fix(website): tighten SEO host consistency and technical signals

Prefer apex patternsocd.com in docs/tests, drop duplicate robots meta,
enrich BlogPosting JSON-LD, refresh sitemap lastmod, add security
headers, and deepen internal links from homepage and guide pages.

Author: maskedsyntax

website/README.md

@@ -1,6 +1,10 @@
 # Patterns Website
 
-Marketing site for [Patterns](https://patterns.maskedsyntax.com/), built with SvelteKit and deployed to GitHub Pages.
+Marketing site for [Patterns](https://patternsocd.com/), built with SvelteKit.
+
+**Preferred host is the apex domain:** `https://patternsocd.com/` (no `www`).
+Canonicals, Open Graph URLs, the sitemap, and `robots.txt` all use apex. DNS
+should 308 `www.patternsocd.com` → `patternsocd.com`, not the other way around.
 
 ## Development
 
@@ -23,4 +27,10 @@ Static output is written to `build/`.
 
 ## Deploy
 
-Pushes to `master` that change `website/**` trigger the GitHub Actions workflow at `.github/workflows/deploy-website.yml`.
+Production deploys via Vercel. Pushes that change `website/**` should rebuild
+the site. After domain changes, confirm:
+
+```bash
+curl -sI https://patternsocd.com/          # 200
+curl -sI https://www.patternsocd.com/      # 308 → https://patternsocd.com/
+```

website/src/lib/data/links.test.ts

@@ -39,3 +39,13 @@ describe('store links', () => {
     expect(new URL(links.macos).searchParams.get('mt')).toBe('12');
   });
 });
+
+describe('canonical site host', () => {
+  it('uses the apex domain with https and a trailing slash', () => {
+    const url = new URL(links.site);
+    expect(url.protocol).toBe('https:');
+    expect(url.hostname).toBe('patternsocd.com');
+    expect(url.hostname.startsWith('www.')).toBe(false);
+    expect(links.site.endsWith('/')).toBe(true);
+  });
+});

website/src/lib/data/site.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest';
+import { links } from './links';
+import { site } from './site';
+
+describe('site metadata', () => {
+  it('keeps absolute asset URLs on the apex host', () => {
+    for (const url of [site.url, site.ogImage, site.logoUrl]) {
+      expect(url.startsWith(links.site) || url === links.site).toBe(true);
+      expect(url).not.toMatch(/https?:\/\/www\.patternsocd\.com/i);
+    }
+  });
+
+  it('exposes logo dimensions for JSON-LD ImageObject', () => {
+    expect(site.logoWidth).toBeGreaterThan(0);
+    expect(site.logoHeight).toBeGreaterThan(0);
+  });
+});

website/src/lib/data/site.ts

@@ -9,11 +9,15 @@ export const site = {
   name: 'Patterns',
   /** Keep in sync with the Flutter app's pubspec version (marketing version). */
   appVersion: '1.5.0',
+  /** Preferred host is the apex domain (no www). See website/README.md. */
   url: links.site,
   /** Purpose-built 1200×630 social share image. */
   ogImage: `${links.site}og/patterns-og.png`,
   ogImageWidth: 1200,
   ogImageHeight: 630,
+  logoUrl: `${links.site}assets/logo.png`,
+  logoWidth: 512,
+  logoHeight: 512,
   author: { name: 'MaskedSyntax', url: 'https://github.com/maskedsyntax' },
   publisher: { name: 'MaskedSyntax', url: links.maskedsyntax }
 } as const;

website/src/lib/sections/BuiltForErp.svelte

@@ -57,6 +57,9 @@
     <AnimatedOnScroll delay={150}>
       <div class="cta-row">
         <a href="/erp" class="link-pill">Learn how ERP works in Patterns <ArrowRight size={16} /></a>
+        <a href="/blog/what-is-erp-exposure-response-prevention" class="link-pill ghost"
+          >What is ERP? <ArrowRight size={16} /></a
+        >
       </div>
     </AnimatedOnScroll>
   </ContentContainer>
@@ -144,7 +147,9 @@
 
   .cta-row {
     display: flex;
+    flex-wrap: wrap;
     justify-content: center;
+    gap: 14px;
     margin-top: 40px;
   }
 
@@ -158,13 +163,25 @@
     font-weight: 600;
     color: #000;
     background: var(--accent);
-    transition: opacity 0.2s;
+    transition: opacity 0.2s, background 0.2s, color 0.2s;
   }
 
   .link-pill:hover {
     opacity: 0.9;
   }
 
+  .link-pill.ghost {
+    color: var(--text);
+    background: transparent;
+    border: 1px solid color-mix(in srgb, var(--border) 80%, transparent);
+  }
+
+  .link-pill.ghost:hover {
+    border-color: color-mix(in srgb, var(--accent) 55%, transparent);
+    color: var(--accent);
+    opacity: 1;
+  }
+
   @media (min-width: 600px) {
     .grid {
       grid-template-columns: repeat(3, 1fr);

website/src/lib/sections/CbtGuide.svelte

@@ -10,8 +10,9 @@
   intro="Cognitive behavioral therapy (CBT) is a family of practical, evidence-based therapies. For OCD specifically, the CBT approach with the strongest evidence is ERP - exposure and response prevention. Patterns is a CBT and ERP app built around that work."
   related={[
     { label: 'How ERP works in Patterns', href: '/erp' },
-    { label: 'Understanding the OCD cycle', href: '/ocd' },
-    { label: 'Frequently asked questions', href: '/faq' }
+    { label: 'ERP vs CBT for OCD', href: '/blog/erp-vs-cbt-for-ocd' },
+    { label: 'Is Patterns a CBT app?', href: '/blog/is-patterns-a-cbt-app' },
+    { label: 'Understanding the OCD cycle', href: '/ocd' }
   ]}
 >
   <p class="lead">

website/src/lib/sections/ErpGuide.svelte

@@ -9,9 +9,10 @@
   title="The urge will pass - even if you don't act on it."
   intro="Exposure and Response Prevention (ERP) is the most evidence-based therapy for OCD. It works by teaching your brain, through experience rather than reassurance, that anxiety fades on its own. Patterns is built to support that work between sessions."
   related={[
-    { label: 'CBT for OCD, and how ERP fits', href: '/cbt' },
-    { label: 'Understanding the OCD cycle', href: '/ocd' },
-    { label: 'Frequently asked questions', href: '/faq' }
+    { label: 'What is ERP? Plain-English guide', href: '/blog/what-is-erp-exposure-response-prevention' },
+    { label: 'How to build an exposure hierarchy', href: '/blog/how-to-build-an-exposure-hierarchy' },
+    { label: 'The compulsion delay technique', href: '/blog/compulsion-delay-technique' },
+    { label: 'Understanding the OCD cycle', href: '/ocd' }
   ]}
 >
   <p class="lead">

website/src/lib/sections/OcdGuide.svelte

@@ -10,8 +10,9 @@
   intro="Obsessive-compulsive disorder isn't about being tidy or liking things 'just so.' It's an exhausting loop between thoughts you don't want and the things you do to feel safe. Understanding that loop is the first step to loosening its grip."
   related={[
     { label: 'How ERP works in Patterns', href: '/erp' },
-    { label: 'CBT for OCD explained', href: '/cbt' },
-    { label: 'Frequently asked questions', href: '/faq' }
+    { label: 'Pure O and mental compulsions', href: '/blog/pure-o-mental-compulsions' },
+    { label: 'OCD vs anxiety', href: '/blog/ocd-vs-anxiety-difference' },
+    { label: 'The Patterns blog', href: '/blog' }
   ]}
 >
   <p class="lead">

website/src/lib/sections/Understanding.svelte

@@ -47,6 +47,7 @@
       <div class="cta-row">
         <a href="/ocd" class="link-pill">Understand the OCD cycle <ArrowRight size={16} /></a>
         <a href="/erp" class="link-pill ghost">How ERP helps <ArrowRight size={16} /></a>
+        <a href="/blog" class="link-pill ghost">From the blog <ArrowRight size={16} /></a>
       </div>
     </AnimatedOnScroll>
   </ContentContainer>

website/src/routes/+layout.svelte

@@ -16,11 +16,6 @@
   const bareRoutes = ['/get'];
   const bare = $derived(bareRoutes.includes($page.url.pathname.replace(/\/$/, '') || '/'));
 
-  // Internal tooling under /dev sets its own noindex tag. Emitting the global
-  // index directive here too would leave the page with two conflicting robots
-  // metas, and crawlers may honour either one.
-  const internal = $derived($page.url.pathname.startsWith('/dev'));
-
   // Campaign params are captured on every entry, not just /get, and the first
   // valid one wins for the session — so a visitor who lands on an ad URL and
   // then browses to /erp still has their store click credited to the ad.
@@ -47,20 +42,14 @@
 </script>
 
 <svelte:head>
-  <!-- Global, always-on tags. Per-page title/description/canonical/OG/JSON-LD
-       are set by the <Seo> component in each route. -->
+  <!-- Global chrome only. Title/description/canonical/OG/robots/JSON-LD come
+       from <Seo> on each public route. /dev pages set their own noindex. -->
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <meta name="author" content="MaskedSyntax" />
-  {#if !internal}
-    <meta name="robots" content="index, follow, max-image-preview:large, max-snippet:-1" />
-    <meta name="googlebot" content="index, follow, max-image-preview:large, max-snippet:-1" />
-  {/if}
   <meta name="application-name" content="Patterns" />
   <meta name="theme-color" content="#0A0A0A" />
   <meta name="color-scheme" content="dark light" />
-  <meta property="og:site_name" content="Patterns" />
-  <meta property="og:locale" content="en_US" />
   <meta name="mobile-web-app-capable" content="yes" />
   <meta name="apple-mobile-web-app-capable" content="yes" />
   <meta name="apple-mobile-web-app-status-bar-style" content="black" />