Small catch between steps 3 and 4: the honeypot branch returns { ok: true }, and the client fires generate_lead whenever body.ok is true. So bots that fill the hidden field would still count as leads in GA4. Returning the lead id only on a real save and checking for body.id before the event keeps analytics matching the inbox.