fix(public): render the signup rejection signal on the homepage

public/index.css

@@ -54,6 +54,11 @@
     box-shadow:0 6px 18px -8px rgba(25,20,16,.6);
     transition:transform var(--mid) var(--ease),box-shadow var(--mid) var(--ease)}
   form button:hover{transform:translateY(-1.5px)}
+  .signal{display:block;margin:18px auto 0;max-width:500px;padding:10px 18px;font-size:14px;line-height:1.6;
+    color:var(--sig);background:rgba(255,253,248,.74);border:1px solid rgba(176,74,46,.35);
+    border-radius:12px;text-align:center}
+  .signal[hidden]{display:none}
+  .signal:focus{outline:none}
   .micro{margin-top:16px;font-size:13.5px;color:var(--muted)}
   .meta{margin:54px auto 0;max-width:900px;display:grid;grid-template-columns:repeat(3,1fr);
     border-top:1px solid var(--hair);padding-top:22px}

public/index.html

@@ -71,6 +71,7 @@
     <div class="orn"><i></i><span class="sc">The appraisal</span><b></b><i></i></div>
     <h1>Most of them leave <em>before they ever get in touch.</em></h1>
     <p class="sub">We read the one page your revenue depends on the way a customer with intent reads it, and show you the exact points at which they go.</p>
+    <p class="signal" id="signal-invalid" role="alert" tabindex="-1" hidden>We could not save that request — the email address did not pass. Check it and try again.</p>
     <form class="lead two" id="start" action="/api/signups" method="post">
       <input type="text" name="website" required inputmode="url" autocomplete="url" placeholder="yourwebsite.com" aria-label="Your website domain" pattern="(https?://)?([a-zA-Z0-9\-]+\.)+[a-zA-Z]{2,}(:[0-9]+)?(/[^\s]*)?" title="Enter your domain, like example.com">
       <input type="email" name="email" required placeholder="Your work email" aria-label="Your work email">

public/index.js

@@ -17,3 +17,21 @@
   }
   document.readyState==='loading'?document.addEventListener('DOMContentLoaded',run):run();
 })();
+
+// Signup rejection signal: the worker 303-redirects failed signups back to
+// /?signal=invalid (the homepage form and the /audit form both post to
+// /api/signups). No page code used to read that signal, so a visitor whose
+// email the server rejected (the server regex is stricter than the browser's
+// type=email check — e.g. "a@b" passes client-side but not server-side) was
+// silently bounced to the homepage with no explanation. Reveal the banner,
+// move focus to it for assistive tech, then strip the query so a refresh
+// (or a copied link) does not re-show the error.
+(function(){
+  var match=(location.search||'').match(/[?&]signal=([^&]+)/);
+  if(!match)return;
+  var banner=document.getElementById('signal-invalid');
+  if(!banner)return;
+  banner.hidden=false;
+  banner.focus();
+  if(history.replaceState)history.replaceState(null,'',location.pathname+location.hash);
+})();

scripts/check-site.mjs

@@ -293,6 +293,46 @@ for (const [pageName, pageHtml] of [["homepage", siteHome], ["audit page", siteA
   }
 }
 
+// Signup rejection-signal guard (dogfood: failed-signup dead end). The worker
+// 303-redirects a rejected signup back to /?signal=invalid (the server email
+// regex is stricter than the browser's type=email check — e.g. "a@b" passes
+// client-side but not server-side), so the homepage must render that state:
+// a role=alert banner, hidden until index.js reads the signal, moves focus
+// into it, and strips the query so a refresh or a copied link does not
+// re-show the error. These are STATIC SOURCE GUARDS, not behavioral tests.
+const signalBanner = siteHome.match(/<p\b[^>]*id="signal-invalid"[^>]*>/i)?.[0] || "";
+if (!signalBanner) {
+  failures.push("Homepage must carry the id=\"signal-invalid\" signup rejection banner.");
+} else {
+  if (!/\brole="alert"/i.test(signalBanner)) {
+    failures.push("Signup rejection banner must expose role=\"alert\".");
+  }
+  if (!/\bhidden(?:\s|>|=)/i.test(signalBanner)) {
+    failures.push("Signup rejection banner must start hidden (revealed only by the signal handler).");
+  }
+}
+const homeScript = read("public/index.js");
+if (!homeScript.includes("signal-invalid")) {
+  failures.push("index.js must reference the signal-invalid banner.");
+}
+if (!/signal=([^&]+)/.test(homeScript)) {
+  failures.push("index.js must read the ?signal= query parameter.");
+}
+if (!homeScript.includes("replaceState")) {
+  failures.push("index.js must strip the signal query with history.replaceState after revealing the banner.");
+}
+const homeCss = read("public/index.css");
+if (!/\.signal\b/.test(homeCss)) {
+  failures.push("index.css must style the signup rejection banner (.signal).");
+}
+if (!/\.signal\[hidden\]\s*\{[^}]*display:\s*none/i.test(homeCss)) {
+  failures.push(".signal[hidden] must force display:none so the banner stays hidden until revealed.");
+}
+if (!worker.includes("htmlRedirect(url, \"invalid\")")) {
+  failures.push("Worker must keep 303-redirecting rejected signups to /?signal=invalid (the homepage banner renders it).");
+}
+
+
 if (!retiredDesk.includes("role=\"tabpanel\"") || !retiredDesk.includes("aria-labelledby=\"output-tab-pipelineBrief\"")) {
   failures.push("Agent output must expose a proper tabpanel relationship.");
 }

scripts/test-agent-worker.mjs

@@ -1089,6 +1089,34 @@ test("legacy /api/agent-audit still labels its rows with the retired self-serve
   assert.equal(runInsert.values[2], "agent-self-serve", "the legacy run keeps its own source label");
 });
 
+test("signup handler redirects a rejected email to /?signal=invalid so the homepage can render it", async () => {
+  // The browser's type=email accepts "a@b", but the worker's stricter regex
+  // requires a dot in the domain. The rejection must 303 back to the homepage
+  // with ?signal=invalid (rendered by public/index.js), not fail silently.
+  const db = new FakeDB();
+  const env = { DB: db, AI: new FakeAI("") };
+  const res = await worker.fetch(
+    new Request("https://tinystudio.io/api/signups", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        "Origin": "https://tinystudio.io",
+        "Accept": "text/html",
+        "User-Agent": "tinystudio-worker-test"
+      },
+      body: new URLSearchParams({ website: "example.com", email: "a@b" }).toString()
+    }),
+    env
+  );
+
+  assert.equal(res.status, 303);
+  const location = new URL(res.headers.get("Location"));
+  assert.equal(location.pathname, "/");
+  assert.equal(location.searchParams.get("signal"), "invalid");
+  const insert = db.calls.find((call) => call.sql.includes("INSERT INTO email_signups"));
+  assert.equal(insert, undefined, "rejected signup must not persist a row");
+});
+
 test("worker serves the same-origin font promotion script (render-blocking fix b8f6046e942a)", async () => {
   // The production CSP (script-src 'self', no unsafe-inline) blocks inline
   // onload handlers, so the pages promote the preloaded Google Fonts css2