diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..23ac51f
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,77 @@
+name: Build and deploy portfolio + intake API
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ohgeec-pages-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  site:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22
+      - name: Generate guide pages
+        run: node build/generate.mjs
+      - name: Assemble public Pages artifact
+        run: |
+          set -eu
+          mkdir -p site
+          cp index.html support.html book.html thanks.html privacy.html tech-support.html \
+            ogc-network.js intake.js portfolio.css portfolio.js fonts.css og-image.png \
+            apple-touch-icon.png robots.txt sitemap.xml CNAME site/
+          cp -R assets fonts tech-support site/
+      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
+        if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+        with:
+          path: site
+
+  deploy-pages:
+    if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+    needs: site
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
+      - id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+
+  publish-intake:
+    if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: ./services/intake
+          push: true
+          tags: |
+            ghcr.io/ohgeeceee/network-intake:stable
+            ghcr.io/ohgeeceee/network-intake:sha-${{ github.sha }}
diff --git a/.gitignore b/.gitignore
index c304e7f..8b59a66 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,9 @@ verify2.js
 hub.js
 .DS_Store
 Thumbs.db
+
+# Local site artifact, CRM secrets, and database backups
+/site/
+/ops/crm/.env
+/ops/crm/*.dump*
+/ops/crm/*.age
diff --git a/DEPLOY.md b/DEPLOY.md
index a30bd67..6543565 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -1,112 +1,37 @@
-# Deploying the ohgeeceee network hub (free)
+# Deploying ohgeec.com and the private CRM
 
-The hub is three static files — `index.html`, `support.html`, `ogc-network.js` (plus
-`CNAME`). No build step, no server. Any static host works; below is **GitHub Pages**
-(what you asked for) and one alternative worth knowing about.
+## Public portfolio
 
----
+The portfolio and support guides remain static on GitHub Pages. `.github/workflows/deploy.yml` builds the guide pages, assembles only public site files, deploys them to Pages, and builds/publishes the private intake service image to GHCR from commits to `main`. Pull requests run the static guide generator but do not publish images or deploy Pages.
 
-## Recommended: GitHub Pages
+To switch from the current branch-based Pages source to the workflow:
 
-Best fit here — it's free, gives you HTTPS on your own domain, and lives next to your
-existing `github.com/ohgeeceee` repos.
+1. In the repository, open **Settings → Pages** and change **Build and deployment → Source** to **GitHub Actions**.
+2. Check that the repository's custom domain is still `ohgeec.com` and HTTPS is enforced.
+3. Merge the workflow to `main`. Confirm the `Build and deploy portfolio + intake API` workflow succeeds and the live site loads `book.html`, `/privacy.html`, the guide hub, and `/tech-support/onsite-montana/`.
+4. The workflow excludes source content, service source, CRM operations files, and credentials from the Pages artifact. The guides and their generated HTML remain public as intended.
 
-### 1. Make the repo
+GitHub Actions uses GitHub-hosted runners only. It publishes `ghcr.io/ohgeeceee/network-intake:stable` and an immutable `sha-<commit>` image tag. The home server pulls the image; GitHub Actions never connects into the home network.
 
-1. Create a new **public** repo, e.g. `github.com/ohgeeceee/ohgeec`.
-2. Add these files to the repo root (drag-and-drop in the browser is fine):
-   - `index.html`
-   - `support.html`
-   - `ogc-network.js`
-   - `CNAME`  ← already contains `ohgeec.com`, this is what binds the domain
-3. Commit to the `main` branch.
+## DNS and public API
 
-### 2. Turn on Pages
+The portfolio stays on GitHub Pages at `ohgeec.com`. The laptop exposes only the intake API through Tailscale Funnel at `https://parrot.tail60dba7.ts.net:8443`; Directus remains private on the separate Tailscale Serve port 443. Funnel provides a tailnet hostname, not a custom `api.ohgeec.com` hostname, and does not require a router port-forward or public home IP.
 
-Repo → **Settings → Pages** → under *Build and deployment*, set **Source: Deploy from a
-branch**, **Branch: `main` / `/ (root)`** → Save. Give it a minute; it'll show a live URL.
+The compose file binds intake to `127.0.0.1:3000`. Enable Funnel on port 8443 with `sudo tailscale funnel --bg --https=8443 --yes http://127.0.0.1:3000`. Do not route other services through Funnel. `PUBLIC_INTAKE_ENABLED` defaults to `false`; change it to `true` only after full-disk encryption and encrypted backup restoration have been verified, then recreate the intake container.
 
-### 3. Point ohgeec.com at GitHub
+The public form sends JSON to `https://parrot.tail60dba7.ts.net:8443/v1/intake`. The receiver validates an allowlisted schema and writes the contact, ticket, and first event in one PostgreSQL function call when intake is enabled. CORS only allows the portfolio's exact origins; it is not treated as authentication. The form contains no shared secret.
 
-At your domain registrar's DNS, add these records for the **apex** (`ohgeec.com`):
+## Private CRM host
 
-| Type | Name | Value |
-|------|------|-------|
-| A | `@` | `185.199.108.153` |
-| A | `@` | `185.199.109.153` |
-| A | `@` | `185.199.110.153` |
-| A | `@` | `185.199.111.153` |
-| AAAA | `@` | `2606:50c0:8000::153` |
-| AAAA | `@` | `2606:50c0:8001::153` |
-| AAAA | `@` | `2606:50c0:8002::153` |
-| AAAA | `@` | `2606:50c0:8003::153` |
+Follow [ops/crm/README.md](ops/crm/README.md) on the Linux server. Directus listens on `127.0.0.1:8055`; use Tailscale Serve for the owner's tailnet access. PostgreSQL has no host port. Never expose Directus or PostgreSQL publicly and never mount the Docker socket into application containers.
 
-And for the `www` version:
+The private host needs Docker Compose v2, outbound DNS/HTTPS, a Tailscale client, GHCR `read:packages` access, a protected `ops/crm/.env`, and a separate encrypted backup target. Image digests in `.env` must be set to reviewed versions before starting services. The compose stack is not live until those host-specific values, DNS, tunnel route, and initial Directus account are configured.
 
-| Type | Name | Value |
-|------|------|-------|
-| CNAME | `www` | `ohgeeceee.github.io` |
+## Update flow
 
-(The four A records are the important ones; the AAAA records add IPv6 and are optional
-but recommended. Always confirm the current IPs in GitHub's docs — link at the bottom.)
+1. A merge to `main` deploys the new static site and publishes the intake container.
+2. The host's systemd timer runs `ops/crm/deploy.sh` every five minutes. The script uses rootless Podman when available; the current laptop host should use the included user-level units (`ohgeec-crm-update.user.service` and `.timer`). Docker hosts can use the system-level units.
+3. The deploy script pulls the `stable` image, restarts only the intake service, waits for its health check, and restores the previous local image tag if the new container does not become healthy.
+4. Schema changes require an encrypted backup and a reviewed forward migration before the application image is rolled out.
 
-### 4. Lock in the domain + HTTPS
-
-Back in **Settings → Pages**: the *Custom domain* box should already read `ohgeec.com`
-(from the `CNAME` file). Once DNS propagates (minutes to a few hours), tick
-**Enforce HTTPS**. Done — `https://ohgeec.com` is live.
-
-### Bandwidth note
-
-GitHub Pages has a ~100 GB/month soft limit. Since every site in the network loads
-`ogc-network.js` from here, that's the one file with real traffic — but it's tiny
-(~14 KB, and browsers cache it), so you're nowhere near the limit at personal scale.
-
----
-
-## Alternative worth considering: Cloudflare Pages
-
-If you'd rather not think about bandwidth at all, **Cloudflare Pages** is the one I'd
-point you to. Same price (free), same drag-or-git deploy, but:
-
-- **Unlimited bandwidth** — nice precisely because `ogc-network.js` is served to all
-  your other domains.
-- Faster global CDN and instant cache purges.
-- Free custom domains + automatic HTTPS.
-
-Trade-off: you manage the domain's DNS inside Cloudflare (which is itself free and, if
-you move `ohgeec.com`'s nameservers there, also simplifies the DNS steps above). If your
-whole world is already on GitHub, Pages is the lower-friction pick. Both are genuinely
-fine.
-
-Netlify and Vercel are also free and excellent for static sites; they're just heavier
-than you need for three files. Any of the four will serve this correctly.
-
----
-
-## After the hub is live
-
-Add one line before `</body>` on each site so the network bar + Support button appear:
-
-```html
-<script src="https://ohgeec.com/ogc-network.js" defer></script>
-```
-
-Add `data-ogc-theme="dark"` on the dark sites (beemuu, Manners, GarageRoute):
-
-```html
-<script src="https://ohgeec.com/ogc-network.js" data-ogc-theme="dark" defer></script>
-```
-
-Because all sites load the registry from `ohgeec.com`, later changes (a new site, or
-flipping Idaho Blotter from "soon" to "live") are a one-line edit in `ogc-network.js`
-here — every site updates automatically, no redeploys elsewhere.
-
----
-
-### Quick sanity check once live
-- `https://ohgeec.com` shows the hub with all six cards.
-- `https://ohgeec.com/ogc-network.js` loads the script (not a 404).
-- On any site with the snippet, the network bar appears at the bottom.
-
-Source for the DNS values: GitHub Docs — *Managing a custom domain for your GitHub Pages site*.
+For a manual update on the host, run `ops/crm/deploy.sh`. Keep deployment credentials read-only for GHCR and do not run untrusted pull-request workflows on the home server.
diff --git a/book.html b/book.html
index bd29015..a4d17b3 100644
--- a/book.html
+++ b/book.html
@@ -3,8 +3,8 @@
 <head>
 <meta charset="UTF-8" />
 <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-<title>Remote Tech Support — Book a Session</title>
-<meta name="description" content="Fast, friendly remote tech support. Book a session and get your computer, network, or software problems solved from anywhere." />
+<title>Remote &amp; On-Site Tech Support — ohgeeceee</title>
+<meta name="description" content="Request remote tech support or on-site home technology help in Montana." />
 <style>
   :root{
     --bg:#0b1020; --bg2:#111a33; --card:#151f3d; --line:#26345f;
@@ -70,6 +70,9 @@
   .submit{justify-self:start; margin-top:6px; padding:14px 30px; border:0; border-radius:999px; cursor:pointer;
     background:linear-gradient(120deg,var(--accent),var(--accent2)); color:#04122e; font-weight:700; font-size:1rem; box-shadow:var(--shadow)}
   .submit:hover{transform:translateY(-2px)}
+  .submit:disabled{opacity:.6;cursor:wait;transform:none}
+  .consent{display:flex;align-items:flex-start;gap:10px}
+  .consent input[type=checkbox]{width:18px;height:18px;flex:0 0 auto;margin:2px 0 0}
   .note{color:var(--muted); font-size:.82rem; margin-top:10px}
   footer{border-top:1px solid var(--line); padding:26px 0 40px; color:var(--muted); font-size:.85rem; text-align:center}
   @media(max-width:640px){ form{grid-template-columns:1fr} .book{padding:24px} }
@@ -89,9 +92,9 @@
   </header>
 
   <section class="hero">
-    <h1>Tech problems solved<br><span>without the house call.</span></h1>
-    <p>Secure remote support for your computer, network, and software — fast, friendly, and fixed from anywhere. Pick a time and I'll take it from there.</p>
-    <a class="cta" href="#book">📅 Book a session</a>
+    <h1 id="booking-hero-title">Tech problems solved<br><span>without the house call.</span></h1>
+    <p id="booking-hero-copy">Secure remote support for your computer, network, and software — fast, friendly, and fixed from anywhere. Pick a time and I'll take it from there.</p>
+    <a class="cta" id="booking-hero-cta" href="#book">📅 Request support</a>
     <div class="trust">
       <span>✅ <b>Secure</b> remote access</span>
       <span>⚡ <b>Same-day</b> appointments</span>
@@ -99,7 +102,7 @@ <h1>Tech problems solved<br><span>without the house call.</span></h1>
     </div>
   </section>
 
-  <section>
+  <section id="service-categories">
     <div class="grid">
       <div class="card">
         <div class="icon"><svg viewBox="0 0 24 24"><path d="M12 2l8 4v6c0 5-3.5 8-8 10-4.5-2-8-5-8-10V6z"/></svg></div>
@@ -134,7 +137,7 @@ <h3>One-on-one tutoring</h3>
     </div>
   </section>
 
-  <section class="pricing">
+  <section class="pricing" id="remote-pricing">
     <div class="plan">
       <h3>Quick Fix</h3>
       <div class="price">$39 <small>/ 30 min</small></div>
@@ -165,67 +168,98 @@ <h3>Premium</h3>
   </section>
 
   <section class="book" id="book">
-    <h2>Book your session</h2>
-    <p class="sub">Tell me what's going on and when works for you. You'll get a confirmation by email.</p>
+    <h2>Request tech support</h2>
+    <p class="sub">Tell me what is happening and when works for you. I will follow up using your preferred contact method.</p>
 
-    <form action="https://formsubmit.co/jon@ohgeec.com" method="POST">
-      <input type="hidden" name="_subject" value="🔧 New Remote Tech Support booking request" />
-      <input type="hidden" name="_captcha" value="false" />
-      <input type="hidden" name="_template" value="table" />
-      <input type="hidden" name="_next" value="thanks.html" />
+    <form id="service-request" data-intake-form data-intake-endpoint="https://parrot.tail60dba7.ts.net:8443/v1/intake">
+      <input type="hidden" id="request-type" name="requestType" value="website_request" />
+      <input type="hidden" id="source-page" name="sourcePage" value="/book.html" />
 
-      <!-- spam honeypot (leave empty) -->
-      <input type="text" name="_honey" style="display:none" tabindex="-1" autocomplete="off" />
+      <!-- Spam honeypot. Humans leave this field blank. -->
+      <div class="field" aria-hidden="true" style="position:absolute;left:-10000px;width:1px;height:1px;overflow:hidden">
+        <label for="website">Leave this field empty</label>
+        <input id="website" name="website" type="text" tabindex="-1" autocomplete="off" />
+      </div>
 
       <div class="field">
         <label for="name">Your name *</label>
-        <input id="name" name="name" type="text" placeholder="Jane Doe" required />
+        <input id="name" name="name" type="text" maxlength="120" placeholder="Jane Doe" autocomplete="name" required />
+      </div>
+      <div class="field">
+        <label for="email">Email</label>
+        <input id="email" name="email" type="email" maxlength="254" placeholder="jane@email.com" autocomplete="email" />
       </div>
       <div class="field">
-        <label for="email">Email *</label>
-        <input id="email" name="email" type="email" placeholder="jane@email.com" required />
+        <label for="phone">Phone</label>
+        <input id="phone" name="phone" type="tel" maxlength="32" placeholder="+1 406 555 0123" autocomplete="tel" />
+      </div>
+      <div class="field">
+        <label for="preferred-contact">Preferred contact *</label>
+        <select id="preferred-contact" name="preferredContact" required>
+          <option value="">Choose one…</option>
+          <option value="phone">Phone call</option>
+          <option value="sms">Text message</option>
+          <option value="email">Email</option>
+        </select>
       </div>
       <div class="field">
-        <label for="phone">Phone (optional)</label>
-        <input id="phone" name="phone" type="tel" placeholder="+1 555 123 4567" />
+        <label for="location">Town or county (required for on-site)</label>
+        <input id="location" name="location" type="text" maxlength="120" placeholder="Town or county; no street address yet" autocomplete="address-level2" />
       </div>
       <div class="field">
         <label for="service">What do you need? *</label>
         <select id="service" name="service" required>
           <option value="">Choose a service…</option>
-          <option>Virus &amp; malware removal</option>
-          <option>Setup &amp; optimization</option>
-          <option>Data backup &amp; recovery</option>
-          <option>Software &amp; app help</option>
-          <option>Network &amp; Wi-Fi</option>
-          <option>One-on-one tutoring</option>
-          <option>Something else</option>
+          <option value="virus_malware">Virus &amp; malware removal</option>
+          <option value="setup_optimization">Setup &amp; optimization</option>
+          <option value="data_recovery">Data backup &amp; recovery</option>
+          <option value="software_help">Software &amp; app help</option>
+          <option value="network_wifi">Network &amp; Wi-Fi</option>
+          <option value="starlink_setup">Starlink setup</option>
+          <option value="tutoring">One-on-one tutoring</option>
+          <option value="other">Something else</option>
+        </select>
+      </div>
+      <div class="field">
+        <label for="device-type">Device type</label>
+        <input id="device-type" name="deviceType" type="text" maxlength="120" placeholder="Router, Starlink, laptop…" />
+      </div>
+      <div class="field">
+        <label for="service-mode">How should we help? *</label>
+        <select id="service-mode" name="serviceMode" required>
+          <option value="undecided">Not sure yet</option>
+          <option value="remote">Remote</option>
+          <option value="onsite">On-site in Montana</option>
         </select>
       </div>
       <div class="field">
-        <label for="date">Preferred date *</label>
-        <input id="date" name="date" type="date" required />
+        <label for="date">Preferred date</label>
+        <input id="date" name="date" type="date" />
       </div>
       <div class="field">
-        <label for="time">Preferred time *</label>
-        <input id="time" name="time" type="time" required />
+        <label for="time">Preferred time</label>
+        <input id="time" name="time" type="time" />
       </div>
       <div class="field full">
-        <label for="message">What's going on? (optional)</label>
-        <textarea id="message" name="message" placeholder="Briefly describe the problem, your device, and anything you've already tried…"></textarea>
+        <label for="message">What is going on? *</label>
+        <textarea id="message" name="message" maxlength="2000" placeholder="Briefly describe the problem, device, and anything you have already tried. Do not include passwords or Wi-Fi credentials." required></textarea>
       </div>
       <div class="field full">
-        <button class="submit" type="submit">Request my session →</button>
-        <p class="note">By submitting you agree to be contacted about your request. Your details are only used to arrange support.</p>
+        <label class="consent"><input id="consent" name="consentToContact" type="checkbox" required /> I agree to be contacted about this service request.</label>
+        <p class="note">Only share what is needed to arrange support. Do not send account passwords, Wi-Fi passwords, or payment details. See the <a href="/privacy.html">privacy note</a>.</p>
+        <p id="intake-status" class="note" role="status" aria-live="polite"></p>
+        <button class="submit" id="intake-submit" type="submit" disabled>Send service request →</button>
+        <noscript><p class="note">The secure request form needs JavaScript. Please email <a href="mailto:hello@ohgeec.com">hello@ohgeec.com</a> or call/text the number listed on the support page. Do not email passwords.</p></noscript>
       </div>
     </form>
   </section>
 
   <footer>
-    Remote Tech Support · Available worldwide via secure remote connection<br>
-    Questions? Just reply to your confirmation email.
+    Remote support and on-site visits in Montana<br>
+    Questions? Email <a href="mailto:hello@ohgeec.com">hello@ohgeec.com</a>.
   </footer>
 
 </div>
+<script src="/intake.js" defer></script>
 </body>
 </html>
diff --git a/build/generate.mjs b/build/generate.mjs
index ec8bc31..c7b8a8d 100644
--- a/build/generate.mjs
+++ b/build/generate.mjs
@@ -252,6 +252,7 @@ function loadGuides() {
       service_intent: d.service_intent || 'pro_recommended',
       on_site_eligible: d.on_site_eligible === true || d.on_site_eligible === 'true',
       cta_type: d.cta_type || 'remote_booking',
+      cta_label: d.cta_label || (SERVICE_LANES[d.cta_type] ? SERVICE_LANES[d.cta_type].label : 'Book a session'),
       service_link: d.service_link || (SERVICE_LANES[d.cta_type] ? SERVICE_LANES[d.cta_type].url : BOOKING_URL),
       problem_type: d.problem_type || '', symptoms: asList(d.symptoms), quick_fix: d.quick_fix,
       prerequisites: asList(d.prerequisites), dont_need: d.dont_need || '',
@@ -396,15 +397,22 @@ function crumbs(items) {
   }).join('');
   return `<nav class="crumb" aria-label="Breadcrumb"><ol>${parts}</ol></nav>`;
 }
-function ctaBlock(heading, body, ctaLabel) {
+function ctaBlock(heading, body, ctaLabel, url = BOOKING_URL, audience = 'REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT') {
   return `<section class="cta">
   <h2 class="rv">${heading}</h2>
   <p class="rv">${body}</p>
-  <a class="btn rv" href="${BOOKING_URL}" rel="noopener">${ctaLabel} &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <a class="btn rv" href="${esc(url)}" rel="noopener">${ctaLabel} &rarr;</a>
+  <p class="fine rv">${audience}</p>
 </section>`;
 }
 
+function guideServiceUrl(g) {
+  const params = new URLSearchParams({ requestType: g.slug, sourcePage: g.urlPath });
+  const [pathAndQuery, fragment] = g.service_link.split('#', 2);
+  const separator = pathAndQuery.includes('?') ? '&' : '?';
+  return `${pathAndQuery}${separator}${params.toString()}${fragment ? `#${fragment}` : ''}`;
+}
+
 /* ------------------------------------------------------------------ *
  * 5. Guide page
  * ------------------------------------------------------------------ */
@@ -473,7 +481,7 @@ function renderGuide(g, all) {
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol>${g.escalation.map((e) => `<li>${inline(e)}</li>`).join('')}</ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="${BOOKING_URL}">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="${esc(guideServiceUrl(g))}">${esc(g.cta_label)} &rarr;</a></p>
       </div>
     </details>` : '';
   const sources = g.sources.length ? g.sources.map((s) => `<a href="${s.url}" rel="noopener">${esc(s.label)}</a>`).join('') : '';
@@ -527,7 +535,7 @@ ${topbar('tech')}
     ${escBlock}
   </div>
 
-  ${ctaBlock('Still stuck? <em>I can take it from here.</em>', 'If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.', 'Book a session')}
+  ${ctaBlock('Still stuck? <em>I can take it from here.</em>', 'If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.', g.cta_label, guideServiceUrl(g), g.cta_type === 'onsite_request' ? 'ON-SITE SERVICE IN MONTANA' : 'REMOTE SUPPORT AVAILABLE')}
 
   <div class="wrap wrap--narrow">
     ${relatedBlock(g, all)}
@@ -691,6 +699,7 @@ function writeSitemap(guides) {
     { loc: '/tech-support/', mod: today, cf: 'weekly', pr: '0.9' },
     ...Object.keys(CATEGORIES).map((k) => ({ loc: `/tech-support/${k}/`, mod: today, cf: 'weekly', pr: '0.7' })),
     ...guides.map((g) => ({ loc: g.urlPath, mod: g.last_verified, cf: 'monthly', pr: '0.8' })),
+    { loc: ONSITE_URL, mod: today, cf: 'monthly', pr: '0.7' },
     { loc: '/book.html', mod: today, cf: 'monthly', pr: '0.7' },
     { loc: '/support.html', mod: today, cf: 'yearly', pr: '0.3' },
   ];
@@ -706,6 +715,58 @@ ${entries.map((e) => `  <url>
 `;
   fs.writeFileSync(path.join(ROOT, 'sitemap.xml'), xml);
 }
+function renderOnsiteLanding() {
+  const canonical = SITE + ONSITE_URL;
+  const ld = {
+    '@context': 'https://schema.org',
+    '@type': 'Service',
+    name: 'On-site home technology support in Montana',
+    provider: { '@type': 'Person', name: AUTHOR, url: SITE + '/' },
+    areaServed: { '@type': 'State', name: 'Montana' },
+    serviceType: 'Home technology setup and troubleshooting',
+    url: canonical,
+  };
+  return `${head({ title: 'On-site tech support in Montana — ohgeeceee', description: 'On-site help with Starlink, Wi-Fi, computers, printers, and connected devices across Montana. Request a visit and share only the details needed to plan it.', canonical, ogImage: OG_DEFAULT, type: 'website', ld })}
+<body>
+${topbar('tech')}
+<main>
+  <div class="wrap wrap--narrow">
+    ${crumbs([{ label: 'Home', href: '/' }, { label: 'Tech Support', href: '/tech-support/' }, { label: 'On-site help in Montana' }])}
+    <p class="kicker rv">MONTANA · HOME TECH SUPPORT</p>
+    <h1 class="rv">The tech at home, sorted.</h1>
+    <p class="lede rv">On-site help for rural homes, small businesses, and the places where a reliable connection matters. Tell me what is happening and where you are; we will confirm availability before scheduling.</p>
+    <section class="prereq rv">
+      <h2>What I can help with</h2>
+      <ul>
+        <li>Starlink setup, dish placement, and Wi-Fi coverage</li>
+        <li>Wi-Fi dead zones, router setup, and connected devices</li>
+        <li>Computer, printer, smart TV, and home network troubleshooting</li>
+      </ul>
+      <p class="dont">No account passwords or Wi-Fi passwords in the request form. We can arrange a safe way to share access if a visit requires it.</p>
+    </section>
+    <section class="cta" id="request">
+      <h2>Request an on-site visit</h2>
+      <p>Share your Montana town or county, a short description, and a preferred time. Exact address and access details can wait until the visit is confirmed.</p>
+      <a class="btn" id="onsite-request-link" href="/book.html?mode=onsite">Request an on-site visit &rarr;</a>
+      <p class="fine">MONTANA ON-SITE SERVICE · REQUESTS ARE CONFIRMED BEFORE A VISIT IS BOOKED</p>
+    </section>
+    <p>If remote help is a better fit, <a href="/book.html?mode=remote">request a remote session</a>. For urgent issues, call or text after we confirm your request.</p>
+  </div>
+</main>
+${footer()}
+<script>
+  const incoming = new URLSearchParams(location.search);
+  const booking = new URL('/book.html', location.origin);
+  booking.searchParams.set('mode', 'onsite');
+  booking.searchParams.set('requestType', incoming.get('requestType') || 'onsite_support');
+  booking.searchParams.set('sourcePage', incoming.get('sourcePage') || location.pathname);
+  document.getElementById('onsite-request-link').href = booking.pathname + booking.search;
+</script>
+${revealScript()}
+</body>
+</html>
+`;
+}
 function writeFeed(guides) {
   const items = guides.map((g) => `    <item>
       <title>${esc(g.title)}</title>
@@ -778,6 +839,8 @@ fs.mkdirSync(path.join(ROOT, 'content'), { recursive: true });
 fs.writeFileSync(path.join(ROOT, 'content', 'guides.json'), JSON.stringify({ generated: today, count: guides.length, guides: manifest }, null, 2));
 
 writeSitemap(guides);
+fs.mkdirSync(path.join(OUT_DIR, 'onsite-montana'), { recursive: true });
+fs.writeFileSync(path.join(OUT_DIR, 'onsite-montana', 'index.html'), renderOnsiteLanding());
 writeFeed(guides);
 writeRedirectStub();
 
@@ -785,6 +848,7 @@ console.log(`\n\u2714 Built ${guides.length} guides, ${Object.keys(CATEGORIES).l
 console.log(`  tech-support/index.html`);
 console.log(`  tech-support/<category>/index.html`);
 console.log(`  tech-support/<category>/<slug>/index.html`);
+console.log(`  tech-support/onsite-montana/index.html`);
 console.log(`  content/guides.json  (${manifest.length} entries)`);
 console.log(`  sitemap.xml, tech-support/feed.xml, tech-support.html (redirect stub)`);
 if (warnings.length) {
@@ -792,4 +856,4 @@ if (warnings.length) {
   for (const w of warnings.slice(0, 40)) console.log('   • ' + w);
   if (warnings.length > 40) console.log(`   … and ${warnings.length - 40} more`);
 }
-console.log('');
\ No newline at end of file
+console.log('');
diff --git a/content/guides.json b/content/guides.json
index 23cee8b..a3d1ace 100644
--- a/content/guides.json
+++ b/content/guides.json
@@ -28,6 +28,11 @@
         "non-technical"
       ],
       "targeted_region": "rural-us",
+      "service_intent": "pro_recommended",
+      "on_site_eligible": true,
+      "cta_type": "onsite_request",
+      "cta_label": "Request an on-site visit",
+      "service_link": "/tech-support/onsite-montana/",
       "problem_type": "No signal",
       "symptoms": [
         "No Service",
@@ -133,6 +138,11 @@
         "non-technical"
       ],
       "targeted_region": "rural-us",
+      "service_intent": "pro_required",
+      "on_site_eligible": true,
+      "cta_type": "onsite_request",
+      "cta_label": "Request on-site Starlink setup",
+      "service_link": "/tech-support/onsite-montana/",
       "problem_type": "Slow",
       "symptoms": [
         "buffering",
@@ -236,6 +246,11 @@
         "small-business"
       ],
       "targeted_region": "rural-us",
+      "service_intent": "pro_required",
+      "on_site_eligible": true,
+      "cta_type": "onsite_request",
+      "cta_label": "Request an on-site visit",
+      "service_link": "/tech-support/onsite-montana/",
       "problem_type": "Weak Wi-Fi",
       "symptoms": [
         "dead zone",
@@ -341,6 +356,11 @@
         "non-technical"
       ],
       "targeted_region": "us",
+      "service_intent": "diy_ok",
+      "on_site_eligible": false,
+      "cta_type": "remote_booking",
+      "cta_label": "Book a remote session",
+      "service_link": "/book.html",
       "problem_type": "Slow",
       "symptoms": [
         "pop-ups",
@@ -447,6 +467,11 @@
         "small-business"
       ],
       "targeted_region": "us",
+      "service_intent": "pro_recommended",
+      "on_site_eligible": false,
+      "cta_type": "remote_booking",
+      "cta_label": "Book a remote session",
+      "service_link": "/book.html",
       "problem_type": "Security",
       "symptoms": [
         "locked out",
@@ -556,6 +581,11 @@
         "small-business"
       ],
       "targeted_region": "us",
+      "service_intent": "pro_recommended",
+      "on_site_eligible": false,
+      "cta_type": "remote_booking",
+      "cta_label": "Book a remote session",
+      "service_link": "/book.html",
       "problem_type": "Slow",
       "symptoms": [
         "slow startup",
@@ -662,6 +692,11 @@
         "rural"
       ],
       "targeted_region": "us",
+      "service_intent": "pro_recommended",
+      "on_site_eligible": true,
+      "cta_type": "onsite_request",
+      "cta_label": "Request an on-site visit",
+      "service_link": "/tech-support/onsite-montana/",
       "problem_type": "Weak Wi-Fi",
       "symptoms": [
         "buffering",
@@ -766,6 +801,11 @@
         "rural"
       ],
       "targeted_region": "us",
+      "service_intent": "pro_recommended",
+      "on_site_eligible": false,
+      "cta_type": "diagnostic",
+      "cta_label": "Get a free 10-minute call",
+      "service_link": "/tech-support/onsite-montana/#request",
       "problem_type": "Security",
       "symptoms": [
         "spam texts",
@@ -871,6 +911,11 @@
         "small-business"
       ],
       "targeted_region": "us",
+      "service_intent": "pro_recommended",
+      "on_site_eligible": true,
+      "cta_type": "onsite_request",
+      "cta_label": "Request an on-site visit",
+      "service_link": "/tech-support/onsite-montana/",
       "problem_type": "Offline",
       "symptoms": [
         "printer offline",
@@ -977,6 +1022,11 @@
         "small-business"
       ],
       "targeted_region": "us",
+      "service_intent": "pro_recommended",
+      "on_site_eligible": false,
+      "cta_type": "remote_booking",
+      "cta_label": "Book a remote session",
+      "service_link": "/book.html",
       "problem_type": "Migration",
       "symptoms": [
         "new phone",
diff --git a/content/guides/02-satellite-internet-slow-starlink-hughesnet.md b/content/guides/02-satellite-internet-slow-starlink-hughesnet.md
index 5c16db1..6d5f98d 100644
--- a/content/guides/02-satellite-internet-slow-starlink-hughesnet.md
+++ b/content/guides/02-satellite-internet-slow-starlink-hughesnet.md
@@ -13,6 +13,7 @@ targeted_region: rural-us
 service_intent: pro_required
 on_site_eligible: true
 cta_type: onsite_request
+cta_label: Request on-site Starlink setup
 service_link: /tech-support/onsite-montana/
 
 problem_type: Slow
diff --git a/intake.js b/intake.js
new file mode 100644
index 0000000..e54e2f5
--- /dev/null
+++ b/intake.js
@@ -0,0 +1,90 @@
+(() => {
+  const form = document.querySelector('[data-intake-form]');
+  if (!form) return;
+  const intakeEndpoint = form.dataset.intakeEndpoint || 'https://api.ohgeec.com/v1/intake';
+
+  const status = document.getElementById('intake-status');
+  const submit = document.getElementById('intake-submit');
+  const params = new URLSearchParams(window.location.search);
+  const mode = params.get('mode');
+  const serviceMode = document.getElementById('service-mode');
+  if (mode === 'onsite' || mode === 'remote') serviceMode.value = mode;
+  const locationField = document.getElementById('location');
+  const syncLocationRequirement = () => { locationField.required = serviceMode.value === 'onsite'; };
+  serviceMode.addEventListener('change', syncLocationRequirement);
+  syncLocationRequirement();
+  if (mode === 'onsite') {
+    document.getElementById('booking-hero-title').innerHTML = 'On-site tech support<br><span>in Montana.</span>';
+    document.getElementById('booking-hero-copy').textContent = 'Starlink, Wi-Fi, computers, printers, and connected devices. Send a request with your Montana town or county and I will confirm availability.';
+    document.getElementById('booking-hero-cta').textContent = 'Request an on-site visit';
+    document.getElementById('remote-pricing').hidden = true;
+    document.getElementById('service-categories').hidden = true;
+    document.querySelector('.book h2').textContent = 'Request an on-site visit';
+  }
+
+  const requestType = params.get('requestType');
+  if (requestType && /^[a-z0-9_-]{1,80}$/i.test(requestType)) {
+    document.getElementById('request-type').value = requestType;
+    if (requestType.includes('starlink')) document.getElementById('service').value = 'starlink_setup';
+  }
+  const sourcePage = params.get('sourcePage');
+  if (sourcePage && sourcePage.startsWith('/') && !sourcePage.startsWith('//')) {
+    document.getElementById('source-page').value = sourcePage.slice(0, 240);
+  }
+
+  let idempotencyKey = crypto.randomUUID();
+  submit.disabled = false;
+  form.addEventListener('submit', async (event) => {
+    event.preventDefault();
+    if (!form.reportValidity()) return;
+
+    const values = new FormData(form);
+    const preferredContact = String(values.get('preferredContact') || '');
+    const phone = String(values.get('phone') || '').trim();
+    const email = String(values.get('email') || '').trim();
+    if ((preferredContact === 'email' && !email) || (preferredContact !== 'email' && !phone)) {
+      status.textContent = preferredContact === 'email'
+        ? 'Please add your email address, or choose phone/text as your preferred contact.'
+        : 'Please add a phone number, or choose email as your preferred contact.';
+      return;
+    }
+
+    const payload = {
+      name: String(values.get('name') || '').trim(),
+      phone,
+      email,
+      location: String(values.get('location') || '').trim(),
+      preferredContact,
+      requestType: String(values.get('requestType') || 'website_request'),
+      deviceType: String(values.get('deviceType') || '').trim(),
+      serviceMode: String(values.get('serviceMode') || 'undecided'),
+      service: String(values.get('service') || ''),
+      description: String(values.get('message') || '').trim(),
+      requestedDate: String(values.get('date') || ''),
+      requestedTime: String(values.get('time') || ''),
+      sourcePage: String(values.get('sourcePage') || '/book.html'),
+      consentToContact: values.get('consentToContact') === 'on',
+      website: String(values.get('website') || ''),
+    };
+
+    submit.disabled = true;
+    status.textContent = 'Sending your request…';
+    try {
+      const response = await fetch(intakeEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'Idempotency-Key': idempotencyKey },
+        body: JSON.stringify(payload),
+        credentials: 'omit',
+        referrerPolicy: 'no-referrer',
+      });
+      if (!response.ok) throw new Error('Request unavailable');
+      form.reset();
+      idempotencyKey = crypto.randomUUID();
+      status.textContent = 'Request received. I will follow up using your preferred contact method.';
+      submit.textContent = 'Request sent';
+    } catch {
+      status.textContent = 'I could not send that request right now. Please try again, or email hello@ohgeec.com. Do not include passwords.';
+      submit.disabled = false;
+    }
+  });
+})();
diff --git a/ops/crm/.env.example b/ops/crm/.env.example
new file mode 100644
index 0000000..1f0be5e
--- /dev/null
+++ b/ops/crm/.env.example
@@ -0,0 +1,11 @@
+# Copy to .env on the Linux host; chmod 600. Never commit actual values.
+POSTGRES_IMAGE=docker.io/library/postgres:17.11-alpine3.24@sha256:aa90e97ee862e558111d34cfb8b2c4bec768c2b039fb791341686928560263b3
+DIRECTUS_IMAGE=docker.io/directus/directus:11.17.4@sha256:304e86483c3f44ceb0b90a1227104f165774483d157da145b4382d9c35b56b0b
+POSTGRES_PASSWORD=GENERATE_LONG_RANDOM_VALUE
+INTAKE_DB_PASSWORD=GENERATE_DIFFERENT_LONG_RANDOM_VALUE
+DIRECTUS_SECRET=GENERATE_64_RANDOM_CHARACTERS
+ADMIN_EMAIL=SET_TO_A_VALID_ADMIN_EMAIL
+ADMIN_PASSWORD=GENERATE_A_UNIQUE_PASSWORD
+DIRECTUS_PRIVATE_URL=https://YOUR-HOST.YOUR-TAILNET.ts.net
+INTAKE_IMAGE=ghcr.io/ohgeeceee/network-intake:stable
+PUBLIC_INTAKE_ENABLED=false
diff --git a/ops/crm/README.md b/ops/crm/README.md
new file mode 100644
index 0000000..5d09afb
--- /dev/null
+++ b/ops/crm/README.md
@@ -0,0 +1,66 @@
+# ohgeec CRM home-server deployment
+
+This Compose project runs the private CRM and the public form receiver. The portfolio stays on GitHub Pages; do not publish the home site's source or customer data from this directory. The API accepts only constrained support requests. Directus and PostgreSQL have no public hostname.
+
+## Before the first start
+
+1. Use a patched Linux host with Docker Compose v2 or Podman 5 with a Compose provider, a firewall that blocks inbound WAN connections, full-disk encryption, and a separate backup destination. Install and authenticate Tailscale on the host before enabling remote admin access. Do not configure router port forwarding. Do not enter real client information until full-disk encryption and encrypted off-host backups are ready.
+2. The public intake route uses Tailscale Funnel at `https://<host>.<tailnet>.ts.net:8443`; Funnel supports only tailnet hostnames and specific HTTPS ports. The compose file binds intake to host loopback port 3000; route Funnel port 8443 to `http://127.0.0.1:3000`. Keep the existing Tailscale Serve route on port 443 for private Directus administration. Do not expose Directus, Postgres, SSH, or the Docker socket publicly. Leave `PUBLIC_INTAKE_ENABLED=false` until full-disk encryption and encrypted backup restoration have been verified.
+3. The example pins the reviewed x86-64 image digests for Postgres and Directus. Copy `.env.example` to `.env`, set a valid `ADMIN_EMAIL`, and replace every remaining placeholder. Generate independent random values for every password/secret, set `chmod 600 .env`, and keep that file outside Git backups.
+4. Give the GitHub Container Registry package `ghcr.io/ohgeeceee/network-intake` read access for a dedicated host token with `read:packages` only. Log in to GHCR as the restricted deploy account (`podman login ghcr.io` for the rootless Podman host, or `docker login ghcr.io` for Docker). Do not use a self-hosted GitHub Actions runner on this server.
+5. Keep the allowed CORS origins limited to the website origins `https://ohgeec.com` and `https://www.ohgeec.com`; do not add the API hostname as an origin.
+
+## Start and administer
+
+```sh
+cp .env.example .env
+chmod 600 .env
+# Fill in .env values first.
+docker compose --env-file .env -f compose.yaml config
+docker compose --env-file .env -f compose.yaml up -d
+```
+
+On first initialization, Postgres creates the schema and a separate `intake_api` DB role. The intake role can execute only the `create_public_intake(...)` function; it cannot query CRM tables. The init scripts run only when the `pgdata` volume is new. For an existing database, apply each new migration from `services/intake/sql/` as the DB owner; `002_crm_extensions.sql` adds lead follow-up and project tracking without deleting data.
+
+Directus listens on host loopback port 8055 only. After the tailnet owner enables Tailscale Serve, proxy its HTTPS tailnet URL to `http://127.0.0.1:8055`; keep tailnet ACLs limited to your own devices. Do not expose the port on the LAN or internet. On first startup, Directus creates the admin account from `ADMIN_EMAIL` and `ADMIN_PASSWORD`. Sign in immediately over Tailscale, enable the strongest supported second factor, then remove those two bootstrap values from `.env` and recreate the Directus container. Keep the current credential in your password manager.
+
+Register the `contacts`, `projects`, `service_tickets`, `client_assets`, and `service_events` tables as Directus collections. Create the many-to-one relationships `projects.contact_id -> contacts.id`, `service_tickets.contact_id -> contacts.id`, `service_tickets.project_id -> projects.id`, `client_assets.contact_id -> contacts.id`, `service_events.contact_id -> contacts.id`, `service_events.ticket_id -> service_tickets.id`, and `service_events.project_id -> projects.id`. Keep the public role with no collection permissions and do not create a public Directus route. Use the admin role only through Tailscale. The `service_events` collection holds history and notes; keep new events append-only where possible. Store only password-manager references in `credential_reference`.
+
+## Backups
+
+Keep an encrypted off-host backup. A simple backup pattern with `age` installed on the host is:
+
+```sh
+umask 077
+stamp=$(date -u +%Y%m%dT%H%M%SZ)
+docker compose --env-file .env -f compose.yaml exec -T postgres pg_dump -U ohgeec_admin -Fc ohgeec \
+  | age -r "$AGE_RECIPIENT" > "/srv/backups/ohgeec/crm-${stamp}.dump.age"
+```
+
+Use a public age recipient on the host; protect the private decryption identity separately from the server. Back up Directus uploads if you add file uploads. Test restoration to a separate database before entering customer data, and repeat restore checks regularly. A same-disk copy is not a disaster-recovery backup.
+
+## Updates and rollback
+
+The workflow publishes both an immutable `sha-<commit>` tag and a convenience `stable` tag. The host pulls the stable tag with `ops/crm/deploy.sh`, checks its container health, and keeps the prior local image tagged for rollback. The script uses rootless Podman when available and can be forced to Docker with `CONTAINER_ENGINE=docker`. Set up an update timer only after GHCR login and `.env` are ready.
+
+For the current rootless Podman laptop host, install the user units and adjust the working path if the repository lives elsewhere:
+
+```sh
+mkdir -p ~/.config/systemd/user
+cp ops/crm/ohgeec-crm-update.user.{service,timer} ~/.config/systemd/user/
+systemctl --user daemon-reload
+systemctl --user enable --now ohgeec-crm-update.user.timer
+```
+
+For a Docker host with the dedicated deploy account, use the system units:
+
+```sh
+sudo useradd --system --home /opt/ohgeec --shell /usr/sbin/nologin ohgeec-deploy
+sudo usermod -aG docker ohgeec-deploy
+# Place a clone of this repo at /opt/ohgeec/network and protect its ops/crm/.env.
+sudo cp ops/crm/ohgeec-crm-update.{service,timer} /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now ohgeec-crm-update.timer
+```
+
+Membership in the Docker group is effectively root access. Protect this account and its credentials accordingly. Review GitHub Actions updates and image digests; never run PR-controlled workflows on the home machine.
diff --git a/ops/crm/compose.yaml b/ops/crm/compose.yaml
new file mode 100644
index 0000000..64ba5de
--- /dev/null
+++ b/ops/crm/compose.yaml
@@ -0,0 +1,86 @@
+name: ohgeec-crm
+services:
+  postgres:
+    image: ${POSTGRES_IMAGE:?pin a reviewed Postgres image digest}
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ohgeec
+      POSTGRES_USER: ohgeec_admin
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set in .env}
+      INTAKE_DB_PASSWORD: ${INTAKE_DB_PASSWORD:?set in .env}
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+      - ../../services/intake/sql/001_schema.sql:/docker-entrypoint-initdb.d/010-schema.sql:ro
+      - ../../services/intake/sql/002_crm_extensions.sql:/docker-entrypoint-initdb.d/015-crm-extensions.sql:ro
+      - ../../services/intake/sql/020-create-api-role.sh:/docker-entrypoint-initdb.d/020-create-api-role.sh:ro
+    networks: [data]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ohgeec_admin -d ohgeec"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 20s
+
+  directus:
+    image: ${DIRECTUS_IMAGE:?pin a reviewed Directus image digest}
+    restart: unless-stopped
+    depends_on:
+      postgres: { condition: service_healthy }
+    environment:
+      SECRET: ${DIRECTUS_SECRET:?set in .env}
+      ADMIN_EMAIL: ${ADMIN_EMAIL:-}
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
+      DB_CLIENT: pg
+      DB_HOST: postgres
+      DB_PORT: 5432
+      DB_DATABASE: ohgeec
+      DB_USER: ohgeec_admin
+      DB_PASSWORD: ${POSTGRES_PASSWORD:?set in .env}
+      PUBLIC_URL: ${DIRECTUS_PRIVATE_URL:?set to Tailscale HTTPS URL}
+      TELEMETRY: "false"
+      LOG_LEVEL: warn
+    ports:
+      - "127.0.0.1:8055:8055"
+    networks: [data, private_admin]
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8055/server/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 60s
+
+  intake:
+    image: ${INTAKE_IMAGE:-ghcr.io/ohgeeceee/network-intake:stable}
+    restart: unless-stopped
+    depends_on:
+      postgres: { condition: service_healthy }
+    environment:
+      DB_HOST: postgres
+      DB_PORT: "5432"
+      DB_NAME: ohgeec
+      DB_USER: intake_api
+      DB_PASSWORD: ${INTAKE_DB_PASSWORD}
+      ALLOWED_ORIGINS: https://ohgeec.com,https://www.ohgeec.com
+      PUBLIC_INTAKE_ENABLED: ${PUBLIC_INTAKE_ENABLED:-false}
+      PORT: "3000"
+    networks: [data]
+    ports:
+      - "127.0.0.1:3000:3000"
+    read_only: true
+    tmpfs: [/tmp]
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 20s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+
+networks:
+  data:
+    internal: true
+  private_admin: {}
+
+volumes:
+  pgdata:
diff --git a/ops/crm/deploy.sh b/ops/crm/deploy.sh
new file mode 100644
index 0000000..2cf9344
--- /dev/null
+++ b/ops/crm/deploy.sh
@@ -0,0 +1,42 @@
+#!/bin/sh
+set -eu
+cd "$(dirname "$0")"
+
+if [ -n "${CONTAINER_ENGINE:-}" ]; then
+  engine=$CONTAINER_ENGINE
+elif command -v podman >/dev/null 2>&1; then
+  engine=podman
+else
+  engine=docker
+fi
+
+compose() {
+  "$engine" compose --env-file .env -f compose.yaml "$@"
+}
+
+service=intake
+old_id=$(compose images -q "$service" 2>/dev/null | head -n 1 || true)
+if [ -n "$old_id" ]; then "$engine" image tag "$old_id" ohgeec-intake:rollback; fi
+compose pull "$service"
+compose up -d --no-deps "$service"
+
+healthy=0
+i=0
+while [ "$i" -lt 18 ]; do
+  container_id=$(compose ps -q "$service")
+  state=$("$engine" inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$container_id" 2>/dev/null || true)
+  if [ "$state" = healthy ]; then healthy=1; break; fi
+  sleep 5
+  i=$((i + 1))
+done
+if [ "$healthy" -eq 1 ]; then
+  echo "Intake service is healthy."
+  exit 0
+fi
+
+echo "New intake image did not become healthy; restoring the previous local image." >&2
+if [ -n "$old_id" ]; then
+  INTAKE_IMAGE=ohgeec-intake:rollback compose up -d --no-deps --pull never "$service"
+  exit 1
+fi
+exit 1
diff --git a/ops/crm/ohgeec-crm-update.service b/ops/crm/ohgeec-crm-update.service
new file mode 100644
index 0000000..b4816bc
--- /dev/null
+++ b/ops/crm/ohgeec-crm-update.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Pull and health-check the approved ohgeec CRM intake image
+After=docker.service network-online.target
+Wants=network-online.target
+Requires=docker.service
+
+[Service]
+Type=oneshot
+User=ohgeec-deploy
+Group=docker
+WorkingDirectory=/opt/ohgeec/network/ops/crm
+ExecStart=/opt/ohgeec/network/ops/crm/deploy.sh
diff --git a/ops/crm/ohgeec-crm-update.timer b/ops/crm/ohgeec-crm-update.timer
new file mode 100644
index 0000000..89f51d4
--- /dev/null
+++ b/ops/crm/ohgeec-crm-update.timer
@@ -0,0 +1,10 @@
+[Unit]
+Description=Check for ohgeec CRM intake image updates
+
+[Timer]
+OnBootSec=3min
+OnUnitActiveSec=5min
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/ops/crm/ohgeec-crm-update.user.service b/ops/crm/ohgeec-crm-update.user.service
new file mode 100644
index 0000000..6f05fb5
--- /dev/null
+++ b/ops/crm/ohgeec-crm-update.user.service
@@ -0,0 +1,9 @@
+[Unit]
+Description=Pull and health-check the approved ohgeec CRM intake image
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+WorkingDirectory=%h/services/ohgeec/network/ops/crm
+ExecStart=%h/services/ohgeec/network/ops/crm/deploy.sh
diff --git a/ops/crm/ohgeec-crm-update.user.timer b/ops/crm/ohgeec-crm-update.user.timer
new file mode 100644
index 0000000..89f51d4
--- /dev/null
+++ b/ops/crm/ohgeec-crm-update.user.timer
@@ -0,0 +1,10 @@
+[Unit]
+Description=Check for ohgeec CRM intake image updates
+
+[Timer]
+OnBootSec=3min
+OnUnitActiveSec=5min
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/privacy.html b/privacy.html
new file mode 100644
index 0000000..f319f77
--- /dev/null
+++ b/privacy.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Service request privacy — ohgeeceee</title>
+  <link rel="stylesheet" href="/fonts.css" />
+  <link rel="stylesheet" href="/portfolio.css" />
+  <meta name="robots" content="index,follow" />
+</head>
+<body>
+  <main class="wrap wrap--narrow">
+    <p class="kicker">PRIVACY · SERVICE REQUESTS</p>
+    <h1>What happens to your service request</h1>
+    <p>When you send a support request, the information you provide passes through Cloudflare Tunnel as network transport and is sent to a privately operated service system so it can be reviewed and used to arrange support. Requests are stored on a home development server and are accessible only to the service operator. The CRM is not publicly accessible.</p>
+    <h2>What to share</h2>
+    <p>Share your name, one way to contact you, your Montana town or county for on-site work, and a short description. Do not send passwords, Wi-Fi credentials, payment card details, or other account secrets through the form.</p>
+    <h2>How it is used</h2>
+    <p>Your details are used to respond to and manage your service request. The request system records the page that referred you and the time submitted. The form does not use advertising trackers or save request contents in browser storage. We keep records for service follow-up and delete them when they are no longer needed; email to request access, correction, or deletion.</p>
+    <h2>Questions or deletion requests</h2>
+    <p>Email <a href="mailto:hello@ohgeec.com">hello@ohgeec.com</a> and include enough context to identify the request. Do not include passwords.</p>
+    <p><a href="/book.html">Return to the service request form</a></p>
+  </main>
+</body>
+</html>
diff --git a/services/intake/Dockerfile b/services/intake/Dockerfile
new file mode 100644
index 0000000..ec880f0
--- /dev/null
+++ b/services/intake/Dockerfile
@@ -0,0 +1,9 @@
+FROM docker.io/library/node:22-alpine@sha256:2c752226d477b4a886378baa95b9af252be59301b725fdb0b7e15208131505a8
+ENV NODE_ENV=production
+WORKDIR /app
+COPY package.json pnpm-lock.yaml ./
+RUN corepack enable && pnpm install --prod --frozen-lockfile && pnpm store prune
+COPY src ./src
+USER node
+EXPOSE 3000
+CMD ["node", "src/server.mjs"]
diff --git a/services/intake/package.json b/services/intake/package.json
new file mode 100644
index 0000000..0109675
--- /dev/null
+++ b/services/intake/package.json
@@ -0,0 +1,20 @@
+{
+  "name": "ohgeec-crm-intake",
+  "private": true,
+  "version": "1.0.0",
+  "type": "module",
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "start": "node src/server.mjs"
+  },
+  "dependencies": {
+    "@fastify/cors": "^11.0.1",
+    "@fastify/rate-limit": "^10.3.0",
+    "fastify": "^5.3.3",
+    "pg": "^8.16.0",
+    "zod": "^3.25.0"
+  },
+  "packageManager": "pnpm@11.19.0"
+}
diff --git a/services/intake/pnpm-lock.yaml b/services/intake/pnpm-lock.yaml
new file mode 100644
index 0000000..f099a32
--- /dev/null
+++ b/services/intake/pnpm-lock.yaml
@@ -0,0 +1,508 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    dependencies:
+      '@fastify/cors':
+        specifier: ^11.0.1
+        version: 11.3.0
+      '@fastify/rate-limit':
+        specifier: ^10.3.0
+        version: 10.3.0
+      fastify:
+        specifier: ^5.3.3
+        version: 5.12.5
+      pg:
+        specifier: ^8.16.0
+        version: 8.23.1
+      zod:
+        specifier: ^3.25.0
+        version: 3.25.76
+
+packages:
+
+  '@fastify/ajv-compiler@4.0.6':
+    resolution: {integrity: sha512-NtuzM0SfaMJbGlnjr9LWQUN5LzgSrbB8tf/wRZNas+4E1O/Nmzl53e7ruT61HDZyRCJGC6FxIogmNZO1c5ETBA==}
+
+  '@fastify/cors@11.3.0':
+    resolution: {integrity: sha512-ggQGua+xHv1MvePbPr0v//xLYEsCXbWspquXCJS9Ot5YoRXq8J8ZWzHnxDBVnbtXosvistXo6LtNzOJswf64Fw==}
+
+  '@fastify/error@4.2.0':
+    resolution: {integrity: sha512-RSo3sVDXfHskiBZKBPRgnQTtIqpi/7zhJOEmAxCiBcM7d0uwdGdxLlsCaLzGs8v8NnxIRlfG0N51p5yFaOentQ==}
+
+  '@fastify/fast-json-stringify-compiler@5.1.0':
+    resolution: {integrity: sha512-PxcYtKLbQ8Z+yApiqjK8FwxIwvEj38k2OiLc17u8dkJSlmfi2wHHPaSnaoqBPQqtvF8YVsDgDpP2snDCfFrpfw==}
+
+  '@fastify/forwarded@3.0.2':
+    resolution: {integrity: sha512-NE8HgKLgYejV9lDpqkEFaDKMLYelJBVfHekhB0UKvX0ghagXRJqg68feg8er1NPXxG4N9i6vPxzt8E+3wHfcmA==}
+
+  '@fastify/merge-json-schemas@0.2.1':
+    resolution: {integrity: sha512-OA3KGBCy6KtIvLf8DINC5880o5iBlDX4SxzLQS8HorJAbqluzLRn80UXU0bxZn7UOFhFgpRJDasfwn9nG4FG4A==}
+
+  '@fastify/proxy-addr@5.1.1':
+    resolution: {integrity: sha512-zv07Y9GEuDsJPegZoDFd4SDWaZOW8N2pa0GSrYmKpId/tjt1Hgo3BjZBVjdVpfVrHaA+Qv5jawtS2O50J5xM9g==}
+
+  '@fastify/rate-limit@10.3.0':
+    resolution: {integrity: sha512-eIGkG9XKQs0nyynatApA3EVrojHOuq4l6fhB4eeCk4PIOeadvOJz9/4w3vGI44Go17uaXOWEcPkaD8kuKm7g6Q==}
+
+  '@lukeed/ms@2.0.2':
+    resolution: {integrity: sha512-9I2Zn6+NJLfaGoz9jN3lpwDgAYvfGeNYdbAIjJOqzs4Tpc+VU3Jqq4IofSUBKajiDS8k9fZIg18/z13mpk1bsA==}
+    engines: {node: '>=8'}
+
+  '@pinojs/redact@0.4.0':
+    resolution: {integrity: sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==}
+
+  abstract-logging@2.0.1:
+    resolution: {integrity: sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA==}
+
+  ajv-formats@3.0.1:
+    resolution: {integrity: sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==}
+    peerDependencies:
+      ajv: ^8.0.0
+    peerDependenciesMeta:
+      ajv:
+        optional: true
+
+  ajv@8.20.0:
+    resolution: {integrity: sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==}
+
+  atomic-sleep@1.0.0:
+    resolution: {integrity: sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==}
+    engines: {node: '>=8.0.0'}
+
+  avvio@9.3.0:
+    resolution: {integrity: sha512-g2tQ7LE7oOSqDfwEm3M+ZCMTJc7KiZCdJ4UwyZJb5ckTKyYu50OYmvv0mCFXPuYXoM4zkSt8zM9XQ9KCvxA74A==}
+
+  cookie@1.1.1:
+    resolution: {integrity: sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==}
+    engines: {node: '>=18'}
+
+  dequal@2.0.3:
+    resolution: {integrity: sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==}
+    engines: {node: '>=6'}
+
+  fast-decode-uri-component@1.0.1:
+    resolution: {integrity: sha512-WKgKWg5eUxvRZGwW8FvfbaH7AXSh2cL+3j5fMGzUMCxWBJ3dV3a7Wz8y2f/uQ0e3B6WmodD3oS54jTQ9HVTIIg==}
+
+  fast-deep-equal@3.1.3:
+    resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
+
+  fast-json-stringify@7.0.1:
+    resolution: {integrity: sha512-eRSayARSbbwlBjpP4vnTTIRD5QPcIrmihPxDeN1DtKnHPg66UuJLx+8hlK1kaFdjvzyQ/dzALoi4vwAQ+T+iZA==}
+
+  fast-querystring@1.1.2:
+    resolution: {integrity: sha512-g6KuKWmFXc0fID8WWH0jit4g0AGBoJhCkJMb1RmbsSEUNvQ+ZC8D6CUZ+GtF8nMzSPXnhiePyyqqipzNNEnHjg==}
+
+  fast-uri@3.1.8:
+    resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==}
+
+  fast-uri@4.2.1:
+    resolution: {integrity: sha512-TmHQgewjHtMq1E5QKA0tOE0yeYGQs25KZC/ziJpubRtWI15W92e6vPFydWOeZBVROSHBYw/QhD9d5OefdD6LDg==}
+
+  fastify-plugin@5.1.0:
+    resolution: {integrity: sha512-FAIDA8eovSt5qcDgcBvDuX/v0Cjz0ohGhENZ/wpc3y+oZCY2afZ9Baqql3g/lC+OHRnciQol4ww7tuthOb9idw==}
+
+  fastify-plugin@6.0.0:
+    resolution: {integrity: sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==}
+
+  fastify@5.12.5:
+    resolution: {integrity: sha512-OB2k1dlxs5/NAABqeKV2FUHkSD2BbENsCak8yULVcymn3fHIPDVa9TI3SDnJSWYSllZmSYuZXy2gTnsT+Sut1A==}
+
+  fastq@1.20.3:
+    resolution: {integrity: sha512-XKv5nnLs6nLF71NgiKJLIZFLkPyIEuOselLG7ujZnGrRfQK8HpvY+WqKhAJUAdLomwVHErVS4LfxFlPq0/FTAw==}
+
+  find-my-way@9.9.0:
+    resolution: {integrity: sha512-sJsgZ1sQH2UDuowPuMKg8az7Qc8F0jnj+SKkFWU/+T0xcFlgV5skgXOGUqmQzOdmW6ALA7AhJINWx3qFBkbLHA==}
+    engines: {node: '>=20'}
+
+  ipaddr.js@2.5.0:
+    resolution: {integrity: sha512-aq+t5NAc+cS6rZQQVWC2x98CPqGtKKTMDd4Gaodv0wShnItdKg/51djkGJ1hqH+Oy0ivDftCbSLCQob8zso01w==}
+    engines: {node: '>= 10'}
+
+  json-schema-ref-resolver@3.0.0:
+    resolution: {integrity: sha512-hOrZIVL5jyYFjzk7+y7n5JDzGlU8rfWDuYyHwGa2WA8/pcmMHezp2xsVwxrebD/Q9t8Nc5DboieySDpCp4WG4A==}
+
+  json-schema-traverse@1.0.0:
+    resolution: {integrity: sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==}
+
+  light-my-request@6.6.0:
+    resolution: {integrity: sha512-CHYbu8RtboSIoVsHZ6Ye4cj4Aw/yg2oAFimlF7mNvfDV192LR7nDiKtSIfCuLT7KokPSTn/9kfVLm5OGN0A28A==}
+
+  on-exit-leak-free@2.1.2:
+    resolution: {integrity: sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==}
+    engines: {node: '>=14.0.0'}
+
+  pg-cloudflare@1.4.1:
+    resolution: {integrity: sha512-6PQbsFWZcp9EmJEwy5cGQ2La+AMWpP46lgbb8X+U/XsHIUweYDNCpeuKck5RxL2MdVFi7krbbEi5nX4Zh7JhrQ==}
+
+  pg-connection-string@2.14.1:
+    resolution: {integrity: sha512-qR3kGNPBLpCNtz0evbKA0Y/MRFXwSSdT+pTJvYp/bXTcReZbvX1kzF0IyTc1QnxqF7AZbOeBhNL8R5mYQZV/MA==}
+
+  pg-int8@1.0.1:
+    resolution: {integrity: sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw==}
+    engines: {node: '>=4.0.0'}
+
+  pg-pool@3.14.0:
+    resolution: {integrity: sha512-gKtPkFdQPU3DksooVLi9LsjZxrsBUZIpa+7aVx+LV5pNh0KzP4Zleud2po+ConrxbuXGBJ6Hfer6hdgpIBpBaw==}
+    peerDependencies:
+      pg: '>=8.0'
+
+  pg-protocol@1.16.1:
+    resolution: {integrity: sha512-p9VOFMiHB/ZbJATetbg+99PxssTVSQRnyuPSQ67mN1+1KBOjZaZ83ZQzltnxPhJwSsC3nwVjJ10DVJlerbFzLg==}
+
+  pg-types@2.2.0:
+    resolution: {integrity: sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA==}
+    engines: {node: '>=4'}
+
+  pg@8.23.1:
+    resolution: {integrity: sha512-aL96AHANtWjPLDOLqnhx+ngp9+UK7ETEU8VJrDCGvsSSi/mGLcWYsS6Herg7lmaBJe4uwrfqsa7gTEFaSizDoQ==}
+    engines: {node: '>= 16.0.0'}
+    peerDependencies:
+      pg-native: '>=3.0.1'
+    peerDependenciesMeta:
+      pg-native:
+        optional: true
+
+  pgpass@1.0.5:
+    resolution: {integrity: sha512-FdW9r/jQZhSeohs1Z3sI1yxFQNFvMcnmfuj4WBMUTxOrAyLMaTcE1aAMBiTlbMNaXvBCQuVi0R7hd8udDSP7ug==}
+
+  pino-abstract-transport@3.0.0:
+    resolution: {integrity: sha512-wlfUczU+n7Hy/Ha5j9a/gZNy7We5+cXp8YL+X+PG8S0KXxw7n/JXA3c46Y0zQznIJ83URJiwy7Lh56WLokNuxg==}
+
+  pino-std-serializers@7.1.0:
+    resolution: {integrity: sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==}
+
+  pino@10.4.0:
+    resolution: {integrity: sha512-bk1ZMTwG/Vymx+zPoa28MhNzucFvXJWp3csrSuxuHPSMeUettaCoQ5Jvg07mtC4JGNpcfTwz41oVCnNgBK9+vA==}
+    hasBin: true
+
+  postgres-array@2.0.0:
+    resolution: {integrity: sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA==}
+    engines: {node: '>=4'}
+
+  postgres-bytea@1.0.1:
+    resolution: {integrity: sha512-5+5HqXnsZPE65IJZSMkZtURARZelel2oXUEO8rH83VS/hxH5vv1uHquPg5wZs8yMAfdv971IU+kcPUczi7NVBQ==}
+    engines: {node: '>=0.10.0'}
+
+  postgres-date@1.0.7:
+    resolution: {integrity: sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q==}
+    engines: {node: '>=0.10.0'}
+
+  postgres-interval@1.2.0:
+    resolution: {integrity: sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==}
+    engines: {node: '>=0.10.0'}
+
+  process-warning@4.0.1:
+    resolution: {integrity: sha512-3c2LzQ3rY9d0hc1emcsHhfT9Jwz0cChib/QN89oME2R451w5fy3f0afAhERFZAwrbDU43wk12d0ORBpDVME50Q==}
+
+  process-warning@5.1.0:
+    resolution: {integrity: sha512-jQSaVHsPgtyw60e1rQ/A+/ArPEj/S8pS/vFnyGa/gYFXrKk/6RuDkoqVDQ5NI5MmS01698ltlAk0NoDBNLujRw==}
+
+  quick-format-unescaped@4.0.4:
+    resolution: {integrity: sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg==}
+
+  real-require@1.0.0:
+    resolution: {integrity: sha512-P4nbQYQfePJxRSmY+v/KINxVucm4NF3p3s7pJveMTtom52FR4YGltUQLB8idDXwDDWW+eYrWDFbuzUnjoWHF7g==}
+
+  require-from-string@2.0.2:
+    resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==}
+    engines: {node: '>=0.10.0'}
+
+  ret@0.5.0:
+    resolution: {integrity: sha512-I1XxrZSQ+oErkRR4jYbAyEEu2I0avBvvMM5JN+6EBprOGRCs63ENqZ3vjavq8fBw2+62G5LF5XelKwuJpcvcxw==}
+    engines: {node: '>=10'}
+
+  reusify@1.1.0:
+    resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
+    engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
+
+  rfdc@1.4.1:
+    resolution: {integrity: sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA==}
+
+  safe-regex2@5.1.1:
+    resolution: {integrity: sha512-mOSBvHGDZMuIEZMdOz/aCEYDCv0E7nfcNsIhUF+/P+xC7Hyf3FkvymqgPbg9D1EdSGu+uKbJgy09K/RKKc7kJA==}
+    hasBin: true
+
+  safe-stable-stringify@2.5.0:
+    resolution: {integrity: sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==}
+    engines: {node: '>=10'}
+
+  secure-json-parse@4.1.0:
+    resolution: {integrity: sha512-l4KnYfEyqYJxDwlNVyRfO2E4NTHfMKAWdUuA8J0yve2Dz/E/PdBepY03RvyJpssIpRFwJoCD55wA+mEDs6ByWA==}
+
+  semver@7.8.5:
+    resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  set-cookie-parser@2.7.2:
+    resolution: {integrity: sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==}
+
+  sonic-boom@4.2.1:
+    resolution: {integrity: sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==}
+
+  split2@4.2.0:
+    resolution: {integrity: sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==}
+    engines: {node: '>= 10.x'}
+
+  thread-stream@4.2.0:
+    resolution: {integrity: sha512-e2zZ96wSChazBsbENf/Pcm/4swHt2cEKQ92rhUjkL9GCKiTDJIaTBenjE/m9DXi0QBmTMDkFDdOomUy20A1tDQ==}
+    engines: {node: '>=20'}
+
+  toad-cache@3.7.4:
+    resolution: {integrity: sha512-m1TdR/rvT7kgGJZhspNtXdsdYk0fddFpJJFlG5s+UkPFo6lkLoZ3YLOaovPYjq1R75NP5JfeTlSHaOsE09peCg==}
+    engines: {node: '>=20'}
+
+  xtend@4.0.2:
+    resolution: {integrity: sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==}
+    engines: {node: '>=0.4'}
+
+  zod@3.25.76:
+    resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==}
+
+snapshots:
+
+  '@fastify/ajv-compiler@4.0.6':
+    dependencies:
+      ajv: 8.20.0
+      ajv-formats: 3.0.1(ajv@8.20.0)
+      fast-uri: 4.2.1
+
+  '@fastify/cors@11.3.0':
+    dependencies:
+      fastify-plugin: 6.0.0
+      toad-cache: 3.7.4
+
+  '@fastify/error@4.2.0': {}
+
+  '@fastify/fast-json-stringify-compiler@5.1.0':
+    dependencies:
+      fast-json-stringify: 7.0.1
+
+  '@fastify/forwarded@3.0.2': {}
+
+  '@fastify/merge-json-schemas@0.2.1':
+    dependencies:
+      dequal: 2.0.3
+
+  '@fastify/proxy-addr@5.1.1':
+    dependencies:
+      '@fastify/forwarded': 3.0.2
+      ipaddr.js: 2.5.0
+
+  '@fastify/rate-limit@10.3.0':
+    dependencies:
+      '@lukeed/ms': 2.0.2
+      fastify-plugin: 5.1.0
+      toad-cache: 3.7.4
+
+  '@lukeed/ms@2.0.2': {}
+
+  '@pinojs/redact@0.4.0': {}
+
+  abstract-logging@2.0.1: {}
+
+  ajv-formats@3.0.1(ajv@8.20.0):
+    optionalDependencies:
+      ajv: 8.20.0
+
+  ajv@8.20.0:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-uri: 3.1.8
+      json-schema-traverse: 1.0.0
+      require-from-string: 2.0.2
+
+  atomic-sleep@1.0.0: {}
+
+  avvio@9.3.0:
+    dependencies:
+      '@fastify/error': 4.2.0
+      fastq: 1.20.3
+
+  cookie@1.1.1: {}
+
+  dequal@2.0.3: {}
+
+  fast-decode-uri-component@1.0.1: {}
+
+  fast-deep-equal@3.1.3: {}
+
+  fast-json-stringify@7.0.1:
+    dependencies:
+      '@fastify/merge-json-schemas': 0.2.1
+      ajv: 8.20.0
+      ajv-formats: 3.0.1(ajv@8.20.0)
+      fast-uri: 4.2.1
+      json-schema-ref-resolver: 3.0.0
+      rfdc: 1.4.1
+
+  fast-querystring@1.1.2:
+    dependencies:
+      fast-decode-uri-component: 1.0.1
+
+  fast-uri@3.1.8: {}
+
+  fast-uri@4.2.1: {}
+
+  fastify-plugin@5.1.0: {}
+
+  fastify-plugin@6.0.0: {}
+
+  fastify@5.12.5:
+    dependencies:
+      '@fastify/ajv-compiler': 4.0.6
+      '@fastify/error': 4.2.0
+      '@fastify/fast-json-stringify-compiler': 5.1.0
+      '@fastify/proxy-addr': 5.1.1
+      abstract-logging: 2.0.1
+      avvio: 9.3.0
+      fast-json-stringify: 7.0.1
+      find-my-way: 9.9.0
+      light-my-request: 6.6.0
+      pino: 10.4.0
+      process-warning: 5.1.0
+      rfdc: 1.4.1
+      secure-json-parse: 4.1.0
+      semver: 7.8.5
+      toad-cache: 3.7.4
+
+  fastq@1.20.3:
+    dependencies:
+      reusify: 1.1.0
+
+  find-my-way@9.9.0:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-querystring: 1.1.2
+      safe-regex2: 5.1.1
+
+  ipaddr.js@2.5.0: {}
+
+  json-schema-ref-resolver@3.0.0:
+    dependencies:
+      dequal: 2.0.3
+
+  json-schema-traverse@1.0.0: {}
+
+  light-my-request@6.6.0:
+    dependencies:
+      cookie: 1.1.1
+      process-warning: 4.0.1
+      set-cookie-parser: 2.7.2
+
+  on-exit-leak-free@2.1.2: {}
+
+  pg-cloudflare@1.4.1:
+    optional: true
+
+  pg-connection-string@2.14.1: {}
+
+  pg-int8@1.0.1: {}
+
+  pg-pool@3.14.0(pg@8.23.1):
+    dependencies:
+      pg: 8.23.1
+
+  pg-protocol@1.16.1: {}
+
+  pg-types@2.2.0:
+    dependencies:
+      pg-int8: 1.0.1
+      postgres-array: 2.0.0
+      postgres-bytea: 1.0.1
+      postgres-date: 1.0.7
+      postgres-interval: 1.2.0
+
+  pg@8.23.1:
+    dependencies:
+      pg-connection-string: 2.14.1
+      pg-pool: 3.14.0(pg@8.23.1)
+      pg-protocol: 1.16.1
+      pg-types: 2.2.0
+      pgpass: 1.0.5
+    optionalDependencies:
+      pg-cloudflare: 1.4.1
+
+  pgpass@1.0.5:
+    dependencies:
+      split2: 4.2.0
+
+  pino-abstract-transport@3.0.0:
+    dependencies:
+      split2: 4.2.0
+
+  pino-std-serializers@7.1.0: {}
+
+  pino@10.4.0:
+    dependencies:
+      '@pinojs/redact': 0.4.0
+      atomic-sleep: 1.0.0
+      on-exit-leak-free: 2.1.2
+      pino-abstract-transport: 3.0.0
+      pino-std-serializers: 7.1.0
+      process-warning: 5.1.0
+      quick-format-unescaped: 4.0.4
+      real-require: 1.0.0
+      safe-stable-stringify: 2.5.0
+      sonic-boom: 4.2.1
+      thread-stream: 4.2.0
+
+  postgres-array@2.0.0: {}
+
+  postgres-bytea@1.0.1: {}
+
+  postgres-date@1.0.7: {}
+
+  postgres-interval@1.2.0:
+    dependencies:
+      xtend: 4.0.2
+
+  process-warning@4.0.1: {}
+
+  process-warning@5.1.0: {}
+
+  quick-format-unescaped@4.0.4: {}
+
+  real-require@1.0.0: {}
+
+  require-from-string@2.0.2: {}
+
+  ret@0.5.0: {}
+
+  reusify@1.1.0: {}
+
+  rfdc@1.4.1: {}
+
+  safe-regex2@5.1.1:
+    dependencies:
+      ret: 0.5.0
+
+  safe-stable-stringify@2.5.0: {}
+
+  secure-json-parse@4.1.0: {}
+
+  semver@7.8.5: {}
+
+  set-cookie-parser@2.7.2: {}
+
+  sonic-boom@4.2.1:
+    dependencies:
+      atomic-sleep: 1.0.0
+
+  split2@4.2.0: {}
+
+  thread-stream@4.2.0:
+    dependencies:
+      real-require: 1.0.0
+
+  toad-cache@3.7.4: {}
+
+  xtend@4.0.2: {}
+
+  zod@3.25.76: {}
diff --git a/services/intake/sql/001_schema.sql b/services/intake/sql/001_schema.sql
new file mode 100644
index 0000000..0f99626
--- /dev/null
+++ b/services/intake/sql/001_schema.sql
@@ -0,0 +1,200 @@
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+CREATE TABLE IF NOT EXISTS contacts (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  full_name text NOT NULL,
+  phone text,
+  phone_normalized text,
+  email text,
+  email_normalized text,
+  location_label text,
+  lead_status text NOT NULL DEFAULT 'new'
+    CHECK (lead_status IN ('new','contacted','qualified','converted','inactive')),
+  next_follow_up_at timestamptz,
+  preferred_contact_method text NOT NULL DEFAULT 'phone'
+    CHECK (preferred_contact_method IN ('phone','sms','email')),
+  consent_to_contact boolean NOT NULL DEFAULT true,
+  source text NOT NULL DEFAULT 'website',
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CHECK (phone IS NOT NULL OR email IS NOT NULL)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS contacts_email_normalized_unique
+  ON contacts(email_normalized) WHERE email_normalized IS NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS contacts_phone_normalized_unique
+  ON contacts(phone_normalized) WHERE phone_normalized IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS projects (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_number bigint GENERATED ALWAYS AS IDENTITY UNIQUE,
+  contact_id uuid NOT NULL REFERENCES contacts(id),
+  name text NOT NULL,
+  summary text,
+  status text NOT NULL DEFAULT 'planned'
+    CHECK (status IN ('planned','scheduled','in_progress','blocked','completed','cancelled')),
+  priority text NOT NULL DEFAULT 'normal'
+    CHECK (priority IN ('low','normal','high','urgent')),
+  start_date date,
+  target_date date,
+  completed_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS service_tickets (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  ticket_number bigint GENERATED ALWAYS AS IDENTITY UNIQUE,
+  contact_id uuid NOT NULL REFERENCES contacts(id),
+  project_id uuid REFERENCES projects(id),
+  issue_category text NOT NULL,
+  request_type text NOT NULL DEFAULT 'website_request',
+  device_type text,
+  service_mode text NOT NULL DEFAULT 'undecided'
+    CHECK (service_mode IN ('onsite','remote','undecided')),
+  status text NOT NULL DEFAULT 'new'
+    CHECK (status IN ('new','triaged','scheduled','in_progress','waiting_client','resolved','closed','cancelled')),
+  priority text NOT NULL DEFAULT 'normal'
+    CHECK (priority IN ('low','normal','high','urgent')),
+  location_label text,
+  requested_window text,
+  public_description text NOT NULL,
+  source_page text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS client_assets (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  contact_id uuid NOT NULL REFERENCES contacts(id),
+  asset_type text NOT NULL,
+  make text,
+  model text,
+  serial_or_service_id text,
+  installed_at date,
+  location_label text,
+  specs jsonb NOT NULL DEFAULT '{}'::jsonb,
+  operational_notes text,
+  credential_reference text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS service_events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  ticket_id uuid REFERENCES service_tickets(id),
+  project_id uuid REFERENCES projects(id),
+  contact_id uuid NOT NULL REFERENCES contacts(id),
+  event_type text NOT NULL CHECK (event_type IN ('note','status_change','visit','call','remote_session','work_log','intake')),
+  body text NOT NULL,
+  visibility text NOT NULL DEFAULT 'internal' CHECK (visibility IN ('internal','client_shareable')),
+  created_by text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS intake_submissions (
+  idempotency_key text PRIMARY KEY,
+  ticket_id uuid REFERENCES service_tickets(id),
+  received_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS tickets_status_priority_created ON service_tickets(status, priority, created_at DESC);
+CREATE INDEX IF NOT EXISTS tickets_contact_created ON service_tickets(contact_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS tickets_project_created ON service_tickets(project_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS projects_status_target ON projects(status, target_date);
+CREATE INDEX IF NOT EXISTS projects_contact ON projects(contact_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS assets_contact ON client_assets(contact_id);
+CREATE INDEX IF NOT EXISTS events_ticket_created ON service_events(ticket_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS events_project_created ON service_events(project_id, created_at DESC);
+
+CREATE OR REPLACE FUNCTION touch_updated_at() RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  NEW.updated_at = now();
+  RETURN NEW;
+END;
+$$;
+DROP TRIGGER IF EXISTS contacts_touch_updated_at ON contacts;
+CREATE TRIGGER contacts_touch_updated_at BEFORE UPDATE ON contacts
+  FOR EACH ROW EXECUTE FUNCTION touch_updated_at();
+DROP TRIGGER IF EXISTS tickets_touch_updated_at ON service_tickets;
+CREATE TRIGGER tickets_touch_updated_at BEFORE UPDATE ON service_tickets
+  FOR EACH ROW EXECUTE FUNCTION touch_updated_at();
+DROP TRIGGER IF EXISTS projects_touch_updated_at ON projects;
+CREATE TRIGGER projects_touch_updated_at BEFORE UPDATE ON projects
+  FOR EACH ROW EXECUTE FUNCTION touch_updated_at();
+DROP TRIGGER IF EXISTS assets_touch_updated_at ON client_assets;
+CREATE TRIGGER assets_touch_updated_at BEFORE UPDATE ON client_assets
+  FOR EACH ROW EXECUTE FUNCTION touch_updated_at();
+
+CREATE OR REPLACE FUNCTION create_public_intake(
+  p_idempotency_key text,
+  p_full_name text,
+  p_phone text,
+  p_email text,
+  p_phone_normalized text,
+  p_email_normalized text,
+  p_location text,
+  p_preferred_contact text,
+  p_issue_category text,
+  p_device_type text,
+  p_service_mode text,
+  p_requested_window text,
+  p_description text,
+  p_request_type text,
+  p_source_page text
+) RETURNS uuid
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $$
+DECLARE
+  v_contact_id uuid;
+  v_ticket_id uuid;
+  v_inserted_key text;
+BEGIN
+  INSERT INTO intake_submissions(idempotency_key)
+    VALUES (p_idempotency_key)
+    ON CONFLICT (idempotency_key) DO NOTHING
+    RETURNING idempotency_key INTO v_inserted_key;
+
+  IF v_inserted_key IS NULL THEN
+    SELECT ticket_id INTO v_ticket_id FROM intake_submissions WHERE idempotency_key = p_idempotency_key;
+    RETURN v_ticket_id;
+  END IF;
+
+  IF p_email_normalized IS NOT NULL THEN
+    INSERT INTO contacts(full_name, phone, phone_normalized, email, email_normalized, location_label,
+                         preferred_contact_method, consent_to_contact, source)
+      VALUES (p_full_name, NULLIF(p_phone, ''), p_phone_normalized, NULLIF(p_email, ''), p_email_normalized,
+              NULLIF(p_location, ''), p_preferred_contact, true, 'website')
+      ON CONFLICT (email_normalized) WHERE email_normalized IS NOT NULL
+      DO UPDATE SET updated_at = now()
+      RETURNING id INTO v_contact_id;
+  ELSIF p_phone_normalized IS NOT NULL THEN
+    INSERT INTO contacts(full_name, phone, phone_normalized, email, email_normalized, location_label,
+                         preferred_contact_method, consent_to_contact, source)
+      VALUES (p_full_name, NULLIF(p_phone, ''), p_phone_normalized, NULLIF(p_email, ''), NULL,
+              NULLIF(p_location, ''), p_preferred_contact, true, 'website')
+      ON CONFLICT (phone_normalized) WHERE phone_normalized IS NOT NULL
+      DO UPDATE SET updated_at = now()
+      RETURNING id INTO v_contact_id;
+  ELSE
+    RAISE EXCEPTION 'contact method required';
+  END IF;
+
+  INSERT INTO service_tickets(contact_id, issue_category, request_type, device_type, service_mode, location_label,
+                              requested_window, public_description, source_page)
+    VALUES (v_contact_id, p_issue_category, p_request_type, NULLIF(p_device_type, ''), p_service_mode,
+            NULLIF(p_location, ''), NULLIF(p_requested_window, ''), p_description, NULLIF(p_source_page, ''))
+    RETURNING id INTO v_ticket_id;
+
+  INSERT INTO service_events(ticket_id, contact_id, event_type, body, visibility, created_by)
+    VALUES (v_ticket_id, v_contact_id, 'intake', 'Public website service request received.', 'internal', 'website-intake');
+
+  UPDATE intake_submissions SET ticket_id = v_ticket_id WHERE idempotency_key = p_idempotency_key;
+  RETURN v_ticket_id;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION create_public_intake(text,text,text,text,text,text,text,text,text,text,text,text,text,text,text) FROM PUBLIC;
diff --git a/services/intake/sql/002_crm_extensions.sql b/services/intake/sql/002_crm_extensions.sql
new file mode 100644
index 0000000..0600a16
--- /dev/null
+++ b/services/intake/sql/002_crm_extensions.sql
@@ -0,0 +1,72 @@
+BEGIN;
+
+ALTER TABLE contacts
+  ADD COLUMN IF NOT EXISTS lead_status text NOT NULL DEFAULT 'new',
+  ADD COLUMN IF NOT EXISTS next_follow_up_at timestamptz;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'contacts_lead_status_check'
+      AND conrelid = 'contacts'::regclass
+  ) THEN
+    ALTER TABLE contacts ADD CONSTRAINT contacts_lead_status_check
+      CHECK (lead_status IN ('new','contacted','qualified','converted','inactive'));
+  END IF;
+END;
+$$;
+
+CREATE TABLE IF NOT EXISTS projects (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_number bigint GENERATED ALWAYS AS IDENTITY UNIQUE,
+  contact_id uuid NOT NULL REFERENCES contacts(id),
+  name text NOT NULL,
+  summary text,
+  status text NOT NULL DEFAULT 'planned'
+    CHECK (status IN ('planned','scheduled','in_progress','blocked','completed','cancelled')),
+  priority text NOT NULL DEFAULT 'normal'
+    CHECK (priority IN ('low','normal','high','urgent')),
+  start_date date,
+  target_date date,
+  completed_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+ALTER TABLE service_tickets ADD COLUMN IF NOT EXISTS project_id uuid;
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'service_tickets_project_id_fkey'
+      AND conrelid = 'service_tickets'::regclass
+  ) THEN
+    ALTER TABLE service_tickets ADD CONSTRAINT service_tickets_project_id_fkey
+      FOREIGN KEY (project_id) REFERENCES projects(id);
+  END IF;
+END;
+$$;
+
+ALTER TABLE service_events ADD COLUMN IF NOT EXISTS project_id uuid;
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'service_events_project_id_fkey'
+      AND conrelid = 'service_events'::regclass
+  ) THEN
+    ALTER TABLE service_events ADD CONSTRAINT service_events_project_id_fkey
+      FOREIGN KEY (project_id) REFERENCES projects(id);
+  END IF;
+END;
+$$;
+
+CREATE INDEX IF NOT EXISTS contacts_lead_follow_up ON contacts(lead_status, next_follow_up_at);
+CREATE INDEX IF NOT EXISTS tickets_project_created ON service_tickets(project_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS projects_status_target ON projects(status, target_date);
+CREATE INDEX IF NOT EXISTS projects_contact ON projects(contact_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS events_project_created ON service_events(project_id, created_at DESC);
+
+DROP TRIGGER IF EXISTS projects_touch_updated_at ON projects;
+CREATE TRIGGER projects_touch_updated_at BEFORE UPDATE ON projects
+  FOR EACH ROW EXECUTE FUNCTION touch_updated_at();
+
+COMMIT;
diff --git a/services/intake/sql/020-create-api-role.sh b/services/intake/sql/020-create-api-role.sh
new file mode 100644
index 0000000..b7ccb66
--- /dev/null
+++ b/services/intake/sql/020-create-api-role.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+set -eu
+: "${INTAKE_DB_PASSWORD:?INTAKE_DB_PASSWORD must be set for initial database creation}"
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
+  -v intake_password="$INTAKE_DB_PASSWORD" <<'SQL'
+CREATE ROLE intake_api LOGIN PASSWORD :'intake_password' NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT;
+REVOKE CREATE ON SCHEMA public FROM PUBLIC;
+GRANT USAGE ON SCHEMA public TO intake_api;
+GRANT EXECUTE ON FUNCTION create_public_intake(text,text,text,text,text,text,text,text,text,text,text,text,text,text,text) TO intake_api;
+SQL
diff --git a/services/intake/src/server.mjs b/services/intake/src/server.mjs
new file mode 100644
index 0000000..2f92e04
--- /dev/null
+++ b/services/intake/src/server.mjs
@@ -0,0 +1,130 @@
+import Fastify from 'fastify';
+import cors from '@fastify/cors';
+import rateLimit from '@fastify/rate-limit';
+import pg from 'pg';
+import { z } from 'zod';
+
+const { Pool } = pg;
+const origins = (process.env.ALLOWED_ORIGINS || 'https://ohgeec.com,https://www.ohgeec.com')
+  .split(',').map((origin) => origin.trim()).filter(Boolean);
+const pool = new Pool({
+  host: process.env.DB_HOST || 'postgres',
+  port: Number(process.env.DB_PORT || 5432),
+  database: process.env.DB_NAME || 'ohgeec',
+  user: process.env.DB_USER || 'intake_api',
+  password: process.env.DB_PASSWORD,
+  max: 5,
+  idleTimeoutMillis: 10_000,
+});
+const app = Fastify({
+  logger: false,
+  bodyLimit: 16 * 1024,
+  trustProxy: false,
+});
+
+const optionalText = (max) => z.string().trim().max(max).optional().default('');
+const intakeSchema = z.object({
+  name: z.string().trim().min(1).max(120),
+  phone: optionalText(32),
+  email: z.union([z.string().trim().email().max(254), z.literal('')]).optional().default(''),
+  location: optionalText(120),
+  preferredContact: z.enum(['phone', 'sms', 'email']),
+  requestType: z.string().trim().min(1).max(80).regex(/^[a-z0-9_-]+$/i),
+  deviceType: optionalText(120),
+  serviceMode: z.enum(['onsite', 'remote', 'undecided']),
+  service: z.enum(['virus_malware','setup_optimization','data_recovery','software_help','network_wifi','starlink_setup','tutoring','other']),
+  description: z.string().trim().min(3).max(2000),
+  requestedDate: z.union([z.string().regex(/^\d{4}-\d{2}-\d{2}$/), z.literal('')]).optional().default(''),
+  requestedTime: z.union([z.string().regex(/^\d{2}:\d{2}$/), z.literal('')]).optional().default(''),
+  sourcePage: z.string().trim().max(240).regex(/^\/(?!\/)[^\r\n]*$/),
+  consentToContact: z.literal(true),
+  website: optionalText(200),
+}).strict();
+
+const normPhone = (value) => {
+  const digits = value.replace(/\D/g, '');
+  if (!digits.length) return null;
+  if (digits.length === 10) return `+1${digits}`;
+  if (digits.length === 11 && digits.startsWith('1')) return `+${digits}`;
+  return `+${digits}`;
+};
+const normEmail = (value) => value ? value.trim().toLowerCase() : null;
+const accepted = async (_request, reply) => reply.code(202).send({ accepted: true });
+
+await app.register(cors, {
+  origin: (origin, callback) => callback(null, !origin || origins.includes(origin)),
+  methods: ['POST', 'OPTIONS'],
+  allowedHeaders: ['Content-Type', 'Idempotency-Key'],
+  maxAge: 600,
+});
+await app.register(rateLimit, {
+  max: 12,
+  timeWindow: '10 minutes',
+  keyGenerator: (request) => request.headers['cf-connecting-ip'] || request.ip,
+  errorResponseBuilder: () => ({ error: 'Please wait before trying again.' }),
+});
+
+app.get('/healthz', { config: { rateLimit: false } }, async (_request, reply) => {
+  try {
+    await pool.query('SELECT 1');
+    return reply.send({ ok: true });
+  } catch {
+    return reply.code(503).send({ ok: false });
+  }
+});
+
+app.post('/v1/intake', async (request, reply) => {
+  if (process.env.PUBLIC_INTAKE_ENABLED !== 'true') {
+    return reply.code(503).send({ error: 'Online requests are temporarily unavailable. Please email hello@ohgeec.com.' });
+  }
+  const key = request.headers['idempotency-key'];
+  if (typeof key !== 'string' || !/^[a-zA-Z0-9_-]{16,100}$/.test(key)) {
+    return reply.code(400).send({ error: 'Request could not be accepted.' });
+  }
+  const parsed = intakeSchema.safeParse(request.body);
+  if (!parsed.success) return reply.code(400).send({ error: 'Please check the request fields and try again.' });
+  const form = parsed.data;
+  if (form.website) return accepted(request, reply);
+  if (form.serviceMode === 'onsite' && !form.location) {
+    return reply.code(400).send({ error: 'Please add your Montana town or county for an on-site request.' });
+  }
+  if (form.preferredContact === 'email' && !form.email) {
+    return reply.code(400).send({ error: 'Please add the preferred contact detail.' });
+  }
+  if (form.preferredContact !== 'email' && !form.phone) {
+    return reply.code(400).send({ error: 'Please add the preferred contact detail.' });
+  }
+
+  const requestedWindow = [form.requestedDate, form.requestedTime].filter(Boolean).join(' ');
+  try {
+    await pool.query(
+      'SELECT create_public_intake($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)',
+      [key, form.name, form.phone, form.email, normPhone(form.phone), normEmail(form.email), form.location,
+       form.preferredContact, form.service, form.deviceType, form.serviceMode, requestedWindow,
+       form.description, form.requestType, form.sourcePage],
+    );
+    return reply.code(202).send({ accepted: true });
+  } catch {
+    // Do not log customer payloads or database error details.
+    return reply.code(503).send({ error: 'Request could not be saved right now. Please try again later.' });
+  }
+});
+
+app.setNotFoundHandler((_request, reply) => reply.code(404).send({ error: 'Not found.' }));
+app.setErrorHandler((error, _request, reply) => {
+  const status = Number.isInteger(error.statusCode) && error.statusCode >= 400 && error.statusCode < 500
+    ? error.statusCode : 400;
+  const message = status === 429 ? 'Please wait before trying again.' : 'Request could not be accepted.';
+  return reply.code(status).send({ error: message });
+});
+
+const port = Number(process.env.PORT || 3000);
+await app.listen({ host: '0.0.0.0', port });
+
+const shutdown = async () => {
+  await app.close();
+  await pool.end();
+  process.exit(0);
+};
+process.on('SIGTERM', shutdown);
+process.on('SIGINT', shutdown);
diff --git a/sitemap.xml b/sitemap.xml
index cce3e7b..abf7fc6 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -96,6 +96,12 @@
     <changefreq>monthly</changefreq>
     <priority>0.8</priority>
   </url>
+  <url>
+    <loc>https://ohgeec.com/tech-support/onsite-montana/</loc>
+    <lastmod>2026-10-04</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.7</priority>
+  </url>
   <url>
     <loc>https://ohgeec.com/book.html</loc>
     <lastmod>2026-10-04</lastmod>
diff --git a/tech-support/connectivity/boost-wifi-signal-large-home-outbuildings/index.html b/tech-support/connectivity/boost-wifi-signal-large-home-outbuildings/index.html
index fca2d9c..2e1ff3a 100644
--- a/tech-support/connectivity/boost-wifi-signal-large-home-outbuildings/index.html
+++ b/tech-support/connectivity/boost-wifi-signal-large-home-outbuildings/index.html
@@ -204,16 +204,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>Log into the router and separate the 2.4 GHz and 5 GHz network names so you can choose. 2.4 GHz reaches further; 5 GHz is faster but shorter.</li><li>Change the Wi-Fi channel to 1, 6, or 11 on 2.4 GHz if neighbours' networks are crowding you.</li><li>Add a mesh system for one building — a set of two or three units is far better than a single booster.</li><li>Use a point-to-point wireless bridge for a separate outbuilding. This is the correct tool for a shop or barn 50 feet or more away, and it is not the same thing as a Wi-Fi booster.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/tech-support/onsite-montana/?requestType=boost-wifi-signal-large-home-outbuildings&amp;sourcePage=%2Ftech-support%2Fconnectivity%2Fboost-wifi-signal-large-home-outbuildings%2F">Request an on-site visit &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/tech-support/onsite-montana/?requestType=boost-wifi-signal-large-home-outbuildings&amp;sourcePage=%2Ftech-support%2Fconnectivity%2Fboost-wifi-signal-large-home-outbuildings%2F" rel="noopener">Request an on-site visit &rarr;</a>
+  <p class="fine rv">ON-SITE SERVICE IN MONTANA</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -267,11 +267,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/connectivity/fix-no-service-sos-mode-rural-montana/index.html b/tech-support/connectivity/fix-no-service-sos-mode-rural-montana/index.html
index 6763f93..1f56443 100644
--- a/tech-support/connectivity/fix-no-service-sos-mode-rural-montana/index.html
+++ b/tech-support/connectivity/fix-no-service-sos-mode-rural-montana/index.html
@@ -217,16 +217,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>Reset Network Settings (iPhone: Settings &gt; General &gt; Transfer or Reset iPhone &gt; Reset &gt; Reset Network Settings; Android: Settings &gt; System &gt; Reset &gt; Reset Wi-Fi, mobile and Bluetooth). This forgets saved Wi-Fi passwords, so have them handy.</li><li>Power the phone off, remove the SIM tray with the pin tool, reseat the card, and power back on. Skip this if your phone uses an eSIM.</li><li>Move the SIM into another phone to prove whether the trouble is the phone or the network.</li><li>Ask a neighbour on the same carrier whether their phone is working right now.</li><li>Check your carrier coverage map and report the dead zone so it is on record.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/tech-support/onsite-montana/?requestType=fix-no-service-sos-mode-rural-montana&amp;sourcePage=%2Ftech-support%2Fconnectivity%2Ffix-no-service-sos-mode-rural-montana%2F">Request an on-site visit &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/tech-support/onsite-montana/?requestType=fix-no-service-sos-mode-rural-montana&amp;sourcePage=%2Ftech-support%2Fconnectivity%2Ffix-no-service-sos-mode-rural-montana%2F" rel="noopener">Request an on-site visit &rarr;</a>
+  <p class="fine rv">ON-SITE SERVICE IN MONTANA</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -280,11 +280,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/connectivity/index.html b/tech-support/connectivity/index.html
index 83d530d..c0c496b 100644
--- a/tech-support/connectivity/index.html
+++ b/tech-support/connectivity/index.html
@@ -121,11 +121,30 @@ <h2 class="rv">Prefer to just <em>have it fixed?</em></h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/connectivity/satellite-internet-slow-starlink-hughesnet/index.html b/tech-support/connectivity/satellite-internet-slow-starlink-hughesnet/index.html
index b181bd5..62d9cf4 100644
--- a/tech-support/connectivity/satellite-internet-slow-starlink-hughesnet/index.html
+++ b/tech-support/connectivity/satellite-internet-slow-starlink-hughesnet/index.html
@@ -207,16 +207,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>Power-cycle the dish: unplug it at the wall for a full 60 seconds, then plug it back in and let it re-acquire (up to 15 minutes).</li><li>Move the router away from the dish's power supply and away from microwaves and cordless phone bases.</li><li>Run an ethernet cable from the router straight to one device to prove whether the slowdown is Wi-Fi or the satellite link itself.</li><li>Contact support with your speed test history and the exact times the slowdown happens — evenings and storms are normal and worth documenting.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/tech-support/onsite-montana/?requestType=satellite-internet-slow-starlink-hughesnet&amp;sourcePage=%2Ftech-support%2Fconnectivity%2Fsatellite-internet-slow-starlink-hughesnet%2F">Request on-site Starlink setup &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/tech-support/onsite-montana/?requestType=satellite-internet-slow-starlink-hughesnet&amp;sourcePage=%2Ftech-support%2Fconnectivity%2Fsatellite-internet-slow-starlink-hughesnet%2F" rel="noopener">Request on-site Starlink setup &rarr;</a>
+  <p class="fine rv">ON-SITE SERVICE IN MONTANA</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -270,11 +270,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/hardware/fix-printer-offline-wireless-setup/index.html b/tech-support/hardware/fix-printer-offline-wireless-setup/index.html
index be9eda8..3001fcb 100644
--- a/tech-support/hardware/fix-printer-offline-wireless-setup/index.html
+++ b/tech-support/hardware/fix-printer-offline-wireless-setup/index.html
@@ -209,16 +209,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>Give the printer a fixed address. In the router settings, reserve an IP address for the printer so it stops changing.</li><li>Remove the printer from your computer and add it again by its address rather than by name.</li><li>Connect by USB once to confirm the printer works at all, then return to Wi-Fi.</li><li>Update the printer firmware from the printer's own menu or the manufacturer's app.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/tech-support/onsite-montana/?requestType=fix-printer-offline-wireless-setup&amp;sourcePage=%2Ftech-support%2Fhardware%2Ffix-printer-offline-wireless-setup%2F">Request an on-site visit &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/tech-support/onsite-montana/?requestType=fix-printer-offline-wireless-setup&amp;sourcePage=%2Ftech-support%2Fhardware%2Ffix-printer-offline-wireless-setup%2F" rel="noopener">Request an on-site visit &rarr;</a>
+  <p class="fine rv">ON-SITE SERVICE IN MONTANA</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -272,11 +272,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/hardware/index.html b/tech-support/hardware/index.html
index c9ce259..f2692b2 100644
--- a/tech-support/hardware/index.html
+++ b/tech-support/hardware/index.html
@@ -111,11 +111,30 @@ <h2 class="rv">Prefer to just <em>have it fixed?</em></h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/hardware/smart-tv-streaming-weak-wifi/index.html b/tech-support/hardware/smart-tv-streaming-weak-wifi/index.html
index ba30aef..0b2bad7 100644
--- a/tech-support/hardware/smart-tv-streaming-weak-wifi/index.html
+++ b/tech-support/hardware/smart-tv-streaming-weak-wifi/index.html
@@ -202,16 +202,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>Switch the TV to the 2.4 GHz network if it is far from the router — it reaches further even though it is slower.</li><li>Move the router higher and out of a cupboard, closer to the TV wall.</li><li>Move the streaming stick out of a metal TV cabinet or away from the back of the TV with a short extension cable.</li><li>Run an ethernet cable to the TV. If the TV has no port, use a powerline adapter or a Wi-Fi extender with an ethernet port, and plug the TV into that.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/tech-support/onsite-montana/?requestType=smart-tv-streaming-weak-wifi&amp;sourcePage=%2Ftech-support%2Fhardware%2Fsmart-tv-streaming-weak-wifi%2F">Request an on-site visit &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/tech-support/onsite-montana/?requestType=smart-tv-streaming-weak-wifi&amp;sourcePage=%2Ftech-support%2Fhardware%2Fsmart-tv-streaming-weak-wifi%2F" rel="noopener">Request an on-site visit &rarr;</a>
+  <p class="fine rv">ON-SITE SERVICE IN MONTANA</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -265,11 +265,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/index.html b/tech-support/index.html
index e028850..dc94414 100644
--- a/tech-support/index.html
+++ b/tech-support/index.html
@@ -205,11 +205,30 @@ <h2 class="rv">Something broken? <em>Let us fix it.</em></h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/onsite-montana/index.html b/tech-support/onsite-montana/index.html
new file mode 100644
index 0000000..9a94676
--- /dev/null
+++ b/tech-support/onsite-montana/index.html
@@ -0,0 +1,138 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+<title>On-site tech support in Montana — ohgeeceee</title>
+<meta name="description" content="On-site help with Starlink, Wi-Fi, computers, printers, and connected devices across Montana. Request a visit and share only the details needed to plan it." />
+<meta name="robots" content="index,follow" />
+<meta name="theme-color" content="#FAF7F2" />
+<link rel="canonical" href="https://ohgeec.com/tech-support/onsite-montana/" />
+
+<meta property="og:type" content="website" />
+<meta property="og:site_name" content="the ohgeeceee network" />
+<meta property="og:title" content="On-site tech support in Montana — ohgeeceee" />
+<meta property="og:description" content="On-site help with Starlink, Wi-Fi, computers, printers, and connected devices across Montana. Request a visit and share only the details needed to plan it." />
+<meta property="og:url" content="https://ohgeec.com/tech-support/onsite-montana/" />
+<meta property="og:image" content="https://ohgeec.com/og-image.png" />
+<meta property="og:image:width" content="1200" />
+<meta property="og:image:height" content="630" />
+<meta name="twitter:card" content="summary_large_image" />
+<meta name="twitter:title" content="On-site tech support in Montana — ohgeeceee" />
+<meta name="twitter:description" content="On-site help with Starlink, Wi-Fi, computers, printers, and connected devices across Montana. Request a visit and share only the details needed to plan it." />
+<meta name="twitter:image" content="https://ohgeec.com/og-image.png" />
+
+<link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Crect width='24' height='24' rx='5' fill='%23FAF7F2'/%3E%3Ccircle cx='12' cy='5' r='2.4' fill='%2314110E'/%3E%3Ccircle cx='5' cy='17' r='2.4' fill='%2314110E'/%3E%3Ccircle cx='19' cy='17' r='2.4' fill='%2314110E'/%3E%3Cpath d='M12 6.6 5.6 15.4M12 6.6l6.4 8.8M6.6 17.6h10.8' stroke='%2314110E' stroke-width='1.3' stroke-linecap='round' fill='none'/%3E%3C/svg%3E" />
+<link rel="apple-touch-icon" href="/apple-touch-icon.png" />
+
+<link rel="preload" href="/fonts/fraunces-var.woff2" as="font" type="font/woff2" crossorigin />
+<link rel="preload" href="/fonts/inter-var.woff2" as="font" type="font/woff2" crossorigin />
+<link rel="stylesheet" href="/fonts.css" />
+<link rel="stylesheet" href="/tech-support/tech-support.css" />
+<script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "Service",
+  "name": "On-site home technology support in Montana",
+  "provider": {
+    "@type": "Person",
+    "name": "ohgeeceee",
+    "url": "https://ohgeec.com/"
+  },
+  "areaServed": {
+    "@type": "State",
+    "name": "Montana"
+  },
+  "serviceType": "Home technology setup and troubleshooting",
+  "url": "https://ohgeec.com/tech-support/onsite-montana/"
+}
+</script>
+</head>
+<body>
+<header class="topbar">
+  <a class="brand" href="/">
+    <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
+      <circle cx="12" cy="5" r="2.4" fill="#14110E"/><circle cx="5" cy="17" r="2.4" fill="#14110E"/><circle cx="19" cy="17" r="2.4" fill="#14110E"/>
+      <path d="M12 6.6 5.6 15.4M12 6.6l6.4 8.8M6.6 17.6h10.8" stroke="#14110E" stroke-width="1.3" stroke-linecap="round"/>
+    </svg>
+    <b>ohgeeceee</b>
+  </a>
+  <span class="coords">Remote &mdash; anywhere in the US</span>
+  <nav>
+    <a href="/#work">Index</a>
+    <a href="/#about">About</a>
+    <a href="/tech-support/" class="current" aria-current="page">Tech help</a>
+    <a href="/support.html" class="nav-support">Support</a>
+  </nav>
+</header>
+<main>
+  <div class="wrap wrap--narrow">
+    <nav class="crumb" aria-label="Breadcrumb"><ol><li><a href="/">Home</a></li><li><a href="/tech-support/">Tech Support</a></li><li><span aria-current="page">On-site help in Montana</span></li></ol></nav>
+    <p class="kicker rv">MONTANA · HOME TECH SUPPORT</p>
+    <h1 class="rv">The tech at home, sorted.</h1>
+    <p class="lede rv">On-site help for rural homes, small businesses, and the places where a reliable connection matters. Tell me what is happening and where you are; we will confirm availability before scheduling.</p>
+    <section class="prereq rv">
+      <h2>What I can help with</h2>
+      <ul>
+        <li>Starlink setup, dish placement, and Wi-Fi coverage</li>
+        <li>Wi-Fi dead zones, router setup, and connected devices</li>
+        <li>Computer, printer, smart TV, and home network troubleshooting</li>
+      </ul>
+      <p class="dont">No account passwords or Wi-Fi passwords in the request form. We can arrange a safe way to share access if a visit requires it.</p>
+    </section>
+    <section class="cta" id="request">
+      <h2>Request an on-site visit</h2>
+      <p>Share your Montana town or county, a short description, and a preferred time. Exact address and access details can wait until the visit is confirmed.</p>
+      <a class="btn" id="onsite-request-link" href="/book.html?mode=onsite">Request an on-site visit &rarr;</a>
+      <p class="fine">MONTANA ON-SITE SERVICE · REQUESTS ARE CONFIRMED BEFORE A VISIT IS BOOKED</p>
+    </section>
+    <p>If remote help is a better fit, <a href="/book.html?mode=remote">request a remote session</a>. For urgent issues, call or text after we confirm your request.</p>
+  </div>
+</main>
+<footer class="site">
+  <span>ohgeeceee &mdash; plain-language tech guides, built on the same philosophy as <a href="https://finally.help" rel="noopener">finally.help</a></span>
+  <span>46.8797&deg; N, 110.3626&deg; W</span>
+  <span>&copy; <span id="yr">2026</span> the ohgeeceee network &mdash; <a href="/">&larr; Back to the network</a></span>
+</footer>
+<script>
+  const incoming = new URLSearchParams(location.search);
+  const booking = new URL('/book.html', location.origin);
+  booking.searchParams.set('mode', 'onsite');
+  booking.searchParams.set('requestType', incoming.get('requestType') || 'onsite_support');
+  booking.searchParams.set('sourcePage', incoming.get('sourcePage') || location.pathname);
+  document.getElementById('onsite-request-link').href = booking.pathname + booking.search;
+</script>
+<script>
+(function () {
+  "use strict";
+  var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
+  var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
+  var els = document.querySelectorAll(".rv");
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
+})();
+</script>
+</body>
+</html>
diff --git a/tech-support/security/index.html b/tech-support/security/index.html
index a9a54e7..6330a8b 100644
--- a/tech-support/security/index.html
+++ b/tech-support/security/index.html
@@ -111,11 +111,30 @@ <h2 class="rv">Prefer to just <em>have it fixed?</em></h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/security/password-recovery-password-managers-2fa/index.html b/tech-support/security/password-recovery-password-managers-2fa/index.html
index fac4dd1..1a596c2 100644
--- a/tech-support/security/password-recovery-password-managers-2fa/index.html
+++ b/tech-support/security/password-recovery-password-managers-2fa/index.html
@@ -224,16 +224,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>If the reset email never arrives, check the spam and junk folders, and search your inbox for the account name.</li><li>If the account uses a phone number you no longer have, use the account's account-recovery form rather than the normal reset.</li><li>If you are locked out of your email itself, call the provider's support line — email is the master key, so it is worth the phone call.</li><li>If you believe the account was taken over, change the email password first, then everything else, then check the account's forwarding and recovery settings for anything you did not add.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html?requestType=password-recovery-password-managers-2fa&amp;sourcePage=%2Ftech-support%2Fsecurity%2Fpassword-recovery-password-managers-2fa%2F">Book a remote session &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/book.html?requestType=password-recovery-password-managers-2fa&amp;sourcePage=%2Ftech-support%2Fsecurity%2Fpassword-recovery-password-managers-2fa%2F" rel="noopener">Book a remote session &rarr;</a>
+  <p class="fine rv">REMOTE SUPPORT AVAILABLE</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -288,11 +288,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/security/spot-avoid-phishing-text-scams-robocalls/index.html b/tech-support/security/spot-avoid-phishing-text-scams-robocalls/index.html
index 631693b..ddc90b5 100644
--- a/tech-support/security/spot-avoid-phishing-text-scams-robocalls/index.html
+++ b/tech-support/security/spot-avoid-phishing-text-scams-robocalls/index.html
@@ -202,16 +202,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>If you already gave out a password, change it immediately and turn on two-factor — start with email.</li><li>If you gave card details, call the number on the back of the card and ask them to freeze it.</li><li>If you installed something they told you to install, remove it and run a malware scan.</li><li>Report the message: forward spam texts to 7726 (SPAM), and report calls and emails to the FTC at ReportFraud.ftc.gov.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/tech-support/onsite-montana/?requestType=spot-avoid-phishing-text-scams-robocalls&amp;sourcePage=%2Ftech-support%2Fsecurity%2Fspot-avoid-phishing-text-scams-robocalls%2F#request">Get a free 10-minute call &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/tech-support/onsite-montana/?requestType=spot-avoid-phishing-text-scams-robocalls&amp;sourcePage=%2Ftech-support%2Fsecurity%2Fspot-avoid-phishing-text-scams-robocalls%2F#request" rel="noopener">Get a free 10-minute call &rarr;</a>
+  <p class="fine rv">REMOTE SUPPORT AVAILABLE</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -265,11 +265,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/software/clear-cache-cookies-popups/index.html b/tech-support/software/clear-cache-cookies-popups/index.html
index 70f86ec..be7b1ba 100644
--- a/tech-support/software/clear-cache-cookies-popups/index.html
+++ b/tech-support/software/clear-cache-cookies-popups/index.html
@@ -205,16 +205,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>Turn on the browser's pop-up blocker (Chrome: Settings &gt; Privacy and security &gt; Site settings &gt; Pop-ups and redirects).</li><li>Remove suspicious extensions: Settings &gt; Extensions. Anything you do not recognise, turn off.</li><li>Reset the browser's settings to default as a last resort — this keeps bookmarks but clears the rest.</li><li>If pop-ups appear even with the browser closed, run a malware scan. That is not a browser problem.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html?requestType=clear-cache-cookies-popups&amp;sourcePage=%2Ftech-support%2Fsoftware%2Fclear-cache-cookies-popups%2F">Book a remote session &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/book.html?requestType=clear-cache-cookies-popups&amp;sourcePage=%2Ftech-support%2Fsoftware%2Fclear-cache-cookies-popups%2F" rel="noopener">Book a remote session &rarr;</a>
+  <p class="fine rv">REMOTE SUPPORT AVAILABLE</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -268,11 +268,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/software/index.html b/tech-support/software/index.html
index 8b0b44b..f78d8a9 100644
--- a/tech-support/software/index.html
+++ b/tech-support/software/index.html
@@ -121,11 +121,30 @@ <h2 class="rv">Prefer to just <em>have it fixed?</em></h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/software/speed-up-slow-computer/index.html b/tech-support/software/speed-up-slow-computer/index.html
index a64daee..87be6bc 100644
--- a/tech-support/software/speed-up-slow-computer/index.html
+++ b/tech-support/software/speed-up-slow-computer/index.html
@@ -211,16 +211,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>Check the drive type. If the computer still has a spinning hard disk rather than an SSD, replacing it with an SSD is the single biggest speed upgrade available and is often cheaper than a new machine.</li><li>Run a full malware scan with the built-in tool (Windows Security or a reputable scanner). Adware is a very common cause of a slow machine.</li><li>Check for a failing drive: run the manufacturer's health tool. A drive that is dying makes everything slow and is worth catching early.</li><li>If it is a work machine or over five years old, weigh the cost of an SSD and more memory against a replacement.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html?requestType=speed-up-slow-computer&amp;sourcePage=%2Ftech-support%2Fsoftware%2Fspeed-up-slow-computer%2F">Book a remote session &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/book.html?requestType=speed-up-slow-computer&amp;sourcePage=%2Ftech-support%2Fsoftware%2Fspeed-up-slow-computer%2F" rel="noopener">Book a remote session &rarr;</a>
+  <p class="fine rv">REMOTE SUPPORT AVAILABLE</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -274,11 +274,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/software/transfer-photos-data-new-device-cloud/index.html b/tech-support/software/transfer-photos-data-new-device-cloud/index.html
index c16a7f4..76392e6 100644
--- a/tech-support/software/transfer-photos-data-new-device-cloud/index.html
+++ b/tech-support/software/transfer-photos-data-new-device-cloud/index.html
@@ -201,16 +201,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>If the new device runs out of storage, move photos to an external drive or cloud and keep only recent ones on the device.</li><li>If a transfer app stalls, do it in batches — photos first, then documents, then everything else.</li><li>If an old device will not turn on, remove its storage drive and read it with a USB adapter, or take it to a shop before disposing of it.</li><li>If cloud storage is full, either upgrade the plan or use an external drive — do not delete the only copy.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html?requestType=transfer-photos-data-new-device-cloud&amp;sourcePage=%2Ftech-support%2Fsoftware%2Ftransfer-photos-data-new-device-cloud%2F">Book a remote session &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/book.html?requestType=transfer-photos-data-new-device-cloud&amp;sourcePage=%2Ftech-support%2Fsoftware%2Ftransfer-photos-data-new-device-cloud%2F" rel="noopener">Book a remote session &rarr;</a>
+  <p class="fine rv">REMOTE SUPPORT AVAILABLE</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -264,11 +264,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/thanks.html b/thanks.html
index 570b930..e3068ff 100644
--- a/thanks.html
+++ b/thanks.html
@@ -3,7 +3,7 @@
 <head>
 <meta charset="UTF-8" />
 <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-<title>Thank you — Remote Tech Support</title>
+<title>Request received — Remote Tech Support</title>
 <style>
   :root{ --bg:#0b1020; --bg2:#111a33; --txt:#e8edff; --accent:#5b8cff; --accent2:#22d3ee; }
   *{box-sizing:border-box}
@@ -21,8 +21,8 @@
 <body>
   <div class="box">
     <div class="check"><svg viewBox="0 0 24 24"><path d="M20 6L9 17l-5-5"/></svg></div>
-    <h1>You're booked in!</h1>
-    <p>Thanks for your request. You'll get a confirmation email shortly with next steps. I'll be in touch to confirm your session.</p>
+    <h1>Request received</h1>
+    <p>Thanks for your request. I’ll follow up using your preferred contact method to confirm next steps and availability.</p>
     <a class="btn" href="index.html">← Back to home</a>
   </div>
 </body>