diff --git a/marketing/images/clavitor-geometric_gold.png b/marketing/images/clavitor-geometric_gold.png
new file mode 100644
index 0000000..d3fd1df
Binary files /dev/null and b/marketing/images/clavitor-geometric_gold.png differ
diff --git a/marketing/images/clavitor-humanist_trust.png b/marketing/images/clavitor-humanist_trust.png
new file mode 100644
index 0000000..cd6b729
Binary files /dev/null and b/marketing/images/clavitor-humanist_trust.png differ
diff --git a/marketing/images/clavitor-monospace_dark.png b/marketing/images/clavitor-monospace_dark.png
new file mode 100644
index 0000000..0294cf1
Binary files /dev/null and b/marketing/images/clavitor-monospace_dark.png differ
diff --git a/marketing/images/clavitor-stark_white.png b/marketing/images/clavitor-stark_white.png
new file mode 100644
index 0000000..a16cce3
Binary files /dev/null and b/marketing/images/clavitor-stark_white.png differ
diff --git a/marketing/images/clavitor-tech_key.png b/marketing/images/clavitor-tech_key.png
new file mode 100644
index 0000000..8cf7cbf
Binary files /dev/null and b/marketing/images/clavitor-tech_key.png differ
diff --git a/oss/app/api/middleware.go b/oss/app/api/middleware.go
index e27ba2f..ed27c6a 100644
--- a/oss/app/api/middleware.go
+++ b/oss/app/api/middleware.go
@@ -142,6 +142,7 @@ func L1Middleware(dataDir string) func(http.Handler) http.Handler {
 			// Find vault DB by first 4 bytes of L1
 			vaultPrefix := base64UrlEncode(l1Raw[:4])
 			dbPath := filepath.Join(dataDir, "vault1984-"+vaultPrefix)
+			log.Printf("L1 auth: l1_hex=%x prefix=%s path=%s", l1Raw, vaultPrefix, dbPath)
 
 			var db *lib.DB
 			if _, err := os.Stat(dbPath); err == nil {
diff --git a/oss/app/lib/types.go b/oss/app/lib/types.go
index de59f71..95e1225 100644
--- a/oss/app/lib/types.go
+++ b/oss/app/lib/types.go
@@ -28,9 +28,10 @@ func (h *HexID) UnmarshalJSON(data []byte) error {
 type VaultField struct {
 	Label   string `json:"label"`
 	Value   string `json:"value"`
-	Kind    string `json:"kind"` // text|password|totp|url|file
+	Kind    string `json:"kind"`              // text|password|totp|url|file
 	Section string `json:"section,omitempty"`
-	L2      bool   `json:"l2,omitempty"` // true = client-side decrypt only
+	L2      bool   `json:"l2,omitempty"`      // legacy: true = L3 in new model
+	Tier    int    `json:"tier,omitempty"`     // 1=L1, 2=L2 (agent), 3=L3 (hardware)
 }
 
 // VaultFile represents an attached file.