# Curbi v31 — findings you can keep, and a start block for agents

Every finding can now leave the page as something a developer keeps:
- **Marked spans:** the exact characters are highlighted, with the rule name next to them.
- **Copy as regression case:** `curbi.regression` JSON with each reply, its expected verdict and its rules.
- **Download runnable test:** a dependency-free `node:test` file that replays the cases against the Check API in one batch (`CURBI_API` overrides the endpoint).
- **Open in Policy Studio:** the policy and the failing reply, carried in the URL fragment, so nothing is sent to a server.

These are live on /check/, the /api/ live tester and /studio/.

The homepage and /mcp/ open with **"Start here if you are an agent"**, built from the real handler:
- the three read-only tools;
- the required `Accept: application/json, text/event-stream` header, and the server's actual reply without it (HTTP 406, `-32000`);
- one command that works.

The company address replaces the personal one on every page (the founder's decision).

## Evidence
- **`v31/site.test.mjs`:** 6 tests. The downloaded test passes as generated and fails when an expectation drifts. Studio links round-trip Unicode and reject malformed input. /api/ publishes the policy its tester actually sends. The agent command works, and the warned-about error matches the real one. 4/4 meaningful page mutants caught.
- **Layer and review review suites:** all layer suites plus the review v28, v29 and v30 reviews pass, 54/54.
- **Full site suite:** no new failures.
- **Browser check (Chromium, production CSP, 24 pages at 1440 and 390, two clean runs):** /check/ regression copied (3 cases, 3 marks), Studio hand-off loads the failing reply, /api/ marks `$99` and `I have refunded`.