host: blog SPA scaffolding (WASM kernel) — server side complete, boost blocked on bundle rebuild

Turn the blog into a SPA using the SX-htmx engine (web/engine.sx) booting the
WASM OCaml kernel (same evaluator as the server) in-browser, with sx-boost
fragment-swapping every link into #content.

Server side DONE + verified:
- lib/host/static.sx: GET /static/** serves shared/static via the file-read
  primitive (ctype by ext, traversal-guarded, 404 on missing). Wired into
  serve.sh (module + route group). Tested: kernel JS + .wasm binary-exact.
- host/blog--page is now the SPA shell: full page = WASM boot scripts +
  sx-boost=#content wrapper + #content; on SX-Request:true returns ONLY the
  inner content fragment for the engine to swap. All 13 handlers thread req.
- docker-compose mounts ./shared/static.
- lib/host/playwright/spa-check.{spec.js,run-spa-check.sh}: boot/boost/swap/back.

Client side: the WASM kernel BOOTS (SxKernel object, data-sx-ready=true, web
stack loads). BLOCKER: the bundled .sxbc throw 'VM: unknown opcode 0' vs this
worktree's kernel -> .sx source fallback -> boot.sx source fails 'Expected
list, got string' -> process-boosted never binds links (boosted 0/N). Fix =
rebuild a consistent WASM bundle (recompile .sxbc against the kernel via
scripts/sx-build-all.sh); the browser wasm target isn't built here yet. See
plans/host-spa.md. Live NOT redeployed (stays on pre-SPA process).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/host/playwright/run-spa-check.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# Browser check for the blog SPA. Spins up an EPHEMERAL host server (this
+# worktree's binary + lib, a temp persist dir), seeds a couple of posts, runs
+# lib/host/playwright/spa-check.spec.js in the main worktree's Playwright, then
+# tears everything down. Verifies the WASM OCaml kernel boots in-browser and
+# sx-boost turns the blog into a SPA. No live-site dependency.
+#
+#   bash lib/host/playwright/run-spa-check.sh
+#
+# Requires: the OCaml binary built (hosts/ocaml/_build/default/bin/sx_server.exe)
+# and Playwright + chromium in /root/rose-ash (the architecture worktree).
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+ROOT=$(pwd)
+
+PORT="${SPA_PORT:-8914}"
+PW_DIR="${PW_DIR:-/root/rose-ash}"          # worktree that has node_modules + chromium
+USER="admin"
+PASS="spa-check-pw"
+SECRET="spa-check-secret"
+PDIR=$(mktemp -d)
+JAR=$(mktemp)
+SPEC_SRC="lib/host/playwright/spa-check.spec.js"
+SPEC_DST="$PW_DIR/tests/playwright/_spa-check.spec.js"
+SERVE_LOG=$(mktemp)
+
+cleanup() {
+  [ -n "${SVPID:-}" ] && kill "$SVPID" 2>/dev/null
+  local pid
+  pid=$(ss -lptn "sport = :$PORT" 2>/dev/null | grep -oE 'pid=[0-9]+' | head -1 | cut -d= -f2)
+  [ -n "$pid" ] && kill "$pid" 2>/dev/null
+  rm -f "$SPEC_DST" "$JAR" "$SERVE_LOG"
+  rm -rf "$PDIR"
+}
+trap cleanup EXIT
+
+echo "== starting ephemeral host server on :$PORT (persist=$PDIR) =="
+HOST_PORT="$PORT" SX_PERSIST_DIR="$PDIR" \
+  SX_ADMIN_USER="$USER" SX_ADMIN_PASSWORD="$PASS" SX_SESSION_SECRET="$SECRET" \
+  bash lib/host/serve.sh >"$SERVE_LOG" 2>&1 &
+SVPID=$!
+
+for i in $(seq 1 60); do
+  curl -sf -o /dev/null "http://127.0.0.1:$PORT/health" 2>/dev/null && break
+  sleep 1
+  [ "$i" = "60" ] && { echo "server never came up:"; cat "$SERVE_LOG"; exit 1; }
+done
+echo "== server up =="
+
+echo "== seeding posts =="
+curl -s -c "$JAR" -o /dev/null -X POST "http://127.0.0.1:$PORT/login" \
+  --data "username=$USER&password=$PASS"
+for t in "Alpha Post" "Beta Post"; do
+  curl -s -b "$JAR" -o /dev/null -X POST "http://127.0.0.1:$PORT/new" \
+    --data "title=$t&sx_content=(article (h1 \"$t\") (p \"body\"))&status=published"
+done
+echo "== seeded ($(curl -s "http://127.0.0.1:$PORT/posts" | grep -o '"slug"' | wc -l) posts) =="
+
+echo "== running Playwright =="
+cp "$ROOT/$SPEC_SRC" "$SPEC_DST"
+cd "$PW_DIR"
+SX_TEST_URL="http://127.0.0.1:$PORT" \
+  node_modules/.bin/playwright test _spa-check.spec.js --workers=1 \
+  --config tests/playwright/playwright.config.js
+RC=$?
+
+echo "== done (exit $RC) =="
+exit $RC

lib/host/playwright/spa-check.spec.js

@@ -0,0 +1,65 @@
+// Browser check for the blog SPA (lib/host/blog.sx + lib/host/static.sx). Runs
+// against an ephemeral host server seeded with a couple of posts by
+// run-spa-check.sh, which copies this spec into the Playwright env and sets
+// SX_TEST_URL. Verifies the WASM OCaml kernel boots in the browser, the SX-htmx
+// engine activates sx-boost on #content's links, and clicking a link does a
+// fragment swap (no full page reload) with history — i.e. it's a real SPA.
+const { test, expect } = require('playwright/test');
+
+// boot-init sets data-sx-ready="true" on <html> once the WASM kernel + web stack
+// have loaded and the page has been processed. WASM compile + ~25 asset fetches,
+// so allow generous time.
+async function waitReady(page) {
+  await expect(page.locator('html[data-sx-ready="true"]')).toHaveCount(1, { timeout: 45000 });
+}
+
+// a post link in the listing (trailing slash); skip /new, /login, /tags.
+const POSTLINK = '#content a[href$="/"]';
+
+test.describe('blog SPA', () => {
+  test('WASM kernel boots and marks the document ready', async ({ page }) => {
+    const errors = [];
+    page.on('console', (m) => { if (m.type() === 'error') errors.push(m.text()); });
+    page.on('pageerror', (e) => errors.push(String(e)));
+    await page.goto('/');
+    await waitReady(page);
+    // the shell shipped the WASM loaders
+    expect(await page.locator('script[src*="sx_browser.bc.wasm.js"]').count()).toBe(1);
+    expect(await page.locator('script[src*="sx-platform.js"]').count()).toBe(1);
+    // no boot-time JS errors
+    expect(errors, errors.join('\n')).toEqual([]);
+  });
+
+  test('links inside #content get boosted', async ({ page }) => {
+    await page.goto('/');
+    await waitReady(page);
+    // the engine marks a boosted element with data-sx-bound containing "boost"
+    await expect(page.locator(POSTLINK).first()).toHaveAttribute('data-sx-bound', /boost/, { timeout: 15000 });
+  });
+
+  test('clicking a link does a fragment swap — no full reload, URL updates', async ({ page }) => {
+    await page.goto('/');
+    await waitReady(page);
+    // sentinel survives ONLY if there is no full-page reload
+    await page.evaluate(() => { window.__noReload = true; });
+    const link = page.locator(POSTLINK).first();
+    const href = await link.getAttribute('href');
+    await link.click();
+    await page.waitForURL((u) => u.pathname === href, { timeout: 15000 });
+    expect(await page.evaluate(() => window.__noReload)).toBe(true);     // no reload
+    // content was swapped into #content (a post page carries the post footer)
+    await expect(page.locator('#content')).toContainText(/all posts/i, { timeout: 15000 });
+  });
+
+  test('back button restores the listing', async ({ page }) => {
+    await page.goto('/');
+    await waitReady(page);
+    const link = page.locator(POSTLINK).first();
+    const href = await link.getAttribute('href');
+    await link.click();
+    await page.waitForURL((u) => u.pathname === href, { timeout: 15000 });
+    await page.goBack();
+    await page.waitForURL((u) => u.pathname === '/', { timeout: 15000 });
+    await expect(page.locator('#content h1')).toContainText('Posts');
+  });
+});