diff --git a/next/kernel/http_server.erl b/next/kernel/http_server.erl
index 3112721d..18827660 100644
--- a/next/kernel/http_server.erl
+++ b/next/kernel/http_server.erl
@@ -1,7 +1,8 @@
 -module(http_server).
 -export([route/1, ok_response/1, not_found_response/0,
          welcome_body/0, capabilities_body/0,
-         capabilities_path/0]).
+         capabilities_path/0,
+         match_prefix/2, actors_prefix/0, actor_doc_response/1]).
 
 %% HTTP request router per design §16.1.
 %%
@@ -34,6 +35,17 @@ dispatch(<<71, 69, 84>>,
          <<47,46,119,101,108,108,45,107,110,111,119,110,
            47,115,120,45,99,97,112,97,98,105,108,105,116,105,101,115>>) ->
     ok_response(capabilities_body());
+%% GET /actors/{id}
+dispatch(<<71, 69, 84>>, Path) ->
+    case match_prefix(actors_prefix(), Path) of
+        {ok, Id} ->
+            case byte_size(Id) of
+                0 -> not_found_response();
+                _ -> actor_doc_response(Id)
+            end;
+        nomatch ->
+            not_found_response()
+    end;
 dispatch(_, _) ->
     not_found_response().
 
@@ -73,3 +85,30 @@ not_found_response() ->
 field(K, [{K, V} | _]) -> V;
 field(K, [_ | Rest]) -> field(K, Rest);
 field(_, []) -> nil.
+
+%% ── Dynamic-segment routing ─────────────────────────────────────
+%%
+%% match_prefix(Prefix, Path) — if Path starts with the entire
+%% Prefix binary, return {ok, Rest} where Rest is the remaining
+%% bytes; else return nomatch. Pure byte-level pattern match,
+%% no regex / no parsing. Path-segment splitting comes in later
+%% sub-deliverables (8c-art, 8c-proj) where it's needed.
+
+match_prefix(<<>>, Rest) -> {ok, Rest};
+match_prefix(<<B, PRest/binary>>, <<B, PathRest/binary>>) ->
+    match_prefix(PRest, PathRest);
+match_prefix(_, _) -> nomatch.
+
+%% "/actors/" — 8 bytes: 47 97 99 116 111 114 115 47
+actors_prefix() ->
+    <<47,97,99,116,111,114,115,47>>.
+
+%% Actor doc stub. Real implementation (Step 8c continuation) will
+%% fetch the actor-state projection entry and serialise it; v1
+%% returns the id as the body so route resolution can be exercised
+%% end-to-end without the projection wiring.
+actor_doc_response(Id) ->
+    %% "actor: " — 7 bytes
+    Pre = <<97,99,116,111,114,58,32>>,
+    Body = <<Pre/binary, Id/binary, 10>>,
+    ok_response(Body).
diff --git a/next/tests/http_actors.sh b/next/tests/http_actors.sh
new file mode 100755
index 00000000..c0fe9b5c
--- /dev/null
+++ b/next/tests/http_actors.sh
@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+# next/tests/http_actors.sh — Step 8c-actors acceptance test.
+#
+# Exercises match_prefix/2 + GET /actors/{id} route. The id is
+# carried back in the response body so callers can confirm the
+# right segment was extracted. 12 cases.
+
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+
+SX_SERVER="${SX_SERVER:-hosts/ocaml/_build/default/bin/sx_server.exe}"
+if [ ! -x "$SX_SERVER" ]; then
+  SX_SERVER="/root/rose-ash/hosts/ocaml/_build/default/bin/sx_server.exe"
+fi
+if [ ! -x "$SX_SERVER" ]; then
+  echo "ERROR: sx_server.exe not found." >&2
+  exit 1
+fi
+
+VERBOSE="${1:-}"
+PASS=0; FAIL=0; ERRORS=""
+TMPFILE=$(mktemp); trap "rm -f $TMPFILE" EXIT
+
+cat > "$TMPFILE" <<'EPOCHS'
+(epoch 1)
+(load "lib/erlang/tokenizer.sx")
+(load "lib/erlang/parser.sx")
+(load "lib/erlang/parser-core.sx")
+(load "lib/erlang/parser-expr.sx")
+(load "lib/erlang/parser-module.sx")
+(load "lib/erlang/transpile.sx")
+(load "lib/erlang/runtime.sx")
+(load "lib/erlang/vm/dispatcher.sx")
+
+(epoch 2)
+(eval "(get (erlang-load-module (file-read \"next/kernel/http_server.erl\")) :name)")
+
+;; match_prefix on a clean match returns the rest
+(epoch 10)
+(eval "(get (erlang-eval-ast \"http_server:match_prefix(<<97,98>>, <<97,98,99,100>>) =:= {ok, <<99,100>>}\") :name)")
+
+;; Empty prefix matches everything
+(epoch 11)
+(eval "(get (erlang-eval-ast \"http_server:match_prefix(<<>>, <<97,98,99>>) =:= {ok, <<97,98,99>>}\") :name)")
+
+;; No common bytes -> nomatch
+(epoch 12)
+(eval "(get (erlang-eval-ast \"http_server:match_prefix(<<97,98>>, <<120,121>>) =:= nomatch\") :name)")
+
+;; Prefix longer than path -> nomatch
+(epoch 13)
+(eval "(get (erlang-eval-ast \"http_server:match_prefix(<<97,98,99,100>>, <<97,98>>) =:= nomatch\") :name)")
+
+;; Exact match yields empty rest
+(epoch 14)
+(eval "(get (erlang-eval-ast \"http_server:match_prefix(<<97,98>>, <<97,98>>) =:= {ok, <<>>}\") :name)")
+
+;; actors_prefix is "/actors/" — 8 bytes
+(epoch 15)
+(eval "(erlang-eval-ast \"byte_size(http_server:actors_prefix())\")")
+
+;; GET /actors/alice -> 200
+(epoch 16)
+(eval "(get (erlang-eval-ast \"Req = [{method, <<71,69,84>>}, {path, <<47,97,99,116,111,114,115,47,97,108,105,99,101>>}], case http_server:route(Req) of [{status, 200} | _] -> ok; _ -> bad end\") :name)")
+
+;; The id appears in the body
+(epoch 17)
+(eval "(get (erlang-eval-ast \"Req = [{method, <<71,69,84>>}, {path, <<47,97,99,116,111,114,115,47,97,108,105,99,101>>}], R = http_server:route(Req), case R of [_, _, {body, B}] -> http_server:match_prefix(<<97,99,116,111,114,58,32>>, B) =/= nomatch; _ -> false end\") :name)")
+
+;; GET /actors/ (empty id) -> 404
+(epoch 18)
+(eval "(get (erlang-eval-ast \"Req = [{method, <<71,69,84>>}, {path, <<47,97,99,116,111,114,115,47>>}], case http_server:route(Req) of [{status, 404} | _] -> ok; _ -> bad end\") :name)")
+
+;; POST /actors/alice -> 404 (only GET)
+(epoch 19)
+(eval "(get (erlang-eval-ast \"Req = [{method, <<80,79,83,84>>}, {path, <<47,97,99,116,111,114,115,47,97,108,105,99,101>>}], case http_server:route(Req) of [{status, 404} | _] -> ok; _ -> bad end\") :name)")
+
+;; GET /unrelated still 404
+(epoch 20)
+(eval "(get (erlang-eval-ast \"Req = [{method, <<71,69,84>>}, {path, <<47,102,111,111>>}], case http_server:route(Req) of [{status, 404} | _] -> ok; _ -> bad end\") :name)")
+
+;; Existing routes (GET /, capabilities) still work
+(epoch 21)
+(eval "(get (erlang-eval-ast \"Req1 = [{method, <<71,69,84>>}, {path, <<47>>}], Req2 = [{method, <<71,69,84>>}, {path, http_server:capabilities_path()}], R1 = case http_server:route(Req1) of [{status, 200} | _] -> ok; _ -> bad end, R2 = case http_server:route(Req2) of [{status, 200} | _] -> ok; _ -> bad end, {R1, R2} =:= {ok, ok}\") :name)")
+EPOCHS
+
+OUTPUT=$(timeout 60 "$SX_SERVER" < "$TMPFILE" 2>/dev/null)
+
+check() {
+  local epoch="$1" desc="$2" expected="$3"
+  local actual
+  actual=$(echo "$OUTPUT" | awk -v e="$epoch" '
+    $0 ~ "^\\(ok-len " e " " { getline; print; exit }
+    $0 ~ "^\\(ok " e " "     { print; exit }
+    $0 ~ "^\\(error " e " "  { print; exit }
+  ')
+  [ -z "$actual" ] && actual="<no output for epoch $epoch>"
+  if echo "$actual" | grep -qF -- "$expected"; then
+    PASS=$((PASS+1))
+    [ "$VERBOSE" = "-v" ] && echo "  ok $desc"
+  else
+    FAIL=$((FAIL+1))
+    ERRORS+="  FAIL [$desc] (epoch $epoch) expected: $expected | actual: $actual
+"
+  fi
+}
+
+check  2  "module load name"                  "http_server"
+check 10  "match_prefix clean match"          "true"
+check 11  "empty prefix matches all"          "true"
+check 12  "no common bytes -> nomatch"        "true"
+check 13  "prefix > path -> nomatch"          "true"
+check 14  "exact match -> empty rest"         "true"
+check 15  "actors_prefix size = 8"            "8"
+check 16  "GET /actors/alice -> 200"          "ok"
+check 17  "body carries 'actor: ' prefix"     "true"
+check 18  "GET /actors/ (empty id) -> 404"    "ok"
+check 19  "POST /actors/alice -> 404"         "ok"
+check 20  "GET /unrelated still 404"          "ok"
+check 21  "existing routes intact"            "true"
+
+TOTAL=$((PASS+FAIL))
+if [ $FAIL -eq 0 ]; then
+  echo "ok $PASS/$TOTAL next/tests/http_actors.sh passed"
+else
+  echo "FAIL $PASS/$TOTAL passed, $FAIL failed:"
+  echo "$ERRORS"
+fi
+[ $FAIL -eq 0 ]
diff --git a/plans/fed-sx-milestone-1.md b/plans/fed-sx-milestone-1.md
index a0f4466c..e11eec72 100644
--- a/plans/fed-sx-milestone-1.md
+++ b/plans/fed-sx-milestone-1.md
@@ -510,7 +510,7 @@ publish(ActorId, ActivityRequest) ->
 - [x] **8b-route** — `next/kernel/http_server.erl`: pure `route/1` dispatch + `ok_response/1`, `not_found_response/0`, `welcome_body/0`. GET / returns welcome; everything else returns 404 (graceful for missing fields). `next/tests/http_route.sh` (11 cases).
 - [ ] **8b-start** — `start/1(Port)` spawns an Erlang process hosting `http:listen/2`, requires the dict↔proplist marshaling bridge in the BIF wrapper.
 - [x] **8c-cap** — Route GET `/.well-known/sx-capabilities` (static doc: kernel/version/verbs lines). `next/tests/http_capabilities.sh` (8 cases). Other concrete routes follow.
-- [ ] **8c-actors** — Routes for `/actors/{id}` + `/actors/{id}/outbox` (needs path-prefix matching since `{id}` is dynamic).
+- [x] **8c-actors-doc** — `match_prefix/2` byte-level path-prefix matcher + GET `/actors/{id}` route returning an `actor: <id>` stub body. `/actors/{id}/outbox` deferred (needs path-segment splitting). `next/tests/http_actors.sh` (13 cases).
 - [ ] **8c-art** — Route `/artifacts/{cid}` (also path-prefix matching).
 - [ ] **8c-proj** — Routes `/projections` (list) + `/projections/{name}` (state).
 - [ ] **8c-post** — POST `/activity` glue: parse body → call `outbox:publish` with bearer-token auth (env var `NEXT_PUBLISH_TOKEN`).
@@ -988,6 +988,7 @@ A few things still under-specified; resolve as work begins.
 Newest first. One line per sub-deliverable commit. Erlang conformance gate
 (`bash lib/erlang/conformance.sh`) must remain 729/729 on every entry.
 
+- **2026-05-28** — Step 8c-actors-doc: `http_server` extended with `match_prefix/2` — pure byte-level prefix matcher built on Erlang binary pattern matching (`<<B, _/binary>>`-style head/tail walk). Empty prefix returns `{ok, FullPath}`; non-match returns `nomatch`; exact match returns `{ok, <<>>}`. Wired into a new GET `/actors/{id}` clause that extracts the id suffix and returns it as the body of `actor_doc_response/1` (stub: `actor: <id>\n`). Empty id falls into 404. `/actors/{id}/outbox` deferred to a later step (needs segment splitting beyond prefix). `next/tests/http_actors.sh` 13/13. Erlang conformance 729/729.
 - **2026-05-28** — Step 8c-cap: GET `/.well-known/sx-capabilities` route + `capabilities_body/0` + `capabilities_path/0` exposed for tests. Body is a small plain-text descriptor with `kernel: fed-sx-m1`, `version: 0.0.1`, `verbs: Create Update Delete` (hand-spelled as integer-segment binary; string-literal segments unusable in this port). `next/tests/http_capabilities.sh` 8/8 covers method+path matching, body content, the existing GET / regression-free. Step 8c split into cap (done) + actors / art / proj / post — the rest need path-prefix matching helpers since `{id}` and `{cid}` are dynamic. Erlang conformance 729/729.
 - **2026-05-28** — Step 8b-route: `next/kernel/http_server.erl` — pure `route/1` request→response dispatch. Request shape `[{method, Bin}, {path, Bin}, ...]`; response `[{status, N}, {headers, []}, {body, Bin}]`. GET / returns 200 with hand-spelled "fed-sx kernel m1" body; everything else returns 404 with "not found" body. Method/path binaries spelled byte-by-byte (string-literal segments would truncate). Split former 8b into 8b-route (done) + 8b-start (needs dict↔proplist marshaling bridge in the BIF wrapper before the spawned `http:listen` call gets useful request fields). `next/tests/http_route.sh` 11/11. Erlang conformance 729/729.
 - **2026-05-28** — Step 8a: `http:listen/2` BIF wrapper added to `lib/erlang/runtime.sx` (the briefing's single allowed scope exception). The BIF takes `(Port, Handler)`, validates Port is an integer and Handler is an Erlang fun (else `badarg`), then builds an SX-callable bridge lambda that marshals request dict↔Erlang term via `er-of-sx`/`er-to-sx` and calls `er-apply-fun` on the handler. Delegates to the native `http-listen` primitive (registered in `bin/sx_server.ml`, native-only). Tests verify registration + arg validation paths (the blocking listen loop itself is not exercised — production callers spawn an Erlang process to host the call). `next/tests/http_listen_bif.sh` 5/5; Erlang conformance preserved at 729/729 despite the runtime.sx edit. Step 8 broken into 8a–8d on the plan.