Harden production and improve performance

[1ove9]

What changed

• Hardened production behavior: upgraded Next.js, removed build-time font downloads, split Sanity read/write tokens, added contact-form abuse protection, repaired signed webhook revalidation, sitemap, environment handling, broken links, and enforced CI builds.
• Reduced client-side work: narrowed Client Component and i18n message boundaries, removed duplicate GSAP/Motion animation dependencies, and aligned Sanity caching with on-demand revalidation.
• Strengthened evidence and conversion: added DOI/publication and source-linked case-study fields, filtered homepage evidence to verifiable records, and improved mobile content rails.
• Added Playwright smoke/E2E coverage for localized routes, internal links, mobile overflow, sitemap, and webhook rejection.

Why

The site needed a production-safe baseline before performance refactoring, plus stronger technical credibility and clearer conversion paths.

Validation

• npm run build
• npm run typecheck
• npm run lint
• Playwright smoke/E2E: 7 passed
• Git diff and remote Git tree hashes verified

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
source-sequence	Ready	Preview, Comment	Jul 29, 2026 5:52pm
v0-sourcesequence	Ready	Preview, Comment, Open in v0	Jul 29, 2026 5:52pm

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 718dd16db3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove the POST-only route from the GET health check

The updated .github/workflows/ci.yml unconditionally runs this smoke suite, but /api/revalidate exports only a POST handler, so this request.get() receives HTTP 405 and response.ok() is false on every CI run. Test the route through its signed POST contract or omit it from this GET-only loop.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Use a separate privileged credential for content seeding

When operators follow .env.example/README and make SANITY_API_WRITE_TOKEN narrowly scoped to creating and querying inquiry documents, this seed fails authorization because it uses that token for createOrReplace calls on capabilities, solution groups, solutions, and case studies. The same credential was also wired into the migration/model-seeding scripts, so content administration needs a separate privileged token rather than the public-form credential.

Useful? React with 👍 / 👎.