fix: add safe analytics floor repair endpoint

fix: stabilize analytics totals across warm containers

fix: initialize new tenant during catalog ingest

fix: allow stable widget route in client iframes

production: harden catalog tenants analytics and widget install

ingest: slice deterministic adds under chroma max batch (7k+ product catalogs)

outreach tracking: /px email-open pixel + widget-load logging per db

product DBs: scope-declined shopping questions answer as honest catalog miss

scheduler: reload volume view each tick

startup: never rewind an overdue auto-crawl timestamp to now

auto-crawl: don't fail auto-ingest DBs on empty prose-URL discovery

widget keys: arbitrary N-day TTL + refuse minting for unknown db

admin: accept 'db' query param alias in _extract_admin_db

polish for client go-live: contact-request identity fix, leads viewer, ingest-fail alert, nvidia provider

tenant routing: never serve a warm container's stale local_db to another tenant

G4 policy prompt: balance answer-from-policy vs over-assertion + stop label leak

G4 policy + G5 count_split determinism (100Q Q22/23/69/71)

fix: drop conversation history from product-DB LLM prose fallback (history-leak guard)

fix: report persisted active db on cold health

fix: apply persisted active db before startup health

fix: return exact catalog answer sources

fix: load active db when stored vectors exist

fix: stabilize tenant routing and active db persistence

chat: scope bot to the logged-in admin/client DB (X-Admin-DB), not global active

admin: surface collection coverage in db-stats + panel badge

catalog ingest: never silently drop sidebar collections under store throttling

app: leadbox criteria, per-DB Auto-Ingest, tenant analytics, volume-reload fix

eval panel: fix custom-tests 500, judge-key UX, product-question generation

perf(chat): live token streaming for docs DBs (TTFT p50 9.2s->6.8s under load)

security: production hardening — tenant isolation, email XSS, write limits, CSP

rate-limit: sharded G-Counter daily budget (v1 single counter was raced)

rate-limit: global per-client daily budget via modal.Dict

scale: multi-tenant rate limits + per-client daily budget + row cache

fix(robustness): close 3 weakness CLASSES found by hamzastore hard eval

feat(gate): productionize answer-quality quiz as hard publish threshold

feat(rag+safety): universal named-product abstention, RRF recall, injection-leak fix

feat(chat): request-scoped follow-up coreference + superlative/greeting parse fixes

crawl: universal schema.org microdata product extraction (no per-DB code)

llm_keys: provider-diversified retries — skip a failed provider on next attempt

admin: per-DB client password = DB name + owner view follows active DB

Crawler: fix product over-classification, --clear seen-cache, WooCommerce URLs

Wire catalog_ingest into _auto_crawl_db + fix double-encoded HTML entity junk

catalog_ingest: also clear catalog/category HTML chunks on re-ingest

crawl: drop storefront utility pages (cart/checkout/account) — gate quarantine fix

fix: make modal crawls durable under large writes

gate: enforce crawl_gate as QUARANTINE before customer publish

fix: harden modal crawl reload path

fix: stabilize chroma temp reload during crawl

gate: content-coverage invariant + cross-batch ID dedup robustness

crawl: dedup chunk IDs within batch to stop whole-batch drops