diff --git a/plans/sx-review/PLAN.md b/plans/sx-review/PLAN.md
index 4681232d..961c457e 100644
--- a/plans/sx-review/PLAN.md
+++ b/plans/sx-review/PLAN.md
@@ -223,6 +223,41 @@ tagging in constant pool (J4); redefinition invalidation (J5/J6); one browser-co
 (W14) is green.
 Gate: W14 differential. Status: DEFERRED (mitigated; only unblock if serving-JIT is wanted).
 
+### W16. Hyperscript engine — shipped-kernel conformance  *(production-facing; added post-ledger from conformance F-16–F-19)*
+Findings: F-16 (shipped browser hs cannot call functions — `host-call-fn`/`host-call-fn-raising`
+referenced by shipped `hs-runtime.sx`/`hs-integration.sx` but defined ONLY in run_tests.ml:3564;
+906 "Undefined symbol: host-call-fn" on the behavioral corpus against the shipped stack), F-17
+(shipped `shared/static/wasm/sx/hs-runtime.sx` dropped the `(jit-exclude! "hs-*")` guard that
+`lib/hyperscript/runtime.sx` has — hs is JIT-eligible in the browser where the parser-combinator
+recursion miscompiles; the tested config ≠ the shipped config), F-18 (the native runner's MOCK DOM
+is the outlier: ≥118 of the 272 "permanent red" hs failures PASS on the shipped WASM kernel +
+happy-dom — the red band mostly indicts the test env, not the engine; 9 genuine WASM-only failures
+remain to bisect: behavior-scoping ×4, as-fragment `__host_handle` leak ×3, init/where ×2), F-19
+(hs corpus drift — generated tests still expect the pre-`beingTold`/`poss` parser AST, ~50 shared
+failures on every kernel; PLUS `assert=` is `(actual expected msg)` but the generated corpus calls
+`(assert= expected actual)` so every failure prints Expected/got SWAPPED — actively misled diagnosis).
+Approach:
+1. **F-16 (quick, production):** register `host-call-fn`/`host-call-fn-raising` in the shipped
+   platform (`sx-platform.js`) — or rename the runtime's calls to the existing `host-call`. One
+   binding unbreaks ~900 hs behaviors in browsers. Same class as F-7/K42 (runner-only binding).
+2. **F-17 (quick, safety):** restore `(jit-exclude! "hs-*")` in the shipped `hs-runtime.sx`, and —
+   better — make the lib→`wasm/sx` sync SCRIPTED (this is the same manual-copy drift as C10/C11/C12/
+   C14 in W11/W15; one sync script fixes the whole family so the guard can't silently drop again).
+3. **F-19 (quick + medium):** fix `assert=` arg order (or the generator's call order) so failure
+   messages stop lying — cosmetic but it misleads every future session; then regenerate the upstream
+   hs corpus against the current parser AST (~50 tests fail purely from drift). Belongs with W14.
+4. **F-18 (medium):** re-baseline the native red band — improve the mock DOM or skip-list the
+   browser-only hs suites so FAIL means something (feeds W14's F-10 skip-list + gate). Then bisect
+   the 9 WASM-only failures — the only candidates for real shipped-kernel bugs left in hs.
+CAVEAT (accuracy): hs engine modules are shipped but may be absent from the production boot list
+(`loadWebStackFallback`, sx-platform.js:670 — hs load path "unclear/on-demand only" per F-19), so
+F-16/F-17 may be LATENT rather than live on blog.rose-ash.com today — confirm whether any served
+page loads the hs engine before treating them as a live outage.
+Ownership: F-16/F-17 are hosts-lane fixes; F-19 assert= + F-18 re-baseline are conformance/W14;
+the WASM corpus runner they need is W14's. Note: js_of_ocaml is ~1-2 orders slower on this corpus
+(≈24s/test) — gate on a curated subset, not the full 6k.
+Gate: pairs with W14 (WASM runner) and W11/W15 (sync-script). Status: OPEN — F-16/F-17 are one-liners.
+
 ### W13. JS host  *(GATE D1 — likely "delete")*
 Findings: C0a (hollow bundle), C0b (2490 fail gate), JS1 (define-record-type/makeRtd), JS2 (host-
 callback type tag), JS3 (arithmetic drops args), JS4 (`.` symbol), JS5 (runner shims), JS6 (str nil),
@@ -333,11 +368,16 @@ Status key: DONE (dc7aa709) · OPEN · PARTIAL · DEFERRED · GATE(Dn) · dup→
 ### Conformance (F1–F15, conf-S1–S5)
 - F1 [W7] OPEN dup→K18/P4 (WASM int wrap) · F2 [W14] OPEN · F3 [W7/W6] OPEN (apply + dict order) · F4 [W13/W14] GATE(D1)
 - F5 [W14] OPEN (host-neutral corpus) · F6 [W14] OPEN (directories one-host-gated) · F7 [W14] OPEN dup→K42
-- F8 [W14] OPEN (differential battery) · F9 [W7/W14] OPEN (primitive parity) dup→K53 · F10 [W14] OPEN (skip hs)
+- F8 [W14] OPEN (differential battery) · F9 [W7/W14] OPEN (primitive parity) dup→K53 · F10 [W14] OPEN (skip hs, =F18)
 - F11 [W12] OPEN dup→C24 · F12 [W6] OPEN dup→C25/26/27 · F13 [W15] DONE · F14 [W15] PARTIAL · F15 [W15] OPEN
-- conf-S1 [W14] OPEN (native-vs-WASM web-stack diff) · conf-S2 [W14] OPEN (hyperscript unverifiable)
+- F16 [W16] OPEN (shipped hs host-call-fn binding gap — one-liner, ~900 tests) dup-class→F7/K42
+- F17 [W16] OPEN (shipped hs missing jit-exclude! — sync drift) dup-class→C10/C11/C12/C14
+- F18 [W16/W14] OPEN (mock-DOM red band re-baseline + 9 WASM-only bisect) dup→F10
+- F19 [W16/W14] OPEN (hs corpus drift + inverted assert= labels)
+- conf-S1 [W14] OPEN (native-vs-WASM web-stack diff) · conf-S2 RESOLVED→promoted to F16/F17/F18
 - conf-S3 [W11] OPEN (import path browser vs test) · conf-S4 [W14] OPEN (float golden precision) · conf-S5 [W11] OPEN (JS build-flag ADT divergence)
 
 ### Tally
-~213 finding-instances. DONE: 13 (dc7aa709). PARTIAL: 4 (K19, K42, C24, F14). DEFERRED: 12 (W11 JIT).
-GATE(D1): ~16 (JS host + Python standalone). OPEN: the rest, distributed across W1–W12/W14/W15.
+~217 finding-instances (incl. late conformance F16–F19). DONE: 13 (dc7aa709). PARTIAL: 4 (K19, K42,
+C24, F14). DEFERRED: 12 (W11 JIT). GATE(D1): ~16 (JS host + Python standalone). RESOLVED-superseded:
+1 (conf-S2). OPEN: the rest, distributed across W1–W12/W14/W15/W16.