@@ -16,6 +16,20 @@ updates:
       interval: weekly
       day: monday
     open-pull-requests-limit: 5
+    # Version-update PRs are restricted to the network packages — the drift
+    # alarm this file exists for. Without this allow-list, dependabot also
+    # proposes FLOOR-RAISES for every other requirement (gunicorn >=23 →
+    # >=26, python-dotenv, pydantic, jsonpath...). Those floors encode
+    # minimum-compatibility knowledge — this repo's gunicorn floor IS the
+    # CVE fact, and its dash-improve-my-llms floor is the cache-bust
+    # mechanism — the resolver already installs latest under them, and a
+    # raise erases the floor's meaning while adding nothing. SECURITY
+    # updates are unaffected: they arrive through GitHub's separate
+    # security-update channel regardless of this list.
+    allow:
+      - dependency-name: "dash*"
+      - dependency-name: "plotly*"
+      - dependency-name: "markdown2dash"
     groups:
       dash-network:
         patterns:
 
@@ -122,7 +122,7 @@ jobs:
           # import. httpx backs starlette's TestClient.
           if [ "${{ matrix.backend }}" != "flask" ]; then
             pip install "dash[${{ matrix.backend }}]" httpx
-            pip install "dash-improve-my-llms[${{ matrix.backend }}]>=2.6.1"
+            pip install "dash-improve-my-llms[${{ matrix.backend }}]>=2.7.1"
           fi
           pip install pytest
 
@@ -141,7 +141,7 @@ jobs:
           # assert sat at 2.3.4 while the pin moved to 2.5.1 and then 2.6.0 —
           # a stale floor asserts nothing, and the deploy that silently ran an
           # old package is exactly what it exists to catch.
-          assert parts(pkg.__version__) >= (2, 6, 1), pkg.__version__
+          assert parts(pkg.__version__) >= (2, 7, 1), pkg.__version__
           # 21.x carried two request-smuggling CVEs (CVE-2024-6827,
           # CVE-2024-1135). markdown2dash's spurious <22 pin must not win.
           assert parts(gunicorn.__version__)[:2] >= (23, 0), gunicorn.__version__
@@ -278,7 +278,7 @@ jobs:
 
           v = version('dash-improve-my-llms')
           print('dash-improve-my-llms', v)
-          assert parts(v) >= (2, 6, 1), f'expected >=2.6.1, image has {v}'
+          assert parts(v) >= (2, 7, 1), f'expected >=2.7.1, image has {v}'
 
           # markdown2dash installs with --no-deps to dodge its gunicorn<22
           # pin; this assert is what proves the dodge kept working. 21.x
 
@@ -172,7 +172,7 @@ race fixed there. Its `clerk-backend-api<8` cap (widened in 1.0.1) is what lets
   sitemap date; `dash-improve-my-llms` >= 2.6.0 emits it verbatim and omits the
   tag when absent. Edit a page's prose → bump its `lastmod` in the SAME commit.
   Never script these from file mtimes (they reset on every Docker build, which
-  re-creates the every-page-changed-today sitemap the 2.6.1 floor exists to
+  re-creates the every-page-changed-today sitemap the floor exists to
   end). The initial values came from `git log -1 --format=%cs -- <file>`.
   `tests/test_seo_icons.py` fails if the sitemap ever emits a date no page
   declared, and if crawler-head icon discovery comes back empty.
 
@@ -433,7 +433,7 @@ Clerk it is hidden, not merely unstyled.
 > the `/var/data` disk in production, so a toggle outlives a deploy; on an
 > ephemeral filesystem it would reset with every one.
 
-### Crawler identity and sitemap honesty (dash-improve-my-llms >= 2.6.1)
+### Crawler identity and sitemap honesty (dash-improve-my-llms >= 2.7.1)
 
 > **A package fix does not reach production until this file's bytes change.**
 > The Dockerfile installs dependencies in their own layer, keyed on
@@ -443,7 +443,7 @@ Clerk it is hidden, not merely unstyled.
 > looking correct. Raising the floor number *is* the cache bust. Confirm with
 > the boot line, which states the resolved version.
 
-The 2.6.1 floor in `requirements.txt` is load-bearing — `pages/markdown.py`
+The 2.7.1 floor in `requirements.txt` is load-bearing — `pages/markdown.py`
 passes `lastmod=` unconditionally, and that argument does not exist below it.
 
 **Icons come from discovery, not a declaration.** This app has never called
 
@@ -22,7 +22,19 @@ ENV PYTHONUNBUFFERED=1 \
 
 WORKDIR /app
 
-# Install Python deps first so this layer is cached across app-code changes.
+# CACHE SEMANTICS — read this before shipping a dependency upgrade. This layer
+# re-runs ONLY when vendor/ or requirements.txt BYTES change. A `>=` floor can
+# NEVER pull a newer release through a cache hit: a code-only commit rebuilds
+# the app layers below while pip silently keeps whatever version the image was
+# first built with. That has bitten this repo twice — 2.6.1 and again at 2.7.1
+# — and both times the site looked fine, because a stale package degrades
+# quietly rather than failing.
+#
+# So ship every dependency upgrade as a floor bump in requirements.txt, and
+# grep the NUMBER, not the file: it also lives in run.py's LLMS_PKG_FLOOR and
+# in ci.yml's asserts. The bump IS the cache bust, and the boot floor turns a
+# stale image from a silent downgrade into a loud refusal to start.
+#
 # vendor/ must come along: requirements.txt installs dash-clerk-auth 1.0.5 from
 # a local tarball there (it is vendored across the 2plot network, not on PyPI).
 # dash-emoji-mart and flexlayout-dash used to live here too and now come from
 
@@ -12,7 +12,7 @@ lastmod: 2026-08-01
 
 .. toc::
 
-# dash-leaflet2 — Leaflet 2 maps for Dash
+## dash-leaflet2 — Leaflet 2 maps for Dash
 
 > **`dash-leaflet2`** wraps **Leaflet 2 core directly** — no react-leaflet — and
 > ships it as real Dash components. By [Pip Install Python](https://github.com/2plotai).
 
@@ -24,6 +24,22 @@
   sweep-time checks.)
 * ``reporting`` — whether the traffic reporter could actually POST, so "wired
   but secretless" is visible without reading boot logs.
+* ``build`` — WHICH COMMIT the running instance was built from. A Render
+  service with a disk restarts with a blip rather than overlapping instances,
+  so a bare 200 proves nothing about which build answered; CD waits on this
+  to verify the artifact it shipped rather than whichever build happens to be
+  serving. Omitted where the platform variable does not exist, so a local run
+  and a fork on another host keep the same probe contract.
+* ``geo`` — the geo guardrail's LIVE state (dash-improve-my-llms >= 2.7.0).
+  Counts and flags only, never the denylist's country codes: a health
+  endpoint is not where anyone should learn policy. ``resolved`` reveals only
+  the caller's own country back to them, which Cloudflare's /cdn-cgi/trace
+  already does — and it localises a failure that is otherwise invisible,
+  because geo can be fully configured and still never match if the country
+  header is not reaching the app. "configured: true, denied: 7, resolved:
+  unknown" says that in one line. The key is OMITTED on older packages, not
+  error-flagged: a host on an older floor is not broken, it predates the
+  diagnostic.
 
 Keep it cheap: the hub measures the round trip, so any work done here is
 reported back as this app being slow.
@@ -35,11 +51,44 @@
 import dash
 
 
+def _resolved_country() -> str:
+    """``geo.explain_resolution`` over THIS request's headers, or a reason.
+
+    Reads the framework's request object directly rather than anything the
+    package threads through, so it answers "did the country header reach this
+    app at all?" independently of how the enforcement seam is wired.
+    """
+    try:
+        from dash_improve_my_llms import geo
+        from dash_improve_my_llms._headers import normalize_headers
+    except Exception:
+        return "unavailable (pre-2.7.0 package)"
+
+    try:
+        from flask import has_request_context, request
+
+        if not has_request_context():
+            return "no request context"
+        return geo.explain_resolution(normalize_headers(request.headers))
+    except Exception:
+        return "unavailable"
+
+
 def health_payload(backend: str) -> dict:
+    """Built PER REQUEST, never snapshotted.
+
+    Every field here was static once (ok/app/version/backend never change for
+    a running process), which made a registration-time snapshot look harmless.
+    It is not: `geo` is configured well after this route is registered, so a
+    snapshot reports the guardrail as unconfigured on a host where it is
+    configured — the diagnostic lying in exactly the situation it exists for.
+    Every backend below renders from this one function for the same reason:
+    a probe contract that varies by backend is not a contract.
+    """
     from lib.constants import APP_VERSION, BASE_URL
     from lib.satellite_reporter import app_key
 
-    return {
+    payload = {
         "ok": True,
         "app": app_key(),
         "version": APP_VERSION,
@@ -49,6 +98,26 @@ def health_payload(backend: str) -> dict:
         "reporting": bool(os.getenv("CROSS_APP_WEBHOOK_SECRET")),
     }
 
+    build = os.environ.get("RENDER_GIT_COMMIT")
+    if build:
+        payload["build"] = build
+
+    try:
+        from dash_improve_my_llms import geo
+    except ImportError:
+        pass  # pre-2.7: omit the key rather than flagging an error
+    else:
+        try:
+            payload["geo"] = {
+                "configured": bool(geo.is_configured()),
+                "denied": len(geo.effective_policy().get("deny_countries") or []),
+                "resolved": _resolved_country(),
+            }
+        except Exception:  # a diagnostic must never break the health probe
+            payload["geo"] = {"configured": False, "denied": 0, "error": True}
+
+    return payload
+
 
 def register_health_route(app, backend: str) -> None:
     """Mount ``/healthz`` on whichever backend is running."""
 
@@ -17,7 +17,11 @@
 from lib.directives.source import SC
 from lib.directives.toc import TOC
 from lib.gate_layouts import gated_layout
-from lib.page_visibility import register_default, register_llms_doc
+from lib.page_visibility import (
+    published_name,
+    register_default,
+    register_llms_doc,
+)
 from lib.versions import substitute_versions
 
 logger = logging.getLogger(__name__)
@@ -119,9 +123,20 @@ def _expand_source_directives(markdown_content: str) -> str:
     `/<page>/llms.txt`. Replacing the directive with the real file content
     is what makes the LLM output self-contained for the "paste into a chat
     window" audience.
+
+    FENCE-AWARE, and it has to be: a directive INSIDE a fenced code block is
+    documentation showing the syntax, not a directive to act on. Expanding
+    one injects a ```python fence inside the already-open fence, which CLOSES
+    it early — from there the inlined file renders as markdown and every
+    `# comment` line becomes an <h1>, so the page's machine lane serves
+    broken structure while the browser lane looks perfect (markdown2dash
+    parses fences properly). No page in THIS repo teaches the directive
+    today, so this is carried from the template as a guard rather than a
+    fix: the day someone documents `.. source::` in a fenced block, nothing
+    silently breaks. tests/test_page_structure.py pins the outcome.
     """
-    def replace(match: re.Match) -> str:
-        file_path = match.group(1).strip()
+    def expansion(directive_line: str) -> str:
+        file_path = _SOURCE_DIRECTIVE.match(directive_line).group(1).strip()
         try:
             full = Path(file_path)
             content = full.read_text()
@@ -134,12 +149,34 @@ def replace(match: re.Match) -> str:
         except Exception as exc:
             return f'\n<!-- Error reading {file_path}: {exc} -->\n'
 
-    return _SOURCE_DIRECTIVE.sub(replace, markdown_content)
+    out: List[str] = []
+    fence = None  # the marker that opened the block we are inside, if any
+    for line in markdown_content.split('\n'):
+        head = line.lstrip()[:3]
+        if fence is None and head in ('```', '~~~'):
+            fence = head
+        elif fence is not None and head == fence:
+            fence = None
+        elif fence is None and _SOURCE_DIRECTIVE.match(line):
+            out.append(expansion(line))
+            continue
+        out.append(line)
+    return '\n'.join(out)
 
 
 def _build_llms_doc(name: str, description: str, expanded_markdown: str, path: str) -> str:
     """Wrap the expanded markdown with the heading/description preamble that
-    /llms.txt readers expect."""
+    /llms.txt readers expect.
+
+    ``name`` must be the PUBLISHED name, not the registered one. The package
+    injects its own `<h1>` header into the crawler document from the published
+    identity, and >= 2.7.0 dedups that against the document's opening h1 — so
+    the two have to be the same string or the page serves both. They were not
+    for "/" alone: the preamble said "Home" (the nav label) while the injected
+    header said the site brand, which is exactly the substitution
+    `lib.page_visibility.published_name` exists to make. See its docstring for
+    why "Home" must never become this site's published identity.
+    """
     parts: List[str] = [f"# {name}\n"]
     if description:
         parts.append(f"> {description}\n")
@@ -244,7 +281,8 @@ def _build_llms_doc(name: str, description: str, expanded_markdown: str, path: s
         metadata.endpoint,
         metadata.name,
         metadata.description,
-        _build_llms_doc(metadata.name, metadata.description, expanded, metadata.endpoint),
+        _build_llms_doc(published_name(metadata.endpoint, metadata.name),
+                        metadata.description, expanded, metadata.endpoint),
         # Same string dash.register_page got. Measured, not assumed: it does
         # NOT double the brand — the package composes its own
         # "<page> · <site>" only when no title is declared.
 
@@ -50,7 +50,18 @@ docutils!=0.21
 jsonpath>=0.82,<0.83
 mistune>=3.0.1,<4.0.0
 python-frontmatter
-# 2.6.1 — and the .1 is a CACHE BUST as much as a feature.
+# 2.7.1 — and as in every round, THE NUMBER CHANGING IS THE CACHE BUST.
+#
+# What 2.7.1 buys: llms.txt v2 discovery relations (rel=alternate/describedby
+# plus Link headers), the text/plain Accept ramp, and the representation
+# digest. What 2.7.0 buys, and this repo needed badly: the prerender H1 dedup.
+# Measured here before the bump — all 27 pages served TWO <h1>s to a crawler,
+# the injected prerender header plus the document's own, and the home page
+# served three. 2.7.0 also stops a page that merely MENTIONS the prerender
+# marker string from losing its prerender, and de-doubles the home footer's
+# /llms.txt link. run.py's LLMS_PKG_FLOOR refuses to boot below this.
+#
+# 2.6.1 — the .1 was a CACHE BUST as much as a feature.
 #
 # The Dockerfile installs deps in their own layer, keyed on requirements.txt's
 # BYTES. A commit that touches only lib/ is a cache hit, so pip never re-runs
@@ -98,7 +109,7 @@ python-frontmatter
 # directive-leakage fix. `configure_access` (2.3) is what lib/access.py
 # hands the gate policy to. The [flask] extra is just flask>=2.0, already
 # present via Dash.
-dash-improve-my-llms[flask]>=2.6.1
+dash-improve-my-llms[flask]>=2.7.1
 python-dotenv>=1.0
 pydantic>=2.0
 requests>=2.31