host: wire :body into live rendering — composition fold is fold #1, live (roadmap step 2)

A record may carry a :body (a composition node); host/blog-post renders it via the
render-fold (host/comp-render) against a context built from the principal (auth), else the
legacy sx_content path. compose.sx loaded into the host (serve.sh + conformance.sh module
lists). host/blog-body-of / host/blog--set-body!.

Seeded /compose-demo: ONE composition object that shows seq + alt(when auth) + row(par) +
each, and renders DIFFERENTLY by context. Verified live-path (ephemeral SX_SERVING_JIT=1):
anon -> login-prompt (else) + columns + event list; authed -> member block (when auth),
login-prompt gone. The object is the program; the render is the execution -- now live.
Focused eval confirms the in-process render matches the test (ANON<span>..> vs MEMBER<..>).
Tests added; full blog suite still box-contended.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

applications/sxtp/spec.sx

@@ -97,6 +97,42 @@
       (:body "Any SX value — event payload (optional)")
       (:time "Number — unix timestamp (optional)"))))
 
+;; ── patch (DOM fragment patch — borrowed from Datastar) ───────────
+;; A server-driven instruction to morph a region of the client DOM.
+;; Subsumes HTMX swap modes; the :body is an SX subtree that the client
+;; renders to DOM nodes before applying the mode at the target.
+(define
+  patch-fields
+  (quote
+    ((:target "String — CSS selector for the element to patch (required)")
+      (:mode "Symbol — patch mode (optional, default outer)")
+      (:body "SX tree — the new content (omitted for mode remove)")
+      (:transition "Boolean — use a view transition (optional, default false)"))))
+
+(define
+  patch-modes
+  (quote
+    ((outer "Replace the target's outerHTML (default; the morph target)")
+      (inner "Replace the target's innerHTML, preserving the wrapper")
+      (replace "Hard-replace without morphing (no diff, plain swap)")
+      (prepend "Insert the body as the target's first child")
+      (append "Insert the body as the target's last child")
+      (before "Insert the body before the target")
+      (after "Insert the body after the target")
+      (remove "Detach the target; :body MUST be absent"))))
+
+;; ── signals (reactive state patch — borrowed from Datastar) ──────
+;; A server-driven update to client-side reactive signals. :values is a
+;; dict of signal-name -> new-value; setting a value to nil REMOVES the
+;; signal. With :only-if-missing true, existing signals are not touched
+;; (use this to lazily initialise signal state without clobbering).
+(define
+  signals-fields
+  (quote
+    ((:values "Dict — signal-name -> new-value (required)")
+      (:only-if-missing
+        "Boolean — only set signals that don't yet exist (optional, default false)"))))
+
 (define
   example-navigate
   (quote
@@ -148,6 +184,23 @@
           :message "No such post"
           :retry false)))))
 
+;; A streaming response intermixing patch + signals: the server pushes
+;; DOM updates AND signal updates over the same channel. The client
+;; dispatches each message by its head symbol; ordering is preserved.
+(define
+  example-patch-stream
+  (quote
+    ((request :verb subscribe :path "/cart/live" :capabilities (fetch))
+      (response :status ok :stream true)
+      (signals :values {:cart/count 3 :cart/loading false})
+      (patch
+        :target "#cart-mini"
+        :mode outer
+        :body (~cart-mini :count 3 :total 47.50))
+      (patch :target "#flash" :mode inner :body (p "Item added."))
+      (signals :values {:cart/loading true})
+      (patch :target "#cart-loading-spinner" :mode remove))))
+
 (define
   example-inspect
   (quote

docker-compose.dev-sx-host.yml

@@ -0,0 +1,58 @@
+# host-on-sx live service — the SX web host (lib/host) served by the native
+# http-listen server via lib/host/serve.sh. Joins the sx-dev project + externalnet
+# so Caddy can reverse_proxy a subdomain to it (blog.rose-ash.com). Isolated from
+# the sx_docs server: separate container, separate port.
+#
+# Usage:
+#   docker compose -p sx-dev -f docker-compose.dev-sx-host.yml up -d sx_host
+#   docker compose -p sx-dev -f docker-compose.dev-sx-host.yml logs -f sx_host
+#   docker compose -p sx-dev -f docker-compose.dev-sx-host.yml down
+
+services:
+  sx_host:
+    image: registry.rose-ash.com:5000/sx_docs:latest
+    container_name: sx-dev-sx_host-1
+    entrypoint: ["bash", "/app/lib/host/serve.sh"]
+    working_dir: /app
+    environment:
+      SX_PROJECT_DIR: /app
+      SX_SERVER: /app/bin/sx_server
+      HOST_PORT: "8000"
+      # Bind all interfaces so Caddy (on externalnet) can reach it.
+      SX_HTTP_HOST: "0.0.0.0"
+      # Durable persist store root — on a named volume so data survives restarts.
+      SX_PERSIST_DIR: /data/persist
+      # Blog write auth: admin login + session-cookie signing secret. The blog
+      # write routes (POST /new, POST/PUT/DELETE /posts) are guarded by a session
+      # login or Bearer token, so these gate publishing. Not a real site — these
+      # are demo creds; rotate by editing here and recreating the container.
+      SX_ADMIN_USER: admin
+      SX_ADMIN_PASSWORD: "sx-host-camper-van-2026"
+      SX_SESSION_SECRET: "ra-host-sess-7c1f9b3e2a8d4056"
+      # Serving-mode JIT: bytecode-compile hot SX (esp. the Datalog/relations path)
+      # on the epoch serving channel. Validated: host conformance 271/271 under JIT,
+      # 5.4x faster (1m43s -> 19s). Default-OFF gate, opt in here.
+      SX_SERVING_JIT: "1"
+      OCAMLRUNPARAM: "b"
+    volumes:
+      # SX source (hot-reload on container restart)
+      - ./spec:/app/spec:ro
+      - ./lib:/app/lib:ro
+      - ./web:/app/web:ro
+      # Client assets for the blog SPA: the WASM OCaml kernel + sx-platform + the
+      # web-stack modules, served by lib/host/static.sx at /static/**.
+      - ./shared/static:/app/shared/static:ro
+      # OCaml server binary — this worktree's build (has the SX_HTTP_HOST bind fix)
+      - ./hosts/ocaml/_build/default/bin/sx_server.exe:/app/bin/sx_server:ro
+      # Durable persist store (the SX op-log/kv on disk) — survives restarts.
+      # Host dir, chowned to the image's appuser (uid 10001) so the non-root
+      # server can write: sudo mkdir -p /root/sx-host-persist && sudo chown 10001:10001 /root/sx-host-persist
+      - /root/sx-host-persist:/data/persist
+    networks:
+      - externalnet
+      - default
+    restart: unless-stopped
+
+networks:
+  externalnet:
+    external: true

hosts/ocaml/bin/dune

@@ -1,5 +1,5 @@
 (executables
- (names run_tests debug_set sx_server integration_tests bench_cek bench_inspect bench_vm)
+ (names run_tests debug_set sx_server integration_tests bench_cek bench_inspect bench_vm repro_jit_resume)
  (libraries sx unix threads.posix otfm yojson))
 
 (executable

hosts/ocaml/bin/integration_tests.ml

@@ -263,7 +263,7 @@ let make_integration_env () =
 
   (* Type predicates — needed by adapter-sx.sx *)
   bind "callable?" (fun args ->
-    match args with [NativeFn _] | [Lambda _] | [Component _] | [Island _] -> Bool true | _ -> Bool false);
+    match args with [NativeFn _] | [Lambda _] | [Component _] | [Island _] | [VmClosure _] -> Bool true | _ -> Bool false);
   bind "lambda?" (fun args -> match args with [Lambda _] -> Bool true | _ -> Bool false);
   bind "macro?" (fun args -> match args with [Macro _] -> Bool true | _ -> Bool false);
   bind "island?" (fun args -> match args with [Island _] -> Bool true | _ -> Bool false);

hosts/ocaml/bin/mcp_tree.ml

@@ -477,7 +477,7 @@ let setup_env () =
   bind "number?" (fun args -> match args with
     | [Number _] -> Bool true | _ -> Bool false);
   bind "callable?" (fun args -> match args with
-    | [NativeFn _ | Lambda _ | Component _ | Island _] -> Bool true | _ -> Bool false);
+    | [NativeFn _ | Lambda _ | Component _ | Island _ | VmClosure _] -> Bool true | _ -> Bool false);
   bind "empty?" (fun args -> match args with
     | [List []] | [ListRef { contents = [] }] -> Bool true
     | [Nil] -> Bool true | _ -> Bool false);

hosts/ocaml/bin/repro_jit_resume.ml

@@ -0,0 +1,202 @@
+(* Surgical repro for the serving-JIT OP_PERFORM/resume stack misalignment.
+   Mirrors what register_jit_hook's resolve_loop does: call_closure, catch
+   VmSuspended, resolve IO (return Nil), resume_vm — looping on re-suspend.
+   No CEK evaluator needed for the direct/multi-frame/reuse paths. *)
+
+open Sx_types
+
+let req_dict () =
+  let h = Hashtbl.create 1 in
+  Hashtbl.replace h "op" (String "noop");
+  Dict h
+
+(* Mirror the serving hook's resolve loop exactly. *)
+let drive cl =
+  let globals = cl.vm_closure_env |> ignore; cl.vm_env_ref in
+  let rec resolve_loop req vm =
+    let _ = req in
+    (try Sx_vm.resume_vm vm Nil
+     with Sx_vm.VmSuspended (r2, v2) -> resolve_loop r2 v2)
+  in
+  try Sx_vm.call_closure cl [] globals
+  with Sx_vm.VmSuspended (req, vm) -> resolve_loop req vm
+
+let mk_code ~locals ~bc ~consts = {
+  vc_arity = 0; vc_rest_arity = -1; vc_locals = locals;
+  vc_bytecode = Array.of_list bc;
+  vc_constants = Array.of_list consts;
+  vc_bytecode_list = None; vc_constants_list = None;
+}
+
+let mk_cl ?(name="tf") ?(env=Hashtbl.create 64) code =
+  { vm_code = code; vm_upvalues = [||]; vm_name = Some name;
+    vm_env_ref = env; vm_closure_env = None }
+
+let report label v =
+  Printf.printf "%-28s => %s\n%!" label (Sx_runtime.value_to_str v)
+
+let run label f =
+  (try report label (f ())
+   with
+   | Eval_error m -> Printf.printf "%-28s => ERROR: %s\n%!" label m
+   | e -> Printf.printf "%-28s => EXN: %s\n%!" label (Printexc.to_string e))
+
+(* opcodes *)
+let _const i = [1; i land 0xff; (i lsr 8) land 0xff]
+let _perform = [112]
+let _pop = [5]
+let _call_prim idx argc = [52; idx land 0xff; (idx lsr 8) land 0xff; argc]
+let _call argc = [48; argc]
+let _return = [50]
+
+let () =
+  (* Serving mode: a synchronous IO resolver is installed (mirrors
+     sx_server's http setup). Our mock resolves every request to Nil. *)
+  Sx_types._cek_io_resolver := Some (fun _req _ -> Nil);
+
+  (* Case 1: direct OP_PERFORM then a list prim in the SAME frame.
+     (do (perform {..}) (rest (list 1 2 3)))  =>  (2 3) *)
+  run "1.direct perform→rest" (fun () ->
+    let consts = [ req_dict (); List [Number 1.; Number 2.; Number 3.]; String "rest" ] in
+    let bc = _const 0 @ _perform @ _pop @ _const 1 @ _call_prim 2 1 @ _return in
+    drive (mk_cl (mk_code ~locals:0 ~bc ~consts)));
+
+  (* Case 2: direct perform then map (2-arg prim).
+     (do (perform {..}) (map inc (list 1 2 3)))  — needs a fn; use a NativeFn const *)
+  run "2.direct perform→map" (fun () ->
+    let inc = NativeFn ("inc1", function [Number n] -> Number (n +. 1.) | _ -> Nil) in
+    let consts = [ req_dict (); inc; List [Number 1.; Number 2.; Number 3.]; String "map" ] in
+    (* push fn, push list, CALL_PRIM map 2 *)
+    let bc = _const 0 @ _perform @ _pop @ _const 1 @ _const 2 @ _call_prim 3 2 @ _return in
+    drive (mk_cl (mk_code ~locals:0 ~bc ~consts)));
+
+  (* Case 3: multi-frame — outer calls a JIT'd helper that performs, THEN outer maps.
+     helper: (do (perform {..}) 99)
+     outer:  (do (helper) (map inc (list 1 2 3))) *)
+  run "3.multiframe perform→map" (fun () ->
+    let env = Hashtbl.create 64 in
+    let helper_code = mk_code ~locals:0
+      ~bc:(_const 0 @ _perform @ _pop @ _const 1 @ _return)
+      ~consts:[ req_dict (); Number 99. ] in
+    let helper_cl = mk_cl ~name:"helper" ~env helper_code in
+    let inc = NativeFn ("inc1", function [Number n] -> Number (n +. 1.) | _ -> Nil) in
+    let consts = [ VmClosure helper_cl; inc; List [Number 1.; Number 2.; Number 3.]; String "map" ] in
+    (* push helper-closure, CALL 0, POP its result, push inc, push list, CALL_PRIM map 2 *)
+    let bc = _const 0 @ _call 0 @ _pop @ _const 1 @ _const 2 @ _call_prim 3 2 @ _return in
+    drive (mk_cl ~name:"outer" ~env (mk_code ~locals:0 ~bc ~consts)));
+
+  (* Case 4: map whose CALLBACK performs (reuse_stack path), then a trailing prim.
+     callback: (do (perform {..}) (inc e))   — but callback gets arg e in slot 0
+     outer: (do (map cb (list 1 2 3)) (rest (list 7 8 9)))  *)
+  run "4.map-callback-perform" (fun () ->
+    let env = Hashtbl.create 64 in
+    (* callback arity 1: slot0 = e. body: (perform {..}); (inc e) ; return
+       LOCAL_GET 0 then CALL_PRIM inc... use NativeFn inc via CALL_PRIM *)
+    let cb_code = {
+      vc_arity = 1; vc_rest_arity = -1; vc_locals = 1;
+      vc_bytecode = Array.of_list (_const 0 @ _perform @ _pop
+                                   @ [16;0] (* LOCAL_GET 0 *)
+                                   @ _call_prim 1 1 @ _return);
+      vc_constants = [| req_dict (); String "inc" |];
+      vc_bytecode_list = None; vc_constants_list = None } in
+    let cb_cl = mk_cl ~name:"cb" ~env cb_code in
+    let consts = [ VmClosure cb_cl; List [Number 1.; Number 2.; Number 3.]; String "map";
+                   List [Number 7.; Number 8.; Number 9.]; String "rest" ] in
+    (* push cb, push list, CALL_PRIM map 2, POP, push list2, CALL_PRIM rest 1, RETURN *)
+    let bc = _const 0 @ _const 1 @ _call_prim 2 2 @ _pop @ _const 3 @ _call_prim 4 1 @ _return in
+    drive (mk_cl ~name:"outer4" ~env (mk_code ~locals:0 ~bc ~consts)));
+
+  (* Case 5: THE HOST CASE — perform via an INTERPRETED helper (pending_cek path),
+     then a list prim. helper is a Lambda (l_compiled = jit_failed) whose body
+     performs; vm_call routes it through cek_call_or_suspend → pending_cek.
+       helper: (perform {..})  [interpreted via CEK]
+       outer:  (do (helper) (rest (list 1 2 3)))  => (2 3) *)
+  run "5.pending_cek perform→rest" (fun () ->
+    let env = Sx_types.make_env () in
+    let helper = Lambda {
+      l_params = []; l_body = List [Symbol "perform"; req_dict ()];
+      l_closure = env; l_name = Some "kvread";
+      l_compiled = Some Sx_vm.jit_failed_sentinel; l_call_count = 0;
+      l_uid = Sx_types.next_lambda_uid () } in
+    let consts = [ helper; List [Number 1.; Number 2.; Number 3.]; String "rest" ] in
+    (* push helper, CALL 0, POP, push list, CALL_PRIM rest 1, RETURN *)
+    let bc = _const 0 @ _call 0 @ _pop @ _const 1 @ _call_prim 2 1 @ _return in
+    drive (mk_cl ~name:"outer5" ~env:(Hashtbl.create 64) (mk_code ~locals:0 ~bc ~consts)));
+
+  (* Case 6: pending_cek perform → MAP (2-arg), the exact host shape. *)
+  run "6.pending_cek perform→map" (fun () ->
+    let env = Sx_types.make_env () in
+    let helper = Lambda {
+      l_params = []; l_body = List [Symbol "perform"; req_dict ()];
+      l_closure = env; l_name = Some "kvread";
+      l_compiled = Some Sx_vm.jit_failed_sentinel; l_call_count = 0;
+      l_uid = Sx_types.next_lambda_uid () } in
+    let inc = NativeFn ("inc1", function [Number n] -> Number (n +. 1.) | _ -> Nil) in
+    let consts = [ helper; inc; List [Number 1.; Number 2.; Number 3.]; String "map" ] in
+    (* push helper, CALL 0, POP, push inc, push list, CALL_PRIM map 2, RETURN *)
+    let bc = _const 0 @ _call 0 @ _pop @ _const 1 @ _const 2 @ _call_prim 3 2 @ _return in
+    drive (mk_cl ~name:"outer6" ~env:(Hashtbl.create 64) (mk_code ~locals:0 ~bc ~consts)));
+
+  (* Case 7: THE HOST SHAPE — map whose callback calls an INTERPRETED helper
+     that performs (kv read via persist helper inside a map), THEN a trailing
+     prim. callback(e): (do (kvread) e)  — kvread suspends via pending_cek.
+     outer: (do (map cb (list 1 2 3)) (drop (list 5 6 7 8) 2)) => (7 8) *)
+  run "7.HOST: map[cb→helper perform]→drop" (fun () ->
+    let genv = Sx_types.make_env () in
+    let helper = Lambda {
+      l_params = []; l_body = List [Symbol "perform"; req_dict ()];
+      l_closure = genv; l_name = Some "kvread";
+      l_compiled = Some Sx_vm.jit_failed_sentinel; l_call_count = 0;
+      l_uid = Sx_types.next_lambda_uid () } in
+    let env = Hashtbl.create 64 in
+    (* cb(e): push helper, CALL 0, POP, LOCAL_GET 0, RETURN *)
+    let cb_code = {
+      vc_arity = 1; vc_rest_arity = -1; vc_locals = 1;
+      vc_bytecode = Array.of_list (_const 0 @ _call 0 @ _pop @ [16;0] @ _return);
+      vc_constants = [| helper |]; vc_bytecode_list=None; vc_constants_list=None } in
+    let cb_cl = mk_cl ~name:"cb7" ~env cb_code in
+    let consts = [ VmClosure cb_cl; List [Number 1.; Number 2.; Number 3.]; String "map";
+                   List [Number 5.; Number 6.; Number 7.; Number 8.]; Number 2.; String "drop" ] in
+    (* push cb, push list, CALL_PRIM map 2, POP, push list2, push 2, CALL_PRIM drop 2, RETURN *)
+    let bc = _const 0 @ _const 1 @ _call_prim 2 2 @ _pop
+             @ _const 3 @ _const 4 @ _call_prim 5 2 @ _return in
+    drive (mk_cl ~name:"outer7" ~env (mk_code ~locals:0 ~bc ~consts)));
+
+  (* Case 8: reduce whose callback performs. (reduce + 0 (list 1 2 3)) with a
+     perform in the reducer => 6 *)
+  run "8.reduce[acc→perform]" (fun () ->
+    let env = Hashtbl.create 64 in
+    (* reducer(acc e): (do (perform {..}) (+ acc e)). slots: 0=acc 1=e *)
+    let rd_code = {
+      vc_arity = 2; vc_rest_arity = -1; vc_locals = 2;
+      vc_bytecode = Array.of_list (_const 0 @ _perform @ _pop
+                                   @ [16;0] @ [16;1] @ _call_prim 1 2 @ _return);
+      vc_constants = [| req_dict (); String "+" |];
+      vc_bytecode_list=None; vc_constants_list=None } in
+    let rd_cl = mk_cl ~name:"rd" ~env rd_code in
+    let consts = [ VmClosure rd_cl; Number 0.; List [Number 1.; Number 2.; Number 3.]; String "reduce" ] in
+    (* push reducer, push 0, push list, CALL_PRIM reduce 3, RETURN *)
+    let bc = _const 0 @ _const 1 @ _const 2 @ _call_prim 3 3 @ _return in
+    drive (mk_cl ~name:"outer8" ~env (mk_code ~locals:0 ~bc ~consts)));
+
+  (* Case 9: nested map — outer map callback runs an inner map whose callback
+     performs. outer over (list 1 2), inner over (list 10 20) performing.
+     cb_outer(x): (map cb_inner (list 10 20)) ; cb_inner(y): (do (perform) y)
+     => ((10 20) (10 20)) *)
+  run "9.nested map[inner→perform]" (fun () ->
+    let env = Hashtbl.create 64 in
+    let inner_code = {
+      vc_arity = 1; vc_rest_arity = -1; vc_locals = 1;
+      vc_bytecode = Array.of_list (_const 0 @ _perform @ _pop @ [16;0] @ _return);
+      vc_constants = [| req_dict () |]; vc_bytecode_list=None; vc_constants_list=None } in
+    let inner_cl = mk_cl ~name:"cbin" ~env inner_code in
+    (* outer cb(x): push inner_cl, push (10 20), CALL_PRIM map 2, RETURN *)
+    let outer_cb_code = {
+      vc_arity = 1; vc_rest_arity = -1; vc_locals = 1;
+      vc_bytecode = Array.of_list (_const 0 @ _const 1 @ _call_prim 2 2 @ _return);
+      vc_constants = [| VmClosure inner_cl; List [Number 10.; Number 20.]; String "map" |];
+      vc_bytecode_list=None; vc_constants_list=None } in
+    let outer_cb_cl = mk_cl ~name:"cbout" ~env outer_cb_code in
+    let consts = [ VmClosure outer_cb_cl; List [Number 1.; Number 2.]; String "map" ] in
+    let bc = _const 0 @ _const 1 @ _call_prim 2 2 @ _return in
+    drive (mk_cl ~name:"outer9" ~env (mk_code ~locals:0 ~bc ~consts)))

hosts/ocaml/bin/run_tests.ml

@@ -595,7 +595,7 @@ let make_test_env () =
   (* regex-find-all now provided by sx_primitives.ml *)
   bind "callable?" (fun args ->
     match args with
-    | [NativeFn _] | [Lambda _] | [Component _] | [Island _] -> Bool true
+    | [NativeFn _] | [Lambda _] | [Component _] | [Island _] | [VmClosure _] -> Bool true
     | _ -> Bool false);
   bind "make-sx-expr" (fun args -> match args with [String s] -> SxExpr s | _ -> raise (Eval_error "make-sx-expr: expected string"));
   bind "sx-expr-source" (fun args -> match args with [SxExpr s] -> String s | [String s] -> String s | _ -> raise (Eval_error "sx-expr-source: expected sx-expr or string"));
@@ -2812,10 +2812,13 @@ let run_spec_tests env test_files =
               | "insertAdjacentHTML" | "prepend" | "showModal" | "show" | "close"
               | "getBoundingClientRect" | "getAnimations" | "scrollIntoView"
               | "scrollTo" | "scroll" | "reset" -> Bool true
-              | "firstElementChild" ->
+              | "firstElementChild" | "firstChild" ->
+                (* the mock treats element children and child nodes alike, so
+                   firstChild == firstElementChild — children-to-fragment walks
+                   firstChild to drain a parsed fragment into a swap target. *)
                 let kids = match Hashtbl.find_opt d "children" with Some (List l) -> l | _ -> [] in
                 (match kids with c :: _ -> c | [] -> Nil)
-              | "lastElementChild" ->
+              | "lastElementChild" | "lastChild" ->
                 let kids = match Hashtbl.find_opt d "children" with Some (List l) -> l | _ -> [] in
                 (match List.rev kids with c :: _ -> c | [] -> Nil)
               | "nextElementSibling" | "nextSibling" ->
@@ -2961,6 +2964,15 @@ let run_spec_tests env test_files =
        | "setTimeout" -> (match rest with fn :: _ -> ignore (Sx_ref.cek_call fn (List [])); Nil | _ -> Nil)
        | "clearTimeout" -> Nil
        | _ -> Nil)
+    (* NodeList.item(i) — dom-query-all iterates the querySelectorAll result
+       (a bare List) via this method, exactly like a browser NodeList. *)
+    | (List _ | ListRef _) :: String "item" :: [idx] ->
+      let items = match args with
+        | List l :: _ -> l
+        | ListRef { contents = l } :: _ -> l
+        | _ -> [] in
+      let i = match idx with Number n -> int_of_float n | Integer n -> n | _ -> -1 in
+      if i >= 0 && i < List.length items then List.nth items i else Nil
     | Dict d :: String "hasOwnProperty" :: [String k] ->
       Bool (Hashtbl.mem d k)
     | Dict d :: String m :: rest ->
@@ -3070,6 +3082,26 @@ let run_spec_tests env test_files =
         (* console.log/debug/error — no-op in tests *)
         Nil
 
+      else if mt = "domparser" then
+        (* DOMParser.parseFromString(text, "text/html") — returns a mock
+           document whose <body> is parsed from `text`. An empty string yields
+           a valid empty document (truthy), matching the browser: that's what
+           the engine's handle-html-response relies on for an empty-body
+           sx-swap="delete" response. *)
+        (match m with
+         | "parseFromString" ->
+           let text = match rest with String t :: _ -> t | _ -> "" in
+           let bd = match make_mock_element "body" with Dict d -> d | _ -> Hashtbl.create 0 in
+           Hashtbl.replace bd "tagName" (String "BODY");
+           Hashtbl.replace bd "nodeName" (String "BODY");
+           parse_html_into bd text;
+           Hashtbl.replace bd "innerHTML" (String text);
+           let doc = Hashtbl.create 4 in
+           Hashtbl.replace doc "__mock_type" (String "document");
+           Hashtbl.replace doc "body" (Dict bd);
+           Dict doc
+         | _ -> Nil)
+
       else
         (* Element methods *)
         (match m with
@@ -3483,6 +3515,10 @@ let run_spec_tests env test_files =
       Dict ev
     | [String "Object"] ->
       Dict (Hashtbl.create 4)
+    | [String "DOMParser"] ->
+      let d = Hashtbl.create 4 in
+      Hashtbl.replace d "__mock_type" (String "domparser");
+      Dict d
     | _ -> Nil);
 
   reg "host-callback" (fun args ->
@@ -3660,6 +3696,7 @@ let run_spec_tests env test_files =
   load_module "router.sx" web_dir;
   load_module "deps.sx" web_dir;
   load_module "orchestration.sx" web_dir;
+  load_module "console-render.sx" web_dir;
   (* Library modules for lib/tests/ *)
   load_module "bytecode.sx" lib_dir;
   load_module "compiler.sx" lib_dir;

hosts/ocaml/bin/sx_server.ml

@@ -32,6 +32,14 @@ let () = ignore (Sx_vm_extensions.id_of_name "")
    which we swallow so a re-entered server process doesn't die. *)
 let () = try Erlang_ext.register () with Failure _ -> ()
 
+(* Ignore SIGPIPE: a client that closes its connection mid-response (a browser
+   aborting an in-flight fetch — the SX engine cancels superseded requests on a
+   debounced filter or a fast nav) must NOT kill the server. SIGPIPE's default
+   action terminates the process before any exception is raised; ignoring it
+   turns the failed write into a catchable Sys_error (EPIPE), which the
+   per-connection handler already swallows, dropping just that one connection. *)
+let () = try Sys.set_signal Sys.sigpipe Sys.Signal_ignore with _ -> ()
+
 (* ====================================================================== *)
 (* Font measurement via otfm — reads OpenType/TrueType font tables         *)
 (* ====================================================================== *)
@@ -522,26 +530,25 @@ let rec load_library_file path =
       Printf.eprintf "[load-library] %s: %s\n%!" (Filename.basename path) msg
   ) exprs
 
-(** IO-aware CEK run — handles suspension by dispatching IO requests.
-    Import requests are handled locally (load .sx file).
-    Other IO requests are sent to the Python bridge. *)
-and cek_run_with_io state =
-  let s = ref state in
-  let is_terminal s = match Sx_ref.cek_terminal_p s with Bool true -> true | _ -> false in
-  let is_suspended s = match Sx_runtime.get_val s (String "phase") with String "io-suspended" -> true | _ -> false in
-  let rec loop () =
-    while not (is_terminal !s) && not (is_suspended !s) do
-      s := Sx_ref.cek_step !s
-    done;
-    if is_suspended !s then begin
-      let request = Sx_runtime.get_val !s (String "request") in
+(* IO-aware CEK run (cek_run_with_io, below) — handles suspension by dispatching
+   IO requests. Import requests are handled locally (load .sx file). *)
+(** Resolve a single IO request value to its response. Shared by
+    cek_run_with_io's suspension loop AND the _cek_io_resolver installed for the
+    http-listen serving path, so the synchronous inline-resolve path (sx_vm.ml's
+    HO-callback suspend fix) resolves durable reads byte-identically to the
+    CEK-driven path. Without an installed resolver, a `perform` inside an HO
+    primitive callback (map/filter/…) unwinds the native loop and corrupts the
+    stack — the host's map/rest/drop serving-JIT miscompile. *)
+and resolve_io_request request =
   let op = match Sx_runtime.get_val request (String "op") with String s -> s | _ -> "" in
-      let response = match op with
+  (match op with
    | "import" ->
      (* Resolve library locally — load the .sx file *)
      let lib_spec = Sx_runtime.get_val request (String "library") in
-          let key = Sx_ref.library_name_key lib_spec in
-          if Sx_types.sx_truthy (Sx_ref.library_loaded_p key) then
+     (* library_loaded_p takes the library SPEC and computes the key itself —
+        passing an already-computed key string double-applies library_name_key
+        and crashes (sx_to_list on a string). *)
+     if Sx_types.sx_truthy (Sx_ref.library_loaded_p lib_spec) then
        (* Already loaded — just resume *)
        Nil
      else begin
@@ -576,8 +583,19 @@ and cek_run_with_io state =
       | Some resp -> resp
       | None ->
         let args = (match argsv with List l -> l | _ -> [argsv]) in
-             io_request op args)
-      in
+        io_request op args))
+
+and cek_run_with_io state =
+  let s = ref state in
+  let is_terminal s = match Sx_ref.cek_terminal_p s with Bool true -> true | _ -> false in
+  let is_suspended s = match Sx_runtime.get_val s (String "phase") with String "io-suspended" -> true | _ -> false in
+  let rec loop () =
+    while not (is_terminal !s) && not (is_suspended !s) do
+      s := Sx_ref.cek_step !s
+    done;
+    if is_suspended !s then begin
+      let request = Sx_runtime.get_val !s (String "request") in
+      let response = resolve_io_request request in
       s := Sx_ref.cek_resume !s response;
       loop ()
     end else
@@ -745,9 +763,27 @@ let setup_evaluator_bridge env =
         | _ -> raise (Eval_error "http-listen: (port handler)") in
       let sock = Unix.socket Unix.PF_INET Unix.SOCK_STREAM 0 in
       Unix.setsockopt sock Unix.SO_REUSEADDR true;
+      (* Bind host: loopback by default (safe for tests + local runs); set
+         SX_HTTP_HOST=0.0.0.0 to expose on the network (container/Caddy). *)
+      let bind_addr =
+        match Sys.getenv_opt "SX_HTTP_HOST" with
+        | Some h -> (try Unix.inet_addr_of_string h
+                     with _ -> Unix.inet_addr_loopback)
+        | None -> Unix.inet_addr_loopback in
       Unix.bind sock
-        (Unix.ADDR_INET (Unix.inet_addr_loopback, port));
+        (Unix.ADDR_INET (bind_addr, port));
       Unix.listen sock 64;
+      (* Install the synchronous IO resolver for the serving path. Without it, a
+         `perform` (durable kv read) that fires inside an HO-primitive callback
+         (map/filter/reduce/…) during request handling suspends through the
+         native OCaml loop, dropping its iteration state and leaving the stack
+         misaligned — the serving-JIT host miscompile (map/rest/drop wrong args,
+         blank pages, empty picker). With a resolver installed, sx_vm.ml resolves
+         that callback's IO inline (byte-identically to cek_run_with_io) and the
+         loop is never unwound. Only set if one isn't already installed. *)
+      (if !Sx_types._cek_io_resolver = None then
+         Sx_types._cek_io_resolver :=
+           Some (fun request _state -> resolve_io_request request));
       (* SX runtime is shared across threads — serialize handler calls. *)
       let mtx = Mutex.create () in
       let reason = function
@@ -807,9 +843,31 @@ let setup_evaluator_bridge env =
              Hashtbl.replace req "body" (String body);
              Mutex.lock mtx;
              let resp =
-               (try Sx_runtime.sx_call handler [Dict req]
-                with e -> Mutex.unlock mtx; raise e) in
+               (* Run the handler through the IO-aware CEK runner (not bare
+                  sx_call) so request handlers can perform per-request IO —
+                  durable store reads/writes resolve via cek_run_with_io's
+                  suspension loop instead of returning an unresolved suspension.
+                  On ANY handler exception, synthesise a 500 response rather than
+                  letting it escape: an escaped exception drops the connection
+                  with no bytes written, which a reverse proxy (Caddy/Cloudflare)
+                  surfaces as a 502 error page. A real 500 keeps the origin
+                  responsive and debuggable. Note: a native exception (e.g. the
+                  parser's Parse_error) cannot be caught by an SX (guard ...), so
+                  this boundary is the only place it can be trapped. *)
+               (try
+                  let st = Sx_ref.continue_with_call handler
+                             (List [Dict req]) (Env (Sx_types.make_env ()))
+                             (List [Dict req]) (List []) in
+                  let r = cek_run_with_io st in
+                  Mutex.unlock mtx; r
+                with e ->
                   Mutex.unlock mtx;
+                  Printf.eprintf "[http-listen] handler error: %s\n%!"
+                    (Printexc.to_string e);
+                  let d = Sx_types.make_dict () in
+                  Hashtbl.replace d "status" (Integer 500);
+                  Hashtbl.replace d "body" (String "Internal Server Error");
+                  Dict d) in
              let getk k = match resp with
                | Dict h -> Hashtbl.find_opt h k | _ -> None in
              let status = match getk "status" with
@@ -835,6 +893,18 @@ let setup_evaluator_bridge env =
              List.iter (fun (k, v) ->
                Buffer.add_string buf
                  (Printf.sprintf "%s: %s\r\n" k v)) rhdrs;
+             (* Cookies: a response carries :set-cookies as a LIST of pre-formatted
+                cookie strings (Dream's dream-set-cookie), because a headers Dict
+                cannot hold more than one Set-Cookie. Emit one header per item. *)
+             (match getk "set-cookies" with
+              | Some (List items) ->
+                List.iter (fun v ->
+                  match v with
+                  | String s ->
+                    Buffer.add_string buf
+                      (Printf.sprintf "Set-Cookie: %s\r\n" s)
+                  | _ -> ()) items
+              | _ -> ());
              if not (List.exists
                        (fun (k, _) ->
                           String.lowercase_ascii k = "content-type")
@@ -1097,7 +1167,11 @@ let setup_introspection env =
   bind "component?" (fun args ->
     match args with [Component _] | [Island _] -> Bool true | _ -> Bool false);
   bind "callable?" (fun args ->
-    match args with [NativeFn _] | [Lambda _] | [Component _] | [Island _] -> Bool true | _ -> Bool false);
+    (* VmClosure must count as callable: a JIT-compiled higher-order function
+       returns its inner closure as a VmClosure, and downstream code (e.g.
+       scheme-apply's `(callable? proc)` guard) must recognize it — it is
+       invocable via the normal call path. *)
+    match args with [NativeFn _] | [Lambda _] | [Component _] | [Island _] | [VmClosure _] -> Bool true | _ -> Bool false);
   bind "spread?" (fun args -> match args with [Spread _] -> Bool true | _ -> Bool false);
   bind "continuation?" (fun args ->
     match args with [Continuation _] -> Bool true | [_] -> Bool false | _ -> Bool false);
@@ -1223,6 +1297,20 @@ let setup_type_constructors env =
       (* Already a value — return as-is *)
       v
     | _ -> raise (Eval_error "parse: expected string"));
+  (* Like parse, but returns nil instead of raising on malformed input. The
+     parser raises a native Parse_error that an SX-level (guard ...) cannot catch
+     (guard only traps SX conditions, not host exceptions), so code that handles
+     untrusted text — e.g. a stored post body — needs a value-returning parse to
+     degrade gracefully rather than crash the request. *)
+  bind "parse-safe" (fun args ->
+    match args with
+    | [String s] | [SxExpr s] ->
+      (try
+         let exprs = Sx_parser.parse_all s in
+         (match exprs with [e] -> e | _ -> List exprs)
+       with _ -> Nil)
+    | [v] -> v
+    | _ -> Nil);
   (* Native bytecode compiler — bootstrapped from lib/compiler.sx *)
   bind "compile" (fun args ->
     match args with [expr] -> Sx_compiler.compile expr | _ -> Nil);
@@ -1468,6 +1556,22 @@ let sx_render_to_html expr env =
 
 let _jit_warned : (string, bool) Hashtbl.t = Hashtbl.create 16
 
+(* Bisection aid: env-var-driven JIT filter. Lets us narrow which named
+   lambda the VM miscompiles without rebuilding.
+   SX_JIT_DENY=name1,name2  — never JIT these (substring match on exact name).
+   SX_JIT_ONLY=name1,name2  — JIT ONLY these (exact name); skip all others. *)
+let _jit_deny_set =
+  match Sys.getenv_opt "SX_JIT_DENY" with
+  | None | Some "" -> []
+  | Some s -> String.split_on_char ',' s |> List.map String.trim
+let _jit_only_set =
+  match Sys.getenv_opt "SX_JIT_ONLY" with
+  | None | Some "" -> []
+  | Some s -> String.split_on_char ',' s |> List.map String.trim
+let _jit_name_allowed name =
+  (not (List.mem name _jit_deny_set))
+  && (match _jit_only_set with [] -> true | only -> List.mem name only)
+
 let rec make_vm_suspend_marker request saved_vm =
   let d = Hashtbl.create 3 in
   Hashtbl.replace d "__vm_suspended" (Bool true);
@@ -1486,6 +1590,8 @@ let rec make_vm_suspend_marker request saved_vm =
 let register_jit_hook env =
   Sx_runtime._jit_try_call_fn := Some (fun f args ->
     match f with
+    | Lambda l when (match l.l_name with Some n -> not (_jit_name_allowed n) | None -> false) ->
+      None  (* bisection filter excluded this name *)
     | Lambda l ->
       (match l.l_compiled with
        | Some cl when not (Sx_vm.is_jit_failed cl) ->
@@ -1502,7 +1608,23 @@ let register_jit_hook env =
                let rec resolve_loop req vm =
                  let result = resolver req (Nil) in
                  (try Some (Sx_vm.resume_vm vm result)
-                  with Sx_vm.VmSuspended (req2, vm2) -> resolve_loop req2 vm2)
+                  with
+                  | Sx_vm.VmSuspended (req2, vm2) -> resolve_loop req2 vm2
+                  | e ->
+                    (* (B) Resume raised mid-execution. resolve_loop runs inside
+                       the VmSuspended handler, so without catching here the
+                       error escapes to the http handler (→ 500). Recover THIS
+                       call on the CEK instead: mark jit_failed and return None
+                       so the interpreter re-runs it (idempotent for the host's
+                       durable reads). Self-heals on the first hit, not a retry. *)
+                    let fn_name = match l.l_name with Some n -> n | None -> "?" in
+                    if not (Hashtbl.mem _jit_warned fn_name) then begin
+                      Hashtbl.replace _jit_warned fn_name true;
+                      Printf.eprintf "[jit] %s resume fallback to CEK: %s\n%!"
+                        fn_name (Printexc.to_string e)
+                    end;
+                    l.l_compiled <- Some Sx_vm.jit_failed_sentinel;
+                    None)
                in
                resolve_loop request saved_vm
              | None -> Some (make_vm_suspend_marker request saved_vm))
@@ -1535,7 +1657,16 @@ let register_jit_hook env =
                    let rec resolve_loop req vm =
                      let result = resolver req (Nil) in
                      (try Some (Sx_vm.resume_vm vm result)
-                      with Sx_vm.VmSuspended (req2, vm2) -> resolve_loop req2 vm2)
+                      with
+                      | Sx_vm.VmSuspended (req2, vm2) -> resolve_loop req2 vm2
+                      | e ->
+                        (* (B) See note above — recover a failed resume on the
+                           CEK instead of escaping to the handler (→ 500). *)
+                        Printf.eprintf "[jit] %s resume fallback to CEK: %s\n%!"
+                          fn_name (Printexc.to_string e);
+                        Hashtbl.replace _jit_warned fn_name true;
+                        l.l_compiled <- Some Sx_vm.jit_failed_sentinel;
+                        None)
                    in
                    resolve_loop request saved_vm
                  | None -> Some (make_vm_suspend_marker request saved_vm))
@@ -1667,6 +1798,10 @@ let rec dispatch env cmd =
         | Nil -> "nil"
         | Bool true -> "true" | Bool false -> "false"
         | Number n -> Sx_types.format_number n
+        (* Bytecode opcodes + arity/upvalue-count are Integers; without this case
+           they hit the `_ -> "nil"` fallthrough, so every .sxbc came out as
+           `:bytecode (nil nil ...)` -> "VM: unknown opcode 0" -> source fallback. *)
+        | Integer n -> string_of_int n
         | String s -> "\"" ^ escape_sx_string s ^ "\""
         | Symbol s -> s | Keyword k -> ":" ^ k
         | List items | ListRef { contents = items } -> "(" ^ String.concat " " (List.map raw_serialize items) ^ ")"
@@ -1694,8 +1829,9 @@ let rec dispatch env cmd =
             | _ -> "" in
           let response = if op = "import" then begin
             let lib_spec = Sx_runtime.get_val request (String "library") in
-            let key = Sx_ref.library_name_key lib_spec in
-            if Sx_types.sx_truthy (Sx_ref.library_loaded_p key) then Nil
+            (* pass the SPEC, not a pre-computed key — library_loaded_p applies
+               library_name_key itself (a key string would crash sx_to_list). *)
+            if Sx_types.sx_truthy (Sx_ref.library_loaded_p lib_spec) then Nil
             else begin
               (match resolve_library_path lib_spec with
                | Some path -> load_library_file path | None -> ());
@@ -4854,6 +4990,46 @@ let () =
   else begin
     (* Normal persistent server mode *)
     let env = make_server_env () in
+    (* render-page: render an (unevaluated) SX page/component expression to HTML
+       using the server env, so http-listen handlers can serve interactive SX
+       pages. render-to-html expands components + collects keyword attrs itself;
+       SX handlers can't reach the server env, so this primitive supplies it. *)
+    ignore (env_bind env "render-page" (NativeFn ("render-page", fun args ->
+      match args with
+      | expr :: _ -> String (sx_render_to_html expr env)
+      | _ -> raise (Eval_error "render-page: (expr)"))));
+    (* JIT in the epoch serving mode is OPT-IN via SX_SERVING_JIT=1.
+       Default OFF: this mode is the shared command channel used by every
+       loop's conformance runner, and enabling JIT globally regresses
+       continuation-based guest interpreters (Scheme/Erlang/Prolog/CL: their
+       eval/dispatch cores capture call/cc continuations the stack VM can't
+       escape, and deep AST recursion can miscompile into a non-terminating
+       loop). Guests that are safe declare their interpret-only namespace with
+       `(jit-exclude! "<ns>-*")`; until every guest is validated, the safe
+       default is no JIT here. Opt in (SX_SERVING_JIT=1) for validated
+       workloads — e.g. the content/Smalltalk page server. *)
+    (match Sys.getenv_opt "SX_SERVING_JIT" with
+     | Some ("1" | "true" | "yes" | "on") ->
+       (* Load the SX bytecode compiler (lib/compiler.sx) as `compile` — the
+          native Sx_compiler.compile is an incomplete stub (arity-0 bytecode,
+          params as GLOBAL_GET). http/cli/site modes already load it. *)
+       (_import_env := Some env;
+        let project_dir = try Sys.getenv "SX_PROJECT_DIR" with Not_found ->
+          try Sys.getenv "SX_ROOT" with Not_found ->
+          if Sys.file_exists "/app/spec" then "/app" else Sys.getcwd () in
+        let lib_base = try Sys.getenv "SX_LIB_DIR" with Not_found ->
+          project_dir ^ "/lib" in
+        let compiler_path = lib_base ^ "/compiler.sx" in
+        let compiler_path =
+          if Sys.file_exists compiler_path then compiler_path
+          else if Sys.file_exists "lib/compiler.sx" then "lib/compiler.sx"
+          else compiler_path in
+        try load_library_file compiler_path; rebind_host_extensions env
+        with exn ->
+          Printf.eprintf "[sx-server] WARNING: failed to load compiler.sx for JIT (%s) — JIT disabled\n%!"
+            (Printexc.to_string exn));
+       register_jit_hook env
+     | _ -> ());
     send "(ready)";
     (* Main command loop *)
     try

hosts/ocaml/browser/bundle.sh

@@ -71,6 +71,11 @@ cp "$ROOT/shared/sx/templates/tw-layout.sx" "$DIST/sx/"
 cp "$ROOT/shared/sx/templates/tw-type.sx"   "$DIST/sx/"
 cp "$ROOT/shared/sx/templates/tw.sx"        "$DIST/sx/"
 
+# 9b. Host app components (content-addressed, client-expanded on boosted nav).
+# Listed in the host's data-sx-manifest "boot" array so the client eager-loads
+# them after the web stack — see lib/host/static.sx + sx-platform.js loadWebStack.
+cp "$ROOT/lib/host/sx/relate-picker.sx" "$DIST/sx/"
+
 # 10. Hyperscript
 for f in tokenizer parser compiler runtime integration htmx; do
   cp "$ROOT/lib/hyperscript/$f.sx" "$DIST/sx/hs-$f.sx"

hosts/ocaml/browser/compile-modules.js

@@ -48,6 +48,8 @@ const SOURCE_MAP = {
   'boot.sx': 'web/boot.sx',
   'tw-layout.sx': 'web/tw-layout.sx', 'tw-type.sx': 'web/tw-type.sx', 'tw.sx': 'web/tw.sx',
   'text-layout.sx': 'lib/text-layout.sx',
+  // Host app components (content-addressed, client-expanded on boosted nav).
+  'relate-picker.sx': 'lib/host/sx/relate-picker.sx',
 };
 let synced = 0;
 for (const [dist, src] of Object.entries(SOURCE_MAP)) {
@@ -87,6 +89,8 @@ const FILES = [
   'hs-tokenizer.sx', 'hs-parser.sx', 'hs-compiler.sx', 'hs-runtime.sx',
   'hs-worker.sx', 'hs-prolog.sx',
   'hs-integration.sx', 'hs-htmx.sx',
+  // Host app components — standalone defcomps, no inter-module deps.
+  'relate-picker.sx',
   'boot.sx',
 ];
 

hosts/ocaml/browser/sx-platform.js

@@ -646,6 +646,18 @@
     // Load entry point itself (boot.sx — not a library, just defines + init)
     loadBytecodeFile("sx/" + entry.file) || loadSxFile("sx/" + entry.file.replace(/\.sxbc$/, '.sx'));
 
+    // App components: the page's data-sx-manifest "boot" array lists app-specific
+    // modules (e.g. ~relate-picker) to eager-load after the web stack, so their
+    // defcomps are registered before a boosted fragment references them. Loaded
+    // content-addressed, the same as any module.
+    var pageM = loadPageManifest();
+    if (pageM && pageM.boot && pageM.boot.length) {
+      for (var b = 0; b < pageM.boot.length; b++) {
+        var bf = pageM.boot[b];
+        loadBytecodeFile("sx/" + bf) || loadSxFile("sx/" + bf.replace(/\.sxbc$/, '.sx'));
+      }
+    }
+
     if (K.endModuleLoad) K.endModuleLoad();
     var count = Object.keys(_loadedLibs).length + 1; // +1 for entry
     var dt = Math.round(performance.now() - t0);

hosts/ocaml/browser/sx_browser.ml

@@ -73,6 +73,7 @@ let rec value_to_js (v : value) : Js.Unsafe.any =
   | Nil -> Js.Unsafe.inject Js.null
   | Bool b -> Js.Unsafe.inject (Js.bool b)
   | Number n -> Js.Unsafe.inject (Js.number_of_float n)
+  | Integer n -> Js.Unsafe.inject (Js.number_of_float (float_of_int n))
   | String s -> Js.Unsafe.inject (Js.string s)
   | RawHTML s -> Js.Unsafe.inject (Js.string s)
   | Symbol s ->
@@ -329,8 +330,9 @@ let handle_import_suspension request =
   let lib_spec = match request with
     | Dict d -> (match Hashtbl.find_opt d "library" with Some v -> v | _ -> Nil)
     | _ -> Nil in
-  let key = Sx_ref.library_name_key lib_spec in
-  if Sx_types.sx_truthy (Sx_ref.library_loaded_p key) then
+  (* library_loaded_p takes the SPEC and applies library_name_key itself —
+     passing a pre-computed key string double-applies it and crashes. *)
+  if Sx_types.sx_truthy (Sx_ref.library_loaded_p lib_spec) then
     Some Nil  (* Already loaded — resume immediately *)
   else
     None  (* Not loaded — JS platform must fetch it *)

hosts/ocaml/lib/sx_cbor.ml

@@ -15,25 +15,29 @@ exception Cbor_error of string
 
 let write_head buf major v =
   let m = major lsl 5 in
+  (* Width selection + big-endian byte emission via Int64, so the web targets
+     compute identically to native: on js_of_ocaml [int] is 32-bit, so the
+     literal 0x100000000 (2^32) truncates to 0 (sending small values to the
+     8-byte branch) and [v lsr (8*i)] with i>=4 is shift-mod-32. Int64 has the
+     full 64-bit width and well-defined shifts on every target. *)
+  let v64 = Int64.of_int v in
+  let put_be nbytes =
+    for i = nbytes - 1 downto 0 do
+      Buffer.add_char buf
+        (Char.chr (Int64.to_int
+           (Int64.logand (Int64.shift_right_logical v64 (8 * i)) 0xFFL)))
+    done
+  in
   if v < 24 then
     Buffer.add_char buf (Char.chr (m lor v))
   else if v < 0x100 then begin
-    Buffer.add_char buf (Char.chr (m lor 24));
-    Buffer.add_char buf (Char.chr v)
+    Buffer.add_char buf (Char.chr (m lor 24)); put_be 1
   end else if v < 0x10000 then begin
-    Buffer.add_char buf (Char.chr (m lor 25));
-    Buffer.add_char buf (Char.chr ((v lsr 8) land 0xFF));
-    Buffer.add_char buf (Char.chr (v land 0xFF))
-  end else if v < 0x100000000 then begin
-    Buffer.add_char buf (Char.chr (m lor 26));
-    for i = 3 downto 0 do
-      Buffer.add_char buf (Char.chr ((v lsr (8 * i)) land 0xFF))
-    done
+    Buffer.add_char buf (Char.chr (m lor 25)); put_be 2
+  end else if Int64.compare v64 0x100000000L < 0 then begin
+    Buffer.add_char buf (Char.chr (m lor 26)); put_be 4
   end else begin
-    Buffer.add_char buf (Char.chr (m lor 27));
-    for i = 7 downto 0 do
-      Buffer.add_char buf (Char.chr ((v lsr (8 * i)) land 0xFF))
-    done
+    Buffer.add_char buf (Char.chr (m lor 27)); put_be 8
   end
 
 (* dag-cbor map key order: shorter key first, then bytewise. *)

hosts/ocaml/lib/sx_cid.ml

@@ -32,7 +32,11 @@ let base32_lower (s : string) : string =
     while !bits >= 5 do
       bits := !bits - 5;
       Buffer.add_char buf b32_alpha.[(!acc lsr !bits) land 0x1f]
-    done) s;
+    done;
+    (* Keep only the unconsumed low [bits] bits, so [acc] stays tiny (< 2^13).
+       Without this it grows by 8 bits per byte and overflows native [int] on
+       the 32-bit web targets, corrupting the emitted symbols. *)
+    acc := !acc land ((1 lsl !bits) - 1)) s;
   if !bits > 0 then
     Buffer.add_char buf b32_alpha.[(!acc lsl (5 - !bits)) land 0x1f];
   Buffer.contents buf

hosts/ocaml/lib/sx_ed25519.ml

@@ -68,15 +68,22 @@ let sub (a : bn) (b : bn) : bn =
   norm r
 
 let mul (a : bn) (b : bn) : bn =
+  (* Accumulate in Int64: a limb product is 26+26 = 52 bits, which overflows the
+     web targets' int (32-bit js_of_ocaml / 31-bit wasm_of_ocaml). Int64 is a
+     real 64-bit type on every target, so the carries are exact. *)
   let la = Array.length a and lb = Array.length b in
   let r = Array.make (la + lb) 0 in
+  let maskL = Int64.of_int mask in
   for i = 0 to la - 1 do
-    let carry = ref 0 in
+    let carry = ref 0L in
+    let ai = Int64.of_int a.(i) in
     for j = 0 to lb - 1 do
-      let s = r.(i + j) + a.(i) * b.(j) + !carry in
-      r.(i + j) <- s land mask; carry := s lsr bits
+      let s = Int64.add (Int64.add (Int64.of_int r.(i + j))
+                           (Int64.mul ai (Int64.of_int b.(j)))) !carry in
+      r.(i + j) <- Int64.to_int (Int64.logand s maskL);
+      carry := Int64.shift_right_logical s bits
     done;
-    r.(i + lb) <- r.(i + lb) + !carry
+    r.(i + lb) <- r.(i + lb) + Int64.to_int !carry
   done;
   norm r
 
@@ -109,12 +116,16 @@ let bn_mod (a : bn) (m : bn) : bn =
   end
 
 let div_small (a : bn) (d : int) : bn =
+  (* [rem lsl bits] reaches ~2^34 (rem < d <= 256, bits = 26), past the web
+     targets' int width — accumulate the running remainder in Int64. *)
   let la = Array.length a in
   let q = Array.make la 0 in
-  let rem = ref 0 in
+  let rem = ref 0L in
+  let dL = Int64.of_int d in
   for i = la - 1 downto 0 do
-    let cur = (!rem lsl bits) lor a.(i) in
-    q.(i) <- cur / d; rem := cur mod d
+    let cur = Int64.logor (Int64.shift_left !rem bits) (Int64.of_int a.(i)) in
+    q.(i) <- Int64.to_int (Int64.div cur dL);
+    rem := Int64.rem cur dL
   done;
   norm q
 

hosts/ocaml/lib/sx_primitives.ml

@@ -4168,6 +4168,38 @@ let () =
     ) Sx_types.jit_cache_queue;
     Queue.clear Sx_types.jit_cache_queue;
     Nil);
+  register "jit-exclude!" (fun args ->
+    (* Mark function names as interpret-only (never JIT-compiled). A guest
+       interpreter calls this for its continuation-using dispatch core.
+       Accepts string/symbol names; a trailing "*" makes it a namespace prefix
+       (e.g. "er-*" excludes every function whose name starts with "er-") —
+       the robust way to declare a whole guest interpreter core. *)
+    List.iter (fun a ->
+      match a with
+      | String n | Symbol n ->
+        let len = String.length n in
+        if len > 0 && n.[len - 1] = '*' then begin
+          let prefix = String.sub n 0 (len - 1) in
+          if not (List.mem prefix !Sx_types.jit_excluded_prefixes) then
+            Sx_types.jit_excluded_prefixes := prefix :: !Sx_types.jit_excluded_prefixes
+        end else
+          Hashtbl.replace Sx_types.jit_excluded n ()
+      | _ -> ()) args;
+    Nil);
+  register "jit-excluded?" (fun args ->
+    match args with
+    | [String n] | [Symbol n] -> Bool (Sx_types.jit_name_excluded n)
+    | _ -> Bool false);
+  register "jit-exclude-callers-of!" (fun args ->
+    (* Register call/cc-establishing forms (e.g. cl-restart-case). Any function
+       whose bytecode references one of these is itself interpret-only — JIT
+       would force the form into a nested cek-run where its continuation can't
+       escape. A guest declares its condition-system / escaping forms here. *)
+    List.iter (fun a ->
+      match a with
+      | String n | Symbol n -> Hashtbl.replace Sx_types.jit_excluded_caller_names n ()
+      | _ -> ()) args;
+    Nil);
   register "jit-reset-counters!" (fun _args ->
     Sx_types.jit_compiled_count := 0;
     Sx_types.jit_skipped_count := 0;

hosts/ocaml/lib/sx_ref.ml

@@ -404,7 +404,7 @@ and library_loaded_p spec =
 
 (* library-exports *)
 and library_exports spec =
-  (get ((get (_library_registry_) ((library_name_key (spec))))) ((String "exports")))
+  (let entry = (get (_library_registry_) ((library_name_key (spec)))) in (if sx_truthy (entry) then (get (entry) ((String "exports"))) else (Dict (Hashtbl.create 0))))
 
 (* register-library *)
 and register_library spec exports =

hosts/ocaml/lib/sx_runtime.ml

@@ -17,11 +17,19 @@ let rec _fast_eq a b =
   | Number x, Number y -> x = y
   | Integer x, Number y -> float_of_int x = y
   | Number x, Integer y -> x = float_of_int y
+  (* Exact rationals — must match the "=" primitive (safe_eq). Cross-multiply
+     for rational/rational; coerce for rational/int and rational/float. *)
+  | Rational (an, ad), Rational (bn, bd) -> an * bd = bn * ad
+  | Rational (n, d), Integer y -> n = y * d
+  | Integer x, Rational (n, d) -> x * d = n
+  | Rational (n, d), Number y -> float_of_int n /. float_of_int d = y
+  | Number x, Rational (n, d) -> x = float_of_int n /. float_of_int d
   | Bool x, Bool y -> x = y
   | Nil, Nil -> true
   | Symbol x, Symbol y -> x = y
   | Keyword x, Keyword y -> x = y
-  | List la, List lb ->
+  | (List la | ListRef { contents = la }),
+    (List lb | ListRef { contents = lb }) ->
     (try List.for_all2 _fast_eq la lb with Invalid_argument _ -> false)
   | _ -> false
 

hosts/ocaml/lib/sx_sha2.ml

@@ -3,37 +3,40 @@
     No C stubs, no external deps. Used by the fed-sx host primitives
     [crypto-sha256] / [crypto-sha512]. Reference: FIPS 180-4. *)
 
-(* ---- SHA-256 (FIPS 180-4 §6.2). 32-bit words held in native int,
-   masked to 32 bits after every arithmetic op. ---- *)
-
-let mask32 = 0xFFFFFFFF
+(* ---- SHA-256 (FIPS 180-4 §6.2). 32-bit words via Int32, NOT native int.
+   On the web targets the kernel is compiled by js_of_ocaml (32-bit int) and
+   wasm_of_ocaml (31-bit int), where native [int] silently truncates the 32-bit
+   round words — producing WRONG digests (and, downstream, bad CIDs and a
+   Char.chr crash at kernel init). Int32 has well-defined wrap-around mod 2^32 on
+   every target, so this matches the 63-bit native build exactly. ---- *)
 
 let k256 = [|
-  0x428a2f98; 0x71374491; 0xb5c0fbcf; 0xe9b5dba5;
-  0x3956c25b; 0x59f111f1; 0x923f82a4; 0xab1c5ed5;
-  0xd807aa98; 0x12835b01; 0x243185be; 0x550c7dc3;
-  0x72be5d74; 0x80deb1fe; 0x9bdc06a7; 0xc19bf174;
-  0xe49b69c1; 0xefbe4786; 0x0fc19dc6; 0x240ca1cc;
-  0x2de92c6f; 0x4a7484aa; 0x5cb0a9dc; 0x76f988da;
-  0x983e5152; 0xa831c66d; 0xb00327c8; 0xbf597fc7;
-  0xc6e00bf3; 0xd5a79147; 0x06ca6351; 0x14292967;
-  0x27b70a85; 0x2e1b2138; 0x4d2c6dfc; 0x53380d13;
-  0x650a7354; 0x766a0abb; 0x81c2c92e; 0x92722c85;
-  0xa2bfe8a1; 0xa81a664b; 0xc24b8b70; 0xc76c51a3;
-  0xd192e819; 0xd6990624; 0xf40e3585; 0x106aa070;
-  0x19a4c116; 0x1e376c08; 0x2748774c; 0x34b0bcb5;
-  0x391c0cb3; 0x4ed8aa4a; 0x5b9cca4f; 0x682e6ff3;
-  0x748f82ee; 0x78a5636f; 0x84c87814; 0x8cc70208;
-  0x90befffa; 0xa4506ceb; 0xbef9a3f7; 0xc67178f2 |]
+  0x428a2f98l; 0x71374491l; 0xb5c0fbcfl; 0xe9b5dba5l;
+  0x3956c25bl; 0x59f111f1l; 0x923f82a4l; 0xab1c5ed5l;
+  0xd807aa98l; 0x12835b01l; 0x243185bel; 0x550c7dc3l;
+  0x72be5d74l; 0x80deb1fel; 0x9bdc06a7l; 0xc19bf174l;
+  0xe49b69c1l; 0xefbe4786l; 0x0fc19dc6l; 0x240ca1ccl;
+  0x2de92c6fl; 0x4a7484aal; 0x5cb0a9dcl; 0x76f988dal;
+  0x983e5152l; 0xa831c66dl; 0xb00327c8l; 0xbf597fc7l;
+  0xc6e00bf3l; 0xd5a79147l; 0x06ca6351l; 0x14292967l;
+  0x27b70a85l; 0x2e1b2138l; 0x4d2c6dfcl; 0x53380d13l;
+  0x650a7354l; 0x766a0abbl; 0x81c2c92el; 0x92722c85l;
+  0xa2bfe8a1l; 0xa81a664bl; 0xc24b8b70l; 0xc76c51a3l;
+  0xd192e819l; 0xd6990624l; 0xf40e3585l; 0x106aa070l;
+  0x19a4c116l; 0x1e376c08l; 0x2748774cl; 0x34b0bcb5l;
+  0x391c0cb3l; 0x4ed8aa4al; 0x5b9cca4fl; 0x682e6ff3l;
+  0x748f82eel; 0x78a5636fl; 0x84c87814l; 0x8cc70208l;
+  0x90befffal; 0xa4506cebl; 0xbef9a3f7l; 0xc67178f2l |]
 
-let rotr32 x n = ((x lsr n) lor (x lsl (32 - n))) land mask32
+let rotr32 (x : int32) (n : int) : int32 =
+  Int32.logor (Int32.shift_right_logical x n) (Int32.shift_left x (32 - n))
 
 let sha256_hex (msg : string) : string =
-  let h = [| 0x6a09e667; 0xbb67ae85; 0x3c6ef372; 0xa54ff53a;
-             0x510e527f; 0x9b05688c; 0x1f83d9ab; 0x5be0cd19 |] in
+  let h = [| 0x6a09e667l; 0xbb67ae85l; 0x3c6ef372l; 0xa54ff53al;
+             0x510e527fl; 0x9b05688cl; 0x1f83d9abl; 0x5be0cd19l |] in
   let len = String.length msg in
   (* Padded length: multiple of 64 bytes. *)
-  let bitlen = len * 8 in
+  let bitlen = Int64.mul (Int64.of_int len) 8L in
   let padlen =
     let r = (len + 1) mod 64 in
     if r <= 56 then 56 - r else 120 - r
@@ -42,60 +45,79 @@ let sha256_hex (msg : string) : string =
   let buf = Bytes.make total '\000' in
   Bytes.blit_string msg 0 buf 0 len;
   Bytes.set buf len '\x80';
-  (* 64-bit big-endian bit length (we cap at OCaml int range). *)
+  (* 64-bit big-endian bit length. Int64 shifts so the high bytes (shift >= 32)
+     are correct on the 32-bit web targets — native int `lsr 32` is shift-mod-32
+     on js_of_ocaml and would leak the low length byte into a higher word. *)
   for i = 0 to 7 do
     Bytes.set buf (total - 1 - i)
-      (Char.chr ((bitlen lsr (8 * i)) land 0xFF))
+      (Char.chr (Int64.to_int
+         (Int64.logand (Int64.shift_right_logical bitlen (8 * i)) 0xFFL)))
   done;
-  let w = Array.make 64 0 in
+  let byte i = Int32.of_int (Char.code (Bytes.get buf i)) in
+  let w = Array.make 64 0l in
   let nblocks = total / 64 in
   for b = 0 to nblocks - 1 do
     let base = b * 64 in
     for t = 0 to 15 do
       let o = base + t * 4 in
       w.(t) <-
-        (Char.code (Bytes.get buf o) lsl 24)
-        lor (Char.code (Bytes.get buf (o + 1)) lsl 16)
-        lor (Char.code (Bytes.get buf (o + 2)) lsl 8)
-        lor (Char.code (Bytes.get buf (o + 3)))
+        Int32.logor
+          (Int32.logor
+             (Int32.shift_left (byte o) 24)
+             (Int32.shift_left (byte (o + 1)) 16))
+          (Int32.logor
+             (Int32.shift_left (byte (o + 2)) 8)
+             (byte (o + 3)))
     done;
     for t = 16 to 63 do
       let s0 =
-        (rotr32 w.(t - 15) 7) lxor (rotr32 w.(t - 15) 18)
-        lxor (w.(t - 15) lsr 3) in
+        Int32.logxor
+          (Int32.logxor (rotr32 w.(t - 15) 7) (rotr32 w.(t - 15) 18))
+          (Int32.shift_right_logical w.(t - 15) 3) in
       let s1 =
-        (rotr32 w.(t - 2) 17) lxor (rotr32 w.(t - 2) 19)
-        lxor (w.(t - 2) lsr 10) in
-      w.(t) <- (w.(t - 16) + s0 + w.(t - 7) + s1) land mask32
+        Int32.logxor
+          (Int32.logxor (rotr32 w.(t - 2) 17) (rotr32 w.(t - 2) 19))
+          (Int32.shift_right_logical w.(t - 2) 10) in
+      w.(t) <-
+        Int32.add (Int32.add w.(t - 16) s0) (Int32.add w.(t - 7) s1)
     done;
     let a = ref h.(0) and bb = ref h.(1) and c = ref h.(2)
     and d = ref h.(3) and e = ref h.(4) and f = ref h.(5)
     and g = ref h.(6) and hh = ref h.(7) in
     for t = 0 to 63 do
       let s1 =
-        (rotr32 !e 6) lxor (rotr32 !e 11) lxor (rotr32 !e 25) in
-      let ch = (!e land !f) lxor ((lnot !e land mask32) land !g) in
-      let t1 = (!hh + s1 + ch + k256.(t) + w.(t)) land mask32 in
+        Int32.logxor
+          (Int32.logxor (rotr32 !e 6) (rotr32 !e 11)) (rotr32 !e 25) in
+      let ch =
+        Int32.logxor (Int32.logand !e !f)
+          (Int32.logand (Int32.lognot !e) !g) in
+      let t1 =
+        Int32.add
+          (Int32.add (Int32.add !hh s1) (Int32.add ch k256.(t))) w.(t) in
       let s0 =
-        (rotr32 !a 2) lxor (rotr32 !a 13) lxor (rotr32 !a 22) in
-      let maj = (!a land !bb) lxor (!a land !c) lxor (!bb land !c) in
-      let t2 = (s0 + maj) land mask32 in
+        Int32.logxor
+          (Int32.logxor (rotr32 !a 2) (rotr32 !a 13)) (rotr32 !a 22) in
+      let maj =
+        Int32.logxor
+          (Int32.logxor (Int32.logand !a !bb) (Int32.logand !a !c))
+          (Int32.logand !bb !c) in
+      let t2 = Int32.add s0 maj in
       hh := !g; g := !f; f := !e;
-      e := (!d + t1) land mask32;
+      e := Int32.add !d t1;
       d := !c; c := !bb; bb := !a;
-      a := (t1 + t2) land mask32
+      a := Int32.add t1 t2
     done;
-    h.(0) <- (h.(0) + !a) land mask32;
-    h.(1) <- (h.(1) + !bb) land mask32;
-    h.(2) <- (h.(2) + !c) land mask32;
-    h.(3) <- (h.(3) + !d) land mask32;
-    h.(4) <- (h.(4) + !e) land mask32;
-    h.(5) <- (h.(5) + !f) land mask32;
-    h.(6) <- (h.(6) + !g) land mask32;
-    h.(7) <- (h.(7) + !hh) land mask32
+    h.(0) <- Int32.add h.(0) !a;
+    h.(1) <- Int32.add h.(1) !bb;
+    h.(2) <- Int32.add h.(2) !c;
+    h.(3) <- Int32.add h.(3) !d;
+    h.(4) <- Int32.add h.(4) !e;
+    h.(5) <- Int32.add h.(5) !f;
+    h.(6) <- Int32.add h.(6) !g;
+    h.(7) <- Int32.add h.(7) !hh
   done;
   let out = Buffer.create 64 in
-  Array.iter (fun x -> Buffer.add_string out (Printf.sprintf "%08x" x)) h;
+  Array.iter (fun x -> Buffer.add_string out (Printf.sprintf "%08lx" x)) h;
   Buffer.contents out
 
 (* ---- SHA-512 (FIPS 180-4 §6.4). 64-bit words via Int64.
@@ -146,7 +168,7 @@ let sha512_hex (msg : string) : string =
              0x510e527fade682d1L; 0x9b05688c2b3e6c1fL;
              0x1f83d9abfb41bd6bL; 0x5be0cd19137e2179L |] in
   let len = String.length msg in
-  let bitlen = len * 8 in
+  let bitlen = Int64.mul (Int64.of_int len) 8L in
   (* Pad to a multiple of 128 bytes; 16-byte big-endian length. *)
   let padlen =
     let r = (len + 1) mod 128 in
@@ -156,9 +178,12 @@ let sha512_hex (msg : string) : string =
   let buf = Bytes.make total '\000' in
   Bytes.blit_string msg 0 buf 0 len;
   Bytes.set buf len '\x80';
+  (* Low 64 bits of the bit length (high 64 stay 0). Int64 shifts so the bytes
+     at shift >= 32 are correct on the 32-bit web targets (js shift-mod-32). *)
   for i = 0 to 7 do
     Bytes.set buf (total - 1 - i)
-      (Char.chr ((bitlen lsr (8 * i)) land 0xFF))
+      (Char.chr (Int64.to_int
+         (Int64.logand (Int64.shift_right_logical bitlen (8 * i)) 0xFFL)))
   done;
   let w = Array.make 80 0L in
   let nblocks = total / 128 in

hosts/ocaml/lib/sx_types.ml

@@ -470,6 +470,52 @@ let jit_compiled_count = ref 0
 let jit_skipped_count = ref 0
 let jit_threshold_skipped_count = ref 0
 
+(** Runtime, data-driven JIT exclusion set. Names added here are never
+    JIT-compiled — they run on the CEK interpreter instead.
+
+    This is how a guest interpreter declares its *interpret-only* functions:
+    those that capture or invoke first-class continuations (e.g. Smalltalk's
+    [call/cc]-based non-local return [^expr], or block escape). The stack VM
+    cannot transfer control through a CEK continuation, so a JIT-compiled
+    frame on the OCaml/VM stack between a [call/cc] and its [(k v)] invocation
+    would either fail at runtime or (worse) re-run with duplicated side
+    effects. Marking the dispatch core interpret-only keeps those functions on
+    the CEK while pure helpers still JIT.
+
+    Populated from SX via the [jit-exclude!] primitive (see sx_primitives).
+    Consulted in [Sx_vm.jit_compile_lambda], so it covers BOTH JIT entry
+    points: the CEK call hook and the in-VM tiered-compilation path. *)
+let jit_excluded : (string, unit) Hashtbl.t = Hashtbl.create 64
+
+(** Namespace-prefix exclusions. A guest interpreter declares its whole
+    function namespace interpret-only with one entry (e.g. ["er-"], ["scm-"]),
+    which is far more robust than enumerating every function — a name-list
+    misses functions in extra files (the erlang VM dispatcher, etc.) and
+    silently regresses. Set via [jit-exclude!] with a trailing ["*"]
+    (e.g. [(jit-exclude! "er-*")]). Checked via [jit_name_excluded]. *)
+let jit_excluded_prefixes : string list ref = ref []
+
+(** True if [name] is excluded from JIT — by exact name or by namespace prefix. *)
+let jit_name_excluded name =
+  Hashtbl.mem jit_excluded name
+  || List.exists (fun p ->
+       String.length name >= String.length p
+       && String.sub name 0 (String.length p) = p) !jit_excluded_prefixes
+
+(** Names of functions that ESTABLISH an escaping continuation via call/cc
+    (e.g. Common-Lisp's [cl-restart-case] / [cl-handler-case] — the condition
+    system). Any SX function that *calls* one of these is itself unsafe to JIT:
+    JIT-compiling the caller forces the call/cc-wrapping form to run in a nested
+    cek-run, where invoking the captured continuation runs-to-completion-and-
+    returns instead of escaping — so a restart/non-local exit silently fails
+    and the body falls through (observed as result accumulation / no-abort).
+
+    These callers are NOT a fixed namespace (they are arbitrary user/test code),
+    so they cannot be prefix-excluded. Instead a guest declares its escaping
+    forms here (via [jit-exclude-callers-of!]) and [jit_compile_lambda] skips
+    any function whose constant pool references one of them. *)
+let jit_excluded_caller_names : (string, unit) Hashtbl.t = Hashtbl.create 16
+
 (** {2 JIT cache LRU eviction — Phase 2}
 
     Once a lambda crosses the threshold, its [l_compiled] slot is filled.

hosts/ocaml/lib/sx_vm.ml

@@ -336,30 +336,51 @@ and call_closure_reuse cl args =
     push_closure_frame vm cl args;
     let saved_frames = List.tl vm.frames in
     vm.frames <- [List.hd vm.frames];
-    (try run vm
+    let result =
+      (try run vm;
+        (* Normal completion: result sits at the top of the stack.
+           OP_RETURN normally leaves sp = saved_sp + 1, but the
+           bytecode-exhausted path (or a callee that returns a closure whose
+           own RETURN leaves extra stack residue) can leave sp inconsistent.
+           Read the result at the expected slot. *)
+        if vm.sp > saved_sp then vm.stack.(vm.sp - 1) else Nil
        with
-     | VmSuspended _ as e ->
-       (* IO suspension: save the caller's continuation on the reuse stack.
-          DON'T merge frames — that corrupts the frame chain with nested
-          closures. On resume, restore_reuse in resume_vm processes these
-          in innermost-first order after the callback finishes. *)
+       | VmSuspended (req, _) as e ->
+         (match !Sx_types._cek_io_resolver with
+          | Some resolver ->
+            (* Serving path: a `perform` fired inside this HO-primitive
+               callback (map/filter/reduce/for-each/…). The primitive's native
+               OCaml loop sits between us and the resume point, so we CANNOT
+               unwind it and resume later (the loop state would be lost and the
+               remaining elements dropped — corrupting the stack so the next
+               CALL_PRIM sees wrong args). Instead resolve the callback's IO
+               inline and run it to completion right here, returning its value
+               to the native loop exactly as a non-suspending callback would.
+               reuse_stack is isolated so an outer suspension's saved
+               continuations aren't consumed by this nested resume. *)
+            let saved_reuse = vm.reuse_stack in
+            vm.reuse_stack <- [];
+            let rec settle req =
+              let r = resolver req Nil in
+              (try resume_vm vm r
+               with VmSuspended (req2, _) -> settle req2)
+            in
+            let cb = settle req in
+            vm.reuse_stack <- saved_reuse;
+            cb
+          | None ->
+            (* CEK-driven path (no synchronous resolver): preserve the existing
+               behaviour — save the caller's continuation on the reuse stack and
+               re-raise so resume_vm restores it after the callback finishes.
+               DON'T merge frames — that corrupts the frame chain. *)
             vm.reuse_stack <- (saved_frames, saved_sp) :: vm.reuse_stack;
-       raise e
+            raise e)
        | e ->
          vm.frames <- saved_frames;
          vm.sp <- saved_sp;
-       raise e);
-    vm.frames <- saved_frames;
-    (* Snapshot/restore sp around the popped result.
-       OP_RETURN normally leaves sp = saved_sp + 1, but the bytecode-exhausted
-       path (or a callee that returns a closure whose own RETURN leaves extra
-       stack residue) can leave sp inconsistent. Read the result at the
-       expected slot and reset sp explicitly so the parent frame's
-       intermediate values are not corrupted. *)
-    let result =
-      if vm.sp > saved_sp then vm.stack.(vm.sp - 1)
-      else Nil
+         raise e)
     in
+    vm.frames <- saved_frames;
     vm.sp <- saved_sp;
     result
   | None ->
@@ -808,14 +829,31 @@ and run vm =
           let b = pop vm and a = pop vm in
           push vm (match a, b with
             | Integer x, Integer y when y <> 0 && x mod y = 0 -> Integer (x / y)
-            | Integer x, Integer y -> Number (float_of_int x /. float_of_int y)
+            (* Non-divisible Integer/Integer must delegate to the "/" primitive:
+               it returns an exact Rational (e.g. 1/2), matching CEK semantics.
+               Inlining float division here (0.5) diverges from the interpreter
+               and breaks numeric equality against rational results. *)
             | Number x, Number y -> Number (x /. y)
             | Integer x, Number y -> Number (float_of_int x /. y)
             | Number x, Integer y -> Number (x /. float_of_int y)
             | _ -> (Hashtbl.find Sx_primitives.primitives "/") [a; b])
         | 164 (* OP_EQ *) ->
           let b = pop vm and a = pop vm in
-          push vm (Bool (Sx_runtime._fast_eq a b))
+          (* Trivial scalar cases inline; everything else (Rational, Dict,
+             Record, Vector, ListRef, nested lists) delegates to the "="
+             primitive so VM equality matches CEK exactly. _fast_eq is a
+             stripped-down subset and must not be the source of truth here. *)
+          push vm (match a, b with
+            | Integer x, Integer y -> Bool (x = y)
+            | Number x, Number y -> Bool (x = y)
+            | Integer x, Number y -> Bool (float_of_int x = y)
+            | Number x, Integer y -> Bool (x = float_of_int y)
+            | String x, String y -> Bool (x = y)
+            | Bool x, Bool y -> Bool (x = y)
+            | Symbol x, Symbol y -> Bool (x = y)
+            | Keyword x, Keyword y -> Bool (x = y)
+            | Nil, Nil -> Bool true
+            | _ -> (Hashtbl.find Sx_primitives.primitives "=") [a; b])
         | 165 (* OP_LT *) ->
           let b = pop vm and a = pop vm in
           push vm (match a, b with
@@ -921,7 +959,17 @@ and run vm =
 
     After the callback finishes, restores any call_closure_reuse
     continuations saved on vm.reuse_stack (innermost first). *)
-let resume_vm vm result =
+and resume_vm vm result =
+  (* The resumed execution runs on [vm]; HO primitives (map/filter/…) called
+     during the resume reach for [!_active_vm] to run their callbacks on the
+     same stack. call_closure restored [_active_vm] to the *caller* when the
+     original VmSuspended unwound through it, so without re-asserting it here
+     the resumed run's callbacks land on the wrong VM (or allocate a fresh
+     one), corrupting the stack. Mirror call_closure's save/set/restore. *)
+  let prev_active = !_active_vm in
+  _active_vm := Some vm;
+  let restore () = _active_vm := prev_active in
+  (try
   (match vm.pending_cek with
    | Some cek_state ->
      vm.pending_cek <- None;
@@ -993,7 +1041,9 @@ let resume_vm vm result =
   let pending = List.rev vm.reuse_stack in
   vm.reuse_stack <- [];
   restore_reuse pending;
-  pop vm
+  let r = pop vm in
+  restore (); r
+  with e -> restore (); raise e)
 
 (** Execute a compiled module (top-level bytecode). *)
 let execute_module code globals =
@@ -1072,7 +1122,7 @@ let _jit_is_broken_name n =
     Operand-size logic mirrors [opcode_operand_size] (which is defined
     later, in the disassembly section); inlined here so this helper can
     sit before [jit_compile_lambda] in the file. *)
-let bytecode_uses_extension_opcodes (bc : int array) (consts : value array) =
+let bytecode_find_opcode (pred : int -> bool) (bc : int array) (consts : value array) =
   let core_operand_size = function
     | 1 | 20 | 21 | 64 | 65 | 128 -> 2  (* u16 *)
     | 16 | 17 | 18 | 19 | 48 | 49 | 144 -> 1  (* u8 *)
@@ -1085,7 +1135,7 @@ let bytecode_uses_extension_opcodes (bc : int array) (consts : value array) =
   let found = ref false in
   while not !found && !ip < len do
     let op = bc.(!ip) in
-    if op >= 200 then found := true
+    if pred op then found := true
     else begin
       ip := !ip + 1;
       let extra = match op with
@@ -1112,6 +1162,49 @@ let bytecode_uses_extension_opcodes (bc : int array) (consts : value array) =
   done;
   !found
 
+let bytecode_uses_extension_opcodes bc consts =
+  bytecode_find_opcode (fun op -> op >= 200) bc consts
+
+(** True if [code] — or any closure nested in its constant pool — installs an
+    exception handler (OP_PUSH_HANDLER = 35), i.e. contains a `guard` /
+    `handler-bind` / dream-catch form. The VM's PUSH_HANDLER only intercepts a
+    VM-level RAISE (opcode 37); it does NOT catch the OCaml [Eval_error] that
+    the `error` primitive throws from inside a CALL/CALL_PRIM in a callee
+    frame. So a JIT-compiled guard silently fails to catch thrown errors (they
+    escape across the JIT frame).
+
+    The scan is RECURSIVE: a curried higher-order function (e.g. Dream's
+    `dream-catch-with = (fn (on-error) (fn (next) (fn (req) (guard ...))))`)
+    has no PUSH_HANDLER in its own body — the guard lives in a nested
+    `OP_CLOSURE` whose code sits in the constant pool. JIT-compiling the outer
+    function would mint that inner guard as a VmClosure with the broken VM
+    handler. Descending into nested closure codes catches this, so the whole
+    closure family runs on the CEK (whose guard catches correctly). Covers
+    dream-catch-with, host wrap-errors, and every guard user centrally. *)
+let rec code_uses_handler code =
+  bytecode_find_opcode (fun op -> op = 35) code.vc_bytecode code.vc_constants
+  || Array.exists (fun c ->
+       match c with
+       | Dict d when Hashtbl.mem d "bytecode" || Hashtbl.mem d "vc-bytecode" ->
+         (try code_uses_handler (code_from_value c) with _ -> false)
+       | _ -> false) code.vc_constants
+
+(** True if [code] — or any nested closure code — references (in its constant
+    pool, as a GLOBAL_GET/CALL name) a function registered in
+    [Sx_types.jit_excluded_caller_names] (a call/cc-establishing form like
+    Common-Lisp's cl-restart-case/cl-handler-case). Such a caller must run on
+    the CEK so the continuation captured inside the called form can escape.
+    The constant-pool string IS the referenced symbol name, so membership is a
+    direct lookup; recurse into nested closure codes. Skipped entirely (no
+    Hashtbl walk) when no escaping forms are registered. *)
+let rec code_refs_escaping_caller code =
+  Array.exists (fun c ->
+    match c with
+    | String s -> Hashtbl.mem Sx_types.jit_excluded_caller_names s
+    | Dict d when Hashtbl.mem d "bytecode" || Hashtbl.mem d "vc-bytecode" ->
+      (try code_refs_escaping_caller (code_from_value c) with _ -> false)
+    | _ -> false) code.vc_constants
+
 let jit_compile_lambda (l : lambda) globals =
   let fn_name = match l.l_name with Some n -> n | None -> "<anon>" in
   if !_jit_compiling then (
@@ -1127,6 +1220,13 @@ let jit_compile_lambda (l : lambda) globals =
     None
   ) else if _jit_is_broken_name fn_name then (
     None
+  ) else if Sx_types.jit_name_excluded fn_name then (
+    (* Guest-declared interpret-only function (continuation-using dispatch
+       core, or a whole namespace via prefix). Run on the CEK; the stack VM
+       can't escape through a CEK continuation and may miscompile deep AST
+       recursion into a non-terminating loop. See Sx_types.jit_excluded /
+       jit_excluded_prefixes. *)
+    None
   ) else
   try
     _jit_compiling := true;
@@ -1183,6 +1283,20 @@ let jit_compile_lambda (l : lambda) globals =
             Printf.eprintf "[jit] SKIP %s: bytecode uses extension opcodes (interpret-only in v1)\n%!"
               fn_name;
             None
+          end else if code_uses_handler code then begin
+            (* guard / handler-bind (possibly in a nested closure): VM
+               PUSH_HANDLER doesn't catch the `error` primitive's OCaml
+               exception across frames — run on the CEK. *)
+            Printf.eprintf "[jit] SKIP %s: installs an exception handler (guard) — interpret-only\n%!"
+              fn_name;
+            None
+          end else if Hashtbl.length Sx_types.jit_excluded_caller_names > 0
+                      && code_refs_escaping_caller code then begin
+            (* Calls a call/cc-establishing form (e.g. cl-restart-case): must
+               run on the CEK so the captured continuation can escape. *)
+            Printf.eprintf "[jit] SKIP %s: calls a call/cc-establishing form — interpret-only\n%!"
+              fn_name;
+            None
           end else
             Some { vm_code = code; vm_upvalues = [||];
                    vm_name = l.l_name; vm_env_ref = effective_globals; vm_closure_env = Some l.l_closure }

lib/common-lisp/runtime.sx

@@ -758,3 +758,23 @@
       (cl-restart-case
         (fn () (cl-signal-obj obj cl-handler-stack))
         (list "continue" (list) (fn () nil))))))
+;; ── JIT interpret-only boundary ───────────────────────────────────────────
+;; The Common-Lisp evaluator implements block/return-from, catch/throw, and
+;; the condition system via non-local control (host continuations); under JIT
+;; a compiled frame can't transfer control through a CEK continuation. Exclude
+;; the cl-/clos- namespaces from JIT. See Sx_types.jit_excluded_prefixes.
+(jit-exclude! "cl-*" "clos-*")
+
+;; cl-restart-case / cl-handler-case / cl-handler-bind wrap their body in
+;; call/cc (restarts + non-local handler exit). Any function that CALLS one of
+;; these (e.g. SX fixtures driving the condition system: parse-recover,
+;; interactive-debugger) must also be interpret-only: JIT'ing such a caller
+;; forces the call/cc form into a nested cek-run where the captured
+;; continuation runs-to-completion-and-returns instead of escaping, so a
+;; restart fails to abort and the body falls through (accumulation/no-abort).
+(jit-exclude-callers-of! "cl-restart-case" "cl-handler-case" "cl-handler-bind")
+;; Also the INVOKE side: cl-invoke-restart / cl-invoke-debugger / cl-signal
+;; trigger the continuation escape; a JIT'd caller can't let the escape
+;; propagate out of its frame (e.g. make-policy-debugger building a debugger
+;; hook that invokes a restart). Mark their callers interpret-only too.
+(jit-exclude-callers-of! "cl-invoke-restart" "cl-invoke-debugger" "cl-signal" "cl-error-with-debugger")

lib/compiler.sx

@@ -783,11 +783,7 @@
                 (rest-clauses
                   (if (> (len flat-args) 2) (slice flat-args 2) (list))))
               (if
-                (or
-                  (and
-                    (= (type-of test) "keyword")
-                    (= (keyword-name test) "else"))
-                  (= test true))
+                (or (and (= (type-of test) "keyword") (= (keyword-name test) "else")) (and (= (type-of test) "symbol") (or (= (symbol-name test) "else") (= (symbol-name test) ":else"))) (= test true))
                 (compile-expr em body scope tail?)
                 (do
                   (compile-expr em test scope false)
@@ -828,11 +824,7 @@
               (rest-clauses
                 (if (> (len clauses) 2) (slice clauses 2) (list))))
             (if
-              (or
-                (and
-                  (= (type-of test) "keyword")
-                  (= (keyword-name test) "else"))
-                (= test true))
+              (or (and (= (type-of test) "keyword") (= (keyword-name test) "else")) (and (= (type-of test) "symbol") (or (= (symbol-name test) "else") (= (symbol-name test) ":else"))) (= test true))
               (do (emit-op em 5) (compile-expr em body scope tail?))
               (do
                 (emit-op em 6)
@@ -1172,11 +1164,7 @@
               (test (first clause))
               (body (rest clause)))
             (if
-              (or
-                (and
-                  (= (type-of test) "keyword")
-                  (= (keyword-name test) "else"))
-                (= test true))
+              (or (and (= (type-of test) "keyword") (= (keyword-name test) "else")) (and (= (type-of test) "symbol") (or (= (symbol-name test) "else") (= (symbol-name test) ":else"))) (= test true))
               (compile-begin em body scope tail?)
               (do
                 (compile-expr em test scope false)

lib/content/api.sx

@@ -25,8 +25,13 @@
 (define content/append doc-append)
 (define content/blocks doc-blocks)
 (define content/count doc-count)
-(define content/find doc-find)
-(define content/has? doc-has?)
+;; find / has? are TREE-WIDE by id (descend into sections) — so the facade reads
+;; back any block content/edit can update or delete. content/find-top / has-top?
+;; keep the top-level-only lookup for callers that mean the ordered sequence.
+(define content/find doc-find-deep)
+(define content/has? doc-has-deep?)
+(define content/find-top doc-find)
+(define content/has-top? doc-has?)
 (define content/ids doc-ids)
 (define content/types doc-types)
 

lib/content/doc.sx

@@ -5,14 +5,19 @@
 ;; and returns a NEW document — the input is never mutated, so any version is the
 ;; head of an op stream (replay-friendly for persist + CRDT merge).
 ;;
-;; CtDoc also carries optional metadata (title/slug/tags) — see meta.sx for the
-;; ergonomic API; they default nil and do not affect block operations.
+;; By-id ops (update/delete) and by-id lookup (doc-find-deep/doc-has-deep?) are
+;; TREE-WIDE: they descend into any block carrying a `children` list (i.e.
+;; sections), since ids are unique across the tree. This keeps the persist
+;; op-log, content/edit and content/find correct for nested documents.
+;; insert/move are positional and act at the top level.
+;;
+;; CtDoc also carries optional metadata (title/slug/tags) — see meta.sx.
 ;;
 ;; Op shapes (data, not objects — they are the persist event payload):
-;;   {:op "insert" :block <blk> :after <id|nil>}   ; after nil = prepend
-;;   {:op "update" :id <id> :field <name> :value <v>}
-;;   {:op "move"   :id <id> :index <n>}
-;;   {:op "delete" :id <id>}
+;;   {:op "insert" :block <blk> :after <id|nil>}   ; after nil = prepend (top level)
+;;   {:op "update" :id <id> :field <name> :value <v>}   ; tree-wide by id
+;;   {:op "move"   :id <id> :index <n>}                 ; top level
+;;   {:op "delete" :id <id>}                            ; tree-wide by id
 
 (define
   content-bootstrap-doc!
@@ -76,17 +81,58 @@
           (first blocks)
           (ct-insert-at (rest blocks) (- i 1) x))))))
 
+;; tree-wide remove by id: drop matches at this level, recurse into children
+;; (blocks carrying a `children` list, i.e. sections).
 (define
   ct-remove-id
   (fn
     (blocks id)
-    (filter (fn (b) (if (= (blk-id b) id) false true)) blocks)))
+    (map
+      (fn
+        (b)
+        (let
+          ((ch (st-iv-get b "children")))
+          (if (list? ch) (st-iv-set! b "children" (ct-remove-id ch id)) b)))
+      (filter (fn (b) (if (= (blk-id b) id) false true)) blocks))))
 
+;; tree-wide replace by id: apply f to the match wherever it sits in the tree.
 (define
   ct-replace-id
   (fn
     (blocks id f)
-    (map (fn (b) (if (= (blk-id b) id) (f b) b)) blocks)))
+    (map
+      (fn
+        (b)
+        (if
+          (= (blk-id b) id)
+          (f b)
+          (let
+            ((ch (st-iv-get b "children")))
+            (if
+              (list? ch)
+              (st-iv-set! b "children" (ct-replace-id ch id f))
+              b))))
+      blocks)))
+
+;; tree-wide find by id: first block matching id anywhere in the tree, or nil.
+;; Descends into any `children` list, mirroring ct-replace-id/ct-remove-id.
+(define
+  ct-find-id
+  (fn
+    (blocks id)
+    (if
+      (= (len blocks) 0)
+      nil
+      (let
+        ((b (first blocks)))
+        (if
+          (= (blk-id b) id)
+          b
+          (let
+            ((ch (st-iv-get b "children")))
+            (let
+              ((nested (if (list? ch) (ct-find-id ch id) nil)))
+              (if (= nested nil) (ct-find-id (rest blocks) id) nested))))))))
 
 ;; ── query ──
 (define doc-index-of (fn (doc id) (ct-index-of (doc-blocks doc) id)))
@@ -103,6 +149,14 @@
   doc-has?
   (fn (doc id) (if (= (doc-index-of doc id) -1) false true)))
 
+;; tree-wide lookup by id — reads a nested block by the same id content/edit can
+;; update/delete (no section.sx dependency; uses the generic children descent).
+(define doc-find-deep (fn (doc id) (ct-find-id (doc-blocks doc) id)))
+
+(define
+  doc-has-deep?
+  (fn (doc id) (if (= (doc-find-deep doc id) nil) false true)))
+
 ;; ── structural edits (each returns a new document) ──
 (define doc-with-blocks (fn (doc blocks) (st-iv-set! doc "blocks" blocks)))
 

lib/content/find-replace.sx

@@ -1,10 +1,17 @@
-;; content-on-sx — global find/replace across text-bearing blocks.
+;; content-on-sx — global find/replace across every text-bearing field.
 ;;
-;; Replaces every occurrence of `from` with `to` in the text field of text /
-;; heading / code / quote blocks, tree-wide (via the transform layer). For
-;; renaming a term throughout a document. Immutable; case-sensitive.
+;; Replaces every occurrence of `from` with `to` in the text-bearing fields of
+;; a document, tree-wide (via the transform layer):
+;;   - the `text` of text / heading / code / quote / callout blocks
+;;   - the `alt` of image blocks
+;;   - each item of list blocks
+;;   - every header and cell of table blocks
+;; This is exactly the set asText / stats / summary draw prose from, so a rename
+;; via content/find-replace and a word count over asText stay consistent.
+;; Immutable; case-sensitive.
 ;;
-;; Requires (loaded by harness): block.sx, transform.sx (content/map-blocks).
+;; Requires (loaded by harness): block.sx, transform.sx (content/map-blocks),
+;; table.sx (CtTable ivars).
 
 (define
   fr-in?
@@ -15,17 +22,54 @@
       ((= (first xs) x) true)
       (else (fr-in? x (rest xs))))))
 
+(define fr-rep (fn (s from to) (replace (str s) from to)))
+
+;; Blocks whose prose content find/replace rewrites (matches asText's set).
 (define
   fr-has-text?
-  (fn (b) (fr-in? (blk-type b) (list "text" "heading" "code" "quote"))))
+  (fn
+    (b)
+    (fr-in?
+      (blk-type b)
+      (list "text" "heading" "code" "quote" "callout" "image" "list" "table"))))
+
+;; Per-type field rewrite. Each branch returns a new (copy-on-write) block.
+(define
+  fr-rewrite
+  (fn
+    (b from to)
+    (let
+      ((t (blk-type b)))
+      (cond
+        ((= t "image")
+          (blk-set b "alt" (fr-rep (blk-get b "alt") from to)))
+        ((= t "list")
+          (let
+            ((items (blk-get b "items")))
+            (if
+              (list? items)
+              (blk-set b "items" (map (fn (it) (fr-rep it from to)) items))
+              b)))
+        ((= t "table")
+          (let
+            ((hs (blk-get b "headers")) (rs (blk-get b "rows")))
+            (let
+              ((b1 (if (list? hs) (blk-set b "headers" (map (fn (h) (fr-rep h from to)) hs)) b)))
+              (if
+                (list? rs)
+                (blk-set
+                  b1
+                  "rows"
+                  (map
+                    (fn
+                      (r)
+                      (if (list? r) (map (fn (c) (fr-rep c from to)) r) r))
+                    rs))
+                b1))))
+        (else (blk-set b "text" (fr-rep (blk-get b "text") from to)))))))
 
 (define
   content/find-replace
   (fn
     (doc from to)
-    (content/map-blocks
-      doc
-      fr-has-text?
-      (fn
-        (b)
-        (blk-set b "text" (replace (str (blk-get b "text")) from to))))))
+    (content/map-blocks doc fr-has-text? (fn (b) (fr-rewrite b from to)))))

lib/content/query.sx

@@ -1,10 +1,10 @@
 ;; content-on-sx — block query + table of contents.
 ;;
 ;; Collect blocks across the whole tree (descending into sections) by predicate
-;; or type, and derive a table of contents from headings. Tree detection is
-;; inline (class + st-iv-get) so this needs no section.sx.
+;; or type, search them by prose, and derive a table of contents from headings.
+;; Tree detection is inline (class + st-iv-get) so this needs no section.sx.
 ;;
-;; Requires (loaded by harness): block.sx, doc.sx.
+;; Requires (loaded by harness): block.sx, doc.sx, text.sx (asText for search).
 
 (define
   qry-section?
@@ -45,6 +45,30 @@
   content/select-ids
   (fn (doc pred) (map (fn (b) (blk-id b)) (content/select doc pred))))
 
+;; Blocks (tree-wide, excluding section containers) whose own prose contains
+;; `term`. "Prose" is (asText b), so search covers exactly what every block
+;; exposes as text — text/heading/code/quote/callout text, image alt, list
+;; items, table headers+cells — with no separate field list to drift from
+;; asText / find-replace / stats. Case-sensitive substring match.
+(define
+  content/search-text
+  (fn
+    (doc term)
+    (content/select
+      doc
+      (fn
+        (b)
+        (and
+          (not (qry-section? b))
+          (>= (index-of (asText b) term) 0))))))
+
+;; Same search, returning matching block ids in document order.
+(define
+  content/search-text-ids
+  (fn
+    (doc term)
+    (map (fn (b) (blk-id b)) (content/search-text doc term))))
+
 ;; table of contents: {:id :level :text} for every heading, in document order.
 (define
   content/headings

lib/content/scoreboard.json

@@ -3,7 +3,7 @@
     "block": {"pass": 38, "fail": 0},
     "doc": {"pass": 40, "fail": 0},
     "render": {"pass": 42, "fail": 0},
-    "api": {"pass": 26, "fail": 0},
+    "api": {"pass": 32, "fail": 0},
     "meta": {"pass": 27, "fail": 0},
     "page": {"pass": 7, "fail": 0},
     "page-full": {"pass": 4, "fail": 0},
@@ -14,14 +14,14 @@
     "tree-edit": {"pass": 17, "fail": 0},
     "move": {"pass": 11, "fail": 0},
     "clone": {"pass": 10, "fail": 0},
-    "query": {"pass": 13, "fail": 0},
+    "query": {"pass": 20, "fail": 0},
     "toc": {"pass": 8, "fail": 0},
     "anchor": {"pass": 6, "fail": 0},
     "outline": {"pass": 14, "fail": 0},
     "flatten": {"pass": 10, "fail": 0},
     "transform": {"pass": 12, "fail": 0},
     "normalize": {"pass": 11, "fail": 0},
-    "find-replace": {"pass": 10, "fail": 0},
+    "find-replace": {"pass": 16, "fail": 0},
     "stats": {"pass": 17, "fail": 0},
     "summary": {"pass": 14, "fail": 0},
     "index": {"pass": 13, "fail": 0},
@@ -31,7 +31,7 @@
     "data": {"pass": 25, "fail": 0},
     "wire": {"pass": 11, "fail": 0},
     "validate": {"pass": 23, "fail": 0},
-    "store": {"pass": 33, "fail": 0},
+    "store": {"pass": 46, "fail": 0},
     "snapshot": {"pass": 20, "fail": 0},
     "crdt": {"pass": 34, "fail": 0},
     "crdt-tree": {"pass": 21, "fail": 0},
@@ -42,7 +42,7 @@
     "md-doc": {"pass": 12, "fail": 0},
     "fed": {"pass": 20, "fail": 0}
   },
-  "total_pass": 746,
+  "total_pass": 778,
   "total_fail": 0,
-  "total": 746
+  "total": 778
 }

lib/content/scoreboard.md

@@ -7,7 +7,7 @@ _Generated by `lib/content/conformance.sh`_
 | block | 38 | 0 | 38 |
 | doc | 40 | 0 | 40 |
 | render | 42 | 0 | 42 |
-| api | 26 | 0 | 26 |
+| api | 32 | 0 | 32 |
 | meta | 27 | 0 | 27 |
 | page | 7 | 0 | 7 |
 | page-full | 4 | 0 | 4 |
@@ -18,14 +18,14 @@ _Generated by `lib/content/conformance.sh`_
 | tree-edit | 17 | 0 | 17 |
 | move | 11 | 0 | 11 |
 | clone | 10 | 0 | 10 |
-| query | 13 | 0 | 13 |
+| query | 20 | 0 | 20 |
 | toc | 8 | 0 | 8 |
 | anchor | 6 | 0 | 6 |
 | outline | 14 | 0 | 14 |
 | flatten | 10 | 0 | 10 |
 | transform | 12 | 0 | 12 |
 | normalize | 11 | 0 | 11 |
-| find-replace | 10 | 0 | 10 |
+| find-replace | 16 | 0 | 16 |
 | stats | 17 | 0 | 17 |
 | summary | 14 | 0 | 14 |
 | index | 13 | 0 | 13 |
@@ -35,7 +35,7 @@ _Generated by `lib/content/conformance.sh`_
 | data | 25 | 0 | 25 |
 | wire | 11 | 0 | 11 |
 | validate | 23 | 0 | 23 |
-| store | 33 | 0 | 33 |
+| store | 46 | 0 | 46 |
 | snapshot | 20 | 0 | 20 |
 | crdt | 34 | 0 | 34 |
 | crdt-tree | 21 | 0 | 21 |
@@ -45,4 +45,4 @@ _Generated by `lib/content/conformance.sh`_
 | md-import | 38 | 0 | 38 |
 | md-doc | 12 | 0 | 12 |
 | fed | 20 | 0 | 20 |
-| **Total** | **746** | **0** | **746** |
+| **Total** | **778** | **0** | **778** |

lib/content/store.sx

@@ -5,9 +5,10 @@
 ;; replay of its op stream up to a sequence number; the materialised doc is a
 ;; cache, never primary state.
 ;;
-;; Requires (loaded by the harness): block.sx, doc.sx, and persist
-;; (event/backend/log/kv/api). The persist backend `b` is opened by the caller
-;; via (persist/open) and injected — content knows nothing about which backend.
+;; Requires (loaded by the harness): block.sx, doc.sx, section.sx (doc-deep-find
+;; + doc-tree-ids, for the tree-wide diff), plus persist (event/backend/log/kv/
+;; api). The persist backend `b` is opened by the caller via (persist/open) and
+;; injected — content knows nothing about which backend.
 
 (define content/-stream (fn (doc-id) (str "content:" doc-id)))
 
@@ -69,11 +70,18 @@
   (fn (b doc-id) (map (fn (ev) {:type (persist/event-type ev) :at (persist/event-at ev) :seq (persist/event-seq ev)}) (content/log b doc-id))))
 
 ;; ── diff between two materialised document versions ──
-;; Returns {:added (ids) :removed (ids) :changed (ids)} where changed = ids
-;; present in both whose block content differs.
-(define
-  content/-missing?
-  (fn (doc id) (= (ct-index-of (doc-blocks doc) id) -1)))
+;; Tree-wide: ids are enumerated across the whole block tree (descending into
+;; sections), so nested-block adds/removes/changes are detected, not just
+;; top-level ones. Returns {:added :removed :changed} (lists of ids):
+;;   :added   — ids present (anywhere) in `new` but not in `old`
+;;   :removed — ids present (anywhere) in `old` but not in `new`
+;;   :changed — content blocks present in both whose block value differs
+;; Section containers never appear in :changed (they hold no own content — a
+;; child change surfaces as that child's own entry); a whole section appearing
+;; or disappearing shows up in :added / :removed by its id.
+(define content/-all-ids (fn (doc) (doc-tree-ids doc)))
+
+(define content/-missing? (fn (doc id) (= (doc-deep-find doc id) nil)))
 
 (define
   content/-changed
@@ -83,15 +91,16 @@
       (fn
         (id)
         (let
-          ((bo (doc-find old id)) (bn (doc-find new id)))
+          ((bo (doc-deep-find old id)) (bn (doc-deep-find new id)))
           (cond
             ((= bo nil) false)
             ((= bn nil) false)
+            ((= (blk-type bo) "section") false)
             ((= bo bn) false)
             (else true))))
-      (doc-ids old))))
+      (content/-all-ids old))))
 
-(define content/diff (fn (old new) {:changed (content/-changed old new) :removed (filter (fn (id) (content/-missing? new id)) (doc-ids old)) :added (filter (fn (id) (content/-missing? old id)) (doc-ids new))}))
+(define content/diff (fn (old new) {:changed (content/-changed old new) :removed (filter (fn (id) (content/-missing? new id)) (content/-all-ids old)) :added (filter (fn (id) (content/-missing? old id)) (content/-all-ids new))}))
 
 ;; convenience: diff two persisted versions by seq.
 (define

lib/content/tests/api.sx

@@ -97,3 +97,37 @@
   "render original unchanged"
   (content/render d1 "html")
   "<h1>Hi</h1><p>World</p>")
+
+;; ── facade find/has? are TREE-WIDE (reach into sections); find-top/has-top?
+;; keep the top-level-only lookup. This makes the read-by-id surface consistent
+;; with content/edit, whose update/delete are already tree-wide. ──
+(content-bootstrap-section!)
+(define
+  nd
+  (content/append
+    (content/empty "nested")
+    (mk-section
+      "sec"
+      (list (content/block "text" "inner" (list (list "text" "deep")))))))
+(content-test
+  "find nested (deep)"
+  (blk-id (content/find nd "inner"))
+  "inner")
+(content-test "has? nested (deep)" (content/has? nd "inner") true)
+(content-test "find-top misses nested" (content/find-top nd "inner") nil)
+(content-test "has-top? misses nested" (content/has-top? nd "inner") false)
+(content-test
+  "find-top sees top-level"
+  (blk-id (content/find-top nd "sec"))
+  "sec")
+;; a nested block updated by id via content/edit is now readable by id via
+;; content/find (was impossible when find was top-level-only).
+(content-test
+  "edit-then-find nested round-trip"
+  (str
+    (blk-send
+      (content/find
+        (content/edit nd (content/update "inner" "text" "edited"))
+        "inner")
+      "text"))
+  "edited")

lib/content/tests/find-replace.sx

@@ -1,8 +1,10 @@
-;; Extension — global find/replace across text-bearing blocks.
+;; Extension — global find/replace across every text-bearing field.
 
 (st-bootstrap-classes!)
 (content/bootstrap!)
 (content-bootstrap-section!)
+(content-bootstrap-callout!)
+(content-bootstrap-table!)
 
 (define
   d
@@ -30,11 +32,12 @@
   (str (blk-send (doc-deep-find r "n") "text"))
   "nested Bar")
 
-;; ── does NOT touch image alt/src (not a text field) ──
+;; ── image alt IS a text field (asText ^ alt), so it is rewritten ──
 (content-test
-  "image alt untouched"
+  "image alt replaced"
   (str (blk-send (doc-deep-find r "img") "alt"))
-  "Foo alt")
+  "Bar alt")
+;; ── but src is a URL, not prose, so it stays put ──
 (content-test
   "image src untouched"
   (str (blk-send (doc-deep-find r "img") "src"))
@@ -76,6 +79,68 @@
   (str (blk-send (doc-find r2 "q") "text"))
   "new saying")
 
+;; ── callout text is covered (consistency with asText/stats/summary) ──
+(content-test
+  "replace callout text"
+  (str
+    (blk-send
+      (doc-find
+        (content/find-replace
+          (doc-append (doc-empty "d") (mk-callout "co" "note" "Foo here"))
+          "Foo"
+          "Bar")
+        "co")
+      "text"))
+  "Bar here")
+(content-test
+  "callout kind untouched by text replace"
+  (str
+    (blk-send
+      (doc-find
+        (content/find-replace
+          (doc-append (doc-empty "d") (mk-callout "co" "note" "x"))
+          "note"
+          "X")
+        "co")
+      "kind"))
+  "note")
+
+;; ── list items are rewritten (asText folds items) ──
+(define
+  rl
+  (content/find-replace
+    (doc-append
+      (doc-empty "d")
+      (mk-list "l" false (list "Foo one" "two Foo")))
+    "Foo"
+    "Bar"))
+(content-test
+  "replace first list item"
+  (str (first (blk-send (doc-find rl "l") "items")))
+  "Bar one")
+(content-test
+  "replace second list item"
+  (str (first (rest (blk-send (doc-find rl "l") "items"))))
+  "two Bar")
+
+;; ── table headers + cells are rewritten (asText folds rows) ──
+(define
+  rt
+  (content/find-replace
+    (doc-append
+      (doc-empty "d")
+      (mk-table "t" (list "Foo head") (list (list "a Foo" "b"))))
+    "Foo"
+    "Bar"))
+(content-test
+  "replace table header"
+  (str (first (table-headers (doc-find rt "t"))))
+  "Bar head")
+(content-test
+  "replace table cell"
+  (str (first (first (table-rows (doc-find rt "t")))))
+  "a Bar")
+
 ;; ── no match → unchanged render ──
 (content-test
   "no match"

lib/content/tests/query.sx

@@ -1,8 +1,11 @@
-;; Extension — block query + table of contents.
+;; Extension — block query + table of contents + prose search.
 
 (st-bootstrap-classes!)
 (content/bootstrap!)
+(content-bootstrap-text!)
 (content-bootstrap-section!)
+(content-bootstrap-table!)
+(content-bootstrap-callout!)
 
 (define
   d
@@ -87,3 +90,49 @@
   "deep toc level"
   (get (first (content/headings deep)) :level)
   3)
+
+;; ── prose search (content/search-text) ──
+;; "cat" appears in text, image alt, a list item, a table cell, and a callout
+;; — every text-bearing field — so search must find all five via asText.
+(define
+  sd
+  (doc-append
+    (doc-append
+      (doc-append
+        (doc-append
+          (doc-append
+            (doc-empty "sd")
+            (mk-heading "sh" 1 "Welcome aboard"))
+          (mk-text "st" "the cat sat"))
+        (mk-image "si" "/x.png" "a cat photo"))
+      (mk-list "sl" false (list "first cat" "second dog")))
+    (mk-section
+      "sec"
+      (list
+        (mk-table "stb" (list "Animal") (list (list "cat") (list "fish")))
+        (mk-callout "sc" "note" "beware of cat")))))
+
+(content-test
+  "search across every text-bearing field"
+  (content/search-text-ids sd "cat")
+  (list "st" "si" "sl" "stb" "sc"))
+(content-test "search count" (len (content/search-text sd "cat")) 5)
+(content-test
+  "search heading text"
+  (content/search-text-ids sd "Welcome")
+  (list "sh"))
+(content-test
+  "search list item only"
+  (content/search-text-ids sd "dog")
+  (list "sl"))
+(content-test "search no match" (content/search-text-ids sd "zzz") (list))
+;; section containers are excluded — a term living only inside a section's
+;; children returns the child, never the section wrapper.
+(content-test
+  "search excludes section wrapper"
+  (content/search-text-ids sd "fish")
+  (list "stb"))
+(content-test
+  "search returns block objects"
+  (blk-id (first (content/search-text sd "Welcome")))
+  "sh")

lib/content/tests/store.sx

@@ -151,3 +151,58 @@
   "op-log media type"
   (blk-type (doc-find (content/head B3 "rich") "v"))
   "media")
+
+;; ── op-log update/delete reach NESTED blocks (tree-wide by id) ──
+(content-bootstrap-section!)
+(define B4 (persist/open))
+(content/commit!
+  B4
+  "nest"
+  (op-insert (mk-section "sec" (list (mk-text "n" "orig"))) nil)
+  1)
+(content/commit! B4 "nest" (op-update "n" "text" "edited") 2)
+(content-test
+  "op-log nested update"
+  (str (blk-send (doc-deep-find (content/head B4 "nest") "n") "text"))
+  "edited")
+(content-test
+  "op-log nested update tree intact"
+  (doc-tree-ids (content/head B4 "nest"))
+  (list "sec" "n"))
+(content/commit! B4 "nest" (op-delete "n") 3)
+(content-test
+  "op-log nested delete"
+  (doc-tree-ids (content/head B4 "nest"))
+  (list "sec"))
+(content-test
+  "op-log nested delete via content/at seq2"
+  (doc-tree-ids (content/at B4 "nest" 2))
+  (list "sec" "n"))
+
+;; ── diff is TREE-WIDE: nested-block add/change/remove are detected, and
+;; section containers never appear in :changed (a top-level-only diff would miss
+;; "n" entirely and instead flag the section). ──
+(define dn01 (content/diff-versions B4 "nest" 0 1))
+(content-test
+  "diff nested added (section + child)"
+  (get dn01 :added)
+  (list "sec" "n"))
+(content-test "diff nested added removed empty" (get dn01 :removed) (list))
+(content-test "diff nested added changed empty" (get dn01 :changed) (list))
+
+(define dn12 (content/diff-versions B4 "nest" 1 2))
+(content-test
+  "diff nested changed child only"
+  (get dn12 :changed)
+  (list "n"))
+(content-test "diff nested changed no add" (get dn12 :added) (list))
+(content-test "diff nested changed no remove" (get dn12 :removed) (list))
+
+(define dn23 (content/diff-versions B4 "nest" 2 3))
+(content-test "diff nested removed child" (get dn23 :removed) (list "n"))
+(content-test "diff nested removed no change" (get dn23 :changed) (list))
+
+(content-test
+  "diff nested no-op"
+  (get (content/diff-versions B4 "nest" 1 1) :changed)
+  (list))

lib/dream/form.sx

@@ -58,6 +58,43 @@
       ((s2 (replace s "+" " ")))
       (dr/url-decode-loop s2 0 (string-length s2) ""))))
 
+;; ── percent encoding (symmetric with dr/url-decode) ────────────────
+;; RFC3986 unreserved set passes through; everything else is %XX (uppercase
+;; hex). Space becomes %20 (not +), so the result is safe in a query value.
+(define dr/hex-chars "0123456789ABCDEF")
+(define
+  dr/url-encode-char
+  (fn
+    (c)
+    (let
+      ((n (char-code c)))
+      (if
+        (or
+          (and (>= n 48) (<= n 57))   ;; 0-9
+          (and (>= n 65) (<= n 90))   ;; A-Z
+          (and (>= n 97) (<= n 122))  ;; a-z
+          (= c "-") (= c "_") (= c ".") (= c "~"))
+        c
+        (str "%"
+          (char-at dr/hex-chars (quotient n 16))
+          (char-at dr/hex-chars (mod n 16)))))))
+
+(define
+  dr/url-encode-loop
+  (fn
+    (s i n acc)
+    (if
+      (>= i n)
+      acc
+      (dr/url-encode-loop s (+ i 1) n
+        (str acc (dr/url-encode-char (char-at s i)))))))
+
+(define
+  dr/url-encode
+  (fn
+    (s)
+    (dr/url-encode-loop (or s "") 0 (string-length (or s "")) "")))
+
 ;; ── substring splitter (split primitive is char-class based) ───────
 (define
   dr/split-on

lib/erlang/runtime.sx

@@ -853,112 +853,6 @@
 (define er-modules-get (fn () (nth er-modules 0)))
 (define er-modules-reset! (fn () (set-nth! er-modules 0 {})))
 
-(define er-mk-module-slot
-  (fn (mod-env old-env version)
-    {:current mod-env :old old-env :version version :tag "module"}))
-
-(define er-module-current-env (fn (slot) (get slot :current)))
-(define er-module-old-env (fn (slot) (get slot :old)))
-(define er-module-version (fn (slot) (get slot :version)))
-
-;; ── FFI BIF registry (Phase 8) ───────────────────────────────────
-;; Global dict from "Module/Name/Arity" key to {:module :name :arity :fn :pure?}.
-;; Replaces the giant cond chain in transpile.sx#er-apply-remote-bif over time —
-;; Phase 8 BIFs (crypto / cid / file / httpc / sqlite) all register here.
-(define er-bif-registry (list {}))
-(define er-bif-registry-get (fn () (nth er-bif-registry 0)))
-(define er-bif-registry-reset! (fn () (set-nth! er-bif-registry 0 {})))
-
-(define er-bif-key
-  (fn (module name arity)
-    (str module "/" name "/" arity)))
-
-(define er-register-bif!
-  (fn (module name arity sx-fn)
-    (dict-set! (er-bif-registry-get) (er-bif-key module name arity)
-      {:module module :name name :arity arity :fn sx-fn :pure? false})
-    (er-mk-atom "ok")))
-
-(define er-register-pure-bif!
-  (fn (module name arity sx-fn)
-    (dict-set! (er-bif-registry-get) (er-bif-key module name arity)
-      {:module module :name name :arity arity :fn sx-fn :pure? true})
-    (er-mk-atom "ok")))
-
-(define er-lookup-bif
-  (fn (module name arity)
-    (let ((reg (er-bif-registry-get)) (k (er-bif-key module name arity)))
-      (if (dict-has? reg k) (get reg k) nil))))
-
-(define er-list-bifs
-  (fn () (keys (er-bif-registry-get))))
-
-;; ── term marshalling (Phase 8) ───────────────────────────────────
-;; Bridge Erlang term values (tagged dicts) and SX-native values for
-;; FFI BIFs to call out into platform primitives. Conversions:
-;;
-;;   Erlang                          SX-native
-;;   ─────────────────────────       ────────────────
-;;   atom  {:tag "atom" :name S}  ↔  symbol (make-symbol S)
-;;   nil   {:tag "nil"}           ↔  '()
-;;   cons  {:tag "cons" :head :tail} →  list of marshalled elements
-;;   tuple {:tag "tuple" :elements} →  list of marshalled elements
-;;   binary {:tag "binary" :bytes} ↔ SX string
-;;   integer / float / boolean   ↔ passthrough
-;;   SX string on the way back   →  binary
-;;
-;; Pids, refs, funs pass through unchanged — they have no SX-native
-;; equivalent and are opaque to FFI primitives.
-
-(define er-cons-to-sx-list
-  (fn (v)
-    (cond
-      (er-nil? v) (list)
-      (er-cons? v)
-        (let ((tail (er-cons-to-sx-list (get v :tail)))
-              (head (er-to-sx (get v :head))))
-          (let ((out (list head)))
-            (for-each
-              (fn (i) (append! out (nth tail i)))
-              (range 0 (len tail)))
-            out))
-      :else (list v))))
-
-(define er-to-sx
-  (fn (v)
-    (cond
-      (er-atom? v) (make-symbol (get v :name))
-      (er-nil? v) (list)
-      (er-cons? v) (er-cons-to-sx-list v)
-      (er-tuple? v)
-        (let ((out (list)) (es (get v :elements)))
-          (for-each
-            (fn (i) (append! out (er-to-sx (nth es i))))
-            (range 0 (len es)))
-          out)
-      (er-binary? v) (list->string (map integer->char (get v :bytes)))
-      :else v)))
-
-(define er-of-sx
-  (fn (v)
-    (let ((ty (type-of v)))
-      (cond
-        (= ty "symbol") (er-mk-atom (str v))
-        (= ty "string") (er-mk-binary (map char->integer (string->list v)))
-        (= ty "list")
-          (let ((out (er-mk-nil)))
-            (for-each
-              (fn (i)
-                (set! out
-                  (er-mk-cons (er-of-sx (nth v (- (- (len v) 1) i))) out)))
-              (range 0 (len v)))
-            out)
-        (= ty "nil") (er-mk-nil)
-        :else v))))
-
-
-
-
 ;; Load an Erlang module declaration. Source must start with
 ;; `-module(Name).` and contain function definitions. Functions
 ;; sharing a name (different arities) get their clauses concatenated
@@ -1003,15 +897,7 @@
               ((all-clauses (get by-name k)))
               (er-env-bind! mod-env k (er-mk-fun all-clauses mod-env))))
           (keys by-name))
-        (let ((registry (er-modules-get)))
-          (if (dict-has? registry mod-name)
-            (let ((existing-slot (get registry mod-name)))
-              (dict-set! registry mod-name
-                (er-mk-module-slot mod-env
-                  (er-module-current-env existing-slot)
-                  (+ (er-module-version existing-slot) 1))))
-            (dict-set! registry mod-name
-              (er-mk-module-slot mod-env nil 1))))
+        (dict-set! (er-modules-get) mod-name mod-env)
         (er-mk-atom mod-name)))))
 
 (define
@@ -1019,7 +905,7 @@
   (fn
     (mod name vs)
     (let
-      ((mod-env (er-module-current-env (get (er-modules-get) mod))))
+      ((mod-env (get (er-modules-get) mod)))
       (if
         (not (dict-has? mod-env name))
         (raise
@@ -1303,325 +1189,24 @@
           :else (er-mk-atom "undefined")))
       :else (error "Erlang: ets:info: arity"))))
 
-
-
-;; ── file module (Phase 8 FFI) ────────────────────────────────────
-;; Synchronous file IO. Filenames must be SX strings (or Erlang
-;; binaries/char-code lists coercible to strings via er-source-to-string).
-;; Returns `{ok, Binary}` / `ok` on success, `{error, Reason}` on failure
-;; where Reason is one of `enoent`, `eacces`, `enotdir`, `posix_error`.
-
-(define er-classify-file-error
-  (fn (msg)
-    (let ((s (str msg)))
+(define
+  er-apply-ets-bif
+  (fn
+    (name vs)
     (cond
-        (string-contains? s "No such") (er-mk-atom "enoent")
-        (string-contains? s "Permission denied") (er-mk-atom "eacces")
-        (string-contains? s "Not a directory") (er-mk-atom "enotdir")
-        (string-contains? s "Is a directory") (er-mk-atom "eisdir")
-        :else (er-mk-atom "posix_error")))))
+      (= name "new") (er-bif-ets-new vs)
+      (= name "insert") (er-bif-ets-insert vs)
+      (= name "lookup") (er-bif-ets-lookup vs)
+      (= name "delete") (er-bif-ets-delete vs)
+      (= name "tab2list") (er-bif-ets-tab2list vs)
+      (= name "info") (er-bif-ets-info vs)
+      :else (error
+        (str "Erlang: undefined 'ets:" name "/" (len vs) "'")))))
 
-(define er-bif-file-read-file
-  (fn (vs)
-    (let ((path (er-source-to-string (nth vs 0))))
-      (cond
-        (= path nil)
-          (er-mk-tuple (list (er-mk-atom "error") (er-mk-atom "badarg")))
-        :else
-          (let ((res (list nil)) (err (list nil)))
-            (guard (c (:else (set-nth! err 0 c)))
-              (set-nth! res 0 (file-read path)))
-            (cond
-              (not (= (nth err 0) nil))
-                (er-mk-tuple (list (er-mk-atom "error")
-                  (er-classify-file-error (nth err 0))))
-              :else
-                (er-mk-tuple (list (er-mk-atom "ok")
-                  (er-mk-binary (map char->integer (string->list (nth res 0)))))))))))) 
-
-(define er-bif-file-write-file
-  (fn (vs)
-    (let ((path (er-source-to-string (nth vs 0)))
-          (data (er-source-to-string (nth vs 1))))
-      (cond
-        (or (= path nil) (= data nil))
-          (er-mk-tuple (list (er-mk-atom "error") (er-mk-atom "badarg")))
-        :else
-          (let ((err (list nil)))
-            (guard (c (:else (set-nth! err 0 c)))
-              (file-write path data))
-            (cond
-              (not (= (nth err 0) nil))
-                (er-mk-tuple (list (er-mk-atom "error")
-                  (er-classify-file-error (nth err 0))))
-              :else (er-mk-atom "ok")))))))
-
-(define er-bif-file-delete
-  (fn (vs)
-    (let ((path (er-source-to-string (nth vs 0))))
-      (cond
-        (= path nil)
-          (er-mk-tuple (list (er-mk-atom "error") (er-mk-atom "badarg")))
-        :else
-          (let ((err (list nil)))
-            (guard (c (:else (set-nth! err 0 c)))
-              (file-delete path))
-            (cond
-              (not (= (nth err 0) nil))
-                (er-mk-tuple (list (er-mk-atom "error")
-                  (er-classify-file-error (nth err 0))))
-              :else (er-mk-atom "ok")))))))
-
-
-;; ── crypto / cid / file:list_dir (Phase 8 FFI — host primitives) ──
-;; Wired against loops/fed-prims host primitives (see plans Blockers
-;; "RESOLVED 2026-05-18"). Term marshalling at the boundary:
-;; Erlang binary/string/charlist -> SX byte-string via er-source-to-string;
-;; results -> Erlang binary via er-mk-binary.
-
-(define er-hexval
-  (fn (c)
-    (let ((v (char->integer c)))
-      (cond
-        (and (>= v 48) (<= v 57)) (- v 48)        ;; 0-9
-        (and (>= v 97) (<= v 102)) (+ 10 (- v 97)) ;; a-f
-        (and (>= v 65) (<= v 70)) (+ 10 (- v 65))  ;; A-F
-        :else 0))))
-
-(define er-hex->bytes
-  (fn (hex)
-    (let ((cs (string->list hex)) (out (list)) (n (string-length hex)))
-      (for-each
-        (fn (i)
-          (append! out
-            (+ (* 16 (er-hexval (nth cs (* i 2))))
-               (er-hexval (nth cs (+ (* i 2) 1))))))
-        (range 0 (truncate (/ n 2))))
-      out)))
-
-;; crypto:hash(Type, Data) -> raw digest binary. Type is an Erlang
-;; atom (sha256 | sha512 | sha3_256). Bad type / non-binary -> badarg.
-(define er-bif-crypto-hash
-  (fn (vs)
-    (let ((ty (nth vs 0)) (data (er-source-to-string (nth vs 1))))
-      (cond
-        (or (not (er-atom? ty)) (= data nil))
-          (raise (er-mk-error-marker (er-mk-atom "badarg")))
-        :else
-          (let ((name (get ty :name)))
-            (let ((hex (cond
-                         (= name "sha256") (crypto-sha256 data)
-                         (= name "sha512") (crypto-sha512 data)
-                         (= name "sha3_256") (crypto-sha3-256 data)
-                         :else nil)))
-              (cond
-                (= hex nil) (raise (er-mk-error-marker (er-mk-atom "badarg")))
-                :else (er-mk-binary (er-hex->bytes hex)))))))))
-
-;; cid:from_bytes(Bin) -> CIDv1 (raw codec 0x55, sha2-256 multihash)
-;; as an Erlang binary string.
-(define er-bif-cid-from-bytes
-  (fn (vs)
-    (let ((data (er-source-to-string (nth vs 0))))
-      (cond
-        (= data nil) (raise (er-mk-error-marker (er-mk-atom "badarg")))
-        :else
-          (let ((digest (er-hex->bytes (crypto-sha256 data))))
-            (let ((mh (list->string
-                        (map integer->char (append (list 18 32) digest)))))
-              (er-mk-binary
-                (map char->integer
-                  (string->list (cid-from-bytes 85 mh))))))))))
-
-;; cid:to_string(Term) -> canonical CIDv1 (dag-cbor) of the term,
-;; as an Erlang binary string.
-(define er-bif-cid-to-string
-  (fn (vs)
-    ;; Canonical CID of the term's stable string form. (cbor-encode
-    ;; rejects symbols, so er-to-sx of compound terms is unencodable;
-    ;; er-format-value yields a canonical SX string per term value.)
-    (er-mk-binary
-      (map char->integer
-        (string->list (cid-from-sx (er-format-value (nth vs 0))))))))
-
-;; file:list_dir(Path) -> {ok, [Binary]} | {error, Reason}
-(define er-bif-file-list-dir
-  (fn (vs)
-    (let ((path (er-source-to-string (nth vs 0))))
-      (cond
-        (= path nil)
-          (er-mk-tuple (list (er-mk-atom "error") (er-mk-atom "badarg")))
-        :else
-          (let ((res (list nil)) (err (list nil)))
-            (guard (c (:else (set-nth! err 0 c)))
-              (set-nth! res 0 (file-list-dir path)))
-            (cond
-              (not (= (nth err 0) nil))
-                (er-mk-tuple (list (er-mk-atom "error")
-                  (er-classify-file-error (nth err 0))))
-              :else
-                (er-mk-tuple (list (er-mk-atom "ok")
-                  (er-of-sx (nth res 0))))))))))
-
-;; ── builtin BIF registrations (Phase 8 migration) ────────────────
-;; Populates `er-bif-registry` with every existing built-in BIF. Each
-;; entry is keyed by "Module/Name/Arity"; multi-arity BIFs register
-;; once per arity. Called eagerly at the end of runtime.sx so the
-;; registry is ready before any erlang-eval-ast call.
-(define er-register-builtin-bifs!
-  (fn ()
-    ;; erlang module — type predicates (all pure)
-    (er-register-pure-bif! "erlang" "is_integer" 1 er-bif-is-integer)
-    (er-register-pure-bif! "erlang" "is_atom" 1 er-bif-is-atom)
-    (er-register-pure-bif! "erlang" "is_list" 1 er-bif-is-list)
-    (er-register-pure-bif! "erlang" "is_tuple" 1 er-bif-is-tuple)
-    (er-register-pure-bif! "erlang" "is_number" 1 er-bif-is-number)
-    (er-register-pure-bif! "erlang" "is_float" 1 er-bif-is-float)
-    (er-register-pure-bif! "erlang" "is_boolean" 1 er-bif-is-boolean)
-    (er-register-pure-bif! "erlang" "is_pid" 1 er-bif-is-pid)
-    (er-register-pure-bif! "erlang" "is_reference" 1 er-bif-is-reference)
-    (er-register-pure-bif! "erlang" "is_binary" 1 er-bif-is-binary)
-    (er-register-pure-bif! "erlang" "is_function" 1 er-bif-is-function)
-    (er-register-pure-bif! "erlang" "is_function" 2 er-bif-is-function)
-    ;; erlang module — pure data ops
-    (er-register-pure-bif! "erlang" "length" 1 er-bif-length)
-    (er-register-pure-bif! "erlang" "hd" 1 er-bif-hd)
-    (er-register-pure-bif! "erlang" "tl" 1 er-bif-tl)
-    (er-register-pure-bif! "erlang" "element" 2 er-bif-element)
-    (er-register-pure-bif! "erlang" "tuple_size" 1 er-bif-tuple-size)
-    (er-register-pure-bif! "erlang" "byte_size" 1 er-bif-byte-size)
-    (er-register-pure-bif! "erlang" "atom_to_list" 1 er-bif-atom-to-list)
-    (er-register-pure-bif! "erlang" "list_to_atom" 1 er-bif-list-to-atom)
-    (er-register-pure-bif! "erlang" "abs" 1 er-bif-abs)
-    (er-register-pure-bif! "erlang" "min" 2 er-bif-min)
-    (er-register-pure-bif! "erlang" "max" 2 er-bif-max)
-    (er-register-pure-bif! "erlang" "tuple_to_list" 1 er-bif-tuple-to-list)
-    (er-register-pure-bif! "erlang" "list_to_tuple" 1 er-bif-list-to-tuple)
-    (er-register-pure-bif! "erlang" "integer_to_list" 1 er-bif-integer-to-list)
-    (er-register-pure-bif! "erlang" "list_to_integer" 1 er-bif-list-to-integer)
-    ;; erlang module — process / runtime (side-effecting)
-    (er-register-bif! "erlang" "self" 0 er-bif-self)
-    (er-register-bif! "erlang" "spawn" 1 er-bif-spawn)
-    (er-register-bif! "erlang" "spawn" 3 er-bif-spawn)
-    (er-register-bif! "erlang" "exit" 1 er-bif-exit)
-    (er-register-bif! "erlang" "exit" 2 er-bif-exit)
-    (er-register-bif! "erlang" "make_ref" 0 er-bif-make-ref)
-    (er-register-bif! "erlang" "link" 1 er-bif-link)
-    (er-register-bif! "erlang" "unlink" 1 er-bif-unlink)
-    (er-register-bif! "erlang" "monitor" 2 er-bif-monitor)
-    (er-register-bif! "erlang" "demonitor" 1 er-bif-demonitor)
-    (er-register-bif! "erlang" "process_flag" 2 er-bif-process-flag)
-    (er-register-bif! "erlang" "register" 2 er-bif-register)
-    (er-register-bif! "erlang" "unregister" 1 er-bif-unregister)
-    (er-register-bif! "erlang" "whereis" 1 er-bif-whereis)
-    (er-register-bif! "erlang" "registered" 0 er-bif-registered)
-    ;; erlang module — exception raising (modelled as side-effecting)
-    (er-register-bif! "erlang" "throw" 1
-      (fn (vs) (raise (er-mk-throw-marker (er-bif-arg1 vs "throw")))))
-    (er-register-bif! "erlang" "error" 1
-      (fn (vs) (raise (er-mk-error-marker (er-bif-arg1 vs "error")))))
-    ;; lists module — all pure
-    (er-register-pure-bif! "lists" "reverse" 1 er-bif-lists-reverse)
-    (er-register-pure-bif! "lists" "map" 2 er-bif-lists-map)
-    (er-register-pure-bif! "lists" "foldl" 3 er-bif-lists-foldl)
-    (er-register-pure-bif! "lists" "seq" 2 er-bif-lists-seq)
-    (er-register-pure-bif! "lists" "seq" 3 er-bif-lists-seq)
-    (er-register-pure-bif! "lists" "sum" 1 er-bif-lists-sum)
-    (er-register-pure-bif! "lists" "nth" 2 er-bif-lists-nth)
-    (er-register-pure-bif! "lists" "last" 1 er-bif-lists-last)
-    (er-register-pure-bif! "lists" "member" 2 er-bif-lists-member)
-    (er-register-pure-bif! "lists" "append" 2 er-bif-lists-append)
-    (er-register-pure-bif! "lists" "filter" 2 er-bif-lists-filter)
-    (er-register-pure-bif! "lists" "any" 2 er-bif-lists-any)
-    (er-register-pure-bif! "lists" "all" 2 er-bif-lists-all)
-    (er-register-pure-bif! "lists" "duplicate" 2 er-bif-lists-duplicate)
-    ;; io module — side-effecting (writes to io buffer)
-    (er-register-bif! "io" "format" 1 er-bif-io-format)
-    (er-register-bif! "io" "format" 2 er-bif-io-format)
-    ;; ets module — side-effecting (mutates table state)
-    (er-register-bif! "ets" "new" 2 er-bif-ets-new)
-    (er-register-bif! "ets" "insert" 2 er-bif-ets-insert)
-    (er-register-bif! "ets" "lookup" 2 er-bif-ets-lookup)
-    (er-register-bif! "ets" "delete" 1 er-bif-ets-delete)
-    (er-register-bif! "ets" "delete" 2 er-bif-ets-delete)
-    (er-register-bif! "ets" "tab2list" 1 er-bif-ets-tab2list)
-    (er-register-bif! "ets" "info" 2 er-bif-ets-info)
-    ;; code module — side-effecting (mutates module registry, kills procs)
-    (er-register-bif! "code" "load_binary" 3 er-bif-code-load-binary)
-    (er-register-bif! "code" "purge" 1 er-bif-code-purge)
-    (er-register-bif! "code" "soft_purge" 1 er-bif-code-soft-purge)
-    (er-register-bif! "code" "which" 1 er-bif-code-which)
-    (er-register-bif! "code" "is_loaded" 1 er-bif-code-is-loaded)
-    (er-register-bif! "code" "all_loaded" 0 er-bif-code-all-loaded)
-    ;; file module
-    (er-register-bif! "file" "read_file" 1 er-bif-file-read-file)
-    (er-register-bif! "file" "write_file" 2 er-bif-file-write-file)
-    (er-register-bif! "file" "delete" 1 er-bif-file-delete)
-    ;; Phase 8 FFI — host-primitive BIFs (loops/fed-prims)
-    (er-register-pure-bif! "crypto" "hash" 2 er-bif-crypto-hash)
-    (er-register-pure-bif! "cid" "from_bytes" 1 er-bif-cid-from-bytes)
-    (er-register-pure-bif! "cid" "to_string" 1 er-bif-cid-to-string)
-
-;; ── binary_to_list / list_to_binary (Step 3b — term codec) ──────
-;; Standard Erlang semantics:
-;;   binary_to_list(<<B1,B2,...>>) -> [B1, B2, ...]   (Erlang cons of ints)
-;;   list_to_binary(IoList)        -> <<...>>         (flattens nested
-;;     iolists; elements are byte ints 0-255 or binaries)
-;; Bad arg / out-of-range byte / non-iolist element -> error:badarg.
-
-(define er-bif-binary-to-list
-  (fn (vs)
-    (let ((v (nth vs 0)))
-      (cond
-        (not (er-binary? v))
-          (raise (er-mk-error-marker (er-mk-atom "badarg")))
-        :else
-          (let ((bs (get v :bytes)) (out (er-mk-nil)))
-            (for-each
-              (fn (i)
-                (set! out (er-mk-cons (nth bs (- (- (len bs) 1) i)) out)))
-              (range 0 (len bs)))
-            out)))))
-
-;; Walk an Erlang iolist, appending bytes to `acc` (a mutable SX list).
-;; Accepts: nil, cons-of-X, binary, integer in 0..255. Anything else
-;; signals failure by setting (nth fail 0) to true.
-(define er-iolist-walk!
-  (fn (v acc fail)
-    (cond
-      (nth fail 0) nil
-      (er-nil? v) nil
-      (er-cons? v)
-        (do (er-iolist-walk! (get v :head) acc fail)
-            (er-iolist-walk! (get v :tail) acc fail))
-      (er-binary? v)
-        (for-each
-          (fn (i) (append! acc (nth (get v :bytes) i)))
-          (range 0 (len (get v :bytes))))
-      (= (type-of v) "number")
-        (cond
-          (and (>= v 0) (<= v 255)) (append! acc v)
-          :else (set-nth! fail 0 true))
-      :else (set-nth! fail 0 true))))
-
-(define er-bif-list-to-binary
-  (fn (vs)
-    (let ((v (nth vs 0)) (acc (list)) (fail (list false)))
-      (cond
-        (not (or (er-nil? v) (er-cons? v) (er-binary? v)))
-          (raise (er-mk-error-marker (er-mk-atom "badarg")))
-        :else
-          (do
-            (er-iolist-walk! v acc fail)
-            (cond
-              (nth fail 0)
-                (raise (er-mk-error-marker (er-mk-atom "badarg")))
-              :else (er-mk-binary acc)))))))
-
-    (er-register-bif! "file" "list_dir" 1 er-bif-file-list-dir)
-    (er-register-pure-bif! "erlang" "binary_to_list" 1 er-bif-binary-to-list)
-    (er-register-pure-bif! "erlang" "list_to_binary"  1 er-bif-list-to-binary)
-    (er-mk-atom "ok")))
-
-;; Register everything at load time.
-(er-register-builtin-bifs!)
+;; ── JIT interpret-only boundary ───────────────────────────────────────────
+;; The Erlang evaluator (er-eval-* in transpile.sx + the vm/dispatcher) recurses
+;; over the AST and the scheduler/receive path captures call/cc continuations.
+;; Under JIT the recursive eval miscompiles into a non-terminating loop and the
+;; continuation path cannot transfer control. Exclude the whole er-/erlang-
+;; namespace (covers transpile, runtime, and vm/dispatcher in one declaration).
+(jit-exclude! "er-*" "erlang-*")

lib/haskell/runtime.sx

@@ -148,3 +148,9 @@
           (fn (acc i) (str acc (char-at buf i)))
           ""
           (range off (string-length buf)))))))
+
+;; ── JIT interpret-only boundary ───────────────────────────────────────────
+;; The Haskell evaluator (hk-eval and the lazy-thunk forcer) recurses deeply
+;; over the AST/graph; under JIT the recursive eval can miscompile into a
+;; non-terminating loop. Exclude the hk- namespace from JIT.
+(jit-exclude! "hk-*")

lib/host/auth.sx

@@ -0,0 +1,141 @@
+;; lib/host/auth.sx — browser login on top of host sessions (lib/host/session.sx).
+;; A login form posts credentials; on success the principal is written to the
+;; session cookie. The guarded write routes then accept EITHER a logged-in session
+;; OR a Bearer token (host/require-user), so the same routes serve browsers and API
+;; clients. Single admin user; credentials come from $SX_ADMIN_USER / _PASSWORD
+;; (set in serve.sh) — the in-source defaults are dev-only.
+;;
+;; Depends on lib/host/session.sx, lib/host/{handler,middleware}.sx, lib/dream/*
+;; (form/types/session) + the kernel render-page primitive.
+
+;; ── page shell (own copy; render-page renders the static SX tree) ───
+(define host/-auth-page
+  (fn (title body)
+    (str "<!doctype html>"
+      (render-page
+        (quasiquote
+          (html
+            (head (meta :charset "utf-8") (title (unquote title)))
+            (body (unquote body))))))))
+
+;; ── admin credential (override from env in serve.sh) ────────────────
+(define host/admin-user "admin")
+(define host/admin-password "letmein")
+(define host/auth-set-admin!
+  (fn (u p) (begin (set! host/admin-user u) (set! host/admin-password p))))
+(define host/-verify-cred
+  (fn (user pass)
+    (and (not (= pass ""))
+         (= user host/admin-user)
+         (= pass host/admin-password))))
+
+;; A return-to target is only honoured if it's a same-site absolute PATH — guards
+;; against an open-redirect (//evil.com, http://…) smuggled through ?next=.
+(define host/-safe-next
+  (fn (n)
+    (if (and n (not (= n "")) (starts-with? n "/") (not (starts-with? n "//")))
+      n "/")))
+
+;; The login form, parameterised by where to return after success.
+(define host/-login-form
+  (fn (next-path message)
+    (host/-auth-page "Log in"
+      (quasiquote
+        (div
+          (h1 "Log in")
+          (unquote (if message (quasiquote (p :style "color:#b00" (unquote message))) ""))
+          (form :method "post" :action "/login"
+            (input :type "hidden" :name "next" :value (unquote next-path))
+            (p (input :name "username" :placeholder "username"))
+            (p (input :name "password" :type "password" :placeholder "password"))
+            (p (button :type "submit" "Log in"))))))))
+
+;; ── GET /login — login form, honouring ?next= (where to go after login) ─────
+(define host/login-page
+  (fn (req)
+    (dream-html
+      (host/-login-form (host/-safe-next (dream-query-param req "next")) nil))))
+
+;; ── POST /login — verify, write session principal, redirect to ?next ────────
+;; The session middleware (host/sessions) has already created/loaded the session
+;; and will set the cookie on this response, so writing :principal here lands on
+;; the right sid and the browser keeps the cookie. On failure the form re-renders
+;; with the same return target so the user lands where they were headed.
+(define host/login-submit
+  (fn (req)
+    (let ((user (host/field req "username"))
+          (pass (host/field req "password"))
+          (next-path (host/-safe-next (host/field req "next"))))
+      (if (host/-verify-cred user pass)
+        (begin
+          (host/login! req user)
+          (dream-redirect next-path))
+        (dream-html-status 401
+          (host/-login-form next-path "Invalid credentials — try again."))))))
+
+;; ── /logout — clear the session, redirect home. Allowed on GET too so a plain
+;; footer link can log out (logout is low-harm, so GET is acceptable here). ─────
+(define host/logout-submit
+  (fn (req)
+    (begin
+      (host/logout! req)
+      (dream-redirect "/"))))
+
+;; ── login routes (mounted by host/make-app) ─────────────────────────
+(define host/auth-routes
+  (list
+    (dream-get "/login" host/login-page)
+    (dream-post "/login" host/login-submit)
+    (dream-get "/logout" host/logout-submit)
+    (dream-post "/logout" host/logout-submit)))
+
+;; ── auth footer fragment ────────────────────────────────────────────
+;; A small SX node pages splice into their footer: "log in" when logged out,
+;; "signed in as <user> · log out" when logged in. Guards a session-less request
+;; (no middleware) so it's safe to call anywhere. Reads the session principal.
+(define host/auth-footer
+  (fn (req)
+    (let ((who (if (get req :dream-session) (host/current-principal req) nil)))
+      (if (and who (not (= who "")))
+        (quasiquote
+          (span (unquote (str "signed in as " who)) " · "
+            (a :href "/logout" "log out")))
+        (quote (a :href "/login" "log in"))))))
+
+;; The authenticated principal for a request, or nil: a logged-in session takes
+;; precedence, else a Bearer token resolved by `resolve` (the API fallback).
+(define host/-principal-of
+  (fn (req resolve)
+    (let ((sp (host/current-principal req)))
+      (if (and sp (not (= sp "")))
+        sp
+        (let ((tok (dream-bearer-token req)))
+          (if tok (resolve tok) nil))))))
+
+;; ── auth middleware (API shape): session principal OR bearer token ──
+;; Place AFTER the session middleware (so host/current-principal can read the
+;; session) and BEFORE host/require-permission. On failure -> JSON 401 with a
+;; Bearer challenge. For API/JSON routes; browser pages want host/require-login.
+(define host/require-user
+  (fn (resolve)
+    (fn (next)
+      (fn (req)
+        (let ((principal (host/-principal-of req resolve)))
+          (if (or (nil? principal) (= principal ""))
+            (dream-add-header
+              (host/error 401 "unauthorized")
+              "www-authenticate" "Bearer")
+            (next (assoc req :dream-principal principal))))))))
+
+;; ── auth middleware (browser shape): same check, but on failure REDIRECT to
+;; the login page with a return-to, instead of a raw JSON 401. Use this for HTML
+;; routes (an edit form, the create form) so an unauthenticated click lands on a
+;; usable login page and returns to where it was headed after logging in. ──
+(define host/require-login
+  (fn (resolve)
+    (fn (next)
+      (fn (req)
+        (let ((principal (host/-principal-of req resolve)))
+          (if (or (nil? principal) (= principal ""))
+            (dream-redirect (str "/login?next=" (host/-safe-next (dream-path req))))
+            (next (assoc req :dream-principal principal))))))))

lib/host/compose.sx

@@ -0,0 +1,98 @@
+;; lib/host/compose.sx — the composition / object render-fold (plans/composition-objects.md).
+;;
+;; An object's :body is a composition node — a tiny UI language over object refs. The
+;; render-fold below is its interpreter. Four combinators (seq/row/alt/each) + leaves
+;; (field/text/card) + ref + recursion (tmpl). The context is an EXTENSIBLE ENVIRONMENT:
+;; `when` reads it, `each` extends it (:item, :depth). Same predicate set as the type
+;; guards. The object's CID is its DEFINITION; render is the EXECUTION (per context+data).
+;; Self-contained (no blog deps) so the model can be proven in isolation.
+
+;; ── predicates for `when` (over the context environment) ────────────
+(define host/comp--pred?
+  (fn (pred ctx)
+    (let ((op (str (first pred))))
+      (cond
+        ((= op "has") (not (nil? (get ctx (str (first (rest pred)))))))
+        ((= op "eq")  (= (str (get ctx (str (first (rest pred))))) (str (first (rest (rest pred))))))
+        ((= op "not") (not (host/comp--pred? (first (rest pred)) ctx)))
+        (else false)))))
+
+;; the value of a leaf (field): the current :item's key, else the context's key.
+(define host/comp--field
+  (fn (k ctx)
+    (let ((item (get ctx "item")) (key (str k)))
+      (if (and item (not (nil? (get item key))))
+        (str (get item key))
+        (str (or (get ctx key) ""))))))
+
+;; the source collection for `each`: literal items, the :item's :children (trees), or a
+;; named list field on the :item. (A graph-query source is wiring step 3, plan roadmap.)
+(define host/comp--source
+  (fn (src ctx)
+    (let ((op (str (first src))) (item (get ctx "item")))
+      (cond
+        ((= op "items")    (rest src))
+        ((= op "children") (if item (or (get item "children") (list)) (list)))
+        ((= op "field")    (if item (or (get item (str (first (rest src)))) (list)) (list)))
+        (else (list))))))
+
+;; ── template registry (recursion: a template may reference itself by name) ──
+(define host/comp--tmpls (dict))
+(define host/comp--def-tmpl! (fn (name node) (dict-set! host/comp--tmpls name node)))
+
+;; ── the render-fold (the interpreter) ───────────────────────────────
+(define host/comp--render-all
+  (fn (nodes ctx) (reduce (fn (acc n) (str acc (host/comp--render n ctx))) "" nodes)))
+
+;; alt: render the FIRST branch whose `when` holds (or `else`) — recursive first-match so
+;; a branch that legitimately renders empty isn't skipped.
+(define host/comp--alt-pick
+  (fn (branches ctx)
+    (if (empty? branches)
+      ""
+      (let ((br (first branches)) (bh (str (first (first branches)))))
+        (cond
+          ((= bh "else") (host/comp--render (first (rest br)) ctx))
+          ((= bh "when") (if (host/comp--pred? (first (rest br)) ctx)
+                           (host/comp--render (first (rest (rest br))) ctx)
+                           (host/comp--alt-pick (rest branches) ctx)))
+          (else (host/comp--alt-pick (rest branches) ctx)))))))
+
+;; each: eval source -> items; render template per item with :item bound + :depth+1
+;; (depth guard backstops runaway recursion; trees terminate naturally on empty source).
+(define host/comp--each
+  (fn (src tmpl ctx)
+    (let ((depth (or (get ctx "depth") 0)))
+      (if (> depth 40)
+        "<em>(max depth)</em>"
+        (reduce
+          (fn (acc item)
+            (str acc (host/comp--render tmpl (merge ctx {"item" item "depth" (+ depth 1)}))))
+          "" (host/comp--source src ctx))))))
+
+;; card leaf (proof: a labelled box; in the host this renders via the card-type's :template).
+(define host/comp--card
+  (fn (ctype fields)
+    (str "<div class=\"card card-" ctype "\">"
+      (reduce (fn (acc k) (str acc "<b>" k ":</b> " (str (get fields k)) " ")) "" (keys fields))
+      "</div>")))
+
+(define host/comp--render
+  (fn (node ctx)
+    (if (not (= (type-of node) "list"))
+      (str node)
+      (let ((h (str (first node))) (args (rest node)))
+        (cond
+          ((= h "seq")   (host/comp--render-all args ctx))
+          ((= h "row")   (str "<div class=\"row\" style=\"display:flex;gap:1em\">" (host/comp--render-all args ctx) "</div>"))
+          ((= h "grid")  (str "<div class=\"grid\" style=\"display:grid;gap:1em\">" (host/comp--render-all args ctx) "</div>"))
+          ((= h "alt")   (host/comp--alt-pick args ctx))
+          ((= h "each")  (host/comp--each (first args) (first (rest args)) ctx))
+          ((= h "field") (str "<span>" (host/comp--field (first args) ctx) "</span>"))
+          ((= h "text")  (str (first args)))
+          ((= h "card")  (host/comp--card (str (first args)) (first (rest args))))
+          ((= h "tmpl")  (host/comp--render (get host/comp--tmpls (str (first args))) ctx))
+          (else ""))))))
+
+;; public entry: render a composition node against a context environment.
+(define host/comp-render (fn (node ctx) (host/comp--render node ctx)))

lib/host/conformance.sh

@@ -0,0 +1,202 @@
+#!/usr/bin/env bash
+# host-on-sx conformance runner — loads the kernel stdlib, the subsystem
+# libraries the host wires to, the host modules, and the host test suites in one
+# sx_server process, then reports pass/fail per suite. Mirrors lib/dream's runner.
+#
+# Usage:
+#   bash lib/host/conformance.sh            # run all suites
+#   bash lib/host/conformance.sh sxtp       # run ONLY the sxtp suite (fast — skips
+#                                           # the Datalog-heavy blog suite)
+#   bash lib/host/conformance.sh blog -v    # one suite, verbose
+#   bash lib/host/conformance.sh -v         # all suites, verbose
+
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+
+SX_SERVER="${SX_SERVER:-hosts/ocaml/_build/default/bin/sx_server.exe}"
+if [ ! -x "$SX_SERVER" ]; then
+  SX_SERVER="/root/rose-ash/hosts/ocaml/_build/default/bin/sx_server.exe"
+fi
+if [ ! -x "$SX_SERVER" ]; then
+  echo "ERROR: sx_server.exe not found." >&2
+  exit 1
+fi
+
+# Args: an optional suite NAME runs just that suite (fast); -v is verbose per-suite.
+VERBOSE=""
+SUITE_FILTER=""
+for arg in "$@"; do
+  case "$arg" in
+    -v|--verbose) VERBOSE="-v" ;;
+    *) SUITE_FILTER="$arg" ;;
+  esac
+done
+
+# Kernel + subsystem dependencies, then the host modules. Order matters:
+# stdlib/r7rs first; the Datalog engine + ACL subsystem (authorisation); the feed
+# subsystem (the first migrated domain); Dream (types/json/auth/error/router) the
+# host builds on; then the host layer itself.
+MODULES=(
+  "spec/stdlib.sx"
+  "lib/r7rs.sx"
+  "lib/apl/runtime.sx"
+  "lib/datalog/tokenizer.sx"
+  "lib/datalog/parser.sx"
+  "lib/datalog/unify.sx"
+  "lib/datalog/db.sx"
+  "lib/datalog/builtins.sx"
+  "lib/datalog/aggregates.sx"
+  "lib/datalog/strata.sx"
+  "lib/datalog/eval.sx"
+  "lib/datalog/api.sx"
+  "lib/datalog/magic.sx"
+  "lib/acl/schema.sx"
+  "lib/acl/facts.sx"
+  "lib/acl/engine.sx"
+  "lib/acl/explain.sx"
+  "lib/acl/audit.sx"
+  "lib/acl/federation.sx"
+  "lib/acl/api.sx"
+  "lib/relations/schema.sx"
+  "lib/relations/engine.sx"
+  "lib/relations/api.sx"
+  "lib/relations/explain.sx"
+  "lib/relations/federation.sx"
+  "lib/relations/tree.sx"
+  "lib/feed/normalize.sx"
+  "lib/feed/stream.sx"
+  "lib/feed/api.sx"
+  "lib/persist/event.sx"
+  "lib/persist/backend.sx"
+  "lib/persist/log.sx"
+  "lib/persist/kv.sx"
+  "lib/persist/api.sx"
+  "lib/persist/durable.sx"
+  "spec/render.sx"
+  "web/adapter-html.sx"
+  "lib/dream/types.sx"
+  "lib/dream/json.sx"
+  "lib/dream/auth.sx"
+  "lib/dream/error.sx"
+  "lib/dream/form.sx"
+  "lib/dream/session.sx"
+  "lib/dream/router.sx"
+  "lib/host/handler.sx"
+  "lib/host/middleware.sx"
+  "lib/host/session.sx"
+  "lib/host/auth.sx"
+  "lib/host/sxtp.sx"
+  "lib/host/router.sx"
+  "lib/host/static.sx"
+  "lib/host/sx/relate-picker.sx"
+  "lib/host/sx/kg-cards.sx"
+  "lib/host/feed.sx"
+  "lib/host/relations.sx"
+  "lib/host/compose.sx"
+  "lib/host/blog.sx"
+  "lib/host/page.sx"
+  "lib/host/server.sx"
+  "lib/host/ledger.sx"
+)
+
+# Suites: NAME RUNNER-FN PATH
+SUITES=(
+  "handler     host-hd-tests-run!  lib/host/tests/handler.sx"
+  "middleware  host-mw-tests-run!  lib/host/tests/middleware.sx"
+  "sxtp        host-sx-tests-run!  lib/host/tests/sxtp.sx"
+  "router      host-rt-tests-run!  lib/host/tests/router.sx"
+  "feed        host-fd-tests-run!  lib/host/tests/feed.sx"
+  "relations   host-rl-tests-run!  lib/host/tests/relations.sx"
+  "blog        host-bl-tests-run!  lib/host/tests/blog.sx"
+  "session     host-se-tests-run!  lib/host/tests/session.sx"
+  "page        host-pg-tests-run!  lib/host/tests/page.sx"
+  "server      host-sv-tests-run!  lib/host/tests/server.sx"
+  "ledger      host-lg-tests-run!  lib/host/tests/ledger.sx"
+)
+
+# Filter to a single suite if a name was given (filter the array itself so its
+# indices stay aligned with the result-parsing loop below). All MODULES still load
+# — the host modules are interdependent; only the TEST suites are narrowed.
+if [ -n "$SUITE_FILTER" ]; then
+  _FILTERED=()
+  for SUITE in "${SUITES[@]}"; do
+    [ "$(echo "$SUITE" | awk '{print $1}')" = "$SUITE_FILTER" ] && _FILTERED+=("$SUITE")
+  done
+  if [ "${#_FILTERED[@]}" -eq 0 ]; then
+    echo "ERROR: no suite named '$SUITE_FILTER'. Valid names:" >&2
+    for SUITE in "${SUITES[@]}"; do echo "  $(echo "$SUITE" | awk '{print $1}')" >&2; done
+    exit 1
+  fi
+  SUITES=("${_FILTERED[@]}")
+fi
+
+TMPFILE=$(mktemp); trap "rm -f $TMPFILE" EXIT
+EPOCH=1
+emit_load () { echo "(epoch $EPOCH)"; echo "(load \"$1\")"; EPOCH=$((EPOCH+1)); }
+emit_eval () { echo "(epoch $EPOCH)"; echo "(eval \"$1\")"; EPOCH=$((EPOCH+1)); }
+
+{
+  for M in "${MODULES[@]}"; do emit_load "$M"; done
+  for SUITE in "${SUITES[@]}"; do
+    read -r _NAME _RUNNER FILE <<< "$SUITE"
+    emit_load "$FILE"
+    emit_eval "($_RUNNER)"
+  done
+} > "$TMPFILE"
+
+# 1200s: the blog suite drives the relations graph hard (every is-a/types-of/
+# instances-of query re-saturates the Datalog db), so it's CPU-bound and much slower
+# under shared-box contention (a sibling loop at load ~6 pushed it past 600s -> false
+# "no suite results parsed" truncation). Override with SX_CONF_TIMEOUT for a tighter cap.
+OUTPUT=$(timeout "${SX_CONF_TIMEOUT:-1200}" "$SX_SERVER" < "$TMPFILE" 2>&1 || true)
+
+# Fail LOUD on any load/eval error. A test file that errors mid-load silently
+# truncates its suite — the runner returns only the tests that ran before the
+# error, so the suite reports a false green (e.g. "blog 13 passed, 0 failed"
+# when 16 CRUD tests never ran). Catch the error markers and abort before the
+# pass/fail tally can hide them.
+if echo "$OUTPUT" | grep -qE 'Undefined symbol|Unhandled exception|\[load\][^|]*[Ee]rror|expected list, got|: error '; then
+  echo "FAIL: load/eval error detected — a suite may be silently truncated:" >&2
+  echo "$OUTPUT" | grep -nE 'Undefined symbol|Unhandled exception|\[load\]|expected list, got|: error ' | head -20 >&2
+  exit 1
+fi
+
+TOTAL_PASS=0
+TOTAL_FAIL=0
+FAILED_SUITES=()
+LAST_DICT_LINES=$(echo "$OUTPUT" | grep -E '^\{:' || true)
+
+I=0
+while read -r LINE; do
+  [ -z "$LINE" ] && continue
+  P=$(echo "$LINE" | grep -oE ':passed [0-9]+' | awk '{print $2}')
+  F=$(echo "$LINE" | grep -oE ':failed [0-9]+' | awk '{print $2}')
+  [ -z "$P" ] && P=0
+  [ -z "$F" ] && F=0
+  SUITE_INFO="${SUITES[$I]}"
+  SUITE_NAME=$(echo "$SUITE_INFO" | awk '{print $1}')
+  TOTAL_PASS=$((TOTAL_PASS + P))
+  TOTAL_FAIL=$((TOTAL_FAIL + F))
+  if [ "$F" -gt 0 ]; then
+    FAILED_SUITES+=("$SUITE_NAME: $P/$((P+F))")
+    printf 'X %-12s %d/%d\n' "$SUITE_NAME" "$P" "$((P+F))"
+    echo "$LINE" | grep -oE ':name "[^"]*"' | sed 's/:name /    fail: /'
+  elif [ "$VERBOSE" = "-v" ]; then
+    printf 'ok %-12s %d passed\n' "$SUITE_NAME" "$P"
+  fi
+  I=$((I+1))
+done <<< "$LAST_DICT_LINES"
+
+TOTAL=$((TOTAL_PASS + TOTAL_FAIL))
+if [ "$TOTAL" -eq 0 ]; then
+  echo "ERROR: no suite results parsed. Raw output:" >&2
+  echo "$OUTPUT" >&2
+  exit 1
+fi
+if [ $TOTAL_FAIL -eq 0 ]; then
+  echo "ok $TOTAL_PASS/$TOTAL host-on-sx tests passed (${#SUITES[@]} suites)"
+else
+  echo "FAIL $TOTAL_PASS/$TOTAL passed, $TOTAL_FAIL failed:"
+  for S in "${FAILED_SUITES[@]}"; do echo "  $S"; done
+  exit 1
+fi

lib/host/feed.sx

@@ -0,0 +1,49 @@
+;; lib/host/feed.sx — Feed domain endpoints on the host. The first domain migrated
+;; onto the SX host: read the activity timeline (GET /feed) and create activities
+;; (POST /feed). Both go straight through the feed subsystem's public API; the
+;; write path runs behind the host middleware stack (auth + ACL). Depends on
+;; lib/feed/* + lib/host/handler.sx + lib/host/middleware.sx (write routes only).
+
+;; ── read ───────────────────────────────────────────────────────────
+
+;; GET /feed -> recent-first activities as a JSON envelope.
+;; Query: ?actor=<id> (filter) ?limit=<n> (cap, applied after filtering).
+(define host/feed-timeline
+  (fn (req)
+    (let ((base (feed/recent (feed/all)))
+          (actor (dream-query-param req "actor")))
+      (let ((filtered (if actor (feed/by-actor base actor) base))
+            (limit (dream-query-param req "limit")))
+        (let ((capped
+                (if limit (feed/take filtered (string->number limit)) filtered)))
+          (host/ok (feed/items capped)))))))
+
+;; Public read route group.
+(define host/feed-routes
+  (list
+    (dream-get "/feed" host/feed-timeline)))
+
+;; ── write ──────────────────────────────────────────────────────────
+
+;; POST /feed -> create an activity from the text/sx body. Returns 201 + the created
+;; (normalised) activity. Body must be an SX dict; anything else -> 400.
+(define host/feed-create
+  (fn (req)
+    (let ((raw (host/sx-body req)))
+      (if (= (type-of raw) "dict")
+        (host/ok-status 201 (feed/post raw))
+        (host/error 400 "invalid activity")))))
+
+;; Guarded write route group: POST /feed behind auth + ACL ("post" on "feed").
+;; resolve : token -> principal | nil (injected auth policy, e.g. token lookup
+;; against the identity subsystem). Errors thrown downstream become a JSON 500.
+(define host/feed-write-routes
+  (fn (resolve)
+    (list
+      (dream-post "/feed"
+        (host/pipeline
+          (list
+            host/wrap-errors
+            (host/require-auth resolve)
+            (host/require-permission "post" (fn (req) "feed")))
+          host/feed-create)))))

lib/host/handler.sx

@@ -0,0 +1,41 @@
+;; lib/host/handler.sx — Host handler layer: the bridge from a Dream request to a
+;; subsystem call and back to a Dream response. A host handler IS a Dream handler
+;; (request -> response); these helpers build the SX-native envelope every host
+;; endpoint shares — text/sx, serialized SX wire format (NOT JSON): {:ok true
+;; :data ...} on success, {:ok false :error ...} on failure. The platform speaks
+;; SX end to end; JSON lives only at the ActivityPub federation edge (JSON-LD).
+;; Depends on lib/dream/types.sx.
+
+;; ── responses ──────────────────────────────────────────────────────
+
+;; SX response at an arbitrary status: content-type text/sx, body = the value
+;; serialized to SX wire format (the same `serialize` SXTP uses). The SX engine /
+;; WASM kernel parses this directly — NO JSON on the internal wire.
+(define host/sx-status
+  (fn (status value)
+    (dream-response status {:content-type "text/sx; charset=utf-8"}
+      (serialize value))))
+
+;; Success envelope: 200 {:ok true :data <value>}.
+(define host/ok
+  (fn (value)
+    (host/sx-status 200 {:ok true :data value})))
+
+;; Success envelope at a chosen status (e.g. 201 for a created resource).
+(define host/ok-status
+  (fn (status value)
+    (host/sx-status status {:ok true :data value})))
+
+;; Error envelope: {:ok false :error <message>} at the given status.
+(define host/error
+  (fn (status message)
+    (host/sx-status status {:ok false :error message})))
+
+;; ── request reading ────────────────────────────────────────────────
+
+;; Integer query param with a fallback (query params arrive as strings).
+;; Absent param -> fallback; present -> parsed number.
+(define host/query-int
+  (fn (req name fallback)
+    (let ((raw (dream-query-param req name)))
+      (if raw (string->number raw) fallback))))

lib/host/ledger.sx

@@ -0,0 +1,89 @@
+;; lib/host/ledger.sx — the strangler migration ledger. A catalogue of every
+;; rose-ash HTTP endpoint with its Quart original and its current host status, so
+;; the cut-over from Quart to the SX host is tracked endpoint-by-endpoint rather
+;; than big-bang. Status is one of:
+;;   :native   — born on the host, has no Quart original (e.g. /health probe)
+;;   :migrated — moved off Quart, now served by an SX handler
+;;   :proxied  — still on Quart; the host forwards until cut over
+;; Coverage (how far the strangler has progressed = how much is OFF Quart) is
+;; computed from the catalogue. Pure data + queries — no IO, fully conformable.
+
+;; ── entry constructor ───────────────────────────────────────────────
+;; quart is a "service:handler" ref string (nil for :native endpoints); handler
+;; is the SX handler name serving it (nil while still :proxied).
+(define host/ledger-entry
+  (fn (domain method path quart status handler)
+    {:domain domain :method method :path path
+     :quart quart :status status :handler handler}))
+
+;; ── the catalogue ───────────────────────────────────────────────────
+;; Reflects the live host: feed reads+writes migrated, /health native, the
+;; relations container endpoints migrated onto lib/relations (reads get-children/
+;; get-parents + writes attach-child/detach-child — see lib/host/relations.sx).
+;; The TYPED relations actions (relate/unrelate/can-relate) stay proxied: they
+;; carry registry + cardinality validation lib/relations does not implement. The
+;; internal-only likes data+action endpoints stay proxied too — likes has no SX
+;; subsystem to dispatch to.
+(define host/ledger
+  (list
+    (host/ledger-entry "host"      "GET"  "/health"                     nil                         "native"   "host/health-route")
+    (host/ledger-entry "blog"      "GET"  "/:slug"                      "blog:post_detail"          "migrated" "host/blog-post")
+    (host/ledger-entry "feed"      "GET"  "/feed"                       "feed:timeline"             "migrated" "host/feed-timeline")
+    (host/ledger-entry "feed"      "POST" "/feed"                       "feed:create"               "migrated" "host/feed-create")
+    (host/ledger-entry "relations" "GET"  "/internal/data/get-children"  "relations:get_children"  "migrated" "host/relations-children")
+    (host/ledger-entry "relations" "GET"  "/internal/data/get-parents"   "relations:get_parents"   "migrated" "host/relations-parents")
+    (host/ledger-entry "relations" "POST" "/internal/actions/attach-child" "relations:attach_child" "migrated" "host/relations-attach")
+    (host/ledger-entry "relations" "POST" "/internal/actions/detach-child" "relations:detach_child" "migrated" "host/relations-detach")
+    (host/ledger-entry "relations" "POST" "/internal/actions/relate"     "relations:relate"        "proxied"  nil)
+    (host/ledger-entry "relations" "POST" "/internal/actions/unrelate"   "relations:unrelate"      "proxied"  nil)
+    (host/ledger-entry "relations" "POST" "/internal/actions/can-relate" "relations:can_relate"    "proxied"  nil)
+    (host/ledger-entry "likes"     "GET"  "/internal/data/is-liked"     "likes:is_liked"            "proxied"  nil)
+    (host/ledger-entry "likes"     "GET"  "/internal/data/liked-slugs"  "likes:liked_slugs"         "proxied"  nil)
+    (host/ledger-entry "likes"     "GET"  "/internal/data/liked-ids"    "likes:liked_ids"           "proxied"  nil)
+    (host/ledger-entry "likes"     "POST" "/internal/actions/toggle"    "likes:toggle"              "proxied"  nil)))
+
+;; ── status / domain queries ─────────────────────────────────────────
+(define host/ledger-by-status
+  (fn (ledger status) (filter (fn (e) (= (get e :status) status)) ledger)))
+(define host/ledger-migrated (fn (ledger) (host/ledger-by-status ledger "migrated")))
+(define host/ledger-proxied  (fn (ledger) (host/ledger-by-status ledger "proxied")))
+(define host/ledger-native   (fn (ledger) (host/ledger-by-status ledger "native")))
+(define host/ledger-by-domain
+  (fn (ledger domain) (filter (fn (e) (= (get e :domain) domain)) ledger)))
+
+;; An endpoint is OFF Quart (served by the host) iff native or migrated.
+(define host/ledger-served?
+  (fn (e) (or (= (get e :status) "native") (= (get e :status) "migrated"))))
+
+;; First entry matching (method, path), or nil.
+(define host/ledger-find
+  (fn (ledger method path)
+    (let ((hits (filter
+                  (fn (e) (and (= (get e :method) method) (= (get e :path) path)))
+                  ledger)))
+      (if (> (len hits) 0) (first hits) nil))))
+
+;; Distinct domains in the catalogue (order: first-seen, reversed by cons).
+(define host/ledger-domains
+  (fn (ledger)
+    (reduce
+      (fn (acc e)
+        (let ((d (get e :domain)))
+          (if (some (fn (x) (= x d)) acc) acc (cons d acc))))
+      (list)
+      ledger)))
+
+;; ── coverage ────────────────────────────────────────────────────────
+;; served = off Quart (migrated + native); percent = served / total, floored.
+(define host/ledger-coverage
+  (fn (ledger)
+    (let ((total (len ledger))
+          (migrated (len (host/ledger-migrated ledger)))
+          (proxied (len (host/ledger-proxied ledger)))
+          (native (len (host/ledger-native ledger))))
+      {:total total
+       :migrated migrated
+       :proxied proxied
+       :native native
+       :served (+ migrated native)
+       :percent (if (= total 0) 0 (quotient (* 100 (+ migrated native)) total))})))

lib/host/live-check.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Non-browser live-check for the host: spins up an EPHEMERAL host server (this
+# worktree's binary + lib + web, a temp persist dir), logs in, seeds one post, then
+# runs a sequence of HTTP checks printing status | content-type | body-head for each.
+# Catches what conformance can't — the real http-listen serving path (serving-JIT
+# divergence, VmSuspended renders, content-type regressions) — without a browser and
+# without touching live data. The non-Playwright counterpart to run-picker-check.sh.
+#
+#   bash lib/host/live-check.sh                      # default smoke: /health /posts /feed / /<seeded>/
+#   bash lib/host/live-check.sh /tags /article/      # check specific GET paths instead
+#
+# Asserts: reads are text/sx (the SX-native wire), pages are non-empty, no 5xx.
+# Requires the OCaml binary built (hosts/ocaml/_build/default/bin/sx_server.exe).
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+
+PORT="${LIVE_PORT:-8914}"
+USER="admin"; PASS="live-check-pw"; SECRET="live-check-secret"
+PDIR=$(mktemp -d); JAR=$(mktemp); LOG=$(mktemp); HDR=$(mktemp)
+BASE="http://127.0.0.1:$PORT"
+RC=0
+
+cleanup() {
+  local pid
+  pid=$(ss -lptn "sport = :$PORT" 2>/dev/null | grep -oE 'pid=[0-9]+' | head -1 | cut -d= -f2)
+  [ -n "$pid" ] && kill "$pid" 2>/dev/null
+  rm -f "$JAR" "$LOG" "$HDR"; rm -rf "$PDIR"
+}
+trap cleanup EXIT
+
+echo "== booting ephemeral host on :$PORT (persist=$PDIR) =="
+# SX_SERVING_JIT=1 to MATCH THE CONTAINER: it gates the http-listen IO resolver, so
+# without it perform-heavy paths (e.g. reach-down's BFS over the type graph — the is-a/
+# tags picker) falsely raise VmSuspended -> 500. The live container sets it; the harness
+# must too, or it reports false 500s the live site never shows.
+SX_SERVING_JIT=1 HOST_PORT="$PORT" SX_PERSIST_DIR="$PDIR" \
+  SX_ADMIN_USER="$USER" SX_ADMIN_PASSWORD="$PASS" SX_SESSION_SECRET="$SECRET" \
+  bash lib/host/serve.sh >"$LOG" 2>&1 &
+for i in $(seq 1 60); do
+  curl -sf -o /dev/null "$BASE/health" 2>/dev/null && break
+  sleep 1; [ "$i" = "60" ] && { echo "server never came up:"; cat "$LOG"; exit 1; }
+done
+echo "== up =="
+
+# Log in + seed one post (also exercises the form-ingest write path).
+curl -s -c "$JAR" -o /dev/null -X POST "$BASE/login" --data "username=$USER&password=$PASS"
+curl -s -b "$JAR" -o /dev/null -X POST "$BASE/new" \
+  --data 'title=Live Check Post&sx_content=(article (h1 "Live Check Post") (p "ok"))&status=published'
+
+# A GET check: prints "<status> <content-type> | <body-head>" and flags problems.
+check() {
+  local path="$1" body ct code
+  body=$(curl -s -b "$JAR" -D "$HDR" "$BASE$path")
+  code=$(awk 'NR==1{print $2}' "$HDR")
+  ct=$(grep -i '^content-type:' "$HDR" | head -1 | tr -d '\r' | sed 's/content-type: *//I')
+  printf '  %-20s %s  %-26s | %s\n' "$path" "${code:-???}" "${ct:-?}" "$(printf '%s' "$body" | tr '\n' ' ' | cut -c1-70)"
+  case "$code" in 5*) echo "    !! 5xx"; RC=1 ;; esac
+  [ -z "$body" ] && { echo "    !! empty body"; RC=1; }
+  # data endpoints must be SX, never JSON
+  case "$path" in
+    /posts|/feed) echo "$ct" | grep -qi 'text/sx' || { echo "    !! expected text/sx, got '$ct'"; RC=1; }
+                  printf '%s' "$body" | grep -q '"ok":' && { echo "    !! JSON leaked"; RC=1; } ;;
+  esac
+}
+
+echo "== checks =="
+if [ "$#" -gt 0 ]; then
+  for p in "$@"; do check "$p"; done
+else
+  for p in /health /posts /feed / /live-check-post/; do check "$p"; done
+fi
+
+echo "== done (rc $RC) =="
+exit $RC

lib/host/middleware.sx

@@ -0,0 +1,54 @@
+;; lib/host/middleware.sx — Host middleware: composable handler->handler layers
+;; for the cross-cutting concerns every write endpoint shares — error trapping
+;; (JSON 500), authentication (bearer token -> principal), and authorisation
+;; (ACL permit?). Middleware is plain function composition; host/pipeline threads a
+;; list onto a handler, FIRST middleware outermost (so it runs first). Auth and
+;; permission policy are INJECTED — the token resolver and the resource extractor —
+;; so this layer carries no hardcoded policy. Reuses Dream's bearer/error helpers
+;; and lib/acl's public acl/permit?.
+;; Depends on lib/dream/{auth,error,router}.sx + lib/acl/api.sx + lib/host/handler.sx.
+
+;; Compose a list of middlewares onto a handler (first = outermost).
+(define host/pipeline
+  (fn (middlewares handler)
+    (dr/apply-middlewares middlewares handler)))
+
+;; The authenticated principal attached by host/require-auth.
+(define host/principal (fn (req) (dream-principal req)))
+
+;; ── error trapping ─────────────────────────────────────────────────
+;; Any error thrown downstream becomes a JSON 500 envelope.
+(define host/-on-error
+  (fn (req e) (host/error 500 "internal error")))
+(define host/wrap-errors (dream-catch-with host/-on-error))
+
+;; ── authentication ─────────────────────────────────────────────────
+;; resolve : token -> principal | nil. Missing/invalid token -> JSON 401 with a
+;; WWW-Authenticate: Bearer challenge; success attaches :dream-principal so
+;; downstream layers (and host/principal) can read it.
+(define host/require-auth
+  (fn (resolve)
+    (fn (next)
+      (fn (req)
+        (let ((tok (dream-bearer-token req)))
+          (let ((principal (if tok (resolve tok) nil)))
+            (if (nil? principal)
+              (dream-add-header
+                (host/error 401 "unauthorized")
+                "www-authenticate"
+                "Bearer")
+              (next (assoc req :dream-principal principal)))))))))
+
+;; ── authorisation ──────────────────────────────────────────────────
+;; Gate on ACL: the authed principal must be permitted `action` on the resource
+;; computed by res-fn from the request. Denied -> JSON 403. Assumes the ACL fact
+;; db was loaded (acl/load!) at startup. Place AFTER host/require-auth.
+(define host/require-permission
+  (fn (action res-fn)
+    (fn (next)
+      (fn (req)
+        (let ((subject (host/principal req))
+              (resource (res-fn req)))
+          (if (acl/permit? subject action resource)
+            (next req)
+            (host/error 403 "forbidden")))))))

lib/host/page.sx

@@ -0,0 +1,22 @@
+;; lib/host/page.sx — serve interactive SX component/island pages on the host
+;; (Phase 5: the generic interactive-SX-page capability).
+;;
+;; The bare `render-to-html` path mangles an EVALUATED component tree's keyword
+;; attributes ((form :id ..) -> "<form>idpost-new-form..."), because evaluating a
+;; defcomp body turns `:id` into a child. The kernel `render-page` primitive
+;; instead renders an UNEVALUATED expression with the server env: render-to-html
+;; expands the components itself and collects keyword args as attributes. SX
+;; handlers can't reach the server env, so render-page supplies it.
+;;
+;; host/page wraps a rendered expression as an HTML response; host/page-route
+;; mounts it on a GET path. This is the component-render step (5.1); the full page
+;; shell (inlined component defs + CSS + client runtime + hydration) and static
+;; asset serving (5.2–5.4) build on top to make the page interactive.
+;; Depends on the kernel `render-page` primitive + lib/dream/types.sx (dream-html).
+
+;; Render an unevaluated SX page/component expression to an HTML response.
+(define host/page (fn (expr) (dream-html (render-page expr))))
+
+;; Mount a GET route that renders a fixed page expression.
+(define host/page-route
+  (fn (path expr) (dream-get path (fn (req) (host/page expr)))))

lib/host/playwright/relate-picker.spec.js

@@ -0,0 +1,118 @@
+// Browser check for the relate picker (lib/host/blog.sx). Runs against an
+// ephemeral host server seeded with a host post + 25 candidates by
+// run-picker-check.sh, which copies this spec into the Playwright env and sets
+// SX_TEST_URL.
+//
+// TRIMMED to the irreducibly-real-browser cases. The picker's interactive
+// behaviours — populate-on-load, debounced filter, sentinel paging, relate→delete
+// row, error/retry visible state — are now SX engine tests in
+// web/tests/test-relate-picker.sx (they drive the SAME engine against a mock DOM,
+// no Chromium). Its server contract + persistence are SX conformance tests in
+// lib/host/tests/blog.sx. What remains here needs a live boosted-SPA browser:
+//   1. a boosted form POST swaps in place (bind-boost-form regression), and
+//   2. the picker re-binds its triggers on content brought in by a boosted SPA
+//      nav (the case an inline <script> picker silently failed).
+const { test, expect } = require('playwright/test');
+
+const USER = process.env.SX_ADMIN_USER || 'admin';
+const PASS = process.env.SX_ADMIN_PASSWORD || 'letmein';
+const HOST = 'picker-host';        // the post whose edit page we drive
+// the Related picker box (the edit page now has one picker per kind)
+const REL = '.relate-picker[data-kind="related"]';
+const RELF = `${REL} .rp-filter`;
+const RELR = `${REL} .rp-results`;
+const RELROWS = `${RELR} li:not(.rp-more)`;   // candidate rows (exclude the sentinel)
+
+// boot-init marks <html data-sx-ready="true"> once the WASM kernel + web stack
+// load. WASM compile + asset fetches, so allow generous time.
+async function waitReady(page) {
+  await expect(page.locator('html[data-sx-ready="true"]')).toHaveCount(1, { timeout: 45000 });
+}
+
+// Navigate to a GUARDED path; the host redirects to /login?next=…, so fill the
+// form and we should land back on the original path (exercises the auth flow).
+async function loginTo(page, path) {
+  await page.goto(path);
+  await page.waitForURL(/\/login/);
+  await page.fill('input[name="username"]', USER);
+  await page.fill('input[name="password"]', PASS);
+  await page.click('button[type="submit"]');
+  await page.waitForURL((u) => !u.pathname.startsWith('/login'));
+}
+
+// Log in directly (for reaching PUBLIC pages while authenticated).
+async function login(page) {
+  await page.goto('/login');
+  await page.fill('input[name="username"]', USER);
+  await page.fill('input[name="password"]', PASS);
+  await page.click('button[type="submit"]');
+  await page.waitForURL((u) => !u.pathname.startsWith('/login'));
+}
+
+test.describe('relate picker (browser-only)', () => {
+  test('relating a candidate adds it to the current list AND removing keeps the picker', async ({ page }) => {
+    // The whole in-page flow the user reported broken — no reloads. Relating a
+    // candidate re-renders the editor: the post moves into the current-relations
+    // list and the picker re-loads its candidates (it is NOT blanked). Removing it
+    // re-renders the editor back: the post leaves the current list and the picker
+    // still offers candidates.
+    test.setTimeout(75000);
+    await loginTo(page, `/${HOST}/edit`);
+    await waitReady(page);
+    await page.evaluate(() => { window.__noReload = true; });
+    // relate Item 13 from the picker
+    await page.fill(RELF, 'Item 13');
+    await expect.poll(() => page.locator(RELROWS).count(), { timeout: 10000 }).toBe(1);
+    await page.locator(`${RELROWS} button`).first().click();
+    const relLink = page.locator('a[href="/picker-item-13/"]');
+    // ISSUE 1: it now appears in the CURRENT relations list (added, not just removed)
+    await expect(relLink).toHaveCount(1, { timeout: 12000 });
+    // and the re-rendered picker still offers candidates (not blanked)
+    await expect.poll(() => page.locator(RELROWS).count(), { timeout: 12000 }).toBeGreaterThan(0);
+    // now remove it via its current-list remove button
+    await page.locator('li:has(a[href="/picker-item-13/"]) button').click();
+    await expect(relLink).toHaveCount(0, { timeout: 12000 });   // left the current list
+    // ISSUE 2: removing must NOT clear "the list of posts to relate"
+    await expect.poll(() => page.locator(RELROWS).count(), { timeout: 12000 }).toBeGreaterThan(0);
+    expect(await page.evaluate(() => window.__noReload)).toBe(true);   // all in-page, no reload
+    // and the relation truly persisted gone (reload shows it not present)
+    await page.reload();
+    await waitReady(page);
+    await expect(page.locator('a[href="/picker-item-13/"]')).toHaveCount(0);
+  });
+
+  test('relating a candidate persists the relation', async ({ page }) => {
+    test.setTimeout(75000);
+    await loginTo(page, `/${HOST}/edit`);
+    await waitReady(page);
+    await page.fill(RELF, 'Item 07');
+    await expect.poll(() => page.locator(RELROWS).count(), { timeout: 10000 }).toBe(1);
+    await page.locator(`${RELROWS} button`).first().click();
+    await expect(page.locator('a[href="/picker-item-07/"]')).toHaveCount(1, { timeout: 12000 });
+    // persisted across a reload
+    await page.reload();
+    await waitReady(page);
+    await expect(page.locator('a[href="/picker-item-07/"]')).toHaveCount(1);
+    // and visible on the public post page
+    await page.goto(`/${HOST}/`);
+    await expect(page.getByRole('heading', { name: 'Related posts' })).toBeVisible();
+    await expect(page.locator('body')).toContainText('Picker Item 07');
+  });
+
+  test('picker populates after a boosted SPA nav to the edit page', async ({ page }) => {
+    // Reach the edit page by CLICKING its link (a boosted SPA nav), not page.goto.
+    // The old inline <script> picker never ran on swapped-in content, so the list
+    // stayed empty here. The declarative form's "load" trigger is re-bound by the
+    // engine on swap, so it populates — that's the regression this guards.
+    await login(page);
+    await page.goto(`/${HOST}/`);              // public post page, logged in
+    await waitReady(page);
+    await page.evaluate(() => { window.__noReload = true; });
+    await page.locator(`a[href="/${HOST}/edit"]`).first().click();
+    await page.waitForURL((u) => u.pathname === `/${HOST}/edit`, { timeout: 15000 });
+    expect(await page.evaluate(() => window.__noReload)).toBe(true);   // it was a SPA nav, no full reload
+    // the picker, brought in by the swap, loaded its first page of candidates
+    await expect.poll(() => page.locator(RELROWS).count(), { timeout: 12000 }).toBeGreaterThanOrEqual(1);
+    await expect(page.locator(RELR)).toContainText('Picker Item');
+  });
+});

lib/host/playwright/run-picker-check.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Browser check for the relate picker. Spins up an EPHEMERAL host server (this
+# worktree's binary + lib, a temp persist dir), seeds a host post + 25 candidates,
+# runs lib/host/playwright/relate-picker.spec.js in the main worktree's Playwright,
+# then tears everything down. No live-site dependency, no live-data pollution.
+#
+#   bash lib/host/playwright/run-picker-check.sh
+#
+# Requires: the OCaml binary built (hosts/ocaml/_build/default/bin/sx_server.exe)
+# and Playwright + chromium in /root/rose-ash (the architecture worktree).
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+ROOT=$(pwd)
+
+PORT="${PICKER_PORT:-8912}"
+PW_DIR="${PW_DIR:-/root/rose-ash}"          # worktree that has node_modules + chromium
+USER="admin"
+PASS="picker-check-pw"
+SECRET="picker-check-secret"
+PDIR=$(mktemp -d)
+JAR=$(mktemp)
+SPEC_SRC="lib/host/playwright/relate-picker.spec.js"
+SPEC_DST="$PW_DIR/tests/playwright/_picker-check.spec.js"
+SERVE_LOG=$(mktemp)
+
+cleanup() {
+  [ -n "${SVPID:-}" ] && kill "$SVPID" 2>/dev/null
+  # kill whatever is still bound to the port (serve.sh re-parents via `| exec`)
+  local pid
+  pid=$(ss -lptn "sport = :$PORT" 2>/dev/null | grep -oE 'pid=[0-9]+' | head -1 | cut -d= -f2)
+  [ -n "$pid" ] && kill "$pid" 2>/dev/null
+  rm -f "$SPEC_DST" "$JAR" "$SERVE_LOG"
+  rm -rf "$PDIR"
+}
+trap cleanup EXIT
+
+echo "== starting ephemeral host server on :$PORT (persist=$PDIR) =="
+# SX_SERVING_JIT=1 matches the live container (gates the http-listen IO resolver);
+# without it, perform-heavy paths (e.g. the is-a/tags picker's reach-down) falsely 500.
+SX_SERVING_JIT=1 HOST_PORT="$PORT" SX_PERSIST_DIR="$PDIR" \
+  SX_ADMIN_USER="$USER" SX_ADMIN_PASSWORD="$PASS" SX_SESSION_SECRET="$SECRET" \
+  bash lib/host/serve.sh >"$SERVE_LOG" 2>&1 &
+SVPID=$!
+
+for i in $(seq 1 60); do
+  curl -sf -o /dev/null "http://127.0.0.1:$PORT/health" 2>/dev/null && break
+  sleep 1
+  [ "$i" = "60" ] && { echo "server never came up:"; cat "$SERVE_LOG"; exit 1; }
+done
+echo "== server up =="
+
+echo "== seeding 1 host post + 25 candidates =="
+curl -s -c "$JAR" -o /dev/null -X POST "http://127.0.0.1:$PORT/login" \
+  --data "username=$USER&password=$PASS"
+curl -s -b "$JAR" -o /dev/null -X POST "http://127.0.0.1:$PORT/new" \
+  --data 'title=Picker Host&sx_content=(p "host")&status=published'
+for n in $(seq -w 1 25); do
+  curl -s -b "$JAR" -o /dev/null -X POST "http://127.0.0.1:$PORT/new" \
+    --data "title=Picker Item $n&sx_content=(p \"item $n\")&status=published"
+done
+echo "== seeded ($(curl -s "http://127.0.0.1:$PORT/posts" | grep -o '"slug"' | wc -l) posts) =="
+
+echo "== running Playwright =="
+cp "$ROOT/$SPEC_SRC" "$SPEC_DST"
+cd "$PW_DIR"
+SX_TEST_URL="http://127.0.0.1:$PORT" SX_ADMIN_USER="$USER" SX_ADMIN_PASSWORD="$PASS" \
+  node_modules/.bin/playwright test _picker-check.spec.js --workers=1 \
+  --config tests/playwright/playwright.config.js
+RC=$?
+
+echo "== done (exit $RC) =="
+exit $RC

lib/host/playwright/run-spa-check.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# Browser check for the blog SPA. Spins up an EPHEMERAL host server (this
+# worktree's binary + lib, a temp persist dir), seeds a couple of posts, runs
+# lib/host/playwright/spa-check.spec.js in the main worktree's Playwright, then
+# tears everything down. Verifies the WASM OCaml kernel boots in-browser and
+# sx-boost turns the blog into a SPA. No live-site dependency.
+#
+#   bash lib/host/playwright/run-spa-check.sh
+#
+# Requires: the OCaml binary built (hosts/ocaml/_build/default/bin/sx_server.exe)
+# and Playwright + chromium in /root/rose-ash (the architecture worktree).
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+ROOT=$(pwd)
+
+PORT="${SPA_PORT:-8914}"
+PW_DIR="${PW_DIR:-/root/rose-ash}"          # worktree that has node_modules + chromium
+USER="admin"
+PASS="spa-check-pw"
+SECRET="spa-check-secret"
+PDIR=$(mktemp -d)
+JAR=$(mktemp)
+SPEC_SRC="lib/host/playwright/spa-check.spec.js"
+SPEC_DST="$PW_DIR/tests/playwright/_spa-check.spec.js"
+SERVE_LOG=$(mktemp)
+
+cleanup() {
+  [ -n "${SVPID:-}" ] && kill "$SVPID" 2>/dev/null
+  local pid
+  pid=$(ss -lptn "sport = :$PORT" 2>/dev/null | grep -oE 'pid=[0-9]+' | head -1 | cut -d= -f2)
+  [ -n "$pid" ] && kill "$pid" 2>/dev/null
+  rm -f "$SPEC_DST" "$JAR" "$SERVE_LOG"
+  rm -rf "$PDIR"
+}
+trap cleanup EXIT
+
+echo "== starting ephemeral host server on :$PORT (persist=$PDIR) =="
+HOST_PORT="$PORT" SX_PERSIST_DIR="$PDIR" \
+  SX_ADMIN_USER="$USER" SX_ADMIN_PASSWORD="$PASS" SX_SESSION_SECRET="$SECRET" \
+  bash lib/host/serve.sh >"$SERVE_LOG" 2>&1 &
+SVPID=$!
+
+for i in $(seq 1 60); do
+  curl -sf -o /dev/null "http://127.0.0.1:$PORT/health" 2>/dev/null && break
+  sleep 1
+  [ "$i" = "60" ] && { echo "server never came up:"; cat "$SERVE_LOG"; exit 1; }
+done
+echo "== server up =="
+
+echo "== seeding posts =="
+curl -s -c "$JAR" -o /dev/null -X POST "http://127.0.0.1:$PORT/login" \
+  --data "username=$USER&password=$PASS"
+for t in "Alpha Post" "Beta Post"; do
+  curl -s -b "$JAR" -o /dev/null -X POST "http://127.0.0.1:$PORT/new" \
+    --data "title=$t&sx_content=(article (h1 \"$t\") (p \"body\"))&status=published"
+done
+echo "== seeded ($(curl -s "http://127.0.0.1:$PORT/posts" | grep -o '"slug"' | wc -l) posts) =="
+
+echo "== running Playwright =="
+cp "$ROOT/$SPEC_SRC" "$SPEC_DST"
+cd "$PW_DIR"
+SX_TEST_URL="http://127.0.0.1:$PORT" \
+  node_modules/.bin/playwright test _spa-check.spec.js --workers=1 \
+  --config tests/playwright/playwright.config.js
+RC=$?
+
+echo "== done (exit $RC) =="
+exit $RC

lib/host/playwright/spa-check.spec.js

@@ -0,0 +1,84 @@
+// Browser check for the blog SPA (lib/host/blog.sx + lib/host/static.sx). Runs
+// against an ephemeral host server seeded with a couple of posts by
+// run-spa-check.sh, which copies this spec into the Playwright env and sets
+// SX_TEST_URL. Verifies the WASM OCaml kernel boots in the browser, the SX-htmx
+// engine activates sx-boost on #content's links, and clicking a link does a
+// fragment swap (no full page reload) with history — i.e. it's a real SPA.
+const { test, expect } = require('playwright/test');
+
+// boot-init sets data-sx-ready="true" on <html> once the WASM kernel + web stack
+// have loaded and the page has been processed. WASM compile + ~25 asset fetches,
+// so allow generous time.
+async function waitReady(page) {
+  await expect(page.locator('html[data-sx-ready="true"]')).toHaveCount(1, { timeout: 45000 });
+}
+
+// a post link in the listing (trailing slash); skip /new, /login, /tags.
+const POSTLINK = '#content a[href$="/"]';
+
+test.describe('blog SPA', () => {
+  test('WASM kernel boots, loads modules content-addressed, marks ready', async ({ page }) => {
+    const errors = [];
+    // Track web-stack module fetches: content-addressed (/sx/h/{hash}) vs the
+    // path-based .sxbc fallback. A correctly-booting client takes ONLY the
+    // content-addressed branch (immutable, localStorage-cached).
+    const caFetches = [];     // /sx/h/{hash}
+    const pathSxbc = [];      // *.sxbc by path (the fallback — should not happen)
+    page.on('request', (r) => {
+      const u = r.url();
+      if (u.includes('/sx/h/')) caFetches.push(u);
+      else if (/\.sxbc(\?|$)/.test(u)) pathSxbc.push(u);
+    });
+    page.on('console', (m) => { if (m.type() === 'error') errors.push(m.text()); });
+    page.on('pageerror', (e) => errors.push(String(e)));
+    await page.goto('/');
+    await waitReady(page);
+    // the shell shipped the WASM loaders
+    expect(await page.locator('script[src*="sx_browser.bc.wasm.js"]').count()).toBe(1);
+    expect(await page.locator('script[src*="sx-platform.js"]').count()).toBe(1);
+    // modules loaded by content hash, with no path-.sxbc fallback fetches
+    expect(caFetches.length, 'expected content-addressed /sx/h/ module fetches').toBeGreaterThan(0);
+    expect(pathSxbc, `path-based .sxbc fallback fetched:\n${pathSxbc.join('\n')}`).toEqual([]);
+    // no boot-time JS errors
+    expect(errors, errors.join('\n')).toEqual([]);
+  });
+
+  test('clicking a link does a fragment swap — no full reload, URL updates', async ({ page }) => {
+    await page.goto('/');
+    await waitReady(page);
+    // sentinel survives ONLY if there is no full-page reload
+    await page.evaluate(() => { window.__noReload = true; });
+    const link = page.locator(POSTLINK).first();
+    const href = await link.getAttribute('href');
+    await link.click();
+    await page.waitForURL((u) => u.pathname === href, { timeout: 15000 });
+    expect(await page.evaluate(() => window.__noReload)).toBe(true);     // no reload
+    // content was swapped into #content (a post page carries the post footer)
+    await expect(page.locator('#content')).toContainText(/all posts/i, { timeout: 15000 });
+    // the post BODY itself rendered — the <article> comes from raw! HTML, which
+    // exercises the client SX raw-HTML path (dom-parse-html). If that drops the
+    // content (NodeList-vs-Node bug), the footer still shows but this fails.
+    await expect(page.locator('#content article').first()).toBeVisible({ timeout: 15000 });
+  });
+
+  test('back button restores the listing', async ({ page }) => {
+    await page.goto('/');
+    await waitReady(page);
+    const link = page.locator(POSTLINK).first();
+    const href = await link.getAttribute('href');
+    await link.click();
+    await page.waitForURL((u) => u.pathname === href, { timeout: 15000 });
+    await page.goBack();
+    await page.waitForURL((u) => u.pathname === '/', { timeout: 15000 });
+    await expect(page.locator('#content h1')).toContainText('Posts');
+    // and a click AFTER back must still be a SPA nav, not a full reload — the
+    // restored content has to be re-boosted (its [sx-boost] marker is an
+    // ancestor of the swap target, so the re-boost must scan upward).
+    await page.evaluate(() => { window.__noReload2 = true; });
+    const link2 = page.locator(POSTLINK).first();
+    const href2 = await link2.getAttribute('href');
+    await link2.click();
+    await page.waitForURL((u) => u.pathname === href2, { timeout: 15000 });
+    expect(await page.evaluate(() => window.__noReload2)).toBe(true);
+  });
+});

lib/host/relations.sx

@@ -0,0 +1,134 @@
+;; lib/host/relations.sx — Relations domain endpoints on the host. The relations
+;; service is internal-only (no public routes): Quart exposes it as signed
+;; /internal/data/{query} reads + /internal/actions/{action} writes. This migrates
+;; the two READ queries — get-children, get-parents — straight onto the SX host,
+;; dispatching to the lib/relations subsystem (a saturating Datalog graph).
+;;
+;; Node model: the Quart relations API keys nodes by a (type, id) pair; the graph
+;; subsystem keys them by an opaque atom. We bridge by composing the atom as the
+;; symbol "type:id", with the relation-type as the edge kind. Optional child-type
+;; / parent-type params filter the result by that "type:" prefix — matching the
+;; Quart queries' optional type narrowing.
+;; Depends on lib/relations/* + lib/host/handler.sx + lib/dream/* (query params).
+
+;; ── node helpers ────────────────────────────────────────────────────
+(define host/-rel-node
+  (fn (type id) (string->symbol (str type ":" id))))
+(define host/-rel-node-type?
+  (fn (node type) (starts-with? (symbol->string node) (str type ":"))))
+(define host/-rel-strings
+  (fn (nodes) (map (fn (n) (symbol->string n)) nodes)))
+
+;; ── GET /internal/data/get-children ─────────────────────────────────
+;; query: parent-type, parent-id, relation-type (required); child-type (optional
+;; filter). Returns the child node ids ("type:id") for the parent under that kind.
+(define host/relations-children
+  (fn (req)
+    (let ((ptype (dream-query-param req "parent-type"))
+          (pid (dream-query-param req "parent-id"))
+          (kind (dream-query-param req "relation-type")))
+      (if (and ptype pid kind)
+        (let ((kids (relations/children (host/-rel-node ptype pid) (string->symbol kind)))
+              (ctype (dream-query-param req "child-type")))
+          (let ((sel (if ctype (filter (fn (k) (host/-rel-node-type? k ctype)) kids) kids)))
+            (host/ok (host/-rel-strings sel))))
+        (host/error 400 "missing parameter")))))
+
+;; ── GET /internal/data/get-parents ──────────────────────────────────
+;; query: child-type, child-id, relation-type (required); parent-type (optional
+;; filter). Returns the parent node ids ("type:id") for the child under that kind.
+(define host/relations-parents
+  (fn (req)
+    (let ((ctype (dream-query-param req "child-type"))
+          (cid (dream-query-param req "child-id"))
+          (kind (dream-query-param req "relation-type")))
+      (if (and ctype cid kind)
+        (let ((ps (relations/parents (host/-rel-node ctype cid) (string->symbol kind)))
+              (ptype (dream-query-param req "parent-type")))
+          (let ((sel (if ptype (filter (fn (p) (host/-rel-node-type? p ptype)) ps) ps)))
+            (host/ok (host/-rel-strings sel))))
+        (host/error 400 "missing parameter")))))
+
+;; ── read route group ────────────────────────────────────────────────
+;; Internal data reads (the signed-internal-auth gate is a separate middleware
+;; concern, like the feed reads); these dispatch straight to the subsystem.
+(define host/relations-routes
+  (list
+    (dream-get "/internal/data/get-children" host/relations-children)
+    (dream-get "/internal/data/get-parents" host/relations-parents)))
+
+;; ── writes: container relations (attach-child / detach-child) ────────
+;; The write side of get-children/get-parents: a container edge between a parent
+;; (type,id) and child (type,id) under a relation kind. Maps to relations/relate
+;; and relations/unrelate over the same "type:id" node model, so an attach is
+;; immediately visible through get-children. (The TYPED relate/unrelate/can-relate
+;; actions stay on Quart — they carry registry + cardinality validation that
+;; lib/relations does not implement.) Body is the action's JSON params dict.
+
+;; Pull the four node coordinates + kind from a payload; nil if any are absent.
+(define host/-rel-edge
+  (fn (p)
+    (let ((pt (get p :parent-type)) (pid (get p :parent-id))
+          (ct (get p :child-type)) (cid (get p :child-id))
+          (kind (get p :relation-type)))
+      (if (and pt pid ct cid kind)
+        {:parent (host/-rel-node pt pid)
+         :child (host/-rel-node ct cid)
+         :kind (string->symbol kind)
+         :parent-id (str pt ":" pid)
+         :child-id (str ct ":" cid)
+         :relation kind}
+        nil))))
+
+;; POST /internal/actions/attach-child — create the container edge. 201 on success.
+;; Body is text/sx (host/sx-body); non-dict -> 400.
+(define host/relations-attach
+  (fn (req)
+    (let ((p (host/sx-body req)))
+      (if (= (type-of p) "dict")
+        (let ((e (host/-rel-edge p)))
+          (if e
+            (begin
+              (relations/relate (get e :parent) (get e :child) (get e :kind))
+              (host/ok-status 201
+                {:parent (get e :parent-id) :child (get e :child-id)
+                 :relation (get e :relation)}))
+            (host/error 400 "missing parameter")))
+        (host/error 400 "invalid payload")))))
+
+;; POST /internal/actions/detach-child — remove the container edge. 200 on success.
+;; Body is text/sx (host/sx-body); non-dict -> 400.
+(define host/relations-detach
+  (fn (req)
+    (let ((p (host/sx-body req)))
+      (if (= (type-of p) "dict")
+        (let ((e (host/-rel-edge p)))
+          (if e
+            (begin
+              (relations/unrelate (get e :parent) (get e :child) (get e :kind))
+              (host/ok
+                {:parent (get e :parent-id) :child (get e :child-id)
+                 :relation (get e :relation) :detached true}))
+            (host/error 400 "missing parameter")))
+        (host/error 400 "invalid payload")))))
+
+;; Guarded write route group: each action behind auth + ACL. attach needs
+;; ("relate","relations"); detach needs ("unrelate","relations"). resolve is the
+;; injected token->principal auth policy (same shape as host/feed-write-routes).
+(define host/relations-write-routes
+  (fn (resolve)
+    (list
+      (dream-post "/internal/actions/attach-child"
+        (host/pipeline
+          (list
+            host/wrap-errors
+            (host/require-auth resolve)
+            (host/require-permission "relate" (fn (req) "relations")))
+          host/relations-attach))
+      (dream-post "/internal/actions/detach-child"
+        (host/pipeline
+          (list
+            host/wrap-errors
+            (host/require-auth resolve)
+            (host/require-permission "unrelate" (fn (req) "relations")))
+          host/relations-detach)))))

lib/host/router.sx

@@ -0,0 +1,25 @@
+;; lib/host/router.sx — Host application assembly. A host app is a single Dream
+;; router built from per-domain route groups, with a built-in health endpoint and
+;; a JSON 404 fallback so the native OCaml HTTP server has one entry point:
+;; request -> response. Each subsystem contributes a list of Dream routes (see
+;; lib/host/feed.sx); host/make-app concatenates them under one router.
+;; dr/flatten-routes (Dream) flattens the nested groups, so a group is just a list
+;; of routes. Depends on lib/dream/router.sx + lib/host/handler.sx + the host
+;; session middleware (lib/host/session.sx) and login routes (lib/host/auth.sx).
+
+;; Liveness probe — GET /health -> 200 {"ok":true,"data":"healthy"}.
+(define host/health-route
+  (dream-get "/health" (fn (req) (host/ok "healthy"))))
+
+;; Build the host app from a list of route groups (each a list of Dream routes).
+;; The health route + login routes are always mounted; Dream's router returns a
+;; JSON 404 for unmatched paths, which host endpoints override per-domain as
+;; needed. The WHOLE app is wrapped in the signed-session middleware so every
+;; request carries a session and any handler can log a principal in/out — this is
+;; the front door, so sessions are not optional.
+(define host/make-app
+  (fn (groups)
+    (let ((router (dream-router
+                    (cons host/health-route
+                      (cons host/auth-routes groups)))))
+      ((host/sessions) router))))

lib/host/serve.sh

@@ -0,0 +1,181 @@
+#!/usr/bin/env bash
+# host-on-sx live server launcher. Loads the kernel stdlib, the subsystem
+# libraries, and the host modules into one sx_server process, then calls
+# (host/serve PORT ...) which binds the native http-listen server to the
+# Dream-shaped host app. Runs in the FOREGROUND (http-listen blocks), so this
+# doubles as a container entrypoint and a local launcher.
+#
+# Usage:
+#   bash lib/host/serve.sh                 # serve on $HOST_PORT (default 8910)
+#   HOST_PORT=8920 bash lib/host/serve.sh  # pick a port
+#
+# The module list is kept identical to lib/host/conformance.sh so what serves is
+# exactly what the suites verify.
+
+set -uo pipefail
+# Project root: SX_PROJECT_DIR in containers (set to /app by the compose stack),
+# else the git toplevel for local runs.
+cd "${SX_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || echo .)}"
+
+SX_SERVER="${SX_SERVER:-hosts/ocaml/_build/default/bin/sx_server.exe}"
+if [ ! -x "$SX_SERVER" ]; then
+  SX_SERVER="/root/rose-ash/hosts/ocaml/_build/default/bin/sx_server.exe"
+fi
+if [ ! -x "$SX_SERVER" ]; then
+  echo "ERROR: sx_server.exe not found." >&2
+  exit 1
+fi
+
+PORT="${HOST_PORT:-8910}"
+
+# Modules: every load line from conformance.sh's MODULES list, minus the ledger
+# (not needed to serve). server.sx supplies host/serve.
+MODULES=(
+  "spec/stdlib.sx"
+  "lib/r7rs.sx"
+  "lib/apl/runtime.sx"
+  "lib/datalog/tokenizer.sx"
+  "lib/datalog/parser.sx"
+  "lib/datalog/unify.sx"
+  "lib/datalog/db.sx"
+  "lib/datalog/builtins.sx"
+  "lib/datalog/aggregates.sx"
+  "lib/datalog/strata.sx"
+  "lib/datalog/eval.sx"
+  "lib/datalog/api.sx"
+  "lib/datalog/magic.sx"
+  "lib/acl/schema.sx"
+  "lib/acl/facts.sx"
+  "lib/acl/engine.sx"
+  "lib/acl/explain.sx"
+  "lib/acl/audit.sx"
+  "lib/acl/federation.sx"
+  "lib/acl/api.sx"
+  "lib/relations/schema.sx"
+  "lib/relations/engine.sx"
+  "lib/relations/api.sx"
+  "lib/relations/explain.sx"
+  "lib/relations/federation.sx"
+  "lib/relations/tree.sx"
+  "lib/feed/normalize.sx"
+  "lib/feed/stream.sx"
+  "lib/feed/api.sx"
+  "lib/persist/event.sx"
+  "lib/persist/backend.sx"
+  "lib/persist/log.sx"
+  "lib/persist/kv.sx"
+  "lib/persist/api.sx"
+  "lib/persist/durable.sx"
+  "spec/render.sx"
+  "web/adapter-html.sx"
+  "lib/dream/types.sx"
+  "lib/dream/json.sx"
+  "lib/dream/auth.sx"
+  "lib/dream/error.sx"
+  "lib/dream/form.sx"
+  "lib/dream/session.sx"
+  "lib/dream/router.sx"
+  "lib/host/handler.sx"
+  "lib/host/middleware.sx"
+  "lib/host/session.sx"
+  "lib/host/auth.sx"
+  "lib/host/sxtp.sx"
+  "lib/host/router.sx"
+  "lib/host/static.sx"
+  "lib/host/sx/relate-picker.sx"
+  "lib/host/sx/kg-cards.sx"
+  "lib/host/feed.sx"
+  "lib/host/relations.sx"
+  "lib/host/compose.sx"
+  "lib/host/blog.sx"
+  "lib/host/server.sx"
+)
+
+# Admin login credentials + session signing secret. Override via the container
+# env; the in-source defaults are dev-only. The blog write routes are now GUARDED
+# (session login or Bearer), so these gate publishing on blog.rose-ash.com.
+ADMIN_USER="${SX_ADMIN_USER:-admin}"
+ADMIN_PASS="${SX_ADMIN_PASSWORD:-letmein}"
+SESSION_SECRET="${SX_SESSION_SECRET:-rose-ash-host-dev-secret-change-me}"
+
+EPOCH=1
+{
+  for M in "${MODULES[@]}"; do
+    echo "(epoch $EPOCH)"; echo "(load \"$M\")"; EPOCH=$((EPOCH+1))
+  done
+  # 100% serving JIT — NO host exclude. The serving-JIT perform-in-HO-callback
+  # miscompile (map/rest/drop wrong args → blank pages, empty picker) is fixed by
+  # two composing pieces: sx-vm-extensions 81177d0e resolves a callback's IO
+  # inline (instead of unwinding the native HO loop) WHEN a synchronous resolver
+  # is installed, and sx_server.ml's http-listen now installs that resolver (it
+  # mirrors cek_run_with_io exactly). So the whole request path — host app +
+  # Dream + Datalog — runs under JIT with no exclude. Verified: ephemeral durable
+  # server, 100% JIT, zero fallbacks, real content, picker lists candidates.
+  # Point the blog at the DURABLE file backend (persists under $SX_PERSIST_DIR),
+  # then idempotently seed a welcome post (sx_content = SX element markup, the
+  # editor's content model). Re-seeding is a no-op if the slug already exists.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/blog-use-store! (persist/durable-backend))\")"
+  EPOCH=$((EPOCH+1))
+  # Rebuild the relations graph from the durable edge store. lib/relations holds
+  # the graph in memory only, so without this, related/tags/types vanish on every
+  # restart even though the posts persist.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/blog-load-edges!)\")"
+  EPOCH=$((EPOCH+1))
+  # Sessions on the DURABLE store, LAZILY: only a logged-in session (one that
+  # writes a field) persists, so a login survives a restart while anonymous /
+  # crawler traffic leaves no rows. host/session-init! bumps the per-boot epoch
+  # that keeps sids unique across restarts. Then the signing secret + admin
+  # credentials, and grant admin "edit" on "blog" so a logged-in session passes
+  # the ACL gate on the write routes.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/session-use-store! (persist/durable-backend))\")"
+  EPOCH=$((EPOCH+1))
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/session-init!)\")"
+  EPOCH=$((EPOCH+1))
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/session-set-secret! \\\"$SESSION_SECRET\\\")\")"
+  EPOCH=$((EPOCH+1))
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/auth-set-admin! \\\"$ADMIN_USER\\\" \\\"$ADMIN_PASS\\\")\")"
+  EPOCH=$((EPOCH+1))
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(acl/load! (list (acl-grant \\\"$ADMIN_USER\\\" \\\"edit\\\" \\\"blog\\\")))\")"
+  EPOCH=$((EPOCH+1))
+  # Idempotently seed a welcome post (sx_content = SX element markup, the editor's
+  # content model). Re-seeding is a no-op if the slug already exists.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/blog-seed! \\\"welcome\\\" \\\"Welcome to the SX host\\\" \\\"(article (h1 \\\\\\\"Welcome to the SX host\\\\\\\") (p \\\\\\\"Rendered by lib/host via render-to-html, from the durable SX store.\\\\\\\"))\\\" \\\"published\\\")\")"
+  EPOCH=$((EPOCH+1))
+  # Seed the root type-posts (type, tag) — types ARE posts. Idempotent.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/blog-seed-types!)\")"
+  EPOCH=$((EPOCH+1))
+  # Seed a live demo of the composition fold (plans/composition-objects.md): /compose-demo
+  # is one composition object rendered by host/comp-render — renders differently by context.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/blog-seed-compose-demo!)\")"
+  EPOCH=$((EPOCH+1))
+  # Load relation metadata (symmetry/labels) from the relation-posts into the
+  # in-memory cache, so render paths read it without a (VmSuspending) durable read.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/blog-load-rel-kinds!)\")"
+  EPOCH=$((EPOCH+1))
+  # Index the web-stack .sxbc by content hash so /sx/h/{hash} can serve them
+  # immutably and the shell can emit the data-sx-manifest (content-addressed
+  # client module cache). Done once at boot.
+  echo "(epoch $EPOCH)"
+  echo "(eval \"(host/static-build-sxh-index!)\")"
+  EPOCH=$((EPOCH+1))
+  echo "(epoch $EPOCH)"
+  # Anonymous reads (feed timeline + relations container reads + blog post detail)
+  # plus the GUARDED blog write routes: POST /new (editor form ingest), POST/PUT/
+  # DELETE /posts behind host/require-user (session login OR Bearer) + ACL. make-app
+  # auto-mounts /login + /logout and wraps everything in the signed-session
+  # middleware, so a browser logs in then publishes. The bearer resolver is a stub
+  # (no API tokens configured) — browser session is the live auth path for now.
+  # blog-routes LAST — its GET /:slug catch-all must not shadow the rest.
+  echo "(eval \"(host/serve $PORT (list host/static-routes host/feed-routes host/relations-routes (host/blog-write-routes (fn (tok) nil)) host/blog-routes))\")"
+} | exec "$SX_SERVER"

lib/host/server.sx

@@ -0,0 +1,48 @@
+;; lib/host/server.sx — the live wiring: bridge the native OCaml http-listen
+;; server to the Dream-shaped host app, and serve. The native server hands a
+;; handler a STRING-keyed request dict {"method" "path" "query" "headers" "body"}
+;; and expects back {:status :headers :body}. The host app (host/make-app ->
+;; dream-router) is a fn dream-request -> dream-response. This module adapts
+;; between the two shapes and calls http-listen.
+;; Depends on lib/dream/* (dream-request/response accessors) + lib/host/router.sx
+;; + the kernel http-listen primitive.
+
+;; ── native request -> dream request ─────────────────────────────────
+;; Reassemble path + query into the target string dream-request parses, and carry
+;; method/headers/body. Missing fields default empty.
+(define host/-native->dream
+  (fn (req)
+    (let ((path (or (get req "path") "/"))
+          (query (or (get req "query") ""))
+          (method (or (get req "method") "GET"))
+          (headers (or (get req "headers") {}))
+          (body (or (get req "body") "")))
+      (let ((target (if (> (len query) 0) (str path "?" query) path)))
+        (dream-request method target headers body)))))
+
+;; ── dream response -> native response ───────────────────────────────
+;; dream-response is already {:body :headers :status}; the native server wants
+;; {:status :headers :body}. Same keys — normalise the shape explicitly so the
+;; contract is visible (and headers/body never nil). :set-cookies is a LIST of
+;; pre-formatted cookie strings (Dream's dream-set-cookie); the kernel http-listen
+;; emit serialises one Set-Cookie header per item (a headers dict can't hold more
+;; than one). Carry it through so sessions/login can set the cookie.
+(define host/-dream->native
+  (fn (resp)
+    {:status (dream-status resp)
+     :headers (or (dream-headers resp) {})
+     :set-cookies (dream-resp-cookies resp)
+     :body (or (dream-resp-body resp) "")}))
+
+;; ── adapter + serve ─────────────────────────────────────────────────
+;; Wrap a Dream app as a native http-listen handler.
+(define host/native-handler
+  (fn (app)
+    (fn (req)
+      (host/-dream->native (app (host/-native->dream req))))))
+
+;; Build the app from route groups and start the native server on `port`.
+;; Blocks (the http-listen primitive runs the server loop).
+(define host/serve
+  (fn (port groups)
+    (http-listen port (host/native-handler (host/make-app groups)))))

lib/host/session.sx

@@ -0,0 +1,81 @@
+;; lib/host/session.sx — durable, signed sessions for the host.
+;; Backs Dream's session middleware ops (session/create|exists|get|set|clear)
+;; with the SAME durable persist KV the blog uses, so a login survives restarts.
+;; The session cookie carries only a signed sid (dream-sessions-signed): the sid
+;; itself is a persisted monotonic counter ("s1", "s2", …) — cheap and ordered —
+;; and the HMAC signature (dr/sess-hash, keyed by host/session-secret) makes a
+;; guessed or forged cookie unusable. http-listen serialises handler calls under a
+;; mutex, so the counter increment is race-free.
+;;
+;; Depends on lib/dream/session.sx (dream-sessions-signed + cookie helpers) and
+;; lib/persist/* (the KV backend). Wired into host/make-app via host/sessions.
+
+;; ── store (durable persist KV, injectable; mirrors host/blog-store) ──
+(define host/session-store (persist/open))
+(define host/session-use-store! (fn (b) (set! host/session-store b)))
+
+;; ── signing secret (override from $SX_SESSION_SECRET in serve.sh) ────
+(define host/session-secret "rose-ash-host-dev-secret-change-me")
+(define host/session-set-secret! (fn (s) (set! host/session-secret s)))
+
+;; ── keys ────────────────────────────────────────────────────────────
+(define host/-sess-key (fn (sid) (str "session:" sid)))
+(define host/-sess-epoch-key "session:-epoch")
+
+;; sid generation: a per-BOOT epoch (one durable write at startup) + an in-memory
+;; counter. The epoch keeps sids unique across restarts WITHOUT a write per
+;; request, so anonymous traffic costs no disk. host/session-init! bumps the epoch
+;; on boot (serve.sh); without it (e.g. tests) epoch 0 is fine within one process.
+(define host/session-epoch 0)
+(define host/session-ctr 0)
+(define host/session-init!
+  (fn ()
+    (let ((e (+ 1 (or (persist/backend-kv-get host/session-store host/-sess-epoch-key) 0))))
+      (begin
+        (persist/backend-kv-put host/session-store host/-sess-epoch-key e)
+        (set! host/session-epoch e)
+        (set! host/session-ctr 0)))))
+(define host/-sess-next-sid
+  (fn ()
+    (begin
+      (set! host/session-ctr (+ host/session-ctr 1))
+      (str "s" host/session-epoch "-" host/session-ctr))))
+
+;; ── backend io fn: dispatch session/* ops onto the persist KV ───────
+;; LAZY: session/create mints a sid but writes NO row, so an anonymous request
+;; (which never sets a field) leaves no durable trace — the store isn't spammed by
+;; crawlers. The row appears on the first session/set (i.e. login), so a logged-in
+;; session persists and survives a restart; session/exists is "has a written row".
+(define host/session-backend
+  (fn (op)
+    (let ((kind (get op :op)))
+      (cond
+        ((= kind "session/create") (host/-sess-next-sid))
+        ((= kind "session/exists")
+          (persist/backend-kv-has? host/session-store (host/-sess-key (get op :sid))))
+        ((= kind "session/get")
+          (get
+            (or (persist/backend-kv-get host/session-store (host/-sess-key (get op :sid))) {})
+            (get op :key)))
+        ((= kind "session/set")
+          (let ((sid (get op :sid)))
+            (persist/backend-kv-put host/session-store (host/-sess-key sid)
+              (assoc
+                (or (persist/backend-kv-get host/session-store (host/-sess-key sid)) {})
+                (get op :key)
+                (get op :val)))))
+        ((= kind "session/load")
+          (or (persist/backend-kv-get host/session-store (host/-sess-key (get op :sid))) {}))
+        ((= kind "session/clear")
+          (persist/backend-kv-delete host/session-store (host/-sess-key (get op :sid))))
+        (else nil)))))
+
+;; ── middleware for the host pipeline: signed cookie + durable backend ─
+(define host/sessions
+  (fn () (dream-sessions-signed host/session-backend host/session-secret)))
+
+;; ── handler-facing helpers ──────────────────────────────────────────
+;; The logged-in principal (or nil), and login/logout writing the session field.
+(define host/current-principal (fn (req) (dream-session-field req :principal)))
+(define host/login! (fn (req principal) (dream-set-session-field req :principal principal)))
+(define host/logout! (fn (req) (dream-invalidate-session req)))

lib/host/static.sx

@@ -0,0 +1,118 @@
+;; lib/host/static.sx — serve the client kernel + assets so the blog can boot the
+;; SX-htmx hypermedia engine (web/engine.sx) and run as a SPA. The native
+;; http-listen host reads files with the `file-read` primitive (no perform), so
+;; GET /static/** maps to a file under the static root (default "shared/static",
+;; resolved against the server cwd — mount ./shared/static there in the container).
+;;
+;; Also wires the CONTENT-ADDRESSED module cache the SX client expects: GET
+;; /sx/h/{hash} serves a web-stack .sxbc by its content hash (immutable, never
+;; stale — a deploy changes the content → changes the hash → a fresh URL), and a
+;; <script data-sx-manifest> mapping {file -> hash} makes the client's
+;; loadBytecodeFile take the content-addressed branch (localStorage + immutable)
+;; instead of the path + max-age=3600 branch.
+;; Depends on lib/dream/types.sx (dream-response/-html-status/-param) + router.
+
+(define host/static-root "shared/static")
+(define host/static-use-root! (fn (r) (set! host/static-root r)))
+
+;; content-type by file extension; default to octet-stream.
+(define host/static--ctype
+  (fn (path)
+    (cond
+      ((ends-with? path ".js")    "application/javascript; charset=utf-8")
+      ((ends-with? path ".mjs")   "application/javascript; charset=utf-8")
+      ((ends-with? path ".css")   "text/css; charset=utf-8")
+      ((ends-with? path ".json")  "application/json; charset=utf-8")
+      ((ends-with? path ".map")   "application/json; charset=utf-8")
+      ((ends-with? path ".svg")   "image/svg+xml")
+      ((ends-with? path ".png")   "image/png")
+      ((ends-with? path ".woff2") "font/woff2")
+      ((ends-with? path ".wasm")  "application/wasm")
+      (true                       "application/octet-stream"))))
+
+;; A content-hashed filename (e.g. js_of_ocaml-651f6707.wasm, or anything under
+;; /sx/h/) is immutable; everything else gets a modest max-age (mutable bundle).
+(define host/static--cache-control
+  (fn (rel)
+    (if (ends-with? rel ".wasm")
+      "public, max-age=31536000, immutable"
+      "public, max-age=3600")))
+
+;; reject empty, absolute, or traversal paths.
+(define host/static--safe?
+  (fn (rel)
+    (and (> (len rel) 0)
+         (not (starts-with? rel "/"))
+         (not (string-contains? rel "..")))))
+
+;; Serve one asset by its path relative to the static root. file-read THROWS on a
+;; missing file, so gate on file-exists? first and return a 404 instead.
+(define host/static-serve
+  (fn (rel)
+    (if (not (host/static--safe? rel))
+      (dream-html-status 403 "Forbidden")
+      (let ((path (str host/static-root "/" rel)))
+        (if (not (file-exists? path))
+          (dream-html-status 404 "Not Found")
+          (dream-response 200
+            {:content-type (host/static--ctype rel)
+             :cache-control (host/static--cache-control rel)}
+            (file-read path)))))))
+
+;; ── content-addressed module cache (/sx/h/{hash}) ───────────────────
+;; Each web-stack .sxbc carries its content hash in its head: (sxbc 1 "HASH" ...).
+;; Index every .sxbc by that hash at startup so the client can fetch each module
+;; immutably + localStorage-cached, and never stale.
+(define host/static--sxh->path (dict))   ;; hash -> filepath
+(define host/static--file->hash (dict))  ;; "dom.sxbc" -> hash
+
+;; the embedded hash from a .sxbc head: (sxbc 1 "HASH" ...  -> "HASH"
+(define host/static--sxbc-hash
+  (fn (head) (nth (split head "\"") 1)))
+
+(define host/static-build-sxh-index!
+  (fn ()
+    (for-each
+      (fn (path)
+        (let ((h (host/static--sxbc-hash (substr (file-read path) 0 60)))
+              (base (last (split path "/"))))
+          (dict-set! host/static--sxh->path h path)
+          (dict-set! host/static--file->hash base h)))
+      (file-glob (str host/static-root "/wasm/sx/*.sxbc")))))
+
+;; GET /sx/h/{hash} -> the .sxbc content, immutable (content-addressed).
+(define host/static-sxh-serve
+  (fn (hash)
+    (let ((path (get host/static--sxh->path hash)))
+      (if (nil? path)
+        (dream-html-status 404 "Not Found")
+        (dream-response 200
+          {:content-type "text/sx; charset=utf-8"
+           :cache-control "public, max-age=31536000, immutable"}
+          (file-read path))))))
+
+;; the data-sx-manifest JSON for the shell: {"modules": {"dom.sxbc": "hash", ...}}.
+;; The client's loadBytecodeFile reads manifest.modules[file] -> hash -> /sx/h/.
+;; App components the client must eager-load (after the web stack) so their
+;; defcomps are registered before a boosted fragment references them. Loaded
+;; content-addressed via the modules map below, the same as any web-stack module.
+(define host/static--boot-modules (list "relate-picker.sxbc"))
+
+(define host/static-manifest-json
+  (fn ()
+    (str "{\"v\":1,\"boot\":["
+      (join "," (map (fn (m) (str "\"" m "\"")) host/static--boot-modules))
+      "],\"defs\":{},\"modules\":{"
+      (join ","
+        (map (fn (k) (str "\"" k "\":\"" (get host/static--file->hash k) "\""))
+          (keys host/static--file->hash)))
+      "}}")))
+
+;; Route group: GET /static/** (path) + GET /sx/h/** (content-addressed). A plain
+;; route LIST (like host/feed-routes); host/serve combines + flattens the groups.
+(define host/static-routes
+  (list
+    (dream-get "/static/**"
+      (fn (req) (host/static-serve (dream-param req "**"))))
+    (dream-get "/sx/h/**"
+      (fn (req) (host/static-sxh-serve (dream-param req "**"))))))

lib/host/sx/kg-cards.sx

@@ -0,0 +1,157 @@
+;; KG card components — Ghost/Koenig-compatible card rendering, copied into the host
+;; so it can render imported Ghost posts (sx_content holds (~kg_cards/kg-*) from the
+;; lexical_to_sx converter). Produces the same HTML structure as lexical_renderer.py.
+;;
+;; ~rich-text: the host-local dep these cards need (raw HTML injection). Defined here
+;; (it was only a test fixture before) so kg-html/kg-bookmark/etc. resolve in the host.
+(defcomp ~rich-text (&key (html :as string)) (raw! html))
+
+;; @css kg-card kg-image-card kg-width-wide kg-width-full kg-gallery-card kg-gallery-container kg-gallery-row kg-gallery-image kg-embed-card kg-bookmark-card kg-bookmark-container kg-bookmark-content kg-bookmark-title kg-bookmark-description kg-bookmark-metadata kg-bookmark-icon kg-bookmark-author kg-bookmark-publisher kg-bookmark-thumbnail kg-callout-card kg-callout-emoji kg-callout-text kg-button-card kg-btn kg-btn-accent kg-toggle-card kg-toggle-heading kg-toggle-heading-text kg-toggle-card-icon kg-toggle-content kg-audio-card kg-audio-thumbnail kg-audio-player-container kg-audio-title kg-audio-player kg-audio-play-icon kg-audio-current-time kg-audio-time kg-audio-seek-slider kg-audio-playback-rate kg-audio-unmute-icon kg-audio-volume-slider kg-video-card kg-video-container kg-file-card kg-file-card-container kg-file-card-contents kg-file-card-title kg-file-card-filesize kg-file-card-icon kg-file-card-caption kg-align-center kg-align-left kg-callout-card-grey kg-callout-card-white kg-callout-card-blue kg-callout-card-green kg-callout-card-yellow kg-callout-card-red kg-callout-card-pink kg-callout-card-purple kg-callout-card-accent kg-html-card kg-md-card placeholder
+
+;; ---------------------------------------------------------------------------
+;; Image card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-image (&key (src :as string) (alt :as string?) (caption :as string?) (width :as string?) (href :as string?))
+  (figure :class (str "kg-card kg-image-card"
+                   (if (= width "wide") " kg-width-wide"
+                     (if (= width "full") " kg-width-full" "")))
+    (if href
+      (a :href href (img :src src :alt (or alt "") :loading "lazy"))
+      (img :src src :alt (or alt "") :loading "lazy"))
+    (when caption (figcaption caption))))
+
+;; ---------------------------------------------------------------------------
+;; Gallery card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-gallery (&key (images :as list) (caption :as string?))
+  (figure :class "kg-card kg-gallery-card kg-width-wide"
+    (div :class "kg-gallery-container"
+      (map (lambda (row)
+        (div :class "kg-gallery-row"
+          (map (lambda (img-data)
+            (figure :class "kg-gallery-image"
+              (img :src (get img-data "src") :alt (or (get img-data "alt") "") :loading "lazy")
+              (when (get img-data "caption") (figcaption (get img-data "caption")))))
+            row)))
+        images))
+    (when caption (figcaption caption))))
+
+;; ---------------------------------------------------------------------------
+;; HTML card — wraps user-pasted HTML so the editor can identify the block.
+;; Content is native sx children (no longer an opaque HTML string).
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-html (&rest children)
+  (div :class "kg-card kg-html-card" children))
+
+;; ---------------------------------------------------------------------------
+;; Markdown card — rendered markdown content, editor can identify the block.
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-md (&rest children)
+  (div :class "kg-card kg-md-card" children))
+
+;; ---------------------------------------------------------------------------
+;; Embed card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-embed (&key (html :as string) (caption :as string?))
+  (figure :class "kg-card kg-embed-card"
+    (~rich-text :html html)
+    (when caption (figcaption caption))))
+
+;; ---------------------------------------------------------------------------
+;; Bookmark card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-bookmark (&key (url :as string) (title :as string?) (description :as string?) (icon :as string?) (author :as string?) (publisher :as string?) (thumbnail :as string?) (caption :as string?))
+  (figure :class "kg-card kg-bookmark-card"
+    (a :class "kg-bookmark-container" :href url
+      (div :class "kg-bookmark-content"
+        (div :class "kg-bookmark-title" (or title ""))
+        (div :class "kg-bookmark-description" (or description ""))
+        (when (or icon author publisher)
+          (span :class "kg-bookmark-metadata"
+            (when icon (img :class "kg-bookmark-icon" :src icon :alt ""))
+            (when author (span :class "kg-bookmark-author" author))
+            (when publisher (span :class "kg-bookmark-publisher" publisher)))))
+      (when thumbnail
+        (div :class "kg-bookmark-thumbnail"
+          (img :src thumbnail :alt ""))))
+    (when caption (figcaption caption))))
+
+;; ---------------------------------------------------------------------------
+;; Callout card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-callout (&key (color :as string?) (emoji :as string?) (content :as string?))
+  (div :class (str "kg-card kg-callout-card kg-callout-card-" (or color "grey"))
+    (when emoji (div :class "kg-callout-emoji" emoji))
+    (div :class "kg-callout-text" (or content ""))))
+
+;; ---------------------------------------------------------------------------
+;; Button card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-button (&key (url :as string) (text :as string?) (alignment :as string?))
+  (div :class (str "kg-card kg-button-card kg-align-" (or alignment "center"))
+    (a :href url :class "kg-btn kg-btn-accent" (or text ""))))
+
+;; ---------------------------------------------------------------------------
+;; Toggle card (accordion)
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-toggle (&key (heading :as string?) (content :as string?))
+  (div :class "kg-card kg-toggle-card" :data-kg-toggle-state "close"
+    (div :class "kg-toggle-heading"
+      (h4 :class "kg-toggle-heading-text" (or heading ""))
+      (button :class "kg-toggle-card-icon"
+        (~rich-text :html "<svg viewBox=\"0 0 14 14\"><path d=\"M7 0a.5.5 0 0 1 .5.5v6h6a.5.5 0 1 1 0 1h-6v6a.5.5 0 1 1-1 0v-6h-6a.5.5 0 0 1 0-1h6v-6A.5.5 0 0 1 7 0Z\" fill=\"currentColor\"/></svg>")))
+    (div :class "kg-toggle-content" (or content ""))))
+
+;; ---------------------------------------------------------------------------
+;; Audio card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-audio (&key (src :as string) (title :as string?) (duration :as string?) (thumbnail :as string?))
+  (div :class "kg-card kg-audio-card"
+    (if thumbnail
+      (img :src thumbnail :alt "audio-thumbnail" :class "kg-audio-thumbnail")
+      (div :class "kg-audio-thumbnail placeholder"
+        (~rich-text :html "<svg viewBox=\"0 0 24 24\"><path d=\"M2 12C2 6.48 6.48 2 12 2s10 4.48 10 10-4.48 10-10 10S2 17.52 2 12zm7.5 5.25L16 12 9.5 6.75v10.5z\" fill=\"currentColor\"/></svg>")))
+    (div :class "kg-audio-player-container"
+      (div :class "kg-audio-title" (or title ""))
+      (div :class "kg-audio-player"
+        (button :class "kg-audio-play-icon"
+          (~rich-text :html "<svg viewBox=\"0 0 24 24\"><path d=\"M8 5v14l11-7z\" fill=\"currentColor\"/></svg>"))
+        (div :class "kg-audio-current-time" "0:00")
+        (div :class "kg-audio-time" (str "/ " (or duration "0:00")))
+        (input :type "range" :class "kg-audio-seek-slider" :max "100" :value "0")
+        (button :class "kg-audio-playback-rate" "1×")
+        (button :class "kg-audio-unmute-icon"
+          (~rich-text :html "<svg viewBox=\"0 0 24 24\"><path d=\"M3 9v6h4l5 5V4L7 9H3zm13.5 3c0-1.77-1.02-3.29-2.5-4.03v8.05c1.48-.73 2.5-2.25 2.5-4.02zM14 3.23v2.06c2.89.86 5 3.54 5 6.71s-2.11 5.85-5 6.71v2.06c4.01-.91 7-4.49 7-8.77s-2.99-7.86-7-8.77z\" fill=\"currentColor\"/></svg>"))
+        (input :type "range" :class "kg-audio-volume-slider" :max "100" :value "100")))
+    (audio :src src :preload "metadata")))
+
+;; ---------------------------------------------------------------------------
+;; Video card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-video (&key (src :as string) (caption :as string?) (width :as string?) (thumbnail :as string?) (loop :as boolean?))
+  (figure :class (str "kg-card kg-video-card"
+                   (if (= width "wide") " kg-width-wide"
+                     (if (= width "full") " kg-width-full" "")))
+    (div :class "kg-video-container"
+      (video :src src :controls true :preload "metadata"
+        :poster (or thumbnail nil) :loop (or loop nil)))
+    (when caption (figcaption caption))))
+
+;; ---------------------------------------------------------------------------
+;; File card
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-file (&key (src :as string) (filename :as string?) (title :as string?) (filesize :as string?) (caption :as string?))
+  (div :class "kg-card kg-file-card"
+    (a :class "kg-file-card-container" :href src :download (or filename "")
+      (div :class "kg-file-card-contents"
+        (div :class "kg-file-card-title" (or title filename ""))
+        (when filesize (div :class "kg-file-card-filesize" filesize)))
+      (div :class "kg-file-card-icon"
+        (~rich-text :html "<svg viewBox=\"0 0 24 24\"><path d=\"M19 9h-4V3H9v6H5l7 7 7-7zM5 18v2h14v-2H5z\" fill=\"currentColor\"/></svg>")))
+    (when caption (div :class "kg-file-card-caption" caption))))
+
+;; ---------------------------------------------------------------------------
+;; Paywall marker
+;; ---------------------------------------------------------------------------
+(defcomp ~kg_cards/kg-paywall ()
+  (~rich-text :html "<!--members-only-->"))

lib/host/sx/relate-picker.sx

@@ -0,0 +1,39 @@
+;; lib/host/sx/relate-picker.sx — the relate picker as a reusable, content-addressed
+;; SX component. On a FULL load render-page expands it server-side (SEO / no-JS); on a
+;; boosted SPA nav the edit body is serialized as `(~relate-picker :slug … :kind …)`
+;; and the CLIENT expands it — the component module is loaded content-addressed via
+;; the data-sx-manifest at boot, so its defcomp is registered before any fragment
+;; referencing it arrives.
+;;
+;; Pure markup, no client JS: the form GETs /<slug>/relate-options serialising kind +
+;; the filter q (a FORM is serialised on GET, a bare input is not), innerHTML-swapping
+;; the results <ul> on "load" and on a debounced "input". Paging is server-driven —
+;; each full page carries a "load more" sentinel (sx-trigger revealed) the endpoint
+;; emits. sx-retry makes a dropped/offline fetch self-heal; the engine's .sx-error
+;; class (styled by the host shell) surfaces a stuck retry. The engine re-binds these
+;; triggers on swapped-in content, so it works on full load AND boosted nav.
+(defcomp
+  ~relate-picker
+  (&key slug kind)
+  (form
+    :class "relate-picker"
+    :data-slug slug
+    :data-kind kind
+    :sx-get (str "/" slug "/relate-options")
+    :sx-trigger "input delay:200ms, load"
+    :sx-target (str "#rp-" kind "-results")
+    :sx-swap "innerHTML"
+    :sx-retry "exponential:1000:30000"
+    :style "margin:0"
+    (input :type "hidden" :name "kind" :value kind)
+    (input
+      :type "text"
+      :name "q"
+      :class "rp-filter"
+      :placeholder "filter…"
+      :autocomplete "off"
+      :style "width:100%;padding:0.4em;box-sizing:border-box")
+    (ul
+      :id (str "rp-" kind "-results")
+      :class "rp-results"
+      :style "list-style:none;padding:0;margin:0.5em 0;border:1px solid #ddd")))

lib/host/sxtp.sx

@@ -0,0 +1,224 @@
+;; lib/host/sxtp.sx — SXTP, the host<->subsystem wire format. SXTP messages are
+;; SX s-expressions (content-type text/sx): a request/response/condition/event is
+;; a tagged list `(request :verb navigate :path "/x" ...)`. See the protocol spec
+;; at applications/sxtp/spec.sx.
+;;
+;; Representation: internally a message is a plain dict tagged by :msg ("request"
+;; /"response"/"condition"/"event"/"patch"/"signals"), with string keys so the
+;; keyword==string rule makes construction and access trivial. verb/status/type/
+;; mode are stored as SYMBOLS (they ride the wire bare, not quoted). The wire
+;; LIST form is produced/consumed only at the serialise/parse boundary:
+;;   sxtp/serialize : msg-dict -> text/sx string
+;;   sxtp/parse     : text/sx string -> msg-dict
+;; A Dream HTTP request/response bridges to/from SXTP via sxtp/from-dream and
+;; sxtp/to-dream, so the host can speak SXTP to subsystems while serving HTTP.
+;; Depends on lib/dream/types.sx (dream-response + request/response accessors).
+
+;; ── helpers ────────────────────────────────────────────────────────
+(define sxtp/-sym
+  (fn (x) (if (= (type-of x) "symbol") x (string->symbol x))))
+(define sxtp/-name
+  (fn (x) (if (= (type-of x) "symbol") (symbol->string x) x)))
+
+;; ── constructors ───────────────────────────────────────────────────
+;; opts is a dict of optional fields (e.g. {:headers .. :params .. :body ..}).
+(define sxtp/request
+  (fn (verb path opts)
+    (merge {:msg "request" :verb (sxtp/-sym verb) :path path} opts)))
+(define sxtp/response
+  (fn (status opts)
+    (merge {:msg "response" :status (sxtp/-sym status)} opts)))
+(define sxtp/condition
+  (fn (ctype opts)
+    (merge {:msg "condition" :type (sxtp/-sym ctype)} opts)))
+(define sxtp/event
+  (fn (etype opts)
+    (merge {:msg "event" :type (sxtp/-sym etype)} opts)))
+
+;; Patch (Datastar-borrowed) — DOM fragment morph.
+;; target: CSS selector (required). mode in opts defaults to outer; accepts
+;; string OR symbol and is normalised. mode values: outer | inner | replace |
+;; prepend | append | before | after | remove. body: SX subtree (omit for remove).
+(define sxtp/patch
+  (fn (target opts)
+    (let ((mode (or (get opts :mode) "outer")))
+      (merge opts {:msg "patch" :target target :mode (sxtp/-sym mode)}))))
+
+;; Signals (Datastar-borrowed) — reactive state patch.
+;; values: dict of signal-name -> new-value (nil removes). only-if-missing: bool.
+(define sxtp/signals
+  (fn (values opts)
+    (merge {:msg "signals" :values values} opts)))
+
+;; ── predicates ─────────────────────────────────────────────────────
+(define sxtp/-is?
+  (fn (m tag) (and (= (type-of m) "dict") (= (get m :msg) tag))))
+(define sxtp/request? (fn (m) (sxtp/-is? m "request")))
+(define sxtp/response? (fn (m) (sxtp/-is? m "response")))
+(define sxtp/condition? (fn (m) (sxtp/-is? m "condition")))
+(define sxtp/event? (fn (m) (sxtp/-is? m "event")))
+(define sxtp/patch? (fn (m) (sxtp/-is? m "patch")))
+(define sxtp/signals? (fn (m) (sxtp/-is? m "signals")))
+
+;; ── accessors ──────────────────────────────────────────────────────
+(define sxtp/verb (fn (m) (get m :verb)))
+(define sxtp/path (fn (m) (get m :path)))
+(define sxtp/req-headers (fn (m) (get m :headers)))
+(define sxtp/params (fn (m) (get m :params)))
+(define sxtp/param (fn (m name) (get (get m :params) name)))
+(define sxtp/body (fn (m) (get m :body)))
+(define sxtp/capabilities (fn (m) (get m :capabilities)))
+(define sxtp/status (fn (m) (get m :status)))
+(define sxtp/resp-headers (fn (m) (get m :headers)))
+(define sxtp/stream? (fn (m) (= (get m :stream) true)))
+(define sxtp/cond-type (fn (m) (get m :type)))
+(define sxtp/cond-message (fn (m) (get m :message)))
+(define sxtp/target (fn (m) (get m :target)))
+(define sxtp/mode (fn (m) (get m :mode)))
+(define sxtp/values (fn (m) (get m :values)))
+(define sxtp/only-if-missing? (fn (m) (= (get m :only-if-missing) true)))
+(define sxtp/transition? (fn (m) (= (get m :transition) true)))
+
+;; ── status helpers (build responses) ───────────────────────────────
+(define sxtp/ok (fn (body) (sxtp/response "ok" {:body body})))
+(define sxtp/created (fn (body) (sxtp/response "created" {:body body})))
+(define sxtp/no-content (fn () (sxtp/response "no-content" {})))
+(define sxtp/not-found
+  (fn (path message)
+    (sxtp/response "not-found"
+      {:body (sxtp/condition "resource-not-found"
+               {:path path :message message :retry false})})))
+(define sxtp/forbidden
+  (fn (message)
+    (sxtp/response "forbidden"
+      {:body (sxtp/condition "forbidden" {:message message})})))
+(define sxtp/invalid
+  (fn (message)
+    (sxtp/response "invalid"
+      {:body (sxtp/condition "invalid" {:message message})})))
+(define sxtp/fail
+  (fn (message)
+    (sxtp/response "error"
+      {:body (sxtp/condition "error" {:message message})})))
+
+;; ── HTTP <-> SXTP mappings ─────────────────────────────────────────
+(define sxtp/-method-verbs
+  {:GET "fetch" :HEAD "fetch" :POST "create"
+   :PUT "mutate" :PATCH "mutate" :DELETE "delete" :OPTIONS "inspect"})
+(define sxtp/verb-for-method
+  (fn (method) (sxtp/-sym (get sxtp/-method-verbs (upper method) "fetch"))))
+
+(define sxtp/-status-http
+  {:ok 200 :created 201 :accepted 202 :no-content 204 :redirect 302
+   :not-modified 304 :error 500 :not-found 404 :forbidden 403
+   :invalid 400 :conflict 409 :unavailable 503})
+(define sxtp/http-status
+  (fn (status) (get sxtp/-status-http (sxtp/-name status) 200)))
+
+;; ── Dream bridge ───────────────────────────────────────────────────
+;; HTTP request -> SXTP request: method->verb, query->params, headers/body carry.
+(define sxtp/from-dream
+  (fn (req)
+    (sxtp/request
+      (sxtp/verb-for-method (get req :method))
+      (get req :path)
+      {:headers (get req :headers)
+       :params (get req :query)
+       :body (get req :body)})))
+
+;; SXTP response -> HTTP response: status->code, body serialised to text/sx.
+(define sxtp/-body-text
+  (fn (b) (if (nil? b) "" (serialize b))))
+(define sxtp/to-dream
+  (fn (resp)
+    (dream-response
+      (sxtp/http-status (sxtp/status resp))
+      (merge {:content-type "text/sx"} (or (sxtp/resp-headers resp) {}))
+      (sxtp/-body-text (sxtp/body resp)))))
+
+;; ── wire serialise (msg-dict -> text/sx) ───────────────────────────
+;; Top-level field order is fixed per message type so output is deterministic;
+;; nested dict/value order follows the serialize primitive.
+(define sxtp/-field-order
+  {:request (list :verb :path :headers :cookies :params :capabilities :body)
+   :response (list :status :headers :set-cookie :body :stream)
+   :condition (list :type :message :path :retry :detail)
+   :event (list :type :id :body :time)
+   :patch (list :target :mode :body :transition)
+   :signals (list :values :only-if-missing)})
+;; A nested SXTP message (a condition/event in a :body) serialises in its own
+;; list form; plain data values go through the serialize primitive.
+(define sxtp/-emit-value
+  (fn (v)
+    (if (and (= (type-of v) "dict") (has-key? v :msg))
+      (sxtp/serialize v)
+      (serialize v))))
+(define sxtp/serialize
+  (fn (msg)
+    (let ((head (get msg :msg)))
+      (let ((order (get sxtp/-field-order head)))
+        (str "("
+          head
+          (reduce
+            (fn (acc k)
+              (if (has-key? msg k)
+                (str acc " :" k " " (sxtp/-emit-value (get msg k)))
+                acc))
+            ""
+            order)
+          ")")))))
+
+;; ── wire parse (text/sx -> msg-dict) ───────────────────────────────
+;; parse yields a list with keyword-token keys and possibly keyword-token dict
+;; keys; sxtp/-normalize deep-converts those tokens to strings so the result is
+;; the same string-keyed shape the constructors produce.
+(define sxtp/-normalize
+  (fn (v)
+    (let ((t (type-of v)))
+      (cond
+        ((= t "keyword") (str v))
+        ((= t "dict")
+          (reduce
+            (fn (acc k) (assoc acc (str k) (sxtp/-normalize (get v k))))
+            {}
+            (keys v)))
+        ((= t "list") (map sxtp/-normalize v))
+        (true v)))))
+(define sxtp/-pairs->dict
+  (fn (kvs acc)
+    (if (< (len kvs) 2)
+      acc
+      (sxtp/-pairs->dict
+        (rest (rest kvs))
+        (assoc acc (str (first kvs)) (sxtp/-normalize (first (rest kvs))))))))
+(define sxtp/parse
+  (fn (text)
+    (let ((lst (parse text)))
+      (sxtp/-pairs->dict (rest lst) {:msg (symbol->string (first lst))}))))
+
+;; ── host write-body: a request's text/sx body -> string-keyed dict ──
+;; The write-side counterpart to host/sx-status: the SX engine posts text/sx for
+;; writes (boosted forms serialise their fields), so write handlers read the body
+;; through this instead of dream-json-body. parse-safe yields keyword-token keys;
+;; sxtp/-normalize deep-converts them to strings so (get p :field) works — the same
+;; shape dream-json-body produced from JSON. Empty / blank / non-dict / unparseable
+;; body -> nil (handlers then return 400).
+(define host/sx-body
+  (fn (req)
+    (let ((raw (dream-body req)))
+      (if (or (nil? raw) (= raw ""))
+        nil
+        (let ((v (parse-safe raw)))
+          (if (= (type-of v) "dict") (sxtp/-normalize v) nil))))))
+
+;; ── unified write-field reader: text/sx body OR urlencoded form ─────
+;; A boosted form posts text/sx (the SX engine serialises its fields); a no-engine
+;; / pre-hydration submit (and the login bootstrap) posts urlencoded. Content-type
+;; decides. host/fields returns ALL fields as one string-keyed dict; host/field
+;; reads one by name. Form handlers read through these so both encodings work.
+(define host/fields
+  (fn (req)
+    (if (contains? (or (dream-content-type-of req) "") "text/sx")
+      (or (host/sx-body req) {})
+      (or (dream-form-fields req) {}))))
+(define host/field (fn (req name) (get (host/fields req) name)))

lib/host/tests/blog.sx

@@ -0,0 +1,805 @@
+;; lib/host/tests/blog.sx — blog on the editor's content model. Posts are
+;; {slug,title,sx_content,status} records in the durable KV; a post page is
+;; render-to-html(parse sx_content). Covers read/render, home index, JSON list,
+;; slugify, the form-urlencoded editor ingest, and JSON CRUD (auth+ACL guarded).
+
+(define host-bl-pass 0)
+(define host-bl-fail 0)
+(define host-bl-fails (list))
+(define
+  host-bl-test
+  (fn (name actual expected)
+    (if (= actual expected)
+      (set! host-bl-pass (+ host-bl-pass 1))
+      (begin
+        (set! host-bl-fail (+ host-bl-fail 1))
+        (append! host-bl-fails {:name name :actual actual :expected expected})))))
+
+(define host-bl-req (fn (target) (dream-request "GET" target {} "")))
+(define host-bl-app (host/make-app (list host/feed-routes host/blog-routes)))
+
+;; ── slugify ─────────────────────────────────────────────────────────
+(host-bl-test "slugify" (host/blog-slugify "Hello World") "hello-world")
+(host-bl-test "slugify trims spaces" (host/blog-slugify "  A  B ") "a-b")
+
+;; ── render a stored post ────────────────────────────────────────────
+(host/blog-use-store! (persist/open))
+(host/blog-put! "hello" "Hello World"
+  "(article (h1 \"Hello World\") (p \"A \" (strong \"bold\") \" word.\"))" "published")
+
+(host-bl-test "post 200" (dream-status (host-bl-app (host-bl-req "/hello/"))) 200)
+(host-bl-test "post content-type html"
+  (contains? (dream-resp-header (host-bl-app (host-bl-req "/hello/")) "content-type") "text/html")
+  true)
+(host-bl-test "post renders sx_content markup"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/hello/"))) "<strong>bold</strong>")
+  true)
+(host-bl-test "post title in page"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/hello/"))) "<title>Hello World</title>")
+  true)
+
+;; ── home + list ─────────────────────────────────────────────────────
+(host-bl-test "home lists post"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/"))) "href=\"/hello/\"")
+  true)
+(host-bl-test "sx list shows post"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/posts"))) ":slug \"hello\"")
+  true)
+(host-bl-test "GET /new shows form"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/new"))) "<form")
+  true)
+
+;; ── unknown + precedence ────────────────────────────────────────────
+(host-bl-test "unknown slug 404" (dream-status (host-bl-app (host-bl-req "/nope/"))) 404)
+(feed/reset!)
+(host-bl-test "/feed not captured by :slug"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/feed"))) ":ok true")
+  true)
+
+;; ── writes: editor form ingest + JSON CRUD (auth+ACL) ───────────────
+(acl/load! (list (acl-grant "editor" "edit" "blog")))
+(define host-bl-resolve
+  (fn (tok) (cond ((= tok "good") "editor") ((= tok "weak") "reader") (true nil))))
+(define host-bl-wapp
+  (host/make-app (list (host/blog-write-routes host-bl-resolve) host/blog-routes)))
+(define host-bl-send
+  (fn (method target auth ctype body)
+    (dream-request method target
+      (merge (if auth {:authorization auth} {}) (if ctype {:content-type ctype} {})) body)))
+
+(host/blog-use-store! (persist/open))
+
+;; -- editor form ingest (form-urlencoded, the editor's submit shape) --
+(host-bl-test "form ingest no auth -> redirect to login"
+  (dream-status (host-bl-wapp (host-bl-send "POST" "/new" nil
+    "application/x-www-form-urlencoded" "title=X")))
+  303)
+(host-bl-test "form ingest no auth Location is /login"
+  (contains? (dream-resp-header (host-bl-wapp (host-bl-send "POST" "/new" nil
+    "application/x-www-form-urlencoded" "title=X")) "location") "/login")
+  true)
+(host-bl-test "form ingest authed -> 303 redirect"
+  (dream-status (host-bl-wapp (host-bl-send "POST" "/new" "Bearer good"
+    "application/x-www-form-urlencoded"
+    "title=My+First+Post&sx_content=(article+(h1+%22My+First+Post%22)+(p+%22Hi%22))&status=published")))
+  303)
+(host-bl-test "form ingest set Location to the new slug"
+  (dream-resp-header
+    (host-bl-wapp (host-bl-send "POST" "/new" "Bearer good"
+      "application/x-www-form-urlencoded"
+      "title=Another+One&sx_content=(p+%22x%22)&status=published"))
+    "location")
+  "/another-one/")
+(host-bl-test "ingested post renders"
+  (contains? (dream-resp-body (host-bl-wapp (host-bl-req "/my-first-post/"))) "<h1>My First Post</h1>")
+  true)
+
+;; (JSON CRUD tests removed — the /posts JSON create/update/delete endpoints were
+;; deleted in the SX-native pivot; create + edit go through the form ingest above.)
+
+;; -- write-time validation: malformed sx_content rejected, never stored --
+;; "%3Ch1+broken%29" decodes to "<h1 broken)" — a typo'd paren the parser rejects.
+(host-bl-test "form ingest malformed sx_content -> 400"
+  (dream-status (host-bl-wapp (host-bl-send "POST" "/new" "Bearer good"
+    "application/x-www-form-urlencoded"
+    "title=Bad+Form&sx_content=%3Ch1+broken%29&status=published")))
+  400)
+(host-bl-test "rejected form post was not stored"
+  (dream-status (host-bl-wapp (host-bl-req "/bad-form/")))
+  404)
+;; (JSON malformed-content tests removed with the JSON CRUD endpoints; the form
+;; ingest malformed-content checks above still cover write-time validation.)
+
+;; -- view source (public) --
+(host-bl-test "view source -> 200"
+  (dream-status (host-bl-wapp (host-bl-req "/my-first-post/source"))) 200)
+(host-bl-test "view source is text/plain"
+  (dream-resp-header (host-bl-wapp (host-bl-req "/my-first-post/source")) "content-type")
+  "text/plain; charset=utf-8")
+(host-bl-test "view source returns raw sx_content"
+  (contains? (dream-resp-body (host-bl-wapp (host-bl-req "/my-first-post/source"))) "(article")
+  true)
+(host-bl-test "view source missing -> 404"
+  (dream-status (host-bl-wapp (host-bl-req "/ghost/source"))) 404)
+(host-bl-test "/:slug not shadowed by /:slug/source"
+  (dream-status (host-bl-wapp (host-bl-req "/my-first-post/"))) 200)
+
+;; -- edit source (guarded GET form + guarded POST save) --
+(host-bl-test "edit form no auth -> redirect to login"
+  (dream-status (host-bl-wapp (host-bl-send "GET" "/my-first-post/edit" nil "" ""))) 303)
+(host-bl-test "edit form no auth Location carries next=/…/edit"
+  (contains?
+    (dream-resp-header (host-bl-wapp (host-bl-send "GET" "/my-first-post/edit" nil "" "")) "location")
+    "/login?next=/my-first-post/edit")
+  true)
+(host-bl-test "edit form authed -> 200"
+  (dream-status (host-bl-wapp (host-bl-send "GET" "/my-first-post/edit" "Bearer good" "" ""))) 200)
+(host-bl-test "edit form shows current source"
+  (contains? (dream-resp-body (host-bl-wapp (host-bl-send "GET" "/my-first-post/edit" "Bearer good" "" "")))
+    "(article")
+  true)
+(host-bl-test "edit submit no auth -> redirect to login"
+  (dream-status (host-bl-wapp (host-bl-send "POST" "/my-first-post/edit" nil
+    "application/x-www-form-urlencoded" "sx_content=(p+%22x%22)"))) 303)
+(host-bl-test "edit submit authed -> 303"
+  (dream-status (host-bl-wapp (host-bl-send "POST" "/my-first-post/edit" "Bearer good"
+    "application/x-www-form-urlencoded"
+    "title=My+First+Post&sx_content=(p+%22edited+via+editor%22)&status=published"))) 303)
+(host-bl-test "edit persisted the new content"
+  (contains? (dream-resp-body (host-bl-wapp (host-bl-req "/my-first-post/"))) "edited via editor")
+  true)
+(host-bl-test "edit preserves the slug"
+  (dream-resp-header
+    (host-bl-wapp (host-bl-send "POST" "/my-first-post/edit" "Bearer good"
+      "application/x-www-form-urlencoded" "title=Renamed&sx_content=(p+%22y%22)&status=draft"))
+    "location")
+  "/my-first-post/")
+(host-bl-test "edit malformed body -> 400"
+  (dream-status (host-bl-wapp (host-bl-send "POST" "/my-first-post/edit" "Bearer good"
+    "application/x-www-form-urlencoded" "sx_content=%3Ch1+broken%29"))) 400)
+(host-bl-test "edit missing post -> 404"
+  (dream-status (host-bl-wapp (host-bl-send "GET" "/ghost/edit" "Bearer good" "" ""))) 404)
+
+;; -- auth footer (discoverable login/logout) --
+(host-bl-test "home footer shows a log in link when anonymous"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/"))) ">log in</a>") true)
+(host-bl-test "post footer shows a log in link when anonymous"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/my-first-post/"))) ">log in</a>") true)
+(host-bl-test "GET /logout -> 303"
+  (dream-status (host-bl-app (host-bl-req "/logout"))) 303)
+
+;; -- relate posts (blog × relations) --
+;; my-first-post and another-one both exist in the write-test store at this point.
+;; Relations are posts now (their symmetry/labels live on relation-posts), so seed
+;; them up front exactly as boot does (serve.sh) before exercising relate, and load
+;; the relation metadata into the in-memory cache the same way.
+(host/blog-seed-types!)
+(host/blog-load-rel-kinds!)
+(host-bl-test "relate no auth -> redirect to login"
+  (dream-status (host-bl-wapp (host-bl-send "POST" "/my-first-post/relate" nil
+    "application/x-www-form-urlencoded" "other=another-one"))) 303)
+(host-bl-test "relate authed -> 303 back to edit"
+  (dream-resp-header (host-bl-wapp (host-bl-send "POST" "/my-first-post/relate" "Bearer good"
+    "application/x-www-form-urlencoded" "other=another-one")) "location")
+  "/my-first-post/edit")
+(host-bl-test "related is symmetric (a -> b)"
+  (contains? (host/blog-related "my-first-post") "another-one") true)
+(host-bl-test "related is symmetric (b -> a)"
+  (contains? (host/blog-related "another-one") "my-first-post") true)
+(host-bl-test "post page shows a Related posts block"
+  (contains? (dream-resp-body (host-bl-wapp (host-bl-req "/my-first-post/"))) "Related posts") true)
+(host-bl-test "post page links the related post"
+  (contains? (dream-resp-body (host-bl-wapp (host-bl-req "/my-first-post/"))) "/another-one/") true)
+(host-bl-test "relate nonexistent other -> no-op"
+  (begin
+    (host-bl-wapp (host-bl-send "POST" "/my-first-post/relate" "Bearer good"
+      "application/x-www-form-urlencoded" "other=ghost-post"))
+    (contains? (host/blog-related "my-first-post") "ghost-post"))
+  false)
+(host-bl-test "unrelate -> removes the link both ways"
+  (begin
+    (host-bl-wapp (host-bl-send "POST" "/my-first-post/unrelate" "Bearer good"
+      "application/x-www-form-urlencoded" "other=another-one"))
+    (list (contains? (host/blog-related "my-first-post") "another-one")
+          (contains? (host/blog-related "another-one") "my-first-post")))
+  (list false false))
+;; (The "delete cleans up related edges" test was removed with the JSON DELETE
+;; /posts endpoint; cascade edge cleanup returns when a browser delete route is
+;; added — see the FOLLOW-UP note in lib/host/blog.sx.)
+
+;; -- relate picker (filterable candidate endpoint + glue + hint) --
+(host/blog-put! "alpha-post" "Alpha Post" "(p \"a\")" "published")
+(host/blog-put! "beta-post" "Beta Post" "(p \"b\")" "published")
+(host/blog-put! "gamma-post" "Gamma Post" "(p \"g\")" "published")
+(host-bl-test "relate-options lists other posts"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/alpha-post/relate-options"))) "Beta Post") true)
+(host-bl-test "relate-options excludes the post itself"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/alpha-post/relate-options"))) ">Alpha Post<") false)
+(host-bl-test "relate-options filters by q (title substring)"
+  (let ((body (dream-resp-body (host-bl-app (host-bl-req "/alpha-post/relate-options?q=beta")))))
+    (list (contains? body "Beta Post") (contains? body "Gamma Post")))
+  (list true false))
+(host-bl-test "relate-options filter url-decodes q (spaces)"
+  (let ((body (dream-resp-body (host-bl-app (host-bl-req "/alpha-post/relate-options?q=Beta%20Post")))))
+    (list (contains? body "Beta Post") (contains? body "Gamma Post")))
+  (list true false))
+(host-bl-test "relate-options excludes already-related candidates"
+  (begin
+    (host/blog-relate! "alpha-post" "beta-post" "related")
+    (contains? (dream-resp-body (host-bl-app (host-bl-req "/alpha-post/relate-options"))) "Beta Post"))
+  false)
+(host/blog-unrelate! "alpha-post" "beta-post" "related")
+;; The picker is a declarative SX-htmx form (no client JS): the form GETs
+;; relate-options serialising kind + the filter q, swapping the results ul on
+;; "load" and on debounced "input". The SX engine re-binds these triggers on
+;; swapped content, so it works on a full load AND a boosted SPA nav.
+(host-bl-test "picker form is declaratively wired to relate-options (load + debounced input)"
+  (let ((html (render-page (host/blog--relation-editor "alpha-post" "related" true))))
+    (list (contains? html "/alpha-post/relate-options")
+          (contains? html "input delay:200ms, load")
+          (contains? html "rp-related-results")))
+  (list true true true))
+;; the editor server-renders the first page of candidates INTO the picker's results
+;; <ul>, so a re-rendered editor is never briefly empty (no flash). The candidate row
+;; for an existing post appears inside the results ul.
+(host-bl-test "editor server-renders the first page of candidates into the picker"
+  (let ((html (render-page (host/blog--relation-editor "alpha-post" "related" true))))
+    (list (contains? html "id=\"cand-related-")          ;; a candidate row is present
+          (contains? html "Beta Post")))                 ;; an unrelated post is offered
+  (list true true))
+;; Paging is server-driven: a full page carries a "load more" sentinel that, when
+;; revealed, GETs the next page and replaces itself (outerHTML), preserving q.
+(host-bl-test "load-more sentinel: revealed, outerHTML-swap, next offset, preserved q"
+  (let ((html (render-page (host/blog--picker-more "alpha-post" "related" "my q" 20))))
+    (list (contains? html "rp-more")
+          (contains? html "revealed")
+          (contains? html "outerHTML")
+          (contains? html "offset=20")
+          (contains? html "q=my%20q")
+          (contains? html "exponential:1000:30000")))   ;; retries a dropped fetch
+  (list true true true true true true))
+(host-bl-test "relate-options omits the load-more sentinel on a short last page"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/alpha-post/relate-options"))) "rp-more")
+  false)
+
+;; -- relate / unrelate keep BOTH lists in sync by re-rendering the kind's editor.
+;;    Regressions: (1) relating a candidate must ADD it to the current-relations
+;;    list (not just delete the candidate row); (2) removing must NOT clear the
+;;    relate picker. Both the candidate's relate form and the remove form target
+;;    #rel-editor-KIND with sx-swap=outerHTML; the handler returns the re-rendered
+;;    editor, so the current list updates and the fresh picker re-loads. --
+(host/blog-relate! "alpha-post" "beta-post" "related")
+;; the editor wraps current list + picker in #rel-editor-KIND; remove re-renders it
+(host-bl-test "relation-editor wires remove to re-render the kind's editor"
+  (let ((html (render-page (host/blog--relation-editor "alpha-post" "related" true))))
+    (list (contains? html "id=\"rel-editor-related\"")           ;; the swap target
+          (contains? html "sx-post=\"/alpha-post/unrelate\"")    ;; AJAX, not plain post
+          (contains? html "sx-target=\"#rel-editor-related\"")
+          (contains? html "sx-swap=\"outerHTML\"")))
+  (list true true true true))
+;; the candidate's relate form targets the SAME editor (so relating re-renders it)
+(host-bl-test "picker candidate relate form re-renders the kind's editor"
+  (let ((html (render-page (host/blog--picker-item "alpha-post" {:slug "gamma-post" :title "Gamma"} "related"))))
+    (list (contains? html "sx-post=\"/alpha-post/relate\"")
+          (contains? html "sx-target=\"#rel-editor-related\"")
+          (contains? html "sx-swap=\"outerHTML\"")))
+  (list true true true))
+;; a POST request to a /:slug/… route, with the :slug route param populated (which
+;; the route matcher would set) plus headers + a form body.
+(define host-bl-relreq
+  (fn (slug action headers other kind)
+    (merge (dream-request "POST" (str "/" slug "/" action) headers
+             (str "other=" other "&kind=" kind))
+           {:params {:slug slug}})))
+;; the AJAX remove (carries SX-Target) returns the re-rendered editor fragment (200,
+;; with the #rel-editor wrapper + the picker) — not an empty body or a redirect.
+(host-bl-test "unrelate (AJAX, SX-Target) returns the re-rendered editor fragment"
+  (let ((resp (host/blog-unrelate-submit
+                (host-bl-relreq "alpha-post" "unrelate"
+                  {:sx-request "true" :sx-target "#rel-editor-related"}
+                  "beta-post" "related"))))
+    (list (dream-status resp)
+          (contains? (dream-resp-body resp) "rel-editor-related")
+          (contains? (dream-resp-body resp) "relate-picker")))
+  (list 200 true true))
+;; relate (AJAX, SX-Target) likewise returns the editor with the new relation listed
+(host/blog-unrelate! "alpha-post" "gamma-post" "related")    ;; clean state
+(host-bl-test "relate (AJAX, SX-Target) returns the editor showing the new relation"
+  (let ((resp (host/blog-relate-submit
+                (host-bl-relreq "alpha-post" "relate"
+                  {:sx-request "true" :sx-target "#rel-editor-related"}
+                  "gamma-post" "related"))))
+    (list (dream-status resp)
+          (contains? (dream-resp-body resp) "/gamma-post/")))   ;; now in the current list
+  (list 200 true))
+(host/blog-unrelate! "alpha-post" "gamma-post" "related")
+;; a plain boosted form / no-JS POST (no SX-Target) still redirects + re-renders,
+;; so the is-a-tag toggle and graceful degradation are unaffected.
+(host-bl-test "unrelate (plain boosted / no-JS, no SX-Target) still redirects"
+  (dream-status (host/blog-unrelate-submit
+                  (host-bl-relreq "alpha-post" "unrelate"
+                    {:sx-request "true"} "beta-post" "related")))
+  303)
+(host/blog-unrelate! "alpha-post" "beta-post" "related")
+(host/blog-put! "hint-post" "Hint Post" "(p \"h\")" "published")
+(host-bl-test "relations section: hint when logged-in + no relations"
+  (contains? (str (host/blog--relations-or-hint "hint-post" true)) "add some") true)
+(host-bl-test "relations section: empty when anonymous + no relations"
+  (= (host/blog--relations-or-hint "hint-post" false) "") true)
+
+;; -- Phase 1: relations carry a kind --
+(host-bl-test "symmetric kind (related) reads from both sides"
+  (begin
+    (host/blog-relate! "alpha-post" "gamma-post" "related")
+    (list (contains? (host/blog-out "alpha-post" "related") "gamma-post")
+          (contains? (host/blog-out "gamma-post" "related") "alpha-post")))
+  (list true true))
+(host-bl-test "directed kind (tagged) writes one direction; inverse via host/blog-in"
+  (begin
+    (host/blog-relate! "alpha-post" "beta-post" "tagged")
+    (list (contains? (host/blog-out "alpha-post" "tagged") "beta-post")
+          (contains? (host/blog-out "beta-post" "tagged") "alpha-post")
+          (contains? (host/blog-in "beta-post" "tagged") "alpha-post")))
+  (list true false true))
+(host-bl-test "unrelate is kind-scoped (related edge survives a tagged unrelate)"
+  (begin
+    (host/blog-unrelate! "alpha-post" "beta-post" "tagged")
+    (list (contains? (host/blog-out "alpha-post" "tagged") "beta-post")
+          (contains? (host/blog-out "alpha-post" "related") "gamma-post")))
+  (list false true))
+(host/blog-unrelate! "alpha-post" "gamma-post" "related")
+(host-bl-test "relate-submit rejects an unknown kind (no-op)"
+  (begin
+    (host-bl-wapp (host-bl-send "POST" "/alpha-post/relate" "Bearer good"
+      "application/x-www-form-urlencoded" "other=beta-post&kind=bogus"))
+    (contains? (host/blog-out "alpha-post" "bogus") "beta-post"))
+  false)
+(host-bl-test "default kind is related (no kind field)"
+  (begin
+    (host-bl-wapp (host-bl-send "POST" "/alpha-post/relate" "Bearer good"
+      "application/x-www-form-urlencoded" "other=beta-post"))
+    (contains? (host/blog-out "alpha-post" "related") "beta-post"))
+  true)
+(host-bl-test "edges are durable: KV row written on relate"
+  (begin
+    (host/blog-relate! "alpha-post" "gamma-post" "tagged")
+    (persist/backend-kv-has? host/blog-store (host/blog--edge-key "alpha-post" "tagged" "gamma-post")))
+  true)
+(host-bl-test "replay rebuilds the graph after an in-memory wipe (restart sim)"
+  (begin
+    (relations/load! (list))                          ;; simulate a fresh process
+    (host/blog-load-edges!)                            ;; replay from the durable store
+    (list (contains? (host/blog-out "alpha-post" "tagged") "gamma-post")
+          (contains? (host/blog-out "alpha-post" "related") "beta-post")
+          (contains? (host/blog-out "beta-post" "related") "alpha-post")))
+  (list true true true))
+(host-bl-test "unrelate deletes the durable KV row"
+  (begin
+    (host/blog-unrelate! "alpha-post" "gamma-post" "tagged")
+    (persist/backend-kv-has? host/blog-store (host/blog--edge-key "alpha-post" "tagged" "gamma-post")))
+  false)
+
+;; -- Phase 2: typing with subsumption (is-a + subtype-of) --
+;; ppost --is-a--> ptutorial ; ptutorial --subtype-of--> particle --subtype-of--> pdoc
+(host/blog-put! "ptutorial" "P Tutorial" "(p \"t\")" "published")
+(host/blog-put! "particle" "P Article" "(p \"a\")" "published")
+(host/blog-put! "pdoc" "P Doc" "(p \"d\")" "published")
+(host/blog-put! "ppost" "P Post" "(p \"p\")" "published")
+(host/blog-relate! "ptutorial" "particle" "subtype-of")
+(host/blog-relate! "particle" "pdoc" "subtype-of")
+(host/blog-relate! "ppost" "ptutorial" "is-a")
+(host-bl-test "types-of = declared type + ALL its subtype-of supertypes"
+  (list (contains? (host/blog-types-of "ppost") "ptutorial")
+        (contains? (host/blog-types-of "ppost") "particle")
+        (contains? (host/blog-types-of "ppost") "pdoc"))
+  (list true true true))
+(host-bl-test "is-a? is transitive THROUGH subtype-of (subsumption)"
+  (list (host/blog-is-a? "ppost" "ptutorial")
+        (host/blog-is-a? "ppost" "pdoc"))
+  (list true true))
+(host-bl-test "is-a? alone does NOT chain (instance-of is not transitive)"
+  (begin
+    (host/blog-put! "pmeta" "P Meta" "(p \"m\")" "published")
+    (host/blog-relate! "pmeta" "ppost" "is-a")        ;; pmeta is-a ppost is-a ptutorial
+    (host/blog-is-a? "pmeta" "ptutorial"))             ;; ... does NOT make pmeta is-a ptutorial
+  false)
+(host-bl-test "is-a? false for an unrelated type"
+  (host/blog-is-a? "ppost" "particle") true)          ;; sanity: this one IS reachable
+(host-bl-test "seed-types: an instance of tag is, transitively, a type"
+  (begin
+    (host/blog-seed-types!)                            ;; type, tag, tag subtype-of type
+    (host/blog-put! "ocaml" "OCaml" "(p \"lang\")" "published")
+    (host/blog-relate! "ocaml" "tag" "is-a")           ;; ocaml is-a tag
+    (list (host/blog-is-a? "ocaml" "tag") (host/blog-is-a? "ocaml" "type")))
+  (list true true))
+(host-bl-test "type-valid? is vacuously true with no schemas (gradual)"
+  (host/blog-type-valid? "ppost" "(p \"anything\")") true)
+
+;; -- relations-as-posts: declaration-driven candidate pools (plans/relations-as-posts.md) --
+;; The picker's candidate set is the down-closure of a relation's anchors. is-a/subtype-of
+;; are anchored by `type`, so they offer the WHOLE type closure — the roots (type/tag/
+;; article) AND the instances — fixing the wrinkle where only instances showed.
+(host-bl-test "is-a candidates = the type closure: roots (type/tag/article) AND instances"
+  (let ((pool (host/blog--candidate-pool "is-a")))
+    (list (contains? pool "type") (contains? pool "tag")
+          (contains? pool "article") (contains? pool "ocaml")))   ;; ocaml is-a tag
+  (list true true true true))
+(host-bl-test "is-a candidates exclude a plain content post (not is-a/subtype-reachable to Type)"
+  (contains? (host/blog--candidate-pool "is-a") "ppost") false)
+(host-bl-test "tagged candidates are anchored by tag (tag + its instances)"
+  (let ((pool (host/blog--candidate-pool "tagged")))
+    (list (contains? pool "tag") (contains? pool "ocaml")))
+  (list true true))
+(host-bl-test "related candidates = every post (no declaration anchors it)"
+  (let ((pool (host/blog--candidate-pool "related")))
+    (list (contains? pool "type") (contains? pool "ppost")))
+  (list true true))
+;; and it flows through to the live picker endpoint: the is-a picker now offers a type root
+(host-bl-test "is-a relate-options offers the type roots (Article)"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/ppost/relate-options?kind=is-a"))) "Article")
+  true)
+
+;; -- relations are posts: symmetry + labels read off the relation-posts (slice 2) --
+(host-bl-test "kind-spec reads :rel metadata off the relation-post"
+  (let ((s (host/blog--kind-spec "is-a")))
+    (list (get s :kind) (get s :label) (get s :symmetric) (get s :inverse-label)))
+  (list "is-a" "Types" false "Instances"))
+(host-bl-test "kind-symmetric? reads symmetry off the post (related yes, is-a no)"
+  (list (host/blog--kind-symmetric? "related") (host/blog--kind-symmetric? "is-a"))
+  (list true false))
+(host-bl-test "an unknown kind has no spec, so relate still validates it away"
+  (host/blog--kind-spec "bogus-kind") nil)
+(host-bl-test "rel-kinds is DERIVED from the graph (every post that is-a relation)"
+  (let ((kinds (map (fn (s) (get s :kind)) host/blog-rel-kinds)))
+    (list (contains? kinds "related") (contains? kinds "is-a")
+          (contains? kinds "subtype-of") (contains? kinds "tagged")))
+  (list true true true true))
+
+;; -- relations are TYPED: the target-type constraint is enforced (slice 3) --
+;; A valid object of a relation is one in its declared candidate set (the picker's
+;; pool). So is-a's object must be a type, tagged's must be a tag, related's any post.
+(host-bl-test "valid-object?: is-a accepts a type (article), rejects a plain post (ppost)"
+  (list (host/blog--valid-object? "is-a" "article") (host/blog--valid-object? "is-a" "ppost"))
+  (list true false))
+(host-bl-test "valid-object?: tagged accepts a tag (ocaml); related accepts any post"
+  (list (host/blog--valid-object? "tagged" "ocaml") (host/blog--valid-object? "related" "ppost"))
+  (list true true))
+;; the relate ENDPOINT enforces it: is-a to a type relates; is-a to a non-type no-ops.
+(host/blog-unrelate! "alpha-post" "article" "is-a")
+(host-bl-test "relate-submit: is-a to a type (article) creates the edge"
+  (begin
+    (host/blog-relate-submit (host-bl-relreq "alpha-post" "relate"
+      {:sx-request "true" :sx-target "#rel-editor-is-a"} "article" "is-a"))
+    (contains? (host/blog-out "alpha-post" "is-a") "article"))
+  true)
+(host/blog-unrelate! "alpha-post" "article" "is-a")
+(host-bl-test "relate-submit: is-a to a NON-type (beta-post) is rejected (no edge)"
+  (begin
+    (host/blog-relate-submit (host-bl-relreq "alpha-post" "relate"
+      {:sx-request "true" :sx-target "#rel-editor-is-a"} "beta-post" "is-a"))
+    (contains? (host/blog-out "alpha-post" "is-a") "beta-post"))
+  false)
+
+;; -- Slice 4: type ALGEBRA — intersection (∧) and union (∨) types --
+;; ocaml is-a tag (seeded above); make it is-a article too, so it's in BOTH extents.
+(host/blog-relate! "ocaml" "article" "is-a")
+(host/blog-make-and! "taggy-article" "tag" "article")   ;; tag ∧ article
+(host/blog-make-or!  "tag-or-article" "tag" "article")   ;; tag ∨ article
+(host-bl-test "intersection (∧): a member iff it's an instance of BOTH operands"
+  (list (host/blog-is-a-expr? "ocaml" "taggy-article")   ;; is-a tag AND is-a article
+        (host/blog-is-a-expr? "ppost" "taggy-article"))  ;; neither
+  (list true false))
+(host-bl-test "union (∨): a member iff it's an instance of EITHER operand"
+  (list (host/blog-is-a-expr? "ocaml" "tag-or-article")  ;; is-a tag (and article)
+        (host/blog-is-a-expr? "ppost" "tag-or-article"))  ;; neither tag nor article
+  (list true false))
+(host-bl-test "the extent is the set intersection of the operands' extents"
+  (let ((ext (host/blog-instances-of-expr "taggy-article")))
+    (list (contains? ext "ocaml")                         ;; in tag ∩ article
+          (contains? ext "ppost")))                       ;; in neither
+  (list true false))
+;; algebra is META-CIRCULAR: an operand can itself be an algebraic type.
+(host/blog-make-and! "nested-and" "taggy-article" "tag")  ;; (tag ∧ article) ∧ tag
+(host-bl-test "nested type expression: (tag ∧ article) ∧ tag still admits ocaml"
+  (host/blog-is-a-expr? "ocaml" "nested-and") true)
+
+;; -- Slice 5: refinement types — schemas live ON the type-post --
+;; article's schema (now on the article post) is still enforced for its instances.
+(host/blog-put! "art-test" "Art Test" "(p \"x\")" "published")
+(host/blog-relate! "art-test" "article" "is-a")
+(host-bl-test "article (refinement type, schema on the post) requires an h1"
+  (list (host/blog-type-valid? "art-test" "(p \"no heading\")")              ;; missing h1
+        (host/blog-type-valid? "art-test" "(article (h1 \"H\") (p \"x\"))"))  ;; has h1
+  (list false true))
+;; a NEW refinement type is pure data: give a type-post a :schema and its instances
+;; are validated against it — no code, no hardcoded table.
+(host/blog-seed! "guide" "Guide" "(article (h1 \"Guide\") (p \"A guide.\"))" "published")
+(host/blog-relate! "guide" "type" "subtype-of")
+(host/blog--set-schema! "guide" (list {:block "pre" :msg "a guide needs a code block (pre)"}))
+(host/blog-put! "g1" "G1" "(p \"x\")" "published")
+(host/blog-relate! "g1" "guide" "is-a")
+(host-bl-test "a NEW refinement type validates its instances against its :schema"
+  (list (host/blog-type-valid? "g1" "(p \"no code\")")                       ;; missing pre
+        (host/blog-type-valid? "g1" "(article (pre \"x\") (p \"y\"))"))      ;; has pre
+  (list false true))
+(host-bl-test "the schema is read off the type-post (data, not a hardcoded table)"
+  (contains? (str (host/blog-schema-of "guide")) "code block") true)
+;; editing a refinement type preserves its :schema (put! merges over the record).
+(host/blog-put! "guide" "Guide v2" "(article (h1 \"Guide\") (p \"edited\"))" "published")
+(host-bl-test "editing a type-post preserves its :schema (and metadata survives edits)"
+  (contains? (str (host/blog-schema-of "guide")) "code block") true)
+
+;; -- Phase 3: tags as posts --  (ocaml is-a tag, from the seed-types test above)
+(host-bl-test "is-tag?: a post that is-a tag is a tag; others are not"
+  (list (host/blog-is-tag? "ocaml") (host/blog-is-tag? "ppost"))
+  (list true false))
+(host-bl-test "instances-of tag includes the tag posts"
+  (contains? (host/blog-instances-of "tag") "ocaml") true)
+(host-bl-test "tag a post: it appears in tags + tagged-with (inverse)"
+  (begin
+    (host/blog-relate! "ppost" "ocaml" "tagged")        ;; ppost tagged ocaml
+    (list (contains? (host/blog-tags "ppost") "ocaml")
+          (contains? (host/blog-tagged-with "ocaml") "ppost")))
+  (list true true))
+(host-bl-test "tagged picker offers only tags (kind=tagged)"
+  (let ((body (dream-resp-body (host-bl-app (host-bl-req "/particle/relate-options?kind=tagged")))))
+    (list (contains? body ">OCaml<") (contains? body ">P Article<")))
+  (list true false))
+(host-bl-test "related picker still offers all posts (kind defaults to related)"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/particle/relate-options"))) ">P Doc<")
+  true)
+(host-bl-test "is-a-tag toggle marks a post a tag via /relate kind=is-a"
+  (begin
+    (host-bl-wapp (host-bl-send "POST" "/pdoc/relate" "Bearer good"
+      "application/x-www-form-urlencoded" "other=tag&kind=is-a"))
+    (host/blog-is-tag? "pdoc"))
+  true)
+
+;; -- Phase 4: registry-driven render + /tags index --
+(host-bl-test "relation-blocks renders Related + Tags from the registry"
+  (begin
+    (host/blog-relate! "hint-post" "ppost" "related")
+    (host/blog-relate! "hint-post" "ocaml" "tagged")
+    (let ((body (str (host/blog--relation-blocks "hint-post"))))
+      (list (contains? body "Related posts") (contains? body "Tags"))))
+  (list true true))
+(host-bl-test "relation-blocks shows an inverse block (Tagged with this) for a tag"
+  (contains? (str (host/blog--relation-blocks "ocaml")) "Tagged with this") true)
+(host-bl-test "/tags lists the tag posts"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/tags"))) "OCaml") true)
+(host-bl-test "/tags is 200 (not shadowed by /:slug)"
+  (dream-status (host-bl-app (host-bl-req "/tags"))) 200)
+
+;; -- Phase 6: gradual schema validation --
+(host/blog-seed-types!)   ;; ensures the "article" type + its schema (requires h1)
+(host-bl-test "all-tags finds nested element tags"
+  (let ((tags (host/blog--all-tags (parse-safe "(article (h1 \"T\") (p \"x\"))"))))
+    (list (contains? tags "h1") (contains? tags "p") (contains? tags "section")))
+  (list true true false))
+(host-bl-test "schema-issues: missing required block -> 1 issue; present -> 0"
+  (let ((sch (host/blog-schema-of "article")))
+    (list (len (host/blog--schema-issues sch "(p \"no heading\")"))
+          (len (host/blog--schema-issues sch "(article (h1 \"yes\"))"))))
+  (list 1 0))
+(host-bl-test "type-valid? enforces an is-a article's schema"
+  (begin
+    (host/blog-put! "art1" "Art 1" "(p \"x\")" "published")
+    (host/blog-relate! "art1" "article" "is-a")
+    (list (host/blog-type-valid? "art1" "(p \"no heading\")")
+          (host/blog-type-valid? "art1" "(article (h1 \"H\") (p \"x\"))")))
+  (list false true))
+
+;; -- metamodel overview (GET /meta) --
+(host-bl-test "type-defs = the subtype hierarchy (type defs), not is-a instances"
+  (let ((defs (host/blog-type-defs)))
+    (list (contains? defs "type") (contains? defs "article") (contains? defs "art1")))
+  (list true true false))
+(host-bl-test "/meta is 200 (not shadowed by /:slug)"
+  (dream-status (host-bl-app (host-bl-req "/meta"))) 200)
+(host-bl-test "/meta lists type definitions + relations + the article's required block"
+  (let ((body (dream-resp-body (host-bl-app (host-bl-req "/meta")))))
+    (list (contains? body "Metamodel") (contains? body "Article")
+          (contains? body "h1") (contains? body "related")
+          (contains? body "symmetric")))
+  (list true true true true true))
+
+;; -- Slice 8: typed scalar fields on a type --
+(host-bl-test "fields-of reads a type's declared fields (seeded on article)"
+  (map (fn (f) (get f :name)) (host/blog-fields-of "article"))
+  (list "subtitle" "hero"))
+(host-bl-test "widget-for: explicit > value-type default > text fallback"
+  (list (host/blog--widget-for {:name "a" :type "URL"})
+        (host/blog--widget-for {:name "b" :type "Text"})
+        (host/blog--widget-for {:name "c" :type "Nonsense"})
+        (host/blog--widget-for {:name "d" :type "String" :widget "custom"}))
+  (list "url" "textarea" "text" "custom"))
+(host-bl-test "set-fields! is idempotent + preserves the rest of the record"
+  (begin
+    (host/blog--set-fields! "article"
+      (list {:name "subtitle" :type "String"} {:name "hero" :type "URL"}))
+    (list (get (host/blog-get "article") :title) (len (host/blog-fields-of "article"))))
+  (list "Article" 2))
+(host-bl-test "a type with no declared fields -> empty list"
+  (host/blog-fields-of "tag") (list))
+(host-bl-test "/meta shows the article's typed fields"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/meta"))) "subtitle:String") true)
+
+;; -- Slice 8b: field values + the generic, type-driven edit form --
+(host-bl-test "fields-for-post = union of the post's (transitive) types' fields"
+  (begin
+    (host/blog-put! "fpost" "F Post" "(article (h1 \"F\"))" "published")
+    (host/blog-relate! "fpost" "article" "is-a")
+    (map (fn (f) (get f :name)) (host/blog--fields-for-post "fpost")))
+  (list "subtitle" "hero"))
+(host-bl-test "a post of no typed type has no fields"
+  (host/blog--fields-for-post "hello") (list))
+(host-bl-test "set/get field-values round-trips on an instance"
+  (begin
+    (host/blog--set-field-values! "fpost" {"subtitle" "A subtitle" "hero" "http://x/y.png"})
+    (list (get (host/blog-field-values-of "fpost") "subtitle")
+          (get (host/blog-field-values-of "fpost") "hero")))
+  (list "A subtitle" "http://x/y.png"))
+(host-bl-test "edit form renders one input per field for a typed post"
+  (let ((body (dream-resp-body (host-bl-wapp (host-bl-send "GET" "/fpost/edit" "Bearer good" nil "")))))
+    (list (contains? body "field-subtitle") (contains? body "field-hero") (contains? body "Fields")))
+  (list true true true))
+(host-bl-test "edit-submit stores the typed field values from the form"
+  (begin
+    (host-bl-wapp (host-bl-send "POST" "/fpost/edit" "Bearer good"
+      "application/x-www-form-urlencoded"
+      "sx_content=(article+(h1+%22F%22))&field-subtitle=Saved+Sub&field-hero=http%3A%2F%2Fz%2Fq.png"))
+    (list (get (host/blog-field-values-of "fpost") "subtitle")
+          (get (host/blog-field-values-of "fpost") "hero")))
+  (list "Saved Sub" "http://z/q.png"))
+
+;; -- Slice 8c: render template per type (fields drive the page too) --
+(host-bl-test "instantiate resolves (field name), replacing the placeholder"
+  (list (contains? (str (host/blog--instantiate (parse-safe "(p (field \"subtitle\"))") {"subtitle" "Hi"})) "Hi")
+        (contains? (str (host/blog--instantiate (parse-safe "(p (field \"x\"))") {})) "field"))
+  (list true false))
+(host-bl-test "template-of reads the article's seeded render template"
+  (contains? (host/blog-template-of "article") "field") true)
+(host-bl-test "typed-block renders a typed post's field values"
+  (begin
+    (host/blog--set-field-values! "fpost" {"subtitle" "My Standfirst" "hero" ""})
+    (contains? (str (host/blog--typed-block "fpost")) "My Standfirst"))
+  true)
+(host-bl-test "typed-block is empty for an untyped post"
+  (host/blog--typed-block "hello") "")
+(host-bl-test "post page renders the typed template standfirst"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/fpost/"))) "My Standfirst") true)
+
+;; -- metamodel editor: define a type through the UI (POST /meta/new-type) --
+(host-bl-test "/meta has the create-type form"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/meta"))) "/meta/new-type") true)
+(host-bl-test "POST /meta/new-type creates a type (subtype-of type) in type-defs"
+  (begin
+    (host-bl-wapp (host-bl-send "POST" "/meta/new-type" "Bearer good"
+      "application/x-www-form-urlencoded" "title=Recipe"))
+    (list (host/blog-exists? "recipe") (contains? (host/blog-type-defs) "recipe")))
+  (list true true))
+(host-bl-test "create-type requires auth (unauthed -> not created)"
+  (begin
+    (host-bl-wapp (host-bl-send "POST" "/meta/new-type" nil
+      "application/x-www-form-urlencoded" "title=Sneaky Type"))
+    (host/blog-exists? "sneaky-type"))
+  false)
+
+;; -- metamodel editor: define a relation through the UI (POST /meta/new-relation) --
+(host-bl-test "/meta has the create-relation form"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/meta"))) "/meta/new-relation") true)
+(host-bl-test "POST /meta/new-relation creates + registers a relation (session-scoped)"
+  (begin
+    (host-bl-wapp (host-bl-send "POST" "/meta/new-relation" "Bearer good"
+      "application/x-www-form-urlencoded" "title=Blocks&label=Blocks&symmetric=on"))
+    (list (host/blog-exists? "blocks")
+          (host/blog-is-a? "blocks" "relation")
+          (not (nil? (host/blog--kind-spec "blocks")))
+          (host/blog--kind-symmetric? "blocks")))
+  (list true true true true))
+(host-bl-test "create-relation requires auth (unauthed -> not created)"
+  (begin
+    (host-bl-wapp (host-bl-send "POST" "/meta/new-relation" nil
+      "application/x-www-form-urlencoded" "title=Sneaky Rel"))
+    (host/blog-exists? "sneaky-rel"))
+  false)
+
+;; -- cards-as-types: the blog content block vocabulary --
+(host-bl-test "card-types are seeded as subtypes of card (in type-defs)"
+  (let ((defs (host/blog-type-defs)))
+    (list (contains? defs "card") (contains? defs "card-image") (contains? defs "card-heading")))
+  (list true true true))
+(host-bl-test "a card-type carries its fields"
+  (map (fn (f) (get f :name)) (host/blog-fields-of "card-image"))
+  (list "src" "alt" "caption"))
+(host-bl-test "/meta lists the card vocabulary with fields"
+  (let ((body (dream-resp-body (host-bl-app (host-bl-req "/meta")))))
+    (list (contains? body ">Image</a>") (contains? body "src:URL, alt:String")))
+  (list true true))
+
+;; -- typed Ghost import (the radar genesis-import seam) --
+(host-bl-test "import-post! lands a Ghost post as a typed Article + fields + tags"
+  (begin
+    (host/blog-import-post! {"slug" "g1" "title" "G1" "sx_content" "(article (h1 \"G1\"))"
+                             "status" "published" "custom_excerpt" "A standfirst"
+                             "feature_image" "http://i/h.jpg" "tags" (list "News")})
+    (list (host/blog-is-a? "g1" "article")
+          (get (host/blog-field-values-of "g1") "subtitle")
+          (get (host/blog-field-values-of "g1") "hero")
+          (contains? (host/blog-out "g1" "tagged") "news")))
+  (list true "A standfirst" "http://i/h.jpg" true))
+(host-bl-test "POST /import (text/sx list of Ghost dicts) lands typed posts"
+  (begin
+    (host-bl-wapp (host-bl-send "POST" "/import" "Bearer good" "text/sx"
+      "({:slug \"g2\" :title \"G2\" :sx_content \"(p \\\"b\\\")\" :status \"published\" :custom_excerpt \"S2\"})"))
+    (list (host/blog-is-a? "g2" "article") (get (host/blog-field-values-of "g2") "subtitle")))
+  (list true "S2"))
+(host-bl-test "POST /import rejects a non-list body -> 400"
+  (dream-status (host-bl-wapp (host-bl-send "POST" "/import" "Bearer good" "text/sx" "{:x 1}")))
+  400)
+
+;; -- composition objects: a record with :body renders via the render-fold --
+(host-bl-test "a record's :body renders via the fold, different per context"
+  (begin
+    (host/blog-put! "cdoc" "C" "(p \"fallback\")" "published")
+    (host/blog--set-body! "cdoc"
+      (quote (seq (alt (when (has "auth") (text "MEMBER")) (else (text "ANON")))
+                  (each (items {:name "X"} {:name "Y"}) (field :name)))))
+    (list (host/comp-render (host/blog-body-of "cdoc") {})
+          (host/comp-render (host/blog-body-of "cdoc") {"auth" "y"})))
+  (list "ANON<span>X</span><span>Y</span>" "MEMBER<span>X</span><span>Y</span>"))
+(host-bl-test "post page renders :body (composition) over sx_content"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/cdoc/"))) "ANON") true)
+(host-bl-test "a post with no schema'd type is vacuously valid"
+  (host/blog-type-valid? "ppost" "(p \"anything\")") true)
+(host-bl-test "edit-submit rejects content violating the type schema (not saved)"
+  (begin
+    (host-bl-wapp (host-bl-send "POST" "/art1/edit" "Bearer good"
+      "application/x-www-form-urlencoded" "sx_content=(p+%22still+no+heading%22)"))
+    (contains? (dream-resp-body (host-bl-wapp (host-bl-req "/art1/"))) "still no heading"))
+  false)
+(host-bl-test "edit-submit accepts content satisfying the schema -> 303"
+  (dream-status (host-bl-wapp (host-bl-send "POST" "/art1/edit" "Bearer good"
+    "application/x-www-form-urlencoded" "sx_content=(article+(h1+%22Heading%22)+(p+%22body%22))")))
+  303)
+
+;; -- experimental unguarded create-only route (POST /new, no auth) --
+(define host-bl-oapp (host/make-app (list host/blog-open-create-routes host/blog-routes)))
+(host/blog-use-store! (persist/open))
+(host-bl-test "open create no auth -> 303"
+  (dream-status (host-bl-oapp (host-bl-send "POST" "/new" nil
+    "application/x-www-form-urlencoded" "title=Open+Post&sx_content=(p+%22o%22)&status=published")))
+  303)
+(host-bl-test "open-created post renders"
+  (contains? (dream-resp-body (host-bl-oapp (host-bl-req "/open-post/"))) "<p>o</p>")
+  true)
+
+;; ── content-addressing: every object carries a stable CID ───────────
+;; A CID is the hash of the canonical (key-sorted) content; the slug (a name) and
+;; any prior :cid are excluded. Same content -> same CID, across slugs and processes.
+(host/blog-use-store! (persist/open))
+(host/blog-put! "cid-a" "Same Body" "(p \"same\")" "published")
+(host/blog-put! "cid-b" "Same Body" "(p \"same\")" "published")
+(host-bl-test "put! stamps a non-nil CID"
+  (and (not (nil? (host/blog-cid "cid-a"))) (> (len (host/blog-cid "cid-a")) 1)) true)
+(host-bl-test "content-addressed: identical content -> identical CID (slug excluded)"
+  (= (host/blog-cid "cid-a") (host/blog-cid "cid-b")) true)
+(host-bl-test "CID changes when content changes"
+  (let ((before (host/blog-cid "cid-a")))
+    (host/blog-put! "cid-a" "Same Body" "(p \"different now\")" "published")
+    (not (= before (host/blog-cid "cid-a"))))
+  true)
+(host-bl-test "canon excludes :slug and :cid"
+  (= (host/blog--canon {:slug "x" :cid "old" :title "T"})
+     (host/blog--canon {:title "T"}))
+  true)
+(host-bl-test "by-cid reverse lookup finds a slug with that CID"
+  (not (nil? (host/blog-by-cid (host/blog-cid "cid-b")))) true)
+(host-bl-test "by-cid of an unknown CID is nil"
+  (host/blog-by-cid "znope-nope") nil)
+
+(define
+  host-bl-tests-run!
+  (fn ()
+    {:total (+ host-bl-pass host-bl-fail)
+     :passed host-bl-pass :failed host-bl-fail :fails host-bl-fails}))

lib/host/tests/feed.sx

@@ -0,0 +1,132 @@
+;; lib/host/tests/feed.sx — the migrated feed endpoints, GET /feed (read) and
+;; POST /feed (guarded write). Includes a golden test: the host read response
+;; body must equal the feed subsystem's own recent-first stream wrapped in the
+;; standard envelope — the endpoint adds the HTTP/JSON shell and nothing else.
+
+(define host-fd-pass 0)
+(define host-fd-fail 0)
+(define host-fd-fails (list))
+
+(define
+  host-fd-test
+  (fn
+    (name actual expected)
+    (if
+      (= actual expected)
+      (set! host-fd-pass (+ host-fd-pass 1))
+      (begin
+        (set! host-fd-fail (+ host-fd-fail 1))
+        (append! host-fd-fails {:name name :actual actual :expected expected})))))
+
+(define
+  host-fd-req
+  (fn (target) (dream-request "GET" target {} "")))
+
+(define
+  host-fd-app
+  (host/make-app (list host/feed-routes)))
+
+;; ── empty feed ─────────────────────────────────────────────────────
+(feed/reset!)
+(host-fd-test
+  "empty feed 200"
+  (dream-status (host-fd-app (host-fd-req "/feed")))
+  200)
+(host-fd-test
+  "empty feed data ()"
+  (contains? (dream-resp-body (host-fd-app (host-fd-req "/feed"))) ":data ()")
+  true)
+
+;; ── seeded feed ────────────────────────────────────────────────────
+(feed/reset!)
+(feed/post {:actor "alice" :verb "post" :object "p1" :at 1})
+(feed/post {:actor "bob" :verb "post" :object "p2" :at 2})
+(feed/post {:actor "alice" :verb "like" :object "p2" :at 3})
+
+;; recent-first: newest activity (at 3) leads, so its marker precedes the oldest.
+(host-fd-test
+  "timeline recent-first"
+  (let ((body (dream-resp-body (host-fd-app (host-fd-req "/feed")))))
+    (< (index-of body ":at 3") (index-of body ":at 1")))
+  true)
+
+;; actor filter: only alice's two activities.
+(host-fd-test
+  "actor filter count"
+  (feed/count
+    (feed/by-actor (feed/recent (feed/all)) "alice"))
+  2)
+(host-fd-test
+  "actor filter excludes bob"
+  (contains?
+    (dream-resp-body (host-fd-app (host-fd-req "/feed?actor=alice")))
+    "bob")
+  false)
+
+;; limit: cap to a single activity (the most recent).
+(host-fd-test
+  "limit caps results"
+  (contains?
+    (dream-resp-body (host-fd-app (host-fd-req "/feed?limit=1")))
+    ":at 1")
+  false)
+
+;; ── golden: endpoint = subsystem recent stream + envelope ───────────
+(host-fd-test
+  "golden full timeline"
+  (dream-resp-body (host-fd-app (host-fd-req "/feed")))
+  (serialize {:ok true :data (feed/items (feed/recent (feed/all)))}))
+(host-fd-test
+  "golden actor-filtered"
+  (dream-resp-body (host-fd-app (host-fd-req "/feed?actor=alice")))
+  (serialize {:ok true :data (feed/items (feed/by-actor (feed/recent (feed/all)) "alice"))}))
+
+;; ── write: POST /feed (auth + ACL + action) ────────────────────────
+(acl/load! (list (acl-grant "alice" "post" "feed")))
+(define host-fd-resolve (fn (tok) (if (= tok "good") "alice" nil)))
+(define
+  host-fd-wapp
+  (host/make-app
+    (list host/feed-routes (host/feed-write-routes host-fd-resolve))))
+(define
+  host-fd-post
+  (fn (auth body)
+    (dream-request "POST" "/feed" (if auth {:authorization auth} {}) body)))
+
+(feed/reset!)
+(host-fd-test
+  "post no auth -> 401"
+  (dream-status (host-fd-wapp (host-fd-post nil "{}")))
+  401)
+(host-fd-test
+  "post unchanged feed after 401"
+  (feed/size)
+  0)
+(host-fd-test
+  "post authed+permitted -> 201"
+  (dream-status
+    (host-fd-wapp
+      (host-fd-post
+        "Bearer good"
+        "{:actor \"alice\" :verb \"post\" :object \"p9\" :at 9}")))
+  201)
+(host-fd-test "post grew feed" (feed/size) 1)
+(host-fd-test
+  "created activity visible in timeline"
+  (contains?
+    (dream-resp-body (host-fd-wapp (host-fd-req "/feed")))
+    "p9")
+  true)
+(host-fd-test
+  "post non-object body -> 400"
+  (dream-status (host-fd-wapp (host-fd-post "Bearer good" "(1 2)")))
+  400)
+
+(define
+  host-fd-tests-run!
+  (fn
+    ()
+    {:total (+ host-fd-pass host-fd-fail)
+     :passed host-fd-pass
+     :failed host-fd-fail
+     :fails host-fd-fails}))

lib/host/tests/handler.sx

@@ -0,0 +1,86 @@
+;; lib/host/tests/handler.sx — host JSON envelope + request-reading helpers.
+
+(define host-hd-pass 0)
+(define host-hd-fail 0)
+(define host-hd-fails (list))
+
+(define
+  host-hd-test
+  (fn
+    (name actual expected)
+    (if
+      (= actual expected)
+      (set! host-hd-pass (+ host-hd-pass 1))
+      (begin
+        (set! host-hd-fail (+ host-hd-fail 1))
+        (append! host-hd-fails {:name name :actual actual :expected expected})))))
+
+;; ── host/ok ────────────────────────────────────────────────────────
+(host-hd-test "ok status 200" (dream-status (host/ok "x")) 200)
+(host-hd-test
+  "ok content-type sx"
+  (dream-resp-header (host/ok "x") "content-type")
+  "text/sx; charset=utf-8")
+(host-hd-test
+  "ok envelope ok:true"
+  (contains? (dream-resp-body (host/ok "x")) ":ok true")
+  true)
+(host-hd-test
+  "ok envelope carries data"
+  (contains? (dream-resp-body (host/ok "hi")) ":data \"hi\"")
+  true)
+
+;; ── host/ok-status ─────────────────────────────────────────────────
+(host-hd-test "ok-status custom" (dream-status (host/ok-status 201 "y")) 201)
+(host-hd-test
+  "ok-status data"
+  (contains? (dream-resp-body (host/ok-status 201 "y")) ":data \"y\"")
+  true)
+
+;; ── host/error ─────────────────────────────────────────────────────
+(host-hd-test "error status" (dream-status (host/error 404 "nope")) 404)
+(host-hd-test
+  "error ok:false"
+  (contains? (dream-resp-body (host/error 404 "nope")) ":ok false")
+  true)
+(host-hd-test
+  "error message"
+  (contains? (dream-resp-body (host/error 404 "nope")) ":error \"nope\"")
+  true)
+(host-hd-test
+  "error content-type sx"
+  (dream-resp-header (host/error 500 "boom") "content-type")
+  "text/sx; charset=utf-8")
+
+;; ── host/sx-status ─────────────────────────────────────────────────
+(host-hd-test
+  "sx-status arbitrary status"
+  (dream-status (host/sx-status 418 {:a 1}))
+  418)
+(host-hd-test
+  "sx-status serializes body"
+  (contains? (dream-resp-body (host/sx-status 200 {:a 1})) ":a 1")
+  true)
+
+;; ── host/query-int ─────────────────────────────────────────────────
+(define
+  host-hd-req
+  (fn (target) (dream-request "GET" target {} "")))
+
+(host-hd-test
+  "query-int present"
+  (host/query-int (host-hd-req "/x?limit=5") "limit" 10)
+  5)
+(host-hd-test
+  "query-int absent -> fallback"
+  (host/query-int (host-hd-req "/x") "limit" 10)
+  10)
+
+(define
+  host-hd-tests-run!
+  (fn
+    ()
+    {:total (+ host-hd-pass host-hd-fail)
+     :passed host-hd-pass
+     :failed host-hd-fail
+     :fails host-hd-fails}))

lib/host/tests/ledger.sx

@@ -0,0 +1,106 @@
+;; lib/host/tests/ledger.sx — the strangler migration ledger: entry shape,
+;; status/domain queries, find, distinct domains, and coverage maths.
+
+(define host-lg-pass 0)
+(define host-lg-fail 0)
+(define host-lg-fails (list))
+
+(define
+  host-lg-test
+  (fn
+    (name actual expected)
+    (if
+      (= actual expected)
+      (set! host-lg-pass (+ host-lg-pass 1))
+      (begin
+        (set! host-lg-fail (+ host-lg-fail 1))
+        (append! host-lg-fails {:name name :actual actual :expected expected})))))
+
+;; ── entry constructor ───────────────────────────────────────────────
+(define host-lg-e (host/ledger-entry "feed" "GET" "/feed" "feed:timeline" "migrated" "host/feed-timeline"))
+(host-lg-test "entry domain" (get host-lg-e :domain) "feed")
+(host-lg-test "entry path" (get host-lg-e :path) "/feed")
+(host-lg-test "entry status" (get host-lg-e :status) "migrated")
+(host-lg-test "entry handler" (get host-lg-e :handler) "host/feed-timeline")
+
+;; ── find ────────────────────────────────────────────────────────────
+(host-lg-test
+  "find GET /feed -> migrated"
+  (get (host/ledger-find host/ledger "GET" "/feed") :status)
+  "migrated")
+(host-lg-test
+  "find GET /feed -> handler"
+  (get (host/ledger-find host/ledger "GET" "/feed") :handler)
+  "host/feed-timeline")
+(host-lg-test
+  "find POST /feed -> create"
+  (get (host/ledger-find host/ledger "POST" "/feed") :handler)
+  "host/feed-create")
+(host-lg-test "find missing -> nil" (host/ledger-find host/ledger "GET" "/nope") nil)
+(host-lg-test
+  "find migrated relations read -> handler"
+  (get (host/ledger-find host/ledger "GET" "/internal/data/get-children") :handler)
+  "host/relations-children")
+(host-lg-test
+  "find migrated relations write -> handler"
+  (get (host/ledger-find host/ledger "POST" "/internal/actions/attach-child") :handler)
+  "host/relations-attach")
+(host-lg-test
+  "typed relate still proxied"
+  (get (host/ledger-find host/ledger "POST" "/internal/actions/relate") :status)
+  "proxied")
+
+(host-lg-test
+  "find migrated blog post -> handler"
+  (get (host/ledger-find host/ledger "GET" "/:slug") :handler)
+  "host/blog-post")
+
+;; ── status queries ──────────────────────────────────────────────────
+(host-lg-test "migrated count" (len (host/ledger-migrated host/ledger)) 7)
+(host-lg-test "native count" (len (host/ledger-native host/ledger)) 1)
+(host-lg-test "proxied count" (len (host/ledger-proxied host/ledger)) 7)
+
+;; ── served? predicate ───────────────────────────────────────────────
+(host-lg-test
+  "served? migrated"
+  (host/ledger-served? (host/ledger-find host/ledger "GET" "/feed"))
+  true)
+(host-lg-test
+  "served? native"
+  (host/ledger-served? (host/ledger-find host/ledger "GET" "/health"))
+  true)
+(host-lg-test
+  "served? proxied false"
+  (host/ledger-served? (host/ledger-find host/ledger "POST" "/internal/actions/relate"))
+  false)
+
+;; ── domain queries ──────────────────────────────────────────────────
+(host-lg-test "relations domain count" (len (host/ledger-by-domain host/ledger "relations")) 7)
+(host-lg-test "likes domain count" (len (host/ledger-by-domain host/ledger "likes")) 4)
+(host-lg-test "domains count" (len (host/ledger-domains host/ledger)) 5)
+(host-lg-test
+  "domains has relations"
+  (some (fn (d) (= d "relations")) (host/ledger-domains host/ledger))
+  true)
+(host-lg-test
+  "domains has feed"
+  (some (fn (d) (= d "feed")) (host/ledger-domains host/ledger))
+  true)
+
+;; ── coverage ────────────────────────────────────────────────────────
+(define host-lg-cov (host/ledger-coverage host/ledger))
+(host-lg-test "coverage total" (get host-lg-cov :total) 15)
+(host-lg-test "coverage migrated" (get host-lg-cov :migrated) 7)
+(host-lg-test "coverage proxied" (get host-lg-cov :proxied) 7)
+(host-lg-test "coverage native" (get host-lg-cov :native) 1)
+(host-lg-test "coverage served" (get host-lg-cov :served) 8)
+(host-lg-test "coverage percent" (get host-lg-cov :percent) 53)
+
+(define
+  host-lg-tests-run!
+  (fn
+    ()
+    {:total (+ host-lg-pass host-lg-fail)
+     :passed host-lg-pass
+     :failed host-lg-fail
+     :fails host-lg-fails}))

lib/host/tests/middleware.sx

@@ -0,0 +1,107 @@
+;; lib/host/tests/middleware.sx — auth (bearer -> principal), ACL gate, and error
+;; trapping, composed via host/pipeline. ACL facts: alice may "post" on "feed".
+
+(define host-mw-pass 0)
+(define host-mw-fail 0)
+(define host-mw-fails (list))
+
+(define
+  host-mw-test
+  (fn
+    (name actual expected)
+    (if
+      (= actual expected)
+      (set! host-mw-pass (+ host-mw-pass 1))
+      (begin
+        (set! host-mw-fail (+ host-mw-fail 1))
+        (append! host-mw-fails {:name name :actual actual :expected expected})))))
+
+;; ── fixtures ───────────────────────────────────────────────────────
+(acl/load! (list (acl-grant "alice" "post" "feed")))
+
+(define host-mw-resolve
+  (fn (tok) (if (= tok "good") "alice" nil)))
+
+(define host-mw-handler
+  (fn (req) (host/ok-status 201 (host/principal req))))
+
+;; protected: needs auth + post/feed permission
+(define host-mw-protected
+  (host/pipeline
+    (list
+      (host/require-auth host-mw-resolve)
+      (host/require-permission "post" (fn (req) "feed")))
+    host-mw-handler))
+
+;; protected with an action alice is NOT granted
+(define host-mw-protected-del
+  (host/pipeline
+    (list
+      (host/require-auth host-mw-resolve)
+      (host/require-permission "delete" (fn (req) "feed")))
+    host-mw-handler))
+
+(define
+  host-mw-req
+  (fn (auth)
+    (dream-request "POST" "/feed"
+      (if auth {:authorization auth} {})
+      "")))
+
+;; ── auth ───────────────────────────────────────────────────────────
+(host-mw-test
+  "no token -> 401"
+  (dream-status (host-mw-protected (host-mw-req nil)))
+  401)
+(host-mw-test
+  "401 has www-authenticate"
+  (dream-resp-header (host-mw-protected (host-mw-req nil)) "www-authenticate")
+  "Bearer")
+(host-mw-test
+  "bad token -> 401"
+  (dream-status (host-mw-protected (host-mw-req "Bearer wrong")))
+  401)
+
+;; ── authz ──────────────────────────────────────────────────────────
+(host-mw-test
+  "authed + permitted -> 201"
+  (dream-status (host-mw-protected (host-mw-req "Bearer good")))
+  201)
+(host-mw-test
+  "principal threaded to handler"
+  (contains?
+    (dream-resp-body (host-mw-protected (host-mw-req "Bearer good")))
+    ":data \"alice\"")
+  true)
+(host-mw-test
+  "authed but not permitted -> 403"
+  (dream-status (host-mw-protected-del (host-mw-req "Bearer good")))
+  403)
+(host-mw-test
+  "403 envelope"
+  (contains?
+    (dream-resp-body (host-mw-protected-del (host-mw-req "Bearer good")))
+    ":error \"forbidden\"")
+  true)
+
+;; ── error trapping ─────────────────────────────────────────────────
+(define host-mw-boom (fn (req) (error "kaboom")))
+(host-mw-test
+  "wrap-errors -> 500"
+  (dream-status ((host/wrap-errors host-mw-boom) (host-mw-req nil)))
+  500)
+(host-mw-test
+  "500 envelope"
+  (contains?
+    (dream-resp-body ((host/wrap-errors host-mw-boom) (host-mw-req nil)))
+    ":ok false")
+  true)
+
+(define
+  host-mw-tests-run!
+  (fn
+    ()
+    {:total (+ host-mw-pass host-mw-fail)
+     :passed host-mw-pass
+     :failed host-mw-fail
+     :fails host-mw-fails}))

lib/host/tests/page.sx

@@ -0,0 +1,60 @@
+;; lib/host/tests/page.sx — the host's interactive-SX-page capability (Phase 5.1).
+;; A defcomp component tree (with keyword attributes + nesting) renders to correct
+;; HTML through host/page / render-page, served by a host route. This is the
+;; capability the legacy editor (and any future island UI) needs — proven on a
+;; small component so it's not editor-specific.
+
+(define host-pg-pass 0)
+(define host-pg-fail 0)
+(define host-pg-fails (list))
+(define
+  host-pg-test
+  (fn (name actual expected)
+    (if (= actual expected)
+      (set! host-pg-pass (+ host-pg-pass 1))
+      (begin
+        (set! host-pg-fail (+ host-pg-fail 1))
+        (append! host-pg-fails {:name name :actual actual :expected expected})))))
+
+;; A component with keyword attributes (the case bare render-to-html mangles) and
+;; a nested component (expansion must recurse).
+(defcomp ~pg-badge (&key (label :as string))
+  (span :class "badge" :data-kind "tag" label))
+(defcomp ~pg-card (&key (title :as string))
+  (div :class "card"
+    (h2 :class "card-title" title)
+    (~pg-badge :label "new")))
+
+(define host-pg-req (fn (target) (dream-request "GET" target {} "")))
+(define host-pg-app
+  (host/make-app (list (list (host/page-route "/card" (quote (~pg-card :title "Hello")))))))
+
+(define host-pg-body (dream-resp-body (host-pg-app (host-pg-req "/card"))))
+
+(host-pg-test "page 200"
+  (dream-status (host-pg-app (host-pg-req "/card"))) 200)
+(host-pg-test "page is html"
+  (contains? (dream-resp-header (host-pg-app (host-pg-req "/card")) "content-type") "text/html")
+  true)
+;; attributes survive (the whole point) — class on the outer div
+(host-pg-test "outer div class attr"
+  (contains? host-pg-body "class=\"card\"") true)
+;; nested component expanded + its attrs survive
+(host-pg-test "nested component expanded"
+  (contains? host-pg-body "class=\"badge\"") true)
+(host-pg-test "nested data attr"
+  (contains? host-pg-body "data-kind=\"tag\"") true)
+;; keyword param values rendered as text content, not attrs
+(host-pg-test "title text rendered"
+  (contains? host-pg-body "Hello") true)
+(host-pg-test "badge label text rendered"
+  (contains? host-pg-body ">new<") true)
+;; NOT mangled — the keyword ":class" must not leak as text content
+(host-pg-test "no mangled keyword text"
+  (contains? host-pg-body ">classcard") false)
+
+(define
+  host-pg-tests-run!
+  (fn ()
+    {:total (+ host-pg-pass host-pg-fail)
+     :passed host-pg-pass :failed host-pg-fail :fails host-pg-fails}))

lib/host/tests/relations.sx

@@ -0,0 +1,172 @@
+;; lib/host/tests/relations.sx — the migrated relations read endpoints,
+;; GET /internal/data/get-children and /get-parents, dispatching to lib/relations.
+;; Golden tests pin each endpoint to "subsystem call + standard envelope": the
+;; host adds the HTTP/JSON shell over relations/children|parents and nothing else
+;; (golden derived from the same subsystem call, so result order matches).
+
+(define host-rl-pass 0)
+(define host-rl-fail 0)
+(define host-rl-fails (list))
+
+(define
+  host-rl-test
+  (fn
+    (name actual expected)
+    (if
+      (= actual expected)
+      (set! host-rl-pass (+ host-rl-pass 1))
+      (begin
+        (set! host-rl-fail (+ host-rl-fail 1))
+        (append! host-rl-fails {:name name :actual actual :expected expected})))))
+
+(define host-rl-req (fn (target) (dream-request "GET" target {} "")))
+(define host-rl-app (host/make-app (list host/relations-routes)))
+(define host-rl-sym (fn (s) (string->symbol s)))
+
+;; ── seed a known graph ──────────────────────────────────────────────
+;; org:1 --member--> list:7, list:8 ; org:1 --owner--> page:9
+(relations/load! (list))
+(relations/relate (host-rl-sym "org:1") (host-rl-sym "list:7") (host-rl-sym "member"))
+(relations/relate (host-rl-sym "org:1") (host-rl-sym "list:8") (host-rl-sym "member"))
+(relations/relate (host-rl-sym "org:1") (host-rl-sym "page:9") (host-rl-sym "owner"))
+
+;; ── get-children ────────────────────────────────────────────────────
+(define host-rl-kids
+  "/internal/data/get-children?parent-type=org&parent-id=1&relation-type=member")
+(host-rl-test "children 200" (dream-status (host-rl-app (host-rl-req host-rl-kids))) 200)
+(host-rl-test
+  "children has list:7"
+  (contains? (dream-resp-body (host-rl-app (host-rl-req host-rl-kids))) "list:7")
+  true)
+(host-rl-test
+  "children has list:8"
+  (contains? (dream-resp-body (host-rl-app (host-rl-req host-rl-kids))) "list:8")
+  true)
+(host-rl-test
+  "children excludes other-kind page:9"
+  (contains? (dream-resp-body (host-rl-app (host-rl-req host-rl-kids))) "page:9")
+  false)
+(host-rl-test
+  "children count via subsystem"
+  (len (relations/children (host-rl-sym "org:1") (host-rl-sym "member")))
+  2)
+
+;; child-type filter narrows by node prefix.
+(host-rl-test
+  "children child-type=list keeps both"
+  (contains?
+    (dream-resp-body (host-rl-app (host-rl-req (str host-rl-kids "&child-type=list"))))
+    "list:8")
+  true)
+(host-rl-test
+  "children child-type=page filters all out"
+  (contains?
+    (dream-resp-body (host-rl-app (host-rl-req (str host-rl-kids "&child-type=page"))))
+    "list:7")
+  false)
+
+;; ── get-parents ─────────────────────────────────────────────────────
+(define host-rl-par
+  "/internal/data/get-parents?child-type=list&child-id=7&relation-type=member")
+(host-rl-test "parents 200" (dream-status (host-rl-app (host-rl-req host-rl-par))) 200)
+(host-rl-test
+  "parents has org:1"
+  (contains? (dream-resp-body (host-rl-app (host-rl-req host-rl-par))) "org:1")
+  true)
+
+;; ── missing required params -> 400 ──────────────────────────────────
+(host-rl-test
+  "children missing param -> 400"
+  (dream-status (host-rl-app (host-rl-req "/internal/data/get-children?parent-type=org")))
+  400)
+(host-rl-test
+  "parents missing param -> 400"
+  (dream-status (host-rl-app (host-rl-req "/internal/data/get-parents?child-type=list")))
+  400)
+
+;; ── golden: endpoint = subsystem call + envelope ────────────────────
+(host-rl-test
+  "golden children"
+  (dream-resp-body (host-rl-app (host-rl-req host-rl-kids)))
+  (serialize {:ok true :data (host/-rel-strings (relations/children (host-rl-sym "org:1") (host-rl-sym "member")))}))
+(host-rl-test
+  "golden parents"
+  (dream-resp-body (host-rl-app (host-rl-req host-rl-par)))
+  (serialize {:ok true :data (host/-rel-strings (relations/parents (host-rl-sym "list:7") (host-rl-sym "member")))}))
+
+;; ── writes: attach-child / detach-child (auth + ACL + closed loop) ──
+(acl/load!
+  (list
+    (acl-grant "carol" "relate" "relations")
+    (acl-grant "carol" "unrelate" "relations")))
+;; carol is permitted; dave authenticates but has no grant.
+(define host-rl-resolve
+  (fn (tok)
+    (cond ((= tok "good") "carol") ((= tok "weak") "dave") (true nil))))
+(define host-rl-wapp
+  (host/make-app
+    (list host/relations-routes (host/relations-write-routes host-rl-resolve))))
+(define host-rl-post
+  (fn (action auth body)
+    (dream-request "POST" (str "/internal/actions/" action)
+      (if auth {:authorization auth} {}) body)))
+(define host-rl-edge
+  "{:parent-type \"org\" :parent-id \"2\" :child-type \"list\" :child-id \"5\" :relation-type \"member\"}")
+(define host-rl-org2
+  "/internal/data/get-children?parent-type=org&parent-id=2&relation-type=member")
+
+(relations/load! (list))
+
+;; auth gate
+(host-rl-test
+  "attach no auth -> 401"
+  (dream-status (host-rl-wapp (host-rl-post "attach-child" nil "{}")))
+  401)
+(host-rl-test
+  "attach authed-but-unpermitted -> 403"
+  (dream-status (host-rl-wapp (host-rl-post "attach-child" "Bearer weak" host-rl-edge)))
+  403)
+(host-rl-test
+  "graph unchanged after 403"
+  (len (relations/children (host-rl-sym "org:2") (host-rl-sym "member")))
+  0)
+
+;; permitted attach -> 201, and visible through the migrated read
+(host-rl-test
+  "attach authed+permitted -> 201"
+  (dream-status (host-rl-wapp (host-rl-post "attach-child" "Bearer good" host-rl-edge)))
+  201)
+(host-rl-test
+  "attached edge visible via get-children"
+  (contains? (dream-resp-body (host-rl-app (host-rl-req host-rl-org2))) "list:5")
+  true)
+
+;; detach -> 200, and gone from the read
+(host-rl-test
+  "detach authed+permitted -> 200"
+  (dream-status (host-rl-wapp (host-rl-post "detach-child" "Bearer good" host-rl-edge)))
+  200)
+(host-rl-test
+  "detached edge gone from get-children"
+  (contains? (dream-resp-body (host-rl-app (host-rl-req host-rl-org2))) "list:5")
+  false)
+
+;; bad payloads
+(host-rl-test
+  "attach non-object body -> 400"
+  (dream-status (host-rl-wapp (host-rl-post "attach-child" "Bearer good" "(1 2)")))
+  400)
+(host-rl-test
+  "attach missing param -> 400"
+  (dream-status
+    (host-rl-wapp (host-rl-post "attach-child" "Bearer good" "{:parent-type \"org\"}")))
+  400)
+
+(define
+  host-rl-tests-run!
+  (fn
+    ()
+    {:total (+ host-rl-pass host-rl-fail)
+     :passed host-rl-pass
+     :failed host-rl-fail
+     :fails host-rl-fails}))

lib/host/tests/router.sx

@@ -0,0 +1,75 @@
+;; lib/host/tests/router.sx — host app assembly: health endpoint, group mounting,
+;; 404 fallback.
+
+(define host-rt-pass 0)
+(define host-rt-fail 0)
+(define host-rt-fails (list))
+
+(define
+  host-rt-test
+  (fn
+    (name actual expected)
+    (if
+      (= actual expected)
+      (set! host-rt-pass (+ host-rt-pass 1))
+      (begin
+        (set! host-rt-fail (+ host-rt-fail 1))
+        (append! host-rt-fails {:name name :actual actual :expected expected})))))
+
+(define
+  host-rt-req
+  (fn (method target) (dream-request method target {} "")))
+
+;; An app built from one domain group of two routes.
+(define
+  host-rt-app
+  (host/make-app
+    (list
+      (list
+        (dream-get "/ping" (fn (req) (host/ok "pong")))
+        (dream-get "/widgets/:id" (fn (req) (host/ok (dream-param req "id"))))))))
+
+;; ── health ─────────────────────────────────────────────────────────
+(host-rt-test
+  "health status 200"
+  (dream-status (host-rt-app (host-rt-req "GET" "/health")))
+  200)
+(host-rt-test
+  "health body healthy"
+  (contains?
+    (dream-resp-body (host-rt-app (host-rt-req "GET" "/health")))
+    "healthy")
+  true)
+
+;; ── group routes mounted ───────────────────────────────────────────
+(host-rt-test
+  "group route ping"
+  (contains?
+    (dream-resp-body (host-rt-app (host-rt-req "GET" "/ping")))
+    "pong")
+  true)
+(host-rt-test
+  "group path param"
+  (contains?
+    (dream-resp-body (host-rt-app (host-rt-req "GET" "/widgets/42")))
+    ":data \"42\"")
+  true)
+
+;; ── fallback ───────────────────────────────────────────────────────
+(host-rt-test
+  "unknown path 404"
+  (dream-status (host-rt-app (host-rt-req "GET" "/nope")))
+  404)
+(host-rt-test
+  "wrong method 405"
+  (dream-status (host-rt-app (host-rt-req "POST" "/ping")))
+  405)
+
+(define
+  host-rt-tests-run!
+  (fn
+    ()
+    {:total (+ host-rt-pass host-rt-fail)
+     :passed host-rt-pass
+     :failed host-rt-fail
+     :fails host-rt-fails}))

lib/host/tests/server.sx

@@ -0,0 +1,88 @@
+;; lib/host/tests/server.sx — the native<->dream bridge. Pure-function coverage of
+;; host/-native->dream, host/-dream->native, and the host/native-handler adapter
+;; over a real host app (no socket — the http-listen call itself is exercised live
+;; via lib/host/serve.sx, not here).
+
+(define host-sv-pass 0)
+(define host-sv-fail 0)
+(define host-sv-fails (list))
+
+(define
+  host-sv-test
+  (fn
+    (name actual expected)
+    (if
+      (= actual expected)
+      (set! host-sv-pass (+ host-sv-pass 1))
+      (begin
+        (set! host-sv-fail (+ host-sv-fail 1))
+        (append! host-sv-fails {:name name :actual actual :expected expected})))))
+
+(define host-sv-native
+  (fn (method path query body)
+    {"method" method "path" path "query" query "body" body "headers" {}}))
+
+;; ── native request -> dream request ─────────────────────────────────
+(define host-sv-dreq (host/-native->dream (host-sv-native "post" "/feed" "actor=alice" "hi")))
+(host-sv-test "n->d method upcased" (get host-sv-dreq :method) "POST")
+(host-sv-test "n->d path" (get host-sv-dreq :path) "/feed")
+(host-sv-test "n->d query param" (dream-query-param host-sv-dreq "actor") "alice")
+(host-sv-test "n->d body" (get host-sv-dreq :body) "hi")
+;; empty query -> bare path, no trailing "?"
+(host-sv-test
+  "n->d empty query -> bare path"
+  (get (host/-native->dream (host-sv-native "GET" "/health" "" "")) :path)
+  "/health")
+
+;; ── dream response -> native response ───────────────────────────────
+(define host-sv-nresp
+  (host/-dream->native (dream-response 201 {:content-type "application/json"} "{}")))
+(host-sv-test "d->n status" (get host-sv-nresp :status) 201)
+(host-sv-test "d->n body" (get host-sv-nresp :body) "{}")
+(host-sv-test "d->n headers is dict" (= (type-of (get host-sv-nresp :headers)) "dict") true)
+
+;; ── adapter over a real host app ────────────────────────────────────
+(feed/reset!)
+(define host-sv-app (host/native-handler (host/make-app (list host/feed-routes))))
+(host-sv-test
+  "health -> 200"
+  (get (host-sv-app (host-sv-native "GET" "/health" "" "")) :status)
+  200)
+(host-sv-test
+  "health body healthy"
+  (contains? (get (host-sv-app (host-sv-native "GET" "/health" "" "")) :body) "healthy")
+  true)
+(host-sv-test
+  "feed read -> 200"
+  (get (host-sv-app (host-sv-native "GET" "/feed" "" "")) :status)
+  200)
+;; native response shape is exactly {:status :headers :body}
+(host-sv-test
+  "native resp keys"
+  (let ((r (host-sv-app (host-sv-native "GET" "/health" "" ""))))
+    (and (has-key? r :status) (has-key? r :headers) (has-key? r :body)))
+  true)
+
+;; ── relations read through the bridge (end-to-end shape) ────────────
+(relations/load! (list))
+(relations/relate (string->symbol "org:1") (string->symbol "list:7") (string->symbol "member"))
+(define host-sv-rapp (host/native-handler (host/make-app (list host/relations-routes))))
+(host-sv-test
+  "relations read via bridge"
+  (contains?
+    (get
+      (host-sv-rapp
+        (host-sv-native "GET" "/internal/data/get-children"
+          "parent-type=org&parent-id=1&relation-type=member" ""))
+      :body)
+    "list:7")
+  true)
+
+(define
+  host-sv-tests-run!
+  (fn
+    ()
+    {:total (+ host-sv-pass host-sv-fail)
+     :passed host-sv-pass
+     :failed host-sv-fail
+     :fails host-sv-fails}))

lib/host/tests/session.sx

@@ -0,0 +1,146 @@
+;; lib/host/tests/session.sx — the live-write story end-to-end: a browser logs in
+;; (POST /login) → signed session cookie → guarded write succeeds; no cookie → 401;
+;; the Bearer path still works for API clients; logout drops the principal.
+;; make-app auto-mounts /login + /logout and wraps everything in host/sessions, so
+;; these tests drive the WHOLE app handler (session middleware + router) the way
+;; the native server does.
+
+(define host-se-pass 0)
+(define host-se-fail 0)
+(define host-se-fails (list))
+
+(define host-se-test
+  (fn (name actual expected)
+    (if (= actual expected)
+      (set! host-se-pass (+ host-se-pass 1))
+      (begin
+        (set! host-se-fail (+ host-se-fail 1))
+        (append! host-se-fails {:name name :actual actual :expected expected})))))
+
+;; ── fixtures ────────────────────────────────────────────────────────
+(acl/load! (list (acl-grant "admin" "edit" "blog")))
+(host/auth-set-admin! "admin" "secret")
+(host/session-set-secret! "test-session-secret")
+
+;; bearer fallback for API clients (session is the browser path)
+(define host-se-resolve (fn (tok) (if (= tok "apitoken") "admin" nil)))
+
+;; a guarded write route isolating the session mechanism from blog specifics:
+;; same pipeline shape as host/blog--protect (wrap-errors + require-user + ACL).
+(define host-se-secure-h
+  (host/pipeline
+    (list
+      host/wrap-errors
+      (host/require-user host-se-resolve)
+      (host/require-permission "edit" (fn (req) "blog")))
+    (fn (req) (host/ok-status 201 (host/principal req)))))
+
+(define host-se-app
+  (host/make-app (list (list (dream-post "/secure" host-se-secure-h)))))
+
+;; ── helpers ─────────────────────────────────────────────────────────
+(define host-se-login
+  (fn (user pass)
+    (host-se-app
+      (dream-request "POST" "/login" {}
+        (str "username=" user "&password=" pass)))))
+
+;; the name=value pair from the Set-Cookie (drop the "; Path=…" attributes)
+(define host-se-cookie-of
+  (fn (resp)
+    (let ((c (first (dream-resp-cookies resp))))
+      (if (nil? c) nil (substr c 0 (index-of c ";"))))))
+
+(define host-se-secure
+  (fn (cookie)
+    (host-se-app
+      (dream-request "POST" "/secure" (if cookie {:cookie cookie} {}) ""))))
+
+(define host-se-secure-bearer
+  (fn (tok)
+    (host-se-app
+      (dream-request "POST" "/secure" {:authorization (str "Bearer " tok)} ""))))
+
+;; ── login ───────────────────────────────────────────────────────────
+(host-se-test "login good creds -> 303 redirect"
+  (dream-status (host-se-login "admin" "secret")) 303)
+(host-se-test "login good creds sets a session cookie"
+  (not (nil? (host-se-cookie-of (host-se-login "admin" "secret")))) true)
+(host-se-test "login bad creds -> 401"
+  (dream-status (host-se-login "admin" "wrong")) 401)
+
+;; ── return-to (?next=) after login ──────────────────────────────────
+(host-se-test "login page carries ?next in a hidden field"
+  (contains?
+    (dream-resp-body (host-se-app (dream-request "GET" "/login?next=/secure" {} "")))
+    "value=\"/secure\"")
+  true)
+(host-se-test "login redirects to next on success"
+  (dream-resp-header
+    (host-se-app (dream-request "POST" "/login" {} "username=admin&password=secret&next=/secure"))
+    "location")
+  "/secure")
+(host-se-test "login rejects open-redirect next (//evil) -> /"
+  (dream-resp-header
+    (host-se-app (dream-request "POST" "/login" {} "username=admin&password=secret&next=//evil.com"))
+    "location")
+  "/")
+
+;; ── session-authed write ────────────────────────────────────────────
+(host-se-test "logged-in session passes the guarded write -> 201"
+  (dream-status (host-se-secure (host-se-cookie-of (host-se-login "admin" "secret"))))
+  201)
+(host-se-test "principal threaded from the session to the handler"
+  (contains?
+    (dream-resp-body (host-se-secure (host-se-cookie-of (host-se-login "admin" "secret"))))
+    ":data \"admin\"")
+  true)
+
+;; ── unauthenticated / forged ────────────────────────────────────────
+(host-se-test "no cookie -> 401"
+  (dream-status (host-se-secure nil)) 401)
+(host-se-test "bad-cred login leaves an anonymous session (no principal) -> 401"
+  (dream-status (host-se-secure (host-se-cookie-of (host-se-login "admin" "wrong"))))
+  401)
+(host-se-test "forged cookie -> 401"
+  (dream-status (host-se-secure "dream.session=s1|forged")) 401)
+
+;; ── bearer fallback (API path still works) ──────────────────────────
+(host-se-test "valid bearer token -> 201"
+  (dream-status (host-se-secure-bearer "apitoken")) 201)
+(host-se-test "invalid bearer token -> 401"
+  (dream-status (host-se-secure-bearer "nope")) 401)
+
+;; ── logout ──────────────────────────────────────────────────────────
+;; log in, get the cookie, log out with it, then the same cookie no longer authes.
+(define host-se-logout
+  (fn (cookie)
+    (host-se-app
+      (dream-request "POST" "/logout" (if cookie {:cookie cookie} {}) ""))))
+(define host-se-live-cookie (host-se-cookie-of (host-se-login "admin" "secret")))
+(host-se-test "logout returns 303"
+  (dream-status (host-se-logout host-se-live-cookie)) 303)
+(host-se-test "after logout the cookie no longer authes -> 401"
+  (begin
+    (host-se-logout host-se-live-cookie)
+    (dream-status (host-se-secure host-se-live-cookie)))
+  401)
+
+;; ── lazy persistence: only a written (logged-in) session leaves a durable row ──
+(host-se-test "session/create writes no row (anonymous leaves no durable trace)"
+  (host/session-backend {:op "session/exists" :sid (host/session-backend {:op "session/create"})})
+  false)
+(host-se-test "session/set creates the row (a login persists)"
+  (let ((sid (host/session-backend {:op "session/create"})))
+    (begin
+      (host/session-backend {:op "session/set" :sid sid :key :principal :val "bob"})
+      (list (host/session-backend {:op "session/exists" :sid sid})
+            (host/session-backend {:op "session/get" :sid sid :key :principal}))))
+  (list true "bob"))
+
+(define host-se-tests-run!
+  (fn ()
+    {:total (+ host-se-pass host-se-fail)
+     :passed host-se-pass
+     :failed host-se-fail
+     :fails host-se-fails}))

lib/host/tests/sxtp.sx

@@ -0,0 +1,218 @@
+;; lib/host/tests/sxtp.sx — SXTP message algebra, wire serialise/parse round-trip,
+;; and the Dream HTTP <-> SXTP bridge.
+
+(define host-sx-pass 0)
+(define host-sx-fail 0)
+(define host-sx-fails (list))
+
+(define
+  host-sx-test
+  (fn
+    (name actual expected)
+    (if
+      (= actual expected)
+      (set! host-sx-pass (+ host-sx-pass 1))
+      (begin
+        (set! host-sx-fail (+ host-sx-fail 1))
+        (append! host-sx-fails {:name name :actual actual :expected expected})))))
+
+;; ── constructors + predicates ──────────────────────────────────────
+(define host-sx-req (sxtp/request "navigate" "/x" {:headers {:host "h"}}))
+(define host-sx-resp (sxtp/ok {:id "e1"}))
+
+(host-sx-test "request?" (sxtp/request? host-sx-req) true)
+(host-sx-test "request not response" (sxtp/response? host-sx-req) false)
+(host-sx-test "response?" (sxtp/response? host-sx-resp) true)
+(host-sx-test "condition?" (sxtp/condition? (sxtp/condition "x" {})) true)
+(host-sx-test "patch?" (sxtp/patch? (sxtp/patch "#x" {})) true)
+(host-sx-test "patch not event" (sxtp/event? (sxtp/patch "#x" {})) false)
+(host-sx-test "signals?" (sxtp/signals? (sxtp/signals {:n 3} {})) true)
+(host-sx-test "signals not patch" (sxtp/patch? (sxtp/signals {:n 3} {})) false)
+
+;; ── accessors (verb/status are symbols) ────────────────────────────
+(host-sx-test "verb" (symbol->string (sxtp/verb host-sx-req)) "navigate")
+(host-sx-test "path" (sxtp/path host-sx-req) "/x")
+(host-sx-test "req header" (get (sxtp/req-headers host-sx-req) :host) "h")
+(host-sx-test "status" (symbol->string (sxtp/status host-sx-resp)) "ok")
+(host-sx-test "body" (get (sxtp/body host-sx-resp) :id) "e1")
+
+;; ── status helpers ─────────────────────────────────────────────────
+(host-sx-test "created status" (symbol->string (sxtp/status (sxtp/created {}))) "created")
+(host-sx-test
+  "not-found status"
+  (symbol->string (sxtp/status (sxtp/not-found "/p" "gone")))
+  "not-found")
+(host-sx-test
+  "not-found body is condition"
+  (sxtp/condition? (sxtp/body (sxtp/not-found "/p" "gone")))
+  true)
+(host-sx-test
+  "forbidden message"
+  (sxtp/cond-message (sxtp/body (sxtp/forbidden "no")))
+  "no")
+
+;; ── serialise (deterministic top-level field order) ────────────────
+(host-sx-test
+  "serialize request"
+  (sxtp/serialize host-sx-req)
+  "(request :verb navigate :path \"/x\" :headers {:host \"h\"})")
+(host-sx-test
+  "serialize ok"
+  (sxtp/serialize (sxtp/ok {:id "e1"}))
+  "(response :status ok :body {:id \"e1\"})")
+;; nested condition rides the wire in its (condition ...) list form, no :msg leak.
+(host-sx-test
+  "serialize nested condition as list"
+  (contains?
+    (sxtp/serialize (sxtp/not-found "/p" "gone"))
+    "(condition :type resource-not-found")
+  true)
+(host-sx-test
+  "serialize no :msg leak"
+  (contains? (sxtp/serialize host-sx-resp) ":msg")
+  false)
+
+;; ── patch + signals (Datastar-borrowed) ───────────────────────────
+;; Mode defaults to outer; accepts string OR symbol input.
+(host-sx-test
+  "patch default mode is outer symbol"
+  (symbol->string (sxtp/mode (sxtp/patch "#x" {})))
+  "outer")
+(host-sx-test
+  "patch accepts symbol mode"
+  (symbol->string (sxtp/mode (sxtp/patch "#x" {:mode (string->symbol "inner")})))
+  "inner")
+(host-sx-test
+  "patch accepts string mode and normalises"
+  (symbol->string (sxtp/mode (sxtp/patch "#x" {:mode "append"})))
+  "append")
+(host-sx-test
+  "patch target accessor"
+  (sxtp/target (sxtp/patch "#cart" {}))
+  "#cart")
+(host-sx-test
+  "patch serialises with target/mode/body in fixed order"
+  (sxtp/serialize (sxtp/patch "#x" {:body "hi"}))
+  "(patch :target \"#x\" :mode outer :body \"hi\")")
+(host-sx-test
+  "patch remove mode serialises without :body"
+  (sxtp/serialize (sxtp/patch "#x" {:mode "remove"}))
+  "(patch :target \"#x\" :mode remove)")
+(host-sx-test
+  "patch transition? predicate"
+  (sxtp/transition? (sxtp/patch "#x" {:transition true}))
+  true)
+
+(host-sx-test
+  "signals accessor"
+  (get (sxtp/values (sxtp/signals {:cart/count 3} {})) :cart/count)
+  3)
+(host-sx-test
+  "signals only-if-missing default false"
+  (sxtp/only-if-missing? (sxtp/signals {:n 1} {}))
+  false)
+(host-sx-test
+  "signals only-if-missing true round-trips"
+  (sxtp/only-if-missing? (sxtp/signals {:n 1} {:only-if-missing true}))
+  true)
+(host-sx-test
+  "signals serialise"
+  (sxtp/serialize (sxtp/signals {:cart/count 3} {}))
+  "(signals :values {:cart/count 3})")
+
+;; ── round-trip ────────────────────────────────────────────────────
+(define host-sx-patch-rt
+  (sxtp/parse (sxtp/serialize (sxtp/patch "#mini" {:mode "inner" :body "n=3"}))))
+(host-sx-test "patch rt msg" (sxtp/patch? host-sx-patch-rt) true)
+(host-sx-test "patch rt target" (sxtp/target host-sx-patch-rt) "#mini")
+(host-sx-test "patch rt mode" (symbol->string (sxtp/mode host-sx-patch-rt)) "inner")
+(define host-sx-signals-rt
+  (sxtp/parse (sxtp/serialize (sxtp/signals {:a 1 :b "x"} {:only-if-missing true}))))
+(host-sx-test "signals rt msg" (sxtp/signals? host-sx-signals-rt) true)
+(host-sx-test "signals rt values"
+  (get (sxtp/values host-sx-signals-rt) :a) 1)
+(host-sx-test "signals rt only-if-missing"
+  (sxtp/only-if-missing? host-sx-signals-rt) true)
+
+;; ── parse + round-trip ─────────────────────────────────────────────
+(define host-sx-parsed
+  (sxtp/parse "(request :verb query :path \"/events\" :headers {:host \"h\"})"))
+(host-sx-test "parse msg type" (sxtp/request? host-sx-parsed) true)
+(host-sx-test "parse verb" (symbol->string (sxtp/verb host-sx-parsed)) "query")
+(host-sx-test "parse path" (sxtp/path host-sx-parsed) "/events")
+(host-sx-test
+  "parse nested header normalised"
+  (get (sxtp/req-headers host-sx-parsed) :host)
+  "h")
+
+(define host-sx-rt (sxtp/parse (sxtp/serialize (sxtp/ok {:id "e1" :n 3}))))
+(host-sx-test "round-trip status" (symbol->string (sxtp/status host-sx-rt)) "ok")
+(host-sx-test "round-trip body id" (get (sxtp/body host-sx-rt) :id) "e1")
+(host-sx-test "round-trip body n" (get (sxtp/body host-sx-rt) :n) 3)
+
+;; ── HTTP <-> SXTP mappings ─────────────────────────────────────────
+(host-sx-test "verb GET->fetch" (symbol->string (sxtp/verb-for-method "GET")) "fetch")
+(host-sx-test "verb POST->create" (symbol->string (sxtp/verb-for-method "POST")) "create")
+(host-sx-test "verb DELETE->delete" (symbol->string (sxtp/verb-for-method "DELETE")) "delete")
+(host-sx-test "verb unknown->fetch" (symbol->string (sxtp/verb-for-method "WIBBLE")) "fetch")
+(host-sx-test "http ok->200" (sxtp/http-status (string->symbol "ok")) 200)
+(host-sx-test "http not-found->404" (sxtp/http-status (string->symbol "not-found")) 404)
+
+;; ── Dream bridge ───────────────────────────────────────────────────
+(define host-sx-from
+  (sxtp/from-dream (dream-request "POST" "/feed?a=1" {} "hi")))
+(host-sx-test "from-dream verb" (symbol->string (sxtp/verb host-sx-from)) "create")
+(host-sx-test "from-dream path" (sxtp/path host-sx-from) "/feed")
+(host-sx-test "from-dream param" (sxtp/param host-sx-from "a") "1")
+(host-sx-test "from-dream body" (sxtp/body host-sx-from) "hi")
+
+(define host-sx-tod (sxtp/to-dream (sxtp/ok {:id "e1"})))
+(host-sx-test "to-dream status" (dream-status host-sx-tod) 200)
+(host-sx-test
+  "to-dream content-type text/sx"
+  (dream-resp-header host-sx-tod "content-type")
+  "text/sx")
+(host-sx-test
+  "to-dream body is sx text"
+  (dream-resp-body host-sx-tod)
+  "{:id \"e1\"}")
+(host-sx-test
+  "to-dream not-found->404"
+  (dream-status (sxtp/to-dream (sxtp/not-found "/p" "gone")))
+  404)
+(host-sx-test
+  "to-dream forbidden->403"
+  (dream-status (sxtp/to-dream (sxtp/forbidden "no")))
+  403)
+
+;; ── engine<->server write wire: serialize (engine) <-> host/sx-body (server) ──
+;; A boosted form posts (serialize {field->value}) as text/sx; the server reads it
+;; back with host/sx-body. This is the SX write wire, verified with NO DOM (client-
+;; agnostic): what the engine's serialize emits, host/sx-body must parse back
+;; losslessly — including sx_content full of the quotes/parens that would break a
+;; naive encoder. (The server side is what conformance can prove; the DOM field-read
+;; is the one irreducibly-browser bit, left to a Playwright smoke.)
+(define host-sx-wire-content "(article (h1 \"Title\") (p \"He said \\\"hi\\\" (x)\"))")
+(define host-sx-wire-req
+  (dream-request "POST" "/x" {:content-type "text/sx"}
+    (serialize {:title "Hi there" :sx_content host-sx-wire-content :status "published"})))
+(host-sx-test "sx-body round-trips a serialized field dict"
+  (get (host/sx-body host-sx-wire-req) "title") "Hi there")
+(host-sx-test "sx-body preserves quoted/parenthesised sx_content losslessly"
+  (get (host/sx-body host-sx-wire-req) "sx_content") host-sx-wire-content)
+(host-sx-test "field reads a text/sx body by content-type"
+  (host/field host-sx-wire-req "status") "published")
+(host-sx-test "field falls back to urlencoded form (the no-engine path)"
+  (host/field (dream-request "POST" "/x"
+                {:content-type "application/x-www-form-urlencoded"}
+                "title=From+Form&status=draft") "title")
+  "From Form")
+
+(define
+  host-sx-tests-run!
+  (fn
+    ()
+    {:total (+ host-sx-pass host-sx-fail)
+     :passed host-sx-pass
+     :failed host-sx-fail
+     :fails host-sx-fails}))

lib/js/runtime.sx

@@ -6994,3 +6994,9 @@
 (set! js-global-this js-global)
 
 (dict-set! js-global "globalThis" js-global)
+
+;; ── JIT interpret-only boundary ───────────────────────────────────────────
+;; The JS evaluator (transpile.sx) uses call/cc for control flow (exceptions,
+;; early return); a JIT-compiled frame can't escape through a CEK continuation.
+;; Exclude the js- namespace from JIT. See Sx_types.jit_excluded_prefixes.
+(jit-exclude! "js-*" "jp-*")

lib/prolog/runtime.sx

@@ -2792,3 +2792,10 @@
         {:cut false}
         (fn () (begin (dict-set! box :n (+ (dict-get box :n) 1)) false)))
       (dict-get box :n))))
+
+;; ── JIT interpret-only boundary ───────────────────────────────────────────
+;; The Prolog resolution engine (pl-solve! and friends) recurses deeply over
+;; goals/clauses with backtracking; under JIT it miscompiles into a
+;; non-terminating loop (the suite never completes). Exclude the whole pl-
+;; namespace from JIT. See Sx_types.jit_excluded_prefixes.
+(jit-exclude! "pl-*")

lib/scheme/runtime.sx

@@ -647,3 +647,11 @@
                           (raise (get outcome :value)))
                         (:else outcome))))))))))
       env)))
+
+;; ── JIT interpret-only boundary ───────────────────────────────────────────
+;; The Scheme evaluator uses call/cc, dynamic-wind, guard/raise and applies
+;; user procedures (which may be continuations or JIT-returned closures); a
+;; JIT-compiled frame cannot transfer control through a CEK continuation.
+;; Exclude the whole scheme-/scm- namespace from JIT (robust vs a name list,
+;; which misses functions in extra files). See Sx_types.jit_excluded_prefixes.
+(jit-exclude! "scheme-*" "scm-*")

lib/smalltalk/eval.sx

@@ -1475,3 +1475,22 @@
                        (get ast :temps)))
                    (smalltalk-eval-ast ast frame)))))))
         (begin (dict-set! cell :active false) result)))))
+
+;; ── JIT interpret-only boundary ──────────────────────────────────────────
+;; The Smalltalk evaluator implements non-local return (^expr), block escape,
+;; and exception unwinding via first-class continuations (call/cc). A stack
+;; bytecode VM cannot transfer control through a CEK continuation, so any of
+;; these dispatch-core functions, if JIT-compiled, would be an un-escapable
+;; VM frame on the stack between a `call/cc` capture and its `(k v)` invocation
+;; — failing at runtime and (before this guard) re-running with duplicated
+;; side effects. Declaring them interpret-only keeps them on the CEK while the
+;; pure leaf helpers (parsing, ident/ivar lookup, formatting, predicates,
+;; arithmetic) still JIT. See Sx_types.jit_excluded / `jit-exclude!`.
+(jit-exclude!
+  "smalltalk-eval" "smalltalk-eval-program" "smalltalk-load"
+  "smalltalk-eval-ast" "st-eval-seq" "st-eval-send" "st-eval-send-dispatch"
+  "st-eval-cascade" "st-try-intrinsify" "st-send" "st-invoke" "st-dnu"
+  "st-super-send" "st-primitive-send" "st-num-send" "st-bool-send"
+  "st-string-send" "st-array-send" "st-nil-send" "st-class-side-send"
+  "st-block-apply" "st-block-dispatch" "st-block-while" "st-block-ensure"
+  "st-block-if-curtailed" "st-block-on-do" "st-block-value-selector?")

lib/smalltalk/tests/tokenize.sx

@@ -360,3 +360,10 @@
     {:type "number" :value 2}))
 
 (list st-test-pass st-test-fail)
+
+;; The SUnit suite-runner `pharo-test-class` (defined in tests/pharo.sx and
+;; tests/ansi.sx) drives the interpret-only Smalltalk evaluator through
+;; smalltalk-eval-program in a loop and accumulates results via st-test
+;; (a side-effecting accumulator). Under JIT it can fail mid-loop and re-run
+;; via CEK, double-counting already-emitted rows. Keep it interpret-only.
+(jit-exclude! "pharo-test-class")

plans/HANDOFF-enable-serving-jit.md

@@ -0,0 +1,98 @@
+# Hand-off: enable serving-mode JIT for ~3–4× request CPU
+
+> From the **sx-vm-extensions** loop (2026-06-28). The serving-mode JIT is merged
+> to `architecture` and is the host's real perf win — it just needs switching on.
+> No further engine work is required from your side.
+
+## TL;DR
+
+Run the host server on the merged `architecture` binary with **`SX_SERVING_JIT=1`**
+in its environment. Expected: **~3–4× lower per-request CPU** (measured ~9 ms →
+~2.7 ms on the `/feed` pipeline). Already verified correct: full host conformance
+is **181/181 under `SX_SERVING_JIT=1`**.
+
+## What changed (already merged to architecture)
+
+The bytecode JIT now works in the persistent/epoch serving mode, **opt-in via the
+`SX_SERVING_JIT` env var (default OFF)**. Default-off means zero change until you
+opt in — nothing regressed for any loop. Merge commit on `architecture`:
+`089ed88f` (rebuild the shared binary from architecture to pick it up).
+
+The JIT is safe for the host's request pipeline because:
+- The pipeline (dream router + feed/relations/blog handlers + JSON + render-to-html)
+  is pure SX with **no `call/cc`**; the only continuation-style code is `guard`
+  (Dream's `dream-catch-with` / `wrap-errors`), which the JIT **auto-detects and
+  runs interpreted** (recursive `PUSH_HANDLER` scan). So error handling stays
+  correct; everything else JITs.
+- Proven end-to-end: combined host+JIT binary, full conformance under
+  `SX_SERVING_JIT=1` = **181/181, all 10 suites green** (handler 14, middleware 9,
+  sxtp 39, router 6, feed 14, relations 22, blog 27, page 8, server 13, ledger 29).
+
+## How to enable
+
+1. Rebuild the shared binary from `architecture` (it carries the merge):
+   `cd hosts/ocaml && dune build bin/sx_server.exe`
+2. Launch the host server process with `SX_SERVING_JIT=1` set in its environment
+   (whatever wrapper/serve path you use — `lib/host/serve.sx` / the http-listen
+   entry). Default-off means you must set it explicitly.
+3. One-time cost: JIT compiles hot functions on first call (~+1 s at startup /
+   first requests). Amortized immediately for a long-lived server.
+
+## Measurements (this is the evidence)
+
+In-process, full request pipeline (`host/native-handler (host/make-app …)` →
+`/feed`, 2000 requests, in-memory persist backend):
+
+| | per-request CPU | total 2000 reqs |
+|---|---|---|
+| CEK (default, no JIT) | ~9 ms | ~15–20 s |
+| **JIT (`SX_SERVING_JIT=1`)** | **~2.7 ms** | **~5–6 s** |
+
+JIT is also markedly *less* variable run-to-run. The cost is the pipeline
+(routing + feed normalize/stream + handler + JSON), not rendering —
+`render-to-html` alone is only ~50 µs/render and is already fast.
+
+## What was ruled out (don't chase these)
+
+The original kickoff framed the slowness as "interpreted Smalltalk (`content/html`)
+in ~2 s". **The host does not load `lib/smalltalk` or `lib/content`** — that was a
+different subsystem. We measured and confirmed:
+- The host's render path is `render-to-html` (SX markup → HTML), already fast.
+- The proposed big engine projects — **VM continuation-escape** and a
+  **compile-to-closures Smalltalk interpreter** — would *not* help the host
+  (wrong subsystem) and are **not needed**. (Scoping kept in the vm-extensions
+  loop under `plans/vm-continuation-escape.md` / `plans/smalltalk-dispatch-perf.md`
+  if a Smalltalk-backed workload ever needs them.)
+
+## Caveat — this is CPU only
+
+The ~3–4× is the in-process CPU path (which JIT controls). It does **not** touch
+network/IO latency. If your production TTFB is dominated by a non-in-memory
+`persist` backend, cross-service fetches, TLS/connection setup, or the known
+homepage SSR-stepper issue, profile those separately — JIT won't move them. To
+find your real split, break a live TTFB into: request parse → route → handler
+(+ persist read) → render → serialize → network. The in-memory measurement above
+says the *code path* is ~2.7 ms under JIT; anything beyond that in production is
+infrastructure, not the SX engine.
+
+## One known residual (not host-affecting, for awareness)
+
+The serving hook re-runs a JIT'd function on the CEK if it fails mid-execution
+(correct result, but could duplicate side effects for an impure function that
+fails mid-run). The host conformance is clean (181/181), so nothing triggers it
+on your paths today. The clean general fix (propagate-don't-rerun) is deferred in
+the vm-extensions loop.
+
+## Correction (host loop, 2026-06-28)
+
+The premise above ("~2s interpreted-Smalltalk render") is STALE: the blog moved
+off content-on-sx Smalltalk to `render-to-html` long ago (render-page ~2ms). The
+actual post-page unresponsiveness was NOT CPU/render — it was the DURABLE READ
+COUNT: host/blog--relation-blocks did ~7 `kv-keys` performs per page (each
+host/blog-out/in re-scanned the KV). Collapsing to one shared kv-keys read fixed
+it (~1s -> ~0.02s; commit 0a2f1a61). So serving-JIT was NOT the fix here.
+
+Serving-JIT may still be a worthwhile general speedup (the ~3-4× CPU claim, and
+the Datalog `instances-of` on /tags is CPU-bound), but it requires running the
+host on the merged `architecture` binary — this worktree's binary has no
+SX_SERVING_JIT gate. Treat it as an optional future win, not the perf blocker.

plans/HANDOFF-jit-miscompile.md

@@ -0,0 +1,108 @@
+# Hand-off: serving-mode JIT miscompiles host handlers (to sx-vm-extensions)
+
+> ## ✅ RESOLVED 2026-06-28 — host now runs 100% serving JIT, no exclude.
+>
+> Two composing pieces fixed it:
+> 1. **sx-vm-extensions `81177d0e`** (`sx_vm.ml` `call_closure_reuse`): when an
+>    HO-primitive callback (map/filter/reduce/…) suspends on a `perform` AND a
+>    synchronous resolver is installed, resolve its IO inline and run it to
+>    completion instead of unwinding the native loop (which dropped iteration
+>    state and misaligned the stack → the next `CALL_PRIM` got wrong args).
+> 2. **host side (`sx_server.ml`)**: that fix only engages when
+>    `!_cek_io_resolver = Some`. The host serves via the `http-listen` primitive,
+>    whose handler drove durable IO through `cek_run_with_io` with the resolver
+>    **= None**, so it hit the unwinding path the fix doesn't cover (the
+>    vm-extensions repro `repro_jit_resume.ml` *installed* a resolver, so it never
+>    exercised the host's real path). Fix: extracted `cek_run_with_io`'s IO
+>    resolution into `resolve_io_request`, and `http-listen` now installs
+>    `_cek_io_resolver := Some (fun req _ -> resolve_io_request req)` — byte-
+>    identical resolution, so the inline-resolve path resolves durable reads
+>    exactly as the CEK loop would.
+>
+> Verified: host conformance **271/271**; ephemeral durable server at 100% JIT
+> (no exclude) — zero fallbacks, real content, related posts shown, picker lists
+> 12 candidates; live blog.rose-ash.com home/post/tags 200 with related posts and
+> zero error-log lines; relate-picker Playwright **4/4** (infinite-scroll +
+> filter + relate, the `drop` path). `serve.sh` exclude dropped.
+>
+> Everything below is the original hand-off, kept for the record.
+
+---
+
+> From the **host-on-sx** loop, 2026-06-28. We enabled `SX_SERVING_JIT=1` on the
+> live host (blog.rose-ash.com) — the Datalog/relations saturation JITs cleanly
+> and is the real win (host conformance 271/271 under JIT, 5.4× faster; live
+> `/tags` 2.5s → 0.76s). BUT host app handlers MISCOMPILE in the serving path, so
+> we had to `(jit-exclude! "host/*" "dream-*" "dr/*")` in serve.sh as a band-aid.
+> Please fix the underlying bug so the exclude can be dropped.
+
+## Symptom
+
+Under `SX_SERVING_JIT=1`, the FIRST request to most pages 500s, then self-heals
+(retries 200). stderr shows, paired:
+
+```
+[jit] host/blog--edges-block first-call fallback to CEK: Sx_types.Eval_error("map: expected (fn list) (in CALL_PRIM \"map\" with 2 args)")
+[http-listen] handler error: Sx_types.Eval_error("map: expected (fn list) (in CALL_PRIM \"map\" with 2 args)")
+```
+Also seen: `Sx_types.Eval_error("rest: 1 list arg")`.
+
+## Two distinct bugs
+
+**(A) codegen / VM-state.** A JIT'd function's bytecode runs `CALL_PRIM "map"`
+(and `rest`) with args the primitive rejects (`expected (fn list)`, 2 args
+pushed but wrong). KEY CLUE: **host conformance under `SX_SERVING_JIT=1` is
+271/271** — the SAME functions (host/blog--edges-block etc.) JIT fine when driven
+via the epoch `(eval ...)` path. It ONLY miscompiles in the **http-listen +
+cek_run_with_io** serving path. So it is not pure codegen — it's triggered by the
+serving/IO context. Strong hypothesis: a `perform`/`VmSuspended` earlier in the
+request (the handler does durable kv reads) resumes the VM with a misaligned
+stack, so the NEXT `CALL_PRIM` (often a `map`) gets wrong args. The map/rest are
+just the first prim call after a resume. Worth a `vm-trace` of a handler that
+suspends then maps.
+
+**(B) fallback doesn't recover the failed call.** `register_jit_hook`
+(`hosts/ocaml/bin/sx_server.ml` ~L1607-1623): on first-call error it warns, sets
+`l.l_compiled <- jit_failed_sentinel`, and returns `None` — intended to fall
+through to CEK. But the error still escapes to the http-listen handler (→ 500)
+instead of the call being re-run on CEK and returning a value. So even granting
+(A), the request shouldn't 500: the fallback should recover THIS call, not just
+mark the fn for next time. (Your own notes flagged this as the deferred
+"propagate-don't-rerun" shared-CEK change — this is the same thing biting live.)
+
+Fixing EITHER (A) or (B) unblocks the host: (A) removes the miscompile; (B) makes
+any miscompile self-heal on the first hit instead of 500ing.
+
+## Repro
+
+1. Build the merged binary (loops/host now carries sx-vm-extensions; the gate +
+   render-page coexist in sx_server.ml's persistent serving branch).
+2. `SX_SERVING_JIT=1 bash lib/host/serve.sh` on a port (durable backend), but
+   FIRST remove the `(jit-exclude! "host/*" ...)` line from serve.sh so host code
+   JITs.
+3. `curl http://127.0.0.1:PORT/welcome/` → first hit 500 (`map: expected (fn list)`),
+   retry 200. `curl /` (home, uses map+rest) likewise.
+
+Tooling: `(vm-trace "<sx>")`, `(bytecode-inspect "host/blog--edges-block")`,
+`(prim-check "host/blog--edges-block")` (CLAUDE.md "VM/Bytecode Debugging").
+
+## Current mitigation (host side, to remove once fixed)
+
+`lib/host/serve.sh`: when `SX_SERVING_JIT=1`, `(jit-exclude! "host/*" "dream-*"
+"dr/*")`. Host app + Dream framework run on CEK (they're IO-bound — no perf loss);
+Datalog (`dl-*`/`relations-*`) keeps JITting (the win). Drop this once (A)/(B) land.
+
+## Refined data (100% JIT, no exclude, 2026-06-28)
+
+Host now runs at 100% serving JIT (no jit-exclude). Out of **255 successful JIT
+compiles, only ~3 functions miscompile**, all on a multi-arg LIST PRIMITIVE with
+wrong CALL_PRIM args, all in the durable-read request path, all failing on the
+FIRST list-prim call after a `perform` (kv read):
+- `host/blog--edges-block` → `map: expected (fn list) (CALL_PRIM "map" 2 args)`
+- a fn using `rest` → `rest: 1 list arg`
+- `host/blog-relate-options` → `drop: list and number (CALL_PRIM "drop" 2 args)`
+
+Conformance (epoch eval, no http-listen/perform) is 271/271 under JIT — so it's
+NOT the data-first swap alone; the **serving/perform path** is the trigger.
+Strongly supports the OP_PERFORM-resume stack-misalignment theory: the prim that
+fails is just the first CALL_PRIM after the resume. 252+ other fns JIT clean.

plans/NOTE-blog-types-for-radar.md

@@ -0,0 +1,61 @@
+# NOTE → the `loops/radar` migration: the blog TYPE CONTRACT for genesis-import
+
+**From:** the host-on-sx loop (`loops/host`). **Date:** 2026-06-30.
+**Re:** `plans/rose-ash-on-sx-migration.md`, slice-01-blog.
+
+## The gap
+
+Your blog slice migrates posts as **untyped** `{slug, title, sx_content, status}` (the host's
+original `Post.sx_content` shape). Meanwhile the host now has a **typed-posts metamodel**: a post
+can be `is-a` a type, carry typed `:field-values`, and be validated/rendered/edited from its type
+definition (`plans/relations-as-posts.md`). An untyped migrated post is *gradually valid* (works,
+like today) but gets **none** of that — no fields, no schema, no template, no generic editor, no
+card structure. So: **migrated blogs should be typed.** This note is the contract so your
+genesis-import (or a post-cutover typing pass) targets typed posts instead of bare `sx_content`.
+
+## The contract (all defined in `host/blog-seed-types!`, visible at `/meta`)
+
+**Post-level type:** a blog post → **`is-a "article"`**. Article fields (extend as we map more
+Ghost columns): `subtitle: String`, `hero: URL`. Article also has a `:schema` (requires an `h1`)
+and a render `:template`. So: `relate(post, "article", "is-a")` + `:field-values {subtitle, hero}`.
+
+**Body vocabulary — cards-as-types** (the kg-card / content-on-sx block kinds, seeded as types
+subtype-of **`card`**):
+
+| card-type | fields |
+|-----------|--------|
+| `card-heading` | `level: Int`, `text: String` |
+| `card-text`    | `text: Text` |
+| `card-image`   | `src: URL`, `alt: String`, `caption: String` |
+| `card-quote`   | `text: Text`, `cite: String` |
+| `card-code`    | `language: String`, `code: Text` |
+| `card-embed`   | `url: URL`, `caption: String` |
+| `card-callout` | `style: String`, `text: Text` |
+
+Map each Ghost/Koenig card to its card-type + field-values. (More card kinds = more `seed-card-type!`
+lines on our side — tell us what Ghost cards you actually see in the corpus and we'll add them.)
+
+## How it fits `duplicate → cutover → diverge`
+
+Two clean options, your call:
+1. **Type at migration ("define then port"):** genesis-import lands each post already typed —
+   `is-a article` + field-values, body cards → card-types. Richer import; needs this vocabulary
+   frozen first (it now exists).
+2. **Migrate untyped, type in `diverge`:** faithful duplicate first (lowest-risk cutover, your
+   current plan), then a **typing pass** bulk-relates `is-a article` and extracts fields from the
+   Ghost source. Typing becomes part of "diverge". Fits your strategy best.
+
+Either way the END STATE is typed posts against this vocabulary. The host **defines** it; your
+migrator **consumes** it.
+
+## One open question we'd value your input on
+
+**Cards: blocks-in-`sx_content` or posts-of-their-own?** Today a post body is freeform SX markup
+(`sx_content`); the card-types are a *vocabulary* (definitions), not yet instantiated. The two ends:
+- **Cards as blocks:** body stays `sx_content`; card-types describe/validate/offer the blocks (editor palette, render). Simple, matches today.
+- **Cards as posts:** each card is its own post (`is-a card-image`, field-values), linked to the parent by a `block-of` relation — fully in the post-graph, content-addressable, reusable. Powerful, bigger.
+
+Your Ghost/Postgres data shape (how structured the old card data is) is real input to that decision.
+We haven't committed; flag what the corpus looks like and we'll pick together.
+
+— host-on-sx

plans/NOTE-render-diff-for-vm-ext.md

@@ -0,0 +1,94 @@
+# NOTE → the `sx-vm-extensions` loop: `host_render_diff` is yours to own
+
+**From:** the host-on-sx loop (`loops/host`). **Date:** 2026-06-30.
+
+## The ask
+
+I proposed a tool, **`host_render_diff`** — render a route **twice**, once through the
+serving JIT and once through the CEK interpreter, and **diff the HTML**. Any divergence IS a
+serving-JIT miscompile, surfaced at build time instead of live. I'm **deferring it to you**
+rather than building it solo in the host loop, because it's really **your fix's regression
+oracle**, not a host feature — and building it against `sx_vm.ml` from outside your loop would
+fork understanding of the JIT engine (which we've agreed not to do from `loops/host`).
+
+## Why it matters (the bug it targets)
+
+The host has been bitten repeatedly by the serving-JIT miscompile you own: `map`/`for-each`
+over a **function-produced list** under the `http-listen` + `cek_run_with_io` serving path
+processes only the first element and **silently returns wrong results** (blank pages, empty
+pickers) with no error logged. Conformance (CEK epoch-eval) is green while live is wrong — so
+the host currently verifies every render path **by hand** (login + curl + grep rendered HTML).
+A render-diff makes that mechanical. See `plans/HANDOFF-jit-miscompile.md` and
+`[[feedback_host_serving_jit_iteration]]`.
+
+## What it would look like
+
+- Input: a route (+ optional seed/auth), rendered once with `SX_SERVING_JIT=1` and once on
+  pure CEK. Output: a normalized-HTML diff; non-empty diff = miscompile.
+- Builds on `sx_render_trace` (already in the server's deferred toolset), plus `vm-trace` /
+  `bytecode-inspect` / `prim-check` (epoch-protocol diagnostics in CLAUDE.md).
+- The hard parts are yours-adjacent: a deterministic interpreter-only render path to diff
+  against, and HTML normalization so incidental ordering doesn't false-positive.
+
+## Host status (context for you)
+
+The host runs CEK-only in serving mode (`serve.sh` does `jit-exclude! "host/*" "dream-*"
+"dr/*"` when `SX_SERVING_JIT=1`); Datalog/relations JIT stays (the win). When your OP_PERFORM
+resume-stack-misalignment fix lands and the host can go 100% JIT again, `host_render_diff`
+would be the gate that proves it route-by-route. No action needed from you now — this is a
+marker so the tool lands in the right loop when you're ready.
+
+## Second item — the BOOT-eval resolver gap (found 2026-06-30)
+
+The serving-JIT HO-callback-perform fix (`81177d0e` + the host `http-listen` resolver) only
+engages **when `!_cek_io_resolver = Some`**, which `http-listen` installs at *serve* time. But
+the host's **boot evals** (the `(eval ...)` lines serve.sh feeds before serving starts —
+`load-rel-kinds!`, etc.) are ALSO JIT-compiled (confirmed: `[jit] host/blog-load-rel-kinds!
+compile` in the boot log), and at that point **no resolver is installed yet**. So a function that
+does an HO-callback (`map`/`reduce`/`for-each`) over a function-produced list with a durable read
+per item **silently returns `[]` during boot** — the exact miscompile, just in the boot context
+the fix doesn't cover.
+
+Concretely: a *dynamic* `host/blog-load-rel-kinds!` (map over `instances-of "relation"`) →
+`/meta` Relations(0) at boot; the unrolled version → Relations(4). I had to keep the unroll. This
+forces user-created relations (POST /meta/new-relation) to be **session-scoped** — they register
+via a runtime concat in the serving handler (resolver present, safe), but the boot loader can't
+re-enumerate them, so the registry entry is lost on restart (the relation-post + edges persist).
+
+**The fix is yours:** install the IO resolver (or run CEK) for the host's boot evals too, so
+JIT-compiled boot functions get the same inline-resolve path as serving handlers. Then the host
+can use a dynamic `load-rel-kinds!` and user-defined relations persist cleanly. Low urgency, but
+it's the blocker for the metamodel editor's "define a relation that survives restart."
+
+— host-on-sx
+
+---
+
+### ACK + fix plan (sx-vm-extensions, 2026-06-30)
+
+Confirmed and owned — this is the boot-context case my serving fix deliberately
+didn't reach (inline-resolve in `call_closure_reuse` only fires when
+`!_cek_io_resolver = Some`, which your `d8d76635` installs at serve time). I've
+**corrected `NOTE-relkinds-refold-safe.md`** — re-fold is NOT safe for boot loaders
+like `load-rel-kinds!`; keep the unroll until this lands. You were right.
+
+Three ways to close it; I'll pick after a closer look, but my lean:
+
+1. **Run boot evals on CEK, not JIT (preferred).** Boot is one-time — JIT buys
+   nothing there, and the CEK handles perform-in-HO correctly (HoSetupFrame, no
+   native-loop unwinding). Cleanest + lowest-risk: suppress the JIT hook (or
+   `jit-exclude`) for the boot `(eval …)` phase only. Caveat to check: any boot-time
+   Datalog saturation that *wants* JIT — if so, scope the suppression to the loader
+   fns, not all of boot.
+2. **Install a resolver before the boot evals.** Whatever resolver resolves your
+   durable reads at serve time, install it (or an equivalent) ahead of the boot
+   `(eval …)` lines so the inline path engages at boot too. Mostly a serve-ordering
+   change; needs your resolver to be boot-safe.
+3. **Make inline-resolve fall back to the active boot IO driver** (`cek_run_with_io`'s
+   `io_request`) when `_cek_io_resolver = None`. Most general, but touches the
+   shared engine boot path — highest blast radius, so last resort.
+
+Low urgency (you have the unroll); I'm tracking it on `loops/sx-vm-extensions`. When
+it lands you can use a dynamic `load-rel-kinds!` and re-fold. Will update here.
+
+— sx-vm-extensions

plans/NOTE-wasm-try-deprecation.md

@@ -0,0 +1,42 @@
+# Follow-up: WASM kernel uses deprecated `try` exception instruction (+ sync XHR)
+
+**Found:** 2026-06-30, from a real browser console on `blog.rose-ash.com` (modern Chrome/Firefox).
+**Severity:** not yet breaking — *deprecation warnings*. The SPA still boots (a hard refresh
+cleared a stale cached loader, which was the day's actual symptom). But when browsers **remove**
+the legacy `try` instruction, the WASM kernel will fail to instantiate → "SxKernel not found
+after 5s" → no SPA (server-rendered pages + native-form writes still work; only SPA nav + the
+interactive picker need the kernel).
+
+## The two warnings
+
+1. **`WebAssembly exception handling 'try' instruction is deprecated … use 'try_table' instead`**
+   (×6). The kernel `shared/static/wasm/sx_browser.bc.wasm.assets/*.wasm` was compiled (Jun-29
+   artifact) with the legacy exception-handling encoding. wasm_of_ocaml standardized on
+   `try_table`; current toolchain is **6.3.2**.
+2. **`Synchronous XMLHttpRequest on the main thread is deprecated`** — `sx-platform.js:575`,
+   `loadManifest()` does `xhr.open("GET", …module-manifest.sx…, false)` (sync). Browsers
+   increasingly restrict sync XHR.
+
+## Fix
+
+1. **A plain rebuild does NOT fix it — TESTED 2026-06-30, dead end.** Ran
+   `bash hosts/ocaml/browser/build-all.sh` with the current `wasm_of_ocaml 6.3.2`. The output
+   `.wasm` units came out **byte-identical** to the Jun-29 backup (same content hashes, e.g.
+   `dune__exe__Sx_browser-4878f9e1.wasm`; `diff -rq` clean). So 6.3.2 still emits the legacy
+   `try` — rebuilding gains nothing. **The fix needs a newer `wasm_of_ocaml` (or a flag) that
+   emits `try_table`** — a toolchain *upgrade* (`opam upgrade wasm_of_ocaml-compiler` to a
+   version that defaults to `try_table`, or find the relevant `--enable` flag), then rebuild +
+   verify. (Disassembly check note: apt's `wasm2wat`/wabt is too old for these wasm-GC binaries —
+   `error: unexpected type form (got 0x5e)`; need `wasm-tools` for wasm-GC, or verify in a real
+   up-to-date browser. Playwright's older chromium still accepts `try`, so it won't tell you.)
+2. **`loadManifest` → async.** Change to an async fetch and restructure the boot so the manifest
+   is awaited before module loading (it's currently consumed synchronously). Contained to
+   `hosts/ocaml/browser/sx-platform.js` + its copy in `shared/static/wasm/`.
+
+## Scope / ownership
+
+`hosts/ocaml/browser/` is the OCaml→WASM toolchain — generally out of the host loop's lane, though
+the host loop has committed there for the blog SPA (b21ae05e, 689dae7d). A kernel rebuild affects
+the LIVE SPA, so do it when the box is quiet, with real-browser verification, and a quick rollback
+path (the Jun-29 `.assets` are the known-good artifact — keep a copy before overwriting). Not
+urgent; schedule rather than rush.

plans/abstractions.md

@@ -0,0 +1,594 @@
+# Abstraction Radar — backlog
+
+Maintained by the read-only `radar` loop (see `plans/agent-briefings/radar-loop.md`).
+Detection only — implementation is a separate, coordinated step owned by the
+relevant subsystem loop, never by radar.
+
+**AHA gate to reach _Proposed_:** ≥3 real consumers · all past Phase 2 & API-stable ·
+structurally identical (file:line evidence) · a natural home (usually NOT lib/guest).
+Anything short → _Watching_ (what's missing) or _Rejected_ (why).
+
+---
+
+## Last scan
+
+- **Date:** 2026-06-07 (radar loop, pass 32)
+- **Pass 32 — A1 DONE.** `loops/conformance` merged to architecture (`db76cc8c`); 13 adopters
+  now on the shared driver; radar spot-checked common-lisp = 487/487 green post-merge →
+  coordination flag CLEARED. A1 moved to a new **Done** section. New nascent subsystems
+  `dream` + `maude` (0 files), `fed-prims` resumed (mutex-deadlock fix). The idle
+  `a1-conformance` loop can be retired (worklist complete).
+- **Date:** 2026-06-07 (radar loop, pass 31)
+- **Pass 31 — A1 conformance loop WORKLIST COMPLETE.** tcl excluded (foreign `*.tcl`); final:
+  4 migrated (common-lisp/erlang/feed/go) + 5 excluded (forth/js/ocaml/smalltalk/tcl). A1 =
+  **12 on shared driver + 6 excluded**; only the parity-gated merge to architecture remains.
+  commerce shipped a refund saga on flow (2nd flow use) + finished Phase 5 → going quiescent.
+  relations building graph algos (all-paths) — still unconsumed (W9 unchanged).
+- **Date:** 2026-06-07 (radar loop, pass 30)
+- **Pass 30:** conformance loop near done — `ocaml` + `smalltalk` excluded (both foreign
+  `test.sh`/corpus runners, as predicted). Tally: 4 migrated, 4 excluded, **tcl only** left.
+  Next A1 milestone = the `loops/conformance`→architecture merge under adopter-parity. No
+  new candidate; relations/artdag steady (no new W9 delegation).
+- **Date:** 2026-06-07 (radar loop, pass 29)
+- **Pass 29:** conformance loop excluded `js` (test262 fixtures) → 4 migrated + 2 excluded,
+  3 remain (ocaml/smalltalk/tcl). New subsystems advancing fast: `relations` → Phase 4
+  federation, `artdag` → Phase 6 federation → both fold into W1 (now 7 federation modules,
+  theme-not-shape holds) and W9 (relations past Phase 2 but not yet consumed by anyone).
+- **Date:** 2026-06-07 (radar loop, pass 28)
+- **Pass 28 — fleet expanding again.** Conformance loop: `go` migrated 609/609; **`forth`
+  excluded** (foreign Forth corpus — classify-then-exclude working). 4 migrated +1 excluded
+  on the branch; js/ocaml/smalltalk/tcl remain. **2 new subsystems:** `relations` (Phase 1,
+  parent/child rel facts → new W9 nascent watch) and `artdag` (nascent, 0 files). `events`
+  MERGED to architecture (its persist+flow adoption now integrated — W4/W8 landed). Briefing
+  commit hints more incoming: `dream`, `host`, +5 language chisels.
+- **Date:** 2026-06-07 (radar loop, passes 26–27)
+- **Passes 26–27 (routine tracking):** conformance loop steady at ~1 migration/iteration —
+  erlang 761/761, then feed 189/189. A1 = 8 on architecture + 3 on the branch; 6 remain.
+  W4 still gated (host-persist adapter not landed); no new subsystem; app loops on
+  incremental domain work (commerce Phase 5 payment envelope, content/events/identity/fed-sx).
+  Nothing new to discover; merge-time adopter-parity flag still open.
+- **Date:** 2026-06-07 (radar loop, pass 25)
+- **Pass 25:** A1 → **8 adopters** (events via its own loop) + common-lisp 487/487 on the
+  conformance branch. The conformance loop **extended the shared `lib/guest` driver**
+  (per-suite counters/preloads) to do it → raised a **coordination flag in A1**: verify the
+  branch is non-regressive against all 8 adopters before merging to architecture. commerce
+  drafting Phase 5 provider-neutral payment envelope. No new candidate; A1 advancing fast.
+- **Date:** 2026-06-07 (radar loop, pass 24)
+- **Pass 24 — three real updates.** (1) **A1 → 7 adopters** (search migrated, counters mode
+  — corrects the earlier exclusion). (2) The dedicated `conformance` loop ran its 1st
+  iteration: refused to force-migrate common-lisp (parity gate worked) and surfaced a
+  **driver feature-gap** (per-suite counters + preloads) gating the complex multi-suite
+  candidates → A1 now splits simple-now vs gated-on-driver-enhancement. (3) **W8 commerce
+  is LIVE** ("order lifecycle as a durable flow-on-sx flow, Phase 3 done") → 2 live flow
+  consumers. events shipped TZ/DST; mod reverted its extraction note (declined on re-read).
+- **Date:** 2026-06-07 (radar loop, pass 23)
+- **Pass 23 — trigger fired (empty streak ends at 19–22).** commerce recorded a Phase 3
+  **flow-integration design** (order saga as a flow-on-sx flow, payment suspended until
+  webhook resume) → 2nd durable-flow consumer; **W8 broadened** from "delivery" to
+  "externally-resumed orchestration on lib/flow." events made its federation transport
+  **fed-sx-ready** (injected) → reinforces W1's 5/5 inject-fed-sx seam. acl left tmux
+  (now fully quiescent). host-persist adapter still not landed (W4 migration still gated).
+- **Empty-discovery streak: passes 19–22** (last verified pass 22). Fleet at steady state —
+  active loops (content CvRDT, events recurrence/reschedule, identity grant-mgmt, fed-sx
+  outbox internals) are building *inside* their domains, not cross-cutting infra. Census
+  exhausted (p17); all gates re-tested (W1 p18, W2 p19). No new candidate clears any gate.
+- **Radar is now trigger-driven.** The next substantive pass needs one of: **(a)** a new
+  subsystem worktree spawning (auto-joins scan), or **(b)** host-persist's durable adapter
+  landing → unblocks the W4 acl/mod→persist/log migration, or **(c)** a quiescent
+  subsystem (acl/mod/search/commerce, static ~9–16 passes) resuming. Polling ~hourly until
+  one fires; will tighten cadence then.
+- **Date:** 2026-06-07 (radar loop, pass 20)
+- **Pass 20 — honest empty pass.** 3 new census recurrences since p17 (normalize/index ×2,
+  query ×3) — all **name collisions** (same noun, domain-specific op), added to the table.
+  Recorded the meta-pattern: the fleet shares vocabulary, not structure. Most subsystems
+  quiescent (acl/mod/search/commerce static ~9-15 passes = API-stable); only events/
+  identity/content/fed-sx still committing domain features. No new gate-clearer.
+- **Date:** 2026-06-07 (radar loop, pass 19)
+- **Pass 19 — honest empty pass.** Scanned 10 active subsystems. content/index.sx is a
+  blog index/tag-cloud listing (presentation, not full-text search — no search reinvention)
+  and content/multi-doc indexing adds no per-viewer filter. **W2 re-tested: still 2**
+  (feed, search) — acl's `permit?`-like matches are its own authZ *engine* (the home),
+  not a downstream read filter. No new candidate cleared any gate.
+- **Date:** 2026-06-07 (radar loop, pass 18)
+- **Pass 18 — W1 gate re-test.** events shipped Phase 4 federation (5th consumer): a 5th
+  divergent merge (sorted agenda + `:origin` provenance), trust-gate = runtime list
+  membership (shares mod's mechanism, not acl's). Reinforces W1's "theme not shape" — but
+  the **inject-fed-sx-transport seam is now 5/5**, strengthening "all are fed-sx
+  consumers-in-waiting." Trust sub-pattern refined: mod+events (runtime set) vs acl (rule).
+- **Date:** 2026-06-07 (radar loop, pass 17)
+- **Pass 17 — filename census declared EXHAUSTED** (see the Census-status table above).
+  Examined the last unswept ≥2 recurrences (schema/engine = acl⇄mod substrate twins;
+  catalog/batch = name collisions; store = divergent). No new candidate. Incremental churn
+  elsewhere (content 621/621, identity PAR, events reminders). Future passes pivot from
+  censusing to re-testing gates as consumers mature.
+- **Date:** 2026-06-07 (radar loop, pass 16)
+- **Pass 16:** events started Phase 3 — **durable notification delivery on `lib/flow`**
+  (new W8: at-least-once + idempotency exemplar; fed-sx/mod roll their own outbox). The two
+  `notify.sx` (feed vs events) are a name collision (read-side digest vs delivery), noted
+  in W8. Substrate-adoption story deepening: app domains now consume persist (content/
+  commerce/events), flow (events), commerce (events), acl-authZ (identity).
+- **Date:** 2026-06-07 (radar loop, pass 15)
+- **Pass 15:** added the **scanning-method note** above after `query.sx` again proved to
+  be merged-lib copies (lib/prolog + lib/persist in every worktree). Corrected census
+  surfaced `wire`×2 (content+mod) → Rejected (shared role, divergent structure: generic SX
+  serializer vs bespoke pipe-format under a Prolog-env string-prim constraint). events↔
+  commerce integration appeared (paid tickets); acl/mod/search quiescent ~7 passes (now
+  API-stable). No new gate-clearer.
+- **Date:** 2026-06-07 (radar loop, pass 14)
+- **Pass 14:** filename census flagged `snapshot`×?? — but the `*/lib/persist/snapshot.sx`
+  copies are just the merged `lib/persist` in each worktree, NOT consumers (same artifact
+  as `lib/feed/rank.sx` everywhere). The one distinct file, `content/snapshot.sx`,
+  reimplements persist's projection-checkpoint on raw KV instead of using `persist/snapshot`
+  → new W7 (persist-adoption nudge). `audit`×3 = the W4 fakes (acl/mod/identity), known.
+- **Date:** 2026-06-07 (radar loop, pass 13)
+- **Pass 13 — honest re-test, no gate-clearer.** Re-tested the two longest-waiting gates
+  against the maturing app-domain loops: **W2** (per-viewer visibility) still 2 consumers
+  (feed, search) — commerce/content/events/identity add no per-viewer read filter; **W3**
+  (pagination) still 2 (feed, search) — `content/page.sx` is an HTML wrapper, not
+  pagination (filename collision, noted in W3). Incremental churn only elsewhere.
+- **Date:** 2026-06-07 (radar loop, pass 12)
+- **Pass 12:** `events` shipped **transactional booking on persist** (3rd live persist
+  consumer) using `persist/append-expect` (optimistic-concurrency CAS, lock-free capacity
+  safety). W4 ledger now shows a persist feature-ladder append → append-once → append-expect
+  that the hand-rolled fakes can't match. No new candidate; W4 reinforced.
+- **Date:** 2026-06-07 (radar loop, pass 11)
+- **Pass 11 — W4 sharpened with a consumer ledger.** commerce built an **order ledger on
+  persist** (2nd live exemplar; uses `persist/append-once` for webhook idempotency) and
+  identity a **grant audit ledger** (in-memory Erlang fake, gated on an Erlang↔persist
+  bridge). The append-only monotonic-seq event-log pattern is now validated across 4
+  domains, 2 live on persist + 3 fakes flagged for adoption. See W4 table.
+- **Date:** 2026-06-07 (radar loop, pass 10)
+- **Pass 10:** commerce/content/events/identity advancing (content 238/238). Probed a
+  shape outside the routing table — **guarded lifecycle state machines** (mod/lifecycle +
+  identity/membership) → new W6: shared *design principle*, divergent *structure*
+  (SX transition-table vs Erlang gen_server), NOT an extraction target. No gate-clearer.
+- **Date:** 2026-06-07 (radar loop, pass 9)
+- **Pass 9:** `commerce` + `content` reached Phase 2 (`content` 162/162). **Key find:
+  `content` built its op log directly on `persist/log`** (backend-injected, append+replay-
+  to-seq) — the live reference exemplar for W4 (see W4). `events` MONTHLY RRULE,
+  `identity` OAuth2 auth-code + PKCE, search boolean-filtered ranked. A1 still 6 adopters.
+- **Date:** 2026-06-06 (radar loop, pass 8)
+- **Pass 8 — fleet expanded by 4 app-domain loops** (the briefing's anticipated
+  `commerce`/`identity` arrivals, auto-picked up by dynamic discovery). All early-stage,
+  **pre-Phase-2 → moving targets, none count toward any gate yet**:
+  - `commerce` (Phase 1: `api/cart/catalog/price`). Its "per-line audit" is a cost
+    *breakdown view* (`api.sx:44`), **not** an append-only decision log → NOT a W4
+    consumer.
+  - `events` (Phase 1: `calendar.sx`, RRULE expansion).
+  - `identity` (early: `session/token`). Defers authZ to acl (`token.sx:15`) — reinforces
+    W2's "delegate `permit?` to acl-on-sx" routing; identity = authN, acl = authZ.
+  - `content` (just-started: `block.sx`).
+  These are the future consumers W2/W3 are waiting on — re-check their per-viewer filters
+  / pagination once each clears Phase 2. No new gate-clearer this pass.
+- **Pass 7:** **A1 jumped 4→6 adopters** — `acl` + `mod` migrated to the shared
+  conformance driver (first app-domain adopters; proves it generalizes past substrates).
+  `host-persist` closed its blob-adapter blocker (durable storage adapter now landing →
+  W4 migration path opening). search shipped proximity/NEAR; flow + persist quiescent.
+- **Pass 6:** new worktree **`host-persist`** (active — building persist's durable host
+  adapter); `feed` went quiescent (left tmux). acl shipped hardening (+25), fed-sx-m1 at
+  Step 6c. **mod loop independently wrote a shared-plumbing note** (`mod-on-sx.md`,
+  538b8a53) corroborating W4/W5 — folded its claims + home disagreements into W1/W4/W5.
+  No new gate-clearer (audit log still 2 consumers), but consumers are now API-stable.
+- **Pass 5:** search (+highlight/snippet) and fed-sx-m1 (+follower_graph) moved; rest
+  unchanged. Filename census: `api`×6, `fed`×3, then `schema/rank/query/page/explain/
+  engine/batch/audit`×2. Examined the ×6 `api.sx` → Rejected (shared name, divergent
+  structure incl. implicit-vs-explicit-state contract). rank/batch/engine all ≤2 +
+  substrate/domain-divergent → no new gate-clearer.
+- **Pass 4:** no churn vs pass 3 (same worktrees/tmux/HEADs/adopters). Swept audit+explain
+  surfaces: acl/mod share an append-only-log shape (→ sharpened W4 with persist/log API
+  evidence) and a proof-explain shape (→ new W5, substrate-bound). No new gate-clearer.
+- **Pass 3 (earlier today):** subsystem set + tmux + A1 adopters (4) all unchanged vs pass 2. Loops
+  advanced: acl shipped Phase 4 federation; search shipped Phase 4 + pagination; feed
+  shipped pagination/threading; mod at Ext 19 (capstone); persist did a worked acl-grants
+  migration (W4). New shape found: offset/limit pagination → folded into W3.
+- **Subsystem set discovered:** loop worktrees `acl, erlang, fed-prims, fed-sx-m1,
+  feed, flow, go, kernel, mod, ocaml, persist, radar, ruby, search,
+  sx-vm-extensions`; main-repo `lib/*` incl. merged `feed` + substrates (`apl,
+  common-lisp, datalog, erlang, forth, go, haskell, hyperscript, js, lua, minikanren,
+  ocaml, prolog, scheme, smalltalk, tcl`) + `lib/guest`.
+  Actively looping (tmux): `acl, fed-sx-m1, feed, flow, mod, persist, search`
+  (+ radar).
+- **New since pass 1:** worktrees `kernel` (empty/unset — not yet a repo) and `ocaml`
+  (`lib/ocaml/baseline` only). Both early-stage, pre–Phase 2 → out of proposal scope.
+- Re-enumerate every pass; new loops (e.g. a future `commerce`/`identity`) auto-join.
+
+**Census status (pass 17): EXHAUSTED.** Every own-namespace filename recurring ≥2× has
+been examined and dispositioned — further filename-censusing is low-yield until new
+subsystems/modules appear. Map:
+| filename | owners | verdict |
+|---|---|---|
+| `api` ×10 | all | Rejected — shared role, divergent state contract |
+| `fed`/`federation` | feed/search/mod/acl(+content) | W1 — theme not shape |
+| `audit` ×3 | acl/mod/identity | W4 — append-only log → persist/log |
+| `page` ×3 | feed/search (pagination) + content (HTML wrapper) | W3 + collision noted |
+| `explain` ×2 | acl/mod | W5 — proof tree, substrate-bound |
+| `snapshot` ×2 | persist(facet) + content(reinvents) | W7 |
+| `wire` ×2 | content(SX serializer) / mod(pipe-format) | Rejected — divergent |
+| `schema`,`engine` ×2 | acl/mod | substrate-twin parallels (Datalog vs Prolog); only audit (W4) is liftable |
+| `catalog`,`batch` ×2 | commerce/persist, mod/persist | name collisions, unrelated |
+| `normalize` ×2 | content(tree-prune)/feed(record-coerce) | name collision (pass 20) |
+| `index` ×2 | content(listing)/search(inverted index) | name collision (pass 20) |
+| `query` ×3 | content(doc-block)/search(bool AST)/persist(stream-read) | 3-way name collision (pass 20) |
+| `store` ×2 | content(on persist) / flow(workflow records) | related concept, divergent |
+| `rank` ×2 | feed/search | different domains (activities vs docs), ≤2 |
+**acl⇄mod are structural twins** (decision engine over a logic substrate, Datalog vs
+Prolog) — they parallel across engine/schema/explain/audit/fed, but only the *audit log*
+is substrate-agnostic and liftable (→ W4); the rest are substrate-idiomatic. Next passes:
+re-test gates (W2/W3/W8) as consumers mature, watch new modules — not re-census.
+
+**Meta-pattern (pass 20):** new module names keep *recurring* but the operations keep
+*colliding* — same noun, domain-specific op (normalize, index, query, catalog, batch,
+notify, page, store all proved to be collisions). This is *why* genuine extraction
+candidates are rare: the fleet shares vocabulary, not structure. The real shared assets
+are the **substrate subsystems** (persist, flow, acl, fed-sx) that app domains *adopt*
+(W1/W2/W4/W7/W8), not hand-rolled libs to extract.
+
+**Scanning-method note (learned the hard way, passes 5/12/14/15):** a filename census
+for *cross-subsystem* recurrence MUST restrict to each subsystem's OWN namespace —
+`X/lib/X/*.sx` — never `X/lib/*/`. The merged substrate libs (`lib/prolog`, `lib/persist`,
+`lib/feed`, `lib/datalog`, …) are checked out inside *every* worktree, so a naive census
+reports e.g. `query.sx`/`snapshot.sx`/`rank.sx` ×N as phantom recurrences that are really
+one merged file copied N times. Correct one-liner:
+`for w in <subsystems>; do for f in $w/lib/$w/*.sx; do basename $f .sx; done; done | sort | uniq -c | sort -rn`.
+
+---
+
+## Done
+
+### A1 · Shared conformance driver — ✅ COMPLETE (merged `db76cc8c`, pass 32)
+Full closed loop: radar detected it → dedicated `conformance` loop implemented it
+(classify-then-migrate-or-exclude, hard parity gate) → **merged to architecture**
+(`db76cc8c Merge loops/conformance into architecture: A1 conformance-driver migration`)
+→ radar spot-verified post-merge (**common-lisp 487/487 green** on architecture — exercises
+the new per-suite-counters/preloads driver feature, the riskiest change). Final state:
+- **13 on the shared driver:** acl, apl, common-lisp, datalog, erlang, events, feed, go,
+  haskell, mod, prolog, relations, search.
+- **6 correctly excluded** (foreign-program runners — a legitimately different harness):
+  forth, js, ocaml, smalltalk, tcl, lua.
+- The shared driver gained per-suite counters + per-suite preloads (backward-compatible);
+  spot-check confirms existing adopters unaffected. Coordination flag CLEARED.
+Detail of the migration arc retained under the original entry below.
+
+## Proposed (cleared the gate)
+
+_(empty — A1 graduated to Done, pass 32.)_
+
+### A1 · Adopt the shared conformance driver across subsystems
+- **Pattern:** every subsystem hand-rolls a near-identical `conformance.sh`
+  (epoch-load → eval → scoreboard emit) and an inline `<x>-test name got expected`
+  pass/fail counter.
+- **Consumers (≥3, overwhelming):** 15 `lib/*/conformance.sh` — `apl, feed, datalog,
+  flow, mod, lua, erlang, forth, go, common-lisp, haskell, js, ocaml, prolog,
+  smalltalk, tcl`.
+- **Home:** `lib/guest` — the one legitimate exception (the shared driver
+  `lib/guest/conformance.sh` + `lib/guest/conformance.sx` already exist; modes
+  `dict` and `counters`).
+- **Status: IN PROGRESS — 6 adopters (pass 7).** `prolog` (dict), `haskell` (counters),
+  `apl` (dict), `datalog` (dict), and **`acl` (dict) + `mod` (dict), newly migrated this
+  pass** — all 3-line exec shims into `lib/guest/conformance.sh` with a `conformance.conf`.
+  **acl + mod are the first *app-domain* adopters** (not language substrates) — strong
+  evidence the driver generalizes beyond the substrate layer, which was the open question.
+  The `apl` migration earlier *surfaced a latent bug*: the old awk extractor
+  under-counted `pipeline` (40 vs the real 152 assertions); true apl total is **562**,
+  not 450 — evidence that adopting the driver also improves correctness.
+- **Not a target (different harness shape):** `lua/conformance.sh` is a Python runner
+  (`lib/lua/conformance.py`) that walks real `*.lua` source files via `lua-eval-ast`
+  and classifies pass/fail/timeout — it does not run SX `deftest` suites with a
+  counter/dict scoreboard, so the shared driver does not fit. Excluded, not pending.
+- **Remaining hand-rolled candidates (~120–220 lines each):** `common-lisp, erlang,
+  feed, forth, go, js, ocaml, smalltalk, tcl` — now being worked by the dedicated
+  `conformance` loop (above). (`lua` excluded: walks real `*.lua` files via Python.
+  `smalltalk` likely excludes too — runs `*.st` via its own `test.sh`. `search` was
+  thought to be excluded but DID migrate via counters mode — see the 7-adopter note.)
+- **Action:** each remaining subsystem's OWN loop migrates when quiescent — add a
+  `conformance.conf` (+ a `test-harness.sx` preload defining its counters) and
+  replace `conformance.sh` with the 1-line exec shim
+  (`exec bash …/guest/conformance.sh …/conformance.conf "$@"`). Recipe template:
+  `lib/haskell/conformance.conf` (counters) or `lib/prolog/conformance.conf` (dict).
+  Keep the `bash lib/X/conformance.sh` entry point so no loop is disrupted.
+- **Priority: HIGH** (15 consumers, low risk, interface-preserving, additive).
+- **8 adopters on architecture** (pass 25): acl, apl, datalog, **events**, haskell, mod,
+  prolog, search — `events` migrated via its OWN loop; `search` via counters mode (which
+  corrects the earlier "search excluded" note). **+4 on the `loops/conformance` branch:
+  `common-lisp` 487/487, `erlang` 761/761, `feed` 189/189, `go` 609/609** — pending merge.
+  **5 EXCLUDED — all foreign-runner harnesses** (correctly, not force-migrated): `forth`
+  (Hayes core.fr via awk+python), `js` (test262 `.js`/`.expected`), `ocaml` (scrapes
+  `test.sh` + `.ml` baseline), `smalltalk` (scrapes `test.sh` + `*.st` corpus), `tcl`
+  (foreign `*.tcl` vs `# expected:` annotations).
+- **✅ CONFORMANCE LOOP WORKLIST COMPLETE (pass 31).** Final A1 picture:
+  - **12 on the shared driver:** acl, apl, datalog, events, haskell, mod, prolog, search
+    (on architecture) + common-lisp, erlang, feed, go (on `loops/conformance`, pending merge).
+  - **6 correctly excluded** (foreign-program runners — testing a language impl against an
+    external corpus is legitimately a different harness): forth, js, ocaml, smalltalk, tcl, lua.
+  - **Honest finding:** the driver's reach is narrower than the raw "15 conformance.sh"
+    count implied — language substrates that run real `.lua/.st/.ml/.tcl/.js/.fr` programs
+    *should* keep their foreign runners. ~half migrate, ~half don't, and that's correct.
+  - **One step left:** merge `loops/conformance` → architecture under the **adopter-parity
+    check** (the coordination flag above — the shared `lib/guest` driver change must be
+    proven non-regressive against all existing adopters first). The loop is now idle.
+- **NOW IN PROGRESS — dedicated loop (2026-06-07).** A human-triggered `conformance` loop
+  (worktree `/root/rose-ash-loops/conformance`, branch `loops/conformance`, tmux session
+  `a1-conformance`, briefing `plans/agent-briefings/conformance-loop.md`) is working the
+  remaining candidates (common-lisp, erlang, feed, forth, go, js, ocaml, smalltalk, tcl)
+  one per iteration, **classify-then-migrate-or-exclude with a hard test-count parity gate**
+  (reverts on any mismatch; never pushes to main/architecture). Radar tracks; it implements.
+- **Driver-capability boundary found (pass 24, first iteration).** The loop did NOT
+  force-migrate `common-lisp` (baseline 305/0 across 12 suites) — the shared driver can't
+  reproduce it: `MODE=counters` supports only ONE global pass/fail counter pair + ONE fixed
+  preload set, but common-lisp needs **per-suite counter names** (8 distinct pairs) and
+  **per-suite preload chains**. It logged a precise blocker + unblock path (extend the
+  `SUITES` entry format with optional per-suite counters/preloads) and moved on.
+- **Driver gap RESOLVED next iteration (pass 25) — but it touched the shared driver.** The
+  loop extended `lib/guest/conformance.sh` (+38 lines: optional per-suite counters + per-suite
+  preloads in the `SUITES` format, backward-compatible) and then migrated common-lisp at
+  **487/487** (above the 305 baseline — likely another extractor under-count correction, à la
+  apl's `pipeline`). The parity gate held throughout.
+- **⚠ COORDINATION FLAG (radar): the `loops/conformance` branch now carries a change to the
+  SHARED `lib/guest` driver** used by all 8 adopters. It's additive by design, but **before
+  this branch merges to `architecture`, re-run the existing adopters' suites under the new
+  driver to confirm zero regression** (acl/apl/datalog/events/haskell/mod/prolog/search).
+  This is the one cross-cutting risk in an otherwise per-subsystem-isolated effort — surfaced
+  here so the merge is gated on adopter-parity, not assumed.
+
+---
+
+## Watching (real but not yet through the gate)
+
+### W1 · Federation scaffold (merge / ingest / backfill / trust-gate)
+- **FAILS the structural-identity gate (deep-dived 2026-06-06, all 4 read).** Consumer
+  count is met (4) but they are *superficially* similar, not structurally identical —
+  the federated unit and merge op differ fundamentally:
+
+  | Subsystem (file) | Federated unit | Merge op | Trust gate | Injected transport |
+  |---|---|---|---|---|
+  | feed (`fed.sx:14,18,40`) | activity streams | dedupe by `(actor verb object)` | none (visibility via `permit?` separately) | `send-fn`, `fetch-fn` |
+  | search (`fed.sx:8`) | inverted indices | relabel DocId `peer*1000+local` + union posting lists | none | none (pure merge fn) |
+  | mod (`fed.sx:11-14,99`) | moderation decisions | advisory-list vs applied-list; bind iff `mod/trusted?` | **yes — runtime list** `mod/trusted? peer scope` | mock outbox / `fed-send!` |
+  | acl (`federation.sx:43,56`) | Datalog delegate facts | pull facts, gate by `trust`/`level_covers` rule, re-saturate | **yes — Datalog rule** at query time | `transport` dict |
+  | events (`federation.sx`) | calendar agendas | fold trusted peers' agendas into one sorted agenda + `:origin` provenance | **yes — runtime list** `ev/trusts?` (peer-id ∈ trust-set) | injected behind `ev/peer-agenda` |
+
+- **The ONLY real commonality is the injection seam** (now 5/5, pass 18), not extractable
+  code: every one says "the real transport is `fed-sx`'s job; inject `send-fn`/`fetch-fn`/
+  `transport`/`peer-agenda` and mock it in tests." That is an architectural *convention the
+  fleet already follows*. The merge op diverges 5 ways (dedupe / index-union / advisory /
+  fact-saturation / agenda-sort). The trust gate, where present, splits: **mod + events use
+  a runtime trust-set membership check; acl uses a declarative Datalog rule** — so even the
+  trust sub-pattern is 2-of-3, and the membership check is a trivial one-liner (below the
+  extraction threshold). No shared merge, no single shared trust mechanism.
+- **Disposition:** do NOT extract a shared "federation lib." When `fed-sx` ships its
+  real transport, these 4 become its *consumers* (wiring `send-fn`/`fetch-fn`/`transport`
+  to it) — that work belongs to each subsystem's loop + the `fed-sx` loop, not a
+  cross-cutting extraction. Stop re-proposing on the shared name. Home: `fed-sx`.
+- **Now 7 federation modules (pass 29):** + `relations` (Phase 4: erel trust-gating,
+  peer_rel/trust, fed-sx mock transport — Datalog-rule trust like acl) and `artdag`
+  (Phase 6: content-addressed cache + trust + **invalidation** — a merge shape unlike any
+  other). Each new one reinforces "theme not shape": 7 divergent merges, all sharing only
+  the inject-fed-sx-transport seam. Verdict unchanged — they're fed-sx consumers-in-waiting.
+- **Narrower sub-claim (mod note, pass 6; refined pass 18):** mod asserts the *fed
+  trust/outbox* shape shares between mod+acl. Radar evidence refines this: the trust gate
+  splits by mechanism, not by subsystem pair — **mod + events** both use a runtime
+  trust-set membership check (`mod/trusted?`, `ev/trusts?`), while **acl** uses a Datalog
+  rule. So a "trust-set membership" helper has 2 consumers (mod, events) — but it's a
+  one-line `member?` and the merge it gates diverges, so still not worth extracting.
+  Resolve at the architecture-merge point if a heavier shared trust-set surface emerges.
+
+### W2 · Per-viewer visibility / permission filter
+- **2 shipped consumers, same shape** — `filter <injected-permit> <ranked/candidate stream>`:
+  - `feed/lib/feed/acl.sx:27` `feed/visible = (feed/filter stream (fn (a) (permit? viewer a)))`,
+    capstone at `:34` (stream → ACL → rank → top-N). `permit?` injected, sig `(viewer activity)→bool`.
+  - `search/lib/search/fed.sx:16` `aclFilter permit docs = filter permit docs`;
+    `topNTfIdfAcl n permit ts idx = take n (aclFilter permit (rankTfIdf ts idx))`.
+    `permit` injected, sig `DocId→Bool` (viewer baked in by caller).
+- **NOT a consumer:** `mod/lib/mod/policy.sx` is moderation policy (reviewer actions),
+  no per-viewer read filter. So mod won't be the 3rd.
+- **Missing:** (a) only 2 consumers, need ≥3; (b) the two interfaces *diverge* —
+  feed passes `(viewer, item)`, search bakes the viewer in — so any shared form must
+  pick a convention; (c) both already **inject** the predicate, and the filter body is
+  literally one line (`filter permit xs`). Leaning toward: the predicate's home is
+  `acl-on-sx` (`permit?`), and the one-line filter is too thin to extract.
+- **Home when ripe:** delegate `permit?` to `acl-on-sx`; do NOT extract the filter.
+  Re-check if a 3rd genuine per-viewer read filter ships (e.g. events/commerce).
+
+### W3 · Collection helpers (group-by, dedupe-by-key, stable top-N, distinct-order, offset/limit page)
+- feed built all of these on APL primitives. search/commerce/events will want
+  group-by / top-N.
+- **NEW (2026-06-06): offset/limit pagination shipped in 2 subsystems, identical shape**
+  `take limit (drop offset xs)`:
+  - `feed/lib/feed/page.sx:9` `feed/page` (offset/limit window over a stream).
+  - `search/lib/search/page.sx:9` `paginate off lim docs = take lim (drop off docs)`.
+  - NOT a 3rd: `persist/lib/persist/query.sx:5` has a *since-cursor* for incremental log
+    consumption — resumable-stream semantics, not result windowing. Different shape.
+  - feed *also* has cursor-by-`:at` recency pagination (`page.sx:21-44`); search has no
+    cursor. So only the plain offset/limit window is shared, and it is a literal 1-liner.
+- **Missing:** ≥3 stable consumers; AND every item here is collection math that belongs
+  in the **substrate** (APL/Haskell already expose grade/sort/unique/take/drop), not a
+  shared lib. A 1-line `take/drop` window is far below the extraction threshold. Watch;
+  revisit only if a non-substrate subsystem needs the same windowing without take/drop.
+- **Filename-collision caution (pass 13):** `content/lib/content/page.sx` is an **HTML
+  page wrapper** (full HTML5 doc), NOT pagination — do not count it as a 3rd pagination
+  consumer. `page.sx` now means two unrelated things across the fleet. Re-tested pass 13:
+  pagination still only feed + search (2).
+
+### W4 · In-memory store fakes → `persist-on-sx`
+- Not an abstraction to extract — a migration target. Every subsystem fakes its
+  store with a mutable list (`feed/-log`, flow store, mod audit, …).
+- **Owner:** `persist-on-sx` (in progress). Tracked there, listed here for visibility.
+- **Concrete instance (file:line, found pass 4): the append-only decision/audit log.**
+  `acl/lib/acl/audit.sx` and `mod/lib/mod/audit.sx` are the SAME hand-rolled shape, and
+  `persist/lib/persist/log.sx` (the persist *log facet*) already implements it durably:
+
+  | role | acl/audit.sx | mod/audit.sx | persist/log.sx (target) |
+  |---|---|---|---|
+  | log var | `acl-audit-log` :9 | `mod/*audit-log*` :10 | backend stream |
+  | monotonic seq | `acl-audit-seq` :10 | `mod/*audit-seq*` :11 | per-stream high-water :1 |
+  | append (auto-seq) | `acl-audit-decide!` | commit :32 | `persist/append` :17 |
+  | count | `acl-audit-count` :51 | `mod/audit-count` :44 | `persist/count` :12 |
+  | read-all oldest-first | snapshot/tail :73 | `mod/audit-all` :43 | `persist/read` :29 |
+  | read seq≥from | — | by-seq | `persist/read-from` :31 |
+
+  Both deliberately use a monotonic seq with **no wall-clock** (deterministic/testable) —
+  identical to persist/log's design. Action when persist's host adapter lands: acl + mod
+  loops swap their in-memory log for `persist/log`. 2 consumers today; not a new lib —
+  the home already exists. Belongs to acl/mod loops × persist loop, not an extraction.
+- **Cross-loop corroboration (pass 6):** the mod loop independently reached the same
+  conclusion — `mod/plans/mod-on-sx.md` (commit 538b8a53): *"mod-sx (Prolog) and acl-sx
+  (Datalog) converged on the same module shape … only the audit log + fed trust/outbox
+  shapes truly share; extract at the architecture-merge point, refactoring both consumers
+  atomically, not unilaterally from a loop branch."* Confirms the shape AND the
+  do-not-extract-unilaterally stance.
+- **Home disagreement to resolve at merge:** mod's note proposes lifting the audit-log
+  primitives into **`lib/guest/`**. Radar routing disagrees: a durable append-only log is
+  a **`persist-on-sx`** concern (the log facet already exists), not language-impl plumbing.
+  Hold the line — `lib/guest` is lexer/parser/AST/HM/test-runner, not an event log.
+- **Migration is becoming concrete:** new `host-persist` loop (worktree + tmux, pass 6)
+  is building the durable-storage host adapter persist was blocked on — once it lands,
+  acl/mod can actually swap to `persist/log`.
+- **LIVE REFERENCE EXEMPLAR (pass 9): `content` already does it right.** `content`
+  (Phase 2 complete, 162/162) built its op log directly on `persist/log` instead of
+  faking it — `content/lib/content/store.sx`: backend injected via `(persist/open)`
+  ("content knows nothing about which backend", :10); append op as event
+  `persist/append b (content/-stream doc-id) …` (:20); read `persist/read` (:36);
+  `persist/last-seq` (:47); **version = replay op stream up to a seq**
+  (filter `persist/event-seq ev <= seq`, :61). "The op log is the source of truth …
+  the materialised doc is a cache, never primary state."
+  This proves the W4 target is real, not hypothetical: acl + mod's hand-rolled
+  monotonic-seq logs should adopt exactly content's `persist/log` pattern.
+- **Consumer ledger of the append-only monotonic-seq event log (pass 11):**
+
+  | consumer | what | backing | note |
+  |---|---|---|---|
+  | content (`store.sx`) | doc op log | **persist/log ✓ live** | plain append + replay-to-seq |
+  | commerce (`ledger.sx`) | order ledger | **persist/log ✓ live** | `persist/append-once` — idempotent, webhook-replay-safe :40,58 |
+  | events (`booking.sx`) | booking roster | **persist/log ✓ live** | `persist/append-expect` — optimistic-concurrency CAS, capacity-safe, lock-free |
+  | acl (`audit.sx`) | decision log | in-memory fake (SX) | migrate directly when host adapter lands |
+  | mod (`audit.sx`) | decision log | in-memory fake (SX) | migrate directly |
+  | identity (`audit.sx`) | grant ledger | in-memory fake (**Erlang**) | `{Seq,Subject,Action}`; needs an **Erlang↔persist bridge** first — author scoped it out until persist lands ("queryable semantics identical") |
+
+- **Two takeaways:** (1) the pattern is **validated across domains** — CRDT doc ops,
+  financial orders, event bookings, rule decisions, OAuth grants all reduce to the same
+  append-only monotonic-seq stream; (2) migrating to `persist/log` is strictly *better*
+  than the fakes — persist exposes a **feature ladder the fakes don't have**:
+  `append` (content) → `append-once`/idempotency (commerce) → `append-expect`/optimistic-
+  concurrency (events). Every fake would have to reinvent a weaker version of these.
+  This is an **adoption** item (the home already exists), NOT a new extraction — owned by
+  persist/host-persist × each consumer loop. The SX fakes (acl, mod) migrate directly;
+  the Erlang fake (identity) is gated on an Erlang↔persist bridge.
+
+### W5 · Proof-tree explanation over a logic-program derivation
+- `acl/lib/acl/explain.sx` (reconstructs a canonical proof by goal-directed search over a
+  saturated Datalog db) and `mod/lib/mod/explain.sx` (renders a Prolog-style proof tree
+  goal-by-goal with proved/unproved marks + unification bindings) are the same *idea*.
+- **Missing / disposition:** only 2 consumers, and they sit on **different substrates**
+  (acl→`lib/datalog`, mod→`lib/prolog`). Proof reconstruction/rendering is logic-engine
+  machinery → it belongs in each **substrate** (datalog/prolog), not a shared app lib.
+  Watch; revisit only if a 3rd logic-backed subsystem reimplements proof explanation.
+- **Cross-loop note (pass 6):** mod's note calls `mod/proof-goals` (re-query-each-goal)
+  generic and proposes lifting it into **`lib/guest/`**. Radar caveat: proof-tree
+  reconstruction *is* engine-agnostic logic machinery, but `lib/guest` is for
+  lexer/parser/AST/HM/match/test-runner — a logic-engine proof helper is a poor fit there.
+  If genuinely shared by ≥3 engines, a `lib/logic`-style substrate helper is the better
+  home than `lib/guest`. Still 2 consumers → stays Watching either way.
+
+---
+
+### W9 · Parent/child relationship tracking → the new `relations` subsystem (nascent)
+- **New subsystem (pass 28):** `relations` (loops/relations, Phase 1 — `schema.sx`+`api.sx`,
+  rel facts + `relate`/`unrelate`/`children`/`parents`/`related`, 22 tests). Per CLAUDE.md
+  it's the canonical "cross-domain parent/child relationship tracking."
+- **Why watch:** several subsystems already track parent/child *locally* — feed reply-to
+  threading (`thread`/`replies`), content nested block trees, events occurrence/RECURRENCE-ID
+  links. If `relations` becomes the shared home, those are candidate *delegators* (like
+  acl=authZ, persist=log). But it's **Phase 1, pre-Phase-2, moving target** — and each
+  local impl is currently domain-specific (different keys/semantics). Do NOT propose yet.
+  Re-check when relations is past Phase 2 AND ≥3 subsystems' relationship logic could
+  genuinely delegate to it. `artdag` also just spawned (nascent, 0 files) — tracking only.
+  (pass 32: `dream` + `maude` also spawned, nascent 0-files; `fed-prims` resumed.)
+- **Update pass 29:** relations rocketed to **Phase 4** (one gate — past Phase 2 — now met),
+  but it's building ITSELF out (schema/federation), **not yet being consumed** by anyone.
+  The blocker is the other gate: 0 subsystems currently *delegate* their parent/child logic
+  to it (feed/content/events still track locally). Watch for the first real delegation.
+  (artdag also raced to Phase 6 — these ports advance fast; treat committed state as truth.)
+
+### W8 · Durable externally-resumed orchestration on `lib/flow` (suspend→host-IO→resume)
+- **The shared shape:** a durable `flow` that `request`s an external action (a suspend
+  point), the **host** performs the IO, then `flow/resume`s the flow with the outcome;
+  flow's deterministic replay means a completed step never re-runs on recovery.
+- **Consumers (pass 24): 2 LIVE** (events delivery, commerce order saga).
+  - `events/lib/events/notify.sx` (**live**) — reminders/digests as durable flows;
+    suspend on delivery `dispatch`, resume with send outcome. At-least-once + idempotency key.
+  - `commerce` (**LIVE** as of pass 24 — "order lifecycle as a durable flow-on-sx flow,
+    21 tests, Phase 3 done") — order saga `(defflow ordf … (request 'reserve oid) … )`:
+    reserve→pay→fulfil as a flow, **payment stays suspended until the payment webhook calls
+    `flow/resume`**. Carries only the order-id; pure orchestration over `ledger.sx`.
+  - **Now 2 LIVE consumers** of the *same* pattern: long-running process, external resume
+    (delivery dispatch vs payment webhook). fed-sx/mod still roll their own outbox (watch
+    for convergence). Strengthens "lib/flow is the home"; still adoption, not extraction.
+- **Disposition:** `lib/flow` IS the abstraction (events proves it, commerce adopts it) →
+  this is an **adoption** observation like W4, NOT an extraction. Home = `lib/flow`.
+- **Flow-onboarding friction (light signal):** commerce's note logs real gotchas adopting
+  flow — `flow-make-env` returns a large likely-cyclic env (don't print it), env build is
+  slow (budget ~540s like flow's own suite). If ≥3 subsystems hit the same onboarding
+  gotchas, that's a signal to smooth `lib/flow`'s adopter API — flow's concern, flagged here.
+- **Name-collision caveat:** `notify.sx` means two unrelated things — `feed/notify.sx` is
+  a *read-side digest* (group inbox by verb+object), NOT delivery. Do not pair them.
+
+### W7 · Snapshot/projection-checkpoint reimplemented vs `persist/snapshot` (delegate)
+- `persist/lib/persist/snapshot.sx` already provides a **generic** projection checkpoint:
+  store `{:value :seq}` in the kv facet under a namespaced key; the headline property is
+  **snapshot + tail == full replay** (pure, clock-free).
+- `content/lib/content/snapshot.sx` **reimplements that same pattern on raw persist KV**
+  rather than delegating: `persist/kv-put b (content/-snap-key doc-id) {:doc … :seq seq}`
+  (:20), `persist/kv-has?`/`kv-get` (:27-28), and its own tail-replay (:53-59). It never
+  calls `persist/snapshot-*`. content's doc-materialisation *is* a projection fold over
+  its op stream — exactly what `persist/snapshot` checkpoints generically.
+- **Disposition:** persist-adoption nudge (like W4): content could delegate to
+  `persist/snapshot` (its projection = "fold ops → doc"), dropping the duplicated
+  KV+replay code. Home already exists → NOT an extraction; owned by content × persist
+  loops. Only 1 reinventor today; watch whether commerce/events/identity also hand-roll a
+  snapshot on raw KV instead of using the facet (would strengthen the nudge). NB timeline:
+  unclear if `persist/snapshot` predated content's — flag, don't blame.
+
+### W6 · Guarded lifecycle state machine (illegal transition = explicit error)
+- Recurs as a **design principle**, NOT a shared structure (found pass 10):
+  - `mod/lib/mod/lifecycle.sx` — pure SX: immutable case `{:state :error :history …}`,
+    explicit transition table `mod/lc-transitions` (:31), illegal transition returns the
+    case unchanged with `:error` set. States open→triaged→decided→appealed→final.
+  - `identity/lib/identity/membership.sx` — an **Erlang `gen_server`** fragment (identity
+    runs on erlang-on-sx): a `receive` loop with `case find(...) of … {error, St}` guards.
+    States none→pending→active→lapsed→revoked.
+- **Both share the guideline** ("invalid transitions are explicit errors, never silent
+  no-ops") but **implement it substrate-idiomatically** — SX transition-table over
+  immutable values vs an Erlang process loop with per-message case guards. Same W1/`api.sx`
+  trap: shared *idea*, divergent *structure*.
+- **Disposition:** not an extraction target — the FSM mechanism is ~10 substrate-specific
+  lines; the value is in each domain's state graph, not the plumbing. At most a **design
+  guideline** ("model lifecycle as a guarded FSM with explicit-error transitions"). Watch
+  whether commerce-checkout / events-booking add their own — if so it confirms the
+  *guideline*, still not a lib. Do not propose extracting a shared state-machine lib.
+
+## Rejected (considered, declined — do not re-propose)
+
+- **"Continuous auto-implementing abstractor loop."** Rejected at design time: an
+  agent writing across `lib/<x>/**` breaks the worktree isolation that makes the
+  fleet safe, and is rewarded for manufacturing premature/wrong abstractions. The
+  radar is read-only by design. (This file is the alternative.)
+- **Shared `api.sx` "public boundary" module (×6).** Rejected pass 4-5: every subsystem
+  has an `api.sx` (acl, feed, flow, mod, persist, search — a 100% filename match), but it
+  is a naming *convention for the public entry point*, not a shared structure. They
+  disagree on the most basic contract: acl/feed use **implicit module state**
+  (`acl/api.sx` "implicit current db", `feed/api.sx` "single mutable log") while
+  `persist/api.sx` threads an **explicit backend as every call's first arg**; flow's api
+  *builds a Scheme env*, search's api *concatenates a Haskell source string*, mod's is a
+  *lifecycle state-machine façade* (17 defs vs persist's 1). Same role, no common shape —
+  the W1 coincidental-resemblance trap. Do not re-propose on the filename.
+- **Shared `wire.sx` "serialization" module (×2).** Rejected pass 15: content + mod both
+  have a `wire.sx`, but `content/wire.sx` uses the **generic SX serializer**
+  (`serialize`/`parse`, full-fidelity round-trip) while `mod/wire.sx` is a **bespoke
+  versioned pipe-delimited line** (subset of fields, `split` hand-built over slice/len
+  because mod's Prolog-loaded env strips string prims). Shared role (wire format),
+  divergent structure + substrate constraint → not a candidate; the SX serializer is
+  already the shared tool for SX-substrate subsystems, and mod can't use it. (Same family
+  as the `api.sx` rejection above.)
+- **Dumping app-domain plumbing into `lib/guest`.** Rejected: `lib/guest` is for
+  language-implementation plumbing. App patterns route to acl/fed-sx/persist/
+  substrate/host instead (see the routing rule in the briefing).

plans/blog-editor-island.md

@@ -0,0 +1,75 @@
+# Handoff: native SX-island blog editor
+
+> Handed off from the **host-on-sx** loop (2026-06-19). Build this in a
+> **browser-capable session** (Playwright installed) — a reactive island only
+> proves out when it hydrates in a browser; this worktree has no Playwright.
+
+## Goal
+
+A native **SX reactive island** WYSIWYG block editor for blog posts — replacing
+the legacy `shared/static/scripts/sx-editor.js` (Koenig-era JS, ~2500 lines).
+It edits blocks reactively and, on publish, emits **`sx_content`** (SX element
+markup) + a title + status, and submits to the host's create endpoint.
+
+## Architecture (decided this session)
+
+- The editor is the **interactivity layer**, so it lives on the **`--http`
+  island pipeline** (`sx.rose-ash.com`, which already SSRs + hydrates islands),
+  **NOT** in the `http-listen` host (the host deliberately doesn't do island
+  hydration — see `plans/host-on-sx.md` Phase 5).
+- It **publishes to the host**: the host serves `blog.rose-ash.com` and owns the
+  durable store + create/render. The editor is a docs-side island that talks to
+  the host's API. Two cooperating SX servers: host = content/API/state, `--http`
+  = interactive UI.
+
+## The host contract (already live + proven)
+
+`POST /new` on the host (`blog.rose-ash.com`) — **works today**:
+- Body: **form-urlencoded** `title`, `sx_content`, `status` (`draft`/`published`).
+- Behaviour: slug derived from title, post stored in the durable KV, **303
+  redirect** to `/<slug>/`.
+- `host/blog-form-submit` in `lib/host/blog.sx`; route `host/blog-open-create-routes`
+  (currently UNGUARDED experimental — gate before real use).
+- A **form POST** (303 redirect) needs **no CORS**. If the editor uses `fetch`
+  instead, the host needs CORS on `/new` — the host loop can add `dream-cors-with`
+  (`lib/dream/cors.sx`) in minutes; just ask.
+
+## `sx_content` format — what to emit
+
+SX **element markup**, rendered host-side by `render-page` → `render-to-html`,
+**per block, guarded** (`host/blog-render` in `lib/host/blog.sx`). So:
+- Top level is a fragment: `(<> (h2 "Title") (p "para " (strong "bold")) (ul (li "a") (li "b")))`.
+- **Use standard tags `render-to-html` knows**: `p h1..h6 ul ol li blockquote
+  code pre strong em a img figure hr br span div`. These render cleanly + fast.
+- **AVOID the legacy `~kg-*` card components** — they show as `(unsupported
+  block)` placeholders (the legacy editor emits bare `~kg-md` but the components
+  are `~kg_cards/kg-md` — name drift we deliberately did NOT alias). If cards are
+  wanted, define **canonical** card components the host loads (no bare-name shim).
+- A bad/unknown block degrades to a placeholder, never crashes the page — but
+  aim to emit only renderable markup.
+
+## Build notes
+
+- It's a `defisland` served as a `defpage` on `--http`. Example island:
+  `sx/sx/home/stepper.sx`. Reactive primitives: `signal`/`deref`/`computed`/
+  `effect` (see the signals spec).
+- **SX island authoring gotchas** (CLAUDE.md "SX Island Authoring Rules"):
+  multi-expr bodies need `(do …)`; `let` is parallel (nest for sequencing);
+  reactive text needs `(deref (computed …))`; effects go in an inner `let`.
+- A reasonable MVP: title input (signal) + an ordered list of block signals
+  (type + text), add/remove/reorder, a few block types (paragraph, heading,
+  list, quote, code), a **live preview** (computed → rendered), and a Publish
+  that serialises blocks → `sx_content` and form-POSTs to the host's `/new`.
+- **Test with `sx_playwright`** (inspect / hydrate / interact / trace-boot) —
+  hydrate the island, simulate typing, assert the serialized `sx_content` and
+  the live preview. Don't ship an island you haven't hydrated in a browser.
+
+## Pointers
+
+- Host ingest + render + page shell: `lib/host/blog.sx` (the `/new` POST is the
+  target; `host/blog-render` shows exactly which markup renders).
+- `render-page` (host's component renderer) + the static-page pattern:
+  `lib/host/page.sx`, `plans/host-on-sx.md` Phase 5.
+- Island example: `sx/sx/home/stepper.sx`. HTML renderer (tags it knows):
+  `web/adapter-html.sx`. Legacy editor (reference only, being replaced):
+  `shared/static/scripts/sx-editor.js`.

plans/blogimport-pickup.md

@@ -0,0 +1,59 @@
+# Staged pickup — persist-backed blog content via `lib/blogimport`
+
+Staged for the host loop (2026-06-30) by the migration/blogimport work. **Pick this up
+after the cards-as-types work lands** — it's the data half that makes the live blog read
+endpoint serve *real* posts instead of the in-memory registry.
+
+## What's ready
+
+`lib/blogimport` is **merged into local `architecture`** (`a746b6ab`, 76/76 conformance:
+lexical 23, import 21, verify 11, source 20/21). It is the blog Postgres→persist
+data-migration tooling (`plans/migration/data-migration.md`, Q-M4 resolved):
+
+- `blogimport/lex-blocks doc` — Ghost lexical (as SX dicts) → content-on-sx block list.
+- `blogimport/import-post! b post at` / `import-all!` — genesis import into the
+  `content:<id>` op-log (idempotent) + metadata in `postmeta:<id>`.
+- `blogimport/verify-post|verify-all` — replay-and-diff parity check at rest.
+- `blogimport/backfill! b fetch-fn at` / `sync-verify b fetch-fn` — live source via an
+  **injected `fetch-fn`** (Q-M4 = internal-data query).
+
+To get it here: this worktree (`loops/host`) is behind local `architecture` — `git merge
+architecture` brings `lib/blogimport` (and the rest of the backlog) in. No `origin` push
+is involved.
+
+## The exact seam in this codebase
+
+Phase 4's blog endpoint (`lib/host/blog.sx`, `GET /<slug>/`) renders a `CtDoc` via
+`content/html`, but `host/blog-lookup` is an **in-memory slug→doc registry** (the plan
+already says "swap for a persist-backed content stream later, handler/route unchanged").
+`lib/blogimport` populates exactly those streams. The pickup is that swap.
+
+## Steps
+
+1. **Merge** local `architecture` into `loops/host` (gets `lib/blogimport` + deps:
+   `dream-json` is the only new load dependency for the source layer).
+2. **Apply the blog-side draft** (Python, on the blog app) so the live source query
+   exists: `lib/blogimport/drafts/published-posts.sx` (defquery) +
+   `drafts/README.md` (the `SqlBlogService.list_published_posts` provider returning
+   published rows **incl. raw `lexical`** — the current post DTO exposes
+   `sx_content`/`html` but not `lexical`).
+3. **Inject the transport**: pass the host's HMAC `fetch_data` wrapper as `blogimport`'s
+   `fetch-fn` (`GET /internal/data/published-posts`). That wrapper is host territory.
+4. **Backfill**: run `blogimport/backfill! b fetch-fn at` against the durable persist
+   backend → every published post becomes a `content:<id>` stream.
+5. **Swap `host/blog-lookup`**: resolve `slug → post-id`, then return
+   `(content/head b post-id)` instead of the in-memory doc. Handler/route unchanged.
+   (Slug→id: from the backfilled `postmeta:<id>` slug field, or a small slug index.)
+6. **Parity gate** (before fronting users): `blogimport/sync-verify b fetch-fn` must be
+   all-ok — same discipline as A1/the slice cutover. Pairs with the still-open Phase 4
+   item "proxy-to-Quart fallback for un-migrated paths" (slice-01-blog's Caddy
+   fall-through-on-404 cutover).
+
+## Notes / limits (carried from blogimport)
+
+- Inline formatting (bold/italic/links) currently **flattens to plain text** —
+  content-on-sx Phase-5 rich runs aren't on `architecture` yet. Swap-point is isolated
+  in `lib/blogimport/lexical.sx` `lex-inline-text`; no host change needed when it lands.
+- `source.sx`'s response contract (`parse-row`) is the executable spec in
+  `lib/blogimport/tests/source.sx` — confirm the live `published-posts` response matches.
+- Re-import with an improved converter (Q-M5) is import-once today (skip-if-exists).

plans/composition-objects.md

@@ -0,0 +1,117 @@
+# Composition objects — a content-addressed, data-driven UI model
+
+Everything the system stores is an **object**: typed, content-addressed (`:cid`), in one graph.
+"Post" was the blog's word; the unit is an object. A *document* is an object whose **body** is a
+composition over other objects' CIDs. This is the cards-as-objects decision, generalised.
+
+## One mechanism: ordered, labelled forks
+
+An object forks into children via **labelled, ordered edges** (the relations engine + `order` on
+the edge value + an optional `when`). There is no separate "composition system" — relations *are*
+the forks. The **label** says what a fork means:
+- **structural** (`contains`) → ordered, part of identity, rendered;
+- **cross-cutting** (`tagged`, `related`, `author`) → loose links, not structural.
+
+Multiple relations from an object *are* its fork. No "multiple DAGs per object" — fork immediately;
+differently-labelled forks (`body` vs `aside`) give named slots. **Join** = a child CID referenced
+by two forks — free, because content-addressed. The whole structure is a **Merkle DAG** (git trees
+/ IPFS / artdag): `:cid` = hash over `fields + contains-forks (child-CID + order + when)`.
+
+## The body is a tiny UI language (the render-fold is its interpreter)
+
+A body is a composition node. Four combinators + leaves + references:
+
+| node | meaning | strategy |
+|------|---------|----------|
+| `(seq …)` | **sequence** | render all (block), in order |
+| `(row …)` / `(grid …)` | **layout** (par) | render all, side-by-side |
+| `(alt (when P n) … (else n))` | **conditional** (or) | render the FIRST child whose `when` holds |
+| `(each src tmpl)` | **iteration** (loop) | eval `src` → items; render `tmpl` per item (item bound) |
+| `(ref CID)` | transclude | fetch object by CID, render its body |
+| `(card TYPE fields)` | leaf | render via the card-type's `:template` (host/blog--instantiate) |
+| `(tmpl NAME)` | **recursion** | a named template, may reference itself |
+
+`seq/row` = render-**all** passing children; `alt` = render-**first** passing child. So **and/or/choice
+all come from one axis (`when` on forks) × the container's all/first strategy** — `Alt` isn't a new
+node kind, it's "first" instead of "all".
+
+## The two fundamentals we designed IN
+
+1. **Recursion** — `(tmpl NAME)` may reference itself; `(each (children) (tmpl NAME))` renders trees
+   (comment threads, nested nav, the `/meta` type hierarchy itself). Terminates naturally when a
+   query runs dry; a **depth guard** in the context backstops it.
+2. **The context is an environment, not a flat dict.** `when` reads it; `each` *extends* it
+   (`:item`). Make it extensible + reactive-ready and the two non-composition axes plug in with NO
+   new combinators:
+   - **Behaviour / interactivity** (Slice 9 lifecycles/effects) — a button references a behaviour;
+   - **Reactivity / local state** (the reactive runtime) — `alt(when local-state=active-tab)` is a
+     tabset, `alt(when accordion-open)` an accordion; a *live* `each` re-renders on data change.
+   The static render-fold becomes a live, interactive UI purely by making the context live.
+
+## The unifying property
+
+**The object's CID is its *definition* (the query, the template, every `when`-variant). The
+*rendering* is the *execution* (which items, which branch, which context).** The object is the
+program; the render is the run. One immutable content-addressed object encodes its whole
+responsive/personalised/variant space; rendering picks the path. Render-fold and the Slice-9
+behaviour interpreter are the **same shape** — interpreters over content-addressed objects + the
+decidable-core predicate set + the graph. The system converges on: objects + small interpreters.
+
+## Beyond content — composition is universal; a fold per domain
+
+The render-fold isn't "the content renderer" — it's **fold #1**. The composition DAG is a
+**universal algebra** (`seq/par/alt/each` over content-addressed objects); *content* is just one
+*interpretation*. Same structure, a different **fold** per domain — what changes is what the
+combinators and leaves *mean*:
+
+| domain | the fold | `seq` | `par` | `alt`+`when` | `each` | substrate |
+|--------|----------|-------|-------|-----------|--------|-----------|
+| **content** | render → HTML | block order | layout/columns | choose variant | map items | `compose.sx` (done) |
+| **behaviour** | execute → effects | steps in order | concurrent | branch (if/cond) | for-each | `[[project_flow_on_sx]]` |
+| **query** | eval → results | join/chain | union | conditional | iterate/quantify | `[[project_relations_on_sx]]` (Datalog) |
+| **pipeline** | reduce → data | dataflow stages | parallel ops | choose path | fan-out | `[[project_artdag_on_sx]]` (content-addressed DAG) |
+| **types** | extent → set | — | ∧ intersection | — | ∨ union | the type algebra (`make-and!`/`make-or!`) |
+
+So **"relations just a fork" generalises**: a `contains` fork folded by *render* is a document; a
+`then` fork folded by *execute* is a workflow step; a `depends-on` fork folded by *eval* is a
+dependency graph. **The relation kind + the fold = the domain.** This isn't aspirational — the
+repo's `X-on-sx` loops ALREADY ARE these folds (flow = execute, Datalog = eval, artdag = a
+content-addressed composition DAG); we just hadn't seen them as one shape. The composition DAG is
+the **convergence point** the whole fleet has been circling.
+
+The payoff is concrete: **build the composition machinery ONCE** (forks + ordered edges + the four
+combinators + a fold framework) → reuse for every domain by writing one interpreter. **The block
+editor edits *any* composition** — author a workflow like a document, same structure, one editor.
+The whole system collapses to four ideas: **content-addressed objects + a composition algebra +
+per-domain folds + the decidable-core predicates (`when`).** The render-fold's shape (walk the
+composition, dispatch combinators, recurse, read the context) is the *template* for every other fold.
+
+## What lives elsewhere (not composition primitives)
+
+Transclusion = a `ref` leaf. Sort/filter/limit/group = the *source query* language (Datalog).
+`each` reconciliation keys = the item's CID (free). Empty / missing-CID = render-fold robustness
+(the per-block guard). Async/streaming, events, local state = the behaviour + reactive axes.
+
+## Build roadmap
+
+1. **Keystone (this):** `lib/host/compose.sx` — the render-fold interpreter over seq/row/alt/each/
+   ref/card/tmpl, with the context-as-environment, `when` predicates, and recursion + depth guard.
+   Self-contained proof: render one composed object two ways (auth on/off) + a recursive tree.
+2. Wire it to objects: a document's `:body` is a composition node; `contains` forks carry order;
+   `host/blog-render` dispatches to the render-fold when `:body` is present (else the legacy
+   `sx_content` path). Card leaves render via the existing card-type `:template`.
+3. `each` source = a graph query (`(query is-a Event)` → `host/blog-instances-of`) — data-driven.
+4. Live context: route auth/device/locale into the context; reactive values later.
+5. The typed importer decomposes Ghost Lexical into card objects + a `contains` body (cards-as-
+   objects), instead of one `sx_content` string.
+6. The block editor edits the body (insert/reorder/`alt`/`each`) — the metamodel editor for content.
+7. **Prove universality with a second fold.** Write a tiny `execute`-fold over the *same*
+   `seq/alt/each` structure that *runs* a workflow (leaves = effects; `seq` = steps in order, `alt`
+   = branch, `each` = for-each) — the way the recursive tree proved recursion, this proves the
+   composition algebra is domain-agnostic. Then the *behaviour* model (Slice 9) is "an `execute`-fold
+   over a composition object", not a separate system.
+8. **Factor out the shared machinery** once two folds exist: the fork model (ordered, labelled,
+   `when`), the combinator dispatch, the context-environment, and recursion become a reusable
+   `compose` core; each domain (`render`, `execute`, `eval`, …) supplies only its leaf + combinator
+   semantics. The block editor + the metamodel UI then generalise to *every* fold — one composition
+   editor authors documents, workflows, queries, and pipelines alike.

plans/content-on-sx.md

@@ -19,7 +19,7 @@ injected adapter, not core.
 
 ## Status (rolling)
 
-`bash lib/content/conformance.sh` → **746/746** (Phases 1–4 COMPLETE + ~34 extensions, hardened: HTML/SX escaping, Markdown render + import/export incl. tables & frontmatter (full round-trip), CvRDT flat + nested-tree + durable replication, tree-aware validation, snapshot cache, doc metadata, plain-text render, nested block trees + deep editing + flatten + relative reorder, doc stats + summary + multi-doc index, table + callout + media blocks, HTML page wrapper + SEO page, doc composition + id-remap, portable data + wire serialization, block query + transforms + find/replace, TOC + anchored headings + outline, normalization)
+`bash lib/content/conformance.sh` → **778/778** (Phases 1–4 COMPLETE + ~34 extensions, hardened: HTML/SX escaping, Markdown render + import/export incl. tables & frontmatter (full round-trip), CvRDT flat + nested-tree + durable replication, tree-aware validation, snapshot cache, doc metadata, plain-text render, nested block trees + deep editing + flatten + relative reorder, doc stats + summary + multi-doc index, table + callout + media blocks, HTML page wrapper + SEO page, doc composition + id-remap, portable data + wire serialization, block query + transforms + find/replace, TOC + anchored headings + outline, normalization)
 
 ## Ground rules
 
@@ -113,6 +113,66 @@ lib/content/api.sx ── (content/edit) (content/render) (content/history) ─
 
 ## Progress log
 
+- 2026-06-07 — Hardening (tree-wide audit): the public facade `content/find` /
+  `content/has?` were top-level-only (`doc-find`/`doc-has?`), so you could
+  `content/edit` an update/delete to a nested block by id (those ops are
+  tree-wide) but couldn't read that same block back by id through the facade — a
+  concrete read/write asymmetry. Added a generic `ct-find-id` to doc.sx (descends
+  into any `children` list, mirroring ct-replace-id/ct-remove-id, no section.sx
+  dependency) plus `doc-find-deep`/`doc-has-deep?`; `content/find`/`content/has?`
+  now point at them. Kept `content/find-top`/`content/has-top?` for the
+  top-level-only lookup. Audited all `doc-find`/`doc-ids`/`ct-index-of` callers:
+  the remaining ones are insert/move (positional, top-level by design) — no other
+  seams. +6 api tests (nested deep find/has, top variants miss nested,
+  edit-then-find round-trip). 778/778.
+
+- 2026-06-07 — Hardening: `content/diff` (and `content/diff-versions`) are now
+  TREE-WIDE. They enumerated ids via `doc-ids`/`doc-find` (top-level only), so a
+  diff between two versions of a document containing sections silently missed
+  every nested-block add/remove/change — the same class of seam as the by-id
+  op-log bug. Now ids come from `doc-tree-ids` and lookups from `doc-deep-find`,
+  so nested changes surface precisely. Section containers are excluded from
+  `:changed` (they hold no own content; a child change reports as that child),
+  while whole-section add/remove still shows in `:added`/`:removed`. Flat-doc
+  diffs are unchanged (deep == top-level with no sections). +9 store tests
+  (nested add = section+child, nested change = child only, nested remove,
+  no-op). 772/772.
+
+- 2026-06-07 — Feature: in-document prose search. `content/search-text` (and
+  `content/search-text-ids`) return every content block, tree-wide, whose
+  `(asText b)` contains a term — so search spans text/heading/code/quote/callout
+  text, image alt, list items and table cells **by construction**: it reuses the
+  one canonical "prose of a block" projection (asText) rather than re-listing
+  fields, so it can't drift from stats/find-replace. Section containers are
+  excluded (a term living only in a section's children returns the child, not the
+  wrapper). +7 query tests (cross-field match, count, single-field, no-match,
+  section exclusion, object return). 763/763.
+
+- 2026-06-07 — Consistency: `find-replace` now rewrites **every** text-bearing
+  field, not just `text`. New `fr-rewrite` dispatches per block type — `alt` of
+  image blocks, each item of list blocks, and every header/cell of table blocks
+  now get rewritten alongside text/heading/code/quote/callout. This closes a real
+  seam: `asText`/stats/word-count already fold image alt, list items, and table
+  cells into a document's prose, so a `content/find-replace` rename that skipped
+  them was inconsistent (a renamed term would still show up in word counts and
+  exports). Flipped the two `image alt untouched` tests to `image alt replaced`;
+  +4 tests (list items ×2, table header + cell). find-replace 16/16, 756/756.
+
+- 2026-06-07 — Consistency: `find-replace` now covers `callout` text. `fr-has-text?`
+  (find-replace.sx) added `callout` to its text-bearing block kinds, matching
+  `asText`/stats/summary which already treat callout bodies as prose. Previously a
+  `content/find-replace` over a doc containing callouts silently skipped them. +2
+  find-replace tests (replace callout text; callout kind untouched by text replace).
+  752/752 (41 suites).
+
+- 2026-06-07 — Hardening: fixed a real layer seam (surfaced in the architecture
+  review) — by-id ops (update/delete) now act TREE-WIDE. `ct-replace-id` /
+  `ct-remove-id` (doc.sx) descend into any block carrying a `children` list, so
+  the persist op-log and `content/edit` correctly reach blocks nested in
+  sections (previously a silent no-op). `doc-move` stays top-level (guarded by
+  doc-find); insert/move remain positional. Inline section detection (no
+  section.sx dep). +4 store regression tests (nested update/delete via op-log +
+  replay-to-seq). Full gate over foundational doc.sx: 750/750.
 - 2026-06-07 — Hardening: audit confirmed the persist op-log (store.sx) carries
   every block type through commit → replay (op-insert carries the block
   instance; updates apply by id). Locked with +4 store tests (callout/media

plans/fed-sx-host-primitives.md

@@ -264,6 +264,25 @@ should leave `httpc`/`sqlite` BIFs blocked with that note.
 
 _Newest first._
 
+- 2026-06-07 — Investigated fed-sx-m2 Blockers #4 ("handler-mutex
+  deadlock") per `plans/agent-briefings/fed-prims-mutex-fix.md`.
+  **Outcome: not a mutex bug; no OCaml change — handed back to m2.**
+  Reproduced deterministically (single kernel-route request fails with
+  empty reply while `/` returns 200; also a 3-line minimal echo
+  gen_server reproduces it). Root cause: native `http-listen` runs the
+  handler on a fresh `Thread.create` outside the Erlang scheduler, so
+  `gen_server:call` → `receive` (which `raise`s `er-suspend-marker`
+  expecting an enclosing `er-sched-step-alive!` guard + `er-sched-run-all!`
+  pump) can never complete. Pattern A is inapplicable (single-request
+  failure ⇒ no contention; the mutex is required and must stay) and
+  `Sx_runtime.sx_call` is fully synchronous; no OCaml symbol can reach
+  the SX-level scheduler. Correct fix is Pattern B done purely in
+  `er-bif-http-listen` (`lib/erlang/runtime.sx`): spawn the handler as an
+  er-process and `er-sched-run-all!` to completion, returning the
+  process's `:exit-result`. That file is m2 / `loops/erlang` scope, so
+  this loop made no code change. Full diagnosis + a concrete patch
+  sketch recorded under Blockers below. `bin/sx_server.ml` unchanged;
+  builds untouched.
 - 2026-05-26 — Phase J: `http-request` primitive in `bin/sx_server.ml`
   (NATIVE ONLY — `Unix.gethostbyname` + `Unix.connect`; HTTP/1.1 with
   inline `http://` URL parser; sends Connection: close + Host +
@@ -339,4 +358,73 @@ _Newest first._
 
 ## Blockers
 
-- _(none yet)_
+- 2026-06-07 — **fed-sx-m2 Blockers #4 (handler-mutex deadlock) is NOT a
+  mutex bug — root cause is in the Erlang substrate, so the fix is m2
+  scope, not OCaml.** Investigated per `plans/agent-briefings/
+  fed-prims-mutex-fix.md`. Reproduced deterministically (m2 worktree
+  binary + `next/kernel/*.erl`, port 51920): a **single** request — no
+  concurrency, no prior request — to `/actors/alice/outbox` returns an
+  empty reply (curl exit 52) while the non-kernel control route `/`
+  returns 200 `fed-sx kernel m1`. Also reproduced with a 3-line minimal
+  echo gen_server + a handler that does `gen_server:call(echo, ping)`
+  (no kernel needed; boots in ~20s vs ~7min for the full kernel here).
+
+  Diagnosis: native `http-listen` (`bin/sx_server.ml:743-840`) runs each
+  connection's handler on a fresh `Thread.create` **outside any Erlang
+  scheduler step**. The handler closure (`er-bif-http-listen`'s
+  `sx-handler`, `lib/erlang/runtime.sx`) calls `er-apply-fun handler`
+  directly, so when the route reaches `gen_server:call` →
+  `receive` (`lib/erlang/transpile.sx:1132`), the `receive` captures a
+  `call/cc` and `raise`s `er-suspend-marker` expecting an enclosing
+  `er-sched-step-alive!` guard **and** a scheduler pump
+  (`er-sched-run-all!`). On the native handler thread neither is on the
+  stack: with no guard the suspend either propagates out (→ empty reply,
+  minimal case) or is caught by an Erlang `try`/guard in the route and
+  the request stalls (→ "hang" the m2 loop observed). The kernel
+  gen_server can never be stepped because the only scheduler driver
+  (the boot thread that ran `erlang-eval-ast`) is parked forever in the
+  native `Unix.accept` loop.
+
+  Why Pattern A (release/rescope the runtime mutex) does NOT apply: the
+  failure reproduces on a **single request with zero contention**, so it
+  is not a mutex-contention deadlock. Releasing the mutex cannot help and
+  would be actively harmful — the mutex is *required* to serialise the
+  shared single-threaded SX runtime / scheduler across handler threads.
+  `Sx_runtime.sx_call` (`lib/sx_runtime.ml:102`) is fully synchronous
+  (it just dispatches into the CEK evaluator), which is exactly the
+  briefing's stated condition for falling back from Pattern A to
+  Pattern B. There is also no OCaml-only fix: `grep` confirms nothing in
+  `hosts/ocaml/{lib,bin}` references `er-sched*`/the Erlang scheduler —
+  `er-sched-run-all!` is a pure-SX symbol in `lib/erlang/runtime.sx`, so
+  OCaml cannot pump it. Running the handler synchronously on the accept
+  thread (no `Thread.create`) does not help either: the `er-suspend-marker`
+  `raise` would unwind the native `handle` frame that writes the HTTP
+  response, losing the response across the suspension.
+
+  Recommended fix (Pattern B, **m2 / `loops/erlang` scope — entirely in
+  `er-bif-http-listen`, no OCaml change**): have `sx-handler` run the
+  handler as a scheduled er-process and pump the scheduler to completion,
+  e.g.
+
+  ```
+  (sx-handler
+    (fn (req-dict)
+      (let ((req-pl (er-request-dict-to-proplist req-dict)))
+        (let ((pid (er-spawn-fun
+                     (fn () (er-apply-fun handler (list req-pl))))))
+          (er-sched-run-all!)                       ; drains: handler →
+                                                    ; kernel reply → handler
+          (er-proplist-to-dict
+            (er-proc-field pid :exit-result))))))   ; handler's return value
+  ```
+
+  This keeps every suspend/resume inside the SX scheduler; the native
+  side only ever sees the final response dict. The existing native
+  per-connection `Thread.create` + `Mutex` stay as-is and remain correct
+  (they serialise the single pump across concurrent connections — the
+  mutex must NOT be removed). Verified by reasoning through the full
+  step trace (handler suspends on `receive` → kernel `handle_call`
+  replies → handler resumes → dies with `:exit-result`); the m2 loop
+  should implement + run `next/tests/http_server_tcp.sh` plus a
+  kernel-route smoke. No OCaml or `bin/sx_server.ml` change was made or
+  is needed.

plans/host-dev-tooling.md

@@ -0,0 +1,96 @@
+# Host dev tooling — close the loop on the serving-JIT bug class
+
+The host-on-sx build loop has one expensive, recurring failure mode and a handful of
+ergonomic papercuts. This plan captures the tooling that would pay for itself across the
+remaining slices (content-addressing, Slices 6–9). Ordered by ROI-per-effort, not ambition.
+
+## The core problem this addresses
+
+**Green conformance ≠ correct live.** The serving-JIT miscompiles iteration over a
+*function-produced list* under the http-listen render VM — `(map f (some-fn))` /
+`(for-each f (some-fn))` can process only the first element and silently drop the rest.
+Conformance (`lib/host/conformance.sh`) and the ephemeral picker-check do NOT reproduce it
+(they passed 287/287 while live rendered 1 of 4 relation editors). The fix lives in a separate
+loop (`plans/jit-bytecode-correctness.md`); until it lands, **every host render path has to be
+eyeballed live** (login + curl + grep the rendered HTML). The tools below make that cheap and,
+eventually, automatic. See `[[feedback_host_serving_jit_iteration]]`,
+`[[project_sx_engine_harness_tests]]`.
+
+## 1. `host_conformance(suite?)` — per-suite, fast (trivial; do first) — DONE 2026-06-30
+
+`conformance.sh [suite] [-v]` now takes an optional suite name (filters the SUITES array so
+result-parser indices stay aligned; all MODULES still load). `conformance.sh sxtp` runs in
+**0.3s** vs ~8min for the full Datalog-heavy run. Bad name → error listing valid suites.
+
+Today `conformance.sh` runs all 11 suites (~10 min, all-or-nothing). Iterating on one subsystem
+means hand-extracting the `MODULES` array to build a focused runner (done by hand this session).
+
+- **Change:** `conformance.sh` takes an optional suite-name arg; with it, emit only that suite's
+  `load` + `(eval (RUNNER))` after the shared MODULES. Without it, run all (current behaviour).
+- **MCP (optional):** thin `host_conformance(suite)` wrapper on the rose-ash-services server so it
+  returns the `{:total :passed :failed :fails}` dict directly.
+- **Effort:** ~1 line of bash + arg parse. **Payoff:** every remaining iteration of this loop.
+- **Not MCP-shaped on its own** — the bash arg is 90% of the value; wrap only if convenient.
+
+## 2. `host_live_check` — rendered HTML from an ephemeral server (high ROI) — DONE 2026-06-30
+
+Built as `lib/host/live-check.sh` (shell, the right grain — matches run-picker-check.sh). Boots
+an ephemeral host, logs in, seeds a post (exercising the form-ingest write path), then prints
+`status | content-type | body-head` for `/health /posts /feed / /<seeded>/` (or paths passed as
+args). Asserts reads are `text/sx`, no JSON leak, no 5xx, non-empty bodies — ~10s, no browser.
+Caught nothing new today (the wire was already verified) but it's the standing pre-deploy smoke.
+
+Generalize `lib/host/playwright/run-picker-check.sh` from "the picker" to "any route." Boot an
+ephemeral host server on a temp persist dir, seed posts, run an **authed request sequence**, and
+return the **rendered HTML** of each response.
+
+- **Why:** this is the manual dance we repeat for every render-path change. It's the only thing
+  that catches the serving-JIT divergence conformance misses — because it exercises the real
+  http-listen render VM, not the test harness.
+- **Shape:** `host_live_check({seed: [{title, sx_content, status}...], requests: [{method, path,
+  auth?, body?}...]})` → `[{status, content_type, body}...]`. Reuse serve.sh + the temp-persist /
+  admin-cred / cleanup scaffolding already in run-picker-check.sh.
+- **Effort:** medium (mostly lifting run-picker-check.sh's boot/seed/teardown into a parameterized
+  runner). **Payoff:** kills the most expensive recurring class — turns "deploy then eyeball" into
+  a pre-deploy check.
+- **Constraint:** never `pkill sx_server` (sibling loop agents share the binary) — bind the
+  ephemeral server to its own port + temp dir and kill only its own PID, as run-picker-check.sh
+  already does (`[[feedback_no_pkill_sx_server]]`).
+
+## 3. `host_render_diff(route)` — JIT vs interpreter, flag divergence (ends the bug class)
+
+The precise detector. Render a route **twice** — once through the JIT-served path, once through
+the interpreter — and diff the HTML. Any divergence IS a serving-JIT miscompile, surfaced at build
+time instead of live.
+
+- **Why:** #2 catches divergence only if a human notices the wrong output; this catches it
+  mechanically. It's the tool that would have flagged the 1-of-4-editors bug before deploy.
+- **Builds on:** `sx_render_trace` (already in the server's deferred toolset), `vm-trace`,
+  `bytecode-inspect`, `prim-check` (epoch-protocol diagnostics in CLAUDE.md).
+- **Effort:** highest (needs a deterministic interpreter-only render path to diff against, and a
+  stable HTML normalization so incidental ordering doesn't false-positive). **Payoff:** retires the
+  "verify live by hand" tax entirely. Coordinate with the `jit-bytecode-correctness` loop — this is
+  also their regression oracle.
+
+## 4. Surface `deps-check` / `prim-check` as MCP (low effort, modest payoff)
+
+Both already exist as epoch-protocol commands (CLAUDE.md). Wrapping them as MCP tools lets us catch
+unresolved symbols / missing primitives **before** a live boot, instead of via a load-time error.
+Strictly an ergonomic win — the capability is already there.
+
+## Explicitly NOT building
+
+- A CID / canon inspector. `sx_eval` already gives `host/blog-cid` / `host/blog--canon`
+  interactively; a dedicated tool wouldn't earn its keep.
+
+## Separately: file the sx-tree worktree bug
+
+Not a new tool — a **bug**. In this worktree (`loops/host`) every sx-tree WRITE/validate tool
+raises `yojson "Expected string, got null"`, forcing `Edit`/`Write` on `.sx` files (against
+CLAUDE.md's structural-edit protocol) and `sx_eval`-load as the validate substitute. File against
+whoever owns the sx-tree MCP; it degrades the intended workflow on every `.sx` edit here.
+
+## Sequence
+
+1 (bash suite-filter) → 2 (`host_live_check`) → 3 (`host_render_diff`), as natural breaks allow.
+Don't detour an in-flight slice for these; pick them up between slices.

plans/host-on-sx.md

@@ -36,7 +36,43 @@ host — no `ocaml-on-sx` dependency.
 
 ## Status (rolling)
 
-`bash lib/host/conformance.sh` → **0/0** (not yet started)
+`bash lib/host/conformance.sh` → **171/171** (9 suites: handler, middleware, sxtp,
+router, feed, relations, blog, server, ledger). **Blog now runs on the EDITOR's
+content model** (`sx_content` = SX element markup, what `blog/sx/editor.sx`
+emits), NOT content-on-sx CtDoc: a post is a `{slug,title,sx_content,status}`
+record in the durable persist **KV**, and a post page is `render-to-html (parse
+sx_content)`. Full CRUD + an editor form-ingest endpoint (`POST /new`,
+form-urlencoded) + JSON API, writes auth+ACL guarded. **`render-to-html` is fast
+(~0ms)** — it doesn't hit the JIT-miscompiled Smalltalk path, so blog rendering
+is no longer the 2s problem (that was content-on-sx's `asHTML`).
+
+> **Per-request IO (kernel) — FIXED.** `http-listen` handlers used to run via
+> `Sx_runtime.sx_call` (bare CEK, no IO resolution), so a handler doing a durable
+> `persist/read` returned an unresolved suspension. Fixed in `sx_server.ml`: the
+> handler now runs through `cek_run_with_io` (`Sx_ref.continue_with_call` →
+> `cek_run_with_io`), the same IO-driving runner the REPL uses — it resolves
+> persist ops via `Sx_persist_store.handle_op` between CEK steps. Verified:
+> handlers do per-request durable reads + writes (incl. 10 concurrent, 15 events
+> on disk, no corruption); handler errors don't crash the server. NOTE: this is
+> the per-request *IO* fix; it does NOT speed up the interpreted Smalltalk render
+> (`/welcome/` still ~2s) — that's a separate concern, addressed by caching the
+> rendered HTML at boot. (Pre-existing: an erroring handler closes the connection
+> with no response instead of a 500 — worth improving later.)
+>
+> **Render speed (separate from IO) — NOT precompiled.** `/welcome/` is ~2s because
+> the interpreted Smalltalk-on-SX render runs on the tree-walking CEK: the JIT hook
+> (`register_jit_hook`) is installed only in `--http` page mode, not the epoch/
+> http-listen serving mode (`make_server_env`), so zero `[jit]` activity. Enabling
+> it in that mode breaks correctness (router 3/6, feed 4/11, … — the known JIT-
+> bytecode bug on complex nested ASTs, which the Smalltalk evaluator is). So the
+> render is slow until the JIT compiler is fixed (big win, broad payoff — its own
+> loop) or the Smalltalk interpreter is optimised. Blog is FULLY DYNAMIC (reads
+> store + renders per request, no cache) — slowness is honest, not hidden. Phases 1 & 2 DONE; Phase 3 cut-over
+landed (50% off Quart). **The host now serves live HTTP** — `lib/host/server.sx`
+bridges the native `http-listen` server to the Dream app and `lib/host/serve.sh`
+boots it (verified: GET /health, /feed, /feed?actor=, relations get-children/
+get-parents all serve real JSON on a host port; unknown→404). Remaining: golden
+harness vs live Quart, internal-HMAC middleware, docker stack + Caddy subdomain.
 
 ## Ground rules
 
@@ -73,28 +109,353 @@ lib/host/sxtp.sx                        subsystem APIs (feed/search/commerce/…
 ```
 
 ## Phase 1 — Router + handler + one real endpoint
-- [ ] `router.sx` — route table, (method,path) match
-- [ ] `handler.sx` — request/response model, subsystem dispatch
-- [ ] migrate ONE read endpoint (e.g. a feed timeline) end-to-end, golden test
-- [ ] `conformance.sh` + scoreboard
+- [x] `router.sx` — `host/make-app` assembles per-domain route groups + a built-in
+      `/health` probe into one Dream router (reuses Dream's `dr/flatten-routes`)
+- [x] `handler.sx` — JSON envelope (`host/ok`/`host/ok-status`/`host/error`),
+      status-carrying `host/json-status` (Dream's `dream-json` is 200-only), and
+      `host/query-int`. A host handler IS a Dream handler (request -> response).
+- [x] migrate ONE read endpoint: `GET /feed` (`lib/host/feed.sx`) reads
+      `feed/all` + stream combinators, serialises recent-first; `?actor=` filter,
+      `?limit=` cap. Golden test asserts body == subsystem recent stream + envelope.
+- [x] `conformance.sh` (mirrors `lib/dream`'s runner) — 28/28
 
 ## Phase 2 — Middleware + SXTP
-- [ ] `middleware.sx` — composable auth/acl/mute/error layers
-- [ ] `sxtp.sx` — host↔subsystem wire format (align with existing spec)
-- [ ] migrate a write endpoint (auth + permission + action)
+- [x] `middleware.sx` — composable layers as `handler->handler`: `host/wrap-errors`
+      (JSON 500), `host/require-auth` (bearer -> principal, JSON 401, INJECTED token
+      resolver), `host/require-permission` (ACL `acl/permit?` gate, JSON 403,
+      INJECTED resource extractor), `host/pipeline` (first = outermost). Reuses
+      Dream's `dream-bearer-token` + `dream-catch-with`; calls lib/acl public API.
+      Mute/prefs layer deferred (no blocker, add when a domain needs it).
+- [x] `sxtp.sx` — host↔subsystem wire format (per `applications/sxtp/spec.sx`).
+      Message algebra (`sxtp/request`/`response`/`condition`/`event` + status
+      helpers `sxtp/ok`/`created`/`not-found`/`forbidden`/`invalid`/`fail`) as
+      string-keyed dicts; verb/status/type as symbols (ride the wire bare). Codec:
+      `sxtp/serialize` (dict → `text/sx` list form, deterministic field order,
+      nested messages in their own list form, no `:msg` leak) and `sxtp/parse`
+      (`text/sx` → dict, deep keyword-token→string normaliser). Dream bridge:
+      `sxtp/from-dream` (HTTP req → SXTP req, method→verb, query→params) and
+      `sxtp/to-dream` (SXTP resp → HTTP resp, status→code, body→`text/sx`).
+- [x] migrate a write endpoint (auth + permission + action): `POST /feed`
+      (`host/feed-write-routes resolve`) — auth ∘ ACL("post","feed") ∘ wrap-errors
+      over `host/feed-create`, which parses the JSON body and `feed/post`s it (201);
+      non-object body -> 400. Created activity is readable back via `GET /feed`.
 
 ## Phase 3 — Strangler migration ledger
-- [ ] enumerate Quart endpoints; track migrated vs proxied
+- [x] enumerate Quart endpoints; track migrated vs proxied — `ledger.sx`: a
+      catalogue of every endpoint (domain, method, path, Quart original, status
+      `:native`/`:migrated`/`:proxied`, SX handler) + queries (by-status/by-domain,
+      `host/ledger-find`, `host/ledger-served?`, distinct domains) and
+      `host/ledger-coverage` (off-Quart % = (migrated+native)/total). Seeded with
+      the live state: feed reads+writes migrated, `/health` native, the
+      internal-only `relations`/`likes` data+action endpoints proxied.
 - [ ] golden-response harness vs the live Quart responses
-- [ ] cut over a whole domain (smallest: `likes` or `relations`) as proof
+- [x] cut over a whole domain (`relations`) as proof — the CONTAINER relations are
+      fully on the host (`lib/host/relations.sx`): reads `GET .../get-children` +
+      `/get-parents` → `relations/children`/`parents`; writes `POST
+      .../attach-child` + `/detach-child` → `relations/relate`/`unrelate`, behind
+      the auth+ACL pipeline (mirrors POST /feed). Node model: graph atom = symbol
+      `"type:id"`, edge = relation-type; `child`/`parent-type` params filter by
+      `"type:"` prefix. Closed-loop test: attach → visible via get-children →
+      detach → gone. The TYPED actions (`relate`/`unrelate`/`can-relate`) stay
+      proxied by design — registry + cardinality validation lib/relations lacks.
 
-## Phase 4 — Dream framework layer (gated)
-- [ ] gate: `ocaml-on-sx` Phases 1–5 + minimal stdlib green
-- [ ] adopt `dream-on-sx` routing/middleware/session ergonomics over the same handlers
-- [ ] re-home external adapters as native where replacements land
+## Phase 4 — Live wiring + Dream framework layer
+- [x] native `http-listen` ↔ Dream-app bridge (`lib/host/server.sx`:
+      `host/native-handler`/`host/serve`) + `lib/host/serve.sh` launcher. Serves
+      real HTTP on a host port — verified live (health/feed/relations reads + 404).
+- [x] promote into the docker stack + a Caddy subdomain — **LIVE at
+      `https://blog.rose-ash.com`** (reusing a down Quart subdomain). New compose
+      service `sx_host` (`docker-compose.dev-sx-host.yml`, container
+      `sx-dev-sx_host-1`) runs `serve.sh` on `externalnet`; Caddy reverse-proxies
+      `blog.rose-ash.com` → `sx-dev-sx_host-1:8000`. Required a `hosts/` fix:
+      `http-listen` bound `inet_addr_loopback` only — added `SX_HTTP_HOST` env
+      (default loopback; stack sets `0.0.0.0`) in `sx_server.ml`, rebuilt this
+      worktree's binary. Verified: `/health`, `/feed`, relations reads serve real
+      JSON through Cloudflare→Caddy; `/` 404 (no root route yet). `rose-ash.com`
+      untouched. (Inode-pinned bind-mount gotcha: editing `/root/caddy/Caddyfile`
+      via a tool swaps its inode so the container kept the old content — loaded live
+      via reload-from-non-bind-path, then RECONCILED by restarting Caddy so the
+      bind re-points to the corrected file. Verified post-restart: blog serves, and
+      `sx.rose-ash.com`/`rose-ash.com` survived.)
+- [x] blog published-post read endpoint — `lib/host/blog.sx`: `GET /<slug>/`
+      renders a content-on-sx `CtDoc` to HTML via `content/html` (anonymous,
+      world-visible). In-memory slug→doc registry now (swap `host/blog-lookup` for
+      a persist-backed content stream later, handler/route unchanged). `:slug`
+      catch-all mounted LAST so domain routes win. **LIVE**: `blog.rose-ash.com/
+      welcome/` renders real HTML through Caddy. Needs Smalltalk+persist+content
+      preloads + `(st-bootstrap-classes!)`+`(content/bootstrap!)` (self-bootstraps
+      at load).
+- [ ] **persist-backed blog content via `lib/blogimport`** (STAGED, pick up after the
+      cards-as-types work). Swap `host/blog-lookup`'s in-memory registry for
+      `(content/head b post-id)` over `content:<id>` streams populated by `lib/blogimport`
+      (merged to local `architecture` `a746b6ab`, 76/76 — `git merge architecture` to
+      get it). Resolves Q-M4 (live source via injected `fetch-fn` = host `fetch_data`).
+      Full steps incl. the blog-side draft query + parity gate: `plans/blogimport-pickup.md`.
+- [ ] proxy-to-Quart fallback for un-migrated paths (strangler requirement before
+      a real subdomain fronts users).
+- [ ] internal-HMAC middleware on `/internal/*` (service-to-service auth; protocol
+      checks native, signature check needs an HMAC-SHA256 kernel prim — absent today).
+- [ ] (gated) adopt `dream-on-sx` session/CSRF ergonomics; re-home external
+      adapters as native where replacements land.
+
+## Phase 5 — Generic interactive SX-page serving (host SSR)
+
+**The generic gap.** A host serves three classes: (1) JSON/data endpoints —
+DONE; (2) static content pages — DONE (`render-to-html` on *parsed* markup, e.g.
+blog post `sx_content`); (3) **interactive UI pages** — component/island trees
+with attributes + client behaviour — **the host cannot do this at all.** The
+"editor problem" is one instance; dashboards, account, market-browse, any admin
+screen are the same gap. The capability — not the editor — is the deliverable.
+
+**Why `render-to-html` alone is insufficient (proven).** `render-to-html` on
+parsed markup handles attributes (`<div id="x">`); but an *evaluated* component
+tree mangles them (`(form :id ..)` → `<form>idpost-new-form…`) because in the
+host preload tags don't collect keyword args as attrs. The `--http` docs server
+already does this correctly via its component-render + shell pipeline. So: reuse
+that pipeline, don't reinvent or patch per-component.
+
+**Reuse, don't rebuild.** The kernel already has: `~shared:shell/sx-page-shell`
+(emits `<!doctype>` + inlined component/island defs in `<script type="text/sx">`
++ CSS + `sx-browser.js` + page SX for hydration), `http_inject_shell_statics`
+(gathers defs/CSS/asset-hashes into the env), and `http_render_page`. These power
+`sx.rose-ash.com`. The job is to make them reachable from the `http-listen`
+serving path.
+
+Sub-steps (each independently gated/verified):
+- [x] **5.1 Page render from a host handler.** DONE. Kernel: a `render-page`
+      primitive (sx_server.ml, persistent mode) renders an UNEVALUATED SX
+      expression with the server env via `sx_render_to_html` — render-to-html
+      expands defcomp components + collects keyword attrs itself; SX handlers
+      can't reach the server env, so the prim supplies it. Host: `lib/host/page.sx`
+      — `host/page` (expr → HTML response) + `host/page-route` (mount on a GET
+      path). Gate MET: `~editor/form` renders correct HTML (`<form method="post"
+      class=.. id="post-new-form">…`), and the `page` suite (8 tests) proves a
+      generic attributed+nested component renders right (no `:class`-as-text
+      mangling). Root cause confirmed: bare render-to-html on an *evaluated* tree
+      mangles attrs; `render-page` renders the *unevaluated* expr so expansion +
+      attr-collection happen in render-to-html.
+- [ ] **5.2 Shell statics + aser SSR (the real dynamic-page path).** `render-page`
+      (5.1) renders STATIC component trees, but is NOT the full evaluator —
+      dynamic-logic bodies fail (proven: a component doing `(map fn items)` over
+      `(unquote data)` → "Not callable: nil"). Clean dynamic component pages
+      (a posts loop) + island pages therefore need the **aser** pipeline (evaluate
+      control flow, serialise tags) + `http_inject_shell_statics` (component defs /
+      CSS / asset hashes) + `~shared:shell/sx-page-shell`. Gate: a page with a data
+      loop renders, and a full shell emits with defs inlined.
+      NOTE (2026-06-19): the legacy-editor stopgaps (kg-compat aliases, `./blog`
+      mount, legacy `sx-editor.js` + hardcoded asset URLs at `/new`, the
+      `~editor/sx-editor-styles` reuse) were REVERTED — they were debt to revive
+      stale code. `/new` is now a clean minimal form; host pages still use minimal
+      shell HTML until the aser path lands. Posts render via per-block guarded
+      `render-page`; unsupported editor cards (e.g. `~kg-md`) show placeholders by
+      design (no alias shim).
+- [ ] **5.3 Static-asset serving.** Serve `/scripts/*.js`, `/*.css`, `/wasm/*`
+      from `shared/static`. Host has none today — needs a kernel file-serving
+      route in the `http-listen` server (or a file-read prim + SX static handler).
+      Interim option to defer: reference assets by absolute URL from the existing
+      static host. Gate: `sx-browser.js`/CSS load for a host-served page.
+- [ ] **5.4 Island hydration.** Confirm a trivial island page boots + hydrates
+      client-side (sx-browser.js) when served by the host. Gate: a counter island
+      increments in the browser.
+- [~] **5.5 Editor POC — HANDED OFF.** The native SX-island editor is the
+      interactivity layer; per the architecture it lives on the `--http` island
+      pipeline (not the host) and needs browser/Playwright iteration (absent in
+      this worktree). Handoff brief: `plans/blog-editor-island.md`. The host side
+      is READY: `POST /new` ingest is live + proven (form-urlencoded
+      title/sx_content/status → 303); CORS can be added on request if the editor
+      uses fetch. Decision: don't port island hydration into the host; the editor
+      is a docs-side island that publishes to the host.
+
+**Note:** component SSR is interpreted → slow until the `sx-vm-extensions` JIT
+loop lands; correctness first, speed follows. Scope spans `hosts/` (page-render
+exposure + static serving) + `lib/host` (page route type + page handlers).
+
+**Modern editor — language.** A WYSIWYG editor is a *reactive UI*, so it should be
+an **SX reactive island** (`defisland` + signals/lakes — the platform's native UI
+primitive), NOT a guest language (Datalog/Prolog/APL/Haskell are logic/data/array
+— wrong tool) and NOT a JS lib (Lexical/Koenig, the legacy baggage). The document
+*model* it edits is **content-on-sx** (structured blocks, CvRDT-ready for
+collaboration). So: **SX islands for the UI, content-on-sx for the model** — SX
+all the way down, dogfooding the reactive runtime + content-on-sx + this new
+page-serving capability. (Legacy `blog/sx/editor.sx` is Lexical/Koenig/Quart-CSRF
+era — replace, don't resurrect; the `POST /new` ingest already speaks the
+`sx_content` contract any new editor emits.)
 
 ## Progress log
-(loop fills this in)
+
+- **Phase 1 (DONE, 28/28).** `lib/host/{handler,router,feed}.sx` + three test
+  suites + `conformance.sh`. The host is a thin wiring layer: a host handler is a
+  Dream handler that calls a subsystem public API and serialises the result via a
+  shared JSON envelope. First migrated endpoint: `GET /feed`.
+  - **Decision — build on Dream from Phase 1, not a throwaway native model.** The
+    plan front-matter gated Dream to Phase 4, but `dream-on-sx` is merged
+    (commit fe958bda) and its gate (`ocaml-on-sx` P1–5+P6) is green (480/480), so
+    reinventing request/response + routing would be pure duplication. Host reuses
+    Dream's `types.sx` (request/response dicts), `json.sx` (encode), and
+    `router.sx` (`dream-router`/`dream-get`/`dr/flatten-routes`). Phase 4's
+    "adopt Dream ergonomics" is therefore largely already satisfied; what remains
+    for Phase 4 is the live wiring against the real OCaml HTTP server + session.
+  - The OCaml server handing a `dream-request`-shaped dict to SX handlers is a
+    `hosts/` change (out of scope) — tracked under Blockers as the eventual
+    live-wiring step. For now the host layer is exercised purely via conformance.
+
+- **Phase 2 (middleware + write endpoint DONE, 43/43).** `lib/host/middleware.sx`
+  + a guarded `POST /feed`. Middleware is plain function composition over Dream's
+  primitives; auth/permission *policy* is injected (token resolver, resource
+  extractor) so the layer is policy-free and testable. ACL authorisation runs
+  against lib/acl's public `acl/permit?` (string atoms work — no symbol coercion
+  needed). The write path proves the auth ∘ permission ∘ action stack end-to-end:
+  401 unauth, 403 unpermitted, 201 + readback on success, 400 on bad body.
+- **Phase 2 COMPLETE (82/82).** `lib/host/sxtp.sx` adds the SXTP codec + Dream
+  bridge (39-test suite). Key representation calls, learned by probing the runtime:
+  keywords are strings at eval time but the `serialize` primitive renders
+  string-keyed dicts back as `{:k v}` and symbols bare — so messages are
+  string-keyed dicts with verb/status/type as symbols, and a small str-based
+  emitter produces wire-faithful list form. `parse` needs a deep normaliser
+  because parsed keyword tokens are a distinct type (not `=` to string literals).
+  `unquote-splicing` is unreliable here, so the serializer is str-based, not
+  quasiquote-based.
+  - **Next: Phase 3 — strangler migration ledger.** Enumerate the Quart endpoints
+    (use the `rose-ash-services` `svc_routes` MCP tool), track migrated vs proxied,
+    and stand up a golden-response harness against the live Quart responses. Then
+    cut over the smallest whole domain (`likes` or `relations`) as proof.
+
+- **Phase 3 — ledger module (DONE, 107/107).** `lib/host/ledger.sx` + a 25-test
+  suite. Enumerated the endpoint surface via the `rose-ash-services` MCP
+  (`svc_routes`/`svc_queries`/`svc_actions`): `likes` and `relations` have **no
+  public blueprint routes** — they're internal-only, exposed as
+  `/internal/data/{query}` + `/internal/actions/{action}` (HMAC-signed). The
+  ledger is a pure-data catalogue keyed by (domain, method, path) carrying each
+  endpoint's Quart original, status, and serving SX handler; coverage reports the
+  off-Quart percentage. Cut-over target chosen: **`relations`** (already has a real
+  SX subsystem `lib/relations` — children/parents reads + relate/unrelate writes
+  map straight onto its public API); `likes` stays proxied (no SX lib to dispatch
+  to). NEXT: migrate the `relations` read endpoints onto host handlers (flip their
+  ledger status to `:migrated`) with golden tests.
+
+- **Phase 3 — relations READ cut-over (DONE, 121/121).** `lib/host/relations.sx`
+  + a 13-test golden suite; ledger flipped (off-Quart coverage 27% → 45%). The two
+  internal read queries (`get-children`, `get-parents`) now dispatch to the
+  `lib/relations` Datalog graph. Bridge: the Quart `(type, id)` node key maps to a
+  graph atom `(string->symbol "type:id")` with relation-type as the edge kind;
+  optional `child-type`/`parent-type` params filter the result list by `"type:"`
+  prefix (verified live: composite-string nodes round-trip through
+  `relations/relate` → `relations/children`). Golden discipline: `relations` is
+  internal-only (no public Quart route — confirmed via `svc_routes`), so the golden
+  is a **pinned fixture** (a known graph loaded in-test, asserted as
+  `subsystem-call + envelope`) rather than a live Quart capture. Reads are
+  unguarded for now — the signed-internal-auth gate is a separate middleware layer,
+  same as the feed reads. NEXT: relations WRITE actions (`relate`/`unrelate`)
+  behind the auth+ACL pipeline (mirroring POST /feed).
+
+- **Phase 3 — relations WRITE cut-over (DONE, 132/132).** `lib/host/relations.sx`
+  gains `host/relations-attach`/`-detach` (`POST .../attach-child` + `/detach-child`)
+  and `host/relations-write-routes` — the write side of the container reads,
+  dispatching to `relations/relate`/`unrelate` over the same `"type:id"` node
+  model so an attach is immediately visible through `get-children`. Each runs
+  behind the host pipeline `wrap-errors ∘ require-auth ∘ require-permission`
+  (`"relate"`/`"unrelate"` on `"relations"`) — exactly the POST /feed stack. The
+  relations test suite proves the closed loop end-to-end: 401 unauth, 403 authed-
+  but-unpermitted (graph unchanged), 201 attach → child visible via the migrated
+  read → 200 detach → child gone; 400 on bad/short payloads. The ledger now models
+  the full relations surface (7 endpoints): container reads+writes `:migrated`,
+  typed `relate`/`unrelate`/`can-relate` `:proxied` (registry/cardinality
+  validation not in lib/relations). Off-Quart coverage 45% → **50%** (7/14).
+  `relations` is the first whole *coherent feature* (container relations) fully
+  off Quart. NEXT: golden-response harness vs live Quart, then survey the next
+  domain (blog/likes proxied — likes needs an SX subsystem first).
+
+- **Phase 4 — live wiring bridge (DONE, 145/145).** `lib/host/server.sx` adapts the
+  native `http-listen` contract (string-keyed req `{"method" "path" "query"
+  "headers" "body"}` → `{:status :headers :body}`) to the Dream app: `host/-native
+  ->dream` reassembles `path`+`query` into a target `dream-request` parses;
+  `host/-dream->native` is near-identity (dream-response is already `{:body
+  :headers :status}`). `host/serve port groups` = `http-listen` over
+  `host/native-handler (host/make-app groups)`. `lib/host/serve.sh` boots the full
+  module set (mirrors conformance) and serves in the foreground (container-entry
+  shaped). **Verified live** on a host port: `/health` 200 JSON, `/feed` recent-
+  first seeded activities, `/feed?actor=` filtered, relations `get-children`/`get-
+  parents` real JSON, unknown→404. Demo run was a standalone `sx_server.exe`
+  process (NOT the docker stack) — killed by its own PID, never `pkill` (siblings
+  share the binary). The standing "live wiring is a hosts/ change" Blocker is
+  resolved for the SX side: the bridge is pure SX in `lib/host`; only the *launch*
+  (docker stack + Caddy) remains. NEXT: golden harness, internal-HMAC, then promote
+  into the stack behind a fresh subdomain.
+
+## SX gotchas + how this loop guards against them
+
+The SX dev experience has real footguns. Most are statically detectable; the
+tools exist (`sx_validate`, `deps-check`, `sx_format_check`) but must be *gated*.
+Hit/relevant here:
+- **Reserved-name shadowing** — `guard`/`bind`/`conj`/`disj` are special forms or
+  host primitives; a local binding of that name is silently shadowed by the form.
+  (`(let ((guard ...)))` made `(guard handler)` invoke the R7RS `guard` special
+  form → `first: expected list`.) Fix: namespace-prefix every helper
+  (`host/blog--protect`, never `guard`).
+- **Silent test truncation** — a test file that errors mid-load returns only the
+  tests that ran before the error, reporting a FALSE GREEN ("blog 13 passed, 0
+  failed" while 16 CRUD tests never ran). **GUARDED**: `conformance.sh` now greps
+  the run output for `Undefined symbol` / `Unhandled exception` / `expected list,
+  got` / `[load] … error` and aborts loudly before the tally can hide it.
+- **`let` is parallel** (bindings can't see each other), **bodies need `(do …)`**
+  (only the last expr evaluates), **`append!` no-ops on map/rest-derived lists**,
+  **parsed keyword tokens ≠ string literals**. These produce wrong *results*, so
+  test coverage catches them as red (not silent) — provided the runner is honest,
+  which the truncation guard now ensures.
+
+Prevention ladder: parse (`sx_validate` after every edit) → unresolved/shadowed
+symbols (`deps-check`, candidate pre-commit gate) → fail-loud runner (done) →
+behavioural tests. A `deps-check`-style "binding shadows a special form" lint
+would catch the reserved-name class before runtime — a worthwhile follow-up.
+
+## ⚠ Experimental: unguarded create live on blog.rose-ash.com
+
+`host/blog-open-create-routes` mounts **`POST /new` with NO auth** (create-only,
+error-trapped) so the SX editor can publish end-to-end. **Validated live**: an
+editor-style form POST → 303 → the post renders at `/<slug>/` and lists on `/`.
+This is a deliberate, short-lived public write hole (create-only — no PUT/DELETE
+exposed; obscure subdomain). **MUST be gated before real use** — Caddy basicauth
+on `/new` (the `/root/caddy/auth` dir exists) or session auth once identity lands.
+Swap `host/blog-open-create-routes` → `host/blog-write-routes <resolver>` to gate.
 
 ## Blockers
-(loop fills this in)
+
+- **Live wiring to the native OCaml HTTP server** (Phase 3/4): the prod server in
+  `hosts/` must hand SX handlers a `dream-request` dict and serialise the returned
+  `dream-response`. That is a `hosts/` change (out of scope for this loop, which is
+  `lib/host/**` only). Until then, endpoints are verified via `conformance.sh`, not
+  HTTP. Not blocking Phase 2 (middleware + SXTP + a write endpoint).
+- **Worktree tooling:** in this `loops/host` worktree every sx-tree *write* tool
+  (`sx_write_file`, `sx_replace_node`, …) raises `yojson "Expected string, got
+  null"` at the MCP layer — same class as the `loops/dream` worktree gotcha, but
+  here even `sx_write_file` fails. Read-side sx-tree tools work. New `.sx` files
+  were created with the `Write` tool (the .sx hook is inactive in this worktree)
+  and each validated afterwards with `sx_validate` to keep the parse guarantee.
+
+## Action item — serving-JIT speedup is NOT a code merge; it's a one-line flag flip
+
+The ~2s interpreted-Smalltalk render (`/welcome/`, blog post pages) is being fixed
+by the **`sx-vm-extensions`** loop — the JIT-bytecode-correctness handoff we kicked
+off on 2026-06-19. **Do not wait for a code merge into `lib/host/**`** — the fix
+lives entirely in the shared kernel (`hosts/ocaml/**`: `sx_server.ml`, `sx_vm.ml`,
+extension modules) + shared guest runtimes (`lib/smalltalk/eval.sx`,
+`lib/compiler.sx`, `lib/*/runtime.sx`). None of it is host code. The speedup is a
+property of the shared `sx_server.exe` binary every loop already runs.
+
+The serving-mode JIT is **gated behind `SX_SERVING_JIT`** (vm-ext commit
+`bf298684`), and host's `serve.sh` / `conformance.sh` currently do **not** set it.
+So host's entire adoption step is:
+
+1. Wait for `sx-vm-extensions` → `architecture` (kernel + guest-runtime merge) and
+   the rebuilt shared binary. Watch its scoreboard: serving-JIT must be green across
+   ALL guest suites (Smalltalk, Datalog, Scheme, Haskell, Erlang, Prolog, APL, js)
+   with `SX_SERVING_JIT=1` — already done as of vm-ext `fed58b28` (js 148/148).
+2. Gate locally: run `SX_SERVING_JIT=1 bash lib/host/conformance.sh` against the
+   rebuilt binary. Must stay green — this is the exact suite that first exposed the
+   miscompile (`router 3/6, feed 4/11, relations 9/16, blog 4/11` with the old JIT
+   on). If green, the residual exclusions in vm-ext covered host's workload.
+3. Flip it on live: add `export SX_SERVING_JIT=1` to `lib/host/serve.sh` (the one
+   in-scope `lib/host/**` change). Commit as a feature. Live render should drop from
+   ~2s to tens of ms — highest-leverage perf win on the platform.
+
+Until step 1's binary is in, this is a no-op — leave `serve.sh` as is.

plans/host-spa.md

@@ -0,0 +1,140 @@
+# Host blog → SPA via the SX-htmx engine (WASM OCaml kernel)
+
+## ✅ COMPLETE 2026-06-29 — live SPA on the WASM OCaml kernel
+
+blog.rose-ash.com is now a single-page app: the browser boots the SAME OCaml
+kernel the server runs (compiled to WASM), `sx-boost` fragment-swaps every link
+into #content with URL push + working back button, no full reload. Verified:
+native host conformance 271/271; `lib/host/playwright/spa-check` 4/4 in chromium;
+LIVE blog.rose-ash.com boost 19/19 + click nav + zero errors.
+
+The boot crash was the crypto stack assuming 63-bit int (fixed in `fce9e0c6`).
+The boost then needed six more source-load/boost-path fixes (commit `689dae7d`):
+import double-apply (library_loaded_p got a key not a spec), unloaded-import
+crash (library_exports nil -> empty dict), value_to_js missing Integer (broke
+dom-query-all -> only 1 link boosted), browser-same-origin? rejecting relative
+URLs, dom-query-in undefined (= dom-query), and lazy-deps never preloaded under
+source fallback (CEK can't lazy-resolve). Everything below is the history.
+
+---
+
+
+Turn the blog (lib/host/blog.sx) into a single-page app using the in-repo SX
+hypermedia engine (web/engine.sx — "our htmx"): boot the **WASM OCaml kernel**
+(the same evaluator the server runs) in the browser, and `sx-boost` every
+link/form into a fragment swap into `#content` — no full reloads, history kept,
+graceful degradation to plain server-rendered pages with no JS.
+
+## Status
+
+**DONE — server side (verified, all green):**
+- `lib/host/static.sx` — `GET /static/**` serves files under `shared/static` via
+  the `file-read` primitive (content-type by extension, path-traversal guarded,
+  404 on missing). Mounted in serve.sh + the route list. Tested: kernel JS 200 +
+  correct ctype + exact bytes; `.wasm` binary-exact with `application/wasm`;
+  traversal/missing → 404.
+- `lib/host/blog.sx` `host/blog--page` is now the SPA shell: full page = WASM boot
+  scripts (`/static/wasm/sx_browser.bc.wasm.js` + `sx-platform.js`) + a
+  `sx-boost="#content"` wrapper div + `#content`. On the `SX-Request: true` header
+  (a boosted nav) it returns ONLY the inner content (fragment) so the engine swaps
+  it into `#content`. All 13 page handlers thread `req`. Tested: full page carries
+  scripts+boost+#content; `SX-Request` returns the bare fragment.
+- `docker-compose.dev-sx-host.yml` mounts `./shared/static` so the live container
+  can serve the kernel.
+- `lib/host/playwright/spa-check.spec.js` + `run-spa-check.sh` — browser check
+  (boot, boost, fragment swap, back button).
+
+**DONE — client side, partial:**
+- The WASM kernel BOOTS in a headless browser: `globalThis.SxKernel` is an object,
+  `<html data-sx-ready="true">` is set, the web-stack modules load.
+- Fixed: this worktree's `shared/static/wasm/sx_browser.bc.wasm.assets/` was
+  missing 5 of 11 `.wasm` units (`sx-`, `unix-`, `re-`, `start-`,
+  `dune__exe__Sx_browser-`); copied the complete set from the main worktree.
+
+**BLOCKER — boost does not activate (`boosted links: 0 / N`):**
+- The bundled `.sxbc` bytecode throws `VM: unknown opcode 0` against this
+  worktree's `sx_browser.bc.wasm.js` kernel, so sx-platform.js falls back to `.sx`
+  source for every web-stack module. Source fallback works for all modules EXCEPT
+  `boot.sx`, which then fails with `Expected list, got string` — so the boot
+  sequence that wires `process-elements → process-boosted` doesn't complete and no
+  link gets `_sxBoundboost`.
+- Root cause: the `.sxbc` in `shared/static/wasm/sx/` are out of sync with the
+  WASM kernel (sx.rose-ash.com avoids this because its Docker image ships a
+  consistent bundle and it navigates via client-router page-routes, not boost).
+
+## UPDATE 2026-06-29 — kernel BOOT crash fixed (crypto WASM-safe)
+
+The boot crash was NOT the build pipeline — it was the kernel's crypto stack
+assuming 63-bit native int. On the web targets (js_of_ocaml 32-bit, wasm_of_ocaml
+31-bit) sha2/cbor/cid/ed25519 truncated, and ed25519 precomputes `sqrtm1` +
+`base_point` AT MODULE INIT via a base-2^26 bignum whose 52-bit products overflow
+→ `Char.chr(-4)` crash on load. Fixed in `fce9e0c6` (sx_sha2 Int32 rounds +
+Int64 length, sx_cbor Int64 width-select, sx_cid bounded base32, sx_ed25519 Int64
+bignum mul/div_small). Verified: NIST/CID vectors match native↔js↔wasm; native
+conformance 271/271; **the freshly-built browser kernel now BOOTS** (SxKernel
+live, data-sx-ready=true, crypto-sha256 correct on js + wasm).
+
+REMAINING for boost (separate layer — web-stack loading, NOT crypto). Two
+compounding roots, both fully diagnosed:
+
+1. **`.sxbc` carry NIL bytecode.** `compile-modules.js` (via the native binary)
+   emits `:bytecode (nil nil nil …)` placeholders, not real bytecode — so the
+   SX-level `vm.sx` interpreter reads nil → `VM: unknown opcode 0`, and the web
+   stack falls back to `.sx` source for every module. (Confirmed by inspecting a
+   freshly-compiled `dom.sxbc`.) The native compiler isn't producing bytecode in
+   this path.
+
+2. **Source-fallback can't resolve manifest-mapped libraries.** With imports
+   stripped, all 23 `boot.sx` body forms load clean — the `Expected list, got
+   string` is from an `import`. `boot.sx` imports `(sx signals-web)`, but that
+   library is *defined inside `signals.sx`* (the file→library names don't match;
+   the module-manifest maps `"sx signals-web" → signals.sxbc`). The `.sx`
+   source-fallback resolver maps a library to a like-named FILE, looks for a
+   non-existent `signals-web.sx`, and the failed resolution returns a string into
+   a list op → the error → `boot.sx` never loads → `process-boosted` never runs →
+   boost 0/N. (A `signals-web.sx` bridge that imports signals was NOT sufficient
+   — there is at least one more such mismatch among the imports.)
+
+THE CLEAN FIX is a proper bundle rebuild via `scripts/sx-build-all.sh` so the
+`.sxbc` carry real bytecode and the manifest-driven path loads everything (no
+source fallback, so root #2 never triggers) — gated on fixing root #1 (why
+`compile-modules.js` emits nil bytecode). Alternatively, make the source-fallback
+resolver manifest-aware. Neither is a quick edit; it's a web-stack build-tooling
+sub-project. The kernel itself is now correct and boots.
+
+## Rebuild attempt (2026-06-28) — FAILED, reverted (superseded by the fix above)
+
+Tried it: `dune build browser/sx_browser.bc.wasm.js` succeeded (with many
+`integer-overflow` warnings — "generated code might be incorrect"), and
+`node hosts/ocaml/browser/compile-modules.js shared/static/wasm` recompiled all
+35 `.sxbc` cleanly. But the freshly-built kernel **crashes on init** in the
+browser: `Fatal error: exception Invalid_argument("Char.chr")` — so `SxKernel`
+never initialises (worse than before). The integer-overflow truncation during
+wasm codegen is the likely culprit (a SHA/char constant). Reverted
+`shared/static/wasm/` to the main-worktree bundle (which boots cleanly —
+verified SxKernel + data-sx-ready). So a naive in-worktree rebuild is NOT the
+fix; the wasm build itself needs investigating (wasm_of_ocaml version? the merged
+sx-vm-extensions/resolver changes interacting with codegen?).
+
+## Next step — rebuild a consistent WASM bundle
+
+`scripts/sx-build-all.sh` does: build the browser wasm target → sync web `.sx`
+into `hosts/ocaml/browser/dist/sx/` → `node hosts/ocaml/browser/compile-modules.js`
+(recompiles `.sxbc` via the native sx_server binary) → copy into
+`shared/static/wasm/`. The browser wasm target is NOT built in this worktree
+(`hosts/ocaml/_build/default/browser/` is empty), so this needs the
+`wasm_of_ocaml` toolchain set up first. Once the `.sxbc` match the kernel, the
+bytecode path loads (no source fallback), `boot.sx` runs, and `process-boosted`
+binds the links — then the SPA Playwright check should pass.
+
+Alternatively: build the browser kernel in the main worktree (which has the
+pipeline) and copy a consistent `sx_browser.bc.wasm.js` + assets + `.sxbc` set
+into this worktree's `shared/static/wasm/`.
+
+## Deploy note
+
+The live container is NOT redeployed with the SPA shell yet — it keeps running the
+pre-SPA `blog.sx` in memory (the native host doesn't hot-reload). Don't recreate
+the container until the bundle is consistent and the SPA Playwright check is green,
+to avoid shipping a kernel that boots but doesn't boost. (Even if it is recreated,
+pages degrade gracefully: links still do normal full-page nav.)

plans/jit-bytecode-correctness.md

@@ -0,0 +1,236 @@
+# JIT bytecode correctness — enable the JIT in serving mode
+
+> Kickoff handed over from the **host-on-sx** loop (2026-06-19). This is the
+> highest-leverage perf win on the platform.
+
+## Why this matters
+
+Every SX-on-SX subsystem runs **interpreted on the tree-walking CEK**: the
+Smalltalk runtime (→ content-on-sx rendering), and the guest languages
+(Datalog, Prolog, APL, Scheme, Haskell, Erlang, Maude). The lazy JIT
+(`register_jit_hook` → bytecode VM) would speed all of them up ~10–60×. It is
+currently **only installed in `--http` page-server mode**, not the epoch /
+`http-listen` serving mode — because it **miscompiles** these workloads.
+
+Concrete impact: the host serves a blog post (`content/html`, interpreted
+Smalltalk) in **~2 seconds per request**. With a correct JIT it should be tens
+of ms. Same slowdown applies to every guest-language-backed service.
+
+## Concrete repro (from the host loop)
+
+In `hosts/ocaml/bin/sx_server.ml`, the persistent server mode (`make_server_env`,
+~line 4871) does **not** call `register_jit_hook env` — only the `--http` mode
+(~line 4034) does. To reproduce the miscompile:
+
+1. Add `register_jit_hook env;` right after `let env = make_server_env () in` in
+   the persistent server-mode branch (~4871).
+2. Rebuild: `eval $(opam env --switch=5.2.0); dune build bin/sx_server.exe`.
+3. Run a Smalltalk/content-heavy suite, e.g. the host-on-sx conformance
+   (`bash /root/rose-ash-loops/host/lib/host/conformance.sh`, or any
+   content-on-sx suite). **With the hook ON, tests FAIL** — host-on-sx dropped to
+   `router 3/6, feed 4/11, relations 9/16, blog 4/11`. With the hook OFF: all green.
+
+So the JIT produces **wrong results** (the known "compiled compiler helpers loop
+on complex nested ASTs" — see memory `project_jit_bytecode_bug`).
+
+## Goal
+
+Make the JIT compile the Smalltalk-on-SX evaluator + guest-language evaluators
+**correctly**, so `register_jit_hook` can be enabled in serving mode with
+conformance **fully green**. Then enable it there.
+
+## Suggested approach
+
+- Minimal repro to bisect: render a `lib/content` doc via `content/html` with JIT
+  ON vs OFF, diff the output, find the first divergence.
+- Localize with the VM debugging tools (see CLAUDE.md): `(vm-trace ...)`,
+  `(bytecode-inspect ...)`, `(prim-check ...)`, `(deps-check ...)`.
+- Likely suspects: nested closures / TCO, dict construction, `st-send` dispatch
+  patterns, recursion through the Smalltalk method interpreter.
+
+## Pointers
+
+- `register_jit_hook` — `sx_server.ml` ~1493; JIT VM-suspend/resolve path ~1497–1514.
+- `hosts/ocaml/lib/sx_vm.ml` — the bytecode VM + compiler.
+- `plans/jit-cache-architecture.md`, `plans/jit-perf-regression.md`, `restore-jit-perf.sh`.
+- Memory: `project_jit_bytecode_bug.md` (plan ref `plans/reflective-rolling-treehouse.md`).
+- The shared `sx_server.exe` binary is used by ALL loops — coordinate before
+  changing VM semantics that could affect sibling conformance runs.
+
+---
+
+## Resolution (2026-06-19, loop loops/sx-vm-extensions)
+
+JIT is now enabled in the persistent (epoch) serving mode (`register_jit_hook`
+in `sx_server.ml`'s server-mode branch). Smalltalk conformance is **847/847 —
+identical to the no-JIT baseline** (no failures, no double-counted rows).
+Datalog conformance (a non-continuation guest) is **356/356** under JIT.
+
+Five distinct root causes were found and fixed (not one "miscompile"):
+
+1. **Serving mode never loaded `lib/compiler.sx`.** The JIT then used the
+   native `Sx_compiler.compile` stub, which emits arity-0 bytecode with every
+   parameter compiled as `GLOBAL_GET` → "VM undefined: <param>" on the first
+   call of essentially every function. `http`/`cli`/`site` modes already load
+   `compiler.sx`; the epoch serving branch now does too (before the hook).
+   *Fix: `sx_server.ml` server-mode branch loads `lib/compiler.sx`.*
+
+2. **`compile-cond`/`compile-case-clauses`/`compile-guard-clauses` only treated
+   the keyword `:else` and `true` as the catch-all** — not the bare symbol
+   `else` that the CEK's `is-else-clause?` accepts. They emitted
+   `GLOBAL_GET "else"` → runtime "VM undefined: else".
+   *Fix: `lib/compiler.sx` — add the symbol-`else` case to all three.*
+
+3. **`OP_DIV` produced a float for non-divisible Integer/Integer** (`1/2` → 0.5)
+   instead of the exact `Rational` the `/` primitive returns → diverged from CEK
+   and broke equality vs rational results.
+   *Fix: `sx_vm.ml` — delegate non-divisible int/int to the `/` primitive.*
+
+4. **`OP_EQ` / `_fast_eq` lacked `Rational`/`ListRef` cases** that the real `=`
+   primitive's `safe_eq` has → `(= 1/2 1/2)` was false under JIT.
+   *Fix: `OP_EQ` delegates non-trivial types to the `=` primitive;
+   `_fast_eq` (also used by `prim_call "="`) gained rational + ListRef cases.*
+
+5. **Continuation-based control flow can't run in the stack VM.** Smalltalk's
+   non-local return (`^expr`), block escape, and exception unwinding use
+   `call/cc`; a JIT-compiled frame between a `call/cc` capture and its `(k v)`
+   invocation cannot transfer control and (via the hook's re-run-on-failure)
+   double-executes side effects.
+   *Fix: a general, data-driven exclusion set — `Sx_types.jit_excluded`,
+   populated from SX via the new `jit-exclude!` primitive, consulted in
+   `jit_compile_lambda` so it covers BOTH JIT entry points (CEK hook + in-VM
+   tiered path). `lib/smalltalk/eval.sx` self-declares its continuation-using
+   dispatch core interpret-only; pure helpers (parsing, lookup, formatting,
+   arithmetic) still JIT.* One SUnit suite-runner test helper
+   (`pharo-test-class`) miscompiles under JIT on a specific iteration and is
+   excluded in the test prelude (`tests/tokenize.sx`).
+
+### Known residual / follow-up
+- The hook still **re-runs a failed VM execution via CEK** (always yields the
+  correct result, but can duplicate side effects if a JIT'd function fails
+  mid-run after a side effect). `run_tests`'s hook instead propagates non-IO /
+  non-"VM undefined" exceptions. Adopting that propagate-don't-rerun semantics
+  in the serving hook would remove the double-execution class entirely, but it
+  surfaces genuine mid-run miscompiles as errors — so it must land together
+  with fixing/excluding any function that miscompiles mid-run (e.g.
+  `pharo-test-class`). Deferred to avoid changing shared VM/CEK semantics under
+  this loop.
+- Other continuation-heavy guests (Scheme, Erlang use `call/cc`) will need
+  their own `jit-exclude!` declarations for their dispatch cores; the mechanism
+  is in place. Non-continuation guests (Datalog/Prolog/Haskell/APL) JIT as-is.
+- A debug aid was added to the serving hook: `SX_JIT_DENY=name,...` /
+  `SX_JIT_ONLY=name,...` env vars to bisect which named lambda the VM
+  mishandles (hook-path only).
+
+---
+
+## Guest-loop regression sweep + safe-default gate (2026-06-19, follow-up)
+
+Host-loop verification found that enabling serving-mode JIT **globally**
+regresses continuation-based guest interpreters (the epoch serving mode is the
+shared command channel for every loop's conformance runner). Failure modes:
+- **VmClosure not callable** — a JIT'd higher-order function returns its inner
+  closure as a `VmClosure`; the native `callable?` predicate didn't list
+  `VmClosure`, so `scheme-apply`'s `(callable? proc)` guard rejected it
+  ("scheme-eval: not a procedure: <vm:anon>"). FIXED generally: `callable?`
+  (all 4 bindings) now accepts `VmClosure`.
+- **Continuation escape** — Scheme `call/cc`, Erlang receive, CL conditions,
+  JS exceptions: a JIT'd frame can't transfer control through a CEK
+  continuation.
+- **Non-terminating miscompile (HANG)** — Erlang/Prolog/Haskell recursive
+  evaluators miscompiled into an infinite loop (worse than an error: can't
+  fall back).
+
+### Mechanism
+- `jit-exclude!` now accepts a trailing `*` wildcard → namespace-prefix
+  exclusion (`Sx_types.jit_excluded_prefixes`, checked in
+  `jit_compile_lambda` for both JIT entry points). One declaration per guest,
+  robust vs name-lists (which missed e.g. the erlang `vm/dispatcher`).
+
+### Per-guest exclusions added (in each guest's runtime, loaded with it)
+| Guest | Declaration | Status under opt-in JIT |
+|-------|-------------|--------------------------|
+| smalltalk | name-list (dispatch core) + `pharo-test-class` | 847/847 == CEK |
+| scheme | `(jit-exclude! "scheme-*" "scm-*")` | flow 166/166 == CEK |
+| erlang | `(jit-exclude! "er-*" "erlang-*")` | 530/530 == CEK, no hang |
+| prolog | `(jit-exclude! "pl-*")` | 590/590 == CEK |
+| common-lisp | `(jit-exclude! "cl-*" "clos-*")` | residual: 6 fail (advanced suites) |
+| js | `(jit-exclude! "js-*")` | (verifying) |
+| haskell | `(jit-exclude! "hk-*")` | (verifying) |
+
+Not JIT-related (fail identically on CEK and JIT, pre-existing): lua 0/16,
+tcl 3/4. apl/datalog/forth/ocaml: clean under JIT as-is (no continuations).
+
+### Safe-default gate
+Serving-mode JIT is now **opt-in via `SX_SERVING_JIT=1` (default OFF)** in
+`sx_server.ml`. Default behavior is unchanged (no JIT in epoch serving) ⇒
+**zero regression** for every sibling loop's conformance. The content/Smalltalk
+page server opts in. This bounds risk: guests are validated and excluded
+incrementally; until then the default protects them. Common-Lisp's advanced
+suites still need investigation before CL is opt-in-clean.
+
+---
+
+## guard / handler-bind under JIT — central recursive PUSH_HANDLER scan (2026-06-20)
+
+Combined-binary integration (my JIT + host render-page) surfaced a third
+JIT-unsafe class beyond guest dispatch cores: **`guard`-based error handling**.
+The VM's `OP_PUSH_HANDLER` (compiled `guard`) only intercepts a VM-level
+`RAISE` (opcode 37) — it does NOT catch the OCaml `Eval_error` the `error`
+primitive throws from a CALL/CALL_PRIM in a callee frame. So a JIT-compiled
+`guard` silently fails to catch; the thrown error escapes across the JIT frame.
+
+- SOLID break: `host/wrap-errors -> dream-catch-with` (curried:
+  `(fn (on-error) (fn (next) (fn (req) (guard ...))))`) — middleware suite
+  7/9 under JIT (9/9 CEK), "kaboom" escaped as Unhandled exception, NOT
+  fallback-saved (the guard is in an outer frame, the throw in an inner one).
+- LATENT (turned out harmless): `host/blog--render-node`'s `guard` — it JIT-
+  failed then the hook RE-RAN it on CEK where the guard caught (pure render, no
+  duplicated effects). This is the double-execution residual firing live.
+
+Fix: `code_uses_handler` scans a JIT candidate's bytecode **recursively**
+(including nested closure code in the constant pool) for `OP_PUSH_HANDLER`;
+`jit_compile_lambda` skips JIT for any match. The recursion is essential —
+curried `dream-catch-with` has no PUSH_HANDLER in its own body; the guard is in
+a nested `OP_CLOSURE`. Verified: direct + curried cross-frame guards catch
+under JIT; host "kaboom" escapes 2 -> 0.
+
+### Remaining (documented, gated): the double-execution residual
+The serving hook still re-runs a failed VM execution via CEK (correct result,
+duplicated side effects if the function is impure and fails mid-run). The guard
+fix removes the common trigger (guard functions no longer JIT). The clean
+general fix is propagate-don't-rerun (run_tests' hook semantics) but that
+surfaces genuine mid-run miscompiles as errors and must land with fixing/
+excluding those — deferred (shared CEK/VM change). The default-OFF gate makes
+all of this opt-in, so nothing regresses by default.
+
+---
+
+## common-lisp residual resolved — call/cc-caller exclusion (2026-06-28)
+
+Investigated the 6 CL opt-in-JIT failures. Findings:
+- **geometry / mop-trace (0/0) are NOT JIT regressions** — they error "Undefined
+  symbol: refl-class-chain-depth-with" on BOTH CEK and JIT (the CLOS suites in
+  conformance.sh don't preload lib/guest/reflective/class-chain.sx). Pre-existing
+  harness gap; not counted in the 6.
+- The **6 real failures** (parse-recover 4, interactive-debugger 2) were all
+  condition-system continuation escape. cl-restart-case/cl-handler-case/
+  cl-handler-bind wrap their body in call/cc. When an SX function driving the
+  condition system (parse-numbers, make-policy-debugger) is JIT-compiled, the
+  call/cc form runs in a NESTED cek-run where invoking the captured continuation
+  runs-to-completion-and-returns instead of escaping → restart fails to abort,
+  body falls through. Seen as accumulation ((1 3 0 3) vs (1 3)) and no-abort
+  (999 sentinel). Also produced a +3 double-execution over-count (490 vs 487).
+
+Fix: a third interpret-only signal beyond name/prefix and PUSH_HANDLER —
+`jit-exclude-callers-of!` registers call/cc-establishing/invoking form names;
+`jit_compile_lambda` skips any function whose constant pool (recursively)
+references one (`code_refs_escaping_caller`). Guarded so it's a no-op for guests
+that don't register. CL registers cl-restart-case/cl-handler-case/cl-handler-bind
+(establish) + cl-invoke-restart/cl-invoke-debugger/cl-signal/cl-error-with-debugger
+(invoke). Result: **CL under SX_SERVING_JIT=1 = 487/0, exactly matching CEK.**
+
+The three interpret-only signals now: (1) name / "ns-*" prefix [jit-exclude!],
+(2) PUSH_HANDLER in bytecode [guard users, structural], (3) references a
+registered escaping form [call/cc-establishing callers]. Together they cover the
+continuation-unsafe surface without a deep VM continuation rewrite.

plans/relations-as-posts.md

@@ -0,0 +1,394 @@
+# Relations as posts — declared, inherited, and eventually algebraic
+
+## Principle
+
+Everything is a post in one graph: content-posts, type-posts, **relation-posts**, and
+(later) **constraint-posts**. Nothing about typing is hardcoded — a type-post *declares*
+which relations it anchors, declarations are *inherited* down the type closure, and
+every candidate set / validation is a transitive graph query (`lib/relations`). This
+closes the meta-circular loop the typing plan gestured at: the type system describes
+itself in its own graph.
+
+Supersedes the hardcoded `:candidates "types"/"tags"/"all"` field of `host/blog-rel-kinds`.
+
+## Content-addressability is universal (foundational)
+
+**Every object carries a content-address (CID) — content-posts, type-posts, relation-posts,
+constraint-posts, all of them.** A CID is the hash of the object's *canonical* form: a recursive,
+**key-sorted** serialization (so insertion order, and any process-seed-dependent dict ordering, is
+irrelevant — identical content always yields an identical CID). The runtime has no hash primitive,
+so the canon serializer + a tail-recursive double-hash are built in SX (`host/blog--canon`,
+`host/blog--cid-of`); the slug is excluded from the hash (it's a *name*, not content).
+
+The model is **git-shaped**: the **slug is a mutable name → CID** (a branch pointing at a commit);
+the **CID is the immutable content identity** (the commit). Editing a post mints a new CID; the slug
+follows. Type evolution is the same — a type *version* is content-addressed, instances reference the
+version they were created against. Two objects with identical content *are* the same object (same
+CID) — correct content-addressing semantics.
+
+**Why it's foundational (federation).** A CID is a **global, location-independent identity**, so:
+
+- **Types flow across `fed-sx`.** The same type *definition* on any node has the same CID → a
+  **shared, content-addressed vocabulary**. Federated *instances* reference type CIDs, so a receiving
+  node can *interpret* them. This is linked-data/RDF realised on the post graph, and it generalises
+  ActivityPub itself: AP has a *fixed* type vocabulary (Note/Article/Person, Create/Follow/Like) —
+  the metamodel makes that vocabulary **extensible and user-defined**.
+- **Structure / behaviour trust-split** (the federation boundary): type **structure** (schema,
+  relations, signatures) is declarative and federates *freely* — sharing a definition is sharing a
+  hash. **Behaviour** (Slice 9 lifecycles/effects) does **not** federate naively: you never run a
+  remote node's lifecycle with *your* effect primitives (their "ship" could `charge-card`).
+  Behaviour federates only under high trust, with the effects **re-bound** to local, audited
+  primitives (their orchestration, your effects). `fed-sx` is already trust-gated — that's the lever.
+
+Build order: stamp a stable CID on every object first (additive — slug-addressing stays the working
+key), then a `cid → slug` index, then migrate references / type versioning, then federation.
+
+## North star — the metamodel as a system-construction kit
+
+The destination this is all heading toward: the host stops being "a blog" and becomes a
+**self-describing metamodel**. You *define a domain* — types (with schemas/refinements) and
+relations (with role signatures + algebra) — and a working system falls out. The blog content
+is one seeded configuration; clear it and define different types and you have a different system
+on the same engine. Framework, not application (cf. `[[feedback_runtime_control]]`,
+`[[project_zero_dependencies]]`).
+
+Most of the **instance UI is already generic** — the edit page's relation editors are generated
+by iterating the relations; each picker's candidates come from the relation's `declares`-anchor /
+role type; validation comes from the type's `:schema`. So once Slices 6–7 land, "define the
+types" through a UI is mostly two surfaces, plus a reset:
+
+1. **Metamodel editor** — create a type-post (give it a schema/refinement); create a relation-post
+   (give it a role signature + algebra). The thing that lets you *construct* a system.
+2. **Generic instance form** — create/edit any post of any type, driven entirely by the
+   definitions above (the relation editors + pickers + save-time validation we already have).
+3. **Clear-and-reseed** — wipe instance data, seed only the metamodel roots (`type`, `relation`,
+   the core relations); start from a bare kit and build a domain up from nothing.
+
+Sequence: finish the schema language (Slices 6–7) → the two UI surfaces + reset → clear the demo
+data and define a real domain through the UI. The slices below are the schema language; this is
+what it's *for*.
+
+### Endgame — the whole platform as a typed domain (greenfield, not a strangler)
+
+Not just the blog: the entire rose-ash platform — **store, events, orders, cart, …** — is
+expressible as type + relation definitions in this one metamodel. `Product`, `Event`, `Order`,
+`Ticket` are types; "cart has line-items", "order for an event", "ticket of an event" are
+relations with signatures (cardinality = a cart has many line-items, a ticket belongs to one
+event). This is NOT a strangler off Quart (`[[project_host_on_sx]]`) — it's a **greenfield,
+SX-native system**: define the domain schema as data from first principles, then **port the data
+once at the end** (define-then-port), rather than reimplementing each service's bespoke models
+endpoint-by-endpoint. The strangler's compatibility machinery (JSON mirrors, route/model parity,
+incremental contracts) is dropped — it was tax, not value, for a system that doesn't *correspond*
+to the old one.
+
+### SX all the way out — no JSON on the internal wire
+
+The platform speaks **SX/SXTP end to end**, both directions, browser included — JSON survives only
+at the ActivityPub federation edge (JSON-LD, a published external standard).
+
+| Layer | SX-native form |
+|-------|----------------|
+| Page render | HTML (the document itself) |
+| Data reads | `text/sx` via the `serialize` primitive (`host/ok`/`host/error` → `host/sx-status`) |
+| Write bodies | `text/sx` parsed via `sxtp/parse` (was JSON / form-urlencoded) |
+| Browser → server | the engine posts `text/sx` (boosted forms serialise fields to SX wire); form-urlencoded survives only as the **no-engine / pre-hydration fallback** + the **login bootstrap** handshake |
+| Federation edge | JSON-LD (ActivityPub — the *only* JSON) |
+
+The blog **JSON CRUD `/posts`** (POST/PUT/DELETE) is **deleted**, not converted: it was a pure
+old-contract REST mirror; writes go through the HTML editor forms + SXTP.
+
+Three honest additions store/events surface (the blog didn't need them):
+
+1. **Typed scalar ATTRIBUTES, not just entity relations.** A `Product` needs `price: Money`,
+   `sku: String`, `stock: Int`; these are *values*, not edges to posts. We've built RDF
+   *object properties* (edges to resources); this needs *datatype properties* (literals with
+   value-types + validation). So a type declares **fields** `{field, value-type, card, required,
+   validation}` alongside relations; instances carry typed values; value-types (`Money`, `Int`,
+   `DateTime`) are primitive types. Same shape as a role — a role points at a *type*, a field
+   holds a *value-type*. **This is a real addition to a/b/c+d** and likely Slice 8.
+2. **Behaviour / lifecycle** (order `pending→paid→shipped`) is NOT structure — it's the
+   substrate loops: `[[project_flow_on_sx]]` (durable workflows), `[[project_commerce_on_sx]]`,
+   `[[project_events_on_sx]]`. The metamodel *attaches behaviour to types by composing those*,
+   not reinventing them.
+3. **Integrations** (SumUp payments, ActivityPub federation, artdag media) — types *reference*
+   these services; they don't dissolve into posts.
+
+So the complete picture: the metamodel expresses **structure + validation** of the whole
+platform's domain model uniformly; **behaviour composes from the substrate loops**;
+**integrations stay referenced services**. It's the convergence point of every loop in the repo.
+
+### Types define the UI — the editor maps onto the metamodel
+
+The payoff of typed fields (Slice 8): **a type drives both sides of the UI from one definition.**
+Beyond name + schema, a type carries **fields** `{name, value-type, widget}` and **templates**:
+
+- **Fields drive the edit UI** — the editor renders one input per field, the widget chosen by the
+  field's `value-type` (`Date`→date-picker, `URL`→link input, `String`→text, `Image`→uploader).
+- **Fields drive the render** — the type's **render template** (a parameterised SX template stored
+  on the type-post, instantiated with the instance's field-values) references those fields by name.
+- An **instance** is then just *field-values* on a post. Add a field to the type → it appears in
+  the editor *and* the page, **no code touched**. Same definition, both surfaces.
+
+**"kg-cards become types."** Each Koenig/Ghost card — image, gallery, callout, embed, bookmark,
+heading — becomes a **type-post** with fields + a render template. We've already enumerated that
+whole vocabulary: `[[project_content_on_sx]]` modelled heading/text/code/quote/image/embed/divider/
+list/table/callout/media as block types — **that list is the seed set of card-types.** "The old
+blog posts get typed" = migrate Ghost content into typed blocks, one type-post per block kind.
+
+**"The editor maps onto the types."** The editor stops being hardcoded card handlers and becomes a
+**generic field-editor**: given a type, emit an input per field; on save, store the values; render
+through the type's template. A new card = a new type-post, **zero editor code — the editor is
+defined by the metamodel.** Proof the pattern works: the edit page's relation-editors are already
+*generated* from relation definitions, not hand-coded (one level up from fields).
+
+Honest layer: the **render template is data** (editable, meta-circular); only the irreducible
+**widgets** (the date-picker, the image-uploader) are platform pieces, and `value-type` is what
+*selects* the widget — the same decidable-core / fenced-frontier line as everywhere else.
+
+**The generic form is the default, not the ceiling — types can specify specialised editors.**
+A UI doesn't just *fall out* of the types; it can be **customised**. A type may declare an
+`:editor` slot — a registered, **content-addressed editor *component*** (a WYSIWYG for rich body,
+a map picker for geo, a colour picker) that replaces or augments the input-per-field form, shipped
+to the client by hash like `~relate-picker`. So the editing spectrum per type is: **generic
+field-form** (data, free) → **per-field widget override** (`value-type`/`:widget`) → **whole
+specialised editor component** (the escape hatch, e.g. WYSIWYG). The metamodel picks the level per
+type — `:editor` if set, else the generic form. Same decidable-core / fenced-frontier shape: the
+declarative form covers the 95%, a code component handles the cases that need real interaction.
+
+**Refined build order** (this is what `/meta` is the on-ramp to):
+1. `/meta` overview — **DONE + LIVE** (the *see*; `host/blog-type-defs` + `host/blog-meta-index`).
+2. **Slice 8 — typed fields** `{name, value-type, widget}` — the keystone — **DONE + LIVE**.
+3. **Generic instance form** — input per field ("the editor maps onto types") — **DONE + LIVE**.
+4. **Render template per type** (8c) — data, `(field "name")` placeholders — **DONE + LIVE**.
+5. **Cards-as-types + migrate** — seed the card-type vocabulary from content-on-sx; type the old posts — NEXT.
+Editor surfaces on `/meta`: **create-type** (`POST /meta/new-type`) — **DONE + LIVE**; **create-relation**
+(`POST /meta/new-relation`) — **DONE, but SESSION-SCOPED**: the relation-post + edges persist, the
+rel-kinds registry entry is a runtime concat lost on restart (boot loader can't dynamically enumerate
+under JIT-at-boot — the kernel boot-resolver gap, flagged to sx-vm-extensions). Then **clear-and-reseed**.
+Also open: **specialised editors** (`:editor` slot → content-addressed component, e.g. WYSIWYG).
+
+## Behaviour as data — lifecycles + ECA over an effect vocabulary (DESIGN — Slice 9)
+
+Structure is inert; "place an order / ship goods" is the dynamic part. The principle:
+**behaviour is data-defined orchestration over a small fixed vocabulary of effects.** Only two
+layers stay code — the **effect primitives** (the irreducible ops that touch the world) and the
+**interpreter** that runs the data. Everything between is editable posts. The system defines its
+own behaviour down to the effect boundary (`[[feedback_runtime_control]]`).
+
+**Shape.** A type declares a **lifecycle** (a state machine) as data, plus standalone **ECA
+rules** for reactions that aren't state transitions:
+
+```
+Order: cart --place--> placed [guard: stock-available ∧ total>0] [effects: reserve-stock]
+       placed --pay--> paid   [guard: payment-ok]               [effects: charge-card, confirm-stock]
+       paid --ship--> shipped [guard: address-valid]            [effects: create-shipment, notify]
+ECA:   when stock(product) < threshold  =>  notify(buyer:owner, "restock")
+```
+
+- **States/transitions/rules/effect-invocations are all posts** — meta-circular: `Lifecycle`,
+  `Transition`, `Rule`, `Effect` are themselves types in the metamodel; a behaviour is instances
+  you edit in the same UI as the schema. A transition = `{from, to, on-event, guard, [effects]}`.
+- **Guards are PURE** — predicates over the instance's attributes/relations, i.e. type-system
+  queries (Datalog). No side effects, analysable, you can diagram a lifecycle.
+- **Runs on `[[project_flow_on_sx]]`** because it's durable + long-running: `placed→paid` waits
+  for a SumUp webhook, `paid→shipped` waits days. flow's suspend/resume IS this. Failures →
+  compensation (saga) — `commerce-on-sx` already does "refund as a flow".
+- "Place an order" / "ship" = *attempt transition T*; the button/webhook just fires the event.
+
+### The effect vocabulary (sketch — store + events)
+
+An effect is a named, parameterised op (itself an `Effect` post: name + params + binding).
+Behaviours reference effects by name with args bound to instance/context. Four tiers:
+
+| Tier | Effect | Notes |
+|------|--------|-------|
+| **Pure guard** (read-only, not an effect) | `is-a? / attr-cmp / count / relation-exists?` | type-system queries (Datalog); compose the transition guards |
+| **Data** (internal, transactional on the graph) | `create(type, attrs)`, `set-attr`, `set-state`, `relate / unrelate`, `incr / decr`, `append-ledger(entry)` | the durable post-graph mutations; `decr` stock is atomic-with-check |
+| **Domain** (composed from data, named for atomicity/meaning) | `reserve-stock`, `release-stock`, `confirm-reservation`, `book-seat`, `issue-ticket` | small compositions the vocabulary blesses; `events-on-sx` has the capacity-safe versions |
+| **Integration** (external services — the code edge) | `charge-card`, `refund` (SumUp), `create-shipment` / `track`, `notify(recipient, template, data)`, `federate(activity)` (ActivityPub), `process-media(asset)` (artdag) | the irreducible primitives; keep this list SMALL and composable (artdag's S-expression effects is the model) |
+| **Control** (durable orchestration — flow primitives) | `wait-for(event)`, `wait-until(time) / after(dur)`, `emit(event)`, `transition(instance, state)` | `wait-for` = the SumUp webhook / shipment-delivered; `after` = reservation-expiry / event-reminder; `emit` chains ECA rules |
+
+So `place order` = guard `stock-available ∧ total>0` → effects `reserve-stock`, `set-state placed`,
+`emit order-placed`; the webhook later fires `pay` → `charge-card`, `confirm-reservation`,
+`set-state paid`. Events reuse the same machinery: ticket `reserved →(after 15m, no pay)→ released`,
+event `--remind(after)--> notify` digests. Almost all of it is the same vocabulary.
+
+### The one fork (same shape as the type-system line)
+
+- **Declarative core** — lifecycles + ECA + the effect vocabulary: safe, analysable, diagrammable,
+  editable by non-programmers, verifiable. Covers ~95%.
+- **Guarded code escape-hatch** — a `Scheme`/`Smalltalk` snippet stored on a post and `eval`'d for
+  the rare bespoke guard/effect (`[[project_content_on_sx]]` is Smalltalk message-passing,
+  `[[project_flow_on_sx]]` is guest Scheme — the homoiconic door exists). Turing-complete, unsafe,
+  fenced — exactly the decidable-core / fenced-frontier split we drew for types.
+
+**Where to start:** pin down the effect vocabulary above (the real design artifact), build the
+generic interpreter on flow-on-sx with pure (Datalog) guards, and **lift `commerce-on-sx` /
+`events-on-sx` from guest-code into lifecycle+effect DATA** — they already implement exactly this,
+just not editably.
+
+## Why (the wrinkle that started this)
+
+Candidates for `is-a`/`subtype-of` were `instances-of("type")` — the *instances* that are
+types, but NOT the type-defining posts themselves (`type`, `tag`, `article` are wired with
+`subtype-of`, no `is-a` edge, so they're not instances of type). So the picker offered
+`tutorial` (is-a tag) but never `tag`/`article`/`type` — the things you most want to say a
+post *is-a*. The fix is to ask the right question: a candidate is anything that **inherited
+the relation's object-end declaration from the anchor**, which includes the roots.
+
+## Model
+
+- A **declaration** is an edge `T --declares--> R`: type-post `T` anchors relation `R` at
+  its **object** end ("you may point *at* `T` with `R`"). Seed: `type declares is-a`,
+  `type declares subtype-of`, `tag declares tagged`. `related` has no declaration.
+- **Candidate set** for relating under `R` = the **down-closure** of `R`'s anchors through
+  `inverse(is-a) ∪ inverse(subtype-of)` (a post is a candidate iff it is, transitively, an
+  instance-or-subtype of an anchor — or IS one). No anchors ⇒ every post (`related`).
+  - `is-a`/`subtype-of`: anchors `{type}` ⇒ the whole type closure (roots + subtypes +
+    instances). **Wrinkle fixed.**
+  - `tagged`: anchors `{tag}` ⇒ the tags.
+  - `related`: no anchor ⇒ all posts.
+
+## Roadmap
+
+### Slice 1 — declarations + candidate-by-inheritance — DONE
+- Seed `declares` edges; add `host/blog--reach-down` (down-closure) and rewire
+  `host/blog--candidate-pool` to be declaration-driven. `:candidates` becomes vestigial.
+- Wrinkle fixed: the type roots now appear as `is-a` candidates.
+
+### Slice 2 — relations as first-class posts — DONE
+- `relation` root + `is-a`/`subtype-of`/`tagged`/`related` seeded as posts (each is-a
+  relation) owning their metadata in a `:rel` slot (`:symmetric :label :inverse-label`).
+  `host/blog-rel-kinds` / `kind-spec` / `kind-symmetric?` now read it; the static registry
+  is gone. `host/blog--rel-slugs` = `host/blog-in "relation" "is-a"` (cheap, flat).
+- **Perform budget under http-listen (the hard lesson):** a durable read inside the
+  render VM raises `VmSuspended`, and too many per request 500s the page. Two fixes:
+  (1) relation metadata is loaded into an in-memory cache at boot (`host/blog-load-rel-kinds!`,
+  like `load-edges!`) so `kind-spec` is pure; (2) the initial edit page renders its pickers
+  EMPTY (the load trigger fills each) — only the relate/unrelate FRAGMENT server-renders
+  candidates (`with-cands` flag), so one page render doesn't do `candidate-get × every
+  picker`. Benign single-perform suspend/resume still logs `VmSuspended` but returns 200.
+- **Live JIT gotcha (cost real time):** the serving-mode JIT drops all-but-first when
+  `map`/`for-each`-ing a *function-produced* list — building `rel-kinds` that way rendered
+  only 1 of 4 editors live, while conformance + the ephemeral server passed. So
+  `host/blog-rel-kinds` is a VALUE the boot populates and the cache loads are UNROLLED.
+  **Conformance green ≠ correct live — verify the rendered edit page.** (Re-fold the
+  enumeration once plans/jit-bytecode-correctness.md lands.)
+### Slice 2.5 — picker title reads are O(page), not O(pool) — DONE
+- `relate-candidates` computes the available candidate SLUGS (slug-sorted, no per-candidate
+  read), then reads titles ONLY for the page it returns. On the unfiltered path (q="" — the
+  initial picker load AND every editor server-fill, the common case) that's ~`limit` reads
+  instead of one-per-post — killing the durable-read churn under http-listen. A filter
+  (q≠"") still resolves titles across the pool (it matches on the title), but that's the
+  interactive path.
+- A boot-time slug→title **cache** would make even the filter O(1)-perform, BUT it's blocked
+  for now: there's no bulk KV read, and a per-post `host/blog-get` loop **at boot** hits the
+  JIT bug (a durable read inside a boot loop drops all-but-first — `load-edges!` only works
+  because its loop body is perform-free). Revisit with a bulk read or once the JIT lands.
+
+**Remaining follow-ups:** subject-end declarations (who may be the *source*); a proper
+relation-subtype closure when relations get subtyped; the boot title cache above.
+
+### Slice 3 — typed relations (target-type constraints) — DONE
+- The declaration's `declares`-anchor IS the target-type constraint: `is-a`/`subtype-of`
+  (anchored by `type`) require a type object; `tagged` (anchored by `tag`) a tag. A new
+  `wrote` relation needs only a `Work declares wrote` edge — fully data-driven.
+- `host/blog--valid-object?(kind, other)` = `other ∈ candidate-pool(kind)` — the SAME set
+  the picker offers, so picker and validation agree by construction. `relate-submit` now
+  enforces it (an invalid target is a silent no-op, like the other guards); `related`
+  (no anchor) accepts any post. The picker never offers an invalid target, so this guards
+  crafted/API requests — the jump from "candidate set" to an enforced relation schema.
+- NOTE: `host/blog-relate!` (direct/seed) stays UNVALIDATED — the seed needs to write
+  `X is-a relation` where `relation` isn't under `type`. Validation is a *handler* boundary.
+
+### Slice 4 — type algebra — DONE (intersection ∧ union)
+- An algebraic type is a post with operand edges: `conj` edges (intersection members),
+  `disj` edges (union members). `host/blog-instances-of-expr` computes its EXTENT from the
+  operands' extents by set intersection / union, RECURSIVELY — so operands can themselves be
+  algebraic (meta-circular; tested with `(tag ∧ article) ∧ tag`). `host/blog-is-a-expr?`
+  generalises `is-a?` to type expressions. `host/blog-make-and!` / `make-or!` build them.
+- Binary today (`nth 0/1`, no fold over operands — robust on the serving JIT); n-ary fold is
+  a follow-up once iteration-with-perform is JIT-reliable.
+- **Operand edges are KV-only** (`host/blog--add-edge-kv!`, read via `host/blog-out`), NOT in
+  lib/relations — feeding extra kinds into the Datalog graph blows up its per-query
+  re-saturation; `load-edges!` skips `conj`/`disj` on replay for the same reason.
+- **Refinement** `{x : T | φ(x)}` (a type-post with a `:constraint` predicate) → Slice 5,
+  with constraints-as-posts. (Process note: a sibling loop running heavy conformance saturates
+  the box; host conformance can EXIT 124 purely from CPU contention — use `timeout 1200`.)
+
+### Slice 5 — refinement types (schemas ON the type-post) — DONE
+- A type-post carries its schema in a `:schema` slot (a list of `{:block :msg}` rules —
+  a refinement `{x : T | x has these blocks}`). `host/blog-schema-of` reads it off the
+  post; the hardcoded `host/blog-type-schemas` table is gone. A NEW refinement type is pure
+  data: give a type-post a `:schema` (`host/blog--set-schema!`) and its instances are
+  validated on save against it — no code. Tested with a `guide` type requiring a `pre` block.
+- Save-time validation (`type-issues`/`type-valid?`, the only callers, in the SAVE request)
+  unions the schemas of a post's full transitive type set — unchanged, just sourced from the
+  posts. `schema-of` reads the post (a durable read) — fine in the save request, never render.
+- `host/blog-put!` now MERGES over the previous record, so editing a post's title/content
+  doesn't nuke its `:schema` / `:rel` metadata (also closes the Slice 2 "edit drops :rel" gap).
+- `article`'s schema migrated onto the article post (`set-schema!` at boot — a single
+  read+write, not a loop, so boot-JIT-safe; idempotent, handles the already-seeded article).
+- FUTURE: arbitrary predicate constraints (not just required blocks); constraints as their
+  own posts; relation cardinality (`is-a` single-valued?) as a declared constraint.
+
+## Parameterised relations (DESIGN — Slices 6 & 7)
+
+The next axis: `Relation<…>`. The key reframe is that the obvious parameters aren't separate
+`<N>`s — they split into **two halves**, and they compose into one coherent thing:
+
+1. **The role SIGNATURE** (the *shape* of a tuple) — Slice 6 (a + b + c).
+2. **The relation's ALGEBRA** (how it *behaves*) — Slice 7 (d).
+
+A relation is `Relation<signature>`, where a signature is an ordered list of **roles**, each
+role carrying a **type** and a **cardinality**; the signature's length is the **arity**.
+Today's binary typed relations are the degenerate 2-role case — backward-compatible, nothing
+gets thrown away. Prior art to borrow (and stay decidable within): Codd / ER reified
+relationships (signature), OWL property characteristics (algebra), Datalog / relation algebra
+(derived relations — the undecidable frontier; fence it). Decidability rule of thumb: concrete
++ algebraic role-types and counts stay decidable; arbitrary predicates / recursive rules don't.
+
+### Slice 6 — the role signature (a + b + c)
+Generalise the relation-post's `:rel` slot from `{:symmetric :label}` to a `:roles` list —
+`{:roles [{:name :type :card} …]}` — driving picker candidates, validation, and arity per-role:
+- **(a) per-role type** — each role's `:type` is a type-expr (so it can be algebraic:
+  `Relation<Work ∧ Published>`). The object-role's type IS today's `declares`-anchor — make it
+  explicit. `valid-object?` becomes per-role `is-a-expr?` against `:type`.
+- **(b) arity** = `(len roles)`. Binary stays the fast `src|kind|dst` edge path; **n-ary needs
+  reification**: a relation *instance* becomes its own post with role edges (`subject→X`,
+  `object→Y`, `recipient→Z`) — on-brand (we made relation *kinds* posts; now *instances* too),
+  but a SECOND representation alongside the binary edges, not a tweak. Qualifiers (Wikidata-
+  style) then come free as extra roles.
+- **(c) cardinality** — `:card` per role (min/max; functional = max 1, required = min 1),
+  enforced on relate by counting. Composes with Slice 5 validation. No model change for binary.
+- Siblings: ordered roles (set vs list), keys/identity (which roles identify a tuple).
+- **Layering (cheapest → deepest):** (c) cardinality on the binary object-role → (a) explicit
+  role-type + the 2-role signature abstraction → (b) reified n-ary (the real lift).
+- **Variance: nominal, none initially** — no structural subtyping of `Relation<…>` (covariance
+  of parameterised types is a research project). JIT caveat: 2-role signatures are unrollable;
+  n-ary role-iteration with per-role reads needs the cache/unroll treatment (Slice 2/5 lesson).
+
+### Slice 7 — relation algebra / characteristics (d)
+The behaviour half — and (d) **transitivity** is special because we ALREADY hardcode it
+(`is-a`/`subtype-of` closure via lib/relations); declaring it generically *removes* code.
+- **Algebraic properties** declared on the relation-post (`:transitive :symmetric :reflexive
+  :antisymmetric :irreflexive`), with the closure **derived generically** from them — OWL's
+  property characteristics. `subtype-of` becomes "a declared transitive + antisymmetric
+  relation" (a partial order), not a special case. `:symmetric` (already stored) folds in here.
+- **Inverse relations** — a real `:inverse` (not just the `:inverse-label` display hint):
+  relating one auto-derives the converse, the way `:symmetric` writes both directions.
+- **Sub-relations** — relations subtyping relations (`wrote subPropertyOf created`): X wrote Y
+  ⟹ X created Y. Same `subtype-of` machinery, over the `relation` root — meta-circular.
+- **Decidable core stops here.** Beyond-d, FENCED: defined-by-rule relations (composition,
+  `grandparent = parent ∘ parent` — straight onto the Datalog substrate, but gate to
+  stratified/bounded rules) and cross-role refinement predicates (`start < end`) — both need
+  the predicate-language-vs-embedded-code decision first.
+
+## Open design questions (track as we go)
+1. **Subject-end declarations** — who may be the *source* of a relation (a root `Thing`?).
+2. **Inheritance path** — through `is-a` AND `subtype-of` downward (current choice); revisit
+   if instances-of-instances as candidates surprises.
+3. **Bootstrap / meta-circularity** — `is-a` needs `is-a`; seed relation-posts + `Type is-a
+   Type`(?) idempotently, as the type seed already is.
+4. **Cost** — `reach-down` is a BFS of direct-edge scans; fine for a small blog, revisit with
+   a `lib/relations` transitive query if the graph grows.

plans/rose-ash-on-sx-migration.md

@@ -0,0 +1,170 @@
+# Re-implementing rose-ash on SX — migration strategy
+
+Status: **strategy proposal** (drafted by the `radar` loop, 2026-06-07). Not a
+unilateral architecture decision — a starting point for the fleet to refine. Radar's
+role here is detection: the `*-on-sx` subsystems have converged into a host-agnostic
+re-implementation of rose-ash's domain logic, so this doc proposes *when* and *how* to
+wire them to production.
+
+---
+
+## 1. Premise: we are ~70% into a re-implementation already
+
+The fleet of `lib/<x>` SX subsystems is not a set of experiments — it is rose-ash's
+domain logic, re-expressed substrate-by-substrate, deliberately **host-agnostic**:
+
+| SX subsystem (`lib/`) | rose-ash production domain |
+|---|---|
+| content-on-sx (CRDT docs, versioning, `page.sx` HTML render) | **blog** |
+| commerce-on-sx (catalog, pricing, cart, order + refund sagas) | **market + cart + orders** |
+| events-on-sx (calendar, ticketing, booking) | **events** |
+| feed-on-sx (activity streams, AP-shaped, threading) | **federation** |
+| identity-on-sx (OAuth2, sessions, grants, membership) | **account** |
+| acl-on-sx (permissions) | cross-cutting authZ |
+| relations / likes | **relations / likes** (internal) |
+| persist-on-sx (log / kv / snapshot facets) | per-service Postgres layer |
+| flow-on-sx (durable sagas) | order/refund/delivery workflows |
+| mod-on-sx, search-on-sx | new capabilities |
+
+**The architectural enabler:** every core was built with *injected seams* — `permit?`,
+`send-fn`/`fetch-fn`, `transport`, `dispatch`, `backend`. That is ports-and-adapters
+(hexagonal) on purpose. Evidence from the radar backlog (`plans/abstractions.md`):
+W1 (7/7 federation modules inject the fed-sx transport), W4 (content/commerce/events run
+live on `persist/log`), W8 (events+commerce run sagas on `lib/flow`). **The cores do not
+depend on how they're hosted, persisted, or federated.**
+
+**Corollary that makes the whole migration tractable:** because logic is separated from
+rendering and storage, we can hold the **domain logic to parity** while **freely
+redesigning the presentation** — the two are different layers with different rules.
+
+---
+
+## 2. The gating insight: the cores are *ahead of the host*
+
+The domain logic is mature. What is *not* yet production-grade is the **host trio** — and
+that is the real critical path:
+
+- **host-on-sx** — HTTP / request-response / session host (briefing exists; the OCaml SX
+  HTTP server already serves `sx.rose-ash.com`).
+- **host-persist** — durable storage adapter (real disk/pg/ipfs) under `persist`'s
+  facets (content-addressed blob blocker recently closed).
+- **fed-sx** — the real ActivityPub transport every core injects (well into m2).
+
+> **So "when do we start?" answers itself: start when the host trio is production-grade,
+> not when the cores are done — they mostly already are.** Prioritise the host loops over
+> further domain features.
+
+---
+
+## 3. The model: duplicate → cut over → diverge (per slice)
+
+This is the "duplicate first, then change" approach, made precise. Each domain slice goes
+through three phases independently:
+
+**Phase A — Duplicate (hold logic to parity).** Stand the SX implementation of the slice
+up *in parallel*, behind the existing edge, serving no users yet. Get its **domain/data
+behaviour** to match Python (see §4 on how). Presentation can start as a rough port or an
+early new design — it doesn't have to match.
+
+**Phase B — Cut over (strangler flip).** Point the edge route for that slice at the SX
+host. Python stays as instant rollback. The slice is now live on SX.
+
+**Phase C — Diverge (change freely).** With the slice live and validated, evolve the
+look/feel and functionality on the SX side. The validated domain logic underneath is
+untouched, so UX/feature changes can't silently corrupt data.
+
+You never rewrite the whole platform at once; you walk slices through A→B→C, oldest tree
+strangled last.
+
+---
+
+## 4. The two techniques, and how "we'll change things" reshapes them
+
+### Strangler edge
+The edge (Caddy) is the front door every request hits. Add routing rules so **one route
+at a time** goes to the SX host while everything else still goes to Python. Properties:
+the site is never half-broken; any single route flips back to Python instantly; the old
+app is strangled route-by-route. (Opposite of big-bang swap, which is how these die.)
+
+### Shadow diff — split by layer
+Run the new version on real traffic in the background, discard its output, and **log how
+it differs** from Python. Flip the edge only when diffs are zero/intended.
+
+But because we *intend* to change look/feel + functionality, parity is a tool we apply
+**only where we want sameness**, not a straitjacket:
+
+| Layer | Want parity? | Oracle |
+|---|---|---|
+| **Domain/data** (totals, tax, permissions, what's stored, who-sees-what) | **YES — silent difference = data corruption** | shadow-diff at the *core* boundary; deterministic cores → replay real request logs through the harness and diff |
+| **Presentation/UX** (HTML, layout, look, feel, flows) | **NO — this is what we're changing** | manual QA + design review; this is the Phase-C divergence |
+
+Practical shape: shadow-diff hits the **domain core's output** (the computed order, the
+visible-activity set, the permission decision) — not the rendered HTML. The deterministic,
+harness-replayable cores are the single biggest advantage we have here; it's the same
+parity discipline that made the A1 conformance migration safe (one reference slice, hard
+parity gate, revert on mismatch).
+
+---
+
+## 5. Readiness gates (start the production migration when ALL hold)
+
+1. **Host trio production-grade** — host-on-sx (HTTP/session), host-persist (durable
+   adapter), fed-sx (AP transport) — each conformance-green.
+2. **Data-migration story exists** — a way to get existing production Postgres state into
+   `persist` event streams (event-source the current state, or dual-write during overlap).
+   This is the honest long-pole; it is *not* domain logic and nobody has built it yet.
+3. **One vertical slice proven end-to-end** at data-parity in production — the reference
+   migration, the way the conformance loop migrated one subsystem before the rest.
+
+---
+
+## 6. Sequencing
+
+1. **Host trio first** (critical path — it's behind the cores).
+2. **Build the strangler edge + shadow-diff harness** as first-class tooling: edge routing
+   rules + a dual-run logger that diffs *core outputs* (not HTML) and stores discrepancies.
+3. **First slice = lowest risk × highest readiness × cleanest data oracle.**
+   Recommended: **the blog read path (content-on-sx)** or **the feed read path**
+   — read-heavy, no money, CRDT/versioning + `page.sx` HTML already exist, and the data
+   oracle is clean. *Avoid cart/orders/payments first* (transactional + SumUp webhooks =
+   highest blast radius).
+4. **Persistence-first, federation-last.** Land host-persist + migrate per-domain event
+   stores before any cutover. Do fed-sx federation as a *coordinated* cut near the end —
+   W1 shows all 7 cores light up federation together once the shared transport ships.
+5. **Walk the remaining slices A→B→C**, retiring Python routes as each cuts over.
+
+---
+
+## 7. The honest long tail (mostly host + adapters, not cores)
+
+The cores are pure domain logic; the production *tail* is not in them yet and is most of
+the remaining real effort:
+
+- Auth: first-party cookies / Safari-ITP, CSRF, silent SSO, grant caching.
+- Cross-cutting: rate limiting, observability/metrics, error pages, caching.
+- Integrations: SumUp payment + webhooks, Ghost CMS sync.
+- Presentation: the actual HTMX templates + CSS (this is also where the redesign happens).
+- **Live data migration** — the single biggest non-core workstream.
+
+---
+
+## 8. Concrete next steps
+
+1. Treat the **host trio** as the fleet's critical path; prioritise over more domain features.
+2. Stand up the **strangler edge + core-level shadow-diff harness** as a tool.
+3. Prove **one slice** (blog/content read path) end-to-end in production as the reference.
+4. **Spec the Postgres → persist data migration** (the long-pole nobody has started).
+5. Then walk slices through duplicate → cut over → diverge, redesigning UX in Phase C.
+
+---
+
+## 9. Why this is low-risk despite being a platform rewrite
+
+- It's **wiring host-agnostic cores to a host**, not rewriting domain logic from scratch.
+- The **strangler edge** means the site always works and any route reverts in seconds.
+- **Deterministic cores** make data-parity *mechanically checkable* (replay + diff), so
+  correctness isn't a matter of faith.
+- **Logic/presentation separation** lets us change look/feel + functionality (Phase C)
+  *without* re-risking the validated domain logic.
+- It's the **same discipline that just shipped A1**: one reference migration, a hard
+  parity gate, honest exclusions, verify-before-merge.

plans/sx-native-engine-tests.md

@@ -0,0 +1,185 @@
+# Plan: SX-native engine tests (browser-independent)
+
+## Goal
+
+Move the host's *interactive* test coverage from Playwright (`.spec.js`, drives a real
+Chromium) into **SX harness tests** that drive the hypermedia engine against a **mock
+platform** — no browser. Reserve Playwright for the one irreducible real-browser fact:
+"the WASM kernel actually compiles, boots, and loads modules content-addressed."
+
+**Why (the principle):** the SX engine (`web/engine.sx` + `web/orchestration.sx`) has no
+hard browser dependency — it talks to a *platform* (fetch, DOM ops, timers) that is
+injected. The harness supplies a mock platform, so engine behaviour (fetch → swap →
+DOM mutation) is asserted with zero browser. The same engine could therefore drive
+*something else* (a server-side DOM, a native UI) — the SX tests prove that
+independence by running without one. This is consistent with
+`[[project_zero_dependencies]]` and `[[feedback_runtime_control]]` (build IN the runtime).
+
+## Current state (2026-06-29)
+
+- **Already SX:** the 272 host conformance tests (`lib/host/tests/*.sx`, `spec/harness.sx`
+  mock-IO). The picker's *server contract* is SX too (`lib/host/tests/blog.sx`:
+  `picker form declaratively wired`, `load-more sentinel`, `no-sentinel-on-short-page`).
+- **Still Playwright (`.spec.js`):** `lib/host/playwright/relate-picker.spec.js` (7 tests)
+  and `spa-check.spec.js` (4) — real-browser checks of populate / filter / paging /
+  relate-delete / remove-button / boosted-nav / error-retry / WASM boot.
+
+## Infrastructure that already exists (the enabler — verified)
+
+- `spec/harness.sx` — `make-harness`, `default-platform` with **`:fetch` overridable**
+  (`(fn (url &rest opts) {:status 200 :body "" :ok true})`), plus DOM ops, `:now`, etc.
+- `web/harness-web.sx` — `(define-library (sx harness-web))` exports: `mock-element`,
+  `mock-set-attr!`, `mock-append-child!`, `mock-get-attr`, `mock-add-listener!`,
+  **`simulate-click` / `simulate-input` / `simulate-event`**, `assert-text`, `assert-attr`,
+  `assert-class`, `assert-no-class`, `assert-child-count`, `assert-event-fired`,
+  `make-web-harness`, render-audit helpers.
+- `web/tests/` — existing SX engine tests: `test-orchestration.sx` (17 deftests),
+  `test-forms.sx` (25), `test-swap-integration.sx` (43, mock-response → swap → assert),
+  `test-engine.sx`, `test-handlers.sx`. **`test-swap-integration.sx` is the reference
+  pattern** (it sets `_mock-body`/`_mock-headers`/`_mock-content-type`, drives a swap,
+  asserts the result).
+- Runner: `hosts/ocaml/bin/run_tests.ml` scans `spec/tests/`, `lib/tests/`, `web/tests/`
+  and loads `harness-web.sx` + `harness-reactive.sx`. Run via the `sx_test host="ocaml"`
+  MCP tool (or `./scripts/sx-build-all.sh`). JS runner: `hosts/javascript/run_tests.js`
+  also loads the web harnesses.
+
+## Phases
+
+### Phase 0 — Proof of concept (small): one behavior, SX
+Port **relate → delete row** to an SX harness test (new `web/tests/test-relate-picker.sx`):
+1. Build a mock DOM: a `.rp-results` `<ul>` containing one candidate `<li id="cand-related-x">`
+   with the relate `<form sx-post=/x/relate sx-target=#cand-related-x sx-swap=delete>`.
+2. `process-elements` (or `bind-triggers`) the tree so the form's submit is bound.
+3. Mock `:fetch` to return `{:status 200 :ok true :body ""}`.
+4. `simulate-click` the button (or `simulate-event` "submit" on the form).
+5. Assert the `<li>` is gone (`assert-child-count` results = 0).
+This validates the **mock-DOM → execute-request → swap-dom-nodes** loop in SX end to end.
+**If it reads cleanly, the rest is mechanical.**
+
+### Phase 1 — Port the picker's interactive behaviors (medium)
+Same file, more deftests, each = mock fetch + simulate + assert:
+- **filter narrows**: `:fetch` returns N candidate rows for `q=...`; `simulate-input` the
+  filter; assert child-count == N.
+- **sentinel paging**: `:fetch` returns rows + a `<li class=rp-more sx-trigger=revealed>`;
+  fire the revealed/intersect path; assert more rows appended, sentinel replaced.
+- **load populate**: `load` trigger → fetch → assert results filled.
+- **error/retry visible state**: `:fetch` rejects → assert `.sx-error` class added
+  (`assert-class`), then succeeds → assert cleared.
+
+### Phase 2 — Trim Playwright to a boot smoke (small)
+Keep ONLY what needs a real browser in `relate-picker.spec.js` / `spa-check.spec.js`:
+- WASM kernel compiles + boots (`data-sx-ready`).
+- modules load **content-addressed** (`/sx/h/` fetches, 0 path `.sxbc`).
+- one boosted nav swaps `#content`.
+Delete the per-behavior browser tests now covered by SX. Net: ~2 browser tests + an
+SX suite.
+
+### Phase 3 — The engine drives the CONSOLE (the non-browser target)
+The concrete "something else" is a **terminal / console platform**. This is the natural
+sibling of the test harness: a harness test *asserts* the engine's output tree; the
+console platform *renders* that same tree to text. Same platform abstraction — one
+observes it, one draws it.
+
+What it means concretely:
+- **Platform ops → a console-backed element tree.** The engine only ever calls platform
+  primitives: `dom-create-element`, `dom-append`, `dom-set-attr`, `dom-query` (by id, for
+  `sx-target`), `dom-remove-child`, `dom-parent`, `morph-children`, `dom-listen`, `fetch`,
+  `set-timeout`. Implement these against an in-memory tree of text nodes instead of the
+  browser DOM. The mock DOM in `web/harness-web.sx` is ~90% of this already.
+- **Render = print the tree as text** (ANSI/box-drawing) — a `render-to-console` mode
+  alongside `render-to-html` / `render-to-dom` (see `spec/render.sx`'s mode table). The
+  results `<ul>` becomes a list; `.sx-error` becomes a red line; the filter input is a
+  text field.
+- **Events = a TUI input loop.** Keypresses / selection map to `simulate-input` /
+  `simulate-click` on the focused node — exactly the harness's `simulate-*`, but driven by
+  a real keyboard instead of a test.
+- **`fetch` stays HTTP** (the host already serves `text/sx` fragments + `relate-options`),
+  or talks to a local store.
+
+Payoff: the **same** `~relate-picker` — `sx-get`, debounced filter, `revealed` paging,
+`sx-swap=delete`, `sx-error` retry — runs unchanged in a terminal. That is the proof that
+the SX hypermedia engine is a *general* runtime, not a browser library: the browser is
+just one platform binding, the console is another, the test harness is a third. Ambitious,
+buildable, and the most convincing demonstration of the whole architecture
+(`[[feedback_runtime_control]]`, `[[project_zero_dependencies]]`).
+
+Sketch of work: (1) a `console-platform.sx` implementing the platform ops over a text
+tree (fork `harness-web.sx`'s mock element), (2) a `render-to-console` mode in render.sx,
+(3) a tiny input loop (raw-mode stdin → focus model → `simulate-*`), (4) run the host's
+picker against it. Phase 1's SX tests become the regression suite for the console renderer
+for free (they already drive the tree, just don't print it).
+
+## Gaps & risks to resolve during Phase 0
+
+- **Mock-DOM completeness:** `swap-dom-nodes` uses `morph-children`, `dom-replace-child`,
+  `dom-insert-after/before/prepend/append`, `dom-remove-child`, `dom-parent`,
+  `dom-first-child`, `dom-clone`, `dom-is-fragment?`. Confirm `harness-web`'s mock DOM
+  implements (or can be extended for) these. `test-swap-integration.sx` already swaps, so
+  most exist; check `delete`/`outerHTML`/fragment paths specifically.
+- **fetch callback shape:** the engine's `fetch-request` calls back
+  `(resp-ok status get-header text)`; the platform `:fetch` returns `{:status :body :ok}`.
+  Confirm/adapt the bridge (see how `test-swap-integration.sx` feeds `_mock-body` etc.).
+- **trigger binding without a browser:** `simulate-click` fires bound listeners — the form
+  must be processed first (`process-elements` on the mock root, or bind directly).
+- **component expansion:** `~relate-picker` need not be expanded for these tests — assert
+  on the *rendered* candidate rows / form markup directly (build the mock DOM from the
+  expanded HTML the server produces, which is already SX-testable server-side).
+
+## Tracked loose ends (separate from this plan)
+- **unrelate "clever" in-place delete** (just-the-row, no `#content` re-render): now that
+  `bind-boost-form` is fixed the remove button works via a boosted POST→swap; the
+  minimal-mutation version (sx-post + `sx-swap=delete` on the current-row) is a further
+  refinement — earlier attempt didn't fire, revisit with the binding now understood.
+- **`hs-repeat-times`** bytecode test (architecture worktree): harness `host-new` stub bug
+  masks a pre-existing `beingTold` resume-env bug. See the diagnosis in this session.
+
+## Progress (2026-06-29)
+
+- **Phase 0 DONE** (commit 297bdc60) — `web/tests/test-relate-picker.sx`: relate→delete
+  row drives the real engine (process-elements → submit → mock fetch → delete swap)
+  against the OCaml runner's mock DOM, green. Mock-DOM completeness added to
+  `run_tests.ml`: `NodeList.item(i)` (so `dom-query-all` iterates) + a `DOMParser`
+  mock (so the empty-body `sx-swap=delete` HTML-response path works as in a browser).
+- **Phase 1 DONE** (commit fe2da2d3) — same file, load / filter / paging / error-retry,
+  5/5 green, zero harness noise. Modelled two browser natives the OCaml runner lacks:
+  `observe-intersection` (a recording stub the test fires to simulate the sentinel
+  scrolling into view) and synchronous-timer retry (stripped in the error test —
+  backoff math is a `test-engine.sx` concern). Mock-DOM: `firstChild`/`lastChild`
+  (so `children-to-fragment` drains a parsed fragment into innerHTML/outerHTML swaps;
+  also repaired one pre-existing web test). No web-suite regressions.
+  - **Key seam discovered:** a top-level `(define …)` override is seen by engine
+    library functions ONLY when the symbol lives in a *different* library than the
+    caller (cross-library late-binds through global; same-library resolves locally).
+    `fetch-request` (boot-helpers) overrides fine from a test; `handle-retry`
+    (orchestration, same lib as `do-fetch`) does NOT — hence the strip-attr approach.
+  - **harness-web.sx is NOT loaded** by the OCaml runner (only the JS runner), and its
+    assertions assume a different mock-element shape (`attrs`/`text`) than the OCaml
+    mock DOM (`attributes`/`textContent`). Assert through the engine's own `dom-*`
+    accessors instead.
+- **Phase 2 DONE** (commit 98ff7a35) — Playwright trimmed 11 → 5 tests, both ephemeral
+  suites green (run-spa-check 3/3, run-picker-check 2/2). Kept: WASM boot +
+  content-addressed module loading (new `/sx/h/` assertion) + boosted nav swap +
+  back/re-boost (spa-check); bind-boost-form remove button + picker re-bind after a
+  boosted SPA nav (relate-picker). Deleted the populate/filter/paging/relate-delete/
+  error-retry browser tests (now SX).
+- **Phase 3 (stretch) — render slice DONE** (commit 16f90ffd) — `web/console-render.sx`:
+  `render-to-console` walks a live DOM element tree through the engine's own `dom-*`
+  accessors and prints it as terminal text (results `<ul>` → bulleted list, filter
+  `<input>` → text field, `.rp-more` sentinel → `…` line, `.sx-error` → flagged line).
+  Wired into the picker's engine tests so the SAME tree drives both the DOM assertion
+  and the terminal output — Phase 1's suite is the console renderer's regression suite
+  for free. Plus a `relate-picker:console` suite. 7/7 green.
+  - **Remaining Phase 3 (future):** the live input loop — raw-mode stdin → focus model
+    → `simulate-input`/`simulate-click` on the focused node — and full ANSI/box-drawing
+    output. Not harness-testable (needs a real TTY), so it's a runtime/demo feature, not
+    a test. The render step (the convincing half — "render = print the tree") is done;
+    the engine→console *event* path reuses the same `simulate-*` the harness already
+    drives. Class membership must read the live `classList` (`dom-has-class?`), not the
+    static `class` attribute (the engine mutates classes through classList).
+
+## Done-when
+- [x] `web/tests/test-relate-picker.sx` covers populate / filter / paging / relate-delete /
+  error-retry in SX, green under `sx_test host="ocaml"`.
+- [x] Playwright trimmed to the boot smoke; suite still green.
+- [~] (Stretch) the picker runs through a non-browser platform — render-to-console done
+  (the engine's tree prints to a terminal); live TTY input loop is future work.

plans/typed-posts-and-relations.md

@@ -0,0 +1,96 @@
+# Typed posts & relations — typing is just relating to a type
+
+> host-on-sx. Driving idea: **classification is a relation to a type node, and
+> types are posts.** Everything (related, tag, category, series, type) becomes a
+> typed edge in `lib/relations` over `blog:<slug>` nodes. One primitive.
+
+## Decisions
+
+- **Types are posts.** No new node namespace — content-posts and type/tag posts
+  are all `blog:<slug>`. A "tag" is a post; tagging documents itself.
+- **`is-a` is the typing edge; `tagged` is membership.** Kept distinct so a tag
+  page can list members without conflating "ocaml is a tag" with "hello is
+  tagged ocaml".
+- **Hierarchy is core, not deferred.** `is-a`/`subtype-of` transitive closure via
+  `lib/relations` reachability is what makes typing-as-relation more than flat
+  labels. All typing helpers are transitive from the first line, or subtypes
+  silently break candidate/`is-a?` checks later.
+- **Validation is gradual, not deferred.** A type-post *optionally* carries a
+  schema slot; validation runs only where one exists. Tags declare none (stay
+  folksonomy-free); `article` can declare "needs a heading". The hook lands with
+  the type phase (reusing `host/blog-content-ok?`); only schema *expressiveness*
+  grows over time. This closes the nominal/structural loop: the declared `is-a`
+  edge is a claim, the validator checks the content honors it.
+- **Scalars stay fields.** `status`/`title`/`sx_content` remain fields, not edges
+  — listings filter on them constantly and `lib/relations` re-saturates Datalog
+  per query. Links-to-shared-nodes → edges; per-post hot scalars → fields.
+
+## The linchpin: a relation-kind registry
+
+One data structure drives validation, the picker candidate sets, and rendering:
+
+```
+host/blog-rel-kinds =
+  ({:kind "related" :label "Related posts" :symmetric true  :candidates "all"}
+   {:kind "is-a"    :label "Types"         :symmetric false :candidates "types"
+                    :inverse-label "Instances"}
+   {:kind "tagged"  :label "Tags"          :symmetric false :candidates "tags"
+                    :inverse-label "Tagged with this"})
+```
+
+`:symmetric` → write both directions on relate. `:candidates` → what the picker
+offers (`all` = every post; `tags` = `is-a? blog:tag` transitively; `types` =
+`is-a? blog:type`). `:label`/`:inverse-label` → headings.
+
+## Phases
+
+### Phase 1 — Kind generalization + registry  ← START HERE
+Pure refactor; zero user-visible change (related keeps working).
+- `host/blog-rel-kinds` registry + `host/blog--kind-spec`/`--kind-symmetric?`.
+- `host/blog-relate!(a,b,kind)` / `unrelate!(a,b,kind)` — directed; symmetric kinds
+  also write the reverse (today's "related" behavior = the symmetric case).
+- `host/blog-out(slug,kind)` (children) / `host/blog-in(slug,kind)` (parents),
+  existence-filtered. `host/blog-related(slug)` = `out(slug,"related")` (back-compat).
+- Routes carry `kind` (form field, default `"related"`); validated against registry.
+- `delete` cleanup drops edges across **all** kinds, both directions.
+
+### Phase 2 — Type resolution via reachability (the spine)
+- Seed root type-posts: `blog:type` ("Type") and `blog:tag is-a blog:type`,
+  each documenting itself. Idempotent seed in `serve.sh`.
+- `host/blog-types-of(slug)` = direct `is-a` targets ∪ `subtype-of`-reach of each
+  (SX-side composition over `lib/relations` reach — no new Datalog rules).
+- `host/blog-is-a?(slug, type)` — **transitive**.
+- Type-posts carry an optional `:schema` slot (designed now, mostly empty).
+- Validation hook: `host/blog-content-ok?` extended to also run any schema(s)
+  implied by the post's declared types. No schema → no-op (gradual).
+
+### Phase 3 — Tags as posts
+- "is a tag" = `host/blog-is-a? slug "tag"` (transitive). Helpers
+  `host/blog-tags(slug)` = `out(slug,"tagged")`, `host/blog-tagged-with(tag)` =
+  `in(tag,"tagged")`.
+- Edit page: a "This post is a tag" toggle = add/remove `is-a blog:tag` edge.
+
+### Phase 4 — Render (data-driven from the registry)
+- Post page iterates the registry → "Related posts" + "Tags" blocks, same code.
+- Tag-post page: its own content (the tag's documentation) **plus** "Tagged with
+  this" (incoming `tagged`). A tag page documents the tag AND lists its members.
+- Optional `/tags` index = posts `is-a? blog:tag`.
+
+### Phase 5 — Generalize the picker
+- `host/blog--relate-candidates(slug, q, kind)` branches on the kind's
+  `:candidates` (all / tags / types).
+- `relate-options` endpoint takes `&kind=`; picker filter input carries
+  `data-kind`; `relate-picker.js` forwards it.
+- Edit page renders one picker section per kind from the registry.
+
+### Phase 6 — Schema expressiveness (ongoing)
+- Grow the type `:schema` language: start minimal (required block kinds / a
+  predicate over content), richer later. Enforcement already wired in Phase 2;
+  only the language grows. Not a blocker — a gradient.
+
+## Notes
+- Node model unchanged (`blog:<slug>`); only `kind` varies. The relate machinery,
+  picker, and post-page block all generalize by lifting the hard-coded
+  `kind: "related"` into a parameter.
+- A type can *be* a post all the way up (`blog:tag is-a blog:type`); meta-circular
+  but bounded by seeding a small root set.

shared/static/wasm/sx-platform.js

@@ -646,6 +646,18 @@
     // Load entry point itself (boot.sx — not a library, just defines + init)
     loadBytecodeFile("sx/" + entry.file) || loadSxFile("sx/" + entry.file.replace(/\.sxbc$/, '.sx'));
 
+    // App components: the page's data-sx-manifest "boot" array lists app-specific
+    // modules (e.g. ~relate-picker) to eager-load after the web stack, so their
+    // defcomps are registered before a boosted fragment references them. Loaded
+    // content-addressed, the same as any module.
+    var pageM = loadPageManifest();
+    if (pageM && pageM.boot && pageM.boot.length) {
+      for (var b = 0; b < pageM.boot.length; b++) {
+        var bf = pageM.boot[b];
+        loadBytecodeFile("sx/" + bf) || loadSxFile("sx/" + bf.replace(/\.sxbc$/, '.sx'));
+      }
+    }
+
     if (K.endModuleLoad) K.endModuleLoad();
     var count = Object.keys(_loadedLibs).length + 1; // +1 for entry
     var dt = Math.round(performance.now() - t0);

shared/static/wasm/sx/boot-helpers.sx

@@ -269,16 +269,28 @@
                   (let
                     ((fd (host-new "FormData" el)))
                     (dict "url" url "body" fd "content-type" nil))
+                  ;; SX-native wire: serialise the form fields to a text/sx body
+                  ;; (the host reads it via host/sx-body / host/field). A hydrated
+                  ;; page posts SX, not urlencoded; the server still accepts
+                  ;; urlencoded for the no-engine fallback. See plans/
+                  ;; relations-as-posts.md ("SX all the way out").
                   (let
-                    ((fd (host-new "FormData" el))
-                      (params (host-new "URLSearchParams" fd)))
+                    ((payload
+                       (reduce
+                         (fn (acc f)
+                           (let ((nm (dom-get-attr f "name")))
+                             (if (and nm (not (= nm "")))
+                               (assoc acc nm (or (host-get f "value") ""))
+                               acc)))
+                         (dict)
+                         (dom-query-all el "input, textarea, select"))))
                     (dict
                       "url"
                       url
                       "body"
-                      (host-call params "toString")
+                      (serialize payload)
                       "content-type"
-                      "application/x-www-form-urlencoded"))))
+                      "text/sx; charset=utf-8"))))
               (dict "url" url "body" nil "content-type" nil))))))
     (define abort-previous-target (fn (el) nil))
     (define abort-previous (fn (el) nil))
@@ -579,7 +591,13 @@
         (dom-listen
           form
           "submit"
-          (fn (e) (prevent-default e) (execute-request form nil nil)))))
+          ;; A boosted form has no sx-get/sx-post, so get-verb-info returns nil and
+          ;; execute-request would no-op (the "submit does nothing — no network"
+          ;; bug). Pass the form's own method+action as the verbInfo so it actually
+          ;; fires the request (and the body is built from the form fields).
+          (fn (e)
+            (prevent-default e)
+            (execute-request form (dict "method" method "url" action) nil)))))
     (define
       bind-client-route-click
       (fn