-on + checked bag', 'Free seat selection', 'Changes allowed'],
+        },
+        {
+          classCode: 'J1',
+          className: 'Business',
+          price: Math.round(basePrice * 3.4),
+          perks: ['Lounge access', 'Lie-flat seat', 'Priority boarding', '2 checked bags'],
+        },
+      ],
+    });
+  }
+  return flights.sort((a, b) => a.departureTime.localeCompare(b.departureTime));
+}
+
+export function getFlight(flightId: string): Flight | undefined {
+  // Flight ids encode origin/destination/date: e.g. JFKLAX2026072100
+  const match = /^([A-Z]{3})([A-Z]{3})(\d{8})(\d{2})$/.exec(flightId);
+  if (!match) return undefined;
+  const [, origin, destination, rawDate] = match;
+  const date = `${rawDate.slice(0, 4)}-${rawDate.slice(4, 6)}-${rawDate.slice(6, 8)}`;
+  return generateFlights(origin, destination, date).find((f) => f.id === flightId);
+}
diff --git a/fixtures/flagship-pages/lib/data/seatmaps.ts b/fixtures/flagship-pages/lib/data/seatmaps.ts
new file mode 100644
index 0000000..43e5a37
--- /dev/null
+++ b/fixtures/flagship-pages/lib/data/seatmaps.ts
@@ -0,0 +1,128 @@
+import { getFlight, type AircraftType } from './flights';
+
+export interface Seat {
+  id: string; // e.g. "12A"
+  row: number;
+  column: string;
+  occupied: boolean;
+  extraLegroom: boolean;
+  fee: number; // USD, on top of fare
+}
+
+export interface CabinSection {
+  name: string;
+  fareClasses: string[]; // which fare classes may sit here
+  columns: string[]; // includes "" for aisle gaps, e.g. ["A","B","C","","D","E","F"]
+  rows: number[];
+  seats: Seat[];
+}
+
+interface CabinLayout {
+  name: string;
+  fareClasses: string[];
+  columns: string[];
+  startRow: number;
+  endRow: number;
+  extraLegroomRows: number[];
+  fee: (row: number, extraLegroom: boolean) => number;
+}
+
+const LAYOUTS: Record<AircraftType, CabinLayout[]> = {
+  A320neo: [
+    {
+      name: 'Business',
+      fareClasses: ['J1'],
+      columns: ['A', 'C', '', 'D', 'F'],
+      startRow: 1,
+      endRow: 3,
+      extraLegroomRows: [1],
+      fee: () => 0,
+    },
+    {
+      name: 'Economy',
+      fareClasses: ['Y1', 'Y2'],
+      columns: ['A', 'B', 'C', '', 'D', 'E', 'F'],
+      startRow: 6,
+      endRow: 28,
+      extraLegroomRows: [6, 14],
+      fee: (row, extra) => (extra ? 32 : row <= 12 ? 14 : 0),
+    },
+  ],
+  'B787-9': [
+    {
+      name: 'Business',
+      fareClasses: ['J1'],
+      columns: ['A', '', 'D', 'E', '', 'K'],
+      startRow: 1,
+      endRow: 6,
+      extraLegroomRows: [1],
+      fee: () => 0,
+    },
+    {
+      name: 'Economy',
+      fareClasses: ['Y1', 'Y2'],
+      columns: ['A', 'B', 'C', '', 'D', 'E', 'F', '', 'H', 'J', 'K'],
+      startRow: 10,
+      endRow: 38,
+      extraLegroomRows: [10, 24],
+      fee: (row, extra) => (extra ? 45 : row <= 16 ? 19 : 0),
+    },
+  ],
+};
+
+function hashString(input: string): number {
+  let h = 2166136261;
+  for (let i = 0; i < input.length; i++) {
+    h ^= input.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return h >>> 0;
+}
+
+function mulberry32(seed: number) {
+  let a = seed;
+  return () => {
+    a |= 0;
+    a = (a + 0x6d2b79f5) | 0;
+    let t = Math.imul(a ^ (a >>> 15), 1 | a);
+    t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t;
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+}
+
+export function getSeatMap(
+  flightId: string,
+): { aircraft: AircraftType; cabins: CabinSection[] } | undefined {
+  const flight = getFlight(flightId);
+  if (!flight) return undefined;
+
+  const rand = mulberry32(hashString(`seats|${flightId}`));
+  const cabins: CabinSection[] = LAYOUTS[flight.aircraft].map((layout) => {
+    const rows: number[] = [];
+    const seats: Seat[] = [];
+    for (let row = layout.startRow; row <= layout.endRow; row++) {
+      rows.push(row);
+      for (const column of layout.columns) {
+        if (!column) continue;
+        const extraLegroom = layout.extraLegroomRows.includes(row);
+        seats.push({
+          id: `${row}${column}`,
+          row,
+          column,
+          occupied: rand() < 0.55,
+          extraLegroom,
+          fee: layout.fee(row, extraLegroom),
+        });
+      }
+    }
+    return {
+      name: layout.name,
+      fareClasses: layout.fareClasses,
+      columns: layout.columns,
+      rows,
+      seats,
+    };
+  });
+
+  return { aircraft: flight.aircraft, cabins };
+}
diff --git a/fixtures/flagship-pages/lib/services/booking.ts b/fixtures/flagship-pages/lib/services/booking.ts
new file mode 100644
index 0000000..f1c0c30
--- /dev/null
+++ b/fixtures/flagship-pages/lib/services/booking.ts
@@ -0,0 +1,89 @@
+import { getFlight, type Flight } from '../data/flights';
+import { getSeatMap } from '../data/seatmaps';
+
+export interface Passenger {
+  firstName: string;
+  lastName: string;
+  email: string;
+}
+
+export interface Booking {
+  bookingId: string;
+  pnr: string | null;
+  status: 'pending' | 'confirmed';
+  flight: Flight;
+  fareClass: string;
+  seatId: string;
+  passenger: Passenger;
+  amount: number; // USD total (fare + seat fee)
+  paymentRef: string | null;
+  createdAt: number;
+}
+
+// In-memory store; survives dev hot reloads via globalThis.
+const globalStore = globalThis as unknown as { __mrBookings?: Map<string, Booking> };
+const bookings: Map<string, Booking> = (globalStore.__mrBookings ??= new Map());
+
+function randomId(prefix: string, length: number): string {
+  const alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+  let out = '';
+  for (let i = 0; i < length; i++) {
+    out += alphabet[Math.floor(Math.random() * alphabet.length)];
+  }
+  return prefix + out;
+}
+
+export function createBooking(input: {
+  flightId: string;
+  fareClass: string;
+  seatId: string;
+  passenger: Passenger;
+}): Booking | { error: string } {
+  const flight = getFlight(input.flightId);
+  if (!flight) return { error: 'FLIGHT_NOT_FOUND' };
+
+  const fare = flight.fares.find((f) => f.classCode === input.fareClass);
+  if (!fare) return { error: 'FARE_NOT_FOUND' };
+
+  const seatMap = getSeatMap(input.flightId);
+  const seat = seatMap?.cabins
+    .filter((c) => c.fareClasses.includes(input.fareClass))
+    .flatMap((c) => c.seats)
+    .find((s) => s.id === input.seatId);
+  if (!seat) return { error: 'SEAT_NOT_FOUND' };
+  if (seat.occupied) return { error: 'SEAT_TAKEN' };
+
+  const { firstName, lastName, email } = input.passenger;
+  if (!firstName?.trim() || !lastName?.trim() || !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email ?? '')) {
+    return { error: 'INVALID_PASSENGER' };
+  }
+
+  const booking: Booking = {
+    bookingId: randomId('BK', 10),
+    pnr: null,
+    status: 'pending',
+    flight,
+    fareClass: input.fareClass,
+    seatId: input.seatId,
+    passenger: { firstName: firstName.trim(), lastName: lastName.trim(), email: email.trim() },
+    amount: fare.price + seat.fee,
+    paymentRef: null,
+    createdAt: Date.now(),
+  };
+  bookings.set(booking.bookingId, booking);
+  return booking;
+}
+
+export function confirmBooking(bookingId: string, paymentRef: string): Booking | { error: string } {
+  const booking = bookings.get(bookingId);
+  if (!booking) return { error: 'BOOKING_NOT_FOUND' };
+  if (booking.status === 'confirmed') return booking;
+  booking.status = 'confirmed';
+  booking.paymentRef = paymentRef;
+  booking.pnr = randomId('', 6);
+  return booking;
+}
+
+export function getBooking(bookingId: string): Booking | undefined {
+  return bookings.get(bookingId);
+}
diff --git a/fixtures/flagship-pages/lib/services/payment.ts b/fixtures/flagship-pages/lib/services/payment.ts
new file mode 100644
index 0000000..7de6f03
--- /dev/null
+++ b/fixtures/flagship-pages/lib/services/payment.ts
@@ -0,0 +1,32 @@
+export interface CardDetails {
+  cardNumber: string;
+  expiry: string; // MM/YY
+  cvv: string;
+  holderName: string;
+}
+
+export interface ChargeResult {
+  success: boolean;
+  paymentRef?: string;
+  declineCode?: string;
+}
+
+// Mock processor: the standard test card succeeds, everything else declines.
+const TEST_CARD = '4242424242424242';
+
+export function chargeCard(card: CardDetails, amount: number): ChargeResult {
+  const digits = card.cardNumber.replace(/\D/g, '');
+  if (digits.length < 15 || !/^\d{2}\/\d{2}$/.test(card.expiry) || !/^\d{3,4}$/.test(card.cvv)) {
+    return { success: false, declineCode: 'invalid_details' };
+  }
+  if (amount <= 0) {
+    return { success: false, declineCode: 'invalid_amount' };
+  }
+  if (digits !== TEST_CARD) {
+    return { success: false, declineCode: 'card_declined' };
+  }
+  return {
+    success: true,
+    paymentRef: `ch_${Math.random().toString(36).slice(2, 12)}`,
+  };
+}
diff --git a/fixtures/flagship-pages/lib/services/search.ts b/fixtures/flagship-pages/lib/services/search.ts
new file mode 100644
index 0000000..f301d62
--- /dev/null
+++ b/fixtures/flagship-pages/lib/services/search.ts
@@ -0,0 +1,16 @@
+import { generateFlights, type Flight } from '../data/flights';
+import { getAirport } from '../data/airports';
+
+export interface SearchQuery {
+  origin: string;
+  destination: string;
+  date: string; // YYYY-MM-DD
+  passengers: number;
+}
+
+export function searchFlights(query: SearchQuery): Flight[] | null {
+  if (!getAirport(query.origin) || !getAirport(query.destination)) return null;
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(query.date)) return null;
+  if (query.passengers < 1 || query.passengers > 9) return null;
+  return generateFlights(query.origin, query.destination, query.date);
+}
diff --git a/fixtures/flagship-pages/middleware.ts b/fixtures/flagship-pages/middleware.ts
new file mode 100644
index 0000000..013d56e
--- /dev/null
+++ b/fixtures/flagship-pages/middleware.ts
@@ -0,0 +1,12 @@
+import { withAx } from '@ora-ai/ax/middleware';
+
+import { axManifest } from './ax-manifest';
+
+// The exact wiring ax's CLI prints, against a Pages-only route model: the generated manifest is
+// the rewrite contract (never rewrite blind, never touch gated paths), and the matcher is pasted
+// as a literal because Next.js only accepts a statically analyzable `config`.
+export default withAx({ manifest: axManifest });
+
+export const config = {
+  matcher: ['/((?!_next|api|.*\\..*|favicon|robots|health|status).*)'],
+};
diff --git a/fixtures/pages-bare/next-env.d.ts b/fixtures/flagship-pages/next-env.d.ts
similarity index 100%
rename from fixtures/pages-bare/next-env.d.ts
rename to fixtures/flagship-pages/next-env.d.ts
diff --git a/fixtures/config-overrides/next.config.mjs b/fixtures/flagship-pages/next.config.mjs
similarity index 100%
rename from fixtures/config-overrides/next.config.mjs
rename to fixtures/flagship-pages/next.config.mjs
diff --git a/fixtures/mcp-adapter/package.json b/fixtures/flagship-pages/package.json
similarity index 88%
rename from fixtures/mcp-adapter/package.json
rename to fixtures/flagship-pages/package.json
index b37d5d1..abf5ee5 100644
--- a/fixtures/mcp-adapter/package.json
+++ b/fixtures/flagship-pages/package.json
@@ -1,8 +1,9 @@
 {
-  "name": "@ax-fixtures/mcp-adapter",
+  "name": "@ax-fixtures/flagship-pages",
   "version": "0.0.0",
   "private": true,
   "scripts": {
+    "prebuild": "ax manifest",
     "build": "next build",
     "postbuild": "ax --report --yes",
     "dev": "next dev",
diff --git a/fixtures/flagship-pages/pages/404.tsx b/fixtures/flagship-pages/pages/404.tsx
new file mode 100644
index 0000000..3b00376
--- /dev/null
+++ b/fixtures/flagship-pages/pages/404.tsx
@@ -0,0 +1,13 @@
+// The Pages Router custom 404. An error page, not addressable content — must be excluded from the
+// route list (the App Router equivalent is `app/not-found.tsx`).
+export default function NotFound() {
+  return (
+    <main>
+      <h1>404 — page not found</h1>
+      <p>
+        Try the <a href="/destinations">route network</a> or search fares from the{' '}
+        <a href="/">homepage</a>.
+      </p>
+    </main>
+  );
+}
diff --git a/fixtures/pages-bare/pages/_app.tsx b/fixtures/flagship-pages/pages/_app.tsx
similarity index 100%
rename from fixtures/pages-bare/pages/_app.tsx
rename to fixtures/flagship-pages/pages/_app.tsx
diff --git a/fixtures/pages-bare/pages/_document.tsx b/fixtures/flagship-pages/pages/_document.tsx
similarity index 72%
rename from fixtures/pages-bare/pages/_document.tsx
rename to fixtures/flagship-pages/pages/_document.tsx
index f8d2be7..c012bbf 100644
--- a/fixtures/pages-bare/pages/_document.tsx
+++ b/fixtures/flagship-pages/pages/_document.tsx
@@ -1,9 +1,9 @@
-import { Head, Html, Main, NextScript } from 'next/document';
+import { Html, Head, Main, NextScript } from 'next/document';
 
 // A special file, never a route. The plugin must not list `/_document`.
 export default function Document() {
   return (
-    <Html lang="en">
+    <Html>
       <Head />
       <body>
         <Main />
diff --git a/fixtures/flagship-pages/pages/account.tsx b/fixtures/flagship-pages/pages/account.tsx
new file mode 100644
index 0000000..d1ab162
--- /dev/null
+++ b/fixtures/flagship-pages/pages/account.tsx
@@ -0,0 +1,19 @@
+import Head from 'next/head';
+
+// Gated page route: listed in ax.config's isGated matcher, so it lands in the serving manifest's
+// gatedPaths and the middleware falls through untouched for agents too.
+export default function AccountPage() {
+  return (
+    <main>
+      <Head>
+        <title>My bookings — Ora Air</title>
+        <meta name="description" content="Sign in to view and manage your Ora Air bookings." />
+      </Head>
+      <h1>Sign in to view your bookings</h1>
+      <p>
+        Your bookings, receipts, and saved travelers live behind sign-in. Use the email address from
+        your confirmation to receive a one-time sign-in link.
+      </p>
+    </main>
+  );
+}
diff --git a/fixtures/flagship-pages/pages/api/[transport].ts b/fixtures/flagship-pages/pages/api/[transport].ts
new file mode 100644
index 0000000..5ba931a
--- /dev/null
+++ b/fixtures/flagship-pages/pages/api/[transport].ts
@@ -0,0 +1,128 @@
+import { createMcpHandler, withMcpAuth } from 'mcp-handler';
+import type { NextApiRequest, NextApiResponse } from 'next';
+import { z } from 'zod';
+
+import { getSeatMap } from '@/lib/data/seatmaps';
+import { createBooking, getBooking, confirmBooking } from '@/lib/services/booking';
+import { chargeCard } from '@/lib/services/payment';
+
+// The flagship's gated MCP server mounted the Pages Router way: a catch-all API route at
+// pages/api/[transport].ts served at /api/mcp, wrapped in withMcpAuth with the same deterministic
+// stub verifier — the plugin detects both the mount and the auth wrapper textually, exactly as it
+// does for the App Router route.ts.
+const handler = createMcpHandler(
+  (server) => {
+    server.tool(
+      'get_seat_map',
+      'Get the seat map (cabins, seats, fees) for a specific flight.',
+      { flightId: z.string().describe('Flight id from search_flights results') },
+      async ({ flightId }) => {
+        const seatMap = getSeatMap(flightId);
+        if (!seatMap) {
+          return { content: [{ type: 'text', text: 'Unknown flight id.' }], isError: true };
+        }
+        return { content: [{ type: 'text', text: JSON.stringify(seatMap) }] };
+      },
+    );
+
+    server.tool(
+      'book_flight',
+      'Create a pending booking for a flight, fare class, and seat. Returns a bookingId and amount.',
+      {
+        flightId: z.string().describe('Flight id from search_flights'),
+        fareClass: z.string().describe("Fare class code, e.g. 'Y', 'W', 'J'"),
+        seatId: z.string().describe("Seat id from get_seat_map, e.g. '14C'"),
+        firstName: z.string().describe('Passenger first name'),
+        lastName: z.string().describe('Passenger last name'),
+        email: z.string().email().describe('Passenger email'),
+      },
+      async ({ flightId, fareClass, seatId, firstName, lastName, email }) => {
+        const result = createBooking({
+          flightId,
+          fareClass,
+          seatId,
+          passenger: { firstName, lastName, email },
+        });
+        if ('error' in result) {
+          return {
+            content: [{ type: 'text', text: `Could not book: ${result.error}` }],
+            isError: true,
+          };
+        }
+        return {
+          content: [
+            {
+              type: 'text',
+              text: JSON.stringify({ bookingId: result.bookingId, amount: result.amount }),
+            },
+          ],
+        };
+      },
+    );
+
+    server.tool(
+      'pay_booking',
+      'Pay for a pending booking and confirm it. Use test card 4242 4242 4242 4242; other cards decline.',
+      {
+        bookingId: z.string().describe('bookingId from book_flight'),
+        cardNumber: z.string().describe('Card number (test: 4242 4242 4242 4242)'),
+        expiry: z.string().describe('Card expiry MM/YY'),
+        cvv: z.string().describe('Card CVV'),
+        holderName: z.string().optional().describe('Cardholder name'),
+      },
+      async ({ bookingId, cardNumber, expiry, cvv, holderName }) => {
+        const booking = getBooking(bookingId);
+        if (!booking || booking.status !== 'pending') {
+          return {
+            content: [{ type: 'text', text: 'Unknown or non-pending booking.' }],
+            isError: true,
+          };
+        }
+        const charge = chargeCard(
+          { cardNumber, expiry, cvv, holderName: holderName ?? '' },
+          booking.amount,
+        );
+        if (!charge.success) {
+          return { content: [{ type: 'text', text: 'Payment declined.' }], isError: true };
+        }
+        const confirmed = confirmBooking(booking.bookingId, charge.paymentRef!);
+        if ('error' in confirmed) {
+          return {
+            content: [{ type: 'text', text: `Could not confirm: ${confirmed.error}` }],
+            isError: true,
+          };
+        }
+        return {
+          content: [
+            {
+              type: 'text',
+              text: JSON.stringify({ pnr: confirmed.pnr, bookingId: confirmed.bookingId }),
+            },
+          ],
+        };
+      },
+    );
+  },
+  { serverInfo: { name: 'ora-air-booking', version: '0.1.0' } },
+  { basePath: '/api', maxDuration: 60 },
+);
+
+const gatedHandler = withMcpAuth(
+  handler,
+  async (_req, bearerToken) => {
+    if (bearerToken !== 'flagship-test-token') return undefined;
+    return { token: bearerToken, clientId: 'flagship-pages-fixture', scopes: ['email', 'profile'] };
+  },
+  { required: true },
+);
+
+// mcp-handler produces a Web-standard `(Request) => Promise<Response>`; bridge it to the Pages
+// Router's `(req, res)` API-route signature.
+export const config = { api: { bodyParser: false } };
+
+export default async function apiHandler(req: NextApiRequest, res: NextApiResponse): Promise<void> {
+  const url = `https://${req.headers.host ?? 'localhost'}${req.url ?? '/api/mcp'}`;
+  const response = await gatedHandler(new Request(url, { method: req.method }));
+  res.status(response.status);
+  res.send(await response.text());
+}
diff --git a/fixtures/flagship-pages/pages/api/public/[transport].ts b/fixtures/flagship-pages/pages/api/public/[transport].ts
new file mode 100644
index 0000000..2f3b6c2
--- /dev/null
+++ b/fixtures/flagship-pages/pages/api/public/[transport].ts
@@ -0,0 +1,47 @@
+import { createMcpHandler } from 'mcp-handler';
+import type { NextApiRequest, NextApiResponse } from 'next';
+import { z } from 'zod';
+
+import { searchFlights } from '@/lib/services/search';
+
+// The flagship's public MCP server mounted the Pages Router way — unauthenticated, advertised as
+// an open surface, served at /api/public/mcp.
+const mcpHandler = createMcpHandler(
+  (server) => {
+    server.tool(
+      'search_flights',
+      'Search available flights between two cities on a date. To book, use the gated MCP server at /api/mcp.',
+      {
+        origin: z.string().describe("Origin city or airport, e.g. 'New York' or 'JFK'"),
+        destination: z
+          .string()
+          .describe("Destination city or airport, e.g. 'Los Angeles' or 'LAX'"),
+        date: z.string().describe('Departure date, ISO 8601 (YYYY-MM-DD)'),
+        passengers: z.number().int().min(1).max(9).default(1).describe('Number of passengers'),
+      },
+      async ({ origin, destination, date, passengers }) => {
+        const flights = searchFlights({ origin, destination, date, passengers });
+        if (!flights) {
+          return {
+            content: [{ type: 'text', text: 'No flights found for that route/date.' }],
+            isError: true,
+          };
+        }
+        return { content: [{ type: 'text', text: JSON.stringify(flights) }] };
+      },
+    );
+  },
+  { serverInfo: { name: 'ora-air-search', version: '0.1.0' } },
+  { basePath: '/api/public', maxDuration: 60 },
+);
+
+// mcp-handler produces a Web-standard `(Request) => Promise<Response>`; bridge it to the Pages
+// Router's `(req, res)` API-route signature.
+export const config = { api: { bodyParser: false } };
+
+export default async function apiHandler(req: NextApiRequest, res: NextApiResponse): Promise<void> {
+  const url = `https://${req.headers.host ?? 'localhost'}${req.url ?? '/api/public/mcp'}`;
+  const response = await mcpHandler(new Request(url, { method: req.method }));
+  res.status(response.status);
+  res.send(await response.text());
+}
diff --git a/fixtures/flagship-pages/pages/checkout.tsx b/fixtures/flagship-pages/pages/checkout.tsx
new file mode 100644
index 0000000..07d75c5
--- /dev/null
+++ b/fixtures/flagship-pages/pages/checkout.tsx
@@ -0,0 +1,18 @@
+import Head from 'next/head';
+import Link from 'next/link';
+
+export default function CheckoutPage() {
+  return (
+    <main>
+      <Head>
+        <title>Checkout — Ora Air</title>
+        <meta name="description" content="Pay for your pending booking with the demo test card." />
+      </Head>
+      <h1>Checkout</h1>
+      <p>
+        Pay with the test card 4242 4242 4242 4242 — any other number declines. A successful payment
+        lands on the <Link href="/confirmation">confirmation</Link> page.
+      </p>
+    </main>
+  );
+}
diff --git a/fixtures/flagship-pages/pages/confirmation.tsx b/fixtures/flagship-pages/pages/confirmation.tsx
new file mode 100644
index 0000000..9f2e7f6
--- /dev/null
+++ b/fixtures/flagship-pages/pages/confirmation.tsx
@@ -0,0 +1,18 @@
+import Head from 'next/head';
+import Link from 'next/link';
+
+export default function ConfirmationPage() {
+  return (
+    <main>
+      <Head>
+        <title>Booking confirmed — Ora Air</title>
+        <meta name="description" content="Your demo booking is confirmed, with a PNR to keep." />
+      </Head>
+      <h1>Booking confirmed</h1>
+      <p>
+        Your PNR and receipt live in <Link href="/account">your bookings</Link>. This is a demo: no
+        ticket was issued and no charge settled.
+      </p>
+    </main>
+  );
+}
diff --git a/fixtures/flagship-pages/pages/destinations/[slug].tsx b/fixtures/flagship-pages/pages/destinations/[slug].tsx
new file mode 100644
index 0000000..1c14eac
--- /dev/null
+++ b/fixtures/flagship-pages/pages/destinations/[slug].tsx
@@ -0,0 +1,35 @@
+import type { GetStaticPaths, GetStaticProps } from 'next';
+import Head from 'next/head';
+import Link from 'next/link';
+import { AIRPORTS, getAirport, type Airport } from '@/lib/data/airports';
+
+// Dynamic segment under a static parent — the Pages Router shape of the same scenario the
+// flagship covers with app/destinations/[slug]: the manifest records the /destinations prefix
+// and the middleware never claims "not found" beneath it.
+export const getStaticPaths: GetStaticPaths = () => ({
+  paths: AIRPORTS.map((airport) => ({ params: { slug: airport.code.toLowerCase() } })),
+  fallback: false,
+});
+
+export const getStaticProps: GetStaticProps<{ airport: Airport }> = ({ params }) => {
+  const airport = getAirport(String(params?.slug ?? ''));
+  if (!airport) return { notFound: true };
+  return { props: { airport } };
+};
+
+export default function DestinationPage({ airport }: { airport: Airport }) {
+  return (
+    <main>
+      <Head>
+        <title>{`${airport.city} (${airport.code}) — Ora Air destinations`}</title>
+      </Head>
+      <h1>
+        {airport.city} ({airport.code})
+      </h1>
+      <p>
+        Ora Air serves {airport.city} through {airport.name}, {airport.country}. Browse the{' '}
+        <Link href="/destinations">full route network</Link> or <Link href="/">search fares</Link>.
+      </p>
+    </main>
+  );
+}
diff --git a/fixtures/flagship-pages/pages/destinations/index.tsx b/fixtures/flagship-pages/pages/destinations/index.tsx
new file mode 100644
index 0000000..bd33ede
--- /dev/null
+++ b/fixtures/flagship-pages/pages/destinations/index.tsx
@@ -0,0 +1,51 @@
+import Head from 'next/head';
+import Link from 'next/link';
+import { AIRPORTS } from '@/lib/data/airports';
+
+// The route-network page, with the declarative WebMCP form: the tool is described by the form's
+// `toolname` attribute, read straight off the JSX, and the page URL (`/destinations`) is resolved
+// from the Pages Router file path.
+export default function DestinationsPage() {
+  return (
+    <main>
+      <Head>
+        <title>Destinations &amp; route network — Ora Air</title>
+        <meta
+          name="description"
+          content="All 12 Ora Air destinations — airports, cities, and countries we fly to."
+        />
+      </Head>
+      <h1>Where we fly</h1>
+      <p>Ora Air serves {AIRPORTS.length} airports. Every route is bookable one-way.</p>
+      <ul>
+        {AIRPORTS.map((airport) => (
+          <li key={airport.code}>
+            <Link href={`/destinations/${airport.code.toLowerCase()}`}>
+              {airport.code} — {airport.city}, {airport.name} ({airport.country})
+            </Link>
+          </li>
+        ))}
+      </ul>
+      <form
+        toolname="watch_route"
+        tooldescription="Get an email alert when fares drop on a route."
+        action="/api/watch"
+        method="post"
+      >
+        <label>
+          Origin
+          <input name="origin" required />
+        </label>
+        <label>
+          Destination
+          <input name="destination" required />
+        </label>
+        <label>
+          Email
+          <input name="email" type="email" required />
+        </label>
+        <button type="submit">Watch this route</button>
+      </form>
+    </main>
+  );
+}
diff --git a/fixtures/flagship-pages/pages/index.tsx b/fixtures/flagship-pages/pages/index.tsx
new file mode 100644
index 0000000..9a3c416
--- /dev/null
+++ b/fixtures/flagship-pages/pages/index.tsx
@@ -0,0 +1,25 @@
+import Head from 'next/head';
+import Link from 'next/link';
+
+export default function Home() {
+  return (
+    <main>
+      <Head>
+        <title>Ora Air — book demo flights</title>
+        <meta
+          name="description"
+          content="Demo airline for exercising agent booking flows: search fares, pick seats, and pay with a test card."
+        />
+      </Head>
+      <h1>Fly Ora Air</h1>
+      <p>
+        Search one-way fares across our route network, hold a seat, and pay with the test card.
+        Nothing here is real inventory and no charge ever settles.
+      </p>
+      <p>
+        Start with the <Link href="/destinations">route network</Link> or jump straight to{' '}
+        <Link href="/results">results</Link>.
+      </p>
+    </main>
+  );
+}
diff --git a/fixtures/flagship-pages/pages/results.tsx b/fixtures/flagship-pages/pages/results.tsx
new file mode 100644
index 0000000..fc6a25a
--- /dev/null
+++ b/fixtures/flagship-pages/pages/results.tsx
@@ -0,0 +1,18 @@
+import Head from 'next/head';
+import Link from 'next/link';
+
+export default function ResultsPage() {
+  return (
+    <main>
+      <Head>
+        <title>Flight results — Ora Air</title>
+        <meta name="description" content="Compare fares and pick a flight for your route." />
+      </Head>
+      <h1>Flight results</h1>
+      <p>
+        Fares are generated per route and date in this demo. Pick a flight, then choose a{' '}
+        <Link href="/seats">seat</Link>.
+      </p>
+    </main>
+  );
+}
diff --git a/fixtures/flagship-pages/pages/seats.tsx b/fixtures/flagship-pages/pages/seats.tsx
new file mode 100644
index 0000000..7288d2d
--- /dev/null
+++ b/fixtures/flagship-pages/pages/seats.tsx
@@ -0,0 +1,18 @@
+import Head from 'next/head';
+import Link from 'next/link';
+
+export default function SeatsPage() {
+  return (
+    <main>
+      <Head>
+        <title>Choose your seat — Ora Air</title>
+        <meta name="description" content="Pick a seat from the cabin map before payment." />
+      </Head>
+      <h1>Choose your seat</h1>
+      <p>
+        Every fare class permits seat selection before payment. Continue to{' '}
+        <Link href="/checkout">checkout</Link> once you have picked one.
+      </p>
+    </main>
+  );
+}
diff --git a/fixtures/mcp-multi-server/report.golden.json b/fixtures/flagship-pages/report.golden.json
similarity index 59%
rename from fixtures/mcp-multi-server/report.golden.json
rename to fixtures/flagship-pages/report.golden.json
index 4513c6a..d207152 100644
--- a/fixtures/mcp-multi-server/report.golden.json
+++ b/fixtures/flagship-pages/report.golden.json
@@ -1,24 +1,30 @@
 {
   "generatedAt": "<generatedAt>",
-  "siteUrl": "https://mcp-multi-fixture.example.com",
+  "siteUrl": "https://flagship-pages-fixture.example.com",
   "basePath": "",
   "routers": [
-    "app"
+    "pages"
   ],
   "catalog": {
-    "entryCount": 2,
+    "entryCount": 3,
     "entries": [
       {
-        "identifier": "urn:air:mcp-multi-fixture.example.com:mcp-server:api-public-mcp",
+        "identifier": "urn:air:flagship-pages-fixture.example.com:mcp-server:api-mcp",
         "type": "application/mcp-server-card+json",
-        "url": "https://mcp-multi-fixture.example.com/.well-known/mcp/server-card.json",
+        "url": "https://flagship-pages-fixture.example.com/.well-known/mcp/server-card/api-mcp.json",
         "displayName": "MCP server"
       },
       {
-        "identifier": "urn:air:mcp-multi-fixture.example.com:mcp-server:api-mcp",
+        "identifier": "urn:air:flagship-pages-fixture.example.com:mcp-server:api-public-mcp",
         "type": "application/mcp-server-card+json",
-        "url": "https://mcp-multi-fixture.example.com/.well-known/mcp/server-card/api-mcp.json",
+        "url": "https://flagship-pages-fixture.example.com/.well-known/mcp/server-card.json",
         "displayName": "MCP server"
+      },
+      {
+        "identifier": "urn:air:flagship-pages-fixture.example.com:webmcp:destinations",
+        "type": "text/html",
+        "url": "https://flagship-pages-fixture.example.com/destinations",
+        "displayName": "WebMCP tools (/destinations)"
       }
     ],
     "path": "public/.well-known/ai-catalog.json",
@@ -27,21 +33,21 @@
   "mcp": {
     "mounts": [
       {
-        "pathname": "/api/public/mcp",
+        "pathname": "/api/mcp",
         "tools": [
-          "search_menu"
+          "get_seat_map",
+          "book_flight",
+          "pay_booking"
         ]
       },
       {
-        "pathname": "/api/mcp",
+        "pathname": "/api/public/mcp",
         "tools": [
-          "place_order"
+          "search_flights"
         ]
       }
     ],
-    "unreviewedMounts": [
-      "/api/public/mcp"
-    ],
+    "unreviewedMounts": [],
     "primaryMount": "/api/public/mcp",
     "serverCardPath": "public/.well-known/mcp/server-card.json",
     "serverCards": [
@@ -56,14 +62,20 @@
     ]
   },
   "agent404": {
-    "notFoundPresent": false,
+    "notFoundPresent": true,
     "agentAware": false,
-    "pages": [],
+    "pages": [
+      {
+        "source": "pages/404.tsx",
+        "agentAware": false
+      }
+    ],
     "markdownGuide": "public/404.md"
   },
   "middleware": {
-    "present": false,
-    "wiredToAx": false
+    "present": true,
+    "wiredToAx": true,
+    "source": "middleware.ts"
   },
   "artifacts": {
     "robotsTxt": {
@@ -89,10 +101,10 @@
     "gatedSurfaces": [
       {
         "path": "/api/mcp",
-        "status": "unknown",
-        "declared": false,
+        "status": "oauth2",
+        "declared": true,
         "oauthEndpoints": false,
-        "note": "Gated but the scheme is undeclared — declare entries[].auth in ax.config (the ax init wizard collects this) so agents know how to authenticate."
+        "docsUrl": "https://flagship-pages-fixture.example.com/agents.md"
       }
     ]
   },
@@ -105,11 +117,43 @@
         "path": "public/index.md",
         "tier": 2,
         "source": "prerender"
+      },
+      {
+        "route": "/destinations",
+        "path": "public/destinations.md",
+        "tier": 2,
+        "source": "prerender"
       }
     ],
     "userOwned": [],
-    "skipped": [],
-    "dynamicRouteCount": 0,
+    "skipped": [
+      {
+        "route": "/account",
+        "reason": "gated",
+        "detail": "The route is gated (isGated), and a gated page’s prerender is typically a login shell — deriving a twin from it would publish a converted login page as the page’s content."
+      },
+      {
+        "route": "/checkout",
+        "reason": "too-little-text",
+        "detail": "The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker)."
+      },
+      {
+        "route": "/confirmation",
+        "reason": "too-little-text",
+        "detail": "The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker)."
+      },
+      {
+        "route": "/results",
+        "reason": "too-little-text",
+        "detail": "The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker)."
+      },
+      {
+        "route": "/seats",
+        "reason": "too-little-text",
+        "detail": "The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker)."
+      }
+    ],
+    "dynamicRouteCount": 1,
     "deleted": [],
     "authMd": {
       "path": "public/auth.md",
@@ -120,51 +164,58 @@
     {
       "artifact": "ai-catalog.json",
       "path": "public/.well-known/ai-catalog.json",
-      "bytes": 960,
-      "chars": 960,
-      "tokens": 240
+      "bytes": 1624,
+      "chars": 1622,
+      "tokens": 406
     },
     {
       "artifact": "mcp-server-card",
       "path": "public/.well-known/mcp/server-card.json",
-      "bytes": 655,
-      "chars": 655,
-      "tokens": 164
+      "bytes": 674,
+      "chars": 674,
+      "tokens": 169
     },
     {
       "artifact": "mcp-server-card",
       "path": "public/.well-known/mcp/server-card/api-public-mcp.json",
-      "bytes": 655,
-      "chars": 655,
-      "tokens": 164
+      "bytes": 674,
+      "chars": 674,
+      "tokens": 169
     },
     {
       "artifact": "mcp-server-card",
       "path": "public/.well-known/mcp/server-card/api-mcp.json",
-      "bytes": 770,
-      "chars": 770,
-      "tokens": 193
+      "bytes": 767,
+      "chars": 767,
+      "tokens": 192
     },
     {
       "artifact": "markdown-twin",
       "path": "public/index.md",
-      "bytes": 528,
-      "chars": 526,
-      "tokens": 132
+      "bytes": 539,
+      "chars": 537,
+      "tokens": 134
+    },
+    {
+      "artifact": "markdown-twin",
+      "path": "public/destinations.md",
+      "bytes": 1327,
+      "chars": 1299,
+      "tokens": 325
     },
     {
       "artifact": "auth.md",
       "path": "public/auth.md",
-      "bytes": 962,
-      "chars": 956,
-      "tokens": 239
+      "bytes": 660,
+      "chars": 656,
+      "tokens": 164
     },
     {
       "artifact": "404.md",
       "path": "public/404.md",
-      "bytes": 924,
-      "chars": 912,
-      "tokens": 228
+      "bytes": 1111,
+      "chars": 1097,
+      "tokens": 274
     }
   ],
   "ora": {
@@ -252,34 +303,37 @@
       {
         "id": "mcp-auth-mechanism",
         "artifact": "auth-declaration",
+        "status": "addressed"
+      },
+      {
+        "id": "oauth-protected-resource",
+        "artifact": "oauth-metadata",
         "status": "actionable",
-        "note": "A gated surface publishes auth.status \"unknown\" — declare entries[].auth in ax.config (the ax init wizard collects this) so agents know the scheme."
+        "note": "OAuth is declared but no RFC 9728 protected-resource metadata is wired, so agents can't discover the authorization server. Add your provider's protected-resource route (see report.auth.provider) or a static /.well-known/oauth-protected-resource document."
       },
       {
         "id": "markdown-negotiation",
         "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
+        "status": "addressed"
       },
       {
         "id": "markdown-negotiation-vary",
         "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
+        "status": "addressed"
       }
     ]
   },
   "warnings": [],
   "recommendations": [
     "No OpenAPI doc found (public/openapi.json) — an OpenAPI doc lets agents understand and call your API without guessing at routes or schemas. ax never generates one; produce it however your API is defined (many schema/validation libraries can emit OpenAPI from your existing route definitions) and commit the result to public/openapi.json.",
+    "1 page file has dynamic URL segments, so no markdown twins exist for them (no build-time HTML, and ax never guesses URLs). To give those pages a markdown representation, add a markdown source per page or prerender representative routes.",
     "No llms.txt found — a short natural-language guide agents read to decide whether your site fits their task, and to find your key pages. Add one at app/llms.txt/route.ts (or public/llms.txt), or set scaffoldLlmsTxt: true in ax.config to have a starter written for you. Pair it with JSON-LD structured data (an Organization block with a sameAs array): llms.txt says what your site is for, JSON-LD identifies it as an entity registries can rank — the two reinforce each other, so add both rather than one alone.",
     "No sitemap found — add one so agents can discover all public routes. Use the built-in Next.js path (app/sitemap.ts); ax never generates a sitemap itself. Give each entry a <lastmod> date (agents use it to judge freshness), then reference it from robots.txt with a \"Sitemap:\" line.",
     "No robots.txt found — add one (app/robots.ts or public/robots.txt) that explicitly Allows the reputable AI agents you want to reach, scoped to specific User-agent groups (never \"User-agent: *\"), plus a \"Sitemap:\" line. Note: Next's MetadataRoute.Robots (app/robots.ts) has no field for the \"Agentmap:\" catalog pointer — put that line in a static public/robots.txt. Set scaffoldRobots: true in ax.config to have one written for you.",
     "No agents.md found — consider adding one (public/agents.md) with when-to-use / when-NOT-to-use guidance for agents. ax won't write its content for you; the companion skill can help author it from your repo.",
     "No JSON-LD structured data found in your layouts/pages — structured data is how registries and agents disambiguate and rank your site. Add an Organization block in your root layout <head> (<script type=\"application/ld+json\">) with a \"sameAs\" array linking your LinkedIn/GitHub/npm/social profiles (the entity-disambiguation signal registries value), and at least one more schema.org @type beyond Organization — SoftwareApplication or Product for an app/API, or a FAQPage — since covering more types helps registries understand your site more fully. JSON-LD pairs with an llms.txt: llms.txt tells agents what your site is for, JSON-LD identifies it as an entity registries can rank — add both, not one alone. ax won’t author the block (the fields are judgment content); the companion skill can help draft it from your repo.",
     "Gated routes should keep their honest 401/403 status and point agents at the auth guide: add a WWW-Authenticate header and a Link (or body) pointer to /auth.md in your gated route handlers. A 200 \"this is gated\" page is a soft auth wall agents are built to distrust; ax generates the guide but never rewrites your handlers.",
-    "Markdown twins exist for your pages — link each HTML page to its twin so crawlers find the machine-readable version. Add this to the page <head> (ax prints the tag; it never edits your layout): <link rel=\"alternate\" type=\"text/markdown\" href=\"https://mcp-multi-fixture.example.com/index.md\" />",
-    "No app/not-found.tsx found — agents that hit a missing URL get Next.js’s bare default 404, a dead end that makes them give up or guess. Add a standard 404 page in your own design system (a clear “page not found” and a way back home), and include `<link rel=\"alternate\" type=\"text/markdown\" href=\"/404.md\" />` so agents can hop from it to /404.md — the generated wayfinding guide (real routes + discovery links) this build writes. Rendered in the page’s JSX, React hoists the tag into <head> (App Router); use next/head in the Pages Router.",
-    "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
+    "Markdown twins exist for your pages — link each HTML page to its twin so crawlers find the machine-readable version. Add this to the page <head> (ax prints the tag; it never edits your layout): <link rel=\"alternate\" type=\"text/markdown\" href=\"https://flagship-pages-fixture.example.com/destinations.md\" />",
+    "pages/404.tsx doesn’t point agents anywhere — an agent hitting a 404 needs to know why (the URL doesn’t exist; retrying won’t help) and how to continue. Add `<link rel=\"alternate\" type=\"text/markdown\" href=\"/404.md\" />` to it so agents can hop to /404.md — the generated wayfinding guide (real routes + discovery links) this build writes. The tag is invisible to human visitors, and your page stays yours — ax never edits it."
   ]
 }
diff --git a/fixtures/mcp-adapter/tsconfig.json b/fixtures/flagship-pages/tsconfig.json
similarity index 68%
rename from fixtures/mcp-adapter/tsconfig.json
rename to fixtures/flagship-pages/tsconfig.json
index 9666dbd..d15525a 100644
--- a/fixtures/mcp-adapter/tsconfig.json
+++ b/fixtures/flagship-pages/tsconfig.json
@@ -1,5 +1,10 @@
 {
   "extends": "../tsconfig.next.json",
+  "compilerOptions": {
+    "paths": {
+      "@/*": ["./*"]
+    }
+  },
   "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
   "exclude": ["node_modules"]
 }
diff --git a/fixtures/mcp-multi-server/twins.golden/404.md b/fixtures/flagship-pages/twins.golden/404.md
similarity index 73%
rename from fixtures/mcp-multi-server/twins.golden/404.md
rename to fixtures/flagship-pages/twins.golden/404.md
index f1a6c33..1d5e37d 100644
--- a/fixtures/mcp-multi-server/twins.golden/404.md
+++ b/fixtures/flagship-pages/twins.golden/404.md
@@ -1,7 +1,7 @@
 ---
-title: "Page not found — mcp-multi-server"
+title: "Page not found — flagship-pages"
 description: "Where to continue when a URL on this site does not exist: discovery links and real routes."
-canonical_url: https://mcp-multi-fixture.example.com/404.md
+canonical_url: https://flagship-pages-fixture.example.com/404.md
 last_updated: <last_updated>
 generated-by: "@ora-ai/ax"
 ---
@@ -21,3 +21,8 @@ below instead.
 ## Pages that do exist
 
 - [/](/) — markdown: [/index.md](/index.md)
+- [/checkout](/checkout)
+- [/confirmation](/confirmation)
+- [/destinations](/destinations) — markdown: [/destinations.md](/destinations.md)
+- [/results](/results)
+- [/seats](/seats)
diff --git a/fixtures/flagship-pages/twins.golden/auth.md b/fixtures/flagship-pages/twins.golden/auth.md
new file mode 100644
index 0000000..d1520c2
--- /dev/null
+++ b/fixtures/flagship-pages/twins.golden/auth.md
@@ -0,0 +1,18 @@
+---
+title: "Authentication — flagship-pages"
+description: "How to obtain access to the gated surfaces on this site."
+canonical_url: https://flagship-pages-fixture.example.com/auth.md
+last_updated: <last_updated>
+generated-by: "@ora-ai/ax"
+---
+
+# Authentication
+
+flagship-pages has 1 gated surface. This document is generated at build time from the site's own committed auth declarations — it describes how to authenticate and never contains credentials.
+
+## MCP server at /api/mcp
+
+An MCP (Model Context Protocol) server. Connecting requires authentication.
+
+- Auth: OAuth 2.0
+- Get access: <https://flagship-pages-fixture.example.com/agents.md>
diff --git a/fixtures/flagship-pages/twins.golden/destinations.md b/fixtures/flagship-pages/twins.golden/destinations.md
new file mode 100644
index 0000000..6247d7d
--- /dev/null
+++ b/fixtures/flagship-pages/twins.golden/destinations.md
@@ -0,0 +1,26 @@
+---
+title: "Destinations & route network — Ora Air"
+description: "All 12 Ora Air destinations — airports, cities, and countries we fly to."
+canonical_url: https://flagship-pages-fixture.example.com/destinations
+last_updated: <last_updated>
+generated-by: "@ora-ai/ax"
+---
+
+# Where we fly
+
+Ora Air serves 12 airports. Every route is bookable one-way.
+
+-   [JFK — New York, John F. Kennedy International (United States)](/destinations/jfk)
+-   [LAX — Los Angeles, Los Angeles International (United States)](/destinations/lax)
+-   [SFO — San Francisco, San Francisco International (United States)](/destinations/sfo)
+-   [MIA — Miami, Miami International (United States)](/destinations/mia)
+-   [ORD — Chicago, O'Hare International (United States)](/destinations/ord)
+-   [SEA — Seattle, Seattle-Tacoma International (United States)](/destinations/sea)
+-   [LHR — London, Heathrow (United Kingdom)](/destinations/lhr)
+-   [CDG — Paris, Charles de Gaulle (France)](/destinations/cdg)
+-   [TLV — Tel Aviv, Ben Gurion (Israel)](/destinations/tlv)
+-   [NRT — Tokyo, Narita International (Japan)](/destinations/nrt)
+-   [SIN — Singapore, Changi (Singapore)](/destinations/sin)
+-   [DXB — Dubai, Dubai International (United Arab Emirates)](/destinations/dxb)
+
+OriginDestinationEmailWatch this route
diff --git a/fixtures/flagship-pages/twins.golden/index.md b/fixtures/flagship-pages/twins.golden/index.md
new file mode 100644
index 0000000..daa00ff
--- /dev/null
+++ b/fixtures/flagship-pages/twins.golden/index.md
@@ -0,0 +1,13 @@
+---
+title: "Ora Air — book demo flights"
+description: "Demo airline for exercising agent booking flows: search fares, pick seats, and pay with a test card."
+canonical_url: https://flagship-pages-fixture.example.com/
+last_updated: <last_updated>
+generated-by: "@ora-ai/ax"
+---
+
+# Fly Ora Air
+
+Search one-way fares across our route network, hold a seat, and pay with the test card. Nothing here is real inventory and no charge ever settles.
+
+Start with the [route network](/destinations) or jump straight to [results](/results).
diff --git a/fixtures/pages-webmcp-declarative/types/webmcp-forms.d.ts b/fixtures/flagship-pages/types/webmcp-forms.d.ts
similarity index 100%
rename from fixtures/pages-webmcp-declarative/types/webmcp-forms.d.ts
rename to fixtures/flagship-pages/types/webmcp-forms.d.ts
diff --git a/fixtures/flagship/README.md b/fixtures/flagship/README.md
new file mode 100644
index 0000000..2189d33
--- /dev/null
+++ b/fixtures/flagship/README.md
@@ -0,0 +1,42 @@
+# fixture: flagship
+
+The corpus's representative app — a fork of the ora-air flight-booking demo, enriched until it
+exercises most detectors in one real build. Where the other fixtures each isolate one behavior,
+this one proves the behaviors compose: middleware negotiation + gating + two MCP servers +
+hand-owned discovery artifacts coexisting in a single `next build`.
+
+What it ships, and the detection path each piece exercises:
+
+- **Pages across the twin ladder** — `/` and `/destinations` are prerendered server components
+  (content twins); `/results`, `/seats`, `/checkout`, `/confirmation` are metadata-wrapped client
+  pages; `/guide` is a mostly-markdown `page.mdx` (`@next/mdx` Tier-1).
+- **`/destinations` twin is committed and hand-authored** (`public/destinations.md`, no
+  `generated-by` marker) — ax records it as the markdown source and never overwrites it, and the
+  first build's manifest already lists it, which is what the dual-fetch dogfood probes against.
+- **`/destinations/[slug]`** — dynamic segment: the manifest records the `/destinations` prefix
+  and the middleware never claims "not found" beneath it.
+- **`/account`** — gated via `ax.config` `isGated`: in `gatedPaths`, middleware falls through
+  untouched, and the gate surfaces in `/auth.md`.
+- **Two `mcp-handler` servers** — `/api/public/mcp` open (`search_flights`), `/api/mcp` gated via
+  `withMcpAuth` with a deterministic stub verifier (multi-server card plan, `authentication`
+  block, gated-entry auth declared `oauth2` in `ax.config`).
+- **OAuth discovery chain** — static RFC 9728 + RFC 8414 documents under `app/.well-known/`, so
+  the 401 → protected-resource → authorization-server walk is complete without any real identity
+  provider (the demo this was forked from uses Clerk; the fixture must build with zero secrets).
+- **Hand-owned artifacts detected, not scaffolded** — `app/llms.txt/route.ts`, `public/agents.md`,
+  `public/openapi.json`, `app/organization-json-ld.tsx` rendered from the layout, `app/sitemap.ts`,
+  and a committed `robots.txt` that `scaffoldRobots: true` appends discovery pointers to
+  (append-only, exercised by the idempotence mutation test).
+- **Middleware wired for real** — `withAx({ manifest }, botGate)`: the composed-second-argument
+  form, proven through Edge bundling by `next build` and live by `scripts/dogfood-middleware.mjs`.
+
+**Exercises:** detector composition under one roof — the serving manifest (twins/gating/dynamic
+prefixes), multi-server MCP cards, declared entry auth, detect-and-reference for every hand-owned
+artifact, and the report/twin/card goldens for all of it. Also the base app for the mutation
+harness (`scripts/mutation-tests.mjs`), which copies it to a tmp dir and rebuilds it after
+scripted edits.
+
+**Reviewing golden diffs:** `report.golden.json` is large because this fixture exercises most of
+the corpus's detectors in one build. When a PR churns it, read the diff by section — `mcp`,
+`catalog`, `auth`, `markdownTwins`, `ora.checks` — rather than as one blob; a change should touch
+only the sections its feature owns.
diff --git a/fixtures/flagship/app/.well-known/oauth-authorization-server/route.ts b/fixtures/flagship/app/.well-known/oauth-authorization-server/route.ts
new file mode 100644
index 0000000..ed55a3a
--- /dev/null
+++ b/fixtures/flagship/app/.well-known/oauth-authorization-server/route.ts
@@ -0,0 +1,36 @@
+import { NextResponse } from 'next/server';
+
+// RFC 8414 authorization-server metadata served from this origin, for MCP clients that look for
+// the sign-in flow on the resource server's own domain. Static and deterministic: the endpoints
+// point at routes that don't exist because no fixture test ever drives a real OAuth handshake —
+// what matters is that the discovery chain (401 → RFC 9728 → this document) is fully walkable.
+const SITE_URL = 'https://flagship-fixture.example.com';
+
+const metadata = {
+  issuer: SITE_URL,
+  authorization_endpoint: `${SITE_URL}/oauth/authorize`,
+  token_endpoint: `${SITE_URL}/oauth/token`,
+  registration_endpoint: `${SITE_URL}/oauth/register`,
+  response_types_supported: ['code'],
+  grant_types_supported: ['authorization_code', 'refresh_token'],
+  code_challenge_methods_supported: ['S256'],
+  token_endpoint_auth_methods_supported: ['none', 'client_secret_basic'],
+  scopes_supported: ['email', 'profile'],
+};
+
+export function GET(): NextResponse {
+  return NextResponse.json(metadata, {
+    headers: { 'access-control-allow-origin': '*' },
+  });
+}
+
+export function OPTIONS(): NextResponse {
+  return new NextResponse(null, {
+    status: 204,
+    headers: {
+      'access-control-allow-origin': '*',
+      'access-control-allow-methods': 'GET, OPTIONS',
+      'access-control-allow-headers': '*',
+    },
+  });
+}
diff --git a/fixtures/flagship/app/.well-known/oauth-protected-resource/route.ts b/fixtures/flagship/app/.well-known/oauth-protected-resource/route.ts
new file mode 100644
index 0000000..0836487
--- /dev/null
+++ b/fixtures/flagship/app/.well-known/oauth-protected-resource/route.ts
@@ -0,0 +1,32 @@
+import { NextResponse } from 'next/server';
+
+// RFC 9728 protected-resource metadata for the gated MCP server — the discovery document MCP
+// clients fetch after a 401 to learn which authorization server to talk to. A real app would
+// derive this from its identity provider; the fixture serves a static, deterministic document
+// naming this origin's own stub authorization-server metadata.
+const SITE_URL = 'https://flagship-fixture.example.com';
+
+const metadata = {
+  resource: `${SITE_URL}/api/mcp`,
+  authorization_servers: [SITE_URL],
+  bearer_methods_supported: ['header'],
+  scopes_supported: ['email', 'profile'],
+  resource_documentation: `${SITE_URL}/agents.md`,
+};
+
+export function GET(): NextResponse {
+  return NextResponse.json(metadata, {
+    headers: { 'access-control-allow-origin': '*' },
+  });
+}
+
+export function OPTIONS(): NextResponse {
+  return new NextResponse(null, {
+    status: 204,
+    headers: {
+      'access-control-allow-origin': '*',
+      'access-control-allow-methods': 'GET, OPTIONS',
+      'access-control-allow-headers': '*',
+    },
+  });
+}
diff --git a/fixtures/flagship/app/account/page.tsx b/fixtures/flagship/app/account/page.tsx
new file mode 100644
index 0000000..fafa333
--- /dev/null
+++ b/fixtures/flagship/app/account/page.tsx
@@ -0,0 +1,21 @@
+import type { Metadata } from 'next';
+
+// Gated page route: listed in ax.config's isGated matcher, so it lands in the serving manifest's
+// gatedPaths and the middleware falls through untouched for agents too — the app's auth answer
+// stays the honest one. The page itself is a plain sign-in wall; no real auth flow exists here.
+export const metadata: Metadata = {
+  title: 'My bookings — Ora Air',
+  description: 'Sign in to view and manage your Ora Air bookings.',
+};
+
+export default function AccountPage() {
+  return (
+    <div className="mx-auto max-w-6xl px-6 py-14">
+      <h1 className="text-3xl font-semibold text-ink">Sign in to view your bookings</h1>
+      <p className="mt-3 max-w-2xl text-[15px] leading-relaxed text-mist">
+        Your bookings, receipts, and saved travelers live behind sign-in. Use the email address from
+        your confirmation to receive a one-time sign-in link.
+      </p>
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/api/[transport]/route.ts b/fixtures/flagship/app/api/[transport]/route.ts
new file mode 100644
index 0000000..1c57c83
--- /dev/null
+++ b/fixtures/flagship/app/api/[transport]/route.ts
@@ -0,0 +1,126 @@
+import { createMcpHandler, withMcpAuth } from 'mcp-handler';
+import { z } from 'zod';
+
+import { getSeatMap } from '@/lib/data/seatmaps';
+import { createBooking, getBooking, confirmBooking } from '@/lib/services/booking';
+import { chargeCard } from '@/lib/services/payment';
+
+// Gated MCP server — seat maps, booking, and payment. Auth is required so ax advertises
+// this as a gated surface (withMcpAuth) while /api/public/mcp stays public. Agents authenticate
+// via OAuth: a 401 here points at the RFC 9728 metadata (/.well-known/oauth-protected-resource).
+// The verifier is a deterministic stub (one fixed test token) — no fixture test drives a real
+// OAuth handshake; what's under test is the static withMcpAuth detection and the discovery chain.
+const handler = createMcpHandler(
+  (server) => {
+    server.tool(
+      'get_seat_map',
+      'Get the seat map (cabins, seats, fees) for a specific flight.',
+      {
+        flightId: z.string().describe('Flight id from search_flights results'),
+      },
+      async ({ flightId }) => {
+        const seatMap = getSeatMap(flightId);
+        if (!seatMap) {
+          return { content: [{ type: 'text', text: 'Unknown flight id.' }], isError: true };
+        }
+        return { content: [{ type: 'text', text: JSON.stringify(seatMap) }] };
+      },
+    );
+
+    server.tool(
+      'book_flight',
+      'Create a pending booking for a flight, fare class, and seat. Returns a bookingId and amount.',
+      {
+        flightId: z.string().describe('Flight id from search_flights'),
+        fareClass: z.string().describe("Fare class code, e.g. 'Y', 'W', 'J'"),
+        seatId: z.string().describe("Seat id from get_seat_map, e.g. '14C'"),
+        firstName: z.string().describe('Passenger first name'),
+        lastName: z.string().describe('Passenger last name'),
+        email: z.string().email().describe('Passenger email'),
+      },
+      async ({ flightId, fareClass, seatId, firstName, lastName, email }) => {
+        const result = createBooking({
+          flightId,
+          fareClass,
+          seatId,
+          passenger: { firstName, lastName, email },
+        });
+        if ('error' in result) {
+          return {
+            content: [{ type: 'text', text: `Could not book: ${result.error}` }],
+            isError: true,
+          };
+        }
+        return {
+          content: [
+            {
+              type: 'text',
+              text: JSON.stringify({ bookingId: result.bookingId, amount: result.amount }),
+            },
+          ],
+        };
+      },
+    );
+
+    server.tool(
+      'pay_booking',
+      'Pay for a pending booking and confirm it. Use test card 4242 4242 4242 4242; other cards decline.',
+      {
+        bookingId: z.string().describe('bookingId from book_flight'),
+        cardNumber: z.string().describe('Card number (test: 4242 4242 4242 4242)'),
+        expiry: z.string().describe('Card expiry MM/YY'),
+        cvv: z.string().describe('Card CVV'),
+        holderName: z.string().optional().describe('Cardholder name'),
+      },
+      async ({ bookingId, cardNumber, expiry, cvv, holderName }) => {
+        const booking = getBooking(bookingId);
+        if (!booking || booking.status !== 'pending') {
+          return {
+            content: [{ type: 'text', text: 'Unknown or non-pending booking.' }],
+            isError: true,
+          };
+        }
+        const charge = chargeCard(
+          { cardNumber, expiry, cvv, holderName: holderName ?? '' },
+          booking.amount,
+        );
+        if (!charge.success) {
+          return { content: [{ type: 'text', text: 'Payment declined.' }], isError: true };
+        }
+        const confirmed = confirmBooking(booking.bookingId, charge.paymentRef!);
+        if ('error' in confirmed) {
+          return {
+            content: [{ type: 'text', text: `Could not confirm: ${confirmed.error}` }],
+            isError: true,
+          };
+        }
+        return {
+          content: [
+            {
+              type: 'text',
+              text: JSON.stringify({ pnr: confirmed.pnr, bookingId: confirmed.bookingId }),
+            },
+          ],
+        };
+      },
+    );
+  },
+  {
+    serverInfo: { name: 'ora-air-booking', version: '0.1.0' },
+  },
+  {
+    basePath: '/api',
+    maxDuration: 60,
+  },
+);
+
+const gatedHandler = withMcpAuth(
+  handler,
+  async (_req, bearerToken) => {
+    if (bearerToken !== 'flagship-test-token') return undefined;
+    return { token: bearerToken, clientId: 'flagship-fixture', scopes: ['email', 'profile'] };
+  },
+  { required: true, resourceMetadataPath: '/.well-known/oauth-protected-resource' },
+);
+
+export { gatedHandler as GET, gatedHandler as POST, gatedHandler as DELETE };
diff --git a/fixtures/flagship/app/api/book/route.ts b/fixtures/flagship/app/api/book/route.ts
new file mode 100644
index 0000000..a732aca
--- /dev/null
+++ b/fixtures/flagship/app/api/book/route.ts
@@ -0,0 +1,35 @@
+import { NextResponse } from 'next/server';
+import { createBooking } from '@/lib/services/booking';
+import { guard, badRequest, backendDelay } from '@/lib/services/api-guard';
+
+export async function POST(request: Request) {
+  const denied = guard(request);
+  if (denied) return denied;
+
+  let body: { f?: string; c?: string; s?: string; px?: { fn?: string; ln?: string; em?: string } };
+  try {
+    body = await request.json();
+  } catch {
+    return badRequest();
+  }
+  if (!body.f || !body.c || !body.s || !body.px) return badRequest();
+
+  await backendDelay();
+
+  const result = createBooking({
+    flightId: body.f,
+    fareClass: body.c,
+    seatId: body.s,
+    passenger: {
+      firstName: body.px.fn ?? '',
+      lastName: body.px.ln ?? '',
+      email: body.px.em ?? '',
+    },
+  });
+  if ('error' in result) return badRequest();
+
+  return NextResponse.json(
+    { b: result.bookingId, a: result.amount },
+    { headers: { 'cache-control': 'no-store' } },
+  );
+}
diff --git a/fixtures/flagship/app/api/pay/route.ts b/fixtures/flagship/app/api/pay/route.ts
new file mode 100644
index 0000000..5cbf275
--- /dev/null
+++ b/fixtures/flagship/app/api/pay/route.ts
@@ -0,0 +1,37 @@
+import { NextResponse } from 'next/server';
+import { getBooking, confirmBooking } from '@/lib/services/booking';
+import { chargeCard } from '@/lib/services/payment';
+import { guard, badRequest, backendDelay } from '@/lib/services/api-guard';
+
+export async function POST(request: Request) {
+  const denied = guard(request);
+  if (denied) return denied;
+
+  let body: { b?: string; cn?: string; ex?: string; cv?: string; nm?: string };
+  try {
+    body = await request.json();
+  } catch {
+    return badRequest();
+  }
+  if (!body.b || !body.cn || !body.ex || !body.cv) return badRequest();
+
+  await backendDelay();
+
+  const booking = getBooking(body.b);
+  if (!booking || booking.status !== 'pending') return badRequest();
+
+  const charge = chargeCard(
+    { cardNumber: body.cn, expiry: body.ex, cvv: body.cv, holderName: body.nm ?? '' },
+    booking.amount,
+  );
+  // Vague on purpose: no decline reason reaches the client.
+  if (!charge.success) return NextResponse.json({ e: 'ERR' }, { status: 400 });
+
+  const confirmed = confirmBooking(booking.bookingId, charge.paymentRef!);
+  if ('error' in confirmed) return badRequest();
+
+  return NextResponse.json(
+    { p: confirmed.pnr, b: confirmed.bookingId },
+    { headers: { 'cache-control': 'no-store' } },
+  );
+}
diff --git a/fixtures/flagship/app/api/public/[transport]/route.ts b/fixtures/flagship/app/api/public/[transport]/route.ts
new file mode 100644
index 0000000..291ff22
--- /dev/null
+++ b/fixtures/flagship/app/api/public/[transport]/route.ts
@@ -0,0 +1,42 @@
+import { createMcpHandler } from 'mcp-handler';
+import { z } from 'zod';
+
+import { searchFlights } from '@/lib/services/search';
+
+// Public MCP server — unauthenticated, advertised as an open surface. Booking tools live
+// on the gated server at /api/gated/mcp so ax can gate that surface without hiding search.
+const handler = createMcpHandler(
+  (server) => {
+    server.tool(
+      'search_flights',
+      'Search available flights between two cities on a date. To book, use the gated MCP server at /api/gated/mcp.',
+      {
+        origin: z.string().describe("Origin city or airport, e.g. 'New York' or 'JFK'"),
+        destination: z
+          .string()
+          .describe("Destination city or airport, e.g. 'Los Angeles' or 'LAX'"),
+        date: z.string().describe('Departure date, ISO 8601 (YYYY-MM-DD)'),
+        passengers: z.number().int().min(1).max(9).default(1).describe('Number of passengers'),
+      },
+      async ({ origin, destination, date, passengers }) => {
+        const flights = searchFlights({ origin, destination, date, passengers });
+        if (!flights) {
+          return {
+            content: [{ type: 'text', text: 'No flights found for that route/date.' }],
+            isError: true,
+          };
+        }
+        return { content: [{ type: 'text', text: JSON.stringify(flights) }] };
+      },
+    );
+  },
+  {
+    serverInfo: { name: 'ora-air-search', version: '0.1.0' },
+  },
+  {
+    basePath: '/api/public',
+    maxDuration: 60,
+  },
+);
+
+export { handler as GET, handler as POST, handler as DELETE };
diff --git a/fixtures/flagship/app/api/search/route.ts b/fixtures/flagship/app/api/search/route.ts
new file mode 100644
index 0000000..43e14e9
--- /dev/null
+++ b/fixtures/flagship/app/api/search/route.ts
@@ -0,0 +1,89 @@
+import { NextResponse } from 'next/server';
+import { searchFlights } from '@/lib/services/search';
+import { badRequest, backendDelay } from '@/lib/services/api-guard';
+
+/**
+ * Public flight search. Read-only, unauthenticated endpoint for third-party clients.
+ *
+ * Query parameters:
+ *   origin       IATA airport code (required), e.g. "JFK"
+ *   destination  IATA airport code (required), e.g. "LAX"
+ *   date         Departure date, YYYY-MM-DD (required)
+ *   passengers   Passenger count 1-9 (optional, default 1)
+ */
+export async function GET(request: Request) {
+  const url = new URL(request.url);
+  const origin = url.searchParams.get('origin');
+  const destination = url.searchParams.get('destination');
+  const date = url.searchParams.get('date');
+  const passengersRaw = url.searchParams.get('passengers');
+
+  if (!origin || !destination || !date) {
+    return NextResponse.json(
+      { error: 'origin, destination and date are required query parameters' },
+      { status: 400 },
+    );
+  }
+
+  const passengers = passengersRaw ? Number(passengersRaw) : 1;
+  if (!Number.isInteger(passengers) || passengers < 1 || passengers > 9) {
+    return NextResponse.json(
+      { error: 'passengers must be an integer between 1 and 9' },
+      { status: 400 },
+    );
+  }
+
+  const flights = searchFlights({ origin, destination, date, passengers });
+  if (!flights) {
+    return NextResponse.json(
+      { error: 'unknown airport code or invalid date (expected YYYY-MM-DD)' },
+      { status: 400 },
+    );
+  }
+
+  return NextResponse.json({ flights }, { headers: { 'cache-control': 'no-store' } });
+}
+
+// Internal endpoint backing the web UI: minified payloads, paired with the browser-minted token
+// flow. Not part of the public API — third-party clients use the GET handler above.
+export async function POST(request: Request) {
+  let body: { o?: string; d?: string; dt?: string; px?: number };
+  try {
+    body = await request.json();
+  } catch {
+    return badRequest();
+  }
+  if (!body.o || !body.d || !body.dt) return badRequest();
+
+  await backendDelay();
+
+  const flights = searchFlights({
+    origin: body.o,
+    destination: body.d,
+    date: body.dt,
+    passengers: body.px ?? 1,
+  });
+  if (!flights) return badRequest();
+
+  return NextResponse.json(
+    {
+      r: flights.map((f) => ({
+        i: f.id,
+        fn: f.flightNumber,
+        o: f.origin,
+        d: f.destination,
+        dp: f.departureTime,
+        ar: f.arrivalTime,
+        du: f.durationMinutes,
+        ac: f.aircraft,
+        fr: f.fares.map((fare) => ({
+          c: fare.classCode,
+          n: fare.className,
+          a: fare.price,
+          pk: fare.perks,
+        })),
+      })),
+    },
+    { headers: { 'cache-control': 'no-store' } },
+  );
+}
diff --git a/fixtures/flagship/app/api/seats/route.ts b/fixtures/flagship/app/api/seats/route.ts
new file mode 100644
index 0000000..cb37fc7
--- /dev/null
+++ b/fixtures/flagship/app/api/seats/route.ts
@@ -0,0 +1,42 @@
+import { NextResponse } from 'next/server';
+import { getSeatMap } from '@/lib/data/seatmaps';
+import { guard, badRequest, backendDelay } from '@/lib/services/api-guard';
+
+export async function POST(request: Request) {
+  const denied = guard(request);
+  if (denied) return denied;
+
+  let body: { f?: string };
+  try {
+    body = await request.json();
+  } catch {
+    return badRequest();
+  }
+  if (!body.f) return badRequest();
+
+  await backendDelay();
+
+  const seatMap = getSeatMap(body.f);
+  if (!seatMap) return badRequest();
+
+  return NextResponse.json(
+    {
+      ac: seatMap.aircraft,
+      cb: seatMap.cabins.map((cabin) => ({
+        n: cabin.name,
+        fc: cabin.fareClasses,
+        cl: cabin.columns,
+        rw: cabin.rows,
+        st: cabin.seats.map((s) => ({
+          s: s.id,
+          r: s.row,
+          c: s.column,
+          o: s.occupied ? 1 : 0,
+          x: s.extraLegroom ? 1 : 0,
+          p: s.fee,
+        })),
+      })),
+    },
+    { headers: { 'cache-control': 'no-store' } },
+  );
+}
diff --git a/fixtures/flagship/app/api/session/route.ts b/fixtures/flagship/app/api/session/route.ts
new file mode 100644
index 0000000..f916954
--- /dev/null
+++ b/fixtures/flagship/app/api/session/route.ts
@@ -0,0 +1,6 @@
+import { NextResponse } from 'next/server';
+import { mintToken } from '@/lib/services/session';
+
+export async function POST() {
+  return NextResponse.json({ t: mintToken() }, { headers: { 'cache-control': 'no-store' } });
+}
diff --git a/fixtures/flagship/app/checkout/checkout-client.tsx b/fixtures/flagship/app/checkout/checkout-client.tsx
new file mode 100644
index 0000000..15b973c
--- /dev/null
+++ b/fixtures/flagship/app/checkout/checkout-client.tsx
@@ -0,0 +1,209 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import { useRouter } from 'next/navigation';
+import StepBar from '../components/StepBar';
+import FareHoldBanner from '../components/FareHoldBanner';
+import SliderCaptcha from '../components/SliderCaptcha';
+import { formatDateLong, money } from '../components/format';
+import { useBooking } from '../state/BookingContext';
+
+export default function CheckoutClient() {
+  const router = useRouter();
+  const { hydrated, flight, fareCode, seatId, seatFee, completeBooking, api } = useBooking();
+
+  const [firstName, setFirstName] = useState('');
+  const [lastName, setLastName] = useState('');
+  const [email, setEmail] = useState('');
+  const [cardNumber, setCardNumber] = useState('');
+  const [expiry, setExpiry] = useState('');
+  const [cvv, setCvv] = useState('');
+  const [holderName, setHolderName] = useState('');
+  const [captchaVerified, setCaptchaVerified] = useState(false);
+  const [submitting, setSubmitting] = useState(false);
+  const [errorMessage, setErrorMessage] = useState<string | null>(null);
+
+  useEffect(() => {
+    if (hydrated && (!flight || !fareCode || !seatId)) router.replace('/');
+  }, [hydrated, flight, fareCode, seatId, router]);
+
+  if (!hydrated || !flight || !fareCode || !seatId) return null;
+
+  const fare = flight.fares.find((f) => f.code === fareCode);
+  const total = (fare?.price ?? 0) + seatFee;
+  const formComplete =
+    firstName.trim() &&
+    lastName.trim() &&
+    email.trim() &&
+    cardNumber.trim() &&
+    expiry.trim() &&
+    cvv.trim() &&
+    captchaVerified;
+
+  const pay = async () => {
+    if (!formComplete || submitting) return;
+    setSubmitting(true);
+    setErrorMessage(null);
+    try {
+      const booked = await api<{ b: string; a: number }>('/api/book', {
+        f: flight.id,
+        c: fareCode,
+        s: seatId,
+        px: { fn: firstName, ln: lastName, em: email },
+      });
+      const paid = await api<{ p: string }>('/api/pay', {
+        b: booked.b,
+        cn: cardNumber,
+        ex: expiry,
+        cv: cvv,
+        nm: holderName,
+      });
+      completeBooking(paid.p, { firstName, lastName, email });
+      router.push('/confirmation');
+    } catch {
+      setErrorMessage(
+        'Your payment could not be processed. Please check your details and try again.',
+      );
+      setSubmitting(false);
+    }
+  };
+
+  const inputClass =
+    'w-full rounded-xl border border-line bg-white px-4 py-3 text-[14px] transition-colors focus:border-navy';
+
+  return (
+    <div className="flex min-h-screen flex-col">
+      <FareHoldBanner />
+      <StepBar current={2} />
+
+      <div className="mx-auto w-full max-w-6xl flex-1 px-6 pt-4 pb-6">
+        <div className="mb-6 text-[22px] font-semibold text-ink">Passenger &amp; payment</div>
+
+        <div className="grid gap-8 md:grid-cols-[1fr_320px]">
+          <div className="space-y-6">
+            <div className="rounded-2xl border border-line bg-white p-6">
+              <div className="mb-4 text-[15px] font-semibold text-ink">Passenger details</div>
+              <div className="grid gap-3 md:grid-cols-2">
+                <input
+                  className={inputClass}
+                  placeholder="First name"
+                  value={firstName}
+                  onChange={(e) => setFirstName(e.target.value)}
+                />
+                <input
+                  className={inputClass}
+                  placeholder="Last name"
+                  value={lastName}
+                  onChange={(e) => setLastName(e.target.value)}
+                />
+                <input
+                  className={`${inputClass} md:col-span-2`}
+                  placeholder="Email address"
+                  value={email}
+                  onChange={(e) => setEmail(e.target.value)}
+                />
+              </div>
+            </div>
+
+            <div className="rounded-2xl border border-line bg-white p-6">
+              <div className="mb-4 flex items-center justify-between">
+                <div className="text-[15px] font-semibold text-ink">Payment</div>
+                <div className="flex items-center gap-1.5">
+                  {['#1a1f71', '#eb001b', '#0079be'].map((color) => (
+                    <div key={color} className="h-5 w-8 rounded" style={{ background: color }} />
+                  ))}
+                </div>
+              </div>
+              <div className="grid gap-3 md:grid-cols-2">
+                <input
+                  className={`${inputClass} md:col-span-2`}
+                  placeholder="Card number"
+                  inputMode="numeric"
+                  value={cardNumber}
+                  onChange={(e) => setCardNumber(e.target.value)}
+                />
+                <input
+                  className={inputClass}
+                  placeholder="MM/YY"
+                  value={expiry}
+                  onChange={(e) => setExpiry(e.target.value)}
+                />
+                <input
+                  className={inputClass}
+                  placeholder="CVC"
+                  inputMode="numeric"
+                  value={cvv}
+                  onChange={(e) => setCvv(e.target.value)}
+                />
+                <input
+                  className={`${inputClass} md:col-span-2`}
+                  placeholder="Name on card"
+                  value={holderName}
+                  onChange={(e) => setHolderName(e.target.value)}
+                />
+              </div>
+              <div className="mt-5">
+                <SliderCaptcha
+                  verified={captchaVerified}
+                  onVerified={() => setCaptchaVerified(true)}
+                />
+              </div>
+              {errorMessage && (
+                <div className="mt-4 rounded-lg border border-danger/30 bg-danger/5 px-4 py-3 text-[13px] text-danger">
+                  {errorMessage}
+                </div>
+              )}
+            </div>
+          </div>
+
+          <div className="h-fit rounded-2xl border border-line bg-white p-6">
+            <div className="mb-4 text-[15px] font-semibold text-ink">Trip summary</div>
+            <div className="mb-4 rounded-xl bg-cloud p-4">
+              <div className="text-[13px] font-semibold text-ink">
+                {flight.origin} → {flight.destination}
+              </div>
+              <div className="mt-0.5 text-[12.5px] text-mist">
+                {formatDateLong(flight.date)} · {flight.departureTime} · {flight.flightNumber}
+              </div>
+              <div className="mt-0.5 text-[12.5px] text-mist">
+                {fare?.name} · Seat {seatId}
+              </div>
+            </div>
+            <div className="space-y-2.5 text-[13.5px]">
+              <div className="flex justify-between">
+                <div className="text-mist">Fare</div>
+                <div className="font-medium text-ink">{money(fare?.price ?? 0)}</div>
+              </div>
+              <div className="flex justify-between">
+                <div className="text-mist">Seat {seatId}</div>
+                <div className="font-medium text-ink">{seatFee ? money(seatFee) : 'Included'}</div>
+              </div>
+              <div className="flex justify-between">
+                <div className="text-mist">Taxes &amp; fees</div>
+                <div className="font-medium text-ink">Included</div>
+              </div>
+              <div className="my-3 h-px bg-line" />
+              <div className="flex justify-between text-[15px]">
+                <div className="font-semibold text-ink">Total</div>
+                <div className="font-semibold text-navy">{money(total)}</div>
+              </div>
+            </div>
+            <div
+              className={`mt-6 rounded-lg py-3 text-center text-[14px] font-semibold transition-colors select-none ${
+                formComplete && !submitting
+                  ? 'cursor-pointer bg-gold text-navy-deep hover:bg-gold-bright'
+                  : 'cursor-default bg-line text-mist'
+              }`}
+              onClick={pay}
+            >
+              {submitting ? 'Processing…' : `Pay ${money(total)}`}
+            </div>
+            <div className="mt-3 text-center text-[11.5px] leading-relaxed text-mist">
+              By paying you agree to our fare conditions and conditions of carriage.
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/checkout/page.tsx b/fixtures/flagship/app/checkout/page.tsx
new file mode 100644
index 0000000..7c1f99b
--- /dev/null
+++ b/fixtures/flagship/app/checkout/page.tsx
@@ -0,0 +1,15 @@
+import type { Metadata } from 'next';
+import CheckoutClient from './checkout-client';
+
+// Thin server wrapper: the flow step itself is a client component (booking context, interactivity),
+// but the route's metadata must live in a server module — and it is what the markdown twin and
+// social/search snippets are derived from.
+export const metadata: Metadata = {
+  title: 'Checkout — Ora Air',
+  description:
+    'Passenger details and payment for your Ora Air booking. Demo payments only — use test card 4242 4242 4242 4242.',
+};
+
+export default function Page() {
+  return <CheckoutClient />;
+}
diff --git a/fixtures/flagship/app/components/AirportSelect.tsx b/fixtures/flagship/app/components/AirportSelect.tsx
new file mode 100644
index 0000000..f4f4bc6
--- /dev/null
+++ b/fixtures/flagship/app/components/AirportSelect.tsx
@@ -0,0 +1,96 @@
+'use client';
+
+import { useEffect, useRef, useState } from 'react';
+import { AIRPORTS, type Airport } from '@/lib/data/airports';
+
+interface Props {
+  placeholder: string;
+  value: string | null; // airport code
+  onChange: (code: string) => void;
+  exclude?: string | null;
+}
+
+export default function AirportSelect({ placeholder, value, onChange, exclude }: Props) {
+  const [open, setOpen] = useState(false);
+  const [filter, setFilter] = useState('');
+  const rootRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    const onDocClick = (e: MouseEvent) => {
+      if (!rootRef.current?.contains(e.target as Node)) setOpen(false);
+    };
+    document.addEventListener('mousedown', onDocClick);
+    return () => document.removeEventListener('mousedown', onDocClick);
+  }, []);
+
+  const selected = value ? AIRPORTS.find((a) => a.code === value) : null;
+  const query = filter.trim().toLowerCase();
+  const options = AIRPORTS.filter(
+    (a) =>
+      a.code !== exclude &&
+      (!query ||
+        a.city.toLowerCase().includes(query) ||
+        a.code.toLowerCase().includes(query) ||
+        a.name.toLowerCase().includes(query)),
+  );
+
+  const pick = (airport: Airport) => {
+    onChange(airport.code);
+    setOpen(false);
+    setFilter('');
+  };
+
+  return (
+    <div ref={rootRef} className="relative">
+      <div
+        className={`cursor-pointer rounded-xl border bg-white px-4 py-3 transition-colors ${
+          open ? 'border-navy' : 'border-line hover:border-mist'
+        }`}
+        onClick={() => setOpen((o) => !o)}
+      >
+        <div className="text-[11px] font-medium tracking-wide text-mist uppercase">
+          {placeholder}
+        </div>
+        {selected ? (
+          <div className="mt-0.5 flex items-baseline gap-2">
+            <div className="text-[15px] font-semibold text-ink">{selected.city}</div>
+            <div className="text-[12px] text-mist">{selected.code}</div>
+          </div>
+        ) : (
+          <div className="mt-0.5 text-[15px] text-[#9aa7ba]">Select city</div>
+        )}
+      </div>
+      {open && (
+        <div className="absolute top-full right-0 left-0 z-30 mt-2 overflow-hidden rounded-xl border border-line bg-white shadow-xl">
+          <input
+            autoFocus
+            className="w-full border-b border-line px-4 py-3 text-[14px]"
+            placeholder="Search city or airport"
+            value={filter}
+            onChange={(e) => setFilter(e.target.value)}
+          />
+          <div className="max-h-64 overflow-y-auto">
+            {options.map((airport) => (
+              <div
+                key={airport.code}
+                className="flex cursor-pointer items-center justify-between px-4 py-2.5 transition-colors hover:bg-cloud"
+                onClick={() => pick(airport)}
+              >
+                <div>
+                  <div className="text-[14px] font-medium text-ink">{airport.city}</div>
+                  <div className="text-[12px] text-mist">{airport.name}</div>
+                </div>
+                <div className="rounded-md bg-cloud px-2 py-0.5 text-[12px] font-semibold text-navy">
+                  {airport.code}
+                </div>
+              </div>
+            ))}
+            {options.length === 0 && (
+              <div className="px-4 py-3 text-[13px] text-mist">No matches</div>
+            )}
+          </div>
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/components/DateSelect.tsx b/fixtures/flagship/app/components/DateSelect.tsx
new file mode 100644
index 0000000..0349288
--- /dev/null
+++ b/fixtures/flagship/app/components/DateSelect.tsx
@@ -0,0 +1,73 @@
+'use client';
+
+import { useEffect, useRef, useState } from 'react';
+import { formatDateLong } from './format';
+
+interface Props {
+  value: string | null; // YYYY-MM-DD
+  onChange: (date: string) => void;
+}
+
+function nextDays(count: number): string[] {
+  const days: string[] = [];
+  const now = new Date();
+  for (let i = 1; i <= count; i++) {
+    const d = new Date(now.getFullYear(), now.getMonth(), now.getDate() + i);
+    days.push(
+      `${d.getFullYear()}-${(d.getMonth() + 1).toString().padStart(2, '0')}-${d
+        .getDate()
+        .toString()
+        .padStart(2, '0')}`,
+    );
+  }
+  return days;
+}
+
+export default function DateSelect({ value, onChange }: Props) {
+  const [open, setOpen] = useState(false);
+  const rootRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    const onDocClick = (e: MouseEvent) => {
+      if (!rootRef.current?.contains(e.target as Node)) setOpen(false);
+    };
+    document.addEventListener('mousedown', onDocClick);
+    return () => document.removeEventListener('mousedown', onDocClick);
+  }, []);
+
+  return (
+    <div ref={rootRef} className="relative">
+      <div
+        className={`cursor-pointer rounded-xl border bg-white px-4 py-3 transition-colors ${
+          open ? 'border-navy' : 'border-line hover:border-mist'
+        }`}
+        onClick={() => setOpen((o) => !o)}
+      >
+        <div className="text-[11px] font-medium tracking-wide text-mist uppercase">Departure</div>
+        <div
+          className={`mt-0.5 text-[15px] ${value ? 'font-semibold text-ink' : 'text-[#9aa7ba]'}`}
+        >
+          {value ? formatDateLong(value) : 'Select date'}
+        </div>
+      </div>
+      {open && (
+        <div className="absolute top-full right-0 left-0 z-30 mt-2 max-h-64 overflow-y-auto rounded-xl border border-line bg-white shadow-xl">
+          {nextDays(30).map((date) => (
+            <div
+              key={date}
+              className={`cursor-pointer px-4 py-2.5 text-[14px] transition-colors hover:bg-cloud ${
+                date === value ? 'font-semibold text-navy' : 'text-ink'
+              }`}
+              onClick={() => {
+                onChange(date);
+                setOpen(false);
+              }}
+            >
+              {formatDateLong(date)}
+            </div>
+          ))}
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/components/FareHoldBanner.tsx b/fixtures/flagship/app/components/FareHoldBanner.tsx
new file mode 100644
index 0000000..82e32cd
--- /dev/null
+++ b/fixtures/flagship/app/components/FareHoldBanner.tsx
@@ -0,0 +1,46 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import { useRouter } from 'next/navigation';
+import { useBooking } from '../state/BookingContext';
+
+export default function FareHoldBanner() {
+  const { holdExpiresAt, resetFlow } = useBooking();
+  const router = useRouter();
+  const [remaining, setRemaining] = useState<number | null>(null);
+
+  useEffect(() => {
+    if (!holdExpiresAt) return;
+    const tick = () => {
+      const ms = holdExpiresAt - Date.now();
+      if (ms <= 0) {
+        resetFlow();
+        router.replace('/');
+        return;
+      }
+      setRemaining(ms);
+    };
+    tick();
+    const interval = setInterval(tick, 1000);
+    return () => clearInterval(interval);
+  }, [holdExpiresAt, resetFlow, router]);
+
+  if (!holdExpiresAt || remaining === null) return null;
+
+  const totalSeconds = Math.floor(remaining / 1000);
+  const minutes = Math.floor(totalSeconds / 60);
+  const seconds = (totalSeconds % 60).toString().padStart(2, '0');
+  const urgent = totalSeconds < 120;
+
+  return (
+    <div
+      className={`${urgent ? 'bg-danger' : 'bg-navy-soft'} py-2 text-center text-[13px] text-white transition-colors`}
+    >
+      We&apos;re holding your fare for{' '}
+      <span className="font-semibold tabular-nums">
+        {minutes}:{seconds}
+      </span>{' '}
+      — complete your booking before the hold expires.
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/components/Footer.tsx b/fixtures/flagship/app/components/Footer.tsx
new file mode 100644
index 0000000..a7e35c4
--- /dev/null
+++ b/fixtures/flagship/app/components/Footer.tsx
@@ -0,0 +1,35 @@
+const COLUMNS: { title: string; links: string[] }[] = [
+  { title: 'Company', links: ['About us', 'Careers', 'Press', 'Investors'] },
+  { title: 'Travel', links: ['Destinations', 'Baggage', 'Special assistance', 'Group travel'] },
+  { title: 'Loyalty', links: ['Ora Miles', 'Status tiers', 'Partners'] },
+  { title: 'Legal', links: ['Privacy', 'Terms & conditions', 'Cookie settings', 'Contact'] },
+];
+
+export default function Footer() {
+  return (
+    <div className="mt-20 bg-navy-deep text-white/60">
+      <div className="mx-auto grid max-w-6xl grid-cols-2 gap-10 px-6 py-14 md:grid-cols-4">
+        {COLUMNS.map((col) => (
+          <div key={col.title}>
+            <div className="mb-4 text-[12px] font-semibold tracking-[0.14em] text-white/85 uppercase">
+              {col.title}
+            </div>
+            {col.links.map((link) => (
+              <div
+                key={link}
+                className="mb-2.5 cursor-pointer text-[13.5px] transition-colors hover:text-white"
+              >
+                {link}
+              </div>
+            ))}
+          </div>
+        ))}
+      </div>
+      <div className="border-t border-white/10">
+        <div className="mx-auto max-w-6xl px-6 py-5 text-[12px]">
+          © {new Date().getFullYear()} Ora Air. All rights reserved.
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/components/Header.tsx b/fixtures/flagship/app/components/Header.tsx
new file mode 100644
index 0000000..7a77be0
--- /dev/null
+++ b/fixtures/flagship/app/components/Header.tsx
@@ -0,0 +1,38 @@
+'use client';
+
+import { useRouter } from 'next/navigation';
+
+const NAV_ITEMS = ['Book', 'Manage trip', 'Check-in', 'Flight status', 'Help'];
+
+export default function Header() {
+  const router = useRouter();
+
+  return (
+    <div className="bg-navy text-white">
+      <div className="mx-auto flex max-w-6xl items-center justify-between px-6 py-4">
+        <div
+          className="flex cursor-pointer items-center gap-2.5 select-none"
+          onClick={() => router.push('/')}
+        >
+          <svg width="30" height="30" viewBox="0 0 24 24" fill="none">
+            <path
+              d="M21 16v-2l-8-5V3.5a1.5 1.5 0 0 0-3 0V9l-8 5v2l8-2.5V19l-2 1.5V22l3.5-1 3.5 1v-1.5L13 19v-5.5l8 2.5z"
+              fill="#c9a227"
+            />
+          </svg>
+          <div className="text-lg font-semibold tracking-[0.18em]">ORA AIR</div>
+        </div>
+        <div className="hidden items-center gap-7 text-[13.5px] text-white/75 md:flex">
+          {NAV_ITEMS.map((item) => (
+            <div key={item} className="cursor-pointer transition-colors hover:text-white">
+              {item}
+            </div>
+          ))}
+          <div className="cursor-pointer rounded-full border border-white/25 px-4 py-1.5 text-white transition-colors hover:border-gold hover:text-gold-bright">
+            Sign in
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/components/PaxSelect.tsx b/fixtures/flagship/app/components/PaxSelect.tsx
new file mode 100644
index 0000000..cdf6aae
--- /dev/null
+++ b/fixtures/flagship/app/components/PaxSelect.tsx
@@ -0,0 +1,41 @@
+'use client';
+
+interface Props {
+  value: number;
+  onChange: (count: number) => void;
+}
+
+export default function PaxSelect({ value, onChange }: Props) {
+  return (
+    <div className="rounded-xl border border-line bg-white px-4 py-3">
+      <div className="text-[11px] font-medium tracking-wide text-mist uppercase">Passengers</div>
+      <div className="mt-0.5 flex items-center justify-between">
+        <div className="text-[15px] font-semibold text-ink">
+          {value} {value === 1 ? 'Adult' : 'Adults'}
+        </div>
+        <div className="flex items-center gap-2">
+          <div
+            className={`flex h-6 w-6 cursor-pointer items-center justify-center rounded-full border text-[14px] select-none ${
+              value <= 1
+                ? 'border-line text-line'
+                : 'border-mist text-mist hover:border-navy hover:text-navy'
+            }`}
+            onClick={() => value > 1 && onChange(value - 1)}
+          >
+            −
+          </div>
+          <div
+            className={`flex h-6 w-6 cursor-pointer items-center justify-center rounded-full border text-[14px] select-none ${
+              value >= 6
+                ? 'border-line text-line'
+                : 'border-mist text-mist hover:border-navy hover:text-navy'
+            }`}
+            onClick={() => value < 6 && onChange(value + 1)}
+          >
+            +
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/components/SearchWidget.tsx b/fixtures/flagship/app/components/SearchWidget.tsx
new file mode 100644
index 0000000..d20b6fd
--- /dev/null
+++ b/fixtures/flagship/app/components/SearchWidget.tsx
@@ -0,0 +1,84 @@
+'use client';
+
+import { useState } from 'react';
+import { useRouter } from 'next/navigation';
+import AirportSelect from './AirportSelect';
+import DateSelect from './DateSelect';
+import PaxSelect from './PaxSelect';
+import { useBooking } from '../state/BookingContext';
+
+// The one interactive island on the (otherwise static, server-rendered) homepage: route + date +
+// passenger selection, handing off to /results via the booking context.
+export default function SearchWidget() {
+  const router = useRouter();
+  const { setSearch } = useBooking();
+  const [origin, setOrigin] = useState<string | null>(null);
+  const [destination, setDestination] = useState<string | null>(null);
+  const [date, setDate] = useState<string | null>(null);
+  const [passengers, setPassengers] = useState(1);
+  const [error, setError] = useState(false);
+
+  const submit = () => {
+    if (!origin || !destination || !date) {
+      setError(true);
+      return;
+    }
+    setSearch({ origin, destination, date, passengers });
+    router.push('/results');
+  };
+
+  return (
+    <div className="rounded-2xl bg-white p-6 shadow-[0_20px_60px_rgba(12,31,63,0.18)]">
+      <div className="mb-5 flex items-center gap-6 text-[14px]">
+        <div className="cursor-pointer border-b-2 border-gold pb-1.5 font-semibold text-ink">
+          One way
+        </div>
+        <div className="cursor-pointer pb-1.5 text-mist transition-colors hover:text-ink">
+          Round trip
+        </div>
+        <div className="cursor-pointer pb-1.5 text-mist transition-colors hover:text-ink">
+          Multi-city
+        </div>
+      </div>
+      <div className="grid gap-3 md:grid-cols-[1fr_1fr_1fr_0.8fr_auto]">
+        <AirportSelect
+          placeholder="From"
+          value={origin}
+          onChange={(code) => {
+            setOrigin(code);
+            setError(false);
+          }}
+          exclude={destination}
+        />
+        <AirportSelect
+          placeholder="To"
+          value={destination}
+          onChange={(code) => {
+            setDestination(code);
+            setError(false);
+          }}
+          exclude={origin}
+        />
+        <DateSelect
+          value={date}
+          onChange={(d) => {
+            setDate(d);
+            setError(false);
+          }}
+        />
+        <PaxSelect value={passengers} onChange={setPassengers} />
+        <div
+          className="flex cursor-pointer items-center justify-center rounded-xl bg-gold px-7 text-[15px] font-semibold text-navy-deep transition-colors select-none hover:bg-gold-bright max-md:py-3.5"
+          onClick={submit}
+        >
+          Search flights
+        </div>
+      </div>
+      {error && (
+        <div className="mt-3 text-[13px] text-danger">
+          Please choose your route and travel date to continue.
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/components/SliderCaptcha.tsx b/fixtures/flagship/app/components/SliderCaptcha.tsx
new file mode 100644
index 0000000..bc4b0ff
--- /dev/null
+++ b/fixtures/flagship/app/components/SliderCaptcha.tsx
@@ -0,0 +1,86 @@
+'use client';
+
+import { useCallback, useEffect, useRef, useState } from 'react';
+
+interface Props {
+  verified: boolean;
+  onVerified: () => void;
+}
+
+// "Slide to verify" gate. Requires a real pointer drag; a plain click does nothing.
+export default function SliderCaptcha({ verified, onVerified }: Props) {
+  const trackRef = useRef<HTMLDivElement>(null);
+  const draggingRef = useRef(false);
+  const progressRef = useRef(0);
+  const [progress, setProgress] = useState(0);
+
+  const updateFromPointer = useCallback((clientX: number) => {
+    const track = trackRef.current;
+    if (!track) return;
+    const rect = track.getBoundingClientRect();
+    const usable = rect.width - 44;
+    const next = Math.min(1, Math.max(0, (clientX - rect.left - 22) / usable));
+    progressRef.current = next;
+    setProgress(next);
+  }, []);
+
+  useEffect(() => {
+    if (verified) return;
+    const onMove = (e: PointerEvent) => {
+      if (draggingRef.current) updateFromPointer(e.clientX);
+    };
+    const onUp = () => {
+      if (!draggingRef.current) return;
+      draggingRef.current = false;
+      if (progressRef.current >= 0.92) {
+        setProgress(1);
+        onVerified();
+      } else {
+        progressRef.current = 0;
+        setProgress(0);
+      }
+    };
+    window.addEventListener('pointermove', onMove);
+    window.addEventListener('pointerup', onUp);
+    return () => {
+      window.removeEventListener('pointermove', onMove);
+      window.removeEventListener('pointerup', onUp);
+    };
+  }, [verified, onVerified, updateFromPointer]);
+
+  const pct = verified ? 1 : progress;
+
+  return (
+    <div
+      ref={trackRef}
+      className={`relative h-11 overflow-hidden rounded-full select-none ${
+        verified ? 'bg-success/10' : 'bg-cloud'
+      } border ${verified ? 'border-success/40' : 'border-line'}`}
+    >
+      <div
+        className={`absolute inset-y-0 left-0 ${verified ? 'bg-success/15' : 'bg-navy/8'}`}
+        style={{ width: `${pct * 100}%` }}
+      />
+      <div className="absolute inset-0 flex items-center justify-center text-[13px] text-mist">
+        {verified ? (
+          <span className="font-medium text-success">Verified — you&apos;re human</span>
+        ) : (
+          "Slide to verify you're not a robot"
+        )}
+      </div>
+      {!verified && (
+        <div
+          className="absolute top-1 flex h-9 w-9 cursor-grab touch-none items-center justify-center rounded-full bg-navy text-white shadow-md active:cursor-grabbing"
+          style={{ left: `calc((100% - 44px) * ${pct} + 4px)` }}
+          onPointerDown={(e) => {
+            draggingRef.current = true;
+            updateFromPointer(e.clientX);
+            (e.target as HTMLElement).setPointerCapture?.(e.pointerId);
+          }}
+        >
+          →
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/components/StepBar.tsx b/fixtures/flagship/app/components/StepBar.tsx
new file mode 100644
index 0000000..54edb0f
--- /dev/null
+++ b/fixtures/flagship/app/components/StepBar.tsx
@@ -0,0 +1,33 @@
+'use client';
+
+const STEPS = ['Flights', 'Seats', 'Payment', 'Done'];
+
+export default function StepBar({ current }: { current: number }) {
+  return (
+    <div className="mx-auto flex max-w-6xl items-center gap-3 px-6 pt-8 pb-2">
+      {STEPS.map((step, i) => (
+        <div key={step} className="flex items-center gap-3">
+          <div className="flex items-center gap-2">
+            <div
+              className={`flex h-6 w-6 items-center justify-center rounded-full text-[11px] font-semibold ${
+                i < current
+                  ? 'bg-success text-white'
+                  : i === current
+                    ? 'bg-navy text-white'
+                    : 'bg-line text-mist'
+              }`}
+            >
+              {i < current ? '✓' : i + 1}
+            </div>
+            <div
+              className={`text-[13px] ${i === current ? 'font-semibold text-ink' : 'text-mist'}`}
+            >
+              {step}
+            </div>
+          </div>
+          {i < STEPS.length - 1 && <div className="h-px w-8 bg-line md:w-14" />}
+        </div>
+      ))}
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/components/format.ts b/fixtures/flagship/app/components/format.ts
new file mode 100644
index 0000000..aba6ed4
--- /dev/null
+++ b/fixtures/flagship/app/components/format.ts
@@ -0,0 +1,16 @@
+export function formatDuration(minutes: number): string {
+  return `${Math.floor(minutes / 60)}h ${(minutes % 60).toString().padStart(2, '0')}m`;
+}
+
+export function formatDateLong(isoDate: string): string {
+  const [y, m, d] = isoDate.split('-').map(Number);
+  return new Date(y, m - 1, d).toLocaleDateString('en-US', {
+    weekday: 'short',
+    month: 'short',
+    day: 'numeric',
+  });
+}
+
+export function money(amount: number): string {
+  return `$${amount.toLocaleString('en-US')}`;
+}
diff --git a/fixtures/flagship/app/confirmation/confirmation-client.tsx b/fixtures/flagship/app/confirmation/confirmation-client.tsx
new file mode 100644
index 0000000..9e64a7c
--- /dev/null
+++ b/fixtures/flagship/app/confirmation/confirmation-client.tsx
@@ -0,0 +1,107 @@
+'use client';
+
+import { useEffect } from 'react';
+import { useRouter } from 'next/navigation';
+import StepBar from '../components/StepBar';
+import { formatDateLong, formatDuration, money } from '../components/format';
+import { useBooking } from '../state/BookingContext';
+import { getAirport } from '@/lib/data/airports';
+
+export default function ConfirmationClient() {
+  const router = useRouter();
+  const { hydrated, flight, fareCode, seatId, seatFee, passenger, pnr, resetFlow } = useBooking();
+
+  useEffect(() => {
+    if (hydrated && (!pnr || !flight)) router.replace('/');
+  }, [hydrated, pnr, flight, router]);
+
+  if (!hydrated || !pnr || !flight) return null;
+
+  const fare = flight.fares.find((f) => f.code === fareCode);
+  const total = (fare?.price ?? 0) + seatFee;
+  const originAirport = getAirport(flight.origin);
+  const destinationAirport = getAirport(flight.destination);
+
+  return (
+    <div className="flex min-h-screen flex-col">
+      <StepBar current={3} />
+
+      <div className="mx-auto w-full max-w-3xl flex-1 px-6 pt-6 pb-6">
+        <div className="fade-up rounded-2xl border border-line bg-white p-8 text-center">
+          <div className="mx-auto mb-4 flex h-14 w-14 items-center justify-center rounded-full bg-success/10 text-2xl text-success">
+            ✓
+          </div>
+          <div className="text-[24px] font-semibold text-ink">You&apos;re booked!</div>
+          <div className="mt-1.5 text-[14px] text-mist">
+            Thanks {passenger?.firstName}, your seat is confirmed. Save this page for your records.
+          </div>
+          <div className="mt-6 inline-block rounded-xl bg-navy px-8 py-4">
+            <div className="text-[11px] tracking-[0.2em] text-white/60 uppercase">
+              Booking reference
+            </div>
+            <div className="mt-1 text-[26px] font-semibold tracking-[0.24em] text-gold-bright">
+              {pnr}
+            </div>
+          </div>
+        </div>
+
+        <div className="fade-up mt-6 overflow-hidden rounded-2xl border border-line bg-white">
+          <div className="bg-navy px-7 py-4 text-white">
+            <div className="text-[12px] tracking-[0.18em] text-white/60 uppercase">Itinerary</div>
+            <div className="mt-0.5 text-[16px] font-semibold">
+              {originAirport?.city} to {destinationAirport?.city}
+            </div>
+          </div>
+          <div className="grid gap-6 px-7 py-6 md:grid-cols-[1fr_auto_1fr]">
+            <div>
+              <div className="text-[28px] font-semibold text-ink">{flight.departureTime}</div>
+              <div className="text-[14px] font-medium text-ink">
+                {flight.origin} · {originAirport?.name}
+              </div>
+              <div className="text-[13px] text-mist">{formatDateLong(flight.date)}</div>
+            </div>
+            <div className="flex flex-col items-center justify-center text-[12px] text-mist">
+              <div>{formatDuration(flight.durationMinutes)}</div>
+              <div className="my-1.5 h-px w-24 bg-line" />
+              <div>
+                {flight.flightNumber} · {flight.aircraft}
+              </div>
+            </div>
+            <div className="md:text-right">
+              <div className="text-[28px] font-semibold text-ink">{flight.arrivalTime}</div>
+              <div className="text-[14px] font-medium text-ink">
+                {flight.destination} · {destinationAirport?.name}
+              </div>
+              <div className="text-[13px] text-mist">{formatDateLong(flight.date)}</div>
+            </div>
+          </div>
+          <div className="grid grid-cols-2 gap-4 border-t border-line px-7 py-5 md:grid-cols-4">
+            {[
+              ['Passenger', `${passenger?.firstName} ${passenger?.lastName}`],
+              ['Fare', fare?.name ?? ''],
+              ['Seat', seatId ?? ''],
+              ['Total paid', money(total)],
+            ].map(([label, value]) => (
+              <div key={label}>
+                <div className="text-[11px] tracking-wide text-mist uppercase">{label}</div>
+                <div className="mt-0.5 text-[14px] font-semibold text-ink">{value}</div>
+              </div>
+            ))}
+          </div>
+        </div>
+
+        <div className="mt-8 text-center">
+          <div
+            className="inline-block cursor-pointer rounded-lg border border-line bg-white px-6 py-2.5 text-[13.5px] font-medium text-ink transition-colors select-none hover:border-navy"
+            onClick={() => {
+              resetFlow();
+              router.push('/');
+            }}
+          >
+            Book another trip
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/confirmation/page.tsx b/fixtures/flagship/app/confirmation/page.tsx
new file mode 100644
index 0000000..c9e8743
--- /dev/null
+++ b/fixtures/flagship/app/confirmation/page.tsx
@@ -0,0 +1,14 @@
+import type { Metadata } from 'next';
+import ConfirmationClient from './confirmation-client';
+
+// Thin server wrapper: the flow step itself is a client component (booking context, interactivity),
+// but the route's metadata must live in a server module — and it is what the markdown twin and
+// social/search snippets are derived from.
+export const metadata: Metadata = {
+  title: 'Booking confirmed — Ora Air',
+  description: 'Your Ora Air booking reference (PNR), itinerary summary, and receipt.',
+};
+
+export default function Page() {
+  return <ConfirmationClient />;
+}
diff --git a/fixtures/flagship/app/destinations/[slug]/page.tsx b/fixtures/flagship/app/destinations/[slug]/page.tsx
new file mode 100644
index 0000000..ccb0df1
--- /dev/null
+++ b/fixtures/flagship/app/destinations/[slug]/page.tsx
@@ -0,0 +1,54 @@
+import type { Metadata } from 'next';
+import Link from 'next/link';
+import { notFound } from 'next/navigation';
+import { AIRPORTS, getAirport } from '@/lib/data/airports';
+
+// Dynamic segment under a static parent: the manifest records the /destinations prefix as
+// dynamic, twins are never guessed for it, and the middleware never claims "not found" beneath
+// it (any slug renders here or 404s honestly via notFound()).
+export function generateStaticParams() {
+  return AIRPORTS.map((airport) => ({ slug: airport.code.toLowerCase() }));
+}
+
+export async function generateMetadata({
+  params,
+}: {
+  params: Promise<{ slug: string }>;
+}): Promise<Metadata> {
+  const { slug } = await params;
+  const airport = getAirport(slug);
+  if (!airport) return { title: 'Destination not found — Ora Air' };
+  return {
+    title: `${airport.city} (${airport.code}) — Ora Air destinations`,
+    description: `Fly Ora Air to ${airport.city} via ${airport.name} (${airport.code}), ${airport.country}.`,
+  };
+}
+
+export default async function DestinationPage({ params }: { params: Promise<{ slug: string }> }) {
+  const { slug } = await params;
+  const airport = getAirport(slug);
+  if (!airport) notFound();
+
+  return (
+    <div className="mx-auto max-w-6xl px-6 py-14">
+      <div className="mb-1 text-[13px] font-medium tracking-[0.2em] text-gold uppercase">
+        Destination
+      </div>
+      <h1 className="text-3xl font-semibold text-ink">
+        {airport.city} ({airport.code})
+      </h1>
+      <p className="mt-3 max-w-2xl text-[15px] leading-relaxed text-mist">
+        Ora Air serves {airport.city} through {airport.name}, {airport.country}. Every route is
+        bookable one-way —{' '}
+        <Link href="/" className="text-navy underline">
+          search fares
+        </Link>{' '}
+        from any of our other {AIRPORTS.length - 1} airports, or browse the{' '}
+        <Link href="/destinations" className="text-navy underline">
+          full route network
+        </Link>
+        .
+      </p>
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/destinations/page.tsx b/fixtures/flagship/app/destinations/page.tsx
new file mode 100644
index 0000000..4fb9be7
--- /dev/null
+++ b/fixtures/flagship/app/destinations/page.tsx
@@ -0,0 +1,55 @@
+import type { Metadata } from 'next';
+import Link from 'next/link';
+import { AIRPORTS } from '@/lib/data/airports';
+
+// A pure server component rendered from the route-network data — the "real content" page shape:
+// no client JS, statically prerendered, so its markdown twin mirrors the actual content.
+export const metadata: Metadata = {
+  title: 'Destinations & route network — Ora Air',
+  description:
+    'All 12 Ora Air destinations across the United States, Europe, the Middle East, and Asia — ' +
+    'airports, cities, and countries we fly to with one-way fares.',
+};
+
+export default function DestinationsPage() {
+  const byCountry = new Map<string, typeof AIRPORTS>();
+  for (const airport of AIRPORTS) {
+    byCountry.set(airport.country, [...(byCountry.get(airport.country) ?? []), airport]);
+  }
+
+  return (
+    <div>
+      <div className="mx-auto max-w-6xl px-6 py-14">
+        <div className="mb-1 text-[13px] font-medium tracking-[0.2em] text-gold uppercase">
+          Route network
+        </div>
+        <h1 className="text-3xl font-semibold text-ink">Where we fly</h1>
+        <p className="mt-3 max-w-2xl text-[15px] leading-relaxed text-mist">
+          Ora Air serves {AIRPORTS.length} airports across {byCountry.size} countries. Every route
+          is bookable one-way — pick any two airports below and{' '}
+          <Link href="/" className="text-navy underline">
+            search fares
+          </Link>
+          .
+        </p>
+
+        {[...byCountry.entries()].map(([country, airports]) => (
+          <section key={country} className="mt-10">
+            <h2 className="text-xl font-semibold text-ink">{country}</h2>
+            <div className="mt-4 grid gap-4 md:grid-cols-3">
+              {airports.map((airport) => (
+                <div key={airport.code} className="rounded-2xl border border-line bg-white p-5">
+                  <div className="text-[12px] tracking-[0.16em] text-mist uppercase">
+                    {airport.code}
+                  </div>
+                  <div className="mt-1 text-lg font-semibold text-ink">{airport.city}</div>
+                  <div className="mt-1 text-[13px] text-mist">{airport.name}</div>
+                </div>
+              ))}
+            </div>
+          </section>
+        ))}
+      </div>
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/globals.css b/fixtures/flagship/app/globals.css
new file mode 100644
index 0000000..035d0f4
--- /dev/null
+++ b/fixtures/flagship/app/globals.css
@@ -0,0 +1,88 @@
+:root {
+  --navy: #0c1f3f;
+  --navy-deep: #071426;
+  --navy-soft: #16305c;
+  --gold: #c9a227;
+  --gold-bright: #e5c15a;
+  --cloud: #f4f6f9;
+  --ink: #1c2636;
+  --mist: #67788f;
+  --line: #e3e8ef;
+  --success: #1c7c4d;
+  --danger: #c0392b;
+}
+
+@theme inline {
+  --color-navy: var(--navy);
+  --color-navy-deep: var(--navy-deep);
+  --color-navy-soft: var(--navy-soft);
+  --color-gold: var(--gold);
+  --color-gold-bright: var(--gold-bright);
+  --color-cloud: var(--cloud);
+  --color-ink: var(--ink);
+  --color-mist: var(--mist);
+  --color-line: var(--line);
+  --color-success: var(--success);
+  --color-danger: var(--danger);
+}
+
+* {
+  box-sizing: border-box;
+}
+
+html,
+body {
+  margin: 0;
+  padding: 0;
+}
+
+body {
+  background: var(--cloud);
+  color: var(--ink);
+  font-family:
+    -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
+  -webkit-font-smoothing: antialiased;
+}
+
+input {
+  font-family: inherit;
+}
+
+input:focus {
+  outline: none;
+}
+
+::placeholder {
+  color: #9aa7ba;
+}
+
+@keyframes shimmer {
+  0% {
+    background-position: -400px 0;
+  }
+  100% {
+    background-position: 400px 0;
+  }
+}
+
+.skeleton {
+  background: linear-gradient(90deg, #e9edf3 25%, #f5f7fa 50%, #e9edf3 75%);
+  background-size: 800px 100%;
+  animation: shimmer 1.4s infinite linear;
+  border-radius: 8px;
+}
+
+@keyframes fadeUp {
+  from {
+    opacity: 0;
+    transform: translateY(10px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
+}
+
+.fade-up {
+  animation: fadeUp 0.35s ease both;
+}
diff --git a/fixtures/flagship/app/guide/page.mdx b/fixtures/flagship/app/guide/page.mdx
new file mode 100644
index 0000000..3753bab
--- /dev/null
+++ b/fixtures/flagship/app/guide/page.mdx
@@ -0,0 +1,27 @@
+# Booking guide
+
+How to search, hold, and pay for an Ora Air flight — the same flow whether you are a person in a
+browser or an agent driving the MCP tools.
+
+## Search
+
+Start from the [homepage](/) or call the public MCP server's `search_flights` tool with an origin,
+a destination, and an ISO date. Results include a flight id, fare classes, and one-way prices.
+
+## Choose a seat
+
+Every fare class permits seat selection before payment. Seat maps list each cabin's rows, the
+seats still open, and any extra-legroom fee. Agents fetch the same data with `get_seat_map` on the
+gated MCP server.
+
+## Book and pay
+
+Booking creates a pending reservation with a `bookingId` and the total amount due. Payment
+confirms it and returns a PNR. This is a demo environment: use the test card `4242 4242 4242 4242`
+— any other number declines.
+
+## When things go wrong
+
+- An unknown flight id means the fare expired; search again.
+- A declined payment leaves the booking pending; retry with the test card.
+- Seats are held only after payment, so a taken seat means re-selecting from the current map.
diff --git a/fixtures/flagship/app/layout.tsx b/fixtures/flagship/app/layout.tsx
new file mode 100644
index 0000000..574a546
--- /dev/null
+++ b/fixtures/flagship/app/layout.tsx
@@ -0,0 +1,25 @@
+import type { Metadata } from 'next';
+import './globals.css';
+import Header from './components/Header';
+import Footer from './components/Footer';
+import { BookingProvider } from './state/BookingContext';
+import { OrganizationJsonLd } from './organization-json-ld';
+
+export const metadata: Metadata = {
+  title: 'Ora Air',
+};
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <html>
+      <body>
+        <OrganizationJsonLd />
+        <BookingProvider>
+          <Header />
+          <main>{children}</main>
+          <Footer />
+        </BookingProvider>
+      </body>
+    </html>
+  );
+}
diff --git a/fixtures/flagship/app/llms.txt/route.ts b/fixtures/flagship/app/llms.txt/route.ts
new file mode 100644
index 0000000..8af79cc
--- /dev/null
+++ b/fixtures/flagship/app/llms.txt/route.ts
@@ -0,0 +1,41 @@
+// Hand-owned llms.txt: no scaffold marker, no TODOs — ax detects the /llms.txt route and
+// references it in the catalog rather than scaffolding its own (the detect-and-reference path).
+export const dynamic = 'force-static';
+
+const SITE_URL = 'https://flagship-fixture.example.com';
+
+export function GET(): Response {
+  const body = `# ora-air
+
+Demo airline for exercising agent booking flows end-to-end: search, seat selection, booking, and
+test payment. Nothing here is real inventory and no charge ever settles.
+
+## When to use
+
+- Compare demo flight options for a specific route and date before recommending one to a traveler.
+- Walk the end-to-end booking flow (search, seats, booking, payment) using the MCP tools and route docs.
+- Validate expected test-flow behavior for demo bookings, including seat-map retrieval and payment confirmation outputs.
+
+## When not to use
+
+- Real airline inventory, prices, or booking confirmations for live commercial travel.
+- Tasks requiring production payment processing, refunds, loyalty accounts, or customer-support workflows.
+
+## Key pages
+
+- [/](${SITE_URL}/) — fare search
+- [/destinations](${SITE_URL}/destinations) — the full route network
+- [/guide](${SITE_URL}/guide) — the booking guide
+- [/results](${SITE_URL}/results), [/seats](${SITE_URL}/seats), [/checkout](${SITE_URL}/checkout), [/confirmation](${SITE_URL}/confirmation) — the booking flow
+
+## Machine-readable resources
+
+- [AI Catalog](${SITE_URL}/.well-known/ai-catalog.json) — every machine-readable artifact this site offers agents
+- [Public MCP server](${SITE_URL}/api/public/mcp) — flight search, no auth
+- [Gated MCP server](${SITE_URL}/api/mcp) — seat maps, booking, payment (OAuth)
+- [OpenAPI description](${SITE_URL}/openapi.json) — the plain HTTP API
+- [Agent guide](${SITE_URL}/agents.md) — what this site is for and how to drive it
+`;
+
+  return new Response(body, { headers: { 'Content-Type': 'text/plain; charset=utf-8' } });
+}
diff --git a/fixtures/flagship/app/organization-json-ld.tsx b/fixtures/flagship/app/organization-json-ld.tsx
new file mode 100644
index 0000000..8c4b431
--- /dev/null
+++ b/fixtures/flagship/app/organization-json-ld.tsx
@@ -0,0 +1,30 @@
+// Organization structured data, scaffolded by ax (scaffoldJsonLd). This file is yours: edit
+// it freely, ax never overwrites it.
+//
+// Nothing renders it until you add it to your root layout — one import and one element:
+//   import { OrganizationJsonLd } from './organization-json-ld';
+//   ...then render <OrganizationJsonLd /> inside <body>.
+//
+// Worth adding beyond the fields below: a logo, an address, and at least one more schema.org
+// @type for what you actually offer (SoftwareApplication / Product for an app or API, FAQPage for
+// a support site) — covering more types helps registries understand the site more fully.
+const organization = {
+  '@context': 'https://schema.org',
+  '@type': 'Organization',
+  name: 'ora-air',
+  url: 'https://flagship-fixture.example.com',
+  sameAs: [
+    'https://flagship-fixture.example.com/',
+    'https://flagship-fixture.example.com/.well-known/ai-catalog.json',
+    'https://flagship-fixture.example.com/.well-known/mcp/server-card.json',
+  ],
+};
+
+export function OrganizationJsonLd() {
+  return (
+    <script
+      type="application/ld+json"
+      dangerouslySetInnerHTML={{ __html: JSON.stringify(organization) }}
+    />
+  );
+}
diff --git a/fixtures/flagship/app/page.tsx b/fixtures/flagship/app/page.tsx
new file mode 100644
index 0000000..a519cc0
--- /dev/null
+++ b/fixtures/flagship/app/page.tsx
@@ -0,0 +1,99 @@
+import type { Metadata } from 'next';
+import Link from 'next/link';
+import SearchWidget from './components/SearchWidget';
+
+// The homepage is a static server component — real prose that prerenders (and therefore yields a
+// faithful markdown twin) — with the interactive search as its one client island.
+export const metadata: Metadata = {
+  title: 'Ora Air — one-way fares across four continents',
+  description:
+    'Book one-way flights across 12 destinations on four continents. Flexible fares, ' +
+    'award-winning cabins, and Ora Miles rewards — search, pick a seat, and pay in minutes.',
+};
+
+const DESTINATIONS = [
+  { city: 'London', code: 'LHR', price: 389, gradient: 'from-[#2c3e6b] to-[#0c1f3f]' },
+  { city: 'Tokyo', code: 'NRT', price: 720, gradient: 'from-[#6b3e2c] to-[#3f200c]' },
+  { city: 'Paris', code: 'CDG', price: 412, gradient: 'from-[#3e2c6b] to-[#200c3f]' },
+  { city: 'Dubai', code: 'DXB', price: 545, gradient: 'from-[#2c6b5e] to-[#0c3f34]' },
+];
+
+export default function HomePage() {
+  return (
+    <div>
+      <div className="relative overflow-hidden bg-gradient-to-b from-navy via-navy-soft to-[#2a4a7f] pb-36">
+        <div className="pointer-events-none absolute inset-0 opacity-20">
+          <div className="absolute -top-20 -right-40 h-96 w-96 rounded-full bg-gold blur-[140px]" />
+          <div className="absolute bottom-0 -left-20 h-80 w-80 rounded-full bg-white blur-[120px]" />
+        </div>
+        <div className="relative mx-auto max-w-6xl px-6 pt-20 pb-10 text-center">
+          <div className="text-[13px] font-medium tracking-[0.24em] text-gold-bright uppercase">
+            Fly beyond expectations
+          </div>
+          <h1 className="mt-4 text-4xl font-semibold text-white md:text-[52px] md:leading-[1.1]">
+            Where will the horizon
+            <br />
+            take you next?
+          </h1>
+          <p className="mx-auto mt-5 max-w-lg text-[15px] leading-relaxed text-white/65">
+            Non-stop routes across four continents, award-winning cabins, and fares designed around
+            the way you travel.
+          </p>
+        </div>
+      </div>
+
+      <div className="relative z-10 mx-auto -mt-28 max-w-6xl px-6">
+        <SearchWidget />
+      </div>
+
+      <div className="mx-auto max-w-6xl px-6 pt-20">
+        <div className="mb-1 text-[13px] font-medium tracking-[0.2em] text-gold uppercase">
+          Featured fares
+        </div>
+        <div className="mb-8 flex items-baseline justify-between">
+          <h2 className="text-2xl font-semibold text-ink">Popular destinations from $389</h2>
+          <Link href="/destinations" className="text-[14px] font-medium text-navy hover:underline">
+            View all destinations →
+          </Link>
+        </div>
+        <div className="grid gap-5 md:grid-cols-4">
+          {DESTINATIONS.map((dest) => (
+            <div
+              key={dest.code}
+              className={`group cursor-pointer rounded-2xl bg-gradient-to-br ${dest.gradient} p-6 text-white transition-transform hover:-translate-y-1`}
+            >
+              <div className="text-[12px] tracking-[0.16em] text-white/60 uppercase">
+                {dest.code}
+              </div>
+              <div className="mt-1 text-xl font-semibold">{dest.city}</div>
+              <div className="mt-10 text-[12px] text-white/60">One way from</div>
+              <div className="text-lg font-semibold text-gold-bright">${dest.price}</div>
+            </div>
+          ))}
+        </div>
+      </div>
+
+      <div className="mx-auto grid max-w-6xl gap-6 px-6 pt-20 md:grid-cols-3">
+        {[
+          {
+            title: 'Flexible by design',
+            body: 'Change your travel dates up to two hours before departure on Flex fares, with no change fees.',
+          },
+          {
+            title: 'Award-winning cabins',
+            body: 'From our refreshed Economy to lie-flat Business suites, every seat is designed around rest.',
+          },
+          {
+            title: 'Ora Miles',
+            body: 'Earn miles on every fare and unlock lounge access, upgrades, and partner rewards.',
+          },
+        ].map((item) => (
+          <div key={item.title} className="rounded-2xl border border-line bg-white p-7">
+            <div className="mb-2.5 text-[16px] font-semibold text-ink">{item.title}</div>
+            <div className="text-[14px] leading-relaxed text-mist">{item.body}</div>
+          </div>
+        ))}
+      </div>
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/results/page.tsx b/fixtures/flagship/app/results/page.tsx
new file mode 100644
index 0000000..5198d82
--- /dev/null
+++ b/fixtures/flagship/app/results/page.tsx
@@ -0,0 +1,14 @@
+import type { Metadata } from 'next';
+import ResultsClient from './results-client';
+
+// Thin server wrapper: the flow step itself is a client component (booking context, interactivity),
+// but the route's metadata must live in a server module — and it is what the markdown twin and
+// social/search snippets are derived from.
+export const metadata: Metadata = {
+  title: 'Flight results — Ora Air',
+  description: 'Compare one-way Ora Air fares and cabins for your route and date.',
+};
+
+export default function Page() {
+  return <ResultsClient />;
+}
diff --git a/fixtures/flagship/app/results/results-client.tsx b/fixtures/flagship/app/results/results-client.tsx
new file mode 100644
index 0000000..0aa8e17
--- /dev/null
+++ b/fixtures/flagship/app/results/results-client.tsx
@@ -0,0 +1,220 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import { useRouter } from 'next/navigation';
+import StepBar from '../components/StepBar';
+import { formatDateLong, formatDuration, money } from '../components/format';
+import { useBooking, type FlightView } from '../state/BookingContext';
+import { getAirport } from '@/lib/data/airports';
+
+interface ApiFlight {
+  i: string;
+  fn: string;
+  o: string;
+  d: string;
+  dp: string;
+  ar: string;
+  du: number;
+  ac: string;
+  fr: { c: string; n: string; a: number; pk: string[] }[];
+}
+
+const FARE_ORDER = ['Y1', 'Y2', 'J1'];
+
+export default function ResultsClient() {
+  const router = useRouter();
+  const { hydrated, search, selectFlight, api } = useBooking();
+  const [flights, setFlights] = useState<FlightView[] | null>(null);
+  const [expandedId, setExpandedId] = useState<string | null>(null);
+  const [failed, setFailed] = useState(false);
+
+  useEffect(() => {
+    if (!hydrated) return;
+    if (!search) {
+      router.replace('/');
+      return;
+    }
+    let cancelled = false;
+    api<{ r: ApiFlight[] }>('/api/search', {
+      o: search.origin,
+      d: search.destination,
+      dt: search.date,
+      px: search.passengers,
+    })
+      .then((data) => {
+        if (cancelled) return;
+        setFlights(
+          data.r.map((f) => ({
+            id: f.i,
+            flightNumber: f.fn,
+            origin: f.o,
+            destination: f.d,
+            date: search.date,
+            departureTime: f.dp,
+            arrivalTime: f.ar,
+            durationMinutes: f.du,
+            aircraft: f.ac,
+            fares: f.fr.map((fare) => ({
+              code: fare.c,
+              name: fare.n,
+              price: fare.a,
+              perks: fare.pk,
+            })),
+          })),
+        );
+      })
+      .catch(() => !cancelled && setFailed(true));
+    return () => {
+      cancelled = true;
+    };
+  }, [hydrated, search, api, router]);
+
+  if (!hydrated || !search) return null;
+
+  const originAirport = getAirport(search.origin);
+  const destinationAirport = getAirport(search.destination);
+
+  const pick = (flight: FlightView, fareCode: string) => {
+    selectFlight(flight, fareCode);
+    router.push('/seats');
+  };
+
+  return (
+    <div className="flex min-h-screen flex-col">
+      <StepBar current={0} />
+
+      <div className="mx-auto w-full max-w-6xl flex-1 px-6 pt-4">
+        <div className="mb-6 flex flex-wrap items-baseline gap-x-3 gap-y-1">
+          <div className="text-[22px] font-semibold text-ink">
+            {originAirport?.city} → {destinationAirport?.city}
+          </div>
+          <div className="text-[14px] text-mist">
+            {formatDateLong(search.date)} · {search.passengers}{' '}
+            {search.passengers === 1 ? 'adult' : 'adults'} · One way
+          </div>
+        </div>
+
+        {failed && (
+          <div className="rounded-xl border border-danger/30 bg-danger/5 px-5 py-4 text-[14px] text-danger">
+            Something went wrong loading flights. Please try again.
+          </div>
+        )}
+
+        {!flights && !failed && (
+          <div className="space-y-3">
+            {[0, 1, 2, 3].map((i) => (
+              <div key={i} className="skeleton h-[92px] w-full" />
+            ))}
+          </div>
+        )}
+
+        {flights && (
+          <div className="space-y-3 pb-4">
+            {flights.map((flight) => {
+              const cheapest = Math.min(...flight.fares.map((f) => f.price));
+              const expanded = expandedId === flight.id;
+              return (
+                <div
+                  key={flight.id}
+                  className="fade-up overflow-hidden rounded-xl border border-line bg-white transition-shadow hover:shadow-md"
+                >
+                  <div
+                    className="grid cursor-pointer items-center gap-4 px-6 py-5 md:grid-cols-[110px_1fr_120px_150px]"
+                    onClick={() => setExpandedId(expanded ? null : flight.id)}
+                  >
+                    <div>
+                      <div className="text-[12px] text-mist">{flight.flightNumber}</div>
+                      <div className="text-[12px] text-mist">{flight.aircraft}</div>
+                    </div>
+                    <div className="flex items-center gap-4">
+                      <div className="text-right">
+                        <div className="text-[20px] font-semibold text-ink">
+                          {flight.departureTime}
+                        </div>
+                        <div className="text-[12px] text-mist">{flight.origin}</div>
+                      </div>
+                      <div className="flex flex-1 flex-col items-center px-2">
+                        <div className="text-[11px] text-mist">
+                          {formatDuration(flight.durationMinutes)}
+                        </div>
+                        <div className="relative my-1 h-px w-full bg-line">
+                          <div className="absolute top-1/2 right-0 h-1.5 w-1.5 -translate-y-1/2 rotate-45 border-t border-r border-mist" />
+                        </div>
+                        <div className="text-[11px] text-mist">Non-stop</div>
+                      </div>
+                      <div>
+                        <div className="text-[20px] font-semibold text-ink">
+                          {flight.arrivalTime}
+                        </div>
+                        <div className="text-[12px] text-mist">{flight.destination}</div>
+                      </div>
+                    </div>
+                    <div className="max-md:hidden" />
+                    <div className="text-right">
+                      <div className="text-[12px] text-mist">from</div>
+                      <div className="text-[20px] font-semibold text-navy">{money(cheapest)}</div>
+                      <div className="text-[12px] font-medium text-gold">
+                        {expanded ? 'Hide fares' : 'View fares'}
+                      </div>
+                    </div>
+                  </div>
+
+                  {expanded && (
+                    <div className="grid gap-3 border-t border-line bg-cloud/60 px-6 py-5 md:grid-cols-3">
+                      {FARE_ORDER.map((code) => {
+                        const fare = flight.fares.find((f) => f.code === code);
+                        if (!fare) return null;
+                        const business = code === 'J1';
+                        return (
+                          <div
+                            key={code}
+                            className={`rounded-xl border bg-white p-5 ${
+                              business ? 'border-gold/50' : 'border-line'
+                            }`}
+                          >
+                            <div className="mb-1 flex items-center justify-between">
+                              <div className="text-[14px] font-semibold text-ink">{fare.name}</div>
+                              {business && (
+                                <div className="rounded-full bg-gold/15 px-2 py-0.5 text-[10px] font-semibold tracking-wide text-gold uppercase">
+                                  Premium
+                                </div>
+                              )}
+                            </div>
+                            <div className="mb-3 text-[20px] font-semibold text-navy">
+                              {money(fare.price)}
+                            </div>
+                            <div className="mb-4 space-y-1.5">
+                              {fare.perks.map((perk) => (
+                                <div
+                                  key={perk}
+                                  className="flex items-start gap-1.5 text-[12.5px] text-mist"
+                                >
+                                  <span className="mt-px text-success">✓</span>
+                                  {perk}
+                                </div>
+                              ))}
+                            </div>
+                            <div
+                              className={`cursor-pointer rounded-lg py-2.5 text-center text-[13.5px] font-semibold transition-colors select-none ${
+                                business
+                                  ? 'bg-navy text-white hover:bg-navy-soft'
+                                  : 'bg-gold text-navy-deep hover:bg-gold-bright'
+                              }`}
+                              onClick={() => pick(flight, code)}
+                            >
+                              Select
+                            </div>
+                          </div>
+                        );
+                      })}
+                    </div>
+                  )}
+                </div>
+              );
+            })}
+          </div>
+        )}
+      </div>
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/seats/page.tsx b/fixtures/flagship/app/seats/page.tsx
new file mode 100644
index 0000000..e2b4d48
--- /dev/null
+++ b/fixtures/flagship/app/seats/page.tsx
@@ -0,0 +1,15 @@
+import type { Metadata } from 'next';
+import SeatsClient from './seats-client';
+
+// Thin server wrapper: the flow step itself is a client component (booking context, interactivity),
+// but the route's metadata must live in a server module — and it is what the markdown twin and
+// social/search snippets are derived from.
+export const metadata: Metadata = {
+  title: 'Choose your seat — Ora Air',
+  description:
+    'Pick your seat from the live cabin map — Economy, Premium, and Business with per-seat fees shown upfront.',
+};
+
+export default function Page() {
+  return <SeatsClient />;
+}
diff --git a/fixtures/flagship/app/seats/seats-client.tsx b/fixtures/flagship/app/seats/seats-client.tsx
new file mode 100644
index 0000000..5c9ea0c
--- /dev/null
+++ b/fixtures/flagship/app/seats/seats-client.tsx
@@ -0,0 +1,196 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import { useRouter } from 'next/navigation';
+import StepBar from '../components/StepBar';
+import FareHoldBanner from '../components/FareHoldBanner';
+import { money } from '../components/format';
+import { useBooking } from '../state/BookingContext';
+
+interface ApiSeat {
+  s: string;
+  r: number;
+  c: string;
+  o: number;
+  x: number;
+  p: number;
+}
+
+interface ApiCabin {
+  n: string;
+  fc: string[];
+  cl: string[];
+  rw: number[];
+  st: ApiSeat[];
+}
+
+export default function SeatsClient() {
+  const router = useRouter();
+  const { hydrated, flight, fareCode, seatId, seatFee, selectSeat, startHold, api } = useBooking();
+  const [cabin, setCabin] = useState<ApiCabin | null>(null);
+  const [failed, setFailed] = useState(false);
+
+  useEffect(() => {
+    if (!hydrated) return;
+    if (!flight || !fareCode) {
+      router.replace('/');
+      return;
+    }
+    startHold();
+    let cancelled = false;
+    api<{ ac: string; cb: ApiCabin[] }>('/api/seats', { f: flight.id })
+      .then((data) => {
+        if (cancelled) return;
+        setCabin(data.cb.find((c) => c.fc.includes(fareCode)) ?? null);
+      })
+      .catch(() => !cancelled && setFailed(true));
+    return () => {
+      cancelled = true;
+    };
+  }, [hydrated, flight, fareCode, api, router, startHold]);
+
+  if (!hydrated || !flight || !fareCode) return null;
+
+  const fare = flight.fares.find((f) => f.code === fareCode);
+  const seatByPosition = new Map(cabin?.st.map((s) => [s.s, s]) ?? []);
+
+  const seatColor = (seat: ApiSeat, selected: boolean): string => {
+    if (selected) return 'bg-gold border-gold text-navy-deep';
+    if (seat.o) return 'bg-[#d4dae3] border-[#d4dae3] cursor-default';
+    if (seat.x) return 'bg-[#dff0ec] border-[#9fd0c5] cursor-pointer hover:border-navy';
+    return 'bg-white border-[#b9c3d0] cursor-pointer hover:border-navy';
+  };
+
+  return (
+    <div className="flex min-h-screen flex-col">
+      <FareHoldBanner />
+      <StepBar current={1} />
+
+      <div className="mx-auto w-full max-w-6xl flex-1 px-6 pt-4 pb-6">
+        <div className="mb-6">
+          <div className="text-[22px] font-semibold text-ink">Choose your seat</div>
+          <div className="text-[14px] text-mist">
+            {flight.flightNumber} · {flight.origin} → {flight.destination} · {fare?.name} ·{' '}
+            {cabin?.n ?? ''} cabin
+          </div>
+        </div>
+
+        <div className="grid gap-8 md:grid-cols-[1fr_320px]">
+          <div className="rounded-2xl border border-line bg-white p-6 md:p-8">
+            {failed && (
+              <div className="text-[14px] text-danger">
+                Something went wrong loading the seat map. Please try again.
+              </div>
+            )}
+            {!cabin && !failed && <div className="skeleton h-[420px] w-full" />}
+            {cabin && (
+              <div className="overflow-x-auto">
+                <div className="mb-6 flex flex-wrap items-center gap-5 text-[12px] text-mist">
+                  {[
+                    ['bg-white border border-[#b9c3d0]', 'Available'],
+                    ['bg-[#dff0ec] border border-[#9fd0c5]', 'Extra legroom'],
+                    ['bg-[#d4dae3]', 'Unavailable'],
+                    ['bg-gold', 'Selected'],
+                  ].map(([cls, label]) => (
+                    <div key={label} className="flex items-center gap-1.5">
+                      <div className={`h-3.5 w-3.5 rounded ${cls}`} />
+                      {label}
+                    </div>
+                  ))}
+                </div>
+
+                <div className="mx-auto w-fit rounded-[40px] border-2 border-line px-6 py-10 md:px-10">
+                  <div
+                    className="mb-3 grid justify-items-center gap-1.5"
+                    style={{ gridTemplateColumns: `28px repeat(${cabin.cl.length}, 34px)` }}
+                  >
+                    <div />
+                    {cabin.cl.map((col, i) =>
+                      col ? (
+                        <div key={`${col}${i}`} className="text-[11px] font-medium text-mist">
+                          {col}
+                        </div>
+                      ) : (
+                        <div key={`gap-${i}`} />
+                      ),
+                    )}
+                  </div>
+                  <div className="space-y-1.5">
+                    {cabin.rw.map((row) => (
+                      <div
+                        key={row}
+                        className="grid items-center justify-items-center gap-1.5"
+                        style={{ gridTemplateColumns: `28px repeat(${cabin.cl.length}, 34px)` }}
+                      >
+                        <div className="text-[11px] text-mist">{row}</div>
+                        {cabin.cl.map((col, i) => {
+                          if (!col) return <div key={`gap-${i}`} />;
+                          const seat = seatByPosition.get(`${row}${col}`);
+                          if (!seat) return <div key={`${row}${col}`} />;
+                          const selected = seatId === seat.s;
+                          return (
+                            <div
+                              key={seat.s}
+                              className={`h-8 w-8 rounded-t-lg rounded-b-sm border transition-colors ${seatColor(seat, selected)}`}
+                              onClick={() => {
+                                if (seat.o) return;
+                                selectSeat(selected ? '' : seat.s, selected ? 0 : seat.p);
+                              }}
+                            />
+                          );
+                        })}
+                      </div>
+                    ))}
+                  </div>
+                </div>
+              </div>
+            )}
+          </div>
+
+          <div className="h-fit rounded-2xl border border-line bg-white p-6">
+            <div className="mb-4 text-[15px] font-semibold text-ink">Your selection</div>
+            <div className="space-y-2.5 text-[13.5px]">
+              <div className="flex justify-between">
+                <div className="text-mist">Flight</div>
+                <div className="font-medium text-ink">{flight.flightNumber}</div>
+              </div>
+              <div className="flex justify-between">
+                <div className="text-mist">Fare</div>
+                <div className="font-medium text-ink">{fare?.name}</div>
+              </div>
+              <div className="flex justify-between">
+                <div className="text-mist">Seat</div>
+                <div className="font-medium text-ink">{seatId || '—'}</div>
+              </div>
+              <div className="flex justify-between">
+                <div className="text-mist">Seat fee</div>
+                <div className="font-medium text-ink">{seatFee ? money(seatFee) : 'Included'}</div>
+              </div>
+              <div className="my-3 h-px bg-line" />
+              <div className="flex justify-between text-[15px]">
+                <div className="font-semibold text-ink">Total</div>
+                <div className="font-semibold text-navy">{money((fare?.price ?? 0) + seatFee)}</div>
+              </div>
+            </div>
+            <div
+              className={`mt-6 rounded-lg py-3 text-center text-[14px] font-semibold transition-colors select-none ${
+                seatId
+                  ? 'cursor-pointer bg-gold text-navy-deep hover:bg-gold-bright'
+                  : 'cursor-default bg-line text-mist'
+              }`}
+              onClick={() => seatId && router.push('/checkout')}
+            >
+              Continue to payment
+            </div>
+            <div
+              className="mt-3 cursor-pointer text-center text-[13px] text-mist transition-colors hover:text-ink"
+              onClick={() => router.push('/results')}
+            >
+              Back to flights
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/fixtures/flagship/app/sitemap.ts b/fixtures/flagship/app/sitemap.ts
new file mode 100644
index 0000000..e1a19c1
--- /dev/null
+++ b/fixtures/flagship/app/sitemap.ts
@@ -0,0 +1,18 @@
+import type { MetadataRoute } from 'next';
+
+const siteUrl = 'https://flagship-fixture.example.com';
+
+// Fixed lastModified keeps the emitted sitemap.xml identical everywhere the fixture is built.
+const lastModified = new Date('2026-01-01T00:00:00.000Z');
+
+export default function sitemap(): MetadataRoute.Sitemap {
+  return [
+    { url: `${siteUrl}/`, lastModified, changeFrequency: 'daily', priority: 1 },
+    { url: `${siteUrl}/destinations`, lastModified, changeFrequency: 'daily', priority: 0.9 },
+    { url: `${siteUrl}/guide`, lastModified, changeFrequency: 'monthly', priority: 0.8 },
+    { url: `${siteUrl}/results`, lastModified, changeFrequency: 'daily', priority: 0.8 },
+    { url: `${siteUrl}/seats`, lastModified, changeFrequency: 'weekly', priority: 0.8 },
+    { url: `${siteUrl}/checkout`, lastModified, changeFrequency: 'weekly', priority: 0.7 },
+    { url: `${siteUrl}/confirmation`, lastModified, changeFrequency: 'weekly', priority: 0.6 },
+  ];
+}
diff --git a/fixtures/flagship/app/state/BookingContext.tsx b/fixtures/flagship/app/state/BookingContext.tsx
new file mode 100644
index 0000000..f1ad4c9
--- /dev/null
+++ b/fixtures/flagship/app/state/BookingContext.tsx
@@ -0,0 +1,203 @@
+'use client';
+
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useRef,
+  useState,
+  type ReactNode,
+} from 'react';
+
+export interface FareView {
+  code: string;
+  name: string;
+  price: number;
+  perks: string[];
+}
+
+export interface FlightView {
+  id: string;
+  flightNumber: string;
+  origin: string;
+  destination: string;
+  date: string;
+  departureTime: string;
+  arrivalTime: string;
+  durationMinutes: number;
+  aircraft: string;
+  fares: FareView[];
+}
+
+export interface SearchState {
+  origin: string;
+  destination: string;
+  date: string; // YYYY-MM-DD
+  passengers: number;
+}
+
+export interface PassengerState {
+  firstName: string;
+  lastName: string;
+  email: string;
+}
+
+interface FlowState {
+  search: SearchState | null;
+  flight: FlightView | null;
+  fareCode: string | null;
+  seatId: string | null;
+  seatFee: number;
+  holdExpiresAt: number | null;
+  passenger: PassengerState | null;
+  pnr: string | null;
+}
+
+const EMPTY_FLOW: FlowState = {
+  search: null,
+  flight: null,
+  fareCode: null,
+  seatId: null,
+  seatFee: 0,
+  holdExpiresAt: null,
+  passenger: null,
+  pnr: null,
+};
+
+interface BookingContextValue extends FlowState {
+  hydrated: boolean;
+  setSearch: (search: SearchState) => void;
+  selectFlight: (flight: FlightView, fareCode: string) => void;
+  selectSeat: (seatId: string, seatFee: number) => void;
+  startHold: () => void;
+  completeBooking: (pnr: string, passenger: PassengerState) => void;
+  resetFlow: () => void;
+  api: <T>(path: string, body: unknown) => Promise<T>;
+}
+
+const BookingContext = createContext<BookingContextValue | null>(null);
+
+const STORAGE_KEY = 'mr.flow';
+
+export function BookingProvider({ children }: { children: ReactNode }) {
+  const [flow, setFlow] = useState<FlowState>(EMPTY_FLOW);
+  const [hydrated, setHydrated] = useState(false);
+  const tokenRef = useRef<string | null>(null);
+
+  // Flow state lives only in this tab's sessionStorage. Nothing is in the URL.
+  useEffect(() => {
+    try {
+      const raw = sessionStorage.getItem(STORAGE_KEY);
+      if (raw) setFlow({ ...EMPTY_FLOW, ...JSON.parse(raw) });
+    } catch {
+      // ignore corrupt state
+    }
+    setHydrated(true);
+  }, []);
+
+  useEffect(() => {
+    if (!hydrated) return;
+    sessionStorage.setItem(STORAGE_KEY, JSON.stringify(flow));
+  }, [flow, hydrated]);
+
+  const api = useCallback(async <T,>(path: string, body: unknown): Promise<T> => {
+    if (!tokenRef.current) {
+      const res = await fetch('/api/session', { method: 'POST' });
+      tokenRef.current = (await res.json()).t;
+    }
+    const res = await fetch(path, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', 'x-mt': tokenRef.current! },
+      body: JSON.stringify(body),
+    });
+    if (!res.ok) throw new Error('request_failed');
+    return res.json();
+  }, []);
+
+  const setSearch = useCallback((search: SearchState) => {
+    setFlow({ ...EMPTY_FLOW, search });
+  }, []);
+
+  const selectFlight = useCallback((flight: FlightView, fareCode: string) => {
+    setFlow((prev) => ({
+      ...prev,
+      flight,
+      fareCode,
+      seatId: null,
+      seatFee: 0,
+      passenger: null,
+      pnr: null,
+    }));
+  }, []);
+
+  const selectSeat = useCallback((seatId: string, seatFee: number) => {
+    setFlow((prev) => ({ ...prev, seatId, seatFee }));
+  }, []);
+
+  const startHold = useCallback(() => {
+    setFlow((prev) =>
+      prev.holdExpiresAt ? prev : { ...prev, holdExpiresAt: Date.now() + 10 * 60 * 1000 },
+    );
+  }, []);
+
+  const completeBooking = useCallback((pnr: string, passenger: PassengerState) => {
+    setFlow((prev) => ({ ...prev, pnr, passenger, holdExpiresAt: null }));
+  }, []);
+
+  const resetFlow = useCallback(() => {
+    setFlow(EMPTY_FLOW);
+  }, []);
+
+  return (
+    <BookingContext.Provider
+      value={{
+        ...flow,
+        hydrated,
+        setSearch,
+        selectFlight,
+        selectSeat,
+        startHold,
+        completeBooking,
+        resetFlow,
+        api,
+      }}
+    >
+      {children}
+    </BookingContext.Provider>
+  );
+}
+
+// NOTE: children render unconditionally — a hydration gate here would replace every page's
+// server-rendered HTML with a splash screen site-wide (agents and crawlers would see nothing).
+// The booking-flow pages that actually depend on restored sessionStorage state each guard on
+// `hydrated` themselves; static pages stay fully server-rendered.
+function Splash() {
+  return (
+    <div className="flex min-h-screen items-center justify-center bg-navy">
+      <div className="flex flex-col items-center gap-4">
+        <svg width="44" height="44" viewBox="0 0 24 24" fill="none">
+          <path
+            d="M21 16v-2l-8-5V3.5a1.5 1.5 0 0 0-3 0V9l-8 5v2l8-2.5V19l-2 1.5V22l3.5-1 3.5 1v-1.5L13 19v-5.5l8 2.5z"
+            fill="#c9a227"
+          />
+        </svg>
+        <div className="flex gap-1.5">
+          {[0, 1, 2].map((i) => (
+            <div
+              key={i}
+              className="h-1.5 w-1.5 animate-pulse rounded-full bg-white/50"
+              style={{ animationDelay: `${i * 150}ms` }}
+            />
+          ))}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+export function useBooking(): BookingContextValue {
+  const ctx = useContext(BookingContext);
+  if (!ctx) throw new Error('useBooking outside provider');
+  return ctx;
+}
diff --git a/fixtures/flagship/ax.config.ts b/fixtures/flagship/ax.config.ts
new file mode 100644
index 0000000..06fc347
--- /dev/null
+++ b/fixtures/flagship/ax.config.ts
@@ -0,0 +1,29 @@
+import type { AxConfig } from '@ora-ai/ax';
+
+// A literal `siteUrl` keeps this fixture's emitted output identical everywhere it's built. The
+// `isGated` matcher restates the built-in floor (inlined — see the runtime default's rationale)
+// and gates /account, so the serving manifest has a gated page the middleware never touches.
+// llms.txt, JSON-LD, and robots.txt all exist as hand-owned sources here, so the scaffold flags
+// stay at their defaults except `scaffoldRobots`. The committed robots.txt already carries the
+// marked ax block, so an in-tree build is a no-op (the marker-detection idempotence path) and the
+// tree stays clean; the raw append runs in the mutation harness, which strips the block first.
+const config: AxConfig = {
+  siteUrl: 'https://flagship-fixture.example.com',
+  scaffoldRobots: true,
+  isGated: ({ path }) =>
+    path.startsWith('/api/auth/') || path.startsWith('/api/webhooks/') || path === '/account',
+  // The gated MCP server authenticates via OAuth (the stub .well-known documents under
+  // app/.well-known/); declaring it here publishes that answer to the catalog entry, the server
+  // card, and the generated /auth.md — the declared-override path of entry auth resolution.
+  entries: [
+    {
+      identifier: 'urn:air:flagship-fixture.example.com:mcp-server:api-mcp',
+      auth: {
+        status: 'oauth2',
+        docsUrl: 'https://flagship-fixture.example.com/agents.md',
+      },
+    },
+  ],
+};
+
+export default config;
diff --git a/fixtures/flagship/cards.golden/server-card.json b/fixtures/flagship/cards.golden/server-card.json
new file mode 100644
index 0000000..9edaa98
--- /dev/null
+++ b/fixtures/flagship/cards.golden/server-card.json
@@ -0,0 +1,28 @@
+{
+  "name": "com.example.flagship-fixture/api-public-mcp",
+  "description": "flagship MCP server at /api/public/mcp",
+  "version": "0.0.0",
+  "serverUrl": "https://flagship-fixture.example.com/api/public/mcp",
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://flagship-fixture.example.com/api/public/mcp"
+    }
+  ],
+  "tools": [
+    {
+      "name": "search_flights"
+    }
+  ],
+  "serverInfo": {
+    "name": "flagship",
+    "version": "0.0.0"
+  },
+  "transport": {
+    "type": "streamable-http",
+    "endpoint": "https://flagship-fixture.example.com/api/public/mcp"
+  },
+  "capabilities": {
+    "tools": {}
+  }
+}
diff --git a/fixtures/flagship/cards.golden/server-card/api-mcp.json b/fixtures/flagship/cards.golden/server-card/api-mcp.json
new file mode 100644
index 0000000..aeb309c
--- /dev/null
+++ b/fixtures/flagship/cards.golden/server-card/api-mcp.json
@@ -0,0 +1,38 @@
+{
+  "name": "com.example.flagship-fixture/api-mcp",
+  "description": "flagship MCP server at /api/mcp",
+  "version": "0.0.0",
+  "serverUrl": "https://flagship-fixture.example.com/api/mcp",
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://flagship-fixture.example.com/api/mcp"
+    }
+  ],
+  "tools": [
+    {
+      "name": "get_seat_map"
+    },
+    {
+      "name": "book_flight"
+    },
+    {
+      "name": "pay_booking"
+    }
+  ],
+  "serverInfo": {
+    "name": "flagship",
+    "version": "0.0.0"
+  },
+  "transport": {
+    "type": "streamable-http",
+    "endpoint": "https://flagship-fixture.example.com/api/mcp"
+  },
+  "capabilities": {
+    "tools": {}
+  },
+  "authentication": {
+    "required": true,
+    "resourceMetadata": "https://flagship-fixture.example.com/.well-known/oauth-protected-resource"
+  }
+}
diff --git a/fixtures/flagship/cards.golden/server-card/api-public-mcp.json b/fixtures/flagship/cards.golden/server-card/api-public-mcp.json
new file mode 100644
index 0000000..9edaa98
--- /dev/null
+++ b/fixtures/flagship/cards.golden/server-card/api-public-mcp.json
@@ -0,0 +1,28 @@
+{
+  "name": "com.example.flagship-fixture/api-public-mcp",
+  "description": "flagship MCP server at /api/public/mcp",
+  "version": "0.0.0",
+  "serverUrl": "https://flagship-fixture.example.com/api/public/mcp",
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://flagship-fixture.example.com/api/public/mcp"
+    }
+  ],
+  "tools": [
+    {
+      "name": "search_flights"
+    }
+  ],
+  "serverInfo": {
+    "name": "flagship",
+    "version": "0.0.0"
+  },
+  "transport": {
+    "type": "streamable-http",
+    "endpoint": "https://flagship-fixture.example.com/api/public/mcp"
+  },
+  "capabilities": {
+    "tools": {}
+  }
+}
diff --git a/fixtures/flagship/lib/data/airports.ts b/fixtures/flagship/lib/data/airports.ts
new file mode 100644
index 0000000..e3ac98c
--- /dev/null
+++ b/fixtures/flagship/lib/data/airports.ts
@@ -0,0 +1,35 @@
+export interface Airport {
+  code: string;
+  city: string;
+  name: string;
+  country: string;
+}
+
+export const AIRPORTS: Airport[] = [
+  {
+    code: 'JFK',
+    city: 'New York',
+    name: 'John F. Kennedy International',
+    country: 'United States',
+  },
+  { code: 'LAX', city: 'Los Angeles', name: 'Los Angeles International', country: 'United States' },
+  {
+    code: 'SFO',
+    city: 'San Francisco',
+    name: 'San Francisco International',
+    country: 'United States',
+  },
+  { code: 'MIA', city: 'Miami', name: 'Miami International', country: 'United States' },
+  { code: 'ORD', city: 'Chicago', name: "O'Hare International", country: 'United States' },
+  { code: 'SEA', city: 'Seattle', name: 'Seattle-Tacoma International', country: 'United States' },
+  { code: 'LHR', city: 'London', name: 'Heathrow', country: 'United Kingdom' },
+  { code: 'CDG', city: 'Paris', name: 'Charles de Gaulle', country: 'France' },
+  { code: 'TLV', city: 'Tel Aviv', name: 'Ben Gurion', country: 'Israel' },
+  { code: 'NRT', city: 'Tokyo', name: 'Narita International', country: 'Japan' },
+  { code: 'SIN', city: 'Singapore', name: 'Changi', country: 'Singapore' },
+  { code: 'DXB', city: 'Dubai', name: 'Dubai International', country: 'United Arab Emirates' },
+];
+
+export function getAirport(code: string): Airport | undefined {
+  return AIRPORTS.find((a) => a.code === code.toUpperCase());
+}
diff --git a/fixtures/flagship/lib/data/flights.ts b/fixtures/flagship/lib/data/flights.ts
new file mode 100644
index 0000000..591daf5
--- /dev/null
+++ b/fixtures/flagship/lib/data/flights.ts
@@ -0,0 +1,166 @@
+import { getAirport } from './airports';
+
+export type AircraftType = 'A320neo' | 'B787-9';
+
+export interface FareOption {
+  classCode: string; // internal fare basis, e.g. Y1, Y2, J1
+  className: string;
+  price: number; // USD
+  perks: string[];
+}
+
+export interface Flight {
+  id: string;
+  flightNumber: string;
+  origin: string;
+  destination: string;
+  date: string; // YYYY-MM-DD
+  departureTime: string; // HH:MM local
+  arrivalTime: string; // HH:MM local
+  durationMinutes: number;
+  aircraft: AircraftType;
+  fares: FareOption[];
+}
+
+// Deterministic PRNG so the same route + date always yields the same flights.
+function hashString(input: string): number {
+  let h = 2166136261;
+  for (let i = 0; i < input.length; i++) {
+    h ^= input.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return h >>> 0;
+}
+
+function mulberry32(seed: number) {
+  let a = seed;
+  return () => {
+    a |= 0;
+    a = (a + 0x6d2b79f5) | 0;
+    let t = Math.imul(a ^ (a >>> 15), 1 | a);
+    t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t;
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+}
+
+// Rough great-circle-ish duration table keyed by unordered pair; fallback derived from seed.
+const ROUTE_MINUTES: Record<string, number> = {
+  'JFK-LAX': 360,
+  'JFK-SFO': 380,
+  'JFK-MIA': 190,
+  'JFK-ORD': 150,
+  'JFK-SEA': 370,
+  'JFK-LHR': 415,
+  'JFK-CDG': 440,
+  'JFK-TLV': 630,
+  'JFK-NRT': 840,
+  'JFK-SIN': 1130,
+  'JFK-DXB': 750,
+  'LAX-SFO': 85,
+  'LAX-MIA': 290,
+  'LAX-ORD': 245,
+  'LAX-SEA': 165,
+  'LAX-LHR': 630,
+  'LAX-CDG': 650,
+  'LAX-TLV': 900,
+  'LAX-NRT': 690,
+  'LAX-SIN': 1050,
+  'LAX-DXB': 960,
+  'SFO-ORD': 255,
+  'SFO-SEA': 130,
+  'SFO-MIA': 320,
+  'SFO-LHR': 620,
+  'SFO-NRT': 660,
+  'LHR-CDG': 80,
+  'LHR-TLV': 290,
+  'LHR-DXB': 410,
+  'CDG-TLV': 270,
+  'TLV-DXB': 200,
+  'SIN-NRT': 420,
+  'SIN-DXB': 450,
+  'NRT-DXB': 660,
+  'ORD-MIA': 185,
+  'ORD-SEA': 250,
+  'SEA-MIA': 340,
+  'MIA-LHR': 520,
+  'ORD-LHR': 470,
+  'SEA-NRT': 630,
+  'MIA-CDG': 540,
+};
+
+function routeMinutes(origin: string, destination: string, rand: () => number): number {
+  const key = [origin, destination].sort().join('-');
+  return ROUTE_MINUTES[key] ?? 120 + Math.floor(rand() * 600);
+}
+
+function pad(n: number): string {
+  return n.toString().padStart(2, '0');
+}
+
+function minutesToClock(totalMinutes: number): string {
+  const m = ((totalMinutes % 1440) + 1440) % 1440;
+  return `${pad(Math.floor(m / 60))}:${pad(m % 60)}`;
+}
+
+export function generateFlights(origin: string, destination: string, date: string): Flight[] {
+  const o = getAirport(origin);
+  const d = getAirport(destination);
+  if (!o || !d || o.code === d.code) return [];
+
+  const seed = hashString(`${o.code}|${d.code}|${date}`);
+  const rand = mulberry32(seed);
+  const count = 5 + Math.floor(rand() * 4); // 5-8 flights
+  const duration = routeMinutes(o.code, d.code, rand);
+  const longHaul = duration > 420;
+
+  const flights: Flight[] = [];
+  for (let i = 0; i < count; i++) {
+    const depMinutes = 355 + Math.floor(i * (1080 / count) + rand() * 60); // spread 06:00-23:00
+    const jitteredDuration = duration + Math.floor(rand() * 30) - 15;
+    const aircraft: AircraftType = longHaul || rand() > 0.7 ? 'B787-9' : 'A320neo';
+    const flightNumber = `MR ${100 + Math.floor(rand() * 880)}`;
+    const basePrice = Math.round((60 + duration * 0.55) * (0.85 + rand() * 0.5));
+
+    flights.push({
+      id: `${o.code}${d.code}${date.replaceAll('-', '')}${pad(i)}`,
+      flightNumber,
+      origin: o.code,
+      destination: d.code,
+      date,
+      departureTime: minutesToClock(depMinutes),
+      arrivalTime: minutesToClock(depMinutes + jitteredDuration),
+      durationMinutes: jitteredDuration,
+      aircraft,
+      fares: [
+        {
+          classCode: 'Y1',
+          className: 'Economy Light',
+          price: basePrice,
+          perks: ['Carry-on bag', 'Seat assigned at check-in'],
+        },
+        {
+          classCode: 'Y2',
+          className: 'Economy Flex',
+          price: Math.round(basePrice * 1.45),
+          perks: ['Carry-on + checked bag', 'Free seat selection', 'Changes allowed'],
+        },
+        {
+          classCode: 'J1',
+          className: 'Business',
+          price: Math.round(basePrice * 3.4),
+          perks: ['Lounge access', 'Lie-flat seat', 'Priority boarding', '2 checked bags'],
+        },
+      ],
+    });
+  }
+  return flights.sort((a, b) => a.departureTime.localeCompare(b.departureTime));
+}
+
+export function getFlight(flightId: string): Flight | undefined {
+  // Flight ids encode origin/destination/date: e.g. JFKLAX2026072100
+  const match = /^([A-Z]{3})([A-Z]{3})(\d{8})(\d{2})$/.exec(flightId);
+  if (!match) return undefined;
+  const [, origin, destination, rawDate] = match;
+  const date = `${rawDate.slice(0, 4)}-${rawDate.slice(4, 6)}-${rawDate.slice(6, 8)}`;
+  return generateFlights(origin, destination, date).find((f) => f.id === flightId);
+}
diff --git a/fixtures/flagship/lib/data/seatmaps.ts b/fixtures/flagship/lib/data/seatmaps.ts
new file mode 100644
index 0000000..43e5a37
--- /dev/null
+++ b/fixtures/flagship/lib/data/seatmaps.ts
@@ -0,0 +1,128 @@
+import { getFlight, type AircraftType } from './flights';
+
+export interface Seat {
+  id: string; // e.g. "12A"
+  row: number;
+  column: string;
+  occupied: boolean;
+  extraLegroom: boolean;
+  fee: number; // USD, on top of fare
+}
+
+export interface CabinSection {
+  name: string;
+  fareClasses: string[]; // which fare classes may sit here
+  columns: string[]; // includes "" for aisle gaps, e.g. ["A","B","C","","D","E","F"]
+  rows: number[];
+  seats: Seat[];
+}
+
+interface CabinLayout {
+  name: string;
+  fareClasses: string[];
+  columns: string[];
+  startRow: number;
+  endRow: number;
+  extraLegroomRows: number[];
+  fee: (row: number, extraLegroom: boolean) => number;
+}
+
+const LAYOUTS: Record<AircraftType, CabinLayout[]> = {
+  A320neo: [
+    {
+      name: 'Business',
+      fareClasses: ['J1'],
+      columns: ['A', 'C', '', 'D', 'F'],
+      startRow: 1,
+      endRow: 3,
+      extraLegroomRows: [1],
+      fee: () => 0,
+    },
+    {
+      name: 'Economy',
+      fareClasses: ['Y1', 'Y2'],
+      columns: ['A', 'B', 'C', '', 'D', 'E', 'F'],
+      startRow: 6,
+      endRow: 28,
+      extraLegroomRows: [6, 14],
+      fee: (row, extra) => (extra ? 32 : row <= 12 ? 14 : 0),
+    },
+  ],
+  'B787-9': [
+    {
+      name: 'Business',
+      fareClasses: ['J1'],
+      columns: ['A', '', 'D', 'E', '', 'K'],
+      startRow: 1,
+      endRow: 6,
+      extraLegroomRows: [1],
+      fee: () => 0,
+    },
+    {
+      name: 'Economy',
+      fareClasses: ['Y1', 'Y2'],
+      columns: ['A', 'B', 'C', '', 'D', 'E', 'F', '', 'H', 'J', 'K'],
+      startRow: 10,
+      endRow: 38,
+      extraLegroomRows: [10, 24],
+      fee: (row, extra) => (extra ? 45 : row <= 16 ? 19 : 0),
+    },
+  ],
+};
+
+function hashString(input: string): number {
+  let h = 2166136261;
+  for (let i = 0; i < input.length; i++) {
+    h ^= input.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return h >>> 0;
+}
+
+function mulberry32(seed: number) {
+  let a = seed;
+  return () => {
+    a |= 0;
+    a = (a + 0x6d2b79f5) | 0;
+    let t = Math.imul(a ^ (a >>> 15), 1 | a);
+    t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t;
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+}
+
+export function getSeatMap(
+  flightId: string,
+): { aircraft: AircraftType; cabins: CabinSection[] } | undefined {
+  const flight = getFlight(flightId);
+  if (!flight) return undefined;
+
+  const rand = mulberry32(hashString(`seats|${flightId}`));
+  const cabins: CabinSection[] = LAYOUTS[flight.aircraft].map((layout) => {
+    const rows: number[] = [];
+    const seats: Seat[] = [];
+    for (let row = layout.startRow; row <= layout.endRow; row++) {
+      rows.push(row);
+      for (const column of layout.columns) {
+        if (!column) continue;
+        const extraLegroom = layout.extraLegroomRows.includes(row);
+        seats.push({
+          id: `${row}${column}`,
+          row,
+          column,
+          occupied: rand() < 0.55,
+          extraLegroom,
+          fee: layout.fee(row, extraLegroom),
+        });
+      }
+    }
+    return {
+      name: layout.name,
+      fareClasses: layout.fareClasses,
+      columns: layout.columns,
+      rows,
+      seats,
+    };
+  });
+
+  return { aircraft: flight.aircraft, cabins };
+}
diff --git a/fixtures/flagship/lib/services/api-guard.ts b/fixtures/flagship/lib/services/api-guard.ts
new file mode 100644
index 0000000..8228af0
--- /dev/null
+++ b/fixtures/flagship/lib/services/api-guard.ts
@@ -0,0 +1,21 @@
+import { NextResponse } from 'next/server';
+import { validateToken } from './session';
+
+// Guards the internal write endpoints (seats/book/pay) used by the web UI. They require the x-mt
+// token minted by the browser client and are not part of the public API. The public read endpoint
+// (GET /api/search) is intentionally unauthenticated.
+export function guard(request: Request): NextResponse | null {
+  if (!validateToken(request.headers.get('x-mt'))) {
+    return NextResponse.json({ e: 'ERR_AUTH' }, { status: 401 });
+  }
+  return null;
+}
+
+export function badRequest(): NextResponse {
+  return NextResponse.json({ e: 'ERR' }, { status: 400 });
+}
+
+// Simulated backend latency so the UI skeleton states feel real.
+export function backendDelay(): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, 500 + Math.random() * 400));
+}
diff --git a/fixtures/flagship/lib/services/booking.ts b/fixtures/flagship/lib/services/booking.ts
new file mode 100644
index 0000000..f1c0c30
--- /dev/null
+++ b/fixtures/flagship/lib/services/booking.ts
@@ -0,0 +1,89 @@
+import { getFlight, type Flight } from '../data/flights';
+import { getSeatMap } from '../data/seatmaps';
+
+export interface Passenger {
+  firstName: string;
+  lastName: string;
+  email: string;
+}
+
+export interface Booking {
+  bookingId: string;
+  pnr: string | null;
+  status: 'pending' | 'confirmed';
+  flight: Flight;
+  fareClass: string;
+  seatId: string;
+  passenger: Passenger;
+  amount: number; // USD total (fare + seat fee)
+  paymentRef: string | null;
+  createdAt: number;
+}
+
+// In-memory store; survives dev hot reloads via globalThis.
+const globalStore = globalThis as unknown as { __mrBookings?: Map<string, Booking> };
+const bookings: Map<string, Booking> = (globalStore.__mrBookings ??= new Map());
+
+function randomId(prefix: string, length: number): string {
+  const alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+  let out = '';
+  for (let i = 0; i < length; i++) {
+    out += alphabet[Math.floor(Math.random() * alphabet.length)];
+  }
+  return prefix + out;
+}
+
+export function createBooking(input: {
+  flightId: string;
+  fareClass: string;
+  seatId: string;
+  passenger: Passenger;
+}): Booking | { error: string } {
+  const flight = getFlight(input.flightId);
+  if (!flight) return { error: 'FLIGHT_NOT_FOUND' };
+
+  const fare = flight.fares.find((f) => f.classCode === input.fareClass);
+  if (!fare) return { error: 'FARE_NOT_FOUND' };
+
+  const seatMap = getSeatMap(input.flightId);
+  const seat = seatMap?.cabins
+    .filter((c) => c.fareClasses.includes(input.fareClass))
+    .flatMap((c) => c.seats)
+    .find((s) => s.id === input.seatId);
+  if (!seat) return { error: 'SEAT_NOT_FOUND' };
+  if (seat.occupied) return { error: 'SEAT_TAKEN' };
+
+  const { firstName, lastName, email } = input.passenger;
+  if (!firstName?.trim() || !lastName?.trim() || !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email ?? '')) {
+    return { error: 'INVALID_PASSENGER' };
+  }
+
+  const booking: Booking = {
+    bookingId: randomId('BK', 10),
+    pnr: null,
+    status: 'pending',
+    flight,
+    fareClass: input.fareClass,
+    seatId: input.seatId,
+    passenger: { firstName: firstName.trim(), lastName: lastName.trim(), email: email.trim() },
+    amount: fare.price + seat.fee,
+    paymentRef: null,
+    createdAt: Date.now(),
+  };
+  bookings.set(booking.bookingId, booking);
+  return booking;
+}
+
+export function confirmBooking(bookingId: string, paymentRef: string): Booking | { error: string } {
+  const booking = bookings.get(bookingId);
+  if (!booking) return { error: 'BOOKING_NOT_FOUND' };
+  if (booking.status === 'confirmed') return booking;
+  booking.status = 'confirmed';
+  booking.paymentRef = paymentRef;
+  booking.pnr = randomId('', 6);
+  return booking;
+}
+
+export function getBooking(bookingId: string): Booking | undefined {
+  return bookings.get(bookingId);
+}
diff --git a/fixtures/flagship/lib/services/payment.ts b/fixtures/flagship/lib/services/payment.ts
new file mode 100644
index 0000000..7de6f03
--- /dev/null
+++ b/fixtures/flagship/lib/services/payment.ts
@@ -0,0 +1,32 @@
+export interface CardDetails {
+  cardNumber: string;
+  expiry: string; // MM/YY
+  cvv: string;
+  holderName: string;
+}
+
+export interface ChargeResult {
+  success: boolean;
+  paymentRef?: string;
+  declineCode?: string;
+}
+
+// Mock processor: the standard test card succeeds, everything else declines.
+const TEST_CARD = '4242424242424242';
+
+export function chargeCard(card: CardDetails, amount: number): ChargeResult {
+  const digits = card.cardNumber.replace(/\D/g, '');
+  if (digits.length < 15 || !/^\d{2}\/\d{2}$/.test(card.expiry) || !/^\d{3,4}$/.test(card.cvv)) {
+    return { success: false, declineCode: 'invalid_details' };
+  }
+  if (amount <= 0) {
+    return { success: false, declineCode: 'invalid_amount' };
+  }
+  if (digits !== TEST_CARD) {
+    return { success: false, declineCode: 'card_declined' };
+  }
+  return {
+    success: true,
+    paymentRef: `ch_${Math.random().toString(36).slice(2, 12)}`,
+  };
+}
diff --git a/fixtures/flagship/lib/services/search.ts b/fixtures/flagship/lib/services/search.ts
new file mode 100644
index 0000000..f301d62
--- /dev/null
+++ b/fixtures/flagship/lib/services/search.ts
@@ -0,0 +1,16 @@
+import { generateFlights, type Flight } from '../data/flights';
+import { getAirport } from '../data/airports';
+
+export interface SearchQuery {
+  origin: string;
+  destination: string;
+  date: string; // YYYY-MM-DD
+  passengers: number;
+}
+
+export function searchFlights(query: SearchQuery): Flight[] | null {
+  if (!getAirport(query.origin) || !getAirport(query.destination)) return null;
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(query.date)) return null;
+  if (query.passengers < 1 || query.passengers > 9) return null;
+  return generateFlights(query.origin, query.destination, query.date);
+}
diff --git a/fixtures/flagship/lib/services/session.ts b/fixtures/flagship/lib/services/session.ts
new file mode 100644
index 0000000..0bf4a96
--- /dev/null
+++ b/fixtures/flagship/lib/services/session.ts
@@ -0,0 +1,31 @@
+import { createHmac } from 'crypto';
+
+// Browser session tokens minted for the web client on app mount. Standard
+// anti-scraping measure: API calls without a freshly minted token are rejected.
+const SECRET = 'mr-web-2f8a1c9e4b7d';
+const MAX_AGE_MS = 2 * 60 * 60 * 1000;
+
+function sign(payload: string): string {
+  return createHmac('sha256', SECRET).update(payload).digest('hex').slice(0, 32);
+}
+
+export function mintToken(): string {
+  const payload = `${Date.now()}.${Math.random().toString(36).slice(2, 10)}`;
+  return Buffer.from(`${payload}.${sign(payload)}`).toString('base64url');
+}
+
+export function validateToken(token: string | null): boolean {
+  if (!token) return false;
+  try {
+    const decoded = Buffer.from(token, 'base64url').toString('utf8');
+    const lastDot = decoded.lastIndexOf('.');
+    if (lastDot < 0) return false;
+    const payload = decoded.slice(0, lastDot);
+    const signature = decoded.slice(lastDot + 1);
+    if (sign(payload) !== signature) return false;
+    const timestamp = Number(payload.split('.')[0]);
+    return Number.isFinite(timestamp) && Date.now() - timestamp < MAX_AGE_MS;
+  } catch {
+    return false;
+  }
+}
diff --git a/fixtures/mdx-content/mdx-components.tsx b/fixtures/flagship/mdx-components.tsx
similarity index 100%
rename from fixtures/mdx-content/mdx-components.tsx
rename to fixtures/flagship/mdx-components.tsx
diff --git a/fixtures/flagship/middleware.ts b/fixtures/flagship/middleware.ts
new file mode 100644
index 0000000..1b1e6f3
--- /dev/null
+++ b/fixtures/flagship/middleware.ts
@@ -0,0 +1,81 @@
+import { withAx } from '@ora-ai/ax/middleware';
+import { NextResponse, type NextRequest } from 'next/server';
+
+import { axManifest } from './ax-manifest';
+
+// Bot policy: traditional search crawlers AND reputable AI agents are explicitly
+// allowed to reach the site; only anonymous scripting/scraping tooling is challenged.
+const ALLOWED_CRAWLERS = [
+  /googlebot/i,
+  /bingbot/i,
+  /duckduckbot/i,
+  /applebot/i,
+  // Reputable AI crawlers — allowed so agents can discover and read the site.
+  /gptbot/i,
+  /chatgpt-user/i,
+  /oai-searchbot/i,
+  /claudebot/i,
+  /claude-web/i,
+  /claude-user/i,
+  /anthropic/i,
+  /perplexitybot/i,
+  /perplexity-user/i,
+  /google-extended/i,
+  /meta-externalagent/i,
+  /amazonbot/i,
+  /cohere/i,
+  /deepseekbot/i,
+  /ccbot/i,
+  /ora-agent/i,
+];
+
+const BLOCKED_AGENTS = [
+  /curl/i,
+  /wget/i,
+  /python-requests/i,
+  /python-httpx/i,
+  /aiohttp/i,
+  /go-http-client/i,
+  /node-fetch/i,
+  /scrapy/i,
+];
+
+function deniedPage(rayId: string): string {
+  return `<!DOCTYPE html>
+<html>
+<head><title>Access denied</title><meta name="viewport" content="width=device-width, initial-scale=1"></head>
+<body style="margin:0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;background:#0b1526;color:#e8edf5;display:flex;align-items:center;justify-content:center;min-height:100vh">
+<div style="max-width:520px;padding:48px;text-align:center">
+<div style="font-size:44px;margin-bottom:16px">&#9992;&#65039;</div>
+<div style="font-size:22px;font-weight:600;margin-bottom:12px">Access denied</div>
+<div style="font-size:15px;line-height:1.6;color:#9aa7ba">Automated traffic has been detected from your connection. To protect our customers, access to ora-air has been blocked.<br><br>Error 1020 &middot; Ray ID: ${rayId}</div>
+</div>
+</body>
+</html>`;
+}
+
+function botGate(request: NextRequest) {
+  const userAgent = request.headers.get('user-agent') ?? '';
+
+  if (
+    !userAgent ||
+    (!ALLOWED_CRAWLERS.some((p) => p.test(userAgent)) &&
+      BLOCKED_AGENTS.some((p) => p.test(userAgent)))
+  ) {
+    const rayId = Math.random().toString(16).slice(2, 18);
+    return new NextResponse(deniedPage(rayId), {
+      status: 403,
+      headers: { 'content-type': 'text/html; charset=utf-8' },
+    });
+  }
+
+  return NextResponse.next();
+}
+
+// withAx's optional second argument: the app's own middleware runs for every request ax's
+// negotiation doesn't claim — the composition a real app with an existing middleware uses.
+export default withAx({ manifest: axManifest }, botGate);
+
+export const config = {
+  matcher: ['/((?!_next|api|.*\\..*|favicon|robots|health|status).*)'],
+};
diff --git a/fixtures/config-overrides/next-env.d.ts b/fixtures/flagship/next-env.d.ts
similarity index 100%
rename from fixtures/config-overrides/next-env.d.ts
rename to fixtures/flagship/next-env.d.ts
diff --git a/fixtures/mdx-content/next.config.mjs b/fixtures/flagship/next.config.mjs
similarity index 100%
rename from fixtures/mdx-content/next.config.mjs
rename to fixtures/flagship/next.config.mjs
diff --git a/fixtures/mdx-content/package.json b/fixtures/flagship/package.json
similarity index 79%
rename from fixtures/mdx-content/package.json
rename to fixtures/flagship/package.json
index 3068ef3..e27e619 100644
--- a/fixtures/mdx-content/package.json
+++ b/fixtures/flagship/package.json
@@ -1,8 +1,9 @@
 {
-  "name": "@ax-fixtures/mdx-content",
+  "name": "@ax-fixtures/flagship",
   "version": "0.0.0",
   "private": true,
   "scripts": {
+    "prebuild": "ax manifest",
     "build": "next build",
     "postbuild": "ax --report --yes",
     "dev": "next dev",
@@ -12,9 +13,11 @@
     "@mdx-js/loader": "^3.1.0",
     "@mdx-js/react": "^3.1.0",
     "@next/mdx": "^15.1.0",
+    "mcp-handler": "^1.1.0",
     "next": "^15.1.0",
     "react": "^19.0.0",
-    "react-dom": "^19.0.0"
+    "react-dom": "^19.0.0",
+    "zod": "^3.24.1"
   },
   "devDependencies": {
     "@types/mdx": "^2.0.13",
diff --git a/fixtures/flagship/public/agents.md b/fixtures/flagship/public/agents.md
new file mode 100644
index 0000000..28fb4f2
--- /dev/null
+++ b/fixtures/flagship/public/agents.md
@@ -0,0 +1,27 @@
+# ora-air agent guide
+
+## When to use this site
+
+- Compare demo flight options for a specific route and date.
+- Execute the end-to-end booking flow in a safe test environment.
+- Retrieve seat maps and fare details before recommending an itinerary.
+
+## When not to use this site
+
+- Live commercial bookings, ticket changes, or refunds.
+- Real payment processing, PCI workflows, or production customer data.
+- Regulatory, immigration, or airport-operational guidance.
+
+## Best workflow for agents
+
+1. Use the public MCP server at `/api/public/mcp` to search for flights.
+2. If a user wants to continue, guide them through auth steps in `/auth.md`.
+3. Use the gated MCP server at `/api/mcp` for seat maps, booking, and payment.
+4. Prefer markdown twins (`/*.md`) when you need compact, machine-readable page context.
+
+## Discovery links
+
+- AI catalog: `/.well-known/ai-catalog.json`
+- Public MCP server card: `/.well-known/mcp/server-card.json`
+- Authentication guide: `/auth.md`
+- LLM guidance: `/llms.txt`
diff --git a/fixtures/flagship/public/destinations.md b/fixtures/flagship/public/destinations.md
new file mode 100644
index 0000000..b734de5
--- /dev/null
+++ b/fixtures/flagship/public/destinations.md
@@ -0,0 +1,26 @@
+# Where we fly (hand-authored twin)
+
+This file is written and maintained by a human — it has no `generated-by` marker, so ax records it
+as the markdown source for `/destinations` and never overwrites it. Because it is committed, the
+prebuild `ax manifest` run lists it on the very first build, which is what lets the dual-fetch
+dogfood prove the middleware rewrite without a second build.
+
+Ora Air serves 12 airports across 8 countries. Every route is bookable one-way.
+
+## United States
+
+- JFK — New York, John F. Kennedy International
+- LAX — Los Angeles, Los Angeles International
+- SFO — San Francisco, San Francisco International
+- MIA — Miami, Miami International
+- ORD — Chicago, O'Hare International
+- SEA — Seattle, Seattle-Tacoma International
+
+## International
+
+- LHR — London, Heathrow (United Kingdom)
+- CDG — Paris, Charles de Gaulle (France)
+- TLV — Tel Aviv, Ben Gurion (Israel)
+- NRT — Tokyo, Narita International (Japan)
+- SIN — Singapore, Changi (Singapore)
+- DXB — Dubai, Dubai International (United Arab Emirates)
diff --git a/fixtures/flagship/public/openapi.json b/fixtures/flagship/public/openapi.json
new file mode 100644
index 0000000..1c9259d
--- /dev/null
+++ b/fixtures/flagship/public/openapi.json
@@ -0,0 +1,344 @@
+{
+  "openapi": "3.1.0",
+  "info": {
+    "title": "ora-air API",
+    "version": "0.1.0",
+    "description": "HTTP API for the ora-air demo app. Public read-only flight search is available without auth; booking, seats, and payment flows are intended for trusted first-party clients."
+  },
+  "servers": [
+    {
+      "url": "https://flagship-fixture.example.com"
+    }
+  ],
+  "paths": {
+    "/api/search": {
+      "get": {
+        "summary": "Search available flights",
+        "parameters": [
+          {
+            "name": "origin",
+            "in": "query",
+            "required": true,
+            "schema": { "type": "string" },
+            "description": "Origin IATA code, e.g. JFK"
+          },
+          {
+            "name": "destination",
+            "in": "query",
+            "required": true,
+            "schema": { "type": "string" },
+            "description": "Destination IATA code, e.g. LAX"
+          },
+          {
+            "name": "date",
+            "in": "query",
+            "required": true,
+            "schema": { "type": "string", "format": "date" },
+            "description": "Departure date in YYYY-MM-DD format"
+          },
+          {
+            "name": "passengers",
+            "in": "query",
+            "required": false,
+            "schema": { "type": "integer", "minimum": 1, "maximum": 9, "default": 1 },
+            "description": "Passenger count"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Matching flight options",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "flights": {
+                      "type": "array",
+                      "items": { "$ref": "#/components/schemas/Flight" }
+                    }
+                  },
+                  "required": ["flights"]
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        }
+      }
+    },
+    "/api/session": {
+      "post": {
+        "summary": "Mint a short-lived demo session token",
+        "responses": {
+          "200": {
+            "description": "Token minted successfully",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "t": { "type": "string" }
+                  },
+                  "required": ["t"]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/seats": {
+      "post": {
+        "summary": "Get seat map for a selected flight",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "f": { "type": "string", "description": "Flight id" }
+                },
+                "required": ["f"]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Seat map returned",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/SeatMapResponse" }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      }
+    },
+    "/api/book": {
+      "post": {
+        "summary": "Create a pending booking",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "f": { "type": "string", "description": "Flight id" },
+                  "c": { "type": "string", "description": "Fare class code" },
+                  "s": { "type": "string", "description": "Seat id" },
+                  "px": {
+                    "type": "object",
+                    "properties": {
+                      "fn": { "type": "string" },
+                      "ln": { "type": "string" },
+                      "em": { "type": "string", "format": "email" }
+                    },
+                    "required": ["fn", "ln", "em"]
+                  }
+                },
+                "required": ["f", "c", "s", "px"]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Booking created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "b": { "type": "string", "description": "Booking id" },
+                    "a": { "type": "number", "description": "Amount due" }
+                  },
+                  "required": ["b", "a"]
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      }
+    },
+    "/api/pay": {
+      "post": {
+        "summary": "Pay and confirm a pending booking",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "b": { "type": "string", "description": "Booking id" },
+                  "cn": { "type": "string", "description": "Card number" },
+                  "ex": { "type": "string", "description": "Expiry MM/YY" },
+                  "cv": { "type": "string", "description": "CVV" },
+                  "nm": { "type": "string", "description": "Cardholder name" }
+                },
+                "required": ["b", "cn", "ex", "cv"]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Payment accepted and booking confirmed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "p": { "type": "string", "description": "PNR" },
+                    "b": { "type": "string", "description": "Booking id" }
+                  },
+                  "required": ["p", "b"]
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      }
+    }
+  },
+  "components": {
+    "responses": {
+      "BadRequest": {
+        "description": "Invalid request payload or parameters",
+        "content": {
+          "application/json": {
+            "schema": {
+              "type": "object",
+              "properties": {
+                "error": { "type": "string" },
+                "e": { "type": "string" }
+              }
+            }
+          }
+        }
+      },
+      "Forbidden": {
+        "description": "Request denied by bot/auth guard",
+        "content": {
+          "application/json": {
+            "schema": {
+              "type": "object",
+              "properties": {
+                "error": { "type": "string" }
+              }
+            }
+          }
+        }
+      }
+    },
+    "schemas": {
+      "Flight": {
+        "type": "object",
+        "properties": {
+          "id": { "type": "string" },
+          "flightNumber": { "type": "string" },
+          "origin": { "type": "string" },
+          "destination": { "type": "string" },
+          "departureTime": { "type": "string" },
+          "arrivalTime": { "type": "string" },
+          "durationMinutes": { "type": "integer" },
+          "aircraft": { "type": "string" },
+          "fares": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "classCode": { "type": "string" },
+                "className": { "type": "string" },
+                "price": { "type": "number" },
+                "perks": {
+                  "type": "array",
+                  "items": { "type": "string" }
+                }
+              },
+              "required": ["classCode", "className", "price", "perks"]
+            }
+          }
+        },
+        "required": [
+          "id",
+          "flightNumber",
+          "origin",
+          "destination",
+          "departureTime",
+          "arrivalTime",
+          "durationMinutes",
+          "aircraft",
+          "fares"
+        ]
+      },
+      "SeatMapResponse": {
+        "type": "object",
+        "properties": {
+          "ac": { "type": "string", "description": "Aircraft model" },
+          "cb": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "n": { "type": "string" },
+                "fc": {
+                  "type": "array",
+                  "items": { "type": "string" }
+                },
+                "cl": {
+                  "type": "array",
+                  "items": { "type": "string" }
+                },
+                "rw": {
+                  "type": "array",
+                  "items": { "type": "integer" }
+                },
+                "st": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "s": { "type": "string" },
+                      "r": { "type": "integer" },
+                      "c": { "type": "string" },
+                      "o": { "type": "integer" },
+                      "x": { "type": "integer" },
+                      "p": { "type": "number" }
+                    },
+                    "required": ["s", "r", "c", "o", "x", "p"]
+                  }
+                }
+              },
+              "required": ["n", "fc", "cl", "rw", "st"]
+            }
+          }
+        },
+        "required": ["ac", "cb"]
+      }
+    }
+  }
+}
diff --git a/fixtures/flagship/public/robots.txt b/fixtures/flagship/public/robots.txt
new file mode 100644
index 0000000..03a05c5
--- /dev/null
+++ b/fixtures/flagship/public/robots.txt
@@ -0,0 +1,19 @@
+
+User-agent: *
+Allow: /
+
+User-agent: AhrefsBot
+User-agent: MJ12bot
+User-agent: Rogerbot
+User-agent: SemrushBot
+User-agent: DotBot
+User-agent: MegaIndex.ru
+User-agent: BlexBot
+User-agent: ZoominfoBot
+User-agent: BytedanceSpy
+Disallow: /
+
+
+# Added by @ora-ai/ax — machine-readable discovery pointers for agents.
+Sitemap: https://flagship-fixture.example.com/sitemap.xml
+Agentmap: https://flagship-fixture.example.com/.well-known/ai-catalog.json
diff --git a/fixtures/flagship/report.golden.json b/fixtures/flagship/report.golden.json
new file mode 100644
index 0000000..845559b
--- /dev/null
+++ b/fixtures/flagship/report.golden.json
@@ -0,0 +1,388 @@
+{
+  "generatedAt": "<generatedAt>",
+  "siteUrl": "https://flagship-fixture.example.com",
+  "basePath": "",
+  "routers": [
+    "app"
+  ],
+  "catalog": {
+    "entryCount": 4,
+    "entries": [
+      {
+        "identifier": "urn:air:flagship-fixture.example.com:mcp-server:api-public-mcp",
+        "type": "application/mcp-server-card+json",
+        "url": "https://flagship-fixture.example.com/.well-known/mcp/server-card.json",
+        "displayName": "MCP server"
+      },
+      {
+        "identifier": "urn:air:flagship-fixture.example.com:mcp-server:api-mcp",
+        "type": "application/mcp-server-card+json",
+        "url": "https://flagship-fixture.example.com/.well-known/mcp/server-card/api-mcp.json",
+        "displayName": "MCP server"
+      },
+      {
+        "identifier": "urn:air:flagship-fixture.example.com:openapi",
+        "type": "application/vnd.oai.openapi+json;version=3.1",
+        "url": "https://flagship-fixture.example.com/openapi.json",
+        "displayName": "ora-air API"
+      },
+      {
+        "identifier": "urn:air:flagship-fixture.example.com:llms-txt",
+        "type": "text/markdown",
+        "url": "https://flagship-fixture.example.com/llms.txt",
+        "displayName": "llms.txt"
+      }
+    ],
+    "path": "public/.well-known/ai-catalog.json",
+    "target": "static"
+  },
+  "mcp": {
+    "mounts": [
+      {
+        "pathname": "/api/public/mcp",
+        "tools": [
+          "search_flights"
+        ]
+      },
+      {
+        "pathname": "/api/mcp",
+        "tools": [
+          "get_seat_map",
+          "book_flight",
+          "pay_booking"
+        ]
+      }
+    ],
+    "unreviewedMounts": [],
+    "primaryMount": "/api/public/mcp",
+    "serverCardPath": "public/.well-known/mcp/server-card.json",
+    "serverCards": [
+      {
+        "mount": "/api/public/mcp",
+        "path": "public/.well-known/mcp/server-card/api-public-mcp.json"
+      },
+      {
+        "mount": "/api/mcp",
+        "path": "public/.well-known/mcp/server-card/api-mcp.json"
+      }
+    ]
+  },
+  "agent404": {
+    "notFoundPresent": false,
+    "agentAware": false,
+    "pages": [],
+    "markdownGuide": "public/404.md"
+  },
+  "middleware": {
+    "present": true,
+    "wiredToAx": true,
+    "source": "middleware.ts"
+  },
+  "artifacts": {
+    "robotsTxt": {
+      "found": true,
+      "source": "public/robots.txt"
+    },
+    "sitemap": {
+      "found": true,
+      "source": "app/sitemap.ts"
+    },
+    "agentsMd": {
+      "found": true,
+      "source": "public/agents.md"
+    },
+    "jsonLd": {
+      "found": true,
+      "source": "app/layout.tsx"
+    },
+    "llmsTxt": {
+      "found": true,
+      "source": "app/llms.txt/route.ts"
+    },
+    "openapi": {
+      "found": true,
+      "source": "public/openapi.json"
+    }
+  },
+  "auth": {
+    "gatedSurfaces": [
+      {
+        "path": "/api/mcp",
+        "status": "oauth2",
+        "declared": true,
+        "oauthEndpoints": false,
+        "docsUrl": "https://flagship-fixture.example.com/agents.md"
+      }
+    ]
+  },
+  "scaffolds": {
+    "robotsTxt": {
+      "action": "unchanged",
+      "path": "public/robots.txt",
+      "reason": "it already declares every discovery pointer ax would add"
+    }
+  },
+  "markdownTwins": {
+    "enabled": true,
+    "written": [
+      {
+        "route": "/guide",
+        "path": "public/guide.md",
+        "tier": 1,
+        "source": "mdx"
+      },
+      {
+        "route": "/",
+        "path": "public/index.md",
+        "tier": 2,
+        "source": "prerender"
+      },
+      {
+        "route": "/checkout",
+        "path": "public/checkout.md",
+        "tier": 2,
+        "source": "metadata"
+      },
+      {
+        "route": "/confirmation",
+        "path": "public/confirmation.md",
+        "tier": 2,
+        "source": "metadata"
+      },
+      {
+        "route": "/results",
+        "path": "public/results.md",
+        "tier": 2,
+        "source": "metadata"
+      },
+      {
+        "route": "/seats",
+        "path": "public/seats.md",
+        "tier": 2,
+        "source": "metadata"
+      }
+    ],
+    "userOwned": [
+      {
+        "route": "/destinations",
+        "source": "public/destinations.md"
+      }
+    ],
+    "skipped": [
+      {
+        "route": "/account",
+        "reason": "gated",
+        "detail": "The route is gated (isGated), and a gated page’s prerender is typically a login shell — deriving a twin from it would publish a converted login page as the page’s content."
+      }
+    ],
+    "dynamicRouteCount": 1,
+    "deleted": [],
+    "authMd": {
+      "path": "public/auth.md",
+      "surfaceCount": 1
+    }
+  },
+  "sizes": [
+    {
+      "artifact": "ai-catalog.json",
+      "path": "public/.well-known/ai-catalog.json",
+      "bytes": 1857,
+      "chars": 1857,
+      "tokens": 464
+    },
+    {
+      "artifact": "mcp-server-card",
+      "path": "public/.well-known/mcp/server-card.json",
+      "bytes": 638,
+      "chars": 638,
+      "tokens": 160
+    },
+    {
+      "artifact": "mcp-server-card",
+      "path": "public/.well-known/mcp/server-card/api-public-mcp.json",
+      "bytes": 638,
+      "chars": 638,
+      "tokens": 160
+    },
+    {
+      "artifact": "mcp-server-card",
+      "path": "public/.well-known/mcp/server-card/api-mcp.json",
+      "bytes": 832,
+      "chars": 832,
+      "tokens": 208
+    },
+    {
+      "artifact": "markdown-twin",
+      "path": "public/guide.md",
+      "bytes": 1246,
+      "chars": 1242,
+      "tokens": 311
+    },
+    {
+      "artifact": "markdown-twin",
+      "path": "public/index.md",
+      "bytes": 1232,
+      "chars": 1224,
+      "tokens": 306
+    },
+    {
+      "artifact": "markdown-twin",
+      "path": "public/checkout.md",
+      "bytes": 675,
+      "chars": 665,
+      "tokens": 166
+    },
+    {
+      "artifact": "markdown-twin",
+      "path": "public/confirmation.md",
+      "bytes": 609,
+      "chars": 603,
+      "tokens": 151
+    },
+    {
+      "artifact": "markdown-twin",
+      "path": "public/results.md",
+      "bytes": 590,
+      "chars": 584,
+      "tokens": 146
+    },
+    {
+      "artifact": "markdown-twin",
+      "path": "public/seats.md",
+      "bytes": 676,
+      "chars": 666,
+      "tokens": 167
+    },
+    {
+      "artifact": "auth.md",
+      "path": "public/auth.md",
+      "bytes": 811,
+      "chars": 807,
+      "tokens": 202
+    },
+    {
+      "artifact": "404.md",
+      "path": "public/404.md",
+      "bytes": 1489,
+      "chars": 1461,
+      "tokens": 365
+    }
+  ],
+  "ora": {
+    "checks": [
+      {
+        "id": "ard-catalog",
+        "artifact": "ai-catalog.json",
+        "status": "addressed"
+      },
+      {
+        "id": "agent-discovery-file",
+        "artifact": "ai-catalog.json",
+        "status": "addressed"
+      },
+      {
+        "id": "llms-txt-exists",
+        "artifact": "llms.txt",
+        "status": "addressed"
+      },
+      {
+        "id": "llms-txt-formatting",
+        "artifact": "llms.txt",
+        "status": "addressed"
+      },
+      {
+        "id": "markdown-url-fallback",
+        "artifact": "markdown-twins",
+        "status": "addressed"
+      },
+      {
+        "id": "markdown-frontmatter",
+        "artifact": "markdown-twins",
+        "status": "addressed"
+      },
+      {
+        "id": "robots-ai-policy-quality",
+        "artifact": "robots.txt",
+        "status": "addressed"
+      },
+      {
+        "id": "sitemap",
+        "artifact": "sitemap",
+        "status": "addressed"
+      },
+      {
+        "id": "agent-instruction",
+        "artifact": "agents.md",
+        "status": "addressed"
+      },
+      {
+        "id": "json-ld",
+        "artifact": "json-ld",
+        "status": "addressed"
+      },
+      {
+        "id": "org-schema-completeness",
+        "artifact": "json-ld",
+        "status": "addressed"
+      },
+      {
+        "id": "openapi-spec",
+        "artifact": "openapi.json",
+        "status": "addressed"
+      },
+      {
+        "id": "mcp-server",
+        "artifact": "mcp-server",
+        "status": "addressed"
+      },
+      {
+        "id": "mcp-server-card",
+        "artifact": "mcp-server-card",
+        "status": "addressed"
+      },
+      {
+        "id": "auth-md-exists",
+        "artifact": "auth.md",
+        "status": "addressed"
+      },
+      {
+        "id": "auth-md-structure",
+        "artifact": "auth.md",
+        "status": "addressed"
+      },
+      {
+        "id": "mcp-auth-mechanism",
+        "artifact": "auth-declaration",
+        "status": "addressed"
+      },
+      {
+        "id": "oauth-protected-resource",
+        "artifact": "oauth-metadata",
+        "status": "addressed"
+      },
+      {
+        "id": "markdown-negotiation",
+        "artifact": "middleware",
+        "status": "addressed"
+      },
+      {
+        "id": "markdown-negotiation-vary",
+        "artifact": "middleware",
+        "status": "addressed"
+      }
+    ]
+  },
+  "warnings": [],
+  "recommendations": [
+    "public/openapi.json declares no components.securitySchemes — if your API requires auth, add the scheme(s) there so agents know how to authenticate. Omit it only if the API is genuinely open.",
+    "4 pages' twins are derived from page metadata only (the content renders in the browser). The twins say so honestly; for full-fidelity twins, give those pages server-rendered content.",
+    "1 page file has dynamic URL segments, so no markdown twins exist for them (no build-time HTML, and ax never guesses URLs). To give those pages a markdown representation, add a markdown source per page or prerender representative routes.",
+    "sitemap detected (app/sitemap.ts) — make sure robots.txt references it with a \"Sitemap:\" line, that it lists all public routes, and that each entry carries a <lastmod> date so agents can judge how fresh a page is before fetching it.",
+    "robots.txt detected (public/robots.txt) — confirm it explicitly Allows the AI agents you want to reach (scoped to specific User-agent groups, never \"User-agent: *\").",
+    "agents.md detected (public/agents.md) — confirm it has clear when-to-use / when-NOT-to-use guidance for agents.",
+    "JSON-LD structured data detected (app/layout.tsx) — confirm it includes an Organization block with a \"sameAs\" array (LinkedIn/GitHub/npm/socials), a logo, and an address, and at least one more @type beyond Organization (SoftwareApplication/Product, or a FAQPage), so registries can disambiguate and rank your site — covering more schema.org types helps them understand it more fully. Make sure you also have an llms.txt: it and JSON-LD reinforce each other (what your site is for vs. what entity it is).",
+    "Gated routes should keep their honest 401/403 status and point agents at the auth guide: add a WWW-Authenticate header and a Link (or body) pointer to /auth.md in your gated route handlers. A 200 \"this is gated\" page is a soft auth wall agents are built to distrust; ax generates the guide but never rewrites your handlers.",
+    "Markdown twins exist for your pages — link each HTML page to its twin so crawlers find the machine-readable version. Add this to the page <head> (ax prints the tag; it never edits your layout): <link rel=\"alternate\" type=\"text/markdown\" href=\"https://flagship-fixture.example.com/checkout.md\" />",
+    "No app/not-found.tsx found — agents that hit a missing URL get Next.js’s bare default 404, a dead end that makes them give up or guess. Add a standard 404 page in your own design system (a clear “page not found” and a way back home), and include `<link rel=\"alternate\" type=\"text/markdown\" href=\"/404.md\" />` so agents can hop from it to /404.md — the generated wayfinding guide (real routes + discovery links) this build writes. Rendered in the page’s JSX, React hoists the tag into <head> (App Router); use next/head in the Pages Router."
+  ]
+}
diff --git a/fixtures/llms-txt/tsconfig.json b/fixtures/flagship/tsconfig.json
similarity index 68%
rename from fixtures/llms-txt/tsconfig.json
rename to fixtures/flagship/tsconfig.json
index 9666dbd..d15525a 100644
--- a/fixtures/llms-txt/tsconfig.json
+++ b/fixtures/flagship/tsconfig.json
@@ -1,5 +1,10 @@
 {
   "extends": "../tsconfig.next.json",
+  "compilerOptions": {
+    "paths": {
+      "@/*": ["./*"]
+    }
+  },
   "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
   "exclude": ["node_modules"]
 }
diff --git a/fixtures/mcp-adapter-gated/twins.golden/404.md b/fixtures/flagship/twins.golden/404.md
similarity index 51%
rename from fixtures/mcp-adapter-gated/twins.golden/404.md
rename to fixtures/flagship/twins.golden/404.md
index d041d3e..f3c3544 100644
--- a/fixtures/mcp-adapter-gated/twins.golden/404.md
+++ b/fixtures/flagship/twins.golden/404.md
@@ -1,7 +1,7 @@
 ---
-title: "Page not found — mcp-adapter-gated"
+title: "Page not found — flagship"
 description: "Where to continue when a URL on this site does not exist: discovery links and real routes."
-canonical_url: https://mcp-gated-fixture.example.com/404.md
+canonical_url: https://flagship-fixture.example.com/404.md
 last_updated: <last_updated>
 generated-by: "@ora-ai/ax"
 ---
@@ -15,9 +15,17 @@ below instead.
 ## Start here
 
 - [/.well-known/ai-catalog.json](/.well-known/ai-catalog.json) — machine-readable catalog of everything this site offers agents
+- [/llms.txt](/llms.txt) — what this site is for and its key pages, in plain language
 - [/auth.md](/auth.md) — how to obtain access to the gated surfaces
+- [/openapi.json](/openapi.json) — the REST API, as an OpenAPI document
 - [/.well-known/mcp/server-card.json](/.well-known/mcp/server-card.json) — the MCP server card (connection + capabilities)
 
 ## Pages that do exist
 
-- [/](/)
+- [/](/) — markdown: [/index.md](/index.md)
+- [/checkout](/checkout) — markdown: [/checkout.md](/checkout.md)
+- [/confirmation](/confirmation) — markdown: [/confirmation.md](/confirmation.md)
+- [/destinations](/destinations) — markdown: [/destinations.md](/destinations.md)
+- [/guide](/guide) — markdown: [/guide.md](/guide.md)
+- [/results](/results) — markdown: [/results.md](/results.md)
+- [/seats](/seats) — markdown: [/seats.md](/seats.md)
diff --git a/fixtures/flagship/twins.golden/auth.md b/fixtures/flagship/twins.golden/auth.md
new file mode 100644
index 0000000..c9d1945
--- /dev/null
+++ b/fixtures/flagship/twins.golden/auth.md
@@ -0,0 +1,19 @@
+---
+title: "Authentication — flagship"
+description: "How to obtain access to the gated surfaces on this site."
+canonical_url: https://flagship-fixture.example.com/auth.md
+last_updated: <last_updated>
+generated-by: "@ora-ai/ax"
+---
+
+# Authentication
+
+flagship has 1 gated surface. This document is generated at build time from the site's own committed auth declarations — it describes how to authenticate and never contains credentials.
+
+## MCP server at /api/mcp
+
+An MCP (Model Context Protocol) server. Connecting requires authentication.
+
+- Auth: OAuth 2.0
+- Auth requirements (RFC 9728 protected-resource metadata): [/.well-known/oauth-protected-resource](https://flagship-fixture.example.com/.well-known/oauth-protected-resource)
+- Get access: <https://flagship-fixture.example.com/agents.md>
diff --git a/fixtures/flagship/twins.golden/checkout.md b/fixtures/flagship/twins.golden/checkout.md
new file mode 100644
index 0000000..55cb50c
--- /dev/null
+++ b/fixtures/flagship/twins.golden/checkout.md
@@ -0,0 +1,13 @@
+---
+title: "Checkout — Ora Air"
+description: "Passenger details and payment for your Ora Air booking. Demo payments only — use test card 4242 4242 4242 4242."
+canonical_url: https://flagship-fixture.example.com/checkout
+last_updated: <last_updated>
+generated-by: "@ora-ai/ax"
+---
+
+# Checkout — Ora Air
+
+Passenger details and payment for your Ora Air booking. Demo payments only — use test card 4242 4242 4242 4242.
+
+> This page is interactive — its content loads in the browser and is not mirrored here. For machine-readable access to this site, start from [/.well-known/ai-catalog.json](https://flagship-fixture.example.com/.well-known/ai-catalog.json).
diff --git a/fixtures/flagship/twins.golden/confirmation.md b/fixtures/flagship/twins.golden/confirmation.md
new file mode 100644
index 0000000..0914c38
--- /dev/null
+++ b/fixtures/flagship/twins.golden/confirmation.md
@@ -0,0 +1,13 @@
+---
+title: "Booking confirmed — Ora Air"
+description: "Your Ora Air booking reference (PNR), itinerary summary, and receipt."
+canonical_url: https://flagship-fixture.example.com/confirmation
+last_updated: <last_updated>
+generated-by: "@ora-ai/ax"
+---
+
+# Booking confirmed — Ora Air
+
+Your Ora Air booking reference (PNR), itinerary summary, and receipt.
+
+> This page is interactive — its content loads in the browser and is not mirrored here. For machine-readable access to this site, start from [/.well-known/ai-catalog.json](https://flagship-fixture.example.com/.well-known/ai-catalog.json).
diff --git a/fixtures/flagship/twins.golden/guide.md b/fixtures/flagship/twins.golden/guide.md
new file mode 100644
index 0000000..f44596c
--- /dev/null
+++ b/fixtures/flagship/twins.golden/guide.md
@@ -0,0 +1,34 @@
+---
+title: "Booking guide"
+canonical_url: https://flagship-fixture.example.com/guide
+last_updated: <last_updated>
+generated-by: "@ora-ai/ax"
+---
+
+# Booking guide
+
+How to search, hold, and pay for an Ora Air flight — the same flow whether you are a person in a
+browser or an agent driving the MCP tools.
+
+## Search
+
+Start from the [homepage](/) or call the public MCP server's `search_flights` tool with an origin,
+a destination, and an ISO date. Results include a flight id, fare classes, and one-way prices.
+
+## Choose a seat
+
+Every fare class permits seat selection before payment. Seat maps list each cabin's rows, the
+seats still open, and any extra-legroom fee. Agents fetch the same data with `get_seat_map` on the
+gated MCP server.
+
+## Book and pay
+
+Booking creates a pending reservation with a `bookingId` and the total amount due. Payment
+confirms it and returns a PNR. This is a demo environment: use the test card `4242 4242 4242 4242`
+— any other number declines.
+
+## When things go wrong
+
+- An unknown flight id means the fare expired; search again.
+- A declined payment leaves the booking pending; retry with the test card.
+- Seats are held only after payment, so a taken seat means re-selecting from the current map.
diff --git a/fixtures/flagship/twins.golden/index.md b/fixtures/flagship/twins.golden/index.md
new file mode 100644
index 0000000..49869a6
--- /dev/null
+++ b/fixtures/flagship/twins.golden/index.md
@@ -0,0 +1,92 @@
+---
+title: "Ora Air — one-way fares across four continents"
+description: "Book one-way flights across 12 destinations on four continents. Flexible fares, award-winning cabins, and Ora Miles rewards — search, pick a seat, and pay in minutes."
+canonical_url: https://flagship-fixture.example.com/
+last_updated: <last_updated>
+generated-by: "@ora-ai/ax"
+---
+
+Fly beyond expectations
+
+# Where will the horizon  
+take you next?
+
+Non-stop routes across four continents, award-winning cabins, and fares designed around the way you travel.
+
+One way
+
+Round trip
+
+Multi-city
+
+From
+
+Select city
+
+To
+
+Select city
+
+Departure
+
+Select date
+
+Passengers
+
+1 Adult
+
+−
+
++
+
+Search flights
+
+Featured fares
+
+## Popular destinations from $389
+
+[View all destinations →](/destinations)
+
+LHR
+
+London
+
+One way from
+
+$389
+
+NRT
+
+Tokyo
+
+One way from
+
+$720
+
+CDG
+
+Paris
+
+One way from
+
+$412
+
+DXB
+
+Dubai
+
+One way from
+
+$545
+
+Flexible by design
+
+Change your travel dates up to two hours before departure on Flex fares, with no change fees.
+
+Award-winning cabins
+
+From our refreshed Economy to lie-flat Business suites, every seat is designed around rest.
+
+Ora Miles
+
+Earn miles on every fare and unlock lounge access, upgrades, and partner rewards.
diff --git a/fixtures/flagship/twins.golden/results.md b/fixtures/flagship/twins.golden/results.md
new file mode 100644
index 0000000..fa1c408
--- /dev/null
+++ b/fixtures/flagship/twins.golden/results.md
@@ -0,0 +1,13 @@
+---
+title: "Flight results — Ora Air"
+description: "Compare one-way Ora Air fares and cabins for your route and date."
+canonical_url: https://flagship-fixture.example.com/results
+last_updated: <last_updated>
+generated-by: "@ora-ai/ax"
+---
+
+# Flight results — Ora Air
+
+Compare one-way Ora Air fares and cabins for your route and date.
+
+> This page is interactive — its content loads in the browser and is not mirrored here. For machine-readable access to this site, start from [/.well-known/ai-catalog.json](https://flagship-fixture.example.com/.well-known/ai-catalog.json).
diff --git a/fixtures/flagship/twins.golden/seats.md b/fixtures/flagship/twins.golden/seats.md
new file mode 100644
index 0000000..372f1f1
--- /dev/null
+++ b/fixtures/flagship/twins.golden/seats.md
@@ -0,0 +1,13 @@
+---
+title: "Choose your seat — Ora Air"
+description: "Pick your seat from the live cabin map — Economy, Premium, and Business with per-seat fees shown upfront."
+canonical_url: https://flagship-fixture.example.com/seats
+last_updated: <last_updated>
+generated-by: "@ora-ai/ax"
+---
+
+# Choose your seat — Ora Air
+
+Pick your seat from the live cabin map — Economy, Premium, and Business with per-seat fees shown upfront.
+
+> This page is interactive — its content loads in the browser and is not mirrored here. For machine-readable access to this site, start from [/.well-known/ai-catalog.json](https://flagship-fixture.example.com/.well-known/ai-catalog.json).
diff --git a/fixtures/llms-txt/README.md b/fixtures/llms-txt/README.md
deleted file mode 100644
index 83e97a7..0000000
--- a/fixtures/llms-txt/README.md
+++ /dev/null
@@ -1,15 +0,0 @@
-# fixture: llms-txt
-
-An app that serves an [`llms.txt`](https://llmstxt.org/) the recommended Next.js way — a route handler
-at `app/llms.txt/route.ts` with `dynamic = 'force-static'`, so `/llms.txt` is prerendered at build. (A
-static `public/llms.txt` is the other supported form.)
-
-**Exercises:** detect-and-reference of a **confirmed-ingested** artifact — Ora's crawler ingests
-`llms.txt` directly. The plugin references `/llms.txt` as a `text/markdown` entry, whether it's
-served from a route or a static file. Scaffolding a starter when absent is in-scope for v1, but
-**opt-in** via `ax.config`'s `scaffoldLlmsTxt: true` — this fixture doesn't need it since it
-already has one.
-
-Ships an `ax.config.ts` declaring `siteUrl` so the emitted entry's URL is deterministic in CI
-(without it, this detector still runs, but skips emitting a URL-bearing entry since none of this
-repo's test environments set Vercel's production-domain env var).
diff --git a/fixtures/llms-txt/app/llms.txt/route.ts b/fixtures/llms-txt/app/llms.txt/route.ts
deleted file mode 100644
index 9971ead..0000000
--- a/fixtures/llms-txt/app/llms.txt/route.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-// llms.txt served the recommended Next.js way: a route handler at app/llms.txt/route.ts. With
-// `dynamic = 'force-static'` Next prerenders it at build, so /llms.txt is served as a static asset.
-// `dynamic` is a standard route-segment export, so this passes Next 15's route-export check.
-export const dynamic = 'force-static';
-
-export function GET(): Response {
-  const body = `# Example
-
-> A minimal agent-oriented documentation index, served at /llms.txt.
-
-## Docs
-
-- [Quickstart](https://example.com/docs/quickstart): Get started in five minutes.
-- [API reference](https://example.com/docs/api): REST endpoints and schemas.
-`;
-
-  return new Response(body, {
-    headers: { 'Content-Type': 'text/plain; charset=utf-8' },
-  });
-}
diff --git a/fixtures/llms-txt/app/page.tsx b/fixtures/llms-txt/app/page.tsx
deleted file mode 100644
index 02e7755..0000000
--- a/fixtures/llms-txt/app/page.tsx
+++ /dev/null
@@ -1,11 +0,0 @@
-export default function Home() {
-  return (
-    <main>
-      <h1>llms.txt fixture</h1>
-      <p>
-        This app serves /llms.txt from a route handler (the recommended Next.js way). The plugin
-        detects it and references it as a text/markdown entry — a confirmed-ingested artifact.
-      </p>
-    </main>
-  );
-}
diff --git a/fixtures/llms-txt/ax.config.ts b/fixtures/llms-txt/ax.config.ts
deleted file mode 100644
index 743f3cf..0000000
--- a/fixtures/llms-txt/ax.config.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import type { AxConfig } from '@ora-ai/ax';
-
-// `siteUrl` makes the fixture deterministic regardless of where it's built (CI, a laptop, ...) —
-// without it, zero-config llms.txt detection (Phase 2.2) would still run but skip emitting a
-// URL-bearing entry, since none of this repo's test environments set Vercel's production-domain
-// env var. A real deployment on Vercel wouldn't need this line.
-//
-// An app hosted somewhere other than Vercel would typically read this from its own env var
-// instead of a literal — this file is evaluated as real code (via jiti), so
-// `siteUrl: process.env.SITE_URL` works with no special support from the plugin. It's a literal
-// here only so this fixture's expected output is identical everywhere it's built, regardless of
-// what env vars happen to be set.
-const config: AxConfig = {
-  siteUrl: 'https://llms-txt-fixture.example.com',
-};
-
-export default config;
diff --git a/fixtures/llms-txt/package.json b/fixtures/llms-txt/package.json
deleted file mode 100644
index edadbd4..0000000
--- a/fixtures/llms-txt/package.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "name": "@ax-fixtures/llms-txt",
-  "version": "0.0.0",
-  "private": true,
-  "scripts": {
-    "build": "next build",
-    "postbuild": "ax --report --yes",
-    "dev": "next dev",
-    "start": "next start"
-  },
-  "dependencies": {
-    "next": "^15.1.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0"
-  },
-  "devDependencies": {
-    "@types/node": "^20.17.12",
-    "@types/react": "^19.0.7",
-    "@types/react-dom": "^19.0.3",
-    "@ora-ai/ax": "workspace:*",
-    "typescript": "^5.7.3"
-  }
-}
diff --git a/fixtures/llms-txt/report.golden.json b/fixtures/llms-txt/report.golden.json
deleted file mode 100644
index 78a7c05..0000000
--- a/fixtures/llms-txt/report.golden.json
+++ /dev/null
@@ -1,183 +0,0 @@
-{
-  "generatedAt": "<generatedAt>",
-  "siteUrl": "https://llms-txt-fixture.example.com",
-  "basePath": "",
-  "routers": [
-    "app"
-  ],
-  "catalog": {
-    "entryCount": 1,
-    "entries": [
-      {
-        "identifier": "urn:air:llms-txt-fixture.example.com:llms-txt",
-        "type": "text/markdown",
-        "url": "https://llms-txt-fixture.example.com/llms.txt",
-        "displayName": "llms.txt"
-      }
-    ],
-    "path": "public/.well-known/ai-catalog.json",
-    "target": "static"
-  },
-  "mcp": {
-    "mounts": [],
-    "unreviewedMounts": []
-  },
-  "agent404": {
-    "notFoundPresent": false,
-    "agentAware": false,
-    "pages": [],
-    "markdownGuide": "public/404.md"
-  },
-  "middleware": {
-    "present": false,
-    "wiredToAx": false
-  },
-  "artifacts": {
-    "robotsTxt": {
-      "found": false
-    },
-    "sitemap": {
-      "found": false
-    },
-    "agentsMd": {
-      "found": false
-    },
-    "jsonLd": {
-      "found": false
-    },
-    "llmsTxt": {
-      "found": true,
-      "source": "app/llms.txt/route.ts"
-    },
-    "openapi": {
-      "found": false
-    }
-  },
-  "auth": {
-    "gatedSurfaces": []
-  },
-  "scaffolds": {},
-  "markdownTwins": {
-    "enabled": true,
-    "written": [],
-    "userOwned": [],
-    "skipped": [
-      {
-        "route": "/",
-        "reason": "too-little-text",
-        "detail": "The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker)."
-      }
-    ],
-    "dynamicRouteCount": 0,
-    "deleted": []
-  },
-  "sizes": [
-    {
-      "artifact": "ai-catalog.json",
-      "path": "public/.well-known/ai-catalog.json",
-      "bytes": 405,
-      "chars": 405,
-      "tokens": 101
-    },
-    {
-      "artifact": "404.md",
-      "path": "public/404.md",
-      "bytes": 771,
-      "chars": 763,
-      "tokens": 191
-    }
-  ],
-  "ora": {
-    "checks": [
-      {
-        "id": "ard-catalog",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "agent-discovery-file",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "llms-txt-exists",
-        "artifact": "llms.txt",
-        "status": "addressed"
-      },
-      {
-        "id": "llms-txt-formatting",
-        "artifact": "llms.txt",
-        "status": "addressed"
-      },
-      {
-        "id": "markdown-url-fallback",
-        "artifact": "markdown-twins",
-        "status": "actionable",
-        "note": "No markdown twin could be derived for the homepage (too-little-text): The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker). The report’s markdownTwins.skipped section lists every twin-less route with its reason."
-      },
-      {
-        "id": "markdown-frontmatter",
-        "artifact": "markdown-twins",
-        "status": "actionable",
-        "note": "No markdown twin could be derived for the homepage (too-little-text): The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker). The report’s markdownTwins.skipped section lists every twin-less route with its reason."
-      },
-      {
-        "id": "robots-ai-policy-quality",
-        "artifact": "robots.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "sitemap",
-        "artifact": "sitemap",
-        "status": "actionable"
-      },
-      {
-        "id": "agent-instruction",
-        "artifact": "agents.md",
-        "status": "actionable"
-      },
-      {
-        "id": "json-ld",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "org-schema-completeness",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "openapi-spec",
-        "artifact": "openapi.json",
-        "status": "actionable"
-      },
-      {
-        "id": "mcp-server",
-        "artifact": "mcp-server",
-        "status": "actionable"
-      },
-      {
-        "id": "markdown-negotiation",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      },
-      {
-        "id": "markdown-negotiation-vary",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      }
-    ]
-  },
-  "warnings": [],
-  "recommendations": [
-    "No OpenAPI doc found (public/openapi.json) — an OpenAPI doc lets agents understand and call your API without guessing at routes or schemas. ax never generates one; produce it however your API is defined (many schema/validation libraries can emit OpenAPI from your existing route definitions) and commit the result to public/openapi.json.",
-    "No sitemap found — add one so agents can discover all public routes. Use the built-in Next.js path (app/sitemap.ts); ax never generates a sitemap itself. Give each entry a <lastmod> date (agents use it to judge freshness), then reference it from robots.txt with a \"Sitemap:\" line.",
-    "No robots.txt found — add one (app/robots.ts or public/robots.txt) that explicitly Allows the reputable AI agents you want to reach, scoped to specific User-agent groups (never \"User-agent: *\"), plus a \"Sitemap:\" line. Note: Next's MetadataRoute.Robots (app/robots.ts) has no field for the \"Agentmap:\" catalog pointer — put that line in a static public/robots.txt. Set scaffoldRobots: true in ax.config to have one written for you.",
-    "No agents.md found — consider adding one (public/agents.md) with when-to-use / when-NOT-to-use guidance for agents. ax won't write its content for you; the companion skill can help author it from your repo.",
-    "No JSON-LD structured data found in your layouts/pages — structured data is how registries and agents disambiguate and rank your site. Add an Organization block in your root layout <head> (<script type=\"application/ld+json\">) with a \"sameAs\" array linking your LinkedIn/GitHub/npm/social profiles (the entity-disambiguation signal registries value), and at least one more schema.org @type beyond Organization — SoftwareApplication or Product for an app/API, or a FAQPage — since covering more types helps registries understand your site more fully. JSON-LD pairs with an llms.txt: llms.txt tells agents what your site is for, JSON-LD identifies it as an entity registries can rank — add both, not one alone. ax won’t author the block (the fields are judgment content); the companion skill can help draft it from your repo.",
-    "No app/not-found.tsx found — agents that hit a missing URL get Next.js’s bare default 404, a dead end that makes them give up or guess. Add a standard 404 page in your own design system (a clear “page not found” and a way back home), and include `<link rel=\"alternate\" type=\"text/markdown\" href=\"/404.md\" />` so agents can hop from it to /404.md — the generated wayfinding guide (real routes + discovery links) this build writes. Rendered in the page’s JSX, React hoists the tag into <head> (App Router); use next/head in the Pages Router.",
-    "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-  ]
-}
diff --git a/fixtures/llms-txt/twins.golden/404.md b/fixtures/llms-txt/twins.golden/404.md
deleted file mode 100644
index f683aea..0000000
--- a/fixtures/llms-txt/twins.golden/404.md
+++ /dev/null
@@ -1,22 +0,0 @@
----
-title: "Page not found — llms-txt"
-description: "Where to continue when a URL on this site does not exist: discovery links and real routes."
-canonical_url: https://llms-txt-fixture.example.com/404.md
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# Page not found
-
-The URL you requested does not exist on this site. It may have moved, or it may never have existed —
-requesting it again will keep returning this response. Do not retry; start from the links
-below instead.
-
-## Start here
-
-- [/.well-known/ai-catalog.json](/.well-known/ai-catalog.json) — machine-readable catalog of everything this site offers agents
-- [/llms.txt](/llms.txt) — what this site is for and its key pages, in plain language
-
-## Pages that do exist
-
-- [/](/)
diff --git a/fixtures/mcp-adapter-gated/README.md b/fixtures/mcp-adapter-gated/README.md
deleted file mode 100644
index 5dabad9..0000000
--- a/fixtures/mcp-adapter-gated/README.md
+++ /dev/null
@@ -1,18 +0,0 @@
-# fixture: mcp-adapter-gated
-
-A Next.js app hosting an MCP server via [`mcp-handler`](https://www.npmjs.com/package/mcp-handler),
-gated behind OAuth with `withMcpAuth` — the sibling of the `mcp-adapter` fixture that exercises the
-**gated** MCP path.
-
-**Exercises:** static auth detection. The `[transport]` route wraps its handler in
-`withMcpAuth(handler, verifyToken, { resourceMetadataPath: '/.well-known/oauth-protected-resource' })`.
-ax detects the wrapper textually and:
-
-- emits the MCP catalog entry with `auth: { status: "unknown" }` — it requires auth, but ax can't
-  probe the live server for the OAuth endpoints at build time, so it never guesses `api_key`/`none`
-  and never advertises the server as open;
-- cross-links the RFC 9728 metadata on the well-known server card as
-  `authentication: { required: true, resourceMetadata: ".../.well-known/oauth-protected-resource" }`.
-
-Ships an `ax.config.ts` declaring `siteUrl` so the emitted output is deterministic in CI. Contrast
-with `mcp-adapter`, whose (un-wrapped) mount carries no `auth` block at all.
diff --git a/fixtures/mcp-adapter-gated/app/[transport]/route.ts b/fixtures/mcp-adapter-gated/app/[transport]/route.ts
deleted file mode 100644
index fa1e634..0000000
--- a/fixtures/mcp-adapter-gated/app/[transport]/route.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-import { createMcpHandler, withMcpAuth } from 'mcp-handler';
-import { z } from 'zod';
-
-// An MCP server mounted with mcp-handler, then gated behind OAuth with `withMcpAuth` — Clerk's
-// official MCP path, and the ecosystem-idiomatic way to require auth. ax detects the wrapper
-// statically and marks the surface gated (auth.status "unknown"; the OAuth endpoints aren't
-// derivable at build time), and reads the `resourceMetadataPath` literal to cross-link the RFC 9728
-// metadata in the server card. It never advertises this server as open.
-const handler = createMcpHandler((server) => {
-  server.tool(
-    'roll_dice',
-    'Roll an N-sided die and return the result.',
-    { sides: z.number().int().min(2).describe('Number of sides on the die') },
-    async ({ sides }) => {
-      const value = 1 + Math.floor(Math.random() * sides);
-      return { content: [{ type: 'text', text: `🎲 ${value}` }] };
-    },
-  );
-});
-
-// A no-op verifier stands in for a real token check — enough to exercise the gated code path.
-const verifyToken = async (_req: Request): Promise<undefined> => undefined;
-
-const authed = withMcpAuth(handler, verifyToken, {
-  resourceMetadataPath: '/.well-known/oauth-protected-resource',
-});
-
-export { authed as GET, authed as POST, authed as DELETE };
diff --git a/fixtures/mcp-adapter-gated/app/layout.tsx b/fixtures/mcp-adapter-gated/app/layout.tsx
deleted file mode 100644
index 9e181f3..0000000
--- a/fixtures/mcp-adapter-gated/app/layout.tsx
+++ /dev/null
@@ -1,14 +0,0 @@
-import type { ReactNode } from 'react';
-
-export const metadata = {
-  title: 'MCP Adapter (gated) Fixture',
-  description: 'A Next.js app hosting an MCP server gated behind OAuth via withMcpAuth.',
-};
-
-export default function RootLayout({ children }: { children: ReactNode }) {
-  return (
-    <html lang="en">
-      <body>{children}</body>
-    </html>
-  );
-}
diff --git a/fixtures/mcp-adapter-gated/app/page.tsx b/fixtures/mcp-adapter-gated/app/page.tsx
deleted file mode 100644
index 75411f4..0000000
--- a/fixtures/mcp-adapter-gated/app/page.tsx
+++ /dev/null
@@ -1,11 +0,0 @@
-export default function Home() {
-  return (
-    <main>
-      <h1>MCP adapter (gated) fixture</h1>
-      <p>
-        An MCP server at /[transport] gated behind OAuth via <code>withMcpAuth</code> — ax marks it
-        gated (auth status &quot;unknown&quot;) rather than advertising it as open.
-      </p>
-    </main>
-  );
-}
diff --git a/fixtures/mcp-adapter-gated/ax.config.ts b/fixtures/mcp-adapter-gated/ax.config.ts
deleted file mode 100644
index b4b2b6a..0000000
--- a/fixtures/mcp-adapter-gated/ax.config.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-import type { AxConfig } from '@ora-ai/ax';
-
-// A literal `siteUrl` keeps this fixture's emitted output identical everywhere it's built (see the
-// mcp-adapter fixture for the full rationale). A real app would read this from its own env var.
-const config: AxConfig = {
-  siteUrl: 'https://mcp-gated-fixture.example.com',
-};
-
-export default config;
diff --git a/fixtures/mcp-adapter-gated/cards.golden/server-card.json b/fixtures/mcp-adapter-gated/cards.golden/server-card.json
deleted file mode 100644
index 1e3813b..0000000
--- a/fixtures/mcp-adapter-gated/cards.golden/server-card.json
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  "name": "com.example.mcp-gated-fixture/mcp-adapter-gated",
-  "description": "mcp-adapter-gated MCP server",
-  "version": "0.0.0",
-  "serverUrl": "https://mcp-gated-fixture.example.com/mcp",
-  "remotes": [
-    {
-      "type": "streamable-http",
-      "url": "https://mcp-gated-fixture.example.com/mcp"
-    }
-  ],
-  "tools": [
-    {
-      "name": "roll_dice"
-    }
-  ],
-  "serverInfo": {
-    "name": "mcp-adapter-gated",
-    "version": "0.0.0"
-  },
-  "transport": {
-    "type": "streamable-http",
-    "endpoint": "https://mcp-gated-fixture.example.com/mcp"
-  },
-  "capabilities": {
-    "tools": {}
-  },
-  "authentication": {
-    "required": true,
-    "resourceMetadata": "https://mcp-gated-fixture.example.com/.well-known/oauth-protected-resource"
-  }
-}
diff --git a/fixtures/mcp-adapter-gated/next-env.d.ts b/fixtures/mcp-adapter-gated/next-env.d.ts
deleted file mode 100644
index 830fb59..0000000
--- a/fixtures/mcp-adapter-gated/next-env.d.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-/// <reference types="next" />
-/// <reference types="next/image-types/global" />
-/// <reference path="./.next/types/routes.d.ts" />
-
-// NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
diff --git a/fixtures/mcp-adapter-gated/next.config.mjs b/fixtures/mcp-adapter-gated/next.config.mjs
deleted file mode 100644
index 4678774..0000000
--- a/fixtures/mcp-adapter-gated/next.config.mjs
+++ /dev/null
@@ -1,4 +0,0 @@
-/** @type {import('next').NextConfig} */
-const nextConfig = {};
-
-export default nextConfig;
diff --git a/fixtures/mcp-adapter-gated/package.json b/fixtures/mcp-adapter-gated/package.json
deleted file mode 100644
index 9df3d4d..0000000
--- a/fixtures/mcp-adapter-gated/package.json
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "name": "@ax-fixtures/mcp-adapter-gated",
-  "version": "0.0.0",
-  "private": true,
-  "scripts": {
-    "build": "next build",
-    "postbuild": "ax --report --yes",
-    "dev": "next dev",
-    "start": "next start"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "1.26.0",
-    "mcp-handler": "^1.1.0",
-    "next": "^15.1.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
-    "zod": "^3.24.1"
-  },
-  "devDependencies": {
-    "@types/node": "^20.17.12",
-    "@types/react": "^19.0.7",
-    "@types/react-dom": "^19.0.3",
-    "@ora-ai/ax": "workspace:*",
-    "typescript": "^5.7.3"
-  }
-}
diff --git a/fixtures/mcp-adapter-gated/report.golden.json b/fixtures/mcp-adapter-gated/report.golden.json
deleted file mode 100644
index 1b72b7f..0000000
--- a/fixtures/mcp-adapter-gated/report.golden.json
+++ /dev/null
@@ -1,239 +0,0 @@
-{
-  "generatedAt": "<generatedAt>",
-  "siteUrl": "https://mcp-gated-fixture.example.com",
-  "basePath": "",
-  "routers": [
-    "app"
-  ],
-  "catalog": {
-    "entryCount": 1,
-    "entries": [
-      {
-        "identifier": "urn:air:mcp-gated-fixture.example.com:mcp-server",
-        "type": "application/mcp-server-card+json",
-        "url": "https://mcp-gated-fixture.example.com/.well-known/mcp/server-card.json",
-        "displayName": "MCP server"
-      }
-    ],
-    "path": "public/.well-known/ai-catalog.json",
-    "target": "static"
-  },
-  "mcp": {
-    "mounts": [
-      {
-        "pathname": "/mcp",
-        "tools": [
-          "roll_dice"
-        ]
-      }
-    ],
-    "unreviewedMounts": [],
-    "serverCardPath": "public/.well-known/mcp/server-card.json"
-  },
-  "agent404": {
-    "notFoundPresent": false,
-    "agentAware": false,
-    "pages": [],
-    "markdownGuide": "public/404.md"
-  },
-  "middleware": {
-    "present": false,
-    "wiredToAx": false
-  },
-  "artifacts": {
-    "robotsTxt": {
-      "found": false
-    },
-    "sitemap": {
-      "found": false
-    },
-    "agentsMd": {
-      "found": false
-    },
-    "jsonLd": {
-      "found": false
-    },
-    "llmsTxt": {
-      "found": false
-    },
-    "openapi": {
-      "found": false
-    }
-  },
-  "auth": {
-    "gatedSurfaces": [
-      {
-        "path": "/mcp",
-        "status": "unknown",
-        "declared": false,
-        "oauthEndpoints": false,
-        "note": "Gated but the scheme is undeclared — declare entries[].auth in ax.config (the ax init wizard collects this) so agents know how to authenticate."
-      }
-    ]
-  },
-  "scaffolds": {},
-  "markdownTwins": {
-    "enabled": true,
-    "written": [],
-    "userOwned": [],
-    "skipped": [
-      {
-        "route": "/",
-        "reason": "too-little-text",
-        "detail": "The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker)."
-      }
-    ],
-    "dynamicRouteCount": 0,
-    "deleted": [],
-    "authMd": {
-      "path": "public/auth.md",
-      "surfaceCount": 1
-    }
-  },
-  "sizes": [
-    {
-      "artifact": "ai-catalog.json",
-      "path": "public/.well-known/ai-catalog.json",
-      "bytes": 570,
-      "chars": 570,
-      "tokens": 143
-    },
-    {
-      "artifact": "mcp-server-card",
-      "path": "public/.well-known/mcp/server-card.json",
-      "bytes": 756,
-      "chars": 756,
-      "tokens": 189
-    },
-    {
-      "artifact": "auth.md",
-      "path": "public/auth.md",
-      "bytes": 960,
-      "chars": 954,
-      "tokens": 239
-    },
-    {
-      "artifact": "404.md",
-      "path": "public/404.md",
-      "bytes": 888,
-      "chars": 878,
-      "tokens": 220
-    }
-  ],
-  "ora": {
-    "checks": [
-      {
-        "id": "ard-catalog",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "agent-discovery-file",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "llms-txt-exists",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "llms-txt-formatting",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "markdown-url-fallback",
-        "artifact": "markdown-twins",
-        "status": "actionable",
-        "note": "No markdown twin could be derived for the homepage (too-little-text): The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker). The report’s markdownTwins.skipped section lists every twin-less route with its reason."
-      },
-      {
-        "id": "markdown-frontmatter",
-        "artifact": "markdown-twins",
-        "status": "actionable",
-        "note": "No markdown twin could be derived for the homepage (too-little-text): The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker). The report’s markdownTwins.skipped section lists every twin-less route with its reason."
-      },
-      {
-        "id": "robots-ai-policy-quality",
-        "artifact": "robots.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "sitemap",
-        "artifact": "sitemap",
-        "status": "actionable"
-      },
-      {
-        "id": "agent-instruction",
-        "artifact": "agents.md",
-        "status": "actionable"
-      },
-      {
-        "id": "json-ld",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "org-schema-completeness",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "openapi-spec",
-        "artifact": "openapi.json",
-        "status": "actionable"
-      },
-      {
-        "id": "mcp-server",
-        "artifact": "mcp-server",
-        "status": "addressed"
-      },
-      {
-        "id": "mcp-server-card",
-        "artifact": "mcp-server-card",
-        "status": "addressed"
-      },
-      {
-        "id": "auth-md-exists",
-        "artifact": "auth.md",
-        "status": "addressed"
-      },
-      {
-        "id": "auth-md-structure",
-        "artifact": "auth.md",
-        "status": "addressed"
-      },
-      {
-        "id": "mcp-auth-mechanism",
-        "artifact": "auth-declaration",
-        "status": "actionable",
-        "note": "A gated surface publishes auth.status \"unknown\" — declare entries[].auth in ax.config (the ax init wizard collects this) so agents know the scheme."
-      },
-      {
-        "id": "markdown-negotiation",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      },
-      {
-        "id": "markdown-negotiation-vary",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      }
-    ]
-  },
-  "warnings": [],
-  "recommendations": [
-    "No OpenAPI doc found (public/openapi.json) — an OpenAPI doc lets agents understand and call your API without guessing at routes or schemas. ax never generates one; produce it however your API is defined (many schema/validation libraries can emit OpenAPI from your existing route definitions) and commit the result to public/openapi.json.",
-    "No llms.txt found — a short natural-language guide agents read to decide whether your site fits their task, and to find your key pages. Add one at app/llms.txt/route.ts (or public/llms.txt), or set scaffoldLlmsTxt: true in ax.config to have a starter written for you. Pair it with JSON-LD structured data (an Organization block with a sameAs array): llms.txt says what your site is for, JSON-LD identifies it as an entity registries can rank — the two reinforce each other, so add both rather than one alone.",
-    "No sitemap found — add one so agents can discover all public routes. Use the built-in Next.js path (app/sitemap.ts); ax never generates a sitemap itself. Give each entry a <lastmod> date (agents use it to judge freshness), then reference it from robots.txt with a \"Sitemap:\" line.",
-    "No robots.txt found — add one (app/robots.ts or public/robots.txt) that explicitly Allows the reputable AI agents you want to reach, scoped to specific User-agent groups (never \"User-agent: *\"), plus a \"Sitemap:\" line. Note: Next's MetadataRoute.Robots (app/robots.ts) has no field for the \"Agentmap:\" catalog pointer — put that line in a static public/robots.txt. Set scaffoldRobots: true in ax.config to have one written for you.",
-    "No agents.md found — consider adding one (public/agents.md) with when-to-use / when-NOT-to-use guidance for agents. ax won't write its content for you; the companion skill can help author it from your repo.",
-    "No JSON-LD structured data found in your layouts/pages — structured data is how registries and agents disambiguate and rank your site. Add an Organization block in your root layout <head> (<script type=\"application/ld+json\">) with a \"sameAs\" array linking your LinkedIn/GitHub/npm/social profiles (the entity-disambiguation signal registries value), and at least one more schema.org @type beyond Organization — SoftwareApplication or Product for an app/API, or a FAQPage — since covering more types helps registries understand your site more fully. JSON-LD pairs with an llms.txt: llms.txt tells agents what your site is for, JSON-LD identifies it as an entity registries can rank — add both, not one alone. ax won’t author the block (the fields are judgment content); the companion skill can help draft it from your repo.",
-    "Gated routes should keep their honest 401/403 status and point agents at the auth guide: add a WWW-Authenticate header and a Link (or body) pointer to /auth.md in your gated route handlers. A 200 \"this is gated\" page is a soft auth wall agents are built to distrust; ax generates the guide but never rewrites your handlers.",
-    "No app/not-found.tsx found — agents that hit a missing URL get Next.js’s bare default 404, a dead end that makes them give up or guess. Add a standard 404 page in your own design system (a clear “page not found” and a way back home), and include `<link rel=\"alternate\" type=\"text/markdown\" href=\"/404.md\" />` so agents can hop from it to /404.md — the generated wayfinding guide (real routes + discovery links) this build writes. Rendered in the page’s JSX, React hoists the tag into <head> (App Router); use next/head in the Pages Router.",
-    "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-  ]
-}
diff --git a/fixtures/mcp-adapter-gated/tsconfig.json b/fixtures/mcp-adapter-gated/tsconfig.json
deleted file mode 100644
index 9666dbd..0000000
--- a/fixtures/mcp-adapter-gated/tsconfig.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "extends": "../tsconfig.next.json",
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules"]
-}
diff --git a/fixtures/mcp-adapter-gated/twins.golden/auth.md b/fixtures/mcp-adapter-gated/twins.golden/auth.md
deleted file mode 100644
index 1fd00eb..0000000
--- a/fixtures/mcp-adapter-gated/twins.golden/auth.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-title: "Authentication — mcp-adapter-gated"
-description: "How to obtain access to the gated surfaces on this site."
-canonical_url: https://mcp-gated-fixture.example.com/auth.md
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# Authentication
-
-mcp-adapter-gated has 1 gated surface. This document is generated at build time from the site's own committed auth declarations — it describes how to authenticate and never contains credentials.
-
-## MCP server at /mcp
-
-An MCP (Model Context Protocol) server. Connecting requires authentication.
-
-- Auth: required — the scheme is not statically derivable from the source
-- Auth requirements (RFC 9728 protected-resource metadata): [/.well-known/oauth-protected-resource](https://mcp-gated-fixture.example.com/.well-known/oauth-protected-resource)
-- Get access: not documented yet. (Site owner: declare `auth.docsUrl` on this entry in ax.config to link where credentials are obtained.)
diff --git a/fixtures/mcp-adapter/README.md b/fixtures/mcp-adapter/README.md
deleted file mode 100644
index 236f315..0000000
--- a/fixtures/mcp-adapter/README.md
+++ /dev/null
@@ -1,18 +0,0 @@
-# fixture: mcp-adapter
-
-A Next.js app that already hosts an MCP server via
-[`mcp-handler`](https://www.npmjs.com/package/mcp-handler).
-
-> **Package note:** the maintained package is `mcp-handler`; `@vercel/mcp-adapter` is now an empty
-> stub. The plugin's MCP detection targets `mcp-handler` and treats `@vercel/mcp-adapter` as a legacy
-> alias.
-
-**Exercises:** zero-config MCP detection (Phase 2.2). An existing MCP mount is unambiguous intent to
-publish, so the plugin surfaces the MCP server in the catalog **without** an opt-in marker — the
-one exception to "route entries are opt-in only." Detection resolves the `[transport]` dynamic
-segment to `/mcp` (`mcp-handler`'s documented default `streamableHttpEndpoint`) and populates
-`capabilities` from the `server.tool(...)` call sites it finds.
-
-Ships an `ax.config.ts` declaring `siteUrl` so the emitted entry's URL is deterministic in CI
-(without it, this detector still runs, but skips emitting a URL-bearing entry since none of this
-repo's test environments set Vercel's production-domain env var).
diff --git a/fixtures/mcp-adapter/app/[transport]/route.ts b/fixtures/mcp-adapter/app/[transport]/route.ts
deleted file mode 100644
index ee4f5d1..0000000
--- a/fixtures/mcp-adapter/app/[transport]/route.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import { createMcpHandler } from 'mcp-handler';
-import { z } from 'zod';
-
-// An MCP server mounted with mcp-handler (the maintained package; @vercel/mcp-adapter is now an
-// empty stub). An existing MCP server is unambiguous intent to publish, so the plugin includes it
-// without an opt-in marker.
-const handler = createMcpHandler((server) => {
-  server.tool(
-    'roll_dice',
-    'Roll an N-sided die and return the result.',
-    { sides: z.number().int().min(2).describe('Number of sides on the die') },
-    async ({ sides }) => {
-      const value = 1 + Math.floor(Math.random() * sides);
-      return { content: [{ type: 'text', text: `🎲 ${value}` }] };
-    },
-  );
-});
-
-export { handler as GET, handler as POST, handler as DELETE };
diff --git a/fixtures/mcp-adapter/app/layout.tsx b/fixtures/mcp-adapter/app/layout.tsx
deleted file mode 100644
index 46ddf62..0000000
--- a/fixtures/mcp-adapter/app/layout.tsx
+++ /dev/null
@@ -1,14 +0,0 @@
-import type { ReactNode } from 'react';
-
-export const metadata = {
-  title: 'MCP Adapter Fixture',
-  description: 'A Next.js app that already hosts an MCP server via @vercel/mcp-adapter.',
-};
-
-export default function RootLayout({ children }: { children: ReactNode }) {
-  return (
-    <html lang="en">
-      <body>{children}</body>
-    </html>
-  );
-}
diff --git a/fixtures/mcp-adapter/app/page.tsx b/fixtures/mcp-adapter/app/page.tsx
deleted file mode 100644
index 8a9b727..0000000
--- a/fixtures/mcp-adapter/app/page.tsx
+++ /dev/null
@@ -1,11 +0,0 @@
-export default function Home() {
-  return (
-    <main>
-      <h1>MCP adapter fixture</h1>
-      <p>
-        An existing MCP server at /[transport] — unambiguous intent to publish, so zero-config
-        should include it.
-      </p>
-    </main>
-  );
-}
diff --git a/fixtures/mcp-adapter/ax.config.ts b/fixtures/mcp-adapter/ax.config.ts
deleted file mode 100644
index 7afb3aa..0000000
--- a/fixtures/mcp-adapter/ax.config.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import type { AxConfig } from '@ora-ai/ax';
-
-// `siteUrl` makes the fixture deterministic regardless of where it's built (CI, a laptop, ...) —
-// without it, zero-config MCP detection (Phase 2.2) would still run but skip emitting a
-// URL-bearing entry, since none of this repo's test environments set Vercel's production-domain
-// env var. A real deployment on Vercel wouldn't need this line.
-//
-// An app hosted somewhere other than Vercel would typically read this from its own env var
-// instead of a literal — this file is evaluated as real code (via jiti), so
-// `siteUrl: process.env.SITE_URL` works with no special support from the plugin. It's a literal
-// here only so this fixture's expected output is identical everywhere it's built, regardless of
-// what env vars happen to be set.
-const config: AxConfig = {
-  siteUrl: 'https://mcp-adapter-fixture.example.com',
-};
-
-export default config;
diff --git a/fixtures/mcp-adapter/cards.golden/server-card.json b/fixtures/mcp-adapter/cards.golden/server-card.json
deleted file mode 100644
index 5ac6067..0000000
--- a/fixtures/mcp-adapter/cards.golden/server-card.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  "name": "com.example.mcp-adapter-fixture/mcp-adapter",
-  "description": "mcp-adapter MCP server",
-  "version": "0.0.0",
-  "serverUrl": "https://mcp-adapter-fixture.example.com/mcp",
-  "remotes": [
-    {
-      "type": "streamable-http",
-      "url": "https://mcp-adapter-fixture.example.com/mcp"
-    }
-  ],
-  "tools": [
-    {
-      "name": "roll_dice"
-    }
-  ],
-  "serverInfo": {
-    "name": "mcp-adapter",
-    "version": "0.0.0"
-  },
-  "transport": {
-    "type": "streamable-http",
-    "endpoint": "https://mcp-adapter-fixture.example.com/mcp"
-  },
-  "capabilities": {
-    "tools": {}
-  }
-}
diff --git a/fixtures/mcp-adapter/next-env.d.ts b/fixtures/mcp-adapter/next-env.d.ts
deleted file mode 100644
index 830fb59..0000000
--- a/fixtures/mcp-adapter/next-env.d.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-/// <reference types="next" />
-/// <reference types="next/image-types/global" />
-/// <reference path="./.next/types/routes.d.ts" />
-
-// NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
diff --git a/fixtures/mcp-adapter/next.config.mjs b/fixtures/mcp-adapter/next.config.mjs
deleted file mode 100644
index 4678774..0000000
--- a/fixtures/mcp-adapter/next.config.mjs
+++ /dev/null
@@ -1,4 +0,0 @@
-/** @type {import('next').NextConfig} */
-const nextConfig = {};
-
-export default nextConfig;
diff --git a/fixtures/mcp-adapter/twins.golden/404.md b/fixtures/mcp-adapter/twins.golden/404.md
deleted file mode 100644
index 2bd79f0..0000000
--- a/fixtures/mcp-adapter/twins.golden/404.md
+++ /dev/null
@@ -1,22 +0,0 @@
----
-title: "Page not found — mcp-adapter"
-description: "Where to continue when a URL on this site does not exist: discovery links and real routes."
-canonical_url: https://mcp-adapter-fixture.example.com/404.md
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# Page not found
-
-The URL you requested does not exist on this site. It may have moved, or it may never have existed —
-requesting it again will keep returning this response. Do not retry; start from the links
-below instead.
-
-## Start here
-
-- [/.well-known/ai-catalog.json](/.well-known/ai-catalog.json) — machine-readable catalog of everything this site offers agents
-- [/.well-known/mcp/server-card.json](/.well-known/mcp/server-card.json) — the MCP server card (connection + capabilities)
-
-## Pages that do exist
-
-- [/](/)
diff --git a/fixtures/mcp-multi-server/README.md b/fixtures/mcp-multi-server/README.md
deleted file mode 100644
index f34e188..0000000
--- a/fixtures/mcp-multi-server/README.md
+++ /dev/null
@@ -1,21 +0,0 @@
-# fixture: mcp-multi-server
-
-A Next.js app hosting **two** MCP servers via [`mcp-handler`](https://www.npmjs.com/package/mcp-handler):
-an open one at `/api/public/mcp` and a `withMcpAuth`-gated one at `/api/mcp` — the multi-server
-sibling of `mcp-adapter` / `mcp-adapter-gated`, modeled on the demo app.
-
-**Exercises:** multi-card emission and per-card persistence.
-
-- One server card per mount: the primary's at `/.well-known/mcp/server-card.json` (the path agent
-  registries and Ora probe), and every server's card at its named
-  `/.well-known/mcp/server-card/<server-name>.json` slot (`api-public-mcp.json`, `api-mcp.json`).
-- The primary defaults to the **public** server on this headless (`--yes`) build; the report
-  records `mcp.primaryMount` and flags `primaryUnreviewed` so an interactive build (or `ax init`)
-  can confirm it. The open mount likewise stays in `unreviewedMounts` — no gating decision is on
-  record for it in a fresh checkout.
-- The gated mount's card carries `authentication: { required: true }` plus the RFC 9728
-  `resourceMetadata` link from its `resourceMetadataPath` literal.
-- Each catalog entry points at its own card: the primary's at the root path, the gated one at its
-  named slot.
-
-Ships an `ax.config.ts` declaring `siteUrl` so the emitted output is deterministic in CI.
diff --git a/fixtures/mcp-multi-server/app/api/mcp/route.ts b/fixtures/mcp-multi-server/app/api/mcp/route.ts
deleted file mode 100644
index 4cbc399..0000000
--- a/fixtures/mcp-multi-server/app/api/mcp/route.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-import { createMcpHandler, withMcpAuth } from 'mcp-handler';
-import { z } from 'zod';
-
-// The gated MCP server: wrapped in `withMcpAuth`, so ax detects the auth requirement statically,
-// marks the surface gated (auth.status "unknown"), and cross-links the RFC 9728 metadata from the
-// `resourceMetadataPath` literal into this server's card. Its card lands at the named per-server
-// slot, never the root path a blind registry probe would hit first.
-const handler = createMcpHandler((server) => {
-  server.tool(
-    'place_order',
-    'Place an order for the signed-in customer.',
-    { item: z.string().describe('Menu item id') },
-    async ({ item }) => ({ content: [{ type: 'text', text: `🧾 ordered ${item}` }] }),
-  );
-});
-
-// A no-op verifier stands in for a real token check — enough to exercise the gated code path.
-const verifyToken = async (_req: Request): Promise<undefined> => undefined;
-
-const authed = withMcpAuth(handler, verifyToken, {
-  resourceMetadataPath: '/.well-known/oauth-protected-resource',
-});
-
-export { authed as GET, authed as POST, authed as DELETE };
diff --git a/fixtures/mcp-multi-server/app/api/public/mcp/route.ts b/fixtures/mcp-multi-server/app/api/public/mcp/route.ts
deleted file mode 100644
index 0468439..0000000
--- a/fixtures/mcp-multi-server/app/api/public/mcp/route.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import { createMcpHandler } from 'mcp-handler';
-import { z } from 'zod';
-
-// The public MCP server: mounted with mcp-handler and no auth wrapper. On a fresh checkout no
-// gating decision is on record for it, so a headless build advertises it as open (the zero-config
-// default) and lists it in the report's unreviewedMounts; it is also the default primary — the
-// server whose card owns the root well-known path — precisely because it is the public one.
-const handler = createMcpHandler((server) => {
-  server.tool(
-    'search_menu',
-    'Search the menu and return matching items.',
-    { query: z.string().describe('Free-text search query') },
-    async ({ query }) => ({ content: [{ type: 'text', text: `🔎 results for ${query}` }] }),
-  );
-});
-
-export { handler as GET, handler as POST, handler as DELETE };
diff --git a/fixtures/mcp-multi-server/app/layout.tsx b/fixtures/mcp-multi-server/app/layout.tsx
deleted file mode 100644
index 48d1fc4..0000000
--- a/fixtures/mcp-multi-server/app/layout.tsx
+++ /dev/null
@@ -1,14 +0,0 @@
-import type { ReactNode } from 'react';
-
-export const metadata = {
-  title: 'MCP Multi-Server Fixture',
-  description: 'A Next.js app hosting two MCP servers: one public, one gated via withMcpAuth.',
-};
-
-export default function RootLayout({ children }: { children: ReactNode }) {
-  return (
-    <html lang="en">
-      <body>{children}</body>
-    </html>
-  );
-}
diff --git a/fixtures/mcp-multi-server/app/page.tsx b/fixtures/mcp-multi-server/app/page.tsx
deleted file mode 100644
index ca96b70..0000000
--- a/fixtures/mcp-multi-server/app/page.tsx
+++ /dev/null
@@ -1,12 +0,0 @@
-export default function Home() {
-  return (
-    <main>
-      <h1>MCP multi-server fixture</h1>
-      <p>
-        Two MCP servers: a public one at /api/public/mcp and one gated behind OAuth via{' '}
-        <code>withMcpAuth</code> at /api/mcp. ax emits one server card per server — the primary
-        (public) card at the root well-known path, and each server&apos;s card at its named slot.
-      </p>
-    </main>
-  );
-}
diff --git a/fixtures/mcp-multi-server/ax.config.ts b/fixtures/mcp-multi-server/ax.config.ts
deleted file mode 100644
index 155f4f6..0000000
--- a/fixtures/mcp-multi-server/ax.config.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-import type { AxConfig } from '@ora-ai/ax';
-
-// A literal `siteUrl` keeps this fixture's emitted output identical everywhere it's built (see the
-// mcp-adapter fixture for the full rationale). A real app would read this from its own env var.
-const config: AxConfig = {
-  siteUrl: 'https://mcp-multi-fixture.example.com',
-};
-
-export default config;
diff --git a/fixtures/mcp-multi-server/cards.golden/server-card.json b/fixtures/mcp-multi-server/cards.golden/server-card.json
deleted file mode 100644
index 39f3621..0000000
--- a/fixtures/mcp-multi-server/cards.golden/server-card.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  "name": "com.example.mcp-multi-fixture/api-public-mcp",
-  "description": "mcp-multi-server MCP server at /api/public/mcp",
-  "version": "0.0.0",
-  "serverUrl": "https://mcp-multi-fixture.example.com/api/public/mcp",
-  "remotes": [
-    {
-      "type": "streamable-http",
-      "url": "https://mcp-multi-fixture.example.com/api/public/mcp"
-    }
-  ],
-  "tools": [
-    {
-      "name": "search_menu"
-    }
-  ],
-  "serverInfo": {
-    "name": "mcp-multi-server",
-    "version": "0.0.0"
-  },
-  "transport": {
-    "type": "streamable-http",
-    "endpoint": "https://mcp-multi-fixture.example.com/api/public/mcp"
-  },
-  "capabilities": {
-    "tools": {}
-  }
-}
diff --git a/fixtures/mcp-multi-server/cards.golden/server-card/api-mcp.json b/fixtures/mcp-multi-server/cards.golden/server-card/api-mcp.json
deleted file mode 100644
index 8a0ff0c..0000000
--- a/fixtures/mcp-multi-server/cards.golden/server-card/api-mcp.json
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  "name": "com.example.mcp-multi-fixture/api-mcp",
-  "description": "mcp-multi-server MCP server at /api/mcp",
-  "version": "0.0.0",
-  "serverUrl": "https://mcp-multi-fixture.example.com/api/mcp",
-  "remotes": [
-    {
-      "type": "streamable-http",
-      "url": "https://mcp-multi-fixture.example.com/api/mcp"
-    }
-  ],
-  "tools": [
-    {
-      "name": "place_order"
-    }
-  ],
-  "serverInfo": {
-    "name": "mcp-multi-server",
-    "version": "0.0.0"
-  },
-  "transport": {
-    "type": "streamable-http",
-    "endpoint": "https://mcp-multi-fixture.example.com/api/mcp"
-  },
-  "capabilities": {
-    "tools": {}
-  },
-  "authentication": {
-    "required": true,
-    "resourceMetadata": "https://mcp-multi-fixture.example.com/.well-known/oauth-protected-resource"
-  }
-}
diff --git a/fixtures/mcp-multi-server/cards.golden/server-card/api-public-mcp.json b/fixtures/mcp-multi-server/cards.golden/server-card/api-public-mcp.json
deleted file mode 100644
index 39f3621..0000000
--- a/fixtures/mcp-multi-server/cards.golden/server-card/api-public-mcp.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  "name": "com.example.mcp-multi-fixture/api-public-mcp",
-  "description": "mcp-multi-server MCP server at /api/public/mcp",
-  "version": "0.0.0",
-  "serverUrl": "https://mcp-multi-fixture.example.com/api/public/mcp",
-  "remotes": [
-    {
-      "type": "streamable-http",
-      "url": "https://mcp-multi-fixture.example.com/api/public/mcp"
-    }
-  ],
-  "tools": [
-    {
-      "name": "search_menu"
-    }
-  ],
-  "serverInfo": {
-    "name": "mcp-multi-server",
-    "version": "0.0.0"
-  },
-  "transport": {
-    "type": "streamable-http",
-    "endpoint": "https://mcp-multi-fixture.example.com/api/public/mcp"
-  },
-  "capabilities": {
-    "tools": {}
-  }
-}
diff --git a/fixtures/mcp-multi-server/next-env.d.ts b/fixtures/mcp-multi-server/next-env.d.ts
deleted file mode 100644
index 830fb59..0000000
--- a/fixtures/mcp-multi-server/next-env.d.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-/// <reference types="next" />
-/// <reference types="next/image-types/global" />
-/// <reference path="./.next/types/routes.d.ts" />
-
-// NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
diff --git a/fixtures/mcp-multi-server/next.config.mjs b/fixtures/mcp-multi-server/next.config.mjs
deleted file mode 100644
index 4678774..0000000
--- a/fixtures/mcp-multi-server/next.config.mjs
+++ /dev/null
@@ -1,4 +0,0 @@
-/** @type {import('next').NextConfig} */
-const nextConfig = {};
-
-export default nextConfig;
diff --git a/fixtures/mcp-multi-server/package.json b/fixtures/mcp-multi-server/package.json
deleted file mode 100644
index c635949..0000000
--- a/fixtures/mcp-multi-server/package.json
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "name": "@ax-fixtures/mcp-multi-server",
-  "version": "0.0.0",
-  "private": true,
-  "scripts": {
-    "build": "next build",
-    "postbuild": "ax --report --yes",
-    "dev": "next dev",
-    "start": "next start"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "1.26.0",
-    "mcp-handler": "^1.1.0",
-    "next": "^15.1.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
-    "zod": "^3.24.1"
-  },
-  "devDependencies": {
-    "@types/node": "^20.17.12",
-    "@types/react": "^19.0.7",
-    "@types/react-dom": "^19.0.3",
-    "@ora-ai/ax": "workspace:*",
-    "typescript": "^5.7.3"
-  }
-}
diff --git a/fixtures/mcp-multi-server/tsconfig.json b/fixtures/mcp-multi-server/tsconfig.json
deleted file mode 100644
index 9666dbd..0000000
--- a/fixtures/mcp-multi-server/tsconfig.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "extends": "../tsconfig.next.json",
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules"]
-}
diff --git a/fixtures/mcp-multi-server/twins.golden/auth.md b/fixtures/mcp-multi-server/twins.golden/auth.md
deleted file mode 100644
index a88d1a1..0000000
--- a/fixtures/mcp-multi-server/twins.golden/auth.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-title: "Authentication — mcp-multi-server"
-description: "How to obtain access to the gated surfaces on this site."
-canonical_url: https://mcp-multi-fixture.example.com/auth.md
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# Authentication
-
-mcp-multi-server has 1 gated surface. This document is generated at build time from the site's own committed auth declarations — it describes how to authenticate and never contains credentials.
-
-## MCP server at /api/mcp
-
-An MCP (Model Context Protocol) server. Connecting requires authentication.
-
-- Auth: required — the scheme is not statically derivable from the source
-- Auth requirements (RFC 9728 protected-resource metadata): [/.well-known/oauth-protected-resource](https://mcp-multi-fixture.example.com/.well-known/oauth-protected-resource)
-- Get access: not documented yet. (Site owner: declare `auth.docsUrl` on this entry in ax.config to link where credentials are obtained.)
diff --git a/fixtures/mcp-multi-server/twins.golden/index.md b/fixtures/mcp-multi-server/twins.golden/index.md
deleted file mode 100644
index fc8bc39..0000000
--- a/fixtures/mcp-multi-server/twins.golden/index.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-title: "MCP Multi-Server Fixture"
-description: "A Next.js app hosting two MCP servers: one public, one gated via withMcpAuth."
-canonical_url: https://mcp-multi-fixture.example.com/
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# MCP multi-server fixture
-
-Two MCP servers: a public one at /api/public/mcp and one gated behind OAuth via `withMcpAuth` at /api/mcp. ax emits one server card per server — the primary (public) card at the root well-known path, and each server's card at its named slot.
diff --git a/fixtures/mdx-content/README.md b/fixtures/mdx-content/README.md
deleted file mode 100644
index 964b4ac..0000000
--- a/fixtures/mdx-content/README.md
+++ /dev/null
@@ -1,15 +0,0 @@
-# fixture: mdx-content
-
-An App Router app wired with `@next/mdx` (`pageExtensions` includes `md`/`mdx`), exercising
-**Tier 1** of the markdown-twin ladder — twins derived from markdown-shaped sources, no HTML
-conversion involved:
-
-- `app/guide/page.mdx` — mostly markdown (one stripped `export`), so its twin is derived straight
-  from the source: highest fidelity, works with zero build output.
-- `app/widgets/page.mdx` — component-heavy MDX (**skip: mostly-jsx** at the ≤25% non-markdown
-  threshold): stripping its components would silently omit what the page shows, so ax recommends
-  moving the prose into markdown instead of guessing.
-- `app/page.tsx` — an ordinary prerendered page, proving Tier 1 and Tier 2 coexist in one build.
-
-**Exercises:** MDX route detection gated on `pageExtensions`, the mostly-markdown threshold, and
-the Tier-1 twin snapshot under `twins.golden/`.
diff --git a/fixtures/mdx-content/app/guide/page.mdx b/fixtures/mdx-content/app/guide/page.mdx
deleted file mode 100644
index 073a3a3..0000000
--- a/fixtures/mdx-content/app/guide/page.mdx
+++ /dev/null
@@ -1,24 +0,0 @@
-export const metadata = { title: 'The MDX guide' };
-
-# The MDX guide
-
-This page's content lives as markdown in the repo, so its twin is derived straight from this
-source — the highest-fidelity rung of the ladder, needing no build output and no HTML conversion.
-
-## Why source beats reconstruction
-
-A twin converted from rendered HTML is a reconstruction; this file _is_ the content. The one
-non-markdown line above (the `metadata` export) is stripped, and it stays comfortably under the
-mostly-markdown threshold.
-
-## Things this guide covers
-
-- Deriving twins from `page.mdx` sources.
-- The `pageExtensions` gate that proves the page actually routes.
-- The frontmatter contract every generated twin carries.
-
-```bash
-npx ax --report
-```
-
-That is everything an agent needs to read this page without parsing HTML.
diff --git a/fixtures/mdx-content/app/layout.tsx b/fixtures/mdx-content/app/layout.tsx
deleted file mode 100644
index c4e9adc..0000000
--- a/fixtures/mdx-content/app/layout.tsx
+++ /dev/null
@@ -1,14 +0,0 @@
-import type { ReactNode } from 'react';
-
-export const metadata = {
-  title: 'MDX Content Fixture',
-  description: 'Exercises Tier-1 markdown-twin derivation from page.mdx sources.',
-};
-
-export default function RootLayout({ children }: { children: ReactNode }) {
-  return (
-    <html lang="en">
-      <body>{children}</body>
-    </html>
-  );
-}
diff --git a/fixtures/mdx-content/app/page.tsx b/fixtures/mdx-content/app/page.tsx
deleted file mode 100644
index e2853d8..0000000
--- a/fixtures/mdx-content/app/page.tsx
+++ /dev/null
@@ -1,13 +0,0 @@
-export default function Home() {
-  return (
-    <main>
-      <h1>MDX content fixture</h1>
-      <p>
-        An ordinary prerendered page living beside the MDX guides, proving Tier-1 (source-derived)
-        and Tier-2 (build-output-derived) twins coexist in one build without stepping on each other.
-        Its own twin is derived from this prerendered HTML, since no markdown source covers this
-        route.
-      </p>
-    </main>
-  );
-}
diff --git a/fixtures/mdx-content/app/widget.tsx b/fixtures/mdx-content/app/widget.tsx
deleted file mode 100644
index 2605c50..0000000
--- a/fixtures/mdx-content/app/widget.tsx
+++ /dev/null
@@ -1,10 +0,0 @@
-import type { ReactNode } from 'react';
-
-export function Widget({ label, children }: { label: string; children: ReactNode }) {
-  return (
-    <section>
-      <h2>{label}</h2>
-      {children}
-    </section>
-  );
-}
diff --git a/fixtures/mdx-content/app/widgets/page.mdx b/fixtures/mdx-content/app/widgets/page.mdx
deleted file mode 100644
index d8b74a7..0000000
--- a/fixtures/mdx-content/app/widgets/page.mdx
+++ /dev/null
@@ -1,7 +0,0 @@
-import { Widget } from '../widget';
-
-<Widget label="Alpha">Interactive widget one.</Widget>
-
-<Widget label="Beta">Interactive widget two.</Widget>
-
-One line of prose between the widgets.
diff --git a/fixtures/mdx-content/next-env.d.ts b/fixtures/mdx-content/next-env.d.ts
deleted file mode 100644
index 830fb59..0000000
--- a/fixtures/mdx-content/next-env.d.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-/// <reference types="next" />
-/// <reference types="next/image-types/global" />
-/// <reference path="./.next/types/routes.d.ts" />
-
-// NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
diff --git a/fixtures/mdx-content/report.golden.json b/fixtures/mdx-content/report.golden.json
deleted file mode 100644
index a5ead75..0000000
--- a/fixtures/mdx-content/report.golden.json
+++ /dev/null
@@ -1,203 +0,0 @@
-{
-  "generatedAt": "<generatedAt>",
-  "siteUrl": "https://mdx-content-fixture.example.com",
-  "basePath": "",
-  "routers": [
-    "app"
-  ],
-  "catalog": {
-    "entryCount": 0,
-    "entries": [],
-    "path": "public/.well-known/ai-catalog.json",
-    "target": "static"
-  },
-  "mcp": {
-    "mounts": [],
-    "unreviewedMounts": []
-  },
-  "agent404": {
-    "notFoundPresent": false,
-    "agentAware": false,
-    "pages": [],
-    "markdownGuide": "public/404.md"
-  },
-  "middleware": {
-    "present": false,
-    "wiredToAx": false
-  },
-  "artifacts": {
-    "robotsTxt": {
-      "found": false
-    },
-    "sitemap": {
-      "found": false
-    },
-    "agentsMd": {
-      "found": false
-    },
-    "jsonLd": {
-      "found": false
-    },
-    "llmsTxt": {
-      "found": false
-    },
-    "openapi": {
-      "found": false
-    }
-  },
-  "auth": {
-    "gatedSurfaces": []
-  },
-  "scaffolds": {},
-  "markdownTwins": {
-    "enabled": true,
-    "written": [
-      {
-        "route": "/guide",
-        "path": "public/guide.md",
-        "tier": 1,
-        "source": "mdx"
-      },
-      {
-        "route": "/",
-        "path": "public/index.md",
-        "tier": 2,
-        "source": "prerender"
-      }
-    ],
-    "userOwned": [],
-    "skipped": [
-      {
-        "route": "/widgets",
-        "reason": "mostly-jsx",
-        "detail": "The MDX source is mostly imports/JSX — stripping them would silently omit what the page shows. Move the prose into markdown (or accept the HTML-derived twin by prerendering)."
-      }
-    ],
-    "dynamicRouteCount": 0,
-    "deleted": []
-  },
-  "sizes": [
-    {
-      "artifact": "ai-catalog.json",
-      "path": "public/.well-known/ai-catalog.json",
-      "bytes": 155,
-      "chars": 155,
-      "tokens": 39
-    },
-    {
-      "artifact": "markdown-twin",
-      "path": "public/guide.md",
-      "bytes": 921,
-      "chars": 919,
-      "tokens": 230
-    },
-    {
-      "artifact": "markdown-twin",
-      "path": "public/index.md",
-      "bytes": 543,
-      "chars": 543,
-      "tokens": 136
-    },
-    {
-      "artifact": "404.md",
-      "path": "public/404.md",
-      "bytes": 726,
-      "chars": 718,
-      "tokens": 180
-    }
-  ],
-  "ora": {
-    "checks": [
-      {
-        "id": "ard-catalog",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "agent-discovery-file",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "llms-txt-exists",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "llms-txt-formatting",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "markdown-url-fallback",
-        "artifact": "markdown-twins",
-        "status": "addressed"
-      },
-      {
-        "id": "markdown-frontmatter",
-        "artifact": "markdown-twins",
-        "status": "addressed"
-      },
-      {
-        "id": "robots-ai-policy-quality",
-        "artifact": "robots.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "sitemap",
-        "artifact": "sitemap",
-        "status": "actionable"
-      },
-      {
-        "id": "agent-instruction",
-        "artifact": "agents.md",
-        "status": "actionable"
-      },
-      {
-        "id": "json-ld",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "org-schema-completeness",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "openapi-spec",
-        "artifact": "openapi.json",
-        "status": "actionable"
-      },
-      {
-        "id": "mcp-server",
-        "artifact": "mcp-server",
-        "status": "actionable"
-      },
-      {
-        "id": "markdown-negotiation",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      },
-      {
-        "id": "markdown-negotiation-vary",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      }
-    ]
-  },
-  "warnings": [],
-  "recommendations": [
-    "No OpenAPI doc found (public/openapi.json) — an OpenAPI doc lets agents understand and call your API without guessing at routes or schemas. ax never generates one; produce it however your API is defined (many schema/validation libraries can emit OpenAPI from your existing route definitions) and commit the result to public/openapi.json.",
-    "app/widgets/page.mdx is mostly imports/JSX, so no markdown twin was derived for it — a twin built by deleting its components would misrepresent the page. Move the prose into markdown to get a source-fidelity twin.",
-    "No llms.txt found — a short natural-language guide agents read to decide whether your site fits their task, and to find your key pages. Add one at app/llms.txt/route.ts (or public/llms.txt), or set scaffoldLlmsTxt: true in ax.config to have a starter written for you. Pair it with JSON-LD structured data (an Organization block with a sameAs array): llms.txt says what your site is for, JSON-LD identifies it as an entity registries can rank — the two reinforce each other, so add both rather than one alone.",
-    "No sitemap found — add one so agents can discover all public routes. Use the built-in Next.js path (app/sitemap.ts); ax never generates a sitemap itself. Give each entry a <lastmod> date (agents use it to judge freshness), then reference it from robots.txt with a \"Sitemap:\" line.",
-    "No robots.txt found — add one (app/robots.ts or public/robots.txt) that explicitly Allows the reputable AI agents you want to reach, scoped to specific User-agent groups (never \"User-agent: *\"), plus a \"Sitemap:\" line. Note: Next's MetadataRoute.Robots (app/robots.ts) has no field for the \"Agentmap:\" catalog pointer — put that line in a static public/robots.txt. Set scaffoldRobots: true in ax.config to have one written for you.",
-    "No agents.md found — consider adding one (public/agents.md) with when-to-use / when-NOT-to-use guidance for agents. ax won't write its content for you; the companion skill can help author it from your repo.",
-    "No JSON-LD structured data found in your layouts/pages — structured data is how registries and agents disambiguate and rank your site. Add an Organization block in your root layout <head> (<script type=\"application/ld+json\">) with a \"sameAs\" array linking your LinkedIn/GitHub/npm/social profiles (the entity-disambiguation signal registries value), and at least one more schema.org @type beyond Organization — SoftwareApplication or Product for an app/API, or a FAQPage — since covering more types helps registries understand your site more fully. JSON-LD pairs with an llms.txt: llms.txt tells agents what your site is for, JSON-LD identifies it as an entity registries can rank — add both, not one alone. ax won’t author the block (the fields are judgment content); the companion skill can help draft it from your repo.",
-    "Markdown twins exist for your pages — link each HTML page to its twin so crawlers find the machine-readable version. Add this to the page <head> (ax prints the tag; it never edits your layout): <link rel=\"alternate\" type=\"text/markdown\" href=\"https://mdx-content-fixture.example.com/guide.md\" />",
-    "No app/not-found.tsx found — agents that hit a missing URL get Next.js’s bare default 404, a dead end that makes them give up or guess. Add a standard 404 page in your own design system (a clear “page not found” and a way back home), and include `<link rel=\"alternate\" type=\"text/markdown\" href=\"/404.md\" />` so agents can hop from it to /404.md — the generated wayfinding guide (real routes + discovery links) this build writes. Rendered in the page’s JSX, React hoists the tag into <head> (App Router); use next/head in the Pages Router.",
-    "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-  ]
-}
diff --git a/fixtures/mdx-content/tsconfig.json b/fixtures/mdx-content/tsconfig.json
deleted file mode 100644
index 9666dbd..0000000
--- a/fixtures/mdx-content/tsconfig.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "extends": "../tsconfig.next.json",
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules"]
-}
diff --git a/fixtures/mdx-content/twins.golden/404.md b/fixtures/mdx-content/twins.golden/404.md
deleted file mode 100644
index 8a5c77a..0000000
--- a/fixtures/mdx-content/twins.golden/404.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-title: "Page not found — mdx-content"
-description: "Where to continue when a URL on this site does not exist: discovery links and real routes."
-canonical_url: https://mdx-content-fixture.example.com/404.md
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# Page not found
-
-The URL you requested does not exist on this site. It may have moved, or it may never have existed —
-requesting it again will keep returning this response. Do not retry; start from the links
-below instead.
-
-## Start here
-
-- [/.well-known/ai-catalog.json](/.well-known/ai-catalog.json) — machine-readable catalog of everything this site offers agents
-
-## Pages that do exist
-
-- [/](/) — markdown: [/index.md](/index.md)
diff --git a/fixtures/mdx-content/twins.golden/guide.md b/fixtures/mdx-content/twins.golden/guide.md
deleted file mode 100644
index 501f726..0000000
--- a/fixtures/mdx-content/twins.golden/guide.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-title: "The MDX guide"
-canonical_url: https://mdx-content-fixture.example.com/guide
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# The MDX guide
-
-This page's content lives as markdown in the repo, so its twin is derived straight from this
-source — the highest-fidelity rung of the ladder, needing no build output and no HTML conversion.
-
-## Why source beats reconstruction
-
-A twin converted from rendered HTML is a reconstruction; this file _is_ the content. The one
-non-markdown line above (the `metadata` export) is stripped, and it stays comfortably under the
-mostly-markdown threshold.
-
-## Things this guide covers
-
-- Deriving twins from `page.mdx` sources.
-- The `pageExtensions` gate that proves the page actually routes.
-- The frontmatter contract every generated twin carries.
-
-```bash
-npx ax --report
-```
-
-That is everything an agent needs to read this page without parsing HTML.
diff --git a/fixtures/mdx-content/twins.golden/index.md b/fixtures/mdx-content/twins.golden/index.md
deleted file mode 100644
index d0418ae..0000000
--- a/fixtures/mdx-content/twins.golden/index.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-title: "MDX Content Fixture"
-description: "Exercises Tier-1 markdown-twin derivation from page.mdx sources."
-canonical_url: https://mdx-content-fixture.example.com/
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# MDX content fixture
-
-An ordinary prerendered page living beside the MDX guides, proving Tier-1 (source-derived) and Tier-2 (build-output-derived) twins coexist in one build without stepping on each other. Its own twin is derived from this prerendered HTML, since no markdown source covers this route.
diff --git a/fixtures/middleware/README.md b/fixtures/middleware/README.md
deleted file mode 100644
index 33c61fe..0000000
--- a/fixtures/middleware/README.md
+++ /dev/null
@@ -1,34 +0,0 @@
-# fixture: middleware
-
-An App Router app that actually wires the `@ora-ai/ax/middleware` runtime entry — the negotiation
-half of the markdown story — and proves it against a real `next build` (the Edge bundle compiles)
-plus a `next start` dual-fetch dogfood (`scripts/dogfood-middleware.mjs`).
-
-The wiring under test:
-
-- `"prebuild": "ax manifest"` regenerates `ax-manifest.ts` (gitignored build output) before
-  `next build` compiles the `middleware.ts` that imports it — the ordering the manifest exists for.
-- `middleware.ts` is the exact three-line wiring the CLI recommends: `withAx({ manifest })` plus
-  the pasted matcher literal.
-
-Routes, one per negotiation branch:
-
-- `/docs` — twin is the committed, hand-authored `public/docs.md`, so the first build's manifest
-  already lists it: agents / `Accept: text/markdown` get **rewritten to the twin** (with
-  `Vary: Accept` + the canonical Link), browsers and Googlebot get HTML.
-- `/` — prerendered page whose twin is **generated postbuild** (golden under `twins.golden/`);
-  the first-build manifest doesn't list it yet (documented one-build staleness), so dogfood probes
-  never target it.
-- `/shell` — a JS-shell page the twin pass permanently refuses: **real route, no twin → agents
-  fall through to HTML** (never an invented markdown representation).
-- `/private` — gated via `ax.config` `isGated`: in `gatedPaths`, so the middleware **falls through
-  untouched** for agents too — the app's auth answer stays the honest one.
-- `/blog/[slug]` — dynamic: the manifest records the `/blog` prefix and the middleware **never
-  claims "not found"** under it (any slug renders here).
-- Any other URL from a detected agent → **200 `text/markdown` wayfinding body** rendered from the
-  manifest; plain clients keep the honest 404.
-
-**Exercises:** the `./middleware` package export compiling in Next's Edge runtime, manifest-driven
-rewrites/gating/dynamic-prefix fall-through, the response-header invariants, and the report/twin
-goldens for a fixture that wires the middleware (its `markdown-negotiation` checks read
-`addressed`).
diff --git a/fixtures/middleware/app/blog/[slug]/page.tsx b/fixtures/middleware/app/blog/[slug]/page.tsx
deleted file mode 100644
index a99022f..0000000
--- a/fixtures/middleware/app/blog/[slug]/page.tsx
+++ /dev/null
@@ -1,13 +0,0 @@
-// A dynamic route: whether /blog/<anything> exists is only knowable at request time, so the
-// manifest records the /blog prefix and the middleware never answers a miss under it with the
-// wayfinding body — this page (any slug renders) is exactly the real content that would otherwise
-// be mislabeled "not found".
-export default async function BlogPost({ params }: { params: Promise<{ slug: string }> }) {
-  const { slug } = await params;
-  return (
-    <main>
-      <h1>Blog: {slug}</h1>
-      <p>This dynamic page renders for every slug the fixture is asked for.</p>
-    </main>
-  );
-}
diff --git a/fixtures/middleware/app/docs/page.tsx b/fixtures/middleware/app/docs/page.tsx
deleted file mode 100644
index 0d094e1..0000000
--- a/fixtures/middleware/app/docs/page.tsx
+++ /dev/null
@@ -1,15 +0,0 @@
-// The negotiation target: its markdown twin is the committed, hand-authored public/docs.md (no
-// generated-by marker), so the prebuild manifest lists the twin on the very first build and the
-// dual-fetch dogfood can prove the rewrite without a second build.
-export default function Docs() {
-  return (
-    <main>
-      <h1>Docs</h1>
-      <p>
-        Browsers and search crawlers see this HTML. Detected agents — and any client sending Accept:
-        text/markdown — are rewritten by the middleware to the markdown twin at /docs.md, with Vary:
-        Accept and a canonical Link pointing back at this page.
-      </p>
-    </main>
-  );
-}
diff --git a/fixtures/middleware/app/layout.tsx b/fixtures/middleware/app/layout.tsx
deleted file mode 100644
index 5855cea..0000000
--- a/fixtures/middleware/app/layout.tsx
+++ /dev/null
@@ -1,20 +0,0 @@
-import type { ReactNode } from 'react';
-
-export const metadata = {
-  title: 'Middleware Fixture',
-  description: 'Exercises the @ora-ai/ax/middleware negotiation entry against a real next build.',
-};
-
-export default function RootLayout({ children }: { children: ReactNode }) {
-  return (
-    <html lang="en">
-      <body>
-        <nav>
-          <a href="/">Home</a> <a href="/docs">Docs</a>
-        </nav>
-        {children}
-        <footer>© Middleware Fixture</footer>
-      </body>
-    </html>
-  );
-}
diff --git a/fixtures/middleware/app/page.tsx b/fixtures/middleware/app/page.tsx
deleted file mode 100644
index cbd6c93..0000000
--- a/fixtures/middleware/app/page.tsx
+++ /dev/null
@@ -1,18 +0,0 @@
-export default function Home() {
-  return (
-    <main>
-      <h1>Middleware fixture</h1>
-      <p>
-        This prerendered homepage gets a generated markdown twin on the postbuild run. On a fresh
-        checkout the prebuild manifest does not list that twin yet (it is generated after this
-        build), so the middleware serves this HTML to everyone until the next build — the documented
-        one-build staleness, and the reason the dogfood probes target the hand-authored docs twin
-        instead.
-      </p>
-      <p>
-        Enough prose lives here to clear the twin pass&apos;s minimum-content guard, so the homepage
-        twin lands in this fixture&apos;s golden snapshots.
-      </p>
-    </main>
-  );
-}
diff --git a/fixtures/middleware/app/private/page.tsx b/fixtures/middleware/app/private/page.tsx
deleted file mode 100644
index 2358b87..0000000
--- a/fixtures/middleware/app/private/page.tsx
+++ /dev/null
@@ -1,20 +0,0 @@
-// Gated by the fixture's isGated matcher. The manifest records /private in gatedPaths, so the
-// middleware must fall through untouched for agents too — the app's own auth answer is the honest
-// one, and a twin never gets generated for a gated route in the first place.
-export default function Private() {
-  return (
-    <main>
-      <h1>Sign in</h1>
-      <p>
-        You need to sign in to see this page. This stand-in login shell carries enough text to pass
-        the twin pass&apos;s length guard, proving its skip comes from the gating policy alone.
-      </p>
-      <form>
-        <label>
-          Email <input type="email" name="email" />
-        </label>
-        <button type="submit">Continue</button>
-      </form>
-    </main>
-  );
-}
diff --git a/fixtures/middleware/app/shell/page.tsx b/fixtures/middleware/app/shell/page.tsx
deleted file mode 100644
index 21927a8..0000000
--- a/fixtures/middleware/app/shell/page.tsx
+++ /dev/null
@@ -1,10 +0,0 @@
-// A JS-shell page with no page-owned metadata: the twin pass refuses it (too little text), so this
-// route is permanently twin-less — the stable dogfood case for "real route, no twin: agents get
-// the HTML, because inventing a markdown representation would be a lie".
-export default function Shell() {
-  return (
-    <main>
-      <div id="app" />
-    </main>
-  );
-}
diff --git a/fixtures/middleware/ax.config.ts b/fixtures/middleware/ax.config.ts
deleted file mode 100644
index 3befcea..0000000
--- a/fixtures/middleware/ax.config.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-import type { AxConfig } from '@ora-ai/ax';
-
-// A literal `siteUrl` keeps this fixture's emitted output identical everywhere it's built. The
-// `isGated` matcher restates the built-in floor (inlined — see config-overrides for why the
-// fixture can't import the runtime `defaultIsGated`) and gates /private, so the middleware has a
-// gated path the manifest tells it never to touch.
-const config: AxConfig = {
-  siteUrl: 'https://middleware-fixture.example.com',
-  isGated: ({ path }) =>
-    path.startsWith('/api/auth/') || path.startsWith('/api/webhooks/') || path === '/private',
-};
-
-export default config;
diff --git a/fixtures/middleware/middleware.ts b/fixtures/middleware/middleware.ts
deleted file mode 100644
index 267d6aa..0000000
--- a/fixtures/middleware/middleware.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-import { withAx } from '@ora-ai/ax/middleware';
-
-import { axManifest } from './ax-manifest';
-
-// The exact wiring ax's CLI prints: the generated manifest is the rewrite contract (never rewrite
-// blind, never touch gated paths), and the matcher is pasted as a literal because Next.js only
-// accepts a statically analyzable `config`.
-export default withAx({ manifest: axManifest });
-
-export const config = {
-  matcher: ['/((?!_next|api|.*\\..*|favicon|robots|health|status).*)'],
-};
diff --git a/fixtures/middleware/next-env.d.ts b/fixtures/middleware/next-env.d.ts
deleted file mode 100644
index 830fb59..0000000
--- a/fixtures/middleware/next-env.d.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-/// <reference types="next" />
-/// <reference types="next/image-types/global" />
-/// <reference path="./.next/types/routes.d.ts" />
-
-// NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
diff --git a/fixtures/middleware/next.config.mjs b/fixtures/middleware/next.config.mjs
deleted file mode 100644
index 4678774..0000000
--- a/fixtures/middleware/next.config.mjs
+++ /dev/null
@@ -1,4 +0,0 @@
-/** @type {import('next').NextConfig} */
-const nextConfig = {};
-
-export default nextConfig;
diff --git a/fixtures/middleware/package.json b/fixtures/middleware/package.json
deleted file mode 100644
index e9d40c1..0000000
--- a/fixtures/middleware/package.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "name": "@ax-fixtures/middleware",
-  "version": "0.0.0",
-  "private": true,
-  "scripts": {
-    "prebuild": "ax manifest",
-    "build": "next build",
-    "postbuild": "ax --report --yes",
-    "dev": "next dev",
-    "start": "next start"
-  },
-  "dependencies": {
-    "next": "^15.1.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0"
-  },
-  "devDependencies": {
-    "@types/node": "^20.17.12",
-    "@types/react": "^19.0.7",
-    "@types/react-dom": "^19.0.3",
-    "@ora-ai/ax": "workspace:*",
-    "typescript": "^5.7.3"
-  }
-}
diff --git a/fixtures/middleware/public/docs.md b/fixtures/middleware/public/docs.md
deleted file mode 100644
index b8c9c1c..0000000
--- a/fixtures/middleware/public/docs.md
+++ /dev/null
@@ -1,9 +0,0 @@
-# Docs (hand-authored twin)
-
-This file is written and maintained by a human — it has no `generated-by` marker, so ax records it
-as the markdown source for `/docs` and never overwrites it. Because it is committed, the prebuild
-`ax manifest` run lists it on the very first build, which is what lets the dual-fetch dogfood
-prove the middleware rewrite without a second build.
-
-- Agents and `Accept: text/markdown` requesters receive this document at `/docs`.
-- Browsers receive the HTML page.
diff --git a/fixtures/middleware/report.golden.json b/fixtures/middleware/report.golden.json
deleted file mode 100644
index 3799b5c..0000000
--- a/fixtures/middleware/report.golden.json
+++ /dev/null
@@ -1,199 +0,0 @@
-{
-  "generatedAt": "<generatedAt>",
-  "siteUrl": "https://middleware-fixture.example.com",
-  "basePath": "",
-  "routers": [
-    "app"
-  ],
-  "catalog": {
-    "entryCount": 0,
-    "entries": [],
-    "path": "public/.well-known/ai-catalog.json",
-    "target": "static"
-  },
-  "mcp": {
-    "mounts": [],
-    "unreviewedMounts": []
-  },
-  "agent404": {
-    "notFoundPresent": false,
-    "agentAware": false,
-    "pages": [],
-    "markdownGuide": "public/404.md"
-  },
-  "middleware": {
-    "present": true,
-    "wiredToAx": true,
-    "source": "middleware.ts"
-  },
-  "artifacts": {
-    "robotsTxt": {
-      "found": false
-    },
-    "sitemap": {
-      "found": false
-    },
-    "agentsMd": {
-      "found": false
-    },
-    "jsonLd": {
-      "found": false
-    },
-    "llmsTxt": {
-      "found": false
-    },
-    "openapi": {
-      "found": false
-    }
-  },
-  "auth": {
-    "gatedSurfaces": []
-  },
-  "scaffolds": {},
-  "markdownTwins": {
-    "enabled": true,
-    "written": [
-      {
-        "route": "/",
-        "path": "public/index.md",
-        "tier": 2,
-        "source": "prerender"
-      }
-    ],
-    "userOwned": [
-      {
-        "route": "/docs",
-        "source": "public/docs.md"
-      }
-    ],
-    "skipped": [
-      {
-        "route": "/private",
-        "reason": "gated",
-        "detail": "The route is gated (isGated), and a gated page’s prerender is typically a login shell — deriving a twin from it would publish a converted login page as the page’s content."
-      },
-      {
-        "route": "/shell",
-        "reason": "too-little-text",
-        "detail": "The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker)."
-      }
-    ],
-    "dynamicRouteCount": 1,
-    "deleted": []
-  },
-  "sizes": [
-    {
-      "artifact": "ai-catalog.json",
-      "path": "public/.well-known/ai-catalog.json",
-      "bytes": 153,
-      "chars": 153,
-      "tokens": 38
-    },
-    {
-      "artifact": "markdown-twin",
-      "path": "public/index.md",
-      "bytes": 783,
-      "chars": 781,
-      "tokens": 195
-    },
-    {
-      "artifact": "404.md",
-      "path": "public/404.md",
-      "bytes": 795,
-      "chars": 785,
-      "tokens": 196
-    }
-  ],
-  "ora": {
-    "checks": [
-      {
-        "id": "ard-catalog",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "agent-discovery-file",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "llms-txt-exists",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "llms-txt-formatting",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "markdown-url-fallback",
-        "artifact": "markdown-twins",
-        "status": "addressed"
-      },
-      {
-        "id": "markdown-frontmatter",
-        "artifact": "markdown-twins",
-        "status": "addressed"
-      },
-      {
-        "id": "robots-ai-policy-quality",
-        "artifact": "robots.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "sitemap",
-        "artifact": "sitemap",
-        "status": "actionable"
-      },
-      {
-        "id": "agent-instruction",
-        "artifact": "agents.md",
-        "status": "actionable"
-      },
-      {
-        "id": "json-ld",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "org-schema-completeness",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "openapi-spec",
-        "artifact": "openapi.json",
-        "status": "actionable"
-      },
-      {
-        "id": "mcp-server",
-        "artifact": "mcp-server",
-        "status": "actionable"
-      },
-      {
-        "id": "markdown-negotiation",
-        "artifact": "middleware",
-        "status": "addressed"
-      },
-      {
-        "id": "markdown-negotiation-vary",
-        "artifact": "middleware",
-        "status": "addressed"
-      }
-    ]
-  },
-  "warnings": [],
-  "recommendations": [
-    "No OpenAPI doc found (public/openapi.json) — an OpenAPI doc lets agents understand and call your API without guessing at routes or schemas. ax never generates one; produce it however your API is defined (many schema/validation libraries can emit OpenAPI from your existing route definitions) and commit the result to public/openapi.json.",
-    "1 page file has dynamic URL segments, so no markdown twins exist for them (no build-time HTML, and ax never guesses URLs). To give those pages a markdown representation, add a markdown source per page or prerender representative routes.",
-    "No llms.txt found — a short natural-language guide agents read to decide whether your site fits their task, and to find your key pages. Add one at app/llms.txt/route.ts (or public/llms.txt), or set scaffoldLlmsTxt: true in ax.config to have a starter written for you. Pair it with JSON-LD structured data (an Organization block with a sameAs array): llms.txt says what your site is for, JSON-LD identifies it as an entity registries can rank — the two reinforce each other, so add both rather than one alone.",
-    "No WebMCP tools found, but your pages contain <form> elements — every form is a latent agent tool. Adding toolname and tooldescription attributes (the W3C WebMCP declarative API) makes a form callable by browser-resident agents with no JS changes, and is scored by Ora’s webmcp check. Chrome ships WebMCP in 157 (origin trial 149–156).",
-    "No sitemap found — add one so agents can discover all public routes. Use the built-in Next.js path (app/sitemap.ts); ax never generates a sitemap itself. Give each entry a <lastmod> date (agents use it to judge freshness), then reference it from robots.txt with a \"Sitemap:\" line.",
-    "No robots.txt found — add one (app/robots.ts or public/robots.txt) that explicitly Allows the reputable AI agents you want to reach, scoped to specific User-agent groups (never \"User-agent: *\"), plus a \"Sitemap:\" line. Note: Next's MetadataRoute.Robots (app/robots.ts) has no field for the \"Agentmap:\" catalog pointer — put that line in a static public/robots.txt. Set scaffoldRobots: true in ax.config to have one written for you.",
-    "No agents.md found — consider adding one (public/agents.md) with when-to-use / when-NOT-to-use guidance for agents. ax won't write its content for you; the companion skill can help author it from your repo.",
-    "No JSON-LD structured data found in your layouts/pages — structured data is how registries and agents disambiguate and rank your site. Add an Organization block in your root layout <head> (<script type=\"application/ld+json\">) with a \"sameAs\" array linking your LinkedIn/GitHub/npm/social profiles (the entity-disambiguation signal registries value), and at least one more schema.org @type beyond Organization — SoftwareApplication or Product for an app/API, or a FAQPage — since covering more types helps registries understand your site more fully. JSON-LD pairs with an llms.txt: llms.txt tells agents what your site is for, JSON-LD identifies it as an entity registries can rank — add both, not one alone. ax won’t author the block (the fields are judgment content); the companion skill can help draft it from your repo.",
-    "Markdown twins exist for your pages — link each HTML page to its twin so crawlers find the machine-readable version. Add this to the page <head> (ax prints the tag; it never edits your layout): <link rel=\"alternate\" type=\"text/markdown\" href=\"https://middleware-fixture.example.com/docs.md\" />",
-    "No app/not-found.tsx found — agents that hit a missing URL get Next.js’s bare default 404, a dead end that makes them give up or guess. Add a standard 404 page in your own design system (a clear “page not found” and a way back home), and include `<link rel=\"alternate\" type=\"text/markdown\" href=\"/404.md\" />` so agents can hop from it to /404.md — the generated wayfinding guide (real routes + discovery links) this build writes. Rendered in the page’s JSX, React hoists the tag into <head> (App Router); use next/head in the Pages Router."
-  ]
-}
diff --git a/fixtures/middleware/tsconfig.json b/fixtures/middleware/tsconfig.json
deleted file mode 100644
index 9666dbd..0000000
--- a/fixtures/middleware/tsconfig.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "extends": "../tsconfig.next.json",
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules"]
-}
diff --git a/fixtures/middleware/twins.golden/404.md b/fixtures/middleware/twins.golden/404.md
deleted file mode 100644
index 360424c..0000000
--- a/fixtures/middleware/twins.golden/404.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-title: "Page not found — middleware"
-description: "Where to continue when a URL on this site does not exist: discovery links and real routes."
-canonical_url: https://middleware-fixture.example.com/404.md
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# Page not found
-
-The URL you requested does not exist on this site. It may have moved, or it may never have existed —
-requesting it again will keep returning this response. Do not retry; start from the links
-below instead.
-
-## Start here
-
-- [/.well-known/ai-catalog.json](/.well-known/ai-catalog.json) — machine-readable catalog of everything this site offers agents
-
-## Pages that do exist
-
-- [/](/) — markdown: [/index.md](/index.md)
-- [/docs](/docs) — markdown: [/docs.md](/docs.md)
-- [/shell](/shell)
diff --git a/fixtures/middleware/twins.golden/index.md b/fixtures/middleware/twins.golden/index.md
deleted file mode 100644
index 47f8cfb..0000000
--- a/fixtures/middleware/twins.golden/index.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-title: "Middleware Fixture"
-description: "Exercises the @ora-ai/ax/middleware negotiation entry against a real next build."
-canonical_url: https://middleware-fixture.example.com/
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# Middleware fixture
-
-This prerendered homepage gets a generated markdown twin on the postbuild run. On a fresh checkout the prebuild manifest does not list that twin yet (it is generated after this build), so the middleware serves this HTML to everyone until the next build — the documented one-build staleness, and the reason the dogfood probes target the hand-authored docs twin instead.
-
-Enough prose lives here to clear the twin pass's minimum-content guard, so the homepage twin lands in this fixture's golden snapshots.
diff --git a/fixtures/next-auth/README.md b/fixtures/next-auth/README.md
new file mode 100644
index 0000000..6c0e1cc
--- /dev/null
+++ b/fixtures/next-auth/README.md
@@ -0,0 +1,11 @@
+# fixture: next-auth
+
+A minimal App Router app with `next-auth` actually installed and mounted at
+`app/api/auth/[...nextauth]/route.ts` — the thin single-axis fixture for auth-provider detection.
+The synthetic unit tests (`detect-auth-provider.test.ts`) cover the provider matrix; this fixture
+proves the one thing they can't: the detection holding against a real dependency tree and a real
+`next build`, with the report noting that next-auth signs humans in (steering gated surfaces to
+the api_key lane) and the default `/api/auth/**` gating floor keeping the mount out of the catalog.
+
+**Exercises:** package.json auth-provider detection (next-auth), the human-sign-in-only report
+note, and the built-in `/api/auth/**` gating floor — all through the golden-report layer.
diff --git a/fixtures/next-auth/app/api/auth/[...nextauth]/route.ts b/fixtures/next-auth/app/api/auth/[...nextauth]/route.ts
new file mode 100644
index 0000000..2aa55a7
--- /dev/null
+++ b/fixtures/next-auth/app/api/auth/[...nextauth]/route.ts
@@ -0,0 +1,19 @@
+import NextAuth from 'next-auth';
+import CredentialsProvider from 'next-auth/providers/credentials';
+
+// The canonical next-auth mount. The provider itself is a stub — no fixture test ever signs in;
+// what's under test is the package.json provider detection (next-auth is human sign-in only, so
+// the report steers gated surfaces toward the api_key lane) and the default /api/auth/** gating
+// floor keeping this route out of the catalog.
+const handler = NextAuth({
+  secret: 'fixture-only-not-a-secret',
+  providers: [
+    CredentialsProvider({
+      name: 'Demo',
+      credentials: { email: { label: 'Email', type: 'email' } },
+      authorize: async () => null,
+    }),
+  ],
+});
+
+export { handler as GET, handler as POST };
diff --git a/fixtures/llms-txt/app/layout.tsx b/fixtures/next-auth/app/layout.tsx
similarity index 66%
rename from fixtures/llms-txt/app/layout.tsx
rename to fixtures/next-auth/app/layout.tsx
index 46b091a..6906aa0 100644
--- a/fixtures/llms-txt/app/layout.tsx
+++ b/fixtures/next-auth/app/layout.tsx
@@ -1,8 +1,8 @@
 import type { ReactNode } from 'react';
 
 export const metadata = {
-  title: 'llms.txt Fixture',
-  description: 'An app that already serves an llms.txt agent-docs index.',
+  title: 'next-auth Fixture',
+  description: 'A minimal app with next-auth wired, for auth-provider detection.',
 };
 
 export default function RootLayout({ children }: { children: ReactNode }) {
diff --git a/fixtures/next-auth/app/page.tsx b/fixtures/next-auth/app/page.tsx
new file mode 100644
index 0000000..4e8199c
--- /dev/null
+++ b/fixtures/next-auth/app/page.tsx
@@ -0,0 +1,11 @@
+export default function Home() {
+  return (
+    <main>
+      <h1>next-auth fixture</h1>
+      <p>
+        Human sign-in lives at /api/auth/* via next-auth. Nothing else here — the fixture exists to
+        prove provider detection against a real dependency in a real build.
+      </p>
+    </main>
+  );
+}
diff --git a/fixtures/mdx-content/ax.config.ts b/fixtures/next-auth/ax.config.ts
similarity index 77%
rename from fixtures/mdx-content/ax.config.ts
rename to fixtures/next-auth/ax.config.ts
index 7566f76..23c658d 100644
--- a/fixtures/mdx-content/ax.config.ts
+++ b/fixtures/next-auth/ax.config.ts
@@ -2,7 +2,7 @@ import type { AxConfig } from '@ora-ai/ax';
 
 // A literal `siteUrl` keeps this fixture's emitted output identical everywhere it's built.
 const config: AxConfig = {
-  siteUrl: 'https://mdx-content-fixture.example.com',
+  siteUrl: 'https://next-auth-fixture.example.com',
 };
 
 export default config;
diff --git a/fixtures/discovery/next-env.d.ts b/fixtures/next-auth/next-env.d.ts
similarity index 100%
rename from fixtures/discovery/next-env.d.ts
rename to fixtures/next-auth/next-env.d.ts
diff --git a/fixtures/discovery/next.config.mjs b/fixtures/next-auth/next.config.mjs
similarity index 100%
rename from fixtures/discovery/next.config.mjs
rename to fixtures/next-auth/next.config.mjs
diff --git a/fixtures/config-overrides/package.json b/fixtures/next-auth/package.json
similarity index 87%
rename from fixtures/config-overrides/package.json
rename to fixtures/next-auth/package.json
index 05eee78..3ada34d 100644
--- a/fixtures/config-overrides/package.json
+++ b/fixtures/next-auth/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "@ax-fixtures/config-overrides",
+  "name": "@ax-fixtures/next-auth",
   "version": "0.0.0",
   "private": true,
   "scripts": {
@@ -10,6 +10,7 @@
   },
   "dependencies": {
     "next": "^15.1.0",
+    "next-auth": "^4.24.11",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
diff --git a/fixtures/webmcp-declarative/report.golden.json b/fixtures/next-auth/report.golden.json
similarity index 94%
rename from fixtures/webmcp-declarative/report.golden.json
rename to fixtures/next-auth/report.golden.json
index d666487..e2b7e0a 100644
--- a/fixtures/webmcp-declarative/report.golden.json
+++ b/fixtures/next-auth/report.golden.json
@@ -1,20 +1,13 @@
 {
   "generatedAt": "<generatedAt>",
-  "siteUrl": "https://webmcp-declarative-fixture.example.com",
+  "siteUrl": "https://next-auth-fixture.example.com",
   "basePath": "",
   "routers": [
     "app"
   ],
   "catalog": {
-    "entryCount": 1,
-    "entries": [
-      {
-        "identifier": "urn:air:webmcp-declarative-fixture.example.com:webmcp",
-        "type": "text/html",
-        "url": "https://webmcp-declarative-fixture.example.com/",
-        "displayName": "WebMCP tools (/)"
-      }
-    ],
+    "entryCount": 0,
+    "entries": [],
     "path": "public/.well-known/ai-catalog.json",
     "target": "static"
   },
@@ -53,7 +46,12 @@
     }
   },
   "auth": {
-    "gatedSurfaces": []
+    "gatedSurfaces": [],
+    "provider": {
+      "name": "next-auth",
+      "package": "next-auth",
+      "note": "next-auth signs humans in but does not expose an OAuth authorization server agents can use. The practical agent lane is an API key issued behind your existing login, declared via entries[].auth (status \"api_key\" + docsUrl) so agents learn where a human obtains it."
+    }
   },
   "scaffolds": {},
   "markdownTwins": {
@@ -74,16 +72,16 @@
     {
       "artifact": "ai-catalog.json",
       "path": "public/.well-known/ai-catalog.json",
-      "bytes": 668,
-      "chars": 666,
-      "tokens": 167
+      "bytes": 151,
+      "chars": 151,
+      "tokens": 38
     },
     {
       "artifact": "404.md",
       "path": "public/404.md",
-      "bytes": 703,
-      "chars": 697,
-      "tokens": 174
+      "bytes": 685,
+      "chars": 679,
+      "tokens": 170
     }
   ],
   "ora": {
diff --git a/fixtures/config-overrides/tsconfig.json b/fixtures/next-auth/tsconfig.json
similarity index 100%
rename from fixtures/config-overrides/tsconfig.json
rename to fixtures/next-auth/tsconfig.json
diff --git a/fixtures/webmcp-declarative/twins.golden/404.md b/fixtures/next-auth/twins.golden/404.md
similarity index 83%
rename from fixtures/webmcp-declarative/twins.golden/404.md
rename to fixtures/next-auth/twins.golden/404.md
index 0b8ba74..0cef3b1 100644
--- a/fixtures/webmcp-declarative/twins.golden/404.md
+++ b/fixtures/next-auth/twins.golden/404.md
@@ -1,7 +1,7 @@
 ---
-title: "Page not found — webmcp-declarative"
+title: "Page not found — next-auth"
 description: "Where to continue when a URL on this site does not exist: discovery links and real routes."
-canonical_url: https://webmcp-declarative-fixture.example.com/404.md
+canonical_url: https://next-auth-fixture.example.com/404.md
 last_updated: <last_updated>
 generated-by: "@ora-ai/ax"
 ---
diff --git a/fixtures/openapi/README.md b/fixtures/openapi/README.md
deleted file mode 100644
index 77b2363..0000000
--- a/fixtures/openapi/README.md
+++ /dev/null
@@ -1,13 +0,0 @@
-# fixture: openapi
-
-An app that already serves an OpenAPI 3.1 document at `public/openapi.json`.
-
-**Exercises:** the **detect-and-reference** path (Phase 2.2). The plugin finds the served
-`openapi.json`, confirms it parses as OpenAPI 3.x, and emits **one** catalog entry of
-`type: application/vnd.oai.openapi+json;version=3.1` pointing at `/openapi.json` — the shape Telnyx
-(Ora's top-ranked A+ site) publishes. It must **not** regenerate or fan the API out into per-route
-entries.
-
-Ships an `ax.config.ts` declaring `siteUrl` so the emitted entry's URL is deterministic in CI
-(without it, this detector still runs, but skips emitting a URL-bearing entry since none of this
-repo's test environments set Vercel's production-domain env var).
diff --git a/fixtures/openapi/app/layout.tsx b/fixtures/openapi/app/layout.tsx
deleted file mode 100644
index dff6cab..0000000
--- a/fixtures/openapi/app/layout.tsx
+++ /dev/null
@@ -1,14 +0,0 @@
-import type { ReactNode } from 'react';
-
-export const metadata = {
-  title: 'OpenAPI Fixture',
-  description: 'An app that already serves an openapi.json for its REST API.',
-};
-
-export default function RootLayout({ children }: { children: ReactNode }) {
-  return (
-    <html lang="en">
-      <body>{children}</body>
-    </html>
-  );
-}
diff --git a/fixtures/openapi/app/page.tsx b/fixtures/openapi/app/page.tsx
deleted file mode 100644
index 27d355c..0000000
--- a/fixtures/openapi/app/page.tsx
+++ /dev/null
@@ -1,11 +0,0 @@
-export default function Home() {
-  return (
-    <main>
-      <h1>OpenAPI fixture</h1>
-      <p>
-        This app serves /openapi.json. The plugin should detect it and reference it as a single
-        application/vnd.oai.openapi+json entry (the Telnyx shape) — not per-route entries.
-      </p>
-    </main>
-  );
-}
diff --git a/fixtures/openapi/ax.config.ts b/fixtures/openapi/ax.config.ts
deleted file mode 100644
index 62f3d9e..0000000
--- a/fixtures/openapi/ax.config.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import type { AxConfig } from '@ora-ai/ax';
-
-// `siteUrl` makes the fixture deterministic regardless of where it's built (CI, a laptop, ...) —
-// without it, zero-config OpenAPI detection (Phase 2.2) would still run but skip emitting a
-// URL-bearing entry, since none of this repo's test environments set Vercel's production-domain
-// env var. A real deployment on Vercel wouldn't need this line.
-//
-// An app hosted somewhere other than Vercel would typically read this from its own env var
-// instead of a literal — this file is evaluated as real code (via jiti), so
-// `siteUrl: process.env.SITE_URL` works with no special support from the plugin. It's a literal
-// here only so this fixture's expected output is identical everywhere it's built, regardless of
-// what env vars happen to be set.
-const config: AxConfig = {
-  siteUrl: 'https://openapi-fixture.example.com',
-};
-
-export default config;
diff --git a/fixtures/openapi/next-env.d.ts b/fixtures/openapi/next-env.d.ts
deleted file mode 100644
index 830fb59..0000000
--- a/fixtures/openapi/next-env.d.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-/// <reference types="next" />
-/// <reference types="next/image-types/global" />
-/// <reference path="./.next/types/routes.d.ts" />
-
-// NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
diff --git a/fixtures/openapi/next.config.mjs b/fixtures/openapi/next.config.mjs
deleted file mode 100644
index 4678774..0000000
--- a/fixtures/openapi/next.config.mjs
+++ /dev/null
@@ -1,4 +0,0 @@
-/** @type {import('next').NextConfig} */
-const nextConfig = {};
-
-export default nextConfig;
diff --git a/fixtures/openapi/public/openapi.json b/fixtures/openapi/public/openapi.json
deleted file mode 100644
index 9b28af4..0000000
--- a/fixtures/openapi/public/openapi.json
+++ /dev/null
@@ -1,63 +0,0 @@
-{
-  "openapi": "3.1.0",
-  "info": {
-    "title": "Example API",
-    "version": "1.0.0",
-    "description": "A minimal OpenAPI 3.1 description served statically at /openapi.json."
-  },
-  "servers": [{ "url": "https://example.com" }],
-  "components": {
-    "securitySchemes": {
-      "oauth2": {
-        "type": "oauth2",
-        "flows": {
-          "authorizationCode": {
-            "authorizationUrl": "https://example.com/oauth/authorize",
-            "tokenUrl": "https://example.com/oauth/token",
-            "scopes": {
-              "read:echo": "Read access",
-              "write:echo": "Write access"
-            }
-          }
-        }
-      }
-    }
-  },
-  "security": [{ "oauth2": ["read:echo"] }],
-  "paths": {
-    "/api/echo": {
-      "post": {
-        "operationId": "echo",
-        "summary": "Echo a message back to the caller.",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "required": ["message"],
-                "properties": {
-                  "message": { "type": "string", "description": "The text to echo back" },
-                  "shout": { "type": "boolean", "description": "Uppercase the echoed text" }
-                }
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "The echoed message.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "properties": { "echoed": { "type": "string" } }
-                }
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/fixtures/openapi/report.golden.json b/fixtures/openapi/report.golden.json
deleted file mode 100644
index 31c144e..0000000
--- a/fixtures/openapi/report.golden.json
+++ /dev/null
@@ -1,224 +0,0 @@
-{
-  "generatedAt": "<generatedAt>",
-  "siteUrl": "https://openapi-fixture.example.com",
-  "basePath": "",
-  "routers": [
-    "app"
-  ],
-  "catalog": {
-    "entryCount": 1,
-    "entries": [
-      {
-        "identifier": "urn:air:openapi-fixture.example.com:openapi",
-        "type": "application/vnd.oai.openapi+json;version=3.1",
-        "url": "https://openapi-fixture.example.com/openapi.json",
-        "displayName": "Example API"
-      }
-    ],
-    "path": "public/.well-known/ai-catalog.json",
-    "target": "static"
-  },
-  "mcp": {
-    "mounts": [],
-    "unreviewedMounts": []
-  },
-  "agent404": {
-    "notFoundPresent": false,
-    "agentAware": false,
-    "pages": [],
-    "markdownGuide": "public/404.md"
-  },
-  "middleware": {
-    "present": false,
-    "wiredToAx": false
-  },
-  "artifacts": {
-    "robotsTxt": {
-      "found": false
-    },
-    "sitemap": {
-      "found": false
-    },
-    "agentsMd": {
-      "found": false
-    },
-    "jsonLd": {
-      "found": false
-    },
-    "llmsTxt": {
-      "found": false
-    },
-    "openapi": {
-      "found": true,
-      "source": "public/openapi.json"
-    }
-  },
-  "auth": {
-    "gatedSurfaces": [
-      {
-        "path": "/openapi.json",
-        "status": "oauth2",
-        "declared": false,
-        "oauthEndpoints": true,
-        "note": "No docsUrl — declare where a human obtains access (entries[].auth.docsUrl) so an agent can hand the sign-up step to its human."
-      }
-    ]
-  },
-  "scaffolds": {},
-  "markdownTwins": {
-    "enabled": true,
-    "written": [],
-    "userOwned": [],
-    "skipped": [
-      {
-        "route": "/",
-        "reason": "too-little-text",
-        "detail": "The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker)."
-      }
-    ],
-    "dynamicRouteCount": 0,
-    "deleted": [],
-    "authMd": {
-      "path": "public/auth.md",
-      "surfaceCount": 1
-    }
-  },
-  "sizes": [
-    {
-      "artifact": "ai-catalog.json",
-      "path": "public/.well-known/ai-catalog.json",
-      "bytes": 843,
-      "chars": 843,
-      "tokens": 211
-    },
-    {
-      "artifact": "auth.md",
-      "path": "public/auth.md",
-      "bytes": 916,
-      "chars": 910,
-      "tokens": 228
-    },
-    {
-      "artifact": "404.md",
-      "path": "public/404.md",
-      "bytes": 825,
-      "chars": 815,
-      "tokens": 204
-    }
-  ],
-  "ora": {
-    "checks": [
-      {
-        "id": "ard-catalog",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "agent-discovery-file",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "llms-txt-exists",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "llms-txt-formatting",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "markdown-url-fallback",
-        "artifact": "markdown-twins",
-        "status": "actionable",
-        "note": "No markdown twin could be derived for the homepage (too-little-text): The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker). The report’s markdownTwins.skipped section lists every twin-less route with its reason."
-      },
-      {
-        "id": "markdown-frontmatter",
-        "artifact": "markdown-twins",
-        "status": "actionable",
-        "note": "No markdown twin could be derived for the homepage (too-little-text): The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker). The report’s markdownTwins.skipped section lists every twin-less route with its reason."
-      },
-      {
-        "id": "robots-ai-policy-quality",
-        "artifact": "robots.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "sitemap",
-        "artifact": "sitemap",
-        "status": "actionable"
-      },
-      {
-        "id": "agent-instruction",
-        "artifact": "agents.md",
-        "status": "actionable"
-      },
-      {
-        "id": "json-ld",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "org-schema-completeness",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "openapi-spec",
-        "artifact": "openapi.json",
-        "status": "addressed"
-      },
-      {
-        "id": "mcp-server",
-        "artifact": "mcp-server",
-        "status": "actionable"
-      },
-      {
-        "id": "auth-md-exists",
-        "artifact": "auth.md",
-        "status": "addressed"
-      },
-      {
-        "id": "auth-md-structure",
-        "artifact": "auth.md",
-        "status": "addressed"
-      },
-      {
-        "id": "mcp-auth-mechanism",
-        "artifact": "auth-declaration",
-        "status": "addressed"
-      },
-      {
-        "id": "oauth-protected-resource",
-        "artifact": "oauth-metadata",
-        "status": "actionable",
-        "note": "OAuth is declared but no RFC 9728 protected-resource metadata is wired, so agents can't discover the authorization server. Add your provider's protected-resource route (see report.auth.provider) or a static /.well-known/oauth-protected-resource document."
-      },
-      {
-        "id": "markdown-negotiation",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      },
-      {
-        "id": "markdown-negotiation-vary",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      }
-    ]
-  },
-  "warnings": [],
-  "recommendations": [
-    "No llms.txt found — a short natural-language guide agents read to decide whether your site fits their task, and to find your key pages. Add one at app/llms.txt/route.ts (or public/llms.txt), or set scaffoldLlmsTxt: true in ax.config to have a starter written for you. Pair it with JSON-LD structured data (an Organization block with a sameAs array): llms.txt says what your site is for, JSON-LD identifies it as an entity registries can rank — the two reinforce each other, so add both rather than one alone.",
-    "No sitemap found — add one so agents can discover all public routes. Use the built-in Next.js path (app/sitemap.ts); ax never generates a sitemap itself. Give each entry a <lastmod> date (agents use it to judge freshness), then reference it from robots.txt with a \"Sitemap:\" line.",
-    "No robots.txt found — add one (app/robots.ts or public/robots.txt) that explicitly Allows the reputable AI agents you want to reach, scoped to specific User-agent groups (never \"User-agent: *\"), plus a \"Sitemap:\" line. Note: Next's MetadataRoute.Robots (app/robots.ts) has no field for the \"Agentmap:\" catalog pointer — put that line in a static public/robots.txt. Set scaffoldRobots: true in ax.config to have one written for you.",
-    "No agents.md found — consider adding one (public/agents.md) with when-to-use / when-NOT-to-use guidance for agents. ax won't write its content for you; the companion skill can help author it from your repo.",
-    "No JSON-LD structured data found in your layouts/pages — structured data is how registries and agents disambiguate and rank your site. Add an Organization block in your root layout <head> (<script type=\"application/ld+json\">) with a \"sameAs\" array linking your LinkedIn/GitHub/npm/social profiles (the entity-disambiguation signal registries value), and at least one more schema.org @type beyond Organization — SoftwareApplication or Product for an app/API, or a FAQPage — since covering more types helps registries understand your site more fully. JSON-LD pairs with an llms.txt: llms.txt tells agents what your site is for, JSON-LD identifies it as an entity registries can rank — add both, not one alone. ax won’t author the block (the fields are judgment content); the companion skill can help draft it from your repo.",
-    "Gated routes should keep their honest 401/403 status and point agents at the auth guide: add a WWW-Authenticate header and a Link (or body) pointer to /auth.md in your gated route handlers. A 200 \"this is gated\" page is a soft auth wall agents are built to distrust; ax generates the guide but never rewrites your handlers.",
-    "No app/not-found.tsx found — agents that hit a missing URL get Next.js’s bare default 404, a dead end that makes them give up or guess. Add a standard 404 page in your own design system (a clear “page not found” and a way back home), and include `<link rel=\"alternate\" type=\"text/markdown\" href=\"/404.md\" />` so agents can hop from it to /404.md — the generated wayfinding guide (real routes + discovery links) this build writes. Rendered in the page’s JSX, React hoists the tag into <head> (App Router); use next/head in the Pages Router.",
-    "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-  ]
-}
diff --git a/fixtures/openapi/tsconfig.json b/fixtures/openapi/tsconfig.json
deleted file mode 100644
index 9666dbd..0000000
--- a/fixtures/openapi/tsconfig.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "extends": "../tsconfig.next.json",
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules"]
-}
diff --git a/fixtures/openapi/twins.golden/404.md b/fixtures/openapi/twins.golden/404.md
deleted file mode 100644
index 3bd0ae3..0000000
--- a/fixtures/openapi/twins.golden/404.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-title: "Page not found — openapi"
-description: "Where to continue when a URL on this site does not exist: discovery links and real routes."
-canonical_url: https://openapi-fixture.example.com/404.md
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# Page not found
-
-The URL you requested does not exist on this site. It may have moved, or it may never have existed —
-requesting it again will keep returning this response. Do not retry; start from the links
-below instead.
-
-## Start here
-
-- [/.well-known/ai-catalog.json](/.well-known/ai-catalog.json) — machine-readable catalog of everything this site offers agents
-- [/auth.md](/auth.md) — how to obtain access to the gated surfaces
-- [/openapi.json](/openapi.json) — the REST API, as an OpenAPI document
-
-## Pages that do exist
-
-- [/](/)
diff --git a/fixtures/openapi/twins.golden/auth.md b/fixtures/openapi/twins.golden/auth.md
deleted file mode 100644
index 28f9e51..0000000
--- a/fixtures/openapi/twins.golden/auth.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-title: "Authentication — openapi"
-description: "How to obtain access to the gated surfaces on this site."
-canonical_url: https://openapi-fixture.example.com/auth.md
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# Authentication
-
-openapi has 1 gated surface. This document is generated at build time from the site's own committed auth declarations — it describes how to authenticate and never contains credentials.
-
-## HTTP API (described by /openapi.json)
-
-The HTTP API documented by [/openapi.json](https://openapi-fixture.example.com/openapi.json) requires authentication; the OpenAPI document declares the scheme(s).
-
-- Auth: OAuth 2.0
-- Authorization endpoint: <https://example.com/oauth/authorize>
-- Token endpoint: <https://example.com/oauth/token>
-- Scopes: `read:echo`, `write:echo`
-- Get access: sign in through your MCP client via OAuth — no manually issued credentials.
diff --git a/fixtures/pages-bare/README.md b/fixtures/pages-bare/README.md
deleted file mode 100644
index 16f2562..0000000
--- a/fixtures/pages-bare/README.md
+++ /dev/null
@@ -1,6 +0,0 @@
-# pages-bare
-
-A minimal **Pages Router** app (no `app/` directory). Its job in the corpus is to prove the plugin
-handles Pages Router route topology: `pages/index.tsx` and `pages/about.tsx` are addressable routes,
-while `pages/_app.tsx`, `pages/_document.tsx`, `pages/404.tsx`, and `pages/blog/[slug].tsx` (dynamic)
-are correctly excluded from the route list.
diff --git a/fixtures/pages-bare/ax.config.ts b/fixtures/pages-bare/ax.config.ts
deleted file mode 100644
index 3fb6b46..0000000
--- a/fixtures/pages-bare/ax.config.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import type { AxConfig } from '@ora-ai/ax';
-
-// `siteUrl` makes the fixture deterministic regardless of where it's built (see the mcp-adapter
-// fixture for the full rationale). This is a Pages Router app — no `app/` directory — so it exists
-// to prove the plugin lists Pages Router routes and never mistakes `_app`/`_document`/`404`/dynamic
-// files for content pages.
-const config: AxConfig = {
-  siteUrl: 'https://pages-bare-fixture.example.com',
-};
-
-export default config;
diff --git a/fixtures/pages-bare/next.config.mjs b/fixtures/pages-bare/next.config.mjs
deleted file mode 100644
index 4678774..0000000
--- a/fixtures/pages-bare/next.config.mjs
+++ /dev/null
@@ -1,4 +0,0 @@
-/** @type {import('next').NextConfig} */
-const nextConfig = {};
-
-export default nextConfig;
diff --git a/fixtures/pages-bare/package.json b/fixtures/pages-bare/package.json
deleted file mode 100644
index c0df1f7..0000000
--- a/fixtures/pages-bare/package.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "name": "@ax-fixtures/pages-bare",
-  "version": "0.0.0",
-  "private": true,
-  "scripts": {
-    "build": "next build",
-    "postbuild": "ax --report --yes",
-    "dev": "next dev",
-    "start": "next start"
-  },
-  "dependencies": {
-    "next": "^15.1.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0"
-  },
-  "devDependencies": {
-    "@types/node": "^20.17.12",
-    "@types/react": "^19.0.7",
-    "@types/react-dom": "^19.0.3",
-    "@ora-ai/ax": "workspace:*",
-    "typescript": "^5.7.3"
-  }
-}
diff --git a/fixtures/pages-bare/pages/404.tsx b/fixtures/pages-bare/pages/404.tsx
deleted file mode 100644
index fc4d8cc..0000000
--- a/fixtures/pages-bare/pages/404.tsx
+++ /dev/null
@@ -1,5 +0,0 @@
-// The Pages Router custom 404. An error page, not addressable content — must be excluded from the
-// route list (the App Router equivalent is `app/not-found.tsx`).
-export default function NotFound() {
-  return <h1>404 — page not found</h1>;
-}
diff --git a/fixtures/pages-bare/pages/about.tsx b/fixtures/pages-bare/pages/about.tsx
deleted file mode 100644
index 3e7720f..0000000
--- a/fixtures/pages-bare/pages/about.tsx
+++ /dev/null
@@ -1,8 +0,0 @@
-export default function About() {
-  return (
-    <main>
-      <h1>About</h1>
-      <p>A second static route (`/about`) — file-path-is-the-route, no `page.tsx` convention.</p>
-    </main>
-  );
-}
diff --git a/fixtures/pages-bare/pages/blog/[slug].tsx b/fixtures/pages-bare/pages/blog/[slug].tsx
deleted file mode 100644
index 5059a03..0000000
--- a/fixtures/pages-bare/pages/blog/[slug].tsx
+++ /dev/null
@@ -1,5 +0,0 @@
-// A dynamic route: its concrete URL isn't statically knowable, so the plugin must NOT list it
-// (precision over recall — never guess a dynamic URL).
-export default function BlogPost() {
-  return <article>A blog post.</article>;
-}
diff --git a/fixtures/pages-bare/pages/index.tsx b/fixtures/pages-bare/pages/index.tsx
deleted file mode 100644
index 94eaf99..0000000
--- a/fixtures/pages-bare/pages/index.tsx
+++ /dev/null
@@ -1,8 +0,0 @@
-export default function Home() {
-  return (
-    <main>
-      <h1>Pages Router bare fixture</h1>
-      <p>The home route (`/`), served by the Pages Router `pages/index.tsx` convention.</p>
-    </main>
-  );
-}
diff --git a/fixtures/pages-bare/report.golden.json b/fixtures/pages-bare/report.golden.json
deleted file mode 100644
index 647beb7..0000000
--- a/fixtures/pages-bare/report.golden.json
+++ /dev/null
@@ -1,187 +0,0 @@
-{
-  "generatedAt": "<generatedAt>",
-  "siteUrl": "https://pages-bare-fixture.example.com",
-  "basePath": "",
-  "routers": [
-    "pages"
-  ],
-  "catalog": {
-    "entryCount": 0,
-    "entries": [],
-    "path": "public/.well-known/ai-catalog.json",
-    "target": "static"
-  },
-  "mcp": {
-    "mounts": [],
-    "unreviewedMounts": []
-  },
-  "agent404": {
-    "notFoundPresent": true,
-    "agentAware": false,
-    "pages": [
-      {
-        "source": "pages/404.tsx",
-        "agentAware": false
-      }
-    ],
-    "markdownGuide": "public/404.md"
-  },
-  "middleware": {
-    "present": false,
-    "wiredToAx": false
-  },
-  "artifacts": {
-    "robotsTxt": {
-      "found": false
-    },
-    "sitemap": {
-      "found": false
-    },
-    "agentsMd": {
-      "found": false
-    },
-    "jsonLd": {
-      "found": false
-    },
-    "llmsTxt": {
-      "found": false
-    },
-    "openapi": {
-      "found": false
-    }
-  },
-  "auth": {
-    "gatedSurfaces": []
-  },
-  "scaffolds": {},
-  "markdownTwins": {
-    "enabled": true,
-    "written": [],
-    "userOwned": [],
-    "skipped": [
-      {
-        "route": "/",
-        "reason": "too-little-text",
-        "detail": "The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker)."
-      },
-      {
-        "route": "/about",
-        "reason": "too-little-text",
-        "detail": "The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker)."
-      }
-    ],
-    "dynamicRouteCount": 1,
-    "deleted": []
-  },
-  "sizes": [
-    {
-      "artifact": "ai-catalog.json",
-      "path": "public/.well-known/ai-catalog.json",
-      "bytes": 153,
-      "chars": 153,
-      "tokens": 38
-    },
-    {
-      "artifact": "404.md",
-      "path": "public/404.md",
-      "bytes": 706,
-      "chars": 700,
-      "tokens": 175
-    }
-  ],
-  "ora": {
-    "checks": [
-      {
-        "id": "ard-catalog",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "agent-discovery-file",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "llms-txt-exists",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "llms-txt-formatting",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "markdown-url-fallback",
-        "artifact": "markdown-twins",
-        "status": "actionable",
-        "note": "No markdown twin could be derived for the homepage (too-little-text): The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker). The report’s markdownTwins.skipped section lists every twin-less route with its reason."
-      },
-      {
-        "id": "markdown-frontmatter",
-        "artifact": "markdown-twins",
-        "status": "actionable",
-        "note": "No markdown twin could be derived for the homepage (too-little-text): The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker). The report’s markdownTwins.skipped section lists every twin-less route with its reason."
-      },
-      {
-        "id": "robots-ai-policy-quality",
-        "artifact": "robots.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "sitemap",
-        "artifact": "sitemap",
-        "status": "actionable"
-      },
-      {
-        "id": "agent-instruction",
-        "artifact": "agents.md",
-        "status": "actionable"
-      },
-      {
-        "id": "json-ld",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "org-schema-completeness",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "openapi-spec",
-        "artifact": "openapi.json",
-        "status": "actionable"
-      },
-      {
-        "id": "mcp-server",
-        "artifact": "mcp-server",
-        "status": "actionable"
-      },
-      {
-        "id": "markdown-negotiation",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      },
-      {
-        "id": "markdown-negotiation-vary",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      }
-    ]
-  },
-  "warnings": [],
-  "recommendations": [
-    "No OpenAPI doc found (public/openapi.json) — an OpenAPI doc lets agents understand and call your API without guessing at routes or schemas. ax never generates one; produce it however your API is defined (many schema/validation libraries can emit OpenAPI from your existing route definitions) and commit the result to public/openapi.json.",
-    "1 page file has dynamic URL segments, so no markdown twins exist for them (no build-time HTML, and ax never guesses URLs). To give those pages a markdown representation, add a markdown source per page or prerender representative routes.",
-    "No llms.txt found — a short natural-language guide agents read to decide whether your site fits their task, and to find your key pages. Add one at app/llms.txt/route.ts (or public/llms.txt), or set scaffoldLlmsTxt: true in ax.config to have a starter written for you. Pair it with JSON-LD structured data (an Organization block with a sameAs array): llms.txt says what your site is for, JSON-LD identifies it as an entity registries can rank — the two reinforce each other, so add both rather than one alone.",
-    "No sitemap found — add one so agents can discover all public routes. Use the built-in Next.js path (app/sitemap.ts); ax never generates a sitemap itself. Give each entry a <lastmod> date (agents use it to judge freshness), then reference it from robots.txt with a \"Sitemap:\" line.",
-    "No robots.txt found — add one (app/robots.ts or public/robots.txt) that explicitly Allows the reputable AI agents you want to reach, scoped to specific User-agent groups (never \"User-agent: *\"), plus a \"Sitemap:\" line. Note: Next's MetadataRoute.Robots (app/robots.ts) has no field for the \"Agentmap:\" catalog pointer — put that line in a static public/robots.txt. Set scaffoldRobots: true in ax.config to have one written for you.",
-    "No agents.md found — consider adding one (public/agents.md) with when-to-use / when-NOT-to-use guidance for agents. ax won't write its content for you; the companion skill can help author it from your repo.",
-    "No JSON-LD structured data found in your layouts/pages — structured data is how registries and agents disambiguate and rank your site. Add an Organization block in your root layout <head> (<script type=\"application/ld+json\">) with a \"sameAs\" array linking your LinkedIn/GitHub/npm/social profiles (the entity-disambiguation signal registries value), and at least one more schema.org @type beyond Organization — SoftwareApplication or Product for an app/API, or a FAQPage — since covering more types helps registries understand your site more fully. JSON-LD pairs with an llms.txt: llms.txt tells agents what your site is for, JSON-LD identifies it as an entity registries can rank — add both, not one alone. ax won’t author the block (the fields are judgment content); the companion skill can help draft it from your repo.",
-    "pages/404.tsx doesn’t point agents anywhere — an agent hitting a 404 needs to know why (the URL doesn’t exist; retrying won’t help) and how to continue. Add `<link rel=\"alternate\" type=\"text/markdown\" href=\"/404.md\" />` to it so agents can hop to /404.md — the generated wayfinding guide (real routes + discovery links) this build writes. The tag is invisible to human visitors, and your page stays yours — ax never edits it.",
-    "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-  ]
-}
diff --git a/fixtures/pages-bare/tsconfig.json b/fixtures/pages-bare/tsconfig.json
deleted file mode 100644
index 9666dbd..0000000
--- a/fixtures/pages-bare/tsconfig.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "extends": "../tsconfig.next.json",
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules"]
-}
diff --git a/fixtures/pages-bare/twins.golden/404.md b/fixtures/pages-bare/twins.golden/404.md
deleted file mode 100644
index 1697faa..0000000
--- a/fixtures/pages-bare/twins.golden/404.md
+++ /dev/null
@@ -1,22 +0,0 @@
----
-title: "Page not found — pages-bare"
-description: "Where to continue when a URL on this site does not exist: discovery links and real routes."
-canonical_url: https://pages-bare-fixture.example.com/404.md
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# Page not found
-
-The URL you requested does not exist on this site. It may have moved, or it may never have existed —
-requesting it again will keep returning this response. Do not retry; start from the links
-below instead.
-
-## Start here
-
-- [/.well-known/ai-catalog.json](/.well-known/ai-catalog.json) — machine-readable catalog of everything this site offers agents
-
-## Pages that do exist
-
-- [/](/)
-- [/about](/about)
diff --git a/fixtures/pages-mcp/README.md b/fixtures/pages-mcp/README.md
deleted file mode 100644
index f681048..0000000
--- a/fixtures/pages-mcp/README.md
+++ /dev/null
@@ -1,5 +0,0 @@
-# pages-mcp
-
-A **Pages Router** app whose MCP server is mounted at `pages/api/[transport].ts`. It proves the
-plugin detects an `mcp-handler` mount in the Pages Router `pages/api/**` shape (not just the App
-Router `route.ts` shape) and resolves the `[transport]` convention to `/api/mcp`.
diff --git a/fixtures/pages-mcp/ax.config.ts b/fixtures/pages-mcp/ax.config.ts
deleted file mode 100644
index 2ec8a6b..0000000
--- a/fixtures/pages-mcp/ax.config.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import type { AxConfig } from '@ora-ai/ax';
-
-// `siteUrl` makes the fixture deterministic (see the mcp-adapter fixture for the full rationale).
-// This is a Pages Router app whose MCP server is mounted at `pages/api/[transport].ts` — the plugin
-// detects it the same way it detects an App Router `app/[transport]/route.ts` mount, resolving the
-// mcp-handler `[transport]` convention to `/api/mcp`.
-const config: AxConfig = {
-  siteUrl: 'https://pages-mcp-fixture.example.com',
-};
-
-export default config;
diff --git a/fixtures/pages-mcp/cards.golden/server-card.json b/fixtures/pages-mcp/cards.golden/server-card.json
deleted file mode 100644
index 0df2d20..0000000
--- a/fixtures/pages-mcp/cards.golden/server-card.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  "name": "com.example.pages-mcp-fixture/pages-mcp",
-  "description": "pages-mcp MCP server",
-  "version": "0.0.0",
-  "serverUrl": "https://pages-mcp-fixture.example.com/api/mcp",
-  "remotes": [
-    {
-      "type": "streamable-http",
-      "url": "https://pages-mcp-fixture.example.com/api/mcp"
-    }
-  ],
-  "tools": [
-    {
-      "name": "roll_dice"
-    }
-  ],
-  "serverInfo": {
-    "name": "pages-mcp",
-    "version": "0.0.0"
-  },
-  "transport": {
-    "type": "streamable-http",
-    "endpoint": "https://pages-mcp-fixture.example.com/api/mcp"
-  },
-  "capabilities": {
-    "tools": {}
-  }
-}
diff --git a/fixtures/pages-mcp/next-env.d.ts b/fixtures/pages-mcp/next-env.d.ts
deleted file mode 100644
index 254b73c..0000000
--- a/fixtures/pages-mcp/next-env.d.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-/// <reference types="next" />
-/// <reference types="next/image-types/global" />
-/// <reference path="./.next/types/routes.d.ts" />
-
-// NOTE: This file should not be edited
-// see https://nextjs.org/docs/pages/api-reference/config/typescript for more information.
diff --git a/fixtures/pages-mcp/next.config.mjs b/fixtures/pages-mcp/next.config.mjs
deleted file mode 100644
index 4678774..0000000
--- a/fixtures/pages-mcp/next.config.mjs
+++ /dev/null
@@ -1,4 +0,0 @@
-/** @type {import('next').NextConfig} */
-const nextConfig = {};
-
-export default nextConfig;
diff --git a/fixtures/pages-mcp/package.json b/fixtures/pages-mcp/package.json
deleted file mode 100644
index 1368821..0000000
--- a/fixtures/pages-mcp/package.json
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "name": "@ax-fixtures/pages-mcp",
-  "version": "0.0.0",
-  "private": true,
-  "scripts": {
-    "build": "next build",
-    "postbuild": "ax --report --yes",
-    "dev": "next dev",
-    "start": "next start"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "1.26.0",
-    "mcp-handler": "^1.1.0",
-    "next": "^15.1.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
-    "zod": "^3.24.1"
-  },
-  "devDependencies": {
-    "@types/node": "^20.17.12",
-    "@types/react": "^19.0.7",
-    "@types/react-dom": "^19.0.3",
-    "@ora-ai/ax": "workspace:*",
-    "typescript": "^5.7.3"
-  }
-}
diff --git a/fixtures/pages-mcp/pages/api/[transport].ts b/fixtures/pages-mcp/pages/api/[transport].ts
deleted file mode 100644
index 0d628e0..0000000
--- a/fixtures/pages-mcp/pages/api/[transport].ts
+++ /dev/null
@@ -1,30 +0,0 @@
-import { createMcpHandler } from 'mcp-handler';
-import type { NextApiRequest, NextApiResponse } from 'next';
-import { z } from 'zod';
-
-// An MCP server mounted the Pages Router way: a catch-all API route at `pages/api/[transport].ts`,
-// served at /api/mcp (mcp-handler's documented `[transport]` default). The plugin detects it
-// textually — the `mcp-handler` import plus the `createMcpHandler(` call — exactly as it does for
-// an App Router `route.ts` mount.
-const mcpHandler = createMcpHandler((server) => {
-  server.tool(
-    'roll_dice',
-    'Roll an N-sided die and return the result.',
-    { sides: z.number().int().min(2).describe('Number of sides on the die') },
-    async ({ sides }) => {
-      const value = 1 + Math.floor(Math.random() * sides);
-      return { content: [{ type: 'text', text: `🎲 ${value}` }] };
-    },
-  );
-});
-
-// mcp-handler produces a Web-standard `(Request) => Promise<Response>`; bridge it to the Pages
-// Router's `(req, res)` API-route signature.
-export const config = { api: { bodyParser: false } };
-
-export default async function handler(req: NextApiRequest, res: NextApiResponse): Promise<void> {
-  const url = `https://${req.headers.host ?? 'localhost'}${req.url ?? '/api/mcp'}`;
-  const response = await mcpHandler(new Request(url, { method: req.method }));
-  res.status(response.status);
-  res.send(await response.text());
-}
diff --git a/fixtures/pages-mcp/pages/index.tsx b/fixtures/pages-mcp/pages/index.tsx
deleted file mode 100644
index 8294daa..0000000
--- a/fixtures/pages-mcp/pages/index.tsx
+++ /dev/null
@@ -1,8 +0,0 @@
-export default function Home() {
-  return (
-    <main>
-      <h1>Pages Router MCP fixture</h1>
-      <p>The MCP server lives at /api/mcp (pages/api/[transport].ts).</p>
-    </main>
-  );
-}
diff --git a/fixtures/pages-mcp/report.golden.json b/fixtures/pages-mcp/report.golden.json
deleted file mode 100644
index 837c652..0000000
--- a/fixtures/pages-mcp/report.golden.json
+++ /dev/null
@@ -1,205 +0,0 @@
-{
-  "generatedAt": "<generatedAt>",
-  "siteUrl": "https://pages-mcp-fixture.example.com",
-  "basePath": "",
-  "routers": [
-    "pages"
-  ],
-  "catalog": {
-    "entryCount": 1,
-    "entries": [
-      {
-        "identifier": "urn:air:pages-mcp-fixture.example.com:mcp-server",
-        "type": "application/mcp-server-card+json",
-        "url": "https://pages-mcp-fixture.example.com/.well-known/mcp/server-card.json",
-        "displayName": "MCP server"
-      }
-    ],
-    "path": "public/.well-known/ai-catalog.json",
-    "target": "static"
-  },
-  "mcp": {
-    "mounts": [
-      {
-        "pathname": "/api/mcp",
-        "tools": [
-          "roll_dice"
-        ]
-      }
-    ],
-    "unreviewedMounts": [
-      "/api/mcp"
-    ],
-    "serverCardPath": "public/.well-known/mcp/server-card.json"
-  },
-  "agent404": {
-    "notFoundPresent": false,
-    "agentAware": false,
-    "pages": [],
-    "markdownGuide": "public/404.md"
-  },
-  "middleware": {
-    "present": false,
-    "wiredToAx": false
-  },
-  "artifacts": {
-    "robotsTxt": {
-      "found": false
-    },
-    "sitemap": {
-      "found": false
-    },
-    "agentsMd": {
-      "found": false
-    },
-    "jsonLd": {
-      "found": false
-    },
-    "llmsTxt": {
-      "found": false
-    },
-    "openapi": {
-      "found": false
-    }
-  },
-  "auth": {
-    "gatedSurfaces": []
-  },
-  "scaffolds": {},
-  "markdownTwins": {
-    "enabled": true,
-    "written": [],
-    "userOwned": [],
-    "skipped": [
-      {
-        "route": "/",
-        "reason": "too-little-text",
-        "detail": "The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker)."
-      }
-    ],
-    "dynamicRouteCount": 0,
-    "deleted": []
-  },
-  "sizes": [
-    {
-      "artifact": "ai-catalog.json",
-      "path": "public/.well-known/ai-catalog.json",
-      "bytes": 509,
-      "chars": 509,
-      "tokens": 127
-    },
-    {
-      "artifact": "mcp-server-card",
-      "path": "public/.well-known/mcp/server-card.json",
-      "bytes": 594,
-      "chars": 594,
-      "tokens": 149
-    },
-    {
-      "artifact": "404.md",
-      "path": "public/404.md",
-      "bytes": 810,
-      "chars": 802,
-      "tokens": 201
-    }
-  ],
-  "ora": {
-    "checks": [
-      {
-        "id": "ard-catalog",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "agent-discovery-file",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "llms-txt-exists",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "llms-txt-formatting",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "markdown-url-fallback",
-        "artifact": "markdown-twins",
-        "status": "actionable",
-        "note": "No markdown twin could be derived for the homepage (too-little-text): The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker). The report’s markdownTwins.skipped section lists every twin-less route with its reason."
-      },
-      {
-        "id": "markdown-frontmatter",
-        "artifact": "markdown-twins",
-        "status": "actionable",
-        "note": "No markdown twin could be derived for the homepage (too-little-text): The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker). The report’s markdownTwins.skipped section lists every twin-less route with its reason."
-      },
-      {
-        "id": "robots-ai-policy-quality",
-        "artifact": "robots.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "sitemap",
-        "artifact": "sitemap",
-        "status": "actionable"
-      },
-      {
-        "id": "agent-instruction",
-        "artifact": "agents.md",
-        "status": "actionable"
-      },
-      {
-        "id": "json-ld",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "org-schema-completeness",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "openapi-spec",
-        "artifact": "openapi.json",
-        "status": "actionable"
-      },
-      {
-        "id": "mcp-server",
-        "artifact": "mcp-server",
-        "status": "addressed"
-      },
-      {
-        "id": "mcp-server-card",
-        "artifact": "mcp-server-card",
-        "status": "addressed"
-      },
-      {
-        "id": "markdown-negotiation",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      },
-      {
-        "id": "markdown-negotiation-vary",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      }
-    ]
-  },
-  "warnings": [],
-  "recommendations": [
-    "No OpenAPI doc found (public/openapi.json) — an OpenAPI doc lets agents understand and call your API without guessing at routes or schemas. ax never generates one; produce it however your API is defined (many schema/validation libraries can emit OpenAPI from your existing route definitions) and commit the result to public/openapi.json.",
-    "No llms.txt found — a short natural-language guide agents read to decide whether your site fits their task, and to find your key pages. Add one at app/llms.txt/route.ts (or public/llms.txt), or set scaffoldLlmsTxt: true in ax.config to have a starter written for you. Pair it with JSON-LD structured data (an Organization block with a sameAs array): llms.txt says what your site is for, JSON-LD identifies it as an entity registries can rank — the two reinforce each other, so add both rather than one alone.",
-    "No sitemap found — add one so agents can discover all public routes. Use the built-in Next.js path (app/sitemap.ts); ax never generates a sitemap itself. Give each entry a <lastmod> date (agents use it to judge freshness), then reference it from robots.txt with a \"Sitemap:\" line.",
-    "No robots.txt found — add one (app/robots.ts or public/robots.txt) that explicitly Allows the reputable AI agents you want to reach, scoped to specific User-agent groups (never \"User-agent: *\"), plus a \"Sitemap:\" line. Note: Next's MetadataRoute.Robots (app/robots.ts) has no field for the \"Agentmap:\" catalog pointer — put that line in a static public/robots.txt. Set scaffoldRobots: true in ax.config to have one written for you.",
-    "No agents.md found — consider adding one (public/agents.md) with when-to-use / when-NOT-to-use guidance for agents. ax won't write its content for you; the companion skill can help author it from your repo.",
-    "No JSON-LD structured data found in your layouts/pages — structured data is how registries and agents disambiguate and rank your site. Add an Organization block in your root layout <head> (<script type=\"application/ld+json\">) with a \"sameAs\" array linking your LinkedIn/GitHub/npm/social profiles (the entity-disambiguation signal registries value), and at least one more schema.org @type beyond Organization — SoftwareApplication or Product for an app/API, or a FAQPage — since covering more types helps registries understand your site more fully. JSON-LD pairs with an llms.txt: llms.txt tells agents what your site is for, JSON-LD identifies it as an entity registries can rank — add both, not one alone. ax won’t author the block (the fields are judgment content); the companion skill can help draft it from your repo.",
-    "No pages/404.tsx found — agents that hit a missing URL get Next.js’s bare default 404, a dead end that makes them give up or guess. Add a standard 404 page in your own design system (a clear “page not found” and a way back home), and include `<link rel=\"alternate\" type=\"text/markdown\" href=\"/404.md\" />` so agents can hop from it to /404.md — the generated wayfinding guide (real routes + discovery links) this build writes. Rendered in the page’s JSX, React hoists the tag into <head> (App Router); use next/head in the Pages Router.",
-    "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-  ]
-}
diff --git a/fixtures/pages-mcp/tsconfig.json b/fixtures/pages-mcp/tsconfig.json
deleted file mode 100644
index 9666dbd..0000000
--- a/fixtures/pages-mcp/tsconfig.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "extends": "../tsconfig.next.json",
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules"]
-}
diff --git a/fixtures/pages-mcp/twins.golden/404.md b/fixtures/pages-mcp/twins.golden/404.md
deleted file mode 100644
index 46cced5..0000000
--- a/fixtures/pages-mcp/twins.golden/404.md
+++ /dev/null
@@ -1,22 +0,0 @@
----
-title: "Page not found — pages-mcp"
-description: "Where to continue when a URL on this site does not exist: discovery links and real routes."
-canonical_url: https://pages-mcp-fixture.example.com/404.md
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# Page not found
-
-The URL you requested does not exist on this site. It may have moved, or it may never have existed —
-requesting it again will keep returning this response. Do not retry; start from the links
-below instead.
-
-## Start here
-
-- [/.well-known/ai-catalog.json](/.well-known/ai-catalog.json) — machine-readable catalog of everything this site offers agents
-- [/.well-known/mcp/server-card.json](/.well-known/mcp/server-card.json) — the MCP server card (connection + capabilities)
-
-## Pages that do exist
-
-- [/](/)
diff --git a/fixtures/pages-webmcp-declarative/README.md b/fixtures/pages-webmcp-declarative/README.md
deleted file mode 100644
index 75d2fe6..0000000
--- a/fixtures/pages-webmcp-declarative/README.md
+++ /dev/null
@@ -1,5 +0,0 @@
-# pages-webmcp-declarative
-
-A **Pages Router** app with a declarative WebMCP `<form toolname>` on `pages/index.tsx`. It proves
-declarative WebMCP detection attributes the tool to the right page URL (`/`) via the Pages Router
-file-is-the-route rule, emitting a `text/html` catalog entry just as the App Router variant does.
diff --git a/fixtures/pages-webmcp-declarative/ax.config.ts b/fixtures/pages-webmcp-declarative/ax.config.ts
deleted file mode 100644
index ad53d5f..0000000
--- a/fixtures/pages-webmcp-declarative/ax.config.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import type { AxConfig } from '@ora-ai/ax';
-
-// `siteUrl` makes the fixture deterministic (see the mcp-adapter fixture for the full rationale).
-// This is a Pages Router app: the declarative `<form toolname>` lives on `pages/index.tsx`, whose
-// URL the plugin resolves via the Pages Router file-is-the-route rule (not the App Router `page.tsx`
-// convention), so it emits the same `text/html` catalog entry it would for an App Router page.
-const config: AxConfig = {
-  siteUrl: 'https://pages-webmcp-fixture.example.com',
-};
-
-export default config;
diff --git a/fixtures/pages-webmcp-declarative/next-env.d.ts b/fixtures/pages-webmcp-declarative/next-env.d.ts
deleted file mode 100644
index 254b73c..0000000
--- a/fixtures/pages-webmcp-declarative/next-env.d.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-/// <reference types="next" />
-/// <reference types="next/image-types/global" />
-/// <reference path="./.next/types/routes.d.ts" />
-
-// NOTE: This file should not be edited
-// see https://nextjs.org/docs/pages/api-reference/config/typescript for more information.
diff --git a/fixtures/pages-webmcp-declarative/next.config.mjs b/fixtures/pages-webmcp-declarative/next.config.mjs
deleted file mode 100644
index 4678774..0000000
--- a/fixtures/pages-webmcp-declarative/next.config.mjs
+++ /dev/null
@@ -1,4 +0,0 @@
-/** @type {import('next').NextConfig} */
-const nextConfig = {};
-
-export default nextConfig;
diff --git a/fixtures/pages-webmcp-declarative/package.json b/fixtures/pages-webmcp-declarative/package.json
deleted file mode 100644
index 02eda85..0000000
--- a/fixtures/pages-webmcp-declarative/package.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "name": "@ax-fixtures/pages-webmcp-declarative",
-  "version": "0.0.0",
-  "private": true,
-  "scripts": {
-    "build": "next build",
-    "postbuild": "ax --report --yes",
-    "dev": "next dev",
-    "start": "next start"
-  },
-  "dependencies": {
-    "next": "^15.1.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0"
-  },
-  "devDependencies": {
-    "@types/node": "^20.17.12",
-    "@types/react": "^19.0.7",
-    "@types/react-dom": "^19.0.3",
-    "@ora-ai/ax": "workspace:*",
-    "typescript": "^5.7.3"
-  }
-}
diff --git a/fixtures/pages-webmcp-declarative/pages/index.tsx b/fixtures/pages-webmcp-declarative/pages/index.tsx
deleted file mode 100644
index e830503..0000000
--- a/fixtures/pages-webmcp-declarative/pages/index.tsx
+++ /dev/null
@@ -1,21 +0,0 @@
-export default function Home() {
-  return (
-    <main>
-      <h1>WebMCP declarative fixture (Pages Router)</h1>
-      {/* Declarative WebMCP: the tool is described by the form's `toolname` attribute, read straight
-          off the JSX. The page URL (`/`) is resolved from the Pages Router file path. */}
-      <form
-        toolname="subscribe_newsletter"
-        tooldescription="Subscribe an email address to the newsletter."
-        action="/api/subscribe"
-        method="post"
-      >
-        <label>
-          Email
-          <input name="email" type="email" required />
-        </label>
-        <button type="submit">Subscribe</button>
-      </form>
-    </main>
-  );
-}
diff --git a/fixtures/pages-webmcp-declarative/report.golden.json b/fixtures/pages-webmcp-declarative/report.golden.json
deleted file mode 100644
index 744f7f7..0000000
--- a/fixtures/pages-webmcp-declarative/report.golden.json
+++ /dev/null
@@ -1,183 +0,0 @@
-{
-  "generatedAt": "<generatedAt>",
-  "siteUrl": "https://pages-webmcp-fixture.example.com",
-  "basePath": "",
-  "routers": [
-    "pages"
-  ],
-  "catalog": {
-    "entryCount": 1,
-    "entries": [
-      {
-        "identifier": "urn:air:pages-webmcp-fixture.example.com:webmcp",
-        "type": "text/html",
-        "url": "https://pages-webmcp-fixture.example.com/",
-        "displayName": "WebMCP tools (/)"
-      }
-    ],
-    "path": "public/.well-known/ai-catalog.json",
-    "target": "static"
-  },
-  "mcp": {
-    "mounts": [],
-    "unreviewedMounts": []
-  },
-  "agent404": {
-    "notFoundPresent": false,
-    "agentAware": false,
-    "pages": [],
-    "markdownGuide": "public/404.md"
-  },
-  "middleware": {
-    "present": false,
-    "wiredToAx": false
-  },
-  "artifacts": {
-    "robotsTxt": {
-      "found": false
-    },
-    "sitemap": {
-      "found": false
-    },
-    "agentsMd": {
-      "found": false
-    },
-    "jsonLd": {
-      "found": false
-    },
-    "llmsTxt": {
-      "found": false
-    },
-    "openapi": {
-      "found": false
-    }
-  },
-  "auth": {
-    "gatedSurfaces": []
-  },
-  "scaffolds": {},
-  "markdownTwins": {
-    "enabled": true,
-    "written": [],
-    "userOwned": [],
-    "skipped": [
-      {
-        "route": "/",
-        "reason": "too-little-text",
-        "detail": "The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker)."
-      }
-    ],
-    "dynamicRouteCount": 0,
-    "deleted": []
-  },
-  "sizes": [
-    {
-      "artifact": "ai-catalog.json",
-      "path": "public/.well-known/ai-catalog.json",
-      "bytes": 656,
-      "chars": 654,
-      "tokens": 164
-    },
-    {
-      "artifact": "404.md",
-      "path": "public/404.md",
-      "bytes": 703,
-      "chars": 697,
-      "tokens": 174
-    }
-  ],
-  "ora": {
-    "checks": [
-      {
-        "id": "ard-catalog",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "agent-discovery-file",
-        "artifact": "ai-catalog.json",
-        "status": "addressed"
-      },
-      {
-        "id": "llms-txt-exists",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "llms-txt-formatting",
-        "artifact": "llms.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "markdown-url-fallback",
-        "artifact": "markdown-twins",
-        "status": "actionable",
-        "note": "No markdown twin could be derived for the homepage (too-little-text): The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker). The report’s markdownTwins.skipped section lists every twin-less route with its reason."
-      },
-      {
-        "id": "markdown-frontmatter",
-        "artifact": "markdown-twins",
-        "status": "actionable",
-        "note": "No markdown twin could be derived for the homepage (too-little-text): The prerendered HTML carries under 200 characters of text — a JS-shell page, whose twin would be an empty page presented as content. If this page renders client-side, keep page.tsx a server component that exports its own `metadata` (title + description) and renders your client component — ax then derives a minimal metadata twin, with no pre-hydration placeholder DOM (which would flicker). The report’s markdownTwins.skipped section lists every twin-less route with its reason."
-      },
-      {
-        "id": "robots-ai-policy-quality",
-        "artifact": "robots.txt",
-        "status": "actionable"
-      },
-      {
-        "id": "sitemap",
-        "artifact": "sitemap",
-        "status": "actionable"
-      },
-      {
-        "id": "agent-instruction",
-        "artifact": "agents.md",
-        "status": "actionable"
-      },
-      {
-        "id": "json-ld",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "org-schema-completeness",
-        "artifact": "json-ld",
-        "status": "actionable"
-      },
-      {
-        "id": "openapi-spec",
-        "artifact": "openapi.json",
-        "status": "actionable"
-      },
-      {
-        "id": "mcp-server",
-        "artifact": "mcp-server",
-        "status": "actionable"
-      },
-      {
-        "id": "markdown-negotiation",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      },
-      {
-        "id": "markdown-negotiation-vary",
-        "artifact": "middleware",
-        "status": "actionable",
-        "note": "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-      }
-    ]
-  },
-  "warnings": [],
-  "recommendations": [
-    "No OpenAPI doc found (public/openapi.json) — an OpenAPI doc lets agents understand and call your API without guessing at routes or schemas. ax never generates one; produce it however your API is defined (many schema/validation libraries can emit OpenAPI from your existing route definitions) and commit the result to public/openapi.json.",
-    "No llms.txt found — a short natural-language guide agents read to decide whether your site fits their task, and to find your key pages. Add one at app/llms.txt/route.ts (or public/llms.txt), or set scaffoldLlmsTxt: true in ax.config to have a starter written for you. Pair it with JSON-LD structured data (an Organization block with a sameAs array): llms.txt says what your site is for, JSON-LD identifies it as an entity registries can rank — the two reinforce each other, so add both rather than one alone.",
-    "No sitemap found — add one so agents can discover all public routes. Use the built-in Next.js path (app/sitemap.ts); ax never generates a sitemap itself. Give each entry a <lastmod> date (agents use it to judge freshness), then reference it from robots.txt with a \"Sitemap:\" line.",
-    "No robots.txt found — add one (app/robots.ts or public/robots.txt) that explicitly Allows the reputable AI agents you want to reach, scoped to specific User-agent groups (never \"User-agent: *\"), plus a \"Sitemap:\" line. Note: Next's MetadataRoute.Robots (app/robots.ts) has no field for the \"Agentmap:\" catalog pointer — put that line in a static public/robots.txt. Set scaffoldRobots: true in ax.config to have one written for you.",
-    "No agents.md found — consider adding one (public/agents.md) with when-to-use / when-NOT-to-use guidance for agents. ax won't write its content for you; the companion skill can help author it from your repo.",
-    "No JSON-LD structured data found in your layouts/pages — structured data is how registries and agents disambiguate and rank your site. Add an Organization block in your root layout <head> (<script type=\"application/ld+json\">) with a \"sameAs\" array linking your LinkedIn/GitHub/npm/social profiles (the entity-disambiguation signal registries value), and at least one more schema.org @type beyond Organization — SoftwareApplication or Product for an app/API, or a FAQPage — since covering more types helps registries understand your site more fully. JSON-LD pairs with an llms.txt: llms.txt tells agents what your site is for, JSON-LD identifies it as an entity registries can rank — add both, not one alone. ax won’t author the block (the fields are judgment content); the companion skill can help draft it from your repo.",
-    "No pages/404.tsx found — agents that hit a missing URL get Next.js’s bare default 404, a dead end that makes them give up or guess. Add a standard 404 page in your own design system (a clear “page not found” and a way back home), and include `<link rel=\"alternate\" type=\"text/markdown\" href=\"/404.md\" />` so agents can hop from it to /404.md — the generated wayfinding guide (real routes + discovery links) this build writes. Rendered in the page’s JSX, React hoists the tag into <head> (App Router); use next/head in the Pages Router.",
-    "Serve agents the generated markdown automatically: First run `npx ax manifest` (and wire it as the \"prebuild\" script so it stays fresh — `middleware.ts` is compiled during `next build`, so the manifest must exist before the build starts). Then: add `import { withAx } from '@ora-ai/ax/middleware';` and `import { axManifest } from './ax-manifest';`, create middleware.ts with `export default withAx({ manifest: axManifest });`, and export the matcher literal `export const config = { matcher: ['/((?!_next|api|.*\\\\..*|favicon|robots|health|status).*)'] };`. The middleware rewrites a request to its markdown twin only when the manifest lists one, never touches gated paths, and answers unknown URLs from detected agents with a 200 markdown wayfinding body — it composes with (never replaces) your existing middleware, and keeps your own gating (UA filters, bot walls) from ever blocking the published discovery artifacts."
-  ]
-}
diff --git a/fixtures/pages-webmcp-declarative/tsconfig.json b/fixtures/pages-webmcp-declarative/tsconfig.json
deleted file mode 100644
index 9666dbd..0000000
--- a/fixtures/pages-webmcp-declarative/tsconfig.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "extends": "../tsconfig.next.json",
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules"]
-}
diff --git a/fixtures/pages-webmcp-declarative/twins.golden/404.md b/fixtures/pages-webmcp-declarative/twins.golden/404.md
deleted file mode 100644
index 03ddb13..0000000
--- a/fixtures/pages-webmcp-declarative/twins.golden/404.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-title: "Page not found — pages-webmcp-declarative"
-description: "Where to continue when a URL on this site does not exist: discovery links and real routes."
-canonical_url: https://pages-webmcp-fixture.example.com/404.md
-last_updated: <last_updated>
-generated-by: "@ora-ai/ax"
----
-
-# Page not found
-
-The URL you requested does not exist on this site. It may have moved, or it may never have existed —
-requesting it again will keep returning this response. Do not retry; start from the links
-below instead.
-
-## Start here
-
-- [/.well-known/ai-catalog.json](/.well-known/ai-catalog.json) — machine-readable catalog of everything this site offers agents
-
-## Pages that do exist
-
-- [/](/)
diff --git a/fixtures/webmcp-declarative/README.md b/fixtures/webmcp-declarative/README.md
deleted file mode 100644
index d43a3ae..0000000
--- a/fixtures/webmcp-declarative/README.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# fixture: webmcp-declarative
-
-Declares an in-page WebMCP tool with JSX `<form toolname="..." tooldescription="...">`.
-
-**Exercises:** the Phase 4 declarative detector — the near-trivial, high-confidence case. The tool is
-read straight off the JSX attributes. `types/webmcp-forms.d.ts` augments React's `FormHTMLAttributes`
-so the custom attributes type-check.
diff --git a/fixtures/webmcp-declarative/app/layout.tsx b/fixtures/webmcp-declarative/app/layout.tsx
deleted file mode 100644
index c6e3f39..0000000
--- a/fixtures/webmcp-declarative/app/layout.tsx
+++ /dev/null
@@ -1,14 +0,0 @@
-import type { ReactNode } from 'react';
-
-export const metadata = {
-  title: 'WebMCP Declarative Fixture',
-  description: 'Declares an in-page WebMCP tool with JSX <form toolname="...">.',
-};
-
-export default function RootLayout({ children }: { children: ReactNode }) {
-  return (
-    <html lang="en">
-      <body>{children}</body>
-    </html>
-  );
-}
diff --git a/fixtures/webmcp-declarative/app/page.tsx b/fixtures/webmcp-declarative/app/page.tsx
deleted file mode 100644
index 6de4660..0000000
--- a/fixtures/webmcp-declarative/app/page.tsx
+++ /dev/null
@@ -1,21 +0,0 @@
-export default function Home() {
-  return (
-    <main>
-      <h1>WebMCP declarative fixture</h1>
-      {/* Declarative WebMCP: the tool is described by the form's `toolname` attribute. The Phase 4
-          declarative detector reads this straight off the JSX — high-confidence, near-trivial. */}
-      <form
-        toolname="subscribe_newsletter"
-        tooldescription="Subscribe an email address to the newsletter."
-        action="/api/subscribe"
-        method="post"
-      >
-        <label>
-          Email
-          <input name="email" type="email" required />
-        </label>
-        <button type="submit">Subscribe</button>
-      </form>
-    </main>
-  );
-}
diff --git a/fixtures/webmcp-declarative/next-env.d.ts b/fixtures/webmcp-declarative/next-env.d.ts
deleted file mode 100644
index 830fb59..0000000
--- a/fixtures/webmcp-declarative/next-env.d.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-/// <reference types="next" />
-/// <reference types="next/image-types/global" />
-/// <reference path="./.next/types/routes.d.ts" />
-
-// NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
diff --git a/fixtures/webmcp-declarative/next.config.mjs b/fixtures/webmcp-declarative/next.config.mjs
deleted file mode 100644
index 4678774..0000000
--- a/fixtures/webmcp-declarative/next.config.mjs
+++ /dev/null
@@ -1,4 +0,0 @@
-/** @type {import('next').NextConfig} */
-const nextConfig = {};
-
-export default nextConfig;
diff --git a/fixtures/webmcp-declarative/package.json b/fixtures/webmcp-declarative/package.json
deleted file mode 100644
index 3122641..0000000
--- a/fixtures/webmcp-declarative/package.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "name": "@ax-fixtures/webmcp-declarative",
-  "version": "0.0.0",
-  "private": true,
-  "scripts": {
-    "build": "next build",
-    "postbuild": "ax --report --yes",
-    "dev": "next dev",
-    "start": "next start"
-  },
-  "dependencies": {
-    "next": "^15.1.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0"
-  },
-  "devDependencies": {
-    "@types/node": "^20.17.12",
-    "@types/react": "^19.0.7",
-    "@types/react-dom": "^19.0.3",
-    "@ora-ai/ax": "workspace:*",
-    "typescript": "^5.7.3"
-  }
-}
diff --git a/fixtures/webmcp-declarative/tsconfig.json b/fixtures/webmcp-declarative/tsconfig.json
deleted file mode 100644
index 9666dbd..0000000
--- a/fixtures/webmcp-declarative/tsconfig.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "extends": "../tsconfig.next.json",
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules"]
-}
diff --git a/fixtures/webmcp-imperative/README.md b/fixtures/webmcp-imperative/README.md
deleted file mode 100644
index 8608a39..0000000
--- a/fixtures/webmcp-imperative/README.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# fixture: webmcp-imperative
-
-A client component that registers an in-page tool via `navigator.modelContext.registerTool(...)`.
-
-**Exercises:** the Phase 4 imperative WebMCP detector — finding the `registerTool` call expression in
-a `'use client'` module. `types/webmcp.d.ts` supplies just enough ambient typing for the draft API to
-compile; detection keys on the call, not the types.
diff --git a/fixtures/webmcp-imperative/app/layout.tsx b/fixtures/webmcp-imperative/app/layout.tsx
deleted file mode 100644
index bab585e..0000000
--- a/fixtures/webmcp-imperative/app/layout.tsx
+++ /dev/null
@@ -1,14 +0,0 @@
-import type { ReactNode } from 'react';
-
-export const metadata = {
-  title: 'WebMCP Imperative Fixture',
-  description: 'Registers an in-page WebMCP tool via navigator.modelContext.registerTool().',
-};
-
-export default function RootLayout({ children }: { children: ReactNode }) {
-  return (
-    <html lang="en">
-      <body>{children}</body>
-    </html>
-  );
-}
diff --git a/fixtures/webmcp-imperative/app/page.tsx b/fixtures/webmcp-imperative/app/page.tsx
deleted file mode 100644
index 82c8277..0000000
--- a/fixtures/webmcp-imperative/app/page.tsx
+++ /dev/null
@@ -1,11 +0,0 @@
-import { RegisterTools } from './register-tools';
-
-export default function Home() {
-  return (
-    <main>
-      <h1>WebMCP imperative fixture</h1>
-      <p>Registers an in-page tool via navigator.modelContext.registerTool().</p>
-      <RegisterTools />
-    </main>
-  );
-}
diff --git a/fixtures/webmcp-imperative/next-env.d.ts b/fixtures/webmcp-imperative/next-env.d.ts
deleted file mode 100644
index 830fb59..0000000
--- a/fixtures/webmcp-imperative/next-env.d.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-/// <reference types="next" />
-/// <reference types="next/image-types/global" />
-/// <reference path="./.next/types/routes.d.ts" />
-
-// NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
diff --git a/fixtures/webmcp-imperative/next.config.mjs b/fixtures/webmcp-imperative/next.config.mjs
deleted file mode 100644
index 4678774..0000000
--- a/fixtures/webmcp-imperative/next.config.mjs
+++ /dev/null
@@ -1,4 +0,0 @@
-/** @type {import('next').NextConfig} */
-const nextConfig = {};
-
-export default nextConfig;
diff --git a/fixtures/webmcp-imperative/package.json b/fixtures/webmcp-imperative/package.json
deleted file mode 100644
index 70b421a..0000000
--- a/fixtures/webmcp-imperative/package.json
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-  "name": "@ax-fixtures/webmcp-imperative",
-  "version": "0.0.0",
-  "private": true,
-  "scripts": {
-    "build": "next build",
-    "dev": "next dev",
-    "start": "next start"
-  },
-  "dependencies": {
-    "next": "^15.1.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0"
-  },
-  "devDependencies": {
-    "@types/node": "^20.17.12",
-    "@types/react": "^19.0.7",
-    "@types/react-dom": "^19.0.3",
-    "typescript": "^5.7.3"
-  }
-}
diff --git a/fixtures/webmcp-imperative/tsconfig.json b/fixtures/webmcp-imperative/tsconfig.json
deleted file mode 100644
index 9666dbd..0000000
--- a/fixtures/webmcp-imperative/tsconfig.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "extends": "../tsconfig.next.json",
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules"]
-}
diff --git a/fixtures/webmcp/README.md b/fixtures/webmcp/README.md
new file mode 100644
index 0000000..86ee650
--- /dev/null
+++ b/fixtures/webmcp/README.md
@@ -0,0 +1,18 @@
+# fixture: webmcp
+
+Both WebMCP registration shapes on one page — the merge of the old `webmcp-declarative` and
+`webmcp-imperative` fixtures (the adversarial patterns that must NOT detect live in `edge-cases`).
+
+- **Declarative** — the `<form toolname="subscribe_newsletter">` on `/`: read straight off the
+  JSX, high-confidence, and the only WebMCP shape that yields a catalog entry (the page URL is the
+  tool surface).
+- **Imperative** — `document.modelContext.registerTool({ name: 'add_to_cart', ... })` in a
+  `'use client'` component on the same page: detected as a tool name, surfaced in the report with
+  the "invisible in server-rendered HTML" recommendation, but never invented into an entry.
+
+Having both on the same route also pins their interaction: the `/` entry's capabilities list the
+declarative tool only, while `report.webMcpToolNames` carries both.
+
+**Exercises:** declarative form detection and page-URL entry emission, imperative call detection in
+client modules, the recommendation-not-entry rule for imperative tools, and the two shapes
+coexisting on one route.
diff --git a/fixtures/webmcp/app/layout.tsx b/fixtures/webmcp/app/layout.tsx
new file mode 100644
index 0000000..3c4a954
--- /dev/null
+++ b/fixtures/webmcp/app/layout.tsx
@@ -0,0 +1,18 @@
+import type { ReactNode } from 'react';
+
+// The metadata description mentions the API by name on purpose: a string that *talks about*
+// registerTool() must never be detected as a registration (the false-positive regression the old
+// webmcp-imperative fixture pinned).
+export const metadata = {
+  title: 'WebMCP Fixture',
+  description:
+    'Registers an in-page WebMCP tool via navigator.modelContext.registerTool(), next to a declarative <form toolname>.',
+};
+
+export default function RootLayout({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  );
+}
diff --git a/fixtures/webmcp/app/page.tsx b/fixtures/webmcp/app/page.tsx
new file mode 100644
index 0000000..8930370
--- /dev/null
+++ b/fixtures/webmcp/app/page.tsx
@@ -0,0 +1,29 @@
+import { RegisterTools } from './register-tools';
+
+export default function Home() {
+  return (
+    <main>
+      <h1>WebMCP fixture</h1>
+      {/* Visible prose naming the API — must never be detected as a registration. */}
+      <p>Registers an in-page tool via navigator.modelContext.registerTool().</p>
+      {/* Declarative WebMCP: the tool is described by the form's `toolname` attribute, read
+          straight off the JSX — high-confidence, and the only WebMCP shape that yields a catalog
+          entry (the page URL is the tool surface). */}
+      <form
+        toolname="subscribe_newsletter"
+        tooldescription="Subscribe an email address to the newsletter."
+        action="/api/subscribe"
+        method="post"
+      >
+        <label>
+          Email
+          <input name="email" type="email" required />
+        </label>
+        <button type="submit">Subscribe</button>
+      </form>
+      {/* Imperative WebMCP on the same page: detected as a tool name, but never invented into an
+          entry — a registerTool() call is invisible in server-rendered HTML. */}
+      <RegisterTools />
+    </main>
+  );
+}
diff --git a/fixtures/webmcp-imperative/app/register-tools.tsx b/fixtures/webmcp/app/register-tools.tsx
similarity index 100%
rename from fixtures/webmcp-imperative/app/register-tools.tsx
rename to fixtures/webmcp/app/register-tools.tsx
diff --git a/fixtures/webmcp-declarative/ax.config.ts b/fixtures/webmcp/ax.config.ts
similarity index 84%
rename from fixtures/webmcp-declarative/ax.config.ts
rename to fixtures/webmcp/ax.config.ts
index d07fd4e..dd88cb3 100644
--- a/fixtures/webmcp-declarative/ax.config.ts
+++ b/fixtures/webmcp/ax.config.ts
@@ -4,7 +4,7 @@ import type { AxConfig } from '@ora-ai/ax';
 // fixture for the full rationale) — without it, declarative WebMCP detection would still run but
 // skip emitting the URL-bearing page entry.
 const config: AxConfig = {
-  siteUrl: 'https://webmcp-declarative-fixture.example.com',
+  siteUrl: 'https://webmcp-fixture.example.com',
 };
 
 export default config;
diff --git a/fixtures/llms-txt/next-env.d.ts b/fixtures/webmcp/next-env.d.ts
similarity index 100%
rename from fixtures/llms-txt/next-env.d.ts
rename to fixtures/webmcp/next-env.d.ts
diff --git a/fixtures/llms-txt/next.config.mjs b/fixtures/webmcp/next.config.mjs
similarity index 100%
rename from fixtures/llms-txt/next.config.mjs
rename to fixtures/webmcp/next.config.mjs
diff --git a/fixtures/openapi/package.json b/fixtures/webmcp/package.json
similarity index 93%
rename from fixtures/openapi/package.json
rename to fixtures/webmcp/package.json
index 118b913..170dd31 100644
--- a/fixtures/openapi/package.json
+++ b/fixtures/webmcp/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "@ax-fixtures/openapi",
+  "name": "@ax-fixtures/webmcp",
   "version": "0.0.0",
   "private": true,
   "scripts": {
diff --git a/fixtures/mcp-adapter/report.golden.json b/fixtures/webmcp/report.golden.json
similarity index 91%
rename from fixtures/mcp-adapter/report.golden.json
rename to fixtures/webmcp/report.golden.json
index cbb4672..3ce7c53 100644
--- a/fixtures/mcp-adapter/report.golden.json
+++ b/fixtures/webmcp/report.golden.json
@@ -1,6 +1,6 @@
 {
   "generatedAt": "<generatedAt>",
-  "siteUrl": "https://mcp-adapter-fixture.example.com",
+  "siteUrl": "https://webmcp-fixture.example.com",
   "basePath": "",
   "routers": [
     "app"
@@ -9,28 +9,18 @@
     "entryCount": 1,
     "entries": [
       {
-        "identifier": "urn:air:mcp-adapter-fixture.example.com:mcp-server",
-        "type": "application/mcp-server-card+json",
-        "url": "https://mcp-adapter-fixture.example.com/.well-known/mcp/server-card.json",
-        "displayName": "MCP server"
+        "identifier": "urn:air:webmcp-fixture.example.com:webmcp",
+        "type": "text/html",
+        "url": "https://webmcp-fixture.example.com/",
+        "displayName": "WebMCP tools (/)"
       }
     ],
     "path": "public/.well-known/ai-catalog.json",
     "target": "static"
   },
   "mcp": {
-    "mounts": [
-      {
-        "pathname": "/mcp",
-        "tools": [
-          "roll_dice"
-        ]
-      }
-    ],
-    "unreviewedMounts": [
-      "/mcp"
-    ],
-    "serverCardPath": "public/.well-known/mcp/server-card.json"
+    "mounts": [],
+    "unreviewedMounts": []
   },
   "agent404": {
     "notFoundPresent": false,
@@ -84,23 +74,16 @@
     {
       "artifact": "ai-catalog.json",
       "path": "public/.well-known/ai-catalog.json",
-      "bytes": 517,
-      "chars": 517,
-      "tokens": 129
-    },
-    {
-      "artifact": "mcp-server-card",
-      "path": "public/.well-known/mcp/server-card.json",
-      "bytes": 596,
-      "chars": 596,
-      "tokens": 149
+      "bytes": 620,
+      "chars": 618,
+      "tokens": 155
     },
     {
       "artifact": "404.md",
       "path": "public/404.md",
-      "bytes": 814,
-      "chars": 806,
-      "tokens": 202
+      "bytes": 679,
+      "chars": 673,
+      "tokens": 168
     }
   ],
   "ora": {
@@ -170,12 +153,7 @@
       {
         "id": "mcp-server",
         "artifact": "mcp-server",
-        "status": "addressed"
-      },
-      {
-        "id": "mcp-server-card",
-        "artifact": "mcp-server-card",
-        "status": "addressed"
+        "status": "actionable"
       },
       {
         "id": "markdown-negotiation",
@@ -195,6 +173,7 @@
   "recommendations": [
     "No OpenAPI doc found (public/openapi.json) — an OpenAPI doc lets agents understand and call your API without guessing at routes or schemas. ax never generates one; produce it however your API is defined (many schema/validation libraries can emit OpenAPI from your existing route definitions) and commit the result to public/openapi.json.",
     "No llms.txt found — a short natural-language guide agents read to decide whether your site fits their task, and to find your key pages. Add one at app/llms.txt/route.ts (or public/llms.txt), or set scaffoldLlmsTxt: true in ax.config to have a starter written for you. Pair it with JSON-LD structured data (an Organization block with a sameAs array): llms.txt says what your site is for, JSON-LD identifies it as an entity registries can rank — the two reinforce each other, so add both rather than one alone.",
+    "1 in-page WebMCP tool registered imperatively (add_to_cart) — imperative registrations run only in the browser, so they are invisible in server-rendered HTML and to HTML-reading scanners (including Ora’s webmcp check). Where a tool wraps a form submission, mirror it declaratively with <form toolname=\"...\" tooldescription=\"...\"> so it is detectable in markup too.",
     "No sitemap found — add one so agents can discover all public routes. Use the built-in Next.js path (app/sitemap.ts); ax never generates a sitemap itself. Give each entry a <lastmod> date (agents use it to judge freshness), then reference it from robots.txt with a \"Sitemap:\" line.",
     "No robots.txt found — add one (app/robots.ts or public/robots.txt) that explicitly Allows the reputable AI agents you want to reach, scoped to specific User-agent groups (never \"User-agent: *\"), plus a \"Sitemap:\" line. Note: Next's MetadataRoute.Robots (app/robots.ts) has no field for the \"Agentmap:\" catalog pointer — put that line in a static public/robots.txt. Set scaffoldRobots: true in ax.config to have one written for you.",
     "No agents.md found — consider adding one (public/agents.md) with when-to-use / when-NOT-to-use guidance for agents. ax won't write its content for you; the companion skill can help author it from your repo.",
diff --git a/fixtures/discovery/tsconfig.json b/fixtures/webmcp/tsconfig.json
similarity index 100%
rename from fixtures/discovery/tsconfig.json
rename to fixtures/webmcp/tsconfig.json
diff --git a/fixtures/config-overrides/twins.golden/404.md b/fixtures/webmcp/twins.golden/404.md
similarity index 86%
rename from fixtures/config-overrides/twins.golden/404.md
rename to fixtures/webmcp/twins.golden/404.md
index ee36ac3..46e4da0 100644
--- a/fixtures/config-overrides/twins.golden/404.md
+++ b/fixtures/webmcp/twins.golden/404.md
@@ -1,7 +1,7 @@
 ---
-title: "Page not found — config-overrides"
+title: "Page not found — webmcp"
 description: "Where to continue when a URL on this site does not exist: discovery links and real routes."
-canonical_url: /404.md
+canonical_url: https://webmcp-fixture.example.com/404.md
 last_updated: <last_updated>
 generated-by: "@ora-ai/ax"
 ---
diff --git a/fixtures/webmcp-declarative/types/webmcp-forms.d.ts b/fixtures/webmcp/types/webmcp-forms.d.ts
similarity index 100%
rename from fixtures/webmcp-declarative/types/webmcp-forms.d.ts
rename to fixtures/webmcp/types/webmcp-forms.d.ts
diff --git a/fixtures/webmcp-imperative/types/webmcp.d.ts b/fixtures/webmcp/types/webmcp.d.ts
similarity index 100%
rename from fixtures/webmcp-imperative/types/webmcp.d.ts
rename to fixtures/webmcp/types/webmcp.d.ts
diff --git a/package.json b/package.json
index 071bcef..0a0b072 100644
--- a/package.json
+++ b/package.json
@@ -17,6 +17,7 @@
     "fixtures:build": "pnpm --filter \"@ax-fixtures/*\" run build",
     "reports:verify": "node scripts/verify-report-snapshots.mjs",
     "dogfood:middleware": "node scripts/dogfood-middleware.mjs",
+    "mutation:test": "node scripts/mutation-tests.mjs",
     "reports:regen": "pnpm fixtures:clean && pnpm fixtures:build && node scripts/verify-report-snapshots.mjs --update",
     "conformance": "bash scripts/conformance.sh",
     "changeset": "changeset",
diff --git a/packages/ax/src/app-dir.ts b/packages/ax/src/app-dir.ts
index bd4632c..2e6f1ac 100644
--- a/packages/ax/src/app-dir.ts
+++ b/packages/ax/src/app-dir.ts
@@ -16,8 +16,20 @@ export function findAppDir(cwd: string): string | undefined {
   return undefined;
 }
 
+/** Extensions the App Router always recognizes as a page. */
+const BASE_PAGE_EXTENSIONS = ['tsx', 'jsx', 'js'] as const;
+
+/**
+ * Extra page extensions the caller *knows* Next.js serves — whether `page.mdx` / `page.md` routes
+ * at all depends on `next.config` `pageExtensions`, so the router model threads the configured
+ * ones here and the default stays conservative (never over-claim a route Next may not serve).
+ */
+export type ExtraPageExtensions = readonly string[];
+
 /** File names the App Router recognizes as a page, across the extensions that can render one. */
-const PAGE_FILE_RE = /^page\.(?:tsx|jsx|js)$/;
+function pageFileRe(extraExtensions: ExtraPageExtensions): RegExp {
+  return new RegExp(`^page\\.(?:${[...BASE_PAGE_EXTENSIONS, ...extraExtensions].join('|')})$`);
+}
 
 /**
  * The URL path an App Router page file is served at, or undefined when it isn't a statically
@@ -28,11 +40,12 @@ const PAGE_FILE_RE = /^page\.(?:tsx|jsx|js)$/;
 export function resolvePagePathname(
   absolutePath: string,
   appDir: string | undefined,
+  extraExtensions: ExtraPageExtensions = [],
 ): string | undefined {
   if (!appDir || !absolutePath.startsWith(appDir)) return undefined;
   const rel = relative(appDir, absolutePath);
   const base = rel.split(/[/\\]/).pop() ?? '';
-  if (!PAGE_FILE_RE.test(base)) return undefined;
+  if (!pageFileRe(extraExtensions).test(base)) return undefined;
   return resolveStaticSegments(rel);
 }
 
@@ -62,10 +75,9 @@ export interface MdxPageFile {
 
 /**
  * Every `page.mdx` / `page.md` under the app dir whose route is statically addressable, sorted by
- * route. Deliberately separate from {@link listStaticPageRoutes}: whether an MDX page actually
- * routes depends on `next.config` `pageExtensions` (which the synchronous router model never
- * loads), so callers that know the configured extensions — markdown-twin derivation — filter on
- * them, and the general route list never over-claims a route that Next.js may not serve.
+ * route. Deliberately separate from {@link listStaticPageRoutes}: markdown-twin derivation wants
+ * the *files* (their markdown is the twin source) regardless of what the route list reports, and
+ * it applies its own `pageExtensions` filter before trusting that a file routes.
  */
 export function listMdxPageFiles(appDir: string): MdxPageFile[] {
   const pages: MdxPageFile[] = [];
@@ -83,10 +95,14 @@ export function listMdxPageFiles(appDir: string): MdxPageFile[] {
  * route table at runtime, but the source tree does. Dynamic/parallel/intercepted routes are
  * deliberately absent (their concrete URLs aren't statically knowable).
  */
-export function listStaticPageRoutes(appDir: string): string[] {
+export function listStaticPageRoutes(
+  appDir: string,
+  extraExtensions: ExtraPageExtensions = [],
+): string[] {
+  const matcher = pageFileRe(extraExtensions);
   const routes = new Set<string>();
-  for (const file of walkFiles(appDir, (name) => PAGE_FILE_RE.test(name))) {
-    const pathname = resolvePagePathname(file.absolutePath, appDir);
+  for (const file of walkFiles(appDir, (name) => matcher.test(name))) {
+    const pathname = resolvePagePathname(file.absolutePath, appDir, extraExtensions);
     if (pathname !== undefined) routes.add(pathname);
   }
   return [...routes].sort();
@@ -100,9 +116,13 @@ export function listStaticPageRoutes(appDir: string): string[] {
  * be a real page, so "not found" must never be claimed there. Parallel/intercepting/private
  * segments still contribute nothing — they aren't URL-addressable at a knowable prefix.
  */
-export function listDynamicRoutePrefixes(appDir: string): string[] {
+export function listDynamicRoutePrefixes(
+  appDir: string,
+  extraExtensions: ExtraPageExtensions = [],
+): string[] {
+  const matcher = pageFileRe(extraExtensions);
   const prefixes = new Set<string>();
-  for (const file of walkFiles(appDir, (name) => PAGE_FILE_RE.test(name))) {
+  for (const file of walkFiles(appDir, (name) => matcher.test(name))) {
     const rel = relative(appDir, file.absolutePath);
     const prefix = dynamicRoutePrefix(pathSegments(join(rel, '..')));
     if (prefix !== undefined) prefixes.add(prefix);
diff --git a/packages/ax/src/cli.ts b/packages/ax/src/cli.ts
index c27958e..24e6d36 100644
--- a/packages/ax/src/cli.ts
+++ b/packages/ax/src/cli.ts
@@ -874,11 +874,8 @@ function reportMarkdownTwinOutcome(
   if (notFoundMdResult.deleted !== undefined) {
     stdout(`[ax] ✓ removed ${notFoundMdResult.deleted} (no router to describe misses for)`);
   }
-  if (twinResult.deleted.length > 0) {
-    stdout(
-      `[ax] ✓ removed ${twinResult.deleted.length} stale markdown twin` +
-        `${twinResult.deleted.length === 1 ? '' : 's'}`,
-    );
+  for (const removed of twinResult.deleted) {
+    stdout(`[ax] ✓ removed ${removed} (stale markdown twin)`);
   }
 
   const skipped = twins.skipped;
diff --git a/packages/ax/src/generate.ts b/packages/ax/src/generate.ts
index 6e61538..37f29f5 100644
--- a/packages/ax/src/generate.ts
+++ b/packages/ax/src/generate.ts
@@ -464,14 +464,20 @@ export async function generateCatalog(
 
   const site = readSiteMetadata(cwd);
 
-  // Decide the file-lookup strategy once (App Router, Pages Router, or both), then hand the same
-  // model to every detector so they all see one route universe — see router-model.ts.
-  const router = buildRouterModel(cwd);
-
   const { config } = await loadAxConfig(cwd);
 
   const nextConfig = await loadNextConfig(cwd);
   for (const warning of nextConfig.warnings) warn(warning);
+
+  // Decide the file-lookup strategy once (App Router, Pages Router, or both), then hand the same
+  // model to every detector so they all see one route universe — see router-model.ts. Built after
+  // next.config so the model knows whether `pageExtensions` makes MDX pages route.
+  const router = buildRouterModel(cwd, {
+    ...(nextConfig.config.pageExtensions !== undefined
+      ? { pageExtensions: nextConfig.config.pageExtensions }
+      : {}),
+  });
+
   const basePath = nextConfig.config.basePath ?? '';
   if (basePath) {
     warn(
diff --git a/packages/ax/src/manifest.ts b/packages/ax/src/manifest.ts
index fe63898..f3d3b18 100644
--- a/packages/ax/src/manifest.ts
+++ b/packages/ax/src/manifest.ts
@@ -241,7 +241,13 @@ export async function writeServingManifest(
   const nextConfig = await loadNextConfig(cwd);
   for (const message of nextConfig.warnings) warn(message);
 
-  const router = buildRouterModel(cwd);
+  // Built with pageExtensions so an MDX page that routes is in the manifest's route table — the
+  // middleware must rewrite/fall through for it, never treat it as a miss.
+  const router = buildRouterModel(cwd, {
+    ...(nextConfig.config.pageExtensions !== undefined
+      ? { pageExtensions: nextConfig.config.pageExtensions }
+      : {}),
+  });
   const data = buildServingManifest({
     cwd,
     router,
diff --git a/packages/ax/src/markdown-twins.ts b/packages/ax/src/markdown-twins.ts
index 7b2543b..ad10bf7 100644
--- a/packages/ax/src/markdown-twins.ts
+++ b/packages/ax/src/markdown-twins.ts
@@ -476,13 +476,22 @@ function metadataTwinBody(
   return `${lines.join('\n')}\n`;
 }
 
+/** Root-level generated markdown that is NOT a route twin — each has its own lifecycle owner. */
+const NON_TWIN_GENERATED_FILES: ReadonlySet<string> = new Set([
+  'auth.md', // managed by auth-md.ts
+  '404.md', // managed by agent-404.ts
+]);
+
 /** Every `.md` under `public/` carrying the generated-by marker — ax's own previous output. */
 function listGeneratedTwinFiles(publicDir: string): string[] {
   if (!existsSync(publicDir)) return [];
   const files: string[] = [];
   for (const file of walkFiles(publicDir, (name) => name.endsWith('.md'))) {
-    // auth.md is generated too but is not a route twin; its lifecycle is managed by auth-md.ts.
-    if (file.relativeDir === '' && file.absolutePath.endsWith(`${sep}auth.md`)) continue;
+    // Generated-but-not-a-twin files must never enter the stale sweep: no run plans them as
+    // twins, so the sweep would delete them every build right before their owner rewrites them —
+    // churn that surfaces as a phantom `deleted` entry in the report.
+    const name = file.absolutePath.split(sep).pop() ?? '';
+    if (file.relativeDir === '' && NON_TWIN_GENERATED_FILES.has(name)) continue;
     try {
       if (isGeneratedMarkdown(readFileSync(file.absolutePath, 'utf8'))) {
         files.push(file.absolutePath);
diff --git a/packages/ax/src/pages-dir.ts b/packages/ax/src/pages-dir.ts
index d363a9d..333ef35 100644
--- a/packages/ax/src/pages-dir.ts
+++ b/packages/ax/src/pages-dir.ts
@@ -16,8 +16,20 @@ export function findPagesDir(cwd: string): string | undefined {
   return undefined;
 }
 
-/** Extensions the Pages Router treats as a routable module. */
-const PAGE_EXT_RE = /\.(?:tsx|jsx|ts|js|mjs|cjs)$/;
+/** Extensions the Pages Router always treats as a routable module. */
+const BASE_PAGE_EXTENSIONS = ['tsx', 'jsx', 'ts', 'js', 'mjs', 'cjs'] as const;
+
+/** Extensions the Pages Router treats as a routable module (base set — API-endpoint listing). */
+const PAGE_EXT_RE = pageExtRe([]);
+
+/**
+ * Extensions the Pages Router treats as a routable module, widened by the extra extensions the
+ * caller knows `next.config` `pageExtensions` actually serves (`.mdx`/`.md` pages) — the same
+ * conservative default as the App Router's `pageFileRe`: never over-claim a route.
+ */
+function pageExtRe(extraExtensions: readonly string[]): RegExp {
+  return new RegExp(`\\.(?:${[...BASE_PAGE_EXTENSIONS, ...extraExtensions].join('|')})$`);
+}
 
 /** Root-level pages that render error responses, not addressable content — excluded from routes. */
 const ERROR_PAGE_NAMES: ReadonlySet<string> = new Set(['404', '500']);
@@ -28,10 +40,10 @@ const ERROR_PAGE_NAMES: ReadonlySet<string> = new Set(['404', '500']);
  * maps to its directory's URL). `pages/blog/index.tsx` → `['blog']`; `pages/about.tsx` → `['about']`;
  * `pages/api/[transport].ts` → `['api', '[transport]']`.
  */
-function routeSegments(relPath: string): string[] {
+function routeSegments(relPath: string, extRe: RegExp = PAGE_EXT_RE): string[] {
   const parts = pathSegments(relPath);
   const last = parts.pop() ?? '';
-  const name = last.replace(PAGE_EXT_RE, '');
+  const name = last.replace(extRe, '');
   if (name !== 'index') parts.push(name);
   return parts;
 }
@@ -47,13 +59,15 @@ function routeSegments(relPath: string): string[] {
 export function resolvePagesPathname(
   absolutePath: string,
   pagesDir: string | undefined,
+  extraExtensions: readonly string[] = [],
 ): string | undefined {
   if (!pagesDir || !absolutePath.startsWith(pagesDir)) return undefined;
+  const extRe = pageExtRe(extraExtensions);
   const rel = relative(pagesDir, absolutePath);
   const base = rel.split(/[/\\]/).pop() ?? '';
-  if (!PAGE_EXT_RE.test(base)) return undefined;
+  if (!extRe.test(base)) return undefined;
 
-  const segments = routeSegments(rel);
+  const segments = routeSegments(rel, extRe);
   if (segments[0] === 'api') return undefined; // API routes aren't pages
   if (segments.length === 1 && ERROR_PAGE_NAMES.has(segments[0] ?? '')) return undefined;
 
@@ -70,10 +84,14 @@ export function resolvePagesPathname(
  * of `listStaticPageRoutes`. Dynamic/private/API/error files are deliberately absent (their concrete
  * URLs aren't statically knowable, or they aren't content pages).
  */
-export function listStaticPagesRoutes(pagesDir: string): string[] {
+export function listStaticPagesRoutes(
+  pagesDir: string,
+  extraExtensions: readonly string[] = [],
+): string[] {
+  const extRe = pageExtRe(extraExtensions);
   const routes = new Set<string>();
-  for (const file of walkFiles(pagesDir, (name) => PAGE_EXT_RE.test(name))) {
-    const pathname = resolvePagesPathname(file.absolutePath, pagesDir);
+  for (const file of walkFiles(pagesDir, (name) => extRe.test(name))) {
+    const pathname = resolvePagesPathname(file.absolutePath, pagesDir, extraExtensions);
     if (pathname !== undefined) routes.add(pathname);
   }
   return [...routes].sort();
@@ -85,11 +103,15 @@ export function listStaticPagesRoutes(pagesDir: string): string[] {
  * Router's `listDynamicRoutePrefixes` — see that doc for why consumers that answer *misses* need
  * it: under one of these prefixes a URL may be a real page, so "not found" must never be claimed.
  */
-export function listDynamicPagesRoutePrefixes(pagesDir: string): string[] {
+export function listDynamicPagesRoutePrefixes(
+  pagesDir: string,
+  extraExtensions: readonly string[] = [],
+): string[] {
+  const extRe = pageExtRe(extraExtensions);
   const prefixes = new Set<string>();
-  for (const file of walkFiles(pagesDir, (name) => PAGE_EXT_RE.test(name))) {
+  for (const file of walkFiles(pagesDir, (name) => extRe.test(name))) {
     const rel = relative(pagesDir, file.absolutePath);
-    const segments = routeSegments(rel);
+    const segments = routeSegments(rel, extRe);
     if (segments[0] === 'api') continue; // API routes aren't pages
     if (segments.length === 1 && ERROR_PAGE_NAMES.has(segments[0] ?? '')) continue;
 
diff --git a/packages/ax/src/prompt.ts b/packages/ax/src/prompt.ts
index 3917cb9..a6fed4b 100644
--- a/packages/ax/src/prompt.ts
+++ b/packages/ax/src/prompt.ts
@@ -153,11 +153,31 @@ export async function createReadlinePrompter(): Promise<Prompter & { close(): vo
 /**
  * The terminal width to wrap the redraw region against, re-read on every draw (not cached) so a
  * resize mid-prompt is honored on the very next keystroke instead of corrupting the layout.
- * `output.columns` is `undefined` on a stream that isn't actually a TTY column-aware pipe; 80 is
- * the same conservative fallback `process.stdout.columns` callers elsewhere assume.
+ * `output.columns` is `undefined` on a stream that isn't actually a TTY column-aware pipe — and
+ * `0` on a PTY that never had its size initialized (observed under `script(1)`), which would
+ * truncate every row to the empty string; both fall back to the conservative 80.
  */
 function terminalColumns(output: NodeJS.WriteStream): number {
-  return output.columns ?? 80;
+  const columns = output.columns;
+  return columns !== undefined && columns > 0 ? columns : 80;
+}
+
+/**
+ * Detaches the shared readline interface's key handling for the duration of a raw-mode selector,
+ * returning the restore function. `rl.pause()` alone is NOT enough: pausing stops the input
+ * stream, but the selector immediately resumes it to read its own raw bytes — and readline's
+ * `keypress` listener is still attached, so it processes the same keys in parallel. An arrow-up
+ * then recalls the *previous question's answer* from history and rewrites it over the redraw
+ * region, and every printable key (space, j/k) is echoed at the cursor — the garbled rows this
+ * guards against. Node's `emitKeypressEvents` machinery re-attaches its internal data decoder via
+ * a `newListener` hook when the listeners come back, so remove-and-restore is safe.
+ */
+function suspendKeypressListeners(input: NodeJS.ReadStream): () => void {
+  const listeners = input.rawListeners('keypress') as Array<(...args: unknown[]) => void>;
+  input.removeAllListeners('keypress');
+  return () => {
+    for (const listener of listeners) input.on('keypress', listener);
+  };
 }
 
 /**
@@ -237,6 +257,7 @@ function interactiveMultiSelect(
   };
 
   rl.pause();
+  const restoreKeypress = suspendKeypressListeners(input);
   const wasRaw = input.isRaw === true;
   input.setRawMode(true);
   input.resume();
@@ -248,6 +269,7 @@ function interactiveMultiSelect(
       input.removeListener('data', onData);
       input.setRawMode(wasRaw);
       output.write('\x1b[?25h');
+      restoreKeypress();
       rl.resume();
       resolve(choices.filter((_, i) => selected[i]).map((choice) => choice.value));
     };
@@ -328,6 +350,7 @@ function interactiveSelect(
   };
 
   rl.pause();
+  const restoreKeypress = suspendKeypressListeners(input);
   const wasRaw = input.isRaw === true;
   input.setRawMode(true);
   input.resume();
@@ -339,6 +362,7 @@ function interactiveSelect(
       input.removeListener('data', onData);
       input.setRawMode(wasRaw);
       output.write('\x1b[?25h');
+      restoreKeypress();
       rl.resume();
       resolve(choices[focus]?.value);
     };
diff --git a/packages/ax/src/router-model.ts b/packages/ax/src/router-model.ts
index 99480da..57a1069 100644
--- a/packages/ax/src/router-model.ts
+++ b/packages/ax/src/router-model.ts
@@ -65,6 +65,15 @@ export interface RouterModel {
   listApiEndpoints(): ApiEndpoint[];
 }
 
+export interface RouterModelOptions {
+  /**
+   * `next.config` `pageExtensions`, when the caller has loaded it. Only `md`/`mdx` widen the
+   * model: whether an MDX page routes at all is a config decision, so without this the model stays
+   * conservative — a `page.mdx` is not counted as a route Next.js may never serve.
+   */
+  pageExtensions?: readonly string[];
+}
+
 /**
  * Builds the project's `RouterModel` once, composing the App and/or Pages adapters based on which
  * router directories exist. `listPageRoutes` unions both routers' routes and lists each URL once —
@@ -74,9 +83,12 @@ export interface RouterModel {
  * every method — the same silent, never-throwing degradation the individual `findAppDir`-based
  * detectors had.
  */
-export function buildRouterModel(cwd: string): RouterModel {
+export function buildRouterModel(cwd: string, options: RouterModelOptions = {}): RouterModel {
   const appDir = findAppDir(cwd);
   const pagesDir = findPagesDir(cwd);
+  const mdxExtensions = ['md', 'mdx'].filter(
+    (ext) => options.pageExtensions?.includes(ext) ?? false,
+  );
 
   const routers: RouterKind[] = [];
   if (appDir) routers.push('app');
@@ -92,27 +104,34 @@ export function buildRouterModel(cwd: string): RouterModel {
 
     listPageRoutes() {
       const routes = new Set<string>();
-      if (appDir) for (const route of listStaticPageRoutes(appDir)) routes.add(route);
-      if (pagesDir) for (const route of listStaticPagesRoutes(pagesDir)) routes.add(route);
+      if (appDir)
+        for (const route of listStaticPageRoutes(appDir, mdxExtensions)) routes.add(route);
+      if (pagesDir) {
+        for (const route of listStaticPagesRoutes(pagesDir, mdxExtensions)) routes.add(route);
+      }
       return [...routes].sort();
     },
 
     listDynamicRoutePrefixes() {
       const prefixes = new Set<string>();
-      if (appDir) for (const prefix of listDynamicRoutePrefixes(appDir)) prefixes.add(prefix);
+      if (appDir) {
+        for (const prefix of listDynamicRoutePrefixes(appDir, mdxExtensions)) prefixes.add(prefix);
+      }
       if (pagesDir) {
-        for (const prefix of listDynamicPagesRoutePrefixes(pagesDir)) prefixes.add(prefix);
+        for (const prefix of listDynamicPagesRoutePrefixes(pagesDir, mdxExtensions)) {
+          prefixes.add(prefix);
+        }
       }
       return [...prefixes].sort();
     },
 
     resolveUrlForFile(absolutePath) {
       if (appDir) {
-        const url = resolvePagePathname(absolutePath, appDir);
+        const url = resolvePagePathname(absolutePath, appDir, mdxExtensions);
         if (url !== undefined) return url;
       }
       if (pagesDir) {
-        const url = resolvePagesPathname(absolutePath, pagesDir);
+        const url = resolvePagesPathname(absolutePath, pagesDir, mdxExtensions);
         if (url !== undefined) return url;
       }
       return undefined;
diff --git a/packages/ax/test/detect-webmcp.test.ts b/packages/ax/test/detect-webmcp.test.ts
index 3a5a82a..dbd5a8f 100644
--- a/packages/ax/test/detect-webmcp.test.ts
+++ b/packages/ax/test/detect-webmcp.test.ts
@@ -435,12 +435,13 @@ export function Tools() {
   });
 });
 
-// The webmcp-imperative fixture is the end-to-end shape of the bug: its layout.tsx mentions the API
-// in a metadata string and its page.tsx renders it as visible prose, which produced four spurious
-// warnings while the one real registration lives in a separate client component.
-describe('detectWebMcp against the webmcp-imperative fixture', () => {
-  it('warns about nothing while still detecting the real registration', () => {
-    const fixture = fileURLToPath(new URL('../../../fixtures/webmcp-imperative/', import.meta.url));
+// The webmcp fixture is the end-to-end shape of the bug: its layout.tsx mentions the API in a
+// metadata string and its page.tsx renders it as visible prose, which once produced four spurious
+// warnings while the one real registration lives in a separate client component. The same page
+// also carries a declarative <form toolname>, so this doubles as the two-shapes-coexisting case.
+describe('detectWebMcp against the webmcp fixture', () => {
+  it('warns about nothing while still detecting the real registrations', () => {
+    const fixture = fileURLToPath(new URL('../../../fixtures/webmcp/', import.meta.url));
     const result = detectWebMcp({
       cwd: fixture,
       siteUrl: SITE_URL,
@@ -450,8 +451,10 @@ describe('detectWebMcp against the webmcp-imperative fixture', () => {
     });
 
     expect(warnings).toEqual([]);
-    expect(result.toolNames).toEqual(['add_to_cart']);
-    expect(result.entries).toEqual([]);
-    expect(result.sites.map((site) => site.source)).toEqual([join('app', 'register-tools.tsx')]);
+    expect([...result.toolNames].sort()).toEqual(['add_to_cart', 'subscribe_newsletter']);
+    // Only the declarative form yields an entry; the imperative registration never does.
+    expect(result.entries).toHaveLength(1);
+    expect(result.entries[0]?.capabilities).toEqual(['subscribe_newsletter']);
+    expect(result.sites.map((site) => site.source)).toContain(join('app', 'register-tools.tsx'));
   });
 });
diff --git a/packages/ax/test/fixtures-integration.test.ts b/packages/ax/test/fixtures-integration.test.ts
index b01fae2..19c7d9d 100644
--- a/packages/ax/test/fixtures-integration.test.ts
+++ b/packages/ax/test/fixtures-integration.test.ts
@@ -15,7 +15,7 @@ const fixturesDir = fileURLToPath(new URL('../../../fixtures/', import.meta.url)
 // corpus (not just synthetic tmp dirs) must stay spec-valid. Doesn't write files — that's covered
 // by write.test.ts — just exercises generateCatalog against real package.json shapes.
 describe('generateCatalog against the fixture corpus', () => {
-  it.each(['bare', 'bare-js', 'deploy-variants'])(
+  it.each(['bare', 'bare-js', 'deploy-variants', 'next-auth'])(
     'produces a spec-valid catalog for %s',
     async (name) => {
       const { catalog } = await generateCatalog({ cwd: `${fixturesDir}${name}` });
@@ -33,114 +33,122 @@ describe('generateCatalog against the fixture corpus', () => {
     });
     expect(warnings.some((w) => w.includes('basePath'))).toBe(true);
   });
-});
-
-// End-to-end: the config-overrides fixture ships a real `ax.config.ts`, so this
-// exercises the whole config path (jiti load -> validate -> entry overrides -> isGated) against a
-// committed fixture rather than a synthetic tmp dir.
-describe('generateCatalog with the config-overrides fixture', () => {
-  it('emits config-declared entries and applies the isGated policy', async () => {
-    const { catalog } = await generateCatalog({ cwd: `${fixturesDir}config-overrides` });
-    expect(validateCatalog(catalog).valid).toBe(true);
-    expect(validateCatalogArd(catalog).valid).toBe(true);
 
-    const ids = catalog.entries.map((entry) => entry.identifier);
-    expect(ids).toContain('urn:air:example.com:docs');
-    expect(ids).toContain('urn:air:example.com:skills');
-    // Gated by the default floor (/api/auth/**) but re-included via the config's isGated matcher.
-    expect(ids).toContain('urn:air:example.com:auth-status');
-    // Gated and NOT re-included — ax can't describe its auth, so it's dropped though it's declared.
-    expect(ids).not.toContain('urn:air:example.com:auth-internal');
+  it('detects next-auth in the next-auth fixture and steers toward the api_key lane', async () => {
+    const { report } = await generateCatalog({ cwd: `${fixturesDir}next-auth` });
+    expect(report.auth.provider).toMatchObject({ name: 'next-auth', package: 'next-auth' });
+    // The [...nextauth] mount sits under the default /api/auth/** gating floor: never an entry.
+    expect(report.auth.provider?.note).toContain('api_key');
   });
 });
 
-// End-to-end: each fixture ships a real artifact (an mcp-handler mount, a static
-// public/openapi.json, an app/llms.txt/route.ts) plus an ax.config.ts declaring a fixture-specific
-// `siteUrl` so the resulting catalog is deterministic in CI. `scaffoldLlmsTxt` stays at its default
-// (`false`) here — these fixtures must never gain files as a side effect of running this suite.
-describe('generateCatalog zero-config detection against the fixture corpus', () => {
-  it('detects the mcp-handler mount in the mcp-adapter fixture', async () => {
-    const { catalog } = await generateCatalog({ cwd: `${fixturesDir}mcp-adapter` });
+// End-to-end against the flagship fixture — the demo-app fork that composes most detectors in one
+// project: two mcp-handler mounts (one withMcpAuth-gated), a hand-owned llms.txt route, a static
+// public/openapi.json, a JSON-LD component rendered from the layout, and a real jiti-loaded
+// ax.config.ts declaring the gated entry's auth. `scaffoldLlmsTxt` stays at its default (`false`)
+// in generateCatalog runs — fixtures must never gain files as a side effect of this suite.
+describe('generateCatalog against the flagship fixture', () => {
+  it('detects both mcp-handler mounts with their tools', async () => {
+    const { catalog, report } = await generateCatalog({ cwd: `${fixturesDir}flagship` });
     expect(validateCatalogArd(catalog).valid).toBe(true);
 
-    const entry = catalog.entries.find(
-      (e) => e.identifier === 'urn:air:mcp-adapter-fixture.example.com:mcp-server',
+    const publicEntry = catalog.entries.find(
+      (e) => e.identifier === 'urn:air:flagship-fixture.example.com:mcp-server:api-public-mcp',
     );
-    expect(entry).toMatchObject({
+    expect(publicEntry).toMatchObject({
       type: 'application/mcp-server-card+json',
-      url: 'https://mcp-adapter-fixture.example.com/.well-known/mcp/server-card.json',
-      capabilities: ['roll_dice'],
+      url: 'https://flagship-fixture.example.com/.well-known/mcp/server-card.json',
+      capabilities: ['search_flights'],
     });
+
+    const mounts = [...report.mcp.mounts].sort((a, b) => a.pathname.localeCompare(b.pathname));
+    expect(mounts).toEqual([
+      { pathname: '/api/mcp', tools: ['get_seat_map', 'book_flight', 'pay_booking'] },
+      { pathname: '/api/public/mcp', tools: ['search_flights'] },
+    ]);
   });
 
-  it('builds a well-known MCP server card from the mcp-adapter fixture mount', async () => {
-    const { serverCardPlan } = await generateCatalog({ cwd: `${fixturesDir}mcp-adapter` });
-    expect(serverCardPlan?.multi).toBe(false);
-    expect(serverCardPlan?.cards[0]?.card).toMatchObject({
-      name: 'com.example.mcp-adapter-fixture/mcp-adapter',
-      serverUrl: 'https://mcp-adapter-fixture.example.com/mcp',
-      remotes: [{ type: 'streamable-http', url: 'https://mcp-adapter-fixture.example.com/mcp' }],
-      tools: [{ name: 'roll_dice' }],
+  it('builds a multi-server card plan (public primary, gated named card)', async () => {
+    const { serverCardPlan } = await generateCatalog({ cwd: `${fixturesDir}flagship` });
+    expect(serverCardPlan?.multi).toBe(true);
+
+    const cards = serverCardPlan?.cards.map((c) => c.card) ?? [];
+    const publicCard = cards.find((c) => c.serverUrl?.endsWith('/api/public/mcp'));
+    expect(publicCard).toMatchObject({
+      name: 'com.example.flagship-fixture/api-public-mcp',
+      serverUrl: 'https://flagship-fixture.example.com/api/public/mcp',
+      tools: [{ name: 'search_flights' }],
     });
-  });
+    expect(publicCard?.authentication).toBeUndefined();
 
-  it('marks the gated mcp-adapter-gated mount with auth and a server-card authentication block', async () => {
-    const { catalog, serverCardPlan } = await generateCatalog({
-      cwd: `${fixturesDir}mcp-adapter-gated`,
+    const gatedCard = cards.find((c) => c.serverUrl?.endsWith('/api/mcp'));
+    expect(gatedCard?.authentication).toEqual({
+      required: true,
+      resourceMetadata: 'https://flagship-fixture.example.com/.well-known/oauth-protected-resource',
     });
-    expect(validateCatalogArd(catalog).valid).toBe(true);
+  });
 
+  it('publishes the config-declared oauth2 descriptor on the gated entry (declared-override path)', async () => {
+    // The raw withMcpAuth-without-declaration default (`auth: { status: 'unknown' }`) is proven
+    // synthetically in generate.test.ts; the flagship declares the answer in its real ax.config.ts,
+    // so this proves the jiti load -> validate -> entry-override pipeline end-to-end.
+    const { catalog } = await generateCatalog({ cwd: `${fixturesDir}flagship` });
     const entry = catalog.entries.find(
-      (e) => e.identifier === 'urn:air:mcp-gated-fixture.example.com:mcp-server',
+      (e) => e.identifier === 'urn:air:flagship-fixture.example.com:mcp-server:api-mcp',
     );
     expect(entry).toMatchObject({
       type: 'application/mcp-server-card+json',
-      url: 'https://mcp-gated-fixture.example.com/.well-known/mcp/server-card.json',
-      auth: { status: 'unknown' },
-    });
-    expect(serverCardPlan?.cards[0]?.card.authentication).toEqual({
-      required: true,
-      resourceMetadata:
-        'https://mcp-gated-fixture.example.com/.well-known/oauth-protected-resource',
+      url: 'https://flagship-fixture.example.com/.well-known/mcp/server-card/api-mcp.json',
+      capabilities: ['get_seat_map', 'book_flight', 'pay_booking'],
+      auth: { status: 'oauth2', docsUrl: 'https://flagship-fixture.example.com/agents.md' },
     });
   });
 
-  it('detects public/openapi.json in the openapi fixture', async () => {
-    const { catalog } = await generateCatalog({ cwd: `${fixturesDir}openapi` });
-    expect(validateCatalogArd(catalog).valid).toBe(true);
+  it('detects the hand-owned llms.txt route and public/openapi.json', async () => {
+    const { catalog } = await generateCatalog({ cwd: `${fixturesDir}flagship` });
 
-    const entry = catalog.entries.find(
-      (e) => e.identifier === 'urn:air:openapi-fixture.example.com:openapi',
-    );
-    expect(entry).toMatchObject({
+    expect(
+      catalog.entries.find((e) => e.identifier === 'urn:air:flagship-fixture.example.com:llms-txt'),
+    ).toMatchObject({
+      type: 'text/markdown',
+      url: 'https://flagship-fixture.example.com/llms.txt',
+    });
+    expect(
+      catalog.entries.find((e) => e.identifier === 'urn:air:flagship-fixture.example.com:openapi'),
+    ).toMatchObject({
       type: 'application/vnd.oai.openapi+json;version=3.1',
-      url: 'https://openapi-fixture.example.com/openapi.json',
+      url: 'https://flagship-fixture.example.com/openapi.json',
     });
   });
 
-  it('detects app/llms.txt/route.ts in the llms-txt fixture', async () => {
-    const { catalog } = await generateCatalog({ cwd: `${fixturesDir}llms-txt` });
-    expect(validateCatalogArd(catalog).valid).toBe(true);
+  it('detects the JSON-LD component rendered from the flagship layout (recommendation, never an entry)', async () => {
+    const recommendations: string[] = [];
+    const { catalog } = await generateCatalog({
+      cwd: `${fixturesDir}flagship`,
+      onRecommendation: (m) => recommendations.push(m),
+    });
+    expect(catalog.entries.every((e) => e.type !== 'application/ld+json')).toBe(true);
+    expect(recommendations.some((r) => r.includes('JSON-LD structured data detected'))).toBe(true);
+  });
 
-    const entry = catalog.entries.find(
-      (e) => e.identifier === 'urn:air:llms-txt-fixture.example.com:llms-txt',
-    );
-    expect(entry).toMatchObject({
-      type: 'text/markdown',
-      url: 'https://llms-txt-fixture.example.com/llms.txt',
+  it('recommends adding JSON-LD for the bare fixture (none present)', async () => {
+    const recommendations: string[] = [];
+    await generateCatalog({
+      cwd: `${fixturesDir}bare`,
+      onRecommendation: (m) => recommendations.push(m),
     });
+    expect(recommendations.some((r) => r.includes('No JSON-LD structured data found'))).toBe(true);
   });
 
   it('never writes into the fixture corpus as a side effect (every scaffold flag defaults to false)', async () => {
     const fixtures = [
       'bare',
       'bare-js',
-      'mcp-adapter',
-      'openapi',
-      'pages-bare',
-      'pages-mcp',
-      'pages-webmcp-declarative',
       'hybrid',
+      'flagship',
+      'flagship-pages',
+      'next-auth',
+      'webmcp',
     ];
     for (const name of fixtures) {
       await generateCatalog({ cwd: `${fixturesDir}${name}` });
@@ -148,76 +156,53 @@ describe('generateCatalog zero-config detection against the fixture corpus', ()
     // One entry per opt-in scaffold: each writes into the consumer's source tree, so a fixture
     // gaining any of these files means a default flipped to on. Covers both router shapes: the App
     // Router route-handler / component targets and the Pages Router static / `_app` targets.
+    // (flagship legitimately owns app/llms.txt and app/organization-json-ld.tsx as committed
+    // sources, so for it only the never-scaffolded-elsewhere paths apply.)
     const neverWritten = [
-      'app/llms.txt',
       'public/llms.txt',
-      'public/robots.txt',
-      'app/organization-json-ld.tsx',
-      'app/organization-json-ld.jsx',
       'pages/organization-json-ld.tsx',
       'pages/organization-json-ld.jsx',
     ];
+    const neverWrittenUnlessCommitted = [
+      'app/llms.txt',
+      'app/organization-json-ld.tsx',
+      'app/organization-json-ld.jsx',
+    ];
     for (const name of fixtures) {
       for (const path of neverWritten) {
         expect(existsSync(`${fixturesDir}${name}/${path}`)).toBe(false);
       }
+      if (name === 'flagship') continue;
+      for (const path of neverWrittenUnlessCommitted) {
+        expect(existsSync(`${fixturesDir}${name}/${path}`)).toBe(false);
+      }
     }
   });
 });
 
-// Detect-and-recommend: the discovery fixture ships a JSON-LD Organization block in its
-// root layout, so generation must surface the "detected" recommendation (never a catalog entry).
-describe('generateCatalog JSON-LD detection against the fixture corpus', () => {
-  it('detects the JSON-LD block in the discovery fixture layout', async () => {
-    const recommendations: string[] = [];
-    const { catalog } = await generateCatalog({
-      cwd: `${fixturesDir}discovery`,
-      onRecommendation: (m) => recommendations.push(m),
-    });
-    expect(catalog.entries.every((e) => e.type !== 'application/ld+json')).toBe(true);
-    expect(recommendations.some((r) => r.includes('JSON-LD structured data detected'))).toBe(true);
-  });
-
-  it('recommends adding JSON-LD for the bare fixture (none present)', async () => {
-    const recommendations: string[] = [];
-    await generateCatalog({
-      cwd: `${fixturesDir}bare`,
-      onRecommendation: (m) => recommendations.push(m),
-    });
-    expect(recommendations.some((r) => r.includes('No JSON-LD structured data found'))).toBe(true);
-  });
-});
-
 // Phase 4: WebMCP detection against the real fixture corpus — declarative tools become a
 // `text/html` page entry; imperative tools surface via recommendations, never invented entries;
 // the edge-cases fixture must warn (server component, deprecated navigator alias) and must not
 // detect the user-defined `registerTool` decoy.
 describe('generateCatalog WebMCP detection against the fixture corpus', () => {
-  it('emits a page entry with tool capabilities for the webmcp-declarative fixture', async () => {
+  it('detects both shapes on one page in the webmcp fixture: declarative entry, imperative recommendation', async () => {
+    const recommendations: string[] = [];
     const { catalog, webMcpToolNames } = await generateCatalog({
-      cwd: `${fixturesDir}webmcp-declarative`,
+      cwd: `${fixturesDir}webmcp`,
+      onRecommendation: (m) => recommendations.push(m),
     });
     expect(validateCatalogArd(catalog).valid).toBe(true);
-    expect(webMcpToolNames).toEqual(['subscribe_newsletter']);
+    expect([...webMcpToolNames].sort()).toEqual(['add_to_cart', 'subscribe_newsletter']);
 
-    const entry = catalog.entries.find(
-      (e) => e.identifier === 'urn:air:webmcp-declarative-fixture.example.com:webmcp',
-    );
-    expect(entry).toMatchObject({
+    // Exactly one entry: the declarative form's page URL. The imperative registerTool() runs only
+    // in the browser, so it is never invented into an entry — only recommended into markup.
+    expect(catalog.entries).toHaveLength(1);
+    expect(catalog.entries[0]).toMatchObject({
+      identifier: 'urn:air:webmcp-fixture.example.com:webmcp',
       type: 'text/html',
-      url: 'https://webmcp-declarative-fixture.example.com/',
+      url: 'https://webmcp-fixture.example.com/',
       capabilities: ['subscribe_newsletter'],
     });
-  });
-
-  it('detects imperative tools in the webmcp-imperative fixture without inventing entries', async () => {
-    const recommendations: string[] = [];
-    const { catalog, webMcpToolNames } = await generateCatalog({
-      cwd: `${fixturesDir}webmcp-imperative`,
-      onRecommendation: (m) => recommendations.push(m),
-    });
-    expect(webMcpToolNames).toEqual(['add_to_cart']);
-    expect(catalog.entries).toEqual([]);
     expect(recommendations.some((r) => r.includes('invisible in server-rendered HTML'))).toBe(true);
   });
 
@@ -257,18 +242,20 @@ describe('loadNextConfig against the fixture corpus', () => {
 
 // Pages Router (and hybrid) support: the same detectors run against `pages/` route topology, and a
 // project with both routers scans both. Output is still the router-agnostic `public/` catalog.
-describe('generateCatalog against the Pages Router fixtures', () => {
-  it('produces a spec-valid catalog for pages-bare, reports the pages router, and detects the existing 404', async () => {
+// flagship-pages is the flagship's information architecture ported wholesale to the Pages Router,
+// so these assertions re-prove the flagship composition against a Pages-only route model.
+describe('generateCatalog against the flagship-pages fixture', () => {
+  it('produces a spec-valid catalog, reports the pages router, and detects the existing 404', async () => {
     const recommendations: string[] = [];
     const { catalog, report } = await generateCatalog({
-      cwd: `${fixturesDir}pages-bare`,
+      cwd: `${fixturesDir}flagship-pages`,
       onRecommendation: (m) => recommendations.push(m),
     });
     expect(validateCatalog(catalog).valid).toBe(true);
     expect(validateCatalogArd(catalog).valid).toBe(true);
     expect(report.routers).toEqual(['pages']);
 
-    // pages-bare ships a plain pages/404.tsx: detected, but not agent-aware — so a "link the
+    // flagship-pages ships a plain pages/404.tsx: detected, but not agent-aware — so a "link the
     // wayfinding guide" recommendation, proving the Pages Router 404 convention is recognized
     // (not just app/not-found).
     expect(report.agent404).toMatchObject({
@@ -280,55 +267,65 @@ describe('generateCatalog against the Pages Router fixtures', () => {
   });
 
   it('lists Pages Router content routes, excluding special/dynamic/error files', () => {
-    // Asserted through the model directly (no scaffold opt-in needed) against the real fixture:
-    // `/` and `/about` are content; `_app`/`_document`/`404`/`[slug]` are not.
-    const routes = buildRouterModel(`${fixturesDir}pages-bare`).listPageRoutes();
-    expect(routes).toEqual(['/', '/about']);
+    // `_app`/`_document`/`404` are special files, `destinations/[slug]` is dynamic — none listed.
+    const routes = buildRouterModel(`${fixturesDir}flagship-pages`).listPageRoutes();
+    expect(routes).toEqual([
+      '/',
+      '/account',
+      '/checkout',
+      '/confirmation',
+      '/destinations',
+      '/results',
+      '/seats',
+    ]);
   });
 
-  it('detects the pages/api/[transport].ts MCP mount at /api/mcp (entry, server card, and report)', async () => {
-    const recommendations: string[] = [];
+  it('detects both pages/api [transport] MCP mounts (gated + public) with entries and cards', async () => {
     const { catalog, serverCardPlan, report } = await generateCatalog({
-      cwd: `${fixturesDir}pages-mcp`,
-      onRecommendation: (m) => recommendations.push(m),
+      cwd: `${fixturesDir}flagship-pages`,
     });
     expect(validateCatalogArd(catalog).valid).toBe(true);
-    expect(report.routers).toEqual(['pages']);
 
-    const entry = catalog.entries.find(
-      (e) => e.identifier === 'urn:air:pages-mcp-fixture.example.com:mcp-server',
+    const mounts = [...report.mcp.mounts].sort((a, b) => a.pathname.localeCompare(b.pathname));
+    expect(mounts).toEqual([
+      { pathname: '/api/mcp', tools: ['get_seat_map', 'book_flight', 'pay_booking'] },
+      { pathname: '/api/public/mcp', tools: ['search_flights'] },
+    ]);
+
+    const gatedEntry = catalog.entries.find(
+      (e) => e.identifier === 'urn:air:flagship-pages-fixture.example.com:mcp-server:api-mcp',
     );
-    expect(entry).toMatchObject({
+    expect(gatedEntry).toMatchObject({
       type: 'application/mcp-server-card+json',
-      url: 'https://pages-mcp-fixture.example.com/.well-known/mcp/server-card.json',
-      capabilities: ['roll_dice'],
+      auth: {
+        status: 'oauth2',
+        docsUrl: 'https://flagship-pages-fixture.example.com/agents.md',
+      },
     });
-    expect(serverCardPlan?.cards[0]?.card).toMatchObject({
-      serverUrl: 'https://pages-mcp-fixture.example.com/api/mcp',
-      tools: [{ name: 'roll_dice' }],
-    });
-    // The report mirrors the detection: the mount is surfaced at /api/mcp with its tools.
-    expect(report.mcp.mounts).toEqual([{ pathname: '/api/mcp', tools: ['roll_dice'] }]);
-    // No pages/404.tsx here — the "add one" recommendation names the Pages Router convention.
-    expect(recommendations.some((r) => r.includes('No pages/404.tsx found'))).toBe(true);
+
+    expect(serverCardPlan?.multi).toBe(true);
+    const cards = serverCardPlan?.cards.map((c) => c.card) ?? [];
+    expect(
+      cards.find((c) => c.serverUrl === 'https://flagship-pages-fixture.example.com/api/public/mcp')
+        ?.tools,
+    ).toEqual([{ name: 'search_flights' }]);
   });
 
-  it('attributes a declarative WebMCP form to its Pages Router page URL (catalog entry)', async () => {
+  it('attributes the declarative WebMCP form to its Pages Router page URL (catalog entry)', async () => {
     const { catalog, webMcpToolNames, report } = await generateCatalog({
-      cwd: `${fixturesDir}pages-webmcp-declarative`,
+      cwd: `${fixturesDir}flagship-pages`,
     });
-    expect(validateCatalogArd(catalog).valid).toBe(true);
-    expect(webMcpToolNames).toEqual(['subscribe_newsletter']);
+    expect(webMcpToolNames).toEqual(['watch_route']);
 
-    // The entry URL is the Pages Router page URL `/` — proving resolveUrlForFile handles the
-    // file-is-the-route rule, not just the App Router `page.*` shape.
+    // The entry URL is the Pages Router page URL `/destinations` — proving resolveUrlForFile
+    // handles the file-is-the-route rule, not just the App Router `page.*` shape.
     const entry = catalog.entries.find(
-      (e) => e.identifier === 'urn:air:pages-webmcp-fixture.example.com:webmcp',
+      (e) => e.identifier === 'urn:air:flagship-pages-fixture.example.com:webmcp:destinations',
     );
     expect(entry).toMatchObject({
       type: 'text/html',
-      url: 'https://pages-webmcp-fixture.example.com/',
-      capabilities: ['subscribe_newsletter'],
+      url: 'https://flagship-pages-fixture.example.com/destinations',
+      capabilities: ['watch_route'],
     });
     // The report carries no webmcp section: the spec is still a draft, so the report doesn't
     // steer agents toward it (see report.ts).
@@ -348,33 +345,49 @@ describe('generateCatalog against the Pages Router fixtures', () => {
   });
 });
 
-// The middleware fixture: the serving manifest its prebuild generates is the middleware's rewrite
-// contract, so the pieces the dogfood relies on must hold from the source tree alone. Assertions
-// stay independent of build state — only committed sources are asserted on (the generated homepage
-// twin and the catalog artifact appear only after a build, so they are deliberately not expected).
-describe('the middleware fixture serving manifest', () => {
-  it('lists the hand-authored twin, the gated path, and the dynamic prefix', async () => {
-    const cwd = join(fixturesDir, 'middleware');
+// The flagship's serving manifest is the middleware's rewrite contract, so the pieces the dogfood
+// relies on must hold from the source tree alone. Assertions stay independent of build state —
+// only committed sources are asserted on (generated twins and the catalog artifact appear only
+// after a build, so they are deliberately not expected).
+describe('the flagship fixture serving manifest', () => {
+  it('lists the hand-authored twin, the gated path, the dynamic prefix, and the MDX route', async () => {
+    const cwd = join(fixturesDir, 'flagship');
     const { buildServingManifest } = await import('../src/manifest.js');
     const { resolveGating } = await import('../src/gating.js');
     const { loadAxConfig } = await import('../src/config.js');
 
     const { config } = await loadAxConfig(cwd);
+    const nextConfig = await loadNextConfig(cwd);
     const manifest = buildServingManifest({
       cwd,
-      router: buildRouterModel(cwd),
+      router: buildRouterModel(cwd, {
+        ...(nextConfig.config.pageExtensions !== undefined
+          ? { pageExtensions: nextConfig.config.pageExtensions }
+          : {}),
+      }),
       isGated: resolveGating(config.isGated),
       basePath: '',
     });
 
-    expect(manifest.routes).toEqual(['/', '/docs', '/private', '/shell']);
-    expect(manifest.markdownTwins['/docs']).toBe('/docs.md');
-    expect(manifest.gatedPaths).toContain('/private');
-    expect(manifest.dynamicRoutePrefixes).toEqual(['/blog']);
+    // /guide is a page.mdx route: it is in the route table exactly because the fixture's
+    // next.config pageExtensions serves mdx — the middleware must never treat it as a miss.
+    expect(manifest.routes).toEqual([
+      '/',
+      '/account',
+      '/checkout',
+      '/confirmation',
+      '/destinations',
+      '/guide',
+      '/results',
+      '/seats',
+    ]);
+    expect(manifest.markdownTwins['/destinations']).toBe('/destinations.md');
+    expect(manifest.gatedPaths).toContain('/account');
+    expect(manifest.dynamicRoutePrefixes).toEqual(['/destinations']);
   });
 
   it('wires the middleware, so its negotiation checks read addressed', async () => {
-    const { report } = await generateCatalog({ cwd: join(fixturesDir, 'middleware') });
+    const { report } = await generateCatalog({ cwd: join(fixturesDir, 'flagship') });
     expect(report.middleware).toMatchObject({ present: true, wiredToAx: true });
     const negotiation = report.ora.checks.filter((check) => check.artifact === 'middleware');
     expect(negotiation.map((check) => check.id).sort()).toEqual([
diff --git a/packages/ax/test/markdown-twins.test.ts b/packages/ax/test/markdown-twins.test.ts
index 1e8e24b..17c1099 100644
--- a/packages/ax/test/markdown-twins.test.ts
+++ b/packages/ax/test/markdown-twins.test.ts
@@ -193,6 +193,19 @@ describe('planMarkdownTwins — user-owned sources and regeneration', () => {
     expect(result.stalePaths).toEqual([join(dir, 'public', 'gone.md')]);
   });
 
+  it('never sweeps generated non-twin artifacts (auth.md, 404.md) as stale', async () => {
+    write('app/docs/page.tsx', 'export default () => null;');
+    write('.next/server/app/docs.html', html('Docs'));
+    // Generated by auth-md.ts / agent-404.ts on a previous run — carry the marker but are not
+    // route twins. No twin plan ever produces them, so listing them stale would delete them every
+    // build right before their owners rewrite them (phantom `deleted` churn on build N+1).
+    write('public/auth.md', `---\ntitle: "Auth"\ngenerated-by: "${GENERATED_BY}"\n---\n\nauth\n`);
+    write('public/404.md', `---\ntitle: "404"\ngenerated-by: "${GENERATED_BY}"\n---\n\nlost?\n`);
+
+    const result = await plan();
+    expect(result.stalePaths).toEqual([]);
+  });
+
   it('a disabled plan is empty and shape-stable', async () => {
     write('app/page.tsx', 'export default () => null;');
     const result = await plan({ enabled: false });
diff --git a/packages/ax/test/router-model.test.ts b/packages/ax/test/router-model.test.ts
index a5f232e..635fabb 100644
--- a/packages/ax/test/router-model.test.ts
+++ b/packages/ax/test/router-model.test.ts
@@ -68,6 +68,30 @@ describe('buildRouterModel — listPageRoutes', () => {
 
     expect(buildRouterModel(dir).listPageRoutes()).toEqual(['/', '/about', '/dashboard']);
   });
+
+  it('counts MDX pages as routes exactly when pageExtensions serves them', () => {
+    write('app/page.tsx');
+    write('app/guide/page.mdx', '# Guide\n');
+    write('pages/faq.mdx', '# FAQ\n');
+
+    // Without pageExtensions the model stays conservative: Next.js may not serve MDX at all, so
+    // claiming /guide or /faq as a route would over-claim.
+    expect(buildRouterModel(dir).listPageRoutes()).toEqual(['/']);
+
+    const configured = buildRouterModel(dir, {
+      pageExtensions: ['js', 'jsx', 'md', 'mdx', 'ts', 'tsx'],
+    });
+    expect(configured.listPageRoutes()).toEqual(['/', '/faq', '/guide']);
+    expect(configured.resolveUrlForFile(join(dir, 'app', 'guide', 'page.mdx'))).toBe('/guide');
+  });
+
+  it('records the dynamic prefix of an MDX page under a dynamic segment when configured', () => {
+    write('app/docs/[slug]/page.mdx', '# Doc\n');
+    expect(buildRouterModel(dir).listDynamicRoutePrefixes()).toEqual([]);
+    expect(
+      buildRouterModel(dir, { pageExtensions: ['mdx', 'tsx'] }).listDynamicRoutePrefixes(),
+    ).toEqual(['/docs']);
+  });
 });
 
 describe('buildRouterModel — resolveUrlForFile', () => {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 878073e..8345521 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -58,34 +58,6 @@ importers:
         specifier: ^19.0.0
         version: 19.2.7(react@19.2.7)
 
-  fixtures/config-overrides:
-    dependencies:
-      next:
-        specifier: ^15.1.0
-        version: 15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react:
-        specifier: ^19.0.0
-        version: 19.2.7
-      react-dom:
-        specifier: ^19.0.0
-        version: 19.2.7(react@19.2.7)
-    devDependencies:
-      '@ora-ai/ax':
-        specifier: workspace:*
-        version: link:../../packages/ax
-      '@types/node':
-        specifier: ^20.17.12
-        version: 20.19.43
-      '@types/react':
-        specifier: ^19.0.7
-        version: 19.2.17
-      '@types/react-dom':
-        specifier: ^19.0.3
-        version: 19.2.3(@types/react@19.2.17)
-      typescript:
-        specifier: ^5.7.3
-        version: 5.9.3
-
   fixtures/deploy-variants:
     dependencies:
       next:
@@ -114,34 +86,6 @@ importers:
         specifier: ^5.7.3
         version: 5.9.3
 
-  fixtures/discovery:
-    dependencies:
-      next:
-        specifier: ^15.1.0
-        version: 15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react:
-        specifier: ^19.0.0
-        version: 19.2.7
-      react-dom:
-        specifier: ^19.0.0
-        version: 19.2.7(react@19.2.7)
-    devDependencies:
-      '@ora-ai/ax':
-        specifier: workspace:*
-        version: link:../../packages/ax
-      '@types/node':
-        specifier: ^20.17.12
-        version: 20.19.43
-      '@types/react':
-        specifier: ^19.0.7
-        version: 19.2.17
-      '@types/react-dom':
-        specifier: ^19.0.3
-        version: 19.2.3(@types/react@19.2.17)
-      typescript:
-        specifier: ^5.7.3
-        version: 5.9.3
-
   fixtures/edge-cases:
     dependencies:
       next:
@@ -167,132 +111,17 @@ importers:
         specifier: ^5.7.3
         version: 5.9.3
 
-  fixtures/hybrid:
-    dependencies:
-      next:
-        specifier: ^15.1.0
-        version: 15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react:
-        specifier: ^19.0.0
-        version: 19.2.7
-      react-dom:
-        specifier: ^19.0.0
-        version: 19.2.7(react@19.2.7)
-    devDependencies:
-      '@ora-ai/ax':
-        specifier: workspace:*
-        version: link:../../packages/ax
-      '@types/node':
-        specifier: ^20.17.12
-        version: 20.19.43
-      '@types/react':
-        specifier: ^19.0.7
-        version: 19.2.17
-      '@types/react-dom':
-        specifier: ^19.0.3
-        version: 19.2.3(@types/react@19.2.17)
-      typescript:
-        specifier: ^5.7.3
-        version: 5.9.3
-
-  fixtures/llms-txt:
-    dependencies:
-      next:
-        specifier: ^15.1.0
-        version: 15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react:
-        specifier: ^19.0.0
-        version: 19.2.7
-      react-dom:
-        specifier: ^19.0.0
-        version: 19.2.7(react@19.2.7)
-    devDependencies:
-      '@ora-ai/ax':
-        specifier: workspace:*
-        version: link:../../packages/ax
-      '@types/node':
-        specifier: ^20.17.12
-        version: 20.19.43
-      '@types/react':
-        specifier: ^19.0.7
-        version: 19.2.17
-      '@types/react-dom':
-        specifier: ^19.0.3
-        version: 19.2.3(@types/react@19.2.17)
-      typescript:
-        specifier: ^5.7.3
-        version: 5.9.3
-
-  fixtures/markdown-twins:
-    dependencies:
-      next:
-        specifier: ^15.1.0
-        version: 15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react:
-        specifier: ^19.0.0
-        version: 19.2.7
-      react-dom:
-        specifier: ^19.0.0
-        version: 19.2.7(react@19.2.7)
-    devDependencies:
-      '@ora-ai/ax':
-        specifier: workspace:*
-        version: link:../../packages/ax
-      '@types/node':
-        specifier: ^20.17.12
-        version: 20.19.43
-      '@types/react':
-        specifier: ^19.0.7
-        version: 19.2.17
-      '@types/react-dom':
-        specifier: ^19.0.3
-        version: 19.2.3(@types/react@19.2.17)
-      typescript:
-        specifier: ^5.7.3
-        version: 5.9.3
-
-  fixtures/mcp-adapter:
+  fixtures/flagship:
     dependencies:
-      '@modelcontextprotocol/sdk':
-        specifier: 1.26.0
-        version: 1.26.0(zod@3.25.76)
-      mcp-handler:
-        specifier: ^1.1.0
-        version: 1.1.0(@modelcontextprotocol/sdk@1.26.0(zod@3.25.76))(next@15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
-      next:
+      '@mdx-js/loader':
+        specifier: ^3.1.0
+        version: 3.1.1
+      '@mdx-js/react':
+        specifier: ^3.1.0
+        version: 3.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@next/mdx':
         specifier: ^15.1.0
-        version: 15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react:
-        specifier: ^19.0.0
-        version: 19.2.7
-      react-dom:
-        specifier: ^19.0.0
-        version: 19.2.7(react@19.2.7)
-      zod:
-        specifier: ^3.24.1
-        version: 3.25.76
-    devDependencies:
-      '@ora-ai/ax':
-        specifier: workspace:*
-        version: link:../../packages/ax
-      '@types/node':
-        specifier: ^20.17.12
-        version: 20.19.43
-      '@types/react':
-        specifier: ^19.0.7
-        version: 19.2.17
-      '@types/react-dom':
-        specifier: ^19.0.3
-        version: 19.2.3(@types/react@19.2.17)
-      typescript:
-        specifier: ^5.7.3
-        version: 5.9.3
-
-  fixtures/mcp-adapter-gated:
-    dependencies:
-      '@modelcontextprotocol/sdk':
-        specifier: 1.26.0
-        version: 1.26.0(zod@3.25.76)
+        version: 15.5.23(@mdx-js/loader@3.1.1)(@mdx-js/react@3.1.1(@types/react@19.2.17)(react@19.2.7))
       mcp-handler:
         specifier: ^1.1.0
         version: 1.1.0(@modelcontextprotocol/sdk@1.26.0(zod@3.25.76))(next@15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
@@ -312,6 +141,9 @@ importers:
       '@ora-ai/ax':
         specifier: workspace:*
         version: link:../../packages/ax
+      '@types/mdx':
+        specifier: ^2.0.13
+        version: 2.0.14
       '@types/node':
         specifier: ^20.17.12
         version: 20.19.43
@@ -325,7 +157,7 @@ importers:
         specifier: ^5.7.3
         version: 5.9.3
 
-  fixtures/mcp-multi-server:
+  fixtures/flagship-pages:
     dependencies:
       '@modelcontextprotocol/sdk':
         specifier: 1.26.0
@@ -362,17 +194,8 @@ importers:
         specifier: ^5.7.3
         version: 5.9.3
 
-  fixtures/mdx-content:
+  fixtures/hybrid:
     dependencies:
-      '@mdx-js/loader':
-        specifier: ^3.1.0
-        version: 3.1.1
-      '@mdx-js/react':
-        specifier: ^3.1.0
-        version: 3.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@next/mdx':
-        specifier: ^15.1.0
-        version: 15.5.23(@mdx-js/loader@3.1.1)(@mdx-js/react@3.1.1(@types/react@19.2.17)(react@19.2.7))
       next:
         specifier: ^15.1.0
         version: 15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
@@ -386,9 +209,6 @@ importers:
       '@ora-ai/ax':
         specifier: workspace:*
         version: link:../../packages/ax
-      '@types/mdx':
-        specifier: ^2.0.13
-        version: 2.0.14
       '@types/node':
         specifier: ^20.17.12
         version: 20.19.43
@@ -402,7 +222,7 @@ importers:
         specifier: ^5.7.3
         version: 5.9.3
 
-  fixtures/middleware:
+  fixtures/markdown-twins:
     dependencies:
       next:
         specifier: ^15.1.0
@@ -457,104 +277,14 @@ importers:
         specifier: ^5.7.3
         version: 5.9.3
 
-  fixtures/openapi:
-    dependencies:
-      next:
-        specifier: ^15.1.0
-        version: 15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react:
-        specifier: ^19.0.0
-        version: 19.2.7
-      react-dom:
-        specifier: ^19.0.0
-        version: 19.2.7(react@19.2.7)
-    devDependencies:
-      '@ora-ai/ax':
-        specifier: workspace:*
-        version: link:../../packages/ax
-      '@types/node':
-        specifier: ^20.17.12
-        version: 20.19.43
-      '@types/react':
-        specifier: ^19.0.7
-        version: 19.2.17
-      '@types/react-dom':
-        specifier: ^19.0.3
-        version: 19.2.3(@types/react@19.2.17)
-      typescript:
-        specifier: ^5.7.3
-        version: 5.9.3
-
-  fixtures/pages-bare:
-    dependencies:
-      next:
-        specifier: ^15.1.0
-        version: 15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react:
-        specifier: ^19.0.0
-        version: 19.2.7
-      react-dom:
-        specifier: ^19.0.0
-        version: 19.2.7(react@19.2.7)
-    devDependencies:
-      '@ora-ai/ax':
-        specifier: workspace:*
-        version: link:../../packages/ax
-      '@types/node':
-        specifier: ^20.17.12
-        version: 20.19.43
-      '@types/react':
-        specifier: ^19.0.7
-        version: 19.2.17
-      '@types/react-dom':
-        specifier: ^19.0.3
-        version: 19.2.3(@types/react@19.2.17)
-      typescript:
-        specifier: ^5.7.3
-        version: 5.9.3
-
-  fixtures/pages-mcp:
-    dependencies:
-      '@modelcontextprotocol/sdk':
-        specifier: 1.26.0
-        version: 1.26.0(zod@3.25.76)
-      mcp-handler:
-        specifier: ^1.1.0
-        version: 1.1.0(@modelcontextprotocol/sdk@1.26.0(zod@3.25.76))(next@15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
-      next:
-        specifier: ^15.1.0
-        version: 15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react:
-        specifier: ^19.0.0
-        version: 19.2.7
-      react-dom:
-        specifier: ^19.0.0
-        version: 19.2.7(react@19.2.7)
-      zod:
-        specifier: ^3.24.1
-        version: 3.25.76
-    devDependencies:
-      '@ora-ai/ax':
-        specifier: workspace:*
-        version: link:../../packages/ax
-      '@types/node':
-        specifier: ^20.17.12
-        version: 20.19.43
-      '@types/react':
-        specifier: ^19.0.7
-        version: 19.2.17
-      '@types/react-dom':
-        specifier: ^19.0.3
-        version: 19.2.3(@types/react@19.2.17)
-      typescript:
-        specifier: ^5.7.3
-        version: 5.9.3
-
-  fixtures/pages-webmcp-declarative:
+  fixtures/next-auth:
     dependencies:
       next:
         specifier: ^15.1.0
         version: 15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      next-auth:
+        specifier: ^4.24.11
+        version: 4.24.15(next@15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       react:
         specifier: ^19.0.0
         version: 19.2.7
@@ -578,7 +308,7 @@ importers:
         specifier: ^5.7.3
         version: 5.9.3
 
-  fixtures/webmcp-declarative:
+  fixtures/webmcp:
     dependencies:
       next:
         specifier: ^15.1.0
@@ -606,31 +336,6 @@ importers:
         specifier: ^5.7.3
         version: 5.9.3
 
-  fixtures/webmcp-imperative:
-    dependencies:
-      next:
-        specifier: ^15.1.0
-        version: 15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react:
-        specifier: ^19.0.0
-        version: 19.2.7
-      react-dom:
-        specifier: ^19.0.0
-        version: 19.2.7(react@19.2.7)
-    devDependencies:
-      '@types/node':
-        specifier: ^20.17.12
-        version: 20.19.43
-      '@types/react':
-        specifier: ^19.0.7
-        version: 19.2.17
-      '@types/react-dom':
-        specifier: ^19.0.3
-        version: 19.2.3(@types/react@19.2.17)
-      typescript:
-        specifier: ^5.7.3
-        version: 5.9.3
-
   packages/ax:
     dependencies:
       '@mixmark-io/domino':
@@ -1342,6 +1047,9 @@ packages:
     resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
     engines: {node: '>= 8'}
 
+  '@panva/hkdf@1.2.1':
+    resolution: {integrity: sha512-6oclG6Y3PiDFcoyk8srjLfVKyMfVCKJ27JwNPViuXziFpmdz+MZnZN/aKY0JGXgYuO/VghU0jcOAZgWXZ1Dmrw==}
+
   '@redis/bloom@1.2.0':
     resolution: {integrity: sha512-HG2DFjYKbpNmVXsa0keLHp/3leGJz1mjh09f2RLGGLQZzSHpkmZWuwJbAvo3QcRY8p80m5+ZdXZdYOSBLlp7Cg==}
     peerDependencies:
@@ -2112,6 +1820,9 @@ packages:
     resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==}
     hasBin: true
 
+  jose@4.15.9:
+    resolution: {integrity: sha512-1vUQX+IdDMVPj4k8kOxgUqlcK518yluMuGZwqlr44FS1ppZB/5GWh4rZG89erpOBOJjU/OBsnCVFfapsRz6nEA==}
+
   jose@6.2.3:
     resolution: {integrity: sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw==}
 
@@ -2163,6 +1874,10 @@ packages:
   loupe@3.2.1:
     resolution: {integrity: sha512-CdzqowRJCeLU72bHvWqwRBBlLcMEtIvGrlvef74kMnV2AolS9Y8xUv1I0U/MNAWMhBlKIoyuEgoJ0t/bbwHbLQ==}
 
+  lru-cache@6.0.0:
+    resolution: {integrity: sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==}
+    engines: {node: '>=10'}
+
   magic-string@0.30.21:
     resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
 
@@ -2341,6 +2056,20 @@ packages:
     resolution: {integrity: sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==}
     engines: {node: '>= 0.6'}
 
+  next-auth@4.24.15:
+    resolution: {integrity: sha512-NnjYtjrSOAx/TIVFGTX4IfI/9yHnNpi4B7FuLUwuV20v2Zxgr2OGP/YN0ynJuI7y8QOnTBPitfOdEXZrVvhIuA==}
+    peerDependencies:
+      '@auth/core': 0.34.3
+      next: ^12.2.5 || ^13 || ^14 || ^15 || ^16
+      nodemailer: ^7.0.7
+      react: ^17.0.2 || ^18 || ^19
+      react-dom: ^17.0.2 || ^18 || ^19
+    peerDependenciesMeta:
+      '@auth/core':
+        optional: true
+      nodemailer:
+        optional: true
+
   next@15.5.20:
     resolution: {integrity: sha512-cvyS3/geydan1xLtE3FA8VCgdoQ/Gg/dlOldFkFCbB5VcVYJV7090hQLBnvTW2PwT76Z/dHdzDZCsVhZpoOlUA==}
     engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0}
@@ -2362,14 +2091,25 @@ packages:
       sass:
         optional: true
 
+  oauth@0.9.15:
+    resolution: {integrity: sha512-a5ERWK1kh38ExDEfoO6qUHJb32rd7aYmPHuyCu3Fta/cnICvYmgd2uhuKXvPD+PXB+gCEYYEaQdIRAjCOwAKNA==}
+
   object-assign@4.1.1:
     resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
     engines: {node: '>=0.10.0'}
 
+  object-hash@2.2.0:
+    resolution: {integrity: sha512-gScRMn0bS5fH+IuwyIFgnh9zBdo4DV+6GhygmWM9HyNJSgS0hScp1f5vjtm7oIIOiT9trXrShAkLFSc2IqKNgw==}
+    engines: {node: '>= 6'}
+
   object-inspect@1.13.4:
     resolution: {integrity: sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==}
     engines: {node: '>= 0.4'}
 
+  oidc-token-hash@5.2.0:
+    resolution: {integrity: sha512-6gj2m8cJZ+iSW8bm0FXdGF0YhIQbKrfP4yWTNzxc31U6MOjfEmB1rHvlYvxI1B7t7BCi1F2vYTT6YhtQRG4hxw==}
+    engines: {node: ^10.13.0 || >=12.0.0}
+
   on-finished@2.4.1:
     resolution: {integrity: sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==}
     engines: {node: '>= 0.8'}
@@ -2377,6 +2117,9 @@ packages:
   once@1.4.0:
     resolution: {integrity: sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==}
 
+  openid-client@5.7.1:
+    resolution: {integrity: sha512-jDBPgSVfTnkIh71Hg9pRvtJc6wTwqjRkN88+gCFtYWrlP4Yx2Dsrow8uPi3qLr/aeymPF3o2+dS+wOpglK04ew==}
+
   outdent@0.5.0:
     resolution: {integrity: sha512-/jHxFIzoMXdqPzTaCpFzAAWhpkSjZPF4Vsn6jAfNpmbH/ymsmd7Qc6VE9BGn0L6YMj6uwpQLxCECpus4ukKS9Q==}
 
@@ -2484,6 +2227,19 @@ packages:
     resolution: {integrity: sha512-Mz8SaolMd8nB+G13WkORcxQKHZ/NE4xXevtkJHVuG+guo9/wYKlIMTKAqGdEmYOXR2ijPjTYNHssizdaVSUNdQ==}
     engines: {node: ^10 || ^12 || >=14}
 
+  preact-render-to-string@5.2.6:
+    resolution: {integrity: sha512-JyhErpYOvBV1hEPwIxc/fHWXPfnEGdRKxc8gFdAZ7XV4tlzyzG847XAyEZqoDnynP88akM4eaHcSOzNcLWFguw==}
+    peerDependencies:
+      preact: '>=10'
+
+  preact@10.29.8:
+    resolution: {integrity: sha512-ej2aVZ+vZ8WO7tvlQWRM9N63A0KzF9q4mWJfDUHgYaIofWY9hu74QdnQrjoPMmZi2/nZ5gN0bJCQF49xQqx09Q==}
+    peerDependencies:
+      preact-render-to-string: '>=5'
+    peerDependenciesMeta:
+      preact-render-to-string:
+        optional: true
+
   prettier@2.8.8:
     resolution: {integrity: sha512-tdN8qQGvNjw4CHbY+XXk0JgCXn9QiF21a55rBe5LJAU+kDyC4WQn4+awm2Xfk2lQMk5fKup9XgzTZtGkjBdP9Q==}
     engines: {node: '>=10.13.0'}
@@ -2494,6 +2250,9 @@ packages:
     engines: {node: '>=14'}
     hasBin: true
 
+  pretty-format@3.8.0:
+    resolution: {integrity: sha512-WuxUnVtlWL1OfZFQFuqvnvs6MiAGk9UNsBostyBOB0Is9wb5uRESevA6rnl/rkksXaGX3GzZhPup5d6Vp1nFew==}
+
   property-information@7.2.0:
     resolution: {integrity: sha512-IAtzIB6sUiWaJYrX9smp3V46pBGbBeLFRGdh25kg1334VcBlD8HzhPeNIWQH9zhGmo2itIe25EHt9dQP7G5hmg==}
 
@@ -2842,6 +2601,10 @@ packages:
     resolution: {integrity: sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==}
     engines: {node: '>= 0.8'}
 
+  uuid@11.1.1:
+    resolution: {integrity: sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==}
+    hasBin: true
+
   vary@1.1.2:
     resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
     engines: {node: '>= 0.8'}
@@ -3510,6 +3273,8 @@ snapshots:
       '@nodelib/fs.scandir': 2.1.5
       fastq: 1.20.1
 
+  '@panva/hkdf@1.2.1': {}
+
   '@redis/bloom@1.2.0(@redis/client@1.6.1)':
     dependencies:
       '@redis/client': 1.6.1
@@ -4287,6 +4052,8 @@ snapshots:
 
   jiti@2.7.0: {}
 
+  jose@4.15.9: {}
+
   jose@6.2.3: {}
 
   joycon@3.1.1: {}
@@ -4326,6 +4093,10 @@ snapshots:
 
   loupe@3.2.1: {}
 
+  lru-cache@6.0.0:
+    dependencies:
+      yallist: 4.0.0
+
   magic-string@0.30.21:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
@@ -4686,6 +4457,21 @@ snapshots:
 
   negotiator@1.0.0: {}
 
+  next-auth@4.24.15(next@15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+    dependencies:
+      '@babel/runtime': 7.29.7
+      '@panva/hkdf': 1.2.1
+      cookie: 0.7.2
+      jose: 4.15.9
+      next: 15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      oauth: 0.9.15
+      openid-client: 5.7.1
+      preact: 10.29.8(preact-render-to-string@5.2.6)
+      preact-render-to-string: 5.2.6(preact@10.29.8)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      uuid: 11.1.1
+
   next@15.5.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
       '@next/env': 15.5.20
@@ -4709,10 +4495,16 @@ snapshots:
       - '@babel/core'
       - babel-plugin-macros
 
+  oauth@0.9.15: {}
+
   object-assign@4.1.1: {}
 
+  object-hash@2.2.0: {}
+
   object-inspect@1.13.4: {}
 
+  oidc-token-hash@5.2.0: {}
+
   on-finished@2.4.1:
     dependencies:
       ee-first: 1.1.1
@@ -4721,6 +4513,13 @@ snapshots:
     dependencies:
       wrappy: 1.0.2
 
+  openid-client@5.7.1:
+    dependencies:
+      jose: 4.15.9
+      lru-cache: 6.0.0
+      object-hash: 2.2.0
+      oidc-token-hash: 5.2.0
+
   outdent@0.5.0: {}
 
   p-filter@2.1.0:
@@ -4804,10 +4603,21 @@ snapshots:
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
+  preact-render-to-string@5.2.6(preact@10.29.8):
+    dependencies:
+      preact: 10.29.8(preact-render-to-string@5.2.6)
+      pretty-format: 3.8.0
+
+  preact@10.29.8(preact-render-to-string@5.2.6):
+    optionalDependencies:
+      preact-render-to-string: 5.2.6(preact@10.29.8)
+
   prettier@2.8.8: {}
 
   prettier@3.9.5: {}
 
+  pretty-format@3.8.0: {}
+
   property-information@7.2.0: {}
 
   proxy-addr@2.0.7:
@@ -5260,6 +5070,8 @@ snapshots:
 
   unpipe@1.0.0: {}
 
+  uuid@11.1.1: {}
+
   vary@1.1.2: {}
 
   vfile-message@4.0.3:
diff --git a/scripts/dogfood-middleware.mjs b/scripts/dogfood-middleware.mjs
index 2299d68..2a308f7 100644
--- a/scripts/dogfood-middleware.mjs
+++ b/scripts/dogfood-middleware.mjs
@@ -1,14 +1,17 @@
 #!/usr/bin/env node
-// Dogfood for the @ora-ai/ax/middleware runtime entry: boots the built `middleware` fixture with
+// Dogfood for the @ora-ai/ax/middleware runtime entry: boots the built `flagship` fixture with
 // a real `next start` and probes it over HTTP — the same black-box posture as Ora's
 // markdown-negotiation checks (dual-fetch of one URL with and without `Accept: text/markdown`
 // must return different content types, correct bodies both ways, and `Vary: Accept` on the
 // negotiated response). Unit tests already cover the branch logic; this proves the wiring holds
-// through Next's Edge bundling, header merging, and static file serving on a real server.
+// through Next's Edge bundling, header merging, and static file serving on a real server —
+// including flagship's composed form, `withAx({ manifest }, botGate)`, where the app's own
+// middleware runs for every request ax's negotiation doesn't claim.
 //
 // Run after `pnpm fixtures:build` (the fixture must be built). Probes deliberately avoid the
 // homepage: its twin is generated *post*build, so the first build's manifest doesn't list it yet
-// (documented one-build staleness) — the hand-authored /docs twin is the stable negotiation target.
+// (documented one-build staleness) — the hand-authored /destinations twin is the stable
+// negotiation target.
 
 import { execFile, spawn } from 'node:child_process';
 import { dirname, join } from 'node:path';
@@ -17,7 +20,7 @@ import { promisify } from 'node:util';
 
 const execFileAsync = promisify(execFile);
 
-const fixtureDir = join(dirname(fileURLToPath(import.meta.url)), '..', 'fixtures', 'middleware');
+const fixtureDir = join(dirname(fileURLToPath(import.meta.url)), '..', 'fixtures', 'flagship');
 const port = 3100 + (process.pid % 500);
 const origin = `http://127.0.0.1:${port}`;
 
@@ -91,24 +94,24 @@ try {
   console.log(`middleware dogfood against ${origin}`);
 
   // Ora's markdown-negotiation-vary semantics: the same URL, with and without the Accept header.
-  const html = await probe('/docs', BROWSER_HEADERS);
-  check('browser /docs is HTML', html.contentType.includes('text/html'), html.contentType);
-  check('browser /docs renders the page', html.body.includes('<h1>Docs</h1>'));
+  const html = await probe('/destinations', BROWSER_HEADERS);
+  check('browser /destinations is HTML', html.contentType.includes('text/html'), html.contentType);
+  check('browser /destinations renders the page', html.body.includes('Where we fly'));
 
-  const negotiated = await probe('/docs', { ...BROWSER_HEADERS, accept: 'text/markdown' });
+  const negotiated = await probe('/destinations', { ...BROWSER_HEADERS, accept: 'text/markdown' });
   check(
-    'Accept: text/markdown /docs is markdown',
+    'Accept: text/markdown /destinations is markdown',
     negotiated.contentType.includes('markdown'),
     negotiated.contentType,
   );
   check(
-    'negotiated /docs serves the twin body',
-    negotiated.body.includes('# Docs (hand-authored twin)'),
+    'negotiated /destinations serves the twin body',
+    negotiated.body.includes('# Where we fly (hand-authored twin)'),
   );
-  check('negotiated /docs carries Vary: Accept', varyCoversAccept(negotiated.response));
+  check('negotiated /destinations carries Vary: Accept', varyCoversAccept(negotiated.response));
   check(
-    'negotiated /docs carries the canonical Link back to the HTML URL',
-    /<[^>]*\/docs>;\s*rel="canonical"/.test(negotiated.response.headers.get('link') ?? ''),
+    'negotiated /destinations carries the canonical Link back to the HTML URL',
+    /<[^>]*\/destinations>;\s*rel="canonical"/.test(negotiated.response.headers.get('link') ?? ''),
     negotiated.response.headers.get('link') ?? '(none)',
   );
   check(
@@ -116,36 +119,43 @@ try {
     html.contentType.split(';')[0] !== negotiated.contentType.split(';')[0],
   );
 
-  const agent = await probe('/docs', { 'user-agent': GPTBOT_UA });
+  const agent = await probe('/destinations', { 'user-agent': GPTBOT_UA });
   check(
-    'detected agent /docs gets the markdown twin',
-    agent.body.includes('# Docs (hand-authored twin)'),
+    'detected agent /destinations gets the markdown twin',
+    agent.body.includes('# Where we fly (hand-authored twin)'),
   );
-  check('agent /docs carries Vary: Accept', varyCoversAccept(agent.response));
+  check('agent /destinations carries Vary: Accept', varyCoversAccept(agent.response));
 
   // The two non-optional cloaking guards.
-  const googlebot = await probe('/docs', { 'user-agent': GOOGLEBOT_UA });
-  check('Googlebot /docs is never rerouted', googlebot.body.includes('<h1>Docs</h1>'));
-  const cursorBody = await probeCurl('/docs', {
+  const googlebot = await probe('/destinations', { 'user-agent': GOOGLEBOT_UA });
+  check('Googlebot /destinations is never rerouted', googlebot.body.includes('Where we fly'));
+  const cursorBody = await probeCurl('/destinations', {
     'user-agent': CURSOR_UA,
     'sec-fetch-mode': 'navigate',
     'sec-fetch-dest': 'document',
     accept: BROWSER_HEADERS.accept,
   });
-  check("Cursor's embedded browser gets HTML", cursorBody.includes('<h1>Docs</h1>'));
+  check("Cursor's embedded browser gets HTML", cursorBody.includes('Where we fly'));
 
-  // The manifest is the contract: no twin / gated / dynamic all fall through to the app.
-  const shell = await probe('/shell', { 'user-agent': GPTBOT_UA });
-  check('agent on a twin-less route gets the HTML', shell.contentType.includes('text/html'));
-  const gated = await probe('/private', { 'user-agent': GPTBOT_UA });
+  // The manifest is the contract: gated / dynamic fall through to the app. (The old twin-less
+  // probe lives on in the markdown-twins fixture's /shell rung; every ungated flagship route in
+  // the manifest has a twin.)
+  const gated = await probe('/account', { 'user-agent': GPTBOT_UA });
   check('agent on a gated path is untouched', gated.body.includes('Sign in'));
-  const dynamic = await probe('/blog/hello', { 'user-agent': GPTBOT_UA });
+  const dynamic = await probe('/destinations/jfk', { 'user-agent': GPTBOT_UA });
   check(
     'agent on a dynamic route gets the real page',
     // React SSR interleaves comment markers between text nodes, so never match the joined string.
     dynamic.contentType.includes('text/html') &&
-      dynamic.body.includes('Blog:') &&
-      dynamic.body.includes('hello'),
+      dynamic.body.includes('New York') &&
+      dynamic.body.includes('JFK'),
+  );
+  // flagship's own middleware (the bot gate composed via withAx's second argument) still runs for
+  // requests ax doesn't claim: a scripted UA on a plain page is challenged.
+  const blocked = await probe('/destinations', { 'user-agent': 'curl/8.6.0' });
+  check(
+    'scripted UA is challenged by the composed app middleware',
+    blocked.response.status === 403,
   );
 
   // The 404 doctrine: agents get a 200 wayfinding body, plain clients keep the honest 404.
@@ -158,7 +168,7 @@ try {
     // are guaranteed both before and after the fixture has ever been built twice.
     wayfinding.contentType.includes('markdown') &&
       wayfinding.body.startsWith('# /definitely-not-here — not found') &&
-      wayfinding.body.includes('[/docs](/docs)'),
+      wayfinding.body.includes('[/destinations](/destinations)'),
   );
   check('wayfinding carries Vary: Accept', varyCoversAccept(wayfinding.response));
   const miss = await probe('/definitely-not-here', BROWSER_HEADERS);
diff --git a/scripts/mutation-tests.mjs b/scripts/mutation-tests.mjs
new file mode 100644
index 0000000..f6727bf
--- /dev/null
+++ b/scripts/mutation-tests.mjs
@@ -0,0 +1,404 @@
+#!/usr/bin/env node
+// Multi-build mutation tests over the flagship fixture. The golden layer proves what one build
+// produces; ax is a repo-mutating build tool, so the interesting bugs live in build N+1 —
+// re-appending to robots.txt, clobbering a user-edited scaffold, leaving orphaned twins behind,
+// serving a stale manifest. Each scenario copies the flagship's tracked sources to a tmp dir,
+// builds, applies one scripted mutation, rebuilds, and asserts on the delta (targeted assertions,
+// never a second golden).
+//
+// The copy is sources-only (git ls-files), so every scenario starts from the same fresh-checkout
+// state `pnpm fixtures:clean` guarantees, and the committed fixture is never touched — tests must
+// not mutate the corpus. Dependencies aren't copied or installed: the tmp dir gets ONE absolute
+// symlink to the fixture's own node_modules. pnpm lays fixture deps out as relative symlinks into
+// the workspace store (a plain `cp -R` dangles; `cp -RL` breaks the .bin shims' relative imports),
+// but Node's resolver walks through a symlinked node_modules transparently — and the linked
+// @ora-ai/ax is the workspace package, so the harness always exercises the current dist.
+//
+// Run after `pnpm fixtures:build` (the fixture's node_modules must be linked and ax's dist built).
+
+import { execFile } from 'node:child_process';
+import {
+  cpSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '..');
+const fixtureDir = join(repoRoot, 'fixtures', 'flagship');
+
+// Goldens and docs are inert in a build; leaving them out keeps copies lean and makes clear the
+// harness never compares against them.
+const COPY_SKIP = /^(README\.md|report\.golden\.json|twins\.golden\/|cards\.golden\/)/;
+
+let failures = 0;
+function check(name, condition, detail) {
+  if (condition) {
+    console.log(`  ✓ ${name}`);
+  } else {
+    failures++;
+    console.error(`  ✗ ${name}${detail ? ` — ${detail}` : ''}`);
+  }
+}
+
+async function trackedFixtureFiles() {
+  const { stdout } = await execFileAsync('git', ['ls-files', '--', 'fixtures/flagship'], {
+    cwd: repoRoot,
+  });
+  return stdout
+    .split('\n')
+    .filter(Boolean)
+    .map((p) => relative(join('fixtures', 'flagship'), p))
+    .filter((rel) => !COPY_SKIP.test(rel));
+}
+
+async function makeCopy() {
+  const dir = mkdtempSync(join(tmpdir(), 'ax-mutation-'));
+  for (const rel of await trackedFixtureFiles()) {
+    const target = join(dir, rel);
+    mkdirSync(dirname(target), { recursive: true });
+    cpSync(join(fixtureDir, rel), target);
+  }
+  // The fixture's tsconfig extends the corpus-shared ../tsconfig.next.json; the copy has no
+  // parent, so materialize the base next to it and repoint the extends.
+  cpSync(join(fixtureDir, '..', 'tsconfig.next.json'), join(dir, 'tsconfig.next.json'));
+  edit(dir, 'tsconfig.json', (content) =>
+    content.replace('"../tsconfig.next.json"', '"./tsconfig.next.json"'),
+  );
+  symlinkSync(join(fixtureDir, 'node_modules'), join(dir, 'node_modules'), 'dir');
+  return dir;
+}
+
+// The fixture's own build pipeline, step by step: prebuild `ax manifest`, `next build`,
+// postbuild `ax --report --yes` — the same technique as dogfood-middleware.mjs (call the bins
+// directly, bypass pnpm).
+async function build(dir) {
+  const bin = (name) => join(dir, 'node_modules', '.bin', name);
+  const options = {
+    cwd: dir,
+    env: { ...process.env, NEXT_TELEMETRY_DISABLED: '1' },
+    maxBuffer: 64 * 1024 * 1024,
+  };
+  await execFileAsync(bin('ax'), ['manifest'], options);
+  await execFileAsync(bin('next'), ['build'], options);
+  await execFileAsync(bin('ax'), ['--report', '--yes'], options);
+}
+
+// The same normalization verify-report-snapshots.mjs applies: strip the copy's absolute root from
+// every path, redact the wall-clock timestamp. What's left must be byte-stable across rebuilds.
+function normalizedReport(dir) {
+  let raw = readFileSync(join(dir, '.ora', 'report.json'), 'utf8');
+  // macOS tmpdirs surface under both /var/... and the /private/var/... realpath.
+  for (const root of [dir, join('/private', dir)]) raw = raw.split(`${root}/`).join('');
+  const obj = JSON.parse(raw);
+  obj.generatedAt = '<generatedAt>';
+  return JSON.stringify(obj, null, 2);
+}
+
+// Every ax-generated markdown file under public/ (generated-by marker), normalized like the
+// snapshot layer normalizes twins (the frontmatter build timestamp is the one varying field).
+function normalizedTwins(dir) {
+  const publicDir = join(dir, 'public');
+  const files = new Map();
+  const stack = existsSync(publicDir) ? [publicDir] : [];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    for (const name of readdirSync(current)) {
+      const abs = join(current, name);
+      if (statSync(abs).isDirectory()) stack.push(abs);
+      else if (name.endsWith('.md')) {
+        const content = readFileSync(abs, 'utf8');
+        if (/^generated-by:\s*"@ora-ai\/ax"$/m.test(content)) {
+          files.set(
+            relative(publicDir, abs),
+            content.replace(/^last_updated: .*$/m, 'last_updated: <last_updated>'),
+          );
+        }
+      }
+    }
+  }
+  return files;
+}
+
+function edit(dir, rel, transform) {
+  const path = join(dir, rel);
+  writeFileSync(path, transform(readFileSync(path, 'utf8')), 'utf8');
+}
+
+async function scenario(name, run) {
+  console.log(`\n${name}`);
+  const dir = await makeCopy();
+  try {
+    await run(dir);
+  } catch (error) {
+    failures++;
+    console.error(`  ✗ scenario crashed — ${error?.message ?? error}`);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+await scenario(
+  'idempotence: a no-change rebuild is byte-stable and append-only writes never double',
+  async (dir) => {
+    // Strip the committed robots block so build 1 exercises the real append path (in the committed
+    // fixture the block is pre-applied precisely so in-tree builds are no-ops).
+    edit(dir, join('public', 'robots.txt'), (content) =>
+      content.replace(/\n# Added by @ora-ai\/ax[^\n]*\n(?:(?:Agentmap|Sitemap):[^\n]*\n?)*/g, '\n'),
+    );
+
+    // Build 1 bootstraps; build 2 is the steady state. The two are NOT byte-identical by design:
+    // 404.md is generated before the first build's catalog exists (the documented one-build
+    // staleness), so it fills in on build 2. Idempotence is asserted where it must hold: build 3
+    // against build 2.
+    await build(dir);
+    const robotsAfterFirst = readFileSync(join(dir, 'public', 'robots.txt'), 'utf8');
+    check(
+      'build 1 appends exactly one Agentmap pointer',
+      robotsAfterFirst.match(/^Agentmap:/gm)?.length === 1,
+    );
+
+    await build(dir);
+    const steadyReport = normalizedReport(dir);
+    const steadyTwins = normalizedTwins(dir);
+
+    await build(dir);
+    const robotsAfterThird = readFileSync(join(dir, 'public', 'robots.txt'), 'utf8');
+    check('rebuilds never re-append to robots.txt', robotsAfterThird === robotsAfterFirst);
+    check(
+      'the normalized report is byte-identical across steady-state rebuilds',
+      normalizedReport(dir) === steadyReport,
+    );
+    const thirdTwins = normalizedTwins(dir);
+    check(
+      'every generated twin is byte-identical across steady-state rebuilds',
+      thirdTwins.size === steadyTwins.size &&
+        [...steadyTwins].every(([rel, content]) => thirdTwins.get(rel) === content),
+    );
+    // Regression guard: the stale-twin sweep once misclassified ax's own 404.md as an orphaned
+    // twin on every build after the first (deleted + rewritten in the same run, phantom entry).
+    const report = JSON.parse(readFileSync(join(dir, '.ora', 'report.json'), 'utf8'));
+    check(
+      'a rebuild deletes nothing when nothing changed',
+      report.markdownTwins.deleted.length === 0,
+      JSON.stringify(report.markdownTwins.deleted),
+    );
+  },
+);
+
+await scenario(
+  'auth-method change: the declared status tracks api_key -> oauth2 across builds',
+  async (dir) => {
+    // The declared descriptor is the published answer for the gated MCP server: it must propagate
+    // to the report, the catalog entry, and auth.md on every build — and flipping it must leave
+    // no remnant of the previous method behind. Build 1 declares api_key, build 2 flips back to
+    // oauth2, covering both directions of the change.
+    const readAuthState = () => {
+      const report = JSON.parse(readFileSync(join(dir, '.ora', 'report.json'), 'utf8'));
+      const catalog = JSON.parse(
+        readFileSync(join(dir, 'public', '.well-known', 'ai-catalog.json'), 'utf8'),
+      );
+      const entry = catalog.entries.find((e) => e.identifier.endsWith(':mcp-server:api-mcp'));
+      return {
+        surface: report.auth.gatedSurfaces.find((s) => s.path === '/api/mcp'),
+        entryStatus: entry?.auth?.status,
+        authMd: readFileSync(join(dir, 'public', 'auth.md'), 'utf8'),
+        unreviewedMounts: report.mcp.unreviewedMounts,
+      };
+    };
+
+    edit(dir, 'ax.config.ts', (content) =>
+      content.replace("status: 'oauth2',", "status: 'api_key',"),
+    );
+    await build(dir);
+    const first = readAuthState();
+    check('build 1 report declares api_key', first.surface?.status === 'api_key');
+    check('build 1 catalog entry carries api_key', first.entryStatus === 'api_key');
+    check(
+      'build 1 auth.md names the API key method only',
+      first.authMd.includes('API key') && !first.authMd.includes('OAuth 2.0'),
+    );
+
+    edit(dir, 'ax.config.ts', (content) =>
+      content.replace("status: 'api_key',", "status: 'oauth2',"),
+    );
+    await build(dir);
+    const second = readAuthState();
+    check('build 2 report declares oauth2', second.surface?.status === 'oauth2');
+    check('build 2 catalog entry carries oauth2', second.entryStatus === 'oauth2');
+    check(
+      'build 2 auth.md names the OAuth method with no api_key remnant',
+      second.authMd.includes('OAuth 2.0') && !second.authMd.includes('API key'),
+    );
+    // The flip must never re-open the review gate: a config-declared auth marks its mount
+    // reviewed (the committed ax.config.ts IS the recorded decision), so headless builds stay
+    // unattended across auth changes — no prompt, no unreviewed action item.
+    check(
+      'a declared auth change leaves no unreviewed mounts behind',
+      first.unreviewedMounts.length === 0 && second.unreviewedMounts.length === 0,
+      JSON.stringify([first.unreviewedMounts, second.unreviewedMounts]),
+    );
+  },
+);
+
+await scenario(
+  'user-edit preservation: a filled-in scaffold TODO survives the next build',
+  async (dir) => {
+    // Remove the hand-owned llms.txt and opt into the scaffold, so build 1 generates the starter.
+    rmSync(join(dir, 'app', 'llms.txt'), { recursive: true, force: true });
+    edit(dir, 'ax.config.ts', (content) =>
+      content.replace('scaffoldRobots: true,', 'scaffoldRobots: true,\n  scaffoldLlmsTxt: true,'),
+    );
+
+    await build(dir);
+    const scaffoldPath = join(dir, 'app', 'llms.txt', 'route.ts');
+    check('build 1 scaffolds app/llms.txt/route.ts', existsSync(scaffoldPath));
+    check(
+      'the scaffold ships its TODO placeholders',
+      readFileSync(scaffoldPath, 'utf8').includes('TODO'),
+    );
+
+    const humanLine = '- Compare demo fares for a route before recommending an itinerary.';
+    edit(dir, join('app', 'llms.txt', 'route.ts'), (content) =>
+      content.replace('- TODO: a task an agent should use this site for', humanLine),
+    );
+
+    await build(dir);
+    const afterRebuild = readFileSync(scaffoldPath, 'utf8');
+    check('the human-edited line survives build 2 verbatim', afterRebuild.includes(humanLine));
+    check(
+      'the replaced TODO line does not come back',
+      !afterRebuild.includes('- TODO: a task an agent should use this site for'),
+    );
+  },
+);
+
+await scenario(
+  'staleness: deleting a page removes its orphaned twin and manifest entry',
+  async (dir) => {
+    await build(dir);
+    check('build 1 generates the /results twin', existsSync(join(dir, 'public', 'results.md')));
+
+    rmSync(join(dir, 'app', 'results'), { recursive: true, force: true });
+
+    await build(dir);
+    check(
+      'the orphaned twin is deleted on build 2',
+      !existsSync(join(dir, 'public', 'results.md')),
+    );
+    const manifest = readFileSync(join(dir, 'ax-manifest.ts'), 'utf8');
+    check(
+      'the manifest no longer lists /results',
+      !manifest.includes("'/results'") && !manifest.includes('"/results"'),
+    );
+  },
+);
+
+await scenario(
+  'additive: a new page and a new MCP tool land in twins, cards, and the report',
+  async (dir) => {
+    await build(dir);
+    const cardPath = join(dir, 'public', '.well-known', 'mcp', 'server-card.json');
+    check(
+      'build 1 card carries only search_flights',
+      JSON.parse(readFileSync(cardPath, 'utf8'))
+        .tools.map((t) => t.name)
+        .join(',') === 'search_flights',
+    );
+
+    mkdirSync(join(dir, 'app', 'press'), { recursive: true });
+    writeFileSync(
+      join(dir, 'app', 'press', 'page.tsx'),
+      `export const metadata = {
+  title: 'Press — Ora Air',
+  description: 'Press resources and media contacts for the Ora Air demo.',
+};
+
+export default function PressPage() {
+  return (
+    <main>
+      <h1>Press</h1>
+      <p>
+        Ora Air is a demonstration airline used to exercise agent booking flows end-to-end. For
+        media inquiries about the demo, its route network, or the booking tools it exposes to
+        agents, use the contact address in the agent guide.
+      </p>
+      <p>
+        Facts and figures: twelve airports across eight countries, one-way fares only, and a test
+        payment card that always settles. No real inventory is represented anywhere in the app.
+      </p>
+    </main>
+  );
+}
+`,
+      'utf8',
+    );
+    edit(dir, join('app', 'api', 'public', '[transport]', 'route.ts'), (content) =>
+      content.replace(
+        '  (server) => {',
+        `  (server) => {
+    server.tool(
+      "get_baggage_policy",
+      "Get the checked and carry-on baggage policy for a fare class.",
+      { fareClass: z.string().describe("Fare class code, e.g. 'Y', 'W', 'J'") },
+      async ({ fareClass }) => ({
+        content: [{ type: "text", text: \`Fare \${fareClass}: 1 carry-on, 1 checked bag.\` }],
+      })
+    );
+`,
+      ),
+    );
+
+    await build(dir);
+    check('the new page gains a twin on build 2', existsSync(join(dir, 'public', 'press.md')));
+    const tools = JSON.parse(readFileSync(cardPath, 'utf8')).tools.map((t) => t.name);
+    check(
+      'the new tool lands in the public server card',
+      tools.includes('get_baggage_policy'),
+      tools.join(','),
+    );
+    const report = JSON.parse(readFileSync(join(dir, '.ora', 'report.json'), 'utf8'));
+    const publicMount = report.mcp.mounts.find((m) => m.pathname === '/api/public/mcp');
+    check(
+      'the new tool lands in report.mcp.mounts',
+      publicMount?.tools.includes('get_baggage_policy'),
+    );
+    const manifest = readFileSync(join(dir, 'ax-manifest.ts'), 'utf8');
+    check('the postbuild-refreshed manifest lists the new twin', manifest.includes('/press.md'));
+  },
+);
+
+await scenario(
+  'manifest drift: removing the gated page refreshes gatedPaths via the prebuild',
+  async (dir) => {
+    await build(dir);
+    check(
+      'build 1 manifest gates /account',
+      readFileSync(join(dir, 'ax-manifest.ts'), 'utf8').includes('/account'),
+    );
+
+    rmSync(join(dir, 'app', 'account'), { recursive: true, force: true });
+
+    await build(dir);
+    const manifest = readFileSync(join(dir, 'ax-manifest.ts'), 'utf8');
+    check('build 2 manifest no longer knows /account at all', !manifest.includes('/account'));
+  },
+);
+
+if (failures > 0) {
+  console.error(`\n${failures} mutation probe(s) failed.`);
+  process.exit(1);
+}
+console.log('\nAll mutation probes passed.');
diff --git a/spec/ard/README.md b/spec/ard/README.md
index 5830709..1d713cb 100644
--- a/spec/ard/README.md
+++ b/spec/ard/README.md
@@ -47,7 +47,7 @@ upstream moves, bump the pinned commit above, re-vendor all three files, and rec
 
 ```sh
 # One fixture's generated catalog (pip install jsonschema first for the strict schema check):
-./spec/ard/conformance/bin/conformance-test manifest fixtures/openapi/public/.well-known/ai-catalog.json
+./spec/ard/conformance/bin/conformance-test manifest fixtures/flagship/public/.well-known/ai-catalog.json
 
 # All fixture catalogs (what CI runs):
 pnpm conformance