diff --git a/.github/workflows/REVIEW.md b/.github/workflows/REVIEW.md
index b699bf4d25..6e82aeae14 100644
--- a/.github/workflows/REVIEW.md
+++ b/.github/workflows/REVIEW.md
@@ -10,8 +10,13 @@ such step enforces its rule automatically, with no reviewer involved -
 `skills/internal/preflight.md` sec."doc.yml - the gates", sec."extended_checks.yml".
 
 **A diff that adds or changes a per-PR gate step - a workflow step that runs on
-`pull_request` and fails the lane when it finds a defect - makes that step fail on every
-defect in what it checks, and on nothing else.**
+`pull_request` and fails the lane when it finds a defect - makes the step's failure the
+lane's failure: no `continue-on-error`, no trailing `|| true`, no swallowed exit code.**
+
+**A diff that adds or changes a per-PR gate step states a run of that step's command on the
+lane's platform in its PR body or commit message; a green run of that lane on the PR's head
+commit is that evidence.** A step that fails for a non-defect turns a green branch red for
+everyone.
 
 **A diff that adds or changes a step in `pages.yml` that names the deployed games writes
 that list as a `for g in <ids>; do` loop.** `examples/games/REVIEW.das` (repo root) reads
diff --git a/.github/workflows/extended_checks.yml b/.github/workflows/extended_checks.yml
index 5b47030bbe..2849bc01e2 100644
--- a/.github/workflows/extended_checks.yml
+++ b/.github/workflows/extended_checks.yml
@@ -523,6 +523,7 @@ jobs:
       run: |
         set -eux
         python3 utils/watchdog/test_tray_state.py
+        python3 utils/watchdog/test_consent.py
 
     - name: "Test pip wheel repack (python)"
       if: matrix.target == 'linux'
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 1d6f69304a..4ac7ca5709 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -571,7 +571,8 @@ jobs:
         cp site-dasllama/robots.txt _site_dasllama/
         cp site-dasllama/sitemap.xml _site_dasllama/
         cp site-dasllama/feed.xml _site_dasllama/
-        cp site-dasllama/files/* _site_dasllama/files/
+        # -R: files/ now carries subdirectories (files/fonts/); a bare * would fail on them
+        cp -R site-dasllama/files/. _site_dasllama/files/
 
         # Shared visual language, staged from the daslang.io tree — single source
         # in the repo, mirrored by site-dasllama/serve.py for local preview.
diff --git a/LICENSE b/LICENSE
index 9f90a8ccef..314e897df9 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,6 +1,6 @@
 BSD 3-Clause License
 
-Copyright (c) 2018-2026, Gaijin Entertainment
+Copyright (c) 2018-2026, Gaijin Games Kft.
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
diff --git a/doc/source/_static/custom.css b/doc/source/_static/custom.css
index 878e1f187d..d8b34e6ce9 100644
--- a/doc/source/_static/custom.css
+++ b/doc/source/_static/custom.css
@@ -8,7 +8,7 @@
 /* `@import` must precede all other rules (CSS 2.1 §6.3) — keeping this
  * at the top of the file so browsers actually fetch the web fonts. A
  * later `@import` after `:root` would be silently dropped. */
-@import url('https://fonts.googleapis.com/css2?family=Inter+Tight:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&family=JetBrains+Mono:wght@400;500;600;700&display=swap');
+@import url('fonts/fonts.css');
 
 :root {
     --bg:        #0d0c0a;
@@ -433,3 +433,13 @@ footer a { color: var(--fg-dim) !important; }
 .highlight .n                                     { color: var(--fg); }
 .highlight .o, .highlight .p                      { color: var(--fg-dim); }
 .highlight .err                                   { color: var(--red); background: transparent; border: none; }
+
+/* LEGAL footer links (layout.html footer block) */
+.forge-legal-links {
+    margin-top: 8px;
+    font-size: 90%;
+    color: var(--fg-faint);
+}
+.forge-legal-links a {
+    color: inherit;
+}
diff --git a/doc/source/_static/fonts/InterTight-italic-cyrillic-ext.woff2 b/doc/source/_static/fonts/InterTight-italic-cyrillic-ext.woff2
new file mode 100644
index 0000000000..83c2eff740
Binary files /dev/null and b/doc/source/_static/fonts/InterTight-italic-cyrillic-ext.woff2 differ
diff --git a/doc/source/_static/fonts/InterTight-italic-cyrillic.woff2 b/doc/source/_static/fonts/InterTight-italic-cyrillic.woff2
new file mode 100644
index 0000000000..70552d21a2
Binary files /dev/null and b/doc/source/_static/fonts/InterTight-italic-cyrillic.woff2 differ
diff --git a/doc/source/_static/fonts/InterTight-italic-greek-ext.woff2 b/doc/source/_static/fonts/InterTight-italic-greek-ext.woff2
new file mode 100644
index 0000000000..c81a4e55a9
Binary files /dev/null and b/doc/source/_static/fonts/InterTight-italic-greek-ext.woff2 differ
diff --git a/doc/source/_static/fonts/InterTight-italic-greek.woff2 b/doc/source/_static/fonts/InterTight-italic-greek.woff2
new file mode 100644
index 0000000000..95d91ab686
Binary files /dev/null and b/doc/source/_static/fonts/InterTight-italic-greek.woff2 differ
diff --git a/doc/source/_static/fonts/InterTight-italic-latin-ext.woff2 b/doc/source/_static/fonts/InterTight-italic-latin-ext.woff2
new file mode 100644
index 0000000000..12f8e8f5a5
Binary files /dev/null and b/doc/source/_static/fonts/InterTight-italic-latin-ext.woff2 differ
diff --git a/doc/source/_static/fonts/InterTight-italic-latin.woff2 b/doc/source/_static/fonts/InterTight-italic-latin.woff2
new file mode 100644
index 0000000000..870e9b5982
Binary files /dev/null and b/doc/source/_static/fonts/InterTight-italic-latin.woff2 differ
diff --git a/doc/source/_static/fonts/InterTight-italic-vietnamese.woff2 b/doc/source/_static/fonts/InterTight-italic-vietnamese.woff2
new file mode 100644
index 0000000000..072774eca7
Binary files /dev/null and b/doc/source/_static/fonts/InterTight-italic-vietnamese.woff2 differ
diff --git a/doc/source/_static/fonts/InterTight-normal-cyrillic-ext.woff2 b/doc/source/_static/fonts/InterTight-normal-cyrillic-ext.woff2
new file mode 100644
index 0000000000..23a7b3eede
Binary files /dev/null and b/doc/source/_static/fonts/InterTight-normal-cyrillic-ext.woff2 differ
diff --git a/doc/source/_static/fonts/InterTight-normal-cyrillic.woff2 b/doc/source/_static/fonts/InterTight-normal-cyrillic.woff2
new file mode 100644
index 0000000000..f0a04608af
Binary files /dev/null and b/doc/source/_static/fonts/InterTight-normal-cyrillic.woff2 differ
diff --git a/doc/source/_static/fonts/InterTight-normal-greek-ext.woff2 b/doc/source/_static/fonts/InterTight-normal-greek-ext.woff2
new file mode 100644
index 0000000000..68cbfb4227
Binary files /dev/null and b/doc/source/_static/fonts/InterTight-normal-greek-ext.woff2 differ
diff --git a/doc/source/_static/fonts/InterTight-normal-greek.woff2 b/doc/source/_static/fonts/InterTight-normal-greek.woff2
new file mode 100644
index 0000000000..0d638f0024
Binary files /dev/null and b/doc/source/_static/fonts/InterTight-normal-greek.woff2 differ
diff --git a/doc/source/_static/fonts/InterTight-normal-latin-ext.woff2 b/doc/source/_static/fonts/InterTight-normal-latin-ext.woff2
new file mode 100644
index 0000000000..8df773db33
Binary files /dev/null and b/doc/source/_static/fonts/InterTight-normal-latin-ext.woff2 differ
diff --git a/doc/source/_static/fonts/InterTight-normal-latin.woff2 b/doc/source/_static/fonts/InterTight-normal-latin.woff2
new file mode 100644
index 0000000000..228154ffb1
Binary files /dev/null and b/doc/source/_static/fonts/InterTight-normal-latin.woff2 differ
diff --git a/doc/source/_static/fonts/InterTight-normal-vietnamese.woff2 b/doc/source/_static/fonts/InterTight-normal-vietnamese.woff2
new file mode 100644
index 0000000000..d08a67efd6
Binary files /dev/null and b/doc/source/_static/fonts/InterTight-normal-vietnamese.woff2 differ
diff --git a/doc/source/_static/fonts/JetBrainsMono-normal-cyrillic-ext.woff2 b/doc/source/_static/fonts/JetBrainsMono-normal-cyrillic-ext.woff2
new file mode 100644
index 0000000000..024a1af5eb
Binary files /dev/null and b/doc/source/_static/fonts/JetBrainsMono-normal-cyrillic-ext.woff2 differ
diff --git a/doc/source/_static/fonts/JetBrainsMono-normal-cyrillic.woff2 b/doc/source/_static/fonts/JetBrainsMono-normal-cyrillic.woff2
new file mode 100644
index 0000000000..1b61cf966c
Binary files /dev/null and b/doc/source/_static/fonts/JetBrainsMono-normal-cyrillic.woff2 differ
diff --git a/doc/source/_static/fonts/JetBrainsMono-normal-greek.woff2 b/doc/source/_static/fonts/JetBrainsMono-normal-greek.woff2
new file mode 100644
index 0000000000..06f0936048
Binary files /dev/null and b/doc/source/_static/fonts/JetBrainsMono-normal-greek.woff2 differ
diff --git a/doc/source/_static/fonts/JetBrainsMono-normal-latin-ext.woff2 b/doc/source/_static/fonts/JetBrainsMono-normal-latin-ext.woff2
new file mode 100644
index 0000000000..310faddfdd
Binary files /dev/null and b/doc/source/_static/fonts/JetBrainsMono-normal-latin-ext.woff2 differ
diff --git a/doc/source/_static/fonts/JetBrainsMono-normal-latin.woff2 b/doc/source/_static/fonts/JetBrainsMono-normal-latin.woff2
new file mode 100644
index 0000000000..2ca6ac6059
Binary files /dev/null and b/doc/source/_static/fonts/JetBrainsMono-normal-latin.woff2 differ
diff --git a/doc/source/_static/fonts/JetBrainsMono-normal-vietnamese.woff2 b/doc/source/_static/fonts/JetBrainsMono-normal-vietnamese.woff2
new file mode 100644
index 0000000000..d37ea35987
Binary files /dev/null and b/doc/source/_static/fonts/JetBrainsMono-normal-vietnamese.woff2 differ
diff --git a/doc/source/_static/fonts/fonts.css b/doc/source/_static/fonts/fonts.css
new file mode 100644
index 0000000000..1462ddfea1
--- /dev/null
+++ b/doc/source/_static/fonts/fonts.css
@@ -0,0 +1,180 @@
+/* cyrillic-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-cyrillic-ext.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-cyrillic.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-greek-ext.woff2) format('woff2');
+  unicode-range: U+1F00-1FFF;
+}
+/* greek */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-greek.woff2) format('woff2');
+  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-vietnamese.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-latin-ext.woff2) format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-latin.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+/* cyrillic-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-cyrillic-ext.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-cyrillic.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-greek-ext.woff2) format('woff2');
+  unicode-range: U+1F00-1FFF;
+}
+/* greek */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-greek.woff2) format('woff2');
+  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-vietnamese.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-latin-ext.woff2) format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-latin.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+/* cyrillic-ext */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-cyrillic-ext.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-cyrillic.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-greek.woff2) format('woff2');
+  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-vietnamese.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-latin-ext.woff2) format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-latin.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
diff --git a/doc/source/_templates/layout.html b/doc/source/_templates/layout.html
index 114e53fc32..1af3c6a248 100644
--- a/doc/source/_templates/layout.html
+++ b/doc/source/_templates/layout.html
@@ -47,3 +47,14 @@
   <div id="docsearch"></div>
 
 {%- endblock %}
+
+{# LEGAL links block — GDPR/EU distributor requirement: Terms, Privacy, license
+   reachable from every docs page. Rendered under the theme footer. #}
+{%- block footer %}
+  {{ super() }}
+  <div class="forge-legal-links">
+    <a href="https://legal.gaijin.net/termsofservice" rel="nofollow">Terms of Service</a> ·
+    <a href="https://legal.gaijin.net/privacypolicy" rel="nofollow">Privacy Policy</a> ·
+    <a href="https://github.com/GaijinEntertainment/daScript/blob/master/LICENSE">BSD 3-Clause License</a>
+  </div>
+{%- endblock %}
diff --git a/doc/source/reference/utils/dasllama_server.rst b/doc/source/reference/utils/dasllama_server.rst
index 28aede34e5..b8238ac285 100644
--- a/doc/source/reference/utils/dasllama_server.rst
+++ b/doc/source/reference/utils/dasllama_server.rst
@@ -189,6 +189,9 @@ Endpoints
    * - ``POST``
      - ``/exchange/retune``
      - Arm a local re-tune and restart — the next boot races this box
+   * - ``POST``
+     - ``/exchange/consent``
+     - ``{"accept": true|false}`` — record the first-contact choice about contacting the exchange; accept on an untuned box drains and restarts to run the lookup
    * - ``POST``
      - ``/gc``
      - Schedule a validated collection at the next lifecycle safe point; concurrent requests coalesce
diff --git a/install/README.md b/install/README.md
index 53261eefb1..25b4e3fab0 100644
--- a/install/README.md
+++ b/install/README.md
@@ -160,5 +160,5 @@ Binaries produced by `cmake --install` are ad-hoc code signed automatically, whi
 
 ## License
 
-BSD 3-Clause License - Copyright (c) 2019-2026, Gaijin Entertainment.
+BSD 3-Clause License - Copyright (c) 2018-2026, Gaijin Games Kft.
 See `LICENSE` for the full text.
diff --git a/modules/dasLLAMA/ARCHITECTURE_ENGINE.md b/modules/dasLLAMA/ARCHITECTURE_ENGINE.md
index d5ef22fd07..dac55550bf 100644
--- a/modules/dasLLAMA/ARCHITECTURE_ENGINE.md
+++ b/modules/dasLLAMA/ARCHITECTURE_ENGINE.md
@@ -190,8 +190,12 @@ file builds an `ArchDesc` (name * `configure` * the `ArchBlocks` fn-ptr quad * `
   (record stores + tune sidecars); the dasllama.io ladder service builds on it.
 - **`dasllama/dasllama_exchange.das`** - the sidecar-exchange client (a sanctioned public entry point): the boot-time
   lookup/apply (llvm_tune's scope resolver - a verified per-box match downloads instead of a
-  ~20-minute tune), the privacy-stripped submit rails, and the control-page surface
-  dasllama-server serves at `/exchange`.
+  ~12-minute tune), the privacy-stripped submit rails, and the control-page surface
+  dasllama-server serves at `/exchange`. The first-contact consent gate (GDPR) sits ahead of
+  every lookup: an explicit `exchange_*` config counts as the expressed choice, otherwise the
+  `<stem>.consent` sidecar-sibling file governs - unset asks on a real terminal, or emits
+  `@sidecar consent state=needed` for the watchdog dialog / control page, and no request
+  leaves until a surface records "accepted".
 - **`benchmarks/asr/mem_census.sh`** - the peak-memory census (`/usr/bin/time -l` around one
   asr_bench process per cell; macOS only) - the interim footprint instrument until a footprint
   leg lands in `gen_bench_records`; its numbers live in `PERF_LEDGER.md`, never the stores.
diff --git a/modules/dasLLAMA/ARCHITECTURE_MEASUREMENT.md b/modules/dasLLAMA/ARCHITECTURE_MEASUREMENT.md
index 3eecddd6e4..7a6ff9fbca 100644
--- a/modules/dasLLAMA/ARCHITECTURE_MEASUREMENT.md
+++ b/modules/dasLLAMA/ARCHITECTURE_MEASUREMENT.md
@@ -64,3 +64,9 @@ stages, tokenizer build) - the rails do not apply. A clock whose value feeds log
 flow, not instrumentation; it is marked `// clock: control` so the sweep and any future lint
 leave it alone.
 
+The override-announce rule (REVIEW.md) draws its boundary here: a knob or setter whose purpose
+is timing still counts as an override when it moves computed numerics - two GEMM forms of the
+same math differ in float terms - while one that changes only WHEN work happens does not, and
+a CLI flag is never an override (it is the run's own command line, visible where the run is
+launched).
+
diff --git a/modules/dasLLAMA/ENVIRONMENT.md b/modules/dasLLAMA/ENVIRONMENT.md
index 022757a0c7..00e3945ad6 100644
--- a/modules/dasLLAMA/ENVIRONMENT.md
+++ b/modules/dasLLAMA/ENVIRONMENT.md
@@ -241,8 +241,8 @@ Overrides for the dasllama.io exchange client.
 
 | Variable | Type | Default | Effect |
 |---|---|---|---|
-| `DASLLAMA_EXCHANGE_URL` | text | unset | Sidecar exchange base URL override (tests, mirrors); unset = the baked-in dasllama.io. |
-| `DASLLAMA_EXCHANGE_ACCEPT` | text | unset | One-shot exchange accept-policy override: verified | any | off; unset = the app config's exchange_accept. The watchdog arms 'any' on a relaunch when the user adopts an unverified sidecar over finishing a tune. |
+| `DASLLAMA_EXCHANGE_URL` | text | unset | Sidecar exchange base URL override (tests, mirrors); unset = the baked-in dasllama.io. Setting it is an expressed choice to use the exchange - the first-contact consent question is skipped (announced at boot). |
+| `DASLLAMA_EXCHANGE_ACCEPT` | text | unset | One-shot exchange accept-policy override: verified | any | off; unset = the app config's exchange_accept. The watchdog arms 'any' on a relaunch when the user adopts an unverified sidecar over finishing a tune. Setting it is an expressed choice to use the exchange - the first-contact consent question is skipped (announced at boot). |
 
 ## daslang core knobs dasLLAMA honours
 
diff --git a/modules/dasLLAMA/REVIEW.md b/modules/dasLLAMA/REVIEW.md
index ad8b7cd1c1..898e0f11c3 100644
--- a/modules/dasLLAMA/REVIEW.md
+++ b/modules/dasLLAMA/REVIEW.md
@@ -1,9 +1,9 @@
 # dasLLAMA Code Review Checklist
 
-**Read `REVIEW_COMMON.md` (repo root) first - its contract binds this checklist.** Architecture doc:
-`ARCHITECTURE.md`. Planned work: `followup_general.md`, `followup_vulkan.md`; the perf
-backlog is `PERF_LEDGER.md` - a performance followup goes there, everything else in the
-two followup ledgers.
+**Read `REVIEW_COMMON.md` (repo root) first - its contract binds this checklist.** Architecture
+docs: `ARCHITECTURE.md` and the `ARCHITECTURE_*.md` companions it indexes. Planned work:
+`followup_general.md`, `followup_vulkan.md`, `PERF_LEDGER.md` (performance goes to the perf
+ledger, everything else to the followup ledgers).
 
 **A dasLLAMA `[test]` file, wherever the diff puts it, answers to this module's
 `tests/REVIEW.md`.**
@@ -87,8 +87,12 @@ file's sec.1 charter line in `ARCHITECTURE_ENGINE.md`, `ARCHITECTURE_GPU.md`, or
 **Platform-specific code in an engine file (`dasllama/`) lands only in that platform's backend
 file.**
 
-**A new engine concern that is not `Model`/`Session`/`Config` state gets its own file, not
-more of `dasllama/dasllama_common.das`.**
+**A diff that adds a new engine concern that is not `Model`/`Session`/`Config` state to
+`dasllama/dasllama_common.das` is a defect - give the concern its own file.**
+
+**A boot-path prompt (code that runs at startup, before the first request) that reads stdin
+without first proving both stdin and stdout are terminals is a defect - emit the question as
+a `@sidecar` event instead.** A supervised or piped boot must never block on input.
 
 **A NEW clock read paired with a print or log of the elapsed interval is a defect in an engine
 file (`dasllama/`) outside a cold one-shot load, bake, map, or tokenizer-build progress log** -
@@ -124,14 +128,13 @@ template strings any of them look up, records a `tests/test_tokenizer.das` run w
 EXECUTED, not skipped.**
 
 **A diff that adds an override, or gives one a new effect, without the announce is a defect.**
-An override is an environment knob or an exported runtime setter that moves a gate, policy, or
-threshold off its default and thereby changes what the run writes, reads, mints, or computes -
-including a knob or setter whose purpose is timing when it moves computed numerics, since two
-GEMM forms of the same math differ in float terms. A knob or setter that changes only WHEN work
-happens is not an override, and a CLI flag is never one. The announce is a line the run prints
-where the override changes the outcome, naming it by the spelling a user would set - the
-environment variable name, the sidecar key, or the setter's function name. Per-site repeats are
-fine. A set-but-inert override stays silent.
+An override is an environment knob, an exported runtime setter, or an on-disk state file that
+moves a gate, policy, or threshold off its default and thereby changes what the run writes,
+reads, mints, or computes - a timing knob included when it moves computed numerics. A knob
+that changes only WHEN work happens is not one, and a CLI flag is never one. The announce is
+a line the run prints where the override changes the outcome, naming it by the spelling a
+user would set - the environment variable name, the sidecar or file key, or the setter's
+function name. Per-site repeats are fine; a set-but-inert override stays silent.
 
 **A change to user-facing API updates every place it is shown: a tutorial source, `.rst` page,
 docstring, help string, `README.md`, or checked-in document still showing the old call, flag, or
@@ -238,7 +241,8 @@ file** - a single-caller helper sanctioned as tower-worthy is ledgered on
 **A harness that prints output for another tool to compare exits non-zero when its run ends
 without those comparison lines - wrong flags, failed load.**
 
-**Tool wire text - building or parsing - is produced only in `dasllama/dasllama_tools.das`.**
+**Tool wire text (the text of a model's tool/function call, built or parsed) is produced only
+in `dasllama/dasllama_tools.das`.**
 
 **No engine file (`dasllama/`) other than `dasllama/dasllama_audio_io.das` requires `audio` (the
 miniaudio decode module).**
diff --git a/modules/dasLLAMA/dasllama/dasllama_env.das b/modules/dasLLAMA/dasllama/dasllama_env.das
index 11868a0e7e..e6ed7dab00 100644
--- a/modules/dasLLAMA/dasllama/dasllama_env.das
+++ b/modules/dasLLAMA/dasllama/dasllama_env.das
@@ -653,10 +653,10 @@ struct public ExampleEnv {
 
 [EnvConfig(env_prefix = "DASLLAMA")]
 struct public ExchangeEnv {
-    @clarg_doc = "Sidecar exchange base URL override (tests, mirrors); unset = the baked-in dasllama.io."
+    @clarg_doc = "Sidecar exchange base URL override (tests, mirrors); unset = the baked-in dasllama.io. Setting it is an expressed choice to use the exchange - the first-contact consent question is skipped (announced at boot)."
     exchange_url : string = ""
 
-    @clarg_doc = "One-shot exchange accept-policy override: verified | any | off; unset = the app config's exchange_accept. The watchdog arms 'any' on a relaunch when the user adopts an unverified sidecar over finishing a tune."
+    @clarg_doc = "One-shot exchange accept-policy override: verified | any | off; unset = the app config's exchange_accept. The watchdog arms 'any' on a relaunch when the user adopts an unverified sidecar over finishing a tune. Setting it is an expressed choice to use the exchange - the first-contact consent question is skipped (announced at boot)."
     exchange_accept : string = ""
 }
 
diff --git a/modules/dasLLAMA/dasllama/dasllama_exchange.das b/modules/dasLLAMA/dasllama/dasllama_exchange.das
index 14bbc4bd99..3a3b93c95d 100644
--- a/modules/dasLLAMA/dasllama/dasllama_exchange.das
+++ b/modules/dasLLAMA/dasllama/dasllama_exchange.das
@@ -17,10 +17,11 @@ require daslib/sha_256
 require daslib/toml
 require daslib/strings_boost
 require daslib/fio
+require daslib/tty
 require strings
 
 // The dasllama.io exchange client: at an untuned boot, download a matching per-box tune
-// sidecar instead of paying ~20 quiet-box minutes; after a local tune, offer/submit it back.
+// sidecar instead of paying ~12 quiet-box minutes; after a local tune, offer/submit it back.
 // Registered as llvm_tune's scope resolver by dasllama-server ([init] — before the guard);
 // lcpp_bench uses only the submit half. The service contract lives in the repo's
 // dasllama-ladder README §1.1; validation is dasllama_exchange_schema, shared with the service.
@@ -48,8 +49,16 @@ struct ExchangePolicy {
     url : string = EXCHANGE_URL_DEFAULT
     accept : string = "verified"    // verified | any | off
     submit : string = "ask"         // ask | always | never
+    configured : bool = false       // any exchange_* key came from the config file or env — an explicit choice
+    configured_via : string = ""    // the knob spelling that expressed it, for the waiver announce
 }
 
+//! The first-contact notice, shown before ANY request leaves for the exchange (GDPR: the
+//! lookup transmits the box identity, and the server sees the connection's IP like any web
+//! server). PLACEHOLDER wording — Gaijin legal owns the final text; the watchdog dialog
+//! (utils/watchdog/watchdog.py CONSENT_*) carries the same wording, keep the two in sync.
+let public EXCHANGE_CONSENT_NOTICE = "dasLLAMA can download a ready performance-tuning preset (a \"sidecar\") for this machine from dasllama.io, instead of spending ~12 minutes tuning locally.\nThe request sends only your hardware class - platform, CPU model and OS build. No serial numbers, user names or other personal data; no cookies. Sharing your own tuning results back is always confirmed separately.\nDetails: https://legal.gaijin.net/privacypolicy"
+
 // structured events for the watchdog (same contract as @tune): folded into supervisor STATE
 def private sc_event(kind : string; kv : string) {
     print("@sidecar {kind}{empty(kv) ? "" : " "}{kv}\n")
@@ -278,17 +287,33 @@ def exchange_policy_from_config(config_path : string) : ExchangePolicy {
             var terr = ""
             var root = read_toml(body, terr)
             if (root != null) {
+                // an AUTHORITATIVE toml is what the control page saves, and its gatherConfig
+                // persists the exchange defaults on EVERY save - so its exchange keys are not
+                // evidence of a choice; only a hand-written config's are (env overrides too)
+                let hand_written = !(root?["authoritative"] ?? false)
                 let u : string = root?["exchange_url"] ?? ""
                 if (!empty(u)) {
                     p.url = u
+                    if (hand_written) {
+                        p.configured = true
+                        p.configured_via = "exchange_url (config)"
+                    }
                 }
                 let a : string = root?["exchange_accept"] ?? ""
                 if (!empty(a)) {
                     p.accept = a
+                    if (hand_written) {
+                        p.configured = true
+                        p.configured_via = "exchange_accept (config)"
+                    }
                 }
                 let s : string = root?["exchange_submit"] ?? ""
                 if (!empty(s)) {
                     p.submit = s
+                    if (hand_written) {
+                        p.configured = true
+                        p.configured_via = "exchange_submit (config)"
+                    }
                 }
                 unsafe {
                     delete root
@@ -298,9 +323,13 @@ def exchange_policy_from_config(config_path : string) : ExchangePolicy {
     }
     if (!empty(g_env_exchange.exchange_url)) {
         p.url = g_env_exchange.exchange_url
+        p.configured = true
+        p.configured_via = "DASLLAMA_EXCHANGE_URL (env)"
     }
     if (!empty(g_env_exchange.exchange_accept)) {
         p.accept = g_env_exchange.exchange_accept
+        p.configured = true
+        p.configured_via = "DASLLAMA_EXCHANGE_ACCEPT (env)"
     }
     if (p.accept != "verified" && p.accept != "any" && p.accept != "off") {
         print("exchange: unknown exchange_accept '{p.accept}' - using verified (valid: verified | any | off)\n")
@@ -313,6 +342,84 @@ def exchange_policy_from_config(config_path : string) : ExchangePolicy {
     return p
 }
 
+// ===== consent (GDPR first-contact gate) =====
+
+// the sidecar-sibling naming rule: foo.tune.json and foo.tune both yield foo.tune.<ext>
+def private sidecar_sibling_path(manifest : string; ext : string) : string {
+    return (ends_with(manifest, ".json")
+        ? "{slice(manifest, 0, length(manifest) - 5)}.{ext}"
+        : "{manifest}.{ext}")
+}
+
+// the sidecar-sibling consent file: "accepted" / "declined", one word. An explicit exchange
+// config (any exchange_* key, TOML or env) is itself consent, so the file only governs the
+// zero-config default path.
+def private exchange_consent_path() : string {
+    return sidecar_sibling_path(tune_manifest_path(), "consent")
+}
+
+//! The recorded first-contact choice: "accepted" | "declined" | "" (never asked).
+def exchange_consent_status() : string {
+    let text = fread(exchange_consent_path())
+    let word = strip(text)
+    return (word == "accepted" || word == "declined") ? word : ""
+}
+
+//! Record the first-contact choice (console prompt, watchdog dialog, control page — every
+//! surface lands here). Emits the `@sidecar consent` event so the supervisor state follows.
+def exchange_record_consent(accept : bool) : bool {
+    let word = accept ? "accepted" : "declined"
+    if (!fwrite(exchange_consent_path(), "{word}\n")) {
+        return false
+    }
+    sc_event("consent", "state={word}")
+    return true
+}
+
+// The interactive arm: notice + Accept/Decline on the console. Enter defaults to Accept
+// (the dialog's default button); anything starting d/D/n/N declines. Only reached on a real
+// terminal — a supervised or piped boot must never block on stdin.
+def private consent_prompt_console() : bool {
+    print("\n{EXCHANGE_CONSENT_NOTICE}\n\n")
+    print("Use the exchange? [Accept]/decline: ")
+    let line = fgets(fstdin())
+    if (empty(line)) {
+        // EOF (Ctrl+D / closed stdin) is a walkaway, not an answer - record nothing, ask
+        // again next boot. A bare Enter arrives as "\n", so it never lands here.
+        print("exchange: no answer - tuning locally; the question returns next boot\n")
+        return false
+    }
+    let word = to_lower(strip(line))
+    let accepted = !(word |> starts_with("d") || word |> starts_with("n"))
+    if (!exchange_record_consent(accepted)) {
+        print("exchange: could not record the choice at {exchange_consent_path()} - not contacting the exchange\n")
+        return false
+    }
+    print(accepted ? "exchange: enabled - this choice is remembered\n" : "exchange: declined - this box tunes locally; the control page can enable it later\n")
+    return accepted
+}
+
+// The gate the resolver runs before the first request leaves. True = a request may be made.
+// No recorded choice: a real terminal asks inline; anything else stays offline this boot and
+// surfaces the question where a human is (watchdog dialog, control page) via the event.
+def private exchange_consent_gate() : bool {
+    let status = exchange_consent_status()
+    if (status == "accepted") {
+        print("exchange: consent on record at {exchange_consent_path()} (exchange_record_consent) - proceeding\n")
+        return true
+    }
+    if (status == "declined") {
+        print("exchange: disabled by the recorded choice - tuning locally (the control page can enable it)\n")
+        return false
+    }
+    if (is_stdin_terminal() && is_stdout_terminal()) {
+        return consent_prompt_console()
+    }
+    sc_event("consent", "state=needed path={url_encode(exchange_consent_path())}")
+    print("exchange: no recorded choice about contacting dasllama.io - tuning locally; answer the tray dialog or use the control page to enable the exchange\n")
+    return false
+}
+
 // ===== the boot resolver (llvm_tune scope-resolver seam) =====
 
 var private g_resolver_config = ""
@@ -327,6 +434,22 @@ def exchange_register_resolver(app_config_name : string) {
     tune_set_scope_resolver(@@exchange_scope_resolver)
 }
 
+//! The pre-request decision the boot resolver enforces: nothing leaves for the exchange
+//! without an expressed choice. `accept = off` never contacts; an explicit exchange config
+//! IS the choice (announced by the knob that expressed it); otherwise the recorded consent
+//! file governs - unset asks on a real terminal or emits the `@sidecar consent` event.
+def exchange_may_contact(policy : ExchangePolicy) : bool {
+    if (policy.accept == "off") {
+        return false
+    }
+    if (policy.configured) {
+        // the override announce: name the knob that expressed the choice and waived the question
+        print("exchange: consent expressed via {policy.configured_via} - not asking\n")
+        return true
+    }
+    return exchange_consent_gate()
+}
+
 def private exchange_scope_resolver(scope_name : string; manifest_path : string; _fnames : string) : bool {
     // one lookup per process — a second scope re-checks completeness off the same applied file
     if (g_resolve_attempted) {
@@ -341,7 +464,8 @@ def private exchange_scope_resolver(scope_name : string; manifest_path : string;
         return false
     }
     let policy = exchange_policy_from_config(exchange_discover_config(g_resolver_config))
-    if (policy.accept == "off") {
+    // GDPR first-contact gate: nothing leaves for the exchange without an expressed choice
+    if (!exchange_may_contact(policy)) {
         return false
     }
     let box = tune_box_identity()
@@ -388,9 +512,7 @@ def private exchange_scope_resolver(scope_name : string; manifest_path : string;
 
 // the sidecar-sibling state file remembering what this box already shared
 def private exchange_state_path(manifest : string) : string {
-    return (ends_with(manifest, ".json")
-        ? "{slice(manifest, 0, length(manifest) - 5)}.exchange.json"
-        : "{manifest}.exchange.json")
+    return sidecar_sibling_path(manifest, "exchange.json")
 }
 
 def private state_submitted_for(manifest : string) : string {
@@ -519,7 +641,7 @@ def exchange_submit_current(policy : ExchangePolicy) : string {
     return ""
 }
 
-//! Arm a local re-tune: the next boot skips the exchange once and races this box (~20 min,
+//! Arm a local re-tune: the next boot skips the exchange once and races this box (~12 min,
 //! quiet machine). The marker is written FIRST and only then is the sidecar removed — a failed
 //! marker write leaves the sidecar intact and returns the error, so the box is never left with
 //! no sidecar AND no re-tune armed (which would silently fall back to the exchange). "" on success.
@@ -567,7 +689,10 @@ def exchange_status_json(policy : ExchangePolicy) : string {
         cur_tab |> insert("version_ok", JV(info.dasllama_version == DASLLAMA_VERSION))
     }
     var top <- {
-        "policy" => JV((url = policy.url, accept = policy.accept, submit = policy.submit)),
+        "policy" => JV((url = policy.url, accept = policy.accept, submit = policy.submit,
+            configured = policy.configured)),
+        "consent" => JV(exchange_consent_status()),
+        "consent_notice" => JV(EXCHANGE_CONSENT_NOTICE),
         "engine_version" => JV(int64(DASLLAMA_VERSION)),
         "box" => JV(tune_box_identity()),
         "manifest" => JV(manifest),
@@ -623,7 +748,9 @@ def exchange_boot_submit_check(policy : ExchangePolicy) {
     if (state_submitted_for(manifest) == raw_sha) {
         return
     }
-    if (policy.submit == "always") {
+    // submit=always out of an authoritative toml is not consent either (the page persists it
+    // on every save) - without a recorded choice the auto-share degrades to the ask offer
+    if (policy.submit == "always" && (policy.configured || exchange_consent_status() == "accepted")) {
         let err = exchange_submit_current(policy)
         if (empty(err)) {
             print("exchange: shared this box's tune (exchange_submit=always)\n")
diff --git a/modules/dasLLAMA/performance/REVIEW.md b/modules/dasLLAMA/performance/REVIEW.md
index 1f905fac80..f66082236f 100644
--- a/modules/dasLLAMA/performance/REVIEW.md
+++ b/modules/dasLLAMA/performance/REVIEW.md
@@ -98,3 +98,20 @@ the box its provenance names, at the current `dasllama_version` - never a hand-e
 `REVIEW.das` (beside this file) machine-checks the age-independent half (`noise` `ok`,
 `validation` `ok`, every `race` winner equal to its `kernels` value); weakening that gate is a
 defect.
+
+**A diff that changes the exchange consent notice wording updates every checked-in copy in
+the same change, and a diff that adds a copy names it here in the same change:
+`EXCHANGE_CONSENT_NOTICE` (`../dasllama/dasllama_exchange.das`), `CONSENT_TITLE` /
+`CONSENT_TEXT` (`utils/watchdog/watchdog.py`, repo root), and the captured
+`utils/dasllama-server/tests/fixtures/exchange.json` (repo root).** The console prompt and the
+control page render the served constant, so they are not copies.
+
+**A diff that adds an outbound exchange request reachable from a tune-boot path
+(`exchange_scope_resolver` / `exchange_boot_submit_check`) without routing it through
+`exchange_may_contact` (`../dasllama/dasllama_exchange.das`) is a defect.**
+
+**A diff that adds a tune-boot-path (`exchange_scope_resolver` /
+`exchange_boot_submit_check`) consent question with no terminal to ask on also emits that
+question as a `@sidecar` event, in the same change** - the watchdog dialog and the control
+page are the answer surfaces a supervised boot has. (The stdin-prompt ban itself is
+`modules/dasLLAMA/REVIEW.md`'s, which every file under the module applies.)
diff --git a/modules/dasLLAMA/tests/_interrupt_probe.das b/modules/dasLLAMA/tests/_interrupt_probe.das
new file mode 100644
index 0000000000..5ad1c75ced
--- /dev/null
+++ b/modules/dasLLAMA/tests/_interrupt_probe.das
@@ -0,0 +1,16 @@
+options gen2
+options indenting = 4
+options _dasllama_internal = true
+
+// dastest fixture, spawned by test_tune_interrupt.das: one interrupt_gate() call between a
+// BEFORE and an AFTER print. While DAS_TUNE_CONTROL names an existing file the gate must
+// abort (exit 1, nothing past it runs); otherwise it passes through.
+
+require ../harness/tuner_noise.das
+
+[export]
+def main {
+    print("PROBE: before gate\n")
+    interrupt_gate("probe_family")
+    print("PROBE: gate passed through\n")
+}
diff --git a/modules/dasLLAMA/tests/run.das b/modules/dasLLAMA/tests/run.das
index 9cd8816282..eab0462e32 100644
--- a/modules/dasLLAMA/tests/run.das
+++ b/modules/dasLLAMA/tests/run.das
@@ -137,6 +137,7 @@ def private suite_files(name : string) : array<string> {   // nolint:STYLE038 -
                     "modules/dasLLAMA/tests/test_tok_seed.das",
                     "modules/dasLLAMA/tests/test_tool_formats.das",
                     "modules/dasLLAMA/tests/test_tower_helpers.das",
+                    "modules/dasLLAMA/tests/test_tune_interrupt.das",
                     "modules/dasLLAMA/tests/test_unicode.das",
                     "modules/dasLLAMA/tests/test_vision.das",
                     "modules/dasLLAMA/tests/test_vision_chat.das",
diff --git a/modules/dasLLAMA/tests/test_tune_interrupt.das b/modules/dasLLAMA/tests/test_tune_interrupt.das
new file mode 100644
index 0000000000..e089aaf00e
--- /dev/null
+++ b/modules/dasLLAMA/tests/test_tune_interrupt.das
@@ -0,0 +1,72 @@
+options gen2
+options indenting = 4
+options persistent_heap
+
+require dastest/testing_boost public
+require daslib/command_line
+require daslib/strings_boost
+require daslib/fio
+require strings
+
+// The supervisor cancel-minting rail, end to end in a child process: while the file named by
+// DAS_TUNE_CONTROL exists, interrupt_gate() aborts between kernel families - the @tune abort
+// event fires and nothing past the gate runs (minting is end-gated, so an interrupted run
+// writes no sidecar). The env is load-once, so a spawned child is the only honest probe.
+
+def private run_probe(control_env : string) : string {
+    let win = get_platform_name() == "windows"
+    // an empty control_env is spelled as an explicit UNSET - the parent (the watchdog sets
+    // this very variable) must never leak its own value into the "unset" cell
+    let envs = (empty(control_env)
+        ? (win ? "set \"DAS_TUNE_CONTROL=\"&& " : "env -u DAS_TUNE_CONTROL ")
+        : (win ? "set \"DAS_TUNE_CONTROL={control_env}\"&& "
+               : "DAS_TUNE_CONTROL=\"{control_env}\" "))
+    let cmd = "{envs}\"{get_das_exe()}\" \"modules/dasLLAMA/tests/_interrupt_probe.das\" -dasroot \"{get_das_root()}\" 2>&1"
+    var out = ""
+    unsafe {
+        popen(cmd) $(f) {
+            if (f != null) {
+                out = build_string() $(w) {
+                    while (!feof(f)) {
+                        w |> write(fgets(f))
+                    }
+                }
+            }
+        }
+    }
+    return out
+}
+
+[test]
+def test_interrupt_aborts_without_minting(t : T?) {
+    t |> run("a present control file aborts at the gate") @(tt : T?) {
+        let res = create_temp_file_result("tune_control_", ".stop")
+        if (res is error) {
+            tt |> failure("could not create a temp control file")
+            return
+        }
+        let control = res as value
+        let out = run_probe(control)
+        tt |> success(out |> find("PROBE: before gate") >= 0, "the probe ran to the gate: {out}")
+        tt |> success(out |> find("@tune abort reason=interrupted at=probe_family") >= 0, "the abort event fired: {out}")
+        tt |> success(out |> find("gate passed through") < 0, "nothing past the gate ran - minting is end-gated, so nothing was written: {out}")
+        remove(control)
+    }
+    t |> run("a named-but-absent control file passes through") @(tt : T?) {
+        let res = create_temp_file_result("tune_control_", ".stop")
+        if (res is error) {
+            tt |> failure("could not create a temp control file")
+            return
+        }
+        let control = res as value
+        remove(control)
+        let out = run_probe(control)
+        tt |> success(out |> find("gate passed through") >= 0, "the gate is armed only while the file EXISTS: {out}")
+        tt |> success(out |> find("@tune abort") < 0, "no abort without the file: {out}")
+    }
+    t |> run("no DAS_TUNE_CONTROL passes through") @(tt : T?) {
+        let out = run_probe("")
+        tt |> success(out |> find("gate passed through") >= 0, "unset env never interrupts: {out}")
+        tt |> success(out |> find("@tune abort") < 0, "no abort with the env unset: {out}")
+    }
+}
diff --git a/site-dasllama/REVIEW.md b/site-dasllama/REVIEW.md
index f30bc0d3d1..82cb57329e 100644
--- a/site-dasllama/REVIEW.md
+++ b/site-dasllama/REVIEW.md
@@ -10,8 +10,9 @@ implementation that does not exist yet.
 **A code sample shown on a page that does not compile and run with the current toolchain is
 a defect.**
 
-**A number shown on a page is a defect unless it is rendered from live data, copied from a
-checked-in measurement record, or carries an HTML comment naming it a placeholder.**
+**A number shown on a page carries checkable provenance: rendered from live data, copied from
+a named checked-in measurement record, or an HTML comment naming the box, date, and what was
+measured (or naming it a placeholder). A number with none of these is a defect.**
 
 **A claim in words on index.html that one engine beats another ("beats", "Nx faster than",
 "fastest") is a defect, the generated news region included.** Figures copied from a
@@ -21,9 +22,13 @@ reader does is not the page's claim.
 **Copy or rendering that lets a row with no reference engine's figure imply parity with a
 reference engine is a defect - an empty ratio cell reads "not raced".**
 
-**A new `dl-*` CSS rule in any file under this directory is a defect** - the `dl-*`
-measurement-table styles live only in `site/files/dasllama-table.css`, and site chrome here
-uses the `dio-` prefix in `files/dasllama-io.css`.
+**A `dl-*` selector that `site/files/dasllama-table.css` (repo root) does not already
+define, declared in any file under this directory, is a defect** - site chrome here uses the
+`dio-` prefix in `files/dasllama-io.css`, and the `dl-*` measurement-table language is that
+shared sheet's.
+
+**A statement on a page here about what a shipped tool does is a defect unless it matches
+the current code.**
 
 **A claim in a `_news/*.md` entry that is not true at publish time is a defect, including a
 claim about what a page here renders - check that one against the page's markup and
@@ -40,3 +45,7 @@ quoted-attribute values, `Number(...)` for anything numeric, and `safeApiHref()`
 
 **A page that lacks `<title>`, a meta description, OpenGraph tags, or the Atom `<link>` is a
 defect - a new or renamed page included.**
+
+**A diff that adds a file under `files/` also verifies the dasllama.io deploy step
+(`.github/workflows/pages.yml`, "Stage dasllama.io for deployment") stages it, in the same
+change.** Local preview serves the tree directly, so a staging miss is invisible until deploy.
diff --git a/site-dasllama/files/dasllama-io.css b/site-dasllama/files/dasllama-io.css
index a6d2932dee..103566c2d1 100644
--- a/site-dasllama/files/dasllama-io.css
+++ b/site-dasllama/files/dasllama-io.css
@@ -167,7 +167,7 @@
 
 /* ── footer ──────────────────────────────────────────────────── */
 .dio-footer{padding:52px 0 60px;border-top:1px solid var(--rule);font-family:var(--font-mono);font-size:12.5px;margin-top:40px}
-.dio-footer__grid{display:grid;grid-template-columns:1.5fr 1fr 1fr 1fr;gap:32px}
+.dio-footer__grid{display:grid;grid-template-columns:1.5fr 1fr 1fr 1fr 1fr;gap:32px}
 .dio-footer__about{margin-top:14px;color:var(--fg-faint);line-height:1.65;max-width:290px}
 .dio-footer__head{color:var(--fg-faint);margin-bottom:12px;text-transform:uppercase;letter-spacing:.1em;font-size:10.5px}
 .dio-footer a.dio-footer__link{color:var(--fg);display:block;margin-bottom:8px}
diff --git a/site-dasllama/files/dasllama-io.js b/site-dasllama/files/dasllama-io.js
index 412f3cb2ed..1ab5d08bb1 100644
--- a/site-dasllama/files/dasllama-io.js
+++ b/site-dasllama/files/dasllama-io.js
@@ -661,7 +661,7 @@
       });
       var head = '<div class="dio-sc__head"><span>status</span><span>box</span><span>engine sha</span><span>date</span><span>noise</span><span></span><span></span></div>';
       if (!show.length) {
-        listBox.innerHTML = head + '<div class="dl-empty">Nothing here yet — tuning your box takes ~20 min of quiet machine and publishes the sidecar that rides along.</div>';
+        listBox.innerHTML = head + '<div class="dl-empty">Nothing here yet — tuning your box takes ~12 min of quiet machine and publishes the sidecar that rides along.</div>';
         return;
       }
       listBox.innerHTML = head + show.map(function (r, i) {
diff --git a/site-dasllama/files/fonts/InterTight-italic-cyrillic-ext.woff2 b/site-dasllama/files/fonts/InterTight-italic-cyrillic-ext.woff2
new file mode 100644
index 0000000000..83c2eff740
Binary files /dev/null and b/site-dasllama/files/fonts/InterTight-italic-cyrillic-ext.woff2 differ
diff --git a/site-dasllama/files/fonts/InterTight-italic-cyrillic.woff2 b/site-dasllama/files/fonts/InterTight-italic-cyrillic.woff2
new file mode 100644
index 0000000000..70552d21a2
Binary files /dev/null and b/site-dasllama/files/fonts/InterTight-italic-cyrillic.woff2 differ
diff --git a/site-dasllama/files/fonts/InterTight-italic-greek-ext.woff2 b/site-dasllama/files/fonts/InterTight-italic-greek-ext.woff2
new file mode 100644
index 0000000000..c81a4e55a9
Binary files /dev/null and b/site-dasllama/files/fonts/InterTight-italic-greek-ext.woff2 differ
diff --git a/site-dasllama/files/fonts/InterTight-italic-greek.woff2 b/site-dasllama/files/fonts/InterTight-italic-greek.woff2
new file mode 100644
index 0000000000..95d91ab686
Binary files /dev/null and b/site-dasllama/files/fonts/InterTight-italic-greek.woff2 differ
diff --git a/site-dasllama/files/fonts/InterTight-italic-latin-ext.woff2 b/site-dasllama/files/fonts/InterTight-italic-latin-ext.woff2
new file mode 100644
index 0000000000..12f8e8f5a5
Binary files /dev/null and b/site-dasllama/files/fonts/InterTight-italic-latin-ext.woff2 differ
diff --git a/site-dasllama/files/fonts/InterTight-italic-latin.woff2 b/site-dasllama/files/fonts/InterTight-italic-latin.woff2
new file mode 100644
index 0000000000..870e9b5982
Binary files /dev/null and b/site-dasllama/files/fonts/InterTight-italic-latin.woff2 differ
diff --git a/site-dasllama/files/fonts/InterTight-italic-vietnamese.woff2 b/site-dasllama/files/fonts/InterTight-italic-vietnamese.woff2
new file mode 100644
index 0000000000..072774eca7
Binary files /dev/null and b/site-dasllama/files/fonts/InterTight-italic-vietnamese.woff2 differ
diff --git a/site-dasllama/files/fonts/InterTight-normal-cyrillic-ext.woff2 b/site-dasllama/files/fonts/InterTight-normal-cyrillic-ext.woff2
new file mode 100644
index 0000000000..23a7b3eede
Binary files /dev/null and b/site-dasllama/files/fonts/InterTight-normal-cyrillic-ext.woff2 differ
diff --git a/site-dasllama/files/fonts/InterTight-normal-cyrillic.woff2 b/site-dasllama/files/fonts/InterTight-normal-cyrillic.woff2
new file mode 100644
index 0000000000..f0a04608af
Binary files /dev/null and b/site-dasllama/files/fonts/InterTight-normal-cyrillic.woff2 differ
diff --git a/site-dasllama/files/fonts/InterTight-normal-greek-ext.woff2 b/site-dasllama/files/fonts/InterTight-normal-greek-ext.woff2
new file mode 100644
index 0000000000..68cbfb4227
Binary files /dev/null and b/site-dasllama/files/fonts/InterTight-normal-greek-ext.woff2 differ
diff --git a/site-dasllama/files/fonts/InterTight-normal-greek.woff2 b/site-dasllama/files/fonts/InterTight-normal-greek.woff2
new file mode 100644
index 0000000000..0d638f0024
Binary files /dev/null and b/site-dasllama/files/fonts/InterTight-normal-greek.woff2 differ
diff --git a/site-dasllama/files/fonts/InterTight-normal-latin-ext.woff2 b/site-dasllama/files/fonts/InterTight-normal-latin-ext.woff2
new file mode 100644
index 0000000000..8df773db33
Binary files /dev/null and b/site-dasllama/files/fonts/InterTight-normal-latin-ext.woff2 differ
diff --git a/site-dasllama/files/fonts/InterTight-normal-latin.woff2 b/site-dasllama/files/fonts/InterTight-normal-latin.woff2
new file mode 100644
index 0000000000..228154ffb1
Binary files /dev/null and b/site-dasllama/files/fonts/InterTight-normal-latin.woff2 differ
diff --git a/site-dasllama/files/fonts/InterTight-normal-vietnamese.woff2 b/site-dasllama/files/fonts/InterTight-normal-vietnamese.woff2
new file mode 100644
index 0000000000..d08a67efd6
Binary files /dev/null and b/site-dasllama/files/fonts/InterTight-normal-vietnamese.woff2 differ
diff --git a/site-dasllama/files/fonts/JetBrainsMono-normal-cyrillic-ext.woff2 b/site-dasllama/files/fonts/JetBrainsMono-normal-cyrillic-ext.woff2
new file mode 100644
index 0000000000..024a1af5eb
Binary files /dev/null and b/site-dasllama/files/fonts/JetBrainsMono-normal-cyrillic-ext.woff2 differ
diff --git a/site-dasllama/files/fonts/JetBrainsMono-normal-cyrillic.woff2 b/site-dasllama/files/fonts/JetBrainsMono-normal-cyrillic.woff2
new file mode 100644
index 0000000000..1b61cf966c
Binary files /dev/null and b/site-dasllama/files/fonts/JetBrainsMono-normal-cyrillic.woff2 differ
diff --git a/site-dasllama/files/fonts/JetBrainsMono-normal-greek.woff2 b/site-dasllama/files/fonts/JetBrainsMono-normal-greek.woff2
new file mode 100644
index 0000000000..06f0936048
Binary files /dev/null and b/site-dasllama/files/fonts/JetBrainsMono-normal-greek.woff2 differ
diff --git a/site-dasllama/files/fonts/JetBrainsMono-normal-latin-ext.woff2 b/site-dasllama/files/fonts/JetBrainsMono-normal-latin-ext.woff2
new file mode 100644
index 0000000000..310faddfdd
Binary files /dev/null and b/site-dasllama/files/fonts/JetBrainsMono-normal-latin-ext.woff2 differ
diff --git a/site-dasllama/files/fonts/JetBrainsMono-normal-latin.woff2 b/site-dasllama/files/fonts/JetBrainsMono-normal-latin.woff2
new file mode 100644
index 0000000000..2ca6ac6059
Binary files /dev/null and b/site-dasllama/files/fonts/JetBrainsMono-normal-latin.woff2 differ
diff --git a/site-dasllama/files/fonts/JetBrainsMono-normal-vietnamese.woff2 b/site-dasllama/files/fonts/JetBrainsMono-normal-vietnamese.woff2
new file mode 100644
index 0000000000..d37ea35987
Binary files /dev/null and b/site-dasllama/files/fonts/JetBrainsMono-normal-vietnamese.woff2 differ
diff --git a/site-dasllama/files/fonts/fonts.css b/site-dasllama/files/fonts/fonts.css
new file mode 100644
index 0000000000..1462ddfea1
--- /dev/null
+++ b/site-dasllama/files/fonts/fonts.css
@@ -0,0 +1,180 @@
+/* cyrillic-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-cyrillic-ext.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-cyrillic.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-greek-ext.woff2) format('woff2');
+  unicode-range: U+1F00-1FFF;
+}
+/* greek */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-greek.woff2) format('woff2');
+  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-vietnamese.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-latin-ext.woff2) format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-latin.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+/* cyrillic-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-cyrillic-ext.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-cyrillic.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-greek-ext.woff2) format('woff2');
+  unicode-range: U+1F00-1FFF;
+}
+/* greek */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-greek.woff2) format('woff2');
+  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-vietnamese.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-latin-ext.woff2) format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-latin.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+/* cyrillic-ext */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-cyrillic-ext.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-cyrillic.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-greek.woff2) format('woff2');
+  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-vietnamese.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-latin-ext.woff2) format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-latin.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
diff --git a/site-dasllama/index.html b/site-dasllama/index.html
index 07e8dd720f..0b24f0ab83 100644
--- a/site-dasllama/index.html
+++ b/site-dasllama/index.html
@@ -10,9 +10,7 @@
 <link rel="canonical" href="https://dasllama.io/"/>
 <link rel="icon" href="files/dasllama-favicon.svg" type="image/svg+xml"/>
 <link rel="alternate" type="application/atom+xml" href="/feed.xml" title="dasllama.io news"/>
-<link rel="preconnect" href="https://fonts.googleapis.com"/>
-<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin/>
-<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter+Tight:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&family=JetBrains+Mono:wght@400;500;600;700&display=swap"/>
+<link rel="stylesheet" href="files/fonts/fonts.css"/>
 <link rel="stylesheet" href="files/forge.css"/>
 <link rel="stylesheet" href="files/dasllama-table.css"/>
 <link rel="stylesheet" href="files/dasllama-io.css"/>
@@ -121,6 +119,6 @@ <h2 class="forge-h2">Latest measurements.</h2>
 <div><div class="dio-footer__head">site</div><a class="dio-footer__link" href="/">news</a><a class="dio-footer__link" href="ladder.html">ladder</a><a class="dio-footer__link" href="sidecars.html">sidecars</a><a class="dio-footer__link" href="/feed.xml">atom feed</a></div>
 <div><div class="dio-footer__head">daslang</div><a class="dio-footer__link" href="https://daslang.io">daslang.io</a><a class="dio-footer__link" href="https://daslang.io/dasllama.html">scoreboard</a><a class="dio-footer__link" href="https://daslang.io/downloads.html">downloads</a><a class="dio-footer__link" href="https://daslang.io/playground/index.html">playground</a></div>
 <div><div class="dio-footer__head">method</div><a class="dio-footer__link" href="https://daslang.io/doc/reference/dasllama_methodology.html">methodology</a><a class="dio-footer__link" href="https://github.com/GaijinEntertainment/daScript">github</a><a class="dio-footer__link" href="https://t.me/daScript">telegram</a></div>
-</div></div></footer>
+<div><div class="dio-footer__head">legal</div><a class="dio-footer__link" href="https://legal.gaijin.net/termsofservice">terms of service</a><a class="dio-footer__link" href="https://legal.gaijin.net/privacypolicy">privacy policy</a><a class="dio-footer__link" href="https://github.com/GaijinEntertainment/daScript/blob/master/LICENSE">bsd 3-clause license</a></div></div></div></footer>
 
 </div></body></html>
diff --git a/site-dasllama/ladder.html b/site-dasllama/ladder.html
index 2465f7460a..cc1b0f07a3 100644
--- a/site-dasllama/ladder.html
+++ b/site-dasllama/ladder.html
@@ -10,9 +10,7 @@
 <link rel="canonical" href="https://dasllama.io/ladder.html"/>
 <link rel="icon" href="files/dasllama-favicon.svg" type="image/svg+xml"/>
 <link rel="alternate" type="application/atom+xml" href="/feed.xml" title="dasllama.io news"/>
-<link rel="preconnect" href="https://fonts.googleapis.com"/>
-<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin/>
-<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter+Tight:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&family=JetBrains+Mono:wght@400;500;600;700&display=swap"/>
+<link rel="stylesheet" href="files/fonts/fonts.css"/>
 <link rel="stylesheet" href="files/forge.css"/>
 <link rel="stylesheet" href="files/dasllama-table.css"/>
 <link rel="stylesheet" href="files/dasllama-io.css"/>
@@ -71,6 +69,6 @@
 <div><div class="dio-footer__head">site</div><a class="dio-footer__link" href="/">news</a><a class="dio-footer__link" href="ladder.html">ladder</a><a class="dio-footer__link" href="sidecars.html">sidecars</a><a class="dio-footer__link" href="/feed.xml">atom feed</a></div>
 <div><div class="dio-footer__head">daslang</div><a class="dio-footer__link" href="https://daslang.io">daslang.io</a><a class="dio-footer__link" href="https://daslang.io/dasllama.html">scoreboard</a><a class="dio-footer__link" href="https://daslang.io/downloads.html">downloads</a></div>
 <div><div class="dio-footer__head">method</div><a class="dio-footer__link" href="https://daslang.io/doc/reference/dasllama_methodology.html">methodology</a><a class="dio-footer__link" href="https://github.com/GaijinEntertainment/daScript">github</a><a class="dio-footer__link" href="https://t.me/daScript">telegram</a></div>
-</div></div></footer>
+<div><div class="dio-footer__head">legal</div><a class="dio-footer__link" href="https://legal.gaijin.net/termsofservice">terms of service</a><a class="dio-footer__link" href="https://legal.gaijin.net/privacypolicy">privacy policy</a><a class="dio-footer__link" href="https://github.com/GaijinEntertainment/daScript/blob/master/LICENSE">bsd 3-clause license</a></div></div></div></footer>
 
 </div></body></html>
diff --git a/site-dasllama/sidecars.html b/site-dasllama/sidecars.html
index b42e1089dd..ae73c1d024 100644
--- a/site-dasllama/sidecars.html
+++ b/site-dasllama/sidecars.html
@@ -2,7 +2,7 @@
 <html lang="en"><head><meta charset="utf-8"/>
 <meta name="viewport" content="width=device-width, initial-scale=1"/>
 <title>sidecars — dasllama.io</title>
-<meta name="description" content="The sidecar exchange — per-box tune manifests for dasLLAMA. Pick one up for your platform, architecture and engine version instead of spending 20 minutes tuning."/>
+<meta name="description" content="The sidecar exchange — per-box tune manifests for dasLLAMA. Pick one up for your platform, architecture and engine version instead of spending ~12 minutes tuning."/>
 <meta property="og:title" content="dasLLAMA sidecars"/>
 <meta property="og:description" content="Per-box tune manifests: kernel winners, runtime scalars, provenance. Pick one up instead of tuning."/>
 <meta property="og:type" content="website"/>
@@ -10,9 +10,7 @@
 <link rel="canonical" href="https://dasllama.io/sidecars.html"/>
 <link rel="icon" href="files/dasllama-favicon.svg" type="image/svg+xml"/>
 <link rel="alternate" type="application/atom+xml" href="/feed.xml" title="dasllama.io news"/>
-<link rel="preconnect" href="https://fonts.googleapis.com"/>
-<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin/>
-<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter+Tight:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&family=JetBrains+Mono:wght@400;500;600;700&display=swap"/>
+<link rel="stylesheet" href="files/fonts/fonts.css"/>
 <link rel="stylesheet" href="files/forge.css"/>
 <link rel="stylesheet" href="files/dasllama-table.css"/>
 <link rel="stylesheet" href="files/dasllama-io.css"/>
@@ -34,7 +32,8 @@
 <header class="dio-head"><div class="forge-container"><div class="dio-head__row">
 <div>
 <h1>Somebody may already have tuned <em>your box.</em></h1>
-<p class="dio-head__lede">A sidecar is dasLLAMA's per-box tune manifest: which JIT kernel variant won in each of ~40 families, 23 tuned runtime scalars, and the provenance to prove where it came from. Producing one costs about 20 minutes of quiet machine. <b style="color:var(--fg);font-weight:400">dasllama-server picks a matching sidecar up automatically at startup</b> — this page is the manual browse.</p>
+<!-- ~12 min: measured first-boot tune on M1 Max 2026-08-28 - 11:46 wall incl. cold JIT codegen, 40 kernel families raced (42 planned), re-exec, model load; run stated in the introducing PR -->
+<p class="dio-head__lede">A sidecar is dasLLAMA's per-box tune manifest: which JIT kernel variant won in each of ~40 families, 23 tuned runtime scalars, and the provenance to prove where it came from. Producing one costs about 12 minutes of quiet machine. <b style="color:var(--fg);font-weight:400">dasllama-server picks a matching sidecar up automatically at startup</b> — this page is the manual browse.</p>
 </div>
 <!-- dio-sc-stats is filled live by mountSidecars; this is the pre-load/API-down fallback (must
      match what the JS renders — a sidecar keys on version × BOX, not arch) -->
@@ -62,18 +61,18 @@ <h1>Somebody may already have tuned <em>your box.</em></h1>
 <div class="forge-section-label"><span class="forge-section-label__num">§ 01</span><span class="forge-section-label__rule"></span>the cli does this for you</div>
 <div class="dio-get__grid">
 <div>
-<h2 class="forge-h2">No questions asked.</h2>
-<p class="forge-p">At startup the server matches your box against the exchange — one code path, no prompts. Manual download is for air-gapped boxes and for people who want to read the manifest before trusting it.</p>
+<h2 class="forge-h2">One question, once.</h2>
+<p class="forge-p">The first start asks once whether to use the exchange — Accept and every later start matches your box automatically, one code path; Decline and the box tunes itself locally. Setting the exchange policy yourself - <code class="forge-code">exchange_*</code> keys in a hand-written config, or the <code class="forge-code">DASLLAMA_EXCHANGE_*</code> environment - skips the question: it IS the answer. Manual download is for air-gapped boxes and for people who want to read the manifest before trusting it.</p>
 <div class="dio-get__steps">
 <div class="dio-get__step"><i>01</i><span>verified match → downloaded, validated, applied</span></div>
 <div class="dio-get__step"><i>02</i><span>unverified match → never auto-applied; adopt it from the control page, or from the tray while a tune runs</span></div>
-<div class="dio-get__step"><i>03</i><span>nothing → the box tunes itself, ~20 min quiet machine, and can share the result back</span></div>
+<div class="dio-get__step"><i>03</i><span>nothing → the box tunes itself, ~12 min quiet machine, and can share the result back</span></div>
 </div>
 </div>
 <!-- every command and output line below is verbatim from a real untuned dasllama-server
      boot against a live exchange (REVIEW.md: no invented shell commands) -->
 <div class="forge-terminal">
-<div class="forge-terminal__header"><div class="forge-terminal__dots"><span class="forge-terminal__dot forge-terminal__dot--red"></span><span class="forge-terminal__dot forge-terminal__dot--amber"></span><span class="forge-terminal__dot forge-terminal__dot--green"></span></div><span class="forge-terminal__label">dasllama-server</span><span class="forge-terminal__status">first start, untuned box</span></div>
+<div class="forge-terminal__header"><div class="forge-terminal__dots"><span class="forge-terminal__dot forge-terminal__dot--red"></span><span class="forge-terminal__dot forge-terminal__dot--amber"></span><span class="forge-terminal__dot forge-terminal__dot--green"></span></div><span class="forge-terminal__label">dasllama-server</span><span class="forge-terminal__status">first start after Accept, untuned box</span></div>
 <div class="forge-output" style="border-top:0;padding:18px 20px;font-size:12.5px;line-height:1.85">
 <div class="forge-output__line"><span class="forge-output__prompt">$</span> daslang -jit main.das -- --model model.gguf</div>
 <div class="forge-output__line">exchange: scope 'dasllama' is untuned - looking up a sidecar for this box (dasllama version 1)</div>
@@ -96,7 +95,7 @@ <h2 class="forge-h2">No questions asked.</h2>
 <div><div class="dio-footer__head">site</div><a class="dio-footer__link" href="/">news</a><a class="dio-footer__link" href="ladder.html">ladder</a><a class="dio-footer__link" href="sidecars.html">sidecars</a><a class="dio-footer__link" href="/feed.xml">atom feed</a></div>
 <div><div class="dio-footer__head">daslang</div><a class="dio-footer__link" href="https://daslang.io">daslang.io</a><a class="dio-footer__link" href="https://daslang.io/dasllama.html">scoreboard</a><a class="dio-footer__link" href="https://daslang.io/downloads.html">downloads</a></div>
 <div><div class="dio-footer__head">method</div><a class="dio-footer__link" href="https://daslang.io/doc/reference/dasllama_methodology.html">methodology</a><a class="dio-footer__link" href="https://github.com/GaijinEntertainment/daScript">github</a><a class="dio-footer__link" href="https://t.me/daScript">telegram</a></div>
-</div></div></footer>
+<div><div class="dio-footer__head">legal</div><a class="dio-footer__link" href="https://legal.gaijin.net/termsofservice">terms of service</a><a class="dio-footer__link" href="https://legal.gaijin.net/privacypolicy">privacy policy</a><a class="dio-footer__link" href="https://github.com/GaijinEntertainment/daScript/blob/master/LICENSE">bsd 3-clause license</a></div></div></div></footer>
 
 
 </div></body></html>
diff --git a/site/README.md b/site/README.md
index 129bc8d9d4..27c0489bd6 100644
--- a/site/README.md
+++ b/site/README.md
@@ -68,7 +68,7 @@ generated and gitignored - see [`site/.gitignore`](.gitignore).
 |---|---|---|
 | **Landing hero** | CodeMirror editor with sample picker, -> run, up playground handoff | Static `<pre><code class="language-daslang">` block, no CM init. Hero buttons + sample tabs hidden via CSS. |
 | **/playground/** | Full multi-file IDE - tabs, splitter, share via `#z=` hash, -> run via WASM | "Open this on a laptop" notice (CSS overlay); the IDE and the runtime still initialize underneath it. |
-| **/blog/<slug>** | Full post + Disqus comments at the bottom (shortname `https-borisbat-github-io-dascf-blog`, identifier = slug, Auto theme picks dark via `:root { color-scheme: dark }`) | Same. Disqus is responsive. |
+| **/blog/<slug>** | Full post (no comment widget — removed for GDPR: Disqus set cookies) | Same. |
 | **Nav** | Inline links: docs * benchmarks * downloads * blog * community + `v0.6.4`, github up, install | == hamburger toggles a dropdown panel with the same links. `v0.6.4` chip is hidden at <480 px. |
 
 The mobile fallbacks are pure CSS + a tiny synchronous gate script - no UA
diff --git a/site/REVIEW.md b/site/REVIEW.md
index f7193059fb..5511d92965 100644
--- a/site/REVIEW.md
+++ b/site/REVIEW.md
@@ -12,9 +12,9 @@ shows.**
 exact argv `modules/dasLLAMA/performance/gen_bench_records.das` (or the released bench exe it
 spawns) ran is a defect.**
 
-**A row `files/dasllama.js` renders without its run's `cmd` + `date` line is a defect - render
-that line on every row the run produced.** One run's `cmd` + `date` covers several rendered
-rows.
+**A row that `files/dasllama.js` renders without its run's `cmd` + `date` line is a defect -
+render that line on every row the run produced.** One run's `cmd` + `date` covers several
+rendered rows.
 
 **A `cmd` or `date` inside a run's `tests` entry in `files/dasllama/bench_records.json` is a
 defect - the pair belongs on the run object that produced the rows.**
@@ -51,23 +51,22 @@ a defect - link every embedded sample.**
 
 **A daslang sample embedded in a page not written in gen2 is a defect.**
 
-**A diff that changes `playground/` (this folder), `examples/_interp.html` (this folder),
-`web/examples/ui/src/`, or `web/examples/ui/samples/` (both repo root) states a run of the
-WASM-staged Playwright suite (`tests/playground/`, this folder) in its PR body or commit
-message, naming the passes and any failures, in the same change.** The no-WASM lane cannot see
-a broken runtime path, and every sample on the page runs through that path.
+**A diff that changes `playground/` (this folder) or `examples/_interp.html` (this folder)
+states a run of the WASM-staged Playwright suite (`tests/playground/`, this folder) in its PR
+body or commit message, naming the passes and any failures, in the same change.** The no-WASM
+lane cannot see a broken runtime path, and every sample on the page runs through that path.
 
 **A stated Playwright run names every sample the diff changed: for each, the spec that loaded
 it, or - when no spec loads it - that it was opened and run by hand in the playground.**
 
-**A stated Playwright run names the runtime artifacts it used: built from this change when the
-diff touches `src/`, `include/`, `daslib/`, `modules/`, or `web/CMakeLists.txt` (all repo
-root); the deployed ones otherwise.**
+**A stated Playwright run names the runtime artifacts it used: built from this change when
+the diff touches `src/`, `include/`, `daslib/`, `modules/`, `dastest/`, or
+`web/CMakeLists.txt` (all repo root); the deployed ones otherwise.**
 
 **A diff that puts a measurement number - a rate, a duration, a size, a score some run
-produced, never a fixture or run parameter such as an image's dimensions or a token budget - on
-a page without rendering it from live data, copying it from a checked-in measurement record, or
-marking it a placeholder in a source comment is a defect.**
+produced, never a fixture or run parameter - on a page without rendering it from live data,
+copying it from a checked-in measurement record, or marking it a placeholder in a source
+comment is a defect.**
 
 **A placeholder number a page reader could take for a fact is a defect - mark it as a
 placeholder on the page itself.**
diff --git a/site/benchmarks.html b/site/benchmarks.html
index 9eaa4e6f86..8044a2722b 100644
--- a/site/benchmarks.html
+++ b/site/benchmarks.html
@@ -8,9 +8,7 @@
     <link rel="canonical" href="https://daslang.io/benchmarks.html" />
     <link rel="icon" type="image/svg+xml" href="files/daslang-favicon.svg" />
     <link rel="alternate icon" type="image/x-icon" href="files/daslang.ico" />
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter+Tight:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&family=JetBrains+Mono:wght@400;500;600;700&display=swap" />
+<link rel="stylesheet" href="files/fonts/fonts.css"/>
     <link rel="stylesheet" href="files/forge.css" />
     <link rel="stylesheet" href="files/nav-dropdown.css" />
 
@@ -231,6 +229,12 @@ <h2 class="forge-h2">The full board.</h2>
                 <a class="forge-footer__link" href="changelist.html">change list</a>
                 <a class="forge-footer__link" href="downloads.html">downloads</a>
             </div>
+            <div>
+                <div class="forge-footer__col-head">legal</div>
+                <a class="forge-footer__link" href="https://legal.gaijin.net/termsofservice">terms of service</a>
+                <a class="forge-footer__link" href="https://legal.gaijin.net/privacypolicy">privacy policy</a>
+                <a class="forge-footer__link" href="https://github.com/GaijinEntertainment/daScript/blob/master/LICENSE">bsd 3-clause license</a>
+            </div>
         </div>
     </footer>
 
diff --git a/site/blog/build_blog.py b/site/blog/build_blog.py
index 0e9ba1fa4d..20a74a77e4 100644
--- a/site/blog/build_blog.py
+++ b/site/blog/build_blog.py
@@ -53,14 +53,6 @@
 
 KEY_RE = re.compile(r'^([a-zA-Z_]+):\s*(.*)$')
 
-# Disqus shortname carried over from the legacy borisbat.github.io/dascf-blog
-# install — the same account, but new threads under daslang.io URLs (Disqus
-# resolves identifier first, then page.url). Old comments stay under the
-# original blog URLs in the Disqus admin and can be migrated via the
-# Disqus URL Mapper if desired.
-DISQUS_SHORTNAME = 'https-borisbat-github-io-dascf-blog'
-
-
 @dataclass
 class Entry:
     slug: str
@@ -296,7 +288,6 @@ def render_post(entry: Entry, prev: Entry | None, next: Entry | None, md, posts_
     else:
         parts.append('<span></span>')
     nav_html = f'<div class="forge-post-nav">{parts[0]}{parts[1]}</div>'
-    comments_html = render_comments(entry)
     return f"""    <article class="forge-post">
         <div class="forge-container">
             <div class="forge-post__meta">
@@ -310,40 +301,10 @@ def render_post(entry: Entry, prev: Entry | None, next: Entry | None, md, posts_
             {nav_html}
         </div>
     </article>
-{comments_html}"""
-
-
-def render_comments(entry: Entry) -> str:
-    """Disqus thread, pinned by post slug as identifier so threads survive
-    URL changes (dev/prod, future renames). The embed script reads
-    `disqus_config` for the URL + identifier."""
-    slug = html.escape(entry.slug, quote=True)
-    return f"""    <section class="forge-post__comments">
-        <div class="forge-container">
-            <div class="forge-section-label">
-                <span class="forge-section-label__num">§</span>
-                <span class="forge-section-label__rule"></span>
-                <span>comments</span>
-            </div>
-            <div id="disqus_thread"></div>
-            <script>
-                var disqus_config = function () {{
-                    this.page.url = window.location.href;
-                    this.page.identifier = "{slug}";
-                }};
-                (function() {{
-                    var d = document, s = d.createElement('script');
-                    s.src = 'https://{DISQUS_SHORTNAME}.disqus.com/embed.js';
-                    s.setAttribute('data-timestamp', +new Date());
-                    (d.head || d.body).appendChild(s);
-                }})();
-            </script>
-            <noscript>Comments require JavaScript — <a href="https://disqus.com/?ref_noscript">comments powered by Disqus</a>.</noscript>
-        </div>
-    </section>
 """
 
 
+
 def render_index(posts: list[Entry], md) -> str:
     items = []
     for p in posts:
diff --git a/site/blog/template.html b/site/blog/template.html
index d8d206b4de..248cdfb296 100644
--- a/site/blog/template.html
+++ b/site/blog/template.html
@@ -9,9 +9,7 @@
     <link rel="icon" type="image/svg+xml" href="{{root}}files/daslang-favicon.svg" />
     <link rel="alternate icon" type="image/x-icon" href="{{root}}files/daslang.ico" />
     <link rel="alternate" type="application/atom+xml" title="Daslang blog" href="{{root}}blog/feed.xml" />
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter+Tight:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&family=JetBrains+Mono:wght@400;500;600;700&display=swap" />
+    <link rel="stylesheet" href="{{root}}files/fonts/fonts.css" />
     <link rel="stylesheet" href="{{root}}files/forge.css" />
     <link rel="stylesheet" href="{{root}}files/nav-dropdown.css" />
     <script src="{{root}}files/cm/daslang-keywords.js" defer></script>
@@ -117,6 +115,12 @@
                 <a class="forge-footer__link" href="{{root}}changelist.html">change list</a>
                 <a class="forge-footer__link" href="{{root}}downloads.html">downloads</a>
             </div>
+            <div>
+                <div class="forge-footer__col-head">legal</div>
+                <a class="forge-footer__link" href="https://legal.gaijin.net/termsofservice">terms of service</a>
+                <a class="forge-footer__link" href="https://legal.gaijin.net/privacypolicy">privacy policy</a>
+                <a class="forge-footer__link" href="https://github.com/GaijinEntertainment/daScript/blob/master/LICENSE">bsd 3-clause license</a>
+            </div>
         </div>
     </footer>
 </div>
diff --git a/site/dasllama.html b/site/dasllama.html
index 966eb62efc..c863fe9120 100644
--- a/site/dasllama.html
+++ b/site/dasllama.html
@@ -17,9 +17,7 @@
     <link rel="icon" type="image/svg+xml" href="files/daslang-favicon.svg" />
     <link rel="alternate icon" type="image/x-icon" href="files/daslang.ico" />
     <link rel="alternate" type="application/atom+xml" title="Daslang blog" href="blog/feed.xml" />
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter+Tight:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&family=JetBrains+Mono:wght@400;500;600;700&display=swap" />
+<link rel="stylesheet" href="files/fonts/fonts.css"/>
     <link rel="stylesheet" href="files/forge.css" />
     <link rel="stylesheet" href="files/nav-dropdown.css" />
 
@@ -479,6 +477,12 @@ <h2 class="forge-h2" style="margin-bottom:36px">The method, stated in full.</h2>
                 <a class="forge-footer__link" href="changelist.html">change list</a>
                 <a class="forge-footer__link" href="downloads.html">downloads</a>
             </div>
+            <div>
+                <div class="forge-footer__col-head">legal</div>
+                <a class="forge-footer__link" href="https://legal.gaijin.net/termsofservice">terms of service</a>
+                <a class="forge-footer__link" href="https://legal.gaijin.net/privacypolicy">privacy policy</a>
+                <a class="forge-footer__link" href="https://github.com/GaijinEntertainment/daScript/blob/master/LICENSE">bsd 3-clause license</a>
+            </div>
         </div>
     </footer>
 
diff --git a/site/daspkg.html b/site/daspkg.html
index 4790d49c1b..8a72813934 100644
--- a/site/daspkg.html
+++ b/site/daspkg.html
@@ -11,9 +11,7 @@
     <link rel="icon" type="image/svg+xml" href="files/daslang-favicon.svg" />
     <link rel="alternate icon" type="image/x-icon" href="files/daslang.ico" />
     <link rel="alternate" type="application/atom+xml" title="Daslang blog" href="blog/feed.xml" />
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter+Tight:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&family=JetBrains+Mono:wght@400;500;600;700&display=swap" />
+<link rel="stylesheet" href="files/fonts/fonts.css"/>
     <link rel="stylesheet" href="files/forge.css" />
     <link rel="stylesheet" href="files/nav-dropdown.css" />
 
@@ -180,6 +178,12 @@ <h1>
                 <a class="forge-footer__link" href="changelist.html">change list</a>
                 <a class="forge-footer__link" href="downloads.html">downloads</a>
             </div>
+            <div>
+                <div class="forge-footer__col-head">legal</div>
+                <a class="forge-footer__link" href="https://legal.gaijin.net/termsofservice">terms of service</a>
+                <a class="forge-footer__link" href="https://legal.gaijin.net/privacypolicy">privacy policy</a>
+                <a class="forge-footer__link" href="https://github.com/GaijinEntertainment/daScript/blob/master/LICENSE">bsd 3-clause license</a>
+            </div>
         </div>
     </footer>
 
diff --git a/site/downloads.html b/site/downloads.html
index 4cdd7a44da..7e499cb5ed 100644
--- a/site/downloads.html
+++ b/site/downloads.html
@@ -10,9 +10,7 @@
     <link rel="icon" type="image/svg+xml" href="files/daslang-favicon.svg" />
     <link rel="alternate icon" type="image/x-icon" href="files/daslang.ico" />
     <link rel="alternate" type="application/atom+xml" title="Daslang blog" href="blog/feed.xml" />
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter+Tight:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&family=JetBrains+Mono:wght@400;500;600;700&display=swap" />
+<link rel="stylesheet" href="files/fonts/fonts.css"/>
     <link rel="stylesheet" href="files/forge.css" />
     <link rel="stylesheet" href="files/nav-dropdown.css" />
 
@@ -235,6 +233,12 @@ <h2 class="forge-h2">Where to learn more.</h2>
                 <a class="forge-footer__link" href="https://github.com/GaijinEntertainment/daScript">github</a>
                 <a class="forge-footer__link" href="changelist.html">change list</a>
             </div>
+            <div>
+                <div class="forge-footer__col-head">legal</div>
+                <a class="forge-footer__link" href="https://legal.gaijin.net/termsofservice">terms of service</a>
+                <a class="forge-footer__link" href="https://legal.gaijin.net/privacypolicy">privacy policy</a>
+                <a class="forge-footer__link" href="https://github.com/GaijinEntertainment/daScript/blob/master/LICENSE">bsd 3-clause license</a>
+            </div>
         </div>
     </footer>
 
diff --git a/site/examples.html b/site/examples.html
index f7da66be53..d6bff6f294 100644
--- a/site/examples.html
+++ b/site/examples.html
@@ -16,9 +16,7 @@
     <link rel="icon" type="image/svg+xml" href="files/daslang-favicon.svg" />
     <link rel="alternate icon" type="image/x-icon" href="files/daslang.ico" />
     <link rel="alternate" type="application/atom+xml" title="Daslang blog" href="blog/feed.xml" />
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter+Tight:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&family=JetBrains+Mono:wght@400;500;600;700&display=swap" />
+<link rel="stylesheet" href="files/fonts/fonts.css"/>
     <link rel="stylesheet" href="files/forge.css" />
     <link rel="stylesheet" href="files/nav-dropdown.css" />
 
@@ -144,6 +142,12 @@ <h1 class="forge-ex-hero__title">
                 <a class="forge-footer__link" href="changelist.html">change list</a>
                 <a class="forge-footer__link" href="downloads.html">downloads</a>
             </div>
+            <div>
+                <div class="forge-footer__col-head">legal</div>
+                <a class="forge-footer__link" href="https://legal.gaijin.net/termsofservice">terms of service</a>
+                <a class="forge-footer__link" href="https://legal.gaijin.net/privacypolicy">privacy policy</a>
+                <a class="forge-footer__link" href="https://github.com/GaijinEntertainment/daScript/blob/master/LICENSE">bsd 3-clause license</a>
+            </div>
         </div>
     </footer>
 
diff --git a/site/files/fonts/InterTight-italic-cyrillic-ext.woff2 b/site/files/fonts/InterTight-italic-cyrillic-ext.woff2
new file mode 100644
index 0000000000..83c2eff740
Binary files /dev/null and b/site/files/fonts/InterTight-italic-cyrillic-ext.woff2 differ
diff --git a/site/files/fonts/InterTight-italic-cyrillic.woff2 b/site/files/fonts/InterTight-italic-cyrillic.woff2
new file mode 100644
index 0000000000..70552d21a2
Binary files /dev/null and b/site/files/fonts/InterTight-italic-cyrillic.woff2 differ
diff --git a/site/files/fonts/InterTight-italic-greek-ext.woff2 b/site/files/fonts/InterTight-italic-greek-ext.woff2
new file mode 100644
index 0000000000..c81a4e55a9
Binary files /dev/null and b/site/files/fonts/InterTight-italic-greek-ext.woff2 differ
diff --git a/site/files/fonts/InterTight-italic-greek.woff2 b/site/files/fonts/InterTight-italic-greek.woff2
new file mode 100644
index 0000000000..95d91ab686
Binary files /dev/null and b/site/files/fonts/InterTight-italic-greek.woff2 differ
diff --git a/site/files/fonts/InterTight-italic-latin-ext.woff2 b/site/files/fonts/InterTight-italic-latin-ext.woff2
new file mode 100644
index 0000000000..12f8e8f5a5
Binary files /dev/null and b/site/files/fonts/InterTight-italic-latin-ext.woff2 differ
diff --git a/site/files/fonts/InterTight-italic-latin.woff2 b/site/files/fonts/InterTight-italic-latin.woff2
new file mode 100644
index 0000000000..870e9b5982
Binary files /dev/null and b/site/files/fonts/InterTight-italic-latin.woff2 differ
diff --git a/site/files/fonts/InterTight-italic-vietnamese.woff2 b/site/files/fonts/InterTight-italic-vietnamese.woff2
new file mode 100644
index 0000000000..072774eca7
Binary files /dev/null and b/site/files/fonts/InterTight-italic-vietnamese.woff2 differ
diff --git a/site/files/fonts/InterTight-normal-cyrillic-ext.woff2 b/site/files/fonts/InterTight-normal-cyrillic-ext.woff2
new file mode 100644
index 0000000000..23a7b3eede
Binary files /dev/null and b/site/files/fonts/InterTight-normal-cyrillic-ext.woff2 differ
diff --git a/site/files/fonts/InterTight-normal-cyrillic.woff2 b/site/files/fonts/InterTight-normal-cyrillic.woff2
new file mode 100644
index 0000000000..f0a04608af
Binary files /dev/null and b/site/files/fonts/InterTight-normal-cyrillic.woff2 differ
diff --git a/site/files/fonts/InterTight-normal-greek-ext.woff2 b/site/files/fonts/InterTight-normal-greek-ext.woff2
new file mode 100644
index 0000000000..68cbfb4227
Binary files /dev/null and b/site/files/fonts/InterTight-normal-greek-ext.woff2 differ
diff --git a/site/files/fonts/InterTight-normal-greek.woff2 b/site/files/fonts/InterTight-normal-greek.woff2
new file mode 100644
index 0000000000..0d638f0024
Binary files /dev/null and b/site/files/fonts/InterTight-normal-greek.woff2 differ
diff --git a/site/files/fonts/InterTight-normal-latin-ext.woff2 b/site/files/fonts/InterTight-normal-latin-ext.woff2
new file mode 100644
index 0000000000..8df773db33
Binary files /dev/null and b/site/files/fonts/InterTight-normal-latin-ext.woff2 differ
diff --git a/site/files/fonts/InterTight-normal-latin.woff2 b/site/files/fonts/InterTight-normal-latin.woff2
new file mode 100644
index 0000000000..228154ffb1
Binary files /dev/null and b/site/files/fonts/InterTight-normal-latin.woff2 differ
diff --git a/site/files/fonts/InterTight-normal-vietnamese.woff2 b/site/files/fonts/InterTight-normal-vietnamese.woff2
new file mode 100644
index 0000000000..d08a67efd6
Binary files /dev/null and b/site/files/fonts/InterTight-normal-vietnamese.woff2 differ
diff --git a/site/files/fonts/JetBrainsMono-normal-cyrillic-ext.woff2 b/site/files/fonts/JetBrainsMono-normal-cyrillic-ext.woff2
new file mode 100644
index 0000000000..024a1af5eb
Binary files /dev/null and b/site/files/fonts/JetBrainsMono-normal-cyrillic-ext.woff2 differ
diff --git a/site/files/fonts/JetBrainsMono-normal-cyrillic.woff2 b/site/files/fonts/JetBrainsMono-normal-cyrillic.woff2
new file mode 100644
index 0000000000..1b61cf966c
Binary files /dev/null and b/site/files/fonts/JetBrainsMono-normal-cyrillic.woff2 differ
diff --git a/site/files/fonts/JetBrainsMono-normal-greek.woff2 b/site/files/fonts/JetBrainsMono-normal-greek.woff2
new file mode 100644
index 0000000000..06f0936048
Binary files /dev/null and b/site/files/fonts/JetBrainsMono-normal-greek.woff2 differ
diff --git a/site/files/fonts/JetBrainsMono-normal-latin-ext.woff2 b/site/files/fonts/JetBrainsMono-normal-latin-ext.woff2
new file mode 100644
index 0000000000..310faddfdd
Binary files /dev/null and b/site/files/fonts/JetBrainsMono-normal-latin-ext.woff2 differ
diff --git a/site/files/fonts/JetBrainsMono-normal-latin.woff2 b/site/files/fonts/JetBrainsMono-normal-latin.woff2
new file mode 100644
index 0000000000..2ca6ac6059
Binary files /dev/null and b/site/files/fonts/JetBrainsMono-normal-latin.woff2 differ
diff --git a/site/files/fonts/JetBrainsMono-normal-vietnamese.woff2 b/site/files/fonts/JetBrainsMono-normal-vietnamese.woff2
new file mode 100644
index 0000000000..d37ea35987
Binary files /dev/null and b/site/files/fonts/JetBrainsMono-normal-vietnamese.woff2 differ
diff --git a/site/files/fonts/fonts.css b/site/files/fonts/fonts.css
new file mode 100644
index 0000000000..1462ddfea1
--- /dev/null
+++ b/site/files/fonts/fonts.css
@@ -0,0 +1,180 @@
+/* cyrillic-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-cyrillic-ext.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-cyrillic.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-greek-ext.woff2) format('woff2');
+  unicode-range: U+1F00-1FFF;
+}
+/* greek */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-greek.woff2) format('woff2');
+  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-vietnamese.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-latin-ext.woff2) format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: italic;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-italic-latin.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+/* cyrillic-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-cyrillic-ext.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-cyrillic.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-greek-ext.woff2) format('woff2');
+  unicode-range: U+1F00-1FFF;
+}
+/* greek */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-greek.woff2) format('woff2');
+  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-vietnamese.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-latin-ext.woff2) format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Inter Tight';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(InterTight-normal-latin.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+/* cyrillic-ext */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-cyrillic-ext.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-cyrillic.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-greek.woff2) format('woff2');
+  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-vietnamese.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-latin-ext.woff2) format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400 700;
+  font-display: swap;
+  src: url(JetBrainsMono-normal-latin.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
diff --git a/site/files/forge.css b/site/files/forge.css
index 37059c353a..6ebb2cab74 100644
--- a/site/files/forge.css
+++ b/site/files/forge.css
@@ -30,7 +30,7 @@
     --font-sans: "Inter Tight", "Inter", -apple-system, system-ui, sans-serif;
     --font-mono: "JetBrains Mono", "SF Mono", ui-monospace, Menlo, monospace;
 
-    /* Hint embedded widgets (Disqus, GitHub, etc.) to render in dark mode. */
+    /* Hint embedded widgets (GitHub, etc.) to render in dark mode. */
     color-scheme: dark;
 }
 
@@ -899,37 +899,6 @@ button { font: inherit; border: 0; background: none; color: inherit; cursor: poi
 .forge-post-nav a { color: var(--fg-dim); }
 .forge-post-nav a:hover { color: var(--amber); }
 
-/* ───── Comments (Disqus) ───── */
-
-/* Disqus loads in a sandboxed iframe so we can only style the wrapper —
- * the comment styling itself comes from the Disqus admin panel
- * (Appearance → Color scheme: Auto). The `color-scheme: dark` hint on
- * :root makes Auto resolve to dark. */
-.forge-post__comments {
-    padding: 56px 0 88px;
-    border-top: 1px solid var(--rule);
-    background: var(--bg);
-}
-.forge-post__comments .forge-section-label { margin-bottom: 18px; }
-.forge-post__comments #disqus_thread {
-    margin-top: 20px;
-    background: var(--bg-2);
-    border: 1px solid var(--rule);
-    border-radius: 8px;
-    padding: 16px 20px;
-    min-height: 80px;
-}
-.forge-post__comments noscript {
-    display: block;
-    margin-top: 16px;
-    color: var(--fg-faint);
-    font-family: var(--font-mono);
-    font-size: 12.5px;
-}
-.forge-post__comments noscript a {
-    color: var(--amber);
-    border-bottom: 1px solid var(--amber-dim);
-}
 
 /* Changelist: same layout as blog listing, wider. */
 .forge-changelist { margin-top: 24px; }
@@ -944,7 +913,7 @@ button { font: inherit; border: 0; background: none; color: inherit; cursor: poi
 }
 .forge-footer__grid {
     display: grid;
-    grid-template-columns: 1.4fr 1fr 1fr 1fr;
+    grid-template-columns: 1.4fr 1fr 1fr 1fr 1fr;
     gap: 32px;
 }
 .forge-footer__about {
diff --git a/site/index.html b/site/index.html
index 87e8cfb34e..edb11f18d1 100644
--- a/site/index.html
+++ b/site/index.html
@@ -19,9 +19,7 @@
     <link rel="alternate" type="application/atom+xml" title="Daslang blog" href="blog/feed.xml" />
 
     <!-- Fonts -->
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter+Tight:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&family=JetBrains+Mono:wght@400;500;600;700&display=swap" />
+<link rel="stylesheet" href="files/fonts/fonts.css"/>
 
     <link rel="stylesheet" href="files/forge.css" />
     <link rel="stylesheet" href="files/nav-dropdown.css" />
@@ -472,6 +470,12 @@ <h2 class="forge-h2">Recent activity.</h2>
                 <a class="forge-footer__link" href="changelist.html">change list</a>
                 <a class="forge-footer__link" href="downloads.html">downloads</a>
             </div>
+            <div>
+                <div class="forge-footer__col-head">legal</div>
+                <a class="forge-footer__link" href="https://legal.gaijin.net/termsofservice">terms of service</a>
+                <a class="forge-footer__link" href="https://legal.gaijin.net/privacypolicy">privacy policy</a>
+                <a class="forge-footer__link" href="https://github.com/GaijinEntertainment/daScript/blob/master/LICENSE">bsd 3-clause license</a>
+            </div>
         </div>
     </footer>
 
diff --git a/site/performance.html b/site/performance.html
index 8c78e29224..c7b2968bd5 100644
--- a/site/performance.html
+++ b/site/performance.html
@@ -17,9 +17,7 @@
     <link rel="icon" type="image/svg+xml" href="files/daslang-favicon.svg" />
     <link rel="alternate icon" type="image/x-icon" href="files/daslang.ico" />
     <link rel="alternate" type="application/atom+xml" title="Daslang blog" href="blog/feed.xml" />
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter+Tight:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&family=JetBrains+Mono:wght@400;500;600;700&display=swap" />
+<link rel="stylesheet" href="files/fonts/fonts.css"/>
     <link rel="stylesheet" href="files/forge.css" />
     <link rel="stylesheet" href="files/nav-dropdown.css" />
 
@@ -353,6 +351,12 @@ <h2 class="forge-h2" style="margin-bottom:36px">How the numbers are made.</h2>
                 <a class="forge-footer__link" href="changelist.html">change list</a>
                 <a class="forge-footer__link" href="downloads.html">downloads</a>
             </div>
+            <div>
+                <div class="forge-footer__col-head">legal</div>
+                <a class="forge-footer__link" href="https://legal.gaijin.net/termsofservice">terms of service</a>
+                <a class="forge-footer__link" href="https://legal.gaijin.net/privacypolicy">privacy policy</a>
+                <a class="forge-footer__link" href="https://github.com/GaijinEntertainment/daScript/blob/master/LICENSE">bsd 3-clause license</a>
+            </div>
         </div>
     </footer>
 
diff --git a/site/playground/index.html b/site/playground/index.html
index f536a9a88e..b39fe80d45 100644
--- a/site/playground/index.html
+++ b/site/playground/index.html
@@ -15,9 +15,7 @@
 
     <link rel="icon" type="image/svg+xml" href="../files/daslang-favicon.svg" />
     <link rel="alternate icon" type="image/x-icon" href="../files/daslang.ico" />
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter+Tight:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&family=JetBrains+Mono:wght@400;500;600;700&display=swap" />
+<link rel="stylesheet" href="../files/fonts/fonts.css"/>
 
     <!-- Forge first (tokens), then web/ui's main.css (IDE structure),
          then forge-skin.css (override IDE chrome to match Forge),
diff --git a/site/playground/placeholder.html b/site/playground/placeholder.html
index e8b6f19098..6e4abb0056 100644
--- a/site/playground/placeholder.html
+++ b/site/playground/placeholder.html
@@ -9,9 +9,7 @@
 
     <link rel="icon" type="image/svg+xml" href="../files/daslang-favicon.svg" />
     <link rel="alternate icon" type="image/x-icon" href="../files/daslang.ico" />
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter+Tight:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&family=JetBrains+Mono:wght@400;500;600;700&display=swap" />
+<link rel="stylesheet" href="../files/fonts/fonts.css"/>
     <link rel="stylesheet" href="../files/forge.css" />
     <link rel="stylesheet" href="../files/nav-dropdown.css" />
 </head>
diff --git a/utils/REVIEW.md b/utils/REVIEW.md
index d9db23509f..c2f6157f50 100644
--- a/utils/REVIEW.md
+++ b/utils/REVIEW.md
@@ -3,8 +3,13 @@
 **Read `REVIEW_COMMON.md` (repo root) first - its contract binds this checklist.** Architecture
 doc: `CLAUDE.md` (repo root).
 
-**A file that belongs to a tool is reviewed with that tool's own `REVIEW.md`, where one exists,
-as well as with this checklist - not the checklist of the directory the file sits in.**
+**A file under `utils/` that belongs to a tool other than the one owning the directory it
+sits in is reviewed with that tool's own `REVIEW.md`, where one exists, as well as with this
+checklist - not with the checklist of the directory it sits in.** A tool's file OUTSIDE
+`utils/` answers to the checklist of the folder that contains it.
+
+**A diff that changes the consent wording in `watchdog/watchdog.py` answers to
+`modules/dasLLAMA/performance/REVIEW.md` (repo root) too.**
 
 **Weakening `REVIEW.das` (beside this file) is a defect.** What the gate checks is read from the
 script itself, and each check's finding text states its rule.
diff --git a/utils/dasllama-server/README.md b/utils/dasllama-server/README.md
index 552339edaa..7183e31e85 100644
--- a/utils/dasllama-server/README.md
+++ b/utils/dasllama-server/README.md
@@ -195,11 +195,12 @@ Windows locks the DLLs.
 | `GET`  | `/config` | Effective config with per-key source (`default`/`cli`/`toml`), the `[[models]]` roster, model files beside the served one, active rail (gguf vs prepared `.dlim`), GPU tier status (`supported` + `reason` when the loaded model can't ride it) |
 | `POST` | `/config` | Validate a `{key: value}` JSON body and write it as an **authoritative** TOML (`authoritative = true`) to the config path (or `dasllama-server.toml` beside the program on a config-less start). Applies on the next restart |
 | `POST` | `/restart` | Drain like `/shutdown`, then exit with code **4** - the watchdog relaunches, picking up the saved config (3 stays the tune-restart code) |
-| `GET`  | `/exchange` | The sidecar-exchange surface: policy (url/accept/submit) + the current tune sidecar's identity and share state (sha, origin, box/applied_box, version gate, shared-yet) |
+| `GET`  | `/exchange` | The sidecar-exchange surface: policy (url/accept/submit/configured), the consent state (`consent`: accepted/declined/empty, `consent_notice`: the first-contact text), + the current tune sidecar's identity and share state (sha, origin, box/applied_box, version gate, shared-yet) |
 | `GET`  | `/exchange/matches` | Live lookup of this box against the exchange (a network call - seconds; the control page requests it explicitly) |
 | `POST` | `/exchange/apply` | `{"sha": ...}`: download + validate (content sha, schema, `DASLLAMA_VERSION`) + adopt that sidecar, then drain and exit **4** so the relaunch stamps its winners |
 | `POST` | `/exchange/submit` | Privacy-strip and submit this box's own tune to the exchange (refuses exchange-sourced or foreign-box sidecars) |
-| `POST` | `/exchange/retune` | Arm a local re-tune: removes the sidecar, skips the exchange once, restarts - the next boot races this box (~20 min, quiet machine) |
+| `POST` | `/exchange/retune` | Arm a local re-tune: removes the sidecar, skips the exchange once, restarts - the next boot races this box (~12 min, quiet machine) |
+| `POST` | `/exchange/consent` | `{"accept": true\|false}`: record the first-contact choice (the GDPR gate below); replies `{ok, accepted, restarting?}`. Accept on an untuned/stale box drains and exits **4** so the relaunch runs the lookup |
 | `POST` | `/gc` | Schedule a validated collection at the next lifecycle safe point; concurrent requests coalesce |
 | `POST` | `/shutdown` | Stop admitting new LLM/ASR work, drain accepted work, then exit |
 
@@ -209,12 +210,21 @@ authoritative TOML`.
 
 The sidecar exchange rides three config-only keys (no CLI flags - one code path):
 `exchange_accept = verified | any | off` (default `verified` - at an untuned boot a verified
-match downloads and applies instead of racing ~20 minutes; unverified NEVER auto-applies),
+match downloads and applies instead of racing ~12 minutes; unverified NEVER auto-applies),
 `exchange_submit = ask | always | never` (default `ask` - a fresh local tune surfaces as an
 offer on the control page and the watchdog balloon; `always` shares it automatically), and
 `exchange_url` (baked default `https://dasllama.io`). `DASLLAMA_EXCHANGE_URL` /
 `DASLLAMA_EXCHANGE_ACCEPT` env override for tests and one-shot watchdog relaunches. Lookup
-failure is never fatal - the boot falls through to the local tuner. The `gpu` key (`auto | off | metal | metal-required | vulkan`) is the first-class
+failure is never fatal - the boot falls through to the local tuner.
+
+**First-contact consent (GDPR):** nothing is sent to the exchange until a choice is
+expressed. Setting any `exchange_*` key (TOML or env) IS that choice; on the zero-config
+path the recorded choice lives in `<app>.tune.consent` beside the sidecar
+(`accepted`/`declined`, one word). With no recorded choice: an interactive terminal asks
+inline (Enter = Accept); a supervised boot emits `@sidecar consent state=needed` - the
+watchdog shows a native Accept/Decline dialog - and this page's exchange card carries the
+same banner (`POST /exchange/consent`). Until one of those answers, the box tunes locally
+and no request leaves. The `gpu` key (`auto | off | metal | metal-required | vulkan`) is the first-class
 backend selector, and **defaults-first: unset (with no legacy `--metal` flag) behaves as
 `auto`** - the boot probes the box and serves on the best detected backend (the Metal rails
 where the box has them, else the Vulkan tier when a device answers, else the CPU), logging
diff --git a/utils/dasllama-server/REVIEW.md b/utils/dasllama-server/REVIEW.md
index 969de12544..a792931765 100644
--- a/utils/dasllama-server/REVIEW.md
+++ b/utils/dasllama-server/REVIEW.md
@@ -1,28 +1,24 @@
 # dasllama-server Code Review Checklist
 
 **Read `REVIEW_COMMON.md` (repo root) first - its contract binds this checklist.** Architecture
-doc: `README.md`.
+doc: `README.md`. Planned work: `CONTROL_PAGE_PLAN.md`.
 
 **A diff to a file that requires a `dasllama/*` module applies `modules/dasLLAMA/REVIEW.md`
 (repo root) too.**
 
-**Never write or edit a fixture under `tests/fixtures/` by hand - capture the bytes of a real
-server run and normalize the machine-local paths instead.** `tests/fixtures/README.md` gives
-the capture steps.
+**Never hand-write or hand-edit a fixture under `tests/fixtures/`, or a wire body in a spec
+under `tests/` - capture the bytes of a real server run and normalize the machine-local paths
+instead.** `tests/fixtures/README.md` gives the capture steps.
 
 **Weakening `REVIEW.das` (beside this file) is a defect** - dropping a check, narrowing what a
 check scans, adding a name to a check's licensed set (the names that check does not flag), or
 changing a finding text so it no longer names what failed. What the gate enforces is read from
 the gate itself.
 
-**A diff that adds or removes a route, or changes its path, method, or a request field the
-server reads, updates every surface that documents or uses that route, in the same change**:
-the `README.md` route row, the endpoint table in
-`doc/source/reference/utils/dasllama_server.rst` (repo root), and `control.html` where the
-page uses it.
+**A diff that adds a route, or changes a request field the server reads, updates
+`control.html` where the page uses it, in the same change.**
 
-**A diff that adds, removes, or renames a key in a response body re-captures that route's
-fixtures under `tests/fixtures/` and updates that route's row in `README.md` (beside this
-file) - a new or renamed key is listed there, a removed key is struck from it - in the same
-change** - the fixtures are the recorded response shape, and the row is where a consumer learns
-the key exists.
+**A diff that makes `control.html` or a spec under `tests/` read a response key that no
+fixture under `tests/fixtures/` carries is a defect - re-capture the fixture and list the key
+in that route's `README.md` row, in the same change.** The fixtures are the recorded response
+shape, and the row is where a consumer learns the key exists.
diff --git a/utils/dasllama-server/control.html b/utils/dasllama-server/control.html
index 94106e3423..e523db88a6 100644
--- a/utils/dasllama-server/control.html
+++ b/utils/dasllama-server/control.html
@@ -413,6 +413,13 @@
 
     <div class="sec" id="exchange"><span>§ 12</span><span class="rule"></span><span>sidecar exchange</span></div>
     <div class="panel">
+        <div class="cfg-file" id="ex-consent" style="display:none">
+            <div id="ex-consent-text" style="white-space:pre-line"></div>
+            <div class="controls" style="margin-top:8px">
+                <button id="b-consent-accept" type="button">accept — use the exchange</button>
+                <button id="b-consent-decline" type="button">decline — tune locally</button>
+            </div>
+        </div>
         <div class="cfg-file" id="ex-current">loading…</div>
         <div class="controls" style="margin:10px 0">
             <button id="b-ex-check" type="button">check the exchange</button>
@@ -2335,11 +2342,45 @@
         box.appendChild(exLine("written " + (c.written || "?") + " · noise " + (c.noise || "?") + " · engine sha " + (c.engine_sha || "?")
             + (c.local ? (c.shared ? " · shared with the exchange" : " · not shared yet") : "")));
     }
-    box.appendChild(exLine("exchange " + (pol.url || "") + " · accept " + (pol.accept || "verified") + " · share " + (pol.submit || "ask")));
+    const consent = pol.configured ? "configured" : (exchangeState.consent || "");
+    box.appendChild(exLine("exchange " + (pol.url || "") + " · accept " + (pol.accept || "verified") + " · share " + (pol.submit || "ask")
+        + " · consent " + (consent || "not asked yet")));
     $("ex-always").checked = pol.submit === "always";
     $("b-ex-submit").style.display = (c.present && c.local && !c.shared) ? "" : "none";
+    // The GDPR first-contact banner: an explicit exchange config is itself consent, so it
+    // shows only on the zero-config path — until a choice is recorded, and again when the
+    // recorded choice is "declined" (as the way to change your mind).
+    const banner = $("ex-consent");
+    if (!pol.configured && consent !== "accepted" && exchangeState.consent_notice) {
+        $("ex-consent-text").textContent = (consent === "declined" ? "The exchange is currently declined — accepting re-enables it.\n\n" : "")
+            + (exchangeState.consent_notice || "");
+        banner.style.display = "";
+    } else {
+        banner.style.display = "none";
+    }
 }
 
+async function postConsent(accept) {
+    $("b-consent-accept").disabled = $("b-consent-decline").disabled = true;
+    try {
+        const r = await fetch("/exchange/consent", {
+            method: "POST", headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ accept })
+        });
+        const doc = await r.json();
+        if (!r.ok) throw new Error(doc.error && doc.error.message || String(r.status));
+        $("ex-note").textContent = doc.restarting
+            ? "exchange enabled — restarting to look up a preset for this box…"
+            : (accept ? "exchange enabled" : "declined — this box tunes locally");
+        await loadExchange();
+    } catch (e) {
+        $("ex-note").textContent = "consent: " + e.message;
+    }
+    $("b-consent-accept").disabled = $("b-consent-decline").disabled = false;
+}
+$("b-consent-accept").addEventListener("click", () => postConsent(true));
+$("b-consent-decline").addEventListener("click", () => postConsent(false));
+
 async function loadExchange() {
     try {
         const r = await fetch("/exchange", { cache: "no-store" });
@@ -2438,7 +2479,7 @@
 });
 
 $("b-ex-retune").addEventListener("click", async () => {
-    if (!window.confirm("Re-tune this box? ~20 minutes on a QUIET machine — the server restarts, races the kernels, then relaunches itself. It does not serve while tuning.\n(needs the watchdog running)")) return;
+    if (!window.confirm("Re-tune this box? ~12 minutes on a QUIET machine — the server restarts, races the kernels, then relaunches itself. It does not serve while tuning.\n(needs the watchdog running)")) return;
     $("b-ex-retune").disabled = true;
     try {
         const r = await fetch("/exchange/retune", { method: "POST" });
@@ -2450,7 +2491,7 @@
             $("b-ex-retune").disabled = false;
             return;
         }
-        $("ex-note").textContent = "re-tune armed — the tune takes ~20 minutes; reload this page when the server is back";
+        $("ex-note").textContent = "re-tune armed — the tune takes ~12 minutes; reload this page when the server is back";
         restartingSince = performance.now();
         setBadge("warn", "restarting");
         waitForRestart();
@@ -2492,6 +2533,11 @@
         }
         exchangePolicy.submit = want;
         savedSnapshot = JSON.stringify(body);
+        // opting INTO auto-share is deliberate exchange engagement — record the consent it
+        // expresses, or the boot-time submit check degrades the choice back to an offer
+        if (want === "always" && (exchangeState.consent || "") !== "accepted") {
+            await postConsent(true);
+        }
         $("ex-note").textContent = want === "always"
             ? "every fresh tune on this box will be shared automatically"
             : "sharing goes back to asking first";
diff --git a/utils/dasllama-server/main.das b/utils/dasllama-server/main.das
index 6ccfc703af..bc0dd9f1b8 100644
--- a/utils/dasllama-server/main.das
+++ b/utils/dasllama-server/main.das
@@ -16,7 +16,7 @@ options stack = 524288   // every dasLLAMA program root takes this budget (optio
 // Then point any OpenAI client at http://127.0.0.1:<port>/v1 (opencode, Open WebUI, the `llm` CLI, …).
 //
 // Per-box tuning: the first start on an untuned box consults the sidecar exchange (dasllama.io —
-// a verified match downloads instead of racing ~20 min; exchange_accept/exchange_submit in the
+// a verified match downloads instead of racing ~12 min; exchange_accept/exchange_submit in the
 // config), else runs the dasLLAMA kernel tuner; either way it exits so the watchdog can restart
 // with the winners (missing = "restart"); `--tune` forces a local re-tune. Set DAS_TUNE_POLICY=error
 // while developing to skip per-start tuning (it prints the tuner command instead). The winners live
@@ -167,7 +167,7 @@ struct ModelEntry {
 }
 
 // registered from [init] so it lands before the tune-policy guard at the top of main: an
-// untuned boot consults the exchange (verified matches only by default) before racing ~20 min
+// untuned boot consults the exchange (verified matches only by default) before racing ~12 min
 [init]
 def register_exchange_resolver {
     exchange_register_resolver("dasllama-server.toml")
diff --git a/utils/dasllama-server/openai_server.das b/utils/dasllama-server/openai_server.das
index a2f6f6298a..a1e2cd831d 100644
--- a/utils/dasllama-server/openai_server.das
+++ b/utils/dasllama-server/openai_server.das
@@ -3495,6 +3495,8 @@ def private handle_exchange_apply(var req : HttpRequest?; var resp : HttpRespons
     if (!empty(err)) {
         return resp |> JSON(error_body(err, "invalid_request_error"), http_status.BAD_REQUEST)
     }
+    // explicitly fetching a sidecar IS engaging the exchange - record the consent it expresses
+    exchange_record_consent(true)
     to_log(LOG_INFO, "dasllama-server: exchange sidecar {sha} applied via the control page; draining for restart\n")
     g_shutdown_requested = true
     g_restart_requested = true
@@ -3513,6 +3515,41 @@ def private handle_exchange_submit(var req : HttpRequest?; var resp : HttpRespon
     return resp |> JSON("\{\"ok\":true}", http_status.OK)
 }
 
+def private handle_exchange_consent(var req : HttpRequest?; var resp : HttpResponse?) : http_status {
+    if (!is_loopback_req(req)) {
+        return resp |> JSON(error_body("loopback-only (operator surface)", "forbidden"), http_status.FORBIDDEN)
+    }
+    var jerr = ""
+    var js = read_json(string(req.body), jerr)
+    defer() {
+        unsafe {
+            delete js
+        }
+    }
+    if (js == null) {
+        return resp |> JSON(error_body("invalid JSON: {jerr}", "invalid_request_error"), http_status.BAD_REQUEST)
+    }
+    let av = js?["accept"]
+    if (av == null || !(av.value is _bool)) {
+        return resp |> JSON(error_body("body must carry accept:true|false", "invalid_request_error"), http_status.BAD_REQUEST)
+    }
+    let accepted = av.value as _bool
+    if (!exchange_record_consent(accepted)) {
+        return resp |> JSON(error_body("could not write the consent file", "server_error"), http_status.INTERNAL_SERVER_ERROR)
+    }
+    let manifest = tune_manifest_path()
+    if (accepted && (!stat(manifest).is_valid || tune_sidecar_stale(manifest))) {
+        // untuned (or stale) box just enabled the exchange — restart so the boot resolver
+        // runs the lookup; a tuned box records the choice and keeps serving
+        to_log(LOG_INFO, "dasllama-server: exchange enabled via the control page; draining for restart to run the lookup\n")
+        g_shutdown_requested = true
+        g_restart_requested = true
+        return resp |> JSON("\{\"ok\":true,\"accepted\":true,\"restarting\":true}", http_status.OK)
+    }
+    to_log(LOG_INFO, "dasllama-server: exchange consent recorded ({accepted ? "accepted" : "declined"}) via the control page\n")
+    return resp |> JSON("\{\"ok\":true,\"accepted\":{accepted}}", http_status.OK)
+}
+
 def private handle_exchange_retune(var req : HttpRequest?; var resp : HttpResponse?) : http_status {
     if (!is_loopback_req(req)) {
         return resp |> JSON(error_body("loopback-only (operator surface)", "forbidden"), http_status.FORBIDDEN)
@@ -4171,6 +4208,9 @@ class OpenAiServer : HvWebServer {
         POST("/exchange/retune") <| @(var req : HttpRequest?; var resp : HttpResponse?) : http_status {
             return handle_exchange_retune(req, resp)
         }
+        POST("/exchange/consent") <| @(var req : HttpRequest?; var resp : HttpResponse?) : http_status {
+            return handle_exchange_consent(req, resp)
+        }
         POST("/bench") <| @(var req : HttpRequest?; var resp : HttpResponse?) : http_status {
             if (!is_loopback_req(req)) return deny_operator(resp)
             return handle_bench_start(resp)
diff --git a/utils/dasllama-server/test_exchange_client.das b/utils/dasllama-server/test_exchange_client.das
index 41f3ecad47..b8f54de32f 100644
--- a/utils/dasllama-server/test_exchange_client.das
+++ b/utils/dasllama-server/test_exchange_client.das
@@ -448,6 +448,7 @@ def test_policy_and_discovery(t : T?) {
         tt |> equal(p0.url, EXCHANGE_URL_DEFAULT)
         tt |> equal(p0.accept, "verified")
         tt |> equal(p0.submit, "ask")
+        tt |> success(!p0.configured, "the baked defaults are not an expressed choice")
         let res = create_temp_file_result("exchange_policy_", ".toml")
         if (res is error) {
             tt |> failure("could not create a temp file")
@@ -459,10 +460,89 @@ def test_policy_and_discovery(t : T?) {
         tt |> equal(p1.url, "http://127.0.0.1:9")
         tt |> equal(p1.accept, "any")
         tt |> equal(p1.submit, "never")
+        tt |> success(p1.configured, "any exchange_* key in the config is an expressed choice (consent)")
         fwrite(path, "exchange_accept = \"yolo\"\nexchange_submit = \"whatever\"\n")
         let p2 = exchange_policy_from_config(path)
         tt |> equal(p2.accept, "verified", "a typo must never widen acceptance")
         tt |> equal(p2.submit, "ask")
+        fwrite(path, "authoritative = true\nexchange_url = \"http://127.0.0.1:9\"\nexchange_accept = \"any\"\n")
+        let p3 = exchange_policy_from_config(path)
+        tt |> equal(p3.accept, "any", "an authoritative toml still sets the policy")
+        tt |> success(!p3.configured, "the control page persists exchange defaults on EVERY save - an authoritative toml's keys are not consent")
         remove(path)
     }
 }
+
+[test]
+def test_consent(t : T?) {
+    t |> run("may_contact: the gate composition over every consent state") @(tt : T?) {
+        let res = create_temp_file_result("exchange_gate_", ".tune.json")
+        if (res is error) {
+            tt |> failure("could not create a temp file")
+            return
+        }
+        let manifest = res as value
+        let consent_file = "{slice(manifest, 0, length(manifest) - 5)}.consent"
+        set_tune_manifest_runtime_path(manifest)
+        remove(consent_file)
+        var off = ExchangePolicy()
+        off.accept = "off"
+        tt |> success(!exchange_may_contact(off), "accept=off never contacts, whatever the consent state")
+        var conf = ExchangePolicy()
+        conf.configured = true
+        conf.configured_via = "exchange_accept (config)"
+        tt |> success(exchange_may_contact(conf), "an expressed exchange config waives the question")
+        let zero = ExchangePolicy()
+        tt |> success(!exchange_may_contact(zero), "zero-config + never asked: nothing leaves (dastest has no TTY, so the event arm answers)")
+        verify(exchange_record_consent(false))
+        tt |> success(!exchange_may_contact(zero), "a recorded decline keeps the box offline")
+        verify(exchange_record_consent(true))
+        tt |> success(exchange_may_contact(zero), "a recorded accept opens the gate")
+        set_tune_manifest_runtime_path("")
+        remove(consent_file)
+        remove(manifest)
+    }
+    t |> run("configured attribution: each exchange_* key alone expresses the choice") @(tt : T?) {
+        let res = create_temp_file_result("exchange_onekey_", ".toml")
+        if (res is error) {
+            tt |> failure("could not create a temp file")
+            return
+        }
+        let path = res as value
+        fwrite(path, "exchange_url = \"http://127.0.0.1:9\"\n")
+        tt |> success(exchange_policy_from_config(path).configured, "exchange_url alone")
+        fwrite(path, "exchange_accept = \"any\"\n")
+        tt |> success(exchange_policy_from_config(path).configured, "exchange_accept alone")
+        fwrite(path, "exchange_submit = \"never\"\n")
+        tt |> success(exchange_policy_from_config(path).configured, "exchange_submit alone")
+        remove(path)
+    }
+    t |> run("consent path: a manifest without the .json suffix still gets a sibling") @(tt : T?) {
+        set_tune_manifest_runtime_path("some_app.tune")
+        verify(exchange_record_consent(true))
+        tt |> equal(exchange_consent_status(), "accepted", "the suffixless-manifest arm works")
+        remove("some_app.tune.consent")
+        set_tune_manifest_runtime_path("")
+    }
+    t |> run("consent: unset, record, round-trip") @(tt : T?) {
+        let res = create_temp_file_result("exchange_consent_", ".tune.json")
+        if (res is error) {
+            tt |> failure("could not create a temp file")
+            return
+        }
+        let manifest = res as value
+        let consent_file = "{slice(manifest, 0, length(manifest) - 5)}.consent"
+        set_tune_manifest_runtime_path(manifest)
+        remove(consent_file)
+        tt |> equal(exchange_consent_status(), "", "no file - never asked")
+        tt |> success(exchange_record_consent(true), "record accept")
+        tt |> equal(exchange_consent_status(), "accepted")
+        tt |> success(exchange_record_consent(false), "record decline")
+        tt |> equal(exchange_consent_status(), "declined")
+        fwrite(consent_file, "garbage\n")
+        tt |> equal(exchange_consent_status(), "", "an unreadable choice reads as never asked, not as either answer")
+        set_tune_manifest_runtime_path("")
+        remove(consent_file)
+        remove(manifest)
+    }
+}
diff --git a/utils/dasllama-server/tests/consent.spec.js b/utils/dasllama-server/tests/consent.spec.js
new file mode 100644
index 0000000000..6a7269cedd
--- /dev/null
+++ b/utils/dasllama-server/tests/consent.spec.js
@@ -0,0 +1,106 @@
+// §12 consent banner: the GDPR first-contact gate. It renders only on the zero-config path
+// of a consent-capable server (consent_notice present in /exchange), records the choice via
+// POST /exchange/consent, and never renders for an explicitly configured policy — an
+// exchange_* key IS the expressed choice. The captured fixture is the zero-config never-asked
+// state, so the banner cases are fixture-first; only consent/configured are varied.
+
+const { test, expect, fx, openControl, lastJson } = require('./fixtures');
+
+function consentEx(consent, configured) {
+    const ex = fx('exchange');
+    return { ...ex, consent, policy: { ...ex.policy, configured } };
+}
+
+test('no recorded choice on a zero-config policy shows the banner', async ({ page }) => {
+    const ex = fx('exchange');
+    // hard failure, not a skip: a regenerated exchange.json must stay the zero-config
+    // never-asked state (capture with no .consent file and no exchange_* config)
+    expect(ex.consent === '' && ex.policy.configured === false && !!ex.consent_notice,
+        'exchange fixture must be the zero-config never-asked state - recapture per fixtures/README.md').toBe(true);
+    await openControl(page);
+    await expect(page.locator('#ex-consent')).toBeVisible();
+    await expect(page.locator('#ex-consent-text')).toContainText(ex.consent_notice.slice(0, 40));
+    await expect(page.locator('#b-consent-accept')).toBeVisible();
+    await expect(page.locator('#b-consent-decline')).toBeVisible();
+    await expect(page.locator('#ex-current')).toContainText('consent not asked yet');
+});
+
+test('accept POSTs the choice and reports the lookup restart', async ({ page }) => {
+    const { posts } = await openControl(page, {
+        responses: { '/exchange/consent': { status: 200, json: { ok: true, accepted: true, restarting: true } } },
+    });
+    await page.locator('#b-consent-accept').click();
+    await expect(page.locator('#ex-note')).toContainText('restarting');
+    const consentPosts = posts.filter(p => p.path === '/exchange/consent');
+    expect(consentPosts.length).toBe(1);
+    expect(lastJson(consentPosts)).toEqual({ accept: true });
+});
+
+test('accept on a tuned box reports enabled without a restart', async ({ page }) => {
+    await openControl(page, {
+        responses: { '/exchange/consent': { status: 200, json: { ok: true, accepted: true } } },
+    });
+    await page.locator('#b-consent-accept').click();
+    await expect(page.locator('#ex-note')).toContainText('exchange enabled');
+});
+
+test('decline POSTs accept:false and says the box tunes locally', async ({ page }) => {
+    const { posts } = await openControl(page, {
+        responses: { '/exchange/consent': { status: 200, json: { ok: true, accepted: false } } },
+    });
+    await page.locator('#b-consent-decline').click();
+    await expect(page.locator('#ex-note')).toContainText('tunes locally');
+    expect(lastJson(posts.filter(p => p.path === '/exchange/consent'))).toEqual({ accept: false });
+});
+
+test('a declined record keeps the banner as the change-your-mind path', async ({ page }) => {
+    await openControl(page, { exchange: consentEx('declined', false) });
+    await expect(page.locator('#ex-consent')).toBeVisible();
+    await expect(page.locator('#ex-consent-text')).toContainText('currently declined');
+    await expect(page.locator('#ex-current')).toContainText('consent declined');
+});
+
+test('an accepted record hides the banner', async ({ page }) => {
+    await openControl(page, { exchange: consentEx('accepted', false) });
+    await expect(page.locator('#ex-consent')).toBeHidden();
+    await expect(page.locator('#ex-current')).toContainText('consent accepted');
+});
+
+test('an explicitly configured policy never shows the banner', async ({ page }) => {
+    await openControl(page, { exchange: consentEx('', true) });
+    await expect(page.locator('#ex-consent')).toBeHidden();
+    await expect(page.locator('#ex-current')).toContainText('consent configured');
+});
+
+test('a pre-consent server (no consent_notice) renders no banner', async ({ page }) => {
+    const ex = consentEx('', false);
+    delete ex.consent_notice;
+    await openControl(page, { exchange: ex });
+    await expect(page.locator('#ex-consent')).toBeHidden();
+});
+
+test('a failed consent POST surfaces the error and re-enables the buttons', async ({ page }) => {
+    await openControl(page, {
+        responses: { '/exchange/consent': { status: 500, json: { error: { message: 'disk full' } } } },
+    });
+    await page.locator('#b-consent-accept').click();
+    await expect(page.locator('#ex-note')).toContainText('consent: disk full');
+    await expect(page.locator('#b-consent-accept')).toBeEnabled();
+    await expect(page.locator('#b-consent-decline')).toBeEnabled();
+});
+
+test('opting into always-share also records consent', async ({ page }) => {
+    // the toggle saves an AUTHORITATIVE toml (not consent by itself) — the deliberate
+    // exchange engagement it expresses must land in the consent file too
+    const { posts } = await openControl(page, {
+        responses: {
+            '/config': { status: 200, json: { ok: true } },
+            '/exchange/consent': { status: 200, json: { ok: true, accepted: true } },
+        },
+    });
+    await page.locator('#ex-always').check();
+    await expect
+        .poll(() => posts.filter(p => p.path === '/exchange/consent').length, { timeout: 5000 })
+        .toBe(1);
+    expect(lastJson(posts.filter(p => p.path === '/exchange/consent'))).toEqual({ accept: true });
+});
diff --git a/utils/dasllama-server/tests/fixtures/exchange.json b/utils/dasllama-server/tests/fixtures/exchange.json
index 2ccaa7cc0a..4674087fdc 100644
--- a/utils/dasllama-server/tests/fixtures/exchange.json
+++ b/utils/dasllama-server/tests/fixtures/exchange.json
@@ -1 +1 @@
-{"policy": {"url": "https://dasllama.io", "accept": "verified", "submit": "ask"}, "engine_version": 5, "box": "windows|x86_64||10.0.26200.9168|AMD64 Family 23 Model 49 Stepping 0, AuthenticAMD", "manifest": "main.tune.json", "current": {"kernel_count": 40, "engine_sha": "a547bb0fa", "box": "windows|x86_64||10.0.26200.9168|AMD64 Family 23 Model 49 Stepping 0, AuthenticAMD", "exchange_sha": "", "present": true, "written": "2026-08-20T06:07:51.034Z", "stale": false, "dasllama_version": 5, "origin": "", "noise": "ok", "shared": false, "sha": "662bc1153dd035f873ade13870989f831639b0155e10854c609fb7411ef0ab38", "version_ok": true, "applied_box": "", "local": true}}
\ No newline at end of file
+{"policy": {"url": "https://dasllama.io", "accept": "verified", "submit": "ask", "configured": false}, "consent": "", "consent_notice": "dasLLAMA can download a ready performance-tuning preset (a \"sidecar\") for this machine from dasllama.io, instead of spending ~12 minutes tuning locally.\nThe request sends only your hardware class - platform, CPU model and OS build. No serial numbers, user names or other personal data; no cookies. Sharing your own tuning results back is always confirmed separately.\nDetails: https://legal.gaijin.net/privacypolicy", "engine_version": 11, "box": "darwin|arm64|MacBookPro18,2|25F84|Apple M1 Max", "manifest": "main.tune.json", "current": {"kernel_count": 40, "engine_sha": "67bf113a3", "box": "darwin|arm64|MacBookPro18,2|25F84|Apple M1 Max", "exchange_sha": "", "present": true, "written": "2026-08-28T15:53:02.196Z", "stale": false, "dasllama_version": 11, "origin": "", "noise": "ok", "shared": false, "sha": "95830f233806f57adc45cba0efdfa07c920c550b4e9ee94f2e4dbeb5ce1470eb", "version_ok": true, "applied_box": "", "local": true}}
\ No newline at end of file
diff --git a/utils/watchdog/README.md b/utils/watchdog/README.md
index 38375ea8c1..c297a22a5c 100644
--- a/utils/watchdog/README.md
+++ b/utils/watchdog/README.md
@@ -82,9 +82,16 @@ no ETA is published and none should be synthesized from these numbers.
 ### The exchange (`@sidecar` events, the tray's tune actions)
 
 dasllama's exchange client emits `@sidecar <kind> k=v ...` on the same contract (`lookup`,
-`none`, `offer`, `apply`, `pending_submit`, `submitted`); the watchdog folds them into
-`STATE["sidecar"]` and logs each one. Balloons announce a decision but never carry the action -
-the tray menu and the control page do:
+`none`, `offer`, `apply`, `pending_submit`, `submitted`, `consent`); the watchdog folds them
+into `STATE["sidecar"]` and logs each one. `consent state=needed` (the GDPR first-contact
+gate: the client found no recorded choice and no terminal to ask on) raises a native
+Accept/Decline dialog - osascript on macOS, MessageBoxW on Windows, a plain notification
+pointing at the control page elsewhere - once per consent file for the watchdog's lifetime.
+The answer lands in the consent file the event names (url-encoded `path=`); Accept during a
+tune also rides the stop rail below (mode `consent`: stop at the boundary, relaunch clean,
+the fresh boot runs the now-consented lookup). Walking away from the dialog answers nothing.
+Balloons announce a decision but never carry the action - the tray menu and the control page
+do:
 
 - **Use available sidecar instead (stops tuning)** - visible while a tune is in flight AND an
   unverified offer exists. Writes the tune-control file (the tuner polls `DAS_TUNE_CONTROL` at
@@ -92,7 +99,7 @@ the tray menu and the control page do:
   a ONE-SHOT `DASLLAMA_EXCHANGE_ACCEPT=any` - consent that never outlives the click.
 - **Stop tuning, run untuned** - visible while a tune is in flight. Same stop file, then a
   `DAS_TUNE_POLICY=fallback` hold kept in `STATE["sticky_env"]` and re-applied on every spawn,
-  so a later crash-restart cannot surprise the box with a 20-minute tune. The hold shows as
+  so a later crash-restart cannot surprise the box with a ~12-minute tune. The hold shows as
   `* tuning off` in the tooltip and is revocable via **Resume tuning**; a control-page config
   restart (which a re-tune rides) also clears it, so the re-tune is not silently defeated.
 - **Resume tuning** - visible only while a run-untuned hold is active; clears it so the next
diff --git a/utils/watchdog/test_consent.py b/utils/watchdog/test_consent.py
new file mode 100644
index 0000000000..00e1dd0bd0
--- /dev/null
+++ b/utils/watchdog/test_consent.py
@@ -0,0 +1,162 @@
+"""The consent surface: the `@sidecar consent` fold, the non-sticky "consent" stop mode, and
+handle_consent_needed's write-then-stop contract (dialog mocked at the show_consent_dialog
+seam — the native call itself is not unit-testable). Self-runnable:
+python3 utils/watchdog/test_consent.py (pytest also works)."""
+
+import argparse
+import importlib.util
+import logging
+from pathlib import Path
+import tempfile
+from types import SimpleNamespace
+from urllib.parse import quote
+
+spec = importlib.util.spec_from_file_location("wd", Path(__file__).with_name("watchdog.py"))
+wd = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(wd)
+
+
+def test_consent_event_folds_into_sidecar_state():
+    sidecar = {}
+    wd.apply_sidecar_event(sidecar, "consent", {"state": "needed", "path": "x"})
+    assert sidecar["consent"] == "needed"
+    wd.apply_sidecar_event(sidecar, "consent", {"state": "accepted"})
+    assert sidecar["consent"] == "accepted"
+
+
+def test_consent_stop_mode_is_one_shot_and_env_free():
+    # "consent" must relaunch CLEAN: no DASLLAMA_EXCHANGE_ACCEPT widening (that is
+    # use_sidecar's one-shot), no sticky DAS_TUNE_POLICY hold (that is run-untuned's)
+    with tempfile.TemporaryDirectory() as td:
+        args = argparse.Namespace(name="t", log=Path(td) / "t.log")
+        saved_notify, saved_set = wd.notify, wd.set_state
+        armed = {}
+        wd.notify = lambda *a, **k: None
+        wd.set_state = lambda **kv: armed.update(kv)
+        try:
+            wd.request_tune_stop(args, logging.getLogger("t"), "consent")
+        finally:
+            wd.notify, wd.set_state = saved_notify, saved_set
+        action = armed["tune_stop"]
+        assert action["mode"] == "consent"
+        assert action["env"] == {}
+        assert action["sticky"] is False
+        assert (Path(td) / "t.tune-stop").read_text() == "stop\n"
+
+
+def run_handler(answer, tune_running, consent_path):
+    """Drive handle_consent_needed with the dialog seam and thread spawn mocked; returns
+    the list of stop modes requested."""
+    args = argparse.Namespace(name="t", log=consent_path.parent / "t.log")
+    stopped = []
+    saved = (wd.show_consent_dialog, wd.tune_in_flight, wd.request_tune_stop,
+             wd.threading, wd.notify)
+    wd.show_consent_dialog = lambda: answer
+    wd.tune_in_flight = lambda: tune_running
+    wd.request_tune_stop = lambda a, lg, mode: stopped.append(mode)
+    wd.notify = lambda *a, **k: None
+
+    class SyncThread:
+        def __init__(self, target=None, **_kw):
+            self._target = target
+
+        def start(self):
+            self._target()
+
+    # rebind the MODULE's threading attribute - never mutate the shared stdlib module
+    wd.threading = SimpleNamespace(Thread=SyncThread)
+    try:
+        wd.handle_consent_needed(args, logging.getLogger("t"), quote(str(consent_path)))
+    finally:
+        (wd.show_consent_dialog, wd.tune_in_flight, wd.request_tune_stop,
+         wd.threading, wd.notify) = saved
+    return stopped
+
+
+def test_accept_writes_file_and_stops_a_running_tune():
+    with tempfile.TemporaryDirectory() as td:
+        p = Path(td) / "main.tune.consent"
+        stopped = run_handler(True, True, p)
+        assert p.read_text() == "accepted\n"
+        assert stopped == ["consent"]
+
+
+def test_accept_with_no_tune_in_flight_only_records():
+    with tempfile.TemporaryDirectory() as td:
+        p = Path(td) / "main.tune.consent"
+        stopped = run_handler(True, False, p)
+        assert p.read_text() == "accepted\n"
+        assert stopped == []
+
+
+def test_decline_records_and_never_stops_the_tune():
+    with tempfile.TemporaryDirectory() as td:
+        p = Path(td) / "main.tune.consent"
+        stopped = run_handler(False, True, p)
+        assert p.read_text() == "declined\n"
+        assert stopped == []
+
+
+def test_walkaway_answers_nothing():
+    # None (timeout / closed / no surface) must leave the question open: no file, no stop
+    with tempfile.TemporaryDirectory() as td:
+        p = Path(td) / "main.tune.consent"
+        stopped = run_handler(None, True, p)
+        assert not p.exists()
+        assert stopped == []
+
+
+def test_stream_child_dispatches_the_dialog_once_per_path():
+    # the @sidecar consent event must reach handle_consent_needed exactly once per consent
+    # file for the watchdog's lifetime - a noise/untuned boot loop re-emits it every restart
+    class FakeProc:
+        def __init__(self, lines):
+            self.stdout = iter(lines)
+            self.pid = 42
+    lines = [
+        "@sidecar consent state=needed path=a%2Fb.consent\n",
+        "@sidecar consent state=needed path=a%2Fb.consent\n",
+        "@sidecar consent state=needed path=other.consent\n",
+    ]
+    calls = []
+    args = argparse.Namespace(name="t", log=Path("/tmp/t.log"))
+    saved = (wd.handle_consent_needed, wd.notify)
+    wd.handle_consent_needed = lambda a, lg, path: calls.append(path)
+    wd.notify = lambda *a, **k: None
+    wd._BALLOONED.clear()
+    try:
+        wd.stream_child(FakeProc(lines), logging.getLogger("t"),
+                        __import__("threading").Event(), set(), {}, "t", args)
+    finally:
+        wd.handle_consent_needed, wd.notify = saved
+        wd._BALLOONED.clear()
+    assert calls == ["a%2Fb.consent", "other.consent"]
+
+
+def test_darwin_dialog_parse_arms():
+    # the osascript OUTPUT parse is unit-testable even though showing the dialog is not:
+    # Accept/Decline must map to True/False, gave-up and Escape must leave the question open
+    if not hasattr(wd, "show_consent_dialog") or wd.IS_WINDOWS or wd.sys.platform != "darwin":
+        return  # the parse under test is the darwin arm
+    def fake_run(stdout):
+        return SimpleNamespace(stdout=stdout)
+    saved = wd.subprocess
+    outs = {}
+    wd.subprocess = SimpleNamespace(
+        run=lambda *a, **k: fake_run(outs["v"]), TimeoutExpired=Exception)
+    try:
+        for text, want in [("button returned:Accept", True),
+                           ("button returned:Decline", False),
+                           ("button returned:Accept, gave up:true", None),
+                           ("", None)]:
+            outs["v"] = text
+            assert wd.show_consent_dialog() is want, (text, want)
+    finally:
+        wd.subprocess = saved
+
+
+if __name__ == "__main__":
+    for name, fn in sorted(globals().items()):
+        if name.startswith("test_"):
+            fn()
+            print(f"PASS {name}")
diff --git a/utils/watchdog/watchdog.py b/utils/watchdog/watchdog.py
index 68c7e70ec9..732278c2b4 100644
--- a/utils/watchdog/watchdog.py
+++ b/utils/watchdog/watchdog.py
@@ -35,7 +35,7 @@
 import time
 import webbrowser
 from urllib.error import URLError
-from urllib.parse import urlsplit
+from urllib.parse import unquote, urlsplit
 from urllib.request import Request, urlopen
 
 
@@ -626,6 +626,89 @@ def advance_stage(stage: dict[str, object], message: str, now: float) -> dict[st
 # fresh 11 s PowerShell process on Windows) is pure spam. Persist across children in the process.
 _BALLOONED: set[str] = set()
 
+# First-contact consent (GDPR): the exchange client reports `@sidecar consent state=needed`
+# when no choice is recorded and no terminal can ask; this dialog is the supervised-session
+# answer surface. PLACEHOLDER wording — Gaijin legal owns the final text; keep in sync with
+# EXCHANGE_CONSENT_NOTICE in modules/dasLLAMA/dasllama/dasllama_exchange.das.
+CONSENT_TITLE = "dasLLAMA — tuning preset exchange"
+CONSENT_TEXT = (
+    "dasLLAMA can download a ready performance-tuning preset (a \"sidecar\") for this "
+    "machine from dasllama.io, instead of spending ~12 minutes tuning locally.\n\n"
+    "The request sends only your hardware class — platform, CPU model and OS build. "
+    "No serial numbers, user names or other personal data; no cookies. Sharing your own "
+    "tuning results back is always confirmed separately.\n\n"
+    "Details: https://legal.gaijin.net/privacypolicy"
+)
+
+
+def show_consent_dialog() -> bool | None:
+    """Blocking native Accept/Decline dialog. True/False = the user's choice; None = no
+    dialog surface here (headless Linux), it failed, or the user walked away (timeout /
+    closed it) — None must leave the question open, never count as either answer."""
+    if IS_WINDOWS:
+        # MessageBoxW offers fixed captions, so the text maps them: Yes = Accept, No = Decline.
+        MB_YESNO, MB_ICONINFORMATION, MB_TOPMOST = 0x04, 0x40, 0x00040000
+        IDYES, IDNO = 6, 7
+        try:
+            r = ctypes.windll.user32.MessageBoxW(
+                0, CONSENT_TEXT + "\n\nYes = Accept, No = Decline", CONSENT_TITLE,
+                MB_YESNO | MB_ICONINFORMATION | MB_TOPMOST)
+        except OSError:
+            return None
+        return True if r == IDYES else False if r == IDNO else None
+    if sys.platform == "darwin":
+        safe_text = CONSENT_TEXT.replace("\\", "\\\\").replace('"', '\\"').replace("\n", "\\n")
+        safe_title = CONSENT_TITLE.replace("\\", "\\\\").replace('"', '\\"')
+        script = (
+            f'display dialog "{safe_text}" with title "{safe_title}" '
+            'buttons {"Decline", "Accept"} default button "Accept" '
+            "with icon note giving up after 3600"
+        )
+        try:
+            out = subprocess.run(
+                ["osascript", "-e", script],
+                capture_output=True, text=True, timeout=3700, check=False,
+            ).stdout
+        except (OSError, subprocess.TimeoutExpired):
+            return None
+        if "gave up:true" in out:
+            return None
+        if "button returned:Accept" in out:
+            return True
+        if "button returned:Decline" in out:
+            return False
+        return None  # Escape/closed — the question stays open
+    return None
+
+
+def handle_consent_needed(args: argparse.Namespace, logger: logging.Logger,
+                          consent_path_quoted: str) -> None:
+    """Ask via the native dialog on a worker thread and record the answer into the consent
+    file the exchange client named (url-encoded in the event — values cannot carry spaces).
+    Accept while a tune is racing rides the existing stop rail: abort at the next kernel
+    boundary, relaunch clean, and the fresh boot runs the (now consented) exchange lookup."""
+    path_text = unquote(consent_path_quoted)
+    if not path_text:
+        return
+
+    def worker() -> None:
+        answer = show_consent_dialog()
+        if answer is None:
+            notify(f"{args.name}: enable the tuning-preset exchange?",
+                   "Open the control page to choose")
+            return
+        try:
+            Path(path_text).write_text("accepted\n" if answer else "declined\n",
+                                       encoding="ascii")
+        except OSError as exc:
+            emit(logger, "consent_write_failed", path=path_text, error=str(exc))
+            return
+        emit(logger, "consent_recorded", accepted=answer, path=path_text)
+        if answer and tune_in_flight():
+            request_tune_stop(args, logger, "consent")
+
+    threading.Thread(target=worker, name="consent-dialog", daemon=True).start()
+
 
 def parse_child_event(message: str, prefix: str) -> tuple[str, dict[str, str]] | None:
     """Return (kind, fields) for a `<prefix><kind> k=v ...` line, or None. Never raises."""
@@ -689,6 +772,9 @@ def apply_sidecar_event(sidecar: dict[str, object], kind: str, fields: dict[str,
     elif kind == "submitted":
         sidecar.pop("pending_submit", None)
         sidecar["submitted"] = fields.get("sha", "")
+    elif kind == "consent":
+        # "needed" while unanswered, then "accepted"/"declined" from whichever surface records it
+        sidecar["consent"] = fields.get("state", "")
 
 
 def stream_child(
@@ -698,6 +784,7 @@ def stream_child(
     jit_dlls: set[Path],
     stage: dict[str, object],
     name: str,
+    wd_args: argparse.Namespace,
 ) -> None:
     assert proc.stdout is not None
     # Per child, and published immediately: the tune-bootstrap restart is the normal first-run
@@ -735,6 +822,14 @@ def stream_child(
             # Balloons announce a DECISION the user can make; they never carry the action
             # (a PowerShell balloon cannot) — the tray menu and the control page do. Announce
             # once per distinct sha (a noise-abort loop re-emits the same offer every boot).
+            if kind == "consent" and fields.get("state") == "needed":
+                # once per consent file for the watchdog's lifetime — an unanswered dialog
+                # re-emits `needed` on every restart of the noise/untuned boot loop
+                consent_key = "consent:" + fields.get("path", "")
+                if consent_key not in _BALLOONED:
+                    _BALLOONED.add(consent_key)
+                    handle_consent_needed(wd_args, logger, fields.get("path", ""))
+                continue
             sha = fields.get("sha", "")
             balloon_key = f"{kind}:{sha}"
             if kind in ("offer", "pending_submit") and balloon_key not in _BALLOONED:
@@ -988,15 +1083,19 @@ def request_tune_stop(args: argparse.Namespace, logger: logging.Logger, mode: st
     always completes). `use_sidecar` arms a ONE-SHOT unverified-accept relaunch — precise
     consent that must never outlive this click; `untuned` makes fallback stamps sticky for
     the rest of this watchdog session (revocable via 'Resume tuning'), so a later crash-restart
-    cannot surprise the box with a 20-minute tune."""
+    cannot surprise the box with a ~12-minute tune."""
     if mode == "use_sidecar":
         action: dict[str, object] = {
             "mode": mode, "env": {"DASLLAMA_EXCHANGE_ACCEPT": "any"}, "sticky": False}
+    elif mode == "consent":
+        # consent just granted mid-tune: stop the race, relaunch clean — the fresh boot's
+        # resolver reads the recorded consent and runs the normal (verified-only) lookup
+        action = {"mode": mode, "env": {}, "sticky": False}
     else:
         action = {"mode": mode, "env": {"DAS_TUNE_POLICY": "fallback"}, "sticky": True}
     # Arm STATE BEFORE writing the file: the supervision loop unlinks the control file and then
     # take_tune_stop()s at each spawn — if the file were written first, that unlink could delete
-    # it and the take miss the action, letting a fresh child tune for the full ~20 minutes.
+    # it and the take miss the action, letting a fresh child tune for the full ~12 minutes.
     set_state(tune_stop=action)
     path = tune_control_path(args)
     try:
@@ -1591,7 +1690,7 @@ def supervise(
             stage: dict[str, object] = {"name": None, "rank": 0, "since": time.monotonic()}
             output = threading.Thread(
                 target=stream_child,
-                args=(child, logger, tune_restart_seen, jit_dlls, stage, args.name),
+                args=(child, logger, tune_restart_seen, jit_dlls, stage, args.name, args),
                 daemon=True,
             )
             output.start()
diff --git a/web/examples/ui/REVIEW.md b/web/examples/ui/REVIEW.md
index 9f165353cf..f1ddb51a7f 100644
--- a/web/examples/ui/REVIEW.md
+++ b/web/examples/ui/REVIEW.md
@@ -11,6 +11,11 @@ puts it.**
 deploy copies these files into the site (`.github/workflows/pages.yml`, repo root), so
 `site/playground/` never shows the change.
 
+**A diff that changes `src/` or `samples/` states a run of the WASM-staged Playwright suite
+(`site/tests/playground/`, repo root) in its PR body or commit message, naming the passes and
+any failures, in the same change.** The no-WASM lane cannot see a broken runtime path, and
+every sample on the page runs through that path.
+
 **A `.das` file under `samples/` not written in gen2, or not a full program that compiles and
 runs with the current toolchain, is a defect.**