Merge branch 'loops/host' into merge/host-arch

# Conflicts:
#	lib/erlang/runtime.sx

applications/sxtp/spec.sx

@@ -97,6 +97,42 @@
       (:body "Any SX value — event payload (optional)")
       (:time "Number — unix timestamp (optional)"))))
 
+;; ── patch (DOM fragment patch — borrowed from Datastar) ───────────
+;; A server-driven instruction to morph a region of the client DOM.
+;; Subsumes HTMX swap modes; the :body is an SX subtree that the client
+;; renders to DOM nodes before applying the mode at the target.
+(define
+  patch-fields
+  (quote
+    ((:target "String — CSS selector for the element to patch (required)")
+      (:mode "Symbol — patch mode (optional, default outer)")
+      (:body "SX tree — the new content (omitted for mode remove)")
+      (:transition "Boolean — use a view transition (optional, default false)"))))
+
+(define
+  patch-modes
+  (quote
+    ((outer "Replace the target's outerHTML (default; the morph target)")
+      (inner "Replace the target's innerHTML, preserving the wrapper")
+      (replace "Hard-replace without morphing (no diff, plain swap)")
+      (prepend "Insert the body as the target's first child")
+      (append "Insert the body as the target's last child")
+      (before "Insert the body before the target")
+      (after "Insert the body after the target")
+      (remove "Detach the target; :body MUST be absent"))))
+
+;; ── signals (reactive state patch — borrowed from Datastar) ──────
+;; A server-driven update to client-side reactive signals. :values is a
+;; dict of signal-name -> new-value; setting a value to nil REMOVES the
+;; signal. With :only-if-missing true, existing signals are not touched
+;; (use this to lazily initialise signal state without clobbering).
+(define
+  signals-fields
+  (quote
+    ((:values "Dict — signal-name -> new-value (required)")
+      (:only-if-missing
+        "Boolean — only set signals that don't yet exist (optional, default false)"))))
+
 (define
   example-navigate
   (quote
@@ -148,6 +184,23 @@
           :message "No such post"
           :retry false)))))
 
+;; A streaming response intermixing patch + signals: the server pushes
+;; DOM updates AND signal updates over the same channel. The client
+;; dispatches each message by its head symbol; ordering is preserved.
+(define
+  example-patch-stream
+  (quote
+    ((request :verb subscribe :path "/cart/live" :capabilities (fetch))
+      (response :status ok :stream true)
+      (signals :values {:cart/count 3 :cart/loading false})
+      (patch
+        :target "#cart-mini"
+        :mode outer
+        :body (~cart-mini :count 3 :total 47.50))
+      (patch :target "#flash" :mode inner :body (p "Item added."))
+      (signals :values {:cart/loading true})
+      (patch :target "#cart-loading-spinner" :mode remove))))
+
 (define
   example-inspect
   (quote

docker-compose.dev-sx-host.yml

@@ -0,0 +1,58 @@
+# host-on-sx live service — the SX web host (lib/host) served by the native
+# http-listen server via lib/host/serve.sh. Joins the sx-dev project + externalnet
+# so Caddy can reverse_proxy a subdomain to it (blog.rose-ash.com). Isolated from
+# the sx_docs server: separate container, separate port.
+#
+# Usage:
+#   docker compose -p sx-dev -f docker-compose.dev-sx-host.yml up -d sx_host
+#   docker compose -p sx-dev -f docker-compose.dev-sx-host.yml logs -f sx_host
+#   docker compose -p sx-dev -f docker-compose.dev-sx-host.yml down
+
+services:
+  sx_host:
+    image: registry.rose-ash.com:5000/sx_docs:latest
+    container_name: sx-dev-sx_host-1
+    entrypoint: ["bash", "/app/lib/host/serve.sh"]
+    working_dir: /app
+    environment:
+      SX_PROJECT_DIR: /app
+      SX_SERVER: /app/bin/sx_server
+      HOST_PORT: "8000"
+      # Bind all interfaces so Caddy (on externalnet) can reach it.
+      SX_HTTP_HOST: "0.0.0.0"
+      # Durable persist store root — on a named volume so data survives restarts.
+      SX_PERSIST_DIR: /data/persist
+      # Blog write auth: admin login + session-cookie signing secret. The blog
+      # write routes (POST /new, POST/PUT/DELETE /posts) are guarded by a session
+      # login or Bearer token, so these gate publishing. Not a real site — these
+      # are demo creds; rotate by editing here and recreating the container.
+      SX_ADMIN_USER: admin
+      SX_ADMIN_PASSWORD: "sx-host-camper-van-2026"
+      SX_SESSION_SECRET: "ra-host-sess-7c1f9b3e2a8d4056"
+      # Serving-mode JIT: bytecode-compile hot SX (esp. the Datalog/relations path)
+      # on the epoch serving channel. Validated: host conformance 271/271 under JIT,
+      # 5.4x faster (1m43s -> 19s). Default-OFF gate, opt in here.
+      SX_SERVING_JIT: "1"
+      OCAMLRUNPARAM: "b"
+    volumes:
+      # SX source (hot-reload on container restart)
+      - ./spec:/app/spec:ro
+      - ./lib:/app/lib:ro
+      - ./web:/app/web:ro
+      # Client assets for the blog SPA: the WASM OCaml kernel + sx-platform + the
+      # web-stack modules, served by lib/host/static.sx at /static/**.
+      - ./shared/static:/app/shared/static:ro
+      # OCaml server binary — this worktree's build (has the SX_HTTP_HOST bind fix)
+      - ./hosts/ocaml/_build/default/bin/sx_server.exe:/app/bin/sx_server:ro
+      # Durable persist store (the SX op-log/kv on disk) — survives restarts.
+      # Host dir, chowned to the image's appuser (uid 10001) so the non-root
+      # server can write: sudo mkdir -p /root/sx-host-persist && sudo chown 10001:10001 /root/sx-host-persist
+      - /root/sx-host-persist:/data/persist
+    networks:
+      - externalnet
+      - default
+    restart: unless-stopped
+
+networks:
+  externalnet:
+    external: true

hosts/ocaml/bin/run_tests.ml

@@ -2812,10 +2812,13 @@ let run_spec_tests env test_files =
               | "insertAdjacentHTML" | "prepend" | "showModal" | "show" | "close"
               | "getBoundingClientRect" | "getAnimations" | "scrollIntoView"
               | "scrollTo" | "scroll" | "reset" -> Bool true
-              | "firstElementChild" ->
+              | "firstElementChild" | "firstChild" ->
+                (* the mock treats element children and child nodes alike, so
+                   firstChild == firstElementChild — children-to-fragment walks
+                   firstChild to drain a parsed fragment into a swap target. *)
                 let kids = match Hashtbl.find_opt d "children" with Some (List l) -> l | _ -> [] in
                 (match kids with c :: _ -> c | [] -> Nil)
-              | "lastElementChild" ->
+              | "lastElementChild" | "lastChild" ->
                 let kids = match Hashtbl.find_opt d "children" with Some (List l) -> l | _ -> [] in
                 (match List.rev kids with c :: _ -> c | [] -> Nil)
               | "nextElementSibling" | "nextSibling" ->
@@ -2961,6 +2964,15 @@ let run_spec_tests env test_files =
        | "setTimeout" -> (match rest with fn :: _ -> ignore (Sx_ref.cek_call fn (List [])); Nil | _ -> Nil)
        | "clearTimeout" -> Nil
        | _ -> Nil)
+    (* NodeList.item(i) — dom-query-all iterates the querySelectorAll result
+       (a bare List) via this method, exactly like a browser NodeList. *)
+    | (List _ | ListRef _) :: String "item" :: [idx] ->
+      let items = match args with
+        | List l :: _ -> l
+        | ListRef { contents = l } :: _ -> l
+        | _ -> [] in
+      let i = match idx with Number n -> int_of_float n | Integer n -> n | _ -> -1 in
+      if i >= 0 && i < List.length items then List.nth items i else Nil
     | Dict d :: String "hasOwnProperty" :: [String k] ->
       Bool (Hashtbl.mem d k)
     | Dict d :: String m :: rest ->
@@ -3070,6 +3082,26 @@ let run_spec_tests env test_files =
         (* console.log/debug/error — no-op in tests *)
         Nil
 
+      else if mt = "domparser" then
+        (* DOMParser.parseFromString(text, "text/html") — returns a mock
+           document whose <body> is parsed from `text`. An empty string yields
+           a valid empty document (truthy), matching the browser: that's what
+           the engine's handle-html-response relies on for an empty-body
+           sx-swap="delete" response. *)
+        (match m with
+         | "parseFromString" ->
+           let text = match rest with String t :: _ -> t | _ -> "" in
+           let bd = match make_mock_element "body" with Dict d -> d | _ -> Hashtbl.create 0 in
+           Hashtbl.replace bd "tagName" (String "BODY");
+           Hashtbl.replace bd "nodeName" (String "BODY");
+           parse_html_into bd text;
+           Hashtbl.replace bd "innerHTML" (String text);
+           let doc = Hashtbl.create 4 in
+           Hashtbl.replace doc "__mock_type" (String "document");
+           Hashtbl.replace doc "body" (Dict bd);
+           Dict doc
+         | _ -> Nil)
+
       else
         (* Element methods *)
         (match m with
@@ -3483,6 +3515,10 @@ let run_spec_tests env test_files =
       Dict ev
     | [String "Object"] ->
       Dict (Hashtbl.create 4)
+    | [String "DOMParser"] ->
+      let d = Hashtbl.create 4 in
+      Hashtbl.replace d "__mock_type" (String "domparser");
+      Dict d
     | _ -> Nil);
 
   reg "host-callback" (fun args ->
@@ -3686,6 +3722,7 @@ let run_spec_tests env test_files =
   load_module "router.sx" web_dir;
   load_module "deps.sx" web_dir;
   load_module "orchestration.sx" web_dir;
+  load_module "console-render.sx" web_dir;
   (* Library modules for lib/tests/ *)
   load_module "bytecode.sx" lib_dir;
   load_module "compiler.sx" lib_dir;

hosts/ocaml/bin/sx_server.ml

@@ -32,6 +32,14 @@ let () = ignore (Sx_vm_extensions.id_of_name "")
    which we swallow so a re-entered server process doesn't die. *)
 let () = try Erlang_ext.register () with Failure _ -> ()
 
+(* Ignore SIGPIPE: a client that closes its connection mid-response (a browser
+   aborting an in-flight fetch — the SX engine cancels superseded requests on a
+   debounced filter or a fast nav) must NOT kill the server. SIGPIPE's default
+   action terminates the process before any exception is raised; ignoring it
+   turns the failed write into a catchable Sys_error (EPIPE), which the
+   per-connection handler already swallows, dropping just that one connection. *)
+let () = try Sys.set_signal Sys.sigpipe Sys.Signal_ignore with _ -> ()
+
 (* ====================================================================== *)
 (* Font measurement via otfm — reads OpenType/TrueType font tables         *)
 (* ====================================================================== *)
@@ -522,9 +530,61 @@ let rec load_library_file path =
       Printf.eprintf "[load-library] %s: %s\n%!" (Filename.basename path) msg
   ) exprs
 
-(** IO-aware CEK run — handles suspension by dispatching IO requests.
-    Import requests are handled locally (load .sx file).
-    Other IO requests are sent to the Python bridge. *)
+(* IO-aware CEK run (cek_run_with_io, below) — handles suspension by dispatching
+   IO requests. Import requests are handled locally (load .sx file). *)
+(** Resolve a single IO request value to its response. Shared by
+    cek_run_with_io's suspension loop AND the _cek_io_resolver installed for the
+    http-listen serving path, so the synchronous inline-resolve path (sx_vm.ml's
+    HO-callback suspend fix) resolves durable reads byte-identically to the
+    CEK-driven path. Without an installed resolver, a `perform` inside an HO
+    primitive callback (map/filter/…) unwinds the native loop and corrupts the
+    stack — the host's map/rest/drop serving-JIT miscompile. *)
+and resolve_io_request request =
+  let op = match Sx_runtime.get_val request (String "op") with String s -> s | _ -> "" in
+  (match op with
+   | "import" ->
+     (* Resolve library locally — load the .sx file *)
+     let lib_spec = Sx_runtime.get_val request (String "library") in
+     (* library_loaded_p takes the library SPEC and computes the key itself —
+        passing an already-computed key string double-applies library_name_key
+        and crashes (sx_to_list on a string). *)
+     if Sx_types.sx_truthy (Sx_ref.library_loaded_p lib_spec) then
+       (* Already loaded — just resume *)
+       Nil
+     else begin
+       (match resolve_library_path lib_spec with
+        | Some path -> load_library_file path
+        | None ->
+          Printf.eprintf "[import] WARNING: no file for library %s\n%!"
+            (Sx_runtime.value_to_str lib_spec));
+       Nil
+     end
+   | "text-measure" ->
+     let args = let a = Sx_runtime.get_val request (String "args") in
+       (match a with List l -> l | _ -> [a]) in
+     let font = match args with String f :: _ -> f | _ -> "serif" in
+     let size = match args with
+       | [_font; Number sz; _text] -> sz
+       | [_font; Number sz] -> sz
+       | _ -> 16.0 in
+     let text = match args with
+       | [_font; _sz; String t] -> t
+       | _ -> "" in
+     let (w, h, asc, desc) = measure_text_otfm font size text in
+     let d = Hashtbl.create 4 in
+     Hashtbl.replace d "width" (Number w);
+     Hashtbl.replace d "height" (Number h);
+     Hashtbl.replace d "ascent" (Number asc);
+     Hashtbl.replace d "descent" (Number desc);
+     Dict d
+   | _ ->
+     let argsv = Sx_runtime.get_val request (String "args") in
+     (match Sx_persist_store.handle_op op argsv with
+      | Some resp -> resp
+      | None ->
+        let args = (match argsv with List l -> l | _ -> [argsv]) in
+        io_request op args))
+
 and cek_run_with_io state =
   let s = ref state in
   let is_terminal s = match Sx_ref.cek_terminal_p s with Bool true -> true | _ -> false in
@@ -535,49 +595,7 @@ and cek_run_with_io state =
     done;
     if is_suspended !s then begin
       let request = Sx_runtime.get_val !s (String "request") in
-      let op = match Sx_runtime.get_val request (String "op") with String s -> s | _ -> "" in
-      let response = match op with
-        | "import" ->
-          (* Resolve library locally — load the .sx file *)
-          let lib_spec = Sx_runtime.get_val request (String "library") in
-          let key = Sx_ref.library_name_key lib_spec in
-          if Sx_types.sx_truthy (Sx_ref.library_loaded_p key) then
-            (* Already loaded — just resume *)
-            Nil
-          else begin
-            (match resolve_library_path lib_spec with
-             | Some path -> load_library_file path
-             | None ->
-               Printf.eprintf "[import] WARNING: no file for library %s\n%!"
-                 (Sx_runtime.value_to_str lib_spec));
-            Nil
-          end
-        | "text-measure" ->
-          let args = let a = Sx_runtime.get_val request (String "args") in
-            (match a with List l -> l | _ -> [a]) in
-          let font = match args with String f :: _ -> f | _ -> "serif" in
-          let size = match args with
-            | [_font; Number sz; _text] -> sz
-            | [_font; Number sz] -> sz
-            | _ -> 16.0 in
-          let text = match args with
-            | [_font; _sz; String t] -> t
-            | _ -> "" in
-          let (w, h, asc, desc) = measure_text_otfm font size text in
-          let d = Hashtbl.create 4 in
-          Hashtbl.replace d "width" (Number w);
-          Hashtbl.replace d "height" (Number h);
-          Hashtbl.replace d "ascent" (Number asc);
-          Hashtbl.replace d "descent" (Number desc);
-          Dict d
-        | _ ->
-          let argsv = Sx_runtime.get_val request (String "args") in
-          (match Sx_persist_store.handle_op op argsv with
-           | Some resp -> resp
-           | None ->
-             let args = (match argsv with List l -> l | _ -> [argsv]) in
-             io_request op args)
-      in
+      let response = resolve_io_request request in
       s := Sx_ref.cek_resume !s response;
       loop ()
     end else
@@ -745,9 +763,27 @@ let setup_evaluator_bridge env =
         | _ -> raise (Eval_error "http-listen: (port handler)") in
       let sock = Unix.socket Unix.PF_INET Unix.SOCK_STREAM 0 in
       Unix.setsockopt sock Unix.SO_REUSEADDR true;
+      (* Bind host: loopback by default (safe for tests + local runs); set
+         SX_HTTP_HOST=0.0.0.0 to expose on the network (container/Caddy). *)
+      let bind_addr =
+        match Sys.getenv_opt "SX_HTTP_HOST" with
+        | Some h -> (try Unix.inet_addr_of_string h
+                     with _ -> Unix.inet_addr_loopback)
+        | None -> Unix.inet_addr_loopback in
       Unix.bind sock
-        (Unix.ADDR_INET (Unix.inet_addr_loopback, port));
+        (Unix.ADDR_INET (bind_addr, port));
       Unix.listen sock 64;
+      (* Install the synchronous IO resolver for the serving path. Without it, a
+         `perform` (durable kv read) that fires inside an HO-primitive callback
+         (map/filter/reduce/…) during request handling suspends through the
+         native OCaml loop, dropping its iteration state and leaving the stack
+         misaligned — the serving-JIT host miscompile (map/rest/drop wrong args,
+         blank pages, empty picker). With a resolver installed, sx_vm.ml resolves
+         that callback's IO inline (byte-identically to cek_run_with_io) and the
+         loop is never unwound. Only set if one isn't already installed. *)
+      (if !Sx_types._cek_io_resolver = None then
+         Sx_types._cek_io_resolver :=
+           Some (fun request _state -> resolve_io_request request));
       (* SX runtime is shared across threads — serialize handler calls. *)
       let mtx = Mutex.create () in
       let reason = function
@@ -807,9 +843,31 @@ let setup_evaluator_bridge env =
              Hashtbl.replace req "body" (String body);
              Mutex.lock mtx;
              let resp =
-               (try Sx_runtime.sx_call handler [Dict req]
-                with e -> Mutex.unlock mtx; raise e) in
-             Mutex.unlock mtx;
+               (* Run the handler through the IO-aware CEK runner (not bare
+                  sx_call) so request handlers can perform per-request IO —
+                  durable store reads/writes resolve via cek_run_with_io's
+                  suspension loop instead of returning an unresolved suspension.
+                  On ANY handler exception, synthesise a 500 response rather than
+                  letting it escape: an escaped exception drops the connection
+                  with no bytes written, which a reverse proxy (Caddy/Cloudflare)
+                  surfaces as a 502 error page. A real 500 keeps the origin
+                  responsive and debuggable. Note: a native exception (e.g. the
+                  parser's Parse_error) cannot be caught by an SX (guard ...), so
+                  this boundary is the only place it can be trapped. *)
+               (try
+                  let st = Sx_ref.continue_with_call handler
+                             (List [Dict req]) (Env (Sx_types.make_env ()))
+                             (List [Dict req]) (List []) in
+                  let r = cek_run_with_io st in
+                  Mutex.unlock mtx; r
+                with e ->
+                  Mutex.unlock mtx;
+                  Printf.eprintf "[http-listen] handler error: %s\n%!"
+                    (Printexc.to_string e);
+                  let d = Sx_types.make_dict () in
+                  Hashtbl.replace d "status" (Integer 500);
+                  Hashtbl.replace d "body" (String "Internal Server Error");
+                  Dict d) in
              let getk k = match resp with
                | Dict h -> Hashtbl.find_opt h k | _ -> None in
              let status = match getk "status" with
@@ -835,6 +893,18 @@ let setup_evaluator_bridge env =
              List.iter (fun (k, v) ->
                Buffer.add_string buf
                  (Printf.sprintf "%s: %s\r\n" k v)) rhdrs;
+             (* Cookies: a response carries :set-cookies as a LIST of pre-formatted
+                cookie strings (Dream's dream-set-cookie), because a headers Dict
+                cannot hold more than one Set-Cookie. Emit one header per item. *)
+             (match getk "set-cookies" with
+              | Some (List items) ->
+                List.iter (fun v ->
+                  match v with
+                  | String s ->
+                    Buffer.add_string buf
+                      (Printf.sprintf "Set-Cookie: %s\r\n" s)
+                  | _ -> ()) items
+              | _ -> ());
              if not (List.exists
                        (fun (k, _) ->
                           String.lowercase_ascii k = "content-type")
@@ -1227,6 +1297,20 @@ let setup_type_constructors env =
       (* Already a value — return as-is *)
       v
     | _ -> raise (Eval_error "parse: expected string"));
+  (* Like parse, but returns nil instead of raising on malformed input. The
+     parser raises a native Parse_error that an SX-level (guard ...) cannot catch
+     (guard only traps SX conditions, not host exceptions), so code that handles
+     untrusted text — e.g. a stored post body — needs a value-returning parse to
+     degrade gracefully rather than crash the request. *)
+  bind "parse-safe" (fun args ->
+    match args with
+    | [String s] | [SxExpr s] ->
+      (try
+         let exprs = Sx_parser.parse_all s in
+         (match exprs with [e] -> e | _ -> List exprs)
+       with _ -> Nil)
+    | [v] -> v
+    | _ -> Nil);
   (* Native bytecode compiler — bootstrapped from lib/compiler.sx *)
   bind "compile" (fun args ->
     match args with [expr] -> Sx_compiler.compile expr | _ -> Nil);
@@ -1714,6 +1798,10 @@ let rec dispatch env cmd =
         | Nil -> "nil"
         | Bool true -> "true" | Bool false -> "false"
         | Number n -> Sx_types.format_number n
+        (* Bytecode opcodes + arity/upvalue-count are Integers; without this case
+           they hit the `_ -> "nil"` fallthrough, so every .sxbc came out as
+           `:bytecode (nil nil ...)` -> "VM: unknown opcode 0" -> source fallback. *)
+        | Integer n -> string_of_int n
         | String s -> "\"" ^ escape_sx_string s ^ "\""
         | Symbol s -> s | Keyword k -> ":" ^ k
         | List items | ListRef { contents = items } -> "(" ^ String.concat " " (List.map raw_serialize items) ^ ")"
@@ -1741,8 +1829,9 @@ let rec dispatch env cmd =
             | _ -> "" in
           let response = if op = "import" then begin
             let lib_spec = Sx_runtime.get_val request (String "library") in
-            let key = Sx_ref.library_name_key lib_spec in
-            if Sx_types.sx_truthy (Sx_ref.library_loaded_p key) then Nil
+            (* pass the SPEC, not a pre-computed key — library_loaded_p applies
+               library_name_key itself (a key string would crash sx_to_list). *)
+            if Sx_types.sx_truthy (Sx_ref.library_loaded_p lib_spec) then Nil
             else begin
               (match resolve_library_path lib_spec with
                | Some path -> load_library_file path | None -> ());
@@ -4901,6 +4990,14 @@ let () =
   else begin
     (* Normal persistent server mode *)
     let env = make_server_env () in
+    (* render-page: render an (unevaluated) SX page/component expression to HTML
+       using the server env, so http-listen handlers can serve interactive SX
+       pages. render-to-html expands components + collects keyword attrs itself;
+       SX handlers can't reach the server env, so this primitive supplies it. *)
+    ignore (env_bind env "render-page" (NativeFn ("render-page", fun args ->
+      match args with
+      | expr :: _ -> String (sx_render_to_html expr env)
+      | _ -> raise (Eval_error "render-page: (expr)"))));
     (* JIT in the epoch serving mode is OPT-IN via SX_SERVING_JIT=1.
        Default OFF: this mode is the shared command channel used by every
        loop's conformance runner, and enabling JIT globally regresses

hosts/ocaml/browser/bundle.sh

@@ -71,6 +71,11 @@ cp "$ROOT/shared/sx/templates/tw-layout.sx" "$DIST/sx/"
 cp "$ROOT/shared/sx/templates/tw-type.sx"   "$DIST/sx/"
 cp "$ROOT/shared/sx/templates/tw.sx"        "$DIST/sx/"
 
+# 9b. Host app components (content-addressed, client-expanded on boosted nav).
+# Listed in the host's data-sx-manifest "boot" array so the client eager-loads
+# them after the web stack — see lib/host/static.sx + sx-platform.js loadWebStack.
+cp "$ROOT/lib/host/sx/relate-picker.sx" "$DIST/sx/"
+
 # 10. Hyperscript
 for f in tokenizer parser compiler runtime integration htmx; do
   cp "$ROOT/lib/hyperscript/$f.sx" "$DIST/sx/hs-$f.sx"

hosts/ocaml/browser/compile-modules.js

@@ -48,6 +48,8 @@ const SOURCE_MAP = {
   'boot.sx': 'web/boot.sx',
   'tw-layout.sx': 'web/tw-layout.sx', 'tw-type.sx': 'web/tw-type.sx', 'tw.sx': 'web/tw.sx',
   'text-layout.sx': 'lib/text-layout.sx',
+  // Host app components (content-addressed, client-expanded on boosted nav).
+  'relate-picker.sx': 'lib/host/sx/relate-picker.sx',
 };
 let synced = 0;
 for (const [dist, src] of Object.entries(SOURCE_MAP)) {
@@ -87,6 +89,8 @@ const FILES = [
   'hs-tokenizer.sx', 'hs-parser.sx', 'hs-compiler.sx', 'hs-runtime.sx',
   'hs-worker.sx', 'hs-prolog.sx',
   'hs-integration.sx', 'hs-htmx.sx',
+  // Host app components — standalone defcomps, no inter-module deps.
+  'relate-picker.sx',
   'boot.sx',
 ];
 

hosts/ocaml/browser/sx-platform.js

@@ -646,6 +646,18 @@
     // Load entry point itself (boot.sx — not a library, just defines + init)
     loadBytecodeFile("sx/" + entry.file) || loadSxFile("sx/" + entry.file.replace(/\.sxbc$/, '.sx'));
 
+    // App components: the page's data-sx-manifest "boot" array lists app-specific
+    // modules (e.g. ~relate-picker) to eager-load after the web stack, so their
+    // defcomps are registered before a boosted fragment references them. Loaded
+    // content-addressed, the same as any module.
+    var pageM = loadPageManifest();
+    if (pageM && pageM.boot && pageM.boot.length) {
+      for (var b = 0; b < pageM.boot.length; b++) {
+        var bf = pageM.boot[b];
+        loadBytecodeFile("sx/" + bf) || loadSxFile("sx/" + bf.replace(/\.sxbc$/, '.sx'));
+      }
+    }
+
     if (K.endModuleLoad) K.endModuleLoad();
     var count = Object.keys(_loadedLibs).length + 1; // +1 for entry
     var dt = Math.round(performance.now() - t0);

hosts/ocaml/browser/sx_browser.ml

@@ -73,6 +73,7 @@ let rec value_to_js (v : value) : Js.Unsafe.any =
   | Nil -> Js.Unsafe.inject Js.null
   | Bool b -> Js.Unsafe.inject (Js.bool b)
   | Number n -> Js.Unsafe.inject (Js.number_of_float n)
+  | Integer n -> Js.Unsafe.inject (Js.number_of_float (float_of_int n))
   | String s -> Js.Unsafe.inject (Js.string s)
   | RawHTML s -> Js.Unsafe.inject (Js.string s)
   | Symbol s ->
@@ -329,8 +330,9 @@ let handle_import_suspension request =
   let lib_spec = match request with
     | Dict d -> (match Hashtbl.find_opt d "library" with Some v -> v | _ -> Nil)
     | _ -> Nil in
-  let key = Sx_ref.library_name_key lib_spec in
-  if Sx_types.sx_truthy (Sx_ref.library_loaded_p key) then
+  (* library_loaded_p takes the SPEC and applies library_name_key itself —
+     passing a pre-computed key string double-applies it and crashes. *)
+  if Sx_types.sx_truthy (Sx_ref.library_loaded_p lib_spec) then
     Some Nil  (* Already loaded — resume immediately *)
   else
     None  (* Not loaded — JS platform must fetch it *)

hosts/ocaml/lib/sx_cbor.ml

@@ -15,25 +15,29 @@ exception Cbor_error of string
 
 let write_head buf major v =
   let m = major lsl 5 in
+  (* Width selection + big-endian byte emission via Int64, so the web targets
+     compute identically to native: on js_of_ocaml [int] is 32-bit, so the
+     literal 0x100000000 (2^32) truncates to 0 (sending small values to the
+     8-byte branch) and [v lsr (8*i)] with i>=4 is shift-mod-32. Int64 has the
+     full 64-bit width and well-defined shifts on every target. *)
+  let v64 = Int64.of_int v in
+  let put_be nbytes =
+    for i = nbytes - 1 downto 0 do
+      Buffer.add_char buf
+        (Char.chr (Int64.to_int
+           (Int64.logand (Int64.shift_right_logical v64 (8 * i)) 0xFFL)))
+    done
+  in
   if v < 24 then
     Buffer.add_char buf (Char.chr (m lor v))
   else if v < 0x100 then begin
-    Buffer.add_char buf (Char.chr (m lor 24));
-    Buffer.add_char buf (Char.chr v)
+    Buffer.add_char buf (Char.chr (m lor 24)); put_be 1
   end else if v < 0x10000 then begin
-    Buffer.add_char buf (Char.chr (m lor 25));
-    Buffer.add_char buf (Char.chr ((v lsr 8) land 0xFF));
-    Buffer.add_char buf (Char.chr (v land 0xFF))
-  end else if v < 0x100000000 then begin
-    Buffer.add_char buf (Char.chr (m lor 26));
-    for i = 3 downto 0 do
-      Buffer.add_char buf (Char.chr ((v lsr (8 * i)) land 0xFF))
-    done
+    Buffer.add_char buf (Char.chr (m lor 25)); put_be 2
+  end else if Int64.compare v64 0x100000000L < 0 then begin
+    Buffer.add_char buf (Char.chr (m lor 26)); put_be 4
   end else begin
-    Buffer.add_char buf (Char.chr (m lor 27));
-    for i = 7 downto 0 do
-      Buffer.add_char buf (Char.chr ((v lsr (8 * i)) land 0xFF))
-    done
+    Buffer.add_char buf (Char.chr (m lor 27)); put_be 8
   end
 
 (* dag-cbor map key order: shorter key first, then bytewise. *)

hosts/ocaml/lib/sx_cid.ml

@@ -32,7 +32,11 @@ let base32_lower (s : string) : string =
     while !bits >= 5 do
       bits := !bits - 5;
       Buffer.add_char buf b32_alpha.[(!acc lsr !bits) land 0x1f]
-    done) s;
+    done;
+    (* Keep only the unconsumed low [bits] bits, so [acc] stays tiny (< 2^13).
+       Without this it grows by 8 bits per byte and overflows native [int] on
+       the 32-bit web targets, corrupting the emitted symbols. *)
+    acc := !acc land ((1 lsl !bits) - 1)) s;
   if !bits > 0 then
     Buffer.add_char buf b32_alpha.[(!acc lsl (5 - !bits)) land 0x1f];
   Buffer.contents buf

hosts/ocaml/lib/sx_ed25519.ml

@@ -68,15 +68,22 @@ let sub (a : bn) (b : bn) : bn =
   norm r
 
 let mul (a : bn) (b : bn) : bn =
+  (* Accumulate in Int64: a limb product is 26+26 = 52 bits, which overflows the
+     web targets' int (32-bit js_of_ocaml / 31-bit wasm_of_ocaml). Int64 is a
+     real 64-bit type on every target, so the carries are exact. *)
   let la = Array.length a and lb = Array.length b in
   let r = Array.make (la + lb) 0 in
+  let maskL = Int64.of_int mask in
   for i = 0 to la - 1 do
-    let carry = ref 0 in
+    let carry = ref 0L in
+    let ai = Int64.of_int a.(i) in
     for j = 0 to lb - 1 do
-      let s = r.(i + j) + a.(i) * b.(j) + !carry in
-      r.(i + j) <- s land mask; carry := s lsr bits
+      let s = Int64.add (Int64.add (Int64.of_int r.(i + j))
+                           (Int64.mul ai (Int64.of_int b.(j)))) !carry in
+      r.(i + j) <- Int64.to_int (Int64.logand s maskL);
+      carry := Int64.shift_right_logical s bits
     done;
-    r.(i + lb) <- r.(i + lb) + !carry
+    r.(i + lb) <- r.(i + lb) + Int64.to_int !carry
   done;
   norm r
 
@@ -109,12 +116,16 @@ let bn_mod (a : bn) (m : bn) : bn =
   end
 
 let div_small (a : bn) (d : int) : bn =
+  (* [rem lsl bits] reaches ~2^34 (rem < d <= 256, bits = 26), past the web
+     targets' int width — accumulate the running remainder in Int64. *)
   let la = Array.length a in
   let q = Array.make la 0 in
-  let rem = ref 0 in
+  let rem = ref 0L in
+  let dL = Int64.of_int d in
   for i = la - 1 downto 0 do
-    let cur = (!rem lsl bits) lor a.(i) in
-    q.(i) <- cur / d; rem := cur mod d
+    let cur = Int64.logor (Int64.shift_left !rem bits) (Int64.of_int a.(i)) in
+    q.(i) <- Int64.to_int (Int64.div cur dL);
+    rem := Int64.rem cur dL
   done;
   norm q
 

hosts/ocaml/lib/sx_ref.ml

@@ -404,7 +404,7 @@ and library_loaded_p spec =
 
 (* library-exports *)
 and library_exports spec =
-  (get ((get (_library_registry_) ((library_name_key (spec))))) ((String "exports")))
+  (let entry = (get (_library_registry_) ((library_name_key (spec)))) in (if sx_truthy (entry) then (get (entry) ((String "exports"))) else (Dict (Hashtbl.create 0))))
 
 (* register-library *)
 and register_library spec exports =

hosts/ocaml/lib/sx_sha2.ml

@@ -3,37 +3,40 @@
     No C stubs, no external deps. Used by the fed-sx host primitives
     [crypto-sha256] / [crypto-sha512]. Reference: FIPS 180-4. *)
 
-(* ---- SHA-256 (FIPS 180-4 §6.2). 32-bit words held in native int,
-   masked to 32 bits after every arithmetic op. ---- *)
-
-let mask32 = 0xFFFFFFFF
+(* ---- SHA-256 (FIPS 180-4 §6.2). 32-bit words via Int32, NOT native int.
+   On the web targets the kernel is compiled by js_of_ocaml (32-bit int) and
+   wasm_of_ocaml (31-bit int), where native [int] silently truncates the 32-bit
+   round words — producing WRONG digests (and, downstream, bad CIDs and a
+   Char.chr crash at kernel init). Int32 has well-defined wrap-around mod 2^32 on
+   every target, so this matches the 63-bit native build exactly. ---- *)
 
 let k256 = [|
-  0x428a2f98; 0x71374491; 0xb5c0fbcf; 0xe9b5dba5;
-  0x3956c25b; 0x59f111f1; 0x923f82a4; 0xab1c5ed5;
-  0xd807aa98; 0x12835b01; 0x243185be; 0x550c7dc3;
-  0x72be5d74; 0x80deb1fe; 0x9bdc06a7; 0xc19bf174;
-  0xe49b69c1; 0xefbe4786; 0x0fc19dc6; 0x240ca1cc;
-  0x2de92c6f; 0x4a7484aa; 0x5cb0a9dc; 0x76f988da;
-  0x983e5152; 0xa831c66d; 0xb00327c8; 0xbf597fc7;
-  0xc6e00bf3; 0xd5a79147; 0x06ca6351; 0x14292967;
-  0x27b70a85; 0x2e1b2138; 0x4d2c6dfc; 0x53380d13;
-  0x650a7354; 0x766a0abb; 0x81c2c92e; 0x92722c85;
-  0xa2bfe8a1; 0xa81a664b; 0xc24b8b70; 0xc76c51a3;
-  0xd192e819; 0xd6990624; 0xf40e3585; 0x106aa070;
-  0x19a4c116; 0x1e376c08; 0x2748774c; 0x34b0bcb5;
-  0x391c0cb3; 0x4ed8aa4a; 0x5b9cca4f; 0x682e6ff3;
-  0x748f82ee; 0x78a5636f; 0x84c87814; 0x8cc70208;
-  0x90befffa; 0xa4506ceb; 0xbef9a3f7; 0xc67178f2 |]
+  0x428a2f98l; 0x71374491l; 0xb5c0fbcfl; 0xe9b5dba5l;
+  0x3956c25bl; 0x59f111f1l; 0x923f82a4l; 0xab1c5ed5l;
+  0xd807aa98l; 0x12835b01l; 0x243185bel; 0x550c7dc3l;
+  0x72be5d74l; 0x80deb1fel; 0x9bdc06a7l; 0xc19bf174l;
+  0xe49b69c1l; 0xefbe4786l; 0x0fc19dc6l; 0x240ca1ccl;
+  0x2de92c6fl; 0x4a7484aal; 0x5cb0a9dcl; 0x76f988dal;
+  0x983e5152l; 0xa831c66dl; 0xb00327c8l; 0xbf597fc7l;
+  0xc6e00bf3l; 0xd5a79147l; 0x06ca6351l; 0x14292967l;
+  0x27b70a85l; 0x2e1b2138l; 0x4d2c6dfcl; 0x53380d13l;
+  0x650a7354l; 0x766a0abbl; 0x81c2c92el; 0x92722c85l;
+  0xa2bfe8a1l; 0xa81a664bl; 0xc24b8b70l; 0xc76c51a3l;
+  0xd192e819l; 0xd6990624l; 0xf40e3585l; 0x106aa070l;
+  0x19a4c116l; 0x1e376c08l; 0x2748774cl; 0x34b0bcb5l;
+  0x391c0cb3l; 0x4ed8aa4al; 0x5b9cca4fl; 0x682e6ff3l;
+  0x748f82eel; 0x78a5636fl; 0x84c87814l; 0x8cc70208l;
+  0x90befffal; 0xa4506cebl; 0xbef9a3f7l; 0xc67178f2l |]
 
-let rotr32 x n = ((x lsr n) lor (x lsl (32 - n))) land mask32
+let rotr32 (x : int32) (n : int) : int32 =
+  Int32.logor (Int32.shift_right_logical x n) (Int32.shift_left x (32 - n))
 
 let sha256_hex (msg : string) : string =
-  let h = [| 0x6a09e667; 0xbb67ae85; 0x3c6ef372; 0xa54ff53a;
-             0x510e527f; 0x9b05688c; 0x1f83d9ab; 0x5be0cd19 |] in
+  let h = [| 0x6a09e667l; 0xbb67ae85l; 0x3c6ef372l; 0xa54ff53al;
+             0x510e527fl; 0x9b05688cl; 0x1f83d9abl; 0x5be0cd19l |] in
   let len = String.length msg in
   (* Padded length: multiple of 64 bytes. *)
-  let bitlen = len * 8 in
+  let bitlen = Int64.mul (Int64.of_int len) 8L in
   let padlen =
     let r = (len + 1) mod 64 in
     if r <= 56 then 56 - r else 120 - r
@@ -42,60 +45,79 @@ let sha256_hex (msg : string) : string =
   let buf = Bytes.make total '\000' in
   Bytes.blit_string msg 0 buf 0 len;
   Bytes.set buf len '\x80';
-  (* 64-bit big-endian bit length (we cap at OCaml int range). *)
+  (* 64-bit big-endian bit length. Int64 shifts so the high bytes (shift >= 32)
+     are correct on the 32-bit web targets — native int `lsr 32` is shift-mod-32
+     on js_of_ocaml and would leak the low length byte into a higher word. *)
   for i = 0 to 7 do
     Bytes.set buf (total - 1 - i)
-      (Char.chr ((bitlen lsr (8 * i)) land 0xFF))
+      (Char.chr (Int64.to_int
+         (Int64.logand (Int64.shift_right_logical bitlen (8 * i)) 0xFFL)))
   done;
-  let w = Array.make 64 0 in
+  let byte i = Int32.of_int (Char.code (Bytes.get buf i)) in
+  let w = Array.make 64 0l in
   let nblocks = total / 64 in
   for b = 0 to nblocks - 1 do
     let base = b * 64 in
     for t = 0 to 15 do
       let o = base + t * 4 in
       w.(t) <-
-        (Char.code (Bytes.get buf o) lsl 24)
-        lor (Char.code (Bytes.get buf (o + 1)) lsl 16)
-        lor (Char.code (Bytes.get buf (o + 2)) lsl 8)
-        lor (Char.code (Bytes.get buf (o + 3)))
+        Int32.logor
+          (Int32.logor
+             (Int32.shift_left (byte o) 24)
+             (Int32.shift_left (byte (o + 1)) 16))
+          (Int32.logor
+             (Int32.shift_left (byte (o + 2)) 8)
+             (byte (o + 3)))
     done;
     for t = 16 to 63 do
       let s0 =
-        (rotr32 w.(t - 15) 7) lxor (rotr32 w.(t - 15) 18)
-        lxor (w.(t - 15) lsr 3) in
+        Int32.logxor
+          (Int32.logxor (rotr32 w.(t - 15) 7) (rotr32 w.(t - 15) 18))
+          (Int32.shift_right_logical w.(t - 15) 3) in
       let s1 =
-        (rotr32 w.(t - 2) 17) lxor (rotr32 w.(t - 2) 19)
-        lxor (w.(t - 2) lsr 10) in
-      w.(t) <- (w.(t - 16) + s0 + w.(t - 7) + s1) land mask32
+        Int32.logxor
+          (Int32.logxor (rotr32 w.(t - 2) 17) (rotr32 w.(t - 2) 19))
+          (Int32.shift_right_logical w.(t - 2) 10) in
+      w.(t) <-
+        Int32.add (Int32.add w.(t - 16) s0) (Int32.add w.(t - 7) s1)
     done;
     let a = ref h.(0) and bb = ref h.(1) and c = ref h.(2)
     and d = ref h.(3) and e = ref h.(4) and f = ref h.(5)
     and g = ref h.(6) and hh = ref h.(7) in
     for t = 0 to 63 do
       let s1 =
-        (rotr32 !e 6) lxor (rotr32 !e 11) lxor (rotr32 !e 25) in
-      let ch = (!e land !f) lxor ((lnot !e land mask32) land !g) in
-      let t1 = (!hh + s1 + ch + k256.(t) + w.(t)) land mask32 in
+        Int32.logxor
+          (Int32.logxor (rotr32 !e 6) (rotr32 !e 11)) (rotr32 !e 25) in
+      let ch =
+        Int32.logxor (Int32.logand !e !f)
+          (Int32.logand (Int32.lognot !e) !g) in
+      let t1 =
+        Int32.add
+          (Int32.add (Int32.add !hh s1) (Int32.add ch k256.(t))) w.(t) in
       let s0 =
-        (rotr32 !a 2) lxor (rotr32 !a 13) lxor (rotr32 !a 22) in
-      let maj = (!a land !bb) lxor (!a land !c) lxor (!bb land !c) in
-      let t2 = (s0 + maj) land mask32 in
+        Int32.logxor
+          (Int32.logxor (rotr32 !a 2) (rotr32 !a 13)) (rotr32 !a 22) in
+      let maj =
+        Int32.logxor
+          (Int32.logxor (Int32.logand !a !bb) (Int32.logand !a !c))
+          (Int32.logand !bb !c) in
+      let t2 = Int32.add s0 maj in
       hh := !g; g := !f; f := !e;
-      e := (!d + t1) land mask32;
+      e := Int32.add !d t1;
       d := !c; c := !bb; bb := !a;
-      a := (t1 + t2) land mask32
+      a := Int32.add t1 t2
     done;
-    h.(0) <- (h.(0) + !a) land mask32;
-    h.(1) <- (h.(1) + !bb) land mask32;
-    h.(2) <- (h.(2) + !c) land mask32;
-    h.(3) <- (h.(3) + !d) land mask32;
-    h.(4) <- (h.(4) + !e) land mask32;
-    h.(5) <- (h.(5) + !f) land mask32;
-    h.(6) <- (h.(6) + !g) land mask32;
-    h.(7) <- (h.(7) + !hh) land mask32
+    h.(0) <- Int32.add h.(0) !a;
+    h.(1) <- Int32.add h.(1) !bb;
+    h.(2) <- Int32.add h.(2) !c;
+    h.(3) <- Int32.add h.(3) !d;
+    h.(4) <- Int32.add h.(4) !e;
+    h.(5) <- Int32.add h.(5) !f;
+    h.(6) <- Int32.add h.(6) !g;
+    h.(7) <- Int32.add h.(7) !hh
   done;
   let out = Buffer.create 64 in
-  Array.iter (fun x -> Buffer.add_string out (Printf.sprintf "%08x" x)) h;
+  Array.iter (fun x -> Buffer.add_string out (Printf.sprintf "%08lx" x)) h;
   Buffer.contents out
 
 (* ---- SHA-512 (FIPS 180-4 §6.4). 64-bit words via Int64.
@@ -146,7 +168,7 @@ let sha512_hex (msg : string) : string =
              0x510e527fade682d1L; 0x9b05688c2b3e6c1fL;
              0x1f83d9abfb41bd6bL; 0x5be0cd19137e2179L |] in
   let len = String.length msg in
-  let bitlen = len * 8 in
+  let bitlen = Int64.mul (Int64.of_int len) 8L in
   (* Pad to a multiple of 128 bytes; 16-byte big-endian length. *)
   let padlen =
     let r = (len + 1) mod 128 in
@@ -156,9 +178,12 @@ let sha512_hex (msg : string) : string =
   let buf = Bytes.make total '\000' in
   Bytes.blit_string msg 0 buf 0 len;
   Bytes.set buf len '\x80';
+  (* Low 64 bits of the bit length (high 64 stay 0). Int64 shifts so the bytes
+     at shift >= 32 are correct on the 32-bit web targets (js shift-mod-32). *)
   for i = 0 to 7 do
     Bytes.set buf (total - 1 - i)
-      (Char.chr ((bitlen lsr (8 * i)) land 0xFF))
+      (Char.chr (Int64.to_int
+         (Int64.logand (Int64.shift_right_logical bitlen (8 * i)) 0xFFL)))
   done;
   let w = Array.make 80 0L in
   let nblocks = total / 128 in

lib/dream/form.sx

@@ -58,6 +58,43 @@
       ((s2 (replace s "+" " ")))
       (dr/url-decode-loop s2 0 (string-length s2) ""))))
 
+;; ── percent encoding (symmetric with dr/url-decode) ────────────────
+;; RFC3986 unreserved set passes through; everything else is %XX (uppercase
+;; hex). Space becomes %20 (not +), so the result is safe in a query value.
+(define dr/hex-chars "0123456789ABCDEF")
+(define
+  dr/url-encode-char
+  (fn
+    (c)
+    (let
+      ((n (char-code c)))
+      (if
+        (or
+          (and (>= n 48) (<= n 57))   ;; 0-9
+          (and (>= n 65) (<= n 90))   ;; A-Z
+          (and (>= n 97) (<= n 122))  ;; a-z
+          (= c "-") (= c "_") (= c ".") (= c "~"))
+        c
+        (str "%"
+          (char-at dr/hex-chars (quotient n 16))
+          (char-at dr/hex-chars (mod n 16)))))))
+
+(define
+  dr/url-encode-loop
+  (fn
+    (s i n acc)
+    (if
+      (>= i n)
+      acc
+      (dr/url-encode-loop s (+ i 1) n
+        (str acc (dr/url-encode-char (char-at s i)))))))
+
+(define
+  dr/url-encode
+  (fn
+    (s)
+    (dr/url-encode-loop (or s "") 0 (string-length (or s "")) "")))
+
 ;; ── substring splitter (split primitive is char-class based) ───────
 (define
   dr/split-on

lib/host/auth.sx

@@ -0,0 +1,153 @@
+;; lib/host/auth.sx — browser login on top of host sessions (lib/host/session.sx).
+;; A login form posts credentials; on success the principal is written to the
+;; session cookie. The guarded write routes then accept EITHER a logged-in session
+;; OR a Bearer token (host/require-user), so the same routes serve browsers and API
+;; clients. Single admin user; credentials come from $SX_ADMIN_USER / _PASSWORD
+;; (set in serve.sh) — the in-source defaults are dev-only.
+;;
+;; Depends on lib/host/session.sx, lib/host/{handler,middleware}.sx, lib/dream/*
+;; (form/types/session) + the kernel render-page primitive.
+
+;; ── page shell (own copy; render-page renders the static SX tree) ───
+(define host/-auth-page
+  (fn (title body)
+    (str "<!doctype html>"
+      (render-page
+        (quasiquote
+          (html
+            (head (meta :charset "utf-8") (title (unquote title)))
+            (body (unquote body))))))))
+
+;; ── admin credential (override from env in serve.sh) ────────────────
+(define host/admin-user "admin")
+(define host/admin-password "letmein")
+(define host/auth-set-admin!
+  (fn (u p) (begin (set! host/admin-user u) (set! host/admin-password p))))
+(define host/-verify-cred
+  (fn (user pass)
+    (and (not (= pass ""))
+         (= user host/admin-user)
+         (= pass host/admin-password))))
+
+;; A return-to target is only honoured if it's a same-site absolute PATH — guards
+;; against an open-redirect (//evil.com, http://…) smuggled through ?next=.
+(define host/-safe-next
+  (fn (n)
+    (if (and n (not (= n "")) (starts-with? n "/") (not (starts-with? n "//")))
+      n "/")))
+
+;; The login form, parameterised by where to return after success.
+(define host/-login-form
+  (fn (next-path message)
+    (host/-auth-page "Log in"
+      (quasiquote
+        (div
+          (h1 "Log in")
+          (unquote (if message (quasiquote (p :style "color:#b00" (unquote message))) ""))
+          (form :method "post" :action "/login"
+            (input :type "hidden" :name "next" :value (unquote next-path))
+            (p (input :name "username" :placeholder "username"))
+            (p (input :name "password" :type "password" :placeholder "password"))
+            (p (button :type "submit" "Log in")))
+          ;; a way back into the app — the login shell is a standalone page (no persistent
+          ;; nav), so without this a logged-out user who followed a guarded link is stranded.
+          (p :style "margin-top:1em" (a :href "/" "← Home")))))))
+
+;; ── GET /login — login form, honouring ?next= (where to go after login) ─────
+(define host/login-page
+  (fn (req)
+    (dream-html
+      (host/-login-form (host/-safe-next (dream-query-param req "next")) nil))))
+
+;; ── POST /login — verify, write session principal, redirect to ?next ────────
+;; The session middleware (host/sessions) has already created/loaded the session
+;; and will set the cookie on this response, so writing :principal here lands on
+;; the right sid and the browser keeps the cookie. On failure the form re-renders
+;; with the same return target so the user lands where they were headed.
+(define host/login-submit
+  (fn (req)
+    (let ((user (host/field req "username"))
+          (pass (host/field req "password"))
+          (next-path (host/-safe-next (host/field req "next"))))
+      (if (host/-verify-cred user pass)
+        (begin
+          (host/login! req user)
+          (dream-redirect next-path))
+        (dream-html-status 401
+          (host/-login-form next-path "Invalid credentials — try again."))))))
+
+;; ── /logout — clear the session, redirect home. Allowed on GET too so a plain
+;; footer link can log out (logout is low-harm, so GET is acceptable here). ─────
+(define host/logout-submit
+  (fn (req)
+    (begin
+      (host/logout! req)
+      (dream-redirect "/"))))
+
+;; ── login routes (mounted by host/make-app) ─────────────────────────
+(define host/auth-routes
+  (list
+    (dream-get "/login" host/login-page)
+    (dream-post "/login" host/login-submit)
+    (dream-get "/logout" host/logout-submit)
+    (dream-post "/logout" host/logout-submit)))
+
+;; ── auth footer fragment ────────────────────────────────────────────
+;; A small SX node pages splice into their footer: "log in" when logged out,
+;; "signed in as <user> · log out" when logged in. Guards a session-less request
+;; (no middleware) so it's safe to call anywhere. Reads the session principal.
+(define host/auth-footer
+  (fn (req)
+    (let ((who (if (get req :dream-session) (host/current-principal req) nil)))
+      (if (and who (not (= who "")))
+        (quasiquote
+          (span (unquote (str "signed in as " who)) " · "
+            (a :href "/logout" "log out")))
+        (quote (a :href "/login" "log in"))))))
+
+;; The authenticated principal for a request, or nil: a logged-in session takes
+;; precedence, else a Bearer token resolved by `resolve` (the API fallback).
+(define host/-principal-of
+  (fn (req resolve)
+    (let ((sp (host/current-principal req)))
+      (if (and sp (not (= sp "")))
+        sp
+        (let ((tok (dream-bearer-token req)))
+          (if tok (resolve tok) nil))))))
+
+;; ── auth middleware (API shape): session principal OR bearer token ──
+;; Place AFTER the session middleware (so host/current-principal can read the
+;; session) and BEFORE host/require-permission. On failure -> JSON 401 with a
+;; Bearer challenge. For API/JSON routes; browser pages want host/require-login.
+(define host/require-user
+  (fn (resolve)
+    (fn (next)
+      (fn (req)
+        (let ((principal (host/-principal-of req resolve)))
+          (if (or (nil? principal) (= principal ""))
+            (dream-add-header
+              (host/error 401 "unauthorized")
+              "www-authenticate" "Bearer")
+            (next (assoc req :dream-principal principal))))))))
+
+;; ── auth middleware (browser shape): same check, but on failure REDIRECT to
+;; the login page with a return-to, instead of a raw JSON 401. Use this for HTML
+;; routes (an edit form, the create form) so an unauthenticated click lands on a
+;; usable login page and returns to where it was headed after logging in. ──
+(define host/require-login
+  (fn (resolve)
+    (fn (next)
+      (fn (req)
+        (let ((principal (host/-principal-of req resolve)))
+          (if (or (nil? principal) (= principal ""))
+            (let ((login-url (str "/login?next=" (host/-safe-next (dream-path req)))))
+              ;; A BOOSTED (SX-Request) request can't be answered with a 303: the browser's
+              ;; fetch follows the redirect WITHOUT the SX-Request header, so /login returns
+              ;; the full HTML shell, which morphed into #content DESTROYS the SPA swap target
+              ;; (every later boosted nav then has nowhere to swap — "nothing happens"). Return
+              ;; an SX-Redirect header instead — the engine does a FULL navigation to /login (a
+              ;; fresh shell). A non-boosted request still gets a plain 303.
+              (if (= (dream-header req "sx-request") "true")
+                (dream-response 200 {:sx-redirect login-url} "")
+                (dream-redirect login-url)))
+            (next (assoc req :dream-principal principal))))))))

lib/host/compose.sx

@@ -0,0 +1,145 @@
+;; lib/host/compose.sx — the composition algebra + its render-fold (plans/composition-objects.md).
+;;
+;; An object's :body is a composition node — a tiny language over object refs:
+;;   (seq …)  sequence   (row/grid …) layout   (alt (when P n)… (else n)) conditional
+;;   (each src tmpl) iteration   + domain leaves   + (tmpl NAME) recursion
+;;
+;; The combinator dispatch (seq/alt/each), the `when` predicate set, the context-environment,
+;; the `each` source, and recursion are SHARED by every domain — they live in the CORE below
+;; (host/comp-fold). A domain plugs in via a small dict {:empty :combine :leaf :overflow};
+;; only the leaves and how results combine differ. The render-fold (render → HTML) is the
+;; first such domain; the execute-fold (execute → effects, lib/host/execute.sx) is the second.
+;; The object's CID is its DEFINITION; a fold is the EXECUTION (per context + data + domain).
+;; Self-contained (no blog deps) so the model can be proven in isolation.
+
+;; ── shared machinery (domain-agnostic) ──────────────────────────────
+;; predicates for `when`, over the context environment.
+(define host/comp--pred?
+  (fn (pred ctx)
+    (let ((op (str (first pred))))
+      (cond
+        ((= op "has") (not (nil? (get ctx (str (first (rest pred)))))))
+        ((= op "eq")  (= (str (get ctx (str (first (rest pred))))) (str (first (rest (rest pred))))))
+        ((= op "not") (not (host/comp--pred? (first (rest pred)) ctx)))
+        (else false)))))
+
+;; the value of a field: the current :item's key, else the context's key.
+(define host/comp--field
+  (fn (k ctx)
+    (let ((item (get ctx "item")) (key (str k)))
+      (if (and item (not (nil? (get item key))))
+        (str (get item key))
+        (str (or (get ctx key) ""))))))
+
+;; the source collection for `each`: literal items, the :item's :children (trees), a named
+;; list field on the :item, or a GRAPH QUERY. `(query REL TYPE)` is data-driven: it delegates
+;; to a resolver bound in the context under "query" (the host injects one with graph access),
+;; so compose.sx stays self-contained — it asks the context for the data.
+(define host/comp--source
+  (fn (src ctx)
+    (let ((op (str (first src))) (item (get ctx "item")))
+      (cond
+        ((= op "items")    (rest src))
+        ((= op "children") (if item (or (get item "children") (list)) (list)))
+        ((= op "field")    (if item (or (get item (str (first (rest src)))) (list)) (list)))
+        ((= op "query")    (let ((qfn (get ctx "query")))
+                             (if qfn (qfn (rest src) ctx) (list))))
+        (else (list))))))
+
+;; template registry (recursion: a template may reference itself by name).
+(define host/comp--tmpls (dict))
+(define host/comp--def-tmpl! (fn (name node) (dict-set! host/comp--tmpls name node)))
+
+;; ── the CORE fold framework (build once, reuse per domain) ──────────
+;; host/comp-fold walks seq/alt/each generically, parameterised by a DOMAIN dict:
+;;   :empty    — the zero result ("" for render, (list) for execute)
+;;   :combine  — merge two results (str for render, concat for execute)
+;;   :overflow — the depth-guard result (a string / an effect)
+;;   :leaf     — (node ctx dom) -> result for any non-core head: the domain's leaves AND its
+;;               own extra combinators (e.g. render's row/grid), which may recurse via the core.
+;; seq, alt+when, each+source, the context-environment, recursion, and the depth guard are
+;; handled HERE, once. A new domain (render, execute, eval, …) is just a new dict.
+(define host/comp--fold-all
+  (fn (nodes ctx dom)
+    (reduce (fn (acc n) ((get dom :combine) acc (host/comp-fold n ctx dom))) (get dom :empty) nodes)))
+(define host/comp--fold-alt
+  (fn (branches ctx dom)
+    (if (empty? branches)
+      (get dom :empty)
+      (let ((br (first branches)) (bh (str (first (first branches)))))
+        (cond
+          ((= bh "else") (host/comp-fold (first (rest br)) ctx dom))
+          ((= bh "when") (if (host/comp--pred? (first (rest br)) ctx)
+                           (host/comp-fold (first (rest (rest br))) ctx dom)
+                           (host/comp--fold-alt (rest branches) ctx dom)))
+          (else (host/comp--fold-alt (rest branches) ctx dom)))))))
+(define host/comp--fold-each
+  (fn (src body ctx dom)
+    (let ((depth (or (get ctx "depth") 0)))
+      (if (> depth 40)
+        (get dom :overflow)
+        (reduce
+          (fn (acc item)
+            ((get dom :combine) acc (host/comp-fold body (merge ctx {"item" item "depth" (+ depth 1)}) dom)))
+          (get dom :empty) (host/comp--source src ctx))))))
+(define host/comp-fold
+  (fn (node ctx dom)
+    (if (not (= (type-of node) "list"))
+      ((get dom :leaf) node ctx dom)
+      (let ((h (str (first node))))
+        (cond
+          ((= h "seq")  (host/comp--fold-all (rest node) ctx dom))
+          ((= h "alt")  (host/comp--fold-alt (rest node) ctx dom))
+          ((= h "each") (host/comp--fold-each (first (rest node)) (first (rest (rest node))) ctx dom))
+          (else ((get dom :leaf) node ctx dom)))))))
+
+;; ── the RENDER domain (render → HTML): leaves + layout combinators ──
+;; card leaf (proof: a labelled box; in the host this renders via the card-type's :template).
+(define host/comp--card
+  (fn (ctype fields)
+    (str "<div class=\"card card-" ctype "\">"
+      (reduce (fn (acc k) (str acc "<b>" k ":</b> " (str (get fields k)) " ")) "" (keys fields))
+      "</div>")))
+
+;; render-leaf handles everything that isn't a core combinator: the layout combinators
+;; row/grid (which recurse via the core), the leaves field/val/text/card, transclusion (ref),
+;; and named-template recursion (tmpl). `field` wraps its value in a <span>; `val` is the raw
+;; value (no markup) for attributes (href/src).
+(define host/comp--render-leaf
+  (fn (node ctx dom)
+    (if (not (= (type-of node) "list"))
+      (str node)
+      (let ((h (str (first node))) (args (rest node)))
+        (cond
+          ((= h "row")   (str "<div class=\"row\" style=\"display:flex;gap:1em\">" (host/comp--fold-all args ctx dom) "</div>"))
+          ((= h "grid")  (str "<div class=\"grid\" style=\"display:grid;gap:1em\">" (host/comp--fold-all args ctx dom) "</div>"))
+          ((= h "field") (str "<span>" (host/comp--field (first args) ctx) "</span>"))
+          ((= h "val")   (host/comp--field (first args) ctx))   ;; raw value, no markup — for attributes
+          ((= h "text")  (str (first args)))
+          ((= h "card")  (host/comp--card (str (first args)) (first (rest args))))
+          ;; ref: TRANSCLUDE another object by id/CID via a context resolver (the host supplies
+          ;; graph access) so compose.sx stays self-contained; a join in the Merkle DAG is free.
+          ((= h "ref")   (let ((rfn (get ctx "ref"))) (if rfn (rfn (str (first args)) ctx) "")))
+          ((= h "tmpl")  (host/comp-fold (get host/comp--tmpls (str (first args))) ctx dom))
+          (else ""))))))
+
+(define host/comp--render-dom
+  {:empty "" :combine str :overflow "<em>(max depth)</em>" :leaf host/comp--render-leaf})
+
+;; public entry: render a composition node against a context environment -> HTML string.
+(define host/comp-render (fn (node ctx) (host/comp-fold node ctx host/comp--render-dom)))
+
+;; ── a THIRD domain (deps → the object ids a composition transcludes) ──
+;; Proof of step 8's claim "a new domain is just a dict + leaf": no new control flow — seq/
+;; alt/each come from the core unchanged; only the leaf + accumulator are new. The deps-leaf
+;; collects `(ref ID)` ids; everything else contributes nothing. Useful in its own right: the
+;; static transclusion set of a body (which card objects it pulls in — the contains DAG for a
+;; (seq (ref c0) (each … (ref …))) body). Context-specific (alt picks the taken branch).
+(define host/comp--deps-leaf
+  (fn (node ctx dom)
+    (if (and (= (type-of node) "list") (= (str (first node)) "ref"))
+      (list (str (first (rest node))))
+      (list))))
+(define host/comp--deps-dom
+  {:empty (list) :combine concat :overflow (list) :leaf host/comp--deps-leaf})
+(define host/comp-deps (fn (node ctx) (host/comp-fold node ctx host/comp--deps-dom)))

lib/host/conformance.sh

@@ -0,0 +1,207 @@
+#!/usr/bin/env bash
+# host-on-sx conformance runner — loads the kernel stdlib, the subsystem
+# libraries the host wires to, the host modules, and the host test suites in one
+# sx_server process, then reports pass/fail per suite. Mirrors lib/dream's runner.
+#
+# Usage:
+#   bash lib/host/conformance.sh            # run all suites
+#   bash lib/host/conformance.sh sxtp       # run ONLY the sxtp suite (fast — skips
+#                                           # the Datalog-heavy blog suite)
+#   bash lib/host/conformance.sh blog -v    # one suite, verbose
+#   bash lib/host/conformance.sh -v         # all suites, verbose
+
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+
+SX_SERVER="${SX_SERVER:-hosts/ocaml/_build/default/bin/sx_server.exe}"
+if [ ! -x "$SX_SERVER" ]; then
+  SX_SERVER="/root/rose-ash/hosts/ocaml/_build/default/bin/sx_server.exe"
+fi
+if [ ! -x "$SX_SERVER" ]; then
+  echo "ERROR: sx_server.exe not found." >&2
+  exit 1
+fi
+
+# Args: an optional suite NAME runs just that suite (fast); -v is verbose per-suite.
+VERBOSE=""
+SUITE_FILTER=""
+for arg in "$@"; do
+  case "$arg" in
+    -v|--verbose) VERBOSE="-v" ;;
+    *) SUITE_FILTER="$arg" ;;
+  esac
+done
+
+# Kernel + subsystem dependencies, then the host modules. Order matters:
+# stdlib/r7rs first; the Datalog engine + ACL subsystem (authorisation); the feed
+# subsystem (the first migrated domain); Dream (types/json/auth/error/router) the
+# host builds on; then the host layer itself.
+MODULES=(
+  "spec/stdlib.sx"
+  "lib/r7rs.sx"
+  "lib/apl/runtime.sx"
+  "lib/datalog/tokenizer.sx"
+  "lib/datalog/parser.sx"
+  "lib/datalog/unify.sx"
+  "lib/datalog/db.sx"
+  "lib/datalog/builtins.sx"
+  "lib/datalog/aggregates.sx"
+  "lib/datalog/strata.sx"
+  "lib/datalog/eval.sx"
+  "lib/datalog/api.sx"
+  "lib/datalog/magic.sx"
+  "lib/acl/schema.sx"
+  "lib/acl/facts.sx"
+  "lib/acl/engine.sx"
+  "lib/acl/explain.sx"
+  "lib/acl/audit.sx"
+  "lib/acl/federation.sx"
+  "lib/acl/api.sx"
+  "lib/relations/schema.sx"
+  "lib/relations/engine.sx"
+  "lib/relations/api.sx"
+  "lib/relations/explain.sx"
+  "lib/relations/federation.sx"
+  "lib/relations/tree.sx"
+  "lib/feed/normalize.sx"
+  "lib/feed/stream.sx"
+  "lib/feed/api.sx"
+  "lib/persist/event.sx"
+  "lib/persist/backend.sx"
+  "lib/persist/log.sx"
+  "lib/persist/kv.sx"
+  "lib/persist/api.sx"
+  "lib/persist/durable.sx"
+  "spec/render.sx"
+  "web/adapter-html.sx"
+  "lib/dream/types.sx"
+  "lib/dream/json.sx"
+  "lib/dream/auth.sx"
+  "lib/dream/error.sx"
+  "lib/dream/form.sx"
+  "lib/dream/session.sx"
+  "lib/dream/router.sx"
+  "lib/host/handler.sx"
+  "lib/host/middleware.sx"
+  "lib/host/session.sx"
+  "lib/host/auth.sx"
+  "lib/host/sxtp.sx"
+  "lib/host/router.sx"
+  "lib/host/static.sx"
+  "lib/host/sx/relate-picker.sx"
+  "lib/host/sx/kg-cards.sx"
+  "lib/host/feed.sx"
+  "lib/host/relations.sx"
+  "lib/host/compose.sx"
+  "lib/host/execute.sx"
+  "lib/host/htmlsx.sx"
+  "lib/host/blog.sx"
+  "lib/host/page.sx"
+  "lib/host/server.sx"
+  "lib/host/ledger.sx"
+)
+
+# Suites: NAME RUNNER-FN PATH
+SUITES=(
+  "handler     host-hd-tests-run!  lib/host/tests/handler.sx"
+  "middleware  host-mw-tests-run!  lib/host/tests/middleware.sx"
+  "sxtp        host-sx-tests-run!  lib/host/tests/sxtp.sx"
+  "router      host-rt-tests-run!  lib/host/tests/router.sx"
+  "feed        host-fd-tests-run!  lib/host/tests/feed.sx"
+  "relations   host-rl-tests-run!  lib/host/tests/relations.sx"
+  "blog        host-bl-tests-run!  lib/host/tests/blog.sx"
+  "htmlsx      host-ht-tests-run!  lib/host/tests/htmlsx.sx"
+  "compose     host-cp-tests-run!  lib/host/tests/compose.sx"
+  "execute     host-ex-tests-run!  lib/host/tests/execute.sx"
+  "session     host-se-tests-run!  lib/host/tests/session.sx"
+  "page        host-pg-tests-run!  lib/host/tests/page.sx"
+  "server      host-sv-tests-run!  lib/host/tests/server.sx"
+  "ledger      host-lg-tests-run!  lib/host/tests/ledger.sx"
+)
+
+# Filter to a single suite if a name was given (filter the array itself so its
+# indices stay aligned with the result-parsing loop below). All MODULES still load
+# — the host modules are interdependent; only the TEST suites are narrowed.
+if [ -n "$SUITE_FILTER" ]; then
+  _FILTERED=()
+  for SUITE in "${SUITES[@]}"; do
+    [ "$(echo "$SUITE" | awk '{print $1}')" = "$SUITE_FILTER" ] && _FILTERED+=("$SUITE")
+  done
+  if [ "${#_FILTERED[@]}" -eq 0 ]; then
+    echo "ERROR: no suite named '$SUITE_FILTER'. Valid names:" >&2
+    for SUITE in "${SUITES[@]}"; do echo "  $(echo "$SUITE" | awk '{print $1}')" >&2; done
+    exit 1
+  fi
+  SUITES=("${_FILTERED[@]}")
+fi
+
+TMPFILE=$(mktemp); trap "rm -f $TMPFILE" EXIT
+EPOCH=1
+emit_load () { echo "(epoch $EPOCH)"; echo "(load \"$1\")"; EPOCH=$((EPOCH+1)); }
+emit_eval () { echo "(epoch $EPOCH)"; echo "(eval \"$1\")"; EPOCH=$((EPOCH+1)); }
+
+{
+  for M in "${MODULES[@]}"; do emit_load "$M"; done
+  for SUITE in "${SUITES[@]}"; do
+    read -r _NAME _RUNNER FILE <<< "$SUITE"
+    emit_load "$FILE"
+    emit_eval "($_RUNNER)"
+  done
+} > "$TMPFILE"
+
+# 1200s: the blog suite drives the relations graph hard (every is-a/types-of/
+# instances-of query re-saturates the Datalog db), so it's CPU-bound and much slower
+# under shared-box contention (a sibling loop at load ~6 pushed it past 600s -> false
+# "no suite results parsed" truncation). Override with SX_CONF_TIMEOUT for a tighter cap.
+OUTPUT=$(timeout "${SX_CONF_TIMEOUT:-1200}" "$SX_SERVER" < "$TMPFILE" 2>&1 || true)
+
+# Fail LOUD on any load/eval error. A test file that errors mid-load silently
+# truncates its suite — the runner returns only the tests that ran before the
+# error, so the suite reports a false green (e.g. "blog 13 passed, 0 failed"
+# when 16 CRUD tests never ran). Catch the error markers and abort before the
+# pass/fail tally can hide them.
+if echo "$OUTPUT" | grep -qE 'Undefined symbol|Unhandled exception|\[load\][^|]*[Ee]rror|expected list, got|: error '; then
+  echo "FAIL: load/eval error detected — a suite may be silently truncated:" >&2
+  echo "$OUTPUT" | grep -nE 'Undefined symbol|Unhandled exception|\[load\]|expected list, got|: error ' | head -20 >&2
+  exit 1
+fi
+
+TOTAL_PASS=0
+TOTAL_FAIL=0
+FAILED_SUITES=()
+LAST_DICT_LINES=$(echo "$OUTPUT" | grep -E '^\{:' || true)
+
+I=0
+while read -r LINE; do
+  [ -z "$LINE" ] && continue
+  P=$(echo "$LINE" | grep -oE ':passed [0-9]+' | awk '{print $2}')
+  F=$(echo "$LINE" | grep -oE ':failed [0-9]+' | awk '{print $2}')
+  [ -z "$P" ] && P=0
+  [ -z "$F" ] && F=0
+  SUITE_INFO="${SUITES[$I]}"
+  SUITE_NAME=$(echo "$SUITE_INFO" | awk '{print $1}')
+  TOTAL_PASS=$((TOTAL_PASS + P))
+  TOTAL_FAIL=$((TOTAL_FAIL + F))
+  if [ "$F" -gt 0 ]; then
+    FAILED_SUITES+=("$SUITE_NAME: $P/$((P+F))")
+    printf 'X %-12s %d/%d\n' "$SUITE_NAME" "$P" "$((P+F))"
+    echo "$LINE" | grep -oE ':name "[^"]*"' | sed 's/:name /    fail: /'
+  elif [ "$VERBOSE" = "-v" ]; then
+    printf 'ok %-12s %d passed\n' "$SUITE_NAME" "$P"
+  fi
+  I=$((I+1))
+done <<< "$LAST_DICT_LINES"
+
+TOTAL=$((TOTAL_PASS + TOTAL_FAIL))
+if [ "$TOTAL" -eq 0 ]; then
+  echo "ERROR: no suite results parsed. Raw output:" >&2
+  echo "$OUTPUT" >&2
+  exit 1
+fi
+if [ $TOTAL_FAIL -eq 0 ]; then
+  echo "ok $TOTAL_PASS/$TOTAL host-on-sx tests passed (${#SUITES[@]} suites)"
+else
+  echo "FAIL $TOTAL_PASS/$TOTAL passed, $TOTAL_FAIL failed:"
+  for S in "${FAILED_SUITES[@]}"; do echo "  $S"; done
+  exit 1
+fi

lib/host/execute.sx

@@ -0,0 +1,40 @@
+;; lib/host/execute.sx — the EXECUTE-fold: a SECOND domain over the SAME composition core
+;; as the render-fold (lib/host/compose.sx), proving the algebra is domain-agnostic
+;; (plans/composition-objects.md steps 7-8). Now that the core (host/comp-fold: the seq/alt/
+;; each dispatch + when-predicates + each-source + context-environment + recursion) is shared,
+;; a whole new domain is just a DOMAIN DICT + a leaf function:
+;;
+;;   render   {:empty ""        :combine str    …}  leaf -> markup;  fold -> HTML string
+;;   execute  {:empty (list)    :combine concat …}  leaf -> effect;  fold -> effect log
+;;
+;; seq = steps in order, alt+when = branch, each = for-each — all from the core, unchanged.
+;; Only the leaf semantics (effect vs markup) and the accumulator (list vs string) are new.
+;; So the behaviour model (Slice 9) is "an execute-fold over a composition object", not a
+;; separate system — the same structure an author edits as a document.
+
+;; resolve an effect argument against the context: (field K) reads the :item/ctx value via
+;; the SAME resolver the render-fold uses; anything else is a literal.
+(define host/exec--arg
+  (fn (a ctx)
+    (if (and (= (type-of a) "list") (= (str (first a)) "field"))
+      (host/comp--field (first (rest a)) ctx)
+      a)))
+
+;; the execute-fold's LEAF: an (effect VERB ARG…) node records one effect {:verb :args};
+;; anything else contributes no effects. (The core handles seq/alt/each.)
+(define host/exec--leaf
+  (fn (node ctx dom)
+    (if (not (= (type-of node) "list"))
+      (list)
+      (let ((h (str (first node))) (args (rest node)))
+        (if (= h "effect")
+          (list {:verb (str (first args)) :args (map (fn (a) (host/exec--arg a ctx)) (rest args))})
+          (list))))))
+
+;; the execute DOMAIN: effects concatenate into a log; the depth guard yields a max-depth
+;; effect. host/comp-fold (compose.sx) supplies the seq/alt/each walk + when + each source.
+(define host/exec--dom
+  {:empty (list) :combine concat :overflow (list {:verb "max-depth" :args (list)}) :leaf host/exec--leaf})
+
+;; public entry: execute a composition node against a context -> the effect log (the run).
+(define host/exec-run (fn (node ctx) (host/comp-fold node ctx host/exec--dom)))

lib/host/feed.sx

@@ -0,0 +1,49 @@
+;; lib/host/feed.sx — Feed domain endpoints on the host. The first domain migrated
+;; onto the SX host: read the activity timeline (GET /feed) and create activities
+;; (POST /feed). Both go straight through the feed subsystem's public API; the
+;; write path runs behind the host middleware stack (auth + ACL). Depends on
+;; lib/feed/* + lib/host/handler.sx + lib/host/middleware.sx (write routes only).
+
+;; ── read ───────────────────────────────────────────────────────────
+
+;; GET /feed -> recent-first activities as a JSON envelope.
+;; Query: ?actor=<id> (filter) ?limit=<n> (cap, applied after filtering).
+(define host/feed-timeline
+  (fn (req)
+    (let ((base (feed/recent (feed/all)))
+          (actor (dream-query-param req "actor")))
+      (let ((filtered (if actor (feed/by-actor base actor) base))
+            (limit (dream-query-param req "limit")))
+        (let ((capped
+                (if limit (feed/take filtered (string->number limit)) filtered)))
+          (host/ok (feed/items capped)))))))
+
+;; Public read route group.
+(define host/feed-routes
+  (list
+    (dream-get "/feed" host/feed-timeline)))
+
+;; ── write ──────────────────────────────────────────────────────────
+
+;; POST /feed -> create an activity from the text/sx body. Returns 201 + the created
+;; (normalised) activity. Body must be an SX dict; anything else -> 400.
+(define host/feed-create
+  (fn (req)
+    (let ((raw (host/sx-body req)))
+      (if (= (type-of raw) "dict")
+        (host/ok-status 201 (feed/post raw))
+        (host/error 400 "invalid activity")))))
+
+;; Guarded write route group: POST /feed behind auth + ACL ("post" on "feed").
+;; resolve : token -> principal | nil (injected auth policy, e.g. token lookup
+;; against the identity subsystem). Errors thrown downstream become a JSON 500.
+(define host/feed-write-routes
+  (fn (resolve)
+    (list
+      (dream-post "/feed"
+        (host/pipeline
+          (list
+            host/wrap-errors
+            (host/require-auth resolve)
+            (host/require-permission "post" (fn (req) "feed")))
+          host/feed-create)))))

lib/host/handler.sx

@@ -0,0 +1,41 @@
+;; lib/host/handler.sx — Host handler layer: the bridge from a Dream request to a
+;; subsystem call and back to a Dream response. A host handler IS a Dream handler
+;; (request -> response); these helpers build the SX-native envelope every host
+;; endpoint shares — text/sx, serialized SX wire format (NOT JSON): {:ok true
+;; :data ...} on success, {:ok false :error ...} on failure. The platform speaks
+;; SX end to end; JSON lives only at the ActivityPub federation edge (JSON-LD).
+;; Depends on lib/dream/types.sx.
+
+;; ── responses ──────────────────────────────────────────────────────
+
+;; SX response at an arbitrary status: content-type text/sx, body = the value
+;; serialized to SX wire format (the same `serialize` SXTP uses). The SX engine /
+;; WASM kernel parses this directly — NO JSON on the internal wire.
+(define host/sx-status
+  (fn (status value)
+    (dream-response status {:content-type "text/sx; charset=utf-8"}
+      (serialize value))))
+
+;; Success envelope: 200 {:ok true :data <value>}.
+(define host/ok
+  (fn (value)
+    (host/sx-status 200 {:ok true :data value})))
+
+;; Success envelope at a chosen status (e.g. 201 for a created resource).
+(define host/ok-status
+  (fn (status value)
+    (host/sx-status status {:ok true :data value})))
+
+;; Error envelope: {:ok false :error <message>} at the given status.
+(define host/error
+  (fn (status message)
+    (host/sx-status status {:ok false :error message})))
+
+;; ── request reading ────────────────────────────────────────────────
+
+;; Integer query param with a fallback (query params arrive as strings).
+;; Absent param -> fallback; present -> parsed number.
+(define host/query-int
+  (fn (req name fallback)
+    (let ((raw (dream-query-param req name)))
+      (if raw (string->number raw) fallback))))

lib/host/htmlsx.sx

@@ -0,0 +1,116 @@
+;; lib/host/htmlsx.sx — a pure-SX HTML → SX converter (the "radar migrator" core). Turns a
+;; post's HTML content into an SX (article …) tree that host/blog--decompose! consumes: img,
+;; p, figure/figcaption, iframe, headings, blockquote, lists, inline strong/em/a (kept nested;
+;; decompose flattens them to text at the block level). Char-level tokenizer + a stack parser.
+;; NOTE: substr is (string, start, LENGTH); index-of returns -1 when absent.
+
+;; ── string helpers ──────────────────────────────────────────────────
+(define host/html--at    (fn (s i) (if (< i (len s)) (substr s i 1) "")))
+(define host/html--from  (fn (s i) (substr s i (- (len s) i))))     ;; s[i:]
+(define host/html--slice (fn (s a b) (substr s a (- b a))))         ;; s[a:b)
+(define host/html--replace-all
+  (fn (s old new)
+    (let ((i (index-of s old)))
+      (if (< i 0) s
+        (str (host/html--slice s 0 i) new
+             (host/html--replace-all (host/html--from s (+ i (len old))) old new))))))
+
+;; ── entity decode (the common named + a few numeric entities → UTF-8) ──
+(define host/html--entities
+  (list (list "&nbsp;" " ") (list "&amp;" "&") (list "&lt;" "<") (list "&gt;" ">")
+        (list "&quot;" "\"") (list "&#39;" "'") (list "&apos;" "'") (list "&#x27;" "'")
+        (list "&#x2019;" "’") (list "&#8217;" "’") (list "&#x2018;" "‘")
+        (list "&hellip;" "…") (list "&#x2026;" "…") (list "&mdash;" "—") (list "&ndash;" "–")
+        (list "&pound;" "£") (list "&#xA3;" "£") (list "&#163;" "£")))
+(define host/html--decode
+  (fn (s) (reduce (fn (acc pair) (host/html--replace-all acc (first pair) (first (rest pair)))) s host/html--entities)))
+
+;; ── tag classification + name/attr parsing ──────────────────────────
+(define host/html--void?
+  (fn (n) (contains? (list "img" "br" "hr" "iframe" "input" "meta" "link" "source" "embed") n)))
+;; the tag name from a tag's inner text ("img src=…" -> "img"): up to the first space or '/'.
+(define host/html--tag-name
+  (fn (inner)
+    (let ((sp (index-of inner " ")))
+      (lower (trim (host/html--replace-all (if (< sp 0) inner (host/html--slice inner 0 sp)) "/" ""))))))
+;; parse the attrs of a tag's inner text into a dict (quoted or unquoted values).
+(define host/html--attrs-loop
+  (fn (rest acc)
+    (let ((r (trim rest)))
+      (if (or (= r "") (= r "/")) acc
+        (let ((eq (index-of r "=")))
+          (if (< eq 0) acc
+            (let ((name (lower (trim (host/html--slice r 0 eq))))
+                  (after (trim (host/html--from r (+ eq 1)))))
+              (let ((q (host/html--at after 0)))
+                (if (or (= q "\"") (= q "'"))
+                  (let ((close (index-of (host/html--from after 1) q)))
+                    (if (< close 0) acc
+                      (host/html--attrs-loop (host/html--from after (+ close 2))
+                        (assoc acc name (host/html--decode (host/html--slice after 1 (+ 1 close)))))))
+                  (let ((sp2 (index-of after " ")))
+                    (host/html--attrs-loop (if (< sp2 0) "" (host/html--from after sp2))
+                      (assoc acc name (if (< sp2 0) after (host/html--slice after 0 sp2))))))))))))))
+(define host/html--parse-attrs
+  (fn (inner)
+    (let ((sp (index-of inner " ")))
+      (if (< sp 0) {} (host/html--attrs-loop (host/html--from inner (+ sp 1)) {})))))
+
+;; ── tokenizer: HTML string → a list of {:t text|open|close|void …} tokens ──
+(define host/html--tokens
+  (fn (s)
+    (let loop ((i 0) (acc (list)))
+      (if (>= i (len s)) acc
+        (if (= (host/html--at s i) "<")
+          (let ((rel (index-of (host/html--from s i) ">")))
+            (if (< rel 0) acc
+              (let ((gt (+ i rel)) (inner (host/html--slice s (+ i 1) (+ i rel))))
+                (cond
+                  ((starts-with? inner "!") (loop (+ gt 1) acc))     ;; comment / doctype
+                  ((starts-with? inner "/")
+                   (loop (+ gt 1) (concat acc (list {:t "close" :name (host/html--tag-name (host/html--from inner 1))}))))
+                  (else
+                   (let ((name (host/html--tag-name inner)))
+                     (loop (+ gt 1) (concat acc (list {:t (if (or (host/html--void? name) (ends-with? inner "/")) "void" "open")
+                                                       :name name :attrs (host/html--parse-attrs inner)})))))))))
+          (let ((rel (index-of (host/html--from s i) "<")))
+            (let ((te (if (< rel 0) (len s) (+ i rel))))
+              (let ((txt (host/html--decode (host/html--slice s i te))))
+                (loop te (if (= (trim txt) "") acc (concat acc (list {:t "text" :text txt}))))))))))))
+
+;; ── parser: tokens → a tree of {:name :attrs :kids} nodes (kids: node | string, in order).
+;; A functional stack of open frames; a synthetic root frame collects the top-level nodes. ──
+(define host/html--push-kid
+  (fn (stack kid)
+    (let ((top (first stack)))
+      (cons (assoc top :kids (concat (get top :kids) (list kid))) (rest stack)))))
+(define host/html--parse
+  (fn (tokens)
+    (let loop ((ts tokens) (stack (list {:name "article" :attrs {} :kids (list)})))
+      (if (empty? ts) (get (first stack) :kids)
+        (let ((tok (first ts)))
+          (cond
+            ((= (get tok :t) "text") (loop (rest ts) (host/html--push-kid stack (get tok :text))))
+            ((= (get tok :t) "void") (loop (rest ts) (host/html--push-kid stack {:name (get tok :name) :attrs (get tok :attrs) :kids (list)})))
+            ((= (get tok :t) "open") (loop (rest ts) (cons {:name (get tok :name) :attrs (get tok :attrs) :kids (list)} stack)))
+            ((= (get tok :t) "close")
+             (if (> (len stack) 1)
+               (loop (rest ts) (host/html--push-kid (rest stack) (first stack)))
+               (loop (rest ts) stack)))
+            (else (loop (rest ts) stack))))))))
+
+;; ── tree → SX. A node becomes (name :attr val … child …); text stays a string. Attr keys
+;; become keywords via parse-safe (":src" -> the keyword :src) so decompose reads them. ──
+(define host/html--attrs->sx
+  (fn (attrs)
+    (reduce (fn (acc k) (concat acc (list (parse-safe (str ":" k)) (get attrs k)))) (list) (keys attrs))))
+(define host/html--node->sx
+  (fn (node)
+    (if (= (type-of node) "string") node
+      (cons (string->symbol (get node :name))
+        (concat (host/html--attrs->sx (get node :attrs))
+                (map host/html--node->sx (get node :kids)))))))
+;; HTML content string → an (article …) SX tree, ready for host/blog--decompose!.
+(define host/html->sx
+  (fn (html)
+    (cons (quote article) (map host/html--node->sx (host/html--parse (host/html--tokens html))))))

lib/host/ledger.sx

@@ -0,0 +1,89 @@
+;; lib/host/ledger.sx — the strangler migration ledger. A catalogue of every
+;; rose-ash HTTP endpoint with its Quart original and its current host status, so
+;; the cut-over from Quart to the SX host is tracked endpoint-by-endpoint rather
+;; than big-bang. Status is one of:
+;;   :native   — born on the host, has no Quart original (e.g. /health probe)
+;;   :migrated — moved off Quart, now served by an SX handler
+;;   :proxied  — still on Quart; the host forwards until cut over
+;; Coverage (how far the strangler has progressed = how much is OFF Quart) is
+;; computed from the catalogue. Pure data + queries — no IO, fully conformable.
+
+;; ── entry constructor ───────────────────────────────────────────────
+;; quart is a "service:handler" ref string (nil for :native endpoints); handler
+;; is the SX handler name serving it (nil while still :proxied).
+(define host/ledger-entry
+  (fn (domain method path quart status handler)
+    {:domain domain :method method :path path
+     :quart quart :status status :handler handler}))
+
+;; ── the catalogue ───────────────────────────────────────────────────
+;; Reflects the live host: feed reads+writes migrated, /health native, the
+;; relations container endpoints migrated onto lib/relations (reads get-children/
+;; get-parents + writes attach-child/detach-child — see lib/host/relations.sx).
+;; The TYPED relations actions (relate/unrelate/can-relate) stay proxied: they
+;; carry registry + cardinality validation lib/relations does not implement. The
+;; internal-only likes data+action endpoints stay proxied too — likes has no SX
+;; subsystem to dispatch to.
+(define host/ledger
+  (list
+    (host/ledger-entry "host"      "GET"  "/health"                     nil                         "native"   "host/health-route")
+    (host/ledger-entry "blog"      "GET"  "/:slug"                      "blog:post_detail"          "migrated" "host/blog-post")
+    (host/ledger-entry "feed"      "GET"  "/feed"                       "feed:timeline"             "migrated" "host/feed-timeline")
+    (host/ledger-entry "feed"      "POST" "/feed"                       "feed:create"               "migrated" "host/feed-create")
+    (host/ledger-entry "relations" "GET"  "/internal/data/get-children"  "relations:get_children"  "migrated" "host/relations-children")
+    (host/ledger-entry "relations" "GET"  "/internal/data/get-parents"   "relations:get_parents"   "migrated" "host/relations-parents")
+    (host/ledger-entry "relations" "POST" "/internal/actions/attach-child" "relations:attach_child" "migrated" "host/relations-attach")
+    (host/ledger-entry "relations" "POST" "/internal/actions/detach-child" "relations:detach_child" "migrated" "host/relations-detach")
+    (host/ledger-entry "relations" "POST" "/internal/actions/relate"     "relations:relate"        "proxied"  nil)
+    (host/ledger-entry "relations" "POST" "/internal/actions/unrelate"   "relations:unrelate"      "proxied"  nil)
+    (host/ledger-entry "relations" "POST" "/internal/actions/can-relate" "relations:can_relate"    "proxied"  nil)
+    (host/ledger-entry "likes"     "GET"  "/internal/data/is-liked"     "likes:is_liked"            "proxied"  nil)
+    (host/ledger-entry "likes"     "GET"  "/internal/data/liked-slugs"  "likes:liked_slugs"         "proxied"  nil)
+    (host/ledger-entry "likes"     "GET"  "/internal/data/liked-ids"    "likes:liked_ids"           "proxied"  nil)
+    (host/ledger-entry "likes"     "POST" "/internal/actions/toggle"    "likes:toggle"              "proxied"  nil)))
+
+;; ── status / domain queries ─────────────────────────────────────────
+(define host/ledger-by-status
+  (fn (ledger status) (filter (fn (e) (= (get e :status) status)) ledger)))
+(define host/ledger-migrated (fn (ledger) (host/ledger-by-status ledger "migrated")))
+(define host/ledger-proxied  (fn (ledger) (host/ledger-by-status ledger "proxied")))
+(define host/ledger-native   (fn (ledger) (host/ledger-by-status ledger "native")))
+(define host/ledger-by-domain
+  (fn (ledger domain) (filter (fn (e) (= (get e :domain) domain)) ledger)))
+
+;; An endpoint is OFF Quart (served by the host) iff native or migrated.
+(define host/ledger-served?
+  (fn (e) (or (= (get e :status) "native") (= (get e :status) "migrated"))))
+
+;; First entry matching (method, path), or nil.
+(define host/ledger-find
+  (fn (ledger method path)
+    (let ((hits (filter
+                  (fn (e) (and (= (get e :method) method) (= (get e :path) path)))
+                  ledger)))
+      (if (> (len hits) 0) (first hits) nil))))
+
+;; Distinct domains in the catalogue (order: first-seen, reversed by cons).
+(define host/ledger-domains
+  (fn (ledger)
+    (reduce
+      (fn (acc e)
+        (let ((d (get e :domain)))
+          (if (some (fn (x) (= x d)) acc) acc (cons d acc))))
+      (list)
+      ledger)))
+
+;; ── coverage ────────────────────────────────────────────────────────
+;; served = off Quart (migrated + native); percent = served / total, floored.
+(define host/ledger-coverage
+  (fn (ledger)
+    (let ((total (len ledger))
+          (migrated (len (host/ledger-migrated ledger)))
+          (proxied (len (host/ledger-proxied ledger)))
+          (native (len (host/ledger-native ledger))))
+      {:total total
+       :migrated migrated
+       :proxied proxied
+       :native native
+       :served (+ migrated native)
+       :percent (if (= total 0) 0 (quotient (* 100 (+ migrated native)) total))})))

lib/host/live-check.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Non-browser live-check for the host: spins up an EPHEMERAL host server (this
+# worktree's binary + lib + web, a temp persist dir), logs in, seeds one post, then
+# runs a sequence of HTTP checks printing status | content-type | body-head for each.
+# Catches what conformance can't — the real http-listen serving path (serving-JIT
+# divergence, VmSuspended renders, content-type regressions) — without a browser and
+# without touching live data. The non-Playwright counterpart to run-picker-check.sh.
+#
+#   bash lib/host/live-check.sh                      # default smoke: /health /posts /feed / /<seeded>/
+#   bash lib/host/live-check.sh /tags /article/      # check specific GET paths instead
+#
+# Asserts: reads are text/sx (the SX-native wire), pages are non-empty, no 5xx.
+# Requires the OCaml binary built (hosts/ocaml/_build/default/bin/sx_server.exe).
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+
+PORT="${LIVE_PORT:-8914}"
+USER="admin"; PASS="live-check-pw"; SECRET="live-check-secret"
+PDIR=$(mktemp -d); JAR=$(mktemp); LOG=$(mktemp); HDR=$(mktemp)
+BASE="http://127.0.0.1:$PORT"
+RC=0
+
+cleanup() {
+  local pid
+  pid=$(ss -lptn "sport = :$PORT" 2>/dev/null | grep -oE 'pid=[0-9]+' | head -1 | cut -d= -f2)
+  [ -n "$pid" ] && kill "$pid" 2>/dev/null
+  rm -f "$JAR" "$LOG" "$HDR"; rm -rf "$PDIR"
+}
+trap cleanup EXIT
+
+echo "== booting ephemeral host on :$PORT (persist=$PDIR) =="
+# SX_SERVING_JIT=1 to MATCH THE CONTAINER: it gates the http-listen IO resolver, so
+# without it perform-heavy paths (e.g. reach-down's BFS over the type graph — the is-a/
+# tags picker) falsely raise VmSuspended -> 500. The live container sets it; the harness
+# must too, or it reports false 500s the live site never shows.
+SX_SERVING_JIT=1 HOST_PORT="$PORT" SX_PERSIST_DIR="$PDIR" \
+  SX_ADMIN_USER="$USER" SX_ADMIN_PASSWORD="$PASS" SX_SESSION_SECRET="$SECRET" \
+  bash lib/host/serve.sh >"$LOG" 2>&1 &
+for i in $(seq 1 60); do
+  curl -sf -o /dev/null "$BASE/health" 2>/dev/null && break
+  sleep 1; [ "$i" = "60" ] && { echo "server never came up:"; cat "$LOG"; exit 1; }
+done
+echo "== up =="
+
+# Log in + seed one post (also exercises the form-ingest write path).
+curl -s -c "$JAR" -o /dev/null -X POST "$BASE/login" --data "username=$USER&password=$PASS"
+curl -s -b "$JAR" -o /dev/null -X POST "$BASE/new" \
+  --data 'title=Live Check Post&sx_content=(article (h1 "Live Check Post") (p "ok"))&status=published'
+
+# A GET check: prints "<status> <content-type> | <body-head>" and flags problems.
+check() {
+  local path="$1" body ct code
+  body=$(curl -s -b "$JAR" -D "$HDR" "$BASE$path")
+  code=$(awk 'NR==1{print $2}' "$HDR")
+  ct=$(grep -i '^content-type:' "$HDR" | head -1 | tr -d '\r' | sed 's/content-type: *//I')
+  printf '  %-20s %s  %-26s | %s\n' "$path" "${code:-???}" "${ct:-?}" "$(printf '%s' "$body" | tr '\n' ' ' | cut -c1-70)"
+  case "$code" in 5*) echo "    !! 5xx"; RC=1 ;; esac
+  [ -z "$body" ] && { echo "    !! empty body"; RC=1; }
+  # data endpoints must be SX, never JSON
+  case "$path" in
+    /posts|/feed) echo "$ct" | grep -qi 'text/sx' || { echo "    !! expected text/sx, got '$ct'"; RC=1; }
+                  printf '%s' "$body" | grep -q '"ok":' && { echo "    !! JSON leaked"; RC=1; } ;;
+  esac
+}
+
+echo "== checks =="
+if [ "$#" -gt 0 ]; then
+  for p in "$@"; do check "$p"; done
+else
+  for p in /health /posts /feed / /live-check-post/; do check "$p"; done
+fi
+
+echo "== done (rc $RC) =="
+exit $RC

lib/host/middleware.sx

@@ -0,0 +1,54 @@
+;; lib/host/middleware.sx — Host middleware: composable handler->handler layers
+;; for the cross-cutting concerns every write endpoint shares — error trapping
+;; (JSON 500), authentication (bearer token -> principal), and authorisation
+;; (ACL permit?). Middleware is plain function composition; host/pipeline threads a
+;; list onto a handler, FIRST middleware outermost (so it runs first). Auth and
+;; permission policy are INJECTED — the token resolver and the resource extractor —
+;; so this layer carries no hardcoded policy. Reuses Dream's bearer/error helpers
+;; and lib/acl's public acl/permit?.
+;; Depends on lib/dream/{auth,error,router}.sx + lib/acl/api.sx + lib/host/handler.sx.
+
+;; Compose a list of middlewares onto a handler (first = outermost).
+(define host/pipeline
+  (fn (middlewares handler)
+    (dr/apply-middlewares middlewares handler)))
+
+;; The authenticated principal attached by host/require-auth.
+(define host/principal (fn (req) (dream-principal req)))
+
+;; ── error trapping ─────────────────────────────────────────────────
+;; Any error thrown downstream becomes a JSON 500 envelope.
+(define host/-on-error
+  (fn (req e) (host/error 500 "internal error")))
+(define host/wrap-errors (dream-catch-with host/-on-error))
+
+;; ── authentication ─────────────────────────────────────────────────
+;; resolve : token -> principal | nil. Missing/invalid token -> JSON 401 with a
+;; WWW-Authenticate: Bearer challenge; success attaches :dream-principal so
+;; downstream layers (and host/principal) can read it.
+(define host/require-auth
+  (fn (resolve)
+    (fn (next)
+      (fn (req)
+        (let ((tok (dream-bearer-token req)))
+          (let ((principal (if tok (resolve tok) nil)))
+            (if (nil? principal)
+              (dream-add-header
+                (host/error 401 "unauthorized")
+                "www-authenticate"
+                "Bearer")
+              (next (assoc req :dream-principal principal)))))))))
+
+;; ── authorisation ──────────────────────────────────────────────────
+;; Gate on ACL: the authed principal must be permitted `action` on the resource
+;; computed by res-fn from the request. Denied -> JSON 403. Assumes the ACL fact
+;; db was loaded (acl/load!) at startup. Place AFTER host/require-auth.
+(define host/require-permission
+  (fn (action res-fn)
+    (fn (next)
+      (fn (req)
+        (let ((subject (host/principal req))
+              (resource (res-fn req)))
+          (if (acl/permit? subject action resource)
+            (next req)
+            (host/error 403 "forbidden")))))))

lib/host/page.sx

@@ -0,0 +1,22 @@
+;; lib/host/page.sx — serve interactive SX component/island pages on the host
+;; (Phase 5: the generic interactive-SX-page capability).
+;;
+;; The bare `render-to-html` path mangles an EVALUATED component tree's keyword
+;; attributes ((form :id ..) -> "<form>idpost-new-form..."), because evaluating a
+;; defcomp body turns `:id` into a child. The kernel `render-page` primitive
+;; instead renders an UNEVALUATED expression with the server env: render-to-html
+;; expands the components itself and collects keyword args as attributes. SX
+;; handlers can't reach the server env, so render-page supplies it.
+;;
+;; host/page wraps a rendered expression as an HTML response; host/page-route
+;; mounts it on a GET path. This is the component-render step (5.1); the full page
+;; shell (inlined component defs + CSS + client runtime + hydration) and static
+;; asset serving (5.2–5.4) build on top to make the page interactive.
+;; Depends on the kernel `render-page` primitive + lib/dream/types.sx (dream-html).
+
+;; Render an unevaluated SX page/component expression to an HTML response.
+(define host/page (fn (expr) (dream-html (render-page expr))))
+
+;; Mount a GET route that renders a fixed page expression.
+(define host/page-route
+  (fn (path expr) (dream-get path (fn (req) (host/page expr)))))

lib/host/playwright/block-editor.spec.js

@@ -0,0 +1,70 @@
+// Browser check for the BLOCK EDITOR (lib/host/blog.sx, composition step 6). Runs against
+// an ephemeral host server seeded with one editable host post by run-block-check.sh, which
+// copies this spec into the Playwright env and sets SX_TEST_URL.
+//
+// What needs a real boosted-SPA browser (the SX conformance tests cover the model ops +
+// server routes; this covers the live SX-htmx swap the engine drives): adding, reordering,
+// and removing blocks re-renders #block-editor IN PLACE (sx-post → outerHTML swap), and the
+// controls RE-BIND on the content brought in by each swap (the case an inline script fails).
+const { test, expect } = require('playwright/test');
+
+const USER = process.env.SX_ADMIN_USER || 'admin';
+const PASS = process.env.SX_ADMIN_PASSWORD || 'letmein';
+const HOST = 'block-host';                 // the post whose edit page we drive
+const BE = '#block-editor';
+const ROWS = `${BE} > ul > li`;            // block rows (exclude the add form)
+
+async function waitReady(page) {
+  await expect(page.locator('html[data-sx-ready="true"]')).toHaveCount(1, { timeout: 45000 });
+}
+async function loginTo(page, path) {
+  await page.goto(path);
+  await page.waitForURL(/\/login/);
+  await page.fill('input[name="username"]', USER);
+  await page.fill('input[name="password"]', PASS);
+  await page.click('button[type="submit"]');
+  await page.waitForURL((u) => !u.pathname.startsWith('/login'));
+}
+
+// add a block via the add-block form (select a card type, type text, submit).
+async function addBlock(page, ctype, text) {
+  await page.selectOption(`${BE} select[name="ctype"]`, ctype);
+  await page.fill(`${BE} input[name="text"]`, text);
+  await page.click(`${BE} form[sx-post$="/blocks/add"] button`);
+}
+
+test.describe('block editor (browser-only, live SX-htmx swap)', () => {
+  test('add, reorder, and remove blocks re-render #block-editor in place', async ({ page }) => {
+    test.setTimeout(90000);
+    await loginTo(page, `/${HOST}/edit`);
+    await waitReady(page);
+    await page.evaluate(() => { window.__noReload = true; });
+
+    // a fresh post has no :body -> no blocks yet
+    await expect(page.locator(ROWS)).toHaveCount(0);
+
+    // ADD #1 (text) -> one row appears live, showing its preview
+    await addBlock(page, 'card-text', 'First block');
+    await expect.poll(() => page.locator(ROWS).count(), { timeout: 15000 }).toBe(1);
+    await expect(page.locator(BE)).toContainText('First block');
+
+    // ADD #2 (heading) -> a second row on the swapped-in editor (controls re-bound)
+    await addBlock(page, 'card-heading', 'A Heading');
+    await expect.poll(() => page.locator(ROWS).count(), { timeout: 15000 }).toBe(2);
+    // order is add-order: block 0 = First block, block 1 = A Heading
+    await expect(page.locator(`${ROWS}`).first()).toContainText('First block');
+
+    // REORDER: move the 2nd block (A Heading) UP -> it becomes the first row
+    await page.locator(`${ROWS}`).nth(1).locator('button', { hasText: '↑' }).click();
+    await expect.poll(
+      () => page.locator(`${ROWS}`).first().innerText(), { timeout: 15000 }
+    ).toContain('A Heading');
+    await expect(page.locator(ROWS)).toHaveCount(2);
+
+    // REMOVE the first row (A Heading) -> one row remains (First block)
+    await page.locator(`${ROWS}`).first().locator('button', { hasText: 'remove' }).click();
+    await expect.poll(() => page.locator(ROWS).count(), { timeout: 15000 }).toBe(1);
+    await expect(page.locator(BE)).toContainText('First block');
+    await expect(page.locator(BE)).not.toContainText('A Heading');
+  });
+});

lib/host/playwright/boost-nav.spec.js

@@ -0,0 +1,107 @@
+// Regression for the boosted-navigation link-rebinding bug (reported on blog.rose-ash.com):
+//   home  --boosted nav-->  a post  --click "edit"-->  lands on /tags (a HOME footer link),
+//   not /<slug>/edit. After a boost swap, the swapped-in links carry a STALE binding from
+//   the previous page. Run by run-boost-nav-check.sh against an ephemeral host server
+//   (serve.sh seeds /compose-demo + the home footer's /tags link).
+const { test, expect } = require('playwright/test');
+
+const BASE = process.env.SX_TEST_URL || 'http://127.0.0.1:8914';
+
+const USER = process.env.SX_ADMIN_USER || 'admin';
+const PASS = process.env.SX_ADMIN_PASSWORD || 'letmein';
+
+async function waitReady(page) {
+  await expect(page.locator('html[data-sx-ready="true"]')).toHaveCount(1, { timeout: 45000 });
+}
+async function login(page) {
+  await page.goto(BASE + '/login');
+  await page.fill('input[name="username"]', USER);
+  await page.fill('input[name="password"]', PASS);
+  await page.click('button[type="submit"]');
+  await page.waitForURL((u) => !u.pathname.startsWith('/login'));
+}
+
+test.describe('boosted navigation (browser-only)', () => {
+  test('a post link clicked AFTER a boosted nav navigates to the right target (not a stale home link)', async ({ page }) => {
+    test.setTimeout(90000);
+    // 1) load HOME (its footer has a /tags link — the stale target the bug lands on)
+    await page.goto(BASE + '/');
+    await waitReady(page);
+    await expect(page.locator('a[href="/tags"]')).toHaveCount(1);   // home has the /tags link
+
+    // 2) boosted nav HOME -> the composed post (no full reload)
+    await page.locator('a[href="/compose-demo/"]').first().click();
+    await expect(page.locator('body')).toContainText('composition object', { timeout: 15000 });
+    expect(page.url()).toContain('/compose-demo/');
+
+    // 3) click the post's "edit" link — brought in by the swap
+    await expect(page.locator('a[href="/compose-demo/edit"]')).toHaveCount(1);
+    await page.locator('a[href="/compose-demo/edit"]').click();
+    await page.waitForTimeout(3000);
+
+    // 4) it MUST navigate to the edit route (guarded -> the login view is fine, the URL is
+    //    pushed to /compose-demo/edit), and MUST NOT land on the stale /tags link.
+    expect(page.url()).not.toContain('/tags');
+    expect(page.url()).toContain('/compose-demo/edit');
+  });
+
+  test('a guarded route reached via boost does a clean full-nav to /login (no clobbered SPA), and Home works from there', async ({ page }) => {
+    test.setTimeout(90000);
+    await page.goto(BASE + '/');
+    await waitReady(page);
+    // boosted nav home -> post
+    await page.locator('a[href="/compose-demo/"]').first().click();
+    await expect(page.locator('body')).toContainText('composition object', { timeout: 15000 });
+    // click "edit" (guarded, logged out). A 303 would be followed by the fetch WITHOUT the
+    // SX-Request header -> /login returns the full shell, which morphed into #content
+    // DESTROYS the swap target (then nothing navigates). The fix returns SX-Redirect, so the
+    // engine does a FULL navigation to a real /login page.
+    await page.locator('a[href="/compose-demo/edit"]').click();
+    await page.waitForTimeout(3500);
+    expect(new URL(page.url()).pathname).toBe('/login');
+    await expect(page.locator('body')).toContainText('Log in');
+    // and the login page offers a way back Home that works (the reported "Home does nothing").
+    await page.locator('a[href="/"]').first().click();
+    await page.waitForTimeout(3000);
+    await expect(page.locator('body')).toContainText('Posts', { timeout: 12000 });
+    expect(new URL(page.url()).pathname).toBe('/');
+  });
+
+  test('LOGGED IN: the Home nav works after a boosted nav to the edit page', async ({ page }) => {
+    test.setTimeout(90000);
+    await login(page);                       // authed session
+    await page.goto(BASE + '/');
+    await waitReady(page);
+    // boosted nav home -> post -> edit (authed, so the real edit form swaps into #content)
+    await page.locator('a[href="/compose-demo/"]').first().click();
+    await expect(page.locator('body')).toContainText('composition object', { timeout: 15000 });
+    // the footer "edit" link (there's also a "no relations — add some" link to edit when authed)
+    await page.locator('a[href="/compose-demo/edit"]').last().click();
+    await expect(page.locator('body')).toContainText('Edit:', { timeout: 15000 });
+    expect(new URL(page.url()).pathname).toBe('/compose-demo/edit');
+    // #content must SURVIVE the edit swap (an outerHTML swap would replace it, then no later
+    // nav can find a swap target — the reported "Home does nothing").
+    expect(await page.locator('#content').count()).toBe(1);
+    // the persistent top-nav Home link must still work on the edit page.
+    await page.locator('nav a[href="/"]').first().click();
+    await page.waitForTimeout(3000);
+    await expect(page.locator('body')).toContainText('Posts', { timeout: 12000 });
+    expect(new URL(page.url()).pathname).toBe('/');
+  });
+
+  test('LOGGED IN: the block-editor card-type dropdown populates after a boosted nav to edit', async ({ page }) => {
+    test.setTimeout(90000);
+    await login(page);
+    await page.goto(BASE + '/');
+    await waitReady(page);
+    await page.locator('a[href="/compose-demo/"]').first().click();
+    await expect(page.locator('body')).toContainText('composition object', { timeout: 15000 });
+    await page.locator('a[href="/compose-demo/edit"]').last().click();
+    await expect(page.locator('body')).toContainText('Edit:', { timeout: 15000 });
+    // the ctype <select> must have selectable <option> DIRECT children. A <span> wrapper
+    // leaves the dropdown empty when the DOM is built programmatically on a boosted swap
+    // (the HTML parser would hoist them out on a full load, hiding the bug there).
+    await expect(page.locator('#block-editor select[name="ctype"] > option')).toHaveCount(5, { timeout: 10000 });
+    await expect(page.locator('#block-editor select[name="ctype"] > option[value="card-heading"]')).toHaveCount(1);
+  });
+});

lib/host/playwright/relate-picker.spec.js

@@ -0,0 +1,118 @@
+// Browser check for the relate picker (lib/host/blog.sx). Runs against an
+// ephemeral host server seeded with a host post + 25 candidates by
+// run-picker-check.sh, which copies this spec into the Playwright env and sets
+// SX_TEST_URL.
+//
+// TRIMMED to the irreducibly-real-browser cases. The picker's interactive
+// behaviours — populate-on-load, debounced filter, sentinel paging, relate→delete
+// row, error/retry visible state — are now SX engine tests in
+// web/tests/test-relate-picker.sx (they drive the SAME engine against a mock DOM,
+// no Chromium). Its server contract + persistence are SX conformance tests in
+// lib/host/tests/blog.sx. What remains here needs a live boosted-SPA browser:
+//   1. a boosted form POST swaps in place (bind-boost-form regression), and
+//   2. the picker re-binds its triggers on content brought in by a boosted SPA
+//      nav (the case an inline <script> picker silently failed).
+const { test, expect } = require('playwright/test');
+
+const USER = process.env.SX_ADMIN_USER || 'admin';
+const PASS = process.env.SX_ADMIN_PASSWORD || 'letmein';
+const HOST = 'picker-host';        // the post whose edit page we drive
+// the Related picker box (the edit page now has one picker per kind)
+const REL = '.relate-picker[data-kind="related"]';
+const RELF = `${REL} .rp-filter`;
+const RELR = `${REL} .rp-results`;
+const RELROWS = `${RELR} li:not(.rp-more)`;   // candidate rows (exclude the sentinel)
+
+// boot-init marks <html data-sx-ready="true"> once the WASM kernel + web stack
+// load. WASM compile + asset fetches, so allow generous time.
+async function waitReady(page) {
+  await expect(page.locator('html[data-sx-ready="true"]')).toHaveCount(1, { timeout: 45000 });
+}
+
+// Navigate to a GUARDED path; the host redirects to /login?next=…, so fill the
+// form and we should land back on the original path (exercises the auth flow).
+async function loginTo(page, path) {
+  await page.goto(path);
+  await page.waitForURL(/\/login/);
+  await page.fill('input[name="username"]', USER);
+  await page.fill('input[name="password"]', PASS);
+  await page.click('button[type="submit"]');
+  await page.waitForURL((u) => !u.pathname.startsWith('/login'));
+}
+
+// Log in directly (for reaching PUBLIC pages while authenticated).
+async function login(page) {
+  await page.goto('/login');
+  await page.fill('input[name="username"]', USER);
+  await page.fill('input[name="password"]', PASS);
+  await page.click('button[type="submit"]');
+  await page.waitForURL((u) => !u.pathname.startsWith('/login'));
+}
+
+test.describe('relate picker (browser-only)', () => {
+  test('relating a candidate adds it to the current list AND removing keeps the picker', async ({ page }) => {
+    // The whole in-page flow the user reported broken — no reloads. Relating a
+    // candidate re-renders the editor: the post moves into the current-relations
+    // list and the picker re-loads its candidates (it is NOT blanked). Removing it
+    // re-renders the editor back: the post leaves the current list and the picker
+    // still offers candidates.
+    test.setTimeout(75000);
+    await loginTo(page, `/${HOST}/edit`);
+    await waitReady(page);
+    await page.evaluate(() => { window.__noReload = true; });
+    // relate Item 13 from the picker
+    await page.fill(RELF, 'Item 13');
+    await expect.poll(() => page.locator(RELROWS).count(), { timeout: 10000 }).toBe(1);
+    await page.locator(`${RELROWS} button`).first().click();
+    const relLink = page.locator('a[href="/picker-item-13/"]');
+    // ISSUE 1: it now appears in the CURRENT relations list (added, not just removed)
+    await expect(relLink).toHaveCount(1, { timeout: 12000 });
+    // and the re-rendered picker still offers candidates (not blanked)
+    await expect.poll(() => page.locator(RELROWS).count(), { timeout: 12000 }).toBeGreaterThan(0);
+    // now remove it via its current-list remove button
+    await page.locator('li:has(a[href="/picker-item-13/"]) button').click();
+    await expect(relLink).toHaveCount(0, { timeout: 12000 });   // left the current list
+    // ISSUE 2: removing must NOT clear "the list of posts to relate"
+    await expect.poll(() => page.locator(RELROWS).count(), { timeout: 12000 }).toBeGreaterThan(0);
+    expect(await page.evaluate(() => window.__noReload)).toBe(true);   // all in-page, no reload
+    // and the relation truly persisted gone (reload shows it not present)
+    await page.reload();
+    await waitReady(page);
+    await expect(page.locator('a[href="/picker-item-13/"]')).toHaveCount(0);
+  });
+
+  test('relating a candidate persists the relation', async ({ page }) => {
+    test.setTimeout(75000);
+    await loginTo(page, `/${HOST}/edit`);
+    await waitReady(page);
+    await page.fill(RELF, 'Item 07');
+    await expect.poll(() => page.locator(RELROWS).count(), { timeout: 10000 }).toBe(1);
+    await page.locator(`${RELROWS} button`).first().click();
+    await expect(page.locator('a[href="/picker-item-07/"]')).toHaveCount(1, { timeout: 12000 });
+    // persisted across a reload
+    await page.reload();
+    await waitReady(page);
+    await expect(page.locator('a[href="/picker-item-07/"]')).toHaveCount(1);
+    // and visible on the public post page
+    await page.goto(`/${HOST}/`);
+    await expect(page.getByRole('heading', { name: 'Related posts' })).toBeVisible();
+    await expect(page.locator('body')).toContainText('Picker Item 07');
+  });
+
+  test('picker populates after a boosted SPA nav to the edit page', async ({ page }) => {
+    // Reach the edit page by CLICKING its link (a boosted SPA nav), not page.goto.
+    // The old inline <script> picker never ran on swapped-in content, so the list
+    // stayed empty here. The declarative form's "load" trigger is re-bound by the
+    // engine on swap, so it populates — that's the regression this guards.
+    await login(page);
+    await page.goto(`/${HOST}/`);              // public post page, logged in
+    await waitReady(page);
+    await page.evaluate(() => { window.__noReload = true; });
+    await page.locator(`a[href="/${HOST}/edit"]`).first().click();
+    await page.waitForURL((u) => u.pathname === `/${HOST}/edit`, { timeout: 15000 });
+    expect(await page.evaluate(() => window.__noReload)).toBe(true);   // it was a SPA nav, no full reload
+    // the picker, brought in by the swap, loaded its first page of candidates
+    await expect.poll(() => page.locator(RELROWS).count(), { timeout: 12000 }).toBeGreaterThanOrEqual(1);
+    await expect(page.locator(RELR)).toContainText('Picker Item');
+  });
+});

lib/host/playwright/run-block-check.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Browser check for the BLOCK EDITOR (composition step 6). Spins up an EPHEMERAL host
+# server (this worktree's binary + lib, a temp persist dir), seeds ONE editable host post,
+# runs lib/host/playwright/block-editor.spec.js in the main worktree's Playwright, then
+# tears everything down. No live-site dependency, no live-data pollution.
+#
+#   bash lib/host/playwright/run-block-check.sh
+#
+# Requires: the OCaml binary built (hosts/ocaml/_build/default/bin/sx_server.exe)
+# and Playwright + chromium in /root/rose-ash (the architecture worktree).
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+ROOT=$(pwd)
+
+PORT="${BLOCK_PORT:-8913}"
+PW_DIR="${PW_DIR:-/root/rose-ash}"          # worktree that has node_modules + chromium
+USER="admin"
+PASS="block-check-pw"
+SECRET="block-check-secret"
+PDIR=$(mktemp -d)
+JAR=$(mktemp)
+SPEC_SRC="lib/host/playwright/block-editor.spec.js"
+SPEC_DST="$PW_DIR/tests/playwright/_block-check.spec.js"
+SERVE_LOG=$(mktemp)
+
+cleanup() {
+  [ -n "${SVPID:-}" ] && kill "$SVPID" 2>/dev/null
+  local pid
+  pid=$(ss -lptn "sport = :$PORT" 2>/dev/null | grep -oE 'pid=[0-9]+' | head -1 | cut -d= -f2)
+  [ -n "$pid" ] && kill "$pid" 2>/dev/null
+  rm -f "$SPEC_DST" "$JAR" "$SERVE_LOG"
+  rm -rf "$PDIR"
+}
+trap cleanup EXIT
+
+echo "== starting ephemeral host server on :$PORT (persist=$PDIR) =="
+# SX_SERVING_JIT=1 matches the live container (gates the http-listen IO resolver).
+SX_SERVING_JIT=1 HOST_PORT="$PORT" SX_PERSIST_DIR="$PDIR" \
+  SX_ADMIN_USER="$USER" SX_ADMIN_PASSWORD="$PASS" SX_SESSION_SECRET="$SECRET" \
+  bash lib/host/serve.sh >"$SERVE_LOG" 2>&1 &
+SVPID=$!
+
+for i in $(seq 1 60); do
+  curl -sf -o /dev/null "http://127.0.0.1:$PORT/health" 2>/dev/null && break
+  sleep 1
+  [ "$i" = "60" ] && { echo "server never came up:"; cat "$SERVE_LOG"; exit 1; }
+done
+echo "== server up =="
+
+echo "== seeding 1 editable host post (block-host) =="
+curl -s -c "$JAR" -o /dev/null -X POST "http://127.0.0.1:$PORT/login" \
+  --data "username=$USER&password=$PASS"
+curl -s -b "$JAR" -o /dev/null -X POST "http://127.0.0.1:$PORT/new" \
+  --data 'title=Block Host&sx_content=(p "host")&status=published'
+
+echo "== running Playwright =="
+cp "$ROOT/$SPEC_SRC" "$SPEC_DST"
+cd "$PW_DIR"
+SX_TEST_URL="http://127.0.0.1:$PORT" SX_ADMIN_USER="$USER" SX_ADMIN_PASSWORD="$PASS" \
+  node_modules/.bin/playwright test _block-check.spec.js --workers=1 \
+  --config tests/playwright/playwright.config.js
+RC=$?
+
+echo "== done (exit $RC) =="
+exit $RC

lib/host/playwright/run-boost-nav-check.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Regression harness for the boosted-nav link-rebinding bug (composition step polish).
+# Spins up an EPHEMERAL host server (this worktree's binary + lib + web + WASM), which on
+# boot seeds /compose-demo and the home footer's /tags link, runs boost-nav.spec.js in the
+# main worktree's Playwright, then tears down. No live-site dependency.
+#
+#   bash lib/host/playwright/run-boost-nav-check.sh
+#
+# Requires: the OCaml binary built + Playwright + chromium in /root/rose-ash.
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+ROOT=$(pwd)
+
+PORT="${BOOST_PORT:-8914}"
+PW_DIR="${PW_DIR:-/root/rose-ash}"
+USER="admin"; PASS="boost-check-pw"; SECRET="boost-check-secret"
+PDIR=$(mktemp -d)
+SPEC_SRC="lib/host/playwright/boost-nav.spec.js"
+SPEC_DST="$PW_DIR/tests/playwright/_boost-nav-check.spec.js"
+SERVE_LOG=$(mktemp)
+
+cleanup() {
+  [ -n "${SVPID:-}" ] && kill "$SVPID" 2>/dev/null
+  local pid
+  pid=$(ss -lptn "sport = :$PORT" 2>/dev/null | grep -oE 'pid=[0-9]+' | head -1 | cut -d= -f2)
+  [ -n "$pid" ] && kill "$pid" 2>/dev/null
+  rm -f "$SPEC_DST" "$SERVE_LOG"; rm -rf "$PDIR"
+}
+trap cleanup EXIT
+
+echo "== starting ephemeral host server on :$PORT (persist=$PDIR) =="
+SX_SERVING_JIT=1 HOST_PORT="$PORT" SX_PERSIST_DIR="$PDIR" \
+  SX_ADMIN_USER="$USER" SX_ADMIN_PASSWORD="$PASS" SX_SESSION_SECRET="$SECRET" \
+  bash lib/host/serve.sh >"$SERVE_LOG" 2>&1 &
+SVPID=$!
+for i in $(seq 1 60); do
+  curl -sf -o /dev/null "http://127.0.0.1:$PORT/health" 2>/dev/null && break
+  sleep 1
+  [ "$i" = "60" ] && { echo "server never came up:"; cat "$SERVE_LOG"; exit 1; }
+done
+echo "== server up =="
+
+echo "== running Playwright =="
+cp "$ROOT/$SPEC_SRC" "$SPEC_DST"
+cd "$PW_DIR"
+SX_TEST_URL="http://127.0.0.1:$PORT" SX_ADMIN_USER="$USER" SX_ADMIN_PASSWORD="$PASS" \
+  node_modules/.bin/playwright test _boost-nav-check.spec.js --workers=1 \
+  --config tests/playwright/playwright.config.js
+RC=$?
+echo "== done (exit $RC) =="
+exit $RC

lib/host/playwright/run-picker-check.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Browser check for the relate picker. Spins up an EPHEMERAL host server (this
+# worktree's binary + lib, a temp persist dir), seeds a host post + 25 candidates,
+# runs lib/host/playwright/relate-picker.spec.js in the main worktree's Playwright,
+# then tears everything down. No live-site dependency, no live-data pollution.
+#
+#   bash lib/host/playwright/run-picker-check.sh
+#
+# Requires: the OCaml binary built (hosts/ocaml/_build/default/bin/sx_server.exe)
+# and Playwright + chromium in /root/rose-ash (the architecture worktree).
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+ROOT=$(pwd)
+
+PORT="${PICKER_PORT:-8912}"
+PW_DIR="${PW_DIR:-/root/rose-ash}"          # worktree that has node_modules + chromium
+USER="admin"
+PASS="picker-check-pw"
+SECRET="picker-check-secret"
+PDIR=$(mktemp -d)
+JAR=$(mktemp)
+SPEC_SRC="lib/host/playwright/relate-picker.spec.js"
+SPEC_DST="$PW_DIR/tests/playwright/_picker-check.spec.js"
+SERVE_LOG=$(mktemp)
+
+cleanup() {
+  [ -n "${SVPID:-}" ] && kill "$SVPID" 2>/dev/null
+  # kill whatever is still bound to the port (serve.sh re-parents via `| exec`)
+  local pid
+  pid=$(ss -lptn "sport = :$PORT" 2>/dev/null | grep -oE 'pid=[0-9]+' | head -1 | cut -d= -f2)
+  [ -n "$pid" ] && kill "$pid" 2>/dev/null
+  rm -f "$SPEC_DST" "$JAR" "$SERVE_LOG"
+  rm -rf "$PDIR"
+}
+trap cleanup EXIT
+
+echo "== starting ephemeral host server on :$PORT (persist=$PDIR) =="
+# SX_SERVING_JIT=1 matches the live container (gates the http-listen IO resolver);
+# without it, perform-heavy paths (e.g. the is-a/tags picker's reach-down) falsely 500.
+SX_SERVING_JIT=1 HOST_PORT="$PORT" SX_PERSIST_DIR="$PDIR" \
+  SX_ADMIN_USER="$USER" SX_ADMIN_PASSWORD="$PASS" SX_SESSION_SECRET="$SECRET" \
+  bash lib/host/serve.sh >"$SERVE_LOG" 2>&1 &
+SVPID=$!
+
+for i in $(seq 1 60); do
+  curl -sf -o /dev/null "http://127.0.0.1:$PORT/health" 2>/dev/null && break
+  sleep 1
+  [ "$i" = "60" ] && { echo "server never came up:"; cat "$SERVE_LOG"; exit 1; }
+done
+echo "== server up =="
+
+echo "== seeding 1 host post + 25 candidates =="
+curl -s -c "$JAR" -o /dev/null -X POST "http://127.0.0.1:$PORT/login" \
+  --data "username=$USER&password=$PASS"
+curl -s -b "$JAR" -o /dev/null -X POST "http://127.0.0.1:$PORT/new" \
+  --data 'title=Picker Host&sx_content=(p "host")&status=published'
+for n in $(seq -w 1 25); do
+  curl -s -b "$JAR" -o /dev/null -X POST "http://127.0.0.1:$PORT/new" \
+    --data "title=Picker Item $n&sx_content=(p \"item $n\")&status=published"
+done
+echo "== seeded ($(curl -s "http://127.0.0.1:$PORT/posts" | grep -o '"slug"' | wc -l) posts) =="
+
+echo "== running Playwright =="
+cp "$ROOT/$SPEC_SRC" "$SPEC_DST"
+cd "$PW_DIR"
+SX_TEST_URL="http://127.0.0.1:$PORT" SX_ADMIN_USER="$USER" SX_ADMIN_PASSWORD="$PASS" \
+  node_modules/.bin/playwright test _picker-check.spec.js --workers=1 \
+  --config tests/playwright/playwright.config.js
+RC=$?
+
+echo "== done (exit $RC) =="
+exit $RC

lib/host/playwright/run-spa-check.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# Browser check for the blog SPA. Spins up an EPHEMERAL host server (this
+# worktree's binary + lib, a temp persist dir), seeds a couple of posts, runs
+# lib/host/playwright/spa-check.spec.js in the main worktree's Playwright, then
+# tears everything down. Verifies the WASM OCaml kernel boots in-browser and
+# sx-boost turns the blog into a SPA. No live-site dependency.
+#
+#   bash lib/host/playwright/run-spa-check.sh
+#
+# Requires: the OCaml binary built (hosts/ocaml/_build/default/bin/sx_server.exe)
+# and Playwright + chromium in /root/rose-ash (the architecture worktree).
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+ROOT=$(pwd)
+
+PORT="${SPA_PORT:-8914}"
+PW_DIR="${PW_DIR:-/root/rose-ash}"          # worktree that has node_modules + chromium
+USER="admin"
+PASS="spa-check-pw"
+SECRET="spa-check-secret"
+PDIR=$(mktemp -d)
+JAR=$(mktemp)
+SPEC_SRC="lib/host/playwright/spa-check.spec.js"
+SPEC_DST="$PW_DIR/tests/playwright/_spa-check.spec.js"
+SERVE_LOG=$(mktemp)
+
+cleanup() {
+  [ -n "${SVPID:-}" ] && kill "$SVPID" 2>/dev/null
+  local pid
+  pid=$(ss -lptn "sport = :$PORT" 2>/dev/null | grep -oE 'pid=[0-9]+' | head -1 | cut -d= -f2)
+  [ -n "$pid" ] && kill "$pid" 2>/dev/null
+  rm -f "$SPEC_DST" "$JAR" "$SERVE_LOG"
+  rm -rf "$PDIR"
+}
+trap cleanup EXIT
+
+echo "== starting ephemeral host server on :$PORT (persist=$PDIR) =="
+HOST_PORT="$PORT" SX_PERSIST_DIR="$PDIR" \
+  SX_ADMIN_USER="$USER" SX_ADMIN_PASSWORD="$PASS" SX_SESSION_SECRET="$SECRET" \
+  bash lib/host/serve.sh >"$SERVE_LOG" 2>&1 &
+SVPID=$!
+
+for i in $(seq 1 60); do
+  curl -sf -o /dev/null "http://127.0.0.1:$PORT/health" 2>/dev/null && break
+  sleep 1
+  [ "$i" = "60" ] && { echo "server never came up:"; cat "$SERVE_LOG"; exit 1; }
+done
+echo "== server up =="
+
+echo "== seeding posts =="
+curl -s -c "$JAR" -o /dev/null -X POST "http://127.0.0.1:$PORT/login" \
+  --data "username=$USER&password=$PASS"
+for t in "Alpha Post" "Beta Post"; do
+  curl -s -b "$JAR" -o /dev/null -X POST "http://127.0.0.1:$PORT/new" \
+    --data "title=$t&sx_content=(article (h1 \"$t\") (p \"body\"))&status=published"
+done
+echo "== seeded ($(curl -s "http://127.0.0.1:$PORT/posts" | grep -o '"slug"' | wc -l) posts) =="
+
+echo "== running Playwright =="
+cp "$ROOT/$SPEC_SRC" "$SPEC_DST"
+cd "$PW_DIR"
+SX_TEST_URL="http://127.0.0.1:$PORT" \
+  node_modules/.bin/playwright test _spa-check.spec.js --workers=1 \
+  --config tests/playwright/playwright.config.js
+RC=$?
+
+echo "== done (exit $RC) =="
+exit $RC

lib/host/playwright/spa-check.spec.js

@@ -0,0 +1,84 @@
+// Browser check for the blog SPA (lib/host/blog.sx + lib/host/static.sx). Runs
+// against an ephemeral host server seeded with a couple of posts by
+// run-spa-check.sh, which copies this spec into the Playwright env and sets
+// SX_TEST_URL. Verifies the WASM OCaml kernel boots in the browser, the SX-htmx
+// engine activates sx-boost on #content's links, and clicking a link does a
+// fragment swap (no full page reload) with history — i.e. it's a real SPA.
+const { test, expect } = require('playwright/test');
+
+// boot-init sets data-sx-ready="true" on <html> once the WASM kernel + web stack
+// have loaded and the page has been processed. WASM compile + ~25 asset fetches,
+// so allow generous time.
+async function waitReady(page) {
+  await expect(page.locator('html[data-sx-ready="true"]')).toHaveCount(1, { timeout: 45000 });
+}
+
+// a post link in the listing (trailing slash); skip /new, /login, /tags.
+const POSTLINK = '#content a[href$="/"]';
+
+test.describe('blog SPA', () => {
+  test('WASM kernel boots, loads modules content-addressed, marks ready', async ({ page }) => {
+    const errors = [];
+    // Track web-stack module fetches: content-addressed (/sx/h/{hash}) vs the
+    // path-based .sxbc fallback. A correctly-booting client takes ONLY the
+    // content-addressed branch (immutable, localStorage-cached).
+    const caFetches = [];     // /sx/h/{hash}
+    const pathSxbc = [];      // *.sxbc by path (the fallback — should not happen)
+    page.on('request', (r) => {
+      const u = r.url();
+      if (u.includes('/sx/h/')) caFetches.push(u);
+      else if (/\.sxbc(\?|$)/.test(u)) pathSxbc.push(u);
+    });
+    page.on('console', (m) => { if (m.type() === 'error') errors.push(m.text()); });
+    page.on('pageerror', (e) => errors.push(String(e)));
+    await page.goto('/');
+    await waitReady(page);
+    // the shell shipped the WASM loaders
+    expect(await page.locator('script[src*="sx_browser.bc.wasm.js"]').count()).toBe(1);
+    expect(await page.locator('script[src*="sx-platform.js"]').count()).toBe(1);
+    // modules loaded by content hash, with no path-.sxbc fallback fetches
+    expect(caFetches.length, 'expected content-addressed /sx/h/ module fetches').toBeGreaterThan(0);
+    expect(pathSxbc, `path-based .sxbc fallback fetched:\n${pathSxbc.join('\n')}`).toEqual([]);
+    // no boot-time JS errors
+    expect(errors, errors.join('\n')).toEqual([]);
+  });
+
+  test('clicking a link does a fragment swap — no full reload, URL updates', async ({ page }) => {
+    await page.goto('/');
+    await waitReady(page);
+    // sentinel survives ONLY if there is no full-page reload
+    await page.evaluate(() => { window.__noReload = true; });
+    const link = page.locator(POSTLINK).first();
+    const href = await link.getAttribute('href');
+    await link.click();
+    await page.waitForURL((u) => u.pathname === href, { timeout: 15000 });
+    expect(await page.evaluate(() => window.__noReload)).toBe(true);     // no reload
+    // content was swapped into #content (a post page carries the post footer)
+    await expect(page.locator('#content')).toContainText(/all posts/i, { timeout: 15000 });
+    // the post BODY itself rendered — the <article> comes from raw! HTML, which
+    // exercises the client SX raw-HTML path (dom-parse-html). If that drops the
+    // content (NodeList-vs-Node bug), the footer still shows but this fails.
+    await expect(page.locator('#content article').first()).toBeVisible({ timeout: 15000 });
+  });
+
+  test('back button restores the listing', async ({ page }) => {
+    await page.goto('/');
+    await waitReady(page);
+    const link = page.locator(POSTLINK).first();
+    const href = await link.getAttribute('href');
+    await link.click();
+    await page.waitForURL((u) => u.pathname === href, { timeout: 15000 });
+    await page.goBack();
+    await page.waitForURL((u) => u.pathname === '/', { timeout: 15000 });
+    await expect(page.locator('#content h1')).toContainText('Posts');
+    // and a click AFTER back must still be a SPA nav, not a full reload — the
+    // restored content has to be re-boosted (its [sx-boost] marker is an
+    // ancestor of the swap target, so the re-boost must scan upward).
+    await page.evaluate(() => { window.__noReload2 = true; });
+    const link2 = page.locator(POSTLINK).first();
+    const href2 = await link2.getAttribute('href');
+    await link2.click();
+    await page.waitForURL((u) => u.pathname === href2, { timeout: 15000 });
+    expect(await page.evaluate(() => window.__noReload2)).toBe(true);
+  });
+});

lib/host/relations.sx

@@ -0,0 +1,134 @@
+;; lib/host/relations.sx — Relations domain endpoints on the host. The relations
+;; service is internal-only (no public routes): Quart exposes it as signed
+;; /internal/data/{query} reads + /internal/actions/{action} writes. This migrates
+;; the two READ queries — get-children, get-parents — straight onto the SX host,
+;; dispatching to the lib/relations subsystem (a saturating Datalog graph).
+;;
+;; Node model: the Quart relations API keys nodes by a (type, id) pair; the graph
+;; subsystem keys them by an opaque atom. We bridge by composing the atom as the
+;; symbol "type:id", with the relation-type as the edge kind. Optional child-type
+;; / parent-type params filter the result by that "type:" prefix — matching the
+;; Quart queries' optional type narrowing.
+;; Depends on lib/relations/* + lib/host/handler.sx + lib/dream/* (query params).
+
+;; ── node helpers ────────────────────────────────────────────────────
+(define host/-rel-node
+  (fn (type id) (string->symbol (str type ":" id))))
+(define host/-rel-node-type?
+  (fn (node type) (starts-with? (symbol->string node) (str type ":"))))
+(define host/-rel-strings
+  (fn (nodes) (map (fn (n) (symbol->string n)) nodes)))
+
+;; ── GET /internal/data/get-children ─────────────────────────────────
+;; query: parent-type, parent-id, relation-type (required); child-type (optional
+;; filter). Returns the child node ids ("type:id") for the parent under that kind.
+(define host/relations-children
+  (fn (req)
+    (let ((ptype (dream-query-param req "parent-type"))
+          (pid (dream-query-param req "parent-id"))
+          (kind (dream-query-param req "relation-type")))
+      (if (and ptype pid kind)
+        (let ((kids (relations/children (host/-rel-node ptype pid) (string->symbol kind)))
+              (ctype (dream-query-param req "child-type")))
+          (let ((sel (if ctype (filter (fn (k) (host/-rel-node-type? k ctype)) kids) kids)))
+            (host/ok (host/-rel-strings sel))))
+        (host/error 400 "missing parameter")))))
+
+;; ── GET /internal/data/get-parents ──────────────────────────────────
+;; query: child-type, child-id, relation-type (required); parent-type (optional
+;; filter). Returns the parent node ids ("type:id") for the child under that kind.
+(define host/relations-parents
+  (fn (req)
+    (let ((ctype (dream-query-param req "child-type"))
+          (cid (dream-query-param req "child-id"))
+          (kind (dream-query-param req "relation-type")))
+      (if (and ctype cid kind)
+        (let ((ps (relations/parents (host/-rel-node ctype cid) (string->symbol kind)))
+              (ptype (dream-query-param req "parent-type")))
+          (let ((sel (if ptype (filter (fn (p) (host/-rel-node-type? p ptype)) ps) ps)))
+            (host/ok (host/-rel-strings sel))))
+        (host/error 400 "missing parameter")))))
+
+;; ── read route group ────────────────────────────────────────────────
+;; Internal data reads (the signed-internal-auth gate is a separate middleware
+;; concern, like the feed reads); these dispatch straight to the subsystem.
+(define host/relations-routes
+  (list
+    (dream-get "/internal/data/get-children" host/relations-children)
+    (dream-get "/internal/data/get-parents" host/relations-parents)))
+
+;; ── writes: container relations (attach-child / detach-child) ────────
+;; The write side of get-children/get-parents: a container edge between a parent
+;; (type,id) and child (type,id) under a relation kind. Maps to relations/relate
+;; and relations/unrelate over the same "type:id" node model, so an attach is
+;; immediately visible through get-children. (The TYPED relate/unrelate/can-relate
+;; actions stay on Quart — they carry registry + cardinality validation that
+;; lib/relations does not implement.) Body is the action's JSON params dict.
+
+;; Pull the four node coordinates + kind from a payload; nil if any are absent.
+(define host/-rel-edge
+  (fn (p)
+    (let ((pt (get p :parent-type)) (pid (get p :parent-id))
+          (ct (get p :child-type)) (cid (get p :child-id))
+          (kind (get p :relation-type)))
+      (if (and pt pid ct cid kind)
+        {:parent (host/-rel-node pt pid)
+         :child (host/-rel-node ct cid)
+         :kind (string->symbol kind)
+         :parent-id (str pt ":" pid)
+         :child-id (str ct ":" cid)
+         :relation kind}
+        nil))))
+
+;; POST /internal/actions/attach-child — create the container edge. 201 on success.
+;; Body is text/sx (host/sx-body); non-dict -> 400.
+(define host/relations-attach
+  (fn (req)
+    (let ((p (host/sx-body req)))
+      (if (= (type-of p) "dict")
+        (let ((e (host/-rel-edge p)))
+          (if e
+            (begin
+              (relations/relate (get e :parent) (get e :child) (get e :kind))
+              (host/ok-status 201
+                {:parent (get e :parent-id) :child (get e :child-id)
+                 :relation (get e :relation)}))
+            (host/error 400 "missing parameter")))
+        (host/error 400 "invalid payload")))))
+
+;; POST /internal/actions/detach-child — remove the container edge. 200 on success.
+;; Body is text/sx (host/sx-body); non-dict -> 400.
+(define host/relations-detach
+  (fn (req)
+    (let ((p (host/sx-body req)))
+      (if (= (type-of p) "dict")
+        (let ((e (host/-rel-edge p)))
+          (if e
+            (begin
+              (relations/unrelate (get e :parent) (get e :child) (get e :kind))
+              (host/ok
+                {:parent (get e :parent-id) :child (get e :child-id)
+                 :relation (get e :relation) :detached true}))
+            (host/error 400 "missing parameter")))
+        (host/error 400 "invalid payload")))))
+
+;; Guarded write route group: each action behind auth + ACL. attach needs
+;; ("relate","relations"); detach needs ("unrelate","relations"). resolve is the
+;; injected token->principal auth policy (same shape as host/feed-write-routes).
+(define host/relations-write-routes
+  (fn (resolve)
+    (list
+      (dream-post "/internal/actions/attach-child"
+        (host/pipeline
+          (list
+            host/wrap-errors
+            (host/require-auth resolve)
+            (host/require-permission "relate" (fn (req) "relations")))
+          host/relations-attach))
+      (dream-post "/internal/actions/detach-child"
+        (host/pipeline
+          (list
+            host/wrap-errors
+            (host/require-auth resolve)
+            (host/require-permission "unrelate" (fn (req) "relations")))
+          host/relations-detach)))))

lib/host/router.sx

@@ -0,0 +1,25 @@
+;; lib/host/router.sx — Host application assembly. A host app is a single Dream
+;; router built from per-domain route groups, with a built-in health endpoint and
+;; a JSON 404 fallback so the native OCaml HTTP server has one entry point:
+;; request -> response. Each subsystem contributes a list of Dream routes (see
+;; lib/host/feed.sx); host/make-app concatenates them under one router.
+;; dr/flatten-routes (Dream) flattens the nested groups, so a group is just a list
+;; of routes. Depends on lib/dream/router.sx + lib/host/handler.sx + the host
+;; session middleware (lib/host/session.sx) and login routes (lib/host/auth.sx).
+
+;; Liveness probe — GET /health -> 200 {"ok":true,"data":"healthy"}.
+(define host/health-route
+  (dream-get "/health" (fn (req) (host/ok "healthy"))))
+
+;; Build the host app from a list of route groups (each a list of Dream routes).
+;; The health route + login routes are always mounted; Dream's router returns a
+;; JSON 404 for unmatched paths, which host endpoints override per-domain as
+;; needed. The WHOLE app is wrapped in the signed-session middleware so every
+;; request carries a session and any handler can log a principal in/out — this is
+;; the front door, so sessions are not optional.
+(define host/make-app
+  (fn (groups)
+    (let ((router (dream-router
+                    (cons host/health-route
+                      (cons host/auth-routes groups)))))
+      ((host/sessions) router))))

lib/host/serve.sh

@@ -0,0 +1,198 @@
+#!/usr/bin/env bash
+# host-on-sx live server launcher. Loads the kernel stdlib, the subsystem
+# libraries, and the host modules into one sx_server process, then calls
+# (host/serve PORT ...) which binds the native http-listen server to the
+# Dream-shaped host app. Runs in the FOREGROUND (http-listen blocks), so this
+# doubles as a container entrypoint and a local launcher.
+#
+# Usage:
+#   bash lib/host/serve.sh                 # serve on $HOST_PORT (default 8910)
+#   HOST_PORT=8920 bash lib/host/serve.sh  # pick a port
+#
+# The module list is kept identical to lib/host/conformance.sh so what serves is
+# exactly what the suites verify.
+
+set -uo pipefail
+# Project root: SX_PROJECT_DIR in containers (set to /app by the compose stack),
+# else the git toplevel for local runs.
+cd "${SX_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || echo .)}"
+
+SX_SERVER="${SX_SERVER:-hosts/ocaml/_build/default/bin/sx_server.exe}"
+if [ ! -x "$SX_SERVER" ]; then
+  SX_SERVER="/root/rose-ash/hosts/ocaml/_build/default/bin/sx_server.exe"
+fi
+if [ ! -x "$SX_SERVER" ]; then
+  echo "ERROR: sx_server.exe not found." >&2
+  exit 1
+fi
+
+PORT="${HOST_PORT:-8910}"
+
+# Modules: every load line from conformance.sh's MODULES list, minus the ledger
+# (not needed to serve). server.sx supplies host/serve.
+MODULES=(
+  "spec/stdlib.sx"
+  "lib/r7rs.sx"
+  "lib/apl/runtime.sx"
+  "lib/datalog/tokenizer.sx"
+  "lib/datalog/parser.sx"
+  "lib/datalog/unify.sx"
+  "lib/datalog/db.sx"
+  "lib/datalog/builtins.sx"
+  "lib/datalog/aggregates.sx"
+  "lib/datalog/strata.sx"
+  "lib/datalog/eval.sx"
+  "lib/datalog/api.sx"
+  "lib/datalog/magic.sx"
+  "lib/acl/schema.sx"
+  "lib/acl/facts.sx"
+  "lib/acl/engine.sx"
+  "lib/acl/explain.sx"
+  "lib/acl/audit.sx"
+  "lib/acl/federation.sx"
+  "lib/acl/api.sx"
+  "lib/relations/schema.sx"
+  "lib/relations/engine.sx"
+  "lib/relations/api.sx"
+  "lib/relations/explain.sx"
+  "lib/relations/federation.sx"
+  "lib/relations/tree.sx"
+  "lib/feed/normalize.sx"
+  "lib/feed/stream.sx"
+  "lib/feed/api.sx"
+  "lib/persist/event.sx"
+  "lib/persist/backend.sx"
+  "lib/persist/log.sx"
+  "lib/persist/kv.sx"
+  "lib/persist/api.sx"
+  "lib/persist/durable.sx"
+  "spec/render.sx"
+  "web/adapter-html.sx"
+  "lib/dream/types.sx"
+  "lib/dream/json.sx"
+  "lib/dream/auth.sx"
+  "lib/dream/error.sx"
+  "lib/dream/form.sx"
+  "lib/dream/session.sx"
+  "lib/dream/router.sx"
+  "lib/host/handler.sx"
+  "lib/host/middleware.sx"
+  "lib/host/session.sx"
+  "lib/host/auth.sx"
+  "lib/host/sxtp.sx"
+  "lib/host/router.sx"
+  "lib/host/static.sx"
+  "lib/host/sx/relate-picker.sx"
+  "lib/host/sx/kg-cards.sx"
+  "lib/host/feed.sx"
+  "lib/host/relations.sx"
+  "lib/host/compose.sx"
+  "lib/host/execute.sx"
+  "lib/host/htmlsx.sx"
+  "lib/host/blog.sx"
+  "lib/host/server.sx"
+)
+
+# Admin login credentials + session signing secret. Override via the container
+# env; the in-source defaults are dev-only. The blog write routes are now GUARDED
+# (session login or Bearer), so these gate publishing on blog.rose-ash.com.
+ADMIN_USER="${SX_ADMIN_USER:-admin}"
+ADMIN_PASS="${SX_ADMIN_PASSWORD:-letmein}"
+SESSION_SECRET="${SX_SESSION_SECRET:-rose-ash-host-dev-secret-change-me}"
+
+EPOCH=1
+{
+  for M in "${MODULES[@]}"; do
+    echo "(epoch $EPOCH)"; echo "(load \"$M\")"; EPOCH=$((EPOCH+1))
+  done
+  # 100% serving JIT — NO host exclude. The serving-JIT perform-in-HO-callback
+  # miscompile (map/rest/drop wrong args → blank pages, empty picker) is fixed by
+  # two composing pieces: sx-vm-extensions 81177d0e resolves a callback's IO
+  # inline (instead of unwinding the native HO loop) WHEN a synchronous resolver
+  # is installed, and sx_server.ml's http-listen now installs that resolver (it
+  # mirrors cek_run_with_io exactly). So the whole request path — host app +
+  # Dream + Datalog — runs under JIT with no exclude. Verified: ephemeral durable
+  # server, 100% JIT, zero fallbacks, real content, picker lists candidates.
+  # Point the blog at the DURABLE file backend (persists under $SX_PERSIST_DIR),
+  # then idempotently seed a welcome post (sx_content = SX element markup, the
+  # editor's content model). Re-seeding is a no-op if the slug already exists.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/blog-use-store! (persist/durable-backend))\")"
+  EPOCH=$((EPOCH+1))
+  # Rebuild the relations graph from the durable edge store. lib/relations holds
+  # the graph in memory only, so without this, related/tags/types vanish on every
+  # restart even though the posts persist.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/blog-load-edges!)\")"
+  EPOCH=$((EPOCH+1))
+  # Sessions on the DURABLE store, LAZILY: only a logged-in session (one that
+  # writes a field) persists, so a login survives a restart while anonymous /
+  # crawler traffic leaves no rows. host/session-init! bumps the per-boot epoch
+  # that keeps sids unique across restarts. Then the signing secret + admin
+  # credentials, and grant admin "edit" on "blog" so a logged-in session passes
+  # the ACL gate on the write routes.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/session-use-store! (persist/durable-backend))\")"
+  EPOCH=$((EPOCH+1))
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/session-init!)\")"
+  EPOCH=$((EPOCH+1))
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/session-set-secret! \\\"$SESSION_SECRET\\\")\")"
+  EPOCH=$((EPOCH+1))
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/auth-set-admin! \\\"$ADMIN_USER\\\" \\\"$ADMIN_PASS\\\")\")"
+  EPOCH=$((EPOCH+1))
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(acl/load! (list (acl-grant \\\"$ADMIN_USER\\\" \\\"edit\\\" \\\"blog\\\")))\")"
+  EPOCH=$((EPOCH+1))
+  # Idempotently seed a welcome post (sx_content = SX element markup, the editor's
+  # content model). Re-seeding is a no-op if the slug already exists.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/blog-seed! \\\"welcome\\\" \\\"Welcome to the SX host\\\" \\\"(article (h1 \\\\\\\"Welcome to the SX host\\\\\\\") (p \\\\\\\"Rendered by lib/host via render-to-html, from the durable SX store.\\\\\\\"))\\\" \\\"published\\\")\")"
+  EPOCH=$((EPOCH+1))
+  # Seed the root type-posts (type, tag) — types ARE posts. Idempotent.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/blog-seed-types!)\")"
+  EPOCH=$((EPOCH+1))
+  # Seed a live demo of the composition fold (plans/composition-objects.md): /compose-demo
+  # is one composition object rendered by host/comp-render — renders differently by context.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/blog-seed-compose-demo!)\")"
+  EPOCH=$((EPOCH+1))
+  # Seed the EXECUTE-fold demo (composition step 7): /workflow-demo runs ONE composition
+  # object through host/exec-run — the same algebra as render, folded to an effect log.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/blog-seed-workflow-demo!)\")"
+  EPOCH=$((EPOCH+1))
+  # Seed a REAL imported blog post (rose-ash.com/nt-live-encore) decomposed into the :body
+  # composition — so the import survives store wipes, reseeded on boot like the demos.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/blog-seed-nt-live-encore!)\")"
+  EPOCH=$((EPOCH+1))
+  # Seed the layer-2 demo: a Landing type with TWO composition fields (:body + :aside) + a
+  # populated instance — so the two-field composition editor + render show side by side.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/blog-seed-landing-demo!)\")"
+  EPOCH=$((EPOCH+1))
+  # Load relation metadata (symmetry/labels) from the relation-posts into the
+  # in-memory cache, so render paths read it without a (VmSuspending) durable read.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/blog-load-rel-kinds!)\")"
+  EPOCH=$((EPOCH+1))
+  # Index the web-stack .sxbc by content hash so /sx/h/{hash} can serve them
+  # immutably and the shell can emit the data-sx-manifest (content-addressed
+  # client module cache). Done once at boot.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/static-build-sxh-index!)\")"
+  EPOCH=$((EPOCH+1))
+  echo "(epoch $EPOCH)"
+  # Anonymous reads (feed timeline + relations container reads + blog post detail)
+  # plus the GUARDED blog write routes: POST /new (editor form ingest), POST/PUT/
+  # DELETE /posts behind host/require-user (session login OR Bearer) + ACL. make-app
+  # auto-mounts /login + /logout and wraps everything in the signed-session
+  # middleware, so a browser logs in then publishes. The bearer resolver is a stub
+  # (no API tokens configured) — browser session is the live auth path for now.
+  # blog-routes LAST — its GET /:slug catch-all must not shadow the rest.
+  echo "(eval \"(host/serve $PORT (list host/static-routes host/feed-routes host/relations-routes (host/blog-write-routes (fn (tok) nil)) host/blog-routes))\")"
+} | exec "$SX_SERVER"

lib/host/server.sx

@@ -0,0 +1,48 @@
+;; lib/host/server.sx — the live wiring: bridge the native OCaml http-listen
+;; server to the Dream-shaped host app, and serve. The native server hands a
+;; handler a STRING-keyed request dict {"method" "path" "query" "headers" "body"}
+;; and expects back {:status :headers :body}. The host app (host/make-app ->
+;; dream-router) is a fn dream-request -> dream-response. This module adapts
+;; between the two shapes and calls http-listen.
+;; Depends on lib/dream/* (dream-request/response accessors) + lib/host/router.sx
+;; + the kernel http-listen primitive.
+
+;; ── native request -> dream request ─────────────────────────────────
+;; Reassemble path + query into the target string dream-request parses, and carry
+;; method/headers/body. Missing fields default empty.
+(define host/-native->dream
+  (fn (req)
+    (let ((path (or (get req "path") "/"))
+          (query (or (get req "query") ""))
+          (method (or (get req "method") "GET"))
+          (headers (or (get req "headers") {}))
+          (body (or (get req "body") "")))
+      (let ((target (if (> (len query) 0) (str path "?" query) path)))
+        (dream-request method target headers body)))))
+
+;; ── dream response -> native response ───────────────────────────────
+;; dream-response is already {:body :headers :status}; the native server wants
+;; {:status :headers :body}. Same keys — normalise the shape explicitly so the
+;; contract is visible (and headers/body never nil). :set-cookies is a LIST of
+;; pre-formatted cookie strings (Dream's dream-set-cookie); the kernel http-listen
+;; emit serialises one Set-Cookie header per item (a headers dict can't hold more
+;; than one). Carry it through so sessions/login can set the cookie.
+(define host/-dream->native
+  (fn (resp)
+    {:status (dream-status resp)
+     :headers (or (dream-headers resp) {})
+     :set-cookies (dream-resp-cookies resp)
+     :body (or (dream-resp-body resp) "")}))
+
+;; ── adapter + serve ─────────────────────────────────────────────────
+;; Wrap a Dream app as a native http-listen handler.
+(define host/native-handler
+  (fn (app)
+    (fn (req)
+      (host/-dream->native (app (host/-native->dream req))))))
+
+;; Build the app from route groups and start the native server on `port`.
+;; Blocks (the http-listen primitive runs the server loop).
+(define host/serve
+  (fn (port groups)
+    (http-listen port (host/native-handler (host/make-app groups)))))

lib/host/session.sx

@@ -0,0 +1,81 @@
+;; lib/host/session.sx — durable, signed sessions for the host.
+;; Backs Dream's session middleware ops (session/create|exists|get|set|clear)
+;; with the SAME durable persist KV the blog uses, so a login survives restarts.
+;; The session cookie carries only a signed sid (dream-sessions-signed): the sid
+;; itself is a persisted monotonic counter ("s1", "s2", …) — cheap and ordered —
+;; and the HMAC signature (dr/sess-hash, keyed by host/session-secret) makes a
+;; guessed or forged cookie unusable. http-listen serialises handler calls under a
+;; mutex, so the counter increment is race-free.
+;;
+;; Depends on lib/dream/session.sx (dream-sessions-signed + cookie helpers) and
+;; lib/persist/* (the KV backend). Wired into host/make-app via host/sessions.
+
+;; ── store (durable persist KV, injectable; mirrors host/blog-store) ──
+(define host/session-store (persist/open))
+(define host/session-use-store! (fn (b) (set! host/session-store b)))
+
+;; ── signing secret (override from $SX_SESSION_SECRET in serve.sh) ────
+(define host/session-secret "rose-ash-host-dev-secret-change-me")
+(define host/session-set-secret! (fn (s) (set! host/session-secret s)))
+
+;; ── keys ────────────────────────────────────────────────────────────
+(define host/-sess-key (fn (sid) (str "session:" sid)))
+(define host/-sess-epoch-key "session:-epoch")
+
+;; sid generation: a per-BOOT epoch (one durable write at startup) + an in-memory
+;; counter. The epoch keeps sids unique across restarts WITHOUT a write per
+;; request, so anonymous traffic costs no disk. host/session-init! bumps the epoch
+;; on boot (serve.sh); without it (e.g. tests) epoch 0 is fine within one process.
+(define host/session-epoch 0)
+(define host/session-ctr 0)
+(define host/session-init!
+  (fn ()
+    (let ((e (+ 1 (or (persist/backend-kv-get host/session-store host/-sess-epoch-key) 0))))
+      (begin
+        (persist/backend-kv-put host/session-store host/-sess-epoch-key e)
+        (set! host/session-epoch e)
+        (set! host/session-ctr 0)))))
+(define host/-sess-next-sid
+  (fn ()
+    (begin
+      (set! host/session-ctr (+ host/session-ctr 1))
+      (str "s" host/session-epoch "-" host/session-ctr))))
+
+;; ── backend io fn: dispatch session/* ops onto the persist KV ───────
+;; LAZY: session/create mints a sid but writes NO row, so an anonymous request
+;; (which never sets a field) leaves no durable trace — the store isn't spammed by
+;; crawlers. The row appears on the first session/set (i.e. login), so a logged-in
+;; session persists and survives a restart; session/exists is "has a written row".
+(define host/session-backend
+  (fn (op)
+    (let ((kind (get op :op)))
+      (cond
+        ((= kind "session/create") (host/-sess-next-sid))
+        ((= kind "session/exists")
+          (persist/backend-kv-has? host/session-store (host/-sess-key (get op :sid))))
+        ((= kind "session/get")
+          (get
+            (or (persist/backend-kv-get host/session-store (host/-sess-key (get op :sid))) {})
+            (get op :key)))
+        ((= kind "session/set")
+          (let ((sid (get op :sid)))
+            (persist/backend-kv-put host/session-store (host/-sess-key sid)
+              (assoc
+                (or (persist/backend-kv-get host/session-store (host/-sess-key sid)) {})
+                (get op :key)
+                (get op :val)))))
+        ((= kind "session/load")
+          (or (persist/backend-kv-get host/session-store (host/-sess-key (get op :sid))) {}))
+        ((= kind "session/clear")
+          (persist/backend-kv-delete host/session-store (host/-sess-key (get op :sid))))
+        (else nil)))))
+
+;; ── middleware for the host pipeline: signed cookie + durable backend ─
+(define host/sessions
+  (fn () (dream-sessions-signed host/session-backend host/session-secret)))
+
+;; ── handler-facing helpers ──────────────────────────────────────────
+;; The logged-in principal (or nil), and login/logout writing the session field.
+(define host/current-principal (fn (req) (dream-session-field req :principal)))
+(define host/login! (fn (req principal) (dream-set-session-field req :principal principal)))
+(define host/logout! (fn (req) (dream-invalidate-session req)))

lib/host/static.sx

@@ -0,0 +1,118 @@
+;; lib/host/static.sx — serve the client kernel + assets so the blog can boot the
+;; SX-htmx hypermedia engine (web/engine.sx) and run as a SPA. The native
+;; http-listen host reads files with the `file-read` primitive (no perform), so
+;; GET /static/** maps to a file under the static root (default "shared/static",
+;; resolved against the server cwd — mount ./shared/static there in the container).
+;;
+;; Also wires the CONTENT-ADDRESSED module cache the SX client expects: GET
+;; /sx/h/{hash} serves a web-stack .sxbc by its content hash (immutable, never
+;; stale — a deploy changes the content → changes the hash → a fresh URL), and a
+;; <script data-sx-manifest> mapping {file -> hash} makes the client's
+;; loadBytecodeFile take the content-addressed branch (localStorage + immutable)
+;; instead of the path + max-age=3600 branch.
+;; Depends on lib/dream/types.sx (dream-response/-html-status/-param) + router.
+
+(define host/static-root "shared/static")
+(define host/static-use-root! (fn (r) (set! host/static-root r)))
+
+;; content-type by file extension; default to octet-stream.
+(define host/static--ctype
+  (fn (path)
+    (cond
+      ((ends-with? path ".js")    "application/javascript; charset=utf-8")
+      ((ends-with? path ".mjs")   "application/javascript; charset=utf-8")
+      ((ends-with? path ".css")   "text/css; charset=utf-8")
+      ((ends-with? path ".json")  "application/json; charset=utf-8")
+      ((ends-with? path ".map")   "application/json; charset=utf-8")
+      ((ends-with? path ".svg")   "image/svg+xml")
+      ((ends-with? path ".png")   "image/png")
+      ((ends-with? path ".woff2") "font/woff2")
+      ((ends-with? path ".wasm")  "application/wasm")
+      (true                       "application/octet-stream"))))
+
+;; A content-hashed filename (e.g. js_of_ocaml-651f6707.wasm, or anything under
+;; /sx/h/) is immutable; everything else gets a modest max-age (mutable bundle).
+(define host/static--cache-control
+  (fn (rel)
+    (if (ends-with? rel ".wasm")
+      "public, max-age=31536000, immutable"
+      "public, max-age=3600")))
+
+;; reject empty, absolute, or traversal paths.
+(define host/static--safe?
+  (fn (rel)
+    (and (> (len rel) 0)
+         (not (starts-with? rel "/"))
+         (not (string-contains? rel "..")))))
+
+;; Serve one asset by its path relative to the static root. file-read THROWS on a
+;; missing file, so gate on file-exists? first and return a 404 instead.
+(define host/static-serve
+  (fn (rel)
+    (if (not (host/static--safe? rel))
+      (dream-html-status 403 "Forbidden")
+      (let ((path (str host/static-root "/" rel)))
+        (if (not (file-exists? path))
+          (dream-html-status 404 "Not Found")
+          (dream-response 200
+            {:content-type (host/static--ctype rel)
+             :cache-control (host/static--cache-control rel)}
+            (file-read path)))))))
+
+;; ── content-addressed module cache (/sx/h/{hash}) ───────────────────
+;; Each web-stack .sxbc carries its content hash in its head: (sxbc 1 "HASH" ...).
+;; Index every .sxbc by that hash at startup so the client can fetch each module
+;; immutably + localStorage-cached, and never stale.
+(define host/static--sxh->path (dict))   ;; hash -> filepath
+(define host/static--file->hash (dict))  ;; "dom.sxbc" -> hash
+
+;; the embedded hash from a .sxbc head: (sxbc 1 "HASH" ...  -> "HASH"
+(define host/static--sxbc-hash
+  (fn (head) (nth (split head "\"") 1)))
+
+(define host/static-build-sxh-index!
+  (fn ()
+    (for-each
+      (fn (path)
+        (let ((h (host/static--sxbc-hash (substr (file-read path) 0 60)))
+              (base (last (split path "/"))))
+          (dict-set! host/static--sxh->path h path)
+          (dict-set! host/static--file->hash base h)))
+      (file-glob (str host/static-root "/wasm/sx/*.sxbc")))))
+
+;; GET /sx/h/{hash} -> the .sxbc content, immutable (content-addressed).
+(define host/static-sxh-serve
+  (fn (hash)
+    (let ((path (get host/static--sxh->path hash)))
+      (if (nil? path)
+        (dream-html-status 404 "Not Found")
+        (dream-response 200
+          {:content-type "text/sx; charset=utf-8"
+           :cache-control "public, max-age=31536000, immutable"}
+          (file-read path))))))
+
+;; the data-sx-manifest JSON for the shell: {"modules": {"dom.sxbc": "hash", ...}}.
+;; The client's loadBytecodeFile reads manifest.modules[file] -> hash -> /sx/h/.
+;; App components the client must eager-load (after the web stack) so their
+;; defcomps are registered before a boosted fragment references them. Loaded
+;; content-addressed via the modules map below, the same as any web-stack module.
+(define host/static--boot-modules (list "relate-picker.sxbc"))
+
+(define host/static-manifest-json
+  (fn ()
+    (str "{\"v\":1,\"boot\":["
+      (join "," (map (fn (m) (str "\"" m "\"")) host/static--boot-modules))
+      "],\"defs\":{},\"modules\":{"
+      (join ","
+        (map (fn (k) (str "\"" k "\":\"" (get host/static--file->hash k) "\""))
+          (keys host/static--file->hash)))
+      "}}")))
+
+;; Route group: GET /static/** (path) + GET /sx/h/** (content-addressed). A plain
+;; route LIST (like host/feed-routes); host/serve combines + flattens the groups.
+(define host/static-routes
+  (list
+    (dream-get "/static/**"
+      (fn (req) (host/static-serve (dream-param req "**"))))
+    (dream-get "/sx/h/**"
+      (fn (req) (host/static-sxh-serve (dream-param req "**"))))))

lib/host/sx/kg-cards.sx

@@ -0,0 +1,157 @@
+;; KG card components — Ghost/Koenig-compatible card rendering, copied into the host
+;; so it can render imported Ghost posts (sx_content holds (~kg_cards/kg-*) from the
+;; lexical_to_sx converter). Produces the same HTML structure as lexical_renderer.py.
+;;
+;; ~rich-text: the host-local dep these cards need (raw HTML injection). Defined here
+;; (it was only a test fixture before) so kg-html/kg-bookmark/etc. resolve in the host.
+(defcomp ~rich-text (&key (html :as string)) (raw! html))
+
+;; @css kg-card kg-image-card kg-width-wide kg-width-full kg-gallery-card kg-gallery-container kg-gallery-row kg-gallery-image kg-embed-card kg-bookmark-card kg-bookmark-container kg-bookmark-content kg-bookmark-title kg-bookmark-description kg-bookmark-metadata kg-bookmark-icon kg-bookmark-author kg-bookmark-publisher kg-bookmark-thumbnail kg-callout-card kg-callout-emoji kg-callout-text kg-button-card kg-btn kg-btn-accent kg-toggle-card kg-toggle-heading kg-toggle-heading-text kg-toggle-card-icon kg-toggle-content kg-audio-card kg-audio-thumbnail kg-audio-player-container kg-audio-title kg-audio-player kg-audio-play-icon kg-audio-current-time kg-audio-time kg-audio-seek-slider kg-audio-playback-rate kg-audio-unmute-icon kg-audio-volume-slider kg-video-card kg-video-container kg-file-card kg-file-card-container kg-file-card-contents kg-file-card-title kg-file-card-filesize kg-file-card-icon kg-file-card-caption kg-align-center kg-align-left kg-callout-card-grey kg-callout-card-white kg-callout-card-blue kg-callout-card-green kg-callout-card-yellow kg-callout-card-red kg-callout-card-pink kg-callout-card-purple kg-callout-card-accent kg-html-card kg-md-card placeholder
+
+;; ---------------------------------------------------------------------------
+;; Image card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-image (&key (src :as string) (alt :as string?) (caption :as string?) (width :as string?) (href :as string?))
+  (figure :class (str "kg-card kg-image-card"
+                   (if (= width "wide") " kg-width-wide"
+                     (if (= width "full") " kg-width-full" "")))
+    (if href
+      (a :href href (img :src src :alt (or alt "") :loading "lazy"))
+      (img :src src :alt (or alt "") :loading "lazy"))
+    (when caption (figcaption caption))))
+
+;; ---------------------------------------------------------------------------
+;; Gallery card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-gallery (&key (images :as list) (caption :as string?))
+  (figure :class "kg-card kg-gallery-card kg-width-wide"
+    (div :class "kg-gallery-container"
+      (map (lambda (row)
+        (div :class "kg-gallery-row"
+          (map (lambda (img-data)
+            (figure :class "kg-gallery-image"
+              (img :src (get img-data "src") :alt (or (get img-data "alt") "") :loading "lazy")
+              (when (get img-data "caption") (figcaption (get img-data "caption")))))
+            row)))
+        images))
+    (when caption (figcaption caption))))
+
+;; ---------------------------------------------------------------------------
+;; HTML card — wraps user-pasted HTML so the editor can identify the block.
+;; Content is native sx children (no longer an opaque HTML string).
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-html (&rest children)
+  (div :class "kg-card kg-html-card" children))
+
+;; ---------------------------------------------------------------------------
+;; Markdown card — rendered markdown content, editor can identify the block.
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-md (&rest children)
+  (div :class "kg-card kg-md-card" children))
+
+;; ---------------------------------------------------------------------------
+;; Embed card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-embed (&key (html :as string) (caption :as string?))
+  (figure :class "kg-card kg-embed-card"
+    (~rich-text :html html)
+    (when caption (figcaption caption))))
+
+;; ---------------------------------------------------------------------------
+;; Bookmark card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-bookmark (&key (url :as string) (title :as string?) (description :as string?) (icon :as string?) (author :as string?) (publisher :as string?) (thumbnail :as string?) (caption :as string?))
+  (figure :class "kg-card kg-bookmark-card"
+    (a :class "kg-bookmark-container" :href url
+      (div :class "kg-bookmark-content"
+        (div :class "kg-bookmark-title" (or title ""))
+        (div :class "kg-bookmark-description" (or description ""))
+        (when (or icon author publisher)
+          (span :class "kg-bookmark-metadata"
+            (when icon (img :class "kg-bookmark-icon" :src icon :alt ""))
+            (when author (span :class "kg-bookmark-author" author))
+            (when publisher (span :class "kg-bookmark-publisher" publisher)))))
+      (when thumbnail
+        (div :class "kg-bookmark-thumbnail"
+          (img :src thumbnail :alt ""))))
+    (when caption (figcaption caption))))
+
+;; ---------------------------------------------------------------------------
+;; Callout card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-callout (&key (color :as string?) (emoji :as string?) (content :as string?))
+  (div :class (str "kg-card kg-callout-card kg-callout-card-" (or color "grey"))
+    (when emoji (div :class "kg-callout-emoji" emoji))
+    (div :class "kg-callout-text" (or content ""))))
+
+;; ---------------------------------------------------------------------------
+;; Button card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-button (&key (url :as string) (text :as string?) (alignment :as string?))
+  (div :class (str "kg-card kg-button-card kg-align-" (or alignment "center"))
+    (a :href url :class "kg-btn kg-btn-accent" (or text ""))))
+
+;; ---------------------------------------------------------------------------
+;; Toggle card (accordion)
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-toggle (&key (heading :as string?) (content :as string?))
+  (div :class "kg-card kg-toggle-card" :data-kg-toggle-state "close"
+    (div :class "kg-toggle-heading"
+      (h4 :class "kg-toggle-heading-text" (or heading ""))
+      (button :class "kg-toggle-card-icon"
+        (~rich-text :html "<svg viewBox=\"0 0 14 14\"><path d=\"M7 0a.5.5 0 0 1 .5.5v6h6a.5.5 0 1 1 0 1h-6v6a.5.5 0 1 1-1 0v-6h-6a.5.5 0 0 1 0-1h6v-6A.5.5 0 0 1 7 0Z\" fill=\"currentColor\"/></svg>")))
+    (div :class "kg-toggle-content" (or content ""))))
+
+;; ---------------------------------------------------------------------------
+;; Audio card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-audio (&key (src :as string) (title :as string?) (duration :as string?) (thumbnail :as string?))
+  (div :class "kg-card kg-audio-card"
+    (if thumbnail
+      (img :src thumbnail :alt "audio-thumbnail" :class "kg-audio-thumbnail")
+      (div :class "kg-audio-thumbnail placeholder"
+        (~rich-text :html "<svg viewBox=\"0 0 24 24\"><path d=\"M2 12C2 6.48 6.48 2 12 2s10 4.48 10 10-4.48 10-10 10S2 17.52 2 12zm7.5 5.25L16 12 9.5 6.75v10.5z\" fill=\"currentColor\"/></svg>")))
+    (div :class "kg-audio-player-container"
+      (div :class "kg-audio-title" (or title ""))
+      (div :class "kg-audio-player"
+        (button :class "kg-audio-play-icon"
+          (~rich-text :html "<svg viewBox=\"0 0 24 24\"><path d=\"M8 5v14l11-7z\" fill=\"currentColor\"/></svg>"))
+        (div :class "kg-audio-current-time" "0:00")
+        (div :class "kg-audio-time" (str "/ " (or duration "0:00")))
+        (input :type "range" :class "kg-audio-seek-slider" :max "100" :value "0")
+        (button :class "kg-audio-playback-rate" "1×")
+        (button :class "kg-audio-unmute-icon"
+          (~rich-text :html "<svg viewBox=\"0 0 24 24\"><path d=\"M3 9v6h4l5 5V4L7 9H3zm13.5 3c0-1.77-1.02-3.29-2.5-4.03v8.05c1.48-.73 2.5-2.25 2.5-4.02zM14 3.23v2.06c2.89.86 5 3.54 5 6.71s-2.11 5.85-5 6.71v2.06c4.01-.91 7-4.49 7-8.77s-2.99-7.86-7-8.77z\" fill=\"currentColor\"/></svg>"))
+        (input :type "range" :class "kg-audio-volume-slider" :max "100" :value "100")))
+    (audio :src src :preload "metadata")))
+
+;; ---------------------------------------------------------------------------
+;; Video card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-video (&key (src :as string) (caption :as string?) (width :as string?) (thumbnail :as string?) (loop :as boolean?))
+  (figure :class (str "kg-card kg-video-card"
+                   (if (= width "wide") " kg-width-wide"
+                     (if (= width "full") " kg-width-full" "")))
+    (div :class "kg-video-container"
+      (video :src src :controls true :preload "metadata"
+        :poster (or thumbnail nil) :loop (or loop nil)))
+    (when caption (figcaption caption))))
+
+;; ---------------------------------------------------------------------------
+;; File card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-file (&key (src :as string) (filename :as string?) (title :as string?) (filesize :as string?) (caption :as string?))
+  (div :class "kg-card kg-file-card"
+    (a :class "kg-file-card-container" :href src :download (or filename "")
+      (div :class "kg-file-card-contents"
+        (div :class "kg-file-card-title" (or title filename ""))
+        (when filesize (div :class "kg-file-card-filesize" filesize)))
+      (div :class "kg-file-card-icon"
+        (~rich-text :html "<svg viewBox=\"0 0 24 24\"><path d=\"M19 9h-4V3H9v6H5l7 7 7-7zM5 18v2h14v-2H5z\" fill=\"currentColor\"/></svg>")))
+    (when caption (div :class "kg-file-card-caption" caption))))
+
+;; ---------------------------------------------------------------------------
+;; Paywall marker
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-paywall ()
+  (~rich-text :html "<!--members-only-->"))

lib/host/sx/relate-picker.sx

@@ -0,0 +1,39 @@
+;; lib/host/sx/relate-picker.sx — the relate picker as a reusable, content-addressed
+;; SX component. On a FULL load render-page expands it server-side (SEO / no-JS); on a
+;; boosted SPA nav the edit body is serialized as `(~relate-picker :slug … :kind …)`
+;; and the CLIENT expands it — the component module is loaded content-addressed via
+;; the data-sx-manifest at boot, so its defcomp is registered before any fragment
+;; referencing it arrives.
+;;
+;; Pure markup, no client JS: the form GETs /<slug>/relate-options serialising kind +
+;; the filter q (a FORM is serialised on GET, a bare input is not), innerHTML-swapping
+;; the results <ul> on "load" and on a debounced "input". Paging is server-driven —
+;; each full page carries a "load more" sentinel (sx-trigger revealed) the endpoint
+;; emits. sx-retry makes a dropped/offline fetch self-heal; the engine's .sx-error
+;; class (styled by the host shell) surfaces a stuck retry. The engine re-binds these
+;; triggers on swapped-in content, so it works on full load AND boosted nav.
+(defcomp
+  ~relate-picker
+  (&key slug kind)
+  (form
+    :class "relate-picker"
+    :data-slug slug
+    :data-kind kind
+    :sx-get (str "/" slug "/relate-options")
+    :sx-trigger "input delay:200ms, load"
+    :sx-target (str "#rp-" kind "-results")
+    :sx-swap "innerHTML"
+    :sx-retry "exponential:1000:30000"
+    :style "margin:0"
+    (input :type "hidden" :name "kind" :value kind)
+    (input
+      :type "text"
+      :name "q"
+      :class "rp-filter"
+      :placeholder "filter…"
+      :autocomplete "off"
+      :style "width:100%;padding:0.4em;box-sizing:border-box")
+    (ul
+      :id (str "rp-" kind "-results")
+      :class "rp-results"
+      :style "list-style:none;padding:0;margin:0.5em 0;border:1px solid #ddd")))

lib/host/sxtp.sx

@@ -0,0 +1,224 @@
+;; lib/host/sxtp.sx — SXTP, the host<->subsystem wire format. SXTP messages are
+;; SX s-expressions (content-type text/sx): a request/response/condition/event is
+;; a tagged list `(request :verb navigate :path "/x" ...)`. See the protocol spec
+;; at applications/sxtp/spec.sx.
+;;
+;; Representation: internally a message is a plain dict tagged by :msg ("request"
+;; /"response"/"condition"/"event"/"patch"/"signals"), with string keys so the
+;; keyword==string rule makes construction and access trivial. verb/status/type/
+;; mode are stored as SYMBOLS (they ride the wire bare, not quoted). The wire
+;; LIST form is produced/consumed only at the serialise/parse boundary:
+;;   sxtp/serialize : msg-dict -> text/sx string
+;;   sxtp/parse     : text/sx string -> msg-dict
+;; A Dream HTTP request/response bridges to/from SXTP via sxtp/from-dream and
+;; sxtp/to-dream, so the host can speak SXTP to subsystems while serving HTTP.
+;; Depends on lib/dream/types.sx (dream-response + request/response accessors).
+
+;; ── helpers ────────────────────────────────────────────────────────
+(define sxtp/-sym
+  (fn (x) (if (= (type-of x) "symbol") x (string->symbol x))))
+(define sxtp/-name
+  (fn (x) (if (= (type-of x) "symbol") (symbol->string x) x)))
+
+;; ── constructors ───────────────────────────────────────────────────
+;; opts is a dict of optional fields (e.g. {:headers .. :params .. :body ..}).
+(define sxtp/request
+  (fn (verb path opts)
+    (merge {:msg "request" :verb (sxtp/-sym verb) :path path} opts)))
+(define sxtp/response
+  (fn (status opts)
+    (merge {:msg "response" :status (sxtp/-sym status)} opts)))
+(define sxtp/condition
+  (fn (ctype opts)
+    (merge {:msg "condition" :type (sxtp/-sym ctype)} opts)))
+(define sxtp/event
+  (fn (etype opts)
+    (merge {:msg "event" :type (sxtp/-sym etype)} opts)))
+
+;; Patch (Datastar-borrowed) — DOM fragment morph.
+;; target: CSS selector (required). mode in opts defaults to outer; accepts
+;; string OR symbol and is normalised. mode values: outer | inner | replace |
+;; prepend | append | before | after | remove. body: SX subtree (omit for remove).
+(define sxtp/patch
+  (fn (target opts)
+    (let ((mode (or (get opts :mode) "outer")))
+      (merge opts {:msg "patch" :target target :mode (sxtp/-sym mode)}))))
+
+;; Signals (Datastar-borrowed) — reactive state patch.
+;; values: dict of signal-name -> new-value (nil removes). only-if-missing: bool.
+(define sxtp/signals
+  (fn (values opts)
+    (merge {:msg "signals" :values values} opts)))
+
+;; ── predicates ─────────────────────────────────────────────────────
+(define sxtp/-is?
+  (fn (m tag) (and (= (type-of m) "dict") (= (get m :msg) tag))))
+(define sxtp/request? (fn (m) (sxtp/-is? m "request")))
+(define sxtp/response? (fn (m) (sxtp/-is? m "response")))
+(define sxtp/condition? (fn (m) (sxtp/-is? m "condition")))
+(define sxtp/event? (fn (m) (sxtp/-is? m "event")))
+(define sxtp/patch? (fn (m) (sxtp/-is? m "patch")))
+(define sxtp/signals? (fn (m) (sxtp/-is? m "signals")))
+
+;; ── accessors ──────────────────────────────────────────────────────
+(define sxtp/verb (fn (m) (get m :verb)))
+(define sxtp/path (fn (m) (get m :path)))
+(define sxtp/req-headers (fn (m) (get m :headers)))
+(define sxtp/params (fn (m) (get m :params)))
+(define sxtp/param (fn (m name) (get (get m :params) name)))
+(define sxtp/body (fn (m) (get m :body)))
+(define sxtp/capabilities (fn (m) (get m :capabilities)))
+(define sxtp/status (fn (m) (get m :status)))
+(define sxtp/resp-headers (fn (m) (get m :headers)))
+(define sxtp/stream? (fn (m) (= (get m :stream) true)))
+(define sxtp/cond-type (fn (m) (get m :type)))
+(define sxtp/cond-message (fn (m) (get m :message)))
+(define sxtp/target (fn (m) (get m :target)))
+(define sxtp/mode (fn (m) (get m :mode)))
+(define sxtp/values (fn (m) (get m :values)))
+(define sxtp/only-if-missing? (fn (m) (= (get m :only-if-missing) true)))
+(define sxtp/transition? (fn (m) (= (get m :transition) true)))
+
+;; ── status helpers (build responses) ───────────────────────────────
+(define sxtp/ok (fn (body) (sxtp/response "ok" {:body body})))
+(define sxtp/created (fn (body) (sxtp/response "created" {:body body})))
+(define sxtp/no-content (fn () (sxtp/response "no-content" {})))
+(define sxtp/not-found
+  (fn (path message)
+    (sxtp/response "not-found"
+      {:body (sxtp/condition "resource-not-found"
+               {:path path :message message :retry false})})))
+(define sxtp/forbidden
+  (fn (message)
+    (sxtp/response "forbidden"
+      {:body (sxtp/condition "forbidden" {:message message})})))
+(define sxtp/invalid
+  (fn (message)
+    (sxtp/response "invalid"
+      {:body (sxtp/condition "invalid" {:message message})})))
+(define sxtp/fail
+  (fn (message)
+    (sxtp/response "error"
+      {:body (sxtp/condition "error" {:message message})})))
+
+;; ── HTTP <-> SXTP mappings ─────────────────────────────────────────
+(define sxtp/-method-verbs
+  {:GET "fetch" :HEAD "fetch" :POST "create"
+   :PUT "mutate" :PATCH "mutate" :DELETE "delete" :OPTIONS "inspect"})
+(define sxtp/verb-for-method
+  (fn (method) (sxtp/-sym (get sxtp/-method-verbs (upper method) "fetch"))))
+
+(define sxtp/-status-http
+  {:ok 200 :created 201 :accepted 202 :no-content 204 :redirect 302
+   :not-modified 304 :error 500 :not-found 404 :forbidden 403
+   :invalid 400 :conflict 409 :unavailable 503})
+(define sxtp/http-status
+  (fn (status) (get sxtp/-status-http (sxtp/-name status) 200)))
+
+;; ── Dream bridge ───────────────────────────────────────────────────
+;; HTTP request -> SXTP request: method->verb, query->params, headers/body carry.
+(define sxtp/from-dream
+  (fn (req)
+    (sxtp/request
+      (sxtp/verb-for-method (get req :method))
+      (get req :path)
+      {:headers (get req :headers)
+       :params (get req :query)
+       :body (get req :body)})))
+
+;; SXTP response -> HTTP response: status->code, body serialised to text/sx.
+(define sxtp/-body-text
+  (fn (b) (if (nil? b) "" (serialize b))))
+(define sxtp/to-dream
+  (fn (resp)
+    (dream-response
+      (sxtp/http-status (sxtp/status resp))
+      (merge {:content-type "text/sx"} (or (sxtp/resp-headers resp) {}))
+      (sxtp/-body-text (sxtp/body resp)))))
+
+;; ── wire serialise (msg-dict -> text/sx) ───────────────────────────
+;; Top-level field order is fixed per message type so output is deterministic;
+;; nested dict/value order follows the serialize primitive.
+(define sxtp/-field-order
+  {:request (list :verb :path :headers :cookies :params :capabilities :body)
+   :response (list :status :headers :set-cookie :body :stream)
+   :condition (list :type :message :path :retry :detail)
+   :event (list :type :id :body :time)
+   :patch (list :target :mode :body :transition)
+   :signals (list :values :only-if-missing)})
+;; A nested SXTP message (a condition/event in a :body) serialises in its own
+;; list form; plain data values go through the serialize primitive.
+(define sxtp/-emit-value
+  (fn (v)
+    (if (and (= (type-of v) "dict") (has-key? v :msg))
+      (sxtp/serialize v)
+      (serialize v))))
+(define sxtp/serialize
+  (fn (msg)
+    (let ((head (get msg :msg)))
+      (let ((order (get sxtp/-field-order head)))
+        (str "("
+          head
+          (reduce
+            (fn (acc k)
+              (if (has-key? msg k)
+                (str acc " :" k " " (sxtp/-emit-value (get msg k)))
+                acc))
+            ""
+            order)
+          ")")))))
+
+;; ── wire parse (text/sx -> msg-dict) ───────────────────────────────
+;; parse yields a list with keyword-token keys and possibly keyword-token dict
+;; keys; sxtp/-normalize deep-converts those tokens to strings so the result is
+;; the same string-keyed shape the constructors produce.
+(define sxtp/-normalize
+  (fn (v)
+    (let ((t (type-of v)))
+      (cond
+        ((= t "keyword") (str v))
+        ((= t "dict")
+          (reduce
+            (fn (acc k) (assoc acc (str k) (sxtp/-normalize (get v k))))
+            {}
+            (keys v)))
+        ((= t "list") (map sxtp/-normalize v))
+        (true v)))))
+(define sxtp/-pairs->dict
+  (fn (kvs acc)
+    (if (< (len kvs) 2)
+      acc
+      (sxtp/-pairs->dict
+        (rest (rest kvs))
+        (assoc acc (str (first kvs)) (sxtp/-normalize (first (rest kvs))))))))
+(define sxtp/parse
+  (fn (text)
+    (let ((lst (parse text)))
+      (sxtp/-pairs->dict (rest lst) {:msg (symbol->string (first lst))}))))
+
+;; ── host write-body: a request's text/sx body -> string-keyed dict ──
+;; The write-side counterpart to host/sx-status: the SX engine posts text/sx for
+;; writes (boosted forms serialise their fields), so write handlers read the body
+;; through this instead of dream-json-body. parse-safe yields keyword-token keys;
+;; sxtp/-normalize deep-converts them to strings so (get p :field) works — the same
+;; shape dream-json-body produced from JSON. Empty / blank / non-dict / unparseable
+;; body -> nil (handlers then return 400).
+(define host/sx-body
+  (fn (req)
+    (let ((raw (dream-body req)))
+      (if (or (nil? raw) (= raw ""))
+        nil
+        (let ((v (parse-safe raw)))
+          (if (= (type-of v) "dict") (sxtp/-normalize v) nil))))))
+
+;; ── unified write-field reader: text/sx body OR urlencoded form ─────
+;; A boosted form posts text/sx (the SX engine serialises its fields); a no-engine
+;; / pre-hydration submit (and the login bootstrap) posts urlencoded. Content-type
+;; decides. host/fields returns ALL fields as one string-keyed dict; host/field
+;; reads one by name. Form handlers read through these so both encodings work.
+(define host/fields
+  (fn (req)
+    (if (contains? (or (dream-content-type-of req) "") "text/sx")
+      (or (host/sx-body req) {})
+      (or (dream-form-fields req) {}))))
+(define host/field (fn (req name) (get (host/fields req) name)))

lib/host/tests/compose.sx

@@ -0,0 +1,93 @@
+;; lib/host/tests/compose.sx — the composition CORE + render-fold (lib/host/compose.sx).
+;; Tests host/comp-fold's shared dispatch (seq/alt/each + when + each-source + recursion +
+;; depth guard) through the RENDER domain (render → HTML). The execute domain is tested in
+;; tests/execute.sx; together they show one core, two folds (plans/composition-objects.md).
+
+(define host-cp-pass 0)
+(define host-cp-fail 0)
+(define host-cp-fails (list))
+(define host-cp-test
+  (fn (name actual expected)
+    (if (= actual expected)
+      (set! host-cp-pass (+ host-cp-pass 1))
+      (begin
+        (set! host-cp-fail (+ host-cp-fail 1))
+        (append! host-cp-fails {:name name :actual actual :expected expected})))))
+
+;; -- leaves --
+(host-cp-test "text leaf passes markup through"
+  (host/comp-render (quote (text "<p>hi</p>")) {}) "<p>hi</p>")
+(host-cp-test "field wraps the value in a span; reads the context"
+  (host/comp-render (quote (field :title)) {"title" "Hello"}) "<span>Hello</span>")
+(host-cp-test "val is the raw value (no markup) — for attributes"
+  (host/comp-render (quote (val :slug)) {"slug" "p1"}) "p1")
+(host-cp-test "a missing field renders empty, not an error"
+  (host/comp-render (quote (field :nope)) {}) "<span></span>")
+
+;; -- seq: render all in order --
+(host-cp-test "seq renders children in order"
+  (host/comp-render (quote (seq (text "a") (text "b") (text "c"))) {}) "abc")
+
+;; -- row/grid: layout combinators wrap + recurse via the core --
+(host-cp-test "row wraps its children in a flex div"
+  (host/comp-render (quote (row (text "A") (text "B"))) {})
+  "<div class=\"row\" style=\"display:flex;gap:1em\">AB</div>")
+
+;; -- alt + when: render the first branch whose predicate holds --
+(host-cp-test "alt renders the when-branch when the predicate holds"
+  (host/comp-render (quote (alt (when (has "auth") (text "in")) (else (text "out")))) {"auth" "y"}) "in")
+(host-cp-test "alt falls through to else"
+  (host/comp-render (quote (alt (when (has "auth") (text "in")) (else (text "out")))) {}) "out")
+(host-cp-test "alt eq predicate matches a context value"
+  (host/comp-render (quote (alt (when (eq "t" "dark") (text "D")) (else (text "L")))) {"t" "dark"}) "D")
+(host-cp-test "alt not predicate negates"
+  (host/comp-render (quote (alt (when (not (has "auth")) (text "anon")) (else (text "user")))) {}) "anon")
+
+;; -- each: iterate a source, binding :item, with field resolution --
+(host-cp-test "each renders the template per item (items source)"
+  (host/comp-render (quote (each (items {:n "x"} {:n "y"}) (seq (text "<li>") (field :n) (text "</li>")))) {})
+  "<li><span>x</span></li><li><span>y</span></li>")
+(host-cp-test "each over an empty source renders empty"
+  (host/comp-render (quote (each (items) (field :n))) {}) "")
+(host-cp-test "each query source delegates to the context resolver"
+  (host/comp-render (quote (each (query is-a t) (field :title)))
+    {"query" (fn (qargs ctx) (list {:title "One"} {:title "Two"}))})
+  "<span>One</span><span>Two</span>")
+
+;; -- recursion via named templates + a depth guard --
+(host/comp--def-tmpl! "node"
+  (quote (seq (field :name) (each (children) (tmpl "node")))))
+(host-cp-test "tmpl recurses over a (children) tree until the source runs dry"
+  (host/comp-render (quote (tmpl "node"))
+    {"item" {:name "root" :children (list {:name "a" :children (list)} {:name "b" :children (list)})}})
+  "<span>root</span><span>a</span><span>b</span>")
+
+;; -- ref: transclude via the context resolver --
+(host-cp-test "ref transcludes via the context resolver"
+  (host/comp-render (quote (ref "c1")) {"ref" (fn (id ctx) (str "<card:" id ">"))}) "<card:c1>")
+(host-cp-test "ref with no resolver renders empty"
+  (host/comp-render (quote (ref "c1")) {}) "")
+
+;; -- the unifying property: ONE object renders differently per context --
+(host-cp-test "the SAME object renders two ways by context (anon vs authed)"
+  (let ((obj (quote (alt (when (has "auth") (text "member")) (else (text "guest"))))))
+    (list (host/comp-render obj {}) (host/comp-render obj {"auth" "y"})))
+  (list "guest" "member"))
+
+;; -- a THIRD domain over the SAME core: deps (collect transcluded refs). Proves step 8 —
+;; a new domain is just a dict + leaf, reusing seq/alt/each with no new control flow. --
+(host-cp-test "deps collects the refs a seq body transcludes (the contains DAG)"
+  (host/comp-deps (quote (seq (ref "c0") (text "x") (ref "c1"))) {})
+  (list "c0" "c1"))
+(host-cp-test "deps walks each — refs inside an iterated template are collected per item"
+  (host/comp-deps (quote (each (items {} {}) (ref "card"))) {})
+  (list "card" "card"))
+(host-cp-test "deps follows alt's taken branch (context-specific transclusions)"
+  (list (host/comp-deps (quote (alt (when (has "auth") (ref "member")) (else (ref "guest")))) {"auth" "y"})
+        (host/comp-deps (quote (alt (when (has "auth") (ref "member")) (else (ref "guest")))) {}))
+  (list (list "member") (list "guest")))
+
+(define host-cp-tests-run!
+  (fn ()
+    {:total (+ host-cp-pass host-cp-fail)
+     :passed host-cp-pass :failed host-cp-fail :fails host-cp-fails}))

lib/host/tests/execute.sx

@@ -0,0 +1,87 @@
+;; lib/host/tests/execute.sx — the EXECUTE-fold (lib/host/execute.sx): a second interpreter
+;; over the SAME seq/alt/each composition algebra as the render-fold, proving the algebra is
+;; domain-agnostic (plans/composition-objects.md step 7). Leaves are effects; the fold
+;; returns an effect log. Reuses compose.sx's when-predicates / field resolver / each source.
+
+(define host-ex-pass 0)
+(define host-ex-fail 0)
+(define host-ex-fails (list))
+(define host-ex-test
+  (fn (name actual expected)
+    (if (= actual expected)
+      (set! host-ex-pass (+ host-ex-pass 1))
+      (begin
+        (set! host-ex-fail (+ host-ex-fail 1))
+        (append! host-ex-fails {:name name :actual actual :expected expected})))))
+
+;; the verbs of an effect log, in order (effect records are {:verb :args}).
+(define ex-verbs (fn (effects) (map (fn (e) (get e :verb)) effects)))
+(define ex-args  (fn (effects) (map (fn (e) (get e :args)) effects)))
+
+;; -- seq: steps in order --
+(host-ex-test "seq runs effects in order"
+  (ex-verbs (host/exec-run (quote (seq (effect a) (effect b) (effect c))) {}))
+  (list "a" "b" "c"))
+(host-ex-test "nested seq flattens in order"
+  (ex-verbs (host/exec-run (quote (seq (effect a) (seq (effect b) (effect c)) (effect d))) {}))
+  (list "a" "b" "c" "d"))
+
+;; -- alt + when: branch (reusing the render-fold's predicate set) --
+(host-ex-test "alt runs the first branch whose when holds"
+  (ex-verbs (host/exec-run (quote (alt (when (has "auth") (effect publish)) (else (effect hold)))) {"auth" "y"}))
+  (list "publish"))
+(host-ex-test "alt falls through to else when no when holds"
+  (ex-verbs (host/exec-run (quote (alt (when (has "auth") (effect publish)) (else (effect hold)))) {}))
+  (list "hold"))
+(host-ex-test "alt eq predicate branches on a context value"
+  (ex-verbs (host/exec-run (quote (alt (when (eq "role" "admin") (effect grant)) (else (effect deny)))) {"role" "admin"}))
+  (list "grant"))
+
+;; -- each: for-each over the (reused) source, with field resolution from the item --
+(host-ex-test "each runs the body per item (for-each)"
+  (ex-verbs (host/exec-run (quote (each (items {:email "a"} {:email "b"}) (effect notify))) {}))
+  (list "notify" "notify"))
+(host-ex-test "effect args resolve (field K) from the current item"
+  (ex-args (host/exec-run (quote (each (items {:email "a@x"} {:email "b@x"}) (effect notify (field :email)))) {}))
+  (list (list "a@x") (list "b@x")))
+(host-ex-test "effect args resolve (field K) from the context, and literals pass through"
+  (ex-args (host/exec-run (quote (seq (effect log (field :who) "done"))) {"who" "alice"}))
+  (list (list "alice" "done")))
+
+;; -- robustness: non-effect leaves / unknown heads produce no effects --
+(host-ex-test "a non-list node yields no effects"
+  (host/exec-run "bare" {}) (list))
+(host-ex-test "an unknown combinator head yields no effects"
+  (host/exec-run (quote (frobnicate 1 2)) {}) (list))
+
+;; -- the KEYSTONE: ONE control skeleton, folded TWO ways. Same alt+when, same context, the
+;; SAME branch is chosen (both use host/comp--pred?); render emits HTML, execute emits an
+;; effect. The composition algebra is domain-agnostic — render and behaviour are two folds. --
+(host-ex-test "same skeleton folds two ways — render picks the branch, execute picks the SAME branch (authed)"
+  (let ((ctx {"auth" "y"}))
+    (list (host/comp-render (quote (alt (when (has "auth") (text "<b>in</b>")) (else (text "out")))) ctx)
+          (ex-verbs (host/exec-run (quote (alt (when (has "auth") (effect enter)) (else (effect leave)))) ctx))))
+  (list "<b>in</b>" (list "enter")))
+(host-ex-test "same skeleton folds two ways — the else branch agrees across folds (anon)"
+  (let ((ctx {}))
+    (list (host/comp-render (quote (alt (when (has "auth") (text "<b>in</b>")) (else (text "out")))) ctx)
+          (ex-verbs (host/exec-run (quote (alt (when (has "auth") (effect enter)) (else (effect leave)))) ctx))))
+  (list "out" (list "leave")))
+
+;; -- a small workflow: validate -> (branch on status) -> notify each recipient. Proves the
+;; behaviour model is just an execute-fold over a composition object. --
+(host-ex-test "a publish workflow runs as one execute-fold over the composition"
+  (ex-verbs
+    (host/exec-run
+      (quote (seq
+               (effect validate (field :slug))
+               (alt (when (eq "status" "ready") (effect publish (field :slug)))
+                    (else (effect hold (field :slug))))
+               (each (items {:to "a"} {:to "b"}) (effect notify (field :to)))))
+      {"slug" "post-1" "status" "ready"}))
+  (list "validate" "publish" "notify" "notify"))
+
+(define host-ex-tests-run!
+  (fn ()
+    {:total (+ host-ex-pass host-ex-fail)
+     :passed host-ex-pass :failed host-ex-fail :fails host-ex-fails}))

lib/host/tests/feed.sx

@@ -0,0 +1,132 @@
+;; lib/host/tests/feed.sx — the migrated feed endpoints, GET /feed (read) and
+;; POST /feed (guarded write). Includes a golden test: the host read response
+;; body must equal the feed subsystem's own recent-first stream wrapped in the
+;; standard envelope — the endpoint adds the HTTP/JSON shell and nothing else.
+
+(define host-fd-pass 0)
+(define host-fd-fail 0)
+(define host-fd-fails (list))
+
+(define
+  host-fd-test
+  (fn
+    (name actual expected)
+    (if
+      (= actual expected)
+      (set! host-fd-pass (+ host-fd-pass 1))
+      (begin
+        (set! host-fd-fail (+ host-fd-fail 1))
+        (append! host-fd-fails {:name name :actual actual :expected expected})))))
+
+(define
+  host-fd-req
+  (fn (target) (dream-request "GET" target {} "")))
+
+(define
+  host-fd-app
+  (host/make-app (list host/feed-routes)))
+
+;; ── empty feed ─────────────────────────────────────────────────────
+(feed/reset!)
+(host-fd-test
+  "empty feed 200"
+  (dream-status (host-fd-app (host-fd-req "/feed")))
+  200)
+(host-fd-test
+  "empty feed data ()"
+  (contains? (dream-resp-body (host-fd-app (host-fd-req "/feed"))) ":data ()")
+  true)
+
+;; ── seeded feed ────────────────────────────────────────────────────
+(feed/reset!)
+(feed/post {:actor "alice" :verb "post" :object "p1" :at 1})
+(feed/post {:actor "bob" :verb "post" :object "p2" :at 2})
+(feed/post {:actor "alice" :verb "like" :object "p2" :at 3})
+
+;; recent-first: newest activity (at 3) leads, so its marker precedes the oldest.
+(host-fd-test
+  "timeline recent-first"
+  (let ((body (dream-resp-body (host-fd-app (host-fd-req "/feed")))))
+    (< (index-of body ":at 3") (index-of body ":at 1")))
+  true)
+
+;; actor filter: only alice's two activities.
+(host-fd-test
+  "actor filter count"
+  (feed/count
+    (feed/by-actor (feed/recent (feed/all)) "alice"))
+  2)
+(host-fd-test
+  "actor filter excludes bob"
+  (contains?
+    (dream-resp-body (host-fd-app (host-fd-req "/feed?actor=alice")))
+    "bob")
+  false)
+
+;; limit: cap to a single activity (the most recent).
+(host-fd-test
+  "limit caps results"
+  (contains?
+    (dream-resp-body (host-fd-app (host-fd-req "/feed?limit=1")))
+    ":at 1")
+  false)
+
+;; ── golden: endpoint = subsystem recent stream + envelope ───────────
+(host-fd-test
+  "golden full timeline"
+  (dream-resp-body (host-fd-app (host-fd-req "/feed")))
+  (serialize {:ok true :data (feed/items (feed/recent (feed/all)))}))
+(host-fd-test
+  "golden actor-filtered"
+  (dream-resp-body (host-fd-app (host-fd-req "/feed?actor=alice")))
+  (serialize {:ok true :data (feed/items (feed/by-actor (feed/recent (feed/all)) "alice"))}))
+
+;; ── write: POST /feed (auth + ACL + action) ────────────────────────
+(acl/load! (list (acl-grant "alice" "post" "feed")))
+(define host-fd-resolve (fn (tok) (if (= tok "good") "alice" nil)))
+(define
+  host-fd-wapp
+  (host/make-app
+    (list host/feed-routes (host/feed-write-routes host-fd-resolve))))
+(define
+  host-fd-post
+  (fn (auth body)
+    (dream-request "POST" "/feed" (if auth {:authorization auth} {}) body)))
+
+(feed/reset!)
+(host-fd-test
+  "post no auth -> 401"
+  (dream-status (host-fd-wapp (host-fd-post nil "{}")))
+  401)
+(host-fd-test
+  "post unchanged feed after 401"
+  (feed/size)
+  0)
+(host-fd-test
+  "post authed+permitted -> 201"
+  (dream-status
+    (host-fd-wapp
+      (host-fd-post
+        "Bearer good"
+        "{:actor \"alice\" :verb \"post\" :object \"p9\" :at 9}")))
+  201)
+(host-fd-test "post grew feed" (feed/size) 1)
+(host-fd-test
+  "created activity visible in timeline"
+  (contains?
+    (dream-resp-body (host-fd-wapp (host-fd-req "/feed")))
+    "p9")
+  true)
+(host-fd-test
+  "post non-object body -> 400"
+  (dream-status (host-fd-wapp (host-fd-post "Bearer good" "(1 2)")))
+  400)
+
+(define
+  host-fd-tests-run!
+  (fn
+    ()
+    {:total (+ host-fd-pass host-fd-fail)
+     :passed host-fd-pass
+     :failed host-fd-fail
+     :fails host-fd-fails}))

lib/host/tests/handler.sx

@@ -0,0 +1,86 @@
+;; lib/host/tests/handler.sx — host JSON envelope + request-reading helpers.
+
+(define host-hd-pass 0)
+(define host-hd-fail 0)
+(define host-hd-fails (list))
+
+(define
+  host-hd-test
+  (fn
+    (name actual expected)
+    (if
+      (= actual expected)
+      (set! host-hd-pass (+ host-hd-pass 1))
+      (begin
+        (set! host-hd-fail (+ host-hd-fail 1))
+        (append! host-hd-fails {:name name :actual actual :expected expected})))))
+
+;; ── host/ok ────────────────────────────────────────────────────────
+(host-hd-test "ok status 200" (dream-status (host/ok "x")) 200)
+(host-hd-test
+  "ok content-type sx"
+  (dream-resp-header (host/ok "x") "content-type")
+  "text/sx; charset=utf-8")
+(host-hd-test
+  "ok envelope ok:true"
+  (contains? (dream-resp-body (host/ok "x")) ":ok true")
+  true)
+(host-hd-test
+  "ok envelope carries data"
+  (contains? (dream-resp-body (host/ok "hi")) ":data \"hi\"")
+  true)
+
+;; ── host/ok-status ─────────────────────────────────────────────────
+(host-hd-test "ok-status custom" (dream-status (host/ok-status 201 "y")) 201)
+(host-hd-test
+  "ok-status data"
+  (contains? (dream-resp-body (host/ok-status 201 "y")) ":data \"y\"")
+  true)
+
+;; ── host/error ─────────────────────────────────────────────────────
+(host-hd-test "error status" (dream-status (host/error 404 "nope")) 404)
+(host-hd-test
+  "error ok:false"
+  (contains? (dream-resp-body (host/error 404 "nope")) ":ok false")
+  true)
+(host-hd-test
+  "error message"
+  (contains? (dream-resp-body (host/error 404 "nope")) ":error \"nope\"")
+  true)
+(host-hd-test
+  "error content-type sx"
+  (dream-resp-header (host/error 500 "boom") "content-type")
+  "text/sx; charset=utf-8")
+
+;; ── host/sx-status ─────────────────────────────────────────────────
+(host-hd-test
+  "sx-status arbitrary status"
+  (dream-status (host/sx-status 418 {:a 1}))
+  418)
+(host-hd-test
+  "sx-status serializes body"
+  (contains? (dream-resp-body (host/sx-status 200 {:a 1})) ":a 1")
+  true)
+
+;; ── host/query-int ─────────────────────────────────────────────────
+(define
+  host-hd-req
+  (fn (target) (dream-request "GET" target {} "")))
+
+(host-hd-test
+  "query-int present"
+  (host/query-int (host-hd-req "/x?limit=5") "limit" 10)
+  5)
+(host-hd-test
+  "query-int absent -> fallback"
+  (host/query-int (host-hd-req "/x") "limit" 10)
+  10)
+
+(define
+  host-hd-tests-run!
+  (fn
+    ()
+    {:total (+ host-hd-pass host-hd-fail)
+     :passed host-hd-pass
+     :failed host-hd-fail
+     :fails host-hd-fails}))

lib/host/tests/htmlsx.sx

@@ -0,0 +1,63 @@
+;; lib/host/tests/htmlsx.sx — the pure-SX HTML → SX converter (host/html->sx). Covers text,
+;; entities, void/nested tags, attributes, figure/iframe, and an end-to-end import round-trip.
+
+(define host-ht-pass 0)
+(define host-ht-fail 0)
+(define host-ht-fails (list))
+(define host-ht-test
+  (fn (name actual expected)
+    (if (= actual expected)
+      (set! host-ht-pass (+ host-ht-pass 1))
+      (begin
+        (set! host-ht-fail (+ host-ht-fail 1))
+        (append! host-ht-fails {:name name :actual actual :expected expected})))))
+
+;; a paragraph with inline formatting — kept nested (decompose flattens to text later).
+(host-ht-test "a <p> with inline <strong> parses to (p \"…\" (strong \"…\") \"…\")"
+  (str (host/html->sx "<p>Hello <strong>world</strong> now</p>"))
+  "(article (p \"Hello \" (strong \"world\") \" now\"))")
+;; HTML entities decode to UTF-8 (not \\uXXXX).
+(host-ht-test "entities decode (&amp; &pound; &#x2019;)"
+  (str (host/html->sx "<p>Tom &amp; Jerry cost &pound;5 &#x2019;n up</p>"))
+  "(article (p \"Tom & Jerry cost £5 ’n up\"))")
+;; a void <img> keeps its attributes as keyword attrs.
+(host-ht-test "a void <img> keeps :src/:alt attrs"
+  (str (host/html->sx "<img src=\"a.jpg\" alt=\"a photo\">"))
+  "(article (img :alt \"a photo\" :src \"a.jpg\"))")
+;; a <figure> with an <img> + <figcaption> nests correctly.
+(host-ht-test "a <figure> nests an <img> and a <figcaption>"
+  (str (host/html->sx "<figure><img src=\"y.jpg\" alt=\"y\"><figcaption>a caption</figcaption></figure>"))
+  "(article (figure (img :alt \"y\" :src \"y.jpg\") (figcaption \"a caption\")))")
+;; an <iframe> is a void-ish embed (self-contained token).
+(host-ht-test "an <iframe> becomes a leaf with its :src"
+  (str (host/html->sx "<iframe src=\"https://youtube.com/embed/x\"></iframe>"))
+  "(article (iframe :src \"https://youtube.com/embed/x\"))")
+;; comments + doctype are skipped; whitespace-only text is dropped.
+(host-ht-test "comments/doctype are skipped, blank text dropped"
+  (str (host/html->sx "<!-- hi --> <p>x</p>\n  <p>y</p>"))
+  "(article (p \"x\") (p \"y\"))")
+;; headings map through (decompose then turns h2 into card-heading).
+(host-ht-test "headings + paragraphs come through in order"
+  (str (host/html->sx "<h2>Title</h2><p>body</p>"))
+  "(article (h2 \"Title\") (p \"body\"))")
+
+;; ── END TO END: HTML → SX → decompose → typed card objects ──────────
+(host/blog-use-store! (persist/open))
+(host/blog-seed-types!)
+(host-ht-test "html->sx feeds decompose: a real snippet becomes typed cards"
+  (begin
+    (host/blog-put! "htdoc" "HT" "(p)" "published")
+    (host/blog--decompose! "htdoc"
+      (host/html->sx "<h2>Heading</h2><p>Some <strong>bold</strong> text.</p><figure><img src=\"p.jpg\" alt=\"a\"><figcaption>cap</figcaption></figure><iframe src=\"https://youtube.com/embed/z\"></iframe>"))
+    (list (host/blog-is-a? "htdoc__body__b0" "card-heading")
+          (host/blog-is-a? "htdoc__body__b1" "card-text")
+          (get (host/blog-field-values-of "htdoc__body__b1") "text")   ;; strong flattened to text
+          (host/blog-is-a? "htdoc__body__b2" "card-image")
+          (get (host/blog-field-values-of "htdoc__body__b2") "caption")
+          (host/blog-is-a? "htdoc__body__b3" "card-embed")))
+  (list true true "Some bold text." true "cap" true))
+
+(define host-ht-tests-run!
+  (fn ()
+    {:total (+ host-ht-pass host-ht-fail)
+     :passed host-ht-pass :failed host-ht-fail :fails host-ht-fails}))

lib/host/tests/ledger.sx

@@ -0,0 +1,106 @@
+;; lib/host/tests/ledger.sx — the strangler migration ledger: entry shape,
+;; status/domain queries, find, distinct domains, and coverage maths.
+
+(define host-lg-pass 0)
+(define host-lg-fail 0)
+(define host-lg-fails (list))
+
+(define
+  host-lg-test
+  (fn
+    (name actual expected)
+    (if
+      (= actual expected)
+      (set! host-lg-pass (+ host-lg-pass 1))
+      (begin
+        (set! host-lg-fail (+ host-lg-fail 1))
+        (append! host-lg-fails {:name name :actual actual :expected expected})))))
+
+;; ── entry constructor ───────────────────────────────────────────────
+(define host-lg-e (host/ledger-entry "feed" "GET" "/feed" "feed:timeline" "migrated" "host/feed-timeline"))
+(host-lg-test "entry domain" (get host-lg-e :domain) "feed")
+(host-lg-test "entry path" (get host-lg-e :path) "/feed")
+(host-lg-test "entry status" (get host-lg-e :status) "migrated")
+(host-lg-test "entry handler" (get host-lg-e :handler) "host/feed-timeline")
+
+;; ── find ────────────────────────────────────────────────────────────
+(host-lg-test
+  "find GET /feed -> migrated"
+  (get (host/ledger-find host/ledger "GET" "/feed") :status)
+  "migrated")
+(host-lg-test
+  "find GET /feed -> handler"
+  (get (host/ledger-find host/ledger "GET" "/feed") :handler)
+  "host/feed-timeline")
+(host-lg-test
+  "find POST /feed -> create"
+  (get (host/ledger-find host/ledger "POST" "/feed") :handler)
+  "host/feed-create")
+(host-lg-test "find missing -> nil" (host/ledger-find host/ledger "GET" "/nope") nil)
+(host-lg-test
+  "find migrated relations read -> handler"
+  (get (host/ledger-find host/ledger "GET" "/internal/data/get-children") :handler)
+  "host/relations-children")
+(host-lg-test
+  "find migrated relations write -> handler"
+  (get (host/ledger-find host/ledger "POST" "/internal/actions/attach-child") :handler)
+  "host/relations-attach")
+(host-lg-test
+  "typed relate still proxied"
+  (get (host/ledger-find host/ledger "POST" "/internal/actions/relate") :status)
+  "proxied")
+
+(host-lg-test
+  "find migrated blog post -> handler"
+  (get (host/ledger-find host/ledger "GET" "/:slug") :handler)
+  "host/blog-post")
+
+;; ── status queries ──────────────────────────────────────────────────
+(host-lg-test "migrated count" (len (host/ledger-migrated host/ledger)) 7)
+(host-lg-test "native count" (len (host/ledger-native host/ledger)) 1)
+(host-lg-test "proxied count" (len (host/ledger-proxied host/ledger)) 7)
+
+;; ── served? predicate ───────────────────────────────────────────────
+(host-lg-test
+  "served? migrated"
+  (host/ledger-served? (host/ledger-find host/ledger "GET" "/feed"))
+  true)
+(host-lg-test
+  "served? native"
+  (host/ledger-served? (host/ledger-find host/ledger "GET" "/health"))
+  true)
+(host-lg-test
+  "served? proxied false"
+  (host/ledger-served? (host/ledger-find host/ledger "POST" "/internal/actions/relate"))
+  false)
+
+;; ── domain queries ──────────────────────────────────────────────────
+(host-lg-test "relations domain count" (len (host/ledger-by-domain host/ledger "relations")) 7)
+(host-lg-test "likes domain count" (len (host/ledger-by-domain host/ledger "likes")) 4)
+(host-lg-test "domains count" (len (host/ledger-domains host/ledger)) 5)
+(host-lg-test
+  "domains has relations"
+  (some (fn (d) (= d "relations")) (host/ledger-domains host/ledger))
+  true)
+(host-lg-test
+  "domains has feed"
+  (some (fn (d) (= d "feed")) (host/ledger-domains host/ledger))
+  true)
+
+;; ── coverage ────────────────────────────────────────────────────────
+(define host-lg-cov (host/ledger-coverage host/ledger))
+(host-lg-test "coverage total" (get host-lg-cov :total) 15)
+(host-lg-test "coverage migrated" (get host-lg-cov :migrated) 7)
+(host-lg-test "coverage proxied" (get host-lg-cov :proxied) 7)
+(host-lg-test "coverage native" (get host-lg-cov :native) 1)
+(host-lg-test "coverage served" (get host-lg-cov :served) 8)
+(host-lg-test "coverage percent" (get host-lg-cov :percent) 53)
+
+(define
+  host-lg-tests-run!
+  (fn
+    ()
+    {:total (+ host-lg-pass host-lg-fail)
+     :passed host-lg-pass
+     :failed host-lg-fail
+     :fails host-lg-fails}))

lib/host/tests/middleware.sx

@@ -0,0 +1,107 @@
+;; lib/host/tests/middleware.sx — auth (bearer -> principal), ACL gate, and error
+;; trapping, composed via host/pipeline. ACL facts: alice may "post" on "feed".
+
+(define host-mw-pass 0)
+(define host-mw-fail 0)
+(define host-mw-fails (list))
+
+(define
+  host-mw-test
+  (fn
+    (name actual expected)
+    (if
+      (= actual expected)
+      (set! host-mw-pass (+ host-mw-pass 1))
+      (begin
+        (set! host-mw-fail (+ host-mw-fail 1))
+        (append! host-mw-fails {:name name :actual actual :expected expected})))))
+
+;; ── fixtures ───────────────────────────────────────────────────────
+(acl/load! (list (acl-grant "alice" "post" "feed")))
+
+(define host-mw-resolve
+  (fn (tok) (if (= tok "good") "alice" nil)))
+
+(define host-mw-handler
+  (fn (req) (host/ok-status 201 (host/principal req))))
+
+;; protected: needs auth + post/feed permission
+(define host-mw-protected
+  (host/pipeline
+    (list
+      (host/require-auth host-mw-resolve)
+      (host/require-permission "post" (fn (req) "feed")))
+    host-mw-handler))
+
+;; protected with an action alice is NOT granted
+(define host-mw-protected-del
+  (host/pipeline
+    (list
+      (host/require-auth host-mw-resolve)
+      (host/require-permission "delete" (fn (req) "feed")))
+    host-mw-handler))
+
+(define
+  host-mw-req
+  (fn (auth)
+    (dream-request "POST" "/feed"
+      (if auth {:authorization auth} {})
+      "")))
+
+;; ── auth ───────────────────────────────────────────────────────────
+(host-mw-test
+  "no token -> 401"
+  (dream-status (host-mw-protected (host-mw-req nil)))
+  401)
+(host-mw-test
+  "401 has www-authenticate"
+  (dream-resp-header (host-mw-protected (host-mw-req nil)) "www-authenticate")
+  "Bearer")
+(host-mw-test
+  "bad token -> 401"
+  (dream-status (host-mw-protected (host-mw-req "Bearer wrong")))
+  401)
+
+;; ── authz ──────────────────────────────────────────────────────────
+(host-mw-test
+  "authed + permitted -> 201"
+  (dream-status (host-mw-protected (host-mw-req "Bearer good")))
+  201)
+(host-mw-test
+  "principal threaded to handler"
+  (contains?
+    (dream-resp-body (host-mw-protected (host-mw-req "Bearer good")))
+    ":data \"alice\"")
+  true)
+(host-mw-test
+  "authed but not permitted -> 403"
+  (dream-status (host-mw-protected-del (host-mw-req "Bearer good")))
+  403)
+(host-mw-test
+  "403 envelope"
+  (contains?
+    (dream-resp-body (host-mw-protected-del (host-mw-req "Bearer good")))
+    ":error \"forbidden\"")
+  true)
+
+;; ── error trapping ─────────────────────────────────────────────────
+(define host-mw-boom (fn (req) (error "kaboom")))
+(host-mw-test
+  "wrap-errors -> 500"
+  (dream-status ((host/wrap-errors host-mw-boom) (host-mw-req nil)))
+  500)
+(host-mw-test
+  "500 envelope"
+  (contains?
+    (dream-resp-body ((host/wrap-errors host-mw-boom) (host-mw-req nil)))
+    ":ok false")
+  true)
+
+(define
+  host-mw-tests-run!
+  (fn
+    ()
+    {:total (+ host-mw-pass host-mw-fail)
+     :passed host-mw-pass
+     :failed host-mw-fail
+     :fails host-mw-fails}))

lib/host/tests/page.sx

@@ -0,0 +1,60 @@
+;; lib/host/tests/page.sx — the host's interactive-SX-page capability (Phase 5.1).
+;; A defcomp component tree (with keyword attributes + nesting) renders to correct
+;; HTML through host/page / render-page, served by a host route. This is the
+;; capability the legacy editor (and any future island UI) needs — proven on a
+;; small component so it's not editor-specific.
+
+(define host-pg-pass 0)
+(define host-pg-fail 0)
+(define host-pg-fails (list))
+(define
+  host-pg-test
+  (fn (name actual expected)
+    (if (= actual expected)
+      (set! host-pg-pass (+ host-pg-pass 1))
+      (begin
+        (set! host-pg-fail (+ host-pg-fail 1))
+        (append! host-pg-fails {:name name :actual actual :expected expected})))))
+
+;; A component with keyword attributes (the case bare render-to-html mangles) and
+;; a nested component (expansion must recurse).
+(defcomp ~pg-badge (&key (label :as string))
+  (span :class "badge" :data-kind "tag" label))
+(defcomp ~pg-card (&key (title :as string))
+  (div :class "card"
+    (h2 :class "card-title" title)
+    (~pg-badge :label "new")))
+
+(define host-pg-req (fn (target) (dream-request "GET" target {} "")))
+(define host-pg-app
+  (host/make-app (list (list (host/page-route "/card" (quote (~pg-card :title "Hello")))))))
+
+(define host-pg-body (dream-resp-body (host-pg-app (host-pg-req "/card"))))
+
+(host-pg-test "page 200"
+  (dream-status (host-pg-app (host-pg-req "/card"))) 200)
+(host-pg-test "page is html"
+  (contains? (dream-resp-header (host-pg-app (host-pg-req "/card")) "content-type") "text/html")
+  true)
+;; attributes survive (the whole point) — class on the outer div
+(host-pg-test "outer div class attr"
+  (contains? host-pg-body "class=\"card\"") true)
+;; nested component expanded + its attrs survive
+(host-pg-test "nested component expanded"
+  (contains? host-pg-body "class=\"badge\"") true)
+(host-pg-test "nested data attr"
+  (contains? host-pg-body "data-kind=\"tag\"") true)
+;; keyword param values rendered as text content, not attrs
+(host-pg-test "title text rendered"
+  (contains? host-pg-body "Hello") true)
+(host-pg-test "badge label text rendered"
+  (contains? host-pg-body ">new<") true)
+;; NOT mangled — the keyword ":class" must not leak as text content
+(host-pg-test "no mangled keyword text"
+  (contains? host-pg-body ">classcard") false)
+
+(define
+  host-pg-tests-run!
+  (fn ()
+    {:total (+ host-pg-pass host-pg-fail)
+     :passed host-pg-pass :failed host-pg-fail :fails host-pg-fails}))

lib/host/tests/relations.sx

@@ -0,0 +1,172 @@
+;; lib/host/tests/relations.sx — the migrated relations read endpoints,
+;; GET /internal/data/get-children and /get-parents, dispatching to lib/relations.
+;; Golden tests pin each endpoint to "subsystem call + standard envelope": the
+;; host adds the HTTP/JSON shell over relations/children|parents and nothing else
+;; (golden derived from the same subsystem call, so result order matches).
+
+(define host-rl-pass 0)
+(define host-rl-fail 0)
+(define host-rl-fails (list))
+
+(define
+  host-rl-test
+  (fn
+    (name actual expected)
+    (if
+      (= actual expected)
+      (set! host-rl-pass (+ host-rl-pass 1))
+      (begin
+        (set! host-rl-fail (+ host-rl-fail 1))
+        (append! host-rl-fails {:name name :actual actual :expected expected})))))
+
+(define host-rl-req (fn (target) (dream-request "GET" target {} "")))
+(define host-rl-app (host/make-app (list host/relations-routes)))
+(define host-rl-sym (fn (s) (string->symbol s)))
+
+;; ── seed a known graph ──────────────────────────────────────────────
+;; org:1 --member--> list:7, list:8 ; org:1 --owner--> page:9
+(relations/load! (list))
+(relations/relate (host-rl-sym "org:1") (host-rl-sym "list:7") (host-rl-sym "member"))
+(relations/relate (host-rl-sym "org:1") (host-rl-sym "list:8") (host-rl-sym "member"))
+(relations/relate (host-rl-sym "org:1") (host-rl-sym "page:9") (host-rl-sym "owner"))
+
+;; ── get-children ────────────────────────────────────────────────────
+(define host-rl-kids
+  "/internal/data/get-children?parent-type=org&parent-id=1&relation-type=member")
+(host-rl-test "children 200" (dream-status (host-rl-app (host-rl-req host-rl-kids))) 200)
+(host-rl-test
+  "children has list:7"
+  (contains? (dream-resp-body (host-rl-app (host-rl-req host-rl-kids))) "list:7")
+  true)
+(host-rl-test
+  "children has list:8"
+  (contains? (dream-resp-body (host-rl-app (host-rl-req host-rl-kids))) "list:8")
+  true)
+(host-rl-test
+  "children excludes other-kind page:9"
+  (contains? (dream-resp-body (host-rl-app (host-rl-req host-rl-kids))) "page:9")
+  false)
+(host-rl-test
+  "children count via subsystem"
+  (len (relations/children (host-rl-sym "org:1") (host-rl-sym "member")))
+  2)
+
+;; child-type filter narrows by node prefix.
+(host-rl-test
+  "children child-type=list keeps both"
+  (contains?
+    (dream-resp-body (host-rl-app (host-rl-req (str host-rl-kids "&child-type=list"))))
+    "list:8")
+  true)
+(host-rl-test
+  "children child-type=page filters all out"
+  (contains?
+    (dream-resp-body (host-rl-app (host-rl-req (str host-rl-kids "&child-type=page"))))
+    "list:7")
+  false)
+
+;; ── get-parents ─────────────────────────────────────────────────────
+(define host-rl-par
+  "/internal/data/get-parents?child-type=list&child-id=7&relation-type=member")
+(host-rl-test "parents 200" (dream-status (host-rl-app (host-rl-req host-rl-par))) 200)
+(host-rl-test
+  "parents has org:1"
+  (contains? (dream-resp-body (host-rl-app (host-rl-req host-rl-par))) "org:1")
+  true)
+
+;; ── missing required params -> 400 ──────────────────────────────────
+(host-rl-test
+  "children missing param -> 400"
+  (dream-status (host-rl-app (host-rl-req "/internal/data/get-children?parent-type=org")))
+  400)
+(host-rl-test
+  "parents missing param -> 400"
+  (dream-status (host-rl-app (host-rl-req "/internal/data/get-parents?child-type=list")))
+  400)
+
+;; ── golden: endpoint = subsystem call + envelope ────────────────────
+(host-rl-test
+  "golden children"
+  (dream-resp-body (host-rl-app (host-rl-req host-rl-kids)))
+  (serialize {:ok true :data (host/-rel-strings (relations/children (host-rl-sym "org:1") (host-rl-sym "member")))}))
+(host-rl-test
+  "golden parents"
+  (dream-resp-body (host-rl-app (host-rl-req host-rl-par)))
+  (serialize {:ok true :data (host/-rel-strings (relations/parents (host-rl-sym "list:7") (host-rl-sym "member")))}))
+
+;; ── writes: attach-child / detach-child (auth + ACL + closed loop) ──
+(acl/load!
+  (list
+    (acl-grant "carol" "relate" "relations")
+    (acl-grant "carol" "unrelate" "relations")))
+;; carol is permitted; dave authenticates but has no grant.
+(define host-rl-resolve
+  (fn (tok)
+    (cond ((= tok "good") "carol") ((= tok "weak") "dave") (true nil))))
+(define host-rl-wapp
+  (host/make-app
+    (list host/relations-routes (host/relations-write-routes host-rl-resolve))))
+(define host-rl-post
+  (fn (action auth body)
+    (dream-request "POST" (str "/internal/actions/" action)
+      (if auth {:authorization auth} {}) body)))
+(define host-rl-edge
+  "{:parent-type \"org\" :parent-id \"2\" :child-type \"list\" :child-id \"5\" :relation-type \"member\"}")
+(define host-rl-org2
+  "/internal/data/get-children?parent-type=org&parent-id=2&relation-type=member")
+
+(relations/load! (list))
+
+;; auth gate
+(host-rl-test
+  "attach no auth -> 401"
+  (dream-status (host-rl-wapp (host-rl-post "attach-child" nil "{}")))
+  401)
+(host-rl-test
+  "attach authed-but-unpermitted -> 403"
+  (dream-status (host-rl-wapp (host-rl-post "attach-child" "Bearer weak" host-rl-edge)))
+  403)
+(host-rl-test
+  "graph unchanged after 403"
+  (len (relations/children (host-rl-sym "org:2") (host-rl-sym "member")))
+  0)
+
+;; permitted attach -> 201, and visible through the migrated read
+(host-rl-test
+  "attach authed+permitted -> 201"
+  (dream-status (host-rl-wapp (host-rl-post "attach-child" "Bearer good" host-rl-edge)))
+  201)
+(host-rl-test
+  "attached edge visible via get-children"
+  (contains? (dream-resp-body (host-rl-app (host-rl-req host-rl-org2))) "list:5")
+  true)
+
+;; detach -> 200, and gone from the read
+(host-rl-test
+  "detach authed+permitted -> 200"
+  (dream-status (host-rl-wapp (host-rl-post "detach-child" "Bearer good" host-rl-edge)))
+  200)
+(host-rl-test
+  "detached edge gone from get-children"
+  (contains? (dream-resp-body (host-rl-app (host-rl-req host-rl-org2))) "list:5")
+  false)
+
+;; bad payloads
+(host-rl-test
+  "attach non-object body -> 400"
+  (dream-status (host-rl-wapp (host-rl-post "attach-child" "Bearer good" "(1 2)")))
+  400)
+(host-rl-test
+  "attach missing param -> 400"
+  (dream-status
+    (host-rl-wapp (host-rl-post "attach-child" "Bearer good" "{:parent-type \"org\"}")))
+  400)
+
+(define
+  host-rl-tests-run!
+  (fn
+    ()
+    {:total (+ host-rl-pass host-rl-fail)
+     :passed host-rl-pass
+     :failed host-rl-fail
+     :fails host-rl-fails}))

lib/host/tests/router.sx

@@ -0,0 +1,75 @@
+;; lib/host/tests/router.sx — host app assembly: health endpoint, group mounting,
+;; 404 fallback.
+
+(define host-rt-pass 0)
+(define host-rt-fail 0)
+(define host-rt-fails (list))
+
+(define
+  host-rt-test
+  (fn
+    (name actual expected)
+    (if
+      (= actual expected)
+      (set! host-rt-pass (+ host-rt-pass 1))
+      (begin
+        (set! host-rt-fail (+ host-rt-fail 1))
+        (append! host-rt-fails {:name name :actual actual :expected expected})))))
+
+(define
+  host-rt-req
+  (fn (method target) (dream-request method target {} "")))
+
+;; An app built from one domain group of two routes.
+(define
+  host-rt-app
+  (host/make-app
+    (list
+      (list
+        (dream-get "/ping" (fn (req) (host/ok "pong")))
+        (dream-get "/widgets/:id" (fn (req) (host/ok (dream-param req "id"))))))))
+
+;; ── health ─────────────────────────────────────────────────────────
+(host-rt-test
+  "health status 200"
+  (dream-status (host-rt-app (host-rt-req "GET" "/health")))
+  200)
+(host-rt-test
+  "health body healthy"
+  (contains?
+    (dream-resp-body (host-rt-app (host-rt-req "GET" "/health")))
+    "healthy")
+  true)
+
+;; ── group routes mounted ───────────────────────────────────────────
+(host-rt-test
+  "group route ping"
+  (contains?
+    (dream-resp-body (host-rt-app (host-rt-req "GET" "/ping")))
+    "pong")
+  true)
+(host-rt-test
+  "group path param"
+  (contains?
+    (dream-resp-body (host-rt-app (host-rt-req "GET" "/widgets/42")))
+    ":data \"42\"")
+  true)
+
+;; ── fallback ───────────────────────────────────────────────────────
+(host-rt-test
+  "unknown path 404"
+  (dream-status (host-rt-app (host-rt-req "GET" "/nope")))
+  404)
+(host-rt-test
+  "wrong method 405"
+  (dream-status (host-rt-app (host-rt-req "POST" "/ping")))
+  405)
+
+(define
+  host-rt-tests-run!
+  (fn
+    ()
+    {:total (+ host-rt-pass host-rt-fail)
+     :passed host-rt-pass
+     :failed host-rt-fail
+     :fails host-rt-fails}))

lib/host/tests/server.sx

@@ -0,0 +1,88 @@
+;; lib/host/tests/server.sx — the native<->dream bridge. Pure-function coverage of
+;; host/-native->dream, host/-dream->native, and the host/native-handler adapter
+;; over a real host app (no socket — the http-listen call itself is exercised live
+;; via lib/host/serve.sx, not here).
+
+(define host-sv-pass 0)
+(define host-sv-fail 0)
+(define host-sv-fails (list))
+
+(define
+  host-sv-test
+  (fn
+    (name actual expected)
+    (if
+      (= actual expected)
+      (set! host-sv-pass (+ host-sv-pass 1))
+      (begin
+        (set! host-sv-fail (+ host-sv-fail 1))
+        (append! host-sv-fails {:name name :actual actual :expected expected})))))
+
+(define host-sv-native
+  (fn (method path query body)
+    {"method" method "path" path "query" query "body" body "headers" {}}))
+
+;; ── native request -> dream request ─────────────────────────────────
+(define host-sv-dreq (host/-native->dream (host-sv-native "post" "/feed" "actor=alice" "hi")))
+(host-sv-test "n->d method upcased" (get host-sv-dreq :method) "POST")
+(host-sv-test "n->d path" (get host-sv-dreq :path) "/feed")
+(host-sv-test "n->d query param" (dream-query-param host-sv-dreq "actor") "alice")
+(host-sv-test "n->d body" (get host-sv-dreq :body) "hi")
+;; empty query -> bare path, no trailing "?"
+(host-sv-test
+  "n->d empty query -> bare path"
+  (get (host/-native->dream (host-sv-native "GET" "/health" "" "")) :path)
+  "/health")
+
+;; ── dream response -> native response ───────────────────────────────
+(define host-sv-nresp
+  (host/-dream->native (dream-response 201 {:content-type "application/json"} "{}")))
+(host-sv-test "d->n status" (get host-sv-nresp :status) 201)
+(host-sv-test "d->n body" (get host-sv-nresp :body) "{}")
+(host-sv-test "d->n headers is dict" (= (type-of (get host-sv-nresp :headers)) "dict") true)
+
+;; ── adapter over a real host app ────────────────────────────────────
+(feed/reset!)
+(define host-sv-app (host/native-handler (host/make-app (list host/feed-routes))))
+(host-sv-test
+  "health -> 200"
+  (get (host-sv-app (host-sv-native "GET" "/health" "" "")) :status)
+  200)
+(host-sv-test
+  "health body healthy"
+  (contains? (get (host-sv-app (host-sv-native "GET" "/health" "" "")) :body) "healthy")
+  true)
+(host-sv-test
+  "feed read -> 200"
+  (get (host-sv-app (host-sv-native "GET" "/feed" "" "")) :status)
+  200)
+;; native response shape is exactly {:status :headers :body}
+(host-sv-test
+  "native resp keys"
+  (let ((r (host-sv-app (host-sv-native "GET" "/health" "" ""))))
+    (and (has-key? r :status) (has-key? r :headers) (has-key? r :body)))
+  true)
+
+;; ── relations read through the bridge (end-to-end shape) ────────────
+(relations/load! (list))
+(relations/relate (string->symbol "org:1") (string->symbol "list:7") (string->symbol "member"))
+(define host-sv-rapp (host/native-handler (host/make-app (list host/relations-routes))))
+(host-sv-test
+  "relations read via bridge"
+  (contains?
+    (get
+      (host-sv-rapp
+        (host-sv-native "GET" "/internal/data/get-children"
+          "parent-type=org&parent-id=1&relation-type=member" ""))
+      :body)
+    "list:7")
+  true)
+
+(define
+  host-sv-tests-run!
+  (fn
+    ()
+    {:total (+ host-sv-pass host-sv-fail)
+     :passed host-sv-pass
+     :failed host-sv-fail
+     :fails host-sv-fails}))

lib/host/tests/session.sx

@@ -0,0 +1,146 @@
+;; lib/host/tests/session.sx — the live-write story end-to-end: a browser logs in
+;; (POST /login) → signed session cookie → guarded write succeeds; no cookie → 401;
+;; the Bearer path still works for API clients; logout drops the principal.
+;; make-app auto-mounts /login + /logout and wraps everything in host/sessions, so
+;; these tests drive the WHOLE app handler (session middleware + router) the way
+;; the native server does.
+
+(define host-se-pass 0)
+(define host-se-fail 0)
+(define host-se-fails (list))
+
+(define host-se-test
+  (fn (name actual expected)
+    (if (= actual expected)
+      (set! host-se-pass (+ host-se-pass 1))
+      (begin
+        (set! host-se-fail (+ host-se-fail 1))
+        (append! host-se-fails {:name name :actual actual :expected expected})))))
+
+;; ── fixtures ────────────────────────────────────────────────────────
+(acl/load! (list (acl-grant "admin" "edit" "blog")))
+(host/auth-set-admin! "admin" "secret")
+(host/session-set-secret! "test-session-secret")
+
+;; bearer fallback for API clients (session is the browser path)
+(define host-se-resolve (fn (tok) (if (= tok "apitoken") "admin" nil)))
+
+;; a guarded write route isolating the session mechanism from blog specifics:
+;; same pipeline shape as host/blog--protect (wrap-errors + require-user + ACL).
+(define host-se-secure-h
+  (host/pipeline
+    (list
+      host/wrap-errors
+      (host/require-user host-se-resolve)
+      (host/require-permission "edit" (fn (req) "blog")))
+    (fn (req) (host/ok-status 201 (host/principal req)))))
+
+(define host-se-app
+  (host/make-app (list (list (dream-post "/secure" host-se-secure-h)))))
+
+;; ── helpers ─────────────────────────────────────────────────────────
+(define host-se-login
+  (fn (user pass)
+    (host-se-app
+      (dream-request "POST" "/login" {}
+        (str "username=" user "&password=" pass)))))
+
+;; the name=value pair from the Set-Cookie (drop the "; Path=…" attributes)
+(define host-se-cookie-of
+  (fn (resp)
+    (let ((c (first (dream-resp-cookies resp))))
+      (if (nil? c) nil (substr c 0 (index-of c ";"))))))
+
+(define host-se-secure
+  (fn (cookie)
+    (host-se-app
+      (dream-request "POST" "/secure" (if cookie {:cookie cookie} {}) ""))))
+
+(define host-se-secure-bearer
+  (fn (tok)
+    (host-se-app
+      (dream-request "POST" "/secure" {:authorization (str "Bearer " tok)} ""))))
+
+;; ── login ───────────────────────────────────────────────────────────
+(host-se-test "login good creds -> 303 redirect"
+  (dream-status (host-se-login "admin" "secret")) 303)
+(host-se-test "login good creds sets a session cookie"
+  (not (nil? (host-se-cookie-of (host-se-login "admin" "secret")))) true)
+(host-se-test "login bad creds -> 401"
+  (dream-status (host-se-login "admin" "wrong")) 401)
+
+;; ── return-to (?next=) after login ──────────────────────────────────
+(host-se-test "login page carries ?next in a hidden field"
+  (contains?
+    (dream-resp-body (host-se-app (dream-request "GET" "/login?next=/secure" {} "")))
+    "value=\"/secure\"")
+  true)
+(host-se-test "login redirects to next on success"
+  (dream-resp-header
+    (host-se-app (dream-request "POST" "/login" {} "username=admin&password=secret&next=/secure"))
+    "location")
+  "/secure")
+(host-se-test "login rejects open-redirect next (//evil) -> /"
+  (dream-resp-header
+    (host-se-app (dream-request "POST" "/login" {} "username=admin&password=secret&next=//evil.com"))
+    "location")
+  "/")
+
+;; ── session-authed write ────────────────────────────────────────────
+(host-se-test "logged-in session passes the guarded write -> 201"
+  (dream-status (host-se-secure (host-se-cookie-of (host-se-login "admin" "secret"))))
+  201)
+(host-se-test "principal threaded from the session to the handler"
+  (contains?
+    (dream-resp-body (host-se-secure (host-se-cookie-of (host-se-login "admin" "secret"))))
+    ":data \"admin\"")
+  true)
+
+;; ── unauthenticated / forged ────────────────────────────────────────
+(host-se-test "no cookie -> 401"
+  (dream-status (host-se-secure nil)) 401)
+(host-se-test "bad-cred login leaves an anonymous session (no principal) -> 401"
+  (dream-status (host-se-secure (host-se-cookie-of (host-se-login "admin" "wrong"))))
+  401)
+(host-se-test "forged cookie -> 401"
+  (dream-status (host-se-secure "dream.session=s1|forged")) 401)
+
+;; ── bearer fallback (API path still works) ──────────────────────────
+(host-se-test "valid bearer token -> 201"
+  (dream-status (host-se-secure-bearer "apitoken")) 201)
+(host-se-test "invalid bearer token -> 401"
+  (dream-status (host-se-secure-bearer "nope")) 401)
+
+;; ── logout ──────────────────────────────────────────────────────────
+;; log in, get the cookie, log out with it, then the same cookie no longer authes.
+(define host-se-logout
+  (fn (cookie)
+    (host-se-app
+      (dream-request "POST" "/logout" (if cookie {:cookie cookie} {}) ""))))
+(define host-se-live-cookie (host-se-cookie-of (host-se-login "admin" "secret")))
+(host-se-test "logout returns 303"
+  (dream-status (host-se-logout host-se-live-cookie)) 303)
+(host-se-test "after logout the cookie no longer authes -> 401"
+  (begin
+    (host-se-logout host-se-live-cookie)
+    (dream-status (host-se-secure host-se-live-cookie)))
+  401)
+
+;; ── lazy persistence: only a written (logged-in) session leaves a durable row ──
+(host-se-test "session/create writes no row (anonymous leaves no durable trace)"
+  (host/session-backend {:op "session/exists" :sid (host/session-backend {:op "session/create"})})
+  false)
+(host-se-test "session/set creates the row (a login persists)"
+  (let ((sid (host/session-backend {:op "session/create"})))
+    (begin
+      (host/session-backend {:op "session/set" :sid sid :key :principal :val "bob"})
+      (list (host/session-backend {:op "session/exists" :sid sid})
+            (host/session-backend {:op "session/get" :sid sid :key :principal}))))
+  (list true "bob"))
+
+(define host-se-tests-run!
+  (fn ()
+    {:total (+ host-se-pass host-se-fail)
+     :passed host-se-pass
+     :failed host-se-fail
+     :fails host-se-fails}))

lib/host/tests/sxtp.sx

@@ -0,0 +1,218 @@
+;; lib/host/tests/sxtp.sx — SXTP message algebra, wire serialise/parse round-trip,
+;; and the Dream HTTP <-> SXTP bridge.
+
+(define host-sx-pass 0)
+(define host-sx-fail 0)
+(define host-sx-fails (list))
+
+(define
+  host-sx-test
+  (fn
+    (name actual expected)
+    (if
+      (= actual expected)
+      (set! host-sx-pass (+ host-sx-pass 1))
+      (begin
+        (set! host-sx-fail (+ host-sx-fail 1))
+        (append! host-sx-fails {:name name :actual actual :expected expected})))))
+
+;; ── constructors + predicates ──────────────────────────────────────
+(define host-sx-req (sxtp/request "navigate" "/x" {:headers {:host "h"}}))
+(define host-sx-resp (sxtp/ok {:id "e1"}))
+
+(host-sx-test "request?" (sxtp/request? host-sx-req) true)
+(host-sx-test "request not response" (sxtp/response? host-sx-req) false)
+(host-sx-test "response?" (sxtp/response? host-sx-resp) true)
+(host-sx-test "condition?" (sxtp/condition? (sxtp/condition "x" {})) true)
+(host-sx-test "patch?" (sxtp/patch? (sxtp/patch "#x" {})) true)
+(host-sx-test "patch not event" (sxtp/event? (sxtp/patch "#x" {})) false)
+(host-sx-test "signals?" (sxtp/signals? (sxtp/signals {:n 3} {})) true)
+(host-sx-test "signals not patch" (sxtp/patch? (sxtp/signals {:n 3} {})) false)
+
+;; ── accessors (verb/status are symbols) ────────────────────────────
+(host-sx-test "verb" (symbol->string (sxtp/verb host-sx-req)) "navigate")
+(host-sx-test "path" (sxtp/path host-sx-req) "/x")
+(host-sx-test "req header" (get (sxtp/req-headers host-sx-req) :host) "h")
+(host-sx-test "status" (symbol->string (sxtp/status host-sx-resp)) "ok")
+(host-sx-test "body" (get (sxtp/body host-sx-resp) :id) "e1")
+
+;; ── status helpers ─────────────────────────────────────────────────
+(host-sx-test "created status" (symbol->string (sxtp/status (sxtp/created {}))) "created")
+(host-sx-test
+  "not-found status"
+  (symbol->string (sxtp/status (sxtp/not-found "/p" "gone")))
+  "not-found")
+(host-sx-test
+  "not-found body is condition"
+  (sxtp/condition? (sxtp/body (sxtp/not-found "/p" "gone")))
+  true)
+(host-sx-test
+  "forbidden message"
+  (sxtp/cond-message (sxtp/body (sxtp/forbidden "no")))
+  "no")
+
+;; ── serialise (deterministic top-level field order) ────────────────
+(host-sx-test
+  "serialize request"
+  (sxtp/serialize host-sx-req)
+  "(request :verb navigate :path \"/x\" :headers {:host \"h\"})")
+(host-sx-test
+  "serialize ok"
+  (sxtp/serialize (sxtp/ok {:id "e1"}))
+  "(response :status ok :body {:id \"e1\"})")
+;; nested condition rides the wire in its (condition ...) list form, no :msg leak.
+(host-sx-test
+  "serialize nested condition as list"
+  (contains?
+    (sxtp/serialize (sxtp/not-found "/p" "gone"))
+    "(condition :type resource-not-found")
+  true)
+(host-sx-test
+  "serialize no :msg leak"
+  (contains? (sxtp/serialize host-sx-resp) ":msg")
+  false)
+
+;; ── patch + signals (Datastar-borrowed) ───────────────────────────
+;; Mode defaults to outer; accepts string OR symbol input.
+(host-sx-test
+  "patch default mode is outer symbol"
+  (symbol->string (sxtp/mode (sxtp/patch "#x" {})))
+  "outer")
+(host-sx-test
+  "patch accepts symbol mode"
+  (symbol->string (sxtp/mode (sxtp/patch "#x" {:mode (string->symbol "inner")})))
+  "inner")
+(host-sx-test
+  "patch accepts string mode and normalises"
+  (symbol->string (sxtp/mode (sxtp/patch "#x" {:mode "append"})))
+  "append")
+(host-sx-test
+  "patch target accessor"
+  (sxtp/target (sxtp/patch "#cart" {}))
+  "#cart")
+(host-sx-test
+  "patch serialises with target/mode/body in fixed order"
+  (sxtp/serialize (sxtp/patch "#x" {:body "hi"}))
+  "(patch :target \"#x\" :mode outer :body \"hi\")")
+(host-sx-test
+  "patch remove mode serialises without :body"
+  (sxtp/serialize (sxtp/patch "#x" {:mode "remove"}))
+  "(patch :target \"#x\" :mode remove)")
+(host-sx-test
+  "patch transition? predicate"
+  (sxtp/transition? (sxtp/patch "#x" {:transition true}))
+  true)
+
+(host-sx-test
+  "signals accessor"
+  (get (sxtp/values (sxtp/signals {:cart/count 3} {})) :cart/count)
+  3)
+(host-sx-test
+  "signals only-if-missing default false"
+  (sxtp/only-if-missing? (sxtp/signals {:n 1} {}))
+  false)
+(host-sx-test
+  "signals only-if-missing true round-trips"
+  (sxtp/only-if-missing? (sxtp/signals {:n 1} {:only-if-missing true}))
+  true)
+(host-sx-test
+  "signals serialise"
+  (sxtp/serialize (sxtp/signals {:cart/count 3} {}))
+  "(signals :values {:cart/count 3})")
+
+;; ── round-trip ────────────────────────────────────────────────────
+(define host-sx-patch-rt
+  (sxtp/parse (sxtp/serialize (sxtp/patch "#mini" {:mode "inner" :body "n=3"}))))
+(host-sx-test "patch rt msg" (sxtp/patch? host-sx-patch-rt) true)
+(host-sx-test "patch rt target" (sxtp/target host-sx-patch-rt) "#mini")
+(host-sx-test "patch rt mode" (symbol->string (sxtp/mode host-sx-patch-rt)) "inner")
+(define host-sx-signals-rt
+  (sxtp/parse (sxtp/serialize (sxtp/signals {:a 1 :b "x"} {:only-if-missing true}))))
+(host-sx-test "signals rt msg" (sxtp/signals? host-sx-signals-rt) true)
+(host-sx-test "signals rt values"
+  (get (sxtp/values host-sx-signals-rt) :a) 1)
+(host-sx-test "signals rt only-if-missing"
+  (sxtp/only-if-missing? host-sx-signals-rt) true)
+
+;; ── parse + round-trip ─────────────────────────────────────────────
+(define host-sx-parsed
+  (sxtp/parse "(request :verb query :path \"/events\" :headers {:host \"h\"})"))
+(host-sx-test "parse msg type" (sxtp/request? host-sx-parsed) true)
+(host-sx-test "parse verb" (symbol->string (sxtp/verb host-sx-parsed)) "query")
+(host-sx-test "parse path" (sxtp/path host-sx-parsed) "/events")
+(host-sx-test
+  "parse nested header normalised"
+  (get (sxtp/req-headers host-sx-parsed) :host)
+  "h")
+
+(define host-sx-rt (sxtp/parse (sxtp/serialize (sxtp/ok {:id "e1" :n 3}))))
+(host-sx-test "round-trip status" (symbol->string (sxtp/status host-sx-rt)) "ok")
+(host-sx-test "round-trip body id" (get (sxtp/body host-sx-rt) :id) "e1")
+(host-sx-test "round-trip body n" (get (sxtp/body host-sx-rt) :n) 3)
+
+;; ── HTTP <-> SXTP mappings ─────────────────────────────────────────
+(host-sx-test "verb GET->fetch" (symbol->string (sxtp/verb-for-method "GET")) "fetch")
+(host-sx-test "verb POST->create" (symbol->string (sxtp/verb-for-method "POST")) "create")
+(host-sx-test "verb DELETE->delete" (symbol->string (sxtp/verb-for-method "DELETE")) "delete")
+(host-sx-test "verb unknown->fetch" (symbol->string (sxtp/verb-for-method "WIBBLE")) "fetch")
+(host-sx-test "http ok->200" (sxtp/http-status (string->symbol "ok")) 200)
+(host-sx-test "http not-found->404" (sxtp/http-status (string->symbol "not-found")) 404)
+
+;; ── Dream bridge ───────────────────────────────────────────────────
+(define host-sx-from
+  (sxtp/from-dream (dream-request "POST" "/feed?a=1" {} "hi")))
+(host-sx-test "from-dream verb" (symbol->string (sxtp/verb host-sx-from)) "create")
+(host-sx-test "from-dream path" (sxtp/path host-sx-from) "/feed")
+(host-sx-test "from-dream param" (sxtp/param host-sx-from "a") "1")
+(host-sx-test "from-dream body" (sxtp/body host-sx-from) "hi")
+
+(define host-sx-tod (sxtp/to-dream (sxtp/ok {:id "e1"})))
+(host-sx-test "to-dream status" (dream-status host-sx-tod) 200)
+(host-sx-test
+  "to-dream content-type text/sx"
+  (dream-resp-header host-sx-tod "content-type")
+  "text/sx")
+(host-sx-test
+  "to-dream body is sx text"
+  (dream-resp-body host-sx-tod)
+  "{:id \"e1\"}")
+(host-sx-test
+  "to-dream not-found->404"
+  (dream-status (sxtp/to-dream (sxtp/not-found "/p" "gone")))
+  404)
+(host-sx-test
+  "to-dream forbidden->403"
+  (dream-status (sxtp/to-dream (sxtp/forbidden "no")))
+  403)
+
+;; ── engine<->server write wire: serialize (engine) <-> host/sx-body (server) ──
+;; A boosted form posts (serialize {field->value}) as text/sx; the server reads it
+;; back with host/sx-body. This is the SX write wire, verified with NO DOM (client-
+;; agnostic): what the engine's serialize emits, host/sx-body must parse back
+;; losslessly — including sx_content full of the quotes/parens that would break a
+;; naive encoder. (The server side is what conformance can prove; the DOM field-read
+;; is the one irreducibly-browser bit, left to a Playwright smoke.)
+(define host-sx-wire-content "(article (h1 \"Title\") (p \"He said \\\"hi\\\" (x)\"))")
+(define host-sx-wire-req
+  (dream-request "POST" "/x" {:content-type "text/sx"}
+    (serialize {:title "Hi there" :sx_content host-sx-wire-content :status "published"})))
+(host-sx-test "sx-body round-trips a serialized field dict"
+  (get (host/sx-body host-sx-wire-req) "title") "Hi there")
+(host-sx-test "sx-body preserves quoted/parenthesised sx_content losslessly"
+  (get (host/sx-body host-sx-wire-req) "sx_content") host-sx-wire-content)
+(host-sx-test "field reads a text/sx body by content-type"
+  (host/field host-sx-wire-req "status") "published")
+(host-sx-test "field falls back to urlencoded form (the no-engine path)"
+  (host/field (dream-request "POST" "/x"
+                {:content-type "application/x-www-form-urlencoded"}
+                "title=From+Form&status=draft") "title")
+  "From Form")
+
+(define
+  host-sx-tests-run!
+  (fn
+    ()
+    {:total (+ host-sx-pass host-sx-fail)
+     :passed host-sx-pass
+     :failed host-sx-fail
+     :fails host-sx-fails}))

lib/host/warm-conf.sh

@@ -0,0 +1,149 @@
+#!/usr/bin/env bash
+# warm-conf.sh — a WARM, persistent conformance server for fast iteration.
+#
+# conformance.sh cold-loads all ~57 modules (datalog/acl/relations/persist/dream + host)
+# on EVERY run — a fixed multi-minute tax, worst under box contention. This keeps a
+# long-lived sx_server with the heavy dependency modules loaded ONCE, and per run reloads
+# only the lib/host/* modules + the suite's test file (the things you actually edit),
+# then evals the runner. Cross-run state is safe: each test file re-opens a fresh persist
+# store at its top, and (since host/blog typing now reads direct KV edges, not lib/relations)
+# the warm Datalog DB no longer feeds blog results, so stale facts can't pollute a re-run.
+#
+# Usage:
+#   lib/host/warm-conf.sh start        # boot server, load the heavy dep modules once
+#   lib/host/warm-conf.sh run blog     # reload host modules + tests/blog.sx, run the suite
+#   lib/host/warm-conf.sh run          # run every suite
+#   lib/host/warm-conf.sh stop         # kill the warm server
+#   lib/host/warm-conf.sh restart      # stop + start
+#
+# It reads the MODULES + SUITES arrays straight from conformance.sh (no duplication, no
+# drift). Heavy deps are everything NOT under lib/host/; those host modules + the test
+# files are what `run` reloads.
+set -u
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$HERE" || exit 1
+CONF="lib/host/conformance.sh"
+
+SX_SERVER="${SX_SERVER:-hosts/ocaml/_build/default/bin/sx_server.exe}"
+[ -x "$SX_SERVER" ] || SX_SERVER="/root/rose-ash/hosts/ocaml/_build/default/bin/sx_server.exe"
+if [ ! -x "$SX_SERVER" ]; then echo "ERROR: sx_server.exe not found" >&2; exit 1; fi
+
+D="${WARM_CONF_DIR:-/tmp/warm-conf-host}"
+FIFO="$D/in"; LOG="$D/out"; SPID="$D/server.pid"; HPID="$D/holder.pid"; EPF="$D/epoch"
+
+# All module load paths from conformance.sh's MODULES=( ... ) array (in order).
+mapfile -t ALL_MODULES < <(awk '/^MODULES=\(/{f=1;next} f&&/^\)/{f=0} f' "$CONF" | grep -oE '"[^"]+\.sx"' | tr -d '"')
+# Heavy deps = everything that is NOT a lib/host module (loaded once, kept warm).
+DEPS=(); HOSTMODS=()
+for m in "${ALL_MODULES[@]}"; do
+  case "$m" in lib/host/*) HOSTMODS+=("$m") ;; *) DEPS+=("$m") ;; esac
+done
+# Suites: "NAME RUNNER FILE" lines from conformance.sh's SUITES=( ... ) array.
+mapfile -t SUITES < <(awk '/^SUITES=\(/{f=1;next} f&&/^\)/{f=0} f' "$CONF" | grep -oE '"[^"]+"' | tr -d '"')
+
+_running() { [ -f "$SPID" ] && kill -0 "$(cat "$SPID")" 2>/dev/null; }
+
+_send() { printf '%s\n' "$1" > "$FIFO"; }
+
+# wait until a line matching $1 appears in the log AFTER byte-offset $2, or $3 seconds pass.
+_wait_for() {
+  local pat="$1" from="$2" timeout="${3:-1200}" waited=0
+  while true; do
+    if tail -c +"$((from+1))" "$LOG" | grep -qE "$pat"; then return 0; fi
+    if tail -c +"$((from+1))" "$LOG" | grep -qE 'Undefined symbol|Unhandled exception|: error |expected list, got'; then
+      echo "  ! error in server output:" >&2
+      tail -c +"$((from+1))" "$LOG" | grep -nE 'Undefined symbol|Unhandled exception|: error |expected list, got' | head -5 >&2
+      return 2
+    fi
+    sleep 1; waited=$((waited+1))
+    [ "$waited" -ge "$timeout" ] && { echo "  ! timeout after ${timeout}s waiting for /$pat/" >&2; return 1; }
+  done
+}
+
+_emit_loads() { # $@ = module paths; uses + bumps the epoch counter in $EPF
+  local e; e="$(cat "$EPF")"
+  { for m in "$@"; do e=$((e+1)); printf '(epoch %d)\n(load "%s")\n' "$e" "$m"; done; } > "$FIFO"
+  echo "$e" > "$EPF"; echo "$e"   # echo the last epoch used
+}
+
+cmd_start() {
+  cmd_stop >/dev/null 2>&1
+  mkdir -p "$D"; : > "$LOG"; echo 0 > "$EPF"
+  rm -f "$FIFO"; mkfifo "$FIFO"
+  "$SX_SERVER" < "$FIFO" > "$LOG" 2>&1 &
+  echo $! > "$SPID"
+  sleep infinity > "$FIFO" &          # holder: keeps the write end open so the server never EOFs
+  echo $! > "$HPID"
+  echo "warm: loading ${#DEPS[@]} dependency modules (once)..."
+  local last; last="$(_emit_loads "${DEPS[@]}")"
+  if _wait_for "^\(ok $last " 0 900; then
+    echo "warm: ready — ${#DEPS[@]} deps loaded, server pid $(cat "$SPID")"
+  else
+    echo "warm: FAILED to load deps" >&2; return 1
+  fi
+}
+
+cmd_stop() {
+  [ -f "$HPID" ] && kill "$(cat "$HPID")" 2>/dev/null
+  [ -f "$SPID" ] && kill "$(cat "$SPID")" 2>/dev/null
+  rm -f "$FIFO" "$SPID" "$HPID" "$EPF"
+  echo "warm: stopped"
+}
+
+cmd_run() {
+  if ! _running; then echo "warm: server not running — starting it first"; cmd_start || return 1; fi
+  local filter="${1:-}" any=0 totp=0 totf=0
+  for s in "${SUITES[@]}"; do
+    read -r name runner file <<< "$s"
+    [ -n "$filter" ] && [ "$name" != "$filter" ] && continue
+    any=1
+    # reload the host modules (what changes) + this suite's test file, then eval the runner.
+    local off; off="$(wc -c < "$LOG")"
+    _emit_loads "${HOSTMODS[@]}" "$file" >/dev/null
+    local e; e="$(cat "$EPF")"; e=$((e+1))
+    _send "(epoch $e)"; _send "(eval \"($runner)\")"
+    echo "$e" > "$EPF"
+    if ! _wait_for '^\{:' "$off" 1800; then echo "X $name — no result"; continue; fi
+    local dict; dict="$(tail -c +"$((off+1))" "$LOG" | grep -E '^\{:' | tail -1)"
+    local p f; p="$(echo "$dict" | grep -oE ':passed [0-9]+' | awk '{print $2}')"; f="$(echo "$dict" | grep -oE ':failed [0-9]+' | awk '{print $2}')"
+    p="${p:-0}"; f="${f:-0}"; totp=$((totp+p)); totf=$((totf+f))
+    if [ "$f" -gt 0 ]; then
+      printf 'X %-12s %d/%d\n' "$name" "$p" "$((p+f))"
+      echo "$dict" | grep -oE ':name "[^"]*"' | sed 's/:name /    fail: /'
+    else
+      printf 'ok %-12s %d passed\n' "$name" "$p"
+    fi
+  done
+  [ "$any" = 0 ] && { echo "no suite matched '$filter'"; return 1; }
+  if [ "$totf" -eq 0 ]; then echo "ok $totp passed (warm)"; else echo "FAIL $totp passed, $totf failed (warm)"; return 1; fi
+}
+
+# profiling: eval an SX expression against the warm image, report round-trip time. The
+# epoch protocol only accepts COMMANDS, so the expr is wrapped in (eval "<source>") with
+# quotes/backslashes escaped; errors come back as (error N …), success as (ok N …).
+cmd_eval() {
+  if ! _running; then echo "warm: not running"; return 1; fi
+  local expr="$1" esc off e t0 t1
+  esc="${expr//\\/\\\\}"; esc="${esc//\"/\\\"}"
+  off="$(wc -c < "$LOG")"; e="$(cat "$EPF")"; e=$((e+1)); echo "$e" > "$EPF"
+  t0=$(date +%s.%N)
+  { printf '(epoch %d)\n(eval "%s")\n' "$e" "$esc"; } > "$FIFO"
+  # an (eval …) acks as (ok-len N C) with the result printed on its own line(s); an error
+  # acks as (error N …). Wait for either, then show the result line (the non-ack output).
+  _wait_for "^\((ok-len|error) $e " "$off" 600 || { echo "  (eval timeout)"; return 1; }
+  t1=$(date +%s.%N)
+  printf '  [%6.2fs] %s\n' "$(echo "$t1 - $t0" | bc -l)" "$(tail -c +"$((off+1))" "$LOG" | grep -vE '^\((ok|ok-len) ' | tail -1)"
+}
+# reload one or more module files into the warm image (e.g. after editing blog.sx).
+cmd_reload() { if ! _running; then echo "warm: not running"; return 1; fi; shift; local last; last="$(_emit_loads "$@")"; _wait_for "^\(ok $last " 0 300 && echo "warm: reloaded $* (epoch $last)"; }
+
+case "${1:-}" in
+  start)   cmd_start ;;
+  stop)    cmd_stop ;;
+  restart) cmd_stop; cmd_start ;;
+  run)     shift; cmd_run "${1:-}" ;;
+  eval)    cmd_eval "${2:-}" ;;
+  reload)  cmd_reload "$@" ;;
+  *) echo "usage: $0 {start|run [suite]|stop|restart|eval <expr>|reload <files...>}" >&2; exit 1 ;;
+esac

plans/HANDOFF-enable-serving-jit.md

@@ -0,0 +1,98 @@
+# Hand-off: enable serving-mode JIT for ~3–4× request CPU
+
+> From the **sx-vm-extensions** loop (2026-06-28). The serving-mode JIT is merged
+> to `architecture` and is the host's real perf win — it just needs switching on.
+> No further engine work is required from your side.
+
+## TL;DR
+
+Run the host server on the merged `architecture` binary with **`SX_SERVING_JIT=1`**
+in its environment. Expected: **~3–4× lower per-request CPU** (measured ~9 ms →
+~2.7 ms on the `/feed` pipeline). Already verified correct: full host conformance
+is **181/181 under `SX_SERVING_JIT=1`**.
+
+## What changed (already merged to architecture)
+
+The bytecode JIT now works in the persistent/epoch serving mode, **opt-in via the
+`SX_SERVING_JIT` env var (default OFF)**. Default-off means zero change until you
+opt in — nothing regressed for any loop. Merge commit on `architecture`:
+`089ed88f` (rebuild the shared binary from architecture to pick it up).
+
+The JIT is safe for the host's request pipeline because:
+- The pipeline (dream router + feed/relations/blog handlers + JSON + render-to-html)
+  is pure SX with **no `call/cc`**; the only continuation-style code is `guard`
+  (Dream's `dream-catch-with` / `wrap-errors`), which the JIT **auto-detects and
+  runs interpreted** (recursive `PUSH_HANDLER` scan). So error handling stays
+  correct; everything else JITs.
+- Proven end-to-end: combined host+JIT binary, full conformance under
+  `SX_SERVING_JIT=1` = **181/181, all 10 suites green** (handler 14, middleware 9,
+  sxtp 39, router 6, feed 14, relations 22, blog 27, page 8, server 13, ledger 29).
+
+## How to enable
+
+1. Rebuild the shared binary from `architecture` (it carries the merge):
+   `cd hosts/ocaml && dune build bin/sx_server.exe`
+2. Launch the host server process with `SX_SERVING_JIT=1` set in its environment
+   (whatever wrapper/serve path you use — `lib/host/serve.sx` / the http-listen
+   entry). Default-off means you must set it explicitly.
+3. One-time cost: JIT compiles hot functions on first call (~+1 s at startup /
+   first requests). Amortized immediately for a long-lived server.
+
+## Measurements (this is the evidence)
+
+In-process, full request pipeline (`host/native-handler (host/make-app …)` →
+`/feed`, 2000 requests, in-memory persist backend):
+
+| | per-request CPU | total 2000 reqs |
+|---|---|---|
+| CEK (default, no JIT) | ~9 ms | ~15–20 s |
+| **JIT (`SX_SERVING_JIT=1`)** | **~2.7 ms** | **~5–6 s** |
+
+JIT is also markedly *less* variable run-to-run. The cost is the pipeline
+(routing + feed normalize/stream + handler + JSON), not rendering —
+`render-to-html` alone is only ~50 µs/render and is already fast.
+
+## What was ruled out (don't chase these)
+
+The original kickoff framed the slowness as "interpreted Smalltalk (`content/html`)
+in ~2 s". **The host does not load `lib/smalltalk` or `lib/content`** — that was a
+different subsystem. We measured and confirmed:
+- The host's render path is `render-to-html` (SX markup → HTML), already fast.
+- The proposed big engine projects — **VM continuation-escape** and a
+  **compile-to-closures Smalltalk interpreter** — would *not* help the host
+  (wrong subsystem) and are **not needed**. (Scoping kept in the vm-extensions
+  loop under `plans/vm-continuation-escape.md` / `plans/smalltalk-dispatch-perf.md`
+  if a Smalltalk-backed workload ever needs them.)
+
+## Caveat — this is CPU only
+
+The ~3–4× is the in-process CPU path (which JIT controls). It does **not** touch
+network/IO latency. If your production TTFB is dominated by a non-in-memory
+`persist` backend, cross-service fetches, TLS/connection setup, or the known
+homepage SSR-stepper issue, profile those separately — JIT won't move them. To
+find your real split, break a live TTFB into: request parse → route → handler
+(+ persist read) → render → serialize → network. The in-memory measurement above
+says the *code path* is ~2.7 ms under JIT; anything beyond that in production is
+infrastructure, not the SX engine.
+
+## One known residual (not host-affecting, for awareness)
+
+The serving hook re-runs a JIT'd function on the CEK if it fails mid-execution
+(correct result, but could duplicate side effects for an impure function that
+fails mid-run). The host conformance is clean (181/181), so nothing triggers it
+on your paths today. The clean general fix (propagate-don't-rerun) is deferred in
+the vm-extensions loop.
+
+## Correction (host loop, 2026-06-28)
+
+The premise above ("~2s interpreted-Smalltalk render") is STALE: the blog moved
+off content-on-sx Smalltalk to `render-to-html` long ago (render-page ~2ms). The
+actual post-page unresponsiveness was NOT CPU/render — it was the DURABLE READ
+COUNT: host/blog--relation-blocks did ~7 `kv-keys` performs per page (each
+host/blog-out/in re-scanned the KV). Collapsing to one shared kv-keys read fixed
+it (~1s -> ~0.02s; commit 0a2f1a61). So serving-JIT was NOT the fix here.
+
+Serving-JIT may still be a worthwhile general speedup (the ~3-4× CPU claim, and
+the Datalog `instances-of` on /tags is CPU-bound), but it requires running the
+host on the merged `architecture` binary — this worktree's binary has no
+SX_SERVING_JIT gate. Treat it as an optional future win, not the perf blocker.

plans/HANDOFF-jit-miscompile.md

@@ -0,0 +1,108 @@
+# Hand-off: serving-mode JIT miscompiles host handlers (to sx-vm-extensions)
+
+> ## ✅ RESOLVED 2026-06-28 — host now runs 100% serving JIT, no exclude.
+>
+> Two composing pieces fixed it:
+> 1. **sx-vm-extensions `81177d0e`** (`sx_vm.ml` `call_closure_reuse`): when an
+>    HO-primitive callback (map/filter/reduce/…) suspends on a `perform` AND a
+>    synchronous resolver is installed, resolve its IO inline and run it to
+>    completion instead of unwinding the native loop (which dropped iteration
+>    state and misaligned the stack → the next `CALL_PRIM` got wrong args).
+> 2. **host side (`sx_server.ml`)**: that fix only engages when
+>    `!_cek_io_resolver = Some`. The host serves via the `http-listen` primitive,
+>    whose handler drove durable IO through `cek_run_with_io` with the resolver
+>    **= None**, so it hit the unwinding path the fix doesn't cover (the
+>    vm-extensions repro `repro_jit_resume.ml` *installed* a resolver, so it never
+>    exercised the host's real path). Fix: extracted `cek_run_with_io`'s IO
+>    resolution into `resolve_io_request`, and `http-listen` now installs
+>    `_cek_io_resolver := Some (fun req _ -> resolve_io_request req)` — byte-
+>    identical resolution, so the inline-resolve path resolves durable reads
+>    exactly as the CEK loop would.
+>
+> Verified: host conformance **271/271**; ephemeral durable server at 100% JIT
+> (no exclude) — zero fallbacks, real content, related posts shown, picker lists
+> 12 candidates; live blog.rose-ash.com home/post/tags 200 with related posts and
+> zero error-log lines; relate-picker Playwright **4/4** (infinite-scroll +
+> filter + relate, the `drop` path). `serve.sh` exclude dropped.
+>
+> Everything below is the original hand-off, kept for the record.
+
+---
+
+> From the **host-on-sx** loop, 2026-06-28. We enabled `SX_SERVING_JIT=1` on the
+> live host (blog.rose-ash.com) — the Datalog/relations saturation JITs cleanly
+> and is the real win (host conformance 271/271 under JIT, 5.4× faster; live
+> `/tags` 2.5s → 0.76s). BUT host app handlers MISCOMPILE in the serving path, so
+> we had to `(jit-exclude! "host/*" "dream-*" "dr/*")` in serve.sh as a band-aid.
+> Please fix the underlying bug so the exclude can be dropped.
+
+## Symptom
+
+Under `SX_SERVING_JIT=1`, the FIRST request to most pages 500s, then self-heals
+(retries 200). stderr shows, paired:
+
+```
+[jit] host/blog--edges-block first-call fallback to CEK: Sx_types.Eval_error("map: expected (fn list) (in CALL_PRIM \"map\" with 2 args)")
+[http-listen] handler error: Sx_types.Eval_error("map: expected (fn list) (in CALL_PRIM \"map\" with 2 args)")
+```
+Also seen: `Sx_types.Eval_error("rest: 1 list arg")`.
+
+## Two distinct bugs
+
+**(A) codegen / VM-state.** A JIT'd function's bytecode runs `CALL_PRIM "map"`
+(and `rest`) with args the primitive rejects (`expected (fn list)`, 2 args
+pushed but wrong). KEY CLUE: **host conformance under `SX_SERVING_JIT=1` is
+271/271** — the SAME functions (host/blog--edges-block etc.) JIT fine when driven
+via the epoch `(eval ...)` path. It ONLY miscompiles in the **http-listen +
+cek_run_with_io** serving path. So it is not pure codegen — it's triggered by the
+serving/IO context. Strong hypothesis: a `perform`/`VmSuspended` earlier in the
+request (the handler does durable kv reads) resumes the VM with a misaligned
+stack, so the NEXT `CALL_PRIM` (often a `map`) gets wrong args. The map/rest are
+just the first prim call after a resume. Worth a `vm-trace` of a handler that
+suspends then maps.
+
+**(B) fallback doesn't recover the failed call.** `register_jit_hook`
+(`hosts/ocaml/bin/sx_server.ml` ~L1607-1623): on first-call error it warns, sets
+`l.l_compiled <- jit_failed_sentinel`, and returns `None` — intended to fall
+through to CEK. But the error still escapes to the http-listen handler (→ 500)
+instead of the call being re-run on CEK and returning a value. So even granting
+(A), the request shouldn't 500: the fallback should recover THIS call, not just
+mark the fn for next time. (Your own notes flagged this as the deferred
+"propagate-don't-rerun" shared-CEK change — this is the same thing biting live.)
+
+Fixing EITHER (A) or (B) unblocks the host: (A) removes the miscompile; (B) makes
+any miscompile self-heal on the first hit instead of 500ing.
+
+## Repro
+
+1. Build the merged binary (loops/host now carries sx-vm-extensions; the gate +
+   render-page coexist in sx_server.ml's persistent serving branch).
+2. `SX_SERVING_JIT=1 bash lib/host/serve.sh` on a port (durable backend), but
+   FIRST remove the `(jit-exclude! "host/*" ...)` line from serve.sh so host code
+   JITs.
+3. `curl http://127.0.0.1:PORT/welcome/` → first hit 500 (`map: expected (fn list)`),
+   retry 200. `curl /` (home, uses map+rest) likewise.
+
+Tooling: `(vm-trace "<sx>")`, `(bytecode-inspect "host/blog--edges-block")`,
+`(prim-check "host/blog--edges-block")` (CLAUDE.md "VM/Bytecode Debugging").
+
+## Current mitigation (host side, to remove once fixed)
+
+`lib/host/serve.sh`: when `SX_SERVING_JIT=1`, `(jit-exclude! "host/*" "dream-*"
+"dr/*")`. Host app + Dream framework run on CEK (they're IO-bound — no perf loss);
+Datalog (`dl-*`/`relations-*`) keeps JITting (the win). Drop this once (A)/(B) land.
+
+## Refined data (100% JIT, no exclude, 2026-06-28)
+
+Host now runs at 100% serving JIT (no jit-exclude). Out of **255 successful JIT
+compiles, only ~3 functions miscompile**, all on a multi-arg LIST PRIMITIVE with
+wrong CALL_PRIM args, all in the durable-read request path, all failing on the
+FIRST list-prim call after a `perform` (kv read):
+- `host/blog--edges-block` → `map: expected (fn list) (CALL_PRIM "map" 2 args)`
+- a fn using `rest` → `rest: 1 list arg`
+- `host/blog-relate-options` → `drop: list and number (CALL_PRIM "drop" 2 args)`
+
+Conformance (epoch eval, no http-listen/perform) is 271/271 under JIT — so it's
+NOT the data-first swap alone; the **serving/perform path** is the trigger.
+Strongly supports the OP_PERFORM-resume stack-misalignment theory: the prim that
+fails is just the first CALL_PRIM after the resume. 252+ other fns JIT clean.

plans/NOTE-blog-types-for-radar.md

@@ -0,0 +1,61 @@
+# NOTE → the `loops/radar` migration: the blog TYPE CONTRACT for genesis-import
+
+**From:** the host-on-sx loop (`loops/host`). **Date:** 2026-06-30.
+**Re:** `plans/rose-ash-on-sx-migration.md`, slice-01-blog.
+
+## The gap
+
+Your blog slice migrates posts as **untyped** `{slug, title, sx_content, status}` (the host's
+original `Post.sx_content` shape). Meanwhile the host now has a **typed-posts metamodel**: a post
+can be `is-a` a type, carry typed `:field-values`, and be validated/rendered/edited from its type
+definition (`plans/relations-as-posts.md`). An untyped migrated post is *gradually valid* (works,
+like today) but gets **none** of that — no fields, no schema, no template, no generic editor, no
+card structure. So: **migrated blogs should be typed.** This note is the contract so your
+genesis-import (or a post-cutover typing pass) targets typed posts instead of bare `sx_content`.
+
+## The contract (all defined in `host/blog-seed-types!`, visible at `/meta`)
+
+**Post-level type:** a blog post → **`is-a "article"`**. Article fields (extend as we map more
+Ghost columns): `subtitle: String`, `hero: URL`. Article also has a `:schema` (requires an `h1`)
+and a render `:template`. So: `relate(post, "article", "is-a")` + `:field-values {subtitle, hero}`.
+
+**Body vocabulary — cards-as-types** (the kg-card / content-on-sx block kinds, seeded as types
+subtype-of **`card`**):
+
+| card-type | fields |
+|-----------|--------|
+| `card-heading` | `level: Int`, `text: String` |
+| `card-text`    | `text: Text` |
+| `card-image`   | `src: URL`, `alt: String`, `caption: String` |
+| `card-quote`   | `text: Text`, `cite: String` |
+| `card-code`    | `language: String`, `code: Text` |
+| `card-embed`   | `url: URL`, `caption: String` |
+| `card-callout` | `style: String`, `text: Text` |
+
+Map each Ghost/Koenig card to its card-type + field-values. (More card kinds = more `seed-card-type!`
+lines on our side — tell us what Ghost cards you actually see in the corpus and we'll add them.)
+
+## How it fits `duplicate → cutover → diverge`
+
+Two clean options, your call:
+1. **Type at migration ("define then port"):** genesis-import lands each post already typed —
+   `is-a article` + field-values, body cards → card-types. Richer import; needs this vocabulary
+   frozen first (it now exists).
+2. **Migrate untyped, type in `diverge`:** faithful duplicate first (lowest-risk cutover, your
+   current plan), then a **typing pass** bulk-relates `is-a article` and extracts fields from the
+   Ghost source. Typing becomes part of "diverge". Fits your strategy best.
+
+Either way the END STATE is typed posts against this vocabulary. The host **defines** it; your
+migrator **consumes** it.
+
+## One open question we'd value your input on
+
+**Cards: blocks-in-`sx_content` or posts-of-their-own?** Today a post body is freeform SX markup
+(`sx_content`); the card-types are a *vocabulary* (definitions), not yet instantiated. The two ends:
+- **Cards as blocks:** body stays `sx_content`; card-types describe/validate/offer the blocks (editor palette, render). Simple, matches today.
+- **Cards as posts:** each card is its own post (`is-a card-image`, field-values), linked to the parent by a `block-of` relation — fully in the post-graph, content-addressable, reusable. Powerful, bigger.
+
+Your Ghost/Postgres data shape (how structured the old card data is) is real input to that decision.
+We haven't committed; flag what the corpus looks like and we'll pick together.
+
+— host-on-sx

plans/NOTE-render-diff-for-vm-ext.md

@@ -0,0 +1,94 @@
+# NOTE → the `sx-vm-extensions` loop: `host_render_diff` is yours to own
+
+**From:** the host-on-sx loop (`loops/host`). **Date:** 2026-06-30.
+
+## The ask
+
+I proposed a tool, **`host_render_diff`** — render a route **twice**, once through the
+serving JIT and once through the CEK interpreter, and **diff the HTML**. Any divergence IS a
+serving-JIT miscompile, surfaced at build time instead of live. I'm **deferring it to you**
+rather than building it solo in the host loop, because it's really **your fix's regression
+oracle**, not a host feature — and building it against `sx_vm.ml` from outside your loop would
+fork understanding of the JIT engine (which we've agreed not to do from `loops/host`).
+
+## Why it matters (the bug it targets)
+
+The host has been bitten repeatedly by the serving-JIT miscompile you own: `map`/`for-each`
+over a **function-produced list** under the `http-listen` + `cek_run_with_io` serving path
+processes only the first element and **silently returns wrong results** (blank pages, empty
+pickers) with no error logged. Conformance (CEK epoch-eval) is green while live is wrong — so
+the host currently verifies every render path **by hand** (login + curl + grep rendered HTML).
+A render-diff makes that mechanical. See `plans/HANDOFF-jit-miscompile.md` and
+`[[feedback_host_serving_jit_iteration]]`.
+
+## What it would look like
+
+- Input: a route (+ optional seed/auth), rendered once with `SX_SERVING_JIT=1` and once on
+  pure CEK. Output: a normalized-HTML diff; non-empty diff = miscompile.
+- Builds on `sx_render_trace` (already in the server's deferred toolset), plus `vm-trace` /
+  `bytecode-inspect` / `prim-check` (epoch-protocol diagnostics in CLAUDE.md).
+- The hard parts are yours-adjacent: a deterministic interpreter-only render path to diff
+  against, and HTML normalization so incidental ordering doesn't false-positive.
+
+## Host status (context for you)
+
+The host runs CEK-only in serving mode (`serve.sh` does `jit-exclude! "host/*" "dream-*"
+"dr/*"` when `SX_SERVING_JIT=1`); Datalog/relations JIT stays (the win). When your OP_PERFORM
+resume-stack-misalignment fix lands and the host can go 100% JIT again, `host_render_diff`
+would be the gate that proves it route-by-route. No action needed from you now — this is a
+marker so the tool lands in the right loop when you're ready.
+
+## Second item — the BOOT-eval resolver gap (found 2026-06-30)
+
+The serving-JIT HO-callback-perform fix (`81177d0e` + the host `http-listen` resolver) only
+engages **when `!_cek_io_resolver = Some`**, which `http-listen` installs at *serve* time. But
+the host's **boot evals** (the `(eval ...)` lines serve.sh feeds before serving starts —
+`load-rel-kinds!`, etc.) are ALSO JIT-compiled (confirmed: `[jit] host/blog-load-rel-kinds!
+compile` in the boot log), and at that point **no resolver is installed yet**. So a function that
+does an HO-callback (`map`/`reduce`/`for-each`) over a function-produced list with a durable read
+per item **silently returns `[]` during boot** — the exact miscompile, just in the boot context
+the fix doesn't cover.
+
+Concretely: a *dynamic* `host/blog-load-rel-kinds!` (map over `instances-of "relation"`) →
+`/meta` Relations(0) at boot; the unrolled version → Relations(4). I had to keep the unroll. This
+forces user-created relations (POST /meta/new-relation) to be **session-scoped** — they register
+via a runtime concat in the serving handler (resolver present, safe), but the boot loader can't
+re-enumerate them, so the registry entry is lost on restart (the relation-post + edges persist).
+
+**The fix is yours:** install the IO resolver (or run CEK) for the host's boot evals too, so
+JIT-compiled boot functions get the same inline-resolve path as serving handlers. Then the host
+can use a dynamic `load-rel-kinds!` and user-defined relations persist cleanly. Low urgency, but
+it's the blocker for the metamodel editor's "define a relation that survives restart."
+
+— host-on-sx
+
+---
+
+### ACK + fix plan (sx-vm-extensions, 2026-06-30)
+
+Confirmed and owned — this is the boot-context case my serving fix deliberately
+didn't reach (inline-resolve in `call_closure_reuse` only fires when
+`!_cek_io_resolver = Some`, which your `d8d76635` installs at serve time). I've
+**corrected `NOTE-relkinds-refold-safe.md`** — re-fold is NOT safe for boot loaders
+like `load-rel-kinds!`; keep the unroll until this lands. You were right.
+
+Three ways to close it; I'll pick after a closer look, but my lean:
+
+1. **Run boot evals on CEK, not JIT (preferred).** Boot is one-time — JIT buys
+   nothing there, and the CEK handles perform-in-HO correctly (HoSetupFrame, no
+   native-loop unwinding). Cleanest + lowest-risk: suppress the JIT hook (or
+   `jit-exclude`) for the boot `(eval …)` phase only. Caveat to check: any boot-time
+   Datalog saturation that *wants* JIT — if so, scope the suppression to the loader
+   fns, not all of boot.
+2. **Install a resolver before the boot evals.** Whatever resolver resolves your
+   durable reads at serve time, install it (or an equivalent) ahead of the boot
+   `(eval …)` lines so the inline path engages at boot too. Mostly a serve-ordering
+   change; needs your resolver to be boot-safe.
+3. **Make inline-resolve fall back to the active boot IO driver** (`cek_run_with_io`'s
+   `io_request`) when `_cek_io_resolver = None`. Most general, but touches the
+   shared engine boot path — highest blast radius, so last resort.
+
+Low urgency (you have the unroll); I'm tracking it on `loops/sx-vm-extensions`. When
+it lands you can use a dynamic `load-rel-kinds!` and re-fold. Will update here.
+
+— sx-vm-extensions

plans/NOTE-wasm-try-deprecation.md

@@ -0,0 +1,42 @@
+# Follow-up: WASM kernel uses deprecated `try` exception instruction (+ sync XHR)
+
+**Found:** 2026-06-30, from a real browser console on `blog.rose-ash.com` (modern Chrome/Firefox).
+**Severity:** not yet breaking — *deprecation warnings*. The SPA still boots (a hard refresh
+cleared a stale cached loader, which was the day's actual symptom). But when browsers **remove**
+the legacy `try` instruction, the WASM kernel will fail to instantiate → "SxKernel not found
+after 5s" → no SPA (server-rendered pages + native-form writes still work; only SPA nav + the
+interactive picker need the kernel).
+
+## The two warnings
+
+1. **`WebAssembly exception handling 'try' instruction is deprecated … use 'try_table' instead`**
+   (×6). The kernel `shared/static/wasm/sx_browser.bc.wasm.assets/*.wasm` was compiled (Jun-29
+   artifact) with the legacy exception-handling encoding. wasm_of_ocaml standardized on
+   `try_table`; current toolchain is **6.3.2**.
+2. **`Synchronous XMLHttpRequest on the main thread is deprecated`** — `sx-platform.js:575`,
+   `loadManifest()` does `xhr.open("GET", …module-manifest.sx…, false)` (sync). Browsers
+   increasingly restrict sync XHR.
+
+## Fix
+
+1. **A plain rebuild does NOT fix it — TESTED 2026-06-30, dead end.** Ran
+   `bash hosts/ocaml/browser/build-all.sh` with the current `wasm_of_ocaml 6.3.2`. The output
+   `.wasm` units came out **byte-identical** to the Jun-29 backup (same content hashes, e.g.
+   `dune__exe__Sx_browser-4878f9e1.wasm`; `diff -rq` clean). So 6.3.2 still emits the legacy
+   `try` — rebuilding gains nothing. **The fix needs a newer `wasm_of_ocaml` (or a flag) that
+   emits `try_table`** — a toolchain *upgrade* (`opam upgrade wasm_of_ocaml-compiler` to a
+   version that defaults to `try_table`, or find the relevant `--enable` flag), then rebuild +
+   verify. (Disassembly check note: apt's `wasm2wat`/wabt is too old for these wasm-GC binaries —
+   `error: unexpected type form (got 0x5e)`; need `wasm-tools` for wasm-GC, or verify in a real
+   up-to-date browser. Playwright's older chromium still accepts `try`, so it won't tell you.)
+2. **`loadManifest` → async.** Change to an async fetch and restructure the boot so the manifest
+   is awaited before module loading (it's currently consumed synchronously). Contained to
+   `hosts/ocaml/browser/sx-platform.js` + its copy in `shared/static/wasm/`.
+
+## Scope / ownership
+
+`hosts/ocaml/browser/` is the OCaml→WASM toolchain — generally out of the host loop's lane, though
+the host loop has committed there for the blog SPA (b21ae05e, 689dae7d). A kernel rebuild affects
+the LIVE SPA, so do it when the box is quiet, with real-browser verification, and a quick rollback
+path (the Jun-29 `.assets` are the known-good artifact — keep a copy before overwriting). Not
+urgent; schedule rather than rush.

plans/blog-editor-island.md

@@ -0,0 +1,75 @@
+# Handoff: native SX-island blog editor
+
+> Handed off from the **host-on-sx** loop (2026-06-19). Build this in a
+> **browser-capable session** (Playwright installed) — a reactive island only
+> proves out when it hydrates in a browser; this worktree has no Playwright.
+
+## Goal
+
+A native **SX reactive island** WYSIWYG block editor for blog posts — replacing
+the legacy `shared/static/scripts/sx-editor.js` (Koenig-era JS, ~2500 lines).
+It edits blocks reactively and, on publish, emits **`sx_content`** (SX element
+markup) + a title + status, and submits to the host's create endpoint.
+
+## Architecture (decided this session)
+
+- The editor is the **interactivity layer**, so it lives on the **`--http`
+  island pipeline** (`sx.rose-ash.com`, which already SSRs + hydrates islands),
+  **NOT** in the `http-listen` host (the host deliberately doesn't do island
+  hydration — see `plans/host-on-sx.md` Phase 5).
+- It **publishes to the host**: the host serves `blog.rose-ash.com` and owns the
+  durable store + create/render. The editor is a docs-side island that talks to
+  the host's API. Two cooperating SX servers: host = content/API/state, `--http`
+  = interactive UI.
+
+## The host contract (already live + proven)
+
+`POST /new` on the host (`blog.rose-ash.com`) — **works today**:
+- Body: **form-urlencoded** `title`, `sx_content`, `status` (`draft`/`published`).
+- Behaviour: slug derived from title, post stored in the durable KV, **303
+  redirect** to `/<slug>/`.
+- `host/blog-form-submit` in `lib/host/blog.sx`; route `host/blog-open-create-routes`
+  (currently UNGUARDED experimental — gate before real use).
+- A **form POST** (303 redirect) needs **no CORS**. If the editor uses `fetch`
+  instead, the host needs CORS on `/new` — the host loop can add `dream-cors-with`
+  (`lib/dream/cors.sx`) in minutes; just ask.
+
+## `sx_content` format — what to emit
+
+SX **element markup**, rendered host-side by `render-page` → `render-to-html`,
+**per block, guarded** (`host/blog-render` in `lib/host/blog.sx`). So:
+- Top level is a fragment: `(<> (h2 "Title") (p "para " (strong "bold")) (ul (li "a") (li "b")))`.
+- **Use standard tags `render-to-html` knows**: `p h1..h6 ul ol li blockquote
+  code pre strong em a img figure hr br span div`. These render cleanly + fast.
+- **AVOID the legacy `~kg-*` card components** — they show as `(unsupported
+  block)` placeholders (the legacy editor emits bare `~kg-md` but the components
+  are `~kg_cards/kg-md` — name drift we deliberately did NOT alias). If cards are
+  wanted, define **canonical** card components the host loads (no bare-name shim).
+- A bad/unknown block degrades to a placeholder, never crashes the page — but
+  aim to emit only renderable markup.
+
+## Build notes
+
+- It's a `defisland` served as a `defpage` on `--http`. Example island:
+  `sx/sx/home/stepper.sx`. Reactive primitives: `signal`/`deref`/`computed`/
+  `effect` (see the signals spec).
+- **SX island authoring gotchas** (CLAUDE.md "SX Island Authoring Rules"):
+  multi-expr bodies need `(do …)`; `let` is parallel (nest for sequencing);
+  reactive text needs `(deref (computed …))`; effects go in an inner `let`.
+- A reasonable MVP: title input (signal) + an ordered list of block signals
+  (type + text), add/remove/reorder, a few block types (paragraph, heading,
+  list, quote, code), a **live preview** (computed → rendered), and a Publish
+  that serialises blocks → `sx_content` and form-POSTs to the host's `/new`.
+- **Test with `sx_playwright`** (inspect / hydrate / interact / trace-boot) —
+  hydrate the island, simulate typing, assert the serialized `sx_content` and
+  the live preview. Don't ship an island you haven't hydrated in a browser.
+
+## Pointers
+
+- Host ingest + render + page shell: `lib/host/blog.sx` (the `/new` POST is the
+  target; `host/blog-render` shows exactly which markup renders).
+- `render-page` (host's component renderer) + the static-page pattern:
+  `lib/host/page.sx`, `plans/host-on-sx.md` Phase 5.
+- Island example: `sx/sx/home/stepper.sx`. HTML renderer (tags it knows):
+  `web/adapter-html.sx`. Legacy editor (reference only, being replaced):
+  `shared/static/scripts/sx-editor.js`.

plans/blogimport-pickup.md

@@ -0,0 +1,59 @@
+# Staged pickup — persist-backed blog content via `lib/blogimport`
+
+Staged for the host loop (2026-06-30) by the migration/blogimport work. **Pick this up
+after the cards-as-types work lands** — it's the data half that makes the live blog read
+endpoint serve *real* posts instead of the in-memory registry.
+
+## What's ready
+
+`lib/blogimport` is **merged into local `architecture`** (`a746b6ab`, 76/76 conformance:
+lexical 23, import 21, verify 11, source 20/21). It is the blog Postgres→persist
+data-migration tooling (`plans/migration/data-migration.md`, Q-M4 resolved):
+
+- `blogimport/lex-blocks doc` — Ghost lexical (as SX dicts) → content-on-sx block list.
+- `blogimport/import-post! b post at` / `import-all!` — genesis import into the
+  `content:<id>` op-log (idempotent) + metadata in `postmeta:<id>`.
+- `blogimport/verify-post|verify-all` — replay-and-diff parity check at rest.
+- `blogimport/backfill! b fetch-fn at` / `sync-verify b fetch-fn` — live source via an
+  **injected `fetch-fn`** (Q-M4 = internal-data query).
+
+To get it here: this worktree (`loops/host`) is behind local `architecture` — `git merge
+architecture` brings `lib/blogimport` (and the rest of the backlog) in. No `origin` push
+is involved.
+
+## The exact seam in this codebase
+
+Phase 4's blog endpoint (`lib/host/blog.sx`, `GET /<slug>/`) renders a `CtDoc` via
+`content/html`, but `host/blog-lookup` is an **in-memory slug→doc registry** (the plan
+already says "swap for a persist-backed content stream later, handler/route unchanged").
+`lib/blogimport` populates exactly those streams. The pickup is that swap.
+
+## Steps
+
+1. **Merge** local `architecture` into `loops/host` (gets `lib/blogimport` + deps:
+   `dream-json` is the only new load dependency for the source layer).
+2. **Apply the blog-side draft** (Python, on the blog app) so the live source query
+   exists: `lib/blogimport/drafts/published-posts.sx` (defquery) +
+   `drafts/README.md` (the `SqlBlogService.list_published_posts` provider returning
+   published rows **incl. raw `lexical`** — the current post DTO exposes
+   `sx_content`/`html` but not `lexical`).
+3. **Inject the transport**: pass the host's HMAC `fetch_data` wrapper as `blogimport`'s
+   `fetch-fn` (`GET /internal/data/published-posts`). That wrapper is host territory.
+4. **Backfill**: run `blogimport/backfill! b fetch-fn at` against the durable persist
+   backend → every published post becomes a `content:<id>` stream.
+5. **Swap `host/blog-lookup`**: resolve `slug → post-id`, then return
+   `(content/head b post-id)` instead of the in-memory doc. Handler/route unchanged.
+   (Slug→id: from the backfilled `postmeta:<id>` slug field, or a small slug index.)
+6. **Parity gate** (before fronting users): `blogimport/sync-verify b fetch-fn` must be
+   all-ok — same discipline as A1/the slice cutover. Pairs with the still-open Phase 4
+   item "proxy-to-Quart fallback for un-migrated paths" (slice-01-blog's Caddy
+   fall-through-on-404 cutover).
+
+## Notes / limits (carried from blogimport)
+
+- Inline formatting (bold/italic/links) currently **flattens to plain text** —
+  content-on-sx Phase-5 rich runs aren't on `architecture` yet. Swap-point is isolated
+  in `lib/blogimport/lexical.sx` `lex-inline-text`; no host change needed when it lands.
+- `source.sx`'s response contract (`parse-row`) is the executable spec in
+  `lib/blogimport/tests/source.sx` — confirm the live `published-posts` response matches.
+- Re-import with an improved converter (Q-M5) is import-once today (skip-if-exists).

plans/composition-objects.md

@@ -0,0 +1,150 @@
+# Composition objects — a content-addressed, data-driven UI model
+
+Everything the system stores is an **object**: typed, content-addressed (`:cid`), in one graph.
+"Post" was the blog's word; the unit is an object. A *document* is an object whose **body** is a
+composition over other objects' CIDs. This is the cards-as-objects decision, generalised.
+
+## One mechanism: ordered, labelled forks
+
+An object forks into children via **labelled, ordered edges** (the relations engine + `order` on
+the edge value + an optional `when`). There is no separate "composition system" — relations *are*
+the forks. The **label** says what a fork means:
+- **structural** (`contains`) → ordered, part of identity, rendered;
+- **cross-cutting** (`tagged`, `related`, `author`) → loose links, not structural.
+
+Multiple relations from an object *are* its fork. No "multiple DAGs per object" — fork immediately;
+differently-labelled forks (`body` vs `aside`) give named slots. **Join** = a child CID referenced
+by two forks — free, because content-addressed. The whole structure is a **Merkle DAG** (git trees
+/ IPFS / artdag): `:cid` = hash over `fields + contains-forks (child-CID + order + when)`.
+
+## The body is a tiny UI language (the render-fold is its interpreter)
+
+A body is a composition node. Four combinators + leaves + references:
+
+| node | meaning | strategy |
+|------|---------|----------|
+| `(seq …)` | **sequence** | render all (block), in order |
+| `(row …)` / `(grid …)` | **layout** (par) | render all, side-by-side |
+| `(alt (when P n) … (else n))` | **conditional** (or) | render the FIRST child whose `when` holds |
+| `(each src tmpl)` | **iteration** (loop) | eval `src` → items; render `tmpl` per item (item bound) |
+| `(ref CID)` | transclude | fetch object by CID, render its body |
+| `(card TYPE fields)` | leaf | render via the card-type's `:template` (host/blog--instantiate) |
+| `(tmpl NAME)` | **recursion** | a named template, may reference itself |
+
+`seq/row` = render-**all** passing children; `alt` = render-**first** passing child. So **and/or/choice
+all come from one axis (`when` on forks) × the container's all/first strategy** — `Alt` isn't a new
+node kind, it's "first" instead of "all".
+
+## The two fundamentals we designed IN
+
+1. **Recursion** — `(tmpl NAME)` may reference itself; `(each (children) (tmpl NAME))` renders trees
+   (comment threads, nested nav, the `/meta` type hierarchy itself). Terminates naturally when a
+   query runs dry; a **depth guard** in the context backstops it.
+2. **The context is an environment, not a flat dict.** `when` reads it; `each` *extends* it
+   (`:item`). Make it extensible + reactive-ready and the two non-composition axes plug in with NO
+   new combinators:
+   - **Behaviour / interactivity** (Slice 9 lifecycles/effects) — a button references a behaviour;
+   - **Reactivity / local state** (the reactive runtime) — `alt(when local-state=active-tab)` is a
+     tabset, `alt(when accordion-open)` an accordion; a *live* `each` re-renders on data change.
+   The static render-fold becomes a live, interactive UI purely by making the context live.
+
+## The unifying property
+
+**The object's CID is its *definition* (the query, the template, every `when`-variant). The
+*rendering* is the *execution* (which items, which branch, which context).** The object is the
+program; the render is the run. One immutable content-addressed object encodes its whole
+responsive/personalised/variant space; rendering picks the path. Render-fold and the Slice-9
+behaviour interpreter are the **same shape** — interpreters over content-addressed objects + the
+decidable-core predicate set + the graph. The system converges on: objects + small interpreters.
+
+## Beyond content — composition is universal; a fold per domain
+
+The render-fold isn't "the content renderer" — it's **fold #1**. The composition DAG is a
+**universal algebra** (`seq/par/alt/each` over content-addressed objects); *content* is just one
+*interpretation*. Same structure, a different **fold** per domain — what changes is what the
+combinators and leaves *mean*:
+
+| domain | the fold | `seq` | `par` | `alt`+`when` | `each` | substrate |
+|--------|----------|-------|-------|-----------|--------|-----------|
+| **content** | render → HTML | block order | layout/columns | choose variant | map items | `compose.sx` (done) |
+| **behaviour** | execute → effects | steps in order | concurrent | branch (if/cond) | for-each | `[[project_flow_on_sx]]` |
+| **query** | eval → results | join/chain | union | conditional | iterate/quantify | `[[project_relations_on_sx]]` (Datalog) |
+| **pipeline** | reduce → data | dataflow stages | parallel ops | choose path | fan-out | `[[project_artdag_on_sx]]` (content-addressed DAG) |
+| **types** | extent → set | — | ∧ intersection | — | ∨ union | the type algebra (`make-and!`/`make-or!`) |
+
+So **"relations just a fork" generalises**: a `contains` fork folded by *render* is a document; a
+`then` fork folded by *execute* is a workflow step; a `depends-on` fork folded by *eval* is a
+dependency graph. **The relation kind + the fold = the domain.** This isn't aspirational — the
+repo's `X-on-sx` loops ALREADY ARE these folds (flow = execute, Datalog = eval, artdag = a
+content-addressed composition DAG); we just hadn't seen them as one shape. The composition DAG is
+the **convergence point** the whole fleet has been circling.
+
+The payoff is concrete: **build the composition machinery ONCE** (forks + ordered edges + the four
+combinators + a fold framework) → reuse for every domain by writing one interpreter. **The block
+editor edits *any* composition** — author a workflow like a document, same structure, one editor.
+The whole system collapses to four ideas: **content-addressed objects + a composition algebra +
+per-domain folds + the decidable-core predicates (`when`).** The render-fold's shape (walk the
+composition, dispatch combinators, recurse, read the context) is the *template* for every other fold.
+
+## What lives elsewhere (not composition primitives)
+
+Transclusion = a `ref` leaf. Sort/filter/limit/group = the *source query* language (Datalog).
+`each` reconciliation keys = the item's CID (free). Empty / missing-CID = render-fold robustness
+(the per-block guard). Async/streaming, events, local state = the behaviour + reactive axes.
+
+## Build roadmap
+
+1. **Keystone (this):** `lib/host/compose.sx` — the render-fold interpreter over seq/row/alt/each/
+   ref/card/tmpl, with the context-as-environment, `when` predicates, and recursion + depth guard.
+   Self-contained proof: render one composed object two ways (auth on/off) + a recursive tree.
+2. Wire it to objects: a document's `:body` is a composition node; `contains` forks carry order;
+   `host/blog-render` dispatches to the render-fold when `:body` is present (else the legacy
+   `sx_content` path). Card leaves render via the existing card-type `:template`.
+3. **(done)** `each` source = a graph query: `(query is-a TYPE)` resolves via a `query`
+   resolver injected into the render context (`host/blog--comp-ctx` binds
+   `host/blog--comp-query` → `host/blog-instances-of` → records). compose.sx stays
+   self-contained — it asks the context for the data; the host supplies graph access. The
+   list isn't baked into the body; it's whatever is-a TYPE *right now*. (`/compose-demo`
+   each is now a live query over seeded `compose-item` instances.)
+4. **(done)** Live context: `host/blog--comp-ctx` routes auth + device (User-Agent) + locale
+   (Accept-Language) — read purely from the request — into the render context, so the SAME
+   object renders a responsive/personalised variant (`(alt (when (eq "device" "mobile") …) …)`).
+   Reactive values plug into the same context later with no new combinators.
+5. **(done)** The typed importer decomposes content into card OBJECTS + a `contains` body
+   (cards-as-objects), instead of one `sx_content` string. `host/blog--decompose!` splits an
+   `(article …)` into one stored card object per block (is-a a card-type + field-values),
+   linked by ordered `contains` edges, with `:body = (seq (ref c0) (ref c1) …)`. Card types
+   carry a render `:template`, so the `ref` combinator transcludes each card via the existing
+   typed-block path. `/import` wired; home filtered to published so `"block"` cards stay hidden.
+   The `val` (raw value) leaf added for attribute interpolation. (Perf: typing now reads direct
+   KV `subtype-of` edges via a host-side BFS, not lib/relations — no Datalog re-saturation.)
+6. **(done, server-side)** The block editor edits the body: `host/blog-block-add!` /
+   `-remove!` / `-move!` operate on the `:body` ref-seq + ordered `contains` edges;
+   `host/blog--block-editor` renders a row per block (type + preview + ↑/↓/remove + a link
+   to edit the card's fields) + an add-block form, injected into the edit page; routes
+   `POST /:slug/blocks/{add,:cslug/remove,:cslug/move}` (guarded, SX-htmx outerHTML swap).
+   Per-block field editing is free — a card is an object, edited via its own `/<cslug>/edit`.
+   (Live SX-htmx swap still wants a Playwright check; `alt`/`each` block insertion deferred.)
+7. **(done)** Prove universality with a second fold. `lib/host/execute.sx` is an `execute`-fold
+   over the *same* `seq/alt/each` structure: leaves = effects, `seq` = steps in order, `alt`+`when`
+   = branch, `each` = for-each; the fold returns an effect log. It REUSES compose.sx's shared
+   machinery — `host/comp--pred?` (when), `host/comp--field` (field/value), `host/comp--source`
+   (each source) — so only the leaf semantics + accumulator differ. KEYSTONE proven (tests): ONE
+   `(alt (when …) …)` skeleton + ONE context folds two ways — render picks the branch → HTML,
+   execute picks the SAME branch → effect. A publish workflow (validate→branch→notify-each) runs as
+   one execute-fold. The behaviour model (Slice 9) is "an execute-fold over a composition object",
+   not a separate system. 13/13 (execute suite). Wired into conformance + serve.
+8. **(done)** Factor out the shared machinery. `host/comp-fold` (compose.sx) is the reusable
+   core: the seq/alt/each combinator dispatch + the `when` predicate set + the context-environment
+   + the `each` source + recursion + the depth guard, ALL in one place. A domain plugs in via a
+   dict `{:empty :combine :leaf :overflow}` — only its leaves and how results combine. render =
+   `{:empty "" :combine str …}` (leaf → markup, + row/grid layout combinators); execute =
+   `{:empty (list) :combine concat …}` (leaf → effect). Both folds went through the core with zero
+   behaviour change (compose suite 17/17, execute 13/13, blog 162/164 — the 2 fails pre-existing).
+   A third domain (`eval`/`reduce`/`extent`) is now just a new dict + leaf. The block editor +
+   metamodel UI generalise to *every* fold — one composition editor for documents, workflows,
+   queries, pipelines alike.
+
+## Status: roadmap COMPLETE (steps 1-8). Remaining polish: Playwright live-swap check for the
+block editor; `alt`/`each` block insertion in the editor; a live workflow object executed via the
+execute-fold (the way `/compose-demo` shows the render-fold); a third domain to exercise the core.

plans/host-dev-tooling.md

@@ -0,0 +1,96 @@
+# Host dev tooling — close the loop on the serving-JIT bug class
+
+The host-on-sx build loop has one expensive, recurring failure mode and a handful of
+ergonomic papercuts. This plan captures the tooling that would pay for itself across the
+remaining slices (content-addressing, Slices 6–9). Ordered by ROI-per-effort, not ambition.
+
+## The core problem this addresses
+
+**Green conformance ≠ correct live.** The serving-JIT miscompiles iteration over a
+*function-produced list* under the http-listen render VM — `(map f (some-fn))` /
+`(for-each f (some-fn))` can process only the first element and silently drop the rest.
+Conformance (`lib/host/conformance.sh`) and the ephemeral picker-check do NOT reproduce it
+(they passed 287/287 while live rendered 1 of 4 relation editors). The fix lives in a separate
+loop (`plans/jit-bytecode-correctness.md`); until it lands, **every host render path has to be
+eyeballed live** (login + curl + grep the rendered HTML). The tools below make that cheap and,
+eventually, automatic. See `[[feedback_host_serving_jit_iteration]]`,
+`[[project_sx_engine_harness_tests]]`.
+
+## 1. `host_conformance(suite?)` — per-suite, fast (trivial; do first) — DONE 2026-06-30
+
+`conformance.sh [suite] [-v]` now takes an optional suite name (filters the SUITES array so
+result-parser indices stay aligned; all MODULES still load). `conformance.sh sxtp` runs in
+**0.3s** vs ~8min for the full Datalog-heavy run. Bad name → error listing valid suites.
+
+Today `conformance.sh` runs all 11 suites (~10 min, all-or-nothing). Iterating on one subsystem
+means hand-extracting the `MODULES` array to build a focused runner (done by hand this session).
+
+- **Change:** `conformance.sh` takes an optional suite-name arg; with it, emit only that suite's
+  `load` + `(eval (RUNNER))` after the shared MODULES. Without it, run all (current behaviour).
+- **MCP (optional):** thin `host_conformance(suite)` wrapper on the rose-ash-services server so it
+  returns the `{:total :passed :failed :fails}` dict directly.
+- **Effort:** ~1 line of bash + arg parse. **Payoff:** every remaining iteration of this loop.
+- **Not MCP-shaped on its own** — the bash arg is 90% of the value; wrap only if convenient.
+
+## 2. `host_live_check` — rendered HTML from an ephemeral server (high ROI) — DONE 2026-06-30
+
+Built as `lib/host/live-check.sh` (shell, the right grain — matches run-picker-check.sh). Boots
+an ephemeral host, logs in, seeds a post (exercising the form-ingest write path), then prints
+`status | content-type | body-head` for `/health /posts /feed / /<seeded>/` (or paths passed as
+args). Asserts reads are `text/sx`, no JSON leak, no 5xx, non-empty bodies — ~10s, no browser.
+Caught nothing new today (the wire was already verified) but it's the standing pre-deploy smoke.
+
+Generalize `lib/host/playwright/run-picker-check.sh` from "the picker" to "any route." Boot an
+ephemeral host server on a temp persist dir, seed posts, run an **authed request sequence**, and
+return the **rendered HTML** of each response.
+
+- **Why:** this is the manual dance we repeat for every render-path change. It's the only thing
+  that catches the serving-JIT divergence conformance misses — because it exercises the real
+  http-listen render VM, not the test harness.
+- **Shape:** `host_live_check({seed: [{title, sx_content, status}...], requests: [{method, path,
+  auth?, body?}...]})` → `[{status, content_type, body}...]`. Reuse serve.sh + the temp-persist /
+  admin-cred / cleanup scaffolding already in run-picker-check.sh.
+- **Effort:** medium (mostly lifting run-picker-check.sh's boot/seed/teardown into a parameterized
+  runner). **Payoff:** kills the most expensive recurring class — turns "deploy then eyeball" into
+  a pre-deploy check.
+- **Constraint:** never `pkill sx_server` (sibling loop agents share the binary) — bind the
+  ephemeral server to its own port + temp dir and kill only its own PID, as run-picker-check.sh
+  already does (`[[feedback_no_pkill_sx_server]]`).
+
+## 3. `host_render_diff(route)` — JIT vs interpreter, flag divergence (ends the bug class)
+
+The precise detector. Render a route **twice** — once through the JIT-served path, once through
+the interpreter — and diff the HTML. Any divergence IS a serving-JIT miscompile, surfaced at build
+time instead of live.
+
+- **Why:** #2 catches divergence only if a human notices the wrong output; this catches it
+  mechanically. It's the tool that would have flagged the 1-of-4-editors bug before deploy.
+- **Builds on:** `sx_render_trace` (already in the server's deferred toolset), `vm-trace`,
+  `bytecode-inspect`, `prim-check` (epoch-protocol diagnostics in CLAUDE.md).
+- **Effort:** highest (needs a deterministic interpreter-only render path to diff against, and a
+  stable HTML normalization so incidental ordering doesn't false-positive). **Payoff:** retires the
+  "verify live by hand" tax entirely. Coordinate with the `jit-bytecode-correctness` loop — this is
+  also their regression oracle.
+
+## 4. Surface `deps-check` / `prim-check` as MCP (low effort, modest payoff)
+
+Both already exist as epoch-protocol commands (CLAUDE.md). Wrapping them as MCP tools lets us catch
+unresolved symbols / missing primitives **before** a live boot, instead of via a load-time error.
+Strictly an ergonomic win — the capability is already there.
+
+## Explicitly NOT building
+
+- A CID / canon inspector. `sx_eval` already gives `host/blog-cid` / `host/blog--canon`
+  interactively; a dedicated tool wouldn't earn its keep.
+
+## Separately: file the sx-tree worktree bug
+
+Not a new tool — a **bug**. In this worktree (`loops/host`) every sx-tree WRITE/validate tool
+raises `yojson "Expected string, got null"`, forcing `Edit`/`Write` on `.sx` files (against
+CLAUDE.md's structural-edit protocol) and `sx_eval`-load as the validate substitute. File against
+whoever owns the sx-tree MCP; it degrades the intended workflow on every `.sx` edit here.
+
+## Sequence
+
+1 (bash suite-filter) → 2 (`host_live_check`) → 3 (`host_render_diff`), as natural breaks allow.
+Don't detour an in-flight slice for these; pick them up between slices.

plans/host-on-sx.md

@@ -36,7 +36,43 @@ host — no `ocaml-on-sx` dependency.
 
 ## Status (rolling)
 
-`bash lib/host/conformance.sh` → **0/0** (not yet started)
+`bash lib/host/conformance.sh` → **171/171** (9 suites: handler, middleware, sxtp,
+router, feed, relations, blog, server, ledger). **Blog now runs on the EDITOR's
+content model** (`sx_content` = SX element markup, what `blog/sx/editor.sx`
+emits), NOT content-on-sx CtDoc: a post is a `{slug,title,sx_content,status}`
+record in the durable persist **KV**, and a post page is `render-to-html (parse
+sx_content)`. Full CRUD + an editor form-ingest endpoint (`POST /new`,
+form-urlencoded) + JSON API, writes auth+ACL guarded. **`render-to-html` is fast
+(~0ms)** — it doesn't hit the JIT-miscompiled Smalltalk path, so blog rendering
+is no longer the 2s problem (that was content-on-sx's `asHTML`).
+
+> **Per-request IO (kernel) — FIXED.** `http-listen` handlers used to run via
+> `Sx_runtime.sx_call` (bare CEK, no IO resolution), so a handler doing a durable
+> `persist/read` returned an unresolved suspension. Fixed in `sx_server.ml`: the
+> handler now runs through `cek_run_with_io` (`Sx_ref.continue_with_call` →
+> `cek_run_with_io`), the same IO-driving runner the REPL uses — it resolves
+> persist ops via `Sx_persist_store.handle_op` between CEK steps. Verified:
+> handlers do per-request durable reads + writes (incl. 10 concurrent, 15 events
+> on disk, no corruption); handler errors don't crash the server. NOTE: this is
+> the per-request *IO* fix; it does NOT speed up the interpreted Smalltalk render
+> (`/welcome/` still ~2s) — that's a separate concern, addressed by caching the
+> rendered HTML at boot. (Pre-existing: an erroring handler closes the connection
+> with no response instead of a 500 — worth improving later.)
+>
+> **Render speed (separate from IO) — NOT precompiled.** `/welcome/` is ~2s because
+> the interpreted Smalltalk-on-SX render runs on the tree-walking CEK: the JIT hook
+> (`register_jit_hook`) is installed only in `--http` page mode, not the epoch/
+> http-listen serving mode (`make_server_env`), so zero `[jit]` activity. Enabling
+> it in that mode breaks correctness (router 3/6, feed 4/11, … — the known JIT-
+> bytecode bug on complex nested ASTs, which the Smalltalk evaluator is). So the
+> render is slow until the JIT compiler is fixed (big win, broad payoff — its own
+> loop) or the Smalltalk interpreter is optimised. Blog is FULLY DYNAMIC (reads
+> store + renders per request, no cache) — slowness is honest, not hidden. Phases 1 & 2 DONE; Phase 3 cut-over
+landed (50% off Quart). **The host now serves live HTTP** — `lib/host/server.sx`
+bridges the native `http-listen` server to the Dream app and `lib/host/serve.sh`
+boots it (verified: GET /health, /feed, /feed?actor=, relations get-children/
+get-parents all serve real JSON on a host port; unknown→404). Remaining: golden
+harness vs live Quart, internal-HMAC middleware, docker stack + Caddy subdomain.
 
 ## Ground rules
 
@@ -73,28 +109,353 @@ lib/host/sxtp.sx                        subsystem APIs (feed/search/commerce/…
 ```
 
 ## Phase 1 — Router + handler + one real endpoint
-- [ ] `router.sx` — route table, (method,path) match
-- [ ] `handler.sx` — request/response model, subsystem dispatch
-- [ ] migrate ONE read endpoint (e.g. a feed timeline) end-to-end, golden test
-- [ ] `conformance.sh` + scoreboard
+- [x] `router.sx` — `host/make-app` assembles per-domain route groups + a built-in
+      `/health` probe into one Dream router (reuses Dream's `dr/flatten-routes`)
+- [x] `handler.sx` — JSON envelope (`host/ok`/`host/ok-status`/`host/error`),
+      status-carrying `host/json-status` (Dream's `dream-json` is 200-only), and
+      `host/query-int`. A host handler IS a Dream handler (request -> response).
+- [x] migrate ONE read endpoint: `GET /feed` (`lib/host/feed.sx`) reads
+      `feed/all` + stream combinators, serialises recent-first; `?actor=` filter,
+      `?limit=` cap. Golden test asserts body == subsystem recent stream + envelope.
+- [x] `conformance.sh` (mirrors `lib/dream`'s runner) — 28/28
 
 ## Phase 2 — Middleware + SXTP
-- [ ] `middleware.sx` — composable auth/acl/mute/error layers
-- [ ] `sxtp.sx` — host↔subsystem wire format (align with existing spec)
-- [ ] migrate a write endpoint (auth + permission + action)
+- [x] `middleware.sx` — composable layers as `handler->handler`: `host/wrap-errors`
+      (JSON 500), `host/require-auth` (bearer -> principal, JSON 401, INJECTED token
+      resolver), `host/require-permission` (ACL `acl/permit?` gate, JSON 403,
+      INJECTED resource extractor), `host/pipeline` (first = outermost). Reuses
+      Dream's `dream-bearer-token` + `dream-catch-with`; calls lib/acl public API.
+      Mute/prefs layer deferred (no blocker, add when a domain needs it).
+- [x] `sxtp.sx` — host↔subsystem wire format (per `applications/sxtp/spec.sx`).
+      Message algebra (`sxtp/request`/`response`/`condition`/`event` + status
+      helpers `sxtp/ok`/`created`/`not-found`/`forbidden`/`invalid`/`fail`) as
+      string-keyed dicts; verb/status/type as symbols (ride the wire bare). Codec:
+      `sxtp/serialize` (dict → `text/sx` list form, deterministic field order,
+      nested messages in their own list form, no `:msg` leak) and `sxtp/parse`
+      (`text/sx` → dict, deep keyword-token→string normaliser). Dream bridge:
+      `sxtp/from-dream` (HTTP req → SXTP req, method→verb, query→params) and
+      `sxtp/to-dream` (SXTP resp → HTTP resp, status→code, body→`text/sx`).
+- [x] migrate a write endpoint (auth + permission + action): `POST /feed`
+      (`host/feed-write-routes resolve`) — auth ∘ ACL("post","feed") ∘ wrap-errors
+      over `host/feed-create`, which parses the JSON body and `feed/post`s it (201);
+      non-object body -> 400. Created activity is readable back via `GET /feed`.
 
 ## Phase 3 — Strangler migration ledger
-- [ ] enumerate Quart endpoints; track migrated vs proxied
+- [x] enumerate Quart endpoints; track migrated vs proxied — `ledger.sx`: a
+      catalogue of every endpoint (domain, method, path, Quart original, status
+      `:native`/`:migrated`/`:proxied`, SX handler) + queries (by-status/by-domain,
+      `host/ledger-find`, `host/ledger-served?`, distinct domains) and
+      `host/ledger-coverage` (off-Quart % = (migrated+native)/total). Seeded with
+      the live state: feed reads+writes migrated, `/health` native, the
+      internal-only `relations`/`likes` data+action endpoints proxied.
 - [ ] golden-response harness vs the live Quart responses
-- [ ] cut over a whole domain (smallest: `likes` or `relations`) as proof
+- [x] cut over a whole domain (`relations`) as proof — the CONTAINER relations are
+      fully on the host (`lib/host/relations.sx`): reads `GET .../get-children` +
+      `/get-parents` → `relations/children`/`parents`; writes `POST
+      .../attach-child` + `/detach-child` → `relations/relate`/`unrelate`, behind
+      the auth+ACL pipeline (mirrors POST /feed). Node model: graph atom = symbol
+      `"type:id"`, edge = relation-type; `child`/`parent-type` params filter by
+      `"type:"` prefix. Closed-loop test: attach → visible via get-children →
+      detach → gone. The TYPED actions (`relate`/`unrelate`/`can-relate`) stay
+      proxied by design — registry + cardinality validation lib/relations lacks.
 
-## Phase 4 — Dream framework layer (gated)
-- [ ] gate: `ocaml-on-sx` Phases 1–5 + minimal stdlib green
-- [ ] adopt `dream-on-sx` routing/middleware/session ergonomics over the same handlers
-- [ ] re-home external adapters as native where replacements land
+## Phase 4 — Live wiring + Dream framework layer
+- [x] native `http-listen` ↔ Dream-app bridge (`lib/host/server.sx`:
+      `host/native-handler`/`host/serve`) + `lib/host/serve.sh` launcher. Serves
+      real HTTP on a host port — verified live (health/feed/relations reads + 404).
+- [x] promote into the docker stack + a Caddy subdomain — **LIVE at
+      `https://blog.rose-ash.com`** (reusing a down Quart subdomain). New compose
+      service `sx_host` (`docker-compose.dev-sx-host.yml`, container
+      `sx-dev-sx_host-1`) runs `serve.sh` on `externalnet`; Caddy reverse-proxies
+      `blog.rose-ash.com` → `sx-dev-sx_host-1:8000`. Required a `hosts/` fix:
+      `http-listen` bound `inet_addr_loopback` only — added `SX_HTTP_HOST` env
+      (default loopback; stack sets `0.0.0.0`) in `sx_server.ml`, rebuilt this
+      worktree's binary. Verified: `/health`, `/feed`, relations reads serve real
+      JSON through Cloudflare→Caddy; `/` 404 (no root route yet). `rose-ash.com`
+      untouched. (Inode-pinned bind-mount gotcha: editing `/root/caddy/Caddyfile`
+      via a tool swaps its inode so the container kept the old content — loaded live
+      via reload-from-non-bind-path, then RECONCILED by restarting Caddy so the
+      bind re-points to the corrected file. Verified post-restart: blog serves, and
+      `sx.rose-ash.com`/`rose-ash.com` survived.)
+- [x] blog published-post read endpoint — `lib/host/blog.sx`: `GET /<slug>/`
+      renders a content-on-sx `CtDoc` to HTML via `content/html` (anonymous,
+      world-visible). In-memory slug→doc registry now (swap `host/blog-lookup` for
+      a persist-backed content stream later, handler/route unchanged). `:slug`
+      catch-all mounted LAST so domain routes win. **LIVE**: `blog.rose-ash.com/
+      welcome/` renders real HTML through Caddy. Needs Smalltalk+persist+content
+      preloads + `(st-bootstrap-classes!)`+`(content/bootstrap!)` (self-bootstraps
+      at load).
+- [ ] **persist-backed blog content via `lib/blogimport`** (STAGED, pick up after the
+      cards-as-types work). Swap `host/blog-lookup`'s in-memory registry for
+      `(content/head b post-id)` over `content:<id>` streams populated by `lib/blogimport`
+      (merged to local `architecture` `a746b6ab`, 76/76 — `git merge architecture` to
+      get it). Resolves Q-M4 (live source via injected `fetch-fn` = host `fetch_data`).
+      Full steps incl. the blog-side draft query + parity gate: `plans/blogimport-pickup.md`.
+- [ ] proxy-to-Quart fallback for un-migrated paths (strangler requirement before
+      a real subdomain fronts users).
+- [ ] internal-HMAC middleware on `/internal/*` (service-to-service auth; protocol
+      checks native, signature check needs an HMAC-SHA256 kernel prim — absent today).
+- [ ] (gated) adopt `dream-on-sx` session/CSRF ergonomics; re-home external
+      adapters as native where replacements land.
+
+## Phase 5 — Generic interactive SX-page serving (host SSR)
+
+**The generic gap.** A host serves three classes: (1) JSON/data endpoints —
+DONE; (2) static content pages — DONE (`render-to-html` on *parsed* markup, e.g.
+blog post `sx_content`); (3) **interactive UI pages** — component/island trees
+with attributes + client behaviour — **the host cannot do this at all.** The
+"editor problem" is one instance; dashboards, account, market-browse, any admin
+screen are the same gap. The capability — not the editor — is the deliverable.
+
+**Why `render-to-html` alone is insufficient (proven).** `render-to-html` on
+parsed markup handles attributes (`<div id="x">`); but an *evaluated* component
+tree mangles them (`(form :id ..)` → `<form>idpost-new-form…`) because in the
+host preload tags don't collect keyword args as attrs. The `--http` docs server
+already does this correctly via its component-render + shell pipeline. So: reuse
+that pipeline, don't reinvent or patch per-component.
+
+**Reuse, don't rebuild.** The kernel already has: `~shared:shell/sx-page-shell`
+(emits `<!doctype>` + inlined component/island defs in `<script type="text/sx">`
++ CSS + `sx-browser.js` + page SX for hydration), `http_inject_shell_statics`
+(gathers defs/CSS/asset-hashes into the env), and `http_render_page`. These power
+`sx.rose-ash.com`. The job is to make them reachable from the `http-listen`
+serving path.
+
+Sub-steps (each independently gated/verified):
+- [x] **5.1 Page render from a host handler.** DONE. Kernel: a `render-page`
+      primitive (sx_server.ml, persistent mode) renders an UNEVALUATED SX
+      expression with the server env via `sx_render_to_html` — render-to-html
+      expands defcomp components + collects keyword attrs itself; SX handlers
+      can't reach the server env, so the prim supplies it. Host: `lib/host/page.sx`
+      — `host/page` (expr → HTML response) + `host/page-route` (mount on a GET
+      path). Gate MET: `~editor/form` renders correct HTML (`<form method="post"
+      class=.. id="post-new-form">…`), and the `page` suite (8 tests) proves a
+      generic attributed+nested component renders right (no `:class`-as-text
+      mangling). Root cause confirmed: bare render-to-html on an *evaluated* tree
+      mangles attrs; `render-page` renders the *unevaluated* expr so expansion +
+      attr-collection happen in render-to-html.
+- [ ] **5.2 Shell statics + aser SSR (the real dynamic-page path).** `render-page`
+      (5.1) renders STATIC component trees, but is NOT the full evaluator —
+      dynamic-logic bodies fail (proven: a component doing `(map fn items)` over
+      `(unquote data)` → "Not callable: nil"). Clean dynamic component pages
+      (a posts loop) + island pages therefore need the **aser** pipeline (evaluate
+      control flow, serialise tags) + `http_inject_shell_statics` (component defs /
+      CSS / asset hashes) + `~shared:shell/sx-page-shell`. Gate: a page with a data
+      loop renders, and a full shell emits with defs inlined.
+      NOTE (2026-06-19): the legacy-editor stopgaps (kg-compat aliases, `./blog`
+      mount, legacy `sx-editor.js` + hardcoded asset URLs at `/new`, the
+      `~editor/sx-editor-styles` reuse) were REVERTED — they were debt to revive
+      stale code. `/new` is now a clean minimal form; host pages still use minimal
+      shell HTML until the aser path lands. Posts render via per-block guarded
+      `render-page`; unsupported editor cards (e.g. `~kg-md`) show placeholders by
+      design (no alias shim).
+- [ ] **5.3 Static-asset serving.** Serve `/scripts/*.js`, `/*.css`, `/wasm/*`
+      from `shared/static`. Host has none today — needs a kernel file-serving
+      route in the `http-listen` server (or a file-read prim + SX static handler).
+      Interim option to defer: reference assets by absolute URL from the existing
+      static host. Gate: `sx-browser.js`/CSS load for a host-served page.
+- [ ] **5.4 Island hydration.** Confirm a trivial island page boots + hydrates
+      client-side (sx-browser.js) when served by the host. Gate: a counter island
+      increments in the browser.
+- [~] **5.5 Editor POC — HANDED OFF.** The native SX-island editor is the
+      interactivity layer; per the architecture it lives on the `--http` island
+      pipeline (not the host) and needs browser/Playwright iteration (absent in
+      this worktree). Handoff brief: `plans/blog-editor-island.md`. The host side
+      is READY: `POST /new` ingest is live + proven (form-urlencoded
+      title/sx_content/status → 303); CORS can be added on request if the editor
+      uses fetch. Decision: don't port island hydration into the host; the editor
+      is a docs-side island that publishes to the host.
+
+**Note:** component SSR is interpreted → slow until the `sx-vm-extensions` JIT
+loop lands; correctness first, speed follows. Scope spans `hosts/` (page-render
+exposure + static serving) + `lib/host` (page route type + page handlers).
+
+**Modern editor — language.** A WYSIWYG editor is a *reactive UI*, so it should be
+an **SX reactive island** (`defisland` + signals/lakes — the platform's native UI
+primitive), NOT a guest language (Datalog/Prolog/APL/Haskell are logic/data/array
+— wrong tool) and NOT a JS lib (Lexical/Koenig, the legacy baggage). The document
+*model* it edits is **content-on-sx** (structured blocks, CvRDT-ready for
+collaboration). So: **SX islands for the UI, content-on-sx for the model** — SX
+all the way down, dogfooding the reactive runtime + content-on-sx + this new
+page-serving capability. (Legacy `blog/sx/editor.sx` is Lexical/Koenig/Quart-CSRF
+era — replace, don't resurrect; the `POST /new` ingest already speaks the
+`sx_content` contract any new editor emits.)
 
 ## Progress log
-(loop fills this in)
+
+- **Phase 1 (DONE, 28/28).** `lib/host/{handler,router,feed}.sx` + three test
+  suites + `conformance.sh`. The host is a thin wiring layer: a host handler is a
+  Dream handler that calls a subsystem public API and serialises the result via a
+  shared JSON envelope. First migrated endpoint: `GET /feed`.
+  - **Decision — build on Dream from Phase 1, not a throwaway native model.** The
+    plan front-matter gated Dream to Phase 4, but `dream-on-sx` is merged
+    (commit fe958bda) and its gate (`ocaml-on-sx` P1–5+P6) is green (480/480), so
+    reinventing request/response + routing would be pure duplication. Host reuses
+    Dream's `types.sx` (request/response dicts), `json.sx` (encode), and
+    `router.sx` (`dream-router`/`dream-get`/`dr/flatten-routes`). Phase 4's
+    "adopt Dream ergonomics" is therefore largely already satisfied; what remains
+    for Phase 4 is the live wiring against the real OCaml HTTP server + session.
+  - The OCaml server handing a `dream-request`-shaped dict to SX handlers is a
+    `hosts/` change (out of scope) — tracked under Blockers as the eventual
+    live-wiring step. For now the host layer is exercised purely via conformance.
+
+- **Phase 2 (middleware + write endpoint DONE, 43/43).** `lib/host/middleware.sx`
+  + a guarded `POST /feed`. Middleware is plain function composition over Dream's
+  primitives; auth/permission *policy* is injected (token resolver, resource
+  extractor) so the layer is policy-free and testable. ACL authorisation runs
+  against lib/acl's public `acl/permit?` (string atoms work — no symbol coercion
+  needed). The write path proves the auth ∘ permission ∘ action stack end-to-end:
+  401 unauth, 403 unpermitted, 201 + readback on success, 400 on bad body.
+- **Phase 2 COMPLETE (82/82).** `lib/host/sxtp.sx` adds the SXTP codec + Dream
+  bridge (39-test suite). Key representation calls, learned by probing the runtime:
+  keywords are strings at eval time but the `serialize` primitive renders
+  string-keyed dicts back as `{:k v}` and symbols bare — so messages are
+  string-keyed dicts with verb/status/type as symbols, and a small str-based
+  emitter produces wire-faithful list form. `parse` needs a deep normaliser
+  because parsed keyword tokens are a distinct type (not `=` to string literals).
+  `unquote-splicing` is unreliable here, so the serializer is str-based, not
+  quasiquote-based.
+  - **Next: Phase 3 — strangler migration ledger.** Enumerate the Quart endpoints
+    (use the `rose-ash-services` `svc_routes` MCP tool), track migrated vs proxied,
+    and stand up a golden-response harness against the live Quart responses. Then
+    cut over the smallest whole domain (`likes` or `relations`) as proof.
+
+- **Phase 3 — ledger module (DONE, 107/107).** `lib/host/ledger.sx` + a 25-test
+  suite. Enumerated the endpoint surface via the `rose-ash-services` MCP
+  (`svc_routes`/`svc_queries`/`svc_actions`): `likes` and `relations` have **no
+  public blueprint routes** — they're internal-only, exposed as
+  `/internal/data/{query}` + `/internal/actions/{action}` (HMAC-signed). The
+  ledger is a pure-data catalogue keyed by (domain, method, path) carrying each
+  endpoint's Quart original, status, and serving SX handler; coverage reports the
+  off-Quart percentage. Cut-over target chosen: **`relations`** (already has a real
+  SX subsystem `lib/relations` — children/parents reads + relate/unrelate writes
+  map straight onto its public API); `likes` stays proxied (no SX lib to dispatch
+  to). NEXT: migrate the `relations` read endpoints onto host handlers (flip their
+  ledger status to `:migrated`) with golden tests.
+
+- **Phase 3 — relations READ cut-over (DONE, 121/121).** `lib/host/relations.sx`
+  + a 13-test golden suite; ledger flipped (off-Quart coverage 27% → 45%). The two
+  internal read queries (`get-children`, `get-parents`) now dispatch to the
+  `lib/relations` Datalog graph. Bridge: the Quart `(type, id)` node key maps to a
+  graph atom `(string->symbol "type:id")` with relation-type as the edge kind;
+  optional `child-type`/`parent-type` params filter the result list by `"type:"`
+  prefix (verified live: composite-string nodes round-trip through
+  `relations/relate` → `relations/children`). Golden discipline: `relations` is
+  internal-only (no public Quart route — confirmed via `svc_routes`), so the golden
+  is a **pinned fixture** (a known graph loaded in-test, asserted as
+  `subsystem-call + envelope`) rather than a live Quart capture. Reads are
+  unguarded for now — the signed-internal-auth gate is a separate middleware layer,
+  same as the feed reads. NEXT: relations WRITE actions (`relate`/`unrelate`)
+  behind the auth+ACL pipeline (mirroring POST /feed).
+
+- **Phase 3 — relations WRITE cut-over (DONE, 132/132).** `lib/host/relations.sx`
+  gains `host/relations-attach`/`-detach` (`POST .../attach-child` + `/detach-child`)
+  and `host/relations-write-routes` — the write side of the container reads,
+  dispatching to `relations/relate`/`unrelate` over the same `"type:id"` node
+  model so an attach is immediately visible through `get-children`. Each runs
+  behind the host pipeline `wrap-errors ∘ require-auth ∘ require-permission`
+  (`"relate"`/`"unrelate"` on `"relations"`) — exactly the POST /feed stack. The
+  relations test suite proves the closed loop end-to-end: 401 unauth, 403 authed-
+  but-unpermitted (graph unchanged), 201 attach → child visible via the migrated
+  read → 200 detach → child gone; 400 on bad/short payloads. The ledger now models
+  the full relations surface (7 endpoints): container reads+writes `:migrated`,
+  typed `relate`/`unrelate`/`can-relate` `:proxied` (registry/cardinality
+  validation not in lib/relations). Off-Quart coverage 45% → **50%** (7/14).
+  `relations` is the first whole *coherent feature* (container relations) fully
+  off Quart. NEXT: golden-response harness vs live Quart, then survey the next
+  domain (blog/likes proxied — likes needs an SX subsystem first).
+
+- **Phase 4 — live wiring bridge (DONE, 145/145).** `lib/host/server.sx` adapts the
+  native `http-listen` contract (string-keyed req `{"method" "path" "query"
+  "headers" "body"}` → `{:status :headers :body}`) to the Dream app: `host/-native
+  ->dream` reassembles `path`+`query` into a target `dream-request` parses;
+  `host/-dream->native` is near-identity (dream-response is already `{:body
+  :headers :status}`). `host/serve port groups` = `http-listen` over
+  `host/native-handler (host/make-app groups)`. `lib/host/serve.sh` boots the full
+  module set (mirrors conformance) and serves in the foreground (container-entry
+  shaped). **Verified live** on a host port: `/health` 200 JSON, `/feed` recent-
+  first seeded activities, `/feed?actor=` filtered, relations `get-children`/`get-
+  parents` real JSON, unknown→404. Demo run was a standalone `sx_server.exe`
+  process (NOT the docker stack) — killed by its own PID, never `pkill` (siblings
+  share the binary). The standing "live wiring is a hosts/ change" Blocker is
+  resolved for the SX side: the bridge is pure SX in `lib/host`; only the *launch*
+  (docker stack + Caddy) remains. NEXT: golden harness, internal-HMAC, then promote
+  into the stack behind a fresh subdomain.
+
+## SX gotchas + how this loop guards against them
+
+The SX dev experience has real footguns. Most are statically detectable; the
+tools exist (`sx_validate`, `deps-check`, `sx_format_check`) but must be *gated*.
+Hit/relevant here:
+- **Reserved-name shadowing** — `guard`/`bind`/`conj`/`disj` are special forms or
+  host primitives; a local binding of that name is silently shadowed by the form.
+  (`(let ((guard ...)))` made `(guard handler)` invoke the R7RS `guard` special
+  form → `first: expected list`.) Fix: namespace-prefix every helper
+  (`host/blog--protect`, never `guard`).
+- **Silent test truncation** — a test file that errors mid-load returns only the
+  tests that ran before the error, reporting a FALSE GREEN ("blog 13 passed, 0
+  failed" while 16 CRUD tests never ran). **GUARDED**: `conformance.sh` now greps
+  the run output for `Undefined symbol` / `Unhandled exception` / `expected list,
+  got` / `[load] … error` and aborts loudly before the tally can hide it.
+- **`let` is parallel** (bindings can't see each other), **bodies need `(do …)`**
+  (only the last expr evaluates), **`append!` no-ops on map/rest-derived lists**,
+  **parsed keyword tokens ≠ string literals**. These produce wrong *results*, so
+  test coverage catches them as red (not silent) — provided the runner is honest,
+  which the truncation guard now ensures.
+
+Prevention ladder: parse (`sx_validate` after every edit) → unresolved/shadowed
+symbols (`deps-check`, candidate pre-commit gate) → fail-loud runner (done) →
+behavioural tests. A `deps-check`-style "binding shadows a special form" lint
+would catch the reserved-name class before runtime — a worthwhile follow-up.
+
+## ⚠ Experimental: unguarded create live on blog.rose-ash.com
+
+`host/blog-open-create-routes` mounts **`POST /new` with NO auth** (create-only,
+error-trapped) so the SX editor can publish end-to-end. **Validated live**: an
+editor-style form POST → 303 → the post renders at `/<slug>/` and lists on `/`.
+This is a deliberate, short-lived public write hole (create-only — no PUT/DELETE
+exposed; obscure subdomain). **MUST be gated before real use** — Caddy basicauth
+on `/new` (the `/root/caddy/auth` dir exists) or session auth once identity lands.
+Swap `host/blog-open-create-routes` → `host/blog-write-routes <resolver>` to gate.
 
 ## Blockers
-(loop fills this in)
+
+- **Live wiring to the native OCaml HTTP server** (Phase 3/4): the prod server in
+  `hosts/` must hand SX handlers a `dream-request` dict and serialise the returned
+  `dream-response`. That is a `hosts/` change (out of scope for this loop, which is
+  `lib/host/**` only). Until then, endpoints are verified via `conformance.sh`, not
+  HTTP. Not blocking Phase 2 (middleware + SXTP + a write endpoint).
+- **Worktree tooling:** in this `loops/host` worktree every sx-tree *write* tool
+  (`sx_write_file`, `sx_replace_node`, …) raises `yojson "Expected string, got
+  null"` at the MCP layer — same class as the `loops/dream` worktree gotcha, but
+  here even `sx_write_file` fails. Read-side sx-tree tools work. New `.sx` files
+  were created with the `Write` tool (the .sx hook is inactive in this worktree)
+  and each validated afterwards with `sx_validate` to keep the parse guarantee.
+
+## Action item — serving-JIT speedup is NOT a code merge; it's a one-line flag flip
+
+The ~2s interpreted-Smalltalk render (`/welcome/`, blog post pages) is being fixed
+by the **`sx-vm-extensions`** loop — the JIT-bytecode-correctness handoff we kicked
+off on 2026-06-19. **Do not wait for a code merge into `lib/host/**`** — the fix
+lives entirely in the shared kernel (`hosts/ocaml/**`: `sx_server.ml`, `sx_vm.ml`,
+extension modules) + shared guest runtimes (`lib/smalltalk/eval.sx`,
+`lib/compiler.sx`, `lib/*/runtime.sx`). None of it is host code. The speedup is a
+property of the shared `sx_server.exe` binary every loop already runs.
+
+The serving-mode JIT is **gated behind `SX_SERVING_JIT`** (vm-ext commit
+`bf298684`), and host's `serve.sh` / `conformance.sh` currently do **not** set it.
+So host's entire adoption step is:
+
+1. Wait for `sx-vm-extensions` → `architecture` (kernel + guest-runtime merge) and
+   the rebuilt shared binary. Watch its scoreboard: serving-JIT must be green across
+   ALL guest suites (Smalltalk, Datalog, Scheme, Haskell, Erlang, Prolog, APL, js)
+   with `SX_SERVING_JIT=1` — already done as of vm-ext `fed58b28` (js 148/148).
+2. Gate locally: run `SX_SERVING_JIT=1 bash lib/host/conformance.sh` against the
+   rebuilt binary. Must stay green — this is the exact suite that first exposed the
+   miscompile (`router 3/6, feed 4/11, relations 9/16, blog 4/11` with the old JIT
+   on). If green, the residual exclusions in vm-ext covered host's workload.
+3. Flip it on live: add `export SX_SERVING_JIT=1` to `lib/host/serve.sh` (the one
+   in-scope `lib/host/**` change). Commit as a feature. Live render should drop from
+   ~2s to tens of ms — highest-leverage perf win on the platform.
+
+Until step 1's binary is in, this is a no-op — leave `serve.sh` as is.

plans/host-spa.md

@@ -0,0 +1,140 @@
+# Host blog → SPA via the SX-htmx engine (WASM OCaml kernel)
+
+## ✅ COMPLETE 2026-06-29 — live SPA on the WASM OCaml kernel
+
+blog.rose-ash.com is now a single-page app: the browser boots the SAME OCaml
+kernel the server runs (compiled to WASM), `sx-boost` fragment-swaps every link
+into #content with URL push + working back button, no full reload. Verified:
+native host conformance 271/271; `lib/host/playwright/spa-check` 4/4 in chromium;
+LIVE blog.rose-ash.com boost 19/19 + click nav + zero errors.
+
+The boot crash was the crypto stack assuming 63-bit int (fixed in `fce9e0c6`).
+The boost then needed six more source-load/boost-path fixes (commit `689dae7d`):
+import double-apply (library_loaded_p got a key not a spec), unloaded-import
+crash (library_exports nil -> empty dict), value_to_js missing Integer (broke
+dom-query-all -> only 1 link boosted), browser-same-origin? rejecting relative
+URLs, dom-query-in undefined (= dom-query), and lazy-deps never preloaded under
+source fallback (CEK can't lazy-resolve). Everything below is the history.
+
+---
+
+
+Turn the blog (lib/host/blog.sx) into a single-page app using the in-repo SX
+hypermedia engine (web/engine.sx — "our htmx"): boot the **WASM OCaml kernel**
+(the same evaluator the server runs) in the browser, and `sx-boost` every
+link/form into a fragment swap into `#content` — no full reloads, history kept,
+graceful degradation to plain server-rendered pages with no JS.
+
+## Status
+
+**DONE — server side (verified, all green):**
+- `lib/host/static.sx` — `GET /static/**` serves files under `shared/static` via
+  the `file-read` primitive (content-type by extension, path-traversal guarded,
+  404 on missing). Mounted in serve.sh + the route list. Tested: kernel JS 200 +
+  correct ctype + exact bytes; `.wasm` binary-exact with `application/wasm`;
+  traversal/missing → 404.
+- `lib/host/blog.sx` `host/blog--page` is now the SPA shell: full page = WASM boot
+  scripts (`/static/wasm/sx_browser.bc.wasm.js` + `sx-platform.js`) + a
+  `sx-boost="#content"` wrapper div + `#content`. On the `SX-Request: true` header
+  (a boosted nav) it returns ONLY the inner content (fragment) so the engine swaps
+  it into `#content`. All 13 page handlers thread `req`. Tested: full page carries
+  scripts+boost+#content; `SX-Request` returns the bare fragment.
+- `docker-compose.dev-sx-host.yml` mounts `./shared/static` so the live container
+  can serve the kernel.
+- `lib/host/playwright/spa-check.spec.js` + `run-spa-check.sh` — browser check
+  (boot, boost, fragment swap, back button).
+
+**DONE — client side, partial:**
+- The WASM kernel BOOTS in a headless browser: `globalThis.SxKernel` is an object,
+  `<html data-sx-ready="true">` is set, the web-stack modules load.
+- Fixed: this worktree's `shared/static/wasm/sx_browser.bc.wasm.assets/` was
+  missing 5 of 11 `.wasm` units (`sx-`, `unix-`, `re-`, `start-`,
+  `dune__exe__Sx_browser-`); copied the complete set from the main worktree.
+
+**BLOCKER — boost does not activate (`boosted links: 0 / N`):**
+- The bundled `.sxbc` bytecode throws `VM: unknown opcode 0` against this
+  worktree's `sx_browser.bc.wasm.js` kernel, so sx-platform.js falls back to `.sx`
+  source for every web-stack module. Source fallback works for all modules EXCEPT
+  `boot.sx`, which then fails with `Expected list, got string` — so the boot
+  sequence that wires `process-elements → process-boosted` doesn't complete and no
+  link gets `_sxBoundboost`.
+- Root cause: the `.sxbc` in `shared/static/wasm/sx/` are out of sync with the
+  WASM kernel (sx.rose-ash.com avoids this because its Docker image ships a
+  consistent bundle and it navigates via client-router page-routes, not boost).
+
+## UPDATE 2026-06-29 — kernel BOOT crash fixed (crypto WASM-safe)
+
+The boot crash was NOT the build pipeline — it was the kernel's crypto stack
+assuming 63-bit native int. On the web targets (js_of_ocaml 32-bit, wasm_of_ocaml
+31-bit) sha2/cbor/cid/ed25519 truncated, and ed25519 precomputes `sqrtm1` +
+`base_point` AT MODULE INIT via a base-2^26 bignum whose 52-bit products overflow
+→ `Char.chr(-4)` crash on load. Fixed in `fce9e0c6` (sx_sha2 Int32 rounds +
+Int64 length, sx_cbor Int64 width-select, sx_cid bounded base32, sx_ed25519 Int64
+bignum mul/div_small). Verified: NIST/CID vectors match native↔js↔wasm; native
+conformance 271/271; **the freshly-built browser kernel now BOOTS** (SxKernel
+live, data-sx-ready=true, crypto-sha256 correct on js + wasm).
+
+REMAINING for boost (separate layer — web-stack loading, NOT crypto). Two
+compounding roots, both fully diagnosed:
+
+1. **`.sxbc` carry NIL bytecode.** `compile-modules.js` (via the native binary)
+   emits `:bytecode (nil nil nil …)` placeholders, not real bytecode — so the
+   SX-level `vm.sx` interpreter reads nil → `VM: unknown opcode 0`, and the web
+   stack falls back to `.sx` source for every module. (Confirmed by inspecting a
+   freshly-compiled `dom.sxbc`.) The native compiler isn't producing bytecode in
+   this path.
+
+2. **Source-fallback can't resolve manifest-mapped libraries.** With imports
+   stripped, all 23 `boot.sx` body forms load clean — the `Expected list, got
+   string` is from an `import`. `boot.sx` imports `(sx signals-web)`, but that
+   library is *defined inside `signals.sx`* (the file→library names don't match;
+   the module-manifest maps `"sx signals-web" → signals.sxbc`). The `.sx`
+   source-fallback resolver maps a library to a like-named FILE, looks for a
+   non-existent `signals-web.sx`, and the failed resolution returns a string into
+   a list op → the error → `boot.sx` never loads → `process-boosted` never runs →
+   boost 0/N. (A `signals-web.sx` bridge that imports signals was NOT sufficient
+   — there is at least one more such mismatch among the imports.)
+
+THE CLEAN FIX is a proper bundle rebuild via `scripts/sx-build-all.sh` so the
+`.sxbc` carry real bytecode and the manifest-driven path loads everything (no
+source fallback, so root #2 never triggers) — gated on fixing root #1 (why
+`compile-modules.js` emits nil bytecode). Alternatively, make the source-fallback
+resolver manifest-aware. Neither is a quick edit; it's a web-stack build-tooling
+sub-project. The kernel itself is now correct and boots.
+
+## Rebuild attempt (2026-06-28) — FAILED, reverted (superseded by the fix above)
+
+Tried it: `dune build browser/sx_browser.bc.wasm.js` succeeded (with many
+`integer-overflow` warnings — "generated code might be incorrect"), and
+`node hosts/ocaml/browser/compile-modules.js shared/static/wasm` recompiled all
+35 `.sxbc` cleanly. But the freshly-built kernel **crashes on init** in the
+browser: `Fatal error: exception Invalid_argument("Char.chr")` — so `SxKernel`
+never initialises (worse than before). The integer-overflow truncation during
+wasm codegen is the likely culprit (a SHA/char constant). Reverted
+`shared/static/wasm/` to the main-worktree bundle (which boots cleanly —
+verified SxKernel + data-sx-ready). So a naive in-worktree rebuild is NOT the
+fix; the wasm build itself needs investigating (wasm_of_ocaml version? the merged
+sx-vm-extensions/resolver changes interacting with codegen?).
+
+## Next step — rebuild a consistent WASM bundle
+
+`scripts/sx-build-all.sh` does: build the browser wasm target → sync web `.sx`
+into `hosts/ocaml/browser/dist/sx/` → `node hosts/ocaml/browser/compile-modules.js`
+(recompiles `.sxbc` via the native sx_server binary) → copy into
+`shared/static/wasm/`. The browser wasm target is NOT built in this worktree
+(`hosts/ocaml/_build/default/browser/` is empty), so this needs the
+`wasm_of_ocaml` toolchain set up first. Once the `.sxbc` match the kernel, the
+bytecode path loads (no source fallback), `boot.sx` runs, and `process-boosted`
+binds the links — then the SPA Playwright check should pass.
+
+Alternatively: build the browser kernel in the main worktree (which has the
+pipeline) and copy a consistent `sx_browser.bc.wasm.js` + assets + `.sxbc` set
+into this worktree's `shared/static/wasm/`.
+
+## Deploy note
+
+The live container is NOT redeployed with the SPA shell yet — it keeps running the
+pre-SPA `blog.sx` in memory (the native host doesn't hot-reload). Don't recreate
+the container until the bundle is consistent and the SPA Playwright check is green,
+to avoid shipping a kernel that boots but doesn't boost. (Even if it is recreated,
+pages degrade gracefully: links still do normal full-page nav.)

plans/relations-as-posts.md

@@ -0,0 +1,394 @@
+# Relations as posts — declared, inherited, and eventually algebraic
+
+## Principle
+
+Everything is a post in one graph: content-posts, type-posts, **relation-posts**, and
+(later) **constraint-posts**. Nothing about typing is hardcoded — a type-post *declares*
+which relations it anchors, declarations are *inherited* down the type closure, and
+every candidate set / validation is a transitive graph query (`lib/relations`). This
+closes the meta-circular loop the typing plan gestured at: the type system describes
+itself in its own graph.
+
+Supersedes the hardcoded `:candidates "types"/"tags"/"all"` field of `host/blog-rel-kinds`.
+
+## Content-addressability is universal (foundational)
+
+**Every object carries a content-address (CID) — content-posts, type-posts, relation-posts,
+constraint-posts, all of them.** A CID is the hash of the object's *canonical* form: a recursive,
+**key-sorted** serialization (so insertion order, and any process-seed-dependent dict ordering, is
+irrelevant — identical content always yields an identical CID). The runtime has no hash primitive,
+so the canon serializer + a tail-recursive double-hash are built in SX (`host/blog--canon`,
+`host/blog--cid-of`); the slug is excluded from the hash (it's a *name*, not content).
+
+The model is **git-shaped**: the **slug is a mutable name → CID** (a branch pointing at a commit);
+the **CID is the immutable content identity** (the commit). Editing a post mints a new CID; the slug
+follows. Type evolution is the same — a type *version* is content-addressed, instances reference the
+version they were created against. Two objects with identical content *are* the same object (same
+CID) — correct content-addressing semantics.
+
+**Why it's foundational (federation).** A CID is a **global, location-independent identity**, so:
+
+- **Types flow across `fed-sx`.** The same type *definition* on any node has the same CID → a
+  **shared, content-addressed vocabulary**. Federated *instances* reference type CIDs, so a receiving
+  node can *interpret* them. This is linked-data/RDF realised on the post graph, and it generalises
+  ActivityPub itself: AP has a *fixed* type vocabulary (Note/Article/Person, Create/Follow/Like) —
+  the metamodel makes that vocabulary **extensible and user-defined**.
+- **Structure / behaviour trust-split** (the federation boundary): type **structure** (schema,
+  relations, signatures) is declarative and federates *freely* — sharing a definition is sharing a
+  hash. **Behaviour** (Slice 9 lifecycles/effects) does **not** federate naively: you never run a
+  remote node's lifecycle with *your* effect primitives (their "ship" could `charge-card`).
+  Behaviour federates only under high trust, with the effects **re-bound** to local, audited
+  primitives (their orchestration, your effects). `fed-sx` is already trust-gated — that's the lever.
+
+Build order: stamp a stable CID on every object first (additive — slug-addressing stays the working
+key), then a `cid → slug` index, then migrate references / type versioning, then federation.
+
+## North star — the metamodel as a system-construction kit
+
+The destination this is all heading toward: the host stops being "a blog" and becomes a
+**self-describing metamodel**. You *define a domain* — types (with schemas/refinements) and
+relations (with role signatures + algebra) — and a working system falls out. The blog content
+is one seeded configuration; clear it and define different types and you have a different system
+on the same engine. Framework, not application (cf. `[[feedback_runtime_control]]`,
+`[[project_zero_dependencies]]`).
+
+Most of the **instance UI is already generic** — the edit page's relation editors are generated
+by iterating the relations; each picker's candidates come from the relation's `declares`-anchor /
+role type; validation comes from the type's `:schema`. So once Slices 6–7 land, "define the
+types" through a UI is mostly two surfaces, plus a reset:
+
+1. **Metamodel editor** — create a type-post (give it a schema/refinement); create a relation-post
+   (give it a role signature + algebra). The thing that lets you *construct* a system.
+2. **Generic instance form** — create/edit any post of any type, driven entirely by the
+   definitions above (the relation editors + pickers + save-time validation we already have).
+3. **Clear-and-reseed** — wipe instance data, seed only the metamodel roots (`type`, `relation`,
+   the core relations); start from a bare kit and build a domain up from nothing.
+
+Sequence: finish the schema language (Slices 6–7) → the two UI surfaces + reset → clear the demo
+data and define a real domain through the UI. The slices below are the schema language; this is
+what it's *for*.
+
+### Endgame — the whole platform as a typed domain (greenfield, not a strangler)
+
+Not just the blog: the entire rose-ash platform — **store, events, orders, cart, …** — is
+expressible as type + relation definitions in this one metamodel. `Product`, `Event`, `Order`,
+`Ticket` are types; "cart has line-items", "order for an event", "ticket of an event" are
+relations with signatures (cardinality = a cart has many line-items, a ticket belongs to one
+event). This is NOT a strangler off Quart (`[[project_host_on_sx]]`) — it's a **greenfield,
+SX-native system**: define the domain schema as data from first principles, then **port the data
+once at the end** (define-then-port), rather than reimplementing each service's bespoke models
+endpoint-by-endpoint. The strangler's compatibility machinery (JSON mirrors, route/model parity,
+incremental contracts) is dropped — it was tax, not value, for a system that doesn't *correspond*
+to the old one.
+
+### SX all the way out — no JSON on the internal wire
+
+The platform speaks **SX/SXTP end to end**, both directions, browser included — JSON survives only
+at the ActivityPub federation edge (JSON-LD, a published external standard).
+
+| Layer | SX-native form |
+|-------|----------------|
+| Page render | HTML (the document itself) |
+| Data reads | `text/sx` via the `serialize` primitive (`host/ok`/`host/error` → `host/sx-status`) |
+| Write bodies | `text/sx` parsed via `sxtp/parse` (was JSON / form-urlencoded) |
+| Browser → server | the engine posts `text/sx` (boosted forms serialise fields to SX wire); form-urlencoded survives only as the **no-engine / pre-hydration fallback** + the **login bootstrap** handshake |
+| Federation edge | JSON-LD (ActivityPub — the *only* JSON) |
+
+The blog **JSON CRUD `/posts`** (POST/PUT/DELETE) is **deleted**, not converted: it was a pure
+old-contract REST mirror; writes go through the HTML editor forms + SXTP.
+
+Three honest additions store/events surface (the blog didn't need them):
+
+1. **Typed scalar ATTRIBUTES, not just entity relations.** A `Product` needs `price: Money`,
+   `sku: String`, `stock: Int`; these are *values*, not edges to posts. We've built RDF
+   *object properties* (edges to resources); this needs *datatype properties* (literals with
+   value-types + validation). So a type declares **fields** `{field, value-type, card, required,
+   validation}` alongside relations; instances carry typed values; value-types (`Money`, `Int`,
+   `DateTime`) are primitive types. Same shape as a role — a role points at a *type*, a field
+   holds a *value-type*. **This is a real addition to a/b/c+d** and likely Slice 8.
+2. **Behaviour / lifecycle** (order `pending→paid→shipped`) is NOT structure — it's the
+   substrate loops: `[[project_flow_on_sx]]` (durable workflows), `[[project_commerce_on_sx]]`,
+   `[[project_events_on_sx]]`. The metamodel *attaches behaviour to types by composing those*,
+   not reinventing them.
+3. **Integrations** (SumUp payments, ActivityPub federation, artdag media) — types *reference*
+   these services; they don't dissolve into posts.
+
+So the complete picture: the metamodel expresses **structure + validation** of the whole
+platform's domain model uniformly; **behaviour composes from the substrate loops**;
+**integrations stay referenced services**. It's the convergence point of every loop in the repo.
+
+### Types define the UI — the editor maps onto the metamodel
+
+The payoff of typed fields (Slice 8): **a type drives both sides of the UI from one definition.**
+Beyond name + schema, a type carries **fields** `{name, value-type, widget}` and **templates**:
+
+- **Fields drive the edit UI** — the editor renders one input per field, the widget chosen by the
+  field's `value-type` (`Date`→date-picker, `URL`→link input, `String`→text, `Image`→uploader).
+- **Fields drive the render** — the type's **render template** (a parameterised SX template stored
+  on the type-post, instantiated with the instance's field-values) references those fields by name.
+- An **instance** is then just *field-values* on a post. Add a field to the type → it appears in
+  the editor *and* the page, **no code touched**. Same definition, both surfaces.
+
+**"kg-cards become types."** Each Koenig/Ghost card — image, gallery, callout, embed, bookmark,
+heading — becomes a **type-post** with fields + a render template. We've already enumerated that
+whole vocabulary: `[[project_content_on_sx]]` modelled heading/text/code/quote/image/embed/divider/
+list/table/callout/media as block types — **that list is the seed set of card-types.** "The old
+blog posts get typed" = migrate Ghost content into typed blocks, one type-post per block kind.
+
+**"The editor maps onto the types."** The editor stops being hardcoded card handlers and becomes a
+**generic field-editor**: given a type, emit an input per field; on save, store the values; render
+through the type's template. A new card = a new type-post, **zero editor code — the editor is
+defined by the metamodel.** Proof the pattern works: the edit page's relation-editors are already
+*generated* from relation definitions, not hand-coded (one level up from fields).
+
+Honest layer: the **render template is data** (editable, meta-circular); only the irreducible
+**widgets** (the date-picker, the image-uploader) are platform pieces, and `value-type` is what
+*selects* the widget — the same decidable-core / fenced-frontier line as everywhere else.
+
+**The generic form is the default, not the ceiling — types can specify specialised editors.**
+A UI doesn't just *fall out* of the types; it can be **customised**. A type may declare an
+`:editor` slot — a registered, **content-addressed editor *component*** (a WYSIWYG for rich body,
+a map picker for geo, a colour picker) that replaces or augments the input-per-field form, shipped
+to the client by hash like `~relate-picker`. So the editing spectrum per type is: **generic
+field-form** (data, free) → **per-field widget override** (`value-type`/`:widget`) → **whole
+specialised editor component** (the escape hatch, e.g. WYSIWYG). The metamodel picks the level per
+type — `:editor` if set, else the generic form. Same decidable-core / fenced-frontier shape: the
+declarative form covers the 95%, a code component handles the cases that need real interaction.
+
+**Refined build order** (this is what `/meta` is the on-ramp to):
+1. `/meta` overview — **DONE + LIVE** (the *see*; `host/blog-type-defs` + `host/blog-meta-index`).
+2. **Slice 8 — typed fields** `{name, value-type, widget}` — the keystone — **DONE + LIVE**.
+3. **Generic instance form** — input per field ("the editor maps onto types") — **DONE + LIVE**.
+4. **Render template per type** (8c) — data, `(field "name")` placeholders — **DONE + LIVE**.
+5. **Cards-as-types + migrate** — seed the card-type vocabulary from content-on-sx; type the old posts — NEXT.
+Editor surfaces on `/meta`: **create-type** (`POST /meta/new-type`) — **DONE + LIVE**; **create-relation**
+(`POST /meta/new-relation`) — **DONE, but SESSION-SCOPED**: the relation-post + edges persist, the
+rel-kinds registry entry is a runtime concat lost on restart (boot loader can't dynamically enumerate
+under JIT-at-boot — the kernel boot-resolver gap, flagged to sx-vm-extensions). Then **clear-and-reseed**.
+Also open: **specialised editors** (`:editor` slot → content-addressed component, e.g. WYSIWYG).
+
+## Behaviour as data — lifecycles + ECA over an effect vocabulary (DESIGN — Slice 9)
+
+Structure is inert; "place an order / ship goods" is the dynamic part. The principle:
+**behaviour is data-defined orchestration over a small fixed vocabulary of effects.** Only two
+layers stay code — the **effect primitives** (the irreducible ops that touch the world) and the
+**interpreter** that runs the data. Everything between is editable posts. The system defines its
+own behaviour down to the effect boundary (`[[feedback_runtime_control]]`).
+
+**Shape.** A type declares a **lifecycle** (a state machine) as data, plus standalone **ECA
+rules** for reactions that aren't state transitions:
+
+```
+Order: cart --place--> placed [guard: stock-available ∧ total>0] [effects: reserve-stock]
+       placed --pay--> paid   [guard: payment-ok]               [effects: charge-card, confirm-stock]
+       paid --ship--> shipped [guard: address-valid]            [effects: create-shipment, notify]
+ECA:   when stock(product) < threshold  =>  notify(buyer:owner, "restock")
+```
+
+- **States/transitions/rules/effect-invocations are all posts** — meta-circular: `Lifecycle`,
+  `Transition`, `Rule`, `Effect` are themselves types in the metamodel; a behaviour is instances
+  you edit in the same UI as the schema. A transition = `{from, to, on-event, guard, [effects]}`.
+- **Guards are PURE** — predicates over the instance's attributes/relations, i.e. type-system
+  queries (Datalog). No side effects, analysable, you can diagram a lifecycle.
+- **Runs on `[[project_flow_on_sx]]`** because it's durable + long-running: `placed→paid` waits
+  for a SumUp webhook, `paid→shipped` waits days. flow's suspend/resume IS this. Failures →
+  compensation (saga) — `commerce-on-sx` already does "refund as a flow".
+- "Place an order" / "ship" = *attempt transition T*; the button/webhook just fires the event.
+
+### The effect vocabulary (sketch — store + events)
+
+An effect is a named, parameterised op (itself an `Effect` post: name + params + binding).
+Behaviours reference effects by name with args bound to instance/context. Four tiers:
+
+| Tier | Effect | Notes |
+|------|--------|-------|
+| **Pure guard** (read-only, not an effect) | `is-a? / attr-cmp / count / relation-exists?` | type-system queries (Datalog); compose the transition guards |
+| **Data** (internal, transactional on the graph) | `create(type, attrs)`, `set-attr`, `set-state`, `relate / unrelate`, `incr / decr`, `append-ledger(entry)` | the durable post-graph mutations; `decr` stock is atomic-with-check |
+| **Domain** (composed from data, named for atomicity/meaning) | `reserve-stock`, `release-stock`, `confirm-reservation`, `book-seat`, `issue-ticket` | small compositions the vocabulary blesses; `events-on-sx` has the capacity-safe versions |
+| **Integration** (external services — the code edge) | `charge-card`, `refund` (SumUp), `create-shipment` / `track`, `notify(recipient, template, data)`, `federate(activity)` (ActivityPub), `process-media(asset)` (artdag) | the irreducible primitives; keep this list SMALL and composable (artdag's S-expression effects is the model) |
+| **Control** (durable orchestration — flow primitives) | `wait-for(event)`, `wait-until(time) / after(dur)`, `emit(event)`, `transition(instance, state)` | `wait-for` = the SumUp webhook / shipment-delivered; `after` = reservation-expiry / event-reminder; `emit` chains ECA rules |
+
+So `place order` = guard `stock-available ∧ total>0` → effects `reserve-stock`, `set-state placed`,
+`emit order-placed`; the webhook later fires `pay` → `charge-card`, `confirm-reservation`,
+`set-state paid`. Events reuse the same machinery: ticket `reserved →(after 15m, no pay)→ released`,
+event `--remind(after)--> notify` digests. Almost all of it is the same vocabulary.
+
+### The one fork (same shape as the type-system line)
+
+- **Declarative core** — lifecycles + ECA + the effect vocabulary: safe, analysable, diagrammable,
+  editable by non-programmers, verifiable. Covers ~95%.
+- **Guarded code escape-hatch** — a `Scheme`/`Smalltalk` snippet stored on a post and `eval`'d for
+  the rare bespoke guard/effect (`[[project_content_on_sx]]` is Smalltalk message-passing,
+  `[[project_flow_on_sx]]` is guest Scheme — the homoiconic door exists). Turing-complete, unsafe,
+  fenced — exactly the decidable-core / fenced-frontier split we drew for types.
+
+**Where to start:** pin down the effect vocabulary above (the real design artifact), build the
+generic interpreter on flow-on-sx with pure (Datalog) guards, and **lift `commerce-on-sx` /
+`events-on-sx` from guest-code into lifecycle+effect DATA** — they already implement exactly this,
+just not editably.
+
+## Why (the wrinkle that started this)
+
+Candidates for `is-a`/`subtype-of` were `instances-of("type")` — the *instances* that are
+types, but NOT the type-defining posts themselves (`type`, `tag`, `article` are wired with
+`subtype-of`, no `is-a` edge, so they're not instances of type). So the picker offered
+`tutorial` (is-a tag) but never `tag`/`article`/`type` — the things you most want to say a
+post *is-a*. The fix is to ask the right question: a candidate is anything that **inherited
+the relation's object-end declaration from the anchor**, which includes the roots.
+
+## Model
+
+- A **declaration** is an edge `T --declares--> R`: type-post `T` anchors relation `R` at
+  its **object** end ("you may point *at* `T` with `R`"). Seed: `type declares is-a`,
+  `type declares subtype-of`, `tag declares tagged`. `related` has no declaration.
+- **Candidate set** for relating under `R` = the **down-closure** of `R`'s anchors through
+  `inverse(is-a) ∪ inverse(subtype-of)` (a post is a candidate iff it is, transitively, an
+  instance-or-subtype of an anchor — or IS one). No anchors ⇒ every post (`related`).
+  - `is-a`/`subtype-of`: anchors `{type}` ⇒ the whole type closure (roots + subtypes +
+    instances). **Wrinkle fixed.**
+  - `tagged`: anchors `{tag}` ⇒ the tags.
+  - `related`: no anchor ⇒ all posts.
+
+## Roadmap
+
+### Slice 1 — declarations + candidate-by-inheritance — DONE
+- Seed `declares` edges; add `host/blog--reach-down` (down-closure) and rewire
+  `host/blog--candidate-pool` to be declaration-driven. `:candidates` becomes vestigial.
+- Wrinkle fixed: the type roots now appear as `is-a` candidates.
+
+### Slice 2 — relations as first-class posts — DONE
+- `relation` root + `is-a`/`subtype-of`/`tagged`/`related` seeded as posts (each is-a
+  relation) owning their metadata in a `:rel` slot (`:symmetric :label :inverse-label`).
+  `host/blog-rel-kinds` / `kind-spec` / `kind-symmetric?` now read it; the static registry
+  is gone. `host/blog--rel-slugs` = `host/blog-in "relation" "is-a"` (cheap, flat).
+- **Perform budget under http-listen (the hard lesson):** a durable read inside the
+  render VM raises `VmSuspended`, and too many per request 500s the page. Two fixes:
+  (1) relation metadata is loaded into an in-memory cache at boot (`host/blog-load-rel-kinds!`,
+  like `load-edges!`) so `kind-spec` is pure; (2) the initial edit page renders its pickers
+  EMPTY (the load trigger fills each) — only the relate/unrelate FRAGMENT server-renders
+  candidates (`with-cands` flag), so one page render doesn't do `candidate-get × every
+  picker`. Benign single-perform suspend/resume still logs `VmSuspended` but returns 200.
+- **Live JIT gotcha (cost real time):** the serving-mode JIT drops all-but-first when
+  `map`/`for-each`-ing a *function-produced* list — building `rel-kinds` that way rendered
+  only 1 of 4 editors live, while conformance + the ephemeral server passed. So
+  `host/blog-rel-kinds` is a VALUE the boot populates and the cache loads are UNROLLED.
+  **Conformance green ≠ correct live — verify the rendered edit page.** (Re-fold the
+  enumeration once plans/jit-bytecode-correctness.md lands.)
+### Slice 2.5 — picker title reads are O(page), not O(pool) — DONE
+- `relate-candidates` computes the available candidate SLUGS (slug-sorted, no per-candidate
+  read), then reads titles ONLY for the page it returns. On the unfiltered path (q="" — the
+  initial picker load AND every editor server-fill, the common case) that's ~`limit` reads
+  instead of one-per-post — killing the durable-read churn under http-listen. A filter
+  (q≠"") still resolves titles across the pool (it matches on the title), but that's the
+  interactive path.
+- A boot-time slug→title **cache** would make even the filter O(1)-perform, BUT it's blocked
+  for now: there's no bulk KV read, and a per-post `host/blog-get` loop **at boot** hits the
+  JIT bug (a durable read inside a boot loop drops all-but-first — `load-edges!` only works
+  because its loop body is perform-free). Revisit with a bulk read or once the JIT lands.
+
+**Remaining follow-ups:** subject-end declarations (who may be the *source*); a proper
+relation-subtype closure when relations get subtyped; the boot title cache above.
+
+### Slice 3 — typed relations (target-type constraints) — DONE
+- The declaration's `declares`-anchor IS the target-type constraint: `is-a`/`subtype-of`
+  (anchored by `type`) require a type object; `tagged` (anchored by `tag`) a tag. A new
+  `wrote` relation needs only a `Work declares wrote` edge — fully data-driven.
+- `host/blog--valid-object?(kind, other)` = `other ∈ candidate-pool(kind)` — the SAME set
+  the picker offers, so picker and validation agree by construction. `relate-submit` now
+  enforces it (an invalid target is a silent no-op, like the other guards); `related`
+  (no anchor) accepts any post. The picker never offers an invalid target, so this guards
+  crafted/API requests — the jump from "candidate set" to an enforced relation schema.
+- NOTE: `host/blog-relate!` (direct/seed) stays UNVALIDATED — the seed needs to write
+  `X is-a relation` where `relation` isn't under `type`. Validation is a *handler* boundary.
+
+### Slice 4 — type algebra — DONE (intersection ∧ union)
+- An algebraic type is a post with operand edges: `conj` edges (intersection members),
+  `disj` edges (union members). `host/blog-instances-of-expr` computes its EXTENT from the
+  operands' extents by set intersection / union, RECURSIVELY — so operands can themselves be
+  algebraic (meta-circular; tested with `(tag ∧ article) ∧ tag`). `host/blog-is-a-expr?`
+  generalises `is-a?` to type expressions. `host/blog-make-and!` / `make-or!` build them.
+- Binary today (`nth 0/1`, no fold over operands — robust on the serving JIT); n-ary fold is
+  a follow-up once iteration-with-perform is JIT-reliable.
+- **Operand edges are KV-only** (`host/blog--add-edge-kv!`, read via `host/blog-out`), NOT in
+  lib/relations — feeding extra kinds into the Datalog graph blows up its per-query
+  re-saturation; `load-edges!` skips `conj`/`disj` on replay for the same reason.
+- **Refinement** `{x : T | φ(x)}` (a type-post with a `:constraint` predicate) → Slice 5,
+  with constraints-as-posts. (Process note: a sibling loop running heavy conformance saturates
+  the box; host conformance can EXIT 124 purely from CPU contention — use `timeout 1200`.)
+
+### Slice 5 — refinement types (schemas ON the type-post) — DONE
+- A type-post carries its schema in a `:schema` slot (a list of `{:block :msg}` rules —
+  a refinement `{x : T | x has these blocks}`). `host/blog-schema-of` reads it off the
+  post; the hardcoded `host/blog-type-schemas` table is gone. A NEW refinement type is pure
+  data: give a type-post a `:schema` (`host/blog--set-schema!`) and its instances are
+  validated on save against it — no code. Tested with a `guide` type requiring a `pre` block.
+- Save-time validation (`type-issues`/`type-valid?`, the only callers, in the SAVE request)
+  unions the schemas of a post's full transitive type set — unchanged, just sourced from the
+  posts. `schema-of` reads the post (a durable read) — fine in the save request, never render.
+- `host/blog-put!` now MERGES over the previous record, so editing a post's title/content
+  doesn't nuke its `:schema` / `:rel` metadata (also closes the Slice 2 "edit drops :rel" gap).
+- `article`'s schema migrated onto the article post (`set-schema!` at boot — a single
+  read+write, not a loop, so boot-JIT-safe; idempotent, handles the already-seeded article).
+- FUTURE: arbitrary predicate constraints (not just required blocks); constraints as their
+  own posts; relation cardinality (`is-a` single-valued?) as a declared constraint.
+
+## Parameterised relations (DESIGN — Slices 6 & 7)
+
+The next axis: `Relation<…>`. The key reframe is that the obvious parameters aren't separate
+`<N>`s — they split into **two halves**, and they compose into one coherent thing:
+
+1. **The role SIGNATURE** (the *shape* of a tuple) — Slice 6 (a + b + c).
+2. **The relation's ALGEBRA** (how it *behaves*) — Slice 7 (d).
+
+A relation is `Relation<signature>`, where a signature is an ordered list of **roles**, each
+role carrying a **type** and a **cardinality**; the signature's length is the **arity**.
+Today's binary typed relations are the degenerate 2-role case — backward-compatible, nothing
+gets thrown away. Prior art to borrow (and stay decidable within): Codd / ER reified
+relationships (signature), OWL property characteristics (algebra), Datalog / relation algebra
+(derived relations — the undecidable frontier; fence it). Decidability rule of thumb: concrete
++ algebraic role-types and counts stay decidable; arbitrary predicates / recursive rules don't.
+
+### Slice 6 — the role signature (a + b + c)
+Generalise the relation-post's `:rel` slot from `{:symmetric :label}` to a `:roles` list —
+`{:roles [{:name :type :card} …]}` — driving picker candidates, validation, and arity per-role:
+- **(a) per-role type** — each role's `:type` is a type-expr (so it can be algebraic:
+  `Relation<Work ∧ Published>`). The object-role's type IS today's `declares`-anchor — make it
+  explicit. `valid-object?` becomes per-role `is-a-expr?` against `:type`.
+- **(b) arity** = `(len roles)`. Binary stays the fast `src|kind|dst` edge path; **n-ary needs
+  reification**: a relation *instance* becomes its own post with role edges (`subject→X`,
+  `object→Y`, `recipient→Z`) — on-brand (we made relation *kinds* posts; now *instances* too),
+  but a SECOND representation alongside the binary edges, not a tweak. Qualifiers (Wikidata-
+  style) then come free as extra roles.
+- **(c) cardinality** — `:card` per role (min/max; functional = max 1, required = min 1),
+  enforced on relate by counting. Composes with Slice 5 validation. No model change for binary.
+- Siblings: ordered roles (set vs list), keys/identity (which roles identify a tuple).
+- **Layering (cheapest → deepest):** (c) cardinality on the binary object-role → (a) explicit
+  role-type + the 2-role signature abstraction → (b) reified n-ary (the real lift).
+- **Variance: nominal, none initially** — no structural subtyping of `Relation<…>` (covariance
+  of parameterised types is a research project). JIT caveat: 2-role signatures are unrollable;
+  n-ary role-iteration with per-role reads needs the cache/unroll treatment (Slice 2/5 lesson).
+
+### Slice 7 — relation algebra / characteristics (d)
+The behaviour half — and (d) **transitivity** is special because we ALREADY hardcode it
+(`is-a`/`subtype-of` closure via lib/relations); declaring it generically *removes* code.
+- **Algebraic properties** declared on the relation-post (`:transitive :symmetric :reflexive
+  :antisymmetric :irreflexive`), with the closure **derived generically** from them — OWL's
+  property characteristics. `subtype-of` becomes "a declared transitive + antisymmetric
+  relation" (a partial order), not a special case. `:symmetric` (already stored) folds in here.
+- **Inverse relations** — a real `:inverse` (not just the `:inverse-label` display hint):
+  relating one auto-derives the converse, the way `:symmetric` writes both directions.
+- **Sub-relations** — relations subtyping relations (`wrote subPropertyOf created`): X wrote Y
+  ⟹ X created Y. Same `subtype-of` machinery, over the `relation` root — meta-circular.
+- **Decidable core stops here.** Beyond-d, FENCED: defined-by-rule relations (composition,
+  `grandparent = parent ∘ parent` — straight onto the Datalog substrate, but gate to
+  stratified/bounded rules) and cross-role refinement predicates (`start < end`) — both need
+  the predicate-language-vs-embedded-code decision first.
+
+## Open design questions (track as we go)
+1. **Subject-end declarations** — who may be the *source* of a relation (a root `Thing`?).
+2. **Inheritance path** — through `is-a` AND `subtype-of` downward (current choice); revisit
+   if instances-of-instances as candidates surprises.
+3. **Bootstrap / meta-circularity** — `is-a` needs `is-a`; seed relation-posts + `Type is-a
+   Type`(?) idempotently, as the type seed already is.
+4. **Cost** — `reach-down` is a BFS of direct-edge scans; fine for a small blog, revisit with
+   a `lib/relations` transitive query if the graph grows.

plans/sx-native-engine-tests.md

@@ -0,0 +1,185 @@
+# Plan: SX-native engine tests (browser-independent)
+
+## Goal
+
+Move the host's *interactive* test coverage from Playwright (`.spec.js`, drives a real
+Chromium) into **SX harness tests** that drive the hypermedia engine against a **mock
+platform** — no browser. Reserve Playwright for the one irreducible real-browser fact:
+"the WASM kernel actually compiles, boots, and loads modules content-addressed."
+
+**Why (the principle):** the SX engine (`web/engine.sx` + `web/orchestration.sx`) has no
+hard browser dependency — it talks to a *platform* (fetch, DOM ops, timers) that is
+injected. The harness supplies a mock platform, so engine behaviour (fetch → swap →
+DOM mutation) is asserted with zero browser. The same engine could therefore drive
+*something else* (a server-side DOM, a native UI) — the SX tests prove that
+independence by running without one. This is consistent with
+`[[project_zero_dependencies]]` and `[[feedback_runtime_control]]` (build IN the runtime).
+
+## Current state (2026-06-29)
+
+- **Already SX:** the 272 host conformance tests (`lib/host/tests/*.sx`, `spec/harness.sx`
+  mock-IO). The picker's *server contract* is SX too (`lib/host/tests/blog.sx`:
+  `picker form declaratively wired`, `load-more sentinel`, `no-sentinel-on-short-page`).
+- **Still Playwright (`.spec.js`):** `lib/host/playwright/relate-picker.spec.js` (7 tests)
+  and `spa-check.spec.js` (4) — real-browser checks of populate / filter / paging /
+  relate-delete / remove-button / boosted-nav / error-retry / WASM boot.
+
+## Infrastructure that already exists (the enabler — verified)
+
+- `spec/harness.sx` — `make-harness`, `default-platform` with **`:fetch` overridable**
+  (`(fn (url &rest opts) {:status 200 :body "" :ok true})`), plus DOM ops, `:now`, etc.
+- `web/harness-web.sx` — `(define-library (sx harness-web))` exports: `mock-element`,
+  `mock-set-attr!`, `mock-append-child!`, `mock-get-attr`, `mock-add-listener!`,
+  **`simulate-click` / `simulate-input` / `simulate-event`**, `assert-text`, `assert-attr`,
+  `assert-class`, `assert-no-class`, `assert-child-count`, `assert-event-fired`,
+  `make-web-harness`, render-audit helpers.
+- `web/tests/` — existing SX engine tests: `test-orchestration.sx` (17 deftests),
+  `test-forms.sx` (25), `test-swap-integration.sx` (43, mock-response → swap → assert),
+  `test-engine.sx`, `test-handlers.sx`. **`test-swap-integration.sx` is the reference
+  pattern** (it sets `_mock-body`/`_mock-headers`/`_mock-content-type`, drives a swap,
+  asserts the result).
+- Runner: `hosts/ocaml/bin/run_tests.ml` scans `spec/tests/`, `lib/tests/`, `web/tests/`
+  and loads `harness-web.sx` + `harness-reactive.sx`. Run via the `sx_test host="ocaml"`
+  MCP tool (or `./scripts/sx-build-all.sh`). JS runner: `hosts/javascript/run_tests.js`
+  also loads the web harnesses.
+
+## Phases
+
+### Phase 0 — Proof of concept (small): one behavior, SX
+Port **relate → delete row** to an SX harness test (new `web/tests/test-relate-picker.sx`):
+1. Build a mock DOM: a `.rp-results` `<ul>` containing one candidate `<li id="cand-related-x">`
+   with the relate `<form sx-post=/x/relate sx-target=#cand-related-x sx-swap=delete>`.
+2. `process-elements` (or `bind-triggers`) the tree so the form's submit is bound.
+3. Mock `:fetch` to return `{:status 200 :ok true :body ""}`.
+4. `simulate-click` the button (or `simulate-event` "submit" on the form).
+5. Assert the `<li>` is gone (`assert-child-count` results = 0).
+This validates the **mock-DOM → execute-request → swap-dom-nodes** loop in SX end to end.
+**If it reads cleanly, the rest is mechanical.**
+
+### Phase 1 — Port the picker's interactive behaviors (medium)
+Same file, more deftests, each = mock fetch + simulate + assert:
+- **filter narrows**: `:fetch` returns N candidate rows for `q=...`; `simulate-input` the
+  filter; assert child-count == N.
+- **sentinel paging**: `:fetch` returns rows + a `<li class=rp-more sx-trigger=revealed>`;
+  fire the revealed/intersect path; assert more rows appended, sentinel replaced.
+- **load populate**: `load` trigger → fetch → assert results filled.
+- **error/retry visible state**: `:fetch` rejects → assert `.sx-error` class added
+  (`assert-class`), then succeeds → assert cleared.
+
+### Phase 2 — Trim Playwright to a boot smoke (small)
+Keep ONLY what needs a real browser in `relate-picker.spec.js` / `spa-check.spec.js`:
+- WASM kernel compiles + boots (`data-sx-ready`).
+- modules load **content-addressed** (`/sx/h/` fetches, 0 path `.sxbc`).
+- one boosted nav swaps `#content`.
+Delete the per-behavior browser tests now covered by SX. Net: ~2 browser tests + an
+SX suite.
+
+### Phase 3 — The engine drives the CONSOLE (the non-browser target)
+The concrete "something else" is a **terminal / console platform**. This is the natural
+sibling of the test harness: a harness test *asserts* the engine's output tree; the
+console platform *renders* that same tree to text. Same platform abstraction — one
+observes it, one draws it.
+
+What it means concretely:
+- **Platform ops → a console-backed element tree.** The engine only ever calls platform
+  primitives: `dom-create-element`, `dom-append`, `dom-set-attr`, `dom-query` (by id, for
+  `sx-target`), `dom-remove-child`, `dom-parent`, `morph-children`, `dom-listen`, `fetch`,
+  `set-timeout`. Implement these against an in-memory tree of text nodes instead of the
+  browser DOM. The mock DOM in `web/harness-web.sx` is ~90% of this already.
+- **Render = print the tree as text** (ANSI/box-drawing) — a `render-to-console` mode
+  alongside `render-to-html` / `render-to-dom` (see `spec/render.sx`'s mode table). The
+  results `<ul>` becomes a list; `.sx-error` becomes a red line; the filter input is a
+  text field.
+- **Events = a TUI input loop.** Keypresses / selection map to `simulate-input` /
+  `simulate-click` on the focused node — exactly the harness's `simulate-*`, but driven by
+  a real keyboard instead of a test.
+- **`fetch` stays HTTP** (the host already serves `text/sx` fragments + `relate-options`),
+  or talks to a local store.
+
+Payoff: the **same** `~relate-picker` — `sx-get`, debounced filter, `revealed` paging,
+`sx-swap=delete`, `sx-error` retry — runs unchanged in a terminal. That is the proof that
+the SX hypermedia engine is a *general* runtime, not a browser library: the browser is
+just one platform binding, the console is another, the test harness is a third. Ambitious,
+buildable, and the most convincing demonstration of the whole architecture
+(`[[feedback_runtime_control]]`, `[[project_zero_dependencies]]`).
+
+Sketch of work: (1) a `console-platform.sx` implementing the platform ops over a text
+tree (fork `harness-web.sx`'s mock element), (2) a `render-to-console` mode in render.sx,
+(3) a tiny input loop (raw-mode stdin → focus model → `simulate-*`), (4) run the host's
+picker against it. Phase 1's SX tests become the regression suite for the console renderer
+for free (they already drive the tree, just don't print it).
+
+## Gaps & risks to resolve during Phase 0
+
+- **Mock-DOM completeness:** `swap-dom-nodes` uses `morph-children`, `dom-replace-child`,
+  `dom-insert-after/before/prepend/append`, `dom-remove-child`, `dom-parent`,
+  `dom-first-child`, `dom-clone`, `dom-is-fragment?`. Confirm `harness-web`'s mock DOM
+  implements (or can be extended for) these. `test-swap-integration.sx` already swaps, so
+  most exist; check `delete`/`outerHTML`/fragment paths specifically.
+- **fetch callback shape:** the engine's `fetch-request` calls back
+  `(resp-ok status get-header text)`; the platform `:fetch` returns `{:status :body :ok}`.
+  Confirm/adapt the bridge (see how `test-swap-integration.sx` feeds `_mock-body` etc.).
+- **trigger binding without a browser:** `simulate-click` fires bound listeners — the form
+  must be processed first (`process-elements` on the mock root, or bind directly).
+- **component expansion:** `~relate-picker` need not be expanded for these tests — assert
+  on the *rendered* candidate rows / form markup directly (build the mock DOM from the
+  expanded HTML the server produces, which is already SX-testable server-side).
+
+## Tracked loose ends (separate from this plan)
+- **unrelate "clever" in-place delete** (just-the-row, no `#content` re-render): now that
+  `bind-boost-form` is fixed the remove button works via a boosted POST→swap; the
+  minimal-mutation version (sx-post + `sx-swap=delete` on the current-row) is a further
+  refinement — earlier attempt didn't fire, revisit with the binding now understood.
+- **`hs-repeat-times`** bytecode test (architecture worktree): harness `host-new` stub bug
+  masks a pre-existing `beingTold` resume-env bug. See the diagnosis in this session.
+
+## Progress (2026-06-29)
+
+- **Phase 0 DONE** (commit 297bdc60) — `web/tests/test-relate-picker.sx`: relate→delete
+  row drives the real engine (process-elements → submit → mock fetch → delete swap)
+  against the OCaml runner's mock DOM, green. Mock-DOM completeness added to
+  `run_tests.ml`: `NodeList.item(i)` (so `dom-query-all` iterates) + a `DOMParser`
+  mock (so the empty-body `sx-swap=delete` HTML-response path works as in a browser).
+- **Phase 1 DONE** (commit fe2da2d3) — same file, load / filter / paging / error-retry,
+  5/5 green, zero harness noise. Modelled two browser natives the OCaml runner lacks:
+  `observe-intersection` (a recording stub the test fires to simulate the sentinel
+  scrolling into view) and synchronous-timer retry (stripped in the error test —
+  backoff math is a `test-engine.sx` concern). Mock-DOM: `firstChild`/`lastChild`
+  (so `children-to-fragment` drains a parsed fragment into innerHTML/outerHTML swaps;
+  also repaired one pre-existing web test). No web-suite regressions.
+  - **Key seam discovered:** a top-level `(define …)` override is seen by engine
+    library functions ONLY when the symbol lives in a *different* library than the
+    caller (cross-library late-binds through global; same-library resolves locally).
+    `fetch-request` (boot-helpers) overrides fine from a test; `handle-retry`
+    (orchestration, same lib as `do-fetch`) does NOT — hence the strip-attr approach.
+  - **harness-web.sx is NOT loaded** by the OCaml runner (only the JS runner), and its
+    assertions assume a different mock-element shape (`attrs`/`text`) than the OCaml
+    mock DOM (`attributes`/`textContent`). Assert through the engine's own `dom-*`
+    accessors instead.
+- **Phase 2 DONE** (commit 98ff7a35) — Playwright trimmed 11 → 5 tests, both ephemeral
+  suites green (run-spa-check 3/3, run-picker-check 2/2). Kept: WASM boot +
+  content-addressed module loading (new `/sx/h/` assertion) + boosted nav swap +
+  back/re-boost (spa-check); bind-boost-form remove button + picker re-bind after a
+  boosted SPA nav (relate-picker). Deleted the populate/filter/paging/relate-delete/
+  error-retry browser tests (now SX).
+- **Phase 3 (stretch) — render slice DONE** (commit 16f90ffd) — `web/console-render.sx`:
+  `render-to-console` walks a live DOM element tree through the engine's own `dom-*`
+  accessors and prints it as terminal text (results `<ul>` → bulleted list, filter
+  `<input>` → text field, `.rp-more` sentinel → `…` line, `.sx-error` → flagged line).
+  Wired into the picker's engine tests so the SAME tree drives both the DOM assertion
+  and the terminal output — Phase 1's suite is the console renderer's regression suite
+  for free. Plus a `relate-picker:console` suite. 7/7 green.
+  - **Remaining Phase 3 (future):** the live input loop — raw-mode stdin → focus model
+    → `simulate-input`/`simulate-click` on the focused node — and full ANSI/box-drawing
+    output. Not harness-testable (needs a real TTY), so it's a runtime/demo feature, not
+    a test. The render step (the convincing half — "render = print the tree") is done;
+    the engine→console *event* path reuses the same `simulate-*` the harness already
+    drives. Class membership must read the live `classList` (`dom-has-class?`), not the
+    static `class` attribute (the engine mutates classes through classList).
+
+## Done-when
+- [x] `web/tests/test-relate-picker.sx` covers populate / filter / paging / relate-delete /
+  error-retry in SX, green under `sx_test host="ocaml"`.
+- [x] Playwright trimmed to the boot smoke; suite still green.
+- [~] (Stretch) the picker runs through a non-browser platform — render-to-console done
+  (the engine's tree prints to a terminal); live TTY input loop is future work.

plans/typed-posts-and-relations.md

@@ -0,0 +1,96 @@
+# Typed posts & relations — typing is just relating to a type
+
+> host-on-sx. Driving idea: **classification is a relation to a type node, and
+> types are posts.** Everything (related, tag, category, series, type) becomes a
+> typed edge in `lib/relations` over `blog:<slug>` nodes. One primitive.
+
+## Decisions
+
+- **Types are posts.** No new node namespace — content-posts and type/tag posts
+  are all `blog:<slug>`. A "tag" is a post; tagging documents itself.
+- **`is-a` is the typing edge; `tagged` is membership.** Kept distinct so a tag
+  page can list members without conflating "ocaml is a tag" with "hello is
+  tagged ocaml".
+- **Hierarchy is core, not deferred.** `is-a`/`subtype-of` transitive closure via
+  `lib/relations` reachability is what makes typing-as-relation more than flat
+  labels. All typing helpers are transitive from the first line, or subtypes
+  silently break candidate/`is-a?` checks later.
+- **Validation is gradual, not deferred.** A type-post *optionally* carries a
+  schema slot; validation runs only where one exists. Tags declare none (stay
+  folksonomy-free); `article` can declare "needs a heading". The hook lands with
+  the type phase (reusing `host/blog-content-ok?`); only schema *expressiveness*
+  grows over time. This closes the nominal/structural loop: the declared `is-a`
+  edge is a claim, the validator checks the content honors it.
+- **Scalars stay fields.** `status`/`title`/`sx_content` remain fields, not edges
+  — listings filter on them constantly and `lib/relations` re-saturates Datalog
+  per query. Links-to-shared-nodes → edges; per-post hot scalars → fields.
+
+## The linchpin: a relation-kind registry
+
+One data structure drives validation, the picker candidate sets, and rendering:
+
+```
+host/blog-rel-kinds =
+  ({:kind "related" :label "Related posts" :symmetric true  :candidates "all"}
+   {:kind "is-a"    :label "Types"         :symmetric false :candidates "types"
+                    :inverse-label "Instances"}
+   {:kind "tagged"  :label "Tags"          :symmetric false :candidates "tags"
+                    :inverse-label "Tagged with this"})
+```
+
+`:symmetric` → write both directions on relate. `:candidates` → what the picker
+offers (`all` = every post; `tags` = `is-a? blog:tag` transitively; `types` =
+`is-a? blog:type`). `:label`/`:inverse-label` → headings.
+
+## Phases
+
+### Phase 1 — Kind generalization + registry  ← START HERE
+Pure refactor; zero user-visible change (related keeps working).
+- `host/blog-rel-kinds` registry + `host/blog--kind-spec`/`--kind-symmetric?`.
+- `host/blog-relate!(a,b,kind)` / `unrelate!(a,b,kind)` — directed; symmetric kinds
+  also write the reverse (today's "related" behavior = the symmetric case).
+- `host/blog-out(slug,kind)` (children) / `host/blog-in(slug,kind)` (parents),
+  existence-filtered. `host/blog-related(slug)` = `out(slug,"related")` (back-compat).
+- Routes carry `kind` (form field, default `"related"`); validated against registry.
+- `delete` cleanup drops edges across **all** kinds, both directions.
+
+### Phase 2 — Type resolution via reachability (the spine)
+- Seed root type-posts: `blog:type` ("Type") and `blog:tag is-a blog:type`,
+  each documenting itself. Idempotent seed in `serve.sh`.
+- `host/blog-types-of(slug)` = direct `is-a` targets ∪ `subtype-of`-reach of each
+  (SX-side composition over `lib/relations` reach — no new Datalog rules).
+- `host/blog-is-a?(slug, type)` — **transitive**.
+- Type-posts carry an optional `:schema` slot (designed now, mostly empty).
+- Validation hook: `host/blog-content-ok?` extended to also run any schema(s)
+  implied by the post's declared types. No schema → no-op (gradual).
+
+### Phase 3 — Tags as posts
+- "is a tag" = `host/blog-is-a? slug "tag"` (transitive). Helpers
+  `host/blog-tags(slug)` = `out(slug,"tagged")`, `host/blog-tagged-with(tag)` =
+  `in(tag,"tagged")`.
+- Edit page: a "This post is a tag" toggle = add/remove `is-a blog:tag` edge.
+
+### Phase 4 — Render (data-driven from the registry)
+- Post page iterates the registry → "Related posts" + "Tags" blocks, same code.
+- Tag-post page: its own content (the tag's documentation) **plus** "Tagged with
+  this" (incoming `tagged`). A tag page documents the tag AND lists its members.
+- Optional `/tags` index = posts `is-a? blog:tag`.
+
+### Phase 5 — Generalize the picker
+- `host/blog--relate-candidates(slug, q, kind)` branches on the kind's
+  `:candidates` (all / tags / types).
+- `relate-options` endpoint takes `&kind=`; picker filter input carries
+  `data-kind`; `relate-picker.js` forwards it.
+- Edit page renders one picker section per kind from the registry.
+
+### Phase 6 — Schema expressiveness (ongoing)
+- Grow the type `:schema` language: start minimal (required block kinds / a
+  predicate over content), richer later. Enforcement already wired in Phase 2;
+  only the language grows. Not a blocker — a gradient.
+
+## Notes
+- Node model unchanged (`blog:<slug>`); only `kind` varies. The relate machinery,
+  picker, and post-page block all generalize by lifting the hard-coded
+  `kind: "related"` into a parameter.
+- A type can *be* a post all the way up (`blog:tag is-a blog:type`); meta-circular
+  but bounded by seeding a small root set.

shared/static/wasm/sx-platform.js

@@ -646,6 +646,18 @@
     // Load entry point itself (boot.sx — not a library, just defines + init)
     loadBytecodeFile("sx/" + entry.file) || loadSxFile("sx/" + entry.file.replace(/\.sxbc$/, '.sx'));
 
+    // App components: the page's data-sx-manifest "boot" array lists app-specific
+    // modules (e.g. ~relate-picker) to eager-load after the web stack, so their
+    // defcomps are registered before a boosted fragment references them. Loaded
+    // content-addressed, the same as any module.
+    var pageM = loadPageManifest();
+    if (pageM && pageM.boot && pageM.boot.length) {
+      for (var b = 0; b < pageM.boot.length; b++) {
+        var bf = pageM.boot[b];
+        loadBytecodeFile("sx/" + bf) || loadSxFile("sx/" + bf.replace(/\.sxbc$/, '.sx'));
+      }
+    }
+
     if (K.endModuleLoad) K.endModuleLoad();
     var count = Object.keys(_loadedLibs).length + 1; // +1 for entry
     var dt = Math.round(performance.now() - t0);

shared/static/wasm/sx/boot-helpers.sx

@@ -269,16 +269,28 @@
                   (let
                     ((fd (host-new "FormData" el)))
                     (dict "url" url "body" fd "content-type" nil))
+                  ;; SX-native wire: serialise the form fields to a text/sx body
+                  ;; (the host reads it via host/sx-body / host/field). A hydrated
+                  ;; page posts SX, not urlencoded; the server still accepts
+                  ;; urlencoded for the no-engine fallback. See plans/
+                  ;; relations-as-posts.md ("SX all the way out").
                   (let
-                    ((fd (host-new "FormData" el))
-                      (params (host-new "URLSearchParams" fd)))
+                    ((payload
+                       (reduce
+                         (fn (acc f)
+                           (let ((nm (dom-get-attr f "name")))
+                             (if (and nm (not (= nm "")))
+                               (assoc acc nm (or (host-get f "value") ""))
+                               acc)))
+                         (dict)
+                         (dom-query-all el "input, textarea, select"))))
                     (dict
                       "url"
                       url
                       "body"
-                      (host-call params "toString")
+                      (serialize payload)
                       "content-type"
-                      "application/x-www-form-urlencoded"))))
+                      "text/sx; charset=utf-8"))))
               (dict "url" url "body" nil "content-type" nil))))))
     (define abort-previous-target (fn (el) nil))
     (define abort-previous (fn (el) nil))
@@ -579,7 +591,13 @@
         (dom-listen
           form
           "submit"
-          (fn (e) (prevent-default e) (execute-request form nil nil)))))
+          ;; A boosted form has no sx-get/sx-post, so get-verb-info returns nil and
+          ;; execute-request would no-op (the "submit does nothing — no network"
+          ;; bug). Pass the form's own method+action as the verbInfo so it actually
+          ;; fires the request (and the body is built from the form fields).
+          (fn (e)
+            (prevent-default e)
+            (execute-request form (dict "method" method "url" action) nil)))))
     (define
       bind-client-route-click
       (fn
@@ -593,7 +611,15 @@
               (not (event-modifier-key? e))
               (prevent-default e)
               (let
-                ((boost-el (dom-query "[sx-boost]"))
+                (;; Read the href FRESH from the element at click time. A morph swap
+                 ;; (innerHTML) REUSES DOM nodes in place — an <a> from the previous page
+                 ;; can be re-purposed as a different link, its href rewritten but this
+                 ;; click closure (and its is-processed? mark, so boost-descendants skips
+                 ;; re-binding) left intact. Capturing href in the closure then navigated
+                 ;; to the STALE target (e.g. home's /tags for a swapped-in "edit" link).
+                 ;; Reading the live attribute makes a reused node follow its CURRENT href.
+                 (href (or (dom-get-attr link "href") href))
+                  (boost-el (dom-query "[sx-boost]"))
                   (target-sel
                     (if
                       boost-el

shared/static/wasm/sx/browser.sx

@@ -49,7 +49,10 @@
       (fn () (host-get (host-get (dom-window) "location") "origin")))
     (define
       browser-same-origin?
-      (fn (url) (starts-with? url (browser-location-origin))))
+      ;; A relative URL (no scheme, not protocol-relative "//host") is same-origin
+      ;; by definition; an absolute URL must start with our origin. The old check
+      ;; only did the latter, so it wrongly rejected every relative link ("/x").
+      (fn (url) (or (starts-with? url (browser-location-origin)) (and (not (string-contains? url "://")) (not (starts-with? url "//"))))))
     (define
       url-pathname
       (fn

shared/static/wasm/sx/compiler.sx

@@ -783,11 +783,7 @@
                 (rest-clauses
                   (if (> (len flat-args) 2) (slice flat-args 2) (list))))
               (if
-                (or
-                  (and
-                    (= (type-of test) "keyword")
-                    (= (keyword-name test) "else"))
-                  (= test true))
+                (or (and (= (type-of test) "keyword") (= (keyword-name test) "else")) (and (= (type-of test) "symbol") (or (= (symbol-name test) "else") (= (symbol-name test) ":else"))) (= test true))
                 (compile-expr em body scope tail?)
                 (do
                   (compile-expr em test scope false)
@@ -828,11 +824,7 @@
               (rest-clauses
                 (if (> (len clauses) 2) (slice clauses 2) (list))))
             (if
-              (or
-                (and
-                  (= (type-of test) "keyword")
-                  (= (keyword-name test) "else"))
-                (= test true))
+              (or (and (= (type-of test) "keyword") (= (keyword-name test) "else")) (and (= (type-of test) "symbol") (or (= (symbol-name test) "else") (= (symbol-name test) ":else"))) (= test true))
               (do (emit-op em 5) (compile-expr em body scope tail?))
               (do
                 (emit-op em 6)
@@ -1008,11 +1000,27 @@
             (let
               ((name (symbol-name head))
                 (argc (len args))
-                (name-idx (pool-add (get em "pool") name)))
+                (specialized-op (cond
+                  (and (= argc 2) (= name "+")) 160
+                  (and (= argc 2) (= name "-")) 161
+                  (and (= argc 2) (= name "*")) 162
+                  (and (= argc 2) (= name "/")) 163
+                  (and (= argc 2) (= name "=")) 164
+                  (and (= argc 2) (= name "<")) 165
+                  (and (= argc 2) (= name ">")) 166
+                  (and (= argc 2) (= name "cons")) 172
+                  (and (= argc 1) (= name "not")) 167
+                  (and (= argc 1) (= name "len")) 168
+                  (and (= argc 1) (= name "first")) 169
+                  (and (= argc 1) (= name "rest")) 170
+                  :else nil)))
               (for-each (fn (a) (compile-expr em a scope false)) args)
-              (emit-op em 52)
-              (emit-u16 em name-idx)
-              (emit-byte em argc))
+              (if specialized-op
+                (emit-op em specialized-op)
+                (let ((name-idx (pool-add (get em "pool") name)))
+                  (emit-op em 52)
+                  (emit-u16 em name-idx)
+                  (emit-byte em argc))))
             (do
               (compile-expr em head scope false)
               (for-each (fn (a) (compile-expr em a scope false)) args)
@@ -1156,11 +1164,7 @@
               (test (first clause))
               (body (rest clause)))
             (if
-              (or
-                (and
-                  (= (type-of test) "keyword")
-                  (= (keyword-name test) "else"))
-                (= test true))
+              (or (and (= (type-of test) "keyword") (= (keyword-name test) "else")) (and (= (type-of test) "symbol") (or (= (symbol-name test) "else") (= (symbol-name test) ":else"))) (= test true))
               (compile-begin em body scope tail?)
               (do
                 (compile-expr em test scope false)

shared/static/wasm/sx/dom.sx

@@ -359,12 +359,27 @@
     (define dom-focus (fn (el) (when el (host-call el "focus"))))
     (define
       dom-parse-html
+      ;; Returns a DocumentFragment of the parsed nodes — a real Node, so it can
+      ;; be appendChild-ed as one unit AND queried (querySelector/firstChild).
+      ;; (Was body.childNodes — a NodeList, which appendChild rejects with
+      ;; "Argument 1 does not implement interface Node", silently dropping raw!
+      ;; HTML in the client SX render; dom-query on it in hs-htmx was a no-op too.)
       (fn
         (html)
         (let
           ((parser (host-new "DOMParser"))
-            (doc (host-call parser "parseFromString" html "text/html")))
-          (host-get (host-get doc "body") "childNodes"))))
+            (doc (host-call parser "parseFromString" html "text/html"))
+            (frag (create-fragment)))
+          (let
+            ((body (host-get doc "body")))
+            (let
+              loop
+              ((node (host-get body "firstChild")))
+              (when
+                (not (nil? node))
+                (host-call frag "appendChild" node) ;; appendChild MOVES the node
+                (loop (host-get body "firstChild"))))
+            frag))))
     (define
       dom-listen
       (fn

shared/static/wasm/sx/engine.sx

@@ -468,7 +468,19 @@
                   (and
                     (not (dom-has-attr? new-el aname))
                     (not (contains? reactive-attrs aname))
-                    (not (= aname "data-sx-reactive-attrs")))
+                    (not (= aname "data-sx-reactive-attrs"))
+                    ;; PRESERVE the boost's client-injected navigation attributes. The boost
+                    ;; (boost-descendants) sets sx-target/sx-swap/sx-push-url on links; the
+                    ;; SERVER never sends them, so this removal loop would strip them when a
+                    ;; morph reuses a node for a different link — leaving sx-swap unset, which
+                    ;; defaults to outerHTML and REPLACES the swap target (#content), breaking
+                    ;; every later nav. These are identical across all boosted links, so
+                    ;; keeping them on a reused node is correct.
+                    (not (= aname "sx-target"))
+                    (not (= aname "sx-swap"))
+                    (not (= aname "sx-push-url"))
+                    (not (= aname "sx-get"))
+                    (not (= aname "sx-select")))
                   (dom-remove-attr old-el aname))))
             (dom-attr-list old-el)))))
     (define

shared/static/wasm/sx/freeze.sxbc

@@ -1,3 +1,3 @@
 (sxbc 1 "050ab6181dc93341"
   (code
-    :constants ("freeze-registry" "dict" "freeze-signal" {:upvalue-count nil :arity nil :constants ("sx-freeze-scope" "context" "get" "freeze-registry" "list" "append!" "dict" "name" "signal" "dict-set!") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} "freeze-scope" {:upvalue-count nil :arity nil :constants ("scope-push!" "sx-freeze-scope" "dict-set!" "freeze-registry" "list" "cek-call" "scope-pop!") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} "cek-freeze-scope" {:upvalue-count nil :arity nil :constants ("get" "freeze-registry" "list" "dict" "for-each" {:upvalue-count nil :arity nil :constants ("dict-set!" "get" "name" "signal-value" "signal") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} "name" "signals") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} "cek-freeze-all" {:upvalue-count nil :arity nil :constants ("map" {:upvalue-count nil :arity nil :constants ("cek-freeze-scope") :bytecode (nil nil nil nil nil nil nil nil)} "keys" "freeze-registry") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} "cek-thaw-scope" {:upvalue-count nil :arity nil :constants ("get" "freeze-registry" "list" "signals" "for-each" {:upvalue-count nil :arity nil :constants ("get" "name" "signal" "not" "nil?" "reset!") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)}) :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} "cek-thaw-all" {:upvalue-count nil :arity nil :constants ("for-each" {:upvalue-count nil :arity nil :constants ("cek-thaw-scope" "get" "name") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)}) :bytecode (nil nil nil nil nil nil nil nil nil nil)} "freeze-to-sx" {:upvalue-count nil :arity nil :constants ("sx-serialize" "cek-freeze-scope") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil)} "thaw-from-sx" {:upvalue-count nil :arity nil :constants ("sx-parse" "not" "empty?" "first" "cek-thaw-scope" "get" "name") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} {:library (sx freeze) :op "import"}) :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)))
+    :constants ("freeze-registry" "dict" "freeze-signal" {:upvalue-count 0 :arity 2 :constants ("sx-freeze-scope" "context" "freeze-registry" "get" "list" "name" "signal" "dict" "append!" "dict-set!") :bytecode (1 0 0 2 52 1 0 2 17 2 16 2 33 55 0 20 2 0 16 2 52 3 0 2 6 34 5 0 5 52 4 0 0 17 3 16 3 1 5 0 16 0 1 6 0 16 1 52 7 0 4 52 8 0 2 5 20 2 0 16 2 16 3 52 9 0 3 32 1 0 2 50)} "freeze-scope" {:upvalue-count 0 :arity 2 :constants ("sx-freeze-scope" "scope-push!" "freeze-registry" "list" "dict-set!" "cek-call" "scope-pop!") :bytecode (1 0 0 16 0 52 1 0 2 5 20 2 0 16 0 52 3 0 0 52 4 0 3 5 16 1 2 52 5 0 2 5 1 0 0 52 6 0 1 5 2 50)} "cek-freeze-scope" {:upvalue-count 0 :arity 1 :constants ("freeze-registry" "get" "list" "dict" {:upvalue-count 1 :arity 1 :constants ("name" "get" "signal-value" "signal" "dict-set!") :bytecode (18 0 16 0 1 0 0 52 1 0 2 20 2 0 16 0 1 3 0 52 1 0 2 48 1 52 4 0 3 50)} "for-each" "name" "signals") :bytecode (20 0 0 16 0 52 1 0 2 6 34 5 0 5 52 2 0 0 17 1 52 3 0 0 17 2 51 4 0 1 2 16 1 52 5 0 2 5 1 6 0 16 0 1 7 0 16 2 52 3 0 4 50)} "cek-freeze-all" {:upvalue-count 0 :arity 0 :constants ({:upvalue-count 0 :arity 1 :constants ("cek-freeze-scope") :bytecode (20 0 0 16 0 49 1 50)} "freeze-registry" "keys" "map") :bytecode (51 0 0 20 1 0 52 2 0 1 52 3 0 2 50)} "cek-thaw-scope" {:upvalue-count 0 :arity 2 :constants ("freeze-registry" "get" "list" "signals" {:upvalue-count 1 :arity 1 :constants ("name" "get" "signal" "nil?" "reset!") :bytecode (16 0 1 0 0 52 1 0 2 17 1 16 0 1 2 0 52 1 0 2 17 2 18 0 16 1 52 1 0 2 17 3 16 3 52 3 0 1 167 33 12 0 20 4 0 16 2 16 3 49 2 32 1 0 2 50)} "for-each") :bytecode (20 0 0 16 0 52 1 0 2 6 34 5 0 5 52 2 0 0 17 2 16 1 1 3 0 52 1 0 2 17 3 16 3 33 14 0 51 4 0 1 3 16 2 52 5 0 2 32 1 0 2 50)} "cek-thaw-all" {:upvalue-count 0 :arity 1 :constants ({:upvalue-count 0 :arity 1 :constants ("cek-thaw-scope" "name" "get") :bytecode (20 0 0 16 0 1 1 0 52 2 0 2 16 0 49 2 50)} "for-each") :bytecode (51 0 0 16 0 52 1 0 2 50)} "freeze-to-sx" {:upvalue-count 0 :arity 1 :constants ("cek-freeze-scope" "sx-serialize") :bytecode (20 0 0 16 0 48 1 52 1 0 1 50)} "thaw-from-sx" {:upvalue-count 0 :arity 1 :constants ("sx-parse" "empty?" "cek-thaw-scope" "name" "get") :bytecode (20 0 0 16 0 48 1 17 1 16 1 52 1 0 1 167 33 24 0 16 1 169 17 2 20 2 0 16 2 1 3 0 52 4 0 2 16 2 49 2 32 1 0 2 50)} {:library (sx freeze) :op "import"}) :bytecode (52 1 0 0 128 0 0 5 51 3 0 128 2 0 5 51 5 0 128 4 0 5 51 7 0 128 6 0 5 51 9 0 128 8 0 5 51 11 0 128 10 0 5 51 13 0 128 12 0 5 51 15 0 128 14 0 5 51 17 0 128 16 0 5 1 18 0 112 50)))

shared/static/wasm/sx/harness-reactive.sxbc

@@ -1,3 +1,3 @@
 (sxbc 1 "0bc2cc2f659d5a90"
   (code
-    :constants ("assert-signal-value" {:upvalue-count nil :arity nil :constants ("deref" "assert=" "str" "Expected signal value " ", got ") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} "assert-signal-has-subscribers" {:upvalue-count nil :arity nil :constants ("assert" ">" "len" "signal-subscribers" nil "Expected signal to have subscribers") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} "assert-signal-no-subscribers" {:upvalue-count nil :arity nil :constants ("assert" "=" "len" "signal-subscribers" nil "Expected signal to have no subscribers") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} "assert-signal-subscriber-count" {:upvalue-count nil :arity nil :constants ("len" "signal-subscribers" "assert=" "str" "Expected " " subscribers, got ") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} "simulate-signal-set!" {:upvalue-count nil :arity nil :constants ("reset!") :bytecode (nil nil nil nil nil nil nil nil nil nil)} "simulate-signal-swap!" {:upvalue-count nil :arity nil :constants ("swap!") :bytecode (nil nil nil nil nil nil nil nil nil nil)} "assert-computed-dep-count" {:upvalue-count nil :arity nil :constants ("len" "signal-deps" "assert=" "str" "Expected " " deps, got ") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} "assert-computed-depends-on" {:upvalue-count nil :arity nil :constants ("assert" "contains?" "signal-deps" "Expected computed to depend on the given signal") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} "count-effect-runs" {:upvalue-count nil :arity nil :constants ("signal" nil "effect" {:upvalue-count nil :arity nil :constants ("deref") :bytecode (nil nil nil nil nil nil nil)} {:upvalue-count nil :arity nil :constants ("+" nil "cek-call") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)}) :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} "make-test-signal" {:upvalue-count nil :arity nil :constants ("signal" "list" "effect" {:upvalue-count nil :arity nil :constants ("append!" "deref") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil)} "history") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} "assert-batch-coalesces" {:upvalue-count nil :arity nil :constants (nil "signal" "effect" {:upvalue-count nil :arity nil :constants ("deref" "+" nil) :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} "batch" "assert=" "str" "Expected " " notifications, got ") :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)} {:library (sx harness-reactive) :op "import"}) :bytecode (nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil)))
+    :constants ("assert-signal-value" {:upvalue-count 0 :arity 2 :constants ("deref" "assert=" "Expected signal value " ", got " "str") :bytecode (16 0 52 0 0 1 17 2 20 1 0 16 2 16 1 1 2 0 16 1 1 3 0 16 2 52 4 0 4 49 3 50)} "assert-signal-has-subscribers" {:upvalue-count 0 :arity 1 :constants ("assert" "signal-subscribers" 0 "Expected signal to have subscribers") :bytecode (20 0 0 20 1 0 16 0 48 1 168 1 2 0 166 1 3 0 49 2 50)} "assert-signal-no-subscribers" {:upvalue-count 0 :arity 1 :constants ("assert" "signal-subscribers" 0 "Expected signal to have no subscribers") :bytecode (20 0 0 20 1 0 16 0 48 1 168 1 2 0 164 1 3 0 49 2 50)} "assert-signal-subscriber-count" {:upvalue-count 0 :arity 2 :constants ("signal-subscribers" "assert=" "Expected " " subscribers, got " "str") :bytecode (20 0 0 16 0 48 1 168 17 2 20 1 0 16 2 16 1 1 2 0 16 1 1 3 0 16 2 52 4 0 4 49 3 50)} "simulate-signal-set!" {:upvalue-count 0 :arity 2 :constants ("reset!") :bytecode (20 0 0 16 0 16 1 49 2 50)} "simulate-signal-swap!" {:upvalue-count 0 :arity 2 :constants ("swap!") :bytecode (20 0 0 16 0 16 1 49 2 50)} "assert-computed-dep-count" {:upvalue-count 0 :arity 2 :constants ("signal-deps" "assert=" "Expected " " deps, got " "str") :bytecode (20 0 0 16 0 48 1 168 17 2 20 1 0 16 2 16 1 1 2 0 16 1 1 3 0 16 2 52 4 0 4 49 3 50)} "assert-computed-depends-on" {:upvalue-count 0 :arity 2 :constants ("assert" "signal-deps" "contains?" "Expected computed to depend on the given signal") :bytecode (20 0 0 20 1 0 16 0 48 1 16 1 52 2 0 2 1 3 0 49 2 50)} "count-effect-runs" {:upvalue-count 0 :arity 1 :constants ("signal" 0 "effect" {:upvalue-count 1 :arity 0 :constants ("deref") :bytecode (18 0 52 0 0 1 50)} {:upvalue-count 2 :arity 0 :constants (1 "cek-call") :bytecode (18 0 1 0 0 160 19 0 5 18 1 2 52 1 0 2 50)}) :bytecode (20 0 0 1 1 0 48 1 17 1 20 2 0 51 3 0 1 1 48 1 5 1 1 0 17 2 20 2 0 51 4 0 1 2 1 0 48 1 17 3 16 2 50)} "make-test-signal" {:upvalue-count 0 :arity 1 :constants ("signal" "list" "effect" {:upvalue-count 2 :arity 0 :constants ("deref" "append!") :bytecode (18 0 18 1 52 0 0 1 52 1 0 2 50)} "history") :bytecode (20 0 0 16 0 48 1 17 1 52 1 0 0 17 2 20 2 0 51 3 0 1 2 1 1 48 1 5 1 0 0 16 1 1 4 0 16 2 65 2 0 50)} "assert-batch-coalesces" {:upvalue-count 0 :arity 2 :constants (0 "signal" "effect" {:upvalue-count 2 :arity 0 :constants ("deref" 1) :bytecode (18 0 52 0 0 1 5 18 1 1 1 0 160 19 1 50)} "batch" "assert=" "Expected " " notifications, got " "str") :bytecode (1 0 0 17 2 20 1 0 1 0 0 48 1 17 3 20 2 0 51 3 0 1 3 1 2 48 1 5 1 0 0 17 2 5 20 4 0 16 0 48 1 5 20 5 0 16 2 16 1 1 6 0 16 1 1 7 0 16 2 52 8 0 4 49 3 50)} {:library (sx harness-reactive) :op "import"}) :bytecode (51 1 0 128 0 0 5 51 3 0 128 2 0 5 51 5 0 128 4 0 5 51 7 0 128 6 0 5 51 9 0 128 8 0 5 51 11 0 128 10 0 5 51 13 0 128 12 0 5 51 15 0 128 14 0 5 51 17 0 128 16 0 5 51 19 0 128 18 0 5 51 21 0 128 20 0 5 1 22 0 112 50)))

shared/static/wasm/sx/hs-compiler.sx

@@ -226,6 +226,28 @@
                             value)
                           (list (quote set!) (hs-to-sx target) value)))))))
               (true (list (quote set!) (hs-to-sx target) value)))))))
+    ;; Throttle/debounce extraction state — module-level so they don't get
+    ;; redefined on every emit-on call (which was causing JIT churn). Set
+    ;; via _strip-throttle-debounce at the start of each emit-on, used in
+    ;; the handler-build step inside scan-on.
+    (define _throttle-ms nil)
+    (define _debounce-ms nil)
+    (define
+      _strip-throttle-debounce
+      (fn
+        (lst)
+        (cond
+          ((<= (len lst) 1) lst)
+          ((= (first lst) :throttle)
+            (do
+              (set! _throttle-ms (nth lst 1))
+              (_strip-throttle-debounce (rest (rest lst)))))
+          ((= (first lst) :debounce)
+            (do
+              (set! _debounce-ms (nth lst 1))
+              (_strip-throttle-debounce (rest (rest lst)))))
+          (true
+            (cons (first lst) (_strip-throttle-debounce (rest lst)))))))
     (define
       emit-on
       (fn
@@ -234,6 +256,8 @@
           ((parts (rest ast)))
           (let
             ((event-name (first parts)))
+            (set! _throttle-ms nil)
+            (set! _debounce-ms nil)
             (define
               scan-on
               (fn
@@ -266,6 +290,13 @@
                                   ((wrapped-body (if catch-info (let ((var (make-symbol (nth catch-info 0))) (catch-body (hs-to-sx (nth catch-info 1)))) (if finally-info (list (quote let) (list (list (quote __hs-exc) nil) (list (quote __hs-reraise) false)) (list (quote do) (list (quote guard) (list var (list true (list (quote let) (list (list var (list (quote host-hs-normalize-exc) var))) (list (quote guard) (list (quote __inner-exc) (list true (list (quote do) (list (quote set!) (quote __hs-exc) (quote __inner-exc)) (list (quote set!) (quote __hs-reraise) true)))) catch-body)))) compiled-body) (hs-to-sx finally-info) (list (quote when) (quote __hs-reraise) (list (quote raise) (quote __hs-exc))))) (list (quote let) (list (list (quote __hs-exc) nil) (list (quote __hs-reraise) false)) (list (quote do) (list (quote guard) (list var (list true (list (quote let) (list (list var (list (quote host-hs-normalize-exc) var))) (list (quote guard) (list (quote __inner-exc) (list true (list (quote do) (list (quote set!) (quote __hs-exc) (quote __inner-exc)) (list (quote set!) (quote __hs-reraise) true)))) catch-body)))) compiled-body) (list (quote when) (quote __hs-reraise) (list (quote raise) (quote __hs-exc))))))) (if finally-info (list (quote do) compiled-body (hs-to-sx finally-info)) compiled-body))))
                                   (let
                                     ((handler (let ((uses-the-result? (fn (expr) (cond ((= expr (quote the-result)) true) ((list? expr) (some (fn (x) (uses-the-result? x)) expr)) (true false))))) (let ((base-handler (list (quote fn) (list (quote event)) (if (uses-the-result? wrapped-body) (list (quote let) (list (list (quote the-result) nil)) wrapped-body) wrapped-body)))) (if count-filter-info (let ((mn (get count-filter-info "min")) (mx (get count-filter-info "max"))) (list (quote let) (list (list (quote __hs-count) 0)) (list (quote fn) (list (quote event)) (list (quote begin) (list (quote set!) (quote __hs-count) (list (quote +) (quote __hs-count) 1)) (list (quote when) (if (= mx -1) (list (quote >=) (quote __hs-count) mn) (list (quote and) (list (quote >=) (quote __hs-count) mn) (list (quote <=) (quote __hs-count) mx))) (nth base-handler 2)))))) base-handler)))))
+                                    (let
+                                      ((handler (cond
+                                                  (_throttle-ms
+                                                    (list (quote hs-throttle!) handler (hs-to-sx _throttle-ms)))
+                                                  (_debounce-ms
+                                                    (list (quote hs-debounce!) handler (hs-to-sx _debounce-ms)))
+                                                  (true handler))))
                                     (let
                                       ((on-call (if every? (list (quote hs-on-every) target event-name handler) (list (quote hs-on) target event-name handler))))
                                       (cond
@@ -325,7 +356,7 @@
                                                       (first pair)
                                                       handler))
                                                   or-sources)))
-                                            on-call)))))))))))))
+                                            on-call))))))))))))))
                   ((= (first items) :from)
                     (scan-on
                       (rest (rest items))
@@ -469,7 +500,7 @@
                       count-filter-info
                       elsewhere?
                       or-sources)))))
-            (scan-on (rest parts) nil nil false nil nil nil nil nil false nil)))))
+            (scan-on (_strip-throttle-debounce (rest parts)) nil nil false nil nil nil nil nil false nil)))))
     (define
       emit-send
       (fn
@@ -2490,6 +2521,15 @@
                             (quote fn)
                             (list (quote it))
                             (hs-to-sx body))))
+                      ((and (list? expr) (= (first expr) (quote attr)))
+                        (list
+                          (quote hs-attr-watch!)
+                          (hs-to-sx (nth expr 2))
+                          (nth expr 1)
+                          (list
+                            (quote fn)
+                            (list (quote it))
+                            (hs-to-sx body))))
                       (true nil))))
                 ((= head (quote init))
                   (list

shared/static/wasm/sx/hs-parser.sx

@@ -1358,7 +1358,17 @@
                           cls
                           (first extra-classes)
                           tgt))
-                      ((match-kw "for")
+                      ((and
+                          (= (tp-type) "keyword") (= (tp-val) "for")
+                          ;; Only consume 'for' as a duration clause if the next
+                          ;; token is NOT '<ident> in ...' — that pattern is a
+                          ;; for-in loop, not a toggle duration.
+                          (not
+                            (and
+                              (> (len tokens) (+ p 2))
+                              (= (get (nth tokens (+ p 1)) "type") "ident")
+                              (= (get (nth tokens (+ p 2)) "value") "in")))
+                          (do (adv!) true))
                         (let
                           ((dur (parse-expr)))
                           (list (quote toggle-class-for) cls tgt dur)))
@@ -3090,7 +3100,17 @@
                               (= (tp-val) "queue"))
                             (do (adv!) (adv!)))
                           (let
-                            ((every? (match-kw "every")))
+                            ((every? (match-kw "every"))
+                             (throttle-ms nil)
+                             (debounce-ms nil))
+                            ;; 'throttled at <duration>' / 'debounced at <duration>'
+                            ;; — parsed as handler modifiers, captured as :throttle / :debounce parts.
+                            (when (and (= (tp-type) "ident") (= (tp-val) "throttled"))
+                              (adv!)
+                              (when (match-kw "at") (set! throttle-ms (parse-expr))))
+                            (when (and (= (tp-type) "ident") (= (tp-val) "debounced"))
+                              (adv!)
+                              (when (match-kw "at") (set! debounce-ms (parse-expr))))
                             (let
                               ((having (if (or h-margin h-threshold) (dict "margin" h-margin "threshold" h-threshold) nil)))
                               (let
@@ -3105,6 +3125,10 @@
                                   (match-kw "end")
                                   (let
                                     ((parts (list (quote on) event-name)))
+                                    (let
+                                      ((parts (if throttle-ms (append parts (list :throttle throttle-ms)) parts)))
+                                    (let
+                                      ((parts (if debounce-ms (append parts (list :debounce debounce-ms)) parts)))
                                     (let
                                       ((parts (if every? (append parts (list :every true)) parts)))
                                       (let
@@ -3127,7 +3151,7 @@
                                                         ((parts (if finally-clause (append parts (list :finally finally-clause)) parts)))
                                                         (let
                                                           ((parts (append parts (list (if (> (len event-vars) 0) (cons (quote do) (append (map (fn (nm) (list (quote ref) nm)) event-vars) (if (and (list? body) (= (first body) (quote do))) (rest body) (list body)))) body)))))
-                                                          parts))))))))))))))))))))))))))
+                                                          parts))))))))))))))))))))))))))))
       (define
         parse-init-feat
         (fn
@@ -3177,6 +3201,7 @@
             (or
               (= (tp-type) "hat")
               (= (tp-type) "local")
+              (= (tp-type) "attr")
               (and (= (tp-type) "keyword") (= (tp-val) "dom")))
             (let
               ((expr (parse-expr)))