diff --git a/scripts/commit-check.sh b/scripts/commit-check.sh
index 38e0f59..39e3b69 100755
--- a/scripts/commit-check.sh
+++ b/scripts/commit-check.sh
@@ -36,32 +36,58 @@ warn() { printf '%s\n' "commit-check: warning: $*" >&2; }
 
 check_attribution() {
     _msg=$1
+    # One vendor alternation shared by every pattern below — extend it
+    # here, never in a single rule, or the rules drift apart.
+    _VENDOR='claude|cursor|copilot|chatgpt|codex|gemini|devin|openai|anthropic|codeium|windsurf|github[[:space:]]+copilot|claude[[:space:]]+code|(claude|gemini)[[:space:]]+(opus|sonnet|pro|ultra)|swe-[0-9a-z.-]*' 
     # AI co-author / bot trailers. A human Co-authored-by is fine; the
     # ban is on AI vendors, bots, and *-ai-* / [bot] addresses.
-    if printf '%s\n' "$_msg" | grep -iE '^[[:space:]]*co-?authored-by:' \
-        | grep -qiE 'claude|cursor|copilot|chatgpt|codex|gemini|devin-ai|cognition\.ai|devin\.ai[[:space:]>]|openai|anthropic|codeium|windsurf|swe-|\[bot\]|[a-z0-9-]*bot@|ai-integration'; then
+    _co=$(printf '%s\n' "$_msg" | grep -iE '^[[:space:]]*co-?authored-by:' || :)
+    # Unambiguous machine signals anywhere in the trailer: [bot] tags,
+    # bot@ addresses, *-ai-integration logins, AI-vendor domains (literal
+    # list of vendor-owned domains — never github.com, or humans on the
+    # privacy relay get flagged), and a vendor token inside a bare email
+    # (no <display name>) — bot forms like
+    # "Co-authored-by: 175728472+Copilot@users.noreply.github.com".
+    if printf '%s\n' "$_co" | grep -qiE '\[bot\]|(^|[<.[:space:]_+-])bot@|ai-integration|noreply@(anthropic|openai)\.|@(anthropic|openai|cognition|devin|codeium|windsurf|claude-code|cursor|gemini|chatgpt|codex|copilot|google)\.(com|ai|dev|io)([[:space:]>]|$)|:[[:space:]]*[^<[:space:]]*('"$_VENDOR"')[^<[:space:]]*@'; then
+        err "AI Co-authored-by trailer"
+    # A bare vendor identity as the display name — "Co-authored-by:
+    # Claude <noreply@anthropic.com>" hits the domain rule above; this
+    # catches no-email and generic-mailbox forms. Human names that merely
+    # CONTAIN a vendor token ("Claude Martin <claude.martin@…>") stay
+    # legal per .cursor/rules/no-ai-attribution.mdc.
+    elif printf '%s\n' "$_co" | sed 's/^[^:]*:[[:space:]]*//; s/<.*//' \
+        | grep -qiE '^\[?('"$_VENDOR"')\]?(\([^)]*\))?([[:space:]-]?ai)?[[:space:]]*$'; then
         err "AI Co-authored-by trailer"
     fi
     # generator footers: "Generated with <tool>", "Made with: X",
     # "Authored via X" — the tool names that sign output, plus the
     # trailer forms regardless of vendor.
-    if printf '%s\n' "$_msg" | grep -iqE '(generated|made|created|authored|written|produced)[[:space:]]+(with|by|via)[[:space:]]*\[?[[:space:]]*(claude|cursor|copilot|chatgpt|codex|gemini|devin|openai|anthropic|codeium|windsurf|swe-)'; then
+    # connector may carry a colon ("Created with: Cursor"); the vendor
+    # token needs a non-alnum tail so "generated by cursors" stays clean.
+    if printf '%s\n' "$_msg" | grep -iqE '(generated|made|created|authored|written|produced)[[:space:]]+(with|by|via):?[[:space:]]*\[?[[:space:]]*('"$_VENDOR"')([^a-z0-9]|$)'; then
         err "AI generator footer"
     fi
     if printf '%s\n' "$_msg" | grep -iqE '^[[:space:]]*(generated|made|authored)[- ](with|by|via)[[:space:]]*:'; then
         err "generator trailer"
     fi
-    # bot-emoji generator signature
-    if printf '%s\n' "$_msg" | grep -q '🤖'; then
+    # standalone "via <tool>" / "by <tool>" / "with <tool>" lines — the
+    # footer regex above needs a leading verb, so a lone via-line slips.
+    if printf '%s\n' "$_msg" | grep -qiE '^[[:space:]]*(via|by|using|with)[[:space:]]+\[?('"$_VENDOR"')\]?(\([^)]*\))?([[:space:]-]?ai)?([^a-z0-9]|$)'; then
+        err "attribution via-line"
+    fi
+    # bot-emoji signature: a bare 🤖 line, or 🤖 sharing a line with
+    # attribution vocabulary — a mid-sentence robot mention stays clean.
+    _bot=$(printf '%s\n' "$_msg" | grep '🤖' || :)
+    if printf '%s\n' "$_bot" | grep -qiE '^[[:space:]]*🤖[[:space:]]*$|generated|made|created|authored|written|produced|built|co-?authored|via[[:space:]]|with[[:space:]]|by[[:space:]]'; then
         err "bot-emoji attribution marker"
     fi
     # AI named as the author/agent — not as the subject of the change.
     # (kept narrow on purpose: "add Copilot webhook" must stay legal)
-    if printf '%s\n' "$_msg" | grep -iqE '\b(as an ai|i generated this|authored by (claude|cursor|copilot|chatgpt|codex|gemini|devin|openai|swe-))\b'; then
+    if printf '%s\n' "$_msg" | grep -iqE '\b(as an ai|i generated this|authored by \[?('"$_VENDOR"'))\b'; then
         err "AI self-attribution"
     fi
     # vendor-stamped HTML comments smuggled into the message
-    if printf '%s\n' "$_msg" | grep -iqE '<!--[^>]*(claude|cursor|copilot|chatgpt|codex|gemini|devin|openai|anthropic|generated|🤖)'; then
+    if printf '%s\n' "$_msg" | grep -iqE '<!--[^>]*('"$_VENDOR"'|generated|🤖)'; then
         err "attribution HTML comment"
     fi
     # zero-width / invisible markers: U+200B..D, U+2060, U+FEFF as raw
diff --git a/src/pages/index.astro b/src/pages/index.astro
index 690d946..d9e36d1 100644
--- a/src/pages/index.astro
+++ b/src/pages/index.astro
@@ -1,4 +1,6 @@
 ---
+import { readFileSync } from "node:fs";
+
 import SiteShell from "@/layouts/SiteShell.astro";
 import { CopyCommand } from "@/components/copy-command";
 import { TerminalDemo } from "@/components/terminal-demo";
@@ -37,6 +39,20 @@ const products = [
 const oxlVersion = docsLock.products.oxl.default;
 const oxAgentVersion = docsLock.products["ox-agent"].default;
 
+// Landing code samples ship inside the product docs bundles — always
+// released, compiled syntax, never hand-maintained site copy.
+let oxlExample: string;
+try {
+	oxlExample = readFileSync(
+		`${process.cwd()}/src/content/docs/docs/oxl/${oxlVersion.replaceAll(".", "-")}/examples/http-server.oxl`,
+		"utf-8",
+	).trim();
+} catch {
+	throw new Error(
+		`missing oxl ${oxlVersion} docs bundle; run \`bun run docs:sync\``,
+	);
+}
+
 const forgePoints = [
 	"Repos, PRs & review, issues, orgs",
 	"Actions CI on your own runners",
@@ -336,26 +352,9 @@ const forgePoints = [
 			<div class="oct-reveal">
 				<div class="overflow-hidden rounded-lg border border-border bg-card">
 					<div class="border-b border-border px-4 py-2 font-mono text-[11px] uppercase tracking-[0.15em] text-muted-foreground">
-						the v0 surface
+						an http service
 					</div>
-					<pre class="overflow-x-auto p-4 font-mono text-[13px] leading-6"><code><span class="text-muted-foreground">package main</span>
-
-<span class="text-foreground">fn fail(b: bool) -&gt; [int, err] {"{"}</span>
-<span class="text-foreground">    if b {"{"} return 0, 1 {"}"}</span>
-<span class="text-foreground">    return 42, nil</span>
-<span class="text-foreground">{"}"}</span>
-
-<span class="text-foreground">fn main() {"{"}</span>
-<span class="text-foreground">    [v, err] = fail(false)</span>
-<span class="text-foreground">    if err != nil {"{"} return {"}"}</span>
-<span class="text-foreground">    println(itoa(v))</span>
-
-<span class="text-foreground">    ch := mkchan()</span>
-<span class="text-foreground">    scope {"{"}</span>
-<span class="text-foreground">        spawn send(ch, 7)</span>
-<span class="text-foreground">        println(itoa(recv(ch)))</span>
-<span class="text-foreground">    {"}"}</span>
-<span class="text-foreground">{"}"}</span></code></pre>
+					<pre class="overflow-x-auto p-4 font-mono text-[13px] leading-6"><code>{oxlExample}</code></pre>
 				</div>
 			</div>
 		</div>