From e46b55d81d7875a347b0d132f793331227da7864 Mon Sep 17 00:00:00 2001
From: Bilal Mansouri <124762008+bighadj22@users.noreply.github.com>
Date: Fri, 4 Sep 2026 18:18:14 +0100
Subject: [PATCH] feat(tracking): Meta Pixel + Conversions API compliance
 overhaul

Browser pixel + server CAPI rebuilt to Meta's current spec, verified
live end-to-end (browser events, server Lead via durable Workflow,
Meta audit rows).

Client (cod-server/src/lib/capi.ts):
- Graph API v18.0 (expired) -> v26.0
- Network/5xx throw -> Cloudflare Workflow retries actually engage;
  4xx returns success:false (Meta rejects whole batch - fail fast)
- PII per docs: phone normalized (+00213 forms fixed), city/names
  diacritic-folded, fn/ln/external_id/event_source_url/content_ids added
- fbc/fbp/IP/UA unhashed, as Meta requires

Durability - the runtime cancels un-awaited promises after response,
which silently dropped every workflow trigger:
- All 3 Purchase trigger sites (dashboard status, Yalidine + ZR
  webhooks) now run via executionCtx.waitUntil
- Lead moved from inline one-shot fetch to the same durable Workflow
  path (capi-{orderId}-Lead), with event_source_url

Merchant control (migration 0018):
- conversion_event: Lead or Purchase - explicitly chosen by the
  merchant, never defaulted; gates every send
- test_mode toggle routes CAPI to Meta's test stream
- ad_account_name reference label; access token now write-only
  (masked reads, keep-on-empty save - same rule as dzverify/Sendili)

Checkout validation:
- Algerian mobile only (05/06/07 + 8 digits), server-enforced and
  normalized to canonical local form; storefront blur-validation with
  ar/fr/en messages
- InitiateCheckout fires on first checkout interaction, not form
  visibility

Browser pixel:
- Custom deferred loader (dropped events when window.load stalled)
  replaced with Meta's canonical base code

Audit + docs: capi_event_log rows for sent/failed/skipped incl. Lead;
docs/META-TRACKING.md end-user guide (trigger chain, webhook relation,
test mode, troubleshooting); README Growth Engine claims re-verified.
---
 README.md                                     |  11 +-
 cod-astro/theme01/src/core/actions/index.ts   |  16 +-
 cod-astro/theme01/src/core/api/client.ts      |   5 +-
 cod-astro/theme01/src/pages/thank-you.astro   |   5 +-
 .../theme/components/layout/BaseHead.astro    |  43 +--
 .../product/ProductDetailContent.astro        |   1 +
 cod-astro/theme01/src/theme/content/ar.ts     |   1 +
 cod-astro/theme01/src/theme/content/en.ts     |   1 +
 cod-astro/theme01/src/theme/content/fr.ts     |   1 +
 cod-astro/theme01/src/theme/content/types.ts  |   1 +
 .../theme01/src/theme/scripts/product.ts      |  74 +++--
 .../src/theme/scripts/track-abandonment.ts    |   8 +-
 cod-client-astro/locales/ar/settings.json     |  17 +-
 cod-client-astro/locales/en/settings.json     |  17 +-
 cod-client-astro/locales/fr/settings.json     |  17 +-
 .../src/features/settings/api.test.ts         |   6 +-
 .../settings/components/TrackingSettings.tsx  | 124 +++++++-
 .../src/features/settings/types.ts            |   8 +-
 .../0018_pixel_conversion_settings.sql        |  10 +
 .../abandoned-orders/store-routes.ts          |   4 +-
 .../src/endpoints/orders/orders.test.ts       |   1 +
 .../src/endpoints/orders/routes.test.ts       |   1 +
 .../endpoints/orders/status-transitions.ts    |  26 +-
 cod-server/src/endpoints/store-otp/phone.ts   |  20 +-
 cod-server/src/endpoints/store/CONTEXT.md     |   2 +-
 .../endpoints/store/capi-lead-trigger.test.ts | 147 +++++++++
 cod-server/src/endpoints/store/handlers.ts    |  57 ++--
 .../src/endpoints/store/otp-gate.test.ts      |  20 +-
 cod-server/src/endpoints/store/routes.test.ts |  17 +-
 .../src/endpoints/store/validation.test.ts    |  63 ++++
 cod-server/src/endpoints/store/validation.ts  |  13 +-
 cod-server/src/endpoints/stores/CONTEXT.md    |  23 +-
 cod-server/src/endpoints/stores/handlers.ts   |  26 +-
 .../src/endpoints/stores/routes.test.ts       |  75 ++++-
 cod-server/src/endpoints/stores/routes.ts     |  10 +-
 cod-server/src/endpoints/webhooks/handlers.ts |  30 +-
 .../src/endpoints/webhooks/webhooks.test.ts   |   1 +
 cod-server/src/lib/capi-log.ts                |  32 ++
 cod-server/src/lib/capi.test.ts               | 234 +++++++++++++++
 cod-server/src/lib/capi.ts                    |  85 ++++--
 cod-server/src/openapi/schemas/store.ts       |  17 +-
 cod-server/src/workflows/capi-helpers.test.ts |  80 +++++
 cod-server/src/workflows/capi-helpers.ts      |  47 +++
 cod-server/src/workflows/capi.ts              | 169 +++++++----
 cod-shared/db/schema.ts                       |   6 +
 cod-shared/queries/pixel-config.test.ts       | 164 ++++++++++
 cod-shared/queries/pixel-config.ts            |  29 +-
 cod-shared/queries/store.ts                   |   9 +-
 docs/META-TRACKING.md                         | 284 ++++++++++++++++++
 49 files changed, 1811 insertions(+), 247 deletions(-)
 create mode 100644 cod-server/src/db/migrations/0018_pixel_conversion_settings.sql
 create mode 100644 cod-server/src/endpoints/store/capi-lead-trigger.test.ts
 create mode 100644 cod-server/src/endpoints/store/validation.test.ts
 create mode 100644 cod-server/src/lib/capi-log.ts
 create mode 100644 cod-server/src/lib/capi.test.ts
 create mode 100644 cod-server/src/workflows/capi-helpers.test.ts
 create mode 100644 cod-shared/queries/pixel-config.test.ts
 create mode 100644 docs/META-TRACKING.md

diff --git a/README.md b/README.md
index 674448f..ea93646 100644
--- a/README.md
+++ b/README.md
@@ -109,11 +109,14 @@ CodFlow v1.1.0 — here's what works today:
 - ✅ Partial returns with automatic inventory restock
 
 ### Growth Engine
-- ✅ Meta Conversions API (CAPI) fires `Purchase` only at confirmed delivery
-- ✅ 7-day attribution window compliance
-- ✅ Advanced data hashing (phone, city, IP, User-Agent)
+- ✅ Meta Pixel (browser) + Conversions API (server) dual setup with event deduplication
+- ✅ Merchant-chosen conversion event: `Lead` at order placement or `Purchase` at confirmed delivery
+- ✅ Test Mode toggle routes CAPI events to Meta's test stream (`test_event_code`)
+- ✅ Graph API v26.0 with 7-day attribution window compliance
+- ✅ PII hashed per Meta spec (phone, names, city, zip, country, external_id); IP, User-Agent, `fbp`, `fbc` sent unhashed as required
 - ✅ `fbp` and `fbc` attribution preservation
-- ✅ Durable retry with Cloudflare Workflows
+- ✅ Durable retry with Cloudflare Workflows (network + Meta 5xx, exponential backoff)
+- ✅ CAPI event audit log (`capi_event_log`) for every send attempt
 
 ### AI & Agentic (MCP)
 - ✅ RFC 9728 OAuth Protected Resource Discovery with dynamic client registration
diff --git a/cod-astro/theme01/src/core/actions/index.ts b/cod-astro/theme01/src/core/actions/index.ts
index ec0f3d4..9a2cae3 100644
--- a/cod-astro/theme01/src/core/actions/index.ts
+++ b/cod-astro/theme01/src/core/actions/index.ts
@@ -66,7 +66,19 @@ export const server = {
         z.string().min(10).max(1024).optional()
       ),
     }),
-    handler: async (input) => {
+    handler: async (input, context) => {
+      // Forward the shopper's attribution headers so cod-server records the
+      // visitor, not this worker — same mechanism as core/endpoints/abandoned.ts.
+      const forwardedHeaders: Record<string, string> = {};
+      const userAgent = context.request.headers.get("User-Agent");
+      if (userAgent) forwardedHeaders["User-Agent"] = userAgent;
+      const clientIp =
+        context.request.headers.get("CF-Connecting-IP") ??
+        context.request.headers.get("X-Forwarded-For")?.split(",")[0]?.trim();
+      if (clientIp) forwardedHeaders["X-Forwarded-For"] = clientIp;
+      const referer = context.request.headers.get("Referer");
+      if (referer) forwardedHeaders["Referer"] = referer;
+
       const result = await placeOrder({
         customerName: input.customerName,
         phone: input.phone,
@@ -86,7 +98,7 @@ export const server = {
         fbc: input.fbc,
         fbp: input.fbp,
         otpToken: input.otpToken,
-      });
+      }, forwardedHeaders);
 
       if (!result.success) {
         throw new Error(result.error);
diff --git a/cod-astro/theme01/src/core/api/client.ts b/cod-astro/theme01/src/core/api/client.ts
index ca53eb5..c00a726 100644
--- a/cod-astro/theme01/src/core/api/client.ts
+++ b/cod-astro/theme01/src/core/api/client.ts
@@ -141,12 +141,13 @@ export async function submitReview(
 }
 
 export async function placeOrder(
-  body: Record<string, unknown>
+  body: Record<string, unknown>,
+  forwardedHeaders?: Record<string, string>
 ): Promise<{ success: true; data: { orderNumber: string; orderId: string; total: number } } | { success: false; error: string }> {
   try {
     const res = await fetch(`${COD_SERVER_URL}/store/orders`, {
       method: "POST",
-      headers: storeHeaders(),
+      headers: { ...storeHeaders(), ...forwardedHeaders },
       body: JSON.stringify(body),
     });
     const json = (await res.json()) as any;
diff --git a/cod-astro/theme01/src/pages/thank-you.astro b/cod-astro/theme01/src/pages/thank-you.astro
index 5b58fb1..577ed63 100644
--- a/cod-astro/theme01/src/pages/thank-you.astro
+++ b/cod-astro/theme01/src/pages/thank-you.astro
@@ -112,7 +112,10 @@ const steps = [
   <script type="text/javascript" set:html={`
 (function() {
   if (typeof fbq !== 'function') return;
-  var eventId = ${JSON.stringify(orderId || orderNumber)};
+  var eventId = ${JSON.stringify(orderId)};
+  // No orderId means no server Lead mirror to deduplicate against — firing
+  // with a different id would double-count the conversion. Skip instead.
+  if (!eventId) return;
   var total   = ${JSON.stringify(totalNum)};
   fbq('track', 'Lead', total ? { value: total, currency: 'DZD' } : {}, { eventID: eventId });
 })();
diff --git a/cod-astro/theme01/src/theme/components/layout/BaseHead.astro b/cod-astro/theme01/src/theme/components/layout/BaseHead.astro
index e41f9d2..fa472a6 100644
--- a/cod-astro/theme01/src/theme/components/layout/BaseHead.astro
+++ b/cod-astro/theme01/src/theme/components/layout/BaseHead.astro
@@ -65,36 +65,25 @@ import { MEDIA_DOMAIN } from "astro:env/server";
   <!-- R2 media domain — early connection for product images -->
   {MEDIA_DOMAIN && <link rel="preconnect" href={`https://${MEDIA_DOMAIN}`} />}
 
-  <!-- Meta Pixel — deferred after window.load so fbevents.js (101 KiB) does
-       not compete with the LCP image for bandwidth. A lightweight queue stub
-       captures all fbq() calls made before the library arrives; they are
-       replayed in order once fbevents.js is ready.
-
-       Why delete window.fbq before injecting the script: fbevents.js opens
-       with `if(f.fbq)return;` — it bails if a fbq already exists. Clearing
-       our stub lets it initialise properly, then we replay the saved queue. -->
+  <!-- Meta Pixel — canonical base code, unmodified. fbevents.js ships its own
+       command queue: every fbq() call made before the library arrives (incl.
+       ViewContent/InitiateCheckout from product.ts) is buffered and flushed
+       automatically once it loads. Do not defer or custom-load it — a
+       hand-rolled loader delays or drops events whenever window.load or the
+       script fetch misbehaves. -->
   {config.pixelId && (
     <Fragment>
       <script type="text/javascript" set:html={`
-(function(w,d){
-  function q(){q.queue=q.queue||[];q.queue.push([].slice.call(arguments));}
-  q.queue=[];q.version='2.0';
-  if(!w.fbq){w.fbq=q;w._fbq=q;}
-  function loadPixel(){
-    var saved=w.fbq&&w.fbq.queue?w.fbq.queue.slice():[];
-    delete w.fbq;delete w._fbq;
-    var s=d.createElement('script');s.async=true;
-    s.src='https://connect.facebook.net/en_US/fbevents.js';
-    s.onload=function(){
-      for(var i=0;i<saved.length;i++){try{w.fbq.apply(null,saved[i]);}catch(e){}}
-    };
-    d.head.appendChild(s);
-  }
-  if(d.readyState==='complete'){loadPixel();}
-  else{w.addEventListener('load',loadPixel,{once:true});}
-})(window,document);
-fbq('init','${config.pixelId}');
-fbq('track','PageView');
+!function(f,b,e,v,n,t,s)
+{if(f.fbq)return;n=f.fbq=function(){n.callMethod?
+n.callMethod.apply(n,arguments):n.queue.push(arguments)};
+if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';
+n.queue=[];t=b.createElement(e);t.async=!0;
+t.src=v;s=b.getElementsByTagName(e)[0];
+s.parentNode.insertBefore(t,s)}(window, document,'script',
+'https://connect.facebook.net/en_US/fbevents.js');
+fbq('init', '${config.pixelId}');
+fbq('track', 'PageView');
       `} />
       <noscript>
         <img height="1" width="1" style="display:none"
diff --git a/cod-astro/theme01/src/theme/components/product/ProductDetailContent.astro b/cod-astro/theme01/src/theme/components/product/ProductDetailContent.astro
index 59b0783..895cfb1 100644
--- a/cod-astro/theme01/src/theme/components/product/ProductDetailContent.astro
+++ b/cod-astro/theme01/src/theme/components/product/ProductDetailContent.astro
@@ -73,6 +73,7 @@ const jsonLd = getProductJsonLd(product, basePrice);
   data-qty-max-stock={content.qtyMaxStock}
   data-inventory={String(product.inventory)}
   data-pixel-id={config.pixelId ?? ""}
+  data-phone-invalid={content.formPhoneInvalid}
   data-product-id={product.id}
   data-product-name={product.name}
 />
diff --git a/cod-astro/theme01/src/theme/content/ar.ts b/cod-astro/theme01/src/theme/content/ar.ts
index 2f508a9..44d7be2 100644
--- a/cod-astro/theme01/src/theme/content/ar.ts
+++ b/cod-astro/theme01/src/theme/content/ar.ts
@@ -89,6 +89,7 @@ export const ar: StoreFrontContent = {
   formNamePlaceholder: "مثال: أحمد بن علي",
   formPhoneLabel: "رقم الهاتف",
   formPhonePlaceholder: "0XX XX XX XX XX",
+  formPhoneInvalid: "رقم هاتف جزائري غير صحيح — يجب أن يبدأ بـ 05 أو 06 أو 07",
   formWilayaLabel: "الولاية",
   formWilayaPlaceholder: "اختر ولايتك",
   formCommuneLabel: "البلدية",
diff --git a/cod-astro/theme01/src/theme/content/en.ts b/cod-astro/theme01/src/theme/content/en.ts
index 726296e..99d12ca 100644
--- a/cod-astro/theme01/src/theme/content/en.ts
+++ b/cod-astro/theme01/src/theme/content/en.ts
@@ -89,6 +89,7 @@ export const en: StoreFrontContent = {
   formNamePlaceholder: "e.g. Ahmed Ben Ali",
   formPhoneLabel: "Phone number",
   formPhonePlaceholder: "0XX XX XX XX XX",
+  formPhoneInvalid: "Invalid Algerian phone number — must start with 05, 06, or 07",
   formWilayaLabel: "Wilaya",
   formWilayaPlaceholder: "Select your wilaya",
   formCommuneLabel: "Commune",
diff --git a/cod-astro/theme01/src/theme/content/fr.ts b/cod-astro/theme01/src/theme/content/fr.ts
index 4e15a21..2c4c2c9 100644
--- a/cod-astro/theme01/src/theme/content/fr.ts
+++ b/cod-astro/theme01/src/theme/content/fr.ts
@@ -89,6 +89,7 @@ export const fr: StoreFrontContent = {
   formNamePlaceholder: "Exemple: Ahmed Ben Ali",
   formPhoneLabel: "Numéro de téléphone",
   formPhonePlaceholder: "0XX XX XX XX XX",
+  formPhoneInvalid: "Numéro algérien invalide — doit commencer par 05, 06 ou 07",
   formWilayaLabel: "Wilaya",
   formWilayaPlaceholder: "Choisissez votre wilaya",
   formCommuneLabel: "Commune",
diff --git a/cod-astro/theme01/src/theme/content/types.ts b/cod-astro/theme01/src/theme/content/types.ts
index 5d0e491..223c1f2 100644
--- a/cod-astro/theme01/src/theme/content/types.ts
+++ b/cod-astro/theme01/src/theme/content/types.ts
@@ -87,6 +87,7 @@ export interface StoreFrontContent {
   formNamePlaceholder: string;
   formPhoneLabel: string;
   formPhonePlaceholder: string;
+  formPhoneInvalid: string;
   formWilayaLabel: string;
   formWilayaPlaceholder: string;
   formCommuneLabel: string;
diff --git a/cod-astro/theme01/src/theme/scripts/product.ts b/cod-astro/theme01/src/theme/scripts/product.ts
index 8af5a23..283fa64 100644
--- a/cod-astro/theme01/src/theme/scripts/product.ts
+++ b/cod-astro/theme01/src/theme/scripts/product.ts
@@ -626,6 +626,42 @@ export function initProductPage() {
     if (submitBtn) submitBtn.disabled = true;
   });
 
+  // ── ALGERIAN PHONE VALIDATION ──────────────────────────────────────────────
+  // Normalizes to the canonical local form "05XXXXXXXX" on blur and blocks
+  // submit with a localized message for anything that is not an Algerian
+  // mobile. The server re-validates (storeOrderSchema) — this is UX, not the
+  // enforcement point.
+  const phoneInput = document.getElementById("f-phone") as HTMLInputElement | null;
+  const phoneInvalidMsg = el.dataset.phoneInvalid || "Invalid phone number";
+
+  function toLocalDzMobile(raw: string): string | null {
+    let digits = raw.replace(/\D/g, "");
+    if (digits.startsWith("00213")) digits = digits.slice(5);
+    else if (digits.startsWith("213")) digits = digits.slice(3);
+    const local = digits.startsWith("0") ? digits.slice(1) : digits;
+    return /^[567]\d{8}$/.test(local) ? "0" + local : null;
+  }
+
+  if (phoneInput) {
+    phoneInput.addEventListener("blur", () => {
+      if (!phoneInput.value.trim()) {
+        phoneInput.setCustomValidity("");
+        return;
+      }
+      const normalized = toLocalDzMobile(phoneInput.value);
+      if (normalized) {
+        phoneInput.value = normalized;
+        phoneInput.setCustomValidity("");
+      } else {
+        phoneInput.setCustomValidity(phoneInvalidMsg);
+        phoneInput.reportValidity();
+      }
+    });
+    phoneInput.addEventListener("input", () => {
+      phoneInput.setCustomValidity("");
+    });
+  }
+
   // ── FINAL INITIALIZATION ───────────────────────────────────────────────────
   // Show the default active tier's variant section (base tier is always default)
   if (tierLabels.length > 0) {
@@ -676,25 +712,29 @@ export function initProductPage() {
     });
   }
 
-  // 2. InitiateCheckout — fires once when the order form scrolls into view
+  // 2. InitiateCheckout — fires once when the shopper STARTS the checkout:
+  //    first focus, keystroke, or selection inside the order form. Seeing the
+  //    form is not starting checkout — Meta's event means the process began.
   if (pixelId) {
     const orderSection = document.getElementById("order-section");
-    if (orderSection && "IntersectionObserver" in window) {
-      const observer = new IntersectionObserver(
-        (entries) => {
-          if (entries[0]?.isIntersecting) {
-            fbqSafe()?.("track", "InitiateCheckout", {
-              content_ids: [productId],
-              content_type: "product",
-              value: currentPrice,
-              currency: "DZD",
-            });
-            observer.disconnect();
-          }
-        },
-        { threshold: 0.3 }
-      );
-      observer.observe(orderSection);
+    if (orderSection) {
+      let checkoutStarted = false;
+      const fireInitiateCheckout = () => {
+        if (checkoutStarted) return;
+        checkoutStarted = true;
+        fbqSafe()?.("track", "InitiateCheckout", {
+          content_ids: [productId],
+          content_type: "product",
+          value: currentPrice,
+          currency: "DZD",
+        });
+        orderSection.removeEventListener("focusin", fireInitiateCheckout);
+        orderSection.removeEventListener("input", fireInitiateCheckout);
+        orderSection.removeEventListener("change", fireInitiateCheckout);
+      };
+      orderSection.addEventListener("focusin", fireInitiateCheckout);
+      orderSection.addEventListener("input", fireInitiateCheckout);
+      orderSection.addEventListener("change", fireInitiateCheckout);
     }
   }
 
diff --git a/cod-astro/theme01/src/theme/scripts/track-abandonment.ts b/cod-astro/theme01/src/theme/scripts/track-abandonment.ts
index 12f7b0c..1a27803 100644
--- a/cod-astro/theme01/src/theme/scripts/track-abandonment.ts
+++ b/cod-astro/theme01/src/theme/scripts/track-abandonment.ts
@@ -37,7 +37,13 @@ function initAbandonmentTracking() {
   }
 
   function isValidPhone(v: string) {
-    return /^[0-9+\s-]+$/.test(v) && v.replace(/\D/g, "").length >= 9;
+    // Algerian mobile, matching the order form + server schema: 05/06/07
+    // followed by 8 digits, in local or international form.
+    let digits = v.replace(/\D/g, "");
+    if (digits.startsWith("00213")) digits = digits.slice(5);
+    else if (digits.startsWith("213")) digits = digits.slice(3);
+    const local = digits.startsWith("0") ? digits.slice(1) : digits;
+    return /^[567]\d{8}$/.test(local);
   }
 
   function getWilayaName(wilayaId: number | undefined): string | undefined {
diff --git a/cod-client-astro/locales/ar/settings.json b/cod-client-astro/locales/ar/settings.json
index b1c5b23..62e28bb 100644
--- a/cod-client-astro/locales/ar/settings.json
+++ b/cod-client-astro/locales/ar/settings.json
@@ -49,10 +49,21 @@
     "tracking_pixel_id_hint": "متوفر في مدير الأحداث Meta ← مصادر البيانات",
     "tracking_pixel_id_placeholder": "مثال: 123456789012345",
     "tracking_token_label": "رمز وصول API التحويلات",
-    "tracking_token_hint": "رمز من جانب الخادم — لا يُكشف أبداً للزوار",
+    "tracking_token_hint": "رمز من جانب الخادم — لا يُكشف أبداً للزوار. اتركه فارغاً للإبقاء على الرمز المخزّن.",
     "tracking_token_placeholder": "EAAxxxxxxxxxxxxxxxx...",
-    "tracking_test_code_label": "رمز الحدث التجريبي (اختياري)",
-    "tracking_test_code_hint": "استخدمه للتحقق من الأحداث في مدير أحداث Meta",
+    "tracking_ad_account_label": "اسم حساب الإعلانات",
+    "tracking_ad_account_hint": "تسمية خاصة بك لحساب الإعلانات على Meta — للمرجعية فقط",
+    "tracking_ad_account_placeholder": "مثال: متجري — الحساب الرئيسي",
+    "tracking_event_label": "حدث التحويل",
+    "tracking_event_lead_label": "Lead — عند تسجيل الطلب",
+    "tracking_event_lead_hint": "يُطلق لحظة تقديم الطلب. إشارة أسرع لإعلاناتك، لكن الطلبات غير المؤكدة تُحتسب ضمنه.",
+    "tracking_event_purchase_label": "Purchase — عند التسليم المؤكد",
+    "tracking_event_purchase_hint": "يُطلق فقط عند تسليم الطلب ودفع قيمته. إشارة أبطأ، لكنها تطابق الإيرادات الحقيقية.",
+    "tracking_test_mode_label": "الوضع التجريبي",
+    "tracking_test_mode_hint": "يرسل أحداث API التحويلات إلى مسار الاختبار لدى Meta بدلاً من قياس الإنتاج",
+    "tracking_test_mode_warning": "الوضع التجريبي مفعّل — الأحداث لا تُحتسب في القياس الفعلي. عطّله قبل الانطلاق.",
+    "tracking_test_code_label": "رمز الحدث التجريبي",
+    "tracking_test_code_hint": "من مدير الأحداث ← أحداث الاختبار — مطلوب عند تفعيل الوضع التجريبي",
     "tracking_test_code_placeholder": "مثال: TEST12345",
     "tracking_last_saved": "آخر حفظ",
     "otp_title": "التحقق",
diff --git a/cod-client-astro/locales/en/settings.json b/cod-client-astro/locales/en/settings.json
index 207d963..054b3af 100644
--- a/cod-client-astro/locales/en/settings.json
+++ b/cod-client-astro/locales/en/settings.json
@@ -49,10 +49,21 @@
     "tracking_pixel_id_hint": "Found in Meta Events Manager → Data Sources",
     "tracking_pixel_id_placeholder": "e.g. 123456789012345",
     "tracking_token_label": "Conversions API Access Token",
-    "tracking_token_hint": "Server-side token — never exposed to visitors",
+    "tracking_token_hint": "Server-side token — never exposed to visitors. Leave empty to keep the stored token.",
     "tracking_token_placeholder": "EAAxxxxxxxxxxxxxxxx...",
-    "tracking_test_code_label": "Test Event Code (optional)",
-    "tracking_test_code_hint": "Use during testing to verify events in Meta Events Manager",
+    "tracking_ad_account_label": "Ad Account Name",
+    "tracking_ad_account_hint": "Your own label for the Meta ad account — for reference only",
+    "tracking_ad_account_placeholder": "e.g. My Store — Main Account",
+    "tracking_event_label": "Conversion Event",
+    "tracking_event_lead_label": "Lead — at order placement",
+    "tracking_event_lead_hint": "Fires the moment an order is placed. Faster signal for your ads, but unconfirmed orders are included.",
+    "tracking_event_purchase_label": "Purchase — at confirmed delivery",
+    "tracking_event_purchase_hint": "Fires only when the order is delivered and paid. Slower signal, but matches real revenue.",
+    "tracking_test_mode_label": "Test Mode",
+    "tracking_test_mode_hint": "Sends Conversions API events to Meta's test stream instead of production measurement",
+    "tracking_test_mode_warning": "Test mode is on — events are not counted for real measurement. Turn it off before going live.",
+    "tracking_test_code_label": "Test Event Code",
+    "tracking_test_code_hint": "From Events Manager → Test Events — required when test mode is on",
     "tracking_test_code_placeholder": "e.g. TEST12345",
     "tracking_last_saved": "Last saved",
     "otp_title": "Verification",
diff --git a/cod-client-astro/locales/fr/settings.json b/cod-client-astro/locales/fr/settings.json
index 22a5bd4..c410dbd 100644
--- a/cod-client-astro/locales/fr/settings.json
+++ b/cod-client-astro/locales/fr/settings.json
@@ -49,10 +49,21 @@
     "tracking_pixel_id_hint": "Disponible dans Meta Events Manager → Sources de données",
     "tracking_pixel_id_placeholder": "ex: 123456789012345",
     "tracking_token_label": "Token d'accès API Conversions",
-    "tracking_token_hint": "Token côté serveur — jamais exposé aux visiteurs",
+    "tracking_token_hint": "Token côté serveur — jamais exposé aux visiteurs. Laissez vide pour conserver le token enregistré.",
     "tracking_token_placeholder": "EAAxxxxxxxxxxxxxxxx...",
-    "tracking_test_code_label": "Code d'événement test (optionnel)",
-    "tracking_test_code_hint": "Utilisez-le pour vérifier les événements dans Meta Events Manager",
+    "tracking_ad_account_label": "Nom du compte publicitaire",
+    "tracking_ad_account_hint": "Votre propre libellé pour le compte publicitaire Meta — à titre de référence",
+    "tracking_ad_account_placeholder": "ex: Ma Boutique — Compte principal",
+    "tracking_event_label": "Événement de conversion",
+    "tracking_event_lead_label": "Lead — dès la commande",
+    "tracking_event_lead_hint": "Déclenché dès qu'une commande est passée. Signal plus rapide pour vos publicités, mais les commandes non confirmées sont incluses.",
+    "tracking_event_purchase_label": "Purchase — à la livraison confirmée",
+    "tracking_event_purchase_hint": "Déclenché uniquement lorsque la commande est livrée et payée. Signal plus lent, mais conforme au revenu réel.",
+    "tracking_test_mode_label": "Mode test",
+    "tracking_test_mode_hint": "Envoie les événements de l'API Conversions vers le flux de test de Meta au lieu de la production",
+    "tracking_test_mode_warning": "Le mode test est activé — les événements ne comptent pas pour la mesure réelle. Désactivez-le avant de lancer.",
+    "tracking_test_code_label": "Code d'événement test",
+    "tracking_test_code_hint": "Depuis Events Manager → Événements de test — requis quand le mode test est activé",
     "tracking_test_code_placeholder": "ex: TEST12345",
     "tracking_last_saved": "Dernière sauvegarde",
     "otp_title": "Vérification",
diff --git a/cod-client-astro/src/features/settings/api.test.ts b/cod-client-astro/src/features/settings/api.test.ts
index 258edcb..eb519d7 100644
--- a/cod-client-astro/src/features/settings/api.test.ts
+++ b/cod-client-astro/src/features/settings/api.test.ts
@@ -29,10 +29,10 @@ describe("settings API adapters", () => {
     await expect(getPixelConfig()).resolves.toBeNull();
     expect(seam.apiFetch).toHaveBeenCalledWith("/api/stores/pixel-config");
 
-    const config = { id: "px1", pixelId: "123", accessToken: "EAAG", testEventCode: null, enabled: true };
+    const config = { id: "px1", pixelId: "123", accessTokenMasked: "••••EAAG", testEventCode: null, conversionEvent: "Purchase" as const, testMode: false, enabled: true };
     seam.apiFetch.mockResolvedValue({ success: true, data: config });
-    await expect(savePixelConfig({ pixelId: "123", accessToken: "EAAG", enabled: true })).resolves.toEqual(config);
-    expect(seam.apiFetch).toHaveBeenCalledWith("/api/stores/pixel-config", expect.objectContaining({ method: "POST", body: JSON.stringify({ pixelId: "123", accessToken: "EAAG", enabled: true }) }));
+    await expect(savePixelConfig({ pixelId: "123", accessToken: "EAAG", conversionEvent: "Purchase", enabled: true })).resolves.toEqual(config);
+    expect(seam.apiFetch).toHaveBeenCalledWith("/api/stores/pixel-config", expect.objectContaining({ method: "POST", body: JSON.stringify({ pixelId: "123", accessToken: "EAAG", conversionEvent: "Purchase", enabled: true }) }));
   });
 
   it("reads the email config (null when absent) and upserts it", async () => {
diff --git a/cod-client-astro/src/features/settings/components/TrackingSettings.tsx b/cod-client-astro/src/features/settings/components/TrackingSettings.tsx
index 60a6948..b6c057f 100644
--- a/cod-client-astro/src/features/settings/components/TrackingSettings.tsx
+++ b/cod-client-astro/src/features/settings/components/TrackingSettings.tsx
@@ -5,12 +5,23 @@ import { useT } from "@/i18n/react";
 import { getPixelConfig, savePixelConfig } from "@/features/settings/api";
 import { FieldRow, SettingsSection } from "@/features/settings/components/SettingsSection";
 
+type ConversionEvent = "Lead" | "Purchase";
+
+const EVENT_OPTIONS: { value: ConversionEvent; labelKey: string; hintKey: string }[] = [
+  { value: "Lead", labelKey: "store.tracking_event_lead_label", hintKey: "store.tracking_event_lead_hint" },
+  { value: "Purchase", labelKey: "store.tracking_event_purchase_label", hintKey: "store.tracking_event_purchase_hint" },
+];
+
 export function TrackingSettings() {
   const t = useT("settings");
   const [pixelId, setPixelId] = useState("");
+  const [adAccountName, setAdAccountName] = useState("");
   const [accessToken, setAccessToken] = useState("");
+  const [accessTokenMasked, setAccessTokenMasked] = useState<string | null>(null);
   const [testEventCode, setTestEventCode] = useState("");
+  const [testMode, setTestMode] = useState(false);
   const [enabled, setEnabled] = useState(true);
+  const [conversionEvent, setConversionEvent] = useState<ConversionEvent | null>(null);
   const [showToken, setShowToken] = useState(false);
   const [lastSaved, setLastSaved] = useState<string | null>(null);
 
@@ -19,8 +30,11 @@ export function TrackingSettings() {
     getPixelConfig().then((data) => {
       if (!alive || !data) return;
       setPixelId(data.pixelId);
-      setAccessToken(data.accessToken);
+      setAdAccountName(data.adAccountName ?? "");
+      setAccessTokenMasked(data.accessTokenMasked);
       setTestEventCode(data.testEventCode ?? "");
+      setConversionEvent(data.conversionEvent);
+      setTestMode(data.testMode);
       setEnabled(data.enabled);
       setLastSaved(data.updatedAt);
     });
@@ -35,12 +49,32 @@ export function TrackingSettings() {
         `${t("store.tracking_pixel_id_label")} ${t("store.field_required")}`,
       );
     }
+    if (!conversionEvent) {
+      throw new Error(
+        `${t("store.tracking_event_label")} ${t("store.field_required")}`,
+      );
+    }
+    if (enabled && !accessToken.trim() && !accessTokenMasked) {
+      throw new Error(
+        `${t("store.tracking_token_label")} ${t("store.field_required")}`,
+      );
+    }
+    if (enabled && testMode && !testEventCode.trim()) {
+      throw new Error(
+        `${t("store.tracking_test_code_label")} ${t("store.field_required")}`,
+      );
+    }
     const result = await savePixelConfig({
       pixelId: pixelId.trim(),
+      adAccountName: adAccountName.trim() || null,
       accessToken: accessToken.trim() || undefined,
       testEventCode: testEventCode.trim() || null,
+      conversionEvent,
+      testMode,
       enabled,
     });
+    setAccessTokenMasked(result.accessTokenMasked);
+    setAccessToken("");
     setLastSaved(result.updatedAt);
   }
 
@@ -75,6 +109,15 @@ export function TrackingSettings() {
         </button>
       </div>
 
+      <FieldRow label={t("store.tracking_ad_account_label")} hint={t("store.tracking_ad_account_hint")}>
+        <Input
+          dir="ltr"
+          value={adAccountName}
+          onChange={(event) => setAdAccountName(event.currentTarget.value)}
+          placeholder={t("store.tracking_ad_account_placeholder")}
+        />
+      </FieldRow>
+
       <FieldRow label={t("store.tracking_pixel_id_label")} hint={t("store.tracking_pixel_id_hint")}>
         <Input
           dir="ltr"
@@ -91,7 +134,7 @@ export function TrackingSettings() {
             dir="ltr"
             value={accessToken}
             onChange={(event) => setAccessToken(event.currentTarget.value)}
-            placeholder={t("store.tracking_token_placeholder")}
+            placeholder={accessTokenMasked ?? t("store.tracking_token_placeholder")}
             className="pe-10"
           />
           <button
@@ -104,17 +147,80 @@ export function TrackingSettings() {
             {showToken ? <EyeOff size={15} /> : <Eye size={15} />}
           </button>
         </div>
+        {accessTokenMasked && !accessToken && (
+          <p className="text-xs text-muted-foreground">
+            {t("store.otp_key_stored")}: <span dir="ltr">{accessTokenMasked}</span>
+          </p>
+        )}
       </FieldRow>
 
-      <FieldRow label={t("store.tracking_test_code_label")} hint={t("store.tracking_test_code_hint")}>
-        <Input
-          dir="ltr"
-          value={testEventCode}
-          onChange={(event) => setTestEventCode(event.currentTarget.value)}
-          placeholder={t("store.tracking_test_code_placeholder")}
-        />
+      <FieldRow label={t("store.tracking_event_label")}>
+        <div className="grid gap-2" role="radiogroup" aria-label={t("store.tracking_event_label")}>
+          {EVENT_OPTIONS.map((option) => (
+            <button
+              key={option.value}
+              type="button"
+              role="radio"
+              aria-checked={conversionEvent === option.value}
+              onClick={() => setConversionEvent(option.value)}
+              className={`cursor-pointer rounded-xl border p-3 text-start transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring ${
+                conversionEvent === option.value
+                  ? "border-primary bg-primary/5"
+                  : "border-border hover:border-primary/40"
+              }`}
+            >
+              <span className="block text-sm font-semibold text-foreground">
+                {t(option.labelKey)}
+              </span>
+              <span className="mt-0.5 block text-xs text-muted-foreground">
+                {t(option.hintKey)}
+              </span>
+            </button>
+          ))}
+        </div>
       </FieldRow>
 
+      <div className="flex items-start justify-between gap-4">
+        <div className="space-y-1">
+          <span className="text-sm font-semibold text-foreground">
+            {t("store.tracking_test_mode_label")}
+          </span>
+          <p className="text-xs text-muted-foreground">{t("store.tracking_test_mode_hint")}</p>
+        </div>
+        <button
+          type="button"
+          role="switch"
+          aria-checked={testMode}
+          onClick={() => setTestMode((current) => !current)}
+          className={`relative inline-flex h-6 w-11 shrink-0 cursor-pointer items-center rounded-full border-2 border-transparent transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring ${
+            testMode ? "bg-primary" : "bg-muted-foreground/30"
+          }`}
+        >
+          <span
+            className={`pointer-events-none inline-block h-4 w-4 transform rounded-full bg-white shadow-sm ring-0 transition-transform ${
+              testMode ? "translate-x-5 rtl:-translate-x-5" : "translate-x-0.5"
+            }`}
+          />
+        </button>
+      </div>
+
+      {testMode && (
+        <p className="rounded-lg border border-amber-500/30 bg-amber-500/10 px-3 py-2 text-xs font-semibold text-amber-600">
+          {t("store.tracking_test_mode_warning")}
+        </p>
+      )}
+
+      {testMode && (
+        <FieldRow label={t("store.tracking_test_code_label")} hint={t("store.tracking_test_code_hint")}>
+          <Input
+            dir="ltr"
+            value={testEventCode}
+            onChange={(event) => setTestEventCode(event.currentTarget.value)}
+            placeholder={t("store.tracking_test_code_placeholder")}
+          />
+        </FieldRow>
+      )}
+
       {lastSaved && (
         <p className="text-xs text-muted-foreground">
           {t("store.tracking_last_saved")}: {new Date(lastSaved).toLocaleString()}
diff --git a/cod-client-astro/src/features/settings/types.ts b/cod-client-astro/src/features/settings/types.ts
index 6522734..a81bb43 100644
--- a/cod-client-astro/src/features/settings/types.ts
+++ b/cod-client-astro/src/features/settings/types.ts
@@ -53,8 +53,11 @@ export interface PixelConfig {
   id: string;
   storeId: string;
   pixelId: string;
-  accessToken: string;
+  adAccountName: string | null;
+  accessTokenMasked: string;
   testEventCode: string | null;
+  conversionEvent: "Lead" | "Purchase";
+  testMode: boolean;
   enabled: boolean;
   createdAt: string;
   updatedAt: string;
@@ -62,8 +65,11 @@ export interface PixelConfig {
 
 export interface SavePixelConfigData {
   pixelId: string;
+  adAccountName?: string | null;
   accessToken?: string;
   testEventCode?: string | null;
+  conversionEvent: "Lead" | "Purchase";
+  testMode?: boolean;
   enabled?: boolean;
 }
 
diff --git a/cod-server/src/db/migrations/0018_pixel_conversion_settings.sql b/cod-server/src/db/migrations/0018_pixel_conversion_settings.sql
new file mode 100644
index 0000000..5f0fde3
--- /dev/null
+++ b/cod-server/src/db/migrations/0018_pixel_conversion_settings.sql
@@ -0,0 +1,10 @@
+-- Tracking settings: merchant-chosen CAPI conversion event + test mode toggle.
+-- conversion_event: which event the merchant optimizes for — 'Lead' (fires at
+-- order placement, deduplicated with the browser pixel) or 'Purchase' (fires
+-- at confirmed delivery). The dashboard requires an explicit choice before
+-- enabling tracking; the column default is defensive only.
+-- test_mode: when 1, CAPI events carry test_event_code to Meta's test stream.
+-- ad_account_name: merchant's own reference label — never sent to Meta.
+ALTER TABLE `store_pixel_config` ADD `ad_account_name` text;--> statement-breakpoint
+ALTER TABLE `store_pixel_config` ADD `conversion_event` text NOT NULL DEFAULT 'Purchase';--> statement-breakpoint
+ALTER TABLE `store_pixel_config` ADD `test_mode` integer NOT NULL DEFAULT 0;
diff --git a/cod-server/src/endpoints/abandoned-orders/store-routes.ts b/cod-server/src/endpoints/abandoned-orders/store-routes.ts
index b77b7ff..fc67e61 100644
--- a/cod-server/src/endpoints/abandoned-orders/store-routes.ts
+++ b/cod-server/src/endpoints/abandoned-orders/store-routes.ts
@@ -62,9 +62,11 @@ async function upsertHandler(c: Context<AppContext>) {
   const db = getDb(c.env.DB);
   const data = (c.req as any).valid("json");
 
+  // X-Forwarded-For first: the storefront worker forwards the shopper's IP
+  // there — CF-Connecting-IP on this hop is the worker itself.
   const ipAddress =
+    c.req.header("X-Forwarded-For")?.split(",")[0]?.trim() ??
     c.req.header("CF-Connecting-IP") ??
-    c.req.header("X-Forwarded-For") ??
     undefined;
   const userAgent = c.req.header("User-Agent") ?? undefined;
 
diff --git a/cod-server/src/endpoints/orders/orders.test.ts b/cod-server/src/endpoints/orders/orders.test.ts
index 648568f..5528c4c 100644
--- a/cod-server/src/endpoints/orders/orders.test.ts
+++ b/cod-server/src/endpoints/orders/orders.test.ts
@@ -52,6 +52,7 @@ vi.mock("@/lib/activity", () => ({
 }));
 vi.mock("@/workflows/capi-helpers", () => ({
   shouldTriggerCapiPurchase: vi.fn(() => false),
+  resolveCapiDispatch: vi.fn(() => ({ send: false, reason: "tracking-disabled", message: "mock skip" })),
 }));
 vi.mock("@/endpoints/delivery-companies/queries");
 vi.mock("@/endpoints/delivery-companies/providers/shipments");
diff --git a/cod-server/src/endpoints/orders/routes.test.ts b/cod-server/src/endpoints/orders/routes.test.ts
index 45eeaba..5e7b10b 100644
--- a/cod-server/src/endpoints/orders/routes.test.ts
+++ b/cod-server/src/endpoints/orders/routes.test.ts
@@ -32,6 +32,7 @@ vi.mock("@/lib/activity", () => ({
 }));
 vi.mock("@/workflows/capi-helpers", () => ({
   shouldTriggerCapiPurchase: vi.fn(() => false),
+  resolveCapiDispatch: vi.fn(() => ({ send: false, reason: "tracking-disabled", message: "mock skip" })),
 }));
 vi.mock("@/endpoints/delivery-companies/queries", () => ({
   getDeliveryCompanyById: vi.fn(async () => ({ id: "comp_1", name: "NOEST" })),
diff --git a/cod-server/src/endpoints/orders/status-transitions.ts b/cod-server/src/endpoints/orders/status-transitions.ts
index fbd4ba4..2c228cb 100644
--- a/cod-server/src/endpoints/orders/status-transitions.ts
+++ b/cod-server/src/endpoints/orders/status-transitions.ts
@@ -75,23 +75,27 @@ export async function updateStatus(c: Context<AppContext>) {
 
   await queries.updateOrderStatus(db, orderId, validated.status, user?.id, user?.name ?? undefined);
 
-  // Fire CAPI Purchase Workflow fire-and-forget — never block the status response.
+  // Fire CAPI Purchase Workflow — never blocks the status response.
+  // waitUntil: the runtime cancels un-awaited promises after the response,
+  // which would silently drop the workflow creation.
   if (shouldTriggerCapiPurchase(validated.status, order.wilayaId)) {
     if (!c.env.CAPI_WORKFLOW) {
       // Binding absent — worker was provisioned before CAPI_WORKFLOW was added.
       // Re-provision the client to activate the binding.
       console.error("[capi-workflow] CAPI_WORKFLOW binding is undefined — worker needs re-provision");
     } else {
-      void c.env.CAPI_WORKFLOW.create({
-        id: `capi-${orderId}-Purchase`,
-        params: {
-          orderId,
-          eventName: "Purchase",
-          triggeredAt: Math.floor(Date.now() / 1000),
-          triggerStatus: validated.status,
-        },
-      }).catch((err: Error) =>
-        console.error("[capi-workflow] trigger failed:", err?.message)
+      c.executionCtx.waitUntil(
+        c.env.CAPI_WORKFLOW.create({
+          id: `capi-${orderId}-Purchase`,
+          params: {
+            orderId,
+            eventName: "Purchase",
+            triggeredAt: Math.floor(Date.now() / 1000),
+            triggerStatus: validated.status,
+          },
+        }).catch((err: Error) =>
+          console.error("[capi-workflow] trigger failed:", err?.message)
+        )
       );
     }
   }
diff --git a/cod-server/src/endpoints/store-otp/phone.ts b/cod-server/src/endpoints/store-otp/phone.ts
index 4279819..1172374 100644
--- a/cod-server/src/endpoints/store-otp/phone.ts
+++ b/cod-server/src/endpoints/store-otp/phone.ts
@@ -24,9 +24,14 @@ function clean(raw: string): string {
 
 export function normalizeAlgerianPhone(raw: string): string | null {
   if (typeof raw !== "string") return null;
-  const phone = clean(raw.trim());
+  let phone = clean(raw.trim());
   if (phone.length < 6 || phone.length > 20) return null;
 
+  // International dialing prefix "00" (e.g. "00213551234567") — treat as "+".
+  if (phone.startsWith("00")) {
+    phone = `+${phone.slice(2)}`;
+  }
+
   // Already international: keep the + form. E.164 allows 7–15 digits after +.
   if (phone.startsWith("+")) {
     return /^\+\d{7,15}$/.test(phone) ? phone : null;
@@ -46,3 +51,16 @@ export function normalizeAlgerianPhone(raw: string): string | null {
 
   return null;
 }
+
+/**
+ * Canonical local form of an Algerian mobile: "0551234567".
+ * Returns null for anything that is not an Algerian mobile (foreign +CC,
+ * landlines, too-short/long inputs). This is the format orders store and
+ * customers are deduplicated on.
+ */
+export function toLocalAlgerianMobile(raw: string): string | null {
+  const e164 = normalizeAlgerianPhone(raw);
+  if (!e164 || !e164.startsWith("+213")) return null;
+  const local = e164.slice(4); // strip "+213"
+  return /^[567]\d{8}$/.test(local) ? `0${local}` : null;
+}
diff --git a/cod-server/src/endpoints/store/CONTEXT.md b/cod-server/src/endpoints/store/CONTEXT.md
index 5e393db..b929c60 100644
--- a/cod-server/src/endpoints/store/CONTEXT.md
+++ b/cod-server/src/endpoints/store/CONTEXT.md
@@ -55,7 +55,7 @@ An order is refused unless the product — or every selected variant — carries
 _Avoid_: Catalog requirement, setup warning
 
 **Lead Mirror**:
-A server-side Meta "Lead" event fired alongside each order using the same event ID as the browser pixel, so Meta deduplicates instead of double-counting. Failure is logged and ignored — it can never block an order.
+A server-side Meta "Lead" event fired alongside each order — only when the merchant chose Lead as the Conversion Event — using the same event ID as the browser pixel, so Meta deduplicates instead of double-counting. Failure is logged and ignored — it can never block an order.
 _Avoid_: Tracking pixel, analytics event
 
 ### Reviews
diff --git a/cod-server/src/endpoints/store/capi-lead-trigger.test.ts b/cod-server/src/endpoints/store/capi-lead-trigger.test.ts
new file mode 100644
index 0000000..c2c9e16
--- /dev/null
+++ b/cod-server/src/endpoints/store/capi-lead-trigger.test.ts
@@ -0,0 +1,147 @@
+/**
+ * CAPI Lead workflow trigger — drives the real createStoreOrder handler
+ * through the mounted store router, pinning:
+ *   - every order creates a durable Lead Workflow (id capi-{orderId}-Lead)
+ *   - creation runs via executionCtx.waitUntil (runtime-safe after response)
+ *   - a failing/missing workflow binding never blocks the order (201)
+ */
+
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { OpenAPIHono } from "@hono/zod-openapi";
+import type { AppContext } from "@/types";
+import { errorHandler } from "@/middleware/error";
+import { openApiValidationHook } from "@/openapi/validation-hook";
+import storeRouter from "./routes";
+import * as storeQueries from "./queries";
+
+vi.mock("@/db", () => ({ getDb: vi.fn(() => ({})) }));
+vi.mock("./queries");
+vi.mock("../../../../cod-shared/queries/otp-config", () => ({
+  getOtpConfigRaw: vi.fn(async () => undefined),
+}));
+
+function orderBody(overrides: Record<string, unknown> = {}) {
+  return {
+    customerName: "Karim Benali",
+    phone: "0551234567",
+    wilayaId: 16,
+    communeId: "c-16-001",
+    deliveryType: "home",
+    productId: "prod-1",
+    productName: "T-shirt",
+    quantity: 1,
+    pricePerUnit: 2500,
+    fbc: "fb.1.1700000000.abc",
+    fbp: "fb.1.1700000001.123",
+    ...overrides,
+  };
+}
+
+function makeApp(workflow?: { create: ReturnType<typeof vi.fn> }) {
+  const app = new OpenAPIHono<AppContext>({ defaultHook: openApiValidationHook });
+  app.use("*", async (c, next) => {
+    c.env = { DB: {}, ...(workflow ? { CAPI_WORKFLOW: workflow } : {}) } as any;
+    c.set("storeId", "store-1");
+    await next();
+  });
+  app.onError(errorHandler);
+  app.route("/store", storeRouter);
+  return app;
+}
+
+function stubSuccessfulOrderFlow() {
+  vi.mocked(storeQueries.validateOrderSkus).mockResolvedValue(null as any);
+  vi.mocked(storeQueries.checkStoreOrderStock).mockResolvedValue(null as any);
+  vi.mocked(storeQueries.findOrCreateCustomer).mockResolvedValue({ id: "cust-1", name: "Karim Benali" } as any);
+  vi.mocked(storeQueries.getDeliveryFee).mockResolvedValue(600 as any);
+  vi.mocked(storeQueries.createStoreOrder).mockResolvedValue({
+    id: "ord-1",
+    orderNumber: "ORD-20260901-0001",
+    price: 2500,
+    deliveryFee: 600,
+  } as any);
+}
+
+async function placeOrder(
+  app: ReturnType<typeof makeApp>,
+  headers: Record<string, string> = {}
+) {
+  const pending: Promise<unknown>[] = [];
+  const executionCtx = {
+    waitUntil: (p: Promise<unknown>) => pending.push(p),
+    passThroughOnException: () => {},
+    props: {} as Record<string, unknown>,
+  };
+  const res = await app.request(
+    "/store/orders",
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Store-API-Key": "key",
+        "CF-Connecting-IP": "41.100.1.1",
+        "User-Agent": "Mozilla/5.0",
+        "Referer": "https://shop.example/prod",
+        ...headers,
+      },
+      body: JSON.stringify(orderBody()),
+    },
+    undefined,
+    executionCtx
+  );
+  await Promise.allSettled(pending);
+  return res;
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  stubSuccessfulOrderFlow();
+});
+
+describe("CAPI Lead workflow trigger", () => {
+  it("creates a durable Lead workflow for every order, via waitUntil", async () => {
+    const workflow = { create: vi.fn(async () => ({ id: "capi-ord-1-Lead" })) };
+    const before = Math.floor(Date.now() / 1000);
+
+    const res = await placeOrder(makeApp(workflow));
+
+    expect(res.status).toBe(201);
+    expect(workflow.create).toHaveBeenCalledOnce();
+    const call = workflow.create.mock.calls[0] as unknown as [
+      { id: string; params: Record<string, unknown> }
+    ];
+    const { id, params } = call[0];
+    expect(id).toBe("capi-ord-1-Lead");
+    expect(params.orderId).toBe("ord-1");
+    expect(params.eventName).toBe("Lead");
+    expect(params.triggerStatus).toBe("order_created");
+    expect(params.eventSourceUrl).toBe("https://shop.example/prod");
+    expect(params.triggeredAt).toBeGreaterThanOrEqual(before);
+    expect(params.triggeredAt).toBeLessThanOrEqual(Math.floor(Date.now() / 1000));
+  });
+
+  it("still returns 201 when workflow creation rejects", async () => {
+    const workflow = { create: vi.fn(async () => { throw new Error("Workflows API down"); }) };
+
+    const res = await placeOrder(makeApp(workflow));
+
+    expect(res.status).toBe(201);
+    expect(workflow.create).toHaveBeenCalledOnce();
+  });
+
+  it("still returns 201 when the CAPI_WORKFLOW binding is absent", async () => {
+    const res = await placeOrder(makeApp());
+
+    expect(res.status).toBe(201);
+  });
+
+  it("normalizes an E.164 phone to the canonical local form before storing", async () => {
+    const workflow = { create: vi.fn(async () => ({})) };
+
+    const res = await placeOrder(makeApp(workflow));
+
+    expect(res.status).toBe(201);
+    const orderArg = vi.mocked(storeQueries.createStoreOrder).mock.calls[0][1];
+    expect(orderArg.phone).toBe("0551234567");
+  });
+});
diff --git a/cod-server/src/endpoints/store/handlers.ts b/cod-server/src/endpoints/store/handlers.ts
index b469740..bc44556 100644
--- a/cod-server/src/endpoints/store/handlers.ts
+++ b/cod-server/src/endpoints/store/handlers.ts
@@ -5,31 +5,8 @@ import * as queries from "./queries";
 import { storeOrderSchema, storeReviewSchema } from "./validation";
 import { NotFoundError, ValidationError, ConflictError, BusinessLogicError } from "@/lib/errors/classes";
 import { ERROR_CODES } from "../../../../cod-shared/errors/codes";
-import { getPixelConfig } from "../../../../cod-shared/queries/pixel-config";
-import { sendCapiEvent } from "@/lib/capi";
 import { assertOtpVerification } from "./otp-gate";
 
-async function sendCapiLeadMirror(
-  db: ReturnType<typeof getDb>,
-  storeId: string,
-  order: { id: string },
-  phone: string,
-  fbc?: string,
-  fbp?: string,
-  ipAddress?: string,
-  userAgent?: string,
-) {
-  const pixelConfig = await getPixelConfig(db, storeId);
-  if (!pixelConfig?.enabled) return;
-  await sendCapiEvent(pixelConfig.pixelId, pixelConfig.accessToken, {
-    eventName: "Lead",
-    eventId: order.id,
-    eventTime: Math.floor(Date.now() / 1000),
-    userData: { phone, fbc, fbp, clientIpAddress: ipAddress, clientUserAgent: userAgent },
-    testEventCode: pixelConfig.testEventCode,
-  });
-}
-
 export async function getStoreConfig(c: Context<AppContext>) {
   const storeId = c.get("storeId")!;
   const db = getDb(c.env.DB);
@@ -132,9 +109,11 @@ export async function createStoreOrder(c: Context<AppContext>) {
     data.deliveryType
   );
 
+  // X-Forwarded-For first: the storefront worker forwards the shopper's IP
+  // there — CF-Connecting-IP on this hop is the worker itself.
   const ipAddress =
-    c.req.header("CF-Connecting-IP") ??
     c.req.header("X-Forwarded-For")?.split(",")[0]?.trim() ??
+    c.req.header("CF-Connecting-IP") ??
     undefined;
   const userAgent = c.req.header("User-Agent") ?? undefined;
 
@@ -147,13 +126,29 @@ export async function createStoreOrder(c: Context<AppContext>) {
     userAgent,
   });
 
-  // Inline CAPI Lead mirror — server-side counterpart to the browser Pixel Lead.
-  // Uses the same event_id (order.id) so Meta deduplicates within 48h.
-  // Fire-and-forget: a CAPI failure must never block order confirmation.
-  const storeId = c.get("storeId")!;
-  void sendCapiLeadMirror(db, storeId, order, data.phone, data.fbc, data.fbp, ipAddress, userAgent).catch(
-    (err) => console.warn("[capi-lead-mirror] failed:", err?.message)
-  );
+  // CAPI Lead event — durable Workflow (same path as Purchase). waitUntil:
+  // the Workers runtime cancels un-awaited promises once the response is
+  // sent, which would silently drop the workflow creation. The workflow
+  // gates on the merchant's conversion-event choice, retries Meta 5xx, and
+  // audit-logs every outcome. A failure can never block order confirmation.
+  if (c.env.CAPI_WORKFLOW) {
+    c.executionCtx.waitUntil(
+      c.env.CAPI_WORKFLOW.create({
+        id: `capi-${order.id}-Lead`,
+        params: {
+          orderId: order.id,
+          eventName: "Lead",
+          triggeredAt: Math.floor(Date.now() / 1000),
+          triggerStatus: "order_created",
+          eventSourceUrl: c.req.header("Referer") ?? undefined,
+        },
+      }).catch((err: unknown) =>
+        console.error("[capi-workflow] lead trigger failed:", (err as Error)?.message)
+      )
+    );
+  } else {
+    console.error("[capi-workflow] CAPI_WORKFLOW binding is undefined — worker needs re-provision");
+  }
 
   return c.json(
     {
diff --git a/cod-server/src/endpoints/store/otp-gate.test.ts b/cod-server/src/endpoints/store/otp-gate.test.ts
index fbc3416..e88cea4 100644
--- a/cod-server/src/endpoints/store/otp-gate.test.ts
+++ b/cod-server/src/endpoints/store/otp-gate.test.ts
@@ -25,6 +25,7 @@ vi.mock("@/db", () => ({ getDb: vi.fn(() => ({})) }));
 vi.mock("./queries");
 vi.mock("@/workflows/capi-helpers", () => ({
   shouldTriggerCapiPurchase: vi.fn(() => false),
+  resolveCapiDispatch: vi.fn(() => ({ send: false, reason: "tracking-disabled", message: "mock skip" })),
 }));
 vi.mock("../../../../cod-shared/queries/otp-config");
 vi.mock("@/lib/capi", () => ({ sendCapiEvent: vi.fn(async () => undefined) }));
@@ -74,11 +75,20 @@ function stubSuccessfulOrderFlow() {
 }
 
 async function place(app: ReturnType<typeof makeApp>, body: Record<string, unknown>) {
-  return app.request("/store/orders", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(body),
-  });
+  const pending: Promise<unknown>[] = [];
+  const executionCtx = { waitUntil: (p: Promise<unknown>) => pending.push(p), passThroughOnException: () => {}, props: {} as Record<string, unknown> };
+  const res = await app.request(
+    "/store/orders",
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    },
+    undefined,
+    executionCtx
+  );
+  await Promise.allSettled(pending);
+  return res;
 }
 
 describe("createStoreOrder OTP gate", () => {
diff --git a/cod-server/src/endpoints/store/routes.test.ts b/cod-server/src/endpoints/store/routes.test.ts
index db582ea..3869928 100644
--- a/cod-server/src/endpoints/store/routes.test.ts
+++ b/cod-server/src/endpoints/store/routes.test.ts
@@ -218,11 +218,18 @@ describe("Store API routes (OpenAPIHono)", () => {
         deliveryFee: 600,
       } as any);
 
-      const res = await app.request("/store/orders", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(validOrder),
-      });
+      const pending: Promise<unknown>[] = [];
+      const res = await app.request(
+        "/store/orders",
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(validOrder),
+        },
+        undefined,
+        { waitUntil: (p: Promise<unknown>) => pending.push(p), passThroughOnException: () => {}, props: {} as Record<string, unknown> }
+      );
+      await Promise.allSettled(pending);
 
       expect(res.status).toBe(201);
       const body: any = await res.json();
diff --git a/cod-server/src/endpoints/store/validation.test.ts b/cod-server/src/endpoints/store/validation.test.ts
new file mode 100644
index 0000000..bedf258
--- /dev/null
+++ b/cod-server/src/endpoints/store/validation.test.ts
@@ -0,0 +1,63 @@
+import { describe, it, expect } from "vitest";
+import { storeOrderSchema } from "./validation";
+import { toLocalAlgerianMobile } from "@/endpoints/store-otp/phone";
+
+function orderWith(phone: string) {
+  return {
+    customerName: "Karim Benali",
+    phone,
+    wilayaId: 16,
+    communeId: "c-16-001",
+    productId: "prod-1",
+    productName: "T-shirt",
+    quantity: 1,
+    pricePerUnit: 2500,
+  };
+}
+
+describe("toLocalAlgerianMobile", () => {
+  it.each([
+    ["0551234567", "0551234567"],
+    ["055 12 34 567", "0551234567"],
+    ["+213551234567", "0551234567"],
+    ["213551234567", "0551234567"],
+    ["00213551234567", "0551234567"],
+    ["0661234567", "0661234567"],
+    ["0771234567", "0771234567"],
+  ])("normalizes %s → %s", (input, expected) => {
+    expect(toLocalAlgerianMobile(input)).toBe(expected);
+  });
+
+  it.each([
+    "12345",           // garbage
+    "05512345",        // too short
+    "05512345678",     // too long
+    "041123456",       // landline (04 prefix)
+    "0812345678",      // invalid prefix
+    "+33123456789",    // foreign number
+    "0000000000",      // zeros
+  ])("rejects %s", (input) => {
+    expect(toLocalAlgerianMobile(input)).toBeNull();
+  });
+});
+
+describe("storeOrderSchema phone", () => {
+  it("accepts a local mobile and normalizes E.164/international forms to local", () => {
+    expect(storeOrderSchema.parse(orderWith("0551234567")).phone).toBe("0551234567");
+    expect(storeOrderSchema.parse(orderWith("+213 551 234 567")).phone).toBe("0551234567");
+    expect(storeOrderSchema.parse(orderWith("00213551234567")).phone).toBe("0551234567");
+  });
+
+  it("rejects non-Algerian-mobile phones with the Arabic error message", () => {
+    const result = storeOrderSchema.safeParse(orderWith("123456"));
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues[0].message).toContain("05");
+    }
+  });
+
+  it("rejects landlines and foreign numbers", () => {
+    expect(storeOrderSchema.safeParse(orderWith("041123456")).success).toBe(false);
+    expect(storeOrderSchema.safeParse(orderWith("+33123456789")).success).toBe(false);
+  });
+});
diff --git a/cod-server/src/endpoints/store/validation.ts b/cod-server/src/endpoints/store/validation.ts
index 7b8abaf..2a42b4a 100644
--- a/cod-server/src/endpoints/store/validation.ts
+++ b/cod-server/src/endpoints/store/validation.ts
@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { toLocalAlgerianMobile } from "@/endpoints/store-otp/phone";
 
 export const variantSelectionSchema = z.object({
   variantId: z.string().min(1),
@@ -7,7 +8,17 @@ export const variantSelectionSchema = z.object({
 
 export const storeOrderSchema = z.object({
   customerName: z.string().min(2).max(100),
-  phone: z.string().min(9).max(20),
+  // Algerian mobile only, normalized to the canonical local form "05XXXXXXXX".
+  // Accepts 05…, +2135…, 2135…, 002135… with separators; rejects landlines,
+  // foreign numbers, and short/long garbage. Canonical form keeps customer
+  // deduplication stable regardless of how the shopper typed the number.
+  phone: z.preprocess(
+    (v) => (typeof v === "string" ? toLocalAlgerianMobile(v) ?? v : v),
+    z.string().regex(
+      /^0[567]\d{8}$/,
+      "رقم الهاتف غير صحيح — أدخل رقماً جزائرياً يبدأ بـ 05 أو 06 أو 07"
+    )
+  ),
   wilayaId: z.number().int().min(1).max(58),
   communeId: z.string().min(1),
   address: z.string().max(300).optional(),
diff --git a/cod-server/src/endpoints/stores/CONTEXT.md b/cod-server/src/endpoints/stores/CONTEXT.md
index d64c9c3..94ecda7 100644
--- a/cod-server/src/endpoints/stores/CONTEXT.md
+++ b/cod-server/src/endpoints/stores/CONTEXT.md
@@ -47,11 +47,28 @@ _Avoid_: Rating toggle, feedback switch
 ### Tracking
 
 **Pixel Config**:
-The Meta pixel integration: pixel ID, access token, optional test-event code, and an enabled switch. Absent until first saved; upserted thereafter.
+The Meta pixel integration: pixel ID, ad-account label, access token, the conversion-event choice, and an enabled switch. Absent until first saved; upserted thereafter.
 _Avoid_: Analytics account, tracking cookie
 
+**Ad Account Name**:
+The merchant's own label for the Meta ad account this pixel belongs to — reference only, never sent to Meta.
+_Avoid_: Account ID, billing account
+
+**Conversion Event**:
+The merchant's choice of which Conversions API event to optimize for — Lead at order placement or Purchase at confirmed delivery. Saving requires the choice explicitly; the platform never defaults it for the merchant.
+_Avoid_: Default event, optimization goal, primary event
+
+**Test Mode**:
+A switch routing Conversions API events to Meta's test stream instead of production measurement. Browser pixel events are unaffected — Meta's Test Events tool catches those itself.
+_Avoid_: Sandbox, debug mode, staging
+
 **Test Event Code**:
-A routing flag that sends events to Meta's test stream during integration work — must be cleared for production measurement.
+The code Meta's Test Events tool generates — attached to server events only while Test Mode is on, and never counted for real measurement.
+_Avoid_: Debug code, sandbox key
+
+**Access Token**:
+The Meta system-user token used for server-side events. Write-only through the API — reads return a masked hint, and saving with an empty token keeps the stored one.
+_Avoid_: API key, login credential
 
 ### Email
 
@@ -89,6 +106,6 @@ Terms owned by neighboring contexts — use them, don't redefine them here:
 
 **Currency symbol is cosmetic**: Merchants can retitle the symbol shoppers see while every amount in the system remains DZD integer math underneath.
 
-**Pixel defaults fill silently**: Saving without an access token stores an empty string and enables tracking — omission equals permissive.
+**Pixel token keeps on empty**: Saving without an access token keeps the previously stored token — the key is write-only and reads return only a masked hint (same rule as the verification and email keys, ADR-0001). Saving still requires the conversion-event choice.
 
 **The email key never comes back**: Like the verification key, the Sendili API key is write-only through the API — reads return a masked hint, and saving with an empty key keeps the stored one. (Storage decision: ADR-0001.)
diff --git a/cod-server/src/endpoints/stores/handlers.ts b/cod-server/src/endpoints/stores/handlers.ts
index ee622fe..36f3b72 100644
--- a/cod-server/src/endpoints/stores/handlers.ts
+++ b/cod-server/src/endpoints/stores/handlers.ts
@@ -42,17 +42,37 @@ export async function updateMyStore(c: Context<AppContext>) {
 
 const pixelConfigSchema = z.object({
   pixelId: z.string().min(1),
+  adAccountName: z.string().max(200).nullable().optional(),
   accessToken: z.string().default(""),
-  testEventCode: z.string().optional().nullable(),
+  testEventCode: z.string().nullable().optional(),
+  conversionEvent: z.enum(["Lead", "Purchase"]),
+  testMode: z.boolean().optional(),
   enabled: z.boolean().optional(),
 });
 
+/** Safe projection — the access token never leaves the API, only a masked hint. */
+function pixelConfigResponse(row: NonNullable<Awaited<ReturnType<typeof queryPixelConfig>>>) {
+  return {
+    id: row.id,
+    storeId: row.storeId,
+    pixelId: row.pixelId,
+    adAccountName: row.adAccountName,
+    accessTokenMasked: maskApiKey(row.accessToken),
+    testEventCode: row.testEventCode,
+    conversionEvent: row.conversionEvent,
+    testMode: row.testMode,
+    enabled: row.enabled,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}
+
 export async function getPixelConfig(c: Context<AppContext>) {
   const db = getDb(c.env.DB);
   const store = await queries.getStore(db);
   if (!store) throw new NotFoundError("Store");
   const config = await queryPixelConfig(db, store.id);
-  return c.json({ success: true, data: config ?? null }, 200);
+  return c.json({ success: true, data: config ? pixelConfigResponse(config) : null }, 200);
 }
 
 export async function savePixelConfig(c: Context<AppContext>) {
@@ -65,7 +85,7 @@ export async function savePixelConfig(c: Context<AppContext>) {
   if (!result) {
     throw new SystemError("Failed to save pixel config");
   }
-  return c.json({ success: true, data: result }, 200);
+  return c.json({ success: true, data: pixelConfigResponse(result) }, 200);
 }
 
 // ─── WhatsApp OTP verification config (dzverify) ──────────────────────────────
diff --git a/cod-server/src/endpoints/stores/routes.test.ts b/cod-server/src/endpoints/stores/routes.test.ts
index c55abc6..b6d8eb8 100644
--- a/cod-server/src/endpoints/stores/routes.test.ts
+++ b/cod-server/src/endpoints/stores/routes.test.ts
@@ -58,8 +58,11 @@ function pixelConfigRow(overrides: Record<string, any> = {}) {
     id: "pix_1",
     storeId: "store_1",
     pixelId: "1234567890123456",
+    adAccountName: "Main Ad Account",
     accessToken: "EAAG...",
     testEventCode: null,
+    conversionEvent: "Purchase" as const,
+    testMode: false,
     enabled: true,
     createdAt: NOW,
     updatedAt: NOW,
@@ -166,7 +169,7 @@ describe("Stores routes (OpenAPIHono)", () => {
   });
 
   describe("GET /api/stores/pixel-config", () => {
-    it("returns 200 with pixel configuration", async () => {
+    it("returns 200 with the pixel configuration — token masked, never returned", async () => {
       vi.mocked(queries.getStore).mockResolvedValue(storeRow());
       vi.mocked(pixelConfigQueries.getPixelConfig).mockResolvedValue(pixelConfigRow());
 
@@ -176,6 +179,9 @@ describe("Stores routes (OpenAPIHono)", () => {
       const body: any = await res.json();
       expect(body.data.pixelId).toBe("1234567890123456");
       expect(body.data.enabled).toBe(true);
+      expect(body.data.conversionEvent).toBe("Purchase");
+      expect(body.data.accessTokenMasked).toBe("••••G...");
+      expect(JSON.stringify(body)).not.toContain("EAAG");
     });
 
     it("returns 200 with null data when not configured", async () => {
@@ -206,12 +212,75 @@ describe("Stores routes (OpenAPIHono)", () => {
       const res = await app.request("/api/stores/pixel-config", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ pixelId: "1234567890123456" }),
+        body: JSON.stringify({ pixelId: "1234567890123456", conversionEvent: "Purchase" }),
       });
 
       expect(res.status).toBe(200);
       const body: any = await res.json();
       expect(body.data.pixelId).toBe("1234567890123456");
+      expect(body.data.accessTokenMasked).toBe("••••G...");
+      expect(JSON.stringify(body)).not.toContain("EAAG");
+    });
+
+    it("accepts Lead as the conversion event and passes the new fields through", async () => {
+      vi.mocked(queries.getStore).mockResolvedValue(storeRow());
+      vi.mocked(pixelConfigQueries.upsertPixelConfig).mockResolvedValue(
+        pixelConfigRow({ conversionEvent: "Lead", testMode: true, adAccountName: "Somer Ads" })
+      );
+
+      const res = await app.request("/api/stores/pixel-config", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          pixelId: "1234567890123456",
+          adAccountName: "Somer Ads",
+          conversionEvent: "Lead",
+          testMode: true,
+          testEventCode: "TEST123",
+        }),
+      });
+
+      expect(res.status).toBe(200);
+      const body: any = await res.json();
+      expect(body.data.conversionEvent).toBe("Lead");
+      expect(body.data.testMode).toBe(true);
+      expect(pixelConfigQueries.upsertPixelConfig).toHaveBeenCalledWith(
+        mockDb,
+        "store_1",
+        expect.objectContaining({
+          pixelId: "1234567890123456",
+          adAccountName: "Somer Ads",
+          conversionEvent: "Lead",
+          testMode: true,
+          testEventCode: "TEST123",
+        })
+      );
+    });
+
+    it("returns 400 when conversionEvent is missing — the merchant must choose explicitly", async () => {
+      vi.mocked(queries.getStore).mockResolvedValue(storeRow());
+
+      const res = await app.request("/api/stores/pixel-config", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ pixelId: "1234567890123456" }),
+      });
+
+      expect(res.status).toBe(400);
+      const body: any = await res.json();
+      expect(body).toMatchObject({ category: ERROR_CATEGORIES.VALIDATION });
+    });
+
+    it("returns 400 when conversionEvent is not Lead or Purchase", async () => {
+      vi.mocked(queries.getStore).mockResolvedValue(storeRow());
+
+      const res = await app.request("/api/stores/pixel-config", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ pixelId: "1234567890123456", conversionEvent: "AddToCart" }),
+      });
+
+      expect(res.status).toBe(400);
     });
 
     it("returns 400 when pixelId is missing", async () => {
@@ -236,7 +305,7 @@ describe("Stores routes (OpenAPIHono)", () => {
       const res = await app.request("/api/stores/pixel-config", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ pixelId: "123" }),
+        body: JSON.stringify({ pixelId: "123", conversionEvent: "Purchase" }),
       });
 
       expect(res.status).toBe(404);
diff --git a/cod-server/src/endpoints/stores/routes.ts b/cod-server/src/endpoints/stores/routes.ts
index 6e19d54..4b04c6f 100644
--- a/cod-server/src/endpoints/stores/routes.ts
+++ b/cod-server/src/endpoints/stores/routes.ts
@@ -49,8 +49,14 @@ const updateStoreBodySchema = z.object({
 
 const savePixelBodySchema = z.object({
   pixelId: z.string().min(1),
-  accessToken: z.string().default(""),
+  adAccountName: z.string().max(200).nullable().optional(),
+  accessToken: z.string().default("").openapi({
+    description:
+      "Meta access token. Empty string keeps the previously stored token (the token is never sent back to the client).",
+  }),
   testEventCode: z.string().nullable().optional(),
+  conversionEvent: z.enum(["Lead", "Purchase"]),
+  testMode: z.boolean().optional(),
   enabled: z.boolean().optional(),
 });
 
@@ -123,7 +129,7 @@ const savePixelConfigRoute = defineRoute({
   tags: ["Store Settings"],
   summary: "Save pixel configuration",
   description:
-    "Upserts the store's Meta pixel tracking configuration. Omitted optional fields fall back to defaults (`accessToken` empty, `enabled` true).",
+    "Upserts the store's Meta pixel tracking configuration. `conversionEvent` is required — the merchant explicitly chooses whether the Conversions API optimizes for `Lead` (fires at order placement, deduplicated with the browser pixel) or `Purchase` (fires at confirmed delivery). An empty `accessToken` keeps the previously stored token.",
   operationId: "savePixelConfig",
   body: savePixelBodySchema,
   responses: {
diff --git a/cod-server/src/endpoints/webhooks/handlers.ts b/cod-server/src/endpoints/webhooks/handlers.ts
index e9c631b..d39e06c 100644
--- a/cod-server/src/endpoints/webhooks/handlers.ts
+++ b/cod-server/src/endpoints/webhooks/handlers.ts
@@ -196,16 +196,18 @@ export async function handleZrWebhook(c: Context<AppContext>) {
       "webhook:zr_express"
     );
 
-    if (updated && shouldTriggerCapiPurchase(newStatus, resolvedOrder.wilayaId)) {
-      if (!c.env.CAPI_WORKFLOW) {
-        console.error("[capi-workflow] CAPI_WORKFLOW binding is undefined — worker needs re-provision");
-      } else {
-        void c.env.CAPI_WORKFLOW.create({
-          id: `capi-${resolvedOrder.id}-Purchase`,
-          params: { orderId: resolvedOrder.id, eventName: "Purchase", triggeredAt: Math.floor(Date.now() / 1000), triggerStatus: newStatus },
-        }).catch((err: unknown) => console.error("[capi-workflow] zr trigger failed:", (err as Error)?.message));
+      if (updated && shouldTriggerCapiPurchase(newStatus, resolvedOrder.wilayaId)) {
+        if (!c.env.CAPI_WORKFLOW) {
+          console.error("[capi-workflow] CAPI_WORKFLOW binding is undefined — worker needs re-provision");
+        } else {
+          c.executionCtx.waitUntil(
+            c.env.CAPI_WORKFLOW.create({
+              id: `capi-${resolvedOrder.id}-Purchase`,
+              params: { orderId: resolvedOrder.id, eventName: "Purchase", triggeredAt: Math.floor(Date.now() / 1000), triggerStatus: newStatus },
+            }).catch((err: unknown) => console.error("[capi-workflow] zr trigger failed:", (err as Error)?.message))
+          );
+        }
       }
-    }
 
     await updateWebhookEvent(db, webhookEventId, {
       result: updated ? "ok" : "ignored",
@@ -407,10 +409,12 @@ export async function handleYalidineWebhook(c: Context<AppContext>) {
         if (!c.env.CAPI_WORKFLOW) {
           console.error("[capi-workflow] CAPI_WORKFLOW binding is undefined — worker needs re-provision");
         } else {
-          void c.env.CAPI_WORKFLOW.create({
-            id: `capi-${order.id}-Purchase`,
-            params: { orderId: order.id, eventName: "Purchase", triggeredAt: Math.floor(Date.now() / 1000), triggerStatus: nextStatus },
-          }).catch((err: unknown) => console.error("[capi-workflow] yalidine trigger failed:", (err as Error)?.message));
+          c.executionCtx.waitUntil(
+            c.env.CAPI_WORKFLOW.create({
+              id: `capi-${order.id}-Purchase`,
+              params: { orderId: order.id, eventName: "Purchase", triggeredAt: Math.floor(Date.now() / 1000), triggerStatus: nextStatus },
+            }).catch((err: unknown) => console.error("[capi-workflow] yalidine trigger failed:", (err as Error)?.message))
+          );
         }
       }
 
diff --git a/cod-server/src/endpoints/webhooks/webhooks.test.ts b/cod-server/src/endpoints/webhooks/webhooks.test.ts
index 462d258..78297b2 100644
--- a/cod-server/src/endpoints/webhooks/webhooks.test.ts
+++ b/cod-server/src/endpoints/webhooks/webhooks.test.ts
@@ -66,6 +66,7 @@ vi.mock("./yalidine-status-mapper", () => ({
 
 vi.mock("@/workflows/capi-helpers", () => ({
   shouldTriggerCapiPurchase: vi.fn().mockReturnValue(false),
+  resolveCapiDispatch: vi.fn(() => ({ send: false, reason: "tracking-disabled", message: "mock skip" })),
 }));
 
 import { getDeliveryCompanyByCode } from "@/endpoints/delivery-companies/queries";
diff --git a/cod-server/src/lib/capi-log.ts b/cod-server/src/lib/capi-log.ts
new file mode 100644
index 0000000..09bd1cd
--- /dev/null
+++ b/cod-server/src/lib/capi-log.ts
@@ -0,0 +1,32 @@
+import { capiEventLog } from "@/db/schema";
+import type { getDb } from "@/db";
+
+export type CapiLogStatus = "sent" | "failed" | "skipped";
+
+export interface CapiLogEntry {
+  orderId: string;
+  eventName: "Lead" | "Purchase";
+  status: CapiLogStatus;
+  metaEventId?: string | null;
+  error?: string | null;
+}
+
+/**
+ * Audit row for every CAPI outcome. Fire-and-forget by design — an audit
+ * write failure must never propagate into order or delivery flows.
+ */
+export async function logCapiEvent(db: ReturnType<typeof getDb>, entry: CapiLogEntry): Promise<void> {
+  try {
+    await db.insert(capiEventLog).values({
+      id: crypto.randomUUID(),
+      orderId: entry.orderId,
+      eventName: entry.eventName,
+      status: entry.status,
+      metaEventId: entry.metaEventId ?? null,
+      error: entry.error ?? null,
+      sentAt: new Date().toISOString(),
+    });
+  } catch (err) {
+    console.warn("[capi-log] failed to write audit row:", err instanceof Error ? err.message : err);
+  }
+}
diff --git a/cod-server/src/lib/capi.test.ts b/cod-server/src/lib/capi.test.ts
new file mode 100644
index 0000000..5ef61de
--- /dev/null
+++ b/cod-server/src/lib/capi.test.ts
@@ -0,0 +1,234 @@
+import { describe, it, expect, afterEach, vi } from "vitest";
+import { sendCapiEvent, type CapiEventPayload } from "./capi";
+
+/**
+ * Meta CAPI client — payload shape, hashing/normalisation, and error
+ * classification. Fixed SHA-256 vectors (lowercase, whitespace-stripped
+ * inputs) were precomputed with Node crypto.
+ */
+
+const PH_213555123456 = "57bc2227c5cf190ba5390a9a06771e92b4863d7054546c3856e44ec12e56a5e3";
+const CT_AINOUSSERA = "bff099d55f6e1eaf21a4308943012fc0357d961032e632ee0759398ccc02d2b8";
+const CT_SIDIMHAMED = "e91c59e06a0de2500bbf97ffea89ff0e8800bdaf36075c92b587fad41c916096";
+const FN_MOHAMED = "575e500ddb529cc2e5b14dd6e7feb389a8b6e0d7c2b162b6bf31831c64d23592";
+const LN_BENALI = "cbf639d625d373b0cb767a553cd1a5e6c72a0224080f8187913d3067370db914";
+const FN_ARABIC = "0cb4c9b21062de4d2c0edd48efc9fa86b97fdc8a6a4e7fa7092544f84e121f61";
+const EXT_CUST123 = "fc3ce5a6986e1e0556c777fcaa0dfb75642361b8f7332c672a3799aa0e709127";
+const ZP_16000 = "2570901c76653e578fecf066b5fc3fa1619f1a051e928e39797bab1b1342bf40";
+const COUNTRY_DZ = "2a92270185a50d8020949f2cfb2125d1af1c2bd3dd92eada9210fcdb5c4310bf";
+
+const PIXEL = "1234567890";
+const TOKEN = "EAAG-test-token";
+
+function basePayload(overrides: Partial<CapiEventPayload> = {}): CapiEventPayload {
+  return {
+    eventName: "Purchase",
+    eventId: "order-1",
+    eventTime: 1700000000,
+    userData: { phone: "0555123456" },
+    value: 5000,
+    currency: "DZD",
+    contentIds: ["prod-1"],
+    ...overrides,
+  };
+}
+
+function metaOk() {
+  return new Response(JSON.stringify({ events_received: 1, fbtrace_id: "TRACE1" }), { status: 200 });
+}
+
+interface Captured {
+  url: string;
+  body: any;
+}
+
+function stubFetch(response: () => Response): Captured {
+  const captured: Captured = { url: "", body: null };
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async (url: string, init: RequestInit) => {
+      captured.url = url;
+      captured.body = JSON.parse(init.body as string);
+      return response();
+    })
+  );
+  return captured;
+}
+
+afterEach(() => vi.unstubAllGlobals());
+
+describe("sendCapiEvent — request shape", () => {
+  it("posts to the current Graph API version with the token in the query string", async () => {
+    const captured = stubFetch(metaOk);
+    await sendCapiEvent(PIXEL, TOKEN, basePayload());
+    expect(captured.url).toBe(
+      `https://graph.facebook.com/v26.0/${PIXEL}/events?access_token=${TOKEN}`
+    );
+  });
+
+  it("sends the canonical event envelope", async () => {
+    const captured = stubFetch(metaOk);
+    await sendCapiEvent(PIXEL, TOKEN, basePayload({ eventSourceUrl: "https://store.example/prod" }));
+    const [event] = captured.body.data;
+    expect(event.event_name).toBe("Purchase");
+    expect(event.event_id).toBe("order-1");
+    expect(event.event_time).toBe(1700000000);
+    expect(event.action_source).toBe("website");
+    expect(event.event_source_url).toBe("https://store.example/prod");
+    expect(event.custom_data).toEqual({
+      value: 5000,
+      currency: "DZD",
+      content_ids: ["prod-1"],
+      content_type: "product",
+    });
+  });
+
+  it("omits custom_data and event_source_url when not provided", async () => {
+    const captured = stubFetch(metaOk);
+    await sendCapiEvent(
+      PIXEL,
+      TOKEN,
+      basePayload({ value: undefined, contentIds: undefined, eventSourceUrl: undefined })
+    );
+    const [event] = captured.body.data;
+    expect(event.custom_data).toBeUndefined();
+    expect(event.event_source_url).toBeUndefined();
+  });
+
+  it("includes test_event_code only when provided", async () => {
+    const without = stubFetch(metaOk);
+    await sendCapiEvent(PIXEL, TOKEN, basePayload());
+    expect(without.body.test_event_code).toBeUndefined();
+
+    const withCode = stubFetch(metaOk);
+    await sendCapiEvent(PIXEL, TOKEN, basePayload({ testEventCode: "TEST123" }));
+    expect(withCode.body.test_event_code).toBe("TEST123");
+  });
+});
+
+describe("sendCapiEvent — user_data hashing and normalisation", () => {
+  it("hashes phone and country, passes fbc/fbp/ip/ua through unhashed", async () => {
+    const captured = stubFetch(metaOk);
+    await sendCapiEvent(PIXEL, TOKEN, {
+      ...basePayload(),
+      userData: {
+        phone: "0555123456",
+        fbc: "fb.1.1700000000.abc",
+        fbp: "fb.1.1700000001.123",
+        clientIpAddress: "41.100.1.1",
+        clientUserAgent: "Mozilla/5.0",
+      },
+    });
+    const ud = captured.body.data[0].user_data;
+    expect(ud.ph).toBe(PH_213555123456);
+    expect(ud.country).toBe(COUNTRY_DZ);
+    expect(ud.fbc).toBe("fb.1.1700000000.abc");
+    expect(ud.fbp).toBe("fb.1.1700000001.123");
+    expect(ud.client_ip_address).toBe("41.100.1.1");
+    expect(ud.client_user_agent).toBe("Mozilla/5.0");
+  });
+
+  it.each(["0555123456", "00213555123456", "+213 555 12 34 56", "213555123456"])(
+    "normalises every DZ phone form to 213… (%s)",
+    async (phone) => {
+      const captured = stubFetch(metaOk);
+      await sendCapiEvent(PIXEL, TOKEN, basePayload({ userData: { phone } }));
+      expect(captured.body.data[0].user_data.ph).toBe(PH_213555123456);
+    }
+  );
+
+  it("folds diacritics and strips punctuation/spaces from city", async () => {
+    const captured = stubFetch(metaOk);
+    await sendCapiEvent(PIXEL, TOKEN, {
+      ...basePayload(),
+      userData: { phone: "0555123456", city: "Aïn Oussera" },
+    });
+    expect(captured.body.data[0].user_data.ct).toBe(CT_AINOUSSERA);
+
+    const captured2 = stubFetch(metaOk);
+    await sendCapiEvent(PIXEL, TOKEN, {
+      ...basePayload(),
+      userData: { phone: "0555123456", city: "Sidi M'hamed" },
+    });
+    expect(captured2.body.data[0].user_data.ct).toBe(CT_SIDIMHAMED);
+  });
+
+  it("hashes first/last names, keeping Unicode letters (Arabic survives)", async () => {
+    const captured = stubFetch(metaOk);
+    await sendCapiEvent(PIXEL, TOKEN, {
+      ...basePayload(),
+      userData: { phone: "0555123456", firstName: "Mohamed", lastName: "Ben-Ali" },
+    });
+    const ud = captured.body.data[0].user_data;
+    expect(ud.fn).toBe(FN_MOHAMED);
+    expect(ud.ln).toBe(LN_BENALI);
+
+    const capturedAr = stubFetch(metaOk);
+    await sendCapiEvent(PIXEL, TOKEN, {
+      ...basePayload(),
+      userData: { phone: "0555123456", firstName: "محمد" },
+    });
+    expect(capturedAr.body.data[0].user_data.fn).toBe(FN_ARABIC);
+  });
+
+  it("hashes external_id and postal code", async () => {
+    const captured = stubFetch(metaOk);
+    await sendCapiEvent(PIXEL, TOKEN, {
+      ...basePayload(),
+      userData: { phone: "0555123456", externalId: "cust-123", postalCode: "16000" },
+    });
+    const ud = captured.body.data[0].user_data;
+    expect(ud.external_id).toBe(EXT_CUST123);
+    expect(ud.zp).toBe(ZP_16000);
+  });
+
+  it("omits optional user_data keys entirely when absent", async () => {
+    const captured = stubFetch(metaOk);
+    await sendCapiEvent(PIXEL, TOKEN, basePayload());
+    const ud = captured.body.data[0].user_data;
+    expect(Object.keys(ud).sort()).toEqual(["country", "ph"]);
+  });
+});
+
+describe("sendCapiEvent — error classification", () => {
+  it("throws on network failure (retryable)", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => {
+        throw new Error("ECONNRESET");
+      })
+    );
+    await expect(sendCapiEvent(PIXEL, TOKEN, basePayload())).rejects.toThrow("Meta CAPI network error");
+  });
+
+  it("throws on Meta 5xx (retryable)", async () => {
+    const captured = stubFetch(
+      () => new Response(JSON.stringify({ error: { message: "Transient failure" } }), { status: 502 })
+    );
+    await expect(sendCapiEvent(PIXEL, TOKEN, basePayload())).rejects.toThrow(
+      "Meta CAPI server error 502: Transient failure"
+    );
+    expect(captured.body.data).toBeDefined();
+  });
+
+  it("returns success:false on Meta 4xx (not retryable — batch rejected)", async () => {
+    stubFetch(
+      () =>
+        new Response(
+          JSON.stringify({ error: { message: "(#100) Param event_time is invalid" } }),
+          { status: 400 }
+        )
+    );
+    const result = await sendCapiEvent(PIXEL, TOKEN, basePayload());
+    expect(result).toEqual({
+      success: false,
+      error: "(#100) Param event_time is invalid",
+    });
+  });
+
+  it("returns success with fbtrace_id on a 2xx events_received=1", async () => {
+    stubFetch(metaOk);
+    const result = await sendCapiEvent(PIXEL, TOKEN, basePayload());
+    expect(result).toEqual({ success: true, fbtrace_id: "TRACE1" });
+  });
+});
diff --git a/cod-server/src/lib/capi.ts b/cod-server/src/lib/capi.ts
index 5657a42..b66c013 100644
--- a/cod-server/src/lib/capi.ts
+++ b/cod-server/src/lib/capi.ts
@@ -1,16 +1,19 @@
 /**
- * Meta Conversions API (CAPI) helper.
+ * Meta Conversions API (CAPI) client.
  *
  * Shared by:
- *  - store/handlers.ts  — inline Lead mirror at order placement
- *  - workflows/capi.ts  — durable Purchase event at delivery
+ *  - endpoints/store/handlers.ts — inline Lead mirror at order placement
+ *  - workflows/capi.ts           — durable Purchase event at delivery
  *
  * All PII is SHA-256 hashed before sending (Meta requirement).
- * Phone is normalised: strip leading 0, prefix country code 213 (Algeria).
+ * Phones are normalised to the Algerian country code 213.
+ * Throws on network errors and Meta 5xx (retryable by the Workflow);
+ * returns { success: false } on 4xx (Meta rejects the whole batch).
  */
 
-const META_API_VERSION = "v18.0";
+const META_API_VERSION = "v26.0";
 const META_API_BASE = "https://graph.facebook.com";
+const DZ_COUNTRY_CODE = "213";
 
 async function sha256hex(value: string): Promise<string> {
   const data = new TextEncoder().encode(value.toLowerCase().replace(/\s+/g, ""));
@@ -22,13 +25,34 @@ async function sha256hex(value: string): Promise<string> {
 
 function normalisePhone(raw: string): string {
   let p = raw.replace(/\D/g, "");
-  if (p.startsWith("0")) p = p.slice(1);
-  if (!p.startsWith("213")) p = "213" + p;
+  p = p.replace(/^0+/, "");
+  if (!p.startsWith(DZ_COUNTRY_CODE)) p = DZ_COUNTRY_CODE + p;
   return p;
 }
 
+/** a-z only, diacritics folded — for ct/zp-style values per Meta docs. */
+function normaliseAsciiText(raw: string): string {
+  return raw
+    .normalize("NFD")
+    .replace(/[\u0300-\u036f]/g, "")
+    .toLowerCase()
+    .replace(/[^a-z]/g, "");
+}
+
+/** Unicode letters only, diacritics folded, lowercased — for fn/ln. */
+function normaliseName(raw: string): string {
+  return raw
+    .normalize("NFD")
+    .replace(/[\u0300-\u036f]/g, "")
+    .toLowerCase()
+    .replace(/[^\p{L}]/gu, "");
+}
+
 export interface CapiUserData {
   phone: string;
+  firstName?: string | null;
+  lastName?: string | null;
+  externalId?: string | null;
   city?: string | null;
   postalCode?: string | null;
   fbc?: string | null;
@@ -41,6 +65,8 @@ export interface CapiEventPayload {
   eventName: "Lead" | "Purchase";
   eventId: string;
   eventTime: number;
+  /** Verified-domain page URL — required by Meta for website events. */
+  eventSourceUrl?: string | null;
   userData: CapiUserData;
   /** DZD value — required for Purchase */
   value?: number;
@@ -60,16 +86,21 @@ export async function sendCapiEvent(
   accessToken: string,
   payload: CapiEventPayload,
 ): Promise<CapiResult> {
-  const ph = await sha256hex(normalisePhone(payload.userData.phone));
+  const ud = payload.userData;
 
-  const userData: Record<string, string> = { ph };
-  if (payload.userData.city) userData.ct = await sha256hex(payload.userData.city);
-  if (payload.userData.postalCode) userData.zp = await sha256hex(payload.userData.postalCode);
-  if (payload.userData.fbc) userData.fbc = payload.userData.fbc;
-  if (payload.userData.fbp) userData.fbp = payload.userData.fbp;
-  if (payload.userData.clientIpAddress) userData.client_ip_address = payload.userData.clientIpAddress;
-  if (payload.userData.clientUserAgent) userData.client_user_agent = payload.userData.clientUserAgent;
-  userData.country = await sha256hex("dz");
+  const userData: Record<string, string> = {
+    ph: await sha256hex(normalisePhone(ud.phone)),
+    country: await sha256hex("dz"),
+  };
+  if (ud.firstName) userData.fn = await sha256hex(normaliseName(ud.firstName));
+  if (ud.lastName) userData.ln = await sha256hex(normaliseName(ud.lastName));
+  if (ud.externalId) userData.external_id = await sha256hex(ud.externalId);
+  if (ud.city) userData.ct = await sha256hex(normaliseAsciiText(ud.city));
+  if (ud.postalCode) userData.zp = await sha256hex(ud.postalCode);
+  if (ud.fbc) userData.fbc = ud.fbc;
+  if (ud.fbp) userData.fbp = ud.fbp;
+  if (ud.clientIpAddress) userData.client_ip_address = ud.clientIpAddress;
+  if (ud.clientUserAgent) userData.client_user_agent = ud.clientUserAgent;
 
   const eventData: Record<string, unknown> = {
     event_name: payload.eventName,
@@ -78,6 +109,7 @@ export async function sendCapiEvent(
     action_source: "website",
     user_data: userData,
   };
+  if (payload.eventSourceUrl) eventData.event_source_url = payload.eventSourceUrl;
 
   if (payload.value !== undefined) {
     eventData.custom_data = {
@@ -93,13 +125,22 @@ export async function sendCapiEvent(
   if (payload.testEventCode) body.test_event_code = payload.testEventCode;
 
   const url = `${META_API_BASE}/${META_API_VERSION}/${pixelId}/events?access_token=${accessToken}`;
-  const res = await fetch(url, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(body),
-  });
 
-  const json = (await res.json()) as any;
+  let res: Response;
+  try {
+    res = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    });
+  } catch (err) {
+    throw new Error(`Meta CAPI network error: ${err instanceof Error ? err.message : String(err)}`);
+  }
+
+  const json = (await res.json().catch(() => null)) as any;
+  if (res.status >= 500) {
+    throw new Error(`Meta CAPI server error ${res.status}: ${json?.error?.message ?? "no message"}`);
+  }
   if (!res.ok) {
     return { success: false, error: json?.error?.message ?? `HTTP ${res.status}` };
   }
diff --git a/cod-server/src/openapi/schemas/store.ts b/cod-server/src/openapi/schemas/store.ts
index 2f9e646..062ee86 100644
--- a/cod-server/src/openapi/schemas/store.ts
+++ b/cod-server/src/openapi/schemas/store.ts
@@ -60,9 +60,22 @@ export const StorePixelConfigSchema = z
     id: z.string(),
     storeId: z.string(),
     pixelId: z.string().openapi({ example: "1234567890123456" }),
-    accessToken: z.string().openapi({ description: "Meta access token used for server-side events" }),
+    adAccountName: z.string().nullable().openapi({
+      description: "Merchant's own label for the Meta ad account — reference only, never sent to Meta.",
+    }),
+    accessTokenMasked: z.string().openapi({
+      description: "Masked hint of the stored Meta access token — the token itself is write-only.",
+      example: "••••a9f2",
+    }),
     testEventCode: z.string().nullable().openapi({
-      description: "Meta test event code — used during integration testing only. Set to null in production.",
+      description: "Meta test event code — used only while Test Mode is on. Set to null in production.",
+    }),
+    conversionEvent: z.enum(["Lead", "Purchase"]).openapi({
+      description:
+        "Merchant-chosen conversion event: 'Lead' fires at order placement (deduplicated with the browser pixel), 'Purchase' fires at confirmed delivery.",
+    }),
+    testMode: z.boolean().openapi({
+      description: "When true, Conversions API events carry test_event_code to Meta's test stream.",
     }),
     enabled: z.boolean().openapi({ example: true }),
     createdAt: z.string().datetime(),
diff --git a/cod-server/src/workflows/capi-helpers.test.ts b/cod-server/src/workflows/capi-helpers.test.ts
new file mode 100644
index 0000000..7246452
--- /dev/null
+++ b/cod-server/src/workflows/capi-helpers.test.ts
@@ -0,0 +1,80 @@
+import { describe, it, expect } from "vitest";
+import { shouldTriggerCapiPurchase, resolveCapiDispatch, type CapiDispatchConfig } from "./capi-helpers";
+
+function config(overrides: Partial<CapiDispatchConfig> = {}): CapiDispatchConfig {
+  return {
+    enabled: true,
+    accessToken: "EAAG-token",
+    conversionEvent: "Purchase",
+    testMode: false,
+    testEventCode: null,
+    ...overrides,
+  };
+}
+
+describe("shouldTriggerCapiPurchase", () => {
+  it("triggers on delivered", () => {
+    expect(shouldTriggerCapiPurchase("delivered", 16)).toBe(true);
+  });
+
+  it("triggers early (out_for_delivery) only for long-haul southern wilayas", () => {
+    expect(shouldTriggerCapiPurchase("out_for_delivery", 1)).toBe(true);
+    expect(shouldTriggerCapiPurchase("out_for_delivery", 37)).toBe(true);
+    expect(shouldTriggerCapiPurchase("out_for_delivery", 16)).toBe(false);
+    expect(shouldTriggerCapiPurchase("out_for_delivery", null)).toBe(false);
+  });
+
+  it("never triggers on other statuses", () => {
+    expect(shouldTriggerCapiPurchase("dispatched", 1)).toBe(false);
+    expect(shouldTriggerCapiPurchase("returned", 16)).toBe(false);
+  });
+});
+
+describe("resolveCapiDispatch", () => {
+  it("sends when tracking is enabled, token present, and event matches the merchant's choice", () => {
+    expect(resolveCapiDispatch(config(), "Purchase")).toEqual({ send: true, testEventCode: null });
+  });
+
+  it("skips when tracking is disabled or no row exists", () => {
+    expect(resolveCapiDispatch(config({ enabled: false }), "Purchase")).toMatchObject({
+      send: false,
+      reason: "tracking-disabled",
+    });
+    expect(resolveCapiDispatch(undefined, "Purchase")).toMatchObject({ send: false, reason: "tracking-disabled" });
+  });
+
+  it("skips with an actionable reason when the token is missing", () => {
+    expect(resolveCapiDispatch(config({ accessToken: "" }), "Purchase")).toEqual({
+      send: false,
+      reason: "no-access-token",
+      message: "No CAPI access token — configure it in Settings → Tracking",
+    });
+  });
+
+  it("skips when the merchant chose a different conversion event", () => {
+    expect(resolveCapiDispatch(config({ conversionEvent: "Lead" }), "Purchase")).toEqual({
+      send: false,
+      reason: "conversion-event-mismatch",
+      message: "Conversion event is set to Lead — Purchase not sent",
+    });
+    expect(resolveCapiDispatch(config({ conversionEvent: "Purchase" }), "Lead")).toMatchObject({
+      send: false,
+      reason: "conversion-event-mismatch",
+    });
+  });
+
+  it("attaches test_event_code only when test mode is on", () => {
+    expect(resolveCapiDispatch(config({ testMode: true, testEventCode: "TEST123" }), "Purchase")).toEqual({
+      send: true,
+      testEventCode: "TEST123",
+    });
+    expect(resolveCapiDispatch(config({ testMode: false, testEventCode: "TEST123" }), "Purchase")).toEqual({
+      send: true,
+      testEventCode: null,
+    });
+    expect(resolveCapiDispatch(config({ testMode: true, testEventCode: null }), "Purchase")).toEqual({
+      send: true,
+      testEventCode: null,
+    });
+  });
+});
diff --git a/cod-server/src/workflows/capi-helpers.ts b/cod-server/src/workflows/capi-helpers.ts
index f0a4b91..5ea93a7 100644
--- a/cod-server/src/workflows/capi-helpers.ts
+++ b/cod-server/src/workflows/capi-helpers.ts
@@ -21,3 +21,50 @@ export function shouldTriggerCapiPurchase(
   if (newStatus === "out_for_delivery" && wilayaId != null && LONG_HAUL_WILAYA_IDS.has(wilayaId)) return true;
   return false;
 }
+
+export interface CapiDispatchConfig {
+  enabled: boolean;
+  accessToken: string;
+  conversionEvent: "Lead" | "Purchase";
+  testMode: boolean;
+  testEventCode: string | null;
+}
+
+export type CapiSkipReason =
+  | "tracking-disabled"
+  | "no-access-token"
+  | "conversion-event-mismatch";
+
+export type CapiDispatch =
+  | { send: true; testEventCode: string | null }
+  | { send: false; reason: CapiSkipReason; message: string };
+
+/**
+ * Single gate for every CAPI send: the store's tracking must be enabled, carry
+ * an access token, and the merchant must have chosen `eventName` as the
+ * conversion event. Test Mode routes events to Meta's test stream — the
+ * test_event_code is attached only when it is on.
+ */
+export function resolveCapiDispatch(
+  config: CapiDispatchConfig | null | undefined,
+  eventName: "Lead" | "Purchase",
+): CapiDispatch {
+  if (!config?.enabled) {
+    return { send: false, reason: "tracking-disabled", message: "Tracking disabled in store settings" };
+  }
+  if (!config.accessToken) {
+    return {
+      send: false,
+      reason: "no-access-token",
+      message: "No CAPI access token — configure it in Settings → Tracking",
+    };
+  }
+  if (config.conversionEvent !== eventName) {
+    return {
+      send: false,
+      reason: "conversion-event-mismatch",
+      message: `Conversion event is set to ${config.conversionEvent} — ${eventName} not sent`,
+    };
+  }
+  return { send: true, testEventCode: config.testMode ? config.testEventCode : null };
+}
diff --git a/cod-server/src/workflows/capi.ts b/cod-server/src/workflows/capi.ts
index 2455923..7cd2910 100644
--- a/cod-server/src/workflows/capi.ts
+++ b/cod-server/src/workflows/capi.ts
@@ -6,32 +6,51 @@
  * Instance ID: `capi-{orderId}-Purchase` — deterministic, prevents duplicate Workflows.
  *
  * Steps:
- *   1. fetch-order-and-config  — load fresh order + pixel config from D1
- *   2. check-7day-window       — guard: reject events older than Meta's 7-day hard limit
- *   3. send-capi-event         — POST to Meta with retries + exponential backoff
- *   4. log-result              — write audit row to capi_event_log
+ *   1. fetch-order-and-config  — load fresh order + pixel config + product ids from D1
+ *   2. log-skip                — audit row when the send could never happen
+ *                                (no access token, or event_time outside Meta's 7-day window)
+ *   3. send-capi-event         — POST to Meta; network/5xx throw so the Workflow
+ *                                retries (5 attempts, exponential backoff). 4xx returns
+ *                                success:false — Meta rejected the batch, retrying won't help.
+ *   4. log-result / log-failure — audit row in capi_event_log for every outcome
+ *
+ * Skips silently when tracking is disabled or the merchant chose Lead as the
+ * conversion event — normal operation, not an anomaly worth an audit row.
  */
 
 import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from "cloudflare:workers";
 import { NonRetryableError } from "cloudflare:workflows";
 import type { Env } from "@/types/env";
 import { getDb } from "@/db";
-import { orders, communes, wilayas, capiEventLog } from "@/db/schema";
+import { orders, communes, orderProducts, stores } from "@/db/schema";
 import { eq } from "drizzle-orm";
 import { getPixelConfig } from "../../../cod-shared/queries/pixel-config";
-import { sendCapiEvent } from "@/lib/capi";
+import { sendCapiEvent, type CapiResult } from "@/lib/capi";
+import { resolveCapiDispatch } from "./capi-helpers";
+import { logCapiEvent } from "@/lib/capi-log";
 
+const SEVEN_DAYS_SECONDS = 7 * 24 * 3600;
 
 export type CodCapiParams = {
   orderId: string;
   eventName: "Lead" | "Purchase";
   triggeredAt: number; // Unix timestamp — becomes event_time
   triggerStatus: string;
+  /** Verified-domain page URL — required by Meta for website events. */
+  eventSourceUrl?: string;
 };
 
+function splitName(customerName: string): { firstName?: string; lastName?: string } {
+  const parts = customerName.trim().split(/\s+/);
+  return {
+    firstName: parts[0] || undefined,
+    lastName: parts.length > 1 ? parts[parts.length - 1] : undefined,
+  };
+}
+
 export class CodCapiWorkflow extends WorkflowEntrypoint<Env, CodCapiParams> {
   async run(event: WorkflowEvent<CodCapiParams>, step: WorkflowStep) {
-    const { orderId, eventName, triggeredAt } = event.payload;
+    const { orderId, eventName, triggeredAt, eventSourceUrl } = event.payload;
 
     // Step 1 — fetch fresh data from D1 (never rely on stale params)
     const data = await step.do("fetch-order-and-config", async () => {
@@ -41,8 +60,8 @@ export class CodCapiWorkflow extends WorkflowEntrypoint<Env, CodCapiParams> {
         .select({
           id: orders.id,
           orderNumber: orders.orderNumber,
-          storeId: orders.id, // placeholder — store context from storeApiKeys
           customerId: orders.customerId,
+          customerName: orders.customerName,
           phone: orders.phone,
           wilayaId: orders.wilayaId,
           communeId: orders.communeId,
@@ -60,88 +79,114 @@ export class CodCapiWorkflow extends WorkflowEntrypoint<Env, CodCapiParams> {
 
       if (!order) throw new NonRetryableError(`Order ${orderId} not found`);
 
-      // Resolve commune name for city hashing
+      // Resolve commune name and postal code for user_data
       const communeRow = order.communeId
-        ? await db.select({ name: communes.name }).from(communes).where(eq(communes.id, order.communeId)).get()
-        : null;
-
-      // Resolve postal code from commune
-      const postalRow = order.communeId
-        ? await db.select({ postalCode: communes.postalCode }).from(communes).where(eq(communes.id, order.communeId)).get()
+        ? await db.select({ name: communes.name, postalCode: communes.postalCode }).from(communes).where(eq(communes.id, order.communeId)).get()
         : null;
 
-      // Resolve storeId from store_api_keys — STORE_API_KEY env var is not available
-      // inside the Workflow, but we can infer it from the DB since there's one store.
-      const { stores } = await import("@/db/schema");
+      // Single-tenant: one store per database
       const storeRow = await db.select({ id: stores.id }).from(stores).limit(1).get();
       if (!storeRow) throw new NonRetryableError("No store found");
 
+      const productRows = await db
+        .select({ productId: orderProducts.productId })
+        .from(orderProducts)
+        .where(eq(orderProducts.orderId, orderId));
+
       const pixelConfig = await getPixelConfig(db, storeRow.id);
 
       return {
         order,
         cityName: communeRow?.name ?? null,
-        postalCode: postalRow?.postalCode ?? null,
+        postalCode: communeRow?.postalCode ?? null,
+        contentIds: [...new Set(productRows.map((r) => r.productId))],
         pixelConfig,
-        storeId: storeRow.id,
       };
     });
 
-    // Step 2 — guard: no pixel config or tracking disabled
-    if (!data.pixelConfig?.enabled) {
-      throw new NonRetryableError(`Tracking not enabled for store ${data.storeId} — skipping`);
-    }
-    if (!data.pixelConfig.accessToken) {
-      throw new NonRetryableError(`No CAPI access token for store ${data.storeId} — configure it in Settings → Tracking`);
+    // Step 2 — gate: merchant must have chosen this event, with a token, tracking on
+    const dispatch = resolveCapiDispatch(data.pixelConfig, eventName);
+    if (!dispatch.send) {
+      if (dispatch.reason === "no-access-token") {
+        await step.do("log-skip", async () => {
+          await logCapiEvent(getDb(this.env.DB), {
+            orderId,
+            eventName,
+            status: "skipped",
+            error: dispatch.message,
+          });
+        });
+      }
+      return;
     }
 
-    // Step 3 — guard: 7-day Meta hard limit
-    await step.do("check-7day-window", async () => {
-      const ageSeconds = Math.floor(Date.now() / 1000) - triggeredAt;
-      const sevenDays = 7 * 24 * 3600;
-      if (ageSeconds >= sevenDays) {
-        throw new NonRetryableError(
-          `event_time expired: order ${orderId} is ${Math.round(ageSeconds / 3600)}h old — outside Meta 7-day window`
-        );
-      }
-    });
+    // Step 3 — guard: 7-day Meta hard limit on event_time
+    const ageSeconds = Math.floor(Date.now() / 1000) - triggeredAt;
+    if (ageSeconds >= SEVEN_DAYS_SECONDS) {
+      await step.do("log-skip", async () => {
+        await logCapiEvent(getDb(this.env.DB), {
+          orderId,
+          eventName,
+          status: "skipped",
+          error: `event_time expired: order ${orderId} is ${Math.round(ageSeconds / 3600)}h old — outside Meta 7-day window`,
+        });
+      });
+      return;
+    }
 
-    // Step 4 — send CAPI event (retries: 5, exponential backoff starting 30s)
-    const capiResult = await step.do(
-      "send-capi-event",
-      { retries: { limit: 5, delay: "30 seconds", backoff: "exponential" } },
-      async () => {
-        return sendCapiEvent(data.pixelConfig!.pixelId, data.pixelConfig!.accessToken, {
+    // Step 4 — send CAPI event. Network errors and Meta 5xx throw, which
+    // engages the Workflow's retry (5 attempts, 30s exponential backoff).
+    const { firstName, lastName } = splitName(data.order.customerName);
+    let capiResult: CapiResult;
+    try {
+      capiResult = await step.do(
+        "send-capi-event",
+        { retries: { limit: 5, delay: "30 seconds", backoff: "exponential" } },
+        async () => {
+          return sendCapiEvent(data.pixelConfig!.pixelId, data.pixelConfig!.accessToken, {
+            eventName,
+            eventId: orderId,
+            eventTime: triggeredAt,
+            eventSourceUrl,
+            userData: {
+              phone: data.order.phone,
+              firstName,
+              lastName,
+              externalId: data.order.customerId,
+              city: data.cityName,
+              postalCode: data.postalCode,
+              fbc: data.order.fbc,
+              fbp: data.order.fbp,
+              clientIpAddress: data.order.ipAddress,
+              clientUserAgent: data.order.userAgent,
+            },
+            value: eventName === "Purchase" ? data.order.price + data.order.deliveryFee : undefined,
+            currency: "DZD",
+            contentIds: data.contentIds,
+            testEventCode: dispatch.testEventCode,
+          });
+        }
+      );
+    } catch (err) {
+      await step.do("log-failure", async () => {
+        await logCapiEvent(getDb(this.env.DB), {
+          orderId,
           eventName,
-          eventId: orderId,
-          eventTime: triggeredAt,
-          userData: {
-            phone: data.order.phone,
-            city: data.cityName,
-            postalCode: data.postalCode,
-            fbc: data.order.fbc,
-            fbp: data.order.fbp,
-            clientIpAddress: data.order.ipAddress,
-            clientUserAgent: data.order.userAgent,
-          },
-          value: eventName === "Purchase" ? data.order.price + data.order.deliveryFee : undefined,
-          currency: "DZD",
-          testEventCode: data.pixelConfig!.testEventCode,
+          status: "failed",
+          error: err instanceof Error ? err.message : String(err),
         });
-      }
-    );
+      });
+      throw err;
+    }
 
     // Step 5 — write audit row to capi_event_log
     await step.do("log-result", async () => {
-      const db = getDb(this.env.DB);
-      await db.insert(capiEventLog).values({
-        id: crypto.randomUUID(),
+      await logCapiEvent(getDb(this.env.DB), {
         orderId,
         eventName,
         status: capiResult.success ? "sent" : "failed",
         metaEventId: capiResult.fbtrace_id ?? null,
         error: capiResult.error ?? null,
-        sentAt: new Date().toISOString(),
       });
     });
   }
diff --git a/cod-shared/db/schema.ts b/cod-shared/db/schema.ts
index 9810cee..f9a3efb 100644
--- a/cod-shared/db/schema.ts
+++ b/cod-shared/db/schema.ts
@@ -1103,9 +1103,15 @@ export const storePixelConfig = sqliteTable("store_pixel_config", {
     .unique()
     .references(() => stores.id, { onDelete: "cascade" }),
   pixelId: text("pixel_id").notNull(),
+  /** Merchant's label for the Meta ad account this pixel belongs to — reference only, never sent to Meta. */
+  adAccountName: text("ad_account_name"),
   accessToken: text("access_token").notNull(),
   /** Meta test event code — used during integration testing only. Set to null in production. */
   testEventCode: text("test_event_code"),
+  /** Which CAPI event the merchant optimizes for — chosen explicitly in the dashboard, never defaulted by the UI. */
+  conversionEvent: text("conversion_event", { enum: ["Lead", "Purchase"] }).notNull().default("Purchase"),
+  /** When true, CAPI events carry test_event_code to Meta's test stream instead of production measurement. */
+  testMode: integer("test_mode", { mode: "boolean" }).notNull().default(false),
   enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull(),
diff --git a/cod-shared/queries/pixel-config.test.ts b/cod-shared/queries/pixel-config.test.ts
new file mode 100644
index 0000000..487d68a
--- /dev/null
+++ b/cod-shared/queries/pixel-config.test.ts
@@ -0,0 +1,164 @@
+/**
+ * store_pixel_config queries — unit tests
+ *
+ * Pins the upsert contract:
+ *   - an empty accessToken keeps the previously stored token (write-only flow)
+ *   - adAccountName / testEventCode keep their stored value when omitted,
+ *     clear when sent empty
+ *   - conversionEvent / testMode keep-on-undefined, with defensive defaults
+ *     on insert (the dashboard must choose explicitly — tested on the API side)
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { getPixelConfig, upsertPixelConfig } from "./pixel-config";
+
+function makeDb(row: unknown | undefined) {
+  const get = vi.fn(async () => row);
+  const returningGet = vi.fn(async () => row);
+  const db = {
+    select: vi.fn(() => ({
+      from: vi.fn(() => ({
+        where: vi.fn(() => ({ get })),
+      })),
+    })),
+    update: vi.fn(() => ({
+      set: vi.fn(() => ({
+        where: vi.fn(() => ({
+          returning: vi.fn(() => ({ get: returningGet })),
+        })),
+      })),
+    })),
+    insert: vi.fn(() => ({
+      values: vi.fn(async () => undefined),
+    })),
+  } as any;
+  return { db, get, returningGet };
+}
+
+describe("getPixelConfig", () => {
+  it("returns undefined when no row exists (tracking inert)", async () => {
+    const { db } = makeDb(undefined);
+    expect(await getPixelConfig(db, "store-1")).toBeUndefined();
+  });
+
+  it("returns the full row — raw accessor for server-side senders", async () => {
+    const { db } = makeDb({
+      storeId: "store-1",
+      pixelId: "123",
+      conversionEvent: "Lead",
+      testMode: true,
+      enabled: true,
+    });
+    const raw = await getPixelConfig(db, "store-1");
+    expect(raw).toMatchObject({ pixelId: "123", conversionEvent: "Lead", testMode: true });
+  });
+});
+
+describe("upsertPixelConfig", () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("inserts a new row with defensive defaults for conversionEvent/testMode", async () => {
+    const { db } = makeDb(undefined);
+    await upsertPixelConfig(db, "store-1", {
+      pixelId: "123",
+      accessToken: "EAAG-1",
+      conversionEvent: "Lead",
+    });
+
+    expect(db.insert).toHaveBeenCalledOnce();
+    const valuesCall = (db.insert.mock.results[0].value as any).values.mock.calls[0][0];
+    expect(valuesCall).toMatchObject({
+      storeId: "store-1",
+      pixelId: "123",
+      accessToken: "EAAG-1",
+      conversionEvent: "Lead",
+      testMode: false,
+      enabled: true,
+    });
+  });
+
+  it("keeps the stored token when accessToken is empty (write-only token flow)", async () => {
+    const { db } = makeDb({
+      id: "row-1",
+      accessToken: "EAAG-stored",
+      adAccountName: "Main Account",
+      testEventCode: "KEEP",
+      conversionEvent: "Purchase",
+      testMode: false,
+      enabled: true,
+    });
+
+    await upsertPixelConfig(db, "store-1", {
+      pixelId: "123",
+      accessToken: "",
+      conversionEvent: "Purchase",
+    });
+
+    const setCall = (db.update.mock.results[0].value as any).set.mock.calls[0][0];
+    expect(setCall.accessToken).toBe("EAAG-stored");
+  });
+
+  it("keeps adAccountName and testEventCode when omitted, clears them when sent empty", async () => {
+    const { db } = makeDb({
+      id: "row-1",
+      accessToken: "EAAG-stored",
+      adAccountName: "Main Account",
+      testEventCode: "KEEP",
+      conversionEvent: "Purchase",
+      testMode: true,
+      enabled: true,
+    });
+
+    await upsertPixelConfig(db, "store-1", {
+      pixelId: "123",
+      conversionEvent: "Purchase",
+    });
+    let setCall = (db.update.mock.results[0].value as any).set.mock.calls[0][0];
+    expect(setCall.adAccountName).toBe("Main Account");
+    expect(setCall.testEventCode).toBe("KEEP");
+    expect(setCall.testMode).toBe(true);
+
+    await upsertPixelConfig(db, "store-1", {
+      pixelId: "123",
+      adAccountName: "",
+      testEventCode: "",
+      conversionEvent: "Lead",
+    });
+    setCall = (db.update.mock.results[1].value as any).set.mock.calls[0][0];
+    expect(setCall.adAccountName).toBeNull();
+    expect(setCall.testEventCode).toBeNull();
+    expect(setCall.conversionEvent).toBe("Lead");
+  });
+
+  it("stores a trimmed adAccountName and testEventCode", async () => {
+    const { db } = makeDb(undefined);
+    await upsertPixelConfig(db, "store-1", {
+      pixelId: "123",
+      adAccountName: "  Somer Ads  ",
+      testEventCode: "  TEST123  ",
+      conversionEvent: "Lead",
+    });
+    const valuesCall = (db.insert.mock.results[0].value as any).values.mock.calls[0][0];
+    expect(valuesCall.adAccountName).toBe("Somer Ads");
+    expect(valuesCall.testEventCode).toBe("TEST123");
+  });
+
+  it("replaces the token when a new one is provided", async () => {
+    const { db } = makeDb({
+      id: "row-1",
+      accessToken: "EAAG-old",
+      conversionEvent: "Purchase",
+    });
+
+    await upsertPixelConfig(db, "store-1", {
+      pixelId: "123",
+      accessToken: "EAAG-new ",
+      conversionEvent: "Purchase",
+    });
+
+    const setCall = (db.update.mock.results[0].value as any).set.mock.calls[0][0];
+    expect(setCall.accessToken).toBe("EAAG-new");
+  });
+});
diff --git a/cod-shared/queries/pixel-config.ts b/cod-shared/queries/pixel-config.ts
index b9217c8..2d6fec1 100644
--- a/cod-shared/queries/pixel-config.ts
+++ b/cod-shared/queries/pixel-config.ts
@@ -2,6 +2,8 @@ import type { AppDb } from "../db/client";
 import { storePixelConfig } from "../db/schema";
 import { eq } from "drizzle-orm";
 
+export type ConversionEvent = "Lead" | "Purchase";
+
 export async function getPixelConfig(db: AppDb, storeId: string) {
   return db
     .select()
@@ -12,8 +14,11 @@ export async function getPixelConfig(db: AppDb, storeId: string) {
 
 export interface UpsertPixelConfigData {
   pixelId: string;
+  adAccountName?: string | null;
   accessToken?: string;
   testEventCode?: string | null;
+  conversionEvent?: ConversionEvent;
+  testMode?: boolean;
   enabled?: boolean;
 }
 
@@ -25,13 +30,26 @@ export async function upsertPixelConfig(
   const now = new Date().toISOString();
   const existing = await getPixelConfig(db, storeId);
 
+  const accessToken = data.accessToken?.trim() || existing?.accessToken || "";
+  const adAccountName =
+    data.adAccountName === undefined
+      ? existing?.adAccountName ?? null
+      : data.adAccountName?.trim() || null;
+  const testEventCode =
+    data.testEventCode === undefined
+      ? existing?.testEventCode ?? null
+      : data.testEventCode?.trim() || null;
+
   if (existing) {
     return db
       .update(storePixelConfig)
       .set({
         pixelId: data.pixelId,
-        accessToken: data.accessToken ?? "",
-        testEventCode: data.testEventCode ?? null,
+        adAccountName,
+        accessToken,
+        testEventCode,
+        conversionEvent: data.conversionEvent ?? existing.conversionEvent,
+        testMode: data.testMode ?? existing.testMode,
         enabled: data.enabled ?? true,
         updatedAt: now,
       })
@@ -44,8 +62,11 @@ export async function upsertPixelConfig(
     id: crypto.randomUUID(),
     storeId,
     pixelId: data.pixelId,
-    accessToken: data.accessToken ?? "",
-    testEventCode: data.testEventCode ?? null,
+    adAccountName,
+    accessToken,
+    testEventCode,
+    conversionEvent: data.conversionEvent ?? "Purchase",
+    testMode: data.testMode ?? false,
     enabled: data.enabled ?? true,
     createdAt: now,
     updatedAt: now,
diff --git a/cod-shared/queries/store.ts b/cod-shared/queries/store.ts
index 5b554ca..6776607 100644
--- a/cod-shared/queries/store.ts
+++ b/cod-shared/queries/store.ts
@@ -932,7 +932,14 @@ export async function createStoreOrder(
 
   await db.batch(statements as [BatchStatement, ...BatchStatement[]]);
 
-  return { id, orderNumber, price, deliveryFee: finalDeliveryFee };
+  return {
+    id,
+    orderNumber,
+    customerId: data.customerId,
+    customerName: data.customerName,
+    price,
+    deliveryFee: finalDeliveryFee,
+  };
 }
 
 // ─── Reviews ──────────────────────────────────────────────────────────────────
diff --git a/docs/META-TRACKING.md b/docs/META-TRACKING.md
new file mode 100644
index 0000000..76608e8
--- /dev/null
+++ b/docs/META-TRACKING.md
@@ -0,0 +1,284 @@
+# Meta Pixel & Conversions API
+
+End-user documentation for Meta ad tracking in CodFlow: the **Meta Pixel**
+(browser side) and the **Conversions API** (server side), and how they work
+together.
+
+---
+
+## What It Does
+
+CodFlow reports what happens in your store to Meta, so Meta can attribute
+orders to your Facebook/Instagram ads and optimize them:
+
+- **Browser events (Meta Pixel)** — what the shopper's browser does: viewing
+  a product (`ViewContent`), reaching the order form (`InitiateCheckout`),
+  placing an order (`Lead`), and every page view (`PageView`).
+- **Server events (Conversions API)** — what your store *knows* server-side,
+  sent directly from CodFlow to Meta with hashed customer data (phone, name,
+  city) for stronger matching. Server events survive browser restrictions
+  such as ad blockers and iOS privacy limits.
+
+**It is optional and off by default.** Until you configure it in Settings,
+nothing is sent to Meta and no pixel script loads on your storefront.
+
+**You choose what counts as a conversion** — this is the most important
+setting in the feature (see *Lead or Purchase?* below).
+
+What it is **not**:
+
+- Not a Meta ad manager — you still create ads in Ads Manager; this only
+  feeds them data.
+- Not analytics or a dashboard — you read results in **Meta Events Manager**.
+- Not able to "unsay" an event — once Meta receives an event, it cannot be
+  retracted (relevant to the Lead choice below).
+
+---
+
+## Before You Start
+
+Collect these from Meta:
+
+1. **Pixel ID** — Meta Events Manager → Data Sources → your pixel
+   (e.g. `1234567890123456`). If you have no pixel yet, create one first
+   (Events Manager → Create Data Source).
+2. **Conversions API access token** — in Events Manager, open your pixel →
+   Settings → Conversions API → *Generate access token*. Copy it somewhere
+   safe: **it is shown once and never displayed again by CodFlow**.
+3. **(Optional) Test event code** — from the Test Events tab of your pixel
+   (e.g. `TEST12345`), for verifying your setup safely.
+
+Your domain should also be **verified** in Meta Business Manager
+(Business Settings → Brand Safety → Domains) — Meta uses it to trust the
+events your store sends.
+
+---
+
+## Turning It On
+
+Dashboard → **Settings → Tracking & Analytics**:
+
+1. **Enable Meta tracking** — the master on/off switch. Off = no pixel on
+   your storefront and no server events, period.
+2. **Ad Account Name** *(optional)* — your own label for the ad account this
+   pixel belongs to (e.g. "My Store — Main Account"). Purely for your
+   reference in the settings page; CodFlow never sends it to Meta.
+3. **Meta Pixel ID** — from step 1 above.
+4. **Conversions API Access Token** — from step 2 above. Paste it once and
+   save: afterwards the field shows only a masked hint (`••••a9f2`). Leaving
+   the field empty on later saves **keeps the stored token**.
+5. **Conversion Event — Lead or Purchase?** — required, you must pick one:
+
+   | | **Lead — at order placement** | **Purchase — at confirmed delivery** |
+   |---|---|---|
+   | Fires | the moment an order is placed | when the order is marked *Delivered* |
+   | Speed | immediate — fast ad optimization signal | days later (delivery time) |
+   | Accuracy | counts **unconfirmed** orders: refusals, fake phones, cancellations | counts **real revenue**: cash actually collected |
+   | Meta dedup | deduplicated with the browser pixel Lead | server-only, no duplication |
+   | 7-day limit | n/a (fires immediately) | if delivery happens more than 7 days after the order, the event is skipped (Meta's hard limit) |
+
+   For COD in Algeria, many merchants start with **Lead** to build ad data
+   fast, then switch to **Purchase** once volume is stable. You can change
+   this at any time — only future events follow the new choice.
+
+6. **Test Mode** — see below. Recommended for first-time setup.
+7. **Save.**
+
+---
+
+## Test Mode (turn it on, verify, then turn it off)
+
+Test Mode sends your **server events to Meta's test stream** instead of your
+production measurement — nothing counts, nothing pollutes your ad data.
+
+To verify the setup:
+
+1. Turn **Test Mode on** and enter your **Test Event Code** (from Events
+   Manager → your pixel → *Test Events* tab).
+2. Save, then open your storefront in a browser and place a test order.
+3. In the Meta **Test Events** tab you should see, within ~20 minutes:
+   - browser events (`PageView`, `ViewContent`, `InitiateCheckout`, `Lead`)
+   - server events (`Lead` or `Purchase` from "CodFlow" / your server)
+   - the server `Lead` and browser `Lead` arriving with the **same event ID**
+     → Meta reports them as *deduplicated* (one conversion, not two).
+4. **Turn Test Mode off** and save before going live. While it is on, a
+   warning banner stays visible on the settings page — your events are not
+   being counted.
+
+> **Important:** after disabling Test Mode, remove the test event code from
+> Events Manager behavior by simply leaving Test Mode off — the code is only
+> attached while the switch is on.
+
+---
+
+## How It Works
+
+### The two channels
+
+```
+Shopper's browser                     CodFlow server (Cloudflare)
+─────────────────                     ──────────────────────────
+Pixel script loaded
+  └─ PageView          (every page)
+  └─ ViewContent       (product page)
+  └─ InitiateCheckout  (first interaction in the order form)   Order placed ──┐
+  └─ Lead + eventID    (thank-you page)  ──┐                                 │
+                                          │                                 ▼
+                                    same eventID ──→ CAPI Workflow: server Lead (if you chose Lead)
+                                          │        Meta counts ONE (dedup, 48h window)
+                                                                            │
+                                        Order delivered ───────────────────┤
+                                                                            ▼
+                                                           CAPI Workflow: server Purchase (if you chose Purchase)
+```
+
+- **Deduplication:** when you choose **Lead**, the browser and the server
+  both send a `Lead` for the same order with the **same event ID** (the
+  internal order ID). Meta matches them within 48 hours and counts **one**
+  conversion. This is Meta's recommended "redundant setup": you get the
+  browser event's speed and the server event's reliability.
+- **Purchase is server-only:** it fires when an order is marked **Delivered**
+  (or *Out for delivery* for the far southern wilayas, to stay inside Meta's
+  7-day window). If Meta is temporarily down, it retries automatically up to
+  5 times with backoff — a Meta hiccup can never block or delay your delivery
+  flow.
+- **Attribution preserved:** the `_fbc` (ad click) and `_fbp` (browser)
+  cookies are captured **at order placement** and stored with the order, so
+  the delivery-day Purchase event still attributes back to the ad the
+  customer clicked days earlier.
+
+### When exactly does CAPI fire? (the trigger chain)
+
+Both server events run as **durable Cloudflare Workflows** — queued, retried
+on failure (5 attempts with backoff), and audit-logged. Nothing here depends
+on a browser still being open.
+
+**Lead** — fires the moment an order is placed:
+
+```
+Storefront checkout → order accepted (201)
+                      └─ Workflow "capi-{orderId}-Lead" starts
+                          ├─ you chose Lead?  → send to Meta (dedup'd with the browser Lead)
+                          └─ you chose Purchase? → skip silently, no event
+```
+
+**Purchase** — fires when an order *reaches delivery*. There are two ways an
+order gets there, and both trigger the same Workflow:
+
+```
+1. You / your team updates the order in the dashboard
+   Dashboard → Orders → mark Delivered ──┐
+                                          ├──→ Workflow "capi-{orderId}-Purchase"
+2. The carrier's webhook updates it automatically          │
+   Yalidine / ZR Express webhook → status "Livré"/"Delivered" ┘
+                                          │
+                                          ├─ you chose Purchase? → send to Meta
+                                          └─ you chose Lead?     → skip silently
+```
+
+**What this means with webhooks:** if you dispatch orders to **Yalidine** or
+**ZR Express**, their systems call CodFlow's webhook whenever the shipment
+moves — picked up, out for delivery, delivered, returned. When the webhook
+reports *delivered*, CodFlow marks the order Delivered **and** starts the
+Purchase Workflow in the same instant: no one has to touch the dashboard.
+
+The other carriers (**NOEST, EcoTrack**) don't send webhooks to CodFlow —
+their status is pulled when you open the order in the dashboard — so for
+them the Purchase event starts when you (or a teammate) view or update the
+order and the status resolves to Delivered.
+
+Timing rule (both events): Meta rejects events older than **7 days** from
+order placement. That's why far-southern wilayas (Adrar, Tamanrasset,
+Tindouf, …) fire Purchase at *Out for delivery* instead of *Delivered* —
+waiting for final delivery there can push past the 7-day limit.
+
+### Privacy: what is sent
+
+CodFlow sends Meta only what its Conversions API accepts, per Meta's spec:
+
+- **Hashed (SHA-256, on our servers before sending):** phone number,
+  first/last name, city, postal code, country, internal customer ID.
+- **Sent as-is (Meta requires these unhashed):** ad-click and browser
+  identifiers, and the shopper's IP address and browser User-Agent —
+  captured at order placement for accurate attribution.
+- **Never sent:** addresses, notes, product names, prices beyond the order
+  total, your ad account label.
+
+### Audit trail
+
+Every server event attempt is recorded in the `capi_event_log` table —
+event, order, outcome (sent / failed / skipped), Meta's trace ID, and any
+error. If something silently fails, the answer is there.
+
+> **Phone numbers:** checkout only accepts **Algerian mobile numbers**
+> (starting 05, 06, or 07). Shoppers can type them in any common form —
+> `0551234567`, `+213 551 23 45 67`, `00213…` — CodFlow normalizes them to
+> one canonical format before storing. Cleaner phone data also means a
+> higher match rate for your Meta events.
+
+---
+
+## Verifying Events in Meta
+
+1. **Live events:** Events Manager → your pixel → *Overview*. Expect
+   `PageView`, `ViewContent`, `InitiateCheckout`, and your chosen
+   conversion event. Events appear within ~20 minutes.
+2. **Event Match Quality (EMQ):** the pixel's *Diagnostics* tab scores how
+   well your server events match Meta users (0–10). Higher = better
+   attribution. Because CodFlow sends phone + name + city + IP + user-agent
+   + click IDs, expect a healthy score.
+3. **Test events:** the Test Events tab (with Test Mode on, as above).
+4. **Browser debugging:** install Meta's **Pixel Helper** Chrome extension —
+   it shows every pixel call on your storefront live.
+
+---
+
+## Troubleshooting
+
+| Symptom | Likely cause | Fix |
+|---|---|---|
+| No events at all in Events Manager | tracking disabled, or pixel ID / token wrong | check the switches in Settings → Tracking; re-paste values |
+| Browser events appear, server events don't | access token invalid or revoked | generate a fresh token in Events Manager, save it in Settings |
+| Server events appear only in Test Events tab | Test Mode still on | turn Test Mode **off** and save |
+| `Lead` counted twice | you send your own pixel `Lead` outside CodFlow | don't add a second pixel script manually — CodFlow already fires the browser Lead with the matching event ID |
+| `Purchase` missing for a delivered order | delivery happened >7 days after placement (Meta's hard limit), or the event is still retrying | check `capi_event_log`; the skip is by design |
+| Pixel Helper shows nothing on the storefront | no Pixel ID saved, or script blocked by an ad blocker | save the Pixel ID; test in a clean browser profile |
+| Order delivered via Yalidine/ZR but no Purchase in Meta | conversion event set to Lead, or tracking/test-mode off | check Settings → Tracking first, then `capi_event_log` for a skipped row |
+| Customer's order rejected with an Arabic phone error | the phone isn't an Algerian mobile (05/06/07) | customers must use a DZ mobile number — fixed-line or foreign numbers are refused at checkout |
+
+---
+
+## FAQ
+
+**Can I run my own pixel script alongside CodFlow's?**
+No — the browser `Lead` and the server `Lead` share one event ID *because
+both come from CodFlow*. A second, manually-installed pixel would
+double-count conversions.
+
+**I chose Purchase — where did my Lead events go?**
+The browser pixel still fires `Lead` on the thank-you page, but the
+server-side mirror is off — the Conversions API conversion signal becomes
+`Purchase` at delivery instead. Meta optimizes on whichever event you
+selected.
+
+**Does my carrier need webhooks for tracking to work?**
+No — webhooks only change **how quickly** the Purchase event starts. With
+Yalidine or ZR Express, the carrier reports *delivered* to CodFlow
+automatically and the Purchase Workflow starts by itself. With NOEST or
+EcoTrack, it starts when your team updates the order in the dashboard. The
+`Lead` conversion event never depends on carriers — it fires at order
+placement either way.
+
+**Does switching Lead → Purchase affect past events?**
+No. The choice applies from the moment you save. Past events stay as they
+were reported.
+
+**What happens if I turn tracking off?**
+The pixel script stops loading on your storefront and no server events are
+sent. Existing settings and history are kept — flipping it back on resumes
+immediately.
+
+**Is the access token safe?**
+It is stored in your store's database and is write-only through the
+dashboard: the API returns only a masked hint (`••••a9f2`), and saving with
+an empty token field keeps the stored one.