diff --git a/notes/bf-2czk.md b/notes/bf-2czk.md
new file mode 100644
index 0000000..38bd9b3
--- /dev/null
+++ b/notes/bf-2czk.md
@@ -0,0 +1,66 @@
+# Audit: User-Facing URL References in web/src
+
+## Summary
+All user-facing URLs in the web source use `ai-code-battle.pages.dev` as the canonical domain. The legacy domains `aicodebattle.com` and `b2.aicodebattle.com` only appear in comments indicating they are outdated/NXDOMAIN.
+
+## Canonical Domain Usage (ai-code-battle.pages.dev)
+
+### Open Graph Tags (web/src/og-tags.ts)
+- **Lines 14-15**: Default OG tags URL and image
+- **Line 76**: Bot profile OG tags (`https://ai-code-battle.pages.dev/#/bot/${bot.id}`)
+- **Line 97**: Replay OG tags (`https://ai-code-battle.pages.dev/#/watch/replay/${match.id}`)
+- **Line 115**: Playlist OG tags (`https://ai-code-battle.pages.dev/#/watch/replays`)
+
+### Embed URLs (web/src/embed.ts)
+- **Line 18**: `PAGES_BASE = 'https://ai-code-battle.pages.dev'`
+- **Line 205**: Embed URL construction for OG tags (`${PAGES_BASE}/embed/${matchId}`)
+
+### Clip Maker Share URLs (web/src/pages/clip-maker.ts)
+- **Line 453**: Share URL for replay clips (`https://ai-code-battle.pages.dev/replay/${matchId}#turns=${startTurn}-${endTurn}`)
+
+### Playlists Embed Codes (web/src/pages/playlists.ts)
+- **Line 539**: Dynamic embed URL using `window.location.origin` - this adapts to whatever domain the user is currently on
+  ```javascript
+  const embedUrl = `${window.location.origin}/embed/${matchId}`;
+  ```
+
+### Bot Card Images (web/src/components/bot-card.ts)
+- **Line 264**: Renders text "ai-code-battle.pages.dev" on card images
+
+### API Documentation (web/src/pages/docs-api.ts)
+- **Line 19**: `PAGES_BASE = 'https://ai-code-battle.pages.dev'`
+- **Line 22**: `B2_BASE = 'https://ai-code-battle.pages.dev/r2'`
+- **Line 338**: Schema `$id` URL
+- **Line 552**: Example replay URL
+
+### Data Documentation (web/src/pages/docs-data.ts)
+- **Lines 29, 86, 132, 138, 143, 148**: curl examples with `https://ai-code-battle.pages.dev`
+
+### Registration Documentation (web/src/pages/docs.ts)
+- **Line 88**: Email contact `hello@ai-code-battle.pages.dev`
+- **Line 90**: API endpoint `https://api.ai-code-battle.pages.dev/api/register`
+
+### Sandbox Page (web/src/pages/sandbox.ts)
+- **Line 175**: Displays sandbox URL `ai-code-battle.pages.dev/#/compete/sandbox`
+
+### Replay Format Documentation (web/src/pages/docs-replay-format.ts)
+- **Lines 23, 26**: curl examples with `https://ai-code-battle.pages.dev/r2/replays/`
+
+## Legacy Domain References (Comments Only)
+
+### API Documentation (web/src/pages/docs-api.ts)
+- **Lines 21-22**: Comment stating `b2.aicodebattle.com` and `aicodebattle.com` are NXDOMAIN (not registered)
+
+### Data Documentation (web/src/pages/docs-data.ts)
+- **Line 19**: Comment stating legacy references are outdated
+
+## Dynamic URL Construction
+
+### Potential Concern
+- **web/src/pages/playlists.ts:539**: Uses `window.location.origin` to construct embed codes
+  - This will use whatever domain the user is currently accessing the site from
+  - If accessed via aicodebattle.com (if DNS were to be pointed there), embed codes would reference that domain
+  - Currently safe since aicodebattle.com is NXDOMAIN
+
+## Recommendation
+The codebase is properly standardized on `ai-code-battle.pages.dev` as the canonical public domain. The only dynamic URL construction (`window.location.origin` in playlists.ts) is appropriate for embed codes since it adapts to the current access domain. No changes needed.