content: document markdown table-pipe round-trip limitation + fix sketch

Probed the Markdown boundary; found table cells containing | don't round-trip
(asMarkdown emits raw |, md/import splits on every |). Recorded under Known
limitations with repro + two-sided fix sketch. Fix blocked: md-import.sx is
449 lines and all sx-tree edit tools error in this worktree (only
sx_write_file works) — deferred rather than risk a full manual rewrite.
Engine SATURATED at 787/787.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/scheduled_tasks.lock

@@ -0,0 +1 @@
+{"sessionId":"bf20a443-9df8-4cb9-932e-8c6f4c4625c2","pid":1303602,"procStart":"253831081","acquiredAt":1779865895644}

.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "sx-tree": {
       "type": "stdio",
-      "command": "./hosts/ocaml/_build/default/bin/mcp_tree.exe"
+      "command": "/root/rose-ash/hosts/ocaml/_build/default/bin/mcp_tree.exe"
     },
     "rose-ash-services": {
       "type": "stdio",

hosts/ocaml/bin/run_tests.ml

@@ -67,6 +67,14 @@ let rec deep_equal a b =
   | NativeFn _, NativeFn _ -> a == b
   | _ -> false
 
+(* ====================================================================== *)
+(* Test extensions for the VM extension registry suite (Phase B)           *)
+(* ====================================================================== *)
+
+(* Extend the extensible variant from sx_vm_extension.ml so the test
+   extensions below can carry their own private state. *)
+type Sx_vm_extension.extension_state += TestRegState of int ref
+
 (* ====================================================================== *)
 (* Build evaluator environment with test platform functions                *)
 (* ====================================================================== *)
@@ -1279,10 +1287,830 @@ let run_foundation_tests () =
   assert_true "sx_truthy \"\"" (Bool (sx_truthy (String "")));
   assert_eq "not truthy nil" (Bool false) (Bool (sx_truthy Nil));
   assert_eq "not truthy false" (Bool false) (Bool (sx_truthy (Bool false)));
-  let l = { l_params = ["x"]; l_body = Symbol "x"; l_closure = Sx_types.make_env (); l_name = None; l_compiled = None } in
+  let l = { l_params = ["x"]; l_body = Symbol "x"; l_closure = Sx_types.make_env (); l_name = None; l_compiled = None; l_call_count = 0; l_uid = Sx_types.next_lambda_uid () } in
   assert_true "is_lambda" (Bool (Sx_types.is_lambda (Lambda l)));
   ignore (Sx_types.set_lambda_name (Lambda l) "my-fn");
-  assert_eq "lambda name mutated" (String "my-fn") (lambda_name (Lambda l))
+  assert_eq "lambda name mutated" (String "my-fn") (lambda_name (Lambda l));
+
+  Printf.printf "\nSuite: crypto-sha2\n";
+  (* NIST FIPS 180-4 published vectors. *)
+  assert_eq "sha256 empty"
+    (String "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855")
+    (call "crypto-sha256" [String ""]);
+  assert_eq "sha256 abc"
+    (String "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad")
+    (call "crypto-sha256" [String "abc"]);
+  assert_eq "sha256 896-bit"
+    (String "248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1")
+    (call "crypto-sha256"
+       [String "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"]);
+  assert_eq "sha256 1M 'a'"
+    (String "cdc76e5c9914fb9281a1c7e284d73e67f1809a48a497200e046d39ccc7112cd0")
+    (call "crypto-sha256" [String (String.make 1000000 'a')]);
+  assert_eq "sha512 empty"
+    (String "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e")
+    (call "crypto-sha512" [String ""]);
+  assert_eq "sha512 abc"
+    (String "ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f")
+    (call "crypto-sha512" [String "abc"]);
+  assert_eq "sha512 896-bit"
+    (String "8e959b75dae313da8cf4f72814fc143f8f7779c6eb9f7fa17299aeadb6889018501d289e4900f7e4331b99dec4b5433ac7d329eeb6dd26545e96e55b874be909")
+    (call "crypto-sha512"
+       [String ("abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmn"
+                ^ "hijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu")]);
+
+  Printf.printf "\nSuite: crypto-sha3\n";
+  (* NIST FIPS 202 published vectors. *)
+  assert_eq "sha3-256 empty"
+    (String "a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a")
+    (call "crypto-sha3-256" [String ""]);
+  assert_eq "sha3-256 abc"
+    (String "3a985da74fe225b2045c172d6bd390bd855f086e3e9d525b46bfe24511431532")
+    (call "crypto-sha3-256" [String "abc"]);
+  assert_eq "sha3-256 896-bit"
+    (String "41c0dba2a9d6240849100376a8235e2c82e1b9998a999e21db32dd97496d3376")
+    (call "crypto-sha3-256"
+       [String "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"]);
+  (* 1600-bit message: 0xa3 * 200 — exercises multi-block absorb (>136B). *)
+  assert_eq "sha3-256 1600-bit 0xa3"
+    (String "79f38adec5c20307a98ef76e8324afbfd46cfd81b22e3973c65fa1bd9de31787")
+    (call "crypto-sha3-256" [String (String.make 200 '\xa3')]);
+
+  Printf.printf "\nSuite: dag-cbor\n";
+  let mkdict pairs =
+    let d = Sx_types.make_dict () in
+    List.iter (fun (k, v) -> Hashtbl.replace d k v) pairs;
+    Dict d
+  in
+  let enc v = call "cbor-encode" [v] in
+  (* RFC 8949 Appendix A — minimal-length deterministic encoding. *)
+  assert_eq "cbor 0"        (String "\x00") (enc (Integer 0));
+  assert_eq "cbor 23"       (String "\x17") (enc (Integer 23));
+  assert_eq "cbor 24"       (String "\x18\x18") (enc (Integer 24));
+  assert_eq "cbor 100"      (String "\x18\x64") (enc (Integer 100));
+  assert_eq "cbor 1000"     (String "\x19\x03\xe8") (enc (Integer 1000));
+  assert_eq "cbor 1000000"
+    (String "\x1a\x00\x0f\x42\x40") (enc (Integer 1000000));
+  assert_eq "cbor -1"       (String "\x20") (enc (Integer (-1)));
+  assert_eq "cbor -100"     (String "\x38\x63") (enc (Integer (-100)));
+  assert_eq "cbor -1000"    (String "\x39\x03\xe7") (enc (Integer (-1000)));
+  assert_eq "cbor false"    (String "\xf4") (enc (Bool false));
+  assert_eq "cbor true"     (String "\xf5") (enc (Bool true));
+  assert_eq "cbor null"     (String "\xf6") (enc Nil);
+  assert_eq "cbor \"\""     (String "\x60") (enc (String ""));
+  assert_eq "cbor \"a\""    (String "\x61\x61") (enc (String "a"));
+  assert_eq "cbor \"IETF\"" (String "\x64IETF") (enc (String "IETF"));
+  assert_eq "cbor []"       (String "\x80") (enc (List []));
+  assert_eq "cbor [1,2,3]"
+    (String "\x83\x01\x02\x03")
+    (enc (List [Integer 1; Integer 2; Integer 3]));
+  assert_eq "cbor [1,[2,3],[4,5]]"
+    (String "\x83\x01\x82\x02\x03\x82\x04\x05")
+    (enc (List [Integer 1;
+                List [Integer 2; Integer 3];
+                List [Integer 4; Integer 5]]));
+  assert_eq "cbor {}" (String "\xa0") (enc (mkdict []));
+  assert_eq "cbor {a:1,b:[2,3]}"
+    (String "\xa2\x61\x61\x01\x61\x62\x82\x02\x03")
+    (enc (mkdict ["a", Integer 1; "b", List [Integer 2; Integer 3]]));
+  assert_eq "cbor {a..e:A..E}"
+    (String "\xa5\x61\x61\x61\x41\x61\x62\x61\x42\x61\x63\x61\x43\x61\x64\x61\x44\x61\x65\x61\x45")
+    (enc (mkdict ["a", String "A"; "b", String "B"; "c", String "C";
+                  "d", String "D"; "e", String "E"]));
+  (* Determinism: insertion order + key length must not change bytes.
+     Sort is length-then-bytewise → a, c, bb. *)
+  let d1 = mkdict ["bb", Integer 2; "a", Integer 1; "c", Integer 3] in
+  let d2 = mkdict ["c", Integer 3; "bb", Integer 2; "a", Integer 1] in
+  assert_eq "cbor det order-invariant" (enc d1) (enc d2);
+  assert_eq "cbor det length-then-bytewise"
+    (String "\xa3\x61\x61\x01\x61\x63\x03\x62\x62\x62\x02")
+    (enc d1);
+  (* Round-trip: decode . encode = identity (structural). *)
+  let roundtrip name v =
+    assert_eq ("cbor rt " ^ name) v (call "cbor-decode" [enc v])
+  in
+  roundtrip "int" (Integer 42);
+  roundtrip "neg" (Integer (-99999));
+  roundtrip "str" (String "hello world");
+  roundtrip "bool" (Bool true);
+  roundtrip "nil" Nil;
+  roundtrip "nested"
+    (List [Integer 1; String "x"; List [Bool false; Nil]]);
+  roundtrip "dict"
+    (mkdict ["k", List [Integer 7]; "name", String "z"]);
+
+  Printf.printf "\nSuite: cid\n";
+  let mh_sha256 s = Sx_cid.multihash 0x12 (Sx_cid.unhex (Sx_sha2.sha256_hex s)) in
+  (* Authoritative vectors (independently derived; match well-known
+     IPFS CIDs). raw "abc" and raw "" — codec 0x55. *)
+  assert_eq "cid raw abc"
+    (String "bafkreif2pall7dybz7vecqka3zo24irdwabwdi4wc55jznaq75q7eaavvu")
+    (call "cid-from-bytes" [Integer 0x55; String (mh_sha256 "abc")]);
+  assert_eq "cid raw empty"
+    (String "bafkreihdwdcefgh4dqkjv67uzcmw7ojee6xedzdetojuzjevtenxquvyku")
+    (call "cid-from-bytes" [Integer 0x55; String (mh_sha256 "")]);
+  (* dag-cbor {} — canonical empty-map CID (sha2-256, codec 0x71). *)
+  assert_eq "cid dag-cbor {}"
+    (String "bafyreigbtj4x7ip5legnfznufuopl4sg4knzc2cof6duas4b3q2fy6swua")
+    (call "cid-from-sx" [mkdict []]);
+  (* Determinism: dict key insertion order must not change the CID. *)
+  let cda = call "cid-from-sx" [mkdict ["b", Integer 2; "a", Integer 1]] in
+  let cdb = call "cid-from-sx" [mkdict ["a", Integer 1; "b", Integer 2]] in
+  assert_eq "cid det order-invariant" cda cdb;
+  assert_true "cid multibase 'b' prefix"
+    (Bool (match call "cid-from-sx" [mkdict []] with
+           | String s -> String.length s > 1 && s.[0] = 'b'
+           | _ -> false));
+
+  Printf.printf "\nSuite: ed25519\n";
+  let hx = Sx_ed25519.unhex in
+  let edv pk msg sg = call "ed25519-verify"
+      [String (hx pk); String (hx msg); String (hx sg)] in
+  (* RFC 8032 §7.1 TEST 1-3 (deterministic; re-derived independently). *)
+  assert_eq "ed25519 RFC T1"
+    (Bool true)
+    (edv "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a"
+         ""
+         "e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b");
+  assert_eq "ed25519 RFC T2"
+    (Bool true)
+    (edv "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c"
+         "72"
+         "92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00");
+  assert_eq "ed25519 RFC T3"
+    (Bool true)
+    (edv "fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025"
+         "af82"
+         "6291d657deec24024827e69c3abe01a30ce548a284743a445e3680d7db5ac3ac18ff9b538d16f290ae67f760984dc6594a7c15e9716ed28dc027beceea1ec40a");
+  (* Tampered message -> false. *)
+  assert_eq "ed25519 tampered msg"
+    (Bool false)
+    (edv "fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025"
+         "af83"
+         "6291d657deec24024827e69c3abe01a30ce548a284743a445e3680d7db5ac3ac18ff9b538d16f290ae67f760984dc6594a7c15e9716ed28dc027beceea1ec40a");
+  (* Tampered signature -> false. *)
+  assert_eq "ed25519 tampered sig"
+    (Bool false)
+    (edv "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a"
+         ""
+         "f5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b");
+  (* Total: wrong-length pubkey / sig -> false, no exception. *)
+  assert_eq "ed25519 short pubkey"
+    (Bool false)
+    (call "ed25519-verify" [String "abc"; String ""; String (String.make 64 '\000')]);
+  assert_eq "ed25519 short sig"
+    (Bool false)
+    (call "ed25519-verify"
+       [String (hx "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a");
+        String ""; String "short"]);
+  assert_eq "ed25519 non-string args"
+    (Bool false)
+    (call "ed25519-verify" [Integer 1; Integer 2; Integer 3]);
+
+  Printf.printf "\nSuite: rsa-sha256\n";
+  (* Fixed RSA-2048 vector: one-off python-cryptography keygen +
+     PKCS1v15/SHA-256 sign of "fed-sx phase F rsa test". *)
+  let rhx = Sx_rsa.unhex in
+  let spki = rhx "30820122300d06092a864886f70d01010105000382010f003082010a0282010100a117b573480bce5a08b54a98384001df26d062e9173caaee2e3a2d0045c6d16f99b2a1e7fb60763f65f95f8c39ff82c18b8590338042914331db3440a06d2dbe65a2f82c82f37d293f67a8b57a1f9014b55150a093cfee90257ef3b4a215d5ab002579bd92b6fcb3536777d51b639347d01e307ddafb209073dd9b8d6a507157c44c624a19b3b9275931472462870ae02132630159132a85c1c889adfb358b6bbd3760ce3fffe6285964833a10ee436d5bc33dfab7f9ed630a74e9a32e5688f5a7797f7cc839ad2494dd1c4c4a8fab844cd26208794bf2602c16b9d12bde434066d8c0dd2d20489f4070f883bae2b4508ead4a1b80b44c576e9e37bdb5df69f10203010001" in
+  let rmsg = rhx "6665642d73782070686173652046207273612074657374" in
+  let rsig = rhx "5e1593d674ed15c0172546d38efdf1aebd252f4b0c0dfbe1f7996fd569d0bfd9f3e8689ea2b14aa45b5fc3f0a05d4f23c6b02b8820d71f6998ea3b5b0d071bb33142236e388b1226ece3ec447d33b38999f189c37564cf052cf038de94c67b2ddf9a97d5a73554bb88818f615824517209a4083258965adace55658f344104eaa0d5f2f44ea00cfac8754674aade87b40d955cccd1ccd9b7649a08b66ce3bc5dba2de96b3e859488ded3ef9fb3744a1e3495fd14841d8319b3cc08054c729d1c02739ee314eba2b20fac46e463f47eb67183d8455583eca73ba37448164612dd9cd77877135d30d12084c2843f986a5b8ad59c6600f9855b91d7cbdf7c6c4b0e" in
+  let rsav s m g = call "rsa-sha256-verify" [String s; String m; String g] in
+  assert_eq "rsa valid" (Bool true) (rsav spki rmsg rsig);
+  assert_eq "rsa tampered msg" (Bool false)
+    (rsav spki (rmsg ^ "x") rsig);
+  assert_eq "rsa tampered sig" (Bool false)
+    (rsav spki rmsg
+       (rhx "5f1593d674ed15c0172546d38efdf1aebd252f4b0c0dfbe1f7996fd569d0bfd9f3e8689ea2b14aa45b5fc3f0a05d4f23c6b02b8820d71f6998ea3b5b0d071bb33142236e388b1226ece3ec447d33b38999f189c37564cf052cf038de94c67b2ddf9a97d5a73554bb88818f615824517209a4083258965adace55658f344104eaa0d5f2f44ea00cfac8754674aade87b40d955cccd1ccd9b7649a08b66ce3bc5dba2de96b3e859488ded3ef9fb3744a1e3495fd14841d8319b3cc08054c729d1c02739ee314eba2b20fac46e463f47eb67183d8455583eca73ba37448164612dd9cd77877135d30d12084c2843f986a5b8ad59c6600f9855b91d7cbdf7c6c4b0e"));
+  assert_eq "rsa garbage spki" (Bool false)
+    (rsav "not der" rmsg rsig);
+  assert_eq "rsa non-string args" (Bool false)
+    (call "rsa-sha256-verify" [Integer 1; Integer 2; Integer 3]);
+
+  Printf.printf "\nSuite: file-list-dir\n";
+  let expect_err nm f =
+    (try ignore (f ());
+       incr fail_count; Printf.printf "  FAIL: %s — no error\n" nm
+     with Eval_error _ ->
+       incr pass_count; Printf.printf "  PASS: %s\n" nm
+        | _ ->
+       incr fail_count; Printf.printf "  FAIL: %s — wrong exn\n" nm)
+  in
+  let tmp = Filename.temp_file "fld" "" in
+  Sys.remove tmp; Unix.mkdir tmp 0o755;
+  let touch n = let oc = open_out (Filename.concat tmp n) in close_out oc in
+  touch "b.txt"; touch "a.txt"; touch "c.txt";
+  assert_eq "file-list-dir sorted"
+    (List [String "a.txt"; String "b.txt"; String "c.txt"])
+    (call "file-list-dir" [String tmp]);
+  expect_err "file-list-dir missing"
+    (fun () -> call "file-list-dir" [String (Filename.concat tmp "nope")]);
+  expect_err "file-list-dir not-a-dir"
+    (fun () -> call "file-list-dir" [String (Filename.concat tmp "a.txt")]);
+  expect_err "file-list-dir arity"
+    (fun () -> call "file-list-dir" []);
+  (* best-effort cleanup *)
+  (try List.iter (fun n -> Sys.remove (Filename.concat tmp n))
+         ["a.txt"; "b.txt"; "c.txt"]; Unix.rmdir tmp
+   with _ -> ());
+
+  Printf.printf "\nSuite: vm-extension-dispatch\n";
+  let make_bc op = ({
+    vc_arity = 0; vc_rest_arity = -1; vc_locals = 0;
+    vc_bytecode = [| op |]; vc_constants = [||];
+    vc_bytecode_list = None; vc_constants_list = None;
+  } : Sx_types.vm_code) in
+  let expect_invalid_opcode label op =
+    let globals = Hashtbl.create 1 in
+    try
+      let _ = Sx_vm.execute_module (make_bc op) globals in
+      incr fail_count;
+      Printf.printf "  FAIL: %s — expected Invalid_opcode, got a result\n" label
+    with
+    | Sx_vm.Invalid_opcode n when n = op ->
+      incr pass_count;
+      Printf.printf "  PASS: %s\n" label
+    | exn ->
+      incr fail_count;
+      Printf.printf "  FAIL: %s — unexpected: %s\n" label (Printexc.to_string exn)
+  in
+  expect_invalid_opcode "opcode 200 raises Invalid_opcode 200" 200;
+  expect_invalid_opcode "opcode 224 raises Invalid_opcode 224" 224;
+  expect_invalid_opcode "opcode 247 raises Invalid_opcode 247" 247;
+  (* Opcode 199 sits just below the extension threshold — should fall to the
+     catch-all (Eval_error), proving the threshold is at 200, not 199. *)
+  let globals = Hashtbl.create 1 in
+  (try
+     let _ = Sx_vm.execute_module (make_bc 199) globals in
+     incr fail_count;
+     Printf.printf "  FAIL: opcode 199 — expected Eval_error, got a result\n"
+   with
+   | Sx_vm.Invalid_opcode _ ->
+     incr fail_count;
+     Printf.printf "  FAIL: opcode 199 routed to extension dispatch (threshold wrong)\n"
+   | Sx_types.Eval_error _ ->
+     incr pass_count;
+     Printf.printf "  PASS: opcode 199 stays in core (catch-all)\n"
+   | exn ->
+     incr fail_count;
+     Printf.printf "  FAIL: opcode 199 — unexpected: %s\n" (Printexc.to_string exn));
+
+  Printf.printf "\nSuite: vm-extension-registry\n";
+  (* Sx_vm_extensions self-installs its dispatcher at module init.  Reset
+     the registry so prior loaded extensions don't interfere with this
+     test. *)
+  Sx_vm_extensions._reset_for_tests ();
+  let module TestExt : Sx_vm_extension.EXTENSION = struct
+    let name = "test_reg"
+    let init () = TestRegState (ref 0)
+    let opcodes _st = [
+      (210, "test_reg.OP_PUSH_42", (fun vm _frame ->
+        Sx_vm.push vm (Sx_types.Integer 42)));
+      (211, "test_reg.OP_DOUBLE_TOS", (fun vm _frame ->
+        let v = Sx_vm.pop vm in
+        match v with
+        | Sx_types.Integer n -> Sx_vm.push vm (Sx_types.Integer (n * 2))
+        | _ -> failwith "OP_DOUBLE_TOS: not an integer"));
+    ]
+  end in
+  Sx_vm_extensions.register (module TestExt);
+
+  (match Sx_vm_extensions.id_of_name "test_reg.OP_PUSH_42" with
+   | Some 210 ->
+     incr pass_count;
+     Printf.printf "  PASS: id_of_name resolves opcode\n"
+   | other ->
+     incr fail_count;
+     Printf.printf "  FAIL: id_of_name: got %s\n"
+       (match other with Some n -> string_of_int n | None -> "None"));
+
+  (match Sx_vm_extensions.id_of_name "nonexistent.OP" with
+   | None ->
+     incr pass_count;
+     Printf.printf "  PASS: id_of_name returns None for unknown\n"
+   | Some _ ->
+     incr fail_count;
+     Printf.printf "  FAIL: id_of_name should return None for unknown\n");
+
+  (match Sx_vm_extensions.state_of_extension "test_reg" with
+   | Some (TestRegState _) ->
+     incr pass_count;
+     Printf.printf "  PASS: state_of_extension returns extension state\n"
+   | _ ->
+     incr fail_count;
+     Printf.printf "  FAIL: state_of_extension lookup\n");
+
+  (match Sx_vm_extensions.state_of_extension "nonexistent" with
+   | None ->
+     incr pass_count;
+     Printf.printf "  PASS: state_of_extension None for unknown\n"
+   | Some _ ->
+     incr fail_count;
+     Printf.printf "  FAIL: state_of_extension should be None\n");
+
+  (* End-to-end dispatch through the VM. Bytecode runs OP_PUSH_42 then
+     OP_RETURN (50); execute_module pops the result. *)
+  let make_bc_seq bytes = ({
+    vc_arity = 0; vc_rest_arity = -1; vc_locals = 0;
+    vc_bytecode = bytes; vc_constants = [||];
+    vc_bytecode_list = None; vc_constants_list = None;
+  } : Sx_types.vm_code) in
+  (let globals = Hashtbl.create 1 in
+   try
+     match Sx_vm.execute_module (make_bc_seq [| 210; 50 |]) globals with
+     | Integer 42 ->
+       incr pass_count;
+       Printf.printf "  PASS: dispatch routes opcode 210 -> push 42\n"
+     | other ->
+       incr fail_count;
+       Printf.printf "  FAIL: dispatch opcode 210: got %s\n"
+         (Sx_types.inspect other)
+   with exn ->
+     incr fail_count;
+     Printf.printf "  FAIL: dispatch opcode 210 raised: %s\n"
+       (Printexc.to_string exn));
+
+  (* Compose two extension opcodes: PUSH_42 then DOUBLE_TOS then RETURN.
+     Verifies that successive extension dispatches share VM state. *)
+  (let globals = Hashtbl.create 1 in
+   try
+     match Sx_vm.execute_module (make_bc_seq [| 210; 211; 50 |]) globals with
+     | Integer 84 ->
+       incr pass_count;
+       Printf.printf "  PASS: extension opcodes compose (42 -> 84)\n"
+     | other ->
+       incr fail_count;
+       Printf.printf "  FAIL: composed opcodes: got %s\n"
+         (Sx_types.inspect other)
+   with exn ->
+     incr fail_count;
+     Printf.printf "  FAIL: composed opcodes raised: %s\n"
+       (Printexc.to_string exn));
+
+  (* Duplicate opcode-id detection. *)
+  let module DupExt : Sx_vm_extension.EXTENSION = struct
+    let name = "dup_check"
+    let init () = TestRegState (ref 0)
+    let opcodes _st = [
+      (210, "dup_check.OP_X", (fun _vm _frame -> ()));
+    ]
+  end in
+  (try
+     Sx_vm_extensions.register (module DupExt);
+     incr fail_count;
+     Printf.printf "  FAIL: duplicate opcode id should have raised\n"
+   with Failure _ ->
+     incr pass_count;
+     Printf.printf "  PASS: duplicate opcode id rejected\n");
+
+  (* Out-of-range opcode-id detection. *)
+  let module OutExt : Sx_vm_extension.EXTENSION = struct
+    let name = "out_of_range"
+    let init () = TestRegState (ref 0)
+    let opcodes _st = [
+      (300, "out_of_range.OP_X", (fun _vm _frame -> ()));
+    ]
+  end in
+  (try
+     Sx_vm_extensions.register (module OutExt);
+     incr fail_count;
+     Printf.printf "  FAIL: out-of-range opcode should have raised\n"
+   with Failure _ ->
+     incr pass_count;
+     Printf.printf "  PASS: out-of-range opcode rejected\n");
+
+  (* Duplicate extension-name detection. *)
+  let module SameNameExt : Sx_vm_extension.EXTENSION = struct
+    let name = "test_reg"  (* same as TestExt above *)
+    let init () = TestRegState (ref 0)
+    let opcodes _st = []
+  end in
+  (try
+     Sx_vm_extensions.register (module SameNameExt);
+     incr fail_count;
+     Printf.printf "  FAIL: duplicate extension name should have raised\n"
+   with Failure _ ->
+     incr pass_count;
+     Printf.printf "  PASS: duplicate extension name rejected\n");
+
+  Printf.printf "\nSuite: extension-opcode-id primitive\n";
+  let prim = Hashtbl.find Sx_primitives.primitives "extension-opcode-id" in
+
+  (* Known opcode (registered by TestExt above). *)
+  (match prim [String "test_reg.OP_PUSH_42"] with
+   | Integer 210 ->
+     incr pass_count;
+     Printf.printf "  PASS: primitive returns Integer for registered opcode\n"
+   | other ->
+     incr fail_count;
+     Printf.printf "  FAIL: registered opcode lookup: got %s\n"
+       (Sx_types.inspect other));
+
+  (* Unknown opcode → Nil. *)
+  (match prim [String "nonexistent.OP_X"] with
+   | Nil ->
+     incr pass_count;
+     Printf.printf "  PASS: primitive returns nil for unknown opcode\n"
+   | other ->
+     incr fail_count;
+     Printf.printf "  FAIL: unknown opcode lookup: got %s\n"
+       (Sx_types.inspect other));
+
+  (* Symbol arg also accepted (compilers may pass quoted symbols). *)
+  (match prim [Symbol "test_reg.OP_DOUBLE_TOS"] with
+   | Integer 211 ->
+     incr pass_count;
+     Printf.printf "  PASS: primitive accepts Symbol args\n"
+   | other ->
+     incr fail_count;
+     Printf.printf "  FAIL: symbol arg: got %s\n" (Sx_types.inspect other));
+
+  (* Wrong arity / type raises Eval_error. *)
+  (try
+     let _ = prim [] in
+     incr fail_count;
+     Printf.printf "  FAIL: zero args should have raised\n"
+   with Sx_types.Eval_error _ ->
+     incr pass_count;
+     Printf.printf "  PASS: zero args rejected\n");
+
+  (try
+     let _ = prim [Integer 42] in
+     incr fail_count;
+     Printf.printf "  FAIL: integer arg should have raised\n"
+   with Sx_types.Eval_error _ ->
+     incr pass_count;
+     Printf.printf "  PASS: integer arg rejected\n");
+
+  Printf.printf "\nSuite: extensions/test_ext (canonical extension)\n";
+  (* Phase D: the real test extension lives at lib/extensions/test_ext.ml.
+     Register it on top of the inline test_reg from earlier suites — the
+     two use disjoint opcode IDs (210/211 vs 220/221) so they coexist. *)
+  Test_ext.register ();
+
+  (* Lookup via the public primitive should now find OP_TEST_PUSH_42. *)
+  (match prim [String "test_ext.OP_TEST_PUSH_42"] with
+   | Integer 220 ->
+     incr pass_count;
+     Printf.printf "  PASS: extension-opcode-id finds test_ext.OP_TEST_PUSH_42\n"
+   | other ->
+     incr fail_count;
+     Printf.printf "  FAIL: opcode lookup: got %s\n" (Sx_types.inspect other));
+
+  (* End-to-end: PUSH_42 + DOUBLE_TOS + RETURN. *)
+  (let globals = Hashtbl.create 1 in
+   try
+     match Sx_vm.execute_module (make_bc_seq [| 220; 221; 50 |]) globals with
+     | Integer 84 ->
+       incr pass_count;
+       Printf.printf "  PASS: extensions/test_ext bytecode executes (84)\n"
+     | other ->
+       incr fail_count;
+       Printf.printf "  FAIL: test_ext bytecode result: got %s\n"
+         (Sx_types.inspect other)
+   with exn ->
+     incr fail_count;
+     Printf.printf "  FAIL: test_ext bytecode raised: %s\n"
+       (Printexc.to_string exn));
+
+  (* Disassembly: opcode_name should resolve 220/221 via the registry,
+     not fall back to UNKNOWN_220 / UNKNOWN_221.  disassemble returns a
+     Dict; the instruction list lives at key "bytecode". *)
+  (let code = make_bc_seq [| 220; 221; 50 |] in
+   let dis = Sx_vm.disassemble code in
+   let entries = match dis with
+     | Dict d -> (match Hashtbl.find_opt d "bytecode" with
+                  | Some (List es) -> es
+                  | _ -> [])
+     | _ -> []
+   in
+   let names = List.filter_map (fun entry -> match entry with
+     | Dict d ->
+       (match Hashtbl.find_opt d "opcode" with
+        | Some (String name) -> Some name
+        | _ -> None)
+     | _ -> None) entries
+   in
+   let has name = List.mem name names in
+   if has "test_ext.OP_TEST_PUSH_42" && has "test_ext.OP_TEST_DOUBLE_TOS" then begin
+     incr pass_count;
+     Printf.printf "  PASS: disassemble shows extension opcode names\n"
+   end else begin
+     incr fail_count;
+     Printf.printf "  FAIL: disassemble names: [%s]\n" (String.concat ", " names)
+   end);
+
+  (* Sanity: opcode_name on an unregistered extension opcode still
+     returns UNKNOWN_n.  Pick 230 — out of test_ext's range. *)
+  (match Sx_vm.opcode_name 230 with
+   | "UNKNOWN_230" ->
+     incr pass_count;
+     Printf.printf "  PASS: unregistered ext opcode falls back to UNKNOWN_n\n"
+   | other ->
+     incr fail_count;
+     Printf.printf "  FAIL: opcode_name 230: got %s\n" other);
+
+  (* Per-extension state: invocation_count should reflect the two opcodes
+     that ran in the dispatch test above. *)
+  (match Test_ext.invocation_count () with
+   | Some n when n >= 2 ->
+     incr pass_count;
+     Printf.printf "  PASS: extension state recorded %d invocations\n" n
+   | other ->
+     incr fail_count;
+     Printf.printf "  FAIL: invocation_count: %s\n"
+       (match other with Some n -> string_of_int n | None -> "None"));
+
+  Printf.printf "\nSuite: extensions/erlang_ext (Phase 9h)\n";
+  (* Register the Erlang opcode namespace. Disjoint id range (200-217)
+     from test_ext (220/221) so they coexist. *)
+  Erlang_ext.register ();
+
+  (match prim [String "erlang.OP_PATTERN_TUPLE"] with
+   | Integer 222 ->
+     incr pass_count;
+     Printf.printf "  PASS: extension-opcode-id erlang.OP_PATTERN_TUPLE = 222\n"
+   | other ->
+     incr fail_count;
+     Printf.printf "  FAIL: erlang.OP_PATTERN_TUPLE: got %s\n"
+       (Sx_types.inspect other));
+
+  (match prim [String "erlang.OP_BIF_IS_TUPLE"] with
+   | Integer 239 ->
+     incr pass_count;
+     Printf.printf "  PASS: extension-opcode-id erlang.OP_BIF_IS_TUPLE = 239\n"
+   | other ->
+     incr fail_count;
+     Printf.printf "  FAIL: erlang.OP_BIF_IS_TUPLE: got %s\n"
+       (Sx_types.inspect other));
+
+  (match prim [String "erlang.OP_NONEXISTENT"] with
+   | Nil ->
+     incr pass_count;
+     Printf.printf "  PASS: unknown erlang opcode -> nil\n"
+   | other ->
+     incr fail_count;
+     Printf.printf "  FAIL: unknown erlang opcode: got %s\n"
+       (Sx_types.inspect other));
+
+  (* Phase 10b vertical slice: erlang.OP_BIF_LENGTH (230) is a REAL
+     handler. Build [CONST 0; OP_BIF_LENGTH; RETURN] with an Erlang
+     list [1,2,3] in the constant pool; expect Integer 3. Proves the
+     full path: bytecode -> Sx_vm extension fallthrough -> erlang_ext
+     handler -> correct stack result. *)
+  (let mk_dict kvs =
+     let h = Hashtbl.create 4 in
+     List.iter (fun (k, v) -> Hashtbl.replace h k v) kvs;
+     Sx_types.Dict h in
+   let er_nil = mk_dict [("tag", Sx_types.String "nil")] in
+   let er_cons hd tl =
+     mk_dict [("tag", Sx_types.String "cons");
+              ("head", hd); ("tail", tl)] in
+   let lst = er_cons (Sx_types.Integer 1)
+               (er_cons (Sx_types.Integer 2)
+                  (er_cons (Sx_types.Integer 3) er_nil)) in
+   let code = ({
+     vc_arity = 0; vc_rest_arity = -1; vc_locals = 0;
+     vc_bytecode = [| 1; 0; 0; 230; 50 |];
+     vc_constants = [| lst |];
+     vc_bytecode_list = None; vc_constants_list = None;
+   } : Sx_types.vm_code) in
+   let globals = Hashtbl.create 1 in
+   try
+     match Sx_vm.execute_module code globals with
+     | Integer 3 ->
+       incr pass_count;
+       Printf.printf "  PASS: erlang.OP_BIF_LENGTH [1,2,3] -> 3 (real handler, end-to-end)\n"
+     | other ->
+       incr fail_count;
+       Printf.printf "  FAIL: OP_BIF_LENGTH result: got %s\n"
+         (Sx_types.inspect other)
+   with exn ->
+     incr fail_count;
+     Printf.printf "  FAIL: OP_BIF_LENGTH raised: %s\n"
+       (Printexc.to_string exn));
+
+  (* More real handlers (Phase 10b batch): build a list/tuple constant
+     and exercise HD/TL/TUPLE_SIZE/IS_* end-to-end through the VM. *)
+  (let mk_dict kvs =
+     let h = Hashtbl.create 4 in
+     List.iter (fun (k, v) -> Hashtbl.replace h k v) kvs;
+     Sx_types.Dict h in
+   let er_nil = mk_dict [("tag", Sx_types.String "nil")] in
+   let er_cons hd tl = mk_dict [("tag", Sx_types.String "cons");
+                                ("head", hd); ("tail", tl)] in
+   let er_tuple es = mk_dict [("tag", Sx_types.String "tuple");
+                              ("elements", Sx_types.List es)] in
+   let er_atom nm = mk_dict [("tag", Sx_types.String "atom");
+                             ("name", Sx_types.String nm)] in
+   let lst3 = er_cons (Sx_types.Integer 7)
+                (er_cons (Sx_types.Integer 8)
+                   (er_cons (Sx_types.Integer 9) er_nil)) in
+   let tup3 = er_tuple [Sx_types.Integer 1; Sx_types.Integer 2;
+                        Sx_types.Integer 3] in
+   let run consts bc =
+     let code = ({
+       vc_arity = 0; vc_rest_arity = -1; vc_locals = 0;
+       vc_bytecode = bc; vc_constants = consts;
+       vc_bytecode_list = None; vc_constants_list = None;
+     } : Sx_types.vm_code) in
+     Sx_vm.execute_module code (Hashtbl.create 1) in
+   let nm = function
+     | Sx_types.Dict d ->
+       (match Hashtbl.find_opt d "name" with
+        | Some (Sx_types.String s) -> s | _ -> "?")
+     | _ -> "?" in
+   let check label want got =
+     if got = want then begin
+       incr pass_count;
+       Printf.printf "  PASS: %s\n" label
+     end else begin
+       incr fail_count;
+       Printf.printf "  FAIL: %s: got %s\n" label (Sx_types.inspect got)
+     end in
+   (* HD [7,8,9] -> 7 *)
+   check "OP_BIF_HD [7,8,9] -> 7" (Sx_types.Integer 7)
+     (run [| lst3 |] [| 1;0;0; 231; 50 |]);
+   (* TL [7,8,9] -> [8,9], check its HD = 8 *)
+   check "OP_BIF_TL then HD -> 8" (Sx_types.Integer 8)
+     (run [| lst3 |] [| 1;0;0; 232; 231; 50 |]);
+   (* TUPLE_SIZE {1,2,3} -> 3 *)
+   check "OP_BIF_TUPLE_SIZE {1,2,3} -> 3" (Sx_types.Integer 3)
+     (run [| tup3 |] [| 1;0;0; 234; 50 |]);
+   (* IS_INTEGER 42 -> true ; IS_INTEGER [..] -> false *)
+   (match run [| Sx_types.Integer 42 |] [| 1;0;0; 236; 50 |] with
+    | v when nm v = "true" ->
+      incr pass_count; Printf.printf "  PASS: OP_BIF_IS_INTEGER 42 -> true\n"
+    | v -> incr fail_count;
+      Printf.printf "  FAIL: IS_INTEGER 42: got %s\n" (Sx_types.inspect v));
+   (match run [| lst3 |] [| 1;0;0; 236; 50 |] with
+    | v when nm v = "false" ->
+      incr pass_count; Printf.printf "  PASS: OP_BIF_IS_INTEGER list -> false\n"
+    | v -> incr fail_count;
+      Printf.printf "  FAIL: IS_INTEGER list: got %s\n" (Sx_types.inspect v));
+   (* IS_ATOM atom -> true ; IS_LIST nil -> true ; IS_TUPLE tuple -> true *)
+   (match run [| er_atom "ok" |] [| 1;0;0; 237; 50 |] with
+    | v when nm v = "true" ->
+      incr pass_count; Printf.printf "  PASS: OP_BIF_IS_ATOM ok -> true\n"
+    | v -> incr fail_count;
+      Printf.printf "  FAIL: IS_ATOM: got %s\n" (Sx_types.inspect v));
+   (match run [| er_nil |] [| 1;0;0; 238; 50 |] with
+    | v when nm v = "true" ->
+      incr pass_count; Printf.printf "  PASS: OP_BIF_IS_LIST nil -> true\n"
+    | v -> incr fail_count;
+      Printf.printf "  FAIL: IS_LIST nil: got %s\n" (Sx_types.inspect v));
+   (match run [| tup3 |] [| 1;0;0; 239; 50 |] with
+    | v when nm v = "true" ->
+      incr pass_count; Printf.printf "  PASS: OP_BIF_IS_TUPLE {..} -> true\n"
+    | v -> incr fail_count;
+      Printf.printf "  FAIL: IS_TUPLE: got %s\n" (Sx_types.inspect v));
+   (match run [| tup3 |] [| 1;0;0; 238; 50 |] with
+    | v when nm v = "false" ->
+      incr pass_count; Printf.printf "  PASS: OP_BIF_IS_LIST tuple -> false\n"
+    | v -> incr fail_count;
+      Printf.printf "  FAIL: IS_LIST tuple: got %s\n" (Sx_types.inspect v));
+   (* ELEMENT: element(2, {1,2,3}) -> 2. Calling convention: push
+      Index then Tuple; opcode pops Tuple (TOS) then Index. *)
+   check "OP_BIF_ELEMENT element(2,{1,2,3}) -> 2" (Sx_types.Integer 2)
+     (run [| Sx_types.Integer 2; tup3 |] [| 1;0;0; 1;1;0; 233; 50 |]);
+   check "OP_BIF_ELEMENT element(1,{1,2,3}) -> 1" (Sx_types.Integer 1)
+     (run [| Sx_types.Integer 1; tup3 |] [| 1;0;0; 1;1;0; 233; 50 |]);
+   (* ELEMENT out of range raises *)
+   (let raised =
+      (try ignore (run [| Sx_types.Integer 9; tup3 |]
+                     [| 1;0;0; 1;1;0; 233; 50 |]); false
+       with Sx_types.Eval_error _ -> true) in
+    if raised then begin
+      incr pass_count;
+      Printf.printf "  PASS: OP_BIF_ELEMENT out-of-range raises\n"
+    end else begin
+      incr fail_count;
+      Printf.printf "  FAIL: OP_BIF_ELEMENT out-of-range should raise\n"
+    end);
+   (* LISTS_REVERSE [7,8,9] -> [9,8,7]; verify HD = 9 then HD of TL = 8 *)
+   check "OP_BIF_LISTS_REVERSE then HD -> 9" (Sx_types.Integer 9)
+     (run [| lst3 |] [| 1;0;0; 235; 231; 50 |]);
+   check "OP_BIF_LISTS_REVERSE then TL,HD -> 8" (Sx_types.Integer 8)
+     (run [| lst3 |] [| 1;0;0; 235; 232; 231; 50 |]);
+   (* reverse preserves length *)
+   check "OP_BIF_LISTS_REVERSE then LENGTH -> 3" (Sx_types.Integer 3)
+     (run [| lst3 |] [| 1;0;0; 235; 230; 50 |]));
+
+  (* A still-stubbed opcode (222 = erlang.OP_PATTERN_TUPLE) raises the
+     not-wired Eval_error — confirms the honest-failure path remains
+     for opcodes whose real handlers haven't landed. *)
+  (let globals = Hashtbl.create 1 in
+   try
+     ignore (Sx_vm.execute_module (make_bc_seq [| 222; 50 |]) globals);
+     incr fail_count;
+     Printf.printf "  FAIL: erlang.OP_PATTERN_TUPLE dispatch should have raised\n"
+   with
+   | Sx_types.Eval_error msg
+     when (let needle = "not yet wired" in
+           let nl = String.length needle and ml = String.length msg in
+           let rec scan i =
+             if i + nl > ml then false
+             else if String.sub msg i nl = needle then true
+             else scan (i + 1)
+           in scan 0) ->
+     incr pass_count;
+     Printf.printf "  PASS: erlang opcode dispatch raises not-wired error\n"
+   | exn ->
+     incr fail_count;
+     Printf.printf "  FAIL: unexpected exn: %s\n" (Printexc.to_string exn));
+
+  (match Erlang_ext.dispatch_count () with
+   | Some n when n >= 1 ->
+     incr pass_count;
+     Printf.printf "  PASS: erlang_ext state recorded %d dispatch(es)\n" n
+   | other ->
+     incr fail_count;
+     Printf.printf "  FAIL: dispatch_count: %s\n"
+       (match other with Some n -> string_of_int n | None -> "None"));
+
+  Printf.printf "\nSuite: jit extension-opcode awareness\n";
+  let scan = Sx_vm.bytecode_uses_extension_opcodes in
+  let no_consts = [||] in
+
+  (* Pure core ops: scan reports false. *)
+  (* OP_TRUE OP_RETURN *)
+  if not (scan [| 3; 50 |] no_consts) then begin
+    incr pass_count;
+    Printf.printf "  PASS: pure core bytecode is JIT-eligible\n"
+  end else begin
+    incr fail_count;
+    Printf.printf "  FAIL: pure core bytecode flagged as extension\n"
+  end;
+
+  (* Extension opcode anywhere → true. *)
+  if scan [| 220; 50 |] no_consts then begin
+    incr pass_count;
+    Printf.printf "  PASS: extension opcode detected at head\n"
+  end else begin
+    incr fail_count;
+    Printf.printf "  FAIL: extension opcode at head missed\n"
+  end;
+
+  (* Mixed: core + extension → true. *)
+  if scan [| 3; 220; 50 |] no_consts then begin
+    incr pass_count;
+    Printf.printf "  PASS: extension opcode detected after core ops\n"
+  end else begin
+    incr fail_count;
+    Printf.printf "  FAIL: extension opcode after core ops missed\n"
+  end;
+
+  (* Operand bytes ≥200 must NOT trigger.  CONST u16 with index 220
+     into a synthetic constant pool — the operand is 220 (lo) 0 (hi),
+     not an opcode.  The pool entry at 220 is irrelevant for the scan. *)
+  let big_consts = Array.make 256 Nil in
+  if not (scan [| 1; 220; 0; 50 |] big_consts) then begin
+    incr pass_count;
+    Printf.printf "  PASS: CONST operand ≥200 not a false positive\n"
+  end else begin
+    incr fail_count;
+    Printf.printf "  FAIL: CONST operand ≥200 false-positives as ext op\n"
+  end;
+
+  (* CALL_PRIM has 3 operand bytes (u16 + u8); all ≥200 should not
+     trigger. *)
+  if not (scan [| 52; 220; 200; 200; 50 |] big_consts) then begin
+    incr pass_count;
+    Printf.printf "  PASS: CALL_PRIM operands ≥200 not a false positive\n"
+  end else begin
+    incr fail_count;
+    Printf.printf "  FAIL: CALL_PRIM operands ≥200 false-positive\n"
+  end;
+
+  (* CLOSURE with upvalue descriptors: scan must skip the 2 + 2*n
+     dynamic operand bytes.  Build a synthetic constant pool with a
+     Dict at index 0 declaring upvalue-count 1, descriptors that are
+     ≥200 — the scan should skip them and not trigger.
+
+     Bytecode layout: CLOSURE 0 0  desc_is_local desc_index  RETURN
+                       op    lo hi      210         220       50
+     With upvalue-count = 1, scan must advance past the 2-byte CLOSURE
+     operand AND the 2 descriptor bytes (210, 220), landing on RETURN. *)
+  let cl_consts = Array.make 1 Nil in
+  let dict = Hashtbl.create 1 in
+  Hashtbl.replace dict "upvalue-count" (Integer 1);
+  cl_consts.(0) <- Dict dict;
+  if not (scan [| 51; 0; 0; 210; 220; 50 |] cl_consts) then begin
+    incr pass_count;
+    Printf.printf "  PASS: CLOSURE upvalue descriptors ≥200 skipped\n"
+  end else begin
+    incr fail_count;
+    Printf.printf "  FAIL: CLOSURE upvalue descriptors false-positive\n"
+  end;
+
+  (* Sanity: opcode after CLOSURE+descriptors that IS an extension
+     opcode triggers correctly. *)
+  if scan [| 51; 0; 0; 210; 220; 221; 50 |] cl_consts then begin
+    incr pass_count;
+    Printf.printf "  PASS: extension opcode after CLOSURE detected\n"
+  end else begin
+    incr fail_count;
+    Printf.printf "  FAIL: extension opcode after CLOSURE missed\n"
+  end
 
 
 (* ====================================================================== *)

hosts/ocaml/bin/sx_server.ml

@@ -18,6 +18,20 @@
 
 open Sx_types
 
+(* Force-link Sx_vm_extensions so its module-init runs: installs the
+   extension dispatch fallthrough and registers the `extension-opcode-id`
+   SX primitive. Without a reference here OCaml dead-code-eliminates the
+   module from sx_server.exe (it's only otherwise reached from run_tests),
+   leaving guest-language opcode extensions (Erlang Phase 9, etc.)
+   invisible to the runtime. The applied call is a harmless lookup. *)
+let () = ignore (Sx_vm_extensions.id_of_name "")
+
+(* Register the Erlang opcode extension (Phase 9h) so
+   `extension-opcode-id "erlang.OP_*"` resolves to the host ids the SX
+   stub dispatcher consults. Guarded: a double-register raises Failure,
+   which we swallow so a re-entered server process doesn't die. *)
+let () = try Erlang_ext.register () with Failure _ -> ()
+
 (* ====================================================================== *)
 (* Font measurement via otfm — reads OpenType/TrueType font tables         *)
 (* ====================================================================== *)
@@ -708,6 +722,139 @@ let setup_evaluator_bridge env =
     match args with
     | [e; expr] -> Sx_ref.eval_expr expr e
     | _ -> raise (Eval_error "eval-in-env: (env expr)"));
+
+  (* fed-sx Milestone 1 Step 8 transport. NATIVE ONLY — sockets +
+     threads; deliberately absent from the WASM kernel (registered
+     here in bin/, never in lib/sx_primitives.ml). Minimal HTTP/1.1,
+     Connection: close. handler : req-dict -> resp-dict where
+     req = {:method :path :query :headers :body},
+     resp = {:status :headers :body}. Never returns. *)
+  Sx_primitives.register "http-listen" (fun args ->
+    let strip_cr s =
+      let n = String.length s in
+      if n > 0 && s.[n - 1] = '\r' then String.sub s 0 (n - 1) else s
+    in
+    match args with
+    | [port_v; handler] ->
+      let port = match port_v with
+        | Integer n -> n
+        | Number f -> int_of_float f
+        | _ -> raise (Eval_error "http-listen: (port handler)") in
+      let sock = Unix.socket Unix.PF_INET Unix.SOCK_STREAM 0 in
+      Unix.setsockopt sock Unix.SO_REUSEADDR true;
+      Unix.bind sock
+        (Unix.ADDR_INET (Unix.inet_addr_loopback, port));
+      Unix.listen sock 64;
+      (* SX runtime is shared across threads — serialize handler calls. *)
+      let mtx = Mutex.create () in
+      let reason = function
+        | 200 -> "OK" | 201 -> "Created" | 204 -> "No Content"
+        | 301 -> "Moved Permanently" | 302 -> "Found"
+        | 400 -> "Bad Request" | 401 -> "Unauthorized"
+        | 403 -> "Forbidden" | 404 -> "Not Found"
+        | 405 -> "Method Not Allowed" | 500 -> "Internal Server Error"
+        | _ -> "OK" in
+      let handle fd =
+        (try
+          let ic = Unix.in_channel_of_descr fd in
+          let oc = Unix.out_channel_of_descr fd in
+          let reqline = strip_cr (input_line ic) in
+          (match String.split_on_char ' ' reqline with
+           | meth :: target :: _ ->
+             let path, query =
+               match String.index_opt target '?' with
+               | Some i ->
+                 String.sub target 0 i,
+                 String.sub target (i + 1)
+                   (String.length target - i - 1)
+               | None -> target, "" in
+             let headers = Sx_types.make_dict () in
+             let clen = ref 0 in
+             let rec rdh () =
+               let h = strip_cr (input_line ic) in
+               if h = "" then ()
+               else begin
+                 (match String.index_opt h ':' with
+                  | Some i ->
+                    let name =
+                      String.lowercase_ascii
+                        (String.trim (String.sub h 0 i)) in
+                    let value =
+                      String.trim
+                        (String.sub h (i + 1)
+                           (String.length h - i - 1)) in
+                    Hashtbl.replace headers name (String value);
+                    if name = "content-length" then
+                      (try clen := int_of_string value with _ -> ())
+                  | None -> ());
+                 rdh ()
+               end in
+             rdh ();
+             let body =
+               if !clen > 0 then begin
+                 let b = Bytes.create !clen in
+                 really_input ic b 0 !clen;
+                 Bytes.unsafe_to_string b
+               end else "" in
+             let req = Sx_types.make_dict () in
+             Hashtbl.replace req "method" (String meth);
+             Hashtbl.replace req "path" (String path);
+             Hashtbl.replace req "query" (String query);
+             Hashtbl.replace req "headers" (Dict headers);
+             Hashtbl.replace req "body" (String body);
+             Mutex.lock mtx;
+             let resp =
+               (try Sx_runtime.sx_call handler [Dict req]
+                with e -> Mutex.unlock mtx; raise e) in
+             Mutex.unlock mtx;
+             let getk k = match resp with
+               | Dict h -> Hashtbl.find_opt h k | _ -> None in
+             let status = match getk "status" with
+               | Some (Integer n) -> n
+               | Some (Number f) -> int_of_float f
+               | _ -> 200 in
+             let rbody = match getk "body" with
+               | Some (String s) -> s
+               | Some v -> Sx_types.value_to_string v
+               | None -> "" in
+             let rhdrs = match getk "headers" with
+               | Some (Dict h) ->
+                 Hashtbl.fold (fun k v acc ->
+                   (k, (match v with
+                        | String s -> s
+                        | v -> Sx_types.value_to_string v)) :: acc)
+                   h []
+               | _ -> [] in
+             let buf = Buffer.create 256 in
+             Buffer.add_string buf
+               (Printf.sprintf "HTTP/1.1 %d %s\r\n" status
+                  (reason status));
+             List.iter (fun (k, v) ->
+               Buffer.add_string buf
+                 (Printf.sprintf "%s: %s\r\n" k v)) rhdrs;
+             if not (List.exists
+                       (fun (k, _) ->
+                          String.lowercase_ascii k = "content-type")
+                       rhdrs)
+             then Buffer.add_string buf
+                 "Content-Type: text/plain\r\n";
+             Buffer.add_string buf
+               (Printf.sprintf "Content-Length: %d\r\n"
+                  (String.length rbody));
+             Buffer.add_string buf "Connection: close\r\n\r\n";
+             Buffer.add_string buf rbody;
+             output_string oc (Buffer.contents buf);
+             flush oc
+           | _ -> ())
+         with _ -> ());
+        (try Unix.close fd with _ -> ())
+      in
+      while true do
+        let fd, _ = Unix.accept sock in
+        ignore (Thread.create handle fd)
+      done;
+      Nil
+    | _ -> raise (Eval_error "http-listen: (port handler)"));
   bind "trampoline" (fun args ->
     match args with
     | [v] ->

hosts/ocaml/bin/test_http.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Phase H test — native-only http-listen primitive.
+# Starts sx_server with a tiny SX echo handler, drives it with curl
+# (GET / POST / 404 / custom header), asserts, then kills it.
+set -u
+cd "$(dirname "$0")/.."
+
+SRV=_build/default/bin/sx_server.exe
+PORT=${HTTP_TEST_PORT:-8911}
+PASS=0
+FAIL=0
+ok()  { echo "  PASS: $1"; PASS=$((PASS+1)); }
+bad() { echo "  FAIL: $1 — $2"; FAIL=$((FAIL+1)); }
+
+if [ ! -x "$SRV" ]; then
+  echo "build sx_server.exe first (dune build bin/sx_server.exe)"; exit 1
+fi
+
+H='(begin (define (h req) (if (= (get req "path") "/echo") {:status 200 :headers {"X-Echo" (get req "method")} :body (str "M=" (get req "method") " P=" (get req "path") " Q=" (get req "query") " B=" (get req "body"))} {:status 404 :body "nope"})) (http-listen '"$PORT"' h))'
+ESC=${H//\"/\\\"}
+
+{ printf '(epoch 1)\n(eval "%s")\n' "$ESC"; sleep 30; } | "$SRV" >/tmp/test_http_srv.out 2>&1 &
+SVPID=$!
+trap 'kill $SVPID 2>/dev/null; wait 2>/dev/null' EXIT
+
+up=0
+for _ in $(seq 1 50); do
+  curl -s -o /dev/null "http://127.0.0.1:$PORT/echo" 2>/dev/null && { up=1; break; }
+  sleep 0.2
+done
+[ "$up" = 1 ] || { echo "  FAIL: server did not start"; cat /tmp/test_http_srv.out; exit 1; }
+
+# GET with query + custom response header.
+g=$(curl -s -i "http://127.0.0.1:$PORT/echo?x=1" | tr -d '\r')
+echo "$g" | grep -q '^HTTP/1.1 200 OK'        && ok "GET status 200"          || bad "GET status" "$g"
+echo "$g" | grep -q '^X-Echo: GET'            && ok "GET custom header"       || bad "GET header" "$g"
+echo "$g" | grep -q '^M=GET P=/echo Q=x=1 B=$' && ok "GET echo body"          || bad "GET body" "$g"
+
+# POST with body.
+p=$(curl -s -X POST --data 'hello' "http://127.0.0.1:$PORT/echo")
+[ "$p" = 'M=POST P=/echo Q= B=hello' ] && ok "POST body echoed" || bad "POST body" "$p"
+
+# 404 path.
+n=$(curl -s -i "http://127.0.0.1:$PORT/missing" | tr -d '\r')
+echo "$n" | grep -q '^HTTP/1.1 404 Not Found' && ok "404 status" || bad "404 status" "$n"
+echo "$n" | grep -q '^nope$'                  && ok "404 body"   || bad "404 body" "$n"
+
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" = 0 ]

hosts/ocaml/browser/sx_browser.ml

@@ -676,7 +676,11 @@ let () =
   let rec deep_equal a b =
     match a, b with
     | Nil, Nil -> true | Bool a, Bool b -> a = b
-    | Number a, Number b -> a = b | String a, String b -> a = b
+    | Integer a, Integer b -> a = b
+    | Number a, Number b -> a = b
+    | Integer a, Number b -> float_of_int a = b
+    | Number a, Integer b -> a = float_of_int b
+    | String a, String b -> a = b
     | Symbol a, Symbol b -> a = b | Keyword a, Keyword b -> a = b
     | (List a | ListRef { contents = a }), (List b | ListRef { contents = b }) ->
       List.length a = List.length b && List.for_all2 deep_equal a b

hosts/ocaml/lib/dune

@@ -2,3 +2,7 @@
  (name sx)
  (wrapped false)
  (libraries re re.pcre unix))
+
+; Pull in extension modules from lib/extensions/ (test_ext.ml, etc).
+; See plans/sx-vm-opcode-extension.md.
+(include_subdirs unqualified)

hosts/ocaml/lib/extensions/README.md

@@ -0,0 +1,71 @@
+# SX VM extensions
+
+Each `*.ml` file here is a VM extension — a first-class OCaml module that
+registers specialized bytecode opcodes with `Sx_vm_extensions`. See
+[`plans/sx-vm-opcode-extension.md`](../../../../plans/sx-vm-opcode-extension.md)
+for the design.
+
+## Pattern
+
+```ocaml
+(* lib/extensions/myport.ml *)
+open Sx_types
+
+type Sx_vm_extension.extension_state += MyportState of { ... }
+
+module M : Sx_vm_extension.EXTENSION = struct
+  let name = "myport"
+  let init () = MyportState { ... }
+  let opcodes _st = [
+    (id, "myport.OP_NAME", handler);
+    ...
+  ]
+end
+
+let register () = Sx_vm_extensions.register (module M)
+```
+
+Then call `Myport.register ()` once at startup from any binary that
+should have the extension loaded.
+
+## Opcode-ID allocation
+
+Range 200-247 (per `Sx_vm_extensions.extension_min` /
+`extension_max`).  Conventions:
+
+| Range   | Use                                                                     |
+|---------|-------------------------------------------------------------------------|
+| 200-209 | reserved for `lib/guest/vm/` shared opcodes (chiselled out on 2nd use)  |
+| 210-219 | inline test extensions defined in `bin/run_tests.ml`                    |
+| 220-229 | this directory's `test_ext` (the canonical template)                    |
+| 230-247 | first-come-first-served by language ports (Erlang first)                |
+
+When a port claims a contiguous block, document it in the table above.
+The registry rejects collisions at startup with a loud error — there is
+no silent shadowing.
+
+## Naming
+
+Always prefix opcode names with the extension name plus a dot:
+`myport.OP_<NAME>`.  The prefix is a hard convention so that multiple
+extensions can share the global opcode-name namespace cleanly.
+
+## State
+
+`extension_state` is an extensible variant.  Add your case (e.g.
+`MyportState of { ... }`) at the top of your file, return it from
+`init`, and pattern-match it inside your handlers.  Other extensions
+cannot see your state — the variant case is private to your module.
+
+## Testing
+
+`test_ext.ml` is the canonical worked example.  `bin/run_tests.ml`
+calls `Test_ext.register ()`, then drives bytecode that exercises the
+opcodes end-to-end (push, double, dispatch, disassemble, invocation
+counter).  Mirror this shape when adding a real port's extension.
+
+## Build wiring
+
+`lib/dune` has `(include_subdirs unqualified)`, so any `.ml` you drop
+in here is automatically part of the `sx` library.  Module name follows
+the filename verbatim (`test_ext.ml` → `Test_ext`).

hosts/ocaml/lib/extensions/erlang_ext.ml

@@ -0,0 +1,278 @@
+(** {1 [erlang_ext] — Erlang-on-SX VM opcode extension (Phase 9h)}
+
+    Registers the Erlang opcode namespace in [Sx_vm_extensions] so that
+    [extension-opcode-id "erlang.OP_*"] resolves to a stable id. The SX
+    stub dispatcher in [lib/erlang/vm/dispatcher.sx] consults these ids
+    (Phase 9i) and falls back to its own local ids when the host
+    extension is absent.
+
+    Opcode ids occupy 222-239 in the extension partition (200-247).
+    222+ is chosen to clear the test extensions' reserved ids
+    (test_reg 210/211, test_ext 220/221) so all three coexist in
+    run_tests; production sx_server only registers this one. Names
+    mirror the SX stub dispatcher exactly:
+
+    - 222 erlang.OP_PATTERN_TUPLE      - 231 erlang.OP_BIF_HD
+    - 223 erlang.OP_PATTERN_LIST       - 232 erlang.OP_BIF_TL
+    - 224 erlang.OP_PATTERN_BINARY     - 233 erlang.OP_BIF_ELEMENT
+    - 225 erlang.OP_PERFORM            - 234 erlang.OP_BIF_TUPLE_SIZE
+    - 226 erlang.OP_HANDLE             - 235 erlang.OP_BIF_LISTS_REVERSE
+    - 227 erlang.OP_RECEIVE_SCAN       - 236 erlang.OP_BIF_IS_INTEGER
+    - 228 erlang.OP_SPAWN              - 237 erlang.OP_BIF_IS_ATOM
+    - 229 erlang.OP_SEND               - 238 erlang.OP_BIF_IS_LIST
+    - 230 erlang.OP_BIF_LENGTH         - 239 erlang.OP_BIF_IS_TUPLE
+
+    {2 Handler status}
+
+    The bytecode compiler does not yet emit these opcodes — Erlang
+    programs run through the general CEK path and the working
+    specialization path is the SX stub dispatcher. So every handler
+    here raises a descriptive [Eval_error] rather than silently
+    corrupting the VM stack. This keeps the extension honest: the
+    namespace is registered and disassembles by name, [extension-opcode-id]
+    works, but actually dispatching an opcode (which only happens once a
+    future phase teaches the compiler to emit them) fails loudly with a
+    pointer to the phase that will wire it. Real stack-machine handlers
+    land alongside compiler emission in a later phase. *)
+
+open Sx_types
+
+(** Per-instance state: invocation counter, purely to exercise the
+    [extension_state] machinery (mirrors [test_ext]). *)
+type Sx_vm_extension.extension_state += ErlangExtState of {
+  mutable dispatched : int;
+}
+
+let not_wired name =
+  raise (Eval_error
+    (Printf.sprintf
+       "%s: bytecode emission not yet wired (Phase 9j) — \
+        Erlang runs via CEK; specialization path is the SX stub \
+        dispatcher in lib/erlang/vm/dispatcher.sx"
+       name))
+
+module M : Sx_vm_extension.EXTENSION = struct
+  let name = "erlang"
+  let init () = ErlangExtState { dispatched = 0 }
+
+  let opcodes st =
+    let bump () = match st with
+      | ErlangExtState s -> s.dispatched <- s.dispatched + 1
+      | _ -> ()
+    in
+    let op id nm =
+      (id, nm, (fun (_vm : Sx_vm.vm) (_frame : Sx_vm.frame) ->
+        bump (); not_wired nm))
+    in
+    (* Phase 10b vertical slice: one REAL register-machine handler.
+       erlang.OP_BIF_LENGTH (230) — pops an Erlang list off the VM
+       stack and pushes its length. Proves the full path works:
+       extension-opcode-id -> bytecode -> Sx_vm dispatch fallthrough
+       -> this handler -> correct stack result. The remaining 17
+       opcodes still raise not_wired until their handlers + compiler
+       emission land. Erlang lists are tagged dicts:
+         nil  = {"tag" -> String "nil"}
+         cons = {"tag" -> String "cons"; "head" -> v; "tail" -> v} *)
+    let er_tag d =
+      match Hashtbl.find_opt d "tag" with
+      | Some (String s) -> s | _ -> ""
+    in
+    let op_bif_length =
+      (230, "erlang.OP_BIF_LENGTH",
+       (fun (vm : Sx_vm.vm) (_frame : Sx_vm.frame) ->
+         bump ();
+         let v = Sx_vm.pop vm in
+         let rec walk acc node =
+           match node with
+           | Dict d ->
+             (match er_tag d with
+              | "nil" -> acc
+              | "cons" ->
+                (match Hashtbl.find_opt d "tail" with
+                 | Some t -> walk (acc + 1) t
+                 | None -> raise (Eval_error
+                     "erlang.OP_BIF_LENGTH: cons cell without :tail"))
+              | _ -> raise (Eval_error
+                  "erlang.OP_BIF_LENGTH: not a proper list"))
+           | _ -> raise (Eval_error
+               "erlang.OP_BIF_LENGTH: not a proper list")
+         in
+         Sx_vm.push vm (Integer (walk 0 v))))
+    in
+    (* Phase 10b — simple hot-BIF handlers. Erlang bool is the atom
+       {"tag"->"atom"; "name"->"true"|"false"}; mk_atom builds it. *)
+    let mk_atom nm =
+      let h = Hashtbl.create 2 in
+      Hashtbl.replace h "tag" (String "atom");
+      Hashtbl.replace h "name" (String nm);
+      Dict h
+    in
+    let er_bool b = mk_atom (if b then "true" else "false") in
+    let is_tag v t = match v with
+      | Dict d -> er_tag d = t
+      | _ -> false
+    in
+    let op_bif_hd =
+      (231, "erlang.OP_BIF_HD",
+       (fun (vm : Sx_vm.vm) _f ->
+         bump ();
+         match Sx_vm.pop vm with
+         | Dict d when er_tag d = "cons" ->
+           (match Hashtbl.find_opt d "head" with
+            | Some h -> Sx_vm.push vm h
+            | None -> raise (Eval_error "erlang.OP_BIF_HD: cons without :head"))
+         | _ -> raise (Eval_error "erlang.OP_BIF_HD: not a cons")))
+    in
+    let op_bif_tl =
+      (232, "erlang.OP_BIF_TL",
+       (fun (vm : Sx_vm.vm) _f ->
+         bump ();
+         match Sx_vm.pop vm with
+         | Dict d when er_tag d = "cons" ->
+           (match Hashtbl.find_opt d "tail" with
+            | Some t -> Sx_vm.push vm t
+            | None -> raise (Eval_error "erlang.OP_BIF_TL: cons without :tail"))
+         | _ -> raise (Eval_error "erlang.OP_BIF_TL: not a cons")))
+    in
+    let op_bif_tuple_size =
+      (234, "erlang.OP_BIF_TUPLE_SIZE",
+       (fun (vm : Sx_vm.vm) _f ->
+         bump ();
+         match Sx_vm.pop vm with
+         | Dict d when er_tag d = "tuple" ->
+           let n = match Hashtbl.find_opt d "elements" with
+             | Some (List es) -> List.length es
+             | Some (ListRef r) -> List.length !r
+             | _ -> raise (Eval_error
+                 "erlang.OP_BIF_TUPLE_SIZE: tuple without :elements")
+           in
+           Sx_vm.push vm (Integer n)
+         | _ -> raise (Eval_error "erlang.OP_BIF_TUPLE_SIZE: not a tuple")))
+    in
+    let op_bif_is_integer =
+      (236, "erlang.OP_BIF_IS_INTEGER",
+       (fun (vm : Sx_vm.vm) _f ->
+         bump ();
+         let v = Sx_vm.pop vm in
+         Sx_vm.push vm (er_bool (match v with Integer _ -> true | _ -> false))))
+    in
+    let op_bif_is_atom =
+      (237, "erlang.OP_BIF_IS_ATOM",
+       (fun (vm : Sx_vm.vm) _f ->
+         bump ();
+         let v = Sx_vm.pop vm in
+         Sx_vm.push vm (er_bool (is_tag v "atom"))))
+    in
+    let op_bif_is_list =
+      (238, "erlang.OP_BIF_IS_LIST",
+       (fun (vm : Sx_vm.vm) _f ->
+         bump ();
+         let v = Sx_vm.pop vm in
+         Sx_vm.push vm (er_bool (is_tag v "cons" || is_tag v "nil"))))
+    in
+    let op_bif_is_tuple =
+      (239, "erlang.OP_BIF_IS_TUPLE",
+       (fun (vm : Sx_vm.vm) _f ->
+         bump ();
+         let v = Sx_vm.pop vm in
+         Sx_vm.push vm (er_bool (is_tag v "tuple"))))
+    in
+    (* element/2 and lists:reverse/1 — pure stack transforms (no
+       bytecode operands). Calling convention: args pushed left→right,
+       so element/2 stack is [.. Index Tuple] (Tuple on top). Erlang
+       element/2 is 1-indexed. *)
+    let op_bif_element =
+      (233, "erlang.OP_BIF_ELEMENT",
+       (fun (vm : Sx_vm.vm) _f ->
+         bump ();
+         let tup = Sx_vm.pop vm in
+         let idx = Sx_vm.pop vm in
+         match tup, idx with
+         | Dict d, Integer i when er_tag d = "tuple" ->
+           let es = match Hashtbl.find_opt d "elements" with
+             | Some (List es) -> es
+             | Some (ListRef r) -> !r
+             | _ -> raise (Eval_error
+                 "erlang.OP_BIF_ELEMENT: tuple without :elements")
+           in
+           let n = List.length es in
+           if i < 1 || i > n then
+             raise (Eval_error
+               (Printf.sprintf
+                  "erlang.OP_BIF_ELEMENT: index %d out of range 1..%d" i n))
+           else
+             Sx_vm.push vm (List.nth es (i - 1))
+         | _, Integer _ ->
+           raise (Eval_error "erlang.OP_BIF_ELEMENT: 2nd arg not a tuple")
+         | _ ->
+           raise (Eval_error "erlang.OP_BIF_ELEMENT: 1st arg not an integer")))
+    in
+    let op_bif_lists_reverse =
+      (235, "erlang.OP_BIF_LISTS_REVERSE",
+       (fun (vm : Sx_vm.vm) _f ->
+         bump ();
+         let v = Sx_vm.pop vm in
+         let mk_nil () =
+           let h = Hashtbl.create 1 in
+           Hashtbl.replace h "tag" (String "nil"); Dict h in
+         let mk_cons hd tl =
+           let h = Hashtbl.create 3 in
+           Hashtbl.replace h "tag" (String "cons");
+           Hashtbl.replace h "head" hd;
+           Hashtbl.replace h "tail" tl;
+           Dict h in
+         let rec rev acc node =
+           match node with
+           | Dict d ->
+             (match er_tag d with
+              | "nil" -> acc
+              | "cons" ->
+                let hd = match Hashtbl.find_opt d "head" with
+                  | Some x -> x
+                  | None -> raise (Eval_error
+                      "erlang.OP_BIF_LISTS_REVERSE: cons without :head") in
+                let tl = match Hashtbl.find_opt d "tail" with
+                  | Some x -> x
+                  | None -> raise (Eval_error
+                      "erlang.OP_BIF_LISTS_REVERSE: cons without :tail") in
+                rev (mk_cons hd acc) tl
+              | _ -> raise (Eval_error
+                  "erlang.OP_BIF_LISTS_REVERSE: not a proper list"))
+           | _ -> raise (Eval_error
+               "erlang.OP_BIF_LISTS_REVERSE: not a proper list")
+         in
+         Sx_vm.push vm (rev (mk_nil ()) v)))
+    in
+    [
+      op 222 "erlang.OP_PATTERN_TUPLE";
+      op 223 "erlang.OP_PATTERN_LIST";
+      op 224 "erlang.OP_PATTERN_BINARY";
+      op 225 "erlang.OP_PERFORM";
+      op 226 "erlang.OP_HANDLE";
+      op 227 "erlang.OP_RECEIVE_SCAN";
+      op 228 "erlang.OP_SPAWN";
+      op 229 "erlang.OP_SEND";
+      op_bif_length;
+      op_bif_hd;
+      op_bif_tl;
+      op_bif_element;
+      op_bif_tuple_size;
+      op_bif_lists_reverse;
+      op_bif_is_integer;
+      op_bif_is_atom;
+      op_bif_is_list;
+      op_bif_is_tuple;
+    ]
+end
+
+(** Register [erlang] in [Sx_vm_extensions]. Idempotent only by failing
+    loudly — calling twice raises [Failure]. sx_server calls this once
+    at startup. *)
+let register () = Sx_vm_extensions.register (module M : Sx_vm_extension.EXTENSION)
+
+(** Read the dispatch counter from the live registry state. [None] if
+    [register] hasn't run. *)
+let dispatch_count () =
+  match Sx_vm_extensions.state_of_extension "erlang" with
+  | Some (ErlangExtState s) -> Some s.dispatched
+  | _ -> None

hosts/ocaml/lib/extensions/test_ext.ml

@@ -0,0 +1,67 @@
+(** {1 [test_ext] — canonical example VM extension}
+
+    A minimal extension demonstrating the registration pattern from
+    [plans/sx-vm-opcode-extension.md].  The opcode IDs (220, 221) sit at
+    the top of the extension range, well clear of anything a real
+    language port would claim.
+
+    Two operand-less opcodes:
+
+    - [test_ext.OP_TEST_PUSH_42] (220) — pushes the integer 42.
+    - [test_ext.OP_TEST_DOUBLE_TOS] (221) — pops the integer on TOS,
+      pushes 2× it.
+
+    These are the smallest stack manipulations that prove the extension
+    mechanism wires through end-to-end (registry → dispatch → human-
+    readable disassembly).  Real ports (Erlang Phase 9, future Haskell
+    perf phases) replace this template with their own opcode set.
+
+    Loading: [Test_ext.register ()] adds the extension to
+    [Sx_vm_extensions].  Run-time binaries that want the test opcodes
+    available call this once at startup.  Unit tests in
+    [bin/run_tests.ml] do exactly that. *)
+
+open Sx_types
+
+(** Per-instance state for [test_ext].  Counts how many times the
+    handlers ran — purely so the extension has *some* state, exercising
+    the [extension_state] machinery. *)
+type Sx_vm_extension.extension_state += TestExtState of {
+  mutable invocations : int;
+}
+
+module M : Sx_vm_extension.EXTENSION = struct
+  let name = "test_ext"
+  let init () = TestExtState { invocations = 0 }
+
+  let opcodes st =
+    let bump () = match st with
+      | TestExtState s -> s.invocations <- s.invocations + 1
+      | _ -> ()
+    in
+    [
+      (220, "test_ext.OP_TEST_PUSH_42",
+       (fun vm _frame -> bump (); Sx_vm.push vm (Integer 42)));
+
+      (221, "test_ext.OP_TEST_DOUBLE_TOS",
+       (fun vm _frame ->
+         bump ();
+         let v = Sx_vm.pop vm in
+         match v with
+         | Integer n -> Sx_vm.push vm (Integer (n * 2))
+         | _ -> raise (Eval_error
+             "test_ext.OP_TEST_DOUBLE_TOS: TOS is not an integer")));
+    ]
+end
+
+(** Register [test_ext] in [Sx_vm_extensions].  Idempotent only by
+    failing loudly — calling twice raises [Failure].  Binaries call this
+    once at startup; tests may [_reset_for_tests] then re-register. *)
+let register () = Sx_vm_extensions.register (module M : Sx_vm_extension.EXTENSION)
+
+(** Read the invocation counter from the live registry state.  Returns
+    [None] if [register] hasn't been called yet. *)
+let invocation_count () =
+  match Sx_vm_extensions.state_of_extension "test_ext" with
+  | Some (TestExtState s) -> Some s.invocations
+  | _ -> None

hosts/ocaml/lib/sx_cbor.ml

@@ -0,0 +1,142 @@
+(** dag-cbor encode / decode — pure OCaml, WASM-safe.
+
+    RFC 8949 deterministic subset as constrained by IPLD dag-cbor
+    (RFC 8742): unsigned/negative ints, text strings, arrays, maps
+    with keys sorted by **length-then-bytewise**, bool, null, and
+    tag 42 (CID link, decode-side passthrough). Floats are not
+    supported (no fed-sx shape needs them yet) — encoding a [Number]
+    or decoding a float head raises. Reference: RFC 8949 §3, §4.2. *)
+
+open Sx_types
+
+exception Cbor_error of string
+
+(* ---- Encoder ---- *)
+
+let write_head buf major v =
+  let m = major lsl 5 in
+  if v < 24 then
+    Buffer.add_char buf (Char.chr (m lor v))
+  else if v < 0x100 then begin
+    Buffer.add_char buf (Char.chr (m lor 24));
+    Buffer.add_char buf (Char.chr v)
+  end else if v < 0x10000 then begin
+    Buffer.add_char buf (Char.chr (m lor 25));
+    Buffer.add_char buf (Char.chr ((v lsr 8) land 0xFF));
+    Buffer.add_char buf (Char.chr (v land 0xFF))
+  end else if v < 0x100000000 then begin
+    Buffer.add_char buf (Char.chr (m lor 26));
+    for i = 3 downto 0 do
+      Buffer.add_char buf (Char.chr ((v lsr (8 * i)) land 0xFF))
+    done
+  end else begin
+    Buffer.add_char buf (Char.chr (m lor 27));
+    for i = 7 downto 0 do
+      Buffer.add_char buf (Char.chr ((v lsr (8 * i)) land 0xFF))
+    done
+  end
+
+(* dag-cbor map key order: shorter key first, then bytewise. *)
+let key_order a b =
+  let la = String.length a and lb = String.length b in
+  if la <> lb then compare la lb else compare a b
+
+let rec encode_into buf (v : value) : unit =
+  match v with
+  | Integer n ->
+    if n >= 0 then write_head buf 0 n
+    else write_head buf 1 (-1 - n)
+  | String s ->
+    write_head buf 3 (String.length s);
+    Buffer.add_string buf s
+  | Symbol s | Keyword s ->
+    write_head buf 3 (String.length s);
+    Buffer.add_string buf s
+  | Bool false -> Buffer.add_char buf '\xf4'
+  | Bool true  -> Buffer.add_char buf '\xf5'
+  | Nil        -> Buffer.add_char buf '\xf6'
+  | List items ->
+    write_head buf 4 (List.length items);
+    List.iter (encode_into buf) items
+  | Dict d ->
+    let keys = Hashtbl.fold (fun k _ acc -> k :: acc) d [] in
+    let keys = List.sort_uniq key_order keys in
+    write_head buf 5 (List.length keys);
+    List.iter (fun k ->
+      write_head buf 3 (String.length k);
+      Buffer.add_string buf k;
+      encode_into buf (Hashtbl.find d k)) keys
+  | Number _ ->
+    raise (Cbor_error "cbor-encode: floats unsupported (dag-cbor subset)")
+  | _ ->
+    raise (Cbor_error
+             ("cbor-encode: unencodable value " ^ type_of v))
+
+let encode (v : value) : string =
+  let buf = Buffer.create 64 in
+  encode_into buf v;
+  Buffer.contents buf
+
+(* ---- Decoder ---- *)
+
+let decode (s : string) : value =
+  let pos = ref 0 in
+  let len = String.length s in
+  let byte () =
+    if !pos >= len then raise (Cbor_error "cbor-decode: truncated");
+    let c = Char.code s.[!pos] in incr pos; c
+  in
+  let read_uint ai =
+    if ai < 24 then ai
+    else if ai = 24 then byte ()
+    else if ai = 25 then let a = byte () in let b = byte () in (a lsl 8) lor b
+    else if ai = 26 then begin
+      let v = ref 0 in
+      for _ = 0 to 3 do v := (!v lsl 8) lor byte () done; !v
+    end else if ai = 27 then begin
+      let v = ref 0 in
+      for _ = 0 to 7 do v := (!v lsl 8) lor byte () done; !v
+    end else raise (Cbor_error "cbor-decode: bad additional info")
+  in
+  let read_bytes n =
+    if !pos + n > len then raise (Cbor_error "cbor-decode: truncated");
+    let r = String.sub s !pos n in pos := !pos + n; r
+  in
+  let rec item () =
+    let b = byte () in
+    let major = b lsr 5 and ai = b land 0x1f in
+    match major with
+    | 0 -> Integer (read_uint ai)
+    | 1 -> Integer (-1 - read_uint ai)
+    | 2 -> String (read_bytes (read_uint ai))
+    | 3 -> String (read_bytes (read_uint ai))
+    | 4 ->
+      let n = read_uint ai in
+      List (List.init n (fun _ -> item ()))
+    | 5 ->
+      let n = read_uint ai in
+      let d = make_dict () in
+      for _ = 1 to n do
+        let k = match item () with
+          | String k -> k
+          | _ -> raise (Cbor_error "cbor-decode: non-string map key")
+        in
+        Hashtbl.replace d k (item ())
+      done;
+      Dict d
+    | 6 ->
+      (* Tag: tag-42 CID link → pass the inner item through. *)
+      ignore (read_uint ai); item ()
+    | 7 ->
+      (match ai with
+       | 20 -> Bool false
+       | 21 -> Bool true
+       | 22 -> Nil
+       | 23 -> Nil
+       | _ ->
+         raise (Cbor_error
+                  "cbor-decode: floats/simple unsupported (dag-cbor subset)"))
+    | _ -> raise (Cbor_error "cbor-decode: bad major type")
+  in
+  let v = item () in
+  v

hosts/ocaml/lib/sx_cid.ml

@@ -0,0 +1,66 @@
+(** CIDv1 computation — pure OCaml, WASM-safe.
+
+    Multihash + CIDv1 + multibase base32-lower (RFC 4648, no pad,
+    multibase prefix 'b'). Codecs: dag-cbor 0x71, raw 0x55. Hash
+    codes: sha2-256 0x12, sha3-256 0x16. Reference: the multiformats
+    specs (unsigned-varint, multihash, cid, multibase). No deps. *)
+
+open Sx_types
+
+(* Unsigned LEB128 (multiformats unsigned-varint). *)
+let varint (n : int) : string =
+  let buf = Buffer.create 4 in
+  let n = ref n in
+  let cont = ref true in
+  while !cont do
+    let b = !n land 0x7f in
+    n := !n lsr 7;
+    if !n = 0 then (Buffer.add_char buf (Char.chr b); cont := false)
+    else Buffer.add_char buf (Char.chr (b lor 0x80))
+  done;
+  Buffer.contents buf
+
+(* RFC 4648 base32 lowercase, no padding. *)
+let b32_alpha = "abcdefghijklmnopqrstuvwxyz234567"
+
+let base32_lower (s : string) : string =
+  let buf = Buffer.create ((String.length s * 8 + 4) / 5) in
+  let acc = ref 0 and bits = ref 0 in
+  String.iter (fun c ->
+    acc := (!acc lsl 8) lor (Char.code c);
+    bits := !bits + 8;
+    while !bits >= 5 do
+      bits := !bits - 5;
+      Buffer.add_char buf b32_alpha.[(!acc lsr !bits) land 0x1f]
+    done) s;
+  if !bits > 0 then
+    Buffer.add_char buf b32_alpha.[(!acc lsl (5 - !bits)) land 0x1f];
+  Buffer.contents buf
+
+(* "abef" -> the 2 raw bytes. *)
+let unhex (h : string) : string =
+  let n = String.length h / 2 in
+  let b = Bytes.create n in
+  for i = 0 to n - 1 do
+    Bytes.set b i
+      (Char.chr (int_of_string ("0x" ^ String.sub h (2 * i) 2)))
+  done;
+  Bytes.unsafe_to_string b
+
+(* multihash = varint(code) || varint(len) || digest *)
+let multihash (code : int) (digest : string) : string =
+  varint code ^ varint (String.length digest) ^ digest
+
+(* CIDv1 = 0x01 || varint(codec) || multihash ; multibase 'b' base32. *)
+let cidv1 (codec : int) (mh : string) : string =
+  "b" ^ base32_lower ("\x01" ^ varint codec ^ mh)
+
+let codec_dag_cbor = 0x71
+let mh_sha2_256 = 0x12
+
+(* Canonicalize an SX value: dag-cbor encode -> sha2-256 ->
+   multihash -> CIDv1 (dag-cbor codec). *)
+let cid_from_sx (v : value) : string =
+  let cbor = Sx_cbor.encode v in
+  let digest = unhex (Sx_sha2.sha256_hex cbor) in
+  cidv1 codec_dag_cbor (multihash mh_sha2_256 digest)

hosts/ocaml/lib/sx_ed25519.ml

@@ -0,0 +1,289 @@
+(** Ed25519 signature verification — pure OCaml, WASM-safe.
+
+    RFC 8032 §5.1.7 cofactorless verify over edwards25519. Includes a
+    minimal arbitrary-precision unsigned bignum (no Zarith / no deps)
+    and twisted-Edwards extended-coordinate point arithmetic. Verify
+    is total: malformed inputs return [false], never raise. SHA-512
+    is reused from {!Sx_sha2}. Reference: RFC 8032, RFC 7748. *)
+
+(* ---- Minimal bignum: int array, little-endian, base 2^26. ---- *)
+
+let bits = 26
+let base = 1 lsl bits
+let mask = base - 1
+
+type bn = int array  (* normalized: no high zero limbs, length >= 1 *)
+
+let norm (a : bn) : bn =
+  let n = ref (Array.length a) in
+  while !n > 1 && a.(!n - 1) = 0 do decr n done;
+  if !n = Array.length a then a else Array.sub a 0 !n
+
+let bzero : bn = [| 0 |]
+let of_int n : bn =
+  if n = 0 then bzero
+  else begin
+    let r = ref [] and n = ref n in
+    while !n > 0 do r := (!n land mask) :: !r; n := !n lsr bits done;
+    norm (Array.of_list (List.rev !r))
+  end
+
+let is_zero (a : bn) = Array.length a = 1 && a.(0) = 0
+
+let cmp (a : bn) (b : bn) : int =
+  let a = norm a and b = norm b in
+  let la = Array.length a and lb = Array.length b in
+  if la <> lb then compare la lb
+  else begin
+    let r = ref 0 and i = ref (la - 1) in
+    while !r = 0 && !i >= 0 do
+      if a.(!i) <> b.(!i) then r := compare a.(!i) b.(!i);
+      decr i
+    done; !r
+  end
+
+let add (a : bn) (b : bn) : bn =
+  let la = Array.length a and lb = Array.length b in
+  let n = (max la lb) + 1 in
+  let r = Array.make n 0 in
+  let carry = ref 0 in
+  for i = 0 to n - 1 do
+    let s = !carry
+            + (if i < la then a.(i) else 0)
+            + (if i < lb then b.(i) else 0) in
+    r.(i) <- s land mask; carry := s lsr bits
+  done;
+  norm r
+
+(* a - b, requires a >= b *)
+let sub (a : bn) (b : bn) : bn =
+  let la = Array.length a and lb = Array.length b in
+  let r = Array.make la 0 in
+  let borrow = ref 0 in
+  for i = 0 to la - 1 do
+    let s = a.(i) - !borrow - (if i < lb then b.(i) else 0) in
+    if s < 0 then (r.(i) <- s + base; borrow := 1)
+    else (r.(i) <- s; borrow := 0)
+  done;
+  norm r
+
+let mul (a : bn) (b : bn) : bn =
+  let la = Array.length a and lb = Array.length b in
+  let r = Array.make (la + lb) 0 in
+  for i = 0 to la - 1 do
+    let carry = ref 0 in
+    for j = 0 to lb - 1 do
+      let s = r.(i + j) + a.(i) * b.(j) + !carry in
+      r.(i + j) <- s land mask; carry := s lsr bits
+    done;
+    r.(i + lb) <- r.(i + lb) + !carry
+  done;
+  norm r
+
+let numbits (a : bn) : int =
+  let a = norm a in
+  let hi = Array.length a - 1 in
+  if hi = 0 && a.(0) = 0 then 0
+  else begin
+    let b = ref 0 and v = ref a.(hi) in
+    while !v > 0 do incr b; v := !v lsr 1 done;
+    hi * bits + !b
+  end
+
+let bit (a : bn) (i : int) : int =
+  let limb = i / bits and off = i mod bits in
+  if limb >= Array.length a then 0 else (a.(limb) lsr off) land 1
+
+(* r = a mod m  (m > 0), binary long division. *)
+let bn_mod (a : bn) (m : bn) : bn =
+  if cmp a m < 0 then norm a
+  else begin
+    let r = ref bzero in
+    for i = numbits a - 1 downto 0 do
+      (* r = r*2 + bit *)
+      r := add !r !r;
+      if bit a i = 1 then r := add !r [| 1 |];
+      if cmp !r m >= 0 then r := sub !r m
+    done;
+    !r
+  end
+
+let div_small (a : bn) (d : int) : bn =
+  let la = Array.length a in
+  let q = Array.make la 0 in
+  let rem = ref 0 in
+  for i = la - 1 downto 0 do
+    let cur = (!rem lsl bits) lor a.(i) in
+    q.(i) <- cur / d; rem := cur mod d
+  done;
+  norm q
+
+let powmod (b0 : bn) (e : bn) (m : bn) : bn =
+  let result = ref [| 1 |] and b = ref (bn_mod b0 m) in
+  let nb = numbits e in
+  for i = 0 to nb - 1 do
+    if bit e i = 1 then result := bn_mod (mul !result !b) m;
+    b := bn_mod (mul !b !b) m
+  done;
+  !result
+
+let of_bytes_le (s : string) : bn =
+  let acc = ref bzero in
+  for i = String.length s - 1 downto 0 do
+    acc := add (mul !acc (of_int 256)) (of_int (Char.code s.[i]))
+  done;
+  !acc
+
+let to_bytes_le (a : bn) (n : int) : string =
+  let b = Bytes.make n '\000' in
+  let cur = ref (norm a) in
+  for i = 0 to n - 1 do
+    let q = div_small !cur 256 in
+    let r =
+      let qm = mul q (of_int 256) in
+      let d = sub !cur qm in
+      if is_zero d then 0 else d.(0)
+    in
+    Bytes.set b i (Char.chr r);
+    cur := q
+  done;
+  Bytes.unsafe_to_string b
+
+(* ---- Field GF(p), p = 2^255 - 19 ---- *)
+
+let p =
+  let twop255 = Array.make 11 0 in   (* 11*26 = 286 > 255 *)
+  let limb = 255 / bits and off = 255 mod bits in
+  twop255.(limb) <- 1 lsl off;
+  sub (norm twop255) (of_int 19)
+
+let fmod a = bn_mod a p
+let fadd a b = fmod (add a b)
+let fsub a b = fmod (add a (sub p (fmod b)))
+let fmul a b = fmod (mul a b)
+let fpow a e = powmod a e p
+let finv a = fpow a (sub p (of_int 2))   (* Fermat: a^(p-2) *)
+
+(* group order L = 2^252 + 27742317777372353535851937790883648493 *)
+let ell =
+  of_bytes_le
+    "\xed\xd3\xf5\x5c\x1a\x63\x12\x58\xd6\x9c\xf7\xa2\xde\xf9\xde\x14\
+     \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10"
+
+(* d = -121665 / 121666 mod p *)
+let dconst =
+  let inv666 = finv (of_int 121666) in
+  fmod (mul (fsub (of_int 0) (of_int 121665)) inv666)
+
+(* sqrt(-1) = 2^((p-1)/4) mod p *)
+let sqrtm1 = fpow (of_int 2) (div_small (sub p (of_int 1)) 4)
+
+(* ---- edwards25519 points in extended coords (X,Y,Z,T) ---- *)
+
+type pt = { x : bn; y : bn; z : bn; t : bn }
+
+let identity = { x = bzero; y = of_int 1; z = of_int 1; t = bzero }
+
+(* add-2008-hwcd-3, complete for a = -1 on ed25519 *)
+let padd (p1 : pt) (p2 : pt) : pt =
+  let a = fmul (fsub p1.y p1.x) (fsub p2.y p2.x) in
+  let b = fmul (fadd p1.y p1.x) (fadd p2.y p2.x) in
+  let c = fmul (fmul p1.t (fmul (of_int 2) dconst)) p2.t in
+  let dd = fmul (fmul p1.z (of_int 2)) p2.z in
+  let e = fsub b a in
+  let f = fsub dd c in
+  let g = fadd dd c in
+  let h = fadd b a in
+  { x = fmul e f; y = fmul g h; t = fmul e h; z = fmul f g }
+
+let scalar_mul (n : bn) (q : pt) : pt =
+  let r = ref identity in
+  for i = numbits n - 1 downto 0 do
+    r := padd !r !r;
+    if bit n i = 1 then r := padd !r q
+  done;
+  !r
+
+let pnegate (q : pt) : pt =
+  { q with x = fsub (of_int 0) q.x; t = fsub (of_int 0) q.t }
+
+(* Decompress a 32-byte little-endian point encoding. *)
+let decompress (s : string) : pt option =
+  if String.length s <> 32 then None
+  else begin
+    let sign = (Char.code s.[31] lsr 7) land 1 in
+    let s' = Bytes.of_string s in
+    Bytes.set s' 31 (Char.chr (Char.code s.[31] land 0x7f));
+    let y = of_bytes_le (Bytes.unsafe_to_string s') in
+    if cmp y p >= 0 then None
+    else begin
+      let y2 = fmul y y in
+      let u = fsub y2 (of_int 1) in
+      let v = fadd (fmul dconst y2) (of_int 1) in
+      (* x = u v^3 (u v^7)^((p-5)/8) *)
+      let v3 = fmul (fmul v v) v in
+      let v7 = fmul (fmul v3 v3) v in
+      let exp = div_small (sub p (of_int 5)) 8 in
+      let x0 = fmul (fmul u v3) (fpow (fmul u v7) exp) in
+      let vx2 = fmul v (fmul x0 x0) in
+      let x =
+        if cmp vx2 u = 0 then Some x0
+        else if cmp vx2 (fsub (of_int 0) u) = 0 then Some (fmul x0 sqrtm1)
+        else None
+      in
+      match x with
+      | None -> None
+      | Some x ->
+        if is_zero x && sign = 1 then None
+        else begin
+          let x = if (bit x 0) <> sign then fsub (of_int 0) x else x in
+          Some { x; y; z = of_int 1; t = fmul x y }
+        end
+    end
+  end
+
+(* Encode a point to 32-byte little-endian (y with x-parity bit). *)
+let encode (q : pt) : string =
+  let zi = finv q.z in
+  let x = fmul q.x zi and y = fmul q.y zi in
+  let b = Bytes.of_string (to_bytes_le y 32) in
+  let last = Char.code (Bytes.get b 31) lor ((bit x 0) lsl 7) in
+  Bytes.set b 31 (Char.chr last);
+  Bytes.unsafe_to_string b
+
+(* base point: y = 4/5 mod p, x even (sign 0). *)
+let base_point =
+  let by = fmul (of_int 4) (finv (of_int 5)) in
+  match decompress (to_bytes_le by 32) with
+  | Some pt -> pt
+  | None -> failwith "ed25519: base point decompress failed"
+
+let unhex (h : string) : string =
+  let n = String.length h / 2 in
+  let b = Bytes.create n in
+  for i = 0 to n - 1 do
+    Bytes.set b i
+      (Char.chr (int_of_string ("0x" ^ String.sub h (2 * i) 2)))
+  done;
+  Bytes.unsafe_to_string b
+
+let sha512_bytes s = unhex (Sx_sha2.sha512_hex s)
+
+(* RFC 8032 §5.1.7 cofactorless: encode([S]B - [k]A) == R. *)
+let verify ~pubkey ~msg ~sig_ : bool =
+  if String.length pubkey <> 32 || String.length sig_ <> 64 then false
+  else
+    let rb = String.sub sig_ 0 32 in
+    let sb = String.sub sig_ 32 32 in
+    let s = of_bytes_le sb in
+    if cmp s ell >= 0 then false
+    else
+      match decompress pubkey with
+      | None -> false
+      | Some a ->
+        let h = sha512_bytes (rb ^ pubkey ^ msg) in
+        let k = bn_mod (of_bytes_le h) ell in
+        let sb_pt = scalar_mul s base_point in
+        let ka = scalar_mul k a in
+        let chk = padd sb_pt (pnegate ka) in
+        (try encode chk = rb with _ -> false)

hosts/ocaml/lib/sx_primitives.ml

@@ -528,6 +528,183 @@ let () =
     | [Rational (_, d)] -> Integer d
     | [Integer _]       -> Integer 1
     | _ -> raise (Eval_error "denominator: expected rational or integer"));
+  (* printf-spec: apply one Tcl/printf format spec to one arg.
+     spec is like "%5.2f", "%-10s", "%x", "%c", "%d". Always starts with %
+     and ends with the conversion char.  Supports d i u x X o c s f e g.
+     Coerces arg to the right type per conversion. *)
+  register "printf-spec" (fun args ->
+    let spec_str, arg = match args with
+      | [String s; v] -> (s, v)
+      | _ -> raise (Eval_error "printf-spec: (spec arg)")
+    in
+    let n = String.length spec_str in
+    if n < 2 || spec_str.[0] <> '%' then
+      raise (Eval_error ("printf-spec: invalid spec " ^ spec_str));
+    let type_char = spec_str.[n - 1] in
+    let to_int v = match v with
+      | Integer i -> i
+      | Number f -> int_of_float f
+      | String s ->
+        let s = String.trim s in
+        (try int_of_string s
+         with _ ->
+           try int_of_float (float_of_string s)
+           with _ -> 0)
+      | Bool true -> 1 | Bool false -> 0
+      | _ -> 0
+    in
+    let to_float v = match v with
+      | Number f -> f
+      | Integer i -> float_of_int i
+      | String s ->
+        let s = String.trim s in
+        (try float_of_string s with _ -> 0.0)
+      | _ -> 0.0
+    in
+    let to_string v = match v with
+      | String s -> s
+      | Integer i -> string_of_int i
+      | Number f -> Sx_types.format_number f
+      | Bool true -> "1" | Bool false -> "0"
+      | Nil -> ""
+      | _ -> Sx_types.inspect v
+    in
+    try
+      match type_char with
+      | 'd' | 'i' ->
+        let fmt = Scanf.format_from_string spec_str "%d" in
+        String (Printf.sprintf fmt (to_int arg))
+      | 'u' ->
+        let fmt = Scanf.format_from_string spec_str "%u" in
+        String (Printf.sprintf fmt (to_int arg))
+      | 'x' ->
+        let fmt = Scanf.format_from_string spec_str "%x" in
+        String (Printf.sprintf fmt (to_int arg))
+      | 'X' ->
+        let fmt = Scanf.format_from_string spec_str "%X" in
+        String (Printf.sprintf fmt (to_int arg))
+      | 'o' ->
+        let fmt = Scanf.format_from_string spec_str "%o" in
+        String (Printf.sprintf fmt (to_int arg))
+      | 'c' ->
+        let n_val = to_int arg in
+        let body = String.sub spec_str 0 (n - 1) in
+        let fmt = Scanf.format_from_string (body ^ "s") "%s" in
+        String (Printf.sprintf fmt (String.make 1 (Char.chr (n_val land 0xff))))
+      | 's' ->
+        let fmt = Scanf.format_from_string spec_str "%s" in
+        String (Printf.sprintf fmt (to_string arg))
+      | 'f' ->
+        let fmt = Scanf.format_from_string spec_str "%f" in
+        String (Printf.sprintf fmt (to_float arg))
+      | 'e' ->
+        let fmt = Scanf.format_from_string spec_str "%e" in
+        String (Printf.sprintf fmt (to_float arg))
+      | 'E' ->
+        let fmt = Scanf.format_from_string spec_str "%E" in
+        String (Printf.sprintf fmt (to_float arg))
+      | 'g' ->
+        let fmt = Scanf.format_from_string spec_str "%g" in
+        String (Printf.sprintf fmt (to_float arg))
+      | 'G' ->
+        let fmt = Scanf.format_from_string spec_str "%G" in
+        String (Printf.sprintf fmt (to_float arg))
+      | _ -> raise (Eval_error ("printf-spec: unsupported conversion " ^ String.make 1 type_char))
+    with
+    | Eval_error _ as e -> raise e
+    | _ -> raise (Eval_error ("printf-spec: invalid format " ^ spec_str)));
+
+  (* scan-spec: apply one Tcl/scanf format spec to a string.
+     Returns (consumed-count . parsed-value), or nil on failure. *)
+  register "scan-spec" (fun args ->
+    let spec_str, str = match args with
+      | [String s; String input] -> (s, input)
+      | _ -> raise (Eval_error "scan-spec: (spec input)")
+    in
+    let n = String.length spec_str in
+    if n < 2 || spec_str.[0] <> '%' then
+      raise (Eval_error ("scan-spec: invalid spec " ^ spec_str));
+    let type_char = spec_str.[n - 1] in
+    let len = String.length str in
+    (* skip leading whitespace for non-%c/%s conversions *)
+    let i = ref 0 in
+    if type_char <> 'c' then
+      while !i < len && (str.[!i] = ' ' || str.[!i] = '\t' || str.[!i] = '\n') do incr i done;
+    let start = !i in
+    try
+      match type_char with
+      | 'd' | 'i' ->
+        let j = ref !i in
+        if !j < len && (str.[!j] = '-' || str.[!j] = '+') then incr j;
+        while !j < len && str.[!j] >= '0' && str.[!j] <= '9' do incr j done;
+        if !j > start && (str.[start] >= '0' && str.[start] <= '9'
+                         || (!j > start + 1 && (str.[start] = '-' || str.[start] = '+'))) then
+          let n_val = int_of_string (String.sub str start (!j - start)) in
+          let d = Hashtbl.create 2 in
+          Hashtbl.replace d "value" (Integer n_val);
+          Hashtbl.replace d "consumed" (Integer !j);
+          Dict d
+        else Nil
+      | 'x' | 'X' ->
+        let j = ref !i in
+        while !j < len &&
+              ((str.[!j] >= '0' && str.[!j] <= '9') ||
+               (str.[!j] >= 'a' && str.[!j] <= 'f') ||
+               (str.[!j] >= 'A' && str.[!j] <= 'F')) do incr j done;
+        if !j > start then
+          let n_val = int_of_string ("0x" ^ String.sub str start (!j - start)) in
+          let d = Hashtbl.create 2 in
+          Hashtbl.replace d "value" (Integer n_val);
+          Hashtbl.replace d "consumed" (Integer !j);
+          Dict d
+        else Nil
+      | 'o' ->
+        let j = ref !i in
+        while !j < len && str.[!j] >= '0' && str.[!j] <= '7' do incr j done;
+        if !j > start then
+          let n_val = int_of_string ("0o" ^ String.sub str start (!j - start)) in
+          let d = Hashtbl.create 2 in
+          Hashtbl.replace d "value" (Integer n_val);
+          Hashtbl.replace d "consumed" (Integer !j);
+          Dict d
+        else Nil
+      | 'f' | 'e' | 'g' ->
+        let j = ref !i in
+        if !j < len && (str.[!j] = '-' || str.[!j] = '+') then incr j;
+        while !j < len && ((str.[!j] >= '0' && str.[!j] <= '9') || str.[!j] = '.') do incr j done;
+        if !j < len && (str.[!j] = 'e' || str.[!j] = 'E') then begin
+          incr j;
+          if !j < len && (str.[!j] = '-' || str.[!j] = '+') then incr j;
+          while !j < len && str.[!j] >= '0' && str.[!j] <= '9' do incr j done
+        end;
+        if !j > start then
+          let f_val = float_of_string (String.sub str start (!j - start)) in
+          let d = Hashtbl.create 2 in
+          Hashtbl.replace d "value" (Number f_val);
+          Hashtbl.replace d "consumed" (Integer !j);
+          Dict d
+        else Nil
+      | 's' ->
+        let j = ref !i in
+        while !j < len && str.[!j] <> ' ' && str.[!j] <> '\t' && str.[!j] <> '\n' do incr j done;
+        if !j > start then
+          let d = Hashtbl.create 2 in
+          Hashtbl.replace d "value" (String (String.sub str start (!j - start)));
+          Hashtbl.replace d "consumed" (Integer !j);
+          Dict d
+        else Nil
+      | 'c' ->
+        if !i < len then
+          let d = Hashtbl.create 2 in
+          Hashtbl.replace d "value" (Integer (Char.code str.[!i]));
+          Hashtbl.replace d "consumed" (Integer (!i + 1));
+          Dict d
+        else Nil
+      | _ -> raise (Eval_error ("scan-spec: unsupported conversion " ^ String.make 1 type_char))
+    with
+    | Eval_error _ as e -> raise e
+    | _ -> Nil);
+
   register "parse-int" (fun args ->
     let parse_leading_int s =
       let len = String.length s in
@@ -582,11 +759,22 @@ let () =
       (List lb | ListRef { contents = lb }) ->
       List.length la = List.length lb &&
       List.for_all2 safe_eq la lb
-    (* Dict: check __host_handle for DOM node identity *)
+    (* Dict: __host_handle identity for DOM-wrapped dicts; otherwise
+       structural equality over keys + values. *)
     | Dict a, Dict b ->
       (match Hashtbl.find_opt a "__host_handle", Hashtbl.find_opt b "__host_handle" with
        | Some (Number ha), Some (Number hb) -> ha = hb
-       | _ -> false)
+       | Some _, _ | _, Some _ -> false
+       | None, None ->
+         Hashtbl.length a = Hashtbl.length b &&
+         (let eq = ref true in
+          Hashtbl.iter (fun k v ->
+            if !eq then
+              match Hashtbl.find_opt b k with
+              | Some v' -> if not (safe_eq v v') then eq := false
+              | None -> eq := false
+          ) a;
+          !eq))
     (* Records: same type + structurally equal fields *)
     | Record a, Record b ->
       a.r_type.rt_uid = b.r_type.rt_uid &&
@@ -3049,6 +3237,21 @@ let () =
       with Sys_error msg -> raise (Eval_error ("file-read: " ^ msg)))
     | _ -> raise (Eval_error "file-read: (path)"));
 
+  (* fed-sx Step 3 segment replay. Sorted names, no "."/".." ;
+     errors prefixed like file-read (msg carries enoent/enotdir). *)
+  register "file-list-dir" (fun args ->
+    match args with
+    | [String path] ->
+      (try
+        let names = Sys.readdir path in
+        let names =
+          Array.to_list names
+          |> List.filter (fun n -> n <> "." && n <> "..") in
+        let names = List.sort compare names in
+        List (List.map (fun n -> String n) names)
+      with Sys_error msg -> raise (Eval_error ("file-list-dir: " ^ msg)))
+    | _ -> raise (Eval_error "file-list-dir: (path)"));
+
   register "file-write" (fun args ->
     match args with
     | [String path; String content] ->
@@ -3399,6 +3602,204 @@ let () =
       Nil
     | _ -> raise (Eval_error "channel-set-blocking!: (channel bool)"));
 
+  (* === Exec === run an external process; capture stdout *)
+  register "exec-process" (fun args ->
+    let items = match args with
+      | [List xs] | [ListRef { contents = xs }] -> xs
+      | _ -> raise (Eval_error "exec-process: (cmd-list)")
+    in
+    let argv = Array.of_list (List.map (function
+      | String s -> s
+      | v -> Sx_types.inspect v
+    ) items) in
+    if Array.length argv = 0 then raise (Eval_error "exec: empty command");
+    let (out_r, out_w) = Unix.pipe () in
+    let (err_r, err_w) = Unix.pipe () in
+    let pid =
+      try Unix.create_process argv.(0) argv Unix.stdin out_w err_w
+      with Unix.Unix_error (e, _, _) ->
+        Unix.close out_r; Unix.close out_w;
+        Unix.close err_r; Unix.close err_w;
+        raise (Eval_error ("exec: " ^ Unix.error_message e))
+    in
+    Unix.close out_w;
+    Unix.close err_w;
+    let buf = Buffer.create 256 in
+    let errbuf = Buffer.create 64 in
+    let chunk = Bytes.create 4096 in
+    let read_all fd target =
+      try
+        let stop = ref false in
+        while not !stop do
+          let n = Unix.read fd chunk 0 (Bytes.length chunk) in
+          if n = 0 then stop := true
+          else Buffer.add_subbytes target chunk 0 n
+        done
+      with _ -> ()
+    in
+    read_all out_r buf;
+    read_all err_r errbuf;
+    Unix.close out_r;
+    Unix.close err_r;
+    let (_, status) = Unix.waitpid [] pid in
+    let exit_code = match status with
+      | Unix.WEXITED n -> n
+      | Unix.WSIGNALED _ | Unix.WSTOPPED _ -> 1
+    in
+    let s = Buffer.contents buf in
+    let trimmed =
+      if String.length s > 0 && s.[String.length s - 1] = '\n'
+      then String.sub s 0 (String.length s - 1) else s
+    in
+    if exit_code <> 0 then
+      raise (Eval_error ("exec: child exited " ^ string_of_int exit_code
+                         ^ (if Buffer.length errbuf > 0
+                            then ": " ^ Buffer.contents errbuf
+                            else "")))
+    else String trimmed);
+
+  (* exec-pipeline: takes a list of words like Tcl `exec` would receive.
+     Recognizes `|` as a stage separator and `> file`, `>> file`, `< file`,
+     `2>@1` (stderr→stdout), `2> file`. Returns trimmed stdout of the last
+     stage; raises Eval_error if the last stage exits non-zero. *)
+  register "exec-pipeline" (fun args ->
+    let items = match args with
+      | [List xs] | [ListRef { contents = xs }] -> xs
+      | _ -> raise (Eval_error "exec-pipeline: (word-list)")
+    in
+    let words = List.map (function
+      | String s -> s
+      | v -> Sx_types.inspect v
+    ) items in
+    if words = [] then raise (Eval_error "exec: empty command");
+    let split_stages ws =
+      let rec loop acc cur = function
+        | [] -> List.rev (List.rev cur :: acc)
+        | "|" :: rest -> loop (List.rev cur :: acc) [] rest
+        | w :: rest -> loop acc (w :: cur) rest
+      in
+      loop [] [] ws
+    in
+    let extract_redirs ws =
+      let in_path = ref None in
+      let out_path = ref None in
+      let out_append = ref false in
+      let err_path = ref None in
+      let merge_err = ref false in
+      let cleaned = ref [] in
+      let rec loop = function
+        | [] -> ()
+        | "<" :: p :: rest -> in_path := Some p; loop rest
+        | ">" :: p :: rest -> out_path := Some p; out_append := false; loop rest
+        | ">>" :: p :: rest -> out_path := Some p; out_append := true; loop rest
+        | "2>@1" :: rest -> merge_err := true; loop rest
+        | "2>" :: p :: rest -> err_path := Some p; loop rest
+        | w :: rest -> cleaned := w :: !cleaned; loop rest
+      in
+      loop ws;
+      (List.rev !cleaned, !in_path, !out_path, !out_append, !err_path, !merge_err)
+    in
+    let stages = List.map extract_redirs (split_stages words) in
+    if stages = [] then raise (Eval_error "exec: no stages");
+    let n = List.length stages in
+    let pipes = Array.init (max 0 (n - 1)) (fun _ -> Unix.pipe ()) in
+    let (final_r, final_w) = Unix.pipe () in
+    let (errstash_r, errstash_w) = Unix.pipe () in
+    let pids = ref [] in
+    let close_safe fd = try Unix.close fd with _ -> () in
+    let open_in_redir = function
+      | None -> Unix.stdin
+      | Some path ->
+        (try Unix.openfile path [Unix.O_RDONLY] 0o644
+         with Unix.Unix_error (e, _, _) ->
+           raise (Eval_error ("exec: open <" ^ path ^ ": " ^ Unix.error_message e)))
+    in
+    let open_out_redir path append =
+      let flags = Unix.O_WRONLY :: Unix.O_CREAT :: (if append then [Unix.O_APPEND] else [Unix.O_TRUNC]) in
+      try Unix.openfile path flags 0o644
+      with Unix.Unix_error (e, _, _) ->
+        raise (Eval_error ("exec: open >" ^ path ^ ": " ^ Unix.error_message e))
+    in
+    let stages_arr = Array.of_list stages in
+    (try
+      Array.iteri (fun i (cleaned, ip, op, app, ep, merge) ->
+        if cleaned = [] then raise (Eval_error "exec: empty stage in pipeline");
+        let argv = Array.of_list cleaned in
+        let stdin_fd =
+          if i = 0 then open_in_redir ip
+          else fst pipes.(i - 1)
+        in
+        let stdout_fd =
+          if i = n - 1 then
+            (match op with
+             | None -> final_w
+             | Some path -> open_out_redir path app)
+          else snd pipes.(i)
+        in
+        let stderr_fd =
+          if merge then stdout_fd
+          else (match ep with
+                | None -> if i = n - 1 then errstash_w else Unix.stderr
+                | Some path -> open_out_redir path false)
+        in
+        let pid =
+          try Unix.create_process argv.(0) argv stdin_fd stdout_fd stderr_fd
+          with Unix.Unix_error (e, _, _) ->
+            raise (Eval_error ("exec: " ^ argv.(0) ^ ": " ^ Unix.error_message e))
+        in
+        pids := pid :: !pids;
+        if i > 0 then close_safe (fst pipes.(i - 1));
+        if i < n - 1 then close_safe (snd pipes.(i));
+        if i = 0 && ip <> None then close_safe stdin_fd;
+        if i = n - 1 && op <> None then close_safe stdout_fd;
+        if not merge && ep <> None then close_safe stderr_fd
+      ) stages_arr
+    with e ->
+      close_safe final_r; close_safe final_w;
+      close_safe errstash_r; close_safe errstash_w;
+      Array.iter (fun (a,b) -> close_safe a; close_safe b) pipes;
+      raise e);
+    close_safe final_w;
+    close_safe errstash_w;
+    let buf = Buffer.create 256 in
+    let errbuf = Buffer.create 64 in
+    let chunk = Bytes.create 4096 in
+    let read_all fd target =
+      try
+        let stop = ref false in
+        while not !stop do
+          let r = Unix.read fd chunk 0 (Bytes.length chunk) in
+          if r = 0 then stop := true
+          else Buffer.add_subbytes target chunk 0 r
+        done
+      with _ -> ()
+    in
+    read_all final_r buf;
+    read_all errstash_r errbuf;
+    close_safe final_r;
+    close_safe errstash_r;
+    let exit_codes = List.rev_map (fun pid ->
+      let (_, st) = Unix.waitpid [] pid in
+      match st with
+      | Unix.WEXITED c -> c
+      | _ -> 1
+    ) !pids in
+    let final_code = match List.rev exit_codes with
+      | [] -> 0
+      | last :: _ -> last
+    in
+    let s = Buffer.contents buf in
+    let trimmed =
+      if String.length s > 0 && s.[String.length s - 1] = '\n'
+      then String.sub s 0 (String.length s - 1) else s
+    in
+    if final_code <> 0 then
+      raise (Eval_error ("exec: pipeline last stage exited " ^ string_of_int final_code
+                         ^ (if Buffer.length errbuf > 0
+                            then ": " ^ Buffer.contents errbuf
+                            else "")))
+    else String trimmed);
+
   (* === Sockets === wrapping Unix.socket/connect/bind/listen/accept *)
   let resolve_inet_addr host =
     if host = "" || host = "0.0.0.0" then Unix.inet_addr_any
@@ -3734,4 +4135,99 @@ let () =
         | k :: v :: rest -> ignore (env_bind child (value_to_string k) v); add_bindings rest
         | [_] -> raise (Eval_error "env-extend: odd number of key-val pairs") in
       add_bindings pairs;
-      Env child)
+      Env child);
+
+  (* JIT cache control & observability — backed by refs in sx_types.ml to
+     avoid creating a sx_primitives → sx_vm dependency cycle. sx_vm reads
+     these refs to decide when to JIT. *)
+  register "jit-stats" (fun _args ->
+    let d = Hashtbl.create 8 in
+    Hashtbl.replace d "threshold"        (Number (float_of_int !Sx_types.jit_threshold));
+    Hashtbl.replace d "budget"           (Number (float_of_int !Sx_types.jit_budget));
+    Hashtbl.replace d "cache-size"       (Number (float_of_int (Sx_types.jit_cache_size ())));
+    Hashtbl.replace d "compiled"         (Number (float_of_int !Sx_types.jit_compiled_count));
+    Hashtbl.replace d "compile-failed"   (Number (float_of_int !Sx_types.jit_skipped_count));
+    Hashtbl.replace d "below-threshold"  (Number (float_of_int !Sx_types.jit_threshold_skipped_count));
+    Hashtbl.replace d "evicted"          (Number (float_of_int !Sx_types.jit_evicted_count));
+    Dict d);
+  register "jit-set-threshold!" (fun args ->
+    match args with
+    | [Number n] -> Sx_types.jit_threshold := int_of_float n; Nil
+    | [Integer n] -> Sx_types.jit_threshold := n; Nil
+    | _ -> raise (Eval_error "jit-set-threshold!: (n) where n is integer"));
+  register "jit-set-budget!" (fun args ->
+    match args with
+    | [Number n] -> Sx_types.jit_budget := int_of_float n; Nil
+    | [Integer n] -> Sx_types.jit_budget := n; Nil
+    | _ -> raise (Eval_error "jit-set-budget!: (n) where n is integer"));
+  register "jit-reset-cache!" (fun _args ->
+    (* Phase 3 manual cache reset — clear all compiled VmClosures.
+       Hot paths will re-JIT on next call (after re-hitting threshold). *)
+    Queue.iter (fun (_, v) ->
+      match v with Lambda l -> l.l_compiled <- None | _ -> ()
+    ) Sx_types.jit_cache_queue;
+    Queue.clear Sx_types.jit_cache_queue;
+    Nil);
+  register "jit-reset-counters!" (fun _args ->
+    Sx_types.jit_compiled_count := 0;
+    Sx_types.jit_skipped_count := 0;
+    Sx_types.jit_threshold_skipped_count := 0;
+    Sx_types.jit_evicted_count := 0;
+    Nil);
+
+  (* fed-sx host primitives — pure-OCaml crypto (WASM-safe). *)
+  register "crypto-sha256" (fun args ->
+    match args with
+    | [String s] -> String (Sx_sha2.sha256_hex s)
+    | _ -> raise (Eval_error "crypto-sha256: (bytes)"));
+
+  register "crypto-sha512" (fun args ->
+    match args with
+    | [String s] -> String (Sx_sha2.sha512_hex s)
+    | _ -> raise (Eval_error "crypto-sha512: (bytes)"));
+
+  register "crypto-sha3-256" (fun args ->
+    match args with
+    | [String s] -> String (Sx_sha3.sha3_256_hex s)
+    | _ -> raise (Eval_error "crypto-sha3-256: (bytes)"));
+
+  register "cbor-encode" (fun args ->
+    match args with
+    | [v] ->
+      (try String (Sx_cbor.encode v)
+       with Sx_cbor.Cbor_error m -> raise (Eval_error m))
+    | _ -> raise (Eval_error "cbor-encode: (value)"));
+
+  register "cbor-decode" (fun args ->
+    match args with
+    | [String s] ->
+      (try Sx_cbor.decode s
+       with Sx_cbor.Cbor_error m -> raise (Eval_error m))
+    | _ -> raise (Eval_error "cbor-decode: (bytes)"));
+
+  register "cid-from-bytes" (fun args ->
+    match args with
+    | [Integer codec; String mh] ->
+      String (Sx_cid.cidv1 codec mh)
+    | _ -> raise (Eval_error "cid-from-bytes: (codec multihash-bytes)"));
+
+  register "cid-from-sx" (fun args ->
+    match args with
+    | [v] ->
+      (try String (Sx_cid.cid_from_sx v)
+       with Sx_cbor.Cbor_error m -> raise (Eval_error m))
+    | _ -> raise (Eval_error "cid-from-sx: (value)"));
+
+  (* Verify is total: any malformed input -> false, never raises. *)
+  register "ed25519-verify" (fun args ->
+    match args with
+    | [String pk; String msg; String sg] ->
+      Bool (try Sx_ed25519.verify ~pubkey:pk ~msg ~sig_:sg
+            with _ -> false)
+    | _ -> Bool false);
+
+  register "rsa-sha256-verify" (fun args ->
+    match args with
+    | [String spki; String msg; String sg] ->
+      Bool (try Sx_rsa.verify ~spki ~msg ~sig_:sg with _ -> false)
+    | _ -> Bool false)

hosts/ocaml/lib/sx_rsa.ml

@@ -0,0 +1,220 @@
+(** RSASSA-PKCS1-v1_5 verification with SHA-256 — pure OCaml,
+    WASM-safe. Self-contained minimal bignum (modexp only), a tiny
+    DER reader for SubjectPublicKeyInfo, and the fixed SHA-256
+    DigestInfo prefix. Verify only on public data — constant time
+    not required. Reference: RFC 8017 §8.2.2, §9.2. No deps. *)
+
+(* ---- Minimal unsigned bignum: int array, little-endian, base 2^26 ---- *)
+
+let bits = 26
+let base = 1 lsl bits
+let mask = base - 1
+
+type bn = int array
+
+let norm a =
+  let n = ref (Array.length a) in
+  while !n > 1 && a.(!n - 1) = 0 do decr n done;
+  if !n = Array.length a then a else Array.sub a 0 !n
+
+let bzero : bn = [| 0 |]
+let is_zero a = Array.length a = 1 && a.(0) = 0
+
+let cmp a b =
+  let a = norm a and b = norm b in
+  let la = Array.length a and lb = Array.length b in
+  if la <> lb then compare la lb
+  else begin
+    let r = ref 0 and i = ref (la - 1) in
+    while !r = 0 && !i >= 0 do
+      if a.(!i) <> b.(!i) then r := compare a.(!i) b.(!i);
+      decr i
+    done; !r
+  end
+
+let add a b =
+  let la = Array.length a and lb = Array.length b in
+  let n = (max la lb) + 1 in
+  let r = Array.make n 0 and carry = ref 0 in
+  for i = 0 to n - 1 do
+    let s = !carry + (if i < la then a.(i) else 0)
+            + (if i < lb then b.(i) else 0) in
+    r.(i) <- s land mask; carry := s lsr bits
+  done;
+  norm r
+
+let sub a b =                       (* requires a >= b *)
+  let la = Array.length a and lb = Array.length b in
+  let r = Array.make la 0 and borrow = ref 0 in
+  for i = 0 to la - 1 do
+    let s = a.(i) - !borrow - (if i < lb then b.(i) else 0) in
+    if s < 0 then (r.(i) <- s + base; borrow := 1)
+    else (r.(i) <- s; borrow := 0)
+  done;
+  norm r
+
+let mul a b =
+  let la = Array.length a and lb = Array.length b in
+  let r = Array.make (la + lb) 0 in
+  for i = 0 to la - 1 do
+    let carry = ref 0 in
+    for j = 0 to lb - 1 do
+      let s = r.(i + j) + a.(i) * b.(j) + !carry in
+      r.(i + j) <- s land mask; carry := s lsr bits
+    done;
+    r.(i + lb) <- r.(i + lb) + !carry
+  done;
+  norm r
+
+let numbits a =
+  let a = norm a in
+  let hi = Array.length a - 1 in
+  if hi = 0 && a.(0) = 0 then 0
+  else begin
+    let b = ref 0 and v = ref a.(hi) in
+    while !v > 0 do incr b; v := !v lsr 1 done;
+    hi * bits + !b
+  end
+
+let bit a i =
+  let limb = i / bits and off = i mod bits in
+  if limb >= Array.length a then 0 else (a.(limb) lsr off) land 1
+
+let bn_mod a m =                    (* binary long division, m > 0 *)
+  if cmp a m < 0 then norm a
+  else begin
+    let r = ref bzero in
+    for i = numbits a - 1 downto 0 do
+      r := add !r !r;
+      if bit a i = 1 then r := add !r [| 1 |];
+      if cmp !r m >= 0 then r := sub !r m
+    done;
+    !r
+  end
+
+let powmod b0 e m =
+  let result = ref [| 1 |] and b = ref (bn_mod b0 m) in
+  for i = 0 to numbits e - 1 do
+    if bit e i = 1 then result := bn_mod (mul !result !b) m;
+    b := bn_mod (mul !b !b) m
+  done;
+  !result
+
+let of_bytes_be (s : string) : bn =
+  let acc = ref bzero in
+  for i = 0 to String.length s - 1 do
+    acc := add (mul !acc [| 256 |]) [| Char.code s.[i] |]
+  done;
+  !acc
+
+let div_small a d =
+  let la = Array.length a in
+  let q = Array.make la 0 and rem = ref 0 in
+  for i = la - 1 downto 0 do
+    let cur = (!rem lsl bits) lor a.(i) in
+    q.(i) <- cur / d; rem := cur mod d
+  done;
+  norm q
+
+let to_bytes_be (a : bn) (n : int) : string =
+  let b = Bytes.make n '\000' in
+  let cur = ref (norm a) in
+  for i = n - 1 downto 0 do
+    let q = div_small !cur 256 in
+    let r =
+      let d = sub !cur (mul q [| 256 |]) in
+      if is_zero d then 0 else d.(0)
+    in
+    Bytes.set b i (Char.chr r);
+    cur := q
+  done;
+  Bytes.unsafe_to_string b
+
+(* ---- Minimal DER reader (for SubjectPublicKeyInfo) ---- *)
+
+exception Der of string
+
+(* Returns (tag, content_start, content_len, next). *)
+let der_tlv s pos =
+  if pos + 2 > String.length s then raise (Der "short");
+  let tag = Char.code s.[pos] in
+  let l0 = Char.code s.[pos + 1] in
+  let len, hdr =
+    if l0 < 0x80 then l0, 2
+    else begin
+      let nb = l0 land 0x7f in
+      if pos + 2 + nb > String.length s then raise (Der "short len");
+      let v = ref 0 in
+      for i = 0 to nb - 1 do
+        v := (!v lsl 8) lor Char.code s.[pos + 2 + i]
+      done;
+      !v, 2 + nb
+    end
+  in
+  (tag, pos + hdr, len, pos + hdr + len)
+
+(* SPKI DER -> (n, e) as bignums. *)
+let parse_spki (der : string) : bn * bn =
+  let tag, c, _l, _ = der_tlv der 0 in
+  if tag <> 0x30 then raise (Der "spki: outer not SEQUENCE");
+  (* AlgorithmIdentifier SEQUENCE — skip. *)
+  let _, _, _, after_alg = der_tlv der c in
+  (* BIT STRING. *)
+  let bt, bc, bl, _ = der_tlv der after_alg in
+  if bt <> 0x03 then raise (Der "spki: expected BIT STRING");
+  (* First content byte = unused bits (must be 0). *)
+  let rpk_start = bc + 1 in
+  ignore bl;
+  let st, sc, _, _ = der_tlv der rpk_start in
+  if st <> 0x30 then raise (Der "spki: RSAPublicKey not SEQUENCE");
+  let nt, nc, nl, after_n = der_tlv der sc in
+  if nt <> 0x02 then raise (Der "spki: modulus not INTEGER");
+  let et, ec, el, _ = der_tlv der after_n in
+  if et <> 0x02 then raise (Der "spki: exponent not INTEGER");
+  let n = of_bytes_be (String.sub der nc nl) in
+  let e = of_bytes_be (String.sub der ec el) in
+  (n, e)
+
+(* SHA-256 DigestInfo DER prefix (RFC 8017 §9.2 note 1). *)
+let sha256_digestinfo_prefix =
+  "\x30\x31\x30\x0d\x06\x09\x60\x86\x48\x01\x65\x03\x04\x02\x01\x05\x00\x04\x20"
+
+let unhex h =
+  let n = String.length h / 2 in
+  let b = Bytes.create n in
+  for i = 0 to n - 1 do
+    Bytes.set b i (Char.chr (int_of_string ("0x" ^ String.sub h (2 * i) 2)))
+  done;
+  Bytes.unsafe_to_string b
+
+(* RSASSA-PKCS1-v1_5 verify with SHA-256. Total: any malformed
+   input yields false (caller wraps, but be defensive here too). *)
+let verify ~spki ~msg ~sig_ : bool =
+  try
+    let n, e = parse_spki spki in
+    let k = (numbits n + 7) / 8 in
+    if String.length sig_ <> k then false
+    else begin
+      let s = of_bytes_be sig_ in
+      if cmp s n >= 0 then false
+      else begin
+        let m = powmod s e n in
+        let em = to_bytes_be m k in
+        (* EM = 0x00 01 FF..FF 00 || DigestInfo || H *)
+        let h = unhex (Sx_sha2.sha256_hex msg) in
+        let t = sha256_digestinfo_prefix ^ h in
+        let tlen = String.length t in
+        if k < tlen + 11 then false
+        else begin
+          let ok = ref (em.[0] = '\x00' && em.[1] = '\x01') in
+          let ps_end = k - tlen - 1 in
+          for i = 2 to ps_end - 1 do
+            if em.[i] <> '\xff' then ok := false
+          done;
+          if em.[ps_end] <> '\x00' then ok := false;
+          if String.sub em (ps_end + 1) tlen <> t then ok := false;
+          !ok
+        end
+      end
+    end
+  with _ -> false

hosts/ocaml/lib/sx_sha2.ml

@@ -0,0 +1,212 @@
+(** SHA-2 (SHA-256, SHA-512) — pure OCaml, WASM-safe.
+
+    No C stubs, no external deps. Used by the fed-sx host primitives
+    [crypto-sha256] / [crypto-sha512]. Reference: FIPS 180-4. *)
+
+(* ---- SHA-256 (FIPS 180-4 §6.2). 32-bit words held in native int,
+   masked to 32 bits after every arithmetic op. ---- *)
+
+let mask32 = 0xFFFFFFFF
+
+let k256 = [|
+  0x428a2f98; 0x71374491; 0xb5c0fbcf; 0xe9b5dba5;
+  0x3956c25b; 0x59f111f1; 0x923f82a4; 0xab1c5ed5;
+  0xd807aa98; 0x12835b01; 0x243185be; 0x550c7dc3;
+  0x72be5d74; 0x80deb1fe; 0x9bdc06a7; 0xc19bf174;
+  0xe49b69c1; 0xefbe4786; 0x0fc19dc6; 0x240ca1cc;
+  0x2de92c6f; 0x4a7484aa; 0x5cb0a9dc; 0x76f988da;
+  0x983e5152; 0xa831c66d; 0xb00327c8; 0xbf597fc7;
+  0xc6e00bf3; 0xd5a79147; 0x06ca6351; 0x14292967;
+  0x27b70a85; 0x2e1b2138; 0x4d2c6dfc; 0x53380d13;
+  0x650a7354; 0x766a0abb; 0x81c2c92e; 0x92722c85;
+  0xa2bfe8a1; 0xa81a664b; 0xc24b8b70; 0xc76c51a3;
+  0xd192e819; 0xd6990624; 0xf40e3585; 0x106aa070;
+  0x19a4c116; 0x1e376c08; 0x2748774c; 0x34b0bcb5;
+  0x391c0cb3; 0x4ed8aa4a; 0x5b9cca4f; 0x682e6ff3;
+  0x748f82ee; 0x78a5636f; 0x84c87814; 0x8cc70208;
+  0x90befffa; 0xa4506ceb; 0xbef9a3f7; 0xc67178f2 |]
+
+let rotr32 x n = ((x lsr n) lor (x lsl (32 - n))) land mask32
+
+let sha256_hex (msg : string) : string =
+  let h = [| 0x6a09e667; 0xbb67ae85; 0x3c6ef372; 0xa54ff53a;
+             0x510e527f; 0x9b05688c; 0x1f83d9ab; 0x5be0cd19 |] in
+  let len = String.length msg in
+  (* Padded length: multiple of 64 bytes. *)
+  let bitlen = len * 8 in
+  let padlen =
+    let r = (len + 1) mod 64 in
+    if r <= 56 then 56 - r else 120 - r
+  in
+  let total = len + 1 + padlen + 8 in
+  let buf = Bytes.make total '\000' in
+  Bytes.blit_string msg 0 buf 0 len;
+  Bytes.set buf len '\x80';
+  (* 64-bit big-endian bit length (we cap at OCaml int range). *)
+  for i = 0 to 7 do
+    Bytes.set buf (total - 1 - i)
+      (Char.chr ((bitlen lsr (8 * i)) land 0xFF))
+  done;
+  let w = Array.make 64 0 in
+  let nblocks = total / 64 in
+  for b = 0 to nblocks - 1 do
+    let base = b * 64 in
+    for t = 0 to 15 do
+      let o = base + t * 4 in
+      w.(t) <-
+        (Char.code (Bytes.get buf o) lsl 24)
+        lor (Char.code (Bytes.get buf (o + 1)) lsl 16)
+        lor (Char.code (Bytes.get buf (o + 2)) lsl 8)
+        lor (Char.code (Bytes.get buf (o + 3)))
+    done;
+    for t = 16 to 63 do
+      let s0 =
+        (rotr32 w.(t - 15) 7) lxor (rotr32 w.(t - 15) 18)
+        lxor (w.(t - 15) lsr 3) in
+      let s1 =
+        (rotr32 w.(t - 2) 17) lxor (rotr32 w.(t - 2) 19)
+        lxor (w.(t - 2) lsr 10) in
+      w.(t) <- (w.(t - 16) + s0 + w.(t - 7) + s1) land mask32
+    done;
+    let a = ref h.(0) and bb = ref h.(1) and c = ref h.(2)
+    and d = ref h.(3) and e = ref h.(4) and f = ref h.(5)
+    and g = ref h.(6) and hh = ref h.(7) in
+    for t = 0 to 63 do
+      let s1 =
+        (rotr32 !e 6) lxor (rotr32 !e 11) lxor (rotr32 !e 25) in
+      let ch = (!e land !f) lxor ((lnot !e land mask32) land !g) in
+      let t1 = (!hh + s1 + ch + k256.(t) + w.(t)) land mask32 in
+      let s0 =
+        (rotr32 !a 2) lxor (rotr32 !a 13) lxor (rotr32 !a 22) in
+      let maj = (!a land !bb) lxor (!a land !c) lxor (!bb land !c) in
+      let t2 = (s0 + maj) land mask32 in
+      hh := !g; g := !f; f := !e;
+      e := (!d + t1) land mask32;
+      d := !c; c := !bb; bb := !a;
+      a := (t1 + t2) land mask32
+    done;
+    h.(0) <- (h.(0) + !a) land mask32;
+    h.(1) <- (h.(1) + !bb) land mask32;
+    h.(2) <- (h.(2) + !c) land mask32;
+    h.(3) <- (h.(3) + !d) land mask32;
+    h.(4) <- (h.(4) + !e) land mask32;
+    h.(5) <- (h.(5) + !f) land mask32;
+    h.(6) <- (h.(6) + !g) land mask32;
+    h.(7) <- (h.(7) + !hh) land mask32
+  done;
+  let out = Buffer.create 64 in
+  Array.iter (fun x -> Buffer.add_string out (Printf.sprintf "%08x" x)) h;
+  Buffer.contents out
+
+(* ---- SHA-512 (FIPS 180-4 §6.4). 64-bit words via Int64.
+   128-bit length append; we only support messages whose bit length
+   fits in 64 bits (high word is always zero). ---- *)
+
+let k512 = [|
+  0x428a2f98d728ae22L; 0x7137449123ef65cdL; 0xb5c0fbcfec4d3b2fL;
+  0xe9b5dba58189dbbcL; 0x3956c25bf348b538L; 0x59f111f1b605d019L;
+  0x923f82a4af194f9bL; 0xab1c5ed5da6d8118L; 0xd807aa98a3030242L;
+  0x12835b0145706fbeL; 0x243185be4ee4b28cL; 0x550c7dc3d5ffb4e2L;
+  0x72be5d74f27b896fL; 0x80deb1fe3b1696b1L; 0x9bdc06a725c71235L;
+  0xc19bf174cf692694L; 0xe49b69c19ef14ad2L; 0xefbe4786384f25e3L;
+  0x0fc19dc68b8cd5b5L; 0x240ca1cc77ac9c65L; 0x2de92c6f592b0275L;
+  0x4a7484aa6ea6e483L; 0x5cb0a9dcbd41fbd4L; 0x76f988da831153b5L;
+  0x983e5152ee66dfabL; 0xa831c66d2db43210L; 0xb00327c898fb213fL;
+  0xbf597fc7beef0ee4L; 0xc6e00bf33da88fc2L; 0xd5a79147930aa725L;
+  0x06ca6351e003826fL; 0x142929670a0e6e70L; 0x27b70a8546d22ffcL;
+  0x2e1b21385c26c926L; 0x4d2c6dfc5ac42aedL; 0x53380d139d95b3dfL;
+  0x650a73548baf63deL; 0x766a0abb3c77b2a8L; 0x81c2c92e47edaee6L;
+  0x92722c851482353bL; 0xa2bfe8a14cf10364L; 0xa81a664bbc423001L;
+  0xc24b8b70d0f89791L; 0xc76c51a30654be30L; 0xd192e819d6ef5218L;
+  0xd69906245565a910L; 0xf40e35855771202aL; 0x106aa07032bbd1b8L;
+  0x19a4c116b8d2d0c8L; 0x1e376c085141ab53L; 0x2748774cdf8eeb99L;
+  0x34b0bcb5e19b48a8L; 0x391c0cb3c5c95a63L; 0x4ed8aa4ae3418acbL;
+  0x5b9cca4f7763e373L; 0x682e6ff3d6b2b8a3L; 0x748f82ee5defb2fcL;
+  0x78a5636f43172f60L; 0x84c87814a1f0ab72L; 0x8cc702081a6439ecL;
+  0x90befffa23631e28L; 0xa4506cebde82bde9L; 0xbef9a3f7b2c67915L;
+  0xc67178f2e372532bL; 0xca273eceea26619cL; 0xd186b8c721c0c207L;
+  0xeada7dd6cde0eb1eL; 0xf57d4f7fee6ed178L; 0x06f067aa72176fbaL;
+  0x0a637dc5a2c898a6L; 0x113f9804bef90daeL; 0x1b710b35131c471bL;
+  0x28db77f523047d84L; 0x32caab7b40c72493L; 0x3c9ebe0a15c9bebcL;
+  0x431d67c49c100d4cL; 0x4cc5d4becb3e42b6L; 0x597f299cfc657e2aL;
+  0x5fcb6fab3ad6faecL; 0x6c44198c4a475817L |]
+
+let ( &: ) = Int64.logand
+let ( |: ) = Int64.logor
+let ( ^: ) = Int64.logxor
+let ( +: ) = Int64.add
+let lnot64 = Int64.lognot
+
+let rotr64 x n =
+  (Int64.shift_right_logical x n) |: (Int64.shift_left x (64 - n))
+
+let sha512_hex (msg : string) : string =
+  let h = [| 0x6a09e667f3bcc908L; 0xbb67ae8584caa73bL;
+             0x3c6ef372fe94f82bL; 0xa54ff53a5f1d36f1L;
+             0x510e527fade682d1L; 0x9b05688c2b3e6c1fL;
+             0x1f83d9abfb41bd6bL; 0x5be0cd19137e2179L |] in
+  let len = String.length msg in
+  let bitlen = len * 8 in
+  (* Pad to a multiple of 128 bytes; 16-byte big-endian length. *)
+  let padlen =
+    let r = (len + 1) mod 128 in
+    if r <= 112 then 112 - r else 240 - r
+  in
+  let total = len + 1 + padlen + 16 in
+  let buf = Bytes.make total '\000' in
+  Bytes.blit_string msg 0 buf 0 len;
+  Bytes.set buf len '\x80';
+  for i = 0 to 7 do
+    Bytes.set buf (total - 1 - i)
+      (Char.chr ((bitlen lsr (8 * i)) land 0xFF))
+  done;
+  let w = Array.make 80 0L in
+  let nblocks = total / 128 in
+  for b = 0 to nblocks - 1 do
+    let base = b * 128 in
+    for t = 0 to 15 do
+      let o = base + t * 8 in
+      let v = ref 0L in
+      for j = 0 to 7 do
+        v := Int64.logor (Int64.shift_left !v 8)
+               (Int64.of_int (Char.code (Bytes.get buf (o + j))))
+      done;
+      w.(t) <- !v
+    done;
+    for t = 16 to 79 do
+      let s0 =
+        (rotr64 w.(t - 15) 1) ^: (rotr64 w.(t - 15) 8)
+        ^: (Int64.shift_right_logical w.(t - 15) 7) in
+      let s1 =
+        (rotr64 w.(t - 2) 19) ^: (rotr64 w.(t - 2) 61)
+        ^: (Int64.shift_right_logical w.(t - 2) 6) in
+      w.(t) <- w.(t - 16) +: s0 +: w.(t - 7) +: s1
+    done;
+    let a = ref h.(0) and bb = ref h.(1) and c = ref h.(2)
+    and d = ref h.(3) and e = ref h.(4) and f = ref h.(5)
+    and g = ref h.(6) and hh = ref h.(7) in
+    for t = 0 to 79 do
+      let s1 = (rotr64 !e 14) ^: (rotr64 !e 18) ^: (rotr64 !e 41) in
+      let ch = (!e &: !f) ^: ((lnot64 !e) &: !g) in
+      let t1 = !hh +: s1 +: ch +: k512.(t) +: w.(t) in
+      let s0 = (rotr64 !a 28) ^: (rotr64 !a 34) ^: (rotr64 !a 39) in
+      let maj = (!a &: !bb) ^: (!a &: !c) ^: (!bb &: !c) in
+      let t2 = s0 +: maj in
+      hh := !g; g := !f; f := !e;
+      e := !d +: t1;
+      d := !c; c := !bb; bb := !a;
+      a := t1 +: t2
+    done;
+    h.(0) <- h.(0) +: !a;
+    h.(1) <- h.(1) +: !bb;
+    h.(2) <- h.(2) +: !c;
+    h.(3) <- h.(3) +: !d;
+    h.(4) <- h.(4) +: !e;
+    h.(5) <- h.(5) +: !f;
+    h.(6) <- h.(6) +: !g;
+    h.(7) <- h.(7) +: !hh
+  done;
+  let out = Buffer.create 128 in
+  Array.iter
+    (fun x -> Buffer.add_string out (Printf.sprintf "%016Lx" x)) h;
+  Buffer.contents out

hosts/ocaml/lib/sx_sha3.ml

@@ -0,0 +1,107 @@
+(** SHA-3 (SHA3-256) — pure OCaml, WASM-safe.
+
+    Keccak-f[1600] permutation + SHA-3 multi-rate padding (domain byte
+    0x06, NOT the legacy Keccak 0x01). Reference: FIPS 202. No deps. *)
+
+let ( ^: ) = Int64.logxor
+let ( &: ) = Int64.logand
+let lnot64 = Int64.lognot
+
+let rotl64 x n =
+  if n = 0 then x
+  else
+    Int64.logor (Int64.shift_left x n) (Int64.shift_right_logical x (64 - n))
+
+(* FIPS 202 Table 2 — ρ rotation offsets, indexed lane = x + 5*y. *)
+let rho = [|
+   0;  1; 62; 28; 27;
+  36; 44;  6; 55; 20;
+   3; 10; 43; 25; 39;
+  41; 45; 15; 21;  8;
+  18;  2; 61; 56; 14 |]
+
+(* FIPS 202 §3.2.5 — round constants RC[0..23] for ι. *)
+let rc = [|
+  0x0000000000000001L; 0x0000000000008082L; 0x800000000000808aL;
+  0x8000000080008000L; 0x000000000000808bL; 0x0000000080000001L;
+  0x8000000080008081L; 0x8000000000008009L; 0x000000000000008aL;
+  0x0000000000000088L; 0x0000000080008009L; 0x000000008000000aL;
+  0x000000008000808bL; 0x800000000000008bL; 0x8000000000008089L;
+  0x8000000000008003L; 0x8000000000008002L; 0x8000000000000080L;
+  0x000000000000800aL; 0x800000008000000aL; 0x8000000080008081L;
+  0x8000000000008080L; 0x0000000080000001L; 0x8000000080008008L |]
+
+let keccak_f (a : int64 array) : unit =
+  let c = Array.make 5 0L and d = Array.make 5 0L in
+  let b = Array.make 25 0L in
+  for round = 0 to 23 do
+    (* θ *)
+    for x = 0 to 4 do
+      c.(x) <- a.(x) ^: a.(x + 5) ^: a.(x + 10)
+               ^: a.(x + 15) ^: a.(x + 20)
+    done;
+    for x = 0 to 4 do
+      d.(x) <- c.((x + 4) mod 5) ^: (rotl64 c.((x + 1) mod 5) 1)
+    done;
+    for x = 0 to 4 do
+      for y = 0 to 4 do
+        a.(x + 5 * y) <- a.(x + 5 * y) ^: d.(x)
+      done
+    done;
+    (* ρ and π: B[y, 2x+3y] = rotl(A[x,y], rho[x,y]) *)
+    for x = 0 to 4 do
+      for y = 0 to 4 do
+        let nx = y and ny = (2 * x + 3 * y) mod 5 in
+        b.(nx + 5 * ny) <- rotl64 a.(x + 5 * y) rho.(x + 5 * y)
+      done
+    done;
+    (* χ *)
+    for y = 0 to 4 do
+      for x = 0 to 4 do
+        a.(x + 5 * y) <-
+          b.(x + 5 * y)
+          ^: ((lnot64 b.((x + 1) mod 5 + 5 * y))
+              &: b.((x + 2) mod 5 + 5 * y))
+      done
+    done;
+    (* ι *)
+    a.(0) <- a.(0) ^: rc.(round)
+  done
+
+let sha3_256_hex (msg : string) : string =
+  let rate = 136 (* bytes: (1600 - 2*256) / 8 *) in
+  let len = String.length msg in
+  (* pad10*1 with SHA-3 domain byte 0x06; last byte ORed with 0x80. *)
+  let q = rate - (len mod rate) in
+  let padded = Bytes.make (len + q) '\000' in
+  Bytes.blit_string msg 0 padded 0 len;
+  if q = 1 then
+    Bytes.set padded len '\x86'
+  else begin
+    Bytes.set padded len '\x06';
+    Bytes.set padded (len + q - 1) '\x80'
+  end;
+  let total = Bytes.length padded in
+  let a = Array.make 25 0L in
+  let nblocks = total / rate in
+  for blk = 0 to nblocks - 1 do
+    let base = blk * rate in
+    (* Absorb: XOR rate bytes into the state, little-endian lanes. *)
+    for j = 0 to rate - 1 do
+      let lane = j / 8 and sh = (j mod 8) * 8 in
+      let byte = Int64.of_int (Char.code (Bytes.get padded (base + j))) in
+      a.(lane) <- a.(lane) ^: (Int64.shift_left byte sh)
+    done;
+    keccak_f a
+  done;
+  (* Squeeze 32 bytes (fits in the first 4 lanes; rate > 32). *)
+  let out = Buffer.create 64 in
+  for j = 0 to 31 do
+    let lane = j / 8 and sh = (j mod 8) * 8 in
+    let byte =
+      Int64.to_int
+        (Int64.logand (Int64.shift_right_logical a.(lane) sh) 0xFFL)
+    in
+    Buffer.add_string out (Printf.sprintf "%02x" byte)
+  done;
+  Buffer.contents out

hosts/ocaml/lib/sx_types.ml

@@ -138,6 +138,8 @@ and lambda = {
   l_closure : env;
   mutable l_name : string option;
   mutable l_compiled : vm_closure option;  (** Lazy JIT cache *)
+  mutable l_call_count : int;              (** Tiered-compilation counter — JIT after threshold calls *)
+  l_uid : int;                             (** Unique identity for LRU cache tracking *)
 }
 
 and component = {
@@ -444,12 +446,60 @@ let unwrap_env_val = function
   | Env e -> e
   | _ -> raise (Eval_error "make_lambda: expected env for closure")
 
+(* Lambda UID — minted on construction, used as LRU cache key (Phase 2). *)
+let lambda_uid_counter = ref 0
+let next_lambda_uid () = incr lambda_uid_counter; !lambda_uid_counter
+
 let make_lambda params body closure =
   let ps = match params with
     | List items -> List.map value_to_string items
     | _ -> value_to_string_list params
   in
-  Lambda { l_params = ps; l_body = body; l_closure = unwrap_env_val closure; l_name = None; l_compiled = None }
+  Lambda { l_params = ps; l_body = body; l_closure = unwrap_env_val closure; l_name = None; l_compiled = None; l_call_count = 0; l_uid = next_lambda_uid () }
+
+(** {1 JIT cache control}
+
+    Tiered compilation: only JIT a lambda after it's been called [jit_threshold]
+    times. This filters out one-shot lambdas (test harness, dynamic eval, REPLs)
+    so they never enter the JIT cache. Counters are exposed to SX as [(jit-stats)].
+
+    These live here (in sx_types) rather than sx_vm so [sx_primitives] can read
+    them without creating a sx_primitives → sx_vm dependency cycle. *)
+let jit_threshold = ref 4
+let jit_compiled_count = ref 0
+let jit_skipped_count = ref 0
+let jit_threshold_skipped_count = ref 0
+
+(** {2 JIT cache LRU eviction — Phase 2}
+
+    Once a lambda crosses the threshold, its [l_compiled] slot is filled.
+    To bound memory under unbounded compilation pressure, track all live
+    compiled lambdas in FIFO order, and evict from the head when the count
+    exceeds [jit_budget].
+
+    [lambda_uid_counter] mints unique identities on lambda creation; the
+    LRU queue holds these IDs paired with a back-reference to the lambda
+    so we can clear its [l_compiled] slot on eviction.
+
+    Budget of 0 = no cache (disable JIT entirely).
+    Budget of [max_int] = unbounded (legacy behaviour). Default 5000 is
+    a generous ceiling for any realistic page; the test harness compiles
+    ~3000 distinct one-shot lambdas in a full run but tiered compilation
+    (Phase 1) means most never enter the cache, so steady-state count
+    stays small.
+
+    [lambda_uid_counter] and [next_lambda_uid] are defined above
+    [make_lambda] (which uses them on construction). *)
+let jit_budget = ref 5000
+let jit_evicted_count = ref 0
+
+(** Live compiled lambdas in FIFO order — front is oldest, back is newest.
+    Each entry is (uid, lambda); on eviction we clear lambda.l_compiled and
+    drop from the queue. Using a mutable Queue rather than a hand-rolled
+    linked list because eviction is amortised O(1) at the head and inserts
+    are O(1) at the tail. *)
+let jit_cache_queue : (int * value) Queue.t = Queue.create ()
+let jit_cache_size () = Queue.length jit_cache_queue
 
 let make_component name params has_children body closure affinity =
   let n = value_to_string name in

hosts/ocaml/lib/sx_vm.ml

@@ -44,6 +44,11 @@ type vm = {
     ip past OP_PERFORM, stack ready for a result push). *)
 exception VmSuspended of value * vm
 
+(** Raised by the extension dispatch fallthrough when an opcode in the
+    extension range (≥ 200) is encountered with no handler registered.
+    Carries the offending opcode id. See plans/sx-vm-opcode-extension.md. *)
+exception Invalid_opcode of int
+
 (* Register the VM suspension converter so sx_runtime.sx_apply_cek can
    catch VmSuspended and convert it to CekPerformRequest without a
    direct dependency on this module. *)
@@ -57,6 +62,24 @@ let () = Sx_types._convert_vm_suspension := (fun exn ->
 let jit_compile_ref : (lambda -> (string, value) Hashtbl.t -> vm_closure option) ref =
   ref (fun _ _ -> None)
 
+(** Forward reference for extension opcode dispatch — Phase B installs the
+    real registry's dispatch function here at module init. Until then, any
+    opcode in the extension range raises [Invalid_opcode]. Same forward-ref
+    pattern as [jit_compile_ref] above; keeps [Sx_vm_extensions] free to
+    depend on [Sx_vm]'s [vm] / [frame] types without a cycle. *)
+let extension_dispatch_ref : (int -> vm -> frame -> unit) ref =
+  ref (fun op _vm _frame -> raise (Invalid_opcode op))
+
+(** Forward reference for extension opcode → name lookup, used by
+    [opcode_name] / [disassemble] for human-readable disassembly.  The
+    registry installs a real lookup at module init; default returns
+    [None] (then [opcode_name] falls back to "UNKNOWN_n"). *)
+let extension_opcode_name_ref : (int -> string option) ref =
+  ref (fun _ -> None)
+
+(* JIT threshold and counters live in Sx_types so primitives can read them
+   without creating a sx_primitives → sx_vm dependency cycle. *)
+
 (** Sentinel closure indicating JIT compilation was attempted and failed.
     Prevents retrying compilation on every call. *)
 let jit_failed_sentinel = {
@@ -364,13 +387,29 @@ and vm_call vm f args =
      | None ->
        if l.l_name <> None
        then begin
-         l.l_compiled <- Some jit_failed_sentinel;
-         match !jit_compile_ref l vm.globals with
-         | Some cl ->
-           l.l_compiled <- Some cl;
-           push_closure_frame vm cl args
-         | None ->
+         l.l_call_count <- l.l_call_count + 1;
+         if l.l_call_count >= !Sx_types.jit_threshold && !Sx_types.jit_budget > 0 then begin
+           l.l_compiled <- Some jit_failed_sentinel;
+           match !jit_compile_ref l vm.globals with
+           | Some cl ->
+             incr Sx_types.jit_compiled_count;
+             l.l_compiled <- Some cl;
+             (* Phase 2 LRU: track this compiled lambda; if cache exceeds budget,
+                evict the oldest by clearing its l_compiled slot. *)
+             Queue.add (l.l_uid, Lambda l) Sx_types.jit_cache_queue;
+             while Queue.length Sx_types.jit_cache_queue > !Sx_types.jit_budget do
+               (match Queue.pop Sx_types.jit_cache_queue with
+                | (_, Lambda ev_l) -> ev_l.l_compiled <- None; incr Sx_types.jit_evicted_count
+                | _ -> ())
+             done;
+             push_closure_frame vm cl args
+           | None ->
+             incr Sx_types.jit_skipped_count;
+             push vm (cek_call_or_suspend vm f (List args))
+         end else begin
+           incr Sx_types.jit_threshold_skipped_count;
            push vm (cek_call_or_suspend vm f (List args))
+         end
        end
        else
          push vm (cek_call_or_suspend vm f (List args)))
@@ -856,6 +895,15 @@ and run vm =
           let request = pop vm in
           raise (VmSuspended (request, vm))
 
+        (* ---- Extension dispatch fallthrough ----
+           Opcode partition (see plans/sx-vm-opcode-extension.md):
+             0       reserved / NOP
+             1-199   core opcodes (current ceiling 175 = OP_DEC)
+             200-247 extension opcodes (registered via Sx_vm_extensions)
+             248-255 reserved for future expansion / multi-byte
+           Any opcode ≥ 200 routes through the extension registry. *)
+        | op when op >= 200 -> !extension_dispatch_ref op vm frame
+
         | opcode ->
           raise (Eval_error (Printf.sprintf "VM: unknown opcode %d at ip=%d"
                                opcode (frame.ip - 1)))
@@ -1008,6 +1056,62 @@ let _jit_is_broken_name n =
   || n = "hs-repeat-while" || n = "hs-repeat-until"
   || n = "hs-for-each" || n = "hs-put!"
 
+(** Scan bytecode for any extension opcode (≥ 200, the registry's
+    [Sx_vm_extensions.extension_min]). Walks operand bytes correctly
+    so values that happen to be ≥200 (e.g. a CONST u16 index pointing
+    into a large pool) do not trigger false positives. CLOSURE's
+    dynamic upvalue descriptors are read from the constant pool entry
+    at the same index it pushes.
+
+    Used by [jit_compile_lambda] (Phase E of the opcode-extension
+    plan): a lambda whose compiled body contains any extension opcode
+    is routed through interpretation rather than JIT.  Extensions
+    interpret their opcodes via the registry; the JIT does not
+    currently know how to compile them.
+
+    Operand-size logic mirrors [opcode_operand_size] (which is defined
+    later, in the disassembly section); inlined here so this helper can
+    sit before [jit_compile_lambda] in the file. *)
+let bytecode_uses_extension_opcodes (bc : int array) (consts : value array) =
+  let core_operand_size = function
+    | 1 | 20 | 21 | 64 | 65 | 128 -> 2  (* u16 *)
+    | 16 | 17 | 18 | 19 | 48 | 49 | 144 -> 1  (* u8 *)
+    | 32 | 33 | 34 | 35 -> 2  (* i16 *)
+    | 52 -> 3  (* CALL_PRIM: u16 + u8 *)
+    | _ -> 0
+  in
+  let len = Array.length bc in
+  let ip = ref 0 in
+  let found = ref false in
+  while not !found && !ip < len do
+    let op = bc.(!ip) in
+    if op >= 200 then found := true
+    else begin
+      ip := !ip + 1;
+      let extra = match op with
+        | 51 (* CLOSURE *) when !ip + 1 < len ->
+          let lo = bc.(!ip) in
+          let hi = bc.(!ip + 1) in
+          let idx = lo lor (hi lsl 8) in
+          let uv_count =
+            if idx < Array.length consts then
+              (match consts.(idx) with
+               | Dict d ->
+                 (match Hashtbl.find_opt d "upvalue-count" with
+                  | Some (Integer n) -> n
+                  | Some (Number n) -> int_of_float n
+                  | _ -> 0)
+               | _ -> 0)
+            else 0
+          in
+          2 + uv_count * 2
+        | _ -> core_operand_size op
+      in
+      ip := !ip + extra
+    end
+  done;
+  !found
+
 let jit_compile_lambda (l : lambda) globals =
   let fn_name = match l.l_name with Some n -> n | None -> "<anon>" in
   if !_jit_compiling then (
@@ -1070,8 +1174,18 @@ let jit_compile_lambda (l : lambda) globals =
         if idx < Array.length outer_code.vc_constants then
           let inner_val = outer_code.vc_constants.(idx) in
           let code = code_from_value inner_val in
-          Some { vm_code = code; vm_upvalues = [||];
-                 vm_name = l.l_name; vm_env_ref = effective_globals; vm_closure_env = Some l.l_closure }
+          (* Phase E: if the inner lambda's bytecode contains any
+             extension opcode (≥200), skip JIT and let the lambda run
+             interpreted via CEK. Extension opcodes dispatch correctly
+             through the VM's registry fallthrough, but the JIT has no
+             knowledge of them and shouldn't claim ownership. *)
+          if bytecode_uses_extension_opcodes code.vc_bytecode code.vc_constants then begin
+            Printf.eprintf "[jit] SKIP %s: bytecode uses extension opcodes (interpret-only in v1)\n%!"
+              fn_name;
+            None
+          end else
+            Some { vm_code = code; vm_upvalues = [||];
+                   vm_name = l.l_name; vm_env_ref = effective_globals; vm_closure_env = Some l.l_closure }
         else begin
           Printf.eprintf "[jit] FAIL %s: closure index %d out of bounds (pool=%d)\n%!"
             fn_name idx (Array.length outer_code.vc_constants);
@@ -1181,7 +1295,12 @@ let opcode_name = function
   | 164 -> "EQ" | 165 -> "LT" | 166 -> "GT" | 167 -> "NOT"
   | 168 -> "LEN" | 169 -> "FIRST" | 170 -> "REST" | 171 -> "NTH"
   | 172 -> "CONS" | 173 -> "NEG" | 174 -> "INC" | 175 -> "DEC"
-  | n -> Printf.sprintf "UNKNOWN_%d" n
+  | n ->
+    (* Extension opcodes (≥200) get their human-readable name from the
+       registry; defaults to UNKNOWN_n if the extension isn't loaded. *)
+    (match !extension_opcode_name_ref n with
+     | Some name -> name
+     | None -> Printf.sprintf "UNKNOWN_%d" n)
 
 (** Number of extra operand bytes consumed by each opcode.
     Returns (format, total_bytes) where format describes the operand types. *)

hosts/ocaml/lib/sx_vm_extension.ml

@@ -0,0 +1,48 @@
+(** {1 VM extension interface}
+
+    Type definitions for VM bytecode extensions. See
+    [plans/sx-vm-opcode-extension.md].
+
+    An extension is a first-class module of type [EXTENSION]: it has a
+    stable [name], an [init] that returns its private state, and an
+    [opcodes] function that lists the opcodes it provides.
+
+    Opcode handlers receive the live [vm] and the active [frame]. They
+    read operands via [Sx_vm.read_u8] / [read_u16], manipulate the stack
+    via [push] / [pop] / [peek], and update the frame's [ip] as needed. *)
+
+(** A handler for an extension opcode. Reads operands from bytecode,
+    manipulates the VM stack, updates the frame's instruction pointer.
+    May raise exceptions (which propagate via the existing VM error path). *)
+type handler = Sx_vm.vm -> Sx_vm.frame -> unit
+
+(** State an extension carries alongside the VM. Opaque to the VM core;
+    extensions extend this with their own constructor and cast as needed.
+
+    Extensible variant — extensions add cases:
+    {[
+      type Sx_vm_extension.extension_state +=
+        | ErlangState of erlang_scheduler
+    ]} *)
+type extension_state = ..
+
+(** An extension is a first-class module of this signature. *)
+module type EXTENSION = sig
+  (** Stable name for this extension (e.g. ["erlang"], ["guest_vm"]).
+      Used as the lookup key in the registry and as the prefix for opcode
+      names ([erlang.OP_PATTERN_TUPLE_2] etc). *)
+  val name : string
+
+  (** Initialize per-instance state. Called once when [register] is
+      invoked on this extension. *)
+  val init : unit -> extension_state
+
+  (** Opcodes this extension provides. Each is
+      [(opcode_id, opcode_name, handler)].
+
+      [opcode_id] must be in the range 200-247 (the extension partition;
+      see the partition comment at the top of [Sx_vm]'s dispatch loop).
+      Conflicts with already-registered opcodes cause [register] to
+      fail. *)
+  val opcodes : extension_state -> (int * string * handler) list
+end

hosts/ocaml/lib/sx_vm_extensions.ml

@@ -0,0 +1,120 @@
+(** {1 VM extension registry}
+
+    Holds the live registry of extension opcodes and installs the
+    [dispatch] function into [Sx_vm.extension_dispatch_ref] at module
+    init time, replacing Phase A's stub.
+
+    See [plans/sx-vm-opcode-extension.md] and [Sx_vm_extension] for the
+    extension interface. *)
+
+open Sx_vm_extension
+
+(** The opcode range an extension is allowed to claim.
+    Mirrors the partition comment in [Sx_vm]. *)
+let extension_min = 200
+let extension_max = 247
+
+(** opcode_id → handler *)
+let by_id : (int, handler) Hashtbl.t = Hashtbl.create 64
+
+(** opcode_name → opcode_id *)
+let by_name : (string, int) Hashtbl.t = Hashtbl.create 64
+
+(** opcode_id → opcode_name (reverse of [by_name]; used by
+    [Sx_vm.opcode_name] for disassembly). *)
+let name_of_id_table : (int, string) Hashtbl.t = Hashtbl.create 64
+
+(** extension_name → state *)
+let states : (string, extension_state) Hashtbl.t = Hashtbl.create 8
+
+(** Registered extension names, newest first. *)
+let extensions : string list ref = ref []
+
+(** Dispatch an extension opcode to its registered handler. Raises
+    [Sx_vm.Invalid_opcode] if no handler is registered for [op]. *)
+let dispatch op vm frame =
+  match Hashtbl.find_opt by_id op with
+  | Some handler -> handler vm frame
+  | None -> raise (Sx_vm.Invalid_opcode op)
+
+(** Register an extension. Fails if the extension name is already
+    registered, or if any opcode_id is outside the extension range or
+    collides with an already-registered opcode. *)
+let register (m : (module EXTENSION)) =
+  let module M = (val m) in
+  if Hashtbl.mem states M.name then
+    failwith (Printf.sprintf
+      "Sx_vm_extensions: extension %S already registered" M.name);
+  let st = M.init () in
+  let ops = M.opcodes st in
+  List.iter (fun (id, opname, _h) ->
+    if id < extension_min || id > extension_max then
+      failwith (Printf.sprintf
+        "Sx_vm_extensions: opcode %d (%s) outside extension range %d-%d"
+        id opname extension_min extension_max);
+    if Hashtbl.mem by_id id then
+      failwith (Printf.sprintf
+        "Sx_vm_extensions: opcode %d (%s) already registered" id opname);
+    if Hashtbl.mem by_name opname then
+      failwith (Printf.sprintf
+        "Sx_vm_extensions: opcode name %S already registered" opname)
+  ) ops;
+  Hashtbl.add states M.name st;
+  List.iter (fun (id, opname, h) ->
+    Hashtbl.add by_id id h;
+    Hashtbl.add by_name opname id;
+    Hashtbl.add name_of_id_table id opname
+  ) ops;
+  extensions := M.name :: !extensions
+
+(** Look up the opcode_id for an opcode_name. Returns [None] if no
+    extension provides that opcode. *)
+let id_of_name name = Hashtbl.find_opt by_name name
+
+(** Look up the opcode_name for an opcode_id. Returns [None] if no
+    extension provides that opcode. Used by disassembly. *)
+let name_of_id id = Hashtbl.find_opt name_of_id_table id
+
+(** Look up the state of an extension by name. Returns [None] if the
+    extension is not registered. *)
+let state_of_extension name = Hashtbl.find_opt states name
+
+(** Names of all registered extensions, newest first. *)
+let registered_extensions () = !extensions
+
+(** Test-only: clear the registry. Used by unit tests to isolate
+    extensions between test cases. The dispatch_ref is left in place. *)
+let _reset_for_tests () =
+  Hashtbl.clear by_id;
+  Hashtbl.clear by_name;
+  Hashtbl.clear name_of_id_table;
+  Hashtbl.clear states;
+  extensions := []
+
+(** Install our [dispatch] into [Sx_vm.extension_dispatch_ref] and our
+    [name_of_id] into [Sx_vm.extension_opcode_name_ref], replacing
+    the Phase A stubs. Idempotent. Called automatically at module init. *)
+let install_dispatch () =
+  Sx_vm.extension_dispatch_ref := dispatch;
+  Sx_vm.extension_opcode_name_ref := name_of_id
+
+let () = install_dispatch ()
+
+(** Compiler-side opcode lookup: register the [extension-opcode-id]
+    primitive. Compilers ([lib/compiler.sx]) call this to emit
+    extension opcodes by name. Returns [Integer id] when registered,
+    [Nil] otherwise — so missing extensions degrade to a fallback
+    rather than failure. *)
+let () =
+  Sx_primitives.register "extension-opcode-id" (fun args ->
+    match args with
+    | [Sx_types.String name] ->
+      (match id_of_name name with
+       | Some id -> Sx_types.Integer id
+       | None -> Sx_types.Nil)
+    | [Sx_types.Symbol name] ->
+      (match id_of_name name with
+       | Some id -> Sx_types.Integer id
+       | None -> Sx_types.Nil)
+    | _ -> raise (Sx_types.Eval_error
+        "extension-opcode-id: expected one string or symbol"))

lib/acl/api.sx

@@ -0,0 +1,45 @@
+;; lib/acl/api.sx — public ACL surface over an implicit current db.
+;;
+;; Callers load a fact set once, then issue decisions without threading the db
+;; through every call. The current db is module state; (acl/load! facts) rebuilds
+;; it. This is the boundary the rest of rose-ash imports.
+
+(define acl-current-db nil)
+
+;; Replace the current fact base. Rebuilds the Datalog db under the active
+;; ruleset (see lib/acl/engine.sx).
+(define
+  acl/load!
+  (fn
+    (facts)
+    (do (set! acl-current-db (acl-build-db facts)) acl-current-db)))
+
+;; Ensure a db exists, building an empty one on first use.
+(define
+  acl-ensure-db!
+  (fn
+    ()
+    (do
+      (when
+        (= acl-current-db nil)
+        (set! acl-current-db (acl-build-db (list))))
+      acl-current-db)))
+
+;; Public decision against the current db (pure, no logging).
+(define
+  acl/permit?
+  (fn (subj act res) (acl-permit? (acl-ensure-db!) subj act res)))
+
+;; Decision-with-proof against the current db. See lib/acl/explain.sx.
+(define
+  acl/explain
+  (fn (subj act res) (acl-explain (acl-ensure-db!) subj act res)))
+
+;; Audited decision: logs the outcome to the append-only audit log and returns
+;; the boolean. See lib/acl/audit.sx.
+(define
+  acl/audit
+  (fn (subj act res) (acl-audit-decide! (acl-ensure-db!) subj act res)))
+
+;; Recent audited decisions (chronological).
+(define acl/audit-tail (fn (n) (acl-audit-tail n)))

lib/acl/audit.sx

@@ -0,0 +1,110 @@
+;; lib/acl/audit.sx — append-only decision log.
+;;
+;; Every decision routed through acl-audit-decide! is appended to an in-memory
+;; log with a monotonic sequence number (no wall-clock — deterministic and
+;; testable; a host can stamp time at the serializer boundary). The log is
+;; append-only: there is no mutate or delete, only append, tail, clear,
+;; snapshot/restore, and serialize-for-disk.
+
+(define acl-audit-log (list))
+(define acl-audit-seq 0)
+
+;; Copy a list into a fresh, append!-able list. `map`/`rest`-derived lists are
+;; NOT extensible by append! in this runtime (it silently no-ops), so the live
+;; log must always be a list built with `list` + `append!`.
+(define
+  acl-audit-copy
+  (fn
+    (xs)
+    (let
+      ((fresh (list)))
+      (do (for-each (fn (e) (append! fresh e)) xs) fresh))))
+
+(define
+  acl-audit-clear!
+  (fn
+    ()
+    (do (set! acl-audit-log (list)) (set! acl-audit-seq 0) nil)))
+
+;; Append a decision record. Returns the record.
+(define
+  acl-audit-record!
+  (fn
+    (subj act res allowed?)
+    (let
+      ((entry {:allowed? allowed? :act act :subj subj :res res :seq acl-audit-seq}))
+      (do
+        (set! acl-audit-seq (+ acl-audit-seq 1))
+        (append! acl-audit-log entry)
+        entry))))
+
+;; Decide against db, log the outcome, and return the boolean. This is the
+;; audited path; acl-permit? remains the pure, side-effect-free decision.
+(define
+  acl-audit-decide!
+  (fn
+    (db subj act res)
+    (let
+      ((allowed? (acl-permit? db subj act res)))
+      (do (acl-audit-record! subj act res allowed?) allowed?))))
+
+(define acl-audit-count (fn () (len acl-audit-log)))
+
+;; Most recent n entries (in chronological order). n >= log size returns all.
+(define
+  acl-audit-tail
+  (fn
+    (n)
+    (let
+      ((total (len acl-audit-log)))
+      (if
+        (<= total n)
+        acl-audit-log
+        (acl-audit-drop acl-audit-log (- total n))))))
+
+(define
+  acl-audit-drop
+  (fn
+    (xs k)
+    (if (<= k 0) xs (acl-audit-drop (rest xs) (- k 1)))))
+
+;; Structured snapshot for save/restore — a {:seq :entries} value carrying a
+;; copy of the log (so later appends don't mutate a held snapshot).
+(define acl-audit-snapshot (fn () {:seq acl-audit-seq :entries (acl-audit-copy acl-audit-log)}))
+
+;; Replace the live log from a snapshot. Restores both entries and the seq
+;; counter so subsequent records continue numbering correctly. The log is
+;; rebuilt as a fresh append!-able list (see acl-audit-copy).
+(define
+  acl-audit-restore!
+  (fn
+    (snap)
+    (do
+      (set! acl-audit-log (acl-audit-copy (get snap :entries)))
+      (set! acl-audit-seq (get snap :seq))
+      nil)))
+
+;; Serialize the whole log to a disk-ready string: one record per line,
+;; "seq\tsubj\tact\tres\tallowed?". A host writes this; structured reload is via
+;; snapshot/restore.
+(define
+  acl-audit-serialize
+  (fn
+    ()
+    (reduce
+      (fn
+        (acc e)
+        (str
+          acc
+          (get e :seq)
+          "\t"
+          (get e :subj)
+          "\t"
+          (get e :act)
+          "\t"
+          (get e :res)
+          "\t"
+          (get e :allowed?)
+          "\n"))
+      ""
+      acl-audit-log)))

lib/acl/conformance.conf

@@ -0,0 +1,32 @@
+# ACL conformance config — sourced by lib/guest/conformance.sh.
+
+LANG_NAME=acl
+MODE=dict
+
+PRELOADS=(
+  lib/datalog/tokenizer.sx
+  lib/datalog/parser.sx
+  lib/datalog/unify.sx
+  lib/datalog/db.sx
+  lib/datalog/builtins.sx
+  lib/datalog/aggregates.sx
+  lib/datalog/strata.sx
+  lib/datalog/eval.sx
+  lib/datalog/api.sx
+  lib/datalog/magic.sx
+  lib/acl/schema.sx
+  lib/acl/facts.sx
+  lib/acl/engine.sx
+  lib/acl/explain.sx
+  lib/acl/audit.sx
+  lib/acl/federation.sx
+  lib/acl/api.sx
+)
+
+SUITES=(
+  "direct:lib/acl/tests/direct.sx:(acl-direct-tests-run!)"
+  "inherit:lib/acl/tests/inherit.sx:(acl-inherit-tests-run!)"
+  "explain:lib/acl/tests/explain.sx:(acl-explain-tests-run!)"
+  "fed:lib/acl/tests/fed.sx:(acl-fed-tests-run!)"
+  "harden:lib/acl/tests/harden.sx:(acl-harden-tests-run!)"
+)

lib/acl/conformance.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+# Thin wrapper — see lib/guest/conformance.sh and lib/acl/conformance.conf.
+exec bash "$(dirname "$0")/../guest/conformance.sh" "$(dirname "$0")/conformance.conf" "$@"

lib/acl/engine.sx

@@ -0,0 +1,72 @@
+;; lib/acl/engine.sx — ACL ruleset + decision reducer over lib/datalog/.
+;;
+;; The engine is a thin layer: it owns the permit ruleset (SX data rules) and
+;; reduces a (subject, action, resource) decision to a Datalog query against a
+;; db built from EDB facts. The rule engine itself is Datalog's.
+;;
+;; Policy — inheritance + federation with deny-overrides:
+;;
+;;   eff_grant(S,A,R) :- grant(S,A,R).                         ; direct
+;;   eff_grant(S,A,R) :- member_of(S,G), eff_grant(G,A,R).     ; group/role chain
+;;   eff_grant(S,A,R) :- child_of(R,P), eff_grant(S,A,P).      ; resource tree
+;;   eff_grant(S,A,R) :- member_of(S,Role), role_grant(Role,A,R). ; role expansion
+;;   eff_grant(S,A,R) :- delegate(Peer,S,A,R),                 ; federated grant
+;;                       trust(Peer,L), level_covers(L,A).
+;;
+;;   eff_deny(S,A,R)  :- deny(S,A,R).                          ; direct
+;;   eff_deny(S,A,R)  :- member_of(S,G), eff_deny(G,A,R).      ; group chain
+;;   eff_deny(S,A,R)  :- child_of(R,P), eff_deny(S,A,P).       ; resource tree
+;;
+;;   permit(S,A,R)    :- eff_grant(S,A,R), not eff_deny(S,A,R).
+;;
+;; DENY-OVERRIDES: an effective deny anywhere in the inheritance closure of
+;; (S,A,R) defeats any effective grant — including federated grants. Deny
+;; inherits through the *same* group and resource chains as grant, so a
+;; group-level or ancestor-resource deny is authoritative for members/
+;; descendants. This is the principled, fail-safe reading of "deny wins".
+;;
+;; FEDERATION — non-transitive trust: a peer's `delegate` fact only grants if a
+;; *local* `trust(Peer, L)` exists AND that level `level_covers` the action.
+;; Trust is re-checked on every query (it is a body literal), never baked in at
+;; fact-ingestion time, so revoking trust or narrowing a level takes effect
+;; immediately on the next decision.
+;;
+;; Termination & stratification:
+;;   - eff_grant/eff_deny recurse only over member_of and child_of, which are
+;;     EDB relations with no function symbols, so the closure is finite (cyclic
+;;     membership/containment just reaches a fixpoint, never loops). The
+;;     federation rule is non-recursive.
+;;   - permit negates eff_deny; neither eff_grant nor eff_deny depends on
+;;     permit, so the program is stratifiable (permit sits in a higher stratum).
+
+(define
+  acl-rules
+  (quote
+    ((eff_grant S A R <- (grant S A R))
+      (eff_grant S A R <- (member_of S G) (eff_grant G A R))
+      (eff_grant S A R <- (child_of R P) (eff_grant S A P))
+      (eff_grant S A R <- (member_of S Role) (role_grant Role A R))
+      (eff_grant
+        S
+        A
+        R
+        <-
+        (delegate Peer S A R)
+        (trust Peer L)
+        (level_covers L A))
+      (eff_deny S A R <- (deny S A R))
+      (eff_deny S A R <- (member_of S G) (eff_deny G A R))
+      (eff_deny S A R <- (child_of R P) (eff_deny S A P))
+      (permit S A R <- (eff_grant S A R) {:neg (eff_deny S A R)}))))
+
+;; Build a Datalog db from a list of EDB facts under the ACL ruleset.
+(define acl-build-db (fn (facts) (dl-program-data facts acl-rules)))
+
+;; Core decision: does the db permit subject S to perform action A on
+;; resource R? Reduces to a ground Datalog query on the derived `permit`
+;; relation — non-empty result means permitted.
+(define
+  acl-permit?
+  (fn
+    (db subj act res)
+    (> (len (dl-query db (list (quote permit) subj act res))) 0)))

lib/acl/explain.sx

@@ -0,0 +1,125 @@
+;; lib/acl/explain.sx — proof-tree reconstruction over the saturated db.
+;;
+;; lib/datalog/ records derived facts but not their provenance, so the proof is
+;; reconstructed here by goal-directed search over the *saturated* db: for a
+;; ground goal we find the first ACL rule (in rule order) whose body holds, take
+;; the first solution binding its remaining variables, and recurse on each body
+;; literal. Negated literals are recorded as verified `:neg-ok` leaves.
+;;
+;; CANONICAL DERIVATION: the Datalog derivation graph is a DAG (a fact may hold
+;; many ways). We pick ONE canonical proof — first matching rule, first solution
+;; — matching the rule order in lib/acl/engine.sx (direct/EDB rules first). A
+;; depth cap guards against pathological cyclic data producing unbounded search.
+;;
+;; A proof node is one of:
+;;   {:fact <lit> :via "edb"}                       — base EDB fact
+;;   {:fact <lit> :rule <head> :body (<node|negleaf> ...)}  — derived
+;;   {:neg-ok <lit>}                                — negation verified to fail
+;;   {:fact <lit> :truncated true}                  — depth cap hit
+
+(define acl-proof-max-depth 64)
+
+;; Substitute a body literal, descending into {:neg ...} dicts (dl-apply-subst
+;; does not recurse into dicts, which would leak the neg's free vars).
+(define
+  acl-subst-lit
+  (fn
+    (lit s)
+    (if
+      (and (dict? lit) (has-key? lit :neg))
+      {:neg (dl-apply-subst (get lit :neg) s)}
+      (dl-apply-subst lit s))))
+
+(define
+  acl-lit-edb?
+  (fn
+    (lit)
+    (and
+      (list? lit)
+      (> (len lit) 0)
+      (symbol? (first lit))
+      (has-key? acl-edb-arity (symbol->string (first lit))))))
+
+(define
+  acl-subst-zip!
+  (fn
+    (d ks vs)
+    (when
+      (> (len ks) 0)
+      (do
+        (dict-set! d (symbol->string (first ks)) (first vs))
+        (acl-subst-zip! d (rest ks) (rest vs))))))
+
+;; Bind a rule head's variables to a ground goal's arguments (positional).
+(define
+  acl-bind-head
+  (fn
+    (head goal)
+    (let
+      ((d {}))
+      (do (acl-subst-zip! d (rest head) (rest goal)) d))))
+
+(define
+  acl-subst-union
+  (fn
+    (a b)
+    (let
+      ((d {}))
+      (do
+        (for-each (fn (k) (dict-set! d k (get a k))) (keys a))
+        (for-each (fn (k) (dict-set! d k (get b k))) (keys b))
+        d))))
+
+(define acl-prove (fn (db goal) (acl-prove-d db goal 0)))
+
+(define
+  acl-prove-d
+  (fn
+    (db goal depth)
+    (cond
+      ((> depth acl-proof-max-depth) {:truncated true :fact goal})
+      ((acl-lit-edb? goal)
+        (if (> (len (dl-query db goal)) 0) {:via "edb" :fact goal} nil))
+      (else (acl-prove-rules db goal acl-rules depth)))))
+
+(define
+  acl-prove-rules
+  (fn
+    (db goal rules depth)
+    (if
+      (= (len rules) 0)
+      nil
+      (let
+        ((p (dl-rule-from-list (first rules))))
+        (if
+          (= (first (get p :head)) (first goal))
+          (let
+            ((hs (acl-bind-head (get p :head) goal)))
+            (let
+              ((qbody (map (fn (l) (acl-subst-lit l hs)) (get p :body))))
+              (let
+                ((sols (dl-query db qbody)))
+                (if
+                  (> (len sols) 0)
+                  (acl-prove-build db goal p hs (first sols) depth)
+                  (acl-prove-rules db goal (rest rules) depth)))))
+          (acl-prove-rules db goal (rest rules) depth))))))
+
+(define
+  acl-prove-build
+  (fn
+    (db goal p hs sol depth)
+    (let ((full (acl-subst-union hs sol))) {:body (map (fn (l) (let ((g (acl-subst-lit l full))) (if (and (dict? g) (has-key? g :neg)) {:neg-ok (get g :neg)} (acl-prove-d db g (+ depth 1))))) (get p :body)) :rule (get p :head) :fact goal})))
+
+;; Public decision-with-proof. Returns:
+;;   {:allowed? <bool> :proof <node|nil> :reason <eff_deny proof|nil>}
+;; When permitted, :proof is the permit derivation. When denied, :proof is nil
+;; and :reason carries the blocking eff_deny proof if one exists (an explicit or
+;; inherited deny), else nil (simply no grant).
+(define
+  acl-explain
+  (fn
+    (db subj act res)
+    (let
+      ((proof (acl-prove db (list (quote permit) subj act res))))
+      (if (= proof nil) {:allowed? false :proof nil :reason (acl-prove db (list (quote eff_deny) subj act res))} {:allowed? true :proof proof :reason nil}))))

lib/acl/facts.sx

@@ -0,0 +1,47 @@
+;; lib/acl/facts.sx — EDB fact constructors.
+;;
+;; Each constructor returns a Datalog fact tuple (a list whose head is the
+;; predicate symbol). These are the only shapes lib/acl/engine.sx feeds to
+;; lib/datalog/.
+;;   Phase 1: actor/resource/grant/deny.
+;;   Phase 2: member_of (subject -> group/role), child_of (resource -> parent),
+;;            role_grant (role -> action,resource capability).
+;;   Phase 4: peer/trust/delegate/level_covers (federation).
+
+(define acl-actor (fn (id kind) (list (quote actor) id kind)))
+
+(define acl-resource-fact (fn (id kind) (list (quote resource) id kind)))
+
+(define acl-grant (fn (subj act res) (list (quote grant) subj act res)))
+
+(define acl-deny (fn (subj act res) (list (quote deny) subj act res)))
+
+;; subject S is a member of group/role G (one hop; transitivity is derived).
+(define acl-member-of (fn (subj grp) (list (quote member_of) subj grp)))
+
+;; resource R is a child of parent P (one hop; transitivity is derived).
+(define acl-child-of (fn (res parent) (list (quote child_of) res parent)))
+
+;; role confers capability (act on res) to every member of the role.
+(define
+  acl-role-grant
+  (fn (role act res) (list (quote role_grant) role act res)))
+
+;; --- federation ---
+
+;; a known peer instance at addr, of some kind (e.g. peer).
+(define acl-peer (fn (addr kind) (list (quote peer) addr kind)))
+
+;; local trust in a peer at a named level. Gates delegated grants at query time.
+(define acl-trust (fn (peer level) (list (quote trust) peer level)))
+
+;; a peer asserts that subject S may A on R. Only takes effect if local trust in
+;; that peer covers action A (see level_covers).
+(define
+  acl-delegate
+  (fn (peer subj act res) (list (quote delegate) peer subj act res)))
+
+;; local policy: trust `level` authorises delegated grants for action `act`.
+(define
+  acl-level-covers
+  (fn (level act) (list (quote level_covers) level act)))

lib/acl/federation.sx

@@ -0,0 +1,61 @@
+;; lib/acl/federation.sx — cross-instance ACL facts + revocation.
+;;
+;; fed-sx replicates ACL facts between instances; this module models the local
+;; side. A peer's authority arrives as `delegate(Peer, S, A, R)` facts, which
+;; only take effect when a local `trust(Peer, L)` and `level_covers(L, A)`
+;; authorise them (enforced by the engine rule, re-checked every query). The
+;; actual network transport is fed-sx's job and is mocked in tests as a dict.
+;;
+;; Trust is NOT transitive: trusting peer α does not extend to peers α trusts.
+;; Only delegate facts that α itself asserts, and that local trust covers, flow.
+
+;; Mock fed-sx pull: `transport` is a dict mapping a peer address (its string
+;; name) to the list of delegate facts that peer asserts. Returns the facts for
+;; `addr`, or an empty list if the peer is unknown / unreachable.
+(define
+  acl-fed-fetch
+  (fn
+    (transport addr)
+    (let
+      ((k (if (symbol? addr) (symbol->string addr) addr)))
+      (if (has-key? transport k) (get transport k) (list)))))
+
+;; Gather delegate facts from every peer in `addrs` via the transport.
+(define
+  acl-fed-collect
+  (fn
+    (transport addrs)
+    (let
+      ((acc (list)))
+      (do
+        (for-each
+          (fn
+            (addr)
+            (for-each
+              (fn (f) (append! acc f))
+              (acl-fed-fetch transport addr)))
+          addrs)
+        acc))))
+
+;; Build a db from local facts plus delegate facts pulled from `peers`. Local
+;; facts must include the `trust`/`level_covers` policy; replicated delegate
+;; facts are gated against it by the engine rule at query time.
+(define
+  acl-fed-build-db
+  (fn
+    (local-facts transport peers)
+    (let
+      ((all (list)))
+      (do
+        (for-each (fn (f) (append! all f)) local-facts)
+        (for-each
+          (fn (f) (append! all f))
+          (acl-fed-collect transport peers))
+        (acl-build-db all)))))
+
+;; Propagated revocation: retract a replicated fact (e.g. a peer's delegate, or
+;; local trust) from a live db. The next decision re-saturates and reflects it.
+(define acl-revoke! (fn (db fact) (do (dl-retract! db fact) db)))
+
+;; Propagated assertion: ingest a newly replicated fact into a live db.
+(define acl-fed-assert! (fn (db fact) (do (dl-assert! db fact) db)))

lib/acl/schema.sx

@@ -0,0 +1,71 @@
+;; lib/acl/schema.sx — ACL sorts and EDB predicate vocabulary.
+;;
+;; Datalog is untyped; this module is the schema-as-data layer. It declares
+;; the subject/resource/action sorts and the arity of every EDB predicate the
+;; ACL engine recognises, plus light validators. Facts that pass these checks
+;; are well-formed inputs to lib/acl/engine.sx.
+
+(define acl-subject-kinds (quote (user group role service)))
+(define acl-resource-kinds (quote (page post thread peer)))
+
+;; Actions are open-ended (a grant may name any action symbol), but these are
+;; the platform's well-known verbs.
+(define acl-actions (quote (read edit comment moderate federate)))
+
+;; EDB predicate name -> arity.
+;;   Phase 1: actor/resource/grant/deny.
+;;   Phase 2: member_of (subject->group/role), child_of (resource->parent),
+;;            role_grant (role->action,resource).
+;;   Phase 4: peer (addr->kind), trust (peer->level),
+;;            delegate (peer->subj,action,resource), level_covers (level->action).
+(define acl-edb-arity {:role_grant 3 :child_of 2 :trust 2 :peer 2 :actor 2 :level_covers 2 :delegate 4 :member_of 2 :deny 3 :grant 3 :resource 2})
+
+(define
+  acl-member?
+  (fn
+    (x xs)
+    (cond
+      ((= (len xs) 0) false)
+      ((= (first xs) x) true)
+      (else (acl-member? x (rest xs))))))
+
+(define acl-subject-kind? (fn (k) (acl-member? k acl-subject-kinds)))
+
+(define acl-resource-kind? (fn (k) (acl-member? k acl-resource-kinds)))
+
+(define acl-known-action? (fn (a) (acl-member? a acl-actions)))
+
+;; A fact is a list whose head is a predicate symbol. Valid when the predicate
+;; is known and the argument count matches the declared arity.
+(define
+  acl-fact-valid?
+  (fn
+    (f)
+    (and
+      (list? f)
+      (> (len f) 0)
+      (symbol? (first f))
+      (let
+        ((pred (symbol->string (first f))))
+        (and
+          (has-key? acl-edb-arity pred)
+          (= (- (len f) 1) (get acl-edb-arity pred)))))))
+
+;; Return the sublist of facts that fail acl-fact-valid?. Empty list means the
+;; whole set is well-formed. acl-build-db stays lenient (Datalog accepts any
+;; tuple, and custom action symbols are allowed); callers opt in to checking.
+(define
+  acl-validate-facts
+  (fn
+    (facts)
+    (let
+      ((bad (list)))
+      (do
+        (for-each
+          (fn (f) (when (not (acl-fact-valid? f)) (append! bad f)))
+          facts)
+        bad))))
+
+(define
+  acl-facts-valid?
+  (fn (facts) (= (len (acl-validate-facts facts)) 0)))

lib/acl/scoreboard.json

@@ -0,0 +1,14 @@
+{
+  "lang": "acl",
+  "total_passed": 145,
+  "total_failed": 0,
+  "total": 145,
+  "suites": [
+    {"name":"direct","passed":24,"failed":0,"total":24},
+    {"name":"inherit","passed":30,"failed":0,"total":30},
+    {"name":"explain","passed":35,"failed":0,"total":35},
+    {"name":"fed","passed":31,"failed":0,"total":31},
+    {"name":"harden","passed":25,"failed":0,"total":25}
+  ],
+  "generated": "2026-06-06T22:43:27+00:00"
+}

lib/acl/scoreboard.md

@@ -0,0 +1,11 @@
+# acl scoreboard
+
+**145 / 145 passing** (0 failure(s)).
+
+| Suite | Passed | Total | Status |
+|-------|--------|-------|--------|
+| direct | 24 | 24 | ok |
+| inherit | 30 | 30 | ok |
+| explain | 35 | 35 | ok |
+| fed | 31 | 31 | ok |
+| harden | 25 | 25 | ok |

lib/acl/tests/direct.sx

@@ -0,0 +1,170 @@
+;; lib/acl/tests/direct.sx — Phase 1: direct grants + deny-overrides.
+
+(define acl-dt-pass 0)
+(define acl-dt-fail 0)
+(define acl-dt-failures (list))
+
+(define
+  acl-dt-check!
+  (fn
+    (name got expected)
+    (if
+      (= got expected)
+      (set! acl-dt-pass (+ acl-dt-pass 1))
+      (do
+        (set! acl-dt-fail (+ acl-dt-fail 1))
+        (append!
+          acl-dt-failures
+          (str name "\n    expected: " expected "\n    got:      " got))))))
+
+;; A small fixture used by most cases: alice can read page1, is denied edit on
+;; page1, and a service may federate peer1.
+(define
+  acl-dt-fixture
+  (fn
+    ()
+    (acl-build-db
+      (list
+        (acl-actor (quote alice) (quote user))
+        (acl-actor (quote svc1) (quote service))
+        (acl-resource-fact (quote page1) (quote page))
+        (acl-resource-fact (quote peer1) (quote peer))
+        (acl-grant (quote alice) (quote read) (quote page1))
+        (acl-grant (quote alice) (quote edit) (quote page1))
+        (acl-deny (quote alice) (quote edit) (quote page1))
+        (acl-grant (quote svc1) (quote federate) (quote peer1))))))
+
+(define
+  acl-dt-run-all!
+  (fn
+    ()
+    (let
+      ((db (acl-dt-fixture)))
+      (do
+        (acl-dt-check!
+          "direct grant permits"
+          (acl-permit? db (quote alice) (quote read) (quote page1))
+          true)
+        (acl-dt-check!
+          "service grant permits federate"
+          (acl-permit? db (quote svc1) (quote federate) (quote peer1))
+          true)
+        (acl-dt-check!
+          "missing action denied"
+          (acl-permit? db (quote alice) (quote comment) (quote page1))
+          false)
+        (acl-dt-check!
+          "missing resource denied"
+          (acl-permit? db (quote alice) (quote read) (quote page2))
+          false)
+        (acl-dt-check!
+          "missing subject denied"
+          (acl-permit? db (quote bob) (quote read) (quote page1))
+          false)
+        (acl-dt-check!
+          "wrong subject for service grant denied"
+          (acl-permit? db (quote alice) (quote federate) (quote peer1))
+          false)
+        (acl-dt-check!
+          "grant plus deny -> deny wins"
+          (acl-permit? db (quote alice) (quote edit) (quote page1))
+          false)
+        (acl-dt-check!
+          "deny alone still denies"
+          (acl-permit?
+            (acl-build-db
+              (list (acl-deny (quote alice) (quote read) (quote page1))))
+            (quote alice)
+            (quote read)
+            (quote page1))
+          false)
+        (acl-dt-check!
+          "deny on edit does not block read"
+          (acl-permit? db (quote alice) (quote read) (quote page1))
+          true)
+        (acl-dt-check!
+          "empty db denies"
+          (acl-permit?
+            (acl-build-db (list))
+            (quote alice)
+            (quote read)
+            (quote page1))
+          false)
+        (let
+          ((db2 (acl-build-db (list (acl-grant (quote a) (quote read) (quote r)) (acl-grant (quote b) (quote read) (quote r)) (acl-deny (quote b) (quote read) (quote r))))))
+          (do
+            (acl-dt-check!
+              "subject a allowed"
+              (acl-permit? db2 (quote a) (quote read) (quote r))
+              true)
+            (acl-dt-check!
+              "subject b denied by override"
+              (acl-permit? db2 (quote b) (quote read) (quote r))
+              false)))
+        (let
+          ((db3 (acl-build-db (list (acl-actor (quote editors) (quote role)) (acl-grant (quote editors) (quote edit) (quote post1))))))
+          (acl-dt-check!
+            "role subject direct grant"
+            (acl-permit? db3 (quote editors) (quote edit) (quote post1))
+            true))
+        (do
+          (acl/load!
+            (list
+              (acl-grant (quote carol) (quote moderate) (quote thread1))))
+          (acl-dt-check!
+            "api permit via current db"
+            (acl/permit? (quote carol) (quote moderate) (quote thread1))
+            true)
+          (acl-dt-check!
+            "api deny via current db"
+            (acl/permit? (quote carol) (quote read) (quote thread1))
+            false))
+        (do
+          (acl/load! (list))
+          (acl-dt-check!
+            "api reload clears prior grants"
+            (acl/permit? (quote carol) (quote moderate) (quote thread1))
+            false))
+        (acl-dt-check!
+          "schema grant arity valid"
+          (acl-fact-valid? (acl-grant (quote x) (quote read) (quote y)))
+          true)
+        (acl-dt-check!
+          "schema bad arity invalid"
+          (acl-fact-valid? (list (quote grant) (quote x)))
+          false)
+        (acl-dt-check!
+          "schema unknown predicate invalid"
+          (acl-fact-valid? (list (quote frobnicate) (quote x)))
+          false)
+        (acl-dt-check!
+          "schema subject kind known"
+          (acl-subject-kind? (quote service))
+          true)
+        (acl-dt-check!
+          "schema resource kind unknown"
+          (acl-resource-kind? (quote galaxy))
+          false)
+        (acl-dt-check!
+          "schema known action"
+          (acl-known-action? (quote moderate))
+          true)
+        (acl-dt-check!
+          "grant constructor shape"
+          (acl-grant (quote u) (quote read) (quote p))
+          (list (quote grant) (quote u) (quote read) (quote p)))
+        (acl-dt-check!
+          "actor constructor shape"
+          (acl-actor (quote u) (quote user))
+          (list (quote actor) (quote u) (quote user)))))))
+
+(define
+  acl-direct-tests-run!
+  (fn
+    ()
+    (do
+      (set! acl-dt-pass 0)
+      (set! acl-dt-fail 0)
+      (set! acl-dt-failures (list))
+      (acl-dt-run-all!)
+      {:failures acl-dt-failures :total (+ acl-dt-pass acl-dt-fail) :passed acl-dt-pass :failed acl-dt-fail})))

lib/acl/tests/explain.sx

@@ -0,0 +1,316 @@
+;; lib/acl/tests/explain.sx — Phase 3: proof correctness + audit completeness.
+
+(define acl-et-pass 0)
+(define acl-et-fail 0)
+(define acl-et-failures (list))
+
+;; Name-based deep equality. The host `=` compares symbols by interned
+;; identity, which is unstable across substitution/saturation; comparing by
+;; name (as the datalog suite does) makes structural assertions deterministic.
+(define
+  acl-et-eq?
+  (fn
+    (a b)
+    (cond
+      ((and (list? a) (list? b))
+        (and (= (len a) (len b)) (acl-et-eq-l? a b 0)))
+      ((and (dict? a) (dict? b))
+        (let
+          ((ka (keys a)) (kb (keys b)))
+          (and (= (len ka) (len kb)) (acl-et-eq-d? a b ka 0))))
+      ((and (symbol? a) (symbol? b))
+        (= (symbol->string a) (symbol->string b)))
+      (else (= a b)))))
+
+(define
+  acl-et-eq-l?
+  (fn
+    (a b i)
+    (cond
+      ((>= i (len a)) true)
+      ((not (acl-et-eq? (nth a i) (nth b i))) false)
+      (else (acl-et-eq-l? a b (+ i 1))))))
+
+(define
+  acl-et-eq-d?
+  (fn
+    (a b ka i)
+    (cond
+      ((>= i (len ka)) true)
+      ((let ((k (nth ka i))) (not (acl-et-eq? (get a k) (get b k))))
+        false)
+      (else (acl-et-eq-d? a b ka (+ i 1))))))
+
+(define
+  acl-et-check!
+  (fn
+    (name got expected)
+    (if
+      (acl-et-eq? got expected)
+      (set! acl-et-pass (+ acl-et-pass 1))
+      (do
+        (set! acl-et-fail (+ acl-et-fail 1))
+        (append!
+          acl-et-failures
+          (str name "\n    expected: " expected "\n    got:      " got))))))
+
+;; --- proof-tree walkers ---
+
+;; True if EDB fact `target` appears as a base leaf anywhere in the proof.
+(define
+  acl-et-has-leaf?
+  (fn
+    (node target)
+    (cond
+      ((= node nil) false)
+      ((and (dict? node) (has-key? node :via))
+        (acl-et-eq? (get node :fact) target))
+      ((and (dict? node) (has-key? node :body))
+        (acl-et-any-leaf? (get node :body) target))
+      (else false))))
+
+(define
+  acl-et-any-leaf?
+  (fn
+    (nodes target)
+    (cond
+      ((= (len nodes) 0) false)
+      ((acl-et-has-leaf? (first nodes) target) true)
+      (else (acl-et-any-leaf? (rest nodes) target)))))
+
+;; True if the proof records a verified negation (deny did not fire).
+(define
+  acl-et-has-negok?
+  (fn
+    (node)
+    (cond
+      ((= node nil) false)
+      ((and (dict? node) (has-key? node :neg-ok)) true)
+      ((and (dict? node) (has-key? node :body))
+        (acl-et-any-negok? (get node :body)))
+      (else false))))
+
+(define
+  acl-et-any-negok?
+  (fn
+    (nodes)
+    (cond
+      ((= (len nodes) 0) false)
+      ((acl-et-has-negok? (first nodes)) true)
+      (else (acl-et-any-negok? (rest nodes))))))
+
+(define
+  acl-et-run-all!
+  (fn
+    ()
+    (do
+      (let
+        ((db (acl-build-db (list (acl-grant (quote u) (quote read) (quote p))))))
+        (let
+          ((e (acl-explain db (quote u) (quote read) (quote p))))
+          (do
+            (acl-et-check! "direct: allowed?" (get e :allowed?) true)
+            (acl-et-check!
+              "direct: proof root fact"
+              (get (get e :proof) :fact)
+              (list (quote permit) (quote u) (quote read) (quote p)))
+            (acl-et-check!
+              "direct: grant leaf present"
+              (acl-et-has-leaf?
+                (get e :proof)
+                (list (quote grant) (quote u) (quote read) (quote p)))
+              true)
+            (acl-et-check!
+              "direct: negation verified"
+              (acl-et-has-negok? (get e :proof))
+              true)
+            (acl-et-check!
+              "direct: reason nil when allowed"
+              (get e :reason)
+              nil))))
+      (let
+        ((db (acl-build-db (list (acl-member-of (quote alice) (quote team)) (acl-member-of (quote team) (quote org)) (acl-grant (quote org) (quote read) (quote doc))))))
+        (let
+          ((e (acl-explain db (quote alice) (quote read) (quote doc))))
+          (do
+            (acl-et-check! "group: allowed?" (get e :allowed?) true)
+            (acl-et-check!
+              "group: member_of alice leaf"
+              (acl-et-has-leaf?
+                (get e :proof)
+                (list (quote member_of) (quote alice) (quote team)))
+              true)
+            (acl-et-check!
+              "group: member_of team leaf"
+              (acl-et-has-leaf?
+                (get e :proof)
+                (list (quote member_of) (quote team) (quote org)))
+              true)
+            (acl-et-check!
+              "group: grant org leaf at base"
+              (acl-et-has-leaf?
+                (get e :proof)
+                (list (quote grant) (quote org) (quote read) (quote doc)))
+              true))))
+      (let
+        ((db (acl-build-db (list (acl-child-of (quote sec) (quote book)) (acl-grant (quote u) (quote read) (quote book))))))
+        (let
+          ((e (acl-explain db (quote u) (quote read) (quote sec))))
+          (do
+            (acl-et-check! "resource: allowed?" (get e :allowed?) true)
+            (acl-et-check!
+              "resource: child_of leaf"
+              (acl-et-has-leaf?
+                (get e :proof)
+                (list (quote child_of) (quote sec) (quote book)))
+              true)
+            (acl-et-check!
+              "resource: grant on parent leaf"
+              (acl-et-has-leaf?
+                (get e :proof)
+                (list (quote grant) (quote u) (quote read) (quote book)))
+              true))))
+      (let
+        ((db (acl-build-db (list (acl-member-of (quote bob) (quote editor)) (acl-role-grant (quote editor) (quote edit) (quote page1))))))
+        (let
+          ((e (acl-explain db (quote bob) (quote edit) (quote page1))))
+          (do
+            (acl-et-check! "role: allowed?" (get e :allowed?) true)
+            (acl-et-check!
+              "role: member_of leaf"
+              (acl-et-has-leaf?
+                (get e :proof)
+                (list (quote member_of) (quote bob) (quote editor)))
+              true)
+            (acl-et-check!
+              "role: role_grant leaf"
+              (acl-et-has-leaf?
+                (get e :proof)
+                (list
+                  (quote role_grant)
+                  (quote editor)
+                  (quote edit)
+                  (quote page1)))
+              true))))
+      (let
+        ((db (acl-build-db (list (acl-grant (quote u) (quote edit) (quote p)) (acl-deny (quote u) (quote edit) (quote p))))))
+        (let
+          ((e (acl-explain db (quote u) (quote edit) (quote p))))
+          (do
+            (acl-et-check! "deny: not allowed" (get e :allowed?) false)
+            (acl-et-check! "deny: no proof" (get e :proof) nil)
+            (acl-et-check!
+              "deny: reason root is eff_deny"
+              (get (get e :reason) :fact)
+              (list (quote eff_deny) (quote u) (quote edit) (quote p)))
+            (acl-et-check!
+              "deny: reason has deny leaf"
+              (acl-et-has-leaf?
+                (get e :reason)
+                (list (quote deny) (quote u) (quote edit) (quote p)))
+              true))))
+      (let
+        ((db (acl-build-db (list (acl-member-of (quote alice) (quote team)) (acl-grant (quote alice) (quote read) (quote doc)) (acl-deny (quote team) (quote read) (quote doc))))))
+        (let
+          ((e (acl-explain db (quote alice) (quote read) (quote doc))))
+          (do
+            (acl-et-check!
+              "inherited deny: not allowed"
+              (get e :allowed?)
+              false)
+            (acl-et-check!
+              "inherited deny: reason has member_of leaf"
+              (acl-et-has-leaf?
+                (get e :reason)
+                (list (quote member_of) (quote alice) (quote team)))
+              true)
+            (acl-et-check!
+              "inherited deny: reason has group deny leaf"
+              (acl-et-has-leaf?
+                (get e :reason)
+                (list (quote deny) (quote team) (quote read) (quote doc)))
+              true))))
+      (let
+        ((db (acl-build-db (list))))
+        (let
+          ((e (acl-explain db (quote u) (quote read) (quote p))))
+          (do
+            (acl-et-check! "no grant: not allowed" (get e :allowed?) false)
+            (acl-et-check! "no grant: proof nil" (get e :proof) nil)
+            (acl-et-check! "no grant: reason nil" (get e :reason) nil))))
+      (let
+        ((db (acl-build-db (list (acl-grant (quote u) (quote read) (quote p)) (acl-deny (quote u) (quote edit) (quote p))))))
+        (do
+          (acl-audit-clear!)
+          (acl-et-check! "audit: starts empty" (acl-audit-count) 0)
+          (acl-et-check!
+            "audit decide allowed returns true"
+            (acl-audit-decide! db (quote u) (quote read) (quote p))
+            true)
+          (acl-et-check!
+            "audit decide denied returns false"
+            (acl-audit-decide! db (quote u) (quote edit) (quote p))
+            false)
+          (acl-audit-decide! db (quote u) (quote comment) (quote p))
+          (acl-et-check!
+            "audit: count after three decisions"
+            (acl-audit-count)
+            3)
+          (acl-et-check!
+            "audit: tail size respects n"
+            (len (acl-audit-tail 2))
+            2)
+          (acl-et-check!
+            "audit: tail returns most recent"
+            (get (first (acl-audit-tail 1)) :act)
+            (quote comment))
+          (acl-et-check!
+            "audit: first record seq is 0"
+            (get (first (acl-audit-tail 3)) :seq)
+            0)
+          (acl-et-check!
+            "audit: allowed flag recorded"
+            (get (first (acl-audit-tail 3)) :allowed?)
+            true)
+          (acl-et-check!
+            "audit: serialize line count"
+            (len (acl-et-lines (acl-audit-serialize)))
+            3)
+          (acl-audit-clear!)
+          (acl-et-check!
+            "audit: clear resets count"
+            (acl-audit-count)
+            0))))))
+
+;; count newline-terminated lines in a serialized log
+(define acl-et-lines (fn (s) (acl-et-count-nl s 0 0)))
+(define
+  acl-et-count-nl
+  (fn
+    (s i n)
+    (if
+      (>= i (len s))
+      (if (= n 0) (list) (acl-et-rangelist n))
+      (acl-et-count-nl
+        s
+        (+ i 1)
+        (if (= (slice s i (+ i 1)) "\n") (+ n 1) n)))))
+(define
+  acl-et-rangelist
+  (fn
+    (n)
+    (if
+      (<= n 0)
+      (list)
+      (cons n (acl-et-rangelist (- n 1))))))
+
+(define
+  acl-explain-tests-run!
+  (fn
+    ()
+    (do
+      (set! acl-et-pass 0)
+      (set! acl-et-fail 0)
+      (set! acl-et-failures (list))
+      (acl-et-run-all!)
+      {:failures acl-et-failures :total (+ acl-et-pass acl-et-fail) :passed acl-et-pass :failed acl-et-fail})))

lib/acl/tests/fed.sx

@@ -0,0 +1,273 @@
+;; lib/acl/tests/fed.sx — Phase 4: federation (peer trust, delegation,
+;; cross-instance chains, revocation). fed-sx transport is mocked as a dict.
+
+(define acl-ft-pass 0)
+(define acl-ft-fail 0)
+(define acl-ft-failures (list))
+
+;; Name-based deep equality (host `=` compares symbols by unstable interned
+;; identity; see lib/acl/tests/explain.sx).
+(define
+  acl-ft-eq?
+  (fn
+    (a b)
+    (cond
+      ((and (list? a) (list? b))
+        (and (= (len a) (len b)) (acl-ft-eq-l? a b 0)))
+      ((and (symbol? a) (symbol? b))
+        (= (symbol->string a) (symbol->string b)))
+      (else (= a b)))))
+(define
+  acl-ft-eq-l?
+  (fn
+    (a b i)
+    (cond
+      ((>= i (len a)) true)
+      ((not (acl-ft-eq? (nth a i) (nth b i))) false)
+      (else (acl-ft-eq-l? a b (+ i 1))))))
+
+(define
+  acl-ft-check!
+  (fn
+    (name got expected)
+    (if
+      (acl-ft-eq? got expected)
+      (set! acl-ft-pass (+ acl-ft-pass 1))
+      (do
+        (set! acl-ft-fail (+ acl-ft-fail 1))
+        (append!
+          acl-ft-failures
+          (str name "\n    expected: " expected "\n    got:      " got))))))
+
+;; proof leaf walker (federated proofs reconstruct through the engine rule).
+(define
+  acl-ft-has-leaf?
+  (fn
+    (node target)
+    (cond
+      ((= node nil) false)
+      ((and (dict? node) (has-key? node :via))
+        (acl-ft-eq? (get node :fact) target))
+      ((and (dict? node) (has-key? node :body))
+        (acl-ft-any-leaf? (get node :body) target))
+      (else false))))
+(define
+  acl-ft-any-leaf?
+  (fn
+    (nodes target)
+    (cond
+      ((= (len nodes) 0) false)
+      ((acl-ft-has-leaf? (first nodes) target) true)
+      (else (acl-ft-any-leaf? (rest nodes) target)))))
+
+(define acl-ft-p? (fn (db s a r) (acl-permit? db s a r)))
+
+;; A standard federation fixture: local trusts peer alpha at "readonly", which
+;; covers read+comment. alpha delegates several capabilities to alice.
+(define
+  acl-ft-fixture
+  (fn
+    ()
+    (acl-build-db
+      (list
+        (acl-trust (quote alpha) (quote readonly))
+        (acl-level-covers (quote readonly) (quote read))
+        (acl-level-covers (quote readonly) (quote comment))
+        (acl-delegate (quote alpha) (quote alice) (quote read) (quote doc))
+        (acl-delegate (quote alpha) (quote alice) (quote edit) (quote doc))))))
+
+(define
+  acl-ft-run-all!
+  (fn
+    ()
+    (do
+      (let
+        ((db (acl-ft-fixture)))
+        (do
+          (acl-ft-check!
+            "trusted delegate, level covers action -> permit"
+            (acl-ft-p? db (quote alice) (quote read) (quote doc))
+            true)
+          (acl-ft-check!
+            "trusted delegate, level does NOT cover action -> deny"
+            (acl-ft-p? db (quote alice) (quote edit) (quote doc))
+            false)
+          (acl-ft-check!
+            "delegated but action class uncovered (comment has no delegate)"
+            (acl-ft-p? db (quote alice) (quote comment) (quote doc))
+            false)))
+      (let
+        ((db (acl-build-db (list (acl-level-covers (quote readonly) (quote read)) (acl-delegate (quote beta) (quote bob) (quote read) (quote doc))))))
+        (acl-ft-check!
+          "untrusted peer delegate -> deny"
+          (acl-ft-p? db (quote bob) (quote read) (quote doc))
+          false))
+      (let
+        ((db (acl-build-db (list (acl-trust (quote alpha) (quote readonly)) (acl-delegate (quote alpha) (quote alice) (quote read) (quote doc))))))
+        (acl-ft-check!
+          "trust but no level_covers -> deny"
+          (acl-ft-p? db (quote alice) (quote read) (quote doc))
+          false))
+      (let
+        ((db (acl-build-db (list (acl-trust (quote alpha) (quote full)) (acl-level-covers (quote full) (quote read)) (acl-delegate (quote alpha) (quote alice) (quote read) (quote doc)) (acl-delegate (quote beta) (quote bob) (quote read) (quote doc))))))
+        (do
+          (acl-ft-check!
+            "trust is per-peer: alpha's delegate applies"
+            (acl-ft-p? db (quote alice) (quote read) (quote doc))
+            true)
+          (acl-ft-check!
+            "trust not transitive: beta's delegate does not apply"
+            (acl-ft-p? db (quote bob) (quote read) (quote doc))
+            false)))
+      (let
+        ((db (acl-build-db (list (acl-trust (quote alpha) (quote full)) (acl-level-covers (quote full) (quote read)) (acl-delegate (quote alpha) (quote alice) (quote read) (quote doc)) (acl-deny (quote alice) (quote read) (quote doc))))))
+        (acl-ft-check!
+          "local deny overrides federated grant"
+          (acl-ft-p? db (quote alice) (quote read) (quote doc))
+          false))
+      (let
+        ((db (acl-build-db (list (acl-trust (quote alpha) (quote full)) (acl-level-covers (quote full) (quote read)) (acl-member-of (quote alice) (quote team)) (acl-delegate (quote alpha) (quote team) (quote read) (quote doc))))))
+        (acl-ft-check!
+          "federated grant to group reaches member"
+          (acl-ft-p? db (quote alice) (quote read) (quote doc))
+          true))
+      (let
+        ((db (acl-build-db (list (acl-trust (quote alpha) (quote full)) (acl-level-covers (quote full) (quote read)) (acl-child-of (quote sec) (quote book)) (acl-delegate (quote alpha) (quote u) (quote read) (quote book))))))
+        (acl-ft-check!
+          "federated grant on parent resource reaches child"
+          (acl-ft-p? db (quote u) (quote read) (quote sec))
+          true))
+      (let
+        ((transport {:gamma (list (acl-delegate (quote gamma) (quote carol) (quote read) (quote post))) :alpha (list (acl-delegate (quote alpha) (quote alice) (quote read) (quote doc)))}))
+        (do
+          (acl-ft-check!
+            "fetch known peer returns its delegates"
+            (len (acl-fed-fetch transport (quote alpha)))
+            1)
+          (acl-ft-check!
+            "fetch unknown peer returns empty"
+            (len (acl-fed-fetch transport (quote delta)))
+            0)
+          (acl-ft-check!
+            "collect across peers"
+            (len
+              (acl-fed-collect transport (list (quote alpha) (quote gamma))))
+            2)
+          (let
+            ((db (acl-fed-build-db (list (acl-trust (quote alpha) (quote readonly)) (acl-trust (quote gamma) (quote readonly)) (acl-level-covers (quote readonly) (quote read))) transport (list (quote alpha) (quote gamma)))))
+            (do
+              (acl-ft-check!
+                "fed-build-db: alpha delegate permits"
+                (acl-ft-p? db (quote alice) (quote read) (quote doc))
+                true)
+              (acl-ft-check!
+                "fed-build-db: gamma delegate permits"
+                (acl-ft-p? db (quote carol) (quote read) (quote post))
+                true)
+              (acl-ft-check!
+                "fed-build-db: untrusted action still denied"
+                (acl-ft-p? db (quote alice) (quote edit) (quote doc))
+                false)))))
+      (let
+        ((db (acl-build-db (list (acl-trust (quote alpha) (quote full)) (acl-level-covers (quote full) (quote read)) (acl-delegate (quote alpha) (quote alice) (quote read) (quote doc))))))
+        (do
+          (acl-ft-check!
+            "before revoke: permitted"
+            (acl-ft-p? db (quote alice) (quote read) (quote doc))
+            true)
+          (acl-revoke!
+            db
+            (acl-delegate
+              (quote alpha)
+              (quote alice)
+              (quote read)
+              (quote doc)))
+          (acl-ft-check!
+            "after delegate revoked: denied"
+            (acl-ft-p? db (quote alice) (quote read) (quote doc))
+            false)))
+      (let
+        ((db (acl-build-db (list (acl-trust (quote alpha) (quote full)) (acl-level-covers (quote full) (quote read)) (acl-delegate (quote alpha) (quote alice) (quote read) (quote doc))))))
+        (do
+          (acl-ft-check!
+            "before trust revoke: permitted"
+            (acl-ft-p? db (quote alice) (quote read) (quote doc))
+            true)
+          (acl-revoke! db (acl-trust (quote alpha) (quote full)))
+          (acl-ft-check!
+            "after trust revoked: denied"
+            (acl-ft-p? db (quote alice) (quote read) (quote doc))
+            false)))
+      (let
+        ((db (acl-build-db (list (acl-level-covers (quote full) (quote read)) (acl-delegate (quote alpha) (quote alice) (quote read) (quote doc))))))
+        (do
+          (acl-ft-check!
+            "delegate without trust: denied"
+            (acl-ft-p? db (quote alice) (quote read) (quote doc))
+            false)
+          (acl-fed-assert! db (acl-trust (quote alpha) (quote full)))
+          (acl-ft-check!
+            "trust ingested then re-checked: permitted"
+            (acl-ft-p? db (quote alice) (quote read) (quote doc))
+            true)))
+      (let
+        ((db (acl-ft-fixture)))
+        (let
+          ((e (acl-explain db (quote alice) (quote read) (quote doc))))
+          (do
+            (acl-ft-check! "federated proof allowed?" (get e :allowed?) true)
+            (acl-ft-check!
+              "federated proof has delegate leaf"
+              (acl-ft-has-leaf?
+                (get e :proof)
+                (list
+                  (quote delegate)
+                  (quote alpha)
+                  (quote alice)
+                  (quote read)
+                  (quote doc)))
+              true)
+            (acl-ft-check!
+              "federated proof has trust leaf"
+              (acl-ft-has-leaf?
+                (get e :proof)
+                (list (quote trust) (quote alpha) (quote readonly)))
+              true)
+            (acl-ft-check!
+              "federated proof has level_covers leaf"
+              (acl-ft-has-leaf?
+                (get e :proof)
+                (list (quote level_covers) (quote readonly) (quote read)))
+              true))))
+      (acl-ft-check!
+        "schema delegate arity valid"
+        (acl-fact-valid?
+          (acl-delegate (quote p) (quote s) (quote a) (quote r)))
+        true)
+      (acl-ft-check!
+        "schema trust arity valid"
+        (acl-fact-valid? (acl-trust (quote p) (quote l)))
+        true)
+      (acl-ft-check!
+        "schema peer arity valid"
+        (acl-fact-valid? (acl-peer (quote p) (quote peer)))
+        true)
+      (acl-ft-check!
+        "schema level_covers arity valid"
+        (acl-fact-valid? (acl-level-covers (quote l) (quote read)))
+        true)
+      (acl-ft-check!
+        "schema delegate bad arity invalid"
+        (acl-fact-valid? (list (quote delegate) (quote p) (quote s)))
+        false))))
+
+(define
+  acl-fed-tests-run!
+  (fn
+    ()
+    (do
+      (set! acl-ft-pass 0)
+      (set! acl-ft-fail 0)
+      (set! acl-ft-failures (list))
+      (acl-ft-run-all!)
+      {:failures acl-ft-failures :total (+ acl-ft-pass acl-ft-fail) :passed acl-ft-pass :failed acl-ft-fail})))

lib/acl/tests/harden.sx

@@ -0,0 +1,228 @@
+;; lib/acl/tests/harden.sx — adversarial / cross-phase hardening.
+;;
+;; Diamond hierarchies, conflict resolution where deny must win through every
+;; path, chain inheritance, cycle termination, multi-peer delegation, fact
+;; validation, and audit save/restore.
+;;
+;; PROVER-FREE BY DESIGN: this suite calls only acl-permit? (which runs in
+;; compiled Datalog, safe at any depth) plus pure data ops — never acl-explain /
+;; acl-prove-d. The SX-side proof reconstructor recurses, and once the kernel
+;; JIT-compiles it (after the explain/fed suites warm the process) it loops on
+;; chains deeper than ~3 (substrate JIT bug — see plan Blockers). Proof
+;; reconstruction is covered by tests/explain.sx (and federated proofs by
+;; tests/fed.sx), both of which stay under the warm-process depth threshold.
+
+(define acl-hd-pass 0)
+(define acl-hd-fail 0)
+(define acl-hd-failures (list))
+
+(define
+  acl-hd-check!
+  (fn
+    (name got expected)
+    (if
+      (= got expected)
+      (set! acl-hd-pass (+ acl-hd-pass 1))
+      (do
+        (set! acl-hd-fail (+ acl-hd-fail 1))
+        (append!
+          acl-hd-failures
+          (str name "\n    expected: " expected "\n    got:      " got))))))
+
+(define acl-hd-p? (fn (db s a r) (acl-permit? db s a r)))
+
+(define
+  acl-hd-run-all!
+  (fn
+    ()
+    (do
+      (let
+        ((grant-deny (acl-build-db (list (acl-child-of (quote r) (quote p1)) (acl-child-of (quote r) (quote p2)) (acl-grant (quote u) (quote read) (quote p1)) (acl-deny (quote u) (quote read) (quote p2)))))
+          (both-grant
+            (acl-build-db
+              (list
+                (acl-child-of (quote r) (quote p1))
+                (acl-child-of (quote r) (quote p2))
+                (acl-grant (quote u) (quote read) (quote p1))
+                (acl-grant (quote u) (quote read) (quote p2))))))
+        (do
+          (acl-hd-check!
+            "diamond resource: grant+deny parents -> deny wins"
+            (acl-hd-p? grant-deny (quote u) (quote read) (quote r))
+            false)
+          (acl-hd-check!
+            "diamond resource: both grant -> permit"
+            (acl-hd-p? both-grant (quote u) (quote read) (quote r))
+            true)
+          (acl-hd-check!
+            "diamond resource: deny does not leak to other parent"
+            (acl-hd-p? grant-deny (quote u) (quote read) (quote p1))
+            true)))
+      (let
+        ((grant-deny (acl-build-db (list (acl-member-of (quote alice) (quote g1)) (acl-member-of (quote alice) (quote g2)) (acl-grant (quote g1) (quote read) (quote doc)) (acl-deny (quote g2) (quote read) (quote doc)))))
+          (both-grant
+            (acl-build-db
+              (list
+                (acl-member-of (quote alice) (quote g1))
+                (acl-member-of (quote alice) (quote g2))
+                (acl-grant (quote g1) (quote read) (quote doc))
+                (acl-grant (quote g2) (quote read) (quote doc))))))
+        (do
+          (acl-hd-check!
+            "diamond group: grant+deny groups -> deny wins"
+            (acl-hd-p? grant-deny (quote alice) (quote read) (quote doc))
+            false)
+          (acl-hd-check!
+            "diamond group: both grant -> permit"
+            (acl-hd-p? both-grant (quote alice) (quote read) (quote doc))
+            true)))
+      (let
+        ((chain (acl-build-db (list (acl-member-of (quote a0) (quote a1)) (acl-member-of (quote a1) (quote a2)) (acl-member-of (quote a2) (quote a3)) (acl-member-of (quote a3) (quote a4)) (acl-grant (quote a4) (quote read) (quote res)))))
+          (chain-deny
+            (acl-build-db
+              (list
+                (acl-member-of (quote a0) (quote a1))
+                (acl-member-of (quote a1) (quote a2))
+                (acl-member-of (quote a2) (quote a3))
+                (acl-member-of (quote a3) (quote a4))
+                (acl-grant (quote a4) (quote read) (quote res))
+                (acl-deny (quote a0) (quote read) (quote res))))))
+        (do
+          (acl-hd-check!
+            "chain: top-group grant reaches leaf member"
+            (acl-hd-p? chain (quote a0) (quote read) (quote res))
+            true)
+          (acl-hd-check!
+            "chain: intermediate also covered"
+            (acl-hd-p? chain (quote a2) (quote read) (quote res))
+            true)
+          (acl-hd-check!
+            "chain: leaf-member deny overrides top grant"
+            (acl-hd-p? chain-deny (quote a0) (quote read) (quote res))
+            false)
+          (acl-hd-check!
+            "chain: deny on leaf does not block sibling level"
+            (acl-hd-p? chain-deny (quote a1) (quote read) (quote res))
+            true)))
+      (let
+        ((self-member (acl-build-db (list (acl-member-of (quote a) (quote a)) (acl-grant (quote a) (quote read) (quote r)))))
+          (self-child
+            (acl-build-db
+              (list
+                (acl-child-of (quote r) (quote r))
+                (acl-grant (quote u) (quote read) (quote r)))))
+          (two-cycle
+            (acl-build-db
+              (list
+                (acl-member-of (quote x) (quote y))
+                (acl-member-of (quote y) (quote x))
+                (acl-grant (quote y) (quote read) (quote r))))))
+        (do
+          (acl-hd-check!
+            "self-membership cycle terminates and grants"
+            (acl-hd-p? self-member (quote a) (quote read) (quote r))
+            true)
+          (acl-hd-check!
+            "self-child cycle terminates and grants"
+            (acl-hd-p? self-child (quote u) (quote read) (quote r))
+            true)
+          (acl-hd-check!
+            "two-node membership cycle terminates"
+            (acl-hd-p? two-cycle (quote x) (quote read) (quote r))
+            true)))
+      (let
+        ((db (acl-build-db (list (acl-trust (quote alpha) (quote full)) (acl-level-covers (quote full) (quote read)) (acl-member-of (quote alice) (quote team)) (acl-delegate (quote alpha) (quote team) (quote read) (quote doc)) (acl-deny (quote alice) (quote read) (quote doc))))))
+        (acl-hd-check!
+          "federated group grant, local member deny -> deny wins"
+          (acl-hd-p? db (quote alice) (quote read) (quote doc))
+          false))
+      (let
+        ((db (acl-build-db (list (acl-trust (quote alpha) (quote full)) (acl-level-covers (quote full) (quote read)) (acl-delegate (quote alpha) (quote bob) (quote read) (quote doc)) (acl-delegate (quote beta) (quote bob) (quote read) (quote doc))))))
+        (acl-hd-check!
+          "two peers delegate, one trusted -> permit"
+          (acl-hd-p? db (quote bob) (quote read) (quote doc))
+          true))
+      (let
+        ((db (acl-build-db (list (acl-trust (quote alpha) (quote full)) (acl-trust (quote beta) (quote full)) (acl-level-covers (quote full) (quote read)) (acl-delegate (quote alpha) (quote bob) (quote read) (quote doc)) (acl-delegate (quote beta) (quote bob) (quote read) (quote doc))))))
+        (acl-hd-check!
+          "two peers both trusted -> permit"
+          (acl-hd-p? db (quote bob) (quote read) (quote doc))
+          true))
+      (let
+        ((empty (acl-build-db (list))))
+        (acl-hd-check!
+          "empty db: nothing permitted"
+          (acl-hd-p? empty (quote u) (quote read) (quote r))
+          false))
+      (do
+        (acl-hd-check!
+          "validate: clean set has no bad facts"
+          (len
+            (acl-validate-facts
+              (list
+                (acl-grant (quote u) (quote read) (quote p))
+                (acl-member-of (quote u) (quote g))
+                (acl-delegate (quote pe) (quote u) (quote read) (quote p)))))
+          0)
+        (acl-hd-check!
+          "validate: facts-valid? true on clean set"
+          (acl-facts-valid?
+            (list (acl-grant (quote u) (quote read) (quote p))))
+          true)
+        (acl-hd-check!
+          "validate: surfaces wrong-arity and unknown predicate"
+          (len
+            (acl-validate-facts
+              (list
+                (acl-grant (quote u) (quote read) (quote p))
+                (list (quote grant) (quote u))
+                (list (quote bogus) (quote x) (quote y)))))
+          2)
+        (acl-hd-check!
+          "validate: empty set is valid"
+          (acl-facts-valid? (list))
+          true))
+      (let
+        ((db (acl-build-db (list (acl-grant (quote u) (quote read) (quote p)) (acl-deny (quote u) (quote edit) (quote p))))))
+        (do
+          (acl-audit-clear!)
+          (acl-audit-decide! db (quote u) (quote read) (quote p))
+          (acl-audit-decide! db (quote u) (quote edit) (quote p))
+          (let
+            ((snap (acl-audit-snapshot)))
+            (do
+              (acl-audit-clear!)
+              (acl-hd-check!
+                "audit: cleared count is 0"
+                (acl-audit-count)
+                0)
+              (acl-audit-restore! snap)
+              (acl-hd-check!
+                "audit: restored count"
+                (acl-audit-count)
+                2)
+              (acl-hd-check!
+                "audit: restored last act"
+                (get (first (acl-audit-tail 1)) :act)
+                (quote edit))
+              (acl-audit-decide! db (quote u) (quote comment) (quote p))
+              (acl-hd-check!
+                "audit: seq continues after restore"
+                (get (first (acl-audit-tail 1)) :seq)
+                2)
+              (acl-hd-check!
+                "audit: snapshot is an immutable copy"
+                (len (get snap :entries))
+                2)
+              (acl-audit-clear!))))))))
+
+(define
+  acl-harden-tests-run!
+  (fn
+    ()
+    (do
+      (set! acl-hd-pass 0)
+      (set! acl-hd-fail 0)
+      (set! acl-hd-failures (list))
+      (acl-hd-run-all!)
+      {:failures acl-hd-failures :total (+ acl-hd-pass acl-hd-fail) :passed acl-hd-pass :failed acl-hd-fail})))

lib/acl/tests/inherit.sx

@@ -0,0 +1,202 @@
+;; lib/acl/tests/inherit.sx — Phase 2: inheritance (groups, resource trees,
+;; role expansion) with deny-overrides.
+
+(define acl-it-pass 0)
+(define acl-it-fail 0)
+(define acl-it-failures (list))
+
+(define
+  acl-it-check!
+  (fn
+    (name got expected)
+    (if
+      (= got expected)
+      (set! acl-it-pass (+ acl-it-pass 1))
+      (do
+        (set! acl-it-fail (+ acl-it-fail 1))
+        (append!
+          acl-it-failures
+          (str name "\n    expected: " expected "\n    got:      " got))))))
+
+(define acl-it-p? (fn (db s a r) (acl-permit? db s a r)))
+
+(define
+  acl-it-run-all!
+  (fn
+    ()
+    (do
+      (let
+        ((db (acl-build-db (list (acl-member-of (quote alice) (quote team)) (acl-grant (quote team) (quote read) (quote doc))))))
+        (do
+          (acl-it-check!
+            "group grant reaches member"
+            (acl-it-p? db (quote alice) (quote read) (quote doc))
+            true)
+          (acl-it-check!
+            "group grant: non-member excluded"
+            (acl-it-p? db (quote bob) (quote read) (quote doc))
+            false)
+          (acl-it-check!
+            "group grant: wrong action"
+            (acl-it-p? db (quote alice) (quote edit) (quote doc))
+            false)))
+      (let
+        ((db (acl-build-db (list (acl-member-of (quote alice) (quote team)) (acl-member-of (quote team) (quote org)) (acl-member-of (quote org) (quote company)) (acl-grant (quote company) (quote read) (quote doc))))))
+        (do
+          (acl-it-check!
+            "deep nested group grant reaches leaf member"
+            (acl-it-p? db (quote alice) (quote read) (quote doc))
+            true)
+          (acl-it-check!
+            "intermediate group also covered"
+            (acl-it-p? db (quote team) (quote read) (quote doc))
+            true)
+          (acl-it-check!
+            "mid group org covered"
+            (acl-it-p? db (quote org) (quote read) (quote doc))
+            true)))
+      (let
+        ((db (acl-build-db (list (acl-member-of (quote a) (quote b)) (acl-member-of (quote b) (quote a)) (acl-grant (quote b) (quote read) (quote r))))))
+        (do
+          (acl-it-check!
+            "cyclic membership terminates and grants"
+            (acl-it-p? db (quote a) (quote read) (quote r))
+            true)
+          (acl-it-check!
+            "cyclic membership covers both"
+            (acl-it-p? db (quote b) (quote read) (quote r))
+            true)))
+      (let
+        ((db (acl-build-db (list (acl-child-of (quote sec) (quote chap)) (acl-child-of (quote chap) (quote book)) (acl-grant (quote u) (quote read) (quote book))))))
+        (do
+          (acl-it-check!
+            "parent grant reaches direct child"
+            (acl-it-p? db (quote u) (quote read) (quote chap))
+            true)
+          (acl-it-check!
+            "parent grant reaches deep descendant"
+            (acl-it-p? db (quote u) (quote read) (quote sec))
+            true)
+          (acl-it-check!
+            "parent grant covers parent itself"
+            (acl-it-p? db (quote u) (quote read) (quote book))
+            true)
+          (acl-it-check!
+            "child grant does not climb to parent"
+            (acl-it-p?
+              (acl-build-db
+                (list
+                  (acl-child-of (quote sec) (quote book))
+                  (acl-grant (quote u) (quote read) (quote sec))))
+              (quote u)
+              (quote read)
+              (quote book))
+            false)))
+      (let
+        ((db (acl-build-db (list (acl-member-of (quote alice) (quote team)) (acl-child-of (quote post1) (quote board)) (acl-grant (quote team) (quote comment) (quote board))))))
+        (do
+          (acl-it-check!
+            "group + resource: member on child resource"
+            (acl-it-p? db (quote alice) (quote comment) (quote post1))
+            true)
+          (acl-it-check!
+            "group + resource: member on parent resource"
+            (acl-it-p? db (quote alice) (quote comment) (quote board))
+            true)))
+      (let
+        ((db (acl-build-db (list (acl-member-of (quote bob) (quote editor)) (acl-role-grant (quote editor) (quote edit) (quote page1)) (acl-role-grant (quote editor) (quote read) (quote page1))))))
+        (do
+          (acl-it-check!
+            "role confers edit to member"
+            (acl-it-p? db (quote bob) (quote edit) (quote page1))
+            true)
+          (acl-it-check!
+            "role confers read to member"
+            (acl-it-p? db (quote bob) (quote read) (quote page1))
+            true)
+          (acl-it-check!
+            "role: capability not in tuple denied"
+            (acl-it-p? db (quote bob) (quote moderate) (quote page1))
+            false)
+          (acl-it-check!
+            "role: non-member excluded"
+            (acl-it-p? db (quote eve) (quote edit) (quote page1))
+            false)))
+      (let
+        ((db (acl-build-db (list (acl-member-of (quote bob) (quote editor)) (acl-child-of (quote draft) (quote page1)) (acl-role-grant (quote editor) (quote edit) (quote page1))))))
+        (acl-it-check!
+          "role grant flows to child resource"
+          (acl-it-p? db (quote bob) (quote edit) (quote draft))
+          true))
+      (let
+        ((db (acl-build-db (list (acl-member-of (quote alice) (quote team)) (acl-grant (quote team) (quote read) (quote doc)) (acl-deny (quote alice) (quote read) (quote doc))))))
+        (acl-it-check!
+          "explicit deny beats inherited group allow"
+          (acl-it-p? db (quote alice) (quote read) (quote doc))
+          false))
+      (let
+        ((db (acl-build-db (list (acl-member-of (quote alice) (quote team)) (acl-grant (quote alice) (quote read) (quote doc)) (acl-deny (quote team) (quote read) (quote doc))))))
+        (do
+          (acl-it-check!
+            "group deny inherits and overrides direct grant"
+            (acl-it-p? db (quote alice) (quote read) (quote doc))
+            false)
+          (acl-it-check!
+            "group deny: another member also blocked"
+            (acl-it-p? db (quote team) (quote read) (quote doc))
+            false)))
+      (let
+        ((db (acl-build-db (list (acl-child-of (quote sec) (quote book)) (acl-grant (quote u) (quote read) (quote sec)) (acl-deny (quote u) (quote read) (quote book))))))
+        (acl-it-check!
+          "ancestor deny overrides descendant grant"
+          (acl-it-p? db (quote u) (quote read) (quote sec))
+          false))
+      (let
+        ((db (acl-build-db (list (acl-member-of (quote alice) (quote team)) (acl-grant (quote team) (quote read) (quote doc)) (acl-grant (quote team) (quote edit) (quote doc)) (acl-deny (quote alice) (quote edit) (quote doc))))))
+        (do
+          (acl-it-check!
+            "deny on edit leaves inherited read intact"
+            (acl-it-p? db (quote alice) (quote read) (quote doc))
+            true)
+          (acl-it-check!
+            "deny on edit blocks edit"
+            (acl-it-p? db (quote alice) (quote edit) (quote doc))
+            false)))
+      (let
+        ((db (acl-build-db (list (acl-member-of (quote alice) (quote team)) (acl-deny (quote team) (quote read) (quote doc))))))
+        (acl-it-check!
+          "inherited deny, no grant: denied"
+          (acl-it-p? db (quote alice) (quote read) (quote doc))
+          false))
+      (let
+        ((db (acl-build-db (list (acl-child-of (quote a) (quote root)) (acl-child-of (quote b) (quote root)) (acl-grant (quote u) (quote read) (quote root)) (acl-deny (quote u) (quote read) (quote a))))))
+        (do
+          (acl-it-check!
+            "deny on sibling a blocks a"
+            (acl-it-p? db (quote u) (quote read) (quote a))
+            false)
+          (acl-it-check!
+            "deny on sibling a leaves b permitted"
+            (acl-it-p? db (quote u) (quote read) (quote b))
+            true)
+          (acl-it-check!
+            "root itself still permitted"
+            (acl-it-p? db (quote u) (quote read) (quote root))
+            true)))
+      (let
+        ((db (acl-build-db (list (acl-grant (quote x) (quote read) (quote y))))))
+        (acl-it-check!
+          "direct grant under inheritance ruleset"
+          (acl-it-p? db (quote x) (quote read) (quote y))
+          true)))))
+
+(define
+  acl-inherit-tests-run!
+  (fn
+    ()
+    (do
+      (set! acl-it-pass 0)
+      (set! acl-it-fail 0)
+      (set! acl-it-failures (list))
+      (acl-it-run-all!)
+      {:failures acl-it-failures :total (+ acl-it-pass acl-it-fail) :passed acl-it-pass :failed acl-it-fail})))

lib/apl/conformance.conf

@@ -0,0 +1,63 @@
+# APL conformance config — sourced by lib/guest/conformance.sh.
+
+LANG_NAME=apl
+MODE=counters
+COUNTERS_PASS=apl-test-pass
+COUNTERS_FAIL=apl-test-fail
+TIMEOUT_PER_SUITE=300
+
+PRELOADS=(
+  spec/stdlib.sx
+  lib/r7rs.sx
+  lib/apl/runtime.sx
+  lib/apl/tokenizer.sx
+  lib/apl/parser.sx
+  lib/apl/transpile.sx
+  lib/apl/test-harness.sx
+)
+
+SUITES=(
+  "structural:lib/apl/tests/structural.sx"
+  "operators:lib/apl/tests/operators.sx"
+  "dfn:lib/apl/tests/dfn.sx"
+  "tradfn:lib/apl/tests/tradfn.sx"
+  "valence:lib/apl/tests/valence.sx"
+  "programs:lib/apl/tests/programs.sx"
+  "system:lib/apl/tests/system.sx"
+  "idioms:lib/apl/tests/idioms.sx"
+  "eval-ops:lib/apl/tests/eval-ops.sx"
+  "pipeline:lib/apl/tests/pipeline.sx"
+)
+
+emit_scoreboard_json() {
+  local n=${#GC_NAMES[@]} i sep
+  printf '{\n'
+  printf '  "suites": {\n'
+  for ((i=0; i<n; i++)); do
+    sep=","; [ $i -eq $((n-1)) ] && sep=""
+    printf '    "%s": {"pass": %d, "fail": %d}%s\n' \
+      "${GC_NAMES[$i]}" "${GC_PASS[$i]}" "${GC_FAIL[$i]}" "$sep"
+  done
+  printf '  },\n'
+  printf '  "total_pass": %d,\n' "$GC_TOTAL_PASS"
+  printf '  "total_fail": %d,\n' "$GC_TOTAL_FAIL"
+  printf '  "total": %d\n' "$GC_TOTAL"
+  printf '}\n'
+}
+
+emit_scoreboard_md() {
+  local n=${#GC_NAMES[@]} i
+  printf '# APL Conformance Scoreboard\n\n'
+  printf '_Generated by `lib/apl/conformance.sh`_\n\n'
+  printf '| Suite | Pass | Fail | Total |\n'
+  printf '|-------|-----:|-----:|------:|\n'
+  for ((i=0; i<n; i++)); do
+    printf '| %s | %d | %d | %d |\n' \
+      "${GC_NAMES[$i]}" "${GC_PASS[$i]}" "${GC_FAIL[$i]}" "${GC_TOTAL_S[$i]}"
+  done
+  printf '| **Total** | **%d** | **%d** | **%d** |\n' "$GC_TOTAL_PASS" "$GC_TOTAL_FAIL" "$GC_TOTAL"
+  printf '\n'
+  printf '## Notes\n\n'
+  printf '%s\n' '- Suites use the standard `apl-test name got expected` framework loaded against `lib/apl/runtime.sx` + `lib/apl/transpile.sx`.'
+  printf '%s\n' '- `lib/apl/tests/parse.sx` and `lib/apl/tests/scalar.sx` use their own self-contained frameworks and are excluded from this scoreboard.'
+}

lib/apl/conformance.sh

@@ -1,116 +1,5 @@
 #!/usr/bin/env bash
-# lib/apl/conformance.sh — run APL test suites, emit scoreboard.json + scoreboard.md.
-
-set -uo pipefail
-cd "$(git rev-parse --show-toplevel)"
-
-SX_SERVER="${SX_SERVER:-/root/rose-ash/hosts/ocaml/_build/default/bin/sx_server.exe}"
-if [ ! -x "$SX_SERVER" ]; then
-  SX_SERVER="hosts/ocaml/_build/default/bin/sx_server.exe"
-fi
-if [ ! -x "$SX_SERVER" ]; then
-  echo "ERROR: sx_server.exe not found." >&2
-  exit 1
-fi
-
-SUITES=(structural operators dfn tradfn valence programs system idioms eval-ops pipeline)
-
-OUT_JSON="lib/apl/scoreboard.json"
-OUT_MD="lib/apl/scoreboard.md"
-
-run_suite() {
-  local suite=$1
-  local file="lib/apl/tests/${suite}.sx"
-  local TMP
-  TMP=$(mktemp)
-  cat > "$TMP" << EPOCHS
-(epoch 1)
-(load "spec/stdlib.sx")
-(load "lib/r7rs.sx")
-(load "lib/apl/runtime.sx")
-(load "lib/apl/tokenizer.sx")
-(load "lib/apl/parser.sx")
-(load "lib/apl/transpile.sx")
-(epoch 2)
-(eval "(define apl-test-pass 0)")
-(eval "(define apl-test-fail 0)")
-(eval "(define apl-test (fn (name got expected) (if (= got expected) (set! apl-test-pass (+ apl-test-pass 1)) (set! apl-test-fail (+ apl-test-fail 1)))))")
-(epoch 3)
-(load "${file}")
-(epoch 4)
-(eval "(list apl-test-pass apl-test-fail)")
-EPOCHS
-
-  local OUTPUT
-  OUTPUT=$(timeout 300 "$SX_SERVER" < "$TMP" 2>/dev/null)
-  rm -f "$TMP"
-
-  local LINE
-  LINE=$(echo "$OUTPUT" | awk '/^\(ok-len 4 / {getline; print; exit}')
-  if [ -z "$LINE" ]; then
-    LINE=$(echo "$OUTPUT" | grep -E '^\(ok 4 \([0-9]+ [0-9]+\)\)' | tail -1 \
-            | sed -E 's/^\(ok 4 //; s/\)$//')
-  fi
-
-  local P F
-  P=$(echo "$LINE" | sed -E 's/^\(([0-9]+) ([0-9]+)\).*/\1/')
-  F=$(echo "$LINE" | sed -E 's/^\(([0-9]+) ([0-9]+)\).*/\2/')
-  P=${P:-0}
-  F=${F:-0}
-  echo "${P} ${F}"
-}
-
-declare -A SUITE_PASS
-declare -A SUITE_FAIL
-TOTAL_PASS=0
-TOTAL_FAIL=0
-
-echo "Running APL conformance suite..." >&2
-for s in "${SUITES[@]}"; do
-  read -r p f < <(run_suite "$s")
-  SUITE_PASS[$s]=$p
-  SUITE_FAIL[$s]=$f
-  TOTAL_PASS=$((TOTAL_PASS + p))
-  TOTAL_FAIL=$((TOTAL_FAIL + f))
-  printf "  %-12s %d/%d\n" "$s" "$p" "$((p+f))" >&2
-done
-
-# scoreboard.json
-{
-  printf '{\n'
-  printf '  "suites": {\n'
-  first=1
-  for s in "${SUITES[@]}"; do
-    if [ $first -eq 0 ]; then printf ',\n'; fi
-    printf '    "%s": {"pass": %d, "fail": %d}' "$s" "${SUITE_PASS[$s]}" "${SUITE_FAIL[$s]}"
-    first=0
-  done
-  printf '\n  },\n'
-  printf '  "total_pass": %d,\n' "$TOTAL_PASS"
-  printf '  "total_fail": %d,\n' "$TOTAL_FAIL"
-  printf '  "total": %d\n' "$((TOTAL_PASS + TOTAL_FAIL))"
-  printf '}\n'
-} > "$OUT_JSON"
-
-# scoreboard.md
-{
-  printf '# APL Conformance Scoreboard\n\n'
-  printf '_Generated by `lib/apl/conformance.sh`_\n\n'
-  printf '| Suite | Pass | Fail | Total |\n'
-  printf '|-------|-----:|-----:|------:|\n'
-  for s in "${SUITES[@]}"; do
-    p=${SUITE_PASS[$s]}
-    f=${SUITE_FAIL[$s]}
-    printf '| %s | %d | %d | %d |\n' "$s" "$p" "$f" "$((p+f))"
-  done
-  printf '| **Total** | **%d** | **%d** | **%d** |\n' "$TOTAL_PASS" "$TOTAL_FAIL" "$((TOTAL_PASS + TOTAL_FAIL))"
-  printf '\n'
-  printf '## Notes\n\n'
-  printf '%s\n' '- Suites use the standard `apl-test name got expected` framework loaded against `lib/apl/runtime.sx` + `lib/apl/transpile.sx`.'
-  printf '%s\n' '- `lib/apl/tests/parse.sx` and `lib/apl/tests/scalar.sx` use their own self-contained frameworks and are excluded from this scoreboard.'
-} > "$OUT_MD"
-
-echo "Wrote $OUT_JSON and $OUT_MD" >&2
-echo "Total: $TOTAL_PASS pass, $TOTAL_FAIL fail" >&2
-
-[ "$TOTAL_FAIL" -eq 0 ]
+# lib/apl/conformance.sh — APL conformance via the shared guest driver.
+# Config lives in lib/apl/conformance.conf (MODE=counters). Override the binary
+# with SX_SERVER=path/to/sx_server.exe bash lib/apl/conformance.sh
+exec bash "$(dirname "$0")/../guest/conformance.sh" "$(dirname "$0")/conformance.conf" "$@"

lib/apl/parser.sx

@@ -270,6 +270,15 @@
               (collect-segments-loop tokens (+ i 1) (append acc {:kind "val" :node (list :str tv)})))
             ((= tt :name)
               (cond
+                ((and (< (+ i 1) (len tokens)) (= (tok-type (nth tokens (+ i 1))) :assign))
+                  (let
+                    ((rhs-tokens (slice tokens (+ i 2) (len tokens))))
+                    (let
+                      ((rhs-expr (parse-apl-expr rhs-tokens)))
+                      (collect-segments-loop
+                        tokens
+                        (len tokens)
+                        (append acc {:kind "val" :node (list :assign-expr tv rhs-expr)})))))
                 ((some (fn (q) (= q tv)) apl-quad-fn-names)
                   (let
                     ((op-result (collect-ops tokens (+ i 1))))
@@ -335,10 +344,22 @@
             ((= tt :glyph)
               (cond
                 ((or (= tv "⍺") (= tv "⍵"))
-                  (collect-segments-loop
-                    tokens
-                    (+ i 1)
-                    (append acc {:kind "val" :node (list :name tv)})))
+                  (if
+                    (and
+                      (< (+ i 1) (len tokens))
+                      (= (tok-type (nth tokens (+ i 1))) :assign))
+                    (let
+                      ((rhs-tokens (slice tokens (+ i 2) (len tokens))))
+                      (let
+                        ((rhs-expr (parse-apl-expr rhs-tokens)))
+                        (collect-segments-loop
+                          tokens
+                          (len tokens)
+                          (append acc {:kind "val" :node (list :assign-expr tv rhs-expr)}))))
+                    (collect-segments-loop
+                      tokens
+                      (+ i 1)
+                      (append acc {:kind "val" :node (list :name tv)}))))
                 ((= tv "∇")
                   (collect-segments-loop
                     tokens
@@ -393,7 +414,23 @@
                             ni
                             (append acc {:kind "fn" :node fn-node})))))))
                 ((apl-parse-op-glyph? tv)
-                  (collect-segments-loop tokens (+ i 1) acc))
+                  (if
+                    (or (= tv "/") (= tv "⌿") (= tv "\\") (= tv "⍀"))
+                    (let
+                      ((next-i (+ i 1)))
+                      (let
+                        ((next-tok (if (< next-i n) (nth tokens next-i) nil)))
+                        (let
+                          ((mod (if (and next-tok (= (tok-type next-tok) :glyph) (or (= (get next-tok :value) "⍨") (= (get next-tok :value) "¨"))) (get next-tok :value) nil))
+                            (base-fn-node (list :fn-glyph tv)))
+                          (let
+                            ((node (if mod (list :derived-fn mod base-fn-node) base-fn-node))
+                              (advance (if mod 2 1)))
+                            (collect-segments-loop
+                              tokens
+                              (+ i advance)
+                              (append acc {:kind "fn" :node node}))))))
+                    (collect-segments-loop tokens (+ i 1) acc)))
                 (true (collect-segments-loop tokens (+ i 1) acc))))
             (true (collect-segments-loop tokens (+ i 1) acc))))))))
 

lib/apl/runtime.sx

@@ -65,10 +65,30 @@
             (get a :shape)
             (map (fn (x) (f x sv)) (get a :ravel)))))
       (else
-        (if
-          (equal? (get a :shape) (get b :shape))
-          (make-array (get a :shape) (map f (get a :ravel) (get b :ravel)))
-          (error "length error: shape mismatch"))))))
+        (let
+          ((a-shape (get a :shape)) (b-shape (get b :shape)))
+          (cond
+            ((equal? a-shape b-shape)
+              (make-array a-shape (map f (get a :ravel) (get b :ravel))))
+            ((and (= (len a-shape) 1) (> (len b-shape) 1))
+              (make-array
+                (append a-shape b-shape)
+                (flatten
+                  (map
+                    (fn
+                      (x)
+                      (get (broadcast-dyadic f (apl-scalar x) b) :ravel))
+                    (get a :ravel)))))
+            ((and (= (len b-shape) 1) (> (len a-shape) 1))
+              (make-array
+                (append a-shape b-shape)
+                (flatten
+                  (map
+                    (fn
+                      (acell)
+                      (get (broadcast-dyadic f (apl-scalar acell) b) :ravel))
+                    (get a :ravel)))))
+            (else (error "length error: shape mismatch"))))))))
 
 ; ============================================================
 ; Arithmetic primitives
@@ -808,6 +828,125 @@
           ((picked (map (fn (i) (nth arr-ravel i)) kept)))
           (make-array (list (len picked)) picked))))))
 
+(define
+  apl-compress-first
+  (fn
+    (mask arr)
+    (let
+      ((mask-ravel (get mask :ravel))
+        (shape (get arr :shape))
+        (ravel (get arr :ravel)))
+      (if
+        (< (len shape) 2)
+        (apl-compress mask arr)
+        (let
+          ((rows (first shape)) (cols (last shape)))
+          (let
+            ((kept-rows (filter (fn (i) (not (= 0 (nth mask-ravel i)))) (range 0 rows))))
+            (let
+              ((new-ravel (reduce (fn (acc r) (append acc (map (fn (j) (nth ravel (+ (* r cols) j))) (range 0 cols)))) (list) kept-rows)))
+              (make-array (cons (len kept-rows) (rest shape)) new-ravel))))))))
+
+(define
+  apl-where
+  (fn
+    (arr)
+    (let
+      ((ravel (get arr :ravel)) (io (disclose (apl-quad-io))))
+      (let
+        ((indices (filter (fn (i) (not (= (nth ravel i) 0))) (range 0 (len ravel)))))
+        (apl-vector (map (fn (i) (+ i io)) indices))))))
+
+(define
+  apl-interval-index
+  (fn
+    (breaks vals)
+    (let
+      ((b-ravel (get breaks :ravel))
+        (v-ravel
+          (if (scalar? vals) (list (disclose vals)) (get vals :ravel))))
+      (let
+        ((result (map (fn (y) (len (filter (fn (b) (<= b y)) b-ravel))) v-ravel)))
+        (if
+          (scalar? vals)
+          (apl-scalar (first result))
+          (make-array (get vals :shape) result))))))
+
+(define
+  apl-unique
+  (fn
+    (arr)
+    (let
+      ((ravel (if (scalar? arr) (list (disclose arr)) (get arr :ravel))))
+      (let
+        ((dedup (reduce (fn (acc x) (if (index-of acc x) acc (append acc (list x)))) (list) ravel)))
+        (apl-vector dedup)))))
+
+(define
+  apl-union
+  (fn
+    (a b)
+    (let
+      ((a-ravel (if (scalar? a) (list (disclose a)) (get a :ravel)))
+        (b-ravel (if (scalar? b) (list (disclose b)) (get b :ravel))))
+      (let
+        ((a-dedup (reduce (fn (acc x) (if (index-of acc x) acc (append acc (list x)))) (list) a-ravel)))
+        (let
+          ((b-extra (filter (fn (x) (not (index-of a-dedup x))) b-ravel)))
+          (let
+            ((b-extra-dedup (reduce (fn (acc x) (if (index-of acc x) acc (append acc (list x)))) (list) b-extra)))
+            (apl-vector (append a-dedup b-extra-dedup))))))))
+
+(define
+  apl-intersect
+  (fn
+    (a b)
+    (let
+      ((a-ravel (if (scalar? a) (list (disclose a)) (get a :ravel)))
+        (b-ravel (if (scalar? b) (list (disclose b)) (get b :ravel))))
+      (apl-vector (filter (fn (x) (index-of b-ravel x)) a-ravel)))))
+
+(define
+  apl-decode
+  (fn
+    (base digits)
+    (let
+      ((d-ravel (if (scalar? digits) (list (disclose digits)) (get digits :ravel))))
+      (let
+        ((d-len (len d-ravel)))
+        (let
+          ((b-ravel (if (scalar? base) (let ((b (disclose base))) (map (fn (i) b) (range 0 d-len))) (get base :ravel))))
+          (let
+            ((result (reduce (fn (acc i) (if (= i 0) (nth d-ravel 0) (+ (* acc (nth b-ravel i)) (nth d-ravel i)))) 0 (range 0 d-len))))
+            (apl-scalar result)))))))
+
+(define
+  apl-encode
+  (fn
+    (base val)
+    (let
+      ((b-ravel (if (scalar? base) (list (disclose base)) (get base :ravel)))
+        (n (if (scalar? val) (disclose val) (first (get val :ravel)))))
+      (let
+        ((b-len (len b-ravel)))
+        (let
+          ((result (reduce (fn (acc-and-n i) (let ((acc (first acc-and-n)) (rem (nth acc-and-n 1))) (let ((b (nth b-ravel (- (- b-len 1) i)))) (if (= b 0) (list (cons rem acc) 0) (list (cons (modulo rem b) acc) (floor (/ rem b))))))) (list (list) n) (range 0 b-len))))
+          (apl-vector (first result)))))))
+
+(define
+  apl-partition
+  (fn
+    (mask val)
+    (let
+      ((m-ravel (if (scalar? mask) (list (disclose mask)) (get mask :ravel)))
+        (v-ravel
+          (if (scalar? val) (list (disclose val)) (get val :ravel))))
+      (let
+        ((n (len m-ravel)))
+        (let
+          ((built (reduce (fn (acc-and-prev i) (let ((acc (first acc-and-prev)) (prev (nth acc-and-prev 1))) (let ((mi (nth m-ravel i)) (vi (nth v-ravel i))) (cond ((= mi 0) (list acc 0)) ((> mi prev) (list (append acc (list (list vi))) mi)) (else (let ((idx (- (len acc) 1))) (list (append (slice acc 0 idx) (list (append (nth acc idx) (list vi)))) mi))))))) (list (list) 0) (range 0 n))))
+          (apl-vector (map (fn (part) (apl-vector part)) (first built))))))))
+
 (define
   apl-primes
   (fn
@@ -985,6 +1124,28 @@
         (some (fn (c) (= c 0)) codes)
         (some (fn (c) (= c (nth e 1))) codes)))))
 
+(define apl-rng-state 12345)
+
+(define apl-rng-seed! (fn (s) (set! apl-rng-state s)))
+
+(define
+  apl-rng-next!
+  (fn
+    ()
+    (begin
+      (set!
+        apl-rng-state
+        (mod (+ (* apl-rng-state 1103515245) 12345) 2147483648))
+      apl-rng-state)))
+
+(define
+  apl-roll
+  (fn
+    (arr)
+    (let
+      ((n (if (scalar? arr) (first (get arr :ravel)) (first (get arr :ravel)))))
+      (apl-scalar (+ apl-io (mod (apl-rng-next!) n))))))
+
 (define
   apl-cartesian
   (fn
@@ -1033,11 +1194,9 @@
             (if
               (= n 0)
               (apl-scalar 0)
-              (apl-scalar
-                (reduce
-                  (fn (a b) (disclose (f (apl-scalar a) (apl-scalar b))))
-                  (first ravel)
-                  (rest ravel)))))
+              (let
+                ((rr (reduce (fn (a b) (let ((wa (if (= (type-of a) "dict") a (apl-scalar a))) (wb (if (= (type-of b) "dict") b (apl-scalar b)))) (let ((r (f wa wb))) (if (scalar? r) (disclose r) r)))) (first ravel) (rest ravel))))
+                (if (= (type-of rr) "dict") rr (apl-scalar rr)))))
           (let
             ((last-dim (last shape))
               (pre-shape (take shape (- (len shape) 1)))
@@ -1059,7 +1218,13 @@
                       (reduce
                         (fn
                           (a b)
-                          (disclose (f (apl-scalar a) (apl-scalar b))))
+                          (let
+                            ((wa (if (= (type-of a) "dict") a (apl-scalar a)))
+                              (wb
+                                (if (= (type-of b) "dict") b (apl-scalar b))))
+                            (let
+                              ((r (f wa wb)))
+                              (if (scalar? r) (disclose r) r))))
                         (first elems)
                         (rest elems)))))
                 (range 0 pre-size)))))))))
@@ -1200,13 +1365,29 @@
     (cond
       ((and (scalar? a) (scalar? b)) (apl-scalar (disclose (f a b))))
       ((scalar? a)
-        (make-array
-          (get b :shape)
-          (map (fn (x) (disclose (f a (apl-scalar x)))) (get b :ravel))))
+        (let
+          ((a-eff (let ((d (disclose a))) (if (= (type-of d) "dict") d a))))
+          (make-array
+            (get b :shape)
+            (map
+              (fn
+                (x)
+                (let
+                  ((r (f a-eff (apl-scalar x))))
+                  (if (scalar? r) (disclose r) r)))
+              (get b :ravel)))))
       ((scalar? b)
-        (make-array
-          (get a :shape)
-          (map (fn (x) (disclose (f (apl-scalar x) b))) (get a :ravel))))
+        (let
+          ((b-eff (let ((d (disclose b))) (if (= (type-of d) "dict") d b))))
+          (make-array
+            (get a :shape)
+            (map
+              (fn
+                (x)
+                (let
+                  ((r (f (apl-scalar x) b-eff)))
+                  (if (scalar? r) (disclose r) r)))
+              (get a :ravel)))))
       (else
         (if
           (equal? (get a :shape) (get b :shape))
@@ -1227,16 +1408,22 @@
         (b-shape (get b :shape))
         (a-ravel (get a :ravel))
         (b-ravel (get b :ravel)))
-      (make-array
-        (append a-shape b-shape)
-        (flatten
-          (map
-            (fn
-              (x)
-              (map
-                (fn (y) (disclose (f (apl-scalar x) (apl-scalar y))))
-                b-ravel))
-            a-ravel))))))
+      (let
+        ((wrap (fn (x) (if (= (type-of x) "dict") x (apl-scalar x)))))
+        (make-array
+          (append a-shape b-shape)
+          (flatten
+            (map
+              (fn
+                (x)
+                (map
+                  (fn
+                    (y)
+                    (let
+                      ((r (f (wrap x) (wrap y))))
+                      (if (scalar? r) (disclose r) r)))
+                  b-ravel))
+              a-ravel)))))))
 
 (define
   apl-inner
@@ -1260,25 +1447,12 @@
               ((a-pre-size (reduce * 1 a-pre))
                 (b-post-size (reduce * 1 b-post))
                 (new-shape (append a-pre b-post)))
-              (make-array
-                new-shape
-                (flatten
-                  (map
-                    (fn
-                      (i)
-                      (map
-                        (fn
-                          (j)
-                          (let
-                            ((pairs (map (fn (k) (disclose (g (apl-scalar (nth a-ravel (+ (* i inner-dim) k))) (apl-scalar (nth b-ravel (+ (* k b-post-size) j)))))) (range 0 inner-dim))))
-                            (reduce
-                              (fn
-                                (x y)
-                                (disclose (f (apl-scalar x) (apl-scalar y))))
-                              (first pairs)
-                              (rest pairs))))
-                        (range 0 b-post-size)))
-                    (range 0 a-pre-size)))))))))))
+              (let
+                ((result (make-array new-shape (flatten (map (fn (i) (map (fn (j) (let ((pairs (map (fn (k) (let ((a-elem (nth a-ravel (+ (* i inner-dim) k))) (b-elem (nth b-ravel (+ (* k b-post-size) j)))) (let ((a-cell (if (= (type-of a-elem) "dict") (nth (get a-elem :ravel) j) a-elem)) (b-cell (if (= (type-of b-elem) "dict") (nth (get b-elem :ravel) 0) b-elem))) (disclose (g (apl-scalar a-cell) (apl-scalar b-cell)))))) (range 0 inner-dim)))) (reduce (fn (x y) (let ((wx (if (= (type-of x) "dict") x (apl-scalar x))) (wy (if (= (type-of y) "dict") y (apl-scalar y)))) (let ((r (f wx wy))) (if (scalar? r) (disclose r) r)))) (first pairs) (rest pairs)))) (range 0 b-post-size))) (range 0 a-pre-size))))))
+                (if
+                  (some (fn (x) (= (type-of x) "dict")) a-ravel)
+                  (enclose result)
+                  result)))))))))
 
 (define apl-commute (fn (f x) (f x x)))
 

lib/apl/scoreboard.json

@@ -9,9 +9,9 @@
     "system": {"pass": 13, "fail": 0},
     "idioms": {"pass": 64, "fail": 0},
     "eval-ops": {"pass": 14, "fail": 0},
-    "pipeline": {"pass": 40, "fail": 0}
+    "pipeline": {"pass": 152, "fail": 0}
   },
-  "total_pass": 450,
+  "total_pass": 562,
   "total_fail": 0,
-  "total": 450
+  "total": 562
 }

lib/apl/scoreboard.md

@@ -13,8 +13,8 @@ _Generated by `lib/apl/conformance.sh`_
 | system | 13 | 0 | 13 |
 | idioms | 64 | 0 | 64 |
 | eval-ops | 14 | 0 | 14 |
-| pipeline | 40 | 0 | 40 |
-| **Total** | **450** | **0** | **450** |
+| pipeline | 152 | 0 | 152 |
+| **Total** | **562** | **0** | **562** |
 
 ## Notes
 

lib/apl/test-harness.sx

@@ -0,0 +1,15 @@
+; lib/apl/test-harness.sx — counters + assertion fn for the shared conformance
+; driver (lib/guest/conformance.sh, MODE=counters). Loaded as a PRELOAD so each
+; suite starts from a fresh 0/0; suites call (apl-test name got expected).
+
+(define apl-test-pass 0)
+(define apl-test-fail 0)
+
+(define
+  apl-test
+  (fn
+    (name got expected)
+    (if
+      (= got expected)
+      (set! apl-test-pass (+ apl-test-pass 1))
+      (set! apl-test-fail (+ apl-test-fail 1)))))

lib/apl/tests/pipeline.sx

@@ -312,3 +312,376 @@
   "train: mean of ⍳10 has shape ()"
   (mksh (apl-run "(+/÷≢) ⍳10"))
   (list))
+
+(apl-test
+  "compress: 1 0 1 0 1 / 10 20 30 40 50"
+  (mkrv (apl-run "1 0 1 0 1 / 10 20 30 40 50"))
+  (list 10 30 50))
+
+(apl-test
+  "compress: empty mask → empty"
+  (mkrv (apl-run "0 0 0 / 1 2 3"))
+  (list))
+
+(apl-test
+  "primes via classic idiom (multi-stmt)"
+  (mkrv (apl-run "P ← ⍳ 30 ⋄ (2 = +⌿ 0 = P ∘.| P) / P"))
+  (list 2 3 5 7 11 13 17 19 23 29))
+
+(apl-test
+  "primes via classic idiom (n=20)"
+  (mkrv (apl-run "P ← ⍳ 20 ⋄ (2 = +⌿ 0 = P ∘.| P) / P"))
+  (list 2 3 5 7 11 13 17 19))
+
+(apl-test
+  "compress: filter even values"
+  (mkrv (apl-run "(0 = 2 | 1 2 3 4 5 6) / 1 2 3 4 5 6"))
+  (list 2 4 6))
+
+(apl-test "inline-assign: x ← 5" (mkrv (apl-run "x ← 5")) (list 5))
+
+(apl-test
+  "inline-assign: (2×x) + x←10 → 30"
+  (mkrv (apl-run "(2 × x) + x ← 10"))
+  (list 30))
+
+(apl-test
+  "inline-assign primes one-liner: (2=+⌿0=a∘.|a)/a←⍳30"
+  (mkrv (apl-run "(2 = +⌿ 0 = a ∘.| a) / a ← ⍳ 30"))
+  (list 2 3 5 7 11 13 17 19 23 29))
+
+(apl-test
+  "inline-assign: x is reusable — x + x ← 7 → 14"
+  (mkrv (apl-run "x + x ← 7"))
+  (list 14))
+
+(apl-test
+  "inline-assign in dfn: f ← {x + x ← ⍵} ⋄ f 8 → 16"
+  (mkrv (apl-run "f ← {x + x ← ⍵} ⋄ f 8"))
+  (list 16))
+
+(begin (apl-rng-seed! 42) nil)
+
+(apl-test
+  "?10 with seed 42 → 8 (deterministic)"
+  (mkrv (apl-run "?10"))
+  (list 8))
+
+(apl-test "?10 next call → 5" (mkrv (apl-run "?10")) (list 5))
+
+(apl-test
+  "?100 stays in range"
+  (let ((v (first (mkrv (apl-run "?100"))))) (and (>= v 1) (<= v 100)))
+  true)
+
+(begin (apl-rng-seed! 42) nil)
+
+(apl-test
+  "?10 with re-seed 42 → 8 (reproducible)"
+  (mkrv (apl-run "?10"))
+  (list 8))
+
+(apl-test
+  "apl-run-file: load primes.apl returns dfn AST"
+  (first (apl-run-file "lib/apl/tests/programs/primes.apl"))
+  :dfn)
+
+(apl-test
+  "apl-run-file: life.apl parses without error"
+  (first (apl-run-file "lib/apl/tests/programs/life.apl"))
+  :dfn)
+
+(apl-test
+  "apl-run-file: quicksort.apl parses without error"
+  (first (apl-run-file "lib/apl/tests/programs/quicksort.apl"))
+  :dfn)
+
+(apl-test
+  "apl-run-file: source-then-call returns primes count"
+  (mksh
+    (apl-run
+      (str (file-read "lib/apl/tests/programs/primes.apl") " ⋄ primes 30")))
+  (list 10))
+
+(apl-test
+  "primes one-liner with ⍵-rebind: primes 30"
+  (mkrv
+    (apl-run "primes ← {(2=+⌿0=⍵∘.|⍵)/⍵←⍳⍵} ⋄ primes 30"))
+  (list 2 3 5 7 11 13 17 19 23 29))
+
+(apl-test
+  "primes one-liner: primes 50"
+  (mkrv
+    (apl-run "primes ← {(2=+⌿0=⍵∘.|⍵)/⍵←⍳⍵} ⋄ primes 50"))
+  (list 2 3 5 7 11 13 17 19 23 29 31 37 41 43 47))
+
+(apl-test
+  "primes.apl loaded + called via apl-run-file"
+  (mkrv
+    (apl-run
+      (str (file-read "lib/apl/tests/programs/primes.apl") " ⋄ primes 20")))
+  (list 2 3 5 7 11 13 17 19))
+
+(apl-test
+  "primes.apl loaded — count of primes ≤ 100"
+  (first
+    (mksh
+      (apl-run
+        (str
+          (file-read "lib/apl/tests/programs/primes.apl")
+          " ⋄ primes 100"))))
+  25)
+
+(apl-test
+  "⍉ monadic transpose 2x3 → 3x2"
+  (mkrv (apl-run "⍉ (2 3) ⍴ ⍳6"))
+  (list 1 4 2 5 3 6))
+
+(apl-test
+  "⍉ transpose shape (3 2)"
+  (mksh (apl-run "⍉ (2 3) ⍴ ⍳6"))
+  (list 3 2))
+
+(apl-test "⊢ monadic identity" (mkrv (apl-run "⊢ 1 2 3")) (list 1 2 3))
+
+(apl-test
+  "5 ⊣ 1 2 3 → 5 (left)"
+  (mkrv (apl-run "5 ⊣ 1 2 3"))
+  (list 5))
+
+(apl-test
+  "5 ⊢ 1 2 3 → 1 2 3 (right)"
+  (mkrv (apl-run "5 ⊢ 1 2 3"))
+  (list 1 2 3))
+
+(apl-test "⍕ 42 → \"42\" (alias for ⎕FMT)" (apl-run "⍕ 42") "42")
+
+(begin
+  (apl-test
+    "⍸ where: indices of truthy cells"
+    (mkrv (apl-run "⍸ 0 1 0 1 1"))
+    (list 2 4 5))
+  (apl-test
+    "⍸ where: leading truthy"
+    (mkrv (apl-run "⍸ 1 0 0 1 1"))
+    (list 1 4 5))
+  (apl-test
+    "⍸ where: all-zero → empty"
+    (mkrv (apl-run "⍸ 0 0 0"))
+    (list))
+  (apl-test
+    "⍸ where: all-truthy"
+    (mkrv (apl-run "⍸ 1 1 1"))
+    (list 1 2 3))
+  (apl-test
+    "⍸ where: ⎕IO=1 (1-based)"
+    (mkrv (apl-run "⍸ (⍳5)=3"))
+    (list 3))
+  (apl-test
+    "⍸ interval-index: 2 4 6 ⍸ 5 → 2"
+    (mkrv (apl-run "2 4 6 ⍸ 5"))
+    (list 2))
+  (apl-test
+    "⍸ interval-index: 2 4 6 ⍸ 1 3 5 6 7 → 0 1 2 3 3"
+    (mkrv (apl-run "2 4 6 ⍸ 1 3 5 6 7"))
+    (list 0 1 2 3 3))
+  (apl-test
+    "⍸ interval-index: ⍳5 ⍸ 3 → 3"
+    (mkrv (apl-run "(⍳5) ⍸ 3"))
+    (list 3))
+  (apl-test
+    "⍸ interval-index: y below all → 0"
+    (mkrv (apl-run "10 20 30 ⍸ 5"))
+    (list 0))
+  (apl-test
+    "⍸ interval-index: y above all → len breaks"
+    (mkrv (apl-run "10 20 30 ⍸ 100"))
+    (list 3)))
+
+(begin
+  (apl-test
+    "∪ unique: dedup keeps first-occurrence order"
+    (mkrv (apl-run "∪ 1 2 1 3 2 1 4"))
+    (list 1 2 3 4))
+  (apl-test
+    "∪ unique: already-unique unchanged"
+    (mkrv (apl-run "∪ 5 4 3 2 1"))
+    (list 5 4 3 2 1))
+  (apl-test "∪ unique: scalar" (mkrv (apl-run "∪ 7")) (list 7))
+  (apl-test
+    "∪ unique: string mississippi → misp"
+    (mkrv (apl-run "∪ 'mississippi'"))
+    (list "m" "i" "s" "p"))
+  (apl-test
+    "∪ union: 1 2 3 ∪ 3 4 5 → 1 2 3 4 5"
+    (mkrv (apl-run "1 2 3 ∪ 3 4 5"))
+    (list 1 2 3 4 5))
+  (apl-test
+    "∪ union: dedups left side too"
+    (mkrv (apl-run "1 2 1 ∪ 1 3 2"))
+    (list 1 2 3))
+  (apl-test
+    "∪ union: disjoint → catenated"
+    (mkrv (apl-run "1 2 ∪ 3 4"))
+    (list 1 2 3 4))
+  (apl-test
+    "∩ intersection: 1 2 3 4 ∩ 2 4 6 → 2 4"
+    (mkrv (apl-run "1 2 3 4 ∩ 2 4 6"))
+    (list 2 4))
+  (apl-test
+    "∩ intersection: disjoint → empty"
+    (mkrv (apl-run "1 2 3 ∩ 4 5 6"))
+    (list))
+  (apl-test
+    "∩ intersection: preserves left order"
+    (mkrv (apl-run "(⍳5) ∩ 5 3 1"))
+    (list 1 3 5))
+  (apl-test
+    "∩ intersection: identical"
+    (mkrv (apl-run "1 2 3 ∩ 1 2 3"))
+    (list 1 2 3))
+  (apl-test
+    "∪/∩ identity: A ∪ A = ∪A"
+    (mkrv (apl-run "1 2 1 ∪ 1 2 1"))
+    (list 1 2)))
+
+(begin
+  (apl-test
+    "⊥ decode: 2 2 2 ⊥ 1 0 1 → 5"
+    (mkrv (apl-run "2 2 2 ⊥ 1 0 1"))
+    (list 5))
+  (apl-test
+    "⊥ decode: 10 10 10 ⊥ 1 2 3 → 123"
+    (mkrv (apl-run "10 10 10 ⊥ 1 2 3"))
+    (list 123))
+  (apl-test
+    "⊥ decode: 24 60 60 ⊥ 2 3 4 → 7384 (mixed-radix HMS)"
+    (mkrv (apl-run "24 60 60 ⊥ 2 3 4"))
+    (list 7384))
+  (apl-test
+    "⊥ decode: scalar base 2 ⊥ 1 0 1 0 → 10"
+    (mkrv (apl-run "2 ⊥ 1 0 1 0"))
+    (list 10))
+  (apl-test
+    "⊥ decode: 16 16 ⊥ 15 15 → 255"
+    (mkrv (apl-run "16 16 ⊥ 15 15"))
+    (list 255))
+  (apl-test
+    "⊤ encode: 2 2 2 ⊤ 5 → 1 0 1"
+    (mkrv (apl-run "2 2 2 ⊤ 5"))
+    (list 1 0 1))
+  (apl-test
+    "⊤ encode: 24 60 60 ⊤ 7384 → 2 3 4 (HMS)"
+    (mkrv (apl-run "24 60 60 ⊤ 7384"))
+    (list 2 3 4))
+  (apl-test
+    "⊤ encode: 2 2 2 2 ⊤ 13 → 1 1 0 1"
+    (mkrv (apl-run "2 2 2 2 ⊤ 13"))
+    (list 1 1 0 1))
+  (apl-test
+    "⊤ encode: 10 10 ⊤ 42 → 4 2"
+    (mkrv (apl-run "10 10 ⊤ 42"))
+    (list 4 2))
+  (apl-test
+    "⊤ encode: round-trip B⊥(B⊤N) = N"
+    (mkrv (apl-run "24 60 60 ⊥ 24 60 60 ⊤ 7384"))
+    (list 7384))
+  (apl-test
+    "⊥ decode: round-trip B⊤(B⊥V) = V"
+    (mkrv (apl-run "2 2 2 ⊤ 2 2 2 ⊥ 1 0 1"))
+    (list 1 0 1)))
+
+(begin
+  (define
+    mk-parts
+    (fn (s) (map (fn (p) (get p :ravel)) (get (apl-run s) :ravel))))
+  (apl-test
+    "⊆ partition: 1 1 0 1 1 ⊆ 'abcde' → ('ab' 'de')"
+    (mk-parts "1 1 0 1 1 ⊆ 'abcde'")
+    (list (list "a" "b") (list "d" "e")))
+  (apl-test
+    "⊆ partition: 1 0 0 1 1 ⊆ ⍳5 → ((1) (4 5))"
+    (mk-parts "1 0 0 1 1 ⊆ ⍳5")
+    (list (list 1) (list 4 5)))
+  (apl-test
+    "⊆ partition: all-zero mask → empty"
+    (len (get (apl-run "0 0 0 ⊆ 1 2 3") :ravel))
+    0)
+  (apl-test
+    "⊆ partition: all-one mask → single partition"
+    (mk-parts "1 1 1 ⊆ 7 8 9")
+    (list (list 7 8 9)))
+  (apl-test
+    "⊆ partition: strict increase 1 2 starts new"
+    (mk-parts "1 2 ⊆ 10 20")
+    (list (list 10) (list 20)))
+  (apl-test
+    "⊆ partition: same level continues 2 2 → one partition"
+    (mk-parts "2 2 ⊆ 10 20")
+    (list (list 10 20)))
+  (apl-test
+    "⊆ partition: 0 separates"
+    (mk-parts "1 1 0 0 1 ⊆ 1 2 3 4 5")
+    (list (list 1 2) (list 5)))
+  (apl-test
+    "⊆ partition: outer length matches partition count"
+    (len (get (apl-run "1 0 1 0 1 ⊆ ⍳5") :ravel))
+    3))
+
+(begin
+  (apl-test
+    "⍎ execute: ⍎ '1 + 2' → 3"
+    (mkrv (apl-run "⍎ '1 + 2'"))
+    (list 3))
+  (apl-test
+    "⍎ execute: ⍎ '+/⍳10' → 55"
+    (mkrv (apl-run "⍎ '+/⍳10'"))
+    (list 55))
+  (apl-test
+    "⍎ execute: ⍎ '⌈/ 1 3 9 5 7' → 9"
+    (mkrv (apl-run "⍎ '⌈/ 1 3 9 5 7'"))
+    (list 9))
+  (apl-test
+    "⍎ execute: ⍎ '⍳5' → 1..5"
+    (mkrv (apl-run "⍎ '⍳5'"))
+    (list 1 2 3 4 5))
+  (apl-test
+    "⍎ execute: ⍎ '×/⍳5' → 120"
+    (mkrv (apl-run "⍎ '×/⍳5'"))
+    (list 120))
+  (apl-test
+    "⍎ execute: round-trip ⍎ ⎕FMT 42 → 42"
+    (mkrv (apl-run "⍎ ⎕FMT 42"))
+    (list 42))
+  (apl-test
+    "⍎ execute: nested ⍎ ⍎"
+    (mkrv (apl-run "⍎ '⍎ ''2 × 3'''"))
+    (list 6))
+  (apl-test
+    "⍎ execute: with assignment side-effect"
+    (mkrv (apl-run "⍎ 'q ← 99 ⋄ q + 1'"))
+    (list 100)))
+
+(begin
+  (apl-test
+    "het-inner: 1 ⍵ ∨.∧ X — result is enclosed (5 5)"
+    (let
+      ((r (apl-run "B ← 5 5 ⍴ 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 0 0 ⋄ X ← 3 4 = +/ +/ ¯1 0 1 ∘.⊖ ¯1 0 1 ⌽¨ ⊂B ⋄ 1 B ∨.∧ X")))
+      (list
+        (len (get r :shape))
+        (= (type-of (first (get r :ravel))) "dict")))
+    (list 0 true))
+  (apl-test
+    "het-inner: ⊃ unwraps to (5 5) board"
+    (mksh
+      (apl-run
+        "B ← 5 5 ⍴ 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 0 0 ⋄ X ← 3 4 = +/ +/ ¯1 0 1 ∘.⊖ ¯1 0 1 ⌽¨ ⊂B ⋄ ⊃ 1 B ∨.∧ X"))
+    (list 5 5))
+  (apl-test
+    "het-inner: homogeneous inner product unaffected"
+    (mkrv (apl-run "1 2 3 +.× 4 5 6"))
+    (list 32))
+  (apl-test
+    "het-inner: matrix inner product unaffected"
+    (mkrv (apl-run "(2 2 ⍴ 1 2 3 4) +.× 2 2 ⍴ 5 6 7 8"))
+    (list 19 22 43 50)))

lib/apl/tests/programs-e2e.sx

@@ -94,3 +94,96 @@
   "e2e: sqrt-via-newton 1 step from 1 → 2.5"
   (mkrv (apl-run "step ← {(⍵+⍺÷⍵)÷2} ⋄ 4 step 1"))
   (list 2.5))
+
+(begin
+  (apl-test
+    "life.apl: blinker 5×5 → vertical blinker"
+    (mkrv
+      (apl-run
+        "life ← {⊃1 ⍵ ∨.∧ 3 4 = +/ +/ ¯1 0 1 ∘.⊖ ¯1 0 1 ⌽¨ ⊂⍵} ⋄ life 5 5 ⍴ 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 0 0"))
+    (list 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0))
+  (apl-test
+    "life.apl: blinker oscillates (period 2)"
+    (mkrv
+      (apl-run
+        "life ← {⊃1 ⍵ ∨.∧ 3 4 = +/ +/ ¯1 0 1 ∘.⊖ ¯1 0 1 ⌽¨ ⊂⍵} ⋄ life life 5 5 ⍴ 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 0 0"))
+    (list 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 0 0))
+  (apl-test
+    "life.apl: 2×2 block stable"
+    (mkrv
+      (apl-run
+        "life ← {⊃1 ⍵ ∨.∧ 3 4 = +/ +/ ¯1 0 1 ∘.⊖ ¯1 0 1 ⌽¨ ⊂⍵} ⋄ life 4 4 ⍴ 0 0 0 0 0 1 1 0 0 1 1 0 0 0 0 0"))
+    (list 0 0 0 0 0 1 1 0 0 1 1 0 0 0 0 0))
+  (apl-test
+    "life.apl: empty grid stays empty"
+    (mkrv
+      (apl-run
+        "life ← {⊃1 ⍵ ∨.∧ 3 4 = +/ +/ ¯1 0 1 ∘.⊖ ¯1 0 1 ⌽¨ ⊂⍵} ⋄ life 5 5 ⍴ 0"))
+    (list 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0))
+  (apl-test
+    "life.apl: source-file as-written runs"
+    (let
+      ((dfn (apl-run-file "lib/apl/tests/programs/life.apl"))
+        (board
+          (apl-run "5 5 ⍴ 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 0 0")))
+      (get (apl-call-dfn-m dfn board) :ravel))
+    (list 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0)))
+
+(begin
+  (apl-test
+    "quicksort.apl: 11-element with duplicates"
+    (begin
+      (apl-rng-seed! 42)
+      (mkrv
+        (apl-run
+          "quicksort ← {1≥≢⍵:⍵ ⋄ p←⍵⌷⍨?≢⍵ ⋄ (∇⍵⌿⍨⍵<p),(p=⍵)/⍵,∇⍵⌿⍨⍵>p} ⋄ quicksort 3 1 4 1 5 9 2 6 5 3 5")))
+    (list 1 1 2 3 3 4 5 5 5 6 9))
+  (apl-test
+    "quicksort.apl: already sorted"
+    (begin
+      (apl-rng-seed! 42)
+      (mkrv
+        (apl-run
+          "quicksort ← {1≥≢⍵:⍵ ⋄ p←⍵⌷⍨?≢⍵ ⋄ (∇⍵⌿⍨⍵<p),(p=⍵)/⍵,∇⍵⌿⍨⍵>p} ⋄ quicksort 1 2 3 4 5")))
+    (list 1 2 3 4 5))
+  (apl-test
+    "quicksort.apl: reverse sorted"
+    (begin
+      (apl-rng-seed! 42)
+      (mkrv
+        (apl-run
+          "quicksort ← {1≥≢⍵:⍵ ⋄ p←⍵⌷⍨?≢⍵ ⋄ (∇⍵⌿⍨⍵<p),(p=⍵)/⍵,∇⍵⌿⍨⍵>p} ⋄ quicksort 5 4 3 2 1")))
+    (list 1 2 3 4 5))
+  (apl-test
+    "quicksort.apl: all equal"
+    (begin
+      (apl-rng-seed! 42)
+      (mkrv
+        (apl-run
+          "quicksort ← {1≥≢⍵:⍵ ⋄ p←⍵⌷⍨?≢⍵ ⋄ (∇⍵⌿⍨⍵<p),(p=⍵)/⍵,∇⍵⌿⍨⍵>p} ⋄ quicksort 7 7 7 7")))
+    (list 7 7 7 7))
+  (apl-test
+    "quicksort.apl: single element"
+    (begin
+      (apl-rng-seed! 42)
+      (mkrv
+        (apl-run
+          "quicksort ← {1≥≢⍵:⍵ ⋄ p←⍵⌷⍨?≢⍵ ⋄ (∇⍵⌿⍨⍵<p),(p=⍵)/⍵,∇⍵⌿⍨⍵>p} ⋄ quicksort ,42")))
+    (list 42))
+  (apl-test
+    "quicksort.apl: matches grade-up"
+    (begin
+      (apl-rng-seed! 42)
+      (mkrv
+        (apl-run
+          "V ← 8 3 1 9 2 7 5 6 4 ⋄ quicksort ← {1≥≢⍵:⍵ ⋄ p←⍵⌷⍨?≢⍵ ⋄ (∇⍵⌿⍨⍵<p),(p=⍵)/⍵,∇⍵⌿⍨⍵>p} ⋄ quicksort V")))
+    (list 1 2 3 4 5 6 7 8 9))
+  (apl-test
+    "quicksort.apl: source-file as-written runs"
+    (begin
+      (apl-rng-seed! 42)
+      (let
+        ((dfn (apl-run-file "lib/apl/tests/programs/quicksort.apl"))
+          (vec (apl-run "5 2 8 1 9 3 7 4 6")))
+        (get (apl-call-dfn-m dfn vec) :ravel)))
+    (list 1 2 3 4 5 6 7 8 9)))

lib/apl/tests/programs.sx

@@ -252,8 +252,6 @@
 
 (apl-test "queens 7 → 40 solutions" (mkrv (apl-queens 7)) (list 40))
 
-(apl-test "queens 8 → 92 solutions" (mkrv (apl-queens 8)) (list 92))
-
 (apl-test "permutations of 3 has 6" (len (apl-permutations 3)) 6)
 
 (apl-test "permutations of 4 has 24" (len (apl-permutations 4)) 24)

lib/apl/tests/programs/life.apl

@@ -8,9 +8,9 @@
 ⍝   ¯1 0 1 ⌽¨ ⊂⍵      : produce 3 horizontally-shifted copies
 ⍝   ¯1 0 1 ∘.⊖ …      : outer-product with vertical shifts → 3×3 = 9 shifts
 ⍝   +/ +/ …           : sum the 9 boards element-wise → neighbor-count + self
-⍝   3 4 = …           : boolean — count is exactly 3 or exactly 4
+⍝   3 4 = …           : leading-axis-extended boolean — count is 3 (born) or 4 (survive)
 ⍝   1 ⍵ ∨.∧ …         : "alive next" iff (count=3) or (alive AND count=4)
-⍝   ⊃ …               : disclose back to a 2D board
+⍝   ⊃ …               : disclose the enclosed result back to a 2D board
 ⍝
 ⍝ Rules in plain language:
 ⍝   - dead cell + 3 live neighbors → born

lib/apl/tokenizer.sx

@@ -19,162 +19,180 @@
              (and (>= ch "A") (<= ch "Z"))
              (= ch "_")))))
 
-(define apl-tokenize
-  (fn (source)
-    (let ((pos 0)
-          (src-len (len source))
-          (tokens (list)))
-
-      (define tok-push!
-        (fn (type value)
-          (append! tokens {:type type :value value})))
-
-      (define cur-sw?
-        (fn (ch)
+(define
+  apl-tokenize
+  (fn
+    (source)
+    (let
+      ((pos 0) (src-len (len source)) (tokens (list)))
+      (define tok-push! (fn (type value) (append! tokens {:value value :type type})))
+      (define
+        cur-sw?
+        (fn
+          (ch)
           (and (< pos src-len) (starts-with? (slice source pos) ch))))
-
-      (define cur-byte
-        (fn ()
-          (if (< pos src-len) (nth source pos) nil)))
-
-      (define advance!
-        (fn ()
-          (set! pos (+ pos 1))))
-
-      (define consume!
-        (fn (ch)
-          (set! pos (+ pos (len ch)))))
-
-      (define find-glyph
-        (fn ()
-          (let ((rem (slice source pos)))
-            (let ((matches (filter (fn (g) (starts-with? rem g)) apl-glyph-set)))
+      (define cur-byte (fn () (if (< pos src-len) (nth source pos) nil)))
+      (define advance! (fn () (set! pos (+ pos 1))))
+      (define consume! (fn (ch) (set! pos (+ pos (len ch)))))
+      (define
+        find-glyph
+        (fn
+          ()
+          (let
+            ((rem (slice source pos)))
+            (let
+              ((matches (filter (fn (g) (starts-with? rem g)) apl-glyph-set)))
               (if (> (len matches) 0) (first matches) nil)))))
-
-      (define read-digits!
-        (fn (acc)
-          (if (and (< pos src-len) (apl-digit? (cur-byte)))
-            (let ((ch (cur-byte)))
-              (begin
-                (advance!)
-                (read-digits! (str acc ch))))
+      (define
+        read-digits!
+        (fn
+          (acc)
+          (if
+            (and (< pos src-len) (apl-digit? (cur-byte)))
+            (let
+              ((ch (cur-byte)))
+              (begin (advance!) (read-digits! (str acc ch))))
             acc)))
-
-      (define read-ident-cont!
-        (fn ()
-          (when (and (< pos src-len)
-                     (let ((ch (cur-byte)))
-                       (or (apl-alpha? ch) (apl-digit? ch))))
-            (begin
-              (advance!)
-              (read-ident-cont!)))))
-
-      (define read-string!
-        (fn (acc)
+      (define
+        read-ident-cont!
+        (fn
+          ()
+          (when
+            (and
+              (< pos src-len)
+              (let
+                ((ch (cur-byte)))
+                (or (apl-alpha? ch) (apl-digit? ch))))
+            (begin (advance!) (read-ident-cont!)))))
+      (define
+        read-string!
+        (fn
+          (acc)
           (cond
             ((>= pos src-len) acc)
             ((cur-sw? "'")
-             (if (and (< (+ pos 1) src-len) (cur-sw? "'"))
-               (begin
-                 (advance!)
-                 (advance!)
-                 (read-string! (str acc "'")))
-               (begin (advance!) acc)))
+              (if
+                (and (< (+ pos 1) src-len) (cur-sw? "'"))
+                (begin (advance!) (advance!) (read-string! (str acc "'")))
+                (begin (advance!) acc)))
             (true
-             (let ((ch (cur-byte)))
-               (begin
-                 (advance!)
-                 (read-string! (str acc ch))))))))
-
-      (define skip-line!
-        (fn ()
-          (when (and (< pos src-len) (not (cur-sw? "\n")))
-            (begin
-              (advance!)
-              (skip-line!)))))
-
-      (define scan!
-        (fn ()
-          (when (< pos src-len)
-            (let ((ch (cur-byte)))
+              (let
+                ((ch (cur-byte)))
+                (begin (advance!) (read-string! (str acc ch))))))))
+      (define
+        skip-line!
+        (fn
+          ()
+          (when
+            (and (< pos src-len) (not (cur-sw? "\n")))
+            (begin (advance!) (skip-line!)))))
+      (define
+        scan!
+        (fn
+          ()
+          (when
+            (< pos src-len)
+            (let
+              ((ch (cur-byte)))
               (cond
                 ((or (= ch " ") (= ch "\t") (= ch "\r"))
-                 (begin (advance!) (scan!)))
+                  (begin (advance!) (scan!)))
                 ((= ch "\n")
-                 (begin (advance!) (tok-push! :newline nil) (scan!)))
-                ((cur-sw? "⍝")
-                 (begin (skip-line!) (scan!)))
+                  (begin (advance!) (tok-push! :newline nil) (scan!)))
+                ((cur-sw? "⍝") (begin (skip-line!) (scan!)))
                 ((cur-sw? "⋄")
-                 (begin (consume! "⋄") (tok-push! :diamond nil) (scan!)))
+                  (begin (consume! "⋄") (tok-push! :diamond nil) (scan!)))
                 ((= ch "(")
-                 (begin (advance!) (tok-push! :lparen nil) (scan!)))
+                  (begin (advance!) (tok-push! :lparen nil) (scan!)))
                 ((= ch ")")
-                 (begin (advance!) (tok-push! :rparen nil) (scan!)))
+                  (begin (advance!) (tok-push! :rparen nil) (scan!)))
                 ((= ch "[")
-                 (begin (advance!) (tok-push! :lbracket nil) (scan!)))
+                  (begin (advance!) (tok-push! :lbracket nil) (scan!)))
                 ((= ch "]")
-                 (begin (advance!) (tok-push! :rbracket nil) (scan!)))
+                  (begin (advance!) (tok-push! :rbracket nil) (scan!)))
                 ((= ch "{")
-                 (begin (advance!) (tok-push! :lbrace nil) (scan!)))
+                  (begin (advance!) (tok-push! :lbrace nil) (scan!)))
                 ((= ch "}")
-                 (begin (advance!) (tok-push! :rbrace nil) (scan!)))
+                  (begin (advance!) (tok-push! :rbrace nil) (scan!)))
                 ((= ch ";")
-                 (begin (advance!) (tok-push! :semi nil) (scan!)))
+                  (begin (advance!) (tok-push! :semi nil) (scan!)))
                 ((cur-sw? "←")
-                 (begin (consume! "←") (tok-push! :assign nil) (scan!)))
+                  (begin (consume! "←") (tok-push! :assign nil) (scan!)))
                 ((= ch ":")
-                 (let ((start pos))
-                   (begin
-                     (advance!)
-                     (if (and (< pos src-len) (apl-alpha? (cur-byte)))
-                       (begin
-                         (read-ident-cont!)
-                         (tok-push! :keyword (slice source start pos)))
-                       (tok-push! :colon nil))
-                     (scan!))))
-                ((and (cur-sw? "¯")
-                      (< (+ pos (len "¯")) src-len)
-                      (apl-digit? (nth source (+ pos (len "¯")))))
-                 (begin
-                   (consume! "¯")
-                   (let ((digits (read-digits! "")))
-                     (if (and (< pos src-len) (= (cur-byte) ".")
-                              (< (+ pos 1) src-len) (apl-digit? (nth source (+ pos 1))))
-                       (begin (advance!)
-                              (let ((frac (read-digits! "")))
-                                (tok-push! :num (- 0 (string->number (str digits "." frac))))))
-                       (tok-push! :num (- 0 (parse-int digits 0)))))
-                   (scan!)))
+                  (let
+                    ((start pos))
+                    (begin
+                      (advance!)
+                      (if
+                        (and (< pos src-len) (apl-alpha? (cur-byte)))
+                        (begin
+                          (read-ident-cont!)
+                          (tok-push! :keyword (slice source start pos)))
+                        (tok-push! :colon nil))
+                      (scan!))))
+                ((and (cur-sw? "¯") (< (+ pos (len "¯")) src-len) (apl-digit? (nth source (+ pos (len "¯")))))
+                  (begin
+                    (consume! "¯")
+                    (let
+                      ((digits (read-digits! "")))
+                      (if
+                        (and
+                          (< pos src-len)
+                          (= (cur-byte) ".")
+                          (< (+ pos 1) src-len)
+                          (apl-digit? (nth source (+ pos 1))))
+                        (begin
+                          (advance!)
+                          (let
+                            ((frac (read-digits! "")))
+                            (tok-push!
+                              :num (- 0 (string->number (str digits "." frac))))))
+                        (tok-push! :num (- 0 (parse-int digits 0)))))
+                    (scan!)))
                 ((apl-digit? ch)
-                 (begin
-                   (let ((digits (read-digits! "")))
-                     (if (and (< pos src-len) (= (cur-byte) ".")
-                              (< (+ pos 1) src-len) (apl-digit? (nth source (+ pos 1))))
-                       (begin (advance!)
-                              (let ((frac (read-digits! "")))
-                                (tok-push! :num (string->number (str digits "." frac)))))
-                       (tok-push! :num (parse-int digits 0))))
-                   (scan!)))
+                  (begin
+                    (let
+                      ((digits (read-digits! "")))
+                      (if
+                        (and
+                          (< pos src-len)
+                          (= (cur-byte) ".")
+                          (< (+ pos 1) src-len)
+                          (apl-digit? (nth source (+ pos 1))))
+                        (begin
+                          (advance!)
+                          (let
+                            ((frac (read-digits! "")))
+                            (tok-push!
+                              :num (string->number (str digits "." frac)))))
+                        (tok-push! :num (parse-int digits 0))))
+                    (scan!)))
                 ((= ch "'")
-                 (begin
-                   (advance!)
-                   (let ((s (read-string! "")))
-                     (tok-push! :str s))
-                   (scan!)))
+                  (begin
+                    (advance!)
+                    (let ((s (read-string! ""))) (tok-push! :str s))
+                    (scan!)))
                 ((or (apl-alpha? ch) (cur-sw? "⎕"))
-                 (let ((start pos))
-                   (begin
-                     (if (cur-sw? "⎕") (consume! "⎕") (advance!))
-                     (if (and (< pos src-len) (cur-sw? "←"))
-                       (consume! "←")
-                       (read-ident-cont!))
-                     (tok-push! :name (slice source start pos))
-                     (scan!))))
+                  (let
+                    ((start pos))
+                    (begin
+                      (if
+                        (cur-sw? "⎕")
+                        (begin
+                          (consume! "⎕")
+                          (if
+                            (and (< pos src-len) (cur-sw? "←"))
+                            (consume! "←")
+                            (read-ident-cont!)))
+                        (begin (advance!) (read-ident-cont!)))
+                      (tok-push! :name (slice source start pos))
+                      (scan!))))
                 (true
-                 (let ((g (find-glyph)))
-                   (if g
-                     (begin (consume! g) (tok-push! :glyph g) (scan!))
-                     (begin (advance!) (scan!))))))))))
-
+                  (let
+                    ((g (find-glyph)))
+                    (if
+                      g
+                      (begin (consume! g) (tok-push! :glyph g) (scan!))
+                      (begin (advance!) (scan!))))))))))
       (scan!)
       tokens)))

lib/apl/transpile.sx

@@ -39,8 +39,16 @@
       ((= g "⊖") apl-reverse-first)
       ((= g "⍋") apl-grade-up)
       ((= g "⍒") apl-grade-down)
+      ((= g "?") apl-roll)
+      ((= g "⍉") apl-transpose)
+      ((= g "⊢") (fn (a) a))
+      ((= g "⊣") (fn (a) a))
+      ((= g "⍕") apl-quad-fmt)
       ((= g "⎕FMT") apl-quad-fmt)
       ((= g "⎕←") apl-quad-print)
+      ((= g "⍸") apl-where)
+      ((= g "∪") apl-unique)
+      ((= g "⍎") apl-execute)
       (else (error "no monadic fn for glyph")))))
 
 (define
@@ -80,6 +88,17 @@
       ((= g "∊") apl-member)
       ((= g "⍳") apl-index-of)
       ((= g "~") apl-without)
+      ((= g "/") apl-compress)
+      ((= g "⌿") apl-compress-first)
+      ((= g "⍉") apl-transpose-dyadic)
+      ((= g "⊢") (fn (a b) b))
+      ((= g "⊣") (fn (a b) a))
+      ((= g "⍸") apl-interval-index)
+      ((= g "∪") apl-union)
+      ((= g "∩") apl-intersect)
+      ((= g "⊥") apl-decode)
+      ((= g "⊤") apl-encode)
+      ((= g "⊆") apl-partition)
       (else (error "no dyadic fn for glyph")))))
 
 (define
@@ -114,13 +133,26 @@
               ((vals (map (fn (n) (apl-eval-ast n env)) items)))
               (make-array
                 (list (len vals))
-                (map (fn (v) (first (get v :ravel))) vals)))))
+                (map
+                  (fn
+                    (v)
+                    (if
+                      (= (len (get v :shape)) 0)
+                      (first (get v :ravel))
+                      v))
+                  vals)))))
         ((= tag :name)
           (let
             ((nm (nth node 1)))
             (cond
-              ((= nm "⍺") (get env "alpha"))
-              ((= nm "⍵") (get env "omega"))
+              ((= nm "⍺")
+                (let
+                  ((v (get env "⍺")))
+                  (if (= v nil) (get env "alpha") v)))
+              ((= nm "⍵")
+                (let
+                  ((v (get env "⍵")))
+                  (if (= v nil) (get env "omega") v)))
               ((= nm "⎕IO") (apl-quad-io))
               ((= nm "⎕ML") (apl-quad-ml))
               ((= nm "⎕FR") (apl-quad-fr))
@@ -132,7 +164,11 @@
             (if
               (and (= (first fn-node) :fn-glyph) (= (nth fn-node 1) "∇"))
               (apl-call-dfn-m (get env "nabla") (apl-eval-ast arg env))
-              ((apl-resolve-monadic fn-node env) (apl-eval-ast arg env)))))
+              (let
+                ((arg-val (apl-eval-ast arg env)))
+                (let
+                  ((new-env (if (and (list? arg) (> (len arg) 0) (= (first arg) :assign-expr)) (assoc env (nth arg 1) arg-val) env)))
+                  ((apl-resolve-monadic fn-node new-env) arg-val))))))
         ((= tag :dyad)
           (let
             ((fn-node (nth node 1))
@@ -144,9 +180,13 @@
                 (get env "nabla")
                 (apl-eval-ast lhs env)
                 (apl-eval-ast rhs env))
-              ((apl-resolve-dyadic fn-node env)
-                (apl-eval-ast lhs env)
-                (apl-eval-ast rhs env)))))
+              (let
+                ((rhs-val (apl-eval-ast rhs env)))
+                (let
+                  ((new-env (if (and (list? rhs) (> (len rhs) 0) (= (first rhs) :assign-expr)) (assoc env (nth rhs 1) rhs-val) env)))
+                  ((apl-resolve-dyadic fn-node new-env)
+                    (apl-eval-ast lhs new-env)
+                    rhs-val))))))
         ((= tag :program) (apl-eval-stmts (rest node) env))
         ((= tag :dfn) node)
         ((= tag :bracket)
@@ -159,6 +199,8 @@
                     (fn (a) (if (= a :all) nil (apl-eval-ast a env)))
                     axis-exprs)))
               (apl-bracket-multi axes arr))))
+        ((= tag :assign-expr) (apl-eval-ast (nth node 2) env))
+        ((= tag :assign) (apl-eval-ast (nth node 2) env))
         (else (error (list "apl-eval-ast: unknown node tag" tag node)))))))
 
 (define
@@ -538,3 +580,13 @@
         (else (error "apl-resolve-dyadic: unknown fn-node tag"))))))
 
 (define apl-run (fn (src) (apl-eval-ast (parse-apl src) {})))
+
+(define apl-run-file (fn (path) (apl-run (file-read path))))
+
+(define
+  apl-execute
+  (fn
+    (arr)
+    (let
+      ((src (cond ((string? arr) arr) ((scalar? arr) (disclose arr)) (else (reduce str "" (get arr :ravel))))))
+      (apl-run src))))

lib/common-lisp/clos.sx

@@ -330,37 +330,22 @@
                     false))))))
         (check-all 0)))))
 
-;; Precedence distance: how far class-name is from spec-name up the hierarchy.
-(define
-  clos-specificity
-  (let
-    ((registry clos-class-registry))
-    (fn
-      (class-name spec-name)
-      (define
-        walk
-        (fn
-          (cn depth)
-          (if
-            (= cn spec-name)
-            depth
-            (let
-              ((rec (get registry cn)))
-              (if
-                (nil? rec)
-                nil
-                (let
-                  ((results (map (fn (p) (walk p (+ depth 1))) (get rec "parents"))))
-                  (let
-                    ((non-nil (filter (fn (x) (not (nil? x))) results)))
-                    (if
-                      (empty? non-nil)
-                      nil
-                      (reduce
-                        (fn (a b) (if (< a b) a b))
-                        (first non-nil)
-                        (rest non-nil))))))))))
-      (walk class-name 0))))
+;; CLOS-side adapter for lib/guest/reflective/class-chain.sx. Classes
+;; live in clos-class-registry; :parents is a list of parent class
+;; names (CLOS supports multiple inheritance).
+(define clos-class-cfg
+  {:parents-of (fn (cn)
+                 (let ((rec (clos-find-class cn)))
+                   (cond ((nil? rec) (list))
+                         (:else (or (get rec "parents") (list))))))
+   :class?     (fn (n) (not (nil? (clos-find-class n))))})
+
+;; Precedence distance: how far class-name is from spec-name up the
+;; hierarchy. Delegates to refl-class-chain-depth-with which handles
+;; the multi-parent DFS with min-depth selection.
+(define clos-specificity
+  (fn (class-name spec-name)
+    (refl-class-chain-depth-with clos-class-cfg class-name spec-name)))
 
 (define
   clos-method-more-specific?

lib/common-lisp/test.sh

@@ -368,7 +368,7 @@ run_program_suite \
 
 # ── Phase 4: CLOS unit tests ─────────────────────────────────────────────────
 CLOS_FILE=$(mktemp); trap "rm -f $CLOS_FILE" EXIT
-printf '(epoch 1)\n(load "spec/stdlib.sx")\n(epoch 2)\n(load "lib/common-lisp/runtime.sx")\n(epoch 3)\n(load "lib/common-lisp/clos.sx")\n(epoch 4)\n(load "lib/common-lisp/tests/clos.sx")\n(epoch 5)\n(eval "passed")\n(epoch 6)\n(eval "failed")\n(epoch 7)\n(eval "failures")\n' > "$CLOS_FILE"
+printf '(epoch 1)\n(load "spec/stdlib.sx")\n(epoch 2)\n(load "lib/common-lisp/runtime.sx")\n(epoch 3)\n(load "lib/guest/reflective/class-chain.sx")\n(load "lib/common-lisp/clos.sx")\n(epoch 4)\n(load "lib/common-lisp/tests/clos.sx")\n(epoch 5)\n(eval "passed")\n(epoch 6)\n(eval "failed")\n(epoch 7)\n(eval "failures")\n' > "$CLOS_FILE"
 CLOS_OUT=$(timeout 30 "$SX_SERVER" < "$CLOS_FILE" 2>/dev/null)
 rm -f "$CLOS_FILE"
 CLOS_PASSED=$(echo "$CLOS_OUT" | grep -A1 "^(ok-len 5 " | tail -1 || true)
@@ -389,7 +389,7 @@ fi
 run_clos_suite() {
   local prog="$1" pass_var="$2" fail_var="$3" failures_var="$4"
   local PROG_FILE=$(mktemp)
-  printf '(epoch 1)\n(load "spec/stdlib.sx")\n(epoch 2)\n(load "lib/common-lisp/runtime.sx")\n(epoch 3)\n(load "lib/common-lisp/clos.sx")\n(epoch 4)\n(load "%s")\n(epoch 5)\n(eval "%s")\n(epoch 6)\n(eval "%s")\n(epoch 7)\n(eval "%s")\n' \
+  printf '(epoch 1)\n(load "spec/stdlib.sx")\n(epoch 2)\n(load "lib/common-lisp/runtime.sx")\n(epoch 3)\n(load "lib/guest/reflective/class-chain.sx")\n(load "lib/common-lisp/clos.sx")\n(epoch 4)\n(load "%s")\n(epoch 5)\n(eval "%s")\n(epoch 6)\n(eval "%s")\n(epoch 7)\n(eval "%s")\n' \
     "$prog" "$pass_var" "$fail_var" "$failures_var" > "$PROG_FILE"
   local OUT; OUT=$(timeout 20 "$SX_SERVER" < "$PROG_FILE" 2>/dev/null)
   rm -f "$PROG_FILE"

lib/content/anchor.sx

@@ -0,0 +1,51 @@
+;; content-on-sx — anchored-heading HTML render.
+;;
+;; Like asHTML, but headings carry an id attribute (the block id), so the TOC's
+;; #id links resolve. A separate render so the plain asHTML stays unchanged.
+;; Tree-aware (sections recurse); other blocks use their normal asHTML.
+;;
+;; Requires (loaded by harness): block.sx, doc.sx, render.sx (asHTML +
+;; htmlEscaped).
+
+(define
+  anch-section?
+  (fn (b) (and (st-instance? b) (= (get b :class) "CtSection"))))
+(define anch-esc (fn (s) (str (st-send s "htmlEscaped" (list)))))
+
+(define
+  anchor-block
+  (fn
+    (b)
+    (cond
+      ((= (blk-type b) "heading")
+        (let
+          ((l (str (blk-get b "level"))) (id (blk-id b)))
+          (str
+            "<h"
+            l
+            " id=\""
+            id
+            "\">"
+            (anch-esc (str (blk-get b "text")))
+            "</h"
+            l
+            ">")))
+      ((anch-section? b)
+        (let
+          ((ch (st-iv-get b "children")))
+          (str
+            "<section>"
+            (anchor-blocks (if (list? ch) ch (list)))
+            "</section>")))
+      (else (str (st-send b "asHTML" (list)))))))
+
+(define
+  anchor-blocks
+  (fn
+    (blocks)
+    (if
+      (= (len blocks) 0)
+      ""
+      (str (anchor-block (first blocks)) (anchor-blocks (rest blocks))))))
+
+(define content/html-anchored (fn (doc) (anchor-blocks (doc-blocks doc))))

lib/content/api.sx

@@ -0,0 +1,72 @@
+;; content-on-sx — public API facade.
+;;
+;; The stable surface other code calls. Composes block + doc + render. Document
+;; values are immutable; every edit returns a new document, so callers hold
+;; explicit versions (the persist op log in Phase 2 becomes the source of truth).
+;;
+;; Requires (loaded by the harness): block.sx, doc.sx, render.sx and a base
+;; Smalltalk class table (st-bootstrap-classes!).
+
+;; Register the content class hierarchy + render methods. Caller bootstraps the
+;; base Smalltalk classes first; this only adds content classes (idempotent).
+(define
+  content/bootstrap!
+  (fn
+    ()
+    (begin
+      (content-bootstrap-blocks!)
+      (content-bootstrap-doc!)
+      (content-bootstrap-render!)
+      true)))
+
+;; ── documents ──
+(define content/new doc-new)
+(define content/empty doc-empty)
+(define content/append doc-append)
+(define content/blocks doc-blocks)
+(define content/count doc-count)
+;; find / has? are TREE-WIDE by id (descend into sections) — so the facade reads
+;; back any block content/edit can update or delete. content/find-top / has-top?
+;; keep the top-level-only lookup for callers that mean the ordered sequence.
+(define content/find doc-find-deep)
+(define content/has? doc-has-deep?)
+(define content/find-top doc-find)
+(define content/has-top? doc-has?)
+(define content/ids doc-ids)
+(define content/types doc-types)
+
+;; ── blocks ──
+(define content/block mk-block)
+
+;; ── edit ops (data payload) ──
+(define content/insert op-insert)
+(define content/update op-update)
+(define content/move op-move)
+(define content/delete op-delete)
+
+(define content/op? (fn (x) (and (dict? x) (has-key? x :op))))
+
+;; edit — apply one op or a stream of ops; returns a new document.
+(define
+  content/edit
+  (fn
+    (doc ops)
+    (if (content/op? ops) (doc-apply doc ops) (doc-apply-all doc ops))))
+
+;; ── render boundary ──
+;; fmt is "html"/"sx"/"md"/"text" (or the matching keyword). "md" needs
+;; markdown.sx loaded; "text" needs text.sx loaded.
+(define
+  content/render
+  (fn
+    (doc fmt)
+    (cond
+      ((= fmt "html") (asHTML doc))
+      ((= fmt "sx") (asSx doc))
+      ((= fmt "md") (asMarkdown doc))
+      ((= fmt "markdown") (asMarkdown doc))
+      ((= fmt "text") (asText doc))
+      (else (error (str "unknown render format: " fmt))))))
+
+(define content/html asHTML)
+(define content/sx asSx)

lib/content/block.sx

@@ -0,0 +1,171 @@
+;; content-on-sx — typed block objects on Smalltalk-on-SX.
+;;
+;; A block is a Smalltalk instance. Behaviour (type tag, later render) is a
+;; message, not a property switch. Fields are immutable: blk-set / mk-* build a
+;; fresh instance via the functional st-iv-set!, so old versions are never
+;; clobbered (history-safe for the persist op log and CRDT merge).
+;;
+;; Hierarchy:
+;;   CtBlock (id)
+;;     CtText (text)
+;;       CtHeading (level)
+;;       CtCode (language)
+;;       CtQuote (cite)
+;;     CtImage (src alt)
+;;     CtEmbed (url provider)
+;;     CtDivider
+;;     CtList (ordered items)
+;; Plus self-contained blocks registered by their own files: CtSection,
+;; CtTable, CtCallout, CtMedia. ct-class-for-type maps every tag (so mk-block,
+;; content/from-data and CRDT materialise build them uniformly); the classes
+;; themselves are registered by content-bootstrap-section!/table!/callout!/media!.
+
+(define
+  ct-def-method!
+  (fn (cls sel src) (st-class-add-method! cls sel (st-parse-method src))))
+
+;; Register the block hierarchy in the Smalltalk class table. Call AFTER
+;; st-bootstrap-classes! (which resets the table). Idempotent.
+(define
+  content-bootstrap-blocks!
+  (fn
+    ()
+    (begin
+      (st-class-define! "CtBlock" "Object" (list "id"))
+      (ct-def-method! "CtBlock" "id" "id ^ id")
+      (ct-def-method! "CtBlock" "type" "type ^ #block")
+      (ct-def-method! "CtBlock" "isBlock" "isBlock ^ true")
+      (st-class-define! "CtText" "CtBlock" (list "text"))
+      (ct-def-method! "CtText" "text" "text ^ text")
+      (ct-def-method! "CtText" "type" "type ^ #text")
+      (st-class-define! "CtHeading" "CtText" (list "level"))
+      (ct-def-method! "CtHeading" "level" "level ^ level")
+      (ct-def-method! "CtHeading" "type" "type ^ #heading")
+      (st-class-define! "CtCode" "CtText" (list "language"))
+      (ct-def-method! "CtCode" "language" "language ^ language")
+      (ct-def-method! "CtCode" "type" "type ^ #code")
+      (st-class-define! "CtQuote" "CtText" (list "cite"))
+      (ct-def-method! "CtQuote" "cite" "cite ^ cite")
+      (ct-def-method! "CtQuote" "type" "type ^ #quote")
+      (st-class-define! "CtImage" "CtBlock" (list "src" "alt"))
+      (ct-def-method! "CtImage" "src" "src ^ src")
+      (ct-def-method! "CtImage" "alt" "alt ^ alt")
+      (ct-def-method! "CtImage" "type" "type ^ #image")
+      (st-class-define! "CtEmbed" "CtBlock" (list "url" "provider"))
+      (ct-def-method! "CtEmbed" "url" "url ^ url")
+      (ct-def-method! "CtEmbed" "provider" "provider ^ provider")
+      (ct-def-method! "CtEmbed" "type" "type ^ #embed")
+      (st-class-define! "CtDivider" "CtBlock" (list))
+      (ct-def-method! "CtDivider" "type" "type ^ #divider")
+      (st-class-define! "CtList" "CtBlock" (list "ordered" "items"))
+      (ct-def-method! "CtList" "ordered" "ordered ^ ordered")
+      (ct-def-method! "CtList" "items" "items ^ items")
+      (ct-def-method! "CtList" "type" "type ^ #list")
+      true)))
+
+;; Apply (name value) pairs functionally onto a fresh instance.
+(define
+  ct-apply-fields
+  (fn
+    (inst pairs)
+    (if
+      (= (len pairs) 0)
+      inst
+      (ct-apply-fields
+        (st-iv-set!
+          inst
+          (first (first pairs))
+          (first (rest (first pairs))))
+        (rest pairs)))))
+
+(define
+  ct-class-for-type
+  (fn
+    (tag)
+    (cond
+      ((= tag "text") "CtText")
+      ((= tag "heading") "CtHeading")
+      ((= tag "code") "CtCode")
+      ((= tag "quote") "CtQuote")
+      ((= tag "image") "CtImage")
+      ((= tag "embed") "CtEmbed")
+      ((= tag "divider") "CtDivider")
+      ((= tag "list") "CtList")
+      ((= tag "section") "CtSection")
+      ((= tag "table") "CtTable")
+      ((= tag "callout") "CtCallout")
+      ((= tag "media") "CtMedia")
+      (else (error (str "unknown block type: " tag))))))
+
+;; Generic constructor — wire tag + id + (name value) field pairs.
+(define
+  mk-block
+  (fn
+    (type-tag id fields)
+    (ct-apply-fields
+      (st-iv-set! (st-make-instance (ct-class-for-type type-tag)) "id" id)
+      fields)))
+
+(define
+  mk-text
+  (fn (id text) (mk-block "text" id (list (list "text" text)))))
+
+(define
+  mk-heading
+  (fn
+    (id level text)
+    (mk-block "heading" id (list (list "level" level) (list "text" text)))))
+
+(define
+  mk-code
+  (fn
+    (id language text)
+    (mk-block
+      "code"
+      id
+      (list (list "language" language) (list "text" text)))))
+
+(define
+  mk-quote
+  (fn
+    (id cite text)
+    (mk-block "quote" id (list (list "cite" cite) (list "text" text)))))
+
+(define
+  mk-image
+  (fn
+    (id src alt)
+    (mk-block "image" id (list (list "src" src) (list "alt" alt)))))
+
+(define
+  mk-embed
+  (fn
+    (id url provider)
+    (mk-block "embed" id (list (list "url" url) (list "provider" provider)))))
+
+(define mk-divider (fn (id) (mk-block "divider" id (list))))
+
+(define
+  mk-list
+  (fn
+    (id ordered items)
+    (mk-block
+      "list"
+      id
+      (list (list "ordered" ordered) (list "items" items)))))
+
+;; Accessors. blk-type / blk-id go through message dispatch (polymorphic);
+;; blk-get reads any ivar directly; blk-set is copy-on-write.
+(define blk-id (fn (b) (st-send b "id" (list))))
+(define blk-type (fn (b) (str (st-send b "type" (list)))))
+(define blk-send (fn (b sel) (st-send b sel (list))))
+(define blk-get (fn (b field) (st-iv-get b field)))
+(define blk-set (fn (b field val) (st-iv-set! b field val)))
+
+(define
+  block?
+  (fn
+    (v)
+    (and
+      (st-instance? v)
+      (st-class-inherits-from? (get v :class) "CtBlock"))))

lib/content/callout.sx

@@ -0,0 +1,49 @@
+;; content-on-sx — callout / admonition block.
+;;
+;; CtCallout holds a `kind` (note/warning/tip/…) and `text`. Self-contained: it
+;; answers asHTML/asSx/asText/asMarkdown: so it composes with the render boundary
+;; with no changes elsewhere. HTML text is htmlEscaped, SX text sxEscaped.
+;;
+;; Requires (loaded by harness): block.sx, doc.sx, render.sx (escapers);
+;; markdown.sx / text.sx for those formats.
+
+(define
+  content-bootstrap-callout!
+  (fn
+    ()
+    (begin
+      (st-class-define! "CtCallout" "CtBlock" (list "kind" "text"))
+      (ct-def-method! "CtCallout" "kind" "kind ^ kind")
+      (ct-def-method! "CtCallout" "text" "text ^ text")
+      (ct-def-method! "CtCallout" "type" "type ^ #callout")
+      (ct-def-method!
+        "CtCallout"
+        "asHTML"
+        "asHTML ^ '<aside class=\"callout callout-' , kind htmlEscaped , '\">' , text htmlEscaped , '</aside>'")
+      (ct-def-method!
+        "CtCallout"
+        "asSx"
+        "asSx ^ '(aside :class \"callout callout-' , kind sxEscaped , '\" \"' , text sxEscaped , '\")'")
+      (ct-def-method! "CtCallout" "asText" "asText ^ text")
+      (ct-def-method!
+        "CtCallout"
+        "asMarkdown:"
+        "asMarkdown: nl ^ '> **' , kind , ':** ' , text")
+      true)))
+
+(define
+  mk-callout
+  (fn
+    (id kind text)
+    (st-iv-set!
+      (st-iv-set!
+        (st-iv-set! (st-make-instance "CtCallout") "id" id)
+        "kind"
+        kind)
+      "text"
+      text)))
+
+(define
+  callout?
+  (fn (b) (and (st-instance? b) (= (get b :class) "CtCallout"))))
+(define callout-kind (fn (b) (st-send b "kind" (list))))

lib/content/clone.sx

@@ -0,0 +1,34 @@
+;; content-on-sx — block id remapping / clone.
+;;
+;; Deep-rewrite every block id in the tree (descending into sections) by applying
+;; a function. Enables collision-free composition: prefix one document's ids
+;; before concatenating it with another. Immutable; content is unchanged, only
+;; ids.
+;;
+;; Requires (loaded by harness): doc.sx, section.sx (section? /
+;; section-children / section-with-children).
+
+(define
+  block-remap-id
+  (fn
+    (b f)
+    (let
+      ((nb (blk-set b "id" (f (blk-id b)))))
+      (if
+        (section? nb)
+        (section-with-children
+          nb
+          (map (fn (c) (block-remap-id c f)) (section-children nb)))
+        nb))))
+
+(define
+  content/remap-ids
+  (fn
+    (doc f)
+    (doc-with-blocks
+      doc
+      (map (fn (b) (block-remap-id b f)) (doc-blocks doc)))))
+
+(define
+  content/prefix-ids
+  (fn (doc prefix) (content/remap-ids doc (fn (id) (str prefix id)))))

lib/content/compose.sx

@@ -0,0 +1,42 @@
+;; content-on-sx — document composition.
+;;
+;; Combine documents (header + body + footer, templates, partials) into a new
+;; document. The result keeps the FIRST document's id and metadata; blocks are
+;; concatenated. Immutable — inputs are untouched. Block-id collisions across
+;; combined docs are the caller's concern (content/validate flags duplicates).
+;;
+;; Requires (loaded by harness): doc.sx.
+
+(define
+  content/concat
+  (fn (a b) (doc-with-blocks a (append (doc-blocks a) (doc-blocks b)))))
+
+(define
+  content/prepend
+  (fn (a b) (doc-with-blocks a (append (doc-blocks b) (doc-blocks a)))))
+
+(define
+  content/-concat-fold
+  (fn
+    (acc more)
+    (if
+      (= (len more) 0)
+      acc
+      (content/-concat-fold (content/concat acc (first more)) (rest more)))))
+
+(define
+  content/concat-all
+  (fn
+    (docs)
+    (if
+      (= (len docs) 0)
+      (doc-empty "merged")
+      (content/-concat-fold (first docs) (rest docs)))))
+
+;; wrap a document's blocks inside a single section (collapse to a subtree).
+;; Requires section.sx (mk-section) when used.
+(define
+  content/wrap-section
+  (fn
+    (doc section-id)
+    (doc-with-blocks doc (list (mk-section section-id (doc-blocks doc))))))

lib/content/conformance.sh

@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+# lib/content/conformance.sh — run content-on-sx suites, emit scoreboard.
+
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+
+SX_SERVER="hosts/ocaml/_build/default/bin/sx_server.exe"
+if [ ! -x "$SX_SERVER" ]; then
+  MAIN_ROOT=$(git worktree list | head -1 | awk '{print $1}')
+  if [ -x "$MAIN_ROOT/$SX_SERVER" ]; then
+    SX_SERVER="$MAIN_ROOT/$SX_SERVER"
+  else
+    echo "ERROR: sx_server.exe not found." >&2
+    exit 1
+  fi
+fi
+
+SUITES=(block doc render api meta page page-full markdown text section compose tree-edit move clone query toc anchor outline flatten transform normalize find-replace stats summary index table callout media data wire validate store snapshot crdt crdt-tree crdt-blocks crdt-store sync md-import md-doc fed)
+
+OUT_JSON="lib/content/scoreboard.json"
+OUT_MD="lib/content/scoreboard.md"
+
+run_suite() {
+  local suite=$1
+  local file="lib/content/tests/${suite}.sx"
+  local TMP
+  TMP=$(mktemp)
+  cat > "$TMP" << EPOCHS
+(epoch 1)
+(load "lib/smalltalk/tokenizer.sx")
+(load "lib/smalltalk/parser.sx")
+(load "lib/guest/reflective/class-chain.sx")
+(load "lib/smalltalk/runtime.sx")
+(load "lib/guest/reflective/env.sx")
+(load "lib/smalltalk/eval.sx")
+(load "lib/persist/event.sx")
+(load "lib/persist/backend.sx")
+(load "lib/persist/log.sx")
+(load "lib/persist/kv.sx")
+(load "lib/persist/api.sx")
+(load "lib/content/block.sx")
+(load "lib/content/doc.sx")
+(load "lib/content/render.sx")
+(load "lib/content/api.sx")
+(load "lib/content/meta.sx")
+(load "lib/content/text.sx")
+(load "lib/content/section.sx")
+(load "lib/content/compose.sx")
+(load "lib/content/tree-edit.sx")
+(load "lib/content/move.sx")
+(load "lib/content/clone.sx")
+(load "lib/content/query.sx")
+(load "lib/content/toc.sx")
+(load "lib/content/anchor.sx")
+(load "lib/content/outline.sx")
+(load "lib/content/flatten.sx")
+(load "lib/content/transform.sx")
+(load "lib/content/normalize.sx")
+(load "lib/content/find-replace.sx")
+(load "lib/content/stats.sx")
+(load "lib/content/summary.sx")
+(load "lib/content/index.sx")
+(load "lib/content/table.sx")
+(load "lib/content/callout.sx")
+(load "lib/content/media.sx")
+(load "lib/content/data.sx")
+(load "lib/content/wire.sx")
+(load "lib/content/page.sx")
+(load "lib/content/page-full.sx")
+(load "lib/content/markdown.sx")
+(load "lib/content/validate.sx")
+(load "lib/content/store.sx")
+(load "lib/content/snapshot.sx")
+(load "lib/content/crdt.sx")
+(load "lib/content/crdt-tree.sx")
+(load "lib/content/crdt-store.sx")
+(load "lib/content/sync.sx")
+(load "lib/content/md-import.sx")
+(load "lib/content/md-doc.sx")
+(load "lib/content/fed.sx")
+(epoch 2)
+(eval "(define content-test-pass 0)")
+(eval "(define content-test-fail 0)")
+(eval "(define content-test-fails (list))")
+(eval "(define content-test (fn (name got expected) (if (= got expected) (set! content-test-pass (+ content-test-pass 1)) (begin (set! content-test-fail (+ content-test-fail 1)) (set! content-test-fails (cons name content-test-fails))))))")
+(epoch 3)
+(load "${file}")
+(epoch 4)
+(eval "(list content-test-pass content-test-fail)")
+EPOCHS
+
+  local OUTPUT
+  OUTPUT=$(timeout 240 "$SX_SERVER" < "$TMP" 2>/dev/null)
+  rm -f "$TMP"
+
+  local LINE
+  LINE=$(echo "$OUTPUT" | awk '/^\(ok-len 4 / {getline; print; exit}')
+  if [ -z "$LINE" ]; then
+    LINE=$(echo "$OUTPUT" | grep -E '^\(ok 4 \([0-9]+ [0-9]+\)\)' | tail -1 \
+            | sed -E 's/^\(ok 4 //; s/\)$//')
+  fi
+
+  local P F
+  P=$(echo "$LINE" | sed -E 's/^\(([0-9]+) ([0-9]+)\).*/\1/')
+  F=$(echo "$LINE" | sed -E 's/^\(([0-9]+) ([0-9]+)\).*/\2/')
+  P=${P:-0}
+  F=${F:-0}
+  echo "${P} ${F}"
+}
+
+declare -A SUITE_PASS
+declare -A SUITE_FAIL
+TOTAL_PASS=0
+TOTAL_FAIL=0
+
+echo "Running content conformance suite..." >&2
+for s in "${SUITES[@]}"; do
+  read -r p f < <(run_suite "$s")
+  SUITE_PASS[$s]=$p
+  SUITE_FAIL[$s]=$f
+  TOTAL_PASS=$((TOTAL_PASS + p))
+  TOTAL_FAIL=$((TOTAL_FAIL + f))
+  printf "  %-12s %d/%d\n" "$s" "$p" "$((p+f))" >&2
+done
+
+{
+  printf '{\n'
+  printf '  "suites": {\n'
+  first=1
+  for s in "${SUITES[@]}"; do
+    if [ $first -eq 0 ]; then printf ',\n'; fi
+    printf '    "%s": {"pass": %d, "fail": %d}' "$s" "${SUITE_PASS[$s]}" "${SUITE_FAIL[$s]}"
+    first=0
+  done
+  printf '\n  },\n'
+  printf '  "total_pass": %d,\n' "$TOTAL_PASS"
+  printf '  "total_fail": %d,\n' "$TOTAL_FAIL"
+  printf '  "total": %d\n' "$((TOTAL_PASS + TOTAL_FAIL))"
+  printf '}\n'
+} > "$OUT_JSON"
+
+{
+  printf '# content-on-sx Conformance Scoreboard\n\n'
+  printf '_Generated by `lib/content/conformance.sh`_\n\n'
+  printf '| Suite | Pass | Fail | Total |\n'
+  printf '|-------|-----:|-----:|------:|\n'
+  for s in "${SUITES[@]}"; do
+    p=${SUITE_PASS[$s]}
+    f=${SUITE_FAIL[$s]}
+    printf '| %s | %d | %d | %d |\n' "$s" "$p" "$f" "$((p+f))"
+  done
+  printf '| **Total** | **%d** | **%d** | **%d** |\n' "$TOTAL_PASS" "$TOTAL_FAIL" "$((TOTAL_PASS + TOTAL_FAIL))"
+} > "$OUT_MD"
+
+echo "Wrote $OUT_JSON and $OUT_MD" >&2
+echo "Total: $TOTAL_PASS pass, $TOTAL_FAIL fail" >&2
+
+[ "$TOTAL_FAIL" -eq 0 ]

lib/content/crdt-store.sx

@@ -0,0 +1,71 @@
+;; content-on-sx — durable collaborative replication: CRDT ops on persist.
+;;
+;; Each replica appends its CRDT ops to its own persist stream
+;; (crdt:<doc>:<replica>). Any node reconstructs the converged document by
+;; replaying every replica's log into a CvRDT state and merging them. Because
+;; the merge is a join and crdt-apply is order/duplicate-insensitive, the
+;; converged result is identical regardless of replica order or re-delivery —
+;; the durable log + CRDT give offline-capable, eventually-consistent editing.
+;;
+;; Requires (loaded by harness): crdt.sx (+ deps) and persist
+;; (event/backend/log/kv/api). Backend `b` injected via (persist/open).
+
+(define crdt/-stream (fn (doc-id replica) (str "crdt:" doc-id ":" replica)))
+
+;; ── commit ops to a replica's durable log ──
+(define
+  crdt/commit!
+  (fn
+    (b doc-id replica op at)
+    (persist/append b (crdt/-stream doc-id replica) (get op :op) at op)))
+
+(define
+  crdt/commit-all!
+  (fn
+    (b doc-id replica ops at)
+    (if
+      (= (len ops) 0)
+      nil
+      (begin
+        (crdt/commit! b doc-id replica (first ops) at)
+        (crdt/commit-all! b doc-id replica (rest ops) at)))))
+
+;; ── read a replica's log ──
+(define
+  crdt/log
+  (fn (b doc-id replica) (persist/read b (crdt/-stream doc-id replica))))
+
+(define
+  crdt/replica-ops
+  (fn
+    (b doc-id replica)
+    (map (fn (ev) (persist/event-data ev)) (crdt/log b doc-id replica))))
+
+(define
+  crdt/replica-version
+  (fn (b doc-id replica) (persist/last-seq b (crdt/-stream doc-id replica))))
+
+;; ── replay one replica's log into a CvRDT state ──
+(define
+  crdt/replay
+  (fn
+    (b doc-id replica)
+    (crdt-apply-all (crdt-empty) (crdt/replica-ops b doc-id replica))))
+
+;; ── converge: merge every replica's replayed state ──
+(define
+  crdt/converge
+  (fn
+    (b doc-id replicas)
+    (crdt-merge-all (map (fn (r) (crdt/replay b doc-id r)) replicas))))
+
+;; ── converged, materialised document ──
+(define
+  crdt/document
+  (fn
+    (b doc-id replicas)
+    (crdt-materialize doc-id (crdt/converge b doc-id replicas))))
+
+(define
+  crdt/order
+  (fn (b doc-id replicas) (crdt-order (crdt/converge b doc-id replicas))))

lib/content/crdt-tree.sx

@@ -0,0 +1,193 @@
+;; content-on-sx — nested-tree CvRDT.
+;;
+;; Extends the flat CvRDT (crdt.sx) to a TREE: each element carries a `parent`
+;; (the id of its containing section, "" = root) alongside its Logoot position.
+;; Merge is still a join — it reuses crdt.sx's position/register/field merges and
+;; adds parent (immutable, set once at insert). Materialisation rebuilds the
+;; ordered tree: root = elements with parent "" (plus ORPHANS — elements whose
+;; parent is not a live section, e.g. after a concurrent delete-section +
+;; insert-child, so content is never silently lost); a section's children =
+;; elements whose parent is that section's id. Commutative/associative/idempotent
+;; like the flat layer.
+;;
+;; Requires (loaded by harness): crdt.sx (merge helpers + live/sort/materialise
+;; bits + crdt-member?), block.sx, doc.sx, section.sx (mk-section).
+
+(define ctt-merge-parent (fn (p1 p2) (if (= p1 nil) p2 p1)))
+
+(define ctt-merge-element (fn (e1 e2) {:fields (crdt-merge-fields (get e1 :fields) (get e2 :fields)) :parent (ctt-merge-parent (get e1 :parent) (get e2 :parent)) :id (get e1 :id) :type (crdt-merge-type (get e1 :type) (get e2 :type)) :deleted (or (= (get e1 :deleted) true) (= (get e2 :deleted) true)) :pos (crdt-merge-pos (get e1 :pos) (get e2 :pos))}))
+
+(define
+  ctt-add-element
+  (fn
+    (state elem)
+    (let
+      ((elems (get state :elements)) (id (get elem :id)))
+      (let
+        ((existing (get elems id)))
+        (assoc
+          state
+          :elements (assoc
+            elems
+            id
+            (if (= existing nil) elem (ctt-merge-element existing elem))))))))
+
+;; ── ops as partial-element contributions ──
+(define
+  crdt-tree-insert
+  (fn
+    (state id type pos parent fields ts actor)
+    (ctt-add-element state {:fields (crdt-build-fields fields ts actor) :parent parent :id id :type type :deleted false :pos pos})))
+
+(define
+  crdt-tree-update
+  (fn (state id fname value ts actor) (ctt-add-element state {:fields (assoc {} fname {:ts ts :actor actor :value value}) :parent nil :id id :type nil :deleted false :pos nil})))
+
+(define crdt-tree-delete (fn (state id) (ctt-add-element state {:fields {} :parent nil :id id :type nil :deleted true :pos nil})))
+
+;; ── state merge (join) ──
+(define
+  ctt-merge-loop
+  (fn
+    (ids ea eb acc)
+    (if
+      (= (len ids) 0)
+      acc
+      (let
+        ((id (first ids)))
+        (let
+          ((x (get ea id)) (y (get eb id)))
+          (ctt-merge-loop
+            (rest ids)
+            ea
+            eb
+            (assoc
+              acc
+              id
+              (cond
+                ((= x nil) y)
+                ((= y nil) x)
+                (else (ctt-merge-element x y))))))))))
+
+(define crdt-tree-merge (fn (a b) {:elements (ctt-merge-loop (crdt-union-keys (get a :elements) (get b :elements)) (get a :elements) (get b :elements) {})}))
+
+(define
+  crdt-tree-merge-all
+  (fn
+    (states)
+    (if
+      (= (len states) 0)
+      (crdt-empty)
+      (if
+        (= (len states) 1)
+        (first states)
+        (crdt-tree-merge (first states) (crdt-tree-merge-all (rest states)))))))
+
+;; ── op interpreter ──
+(define
+  crdt-tree-op-insert
+  (fn (id type pos parent fields ts actor) {:ts ts :fields fields :parent parent :id id :type type :op "insert" :actor actor :pos pos}))
+
+(define crdt-tree-op-update (fn (id field value ts actor) {:ts ts :field field :id id :op "update" :actor actor :value value}))
+
+(define crdt-tree-op-delete (fn (id) {:id id :op "delete"}))
+
+(define
+  crdt-tree-apply
+  (fn
+    (state op)
+    (let
+      ((k (get op :op)))
+      (cond
+        ((= k "insert")
+          (crdt-tree-insert
+            state
+            (get op :id)
+            (get op :type)
+            (get op :pos)
+            (get op :parent)
+            (get op :fields)
+            (get op :ts)
+            (get op :actor)))
+        ((= k "update")
+          (crdt-tree-update
+            state
+            (get op :id)
+            (get op :field)
+            (get op :value)
+            (get op :ts)
+            (get op :actor)))
+        ((= k "delete") (crdt-tree-delete state (get op :id)))
+        (else (error (str "unknown crdt-tree op: " k)))))))
+
+(define
+  crdt-tree-apply-all
+  (fn
+    (state ops)
+    (if
+      (= (len ops) 0)
+      state
+      (crdt-tree-apply-all (crdt-tree-apply state (first ops)) (rest ops)))))
+
+;; ── materialise to a Phase-1 document (rebuild the ordered tree) ──
+(define
+  ctt-live-section-ids
+  (fn
+    (state)
+    (map
+      (fn (e) (get e :id))
+      (filter
+        (fn (e) (= (get e :type) "section"))
+        (crdt-live-elements state)))))
+
+;; an element belongs at root if its parent is "" or its parent is not a live
+;; section (orphan-reparenting: don't lose content when its section is deleted).
+(define
+  ctt-roots
+  (fn
+    (state)
+    (let
+      ((secids (ctt-live-section-ids state)))
+      (crdt-sort-by-pos
+        (filter
+          (fn
+            (e)
+            (if
+              (= (get e :parent) "")
+              true
+              (if (crdt-member? (get e :parent) secids) false true)))
+          (crdt-live-elements state))))))
+
+(define
+  ctt-children
+  (fn
+    (state parent-id)
+    (crdt-sort-by-pos
+      (filter
+        (fn (e) (= (get e :parent) parent-id))
+        (crdt-live-elements state)))))
+
+(define
+  ctt-element->block
+  (fn
+    (state e)
+    (if
+      (= (get e :type) "section")
+      (mk-section
+        (get e :id)
+        (map
+          (fn (c) (ctt-element->block state c))
+          (ctt-children state (get e :id))))
+      (crdt-element->block e))))
+
+(define
+  crdt-tree-materialize
+  (fn
+    (doc-id state)
+    (doc-new
+      doc-id
+      (map (fn (e) (ctt-element->block state e)) (ctt-roots state)))))
+
+(define
+  crdt-tree-order
+  (fn (state) (map (fn (e) (get e :id)) (ctt-roots state))))

lib/content/crdt.sx

@@ -0,0 +1,378 @@
+;; content-on-sx — collaborative merge (state-based CvRDT).
+;;
+;; The merge is a join (least upper bound) on a semilattice, so it is
+;; commutative, associative and idempotent BY CONSTRUCTION — applying ops in any
+;; order, or merging replicas in any order / twice, converges to the same
+;; document. This is NOT last-write-wins-as-cop-out: ordering uses unique dense
+;; position keys (Logoot), presence uses OR-tombstones (remove-wins), and each
+;; field is an LWW-Register keyed by a logical (ts, actor) clock — an explicit,
+;; deterministic per-field conflict policy.
+;;
+;; Every op (insert/update/delete) contributes a PARTIAL element; the per-id
+;; state is the join of all contributions. So update-before-insert and
+;; delete-before-insert are not lost — they merge when the rest arrives.
+;;
+;; Shapes:
+;;   state    = {:elements <dict id -> element>}
+;;   element  = {:id :pos :type :deleted :fields <dict fname -> register>}
+;;   register = {:value v :ts <int> :actor <int>}
+;;   position = list of cells; cell = (list digit actor); lexicographic order
+;;
+;; Requires (loaded by harness): block.sx, doc.sx.
+
+(define CRDT-BASE 65536)
+
+;; ── position order (Logoot) ──
+(define
+  crdt-cell-cmp
+  (fn
+    (c1 c2)
+    (let
+      ((d1 (first c1)) (d2 (first c2)))
+      (cond
+        ((< d1 d2) -1)
+        ((> d1 d2) 1)
+        (else
+          (let
+            ((a1 (first (rest c1))) (a2 (first (rest c2))))
+            (cond
+              ((< a1 a2) -1)
+              ((> a1 a2) 1)
+              (else 0))))))))
+
+(define
+  crdt-pos-compare
+  (fn
+    (p1 p2)
+    (cond
+      ((and (= (len p1) 0) (= (len p2) 0)) 0)
+      ((= (len p1) 0) -1)
+      ((= (len p2) 0) 1)
+      (else
+        (let
+          ((c (crdt-cell-cmp (first p1) (first p2))))
+          (if (= c 0) (crdt-pos-compare (rest p1) (rest p2)) c))))))
+
+;; single-cell position constructor (handy for explicit tests)
+(define crdt-pos (fn (digit actor) (list (list digit actor))))
+
+;; allocate a position strictly between left and right (nil = unbounded)
+(define
+  cr-alloc
+  (fn
+    (left right actor i acc)
+    (let
+      ((ld (if (< i (len left)) (first (nth left i)) 0))
+        (rd (if (< i (len right)) (first (nth right i)) CRDT-BASE)))
+      (if
+        (> (- rd ld) 1)
+        (append
+          acc
+          (list
+            (list
+              (+
+                ld
+                (+
+                  1
+                  (floor (/ (- (- rd ld) 1) 2))))
+              actor)))
+        (cr-alloc
+          left
+          right
+          actor
+          (+ i 1)
+          (append
+            acc
+            (list
+              (list
+                ld
+                (if (< i (len left)) (first (rest (nth left i))) actor)))))))))
+
+(define
+  crdt-pos-between
+  (fn
+    (left right actor)
+    (cr-alloc
+      (if (= left nil) (list) left)
+      (if (= right nil) (list) right)
+      actor
+      0
+      (list))))
+
+;; ── register (LWW by logical (ts, actor)) ──
+(define
+  crdt-reg-max
+  (fn
+    (r1 r2)
+    (cond
+      ((= r1 nil) r2)
+      ((= r2 nil) r1)
+      (else
+        (let
+          ((t1 (get r1 :ts)) (t2 (get r2 :ts)))
+          (cond
+            ((> t1 t2) r1)
+            ((< t1 t2) r2)
+            (else (if (>= (get r1 :actor) (get r2 :actor)) r1 r2))))))))
+
+;; ── small set/dict helpers ──
+(define
+  crdt-member?
+  (fn
+    (x xs)
+    (cond
+      ((= (len xs) 0) false)
+      ((= (first xs) x) true)
+      (else (crdt-member? x (rest xs))))))
+
+(define
+  crdt-dedup-loop
+  (fn
+    (xs seen)
+    (if
+      (= (len xs) 0)
+      (reverse seen)
+      (if
+        (crdt-member? (first xs) seen)
+        (crdt-dedup-loop (rest xs) seen)
+        (crdt-dedup-loop (rest xs) (cons (first xs) seen))))))
+
+(define crdt-dedup (fn (xs) (crdt-dedup-loop xs (list))))
+
+(define
+  crdt-union-keys
+  (fn (d1 d2) (crdt-dedup (append (keys d1) (keys d2)))))
+
+;; ── element join ──
+(define
+  crdt-merge-pos
+  (fn
+    (p1 p2)
+    (cond
+      ((= p1 nil) p2)
+      ((= p2 nil) p1)
+      ((<= (crdt-pos-compare p1 p2) 0) p1)
+      (else p2))))
+
+(define crdt-merge-type (fn (t1 t2) (if (= t1 nil) t2 t1)))
+
+(define
+  crdt-merge-fields-loop
+  (fn
+    (names f1 f2 acc)
+    (if
+      (= (len names) 0)
+      acc
+      (let
+        ((nm (first names)))
+        (crdt-merge-fields-loop
+          (rest names)
+          f1
+          f2
+          (assoc acc nm (crdt-reg-max (get f1 nm) (get f2 nm))))))))
+
+(define
+  crdt-merge-fields
+  (fn
+    (f1 f2)
+    (crdt-merge-fields-loop (crdt-union-keys f1 f2) f1 f2 {})))
+
+(define crdt-merge-element (fn (e1 e2) {:fields (crdt-merge-fields (get e1 :fields) (get e2 :fields)) :id (get e1 :id) :type (crdt-merge-type (get e1 :type) (get e2 :type)) :deleted (or (= (get e1 :deleted) true) (= (get e2 :deleted) true)) :pos (crdt-merge-pos (get e1 :pos) (get e2 :pos))}))
+
+;; ── state ──
+(define crdt-empty (fn () {:elements {}}))
+
+(define
+  crdt-add-element
+  (fn
+    (state elem)
+    (let
+      ((elems (get state :elements)) (id (get elem :id)))
+      (let
+        ((existing (get elems id)))
+        (assoc
+          state
+          :elements (assoc
+            elems
+            id
+            (if (= existing nil) elem (crdt-merge-element existing elem))))))))
+
+(define
+  crdt-build-fields-loop
+  (fn
+    (pairs ts actor acc)
+    (if
+      (= (len pairs) 0)
+      acc
+      (crdt-build-fields-loop
+        (rest pairs)
+        ts
+        actor
+        (assoc acc (first (first pairs)) {:ts ts :actor actor :value (first (rest (first pairs)))})))))
+
+(define
+  crdt-build-fields
+  (fn (pairs ts actor) (crdt-build-fields-loop pairs ts actor {})))
+
+;; ── ops as partial-element contributions ──
+(define
+  crdt-insert
+  (fn
+    (state id type pos fields ts actor)
+    (crdt-add-element state {:fields (crdt-build-fields fields ts actor) :id id :type type :deleted false :pos pos})))
+
+(define
+  crdt-update
+  (fn (state id fname value ts actor) (crdt-add-element state {:fields (assoc {} fname {:ts ts :actor actor :value value}) :id id :type nil :deleted false :pos nil})))
+
+(define crdt-delete (fn (state id) (crdt-add-element state {:fields {} :id id :type nil :deleted true :pos nil})))
+
+;; ── state merge (join) ──
+(define
+  crdt-merge-loop
+  (fn
+    (ids ea eb acc)
+    (if
+      (= (len ids) 0)
+      acc
+      (let
+        ((id (first ids)))
+        (let
+          ((x (get ea id)) (y (get eb id)))
+          (crdt-merge-loop
+            (rest ids)
+            ea
+            eb
+            (assoc
+              acc
+              id
+              (cond
+                ((= x nil) y)
+                ((= y nil) x)
+                (else (crdt-merge-element x y))))))))))
+
+(define crdt-merge (fn (a b) {:elements (crdt-merge-loop (crdt-union-keys (get a :elements) (get b :elements)) (get a :elements) (get b :elements) {})}))
+
+(define
+  crdt-merge-all
+  (fn
+    (states)
+    (if
+      (= (len states) 0)
+      (crdt-empty)
+      (if
+        (= (len states) 1)
+        (first states)
+        (crdt-merge (first states) (crdt-merge-all (rest states)))))))
+
+;; ── op interpreter ──
+(define crdt-op-insert (fn (id type pos fields ts actor) {:ts ts :fields fields :id id :type type :op "insert" :actor actor :pos pos}))
+
+(define crdt-op-update (fn (id field value ts actor) {:ts ts :field field :id id :op "update" :actor actor :value value}))
+
+(define crdt-op-delete (fn (id) {:id id :op "delete"}))
+
+(define
+  crdt-apply
+  (fn
+    (state op)
+    (let
+      ((k (get op :op)))
+      (cond
+        ((= k "insert")
+          (crdt-insert
+            state
+            (get op :id)
+            (get op :type)
+            (get op :pos)
+            (get op :fields)
+            (get op :ts)
+            (get op :actor)))
+        ((= k "update")
+          (crdt-update
+            state
+            (get op :id)
+            (get op :field)
+            (get op :value)
+            (get op :ts)
+            (get op :actor)))
+        ((= k "delete") (crdt-delete state (get op :id)))
+        (else (error (str "unknown crdt op: " k)))))))
+
+(define
+  crdt-apply-all
+  (fn
+    (state ops)
+    (if
+      (= (len ops) 0)
+      state
+      (crdt-apply-all (crdt-apply state (first ops)) (rest ops)))))
+
+;; ── materialise to a Phase-1 document ──
+(define
+  crdt-elements-list
+  (fn
+    (state)
+    (map
+      (fn (id) (get (get state :elements) id))
+      (keys (get state :elements)))))
+
+(define
+  crdt-live?
+  (fn
+    (e)
+    (and
+      (= (get e :deleted) false)
+      (if (= (get e :pos) nil) false true)
+      (if (= (get e :type) nil) false true))))
+
+(define
+  crdt-live-elements
+  (fn (state) (filter crdt-live? (crdt-elements-list state))))
+
+(define
+  crdt-insert-sorted
+  (fn
+    (e sorted)
+    (cond
+      ((= (len sorted) 0) (list e))
+      ((< (crdt-pos-compare (get e :pos) (get (first sorted) :pos)) 0)
+        (cons e sorted))
+      (else (cons (first sorted) (crdt-insert-sorted e (rest sorted)))))))
+
+(define
+  crdt-sort-by-pos
+  (fn
+    (elems)
+    (if
+      (= (len elems) 0)
+      (list)
+      (crdt-insert-sorted (first elems) (crdt-sort-by-pos (rest elems))))))
+
+(define
+  crdt-field-pairs
+  (fn
+    (fields)
+    (map (fn (nm) (list nm (get (get fields nm) :value))) (keys fields))))
+
+(define
+  crdt-element->block
+  (fn
+    (e)
+    (mk-block (get e :type) (get e :id) (crdt-field-pairs (get e :fields)))))
+
+(define
+  crdt-order
+  (fn
+    (state)
+    (map
+      (fn (e) (get e :id))
+      (crdt-sort-by-pos (crdt-live-elements state)))))
+
+(define
+  crdt-materialize
+  (fn
+    (doc-id state)
+    (doc-new
+      doc-id
+      (map crdt-element->block (crdt-sort-by-pos (crdt-live-elements state))))))

lib/content/data.sx

@@ -0,0 +1,79 @@
+;; content-on-sx — portable data serialization.
+;;
+;; Converts documents to/from a plain SX data form, decoupling storage and
+;; transport from the Smalltalk instance shape. A document becomes
+;;   {:id :title :slug :tags :blocks (list block-data)}
+;; and a block becomes {:id :type :fields {...}} (section children recurse).
+;; content/from-data reconstructs real block objects.
+;;
+;; Requires (loaded by harness): block.sx, doc.sx, meta.sx, section.sx
+;; (mk-section), table.sx (mk-table).
+
+;; ── to-data ──
+(define
+  content/-fd-loop
+  (fn
+    (ks ivs acc)
+    (if
+      (= (len ks) 0)
+      acc
+      (let
+        ((k (first ks)))
+        (if
+          (= k "id")
+          (content/-fd-loop (rest ks) ivs acc)
+          (content/-fd-loop
+            (rest ks)
+            ivs
+            (assoc
+              acc
+              k
+              (if
+                (= k "children")
+                (map block->data (get ivs k))
+                (get ivs k)))))))))
+
+(define block->data (fn (b) {:fields (content/-fd-loop (keys (get b :ivars)) (get b :ivars) {}) :id (blk-id b) :type (blk-type b)}))
+
+(define content/to-data (fn (doc) {:blocks (map block->data (doc-blocks doc)) :slug (doc-slug doc) :id (doc-id doc) :title (doc-title doc) :tags (doc-tags doc)}))
+
+;; ── from-data ──
+(define
+  content/-field-pairs
+  (fn (fields) (map (fn (k) (list k (get fields k))) (keys fields))))
+
+(define
+  data->block
+  (fn
+    (d)
+    (let
+      ((type (get d :type)) (id (get d :id)) (fields (get d :fields)))
+      (cond
+        ((= type "section")
+          (mk-section id (map data->block (get fields "children"))))
+        ((= type "table")
+          (mk-table id (get fields "headers") (get fields "rows")))
+        (else (mk-block type id (content/-field-pairs fields)))))))
+
+(define
+  content/-meta-of
+  (fn
+    (data)
+    (let
+      ((m1 (if (= (get data :title) nil) {} (assoc {} :title (get data :title)))))
+      (let
+        ((m2 (if (= (get data :slug) nil) m1 (assoc m1 :slug (get data :slug)))))
+        (let
+          ((tags (get data :tags)))
+          (if
+            (or (= tags nil) (= (len tags) 0))
+            m2
+            (assoc m2 :tags tags)))))))
+
+(define
+  content/from-data
+  (fn
+    (data)
+    (doc-with-meta
+      (doc-new (get data :id) (map data->block (get data :blocks)))
+      (content/-meta-of data))))

lib/content/doc.sx

@@ -0,0 +1,257 @@
+;; content-on-sx — ordered block document on Smalltalk-on-SX.
+;;
+;; A document (CtDoc) is a Smalltalk object holding an ordered sequence of block
+;; objects. Editing is a stream of ops (data dicts); doc-apply interprets one op
+;; and returns a NEW document — the input is never mutated, so any version is the
+;; head of an op stream (replay-friendly for persist + CRDT merge).
+;;
+;; By-id ops (update/delete) and by-id lookup (doc-find-deep/doc-has-deep?) are
+;; TREE-WIDE: they descend into any block carrying a `children` list (i.e.
+;; sections), since ids are unique across the tree. This keeps the persist
+;; op-log, content/edit and content/find correct for nested documents.
+;; insert/move are positional and act at the top level.
+;;
+;; CtDoc also carries optional metadata (title/slug/tags) — see meta.sx.
+;;
+;; Op shapes (data, not objects — they are the persist event payload):
+;;   {:op "insert" :block <blk> :after <id|nil>}   ; after nil = prepend (top level)
+;;   {:op "update" :id <id> :field <name> :value <v>}   ; tree-wide by id
+;;   {:op "move"   :id <id> :index <n>}                 ; top level
+;;   {:op "delete" :id <id>}                            ; tree-wide by id
+
+(define
+  content-bootstrap-doc!
+  (fn
+    ()
+    (begin
+      (st-class-define!
+        "CtDoc"
+        "Object"
+        (list "id" "blocks" "title" "slug" "tags"))
+      (ct-def-method! "CtDoc" "id" "id ^ id")
+      (ct-def-method! "CtDoc" "blocks" "blocks ^ blocks")
+      (ct-def-method! "CtDoc" "type" "type ^ #document")
+      (ct-def-method! "CtDoc" "title" "title ^ title")
+      (ct-def-method! "CtDoc" "slug" "slug ^ slug")
+      (ct-def-method! "CtDoc" "tags" "tags ^ tags")
+      true)))
+
+;; ── construction ──
+(define
+  doc-new
+  (fn
+    (id blocks)
+    (st-iv-set!
+      (st-iv-set! (st-make-instance "CtDoc") "id" id)
+      "blocks"
+      blocks)))
+
+(define doc-empty (fn (id) (doc-new id (list))))
+
+;; ── accessors (message dispatch) ──
+(define doc-id (fn (doc) (st-send doc "id" (list))))
+(define doc-type (fn (doc) (str (st-send doc "type" (list)))))
+(define doc-blocks (fn (doc) (st-send doc "blocks" (list))))
+(define doc-count (fn (doc) (len (doc-blocks doc))))
+(define doc-block-at (fn (doc i) (nth (doc-blocks doc) i)))
+
+(define doc? (fn (v) (and (st-instance? v) (= (get v :class) "CtDoc"))))
+
+;; ── list helpers over block sequences ──
+(define
+  ct-index-loop
+  (fn
+    (blocks id i)
+    (cond
+      ((= (len blocks) 0) -1)
+      ((= (blk-id (first blocks)) id) i)
+      (else (ct-index-loop (rest blocks) id (+ i 1))))))
+
+(define ct-index-of (fn (blocks id) (ct-index-loop blocks id 0)))
+
+(define
+  ct-insert-at
+  (fn
+    (blocks i x)
+    (cond
+      ((= i 0) (cons x blocks))
+      ((= (len blocks) 0) (list x))
+      (else
+        (cons
+          (first blocks)
+          (ct-insert-at (rest blocks) (- i 1) x))))))
+
+;; tree-wide remove by id: drop matches at this level, recurse into children
+;; (blocks carrying a `children` list, i.e. sections).
+(define
+  ct-remove-id
+  (fn
+    (blocks id)
+    (map
+      (fn
+        (b)
+        (let
+          ((ch (st-iv-get b "children")))
+          (if (list? ch) (st-iv-set! b "children" (ct-remove-id ch id)) b)))
+      (filter (fn (b) (if (= (blk-id b) id) false true)) blocks))))
+
+;; tree-wide replace by id: apply f to the match wherever it sits in the tree.
+(define
+  ct-replace-id
+  (fn
+    (blocks id f)
+    (map
+      (fn
+        (b)
+        (if
+          (= (blk-id b) id)
+          (f b)
+          (let
+            ((ch (st-iv-get b "children")))
+            (if
+              (list? ch)
+              (st-iv-set! b "children" (ct-replace-id ch id f))
+              b))))
+      blocks)))
+
+;; tree-wide find by id: first block matching id anywhere in the tree, or nil.
+;; Descends into any `children` list, mirroring ct-replace-id/ct-remove-id.
+(define
+  ct-find-id
+  (fn
+    (blocks id)
+    (if
+      (= (len blocks) 0)
+      nil
+      (let
+        ((b (first blocks)))
+        (if
+          (= (blk-id b) id)
+          b
+          (let
+            ((ch (st-iv-get b "children")))
+            (let
+              ((nested (if (list? ch) (ct-find-id ch id) nil)))
+              (if (= nested nil) (ct-find-id (rest blocks) id) nested))))))))
+
+;; ── query ──
+(define doc-index-of (fn (doc id) (ct-index-of (doc-blocks doc) id)))
+
+(define
+  doc-find
+  (fn
+    (doc id)
+    (let
+      ((hits (filter (fn (b) (= (blk-id b) id)) (doc-blocks doc))))
+      (if (= (len hits) 0) nil (first hits)))))
+
+(define
+  doc-has?
+  (fn (doc id) (if (= (doc-index-of doc id) -1) false true)))
+
+;; tree-wide lookup by id — reads a nested block by the same id content/edit can
+;; update/delete (no section.sx dependency; uses the generic children descent).
+(define doc-find-deep (fn (doc id) (ct-find-id (doc-blocks doc) id)))
+
+(define
+  doc-has-deep?
+  (fn (doc id) (if (= (doc-find-deep doc id) nil) false true)))
+
+;; ── structural edits (each returns a new document) ──
+(define doc-with-blocks (fn (doc blocks) (st-iv-set! doc "blocks" blocks)))
+
+(define
+  doc-append
+  (fn
+    (doc block)
+    (doc-with-blocks doc (append (doc-blocks doc) (list block)))))
+
+(define
+  doc-insert-at
+  (fn
+    (doc block i)
+    (doc-with-blocks doc (ct-insert-at (doc-blocks doc) i block))))
+
+(define
+  doc-insert-after
+  (fn
+    (doc block after-id)
+    (let
+      ((blocks (doc-blocks doc)))
+      (if
+        (= after-id nil)
+        (doc-with-blocks doc (cons block blocks))
+        (let
+          ((idx (ct-index-of blocks after-id)))
+          (if
+            (= idx -1)
+            (doc-with-blocks doc (append blocks (list block)))
+            (doc-with-blocks
+              doc
+              (ct-insert-at blocks (+ idx 1) block))))))))
+
+(define
+  doc-update
+  (fn
+    (doc id field value)
+    (doc-with-blocks
+      doc
+      (ct-replace-id (doc-blocks doc) id (fn (b) (blk-set b field value))))))
+
+(define
+  doc-delete
+  (fn (doc id) (doc-with-blocks doc (ct-remove-id (doc-blocks doc) id))))
+
+(define
+  doc-move
+  (fn
+    (doc id i)
+    (let
+      ((blk (doc-find doc id)))
+      (if
+        (= blk nil)
+        doc
+        (doc-with-blocks
+          doc
+          (ct-insert-at (ct-remove-id (doc-blocks doc) id) i blk))))))
+
+;; ── op constructors (data payload, reused by persist op log) ──
+(define op-insert (fn (block after) {:after after :op "insert" :block block}))
+
+(define op-update (fn (id field value) {:field field :id id :op "update" :value value}))
+
+(define op-move (fn (id index) {:id id :op "move" :index index}))
+
+(define op-delete (fn (id) {:id id :op "delete"}))
+
+;; ── op interpreter ──
+(define
+  doc-apply
+  (fn
+    (doc op)
+    (let
+      ((kind (get op :op)))
+      (cond
+        ((= kind "insert")
+          (doc-insert-after doc (get op :block) (get op :after)))
+        ((= kind "update")
+          (doc-update doc (get op :id) (get op :field) (get op :value)))
+        ((= kind "move") (doc-move doc (get op :id) (get op :index)))
+        ((= kind "delete") (doc-delete doc (get op :id)))
+        (else (error (str "unknown op: " kind)))))))
+
+(define
+  doc-apply-all
+  (fn
+    (doc ops)
+    (if
+      (= (len ops) 0)
+      doc
+      (doc-apply-all (doc-apply doc (first ops)) (rest ops)))))
+
+;; ── render-agnostic snapshot: list of (id . type) for assertions/debug ──
+(define doc-ids (fn (doc) (map (fn (b) (blk-id b)) (doc-blocks doc))))
+
+(define
+  doc-types
+  (fn (doc) (map (fn (b) (blk-type b)) (doc-blocks doc))))

lib/content/fed.sx

@@ -0,0 +1,68 @@
+;; content-on-sx — federated documents: trust-gated peer-authored ops.
+;;
+;; A peer-authored op carries provenance (:author, and a :sig stub). We never
+;; auto-accept: a peer op is applied only if it passes a trust gate. The gate is
+;; a predicate (fn op -> bool) so acl-on-sx can inject real trust facts later;
+;; the convenience form takes an explicit trusted-actor list (the stub).
+;;
+;; Accepted ops flow through the CvRDT merge (Phase 3), so concurrent local and
+;; external edits reconcile deterministically (same-field LWW, order-independent).
+;;
+;; Requires (loaded by harness): crdt.sx (and its deps).
+
+;; tag an op with provenance
+(define content/authored (fn (op author) (assoc op :author author)))
+
+(define
+  content/signed
+  (fn (op author sig) (assoc (assoc op :author author) :sig sig)))
+
+;; explicit trust stub: membership in a trusted-actor list
+(define content/trusted? (fn (trust author) (crdt-member? author trust)))
+
+;; general form: accept? is a predicate (fn op -> bool). Applies accepted ops
+;; through the CRDT; quarantines the rest. Returns
+;; {:state :accepted (ops) :rejected (ops)}.
+(define
+  content/-merge-peer-loop
+  (fn
+    (state accept? ops accepted rejected)
+    (if
+      (= (len ops) 0)
+      {:state state :accepted (reverse accepted) :rejected (reverse rejected)}
+      (let
+        ((op (first ops)))
+        (if
+          (accept? op)
+          (content/-merge-peer-loop
+            (crdt-apply state op)
+            accept?
+            (rest ops)
+            (cons op accepted)
+            rejected)
+          (content/-merge-peer-loop
+            state
+            accept?
+            (rest ops)
+            accepted
+            (cons op rejected)))))))
+
+(define
+  content/merge-peer-with
+  (fn
+    (state accept? ops)
+    (content/-merge-peer-loop state accept? ops (list) (list))))
+
+;; convenience: trust = list of trusted actor ids
+(define
+  content/merge-peer
+  (fn
+    (state trust ops)
+    (content/merge-peer-with
+      state
+      (fn (op) (content/trusted? trust (get op :author)))
+      ops)))
+
+(define content/accepted (fn (res) (get res :accepted)))
+(define content/rejected (fn (res) (get res :rejected)))
+(define content/peer-state (fn (res) (get res :state)))

lib/content/find-replace.sx

@@ -0,0 +1,75 @@
+;; content-on-sx — global find/replace across every text-bearing field.
+;;
+;; Replaces every occurrence of `from` with `to` in the text-bearing fields of
+;; a document, tree-wide (via the transform layer):
+;;   - the `text` of text / heading / code / quote / callout blocks
+;;   - the `alt` of image blocks
+;;   - each item of list blocks
+;;   - every header and cell of table blocks
+;; This is exactly the set asText / stats / summary draw prose from, so a rename
+;; via content/find-replace and a word count over asText stay consistent.
+;; Immutable; case-sensitive.
+;;
+;; Requires (loaded by harness): block.sx, transform.sx (content/map-blocks),
+;; table.sx (CtTable ivars).
+
+(define
+  fr-in?
+  (fn
+    (x xs)
+    (cond
+      ((= (len xs) 0) false)
+      ((= (first xs) x) true)
+      (else (fr-in? x (rest xs))))))
+
+(define fr-rep (fn (s from to) (replace (str s) from to)))
+
+;; Blocks whose prose content find/replace rewrites (matches asText's set).
+(define
+  fr-has-text?
+  (fn
+    (b)
+    (fr-in?
+      (blk-type b)
+      (list "text" "heading" "code" "quote" "callout" "image" "list" "table"))))
+
+;; Per-type field rewrite. Each branch returns a new (copy-on-write) block.
+(define
+  fr-rewrite
+  (fn
+    (b from to)
+    (let
+      ((t (blk-type b)))
+      (cond
+        ((= t "image")
+          (blk-set b "alt" (fr-rep (blk-get b "alt") from to)))
+        ((= t "list")
+          (let
+            ((items (blk-get b "items")))
+            (if
+              (list? items)
+              (blk-set b "items" (map (fn (it) (fr-rep it from to)) items))
+              b)))
+        ((= t "table")
+          (let
+            ((hs (blk-get b "headers")) (rs (blk-get b "rows")))
+            (let
+              ((b1 (if (list? hs) (blk-set b "headers" (map (fn (h) (fr-rep h from to)) hs)) b)))
+              (if
+                (list? rs)
+                (blk-set
+                  b1
+                  "rows"
+                  (map
+                    (fn
+                      (r)
+                      (if (list? r) (map (fn (c) (fr-rep c from to)) r) r))
+                    rs))
+                b1))))
+        (else (blk-set b "text" (fr-rep (blk-get b "text") from to)))))))
+
+(define
+  content/find-replace
+  (fn
+    (doc from to)
+    (content/map-blocks doc fr-has-text? (fn (b) (fr-rewrite b from to)))))

lib/content/flatten.sx

@@ -0,0 +1,34 @@
+;; content-on-sx — document flatten.
+;;
+;; Un-nests a sectioned document into a flat block sequence: each section is
+;; replaced inline by its (recursively flattened) children, dropping the section
+;; wrapper. The inverse of content/wrap-section, for flat export targets.
+;; Immutable; inline tree handling (no section.sx dep).
+;;
+;; Requires (loaded by harness): block.sx, doc.sx.
+
+(define
+  flat-section?
+  (fn (b) (and (st-instance? b) (= (get b :class) "CtSection"))))
+
+(define
+  flat-blocks
+  (fn
+    (blocks)
+    (if
+      (= (len blocks) 0)
+      (list)
+      (let
+        ((b (first blocks)))
+        (append
+          (if
+            (flat-section? b)
+            (let
+              ((ch (st-iv-get b "children")))
+              (if (list? ch) (flat-blocks ch) (list)))
+            (list b))
+          (flat-blocks (rest blocks)))))))
+
+(define
+  content/flatten
+  (fn (doc) (doc-with-blocks doc (flat-blocks (doc-blocks doc)))))

lib/content/index.sx

@@ -0,0 +1,51 @@
+;; content-on-sx — multi-document index.
+;;
+;; Projects a list of documents into summary cards (the blog index page), with
+;; tag filtering (category pages) and a tag cloud. Composes content/summary +
+;; doc metadata.
+;;
+;; Requires (loaded by harness): summary.sx (content/summary), meta.sx (doc-tags).
+
+(define
+  idx-in?
+  (fn
+    (x xs)
+    (cond
+      ((= (len xs) 0) false)
+      ((= (first xs) x) true)
+      (else (idx-in? x (rest xs))))))
+
+(define
+  idx-dedup
+  (fn
+    (xs seen)
+    (if
+      (= (len xs) 0)
+      (reverse seen)
+      (if
+        (idx-in? (first xs) seen)
+        (idx-dedup (rest xs) seen)
+        (idx-dedup (rest xs) (cons (first xs) seen))))))
+
+(define content/index (fn (docs) (map content/summary docs)))
+
+(define content/has-tag? (fn (doc tag) (idx-in? tag (doc-tags doc))))
+
+(define
+  content/index-by-tag
+  (fn
+    (docs tag)
+    (map content/summary (filter (fn (d) (content/has-tag? d tag)) docs))))
+
+(define
+  content/all-tags
+  (fn (docs) (idx-dedup (ct-flatmap-tags docs) (list))))
+
+(define
+  ct-flatmap-tags
+  (fn
+    (docs)
+    (if
+      (= (len docs) 0)
+      (list)
+      (append (doc-tags (first docs)) (ct-flatmap-tags (rest docs))))))

lib/content/markdown.sx

@@ -0,0 +1,55 @@
+;; content-on-sx — Markdown render mode.
+;;
+;; A third boundary format alongside asHTML / asSx, via the same polymorphic
+;; dispatch. The newline is supplied by the boundary as a keyword arg
+;; (asMarkdown: nl) because this Smalltalk dialect has no Character newline
+;; constructor — blocks that need internal newlines (code, lists, doc) use it.
+;;
+;; No Markdown escaping yet (Markdown's escaping rules differ from HTML); raw
+;; text is emitted. Ordered lists emit "1." for every item (Markdown renumbers).
+;;
+;; Requires (loaded by harness): block.sx, doc.sx.
+
+(define
+  content-bootstrap-markdown!
+  (fn
+    ()
+    (begin
+      (ct-def-method!
+        "CtHeading"
+        "asMarkdown:"
+        "asMarkdown: nl | h i | h := ''. i := 0. [i < level] whileTrue: [h := h , '#'. i := i + 1]. ^ h , ' ' , text")
+      (ct-def-method! "CtText" "asMarkdown:" "asMarkdown: nl ^ text")
+      (ct-def-method!
+        "CtCode"
+        "asMarkdown:"
+        "asMarkdown: nl ^ '```' , language , nl , text , nl , '```'")
+      (ct-def-method! "CtQuote" "asMarkdown:" "asMarkdown: nl ^ '> ' , text")
+      (ct-def-method!
+        "CtImage"
+        "asMarkdown:"
+        "asMarkdown: nl ^ '![' , alt , '](' , src , ')'")
+      (ct-def-method!
+        "CtEmbed"
+        "asMarkdown:"
+        "asMarkdown: nl ^ '[embed](' , url , ')'")
+      (ct-def-method! "CtDivider" "asMarkdown:" "asMarkdown: nl ^ '---'")
+      (ct-def-method!
+        "CtList"
+        "asMarkdown:"
+        "asMarkdown: nl | mark | mark := ordered ifTrue: ['1. '] ifFalse: ['- ']. ^ (items inject: '' into: [:a :x | a , (a = '' ifTrue: [''] ifFalse: [nl]) , mark , x])")
+      (ct-def-method!
+        "CtDoc"
+        "asMarkdown:"
+        "asMarkdown: nl ^ (blocks inject: '' into: [:a :b | a , (a = '' ifTrue: [''] ifFalse: [nl , nl]) , (b asMarkdown: nl)])")
+      true)))
+
+(define ct-nl (str "\n"))
+
+;; ── SX boundary ──
+(define
+  asMarkdown
+  (fn (node) (str (st-send node "asMarkdown:" (list ct-nl)))))
+(define content/markdown asMarkdown)
+(define render-markdown asMarkdown)
+(define block-markdown asMarkdown)

lib/content/md-doc.sx

@@ -0,0 +1,63 @@
+;; content-on-sx — Markdown document export (frontmatter + body).
+;;
+;; content/markdown-doc emits a YAML-ish --- frontmatter block from the document
+;; metadata (title/slug/tags) followed by the Markdown body, completing the
+;; metadata round-trip with md/import (md/import ∘ content/markdown-doc keeps
+;; title/slug/tags). With no metadata it is just asMarkdown.
+;;
+;; Requires (loaded by harness): doc.sx, meta.sx (doc-title/slug/tags),
+;; markdown.sx (asMarkdown).
+
+(define mdd-nl (str "\n"))
+
+(define
+  mdd-join
+  (fn
+    (sep parts)
+    (cond
+      ((= (len parts) 0) "")
+      ((= (len parts) 1) (first parts))
+      (else (str (first parts) sep (mdd-join sep (rest parts)))))))
+
+(define
+  content/-fm-parts
+  (fn
+    (doc)
+    (append
+      (append
+        (if
+          (= (doc-title doc) nil)
+          (list)
+          (list (str "title: " (doc-title doc))))
+        (if
+          (= (doc-slug doc) nil)
+          (list)
+          (list (str "slug: " (doc-slug doc)))))
+      (let
+        ((tags (doc-tags doc)))
+        (if
+          (= (len tags) 0)
+          (list)
+          (list (str "tags: " (mdd-join ", " tags))))))))
+
+(define
+  content/-frontmatter
+  (fn
+    (doc)
+    (let
+      ((parts (content/-fm-parts doc)))
+      (if
+        (= (len parts) 0)
+        ""
+        (str "---" mdd-nl (mdd-join mdd-nl parts) mdd-nl "---")))))
+
+(define
+  content/markdown-doc
+  (fn
+    (doc)
+    (let
+      ((fm (content/-frontmatter doc)))
+      (if
+        (= fm "")
+        (asMarkdown doc)
+        (str fm mdd-nl mdd-nl (asMarkdown doc))))))

lib/content/md-import.sx

@@ -0,0 +1,449 @@
+;; content-on-sx — Markdown import adapter (markdown text -> block document).
+;;
+;; A line-based parser, the inverse of markdown.sx's asMarkdown. Confined to the
+;; adapter boundary: the core knows nothing about Markdown. Handles a leading
+;; --- frontmatter block (key: value -> doc metadata), ATX headings (#..######),
+;; fenced code (```lang), blockquotes (> ), unordered (- / * ) and ordered (1. )
+;; lists, thematic breaks (--- / ***), pipe tables (header + --- separator +
+;; body), and paragraphs (consecutive plain lines joined with a space). Block ids
+;; are assigned sequentially b0,b1…
+;;
+;; Requires (loaded by harness): block.sx, doc.sx, table.sx (mk-table),
+;; meta.sx (doc-with-meta); markdown.sx for the adapter's export side.
+
+(define md/-id (fn (i) (str "b" i)))
+(define md/-blank? (fn (s) (= s "")))
+(define md/-hr? (fn (s) (if (= s "---") true (= s "***"))))
+
+(define
+  ct-in?
+  (fn
+    (x xs)
+    (cond
+      ((= (len xs) 0) false)
+      ((= (first xs) x) true)
+      (else (ct-in? x (rest xs))))))
+
+(define
+  ct-starts-with?
+  (fn
+    (s prefix)
+    (and
+      (>= (string-length s) (string-length prefix))
+      (= (substring s 0 (string-length prefix)) prefix))))
+
+(define
+  md/-drop
+  (fn (s prefix) (substring s (string-length prefix) (string-length s))))
+
+(define
+  md/-drop-n
+  (fn
+    (xs n)
+    (if
+      (= n 0)
+      xs
+      (if
+        (= (len xs) 0)
+        xs
+        (md/-drop-n (rest xs) (- n 1))))))
+
+(define
+  md/-join-with
+  (fn
+    (sep parts)
+    (cond
+      ((= (len parts) 0) "")
+      ((= (len parts) 1) (first parts))
+      (else (str (first parts) sep (md/-join-with sep (rest parts)))))))
+(define md/-join-sp (fn (parts) (md/-join-with " " parts)))
+(define md/-join-nl (fn (parts) (md/-join-with (str "\n") parts)))
+
+;; ── heading detection (leading #s then a space) ──
+(define
+  md/-hashes
+  (fn
+    (s n)
+    (if
+      (and
+        (< n (string-length s))
+        (= (substring s n (+ n 1)) "#"))
+      (md/-hashes s (+ n 1))
+      n)))
+(define
+  md/-heading?
+  (fn
+    (line)
+    (let
+      ((n (md/-hashes line 0)))
+      (and
+        (> n 0)
+        (<= n 6)
+        (> (string-length line) n)
+        (= (substring line n (+ n 1)) " ")))))
+(define
+  md/-heading-block
+  (fn
+    (line i)
+    (let
+      ((n (md/-hashes line 0)))
+      (mk-heading
+        (md/-id i)
+        n
+        (substring line (+ n 1) (string-length line))))))
+
+;; ── list detection ──
+(define
+  ct-digit?
+  (fn (ch) (ct-in? ch (list "0" "1" "2" "3" "4" "5" "6" "7" "8" "9"))))
+(define
+  md/-digits
+  (fn
+    (s n)
+    (if
+      (and
+        (< n (string-length s))
+        (ct-digit? (substring s n (+ n 1))))
+      (md/-digits s (+ n 1))
+      n)))
+(define
+  md/-ol?
+  (fn
+    (line)
+    (let
+      ((n (md/-digits line 0)))
+      (and
+        (> n 0)
+        (>= (string-length line) (+ n 2))
+        (= (substring line n (+ n 2)) ". ")))))
+(define
+  md/-drop-ol
+  (fn
+    (line)
+    (let
+      ((n (md/-digits line 0)))
+      (substring line (+ n 2) (string-length line)))))
+(define
+  md/-ul?
+  (fn
+    (line)
+    (if (ct-starts-with? line "- ") true (ct-starts-with? line "* "))))
+(define
+  md/-drop-ul
+  (fn (line) (substring line 2 (string-length line))))
+
+;; ── table detection ──
+(define md/-pipe-row? (fn (line) (ct-starts-with? (trim line) "|")))
+(define md/-sep-char? (fn (ch) (ct-in? ch (list "-" ":" "|" " "))))
+(define
+  md/-all-sep?
+  (fn
+    (s i)
+    (if
+      (>= i (string-length s))
+      true
+      (if
+        (md/-sep-char? (substring s i (+ i 1)))
+        (md/-all-sep? s (+ i 1))
+        false))))
+(define
+  md/-has-dash?
+  (fn
+    (s i)
+    (if
+      (>= i (string-length s))
+      false
+      (if
+        (= (substring s i (+ i 1)) "-")
+        true
+        (md/-has-dash? s (+ i 1))))))
+(define
+  md/-sep-row?
+  (fn
+    (line)
+    (and
+      (md/-pipe-row? line)
+      (md/-all-sep? (trim line) 0)
+      (md/-has-dash? line 0))))
+(define
+  md/-table-start?
+  (fn
+    (lines)
+    (and
+      (md/-pipe-row? (first lines))
+      (> (len lines) 1)
+      (md/-sep-row? (nth lines 1)))))
+(define
+  md/-strip-pipes
+  (fn
+    (s0)
+    (let
+      ((s (trim s0)))
+      (let
+        ((a (if (ct-starts-with? s "|") (substring s 1 (string-length s)) s)))
+        (if
+          (and
+            (> (string-length a) 0)
+            (=
+              (substring
+                a
+                (- (string-length a) 1)
+                (string-length a))
+              "|"))
+          (substring a 0 (- (string-length a) 1))
+          a)))))
+(define
+  md/-cells
+  (fn (line) (map (fn (c) (trim c)) (split (md/-strip-pipes line) "|"))))
+
+(define
+  md/-plain?
+  (fn
+    (line)
+    (if
+      (md/-blank? line)
+      false
+      (if
+        (ct-starts-with? line "```")
+        false
+        (if
+          (md/-heading? line)
+          false
+          (if
+            (ct-starts-with? line "> ")
+            false
+            (if
+              (md/-hr? line)
+              false
+              (if (md/-ul? line) false (if (md/-ol? line) false true)))))))))
+
+;; ── multi-line collectors ──
+(define
+  md/-code
+  (fn
+    (lines i acc)
+    (md/-code-collect
+      (rest lines)
+      (md/-drop (first lines) "```")
+      (list)
+      i
+      acc)))
+(define
+  md/-code-collect
+  (fn
+    (lines lang body i acc)
+    (cond
+      ((= (len lines) 0)
+        (md/-walk
+          lines
+          (+ i 1)
+          (cons (mk-code (md/-id i) lang (md/-join-nl (reverse body))) acc)))
+      ((= (first lines) "```")
+        (md/-walk
+          (rest lines)
+          (+ i 1)
+          (cons (mk-code (md/-id i) lang (md/-join-nl (reverse body))) acc)))
+      (else
+        (md/-code-collect (rest lines) lang (cons (first lines) body) i acc)))))
+
+(define
+  md/-table-body
+  (fn
+    (lines headers rows i acc)
+    (if
+      (= (len lines) 0)
+      (md/-walk
+        lines
+        (+ i 1)
+        (cons (mk-table (md/-id i) headers (reverse rows)) acc))
+      (let
+        ((line (first lines)))
+        (if
+          (md/-pipe-row? line)
+          (md/-table-body
+            (rest lines)
+            headers
+            (cons (md/-cells line) rows)
+            i
+            acc)
+          (md/-walk
+            lines
+            (+ i 1)
+            (cons (mk-table (md/-id i) headers (reverse rows)) acc)))))))
+(define
+  md/-table
+  (fn
+    (lines i acc)
+    (md/-table-body
+      (rest (rest lines))
+      (md/-cells (first lines))
+      (list)
+      i
+      acc)))
+
+(define
+  md/-list-collect
+  (fn
+    (lines items i acc ordered)
+    (if
+      (= (len lines) 0)
+      (md/-walk
+        lines
+        (+ i 1)
+        (cons (mk-list (md/-id i) ordered (reverse items)) acc))
+      (let
+        ((line (first lines)))
+        (cond
+          (ordered
+            (if
+              (md/-ol? line)
+              (md/-list-collect
+                (rest lines)
+                (cons (md/-drop-ol line) items)
+                i
+                acc
+                ordered)
+              (md/-walk
+                lines
+                (+ i 1)
+                (cons (mk-list (md/-id i) ordered (reverse items)) acc))))
+          (else
+            (if
+              (md/-ul? line)
+              (md/-list-collect
+                (rest lines)
+                (cons (md/-drop-ul line) items)
+                i
+                acc
+                ordered)
+              (md/-walk
+                lines
+                (+ i 1)
+                (cons (mk-list (md/-id i) ordered (reverse items)) acc)))))))))
+
+(define
+  md/-para-collect
+  (fn
+    (lines parts i acc)
+    (if
+      (= (len lines) 0)
+      (md/-walk
+        lines
+        (+ i 1)
+        (cons (mk-text (md/-id i) (md/-join-sp (reverse parts))) acc))
+      (let
+        ((line (first lines)))
+        (if
+          (md/-plain? line)
+          (md/-para-collect (rest lines) (cons line parts) i acc)
+          (md/-walk
+            lines
+            (+ i 1)
+            (cons (mk-text (md/-id i) (md/-join-sp (reverse parts))) acc)))))))
+
+;; ── main walk ──
+(define
+  md/-walk
+  (fn
+    (lines i acc)
+    (if
+      (= (len lines) 0)
+      (reverse acc)
+      (let
+        ((line (first lines)))
+        (cond
+          ((md/-blank? line) (md/-walk (rest lines) i acc))
+          ((ct-starts-with? line "```") (md/-code lines i acc))
+          ((md/-heading? line)
+            (md/-walk
+              (rest lines)
+              (+ i 1)
+              (cons (md/-heading-block line i) acc)))
+          ((ct-starts-with? line "> ")
+            (md/-walk
+              (rest lines)
+              (+ i 1)
+              (cons (mk-quote (md/-id i) "" (md/-drop line "> ")) acc)))
+          ((md/-hr? line)
+            (md/-walk
+              (rest lines)
+              (+ i 1)
+              (cons (mk-divider (md/-id i)) acc)))
+          ((md/-table-start? lines) (md/-table lines i acc))
+          ((md/-ul? line) (md/-list-collect lines (list) i acc false))
+          ((md/-ol? line) (md/-list-collect lines (list) i acc true))
+          (else (md/-para-collect lines (list) i acc)))))))
+
+(define
+  md/parse
+  (fn (text) (md/-walk (split text (str "\n")) 0 (list))))
+
+;; ── frontmatter (leading --- key: value --- block) ──
+(define
+  md/-frontmatter?
+  (fn (lines) (and (> (len lines) 0) (= (first lines) "---"))))
+(define
+  md/-fm-end
+  (fn
+    (lines i)
+    (cond
+      ((>= i (len lines)) -1)
+      ((= (nth lines i) "---") i)
+      (else (md/-fm-end lines (+ i 1))))))
+(define
+  md/-fm-add
+  (fn
+    (acc line)
+    (let
+      ((parts (split line ":")))
+      (if
+        (< (len parts) 2)
+        acc
+        (let
+          ((key (trim (first parts)))
+            (val (trim (md/-join-with ":" (rest parts)))))
+          (cond
+            ((= key "title") (assoc acc :title val))
+            ((= key "slug") (assoc acc :slug val))
+            ((= key "tags")
+              (assoc acc :tags (map (fn (t) (trim t)) (split val ","))))
+            (else acc)))))))
+(define
+  md/-fm-pairs
+  (fn
+    (lines start end acc)
+    (if
+      (>= start end)
+      acc
+      (md/-fm-pairs
+        lines
+        (+ start 1)
+        end
+        (md/-fm-add acc (nth lines start))))))
+
+;; ── adapter ──
+(define
+  md/import
+  (fn
+    (text doc-id)
+    (let
+      ((lines (split text (str "\n"))))
+      (if
+        (md/-frontmatter? lines)
+        (let
+          ((end (md/-fm-end lines 1)))
+          (if
+            (= end -1)
+            (doc-new doc-id (md/-walk lines 0 (list)))
+            (doc-with-meta
+              (doc-new
+                doc-id
+                (md/-walk
+                  (md/-drop-n lines (+ end 1))
+                  0
+                  (list)))
+              (md/-fm-pairs lines 1 end {}))))
+        (doc-new doc-id (md/-walk lines 0 (list)))))))
+
+(define content/from-markdown md/import)
+(define markdown-adapter {:export (fn (doc) (asMarkdown doc)) :import md/import})

lib/content/media.sx

@@ -0,0 +1,52 @@
+;; content-on-sx — video/audio media block.
+;;
+;; CtMedia holds a `kind` (video/audio) and `src`. Self-contained: answers
+;; asHTML/asSx/asText/asMarkdown: so it composes with the render boundary with no
+;; changes elsewhere. HTML src is htmlEscaped, SX src sxEscaped.
+;;
+;; Requires (loaded by harness): block.sx, doc.sx, render.sx (escapers);
+;; markdown.sx / text.sx for those formats.
+
+(define
+  content-bootstrap-media!
+  (fn
+    ()
+    (begin
+      (st-class-define! "CtMedia" "CtBlock" (list "kind" "src"))
+      (ct-def-method! "CtMedia" "kind" "kind ^ kind")
+      (ct-def-method! "CtMedia" "src" "src ^ src")
+      (ct-def-method! "CtMedia" "type" "type ^ #media")
+      (ct-def-method!
+        "CtMedia"
+        "asHTML"
+        "asHTML ^ '<' , kind , ' src=\"' , src htmlEscaped , '\" controls></' , kind , '>'")
+      (ct-def-method!
+        "CtMedia"
+        "asSx"
+        "asSx ^ '(' , kind , ' :src \"' , src sxEscaped , '\")'")
+      (ct-def-method! "CtMedia" "asText" "asText ^ ''")
+      (ct-def-method!
+        "CtMedia"
+        "asMarkdown:"
+        "asMarkdown: nl ^ '[' , kind , '](' , src , ')'")
+      true)))
+
+(define
+  mk-media
+  (fn
+    (id kind src)
+    (st-iv-set!
+      (st-iv-set!
+        (st-iv-set! (st-make-instance "CtMedia") "id" id)
+        "kind"
+        kind)
+      "src"
+      src)))
+
+(define
+  media?
+  (fn (b) (and (st-instance? b) (= (get b :class) "CtMedia"))))
+(define media-kind (fn (b) (st-send b "kind" (list))))
+
+(define mk-video (fn (id src) (mk-media id "video" src)))
+(define mk-audio (fn (id src) (mk-media id "audio" src)))

lib/content/meta.sx

@@ -0,0 +1,53 @@
+;; content-on-sx — document metadata (title / slug / tags).
+;;
+;; CtDoc carries optional metadata alongside its blocks (ivars declared in
+;; doc.sx). Reads go through message dispatch; setters are copy-on-write
+;; (functional st-iv-set!), consistent with the immutable document model.
+;;
+;; Requires (loaded by harness): block.sx, doc.sx.
+
+;; ── reads ──
+(define doc-title (fn (doc) (st-send doc "title" (list))))
+(define doc-slug (fn (doc) (st-send doc "slug" (list))))
+(define
+  doc-tags
+  (fn
+    (doc)
+    (let ((t (st-send doc "tags" (list)))) (if (= t nil) (list) t))))
+
+(define doc-meta (fn (doc) {:slug (doc-slug doc) :id (doc-id doc) :title (doc-title doc) :tags (doc-tags doc)}))
+
+;; ── copy-on-write setters ──
+(define doc-with-title (fn (doc title) (st-iv-set! doc "title" title)))
+(define doc-with-slug (fn (doc slug) (st-iv-set! doc "slug" slug)))
+(define doc-with-tags (fn (doc tags) (st-iv-set! doc "tags" tags)))
+
+(define
+  doc-add-tag
+  (fn (doc tag) (doc-with-tags doc (append (doc-tags doc) (list tag)))))
+
+;; set several at once: meta is a dict with optional :title :slug :tags
+(define
+  doc-with-meta
+  (fn
+    (doc meta)
+    (let
+      ((d1 (if (has-key? meta :title) (doc-with-title doc (get meta :title)) doc)))
+      (let
+        ((d2 (if (has-key? meta :slug) (doc-with-slug d1 (get meta :slug)) d1)))
+        (if (has-key? meta :tags) (doc-with-tags d2 (get meta :tags)) d2)))))
+
+;; constructor with metadata
+(define
+  doc-new-meta
+  (fn (id blocks meta) (doc-with-meta (doc-new id blocks) meta)))
+
+;; ── content/* facade aliases ──
+(define content/title doc-title)
+(define content/slug doc-slug)
+(define content/tags doc-tags)
+(define content/meta doc-meta)
+(define content/with-title doc-with-title)
+(define content/with-slug doc-with-slug)
+(define content/with-tags doc-with-tags)
+(define content/with-meta doc-with-meta)

lib/content/move.sx

@@ -0,0 +1,69 @@
+;; content-on-sx — relative block reorder.
+;;
+;; Move a top-level block to just before / after another block by id — more
+;; ergonomic than the index-based doc-move. No-op if either id is missing.
+;; Immutable; composes the doc.sx list helpers.
+;;
+;; Requires (loaded by harness): doc.sx.
+
+(define
+  content/move-before
+  (fn
+    (doc id target)
+    (let
+      ((blk (doc-find doc id)))
+      (if
+        (= blk nil)
+        doc
+        (let
+          ((without (ct-remove-id (doc-blocks doc) id)))
+          (let
+            ((idx (ct-index-of without target)))
+            (if
+              (= idx -1)
+              doc
+              (doc-with-blocks doc (ct-insert-at without idx blk)))))))))
+
+(define
+  content/move-after
+  (fn
+    (doc id target)
+    (let
+      ((blk (doc-find doc id)))
+      (if
+        (= blk nil)
+        doc
+        (let
+          ((without (ct-remove-id (doc-blocks doc) id)))
+          (let
+            ((idx (ct-index-of without target)))
+            (if
+              (= idx -1)
+              doc
+              (doc-with-blocks
+                doc
+                (ct-insert-at without (+ idx 1) blk)))))))))
+
+(define
+  content/move-to-front
+  (fn
+    (doc id)
+    (let
+      ((blk (doc-find doc id)))
+      (if
+        (= blk nil)
+        doc
+        (doc-with-blocks doc (cons blk (ct-remove-id (doc-blocks doc) id)))))))
+
+(define
+  content/move-to-back
+  (fn
+    (doc id)
+    (let
+      ((blk (doc-find doc id)))
+      (if
+        (= blk nil)
+        doc
+        (doc-with-blocks
+          doc
+          (append (ct-remove-id (doc-blocks doc) id) (list blk)))))))

lib/content/normalize.sx

@@ -0,0 +1,49 @@
+;; content-on-sx — document normalization.
+;;
+;; A cleanup pass: drop empty text blocks and empty sections across the tree.
+;; Sections are normalised first, so a section that becomes empty (all children
+;; dropped) is itself dropped. For tidying imported/edited documents. Immutable.
+;; Inline tree handling (no section.sx dep).
+;;
+;; Requires (loaded by harness): block.sx, doc.sx.
+
+(define
+  norm-section?
+  (fn (b) (and (st-instance? b) (= (get b :class) "CtSection"))))
+(define
+  norm-empty-text?
+  (fn (b) (and (= (blk-type b) "text") (= (str (blk-get b "text")) ""))))
+(define
+  norm-empty-section?
+  (fn
+    (b)
+    (and
+      (norm-section? b)
+      (let
+        ((ch (st-iv-get b "children")))
+        (or (= ch nil) (= (len ch) 0))))))
+
+(define
+  norm-recurse
+  (fn
+    (b)
+    (if
+      (norm-section? b)
+      (let
+        ((ch (st-iv-get b "children")))
+        (if (list? ch) (st-iv-set! b "children" (norm-blocks ch)) b))
+      b)))
+
+(define
+  norm-keep?
+  (fn
+    (b)
+    (if (norm-empty-text? b) false (if (norm-empty-section? b) false true))))
+
+(define
+  norm-blocks
+  (fn (blocks) (filter norm-keep? (map norm-recurse blocks))))
+
+(define
+  content/normalize
+  (fn (doc) (doc-with-blocks doc (norm-blocks (doc-blocks doc)))))

lib/content/outline.sx

@@ -0,0 +1,34 @@
+;; content-on-sx — nested document outline.
+;;
+;; Builds a hierarchical heading tree from content/headings: each node is
+;; {:id :text :level :children}, where a heading nests under the nearest
+;; preceding heading of a lower level. The structured companion to the flat TOC,
+;; for rendering nested navigation.
+;;
+;; Requires (loaded by harness): query.sx (content/headings).
+
+;; consume a prefix of `hs` forming nodes whose level > minlevel; return
+;; {:nodes ... :rest ...}.
+(define
+  ol-forest
+  (fn
+    (hs minlevel)
+    (if
+      (= (len hs) 0)
+      {:rest (list) :nodes (list)}
+      (let
+        ((h (first hs)))
+        (if
+          (<= (get h :level) minlevel)
+          {:rest hs :nodes (list)}
+          (let
+            ((sub (ol-forest (rest hs) (get h :level))))
+            (let
+              ((node {:id (get h :id) :text (get h :text) :children (get sub :nodes) :level (get h :level)}))
+              (let
+                ((more (ol-forest (get sub :rest) minlevel)))
+                {:rest (get more :rest) :nodes (cons node (get more :nodes))}))))))))
+
+(define
+  content/outline
+  (fn (doc) (get (ol-forest (content/headings doc) 0) :nodes)))

lib/content/page-full.sx

@@ -0,0 +1,23 @@
+;; content-on-sx — SEO-complete HTML page.
+;;
+;; content/page-full extends content/page with a lang attribute and a
+;; <meta name="description"> drawn from the document excerpt (plain text,
+;; truncated). Composes the page, metadata and text layers.
+;;
+;; Requires (loaded by harness): page.sx (ct-html-escape, content/page-title),
+;; text.sx (content/excerpt), render.sx (asHTML).
+
+(define CONTENT-EXCERPT-LEN 160)
+
+(define
+  content/page-full
+  (fn
+    (doc)
+    (str
+      "<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\"><title>"
+      (ct-html-escape (content/page-title doc))
+      "</title><meta name=\"description\" content=\""
+      (ct-html-escape (content/excerpt doc CONTENT-EXCERPT-LEN))
+      "\"></head><body>"
+      (asHTML doc)
+      "</body></html>")))

lib/content/page.sx

@@ -0,0 +1,26 @@
+;; content-on-sx — full HTML page wrapper.
+;;
+;; content/page composes the metadata + render layers into the shippable
+;; artifact the blog serves: a minimal valid HTML5 document with an escaped
+;; <title> (from doc metadata, falling back to the id) and the rendered blocks
+;; as the body.
+;;
+;; Requires (loaded by harness): doc.sx, render.sx (asHTML + htmlEscaped),
+;; meta.sx (doc-title).
+
+(define ct-html-escape (fn (s) (str (st-send s "htmlEscaped" (list)))))
+
+(define
+  content/page-title
+  (fn (doc) (let ((t (doc-title doc))) (if (= t nil) (doc-id doc) t))))
+
+(define
+  content/page
+  (fn
+    (doc)
+    (str
+      "<!doctype html><html><head><meta charset=\"utf-8\"><title>"
+      (ct-html-escape (content/page-title doc))
+      "</title></head><body>"
+      (asHTML doc)
+      "</body></html>")))

lib/content/query.sx

@@ -0,0 +1,75 @@
+;; content-on-sx — block query + table of contents.
+;;
+;; Collect blocks across the whole tree (descending into sections) by predicate
+;; or type, search them by prose, and derive a table of contents from headings.
+;; Tree detection is inline (class + st-iv-get) so this needs no section.sx.
+;;
+;; Requires (loaded by harness): block.sx, doc.sx, text.sx (asText for search).
+
+(define
+  qry-section?
+  (fn (b) (and (st-instance? b) (= (get b :class) "CtSection"))))
+(define
+  qry-tree
+  (fn
+    (blocks)
+    (if
+      (= (len blocks) 0)
+      (list)
+      (let
+        ((b (first blocks)))
+        (append
+          (cons
+            b
+            (if
+              (qry-section? b)
+              (let
+                ((ch (st-iv-get b "children")))
+                (if (list? ch) (qry-tree ch) (list)))
+              (list)))
+          (qry-tree (rest blocks)))))))
+
+(define
+  content/select
+  (fn (doc pred) (filter pred (qry-tree (doc-blocks doc)))))
+
+(define
+  content/select-type
+  (fn (doc type) (content/select doc (fn (b) (= (blk-type b) type)))))
+
+(define
+  content/count-type
+  (fn (doc type) (len (content/select-type doc type))))
+
+(define
+  content/select-ids
+  (fn (doc pred) (map (fn (b) (blk-id b)) (content/select doc pred))))
+
+;; Blocks (tree-wide, excluding section containers) whose own prose contains
+;; `term`. "Prose" is (asText b), so search covers exactly what every block
+;; exposes as text — text/heading/code/quote/callout text, image alt, list
+;; items, table headers+cells — with no separate field list to drift from
+;; asText / find-replace / stats. Case-sensitive substring match.
+(define
+  content/search-text
+  (fn
+    (doc term)
+    (content/select
+      doc
+      (fn
+        (b)
+        (and
+          (not (qry-section? b))
+          (>= (index-of (asText b) term) 0))))))
+
+;; Same search, returning matching block ids in document order.
+(define
+  content/search-text-ids
+  (fn
+    (doc term)
+    (map (fn (b) (blk-id b)) (content/search-text doc term))))
+
+;; table of contents: {:id :level :text} for every heading, in document order.
+(define
+  content/headings
+  (fn (doc) (map (fn (b) {:id (blk-id b) :text (blk-get b "text") :level (blk-get b "level")}) (content/select-type doc "heading"))))

lib/content/render.sx

@@ -0,0 +1,99 @@
+;; content-on-sx — render boundary.
+;;
+;; Rendering is a message, not a property switch: every block (and the document)
+;; answers asHTML and asSx. The internal model carries no presentation — the
+;; boundary format is chosen by which message you send. The document folds its
+;; children's renderings, so (asHTML doc) / (asSx doc) are pure polymorphic
+;; sends with no type dispatch in the SX layer.
+;;
+;; Escaping happens HERE, at the boundary. asHTML routes text/attrs through
+;; String>>htmlEscaped (& < > "); asSx routes them through String>>sxEscaped
+;; (\ and ") so values cannot break out of an element or an SX string literal.
+
+(define
+  content-bootstrap-render!
+  (fn
+    ()
+    (begin
+      (ct-def-method!
+        "String"
+        "htmlEscaped"
+        "htmlEscaped | out i n c | out := ''. n := self size. i := 1. [i <= n] whileTrue: [c := self at: i. (c = $&) ifTrue: [out := out , '&amp;'] ifFalse: [(c = $<) ifTrue: [out := out , '&lt;'] ifFalse: [(c = $>) ifTrue: [out := out , '&gt;'] ifFalse: [(c = $\") ifTrue: [out := out , '&quot;'] ifFalse: [out := out , c asString]]]]. i := i + 1]. ^ out")
+      (ct-def-method!
+        "String"
+        "sxEscaped"
+        "sxEscaped | out i n c | out := ''. n := self size. i := 1. [i <= n] whileTrue: [c := self at: i. (c = $\\) ifTrue: [out := out , '\\\\'] ifFalse: [(c = $\") ifTrue: [out := out , '\\\"'] ifFalse: [out := out , c asString]]. i := i + 1]. ^ out")
+      (ct-def-method!
+        "CtHeading"
+        "asHTML"
+        "asHTML | t | t := level printString. ^ '<h' , t , '>' , text htmlEscaped , '</h' , t , '>'")
+      (ct-def-method!
+        "CtText"
+        "asHTML"
+        "asHTML ^ '<p>' , text htmlEscaped , '</p>'")
+      (ct-def-method!
+        "CtCode"
+        "asHTML"
+        "asHTML ^ '<pre><code class=\"language-' , language htmlEscaped , '\">' , text htmlEscaped , '</code></pre>'")
+      (ct-def-method!
+        "CtQuote"
+        "asHTML"
+        "asHTML ^ '<blockquote>' , text htmlEscaped , '</blockquote>'")
+      (ct-def-method!
+        "CtImage"
+        "asHTML"
+        "asHTML ^ '<img src=\"' , src htmlEscaped , '\" alt=\"' , alt htmlEscaped , '\">'")
+      (ct-def-method!
+        "CtEmbed"
+        "asHTML"
+        "asHTML ^ '<iframe src=\"' , url htmlEscaped , '\"></iframe>'")
+      (ct-def-method! "CtDivider" "asHTML" "asHTML ^ '<hr>'")
+      (ct-def-method!
+        "CtList"
+        "asHTML"
+        "asHTML | tag | tag := ordered ifTrue: ['ol'] ifFalse: ['ul']. ^ '<' , tag , '>' , (items inject: '' into: [:a :x | a , '<li>' , x htmlEscaped , '</li>']) , '</' , tag , '>'")
+      (ct-def-method!
+        "CtDoc"
+        "asHTML"
+        "asHTML ^ blocks inject: '' into: [:a :b | a , (b asHTML)]")
+      (ct-def-method!
+        "CtHeading"
+        "asSx"
+        "asSx | t | t := level printString. ^ '(h' , t , ' \"' , text sxEscaped , '\")'")
+      (ct-def-method! "CtText" "asSx" "asSx ^ '(p \"' , text sxEscaped , '\")'")
+      (ct-def-method!
+        "CtCode"
+        "asSx"
+        "asSx ^ '(pre (code \"' , text sxEscaped , '\"))'")
+      (ct-def-method!
+        "CtQuote"
+        "asSx"
+        "asSx ^ '(blockquote \"' , text sxEscaped , '\")'")
+      (ct-def-method!
+        "CtImage"
+        "asSx"
+        "asSx ^ '(img :src \"' , src sxEscaped , '\" :alt \"' , alt sxEscaped , '\")'")
+      (ct-def-method!
+        "CtEmbed"
+        "asSx"
+        "asSx ^ '(iframe :src \"' , url sxEscaped , '\")'")
+      (ct-def-method! "CtDivider" "asSx" "asSx ^ '(hr)'")
+      (ct-def-method!
+        "CtList"
+        "asSx"
+        "asSx | tag | tag := ordered ifTrue: ['ol'] ifFalse: ['ul']. ^ '(' , tag , ' ' , (items inject: '' into: [:a :x | a , '(li \"' , x sxEscaped , '\")']) , ')'")
+      (ct-def-method!
+        "CtDoc"
+        "asSx"
+        "asSx ^ '(article ' , (blocks inject: '' into: [:a :b | a , (b asSx)]) , ')'")
+      true)))
+
+;; ── SX boundary API — pure message sends ──
+(define asHTML (fn (node) (str (st-send node "asHTML" (list)))))
+(define asSx (fn (node) (str (st-send node "asSx" (list)))))
+
+;; readable aliases
+(define render-html asHTML)
+(define render-sx asSx)
+(define block-html asHTML)
+(define block-sx asSx)

lib/content/scoreboard.json

@@ -0,0 +1,48 @@
+{
+  "suites": {
+    "block": {"pass": 38, "fail": 0},
+    "doc": {"pass": 40, "fail": 0},
+    "render": {"pass": 42, "fail": 0},
+    "api": {"pass": 32, "fail": 0},
+    "meta": {"pass": 27, "fail": 0},
+    "page": {"pass": 7, "fail": 0},
+    "page-full": {"pass": 4, "fail": 0},
+    "markdown": {"pass": 20, "fail": 0},
+    "text": {"pass": 20, "fail": 0},
+    "section": {"pass": 25, "fail": 0},
+    "compose": {"pass": 17, "fail": 0},
+    "tree-edit": {"pass": 17, "fail": 0},
+    "move": {"pass": 11, "fail": 0},
+    "clone": {"pass": 10, "fail": 0},
+    "query": {"pass": 20, "fail": 0},
+    "toc": {"pass": 8, "fail": 0},
+    "anchor": {"pass": 6, "fail": 0},
+    "outline": {"pass": 14, "fail": 0},
+    "flatten": {"pass": 10, "fail": 0},
+    "transform": {"pass": 12, "fail": 0},
+    "normalize": {"pass": 11, "fail": 0},
+    "find-replace": {"pass": 16, "fail": 0},
+    "stats": {"pass": 17, "fail": 0},
+    "summary": {"pass": 14, "fail": 0},
+    "index": {"pass": 13, "fail": 0},
+    "table": {"pass": 15, "fail": 0},
+    "callout": {"pass": 12, "fail": 0},
+    "media": {"pass": 15, "fail": 0},
+    "data": {"pass": 25, "fail": 0},
+    "wire": {"pass": 11, "fail": 0},
+    "validate": {"pass": 32, "fail": 0},
+    "store": {"pass": 46, "fail": 0},
+    "snapshot": {"pass": 20, "fail": 0},
+    "crdt": {"pass": 34, "fail": 0},
+    "crdt-tree": {"pass": 21, "fail": 0},
+    "crdt-blocks": {"pass": 7, "fail": 0},
+    "crdt-store": {"pass": 14, "fail": 0},
+    "sync": {"pass": 14, "fail": 0},
+    "md-import": {"pass": 38, "fail": 0},
+    "md-doc": {"pass": 12, "fail": 0},
+    "fed": {"pass": 20, "fail": 0}
+  },
+  "total_pass": 787,
+  "total_fail": 0,
+  "total": 787
+}

lib/content/scoreboard.md

@@ -0,0 +1,48 @@
+# content-on-sx Conformance Scoreboard
+
+_Generated by `lib/content/conformance.sh`_
+
+| Suite | Pass | Fail | Total |
+|-------|-----:|-----:|------:|
+| block | 38 | 0 | 38 |
+| doc | 40 | 0 | 40 |
+| render | 42 | 0 | 42 |
+| api | 32 | 0 | 32 |
+| meta | 27 | 0 | 27 |
+| page | 7 | 0 | 7 |
+| page-full | 4 | 0 | 4 |
+| markdown | 20 | 0 | 20 |
+| text | 20 | 0 | 20 |
+| section | 25 | 0 | 25 |
+| compose | 17 | 0 | 17 |
+| tree-edit | 17 | 0 | 17 |
+| move | 11 | 0 | 11 |
+| clone | 10 | 0 | 10 |
+| query | 20 | 0 | 20 |
+| toc | 8 | 0 | 8 |
+| anchor | 6 | 0 | 6 |
+| outline | 14 | 0 | 14 |
+| flatten | 10 | 0 | 10 |
+| transform | 12 | 0 | 12 |
+| normalize | 11 | 0 | 11 |
+| find-replace | 16 | 0 | 16 |
+| stats | 17 | 0 | 17 |
+| summary | 14 | 0 | 14 |
+| index | 13 | 0 | 13 |
+| table | 15 | 0 | 15 |
+| callout | 12 | 0 | 12 |
+| media | 15 | 0 | 15 |
+| data | 25 | 0 | 25 |
+| wire | 11 | 0 | 11 |
+| validate | 32 | 0 | 32 |
+| store | 46 | 0 | 46 |
+| snapshot | 20 | 0 | 20 |
+| crdt | 34 | 0 | 34 |
+| crdt-tree | 21 | 0 | 21 |
+| crdt-blocks | 7 | 0 | 7 |
+| crdt-store | 14 | 0 | 14 |
+| sync | 14 | 0 | 14 |
+| md-import | 38 | 0 | 38 |
+| md-doc | 12 | 0 | 12 |
+| fed | 20 | 0 | 20 |
+| **Total** | **787** | **0** | **787** |

lib/content/section.sx

@@ -0,0 +1,103 @@
+;; content-on-sx — nested block trees (section container).
+;;
+;; CtSection is a block whose ivar `children` is an ordered list of blocks (any
+;; type, including nested sections → arbitrary depth). This turns the document
+;; from a flat sequence into the ordered TREE of the architecture sketch.
+;;
+;; Self-contained: CtSection answers asHTML/asSx/asText/asMarkdown: by folding
+;; its children's renderings — pure polymorphic recursion, so it composes with
+;; the existing render boundary with no changes to block.sx or render.sx. (The
+;; relevant per-block render bootstrap must be loaded for the children.)
+;;
+;; Requires (loaded by harness): block.sx, doc.sx, render.sx (asHTML/asSx);
+;; markdown.sx / text.sx for those formats on children.
+
+(define
+  content-bootstrap-section!
+  (fn
+    ()
+    (begin
+      (st-class-define! "CtSection" "CtBlock" (list "children"))
+      (ct-def-method! "CtSection" "children" "children ^ children")
+      (ct-def-method! "CtSection" "type" "type ^ #section")
+      (ct-def-method!
+        "CtSection"
+        "asHTML"
+        "asHTML ^ '<section>' , (children inject: '' into: [:a :b | a , (b asHTML)]) , '</section>'")
+      (ct-def-method!
+        "CtSection"
+        "asSx"
+        "asSx ^ '(section ' , (children inject: '' into: [:a :b | a , (b asSx)]) , ')'")
+      (ct-def-method!
+        "CtSection"
+        "asText"
+        "asText ^ (children inject: '' into: [:a :b | (b asText = '') ifTrue: [a] ifFalse: [(a = '' ifTrue: [b asText] ifFalse: [a , ' ' , b asText])]])")
+      (ct-def-method!
+        "CtSection"
+        "asMarkdown:"
+        "asMarkdown: nl ^ (children inject: '' into: [:a :b | a , (a = '' ifTrue: [''] ifFalse: [nl , nl]) , (b asMarkdown: nl)])")
+      true)))
+
+(define
+  mk-section
+  (fn
+    (id children)
+    (st-iv-set!
+      (st-iv-set! (st-make-instance "CtSection") "id" id)
+      "children"
+      children)))
+
+(define
+  section?
+  (fn (b) (and (st-instance? b) (= (get b :class) "CtSection"))))
+
+(define section-children (fn (sec) (st-send sec "children" (list))))
+
+;; copy-on-write child edits (return a new section)
+(define
+  section-with-children
+  (fn (sec children) (st-iv-set! sec "children" children)))
+(define
+  section-append
+  (fn
+    (sec block)
+    (section-with-children sec (append (section-children sec) (list block)))))
+
+;; ── tree traversal (descends into nested sections) ──
+(define
+  block-deep-find
+  (fn
+    (blocks id)
+    (if
+      (= (len blocks) 0)
+      nil
+      (let
+        ((b (first blocks)))
+        (if
+          (= (blk-id b) id)
+          b
+          (let
+            ((nested (if (section? b) (block-deep-find (section-children b) id) nil)))
+            (if (= nested nil) (block-deep-find (rest blocks) id) nested)))))))
+
+(define doc-deep-find (fn (doc id) (block-deep-find (doc-blocks doc) id)))
+
+(define
+  block-tree-ids
+  (fn
+    (blocks)
+    (if
+      (= (len blocks) 0)
+      (list)
+      (let
+        ((b (first blocks)))
+        (append
+          (cons
+            (blk-id b)
+            (if (section? b) (block-tree-ids (section-children b)) (list)))
+          (block-tree-ids (rest blocks)))))))
+
+(define doc-tree-ids (fn (doc) (block-tree-ids (doc-blocks doc))))
+
+(define block-tree-count (fn (blocks) (len (block-tree-ids blocks))))
+(define doc-tree-count (fn (doc) (len (doc-tree-ids doc))))

lib/content/snapshot.sx

@@ -0,0 +1,90 @@
+;; content-on-sx — snapshot cache over the op-log replay.
+;;
+;; Snapshots are a CACHE, never primary state: the op log stays the source of
+;; truth. A snapshot stores a materialised document at a sequence in the persist
+;; KV; cached reads start from it and replay only the tail of ops, so they return
+;; a document IDENTICAL to a full replay — just faster. Drop the snapshot and
+;; nothing is lost.
+;;
+;; Requires (loaded by harness): store.sx (+ doc.sx, persist event/log/kv/api).
+
+(define content/-snap-key (fn (doc-id) (str "content-snap:" doc-id)))
+
+;; take a snapshot of the current head at the current version. Returns the seq.
+(define
+  content/snapshot!
+  (fn
+    (b doc-id)
+    (let
+      ((seq (content/version-count b doc-id)))
+      (begin (persist/kv-put b (content/-snap-key doc-id) {:doc (content/head b doc-id) :seq seq}) seq))))
+
+(define
+  content/-snapshot
+  (fn
+    (b doc-id)
+    (if
+      (persist/kv-has? b (content/-snap-key doc-id))
+      (persist/kv-get b (content/-snap-key doc-id))
+      nil)))
+
+(define
+  content/snapshot-seq
+  (fn
+    (b doc-id)
+    (let
+      ((s (content/-snapshot b doc-id)))
+      (if (= s nil) 0 (get s :seq)))))
+
+(define
+  content/has-snapshot?
+  (fn (b doc-id) (persist/kv-has? b (content/-snap-key doc-id))))
+
+(define
+  content/drop-snapshot!
+  (fn (b doc-id) (persist/kv-delete b (content/-snap-key doc-id))))
+
+;; ── cached reads (transparent: identical result to store.sx replay) ──
+(define
+  content/-tail-ops
+  (fn
+    (b doc-id from to)
+    (map
+      (fn (ev) (persist/event-data ev))
+      (filter
+        (fn
+          (ev)
+          (and
+            (> (persist/event-seq ev) from)
+            (<= (persist/event-seq ev) to)))
+        (content/log b doc-id)))))
+
+(define
+  content/head-cached
+  (fn
+    (b doc-id)
+    (let
+      ((snap (content/-snapshot b doc-id)))
+      (if
+        (= snap nil)
+        (content/head b doc-id)
+        (doc-apply-all
+          (get snap :doc)
+          (content/-tail-ops
+            b
+            doc-id
+            (get snap :seq)
+            (content/version-count b doc-id)))))))
+
+(define
+  content/at-cached
+  (fn
+    (b doc-id seq)
+    (let
+      ((snap (content/-snapshot b doc-id)))
+      (if
+        (or (= snap nil) (< seq (get snap :seq)))
+        (content/at b doc-id seq)
+        (doc-apply-all
+          (get snap :doc)
+          (content/-tail-ops b doc-id (get snap :seq) seq))))))

lib/content/stats.sx

@@ -0,0 +1,49 @@
+;; content-on-sx — document statistics (word/char/block counts, reading time).
+;;
+;; Counts derive from the plain-text projection (asText, tree-accurate via
+;; section recursion) and a tree block count (inline class check, so this needs
+;; no section.sx). Reading time uses 200 wpm, rounded up.
+;;
+;; Requires (loaded by harness): block.sx, doc.sx, text.sx (asText).
+
+(define
+  ct-words
+  (fn (s) (filter (fn (w) (if (= w "") false true)) (split s " "))))
+
+(define ct-ceil-div (fn (a b) (quotient (+ a (- b 1)) b)))
+
+(define
+  ct-stat-section?
+  (fn (b) (and (st-instance? b) (= (get b :class) "CtSection"))))
+(define
+  ct-stat-count
+  (fn
+    (blocks)
+    (if
+      (= (len blocks) 0)
+      0
+      (let
+        ((b (first blocks)))
+        (+
+          (+
+            1
+            (if
+              (ct-stat-section? b)
+              (let
+                ((ch (st-iv-get b "children")))
+                (if (list? ch) (ct-stat-count ch) 0))
+              0))
+          (ct-stat-count (rest blocks)))))))
+
+(define content/word-count (fn (doc) (len (ct-words (asText doc)))))
+(define content/char-count (fn (doc) (string-length (asText doc))))
+(define content/block-count (fn (doc) (ct-stat-count (doc-blocks doc))))
+(define
+  content/reading-minutes
+  (fn
+    (doc)
+    (let
+      ((w (content/word-count doc)))
+      (if (= w 0) 0 (ct-ceil-div w 200)))))
+
+(define content/stats (fn (doc) {:blocks (content/block-count doc) :reading-minutes (content/reading-minutes doc) :words (content/word-count doc) :chars (content/char-count doc)}))

lib/content/store.sx

@@ -0,0 +1,110 @@
+;; content-on-sx — op log + versioning over the persist event stream.
+;;
+;; The op log is the source of truth. Editing a document = appending the edit op
+;; as a persist event to the document's stream. Any version of the document is a
+;; replay of its op stream up to a sequence number; the materialised doc is a
+;; cache, never primary state.
+;;
+;; Requires (loaded by the harness): block.sx, doc.sx, section.sx (doc-deep-find
+;; + doc-tree-ids, for the tree-wide diff), plus persist (event/backend/log/kv/
+;; api). The persist backend `b` is opened by the caller via (persist/open) and
+;; injected — content knows nothing about which backend.
+
+(define content/-stream (fn (doc-id) (str "content:" doc-id)))
+
+;; ── commit: append an edit op as an event. `at` is a caller-supplied logical
+;; timestamp (Date.now is unavailable in-kernel). Returns the stored event. ──
+(define
+  content/commit!
+  (fn
+    (b doc-id op at)
+    (persist/append b (content/-stream doc-id) (get op :op) at op)))
+
+(define
+  content/commit-all!
+  (fn
+    (b doc-id ops at)
+    (if
+      (= (len ops) 0)
+      nil
+      (begin
+        (content/commit! b doc-id (first ops) at)
+        (content/commit-all! b doc-id (rest ops) at)))))
+
+;; ── read the raw log / op stream ──
+(define
+  content/log
+  (fn (b doc-id) (persist/read b (content/-stream doc-id))))
+
+(define
+  content/ops
+  (fn
+    (b doc-id)
+    (map (fn (ev) (persist/event-data ev)) (content/log b doc-id))))
+
+;; logical version count (highest seq assigned, survives compaction)
+(define
+  content/version-count
+  (fn (b doc-id) (persist/last-seq b (content/-stream doc-id))))
+
+;; ── replay ──
+;; head — materialise the latest document by folding all ops.
+(define
+  content/head
+  (fn (b doc-id) (doc-apply-all (doc-empty doc-id) (content/ops b doc-id))))
+
+;; at — materialise the document as of sequence `seq` (a version).
+(define
+  content/at
+  (fn
+    (b doc-id seq)
+    (let
+      ((evs (filter (fn (ev) (<= (persist/event-seq ev) seq)) (content/log b doc-id))))
+      (doc-apply-all
+        (doc-empty doc-id)
+        (map (fn (ev) (persist/event-data ev)) evs)))))
+
+;; ── history: per-version metadata, oldest-first ──
+(define
+  content/history
+  (fn (b doc-id) (map (fn (ev) {:type (persist/event-type ev) :at (persist/event-at ev) :seq (persist/event-seq ev)}) (content/log b doc-id))))
+
+;; ── diff between two materialised document versions ──
+;; Tree-wide: ids are enumerated across the whole block tree (descending into
+;; sections), so nested-block adds/removes/changes are detected, not just
+;; top-level ones. Returns {:added :removed :changed} (lists of ids):
+;;   :added   — ids present (anywhere) in `new` but not in `old`
+;;   :removed — ids present (anywhere) in `old` but not in `new`
+;;   :changed — content blocks present in both whose block value differs
+;; Section containers never appear in :changed (they hold no own content — a
+;; child change surfaces as that child's own entry); a whole section appearing
+;; or disappearing shows up in :added / :removed by its id.
+(define content/-all-ids (fn (doc) (doc-tree-ids doc)))
+
+(define content/-missing? (fn (doc id) (= (doc-deep-find doc id) nil)))
+
+(define
+  content/-changed
+  (fn
+    (old new)
+    (filter
+      (fn
+        (id)
+        (let
+          ((bo (doc-deep-find old id)) (bn (doc-deep-find new id)))
+          (cond
+            ((= bo nil) false)
+            ((= bn nil) false)
+            ((= (blk-type bo) "section") false)
+            ((= bo bn) false)
+            (else true))))
+      (content/-all-ids old))))
+
+(define content/diff (fn (old new) {:changed (content/-changed old new) :removed (filter (fn (id) (content/-missing? new id)) (content/-all-ids old)) :added (filter (fn (id) (content/-missing? old id)) (content/-all-ids new))}))
+
+;; convenience: diff two persisted versions by seq.
+(define
+  content/diff-versions
+  (fn
+    (b doc-id seq-a seq-b)
+    (content/diff (content/at b doc-id seq-a) (content/at b doc-id seq-b))))

lib/content/summary.sx

@@ -0,0 +1,26 @@
+;; content-on-sx — list-card summary projection.
+;;
+;; content/summary returns a one-call projection for index/listing cards:
+;;   {:id :title :excerpt :words :reading-minutes :cover}
+;; composing the metadata, text, stats and query layers. `cover` is the first
+;; image's src (or nil).
+;;
+;; Requires (loaded by harness): doc.sx, meta.sx (doc-title), text.sx
+;; (content/excerpt), stats.sx (word-count/reading), query.sx (select-type).
+
+(define
+  content/summary-title
+  (fn (doc) (let ((t (doc-title doc))) (if (= t nil) (doc-id doc) t))))
+
+(define
+  content/cover
+  (fn
+    (doc)
+    (let
+      ((imgs (content/select-type doc "image")))
+      (if
+        (= (len imgs) 0)
+        nil
+        (str (blk-get (first imgs) "src"))))))
+
+(define content/summary (fn (doc) {:id (doc-id doc) :reading-minutes (content/reading-minutes doc) :words (content/word-count doc) :title (content/summary-title doc) :excerpt (content/excerpt doc 160) :cover (content/cover doc)}))

lib/content/sync.sx

@@ -0,0 +1,74 @@
+;; content-on-sx — external CMS sync via an injected adapter.
+;;
+;; Sync is a peripheral, not a feature. The core defines a SHAPE — an adapter is
+;; a dict {:import (fn external doc-id -> doc) :export (fn doc -> external)} — and
+;; delegates to it. The core knows nothing about Ghost's data model; all
+;; translation lives in the adapter. Swap the adapter and the core is unchanged;
+;; if Ghost goes away, nothing here does.
+;;
+;; Requires (loaded by harness): block.sx, doc.sx.
+
+;; ── generic boundary: pure delegation ──
+(define
+  content/import
+  (fn (adapter external doc-id) ((get adapter :import) external doc-id)))
+
+(define content/export (fn (adapter doc) ((get adapter :export) doc)))
+
+;; round-trip a document through an adapter (export then import).
+(define
+  content/round-trip
+  (fn
+    (adapter doc)
+    (content/import adapter (content/export adapter doc) (doc-id doc))))
+
+;; ── a Ghost-flavoured adapter (the peripheral). Ghost knowledge is confined
+;; here: a post is {:title :sections (list section)}; a section is a tagged dict
+;; {:kind ...} that this adapter maps to/from content blocks. ──
+(define
+  ghost-section->block
+  (fn
+    (sec)
+    (let
+      ((kind (get sec :kind)) (id (get sec :id)))
+      (cond
+        ((= kind "heading")
+          (mk-heading id (get sec :level) (get sec :text)))
+        ((= kind "paragraph") (mk-text id (get sec :text)))
+        ((= kind "image") (mk-image id (get sec :src) (get sec :alt)))
+        ((= kind "code") (mk-code id (get sec :language) (get sec :text)))
+        ((= kind "quote") (mk-quote id (get sec :cite) (get sec :text)))
+        ((= kind "hr") (mk-divider id))
+        ((= kind "list") (mk-list id (get sec :ordered) (get sec :items)))
+        ((= kind "embed") (mk-embed id (get sec :url) (get sec :provider)))
+        (else (mk-text id (get sec :text)))))))
+
+(define
+  block->ghost-section
+  (fn
+    (b)
+    (let
+      ((t (blk-type b)) (id (blk-id b)))
+      (cond
+        ((= t "heading") {:id id :text (str (blk-send b "text")) :kind "heading" :level (blk-send b "level")})
+        ((= t "text") {:id id :text (str (blk-send b "text")) :kind "paragraph"})
+        ((= t "image") {:id id :src (str (blk-send b "src")) :alt (str (blk-send b "alt")) :kind "image"})
+        ((= t "code") {:id id :text (str (blk-send b "text")) :kind "code" :language (str (blk-send b "language"))})
+        ((= t "quote") {:cite (str (blk-send b "cite")) :id id :text (str (blk-send b "text")) :kind "quote"})
+        ((= t "divider") {:id id :kind "hr"})
+        ((= t "list") {:items (blk-send b "items") :id id :kind "list" :ordered (blk-send b "ordered")})
+        ((= t "embed") {:id id :provider (str (blk-send b "provider")) :kind "embed" :url (str (blk-send b "url"))})
+        (else {:id id :text "" :kind "paragraph"})))))
+
+(define
+  ghost-import
+  (fn
+    (post doc-id)
+    (st-iv-set!
+      (doc-new doc-id (map ghost-section->block (get post :sections)))
+      "title"
+      (get post :title))))
+
+(define ghost-export (fn (doc) {:sections (map block->ghost-section (doc-blocks doc)) :title (st-send doc "title" (list))}))
+
+(define ghost-adapter {:export ghost-export :import ghost-import})

lib/content/table.sx

@@ -0,0 +1,54 @@
+;; content-on-sx — table block.
+;;
+;; CtTable holds `headers` (list of strings) and `rows` (list of string lists).
+;; Self-contained: it answers asHTML/asSx/asText/asMarkdown: by folding rows and
+;; cells, so it composes with the render boundary with no changes elsewhere. HTML
+;; cells are htmlEscaped, SX cells sxEscaped (render.sx must be loaded).
+;;
+;; Requires (loaded by harness): block.sx, doc.sx, render.sx (escapers);
+;; markdown.sx / text.sx for those formats.
+
+(define
+  content-bootstrap-table!
+  (fn
+    ()
+    (begin
+      (st-class-define! "CtTable" "CtBlock" (list "headers" "rows"))
+      (ct-def-method! "CtTable" "headers" "headers ^ headers")
+      (ct-def-method! "CtTable" "rows" "rows ^ rows")
+      (ct-def-method! "CtTable" "type" "type ^ #table")
+      (ct-def-method!
+        "CtTable"
+        "asHTML"
+        "asHTML | thead tbody | thead := '<thead><tr>' , (headers inject: '' into: [:a :h | a , '<th>' , h htmlEscaped , '</th>']) , '</tr></thead>'. tbody := '<tbody>' , (rows inject: '' into: [:a :r | a , '<tr>' , (r inject: '' into: [:b :c | b , '<td>' , c htmlEscaped , '</td>']) , '</tr>']) , '</tbody>'. ^ '<table>' , thead , tbody , '</table>'")
+      (ct-def-method!
+        "CtTable"
+        "asSx"
+        "asSx ^ '(table (thead (tr ' , (headers inject: '' into: [:a :h | a , '(th \"' , h sxEscaped , '\")']) , ')) (tbody ' , (rows inject: '' into: [:a :r | a , '(tr ' , (r inject: '' into: [:b :c | b , '(td \"' , c sxEscaped , '\")']) , ')']) , '))'")
+      (ct-def-method!
+        "CtTable"
+        "asText"
+        "asText ^ (rows inject: (headers inject: '' into: [:a :h | (a = '' ifTrue: [h] ifFalse: [a , ' ' , h])]) into: [:acc :r | acc , ' ' , (r inject: '' into: [:b :c | (b = '' ifTrue: [c] ifFalse: [b , ' ' , c])])])")
+      (ct-def-method!
+        "CtTable"
+        "asMarkdown:"
+        "asMarkdown: nl | head sep body | head := '|' , (headers inject: '' into: [:a :h | a , ' ' , h , ' |']). sep := '|' , (headers inject: '' into: [:a :h | a , ' --- |']). body := (rows inject: '' into: [:acc :r | acc , nl , '|' , (r inject: '' into: [:a :c | a , ' ' , c , ' |'])]). ^ head , nl , sep , body")
+      true)))
+
+(define
+  mk-table
+  (fn
+    (id headers rows)
+    (st-iv-set!
+      (st-iv-set!
+        (st-iv-set! (st-make-instance "CtTable") "id" id)
+        "headers"
+        headers)
+      "rows"
+      rows)))
+
+(define
+  table?
+  (fn (b) (and (st-instance? b) (= (get b :class) "CtTable"))))
+(define table-headers (fn (tb) (st-send tb "headers" (list))))
+(define table-rows (fn (tb) (st-send tb "rows" (list))))

lib/content/tests/anchor.sx

@@ -0,0 +1,58 @@
+;; Extension — anchored-heading HTML render (functional TOC links).
+
+(st-bootstrap-classes!)
+(content/bootstrap!)
+(content-bootstrap-section!)
+
+(define
+  d
+  (doc-append
+    (doc-append
+      (doc-append (doc-empty "d") (mk-heading "intro" 1 "Intro"))
+      (mk-text "p" "Body"))
+    (mk-section
+      "s"
+      (list (mk-heading "sub" 2 "Sub") (mk-text "n" "nested")))))
+
+;; ── headings get id anchors; other blocks unchanged ──
+(content-test
+  "anchored html"
+  (content/html-anchored d)
+  "<h1 id=\"intro\">Intro</h1><p>Body</p><section><h2 id=\"sub\">Sub</h2><p>nested</p></section>")
+
+;; ── heading text escaped ──
+(content-test
+  "anchored escapes text"
+  (content/html-anchored
+    (doc-append (doc-empty "d") (mk-heading "h" 2 "A < B")))
+  "<h2 id=\"h\">A &lt; B</h2>")
+
+;; ── non-heading-only doc identical to asHTML ──
+(define
+  np
+  (doc-append
+    (doc-append (doc-empty "d") (mk-text "p" "x"))
+    (mk-image "i" "/a.png" "alt")))
+(content-test "no headings == asHTML" (content/html-anchored np) (asHTML np))
+
+;; ── empty doc ──
+(content-test "anchored empty" (content/html-anchored (doc-empty "e")) "")
+
+;; ── anchors match TOC ids (end-to-end) ──
+(content-test
+  "anchor ids match toc"
+  (map (fn (h) (get h :id)) (content/headings d))
+  (list "intro" "sub"))
+
+;; ── deep nesting ──
+(define
+  deep
+  (doc-append
+    (doc-empty "d")
+    (mk-section
+      "o"
+      (list (mk-section "i" (list (mk-heading "deep" 3 "Deep")))))))
+(content-test
+  "deep anchored"
+  (content/html-anchored deep)
+  "<section><section><h3 id=\"deep\">Deep</h3></section></section>")

lib/content/tests/api.sx

@@ -0,0 +1,133 @@
+;; Phase 1 — public API facade. End-to-end through content/*.
+
+(st-bootstrap-classes!)
+(content/bootstrap!)
+
+;; ── build a document via the facade ──
+(define d0 (content/empty "post"))
+(define
+  h
+  (content/block
+    "heading"
+    "h"
+    (list (list "level" 1) (list "text" "Hi"))))
+(define p (content/block "text" "p" (list (list "text" "World"))))
+(define d1 (content/append (content/append d0 h) p))
+
+(content/op? (content/insert h nil))
+(content-test "count" (content/count d1) 2)
+(content-test "ids" (content/ids d1) (list "h" "p"))
+(content-test "types" (content/types d1) (list "heading" "text"))
+(content-test "find" (blk-id (content/find d1 "p")) "p")
+(content-test "has? yes" (content/has? d1 "h") true)
+(content-test "has? no" (content/has? d1 "x") false)
+
+;; ── content/op? distinguishes a single op from a list / a block ──
+(content-test "op? on insert" (content/op? (content/insert h nil)) true)
+(content-test
+  "op? on update"
+  (content/op? (content/update "p" "text" "z"))
+  true)
+(content-test "op? on list" (content/op? (list (content/delete "h"))) false)
+(content-test "op? on block" (content/op? h) false)
+(content-test "op? on doc" (content/op? d1) false)
+
+;; ── edit with a single op ──
+(define
+  img
+  (content/block
+    "image"
+    "img"
+    (list (list "src" "/c.png") (list "alt" "cat"))))
+(define d2 (content/edit d1 (content/insert img "h")))
+(content-test "edit single op order" (content/ids d2) (list "h" "img" "p"))
+(content-test "edit single immutable" (content/ids d1) (list "h" "p"))
+(content-test
+  "edit update"
+  (str
+    (blk-send
+      (content/find
+        (content/edit d1 (content/update "p" "text" "Edited"))
+        "p")
+      "text"))
+  "Edited")
+(content-test
+  "edit delete"
+  (content/ids (content/edit d1 (content/delete "h")))
+  (list "p"))
+(content-test
+  "edit move"
+  (content/ids (content/edit d1 (content/move "p" 0)))
+  (list "p" "h"))
+
+;; ── edit with a stream of ops ──
+(define ops (list (content/insert img "h") (content/delete "p")))
+(content-test
+  "edit op stream"
+  (content/ids (content/edit d1 ops))
+  (list "h" "img"))
+(content-test "edit op stream immutable" (content/ids d1) (list "h" "p"))
+
+;; ── render via facade ──
+(content-test
+  "render html"
+  (content/render d1 "html")
+  "<h1>Hi</h1><p>World</p>")
+(content-test
+  "render sx"
+  (content/render d1 "sx")
+  "(article (h1 \"Hi\")(p \"World\"))")
+(content-test
+  "render html keyword"
+  (content/render d1 :html)
+  "<h1>Hi</h1><p>World</p>")
+(content-test
+  "render sx keyword"
+  (content/render d1 :sx)
+  "(article (h1 \"Hi\")(p \"World\"))")
+(content-test "content/html" (content/html d1) "<h1>Hi</h1><p>World</p>")
+(content-test "content/sx" (content/sx d1) "(article (h1 \"Hi\")(p \"World\"))")
+
+;; ── render reflects each version ──
+(content-test
+  "render edited version"
+  (content/render (content/edit d1 (content/update "h" "text" "Hey")) "html")
+  "<h1>Hey</h1><p>World</p>")
+(content-test
+  "render original unchanged"
+  (content/render d1 "html")
+  "<h1>Hi</h1><p>World</p>")
+
+;; ── facade find/has? are TREE-WIDE (reach into sections); find-top/has-top?
+;; keep the top-level-only lookup. This makes the read-by-id surface consistent
+;; with content/edit, whose update/delete are already tree-wide. ──
+(content-bootstrap-section!)
+(define
+  nd
+  (content/append
+    (content/empty "nested")
+    (mk-section
+      "sec"
+      (list (content/block "text" "inner" (list (list "text" "deep")))))))
+(content-test
+  "find nested (deep)"
+  (blk-id (content/find nd "inner"))
+  "inner")
+(content-test "has? nested (deep)" (content/has? nd "inner") true)
+(content-test "find-top misses nested" (content/find-top nd "inner") nil)
+(content-test "has-top? misses nested" (content/has-top? nd "inner") false)
+(content-test
+  "find-top sees top-level"
+  (blk-id (content/find-top nd "sec"))
+  "sec")
+;; a nested block updated by id via content/edit is now readable by id via
+;; content/find (was impossible when find was top-level-only).
+(content-test
+  "edit-then-find nested round-trip"
+  (str
+    (blk-send
+      (content/find
+        (content/edit nd (content/update "inner" "text" "edited"))
+        "inner")
+      "text"))
+  "edited")

lib/content/tests/block.sx

@@ -0,0 +1,75 @@
+;; Phase 1 — typed block objects. Behaviour via message dispatch; fields
+;; immutable (copy-on-write).
+
+(st-bootstrap-classes!)
+(content-bootstrap-blocks!)
+
+;; ── construction + polymorphic type dispatch ──
+(define h (mk-heading "b1" 2 "Title"))
+(define t (mk-text "b2" "Body text"))
+(define img (mk-image "b3" "/cat.png" "a cat"))
+(define code (mk-code "b4" "sx" "(+ 1 2)"))
+(define q (mk-quote "b5" "Ada" "to err"))
+(define em (mk-embed "b6" "https://v/1" "vimeo"))
+(define dv (mk-divider "b7"))
+(define ls (mk-list "b8" true (list "one" "two")))
+
+(content-test "heading type" (blk-type h) "heading")
+(content-test "text type" (blk-type t) "text")
+(content-test "image type" (blk-type img) "image")
+(content-test "code type" (blk-type code) "code")
+(content-test "quote type" (blk-type q) "quote")
+(content-test "embed type" (blk-type em) "embed")
+(content-test "divider type" (blk-type dv) "divider")
+(content-test "list type" (blk-type ls) "list")
+
+;; ── id via message dispatch ──
+(content-test "heading id" (blk-id h) "b1")
+(content-test "image id" (blk-id img) "b3")
+(content-test "divider id" (blk-id dv) "b7")
+
+;; ── field reads via messages (incl. inherited text) ──
+(content-test "heading text inherited" (str (blk-send h "text")) "Title")
+(content-test "heading level" (blk-send h "level") 2)
+(content-test "text body" (str (blk-send t "text")) "Body text")
+(content-test "image src" (str (blk-send img "src")) "/cat.png")
+(content-test "image alt" (str (blk-send img "alt")) "a cat")
+(content-test "code language" (str (blk-send code "language")) "sx")
+(content-test "code text inherited" (str (blk-send code "text")) "(+ 1 2)")
+(content-test "quote cite" (str (blk-send q "cite")) "Ada")
+(content-test "embed url" (str (blk-send em "url")) "https://v/1")
+(content-test "embed provider" (str (blk-send em "provider")) "vimeo")
+(content-test "list ordered" (blk-send ls "ordered") true)
+(content-test "list items" (blk-send ls "items") (list "one" "two"))
+
+;; ── blk-get reads ivars directly ──
+(content-test "blk-get level" (blk-get h "level") 2)
+(content-test "blk-get missing nil" (blk-get h "nope") nil)
+
+;; ── copy-on-write: blk-set returns a new block, original untouched ──
+(define h2 (blk-set h "level" 1))
+(content-test "blk-set new value" (blk-send h2 "level") 1)
+(content-test "blk-set original unchanged" (blk-send h "level") 2)
+(content-test "blk-set keeps id" (blk-id h2) "b1")
+(content-test "blk-set keeps text" (str (blk-send h2 "text")) "Title")
+
+;; ── predicate ──
+(content-test "block? on heading" (block? h) true)
+(content-test "block? on divider" (block? dv) true)
+(content-test "block? on number" (block? 5) false)
+(content-test "block? on string" (block? "x") false)
+
+;; ── isBlock message inherited by all ──
+(content-test "isBlock heading" (blk-send h "isBlock") true)
+(content-test "isBlock list" (blk-send ls "isBlock") true)
+
+;; ── generic mk-block via wire tag ──
+(define
+  g
+  (mk-block
+    "heading"
+    "g1"
+    (list (list "level" 3) (list "text" "Gen"))))
+(content-test "mk-block type" (blk-type g) "heading")
+(content-test "mk-block level" (blk-send g "level") 3)
+(content-test "mk-block text" (str (blk-send g "text")) "Gen")

lib/content/tests/callout.sx

@@ -0,0 +1,55 @@
+;; Extension — callout / admonition block.
+
+(st-bootstrap-classes!)
+(content/bootstrap!)
+(content-bootstrap-markdown!)
+(content-bootstrap-text!)
+(content-bootstrap-callout!)
+
+(define c (mk-callout "c" "warning" "Be careful"))
+
+;; ── identity ──
+(content-test "callout is block" (block? c) true)
+(content-test "callout? yes" (callout? c) true)
+(content-test "callout type" (blk-type c) "callout")
+(content-test "callout kind" (callout-kind c) "warning")
+
+;; ── render ──
+(content-test
+  "callout html"
+  (asHTML c)
+  "<aside class=\"callout callout-warning\">Be careful</aside>")
+(content-test
+  "callout sx"
+  (asSx c)
+  "(aside :class \"callout callout-warning\" \"Be careful\")")
+(content-test "callout text" (asText c) "Be careful")
+(content-test "callout markdown" (asMarkdown c) "> **warning:** Be careful")
+
+;; ── html escapes text ──
+(content-test
+  "callout html escapes"
+  (asHTML (mk-callout "c" "note" "a < b"))
+  "<aside class=\"callout callout-note\">a &lt; b</aside>")
+
+;; ── in a document ──
+(define
+  d
+  (doc-append
+    (doc-append (doc-empty "d") (mk-heading "h" 1 "T"))
+    c))
+(content-test
+  "doc with callout html"
+  (asHTML d)
+  "<h1>T</h1><aside class=\"callout callout-warning\">Be careful</aside>")
+
+;; ── validation ──
+(content-test
+  "valid callout"
+  (content/valid? (doc-append (doc-empty "d") c))
+  true)
+(content-test
+  "bad callout kind flagged"
+  (content/issue-kinds
+    (doc-append (doc-empty "d") (mk-callout "c" 5 "x")))
+  (list "field"))

lib/content/tests/clone.sx

@@ -0,0 +1,55 @@
+;; Extension — block id remapping / clone.
+
+(st-bootstrap-classes!)
+(content/bootstrap!)
+(content-bootstrap-section!)
+
+(define
+  d
+  (doc-append
+    (doc-append (doc-empty "d") (mk-heading "h" 1 "Title"))
+    (mk-section "s" (list (mk-text "a" "A") (mk-text "b" "B")))))
+
+;; ── prefix-ids rewrites every id in the tree ──
+(define p (content/prefix-ids d "x-"))
+(content-test "prefix top-level ids" (doc-ids p) (list "x-h" "x-s"))
+(content-test
+  "prefix tree-ids"
+  (doc-tree-ids p)
+  (list "x-h" "x-s" "x-a" "x-b"))
+(content-test "prefix immutable" (doc-tree-ids d) (list "h" "s" "a" "b"))
+(content-test "prefix preserves content" (asHTML p) (asHTML d))
+(content-test
+  "prefix preserves nested content"
+  (str (blk-send (doc-deep-find p "x-a") "text"))
+  "A")
+
+;; ── custom remap fn ──
+(define u (content/remap-ids d (fn (id) (str id "!"))))
+(content-test "remap suffix" (doc-tree-ids u) (list "h!" "s!" "a!" "b!"))
+
+;; ── collision-free composition ──
+(define
+  d2
+  (doc-append (doc-empty "d2") (mk-heading "h" 2 "Other")))
+(define
+  combined
+  (content/concat
+    (content/prefix-ids d "left-")
+    (content/prefix-ids d2 "right-")))
+(content-test
+  "combined ids unique"
+  (doc-tree-ids combined)
+  (list "left-h" "left-s" "left-a" "left-b" "right-h"))
+(content-test "combined validates" (content/valid? combined) true)
+;; without prefixing, the shared id "h" collides
+(content-test
+  "unprefixed collides"
+  (content/valid? (content/concat d d2))
+  false)
+
+;; ── render of combined ──
+(content-test
+  "combined render"
+  (asHTML combined)
+  "<h1>Title</h1><section><p>A</p><p>B</p></section><h2>Other</h2>")

lib/content/tests/compose.sx

@@ -0,0 +1,76 @@
+;; Extension — document composition.
+
+(st-bootstrap-classes!)
+(content/bootstrap!)
+(content-bootstrap-section!)
+
+(define
+  a
+  (doc-with-title
+    (doc-append (doc-empty "a") (mk-heading "h" 1 "A"))
+    "Doc A"))
+(define
+  b
+  (doc-append
+    (doc-append (doc-empty "b") (mk-text "p" "B1"))
+    (mk-text "q" "B2")))
+
+;; ── concat ──
+(define ab (content/concat a b))
+(content-test "concat ids" (doc-ids ab) (list "h" "p" "q"))
+(content-test "concat keeps first id" (doc-id ab) "a")
+(content-test "concat keeps first title" (doc-title ab) "Doc A")
+(content-test "concat immutable a" (doc-ids a) (list "h"))
+(content-test "concat immutable b" (doc-ids b) (list "p" "q"))
+
+;; ── prepend ──
+(define ba (content/prepend a b))
+(content-test "prepend ids" (doc-ids ba) (list "p" "q" "h"))
+(content-test "prepend keeps a id" (doc-id ba) "a")
+
+;; ── concat with empty ──
+(content-test
+  "concat empty right"
+  (doc-ids (content/concat a (doc-empty "e")))
+  (list "h"))
+(content-test
+  "concat empty left"
+  (doc-ids (content/concat (doc-empty "e") b))
+  (list "p" "q"))
+
+;; ── concat-all ──
+(define c (doc-append (doc-empty "c") (mk-divider "d")))
+(content-test
+  "concat-all order"
+  (doc-ids (content/concat-all (list a b c)))
+  (list "h" "p" "q" "d"))
+(content-test
+  "concat-all keeps first id"
+  (doc-id (content/concat-all (list a b c)))
+  "a")
+(content-test
+  "concat-all single"
+  (doc-ids (content/concat-all (list a)))
+  (list "h"))
+(content-test
+  "concat-all empty"
+  (doc-ids (content/concat-all (list)))
+  (list))
+
+;; ── render of composed doc ──
+(content-test
+  "composed renders"
+  (asHTML (content/concat a b))
+  "<h1>A</h1><p>B1</p><p>B2</p>")
+
+;; ── wrap-section collapses blocks into a subtree ──
+(define w (content/wrap-section ab "sec"))
+(content-test "wrap top-level is one section" (doc-ids w) (list "sec"))
+(content-test
+  "wrap children preserved"
+  (doc-tree-ids w)
+  (list "sec" "h" "p" "q"))
+(content-test
+  "wrap renders nested"
+  (asHTML w)
+  "<section><h1>A</h1><p>B1</p><p>B2</p></section>")

lib/content/tests/crdt-blocks.sx

@@ -0,0 +1,136 @@
+;; Hardening — non-core block types (callout/table/media/section) survive the
+;; flat and tree CvRDT materialise paths (regression for the ct-class-for-type
+;; fix: these route through crdt-element->block -> mk-block).
+
+(st-bootstrap-classes!)
+(content-bootstrap-blocks!)
+(content-bootstrap-doc!)
+(content-bootstrap-render!)
+(content-bootstrap-section!)
+(content-bootstrap-callout!)
+(content-bootstrap-table!)
+(content-bootstrap-media!)
+
+;; ── flat CRDT: callout / table / media leaves ──
+(define
+  s
+  (crdt-apply-all
+    (crdt-empty)
+    (list
+      (crdt-op-insert
+        "co"
+        "callout"
+        (crdt-pos 1 0)
+        (list (list "kind" "note") (list "text" "hi"))
+        1
+        0)
+      (crdt-op-insert
+        "tb"
+        "table"
+        (crdt-pos 2 0)
+        (list (list "headers" (list "A")) (list "rows" (list (list "1"))))
+        1
+        0)
+      (crdt-op-insert
+        "vid"
+        "media"
+        (crdt-pos 3 0)
+        (list (list "kind" "video") (list "src" "/v.mp4"))
+        1
+        0))))
+(content-test
+  "flat crdt callout render"
+  (asHTML (crdt-materialize "d" s))
+  "<aside class=\"callout callout-note\">hi</aside><table><thead><tr><th>A</th></tr></thead><tbody><tr><td>1</td></tr></tbody></table><video src=\"/v.mp4\" controls></video>")
+(content-test "flat crdt order" (crdt-order s) (list "co" "tb" "vid"))
+
+;; ── flat CRDT: callout field via LWW update ──
+(define s2 (crdt-update s "co" "text" "edited" 5 1))
+(content-test
+  "flat crdt callout update"
+  (str (blk-send (doc-find (crdt-materialize "d" s2) "co") "text"))
+  "edited")
+
+;; ── tree CRDT: callout/table inside a section ──
+(define
+  t
+  (crdt-tree-apply-all
+    (crdt-empty)
+    (list
+      (crdt-tree-op-insert
+        "sec"
+        "section"
+        (crdt-pos 1 0)
+        ""
+        (list)
+        1
+        0)
+      (crdt-tree-op-insert
+        "co"
+        "callout"
+        (crdt-pos 1 0)
+        "sec"
+        (list (list "kind" "tip") (list "text" "T"))
+        1
+        0)
+      (crdt-tree-op-insert
+        "tb"
+        "table"
+        (crdt-pos 2 0)
+        "sec"
+        (list (list "headers" (list "H")) (list "rows" (list)))
+        1
+        0))))
+(content-test
+  "tree crdt nested blocks"
+  (doc-tree-ids (crdt-tree-materialize "d" t))
+  (list "sec" "co" "tb"))
+(content-test
+  "tree crdt nested render"
+  (asHTML (crdt-tree-materialize "d" t))
+  "<section><aside class=\"callout callout-tip\">T</aside><table><thead><tr><th>H</th></tr></thead><tbody></tbody></table></section>")
+
+;; ── tree CRDT: concurrent callout inserts into a section converge ──
+(define
+  base
+  (crdt-tree-insert
+    (crdt-empty)
+    "sec"
+    "section"
+    (crdt-pos 1 0)
+    ""
+    (list)
+    1
+    0))
+(define
+  rA
+  (crdt-tree-insert
+    base
+    "x"
+    "callout"
+    (crdt-pos 5 1)
+    "sec"
+    (list (list "kind" "note") (list "text" "A"))
+    2
+    1))
+(define
+  rB
+  (crdt-tree-insert
+    base
+    "y"
+    "media"
+    (crdt-pos 5 2)
+    "sec"
+    (list (list "kind" "audio") (list "src" "/a.mp3"))
+    2
+    2))
+(content-test
+  "tree crdt mixed converge"
+  (=
+    (get (crdt-tree-merge rA rB) :elements)
+    (get (crdt-tree-merge rB rA) :elements))
+  true)
+(content-test
+  "tree crdt mixed ids"
+  (doc-tree-ids (crdt-tree-materialize "d" (crdt-tree-merge rA rB)))
+  (list "sec" "x" "y"))

lib/content/tests/crdt-store.sx

@@ -0,0 +1,139 @@
+;; Extension — durable collaborative replication (CRDT ops on persist).
+;; Replicas log independently; converge merges the logs deterministically.
+
+(st-bootstrap-classes!)
+(content-bootstrap-blocks!)
+(content-bootstrap-doc!)
+(content-bootstrap-render!)
+
+(define same? (fn (a b) (= (get a :elements) (get b :elements))))
+(define B (persist/open))
+
+;; replica "a" (origin): inserts h, p
+(crdt/commit!
+  B
+  "doc"
+  "a"
+  (crdt-op-insert
+    "h"
+    "heading"
+    (crdt-pos 1 0)
+    (list (list "level" 1) (list "text" "T"))
+    1
+    1)
+  1)
+(crdt/commit!
+  B
+  "doc"
+  "a"
+  (crdt-op-insert
+    "p"
+    "text"
+    (crdt-pos 2 0)
+    (list (list "text" "Body"))
+    1
+    1)
+  1)
+
+;; replica "b" (concurrent): edits p, inserts x
+(crdt/commit-all!
+  B
+  "doc"
+  "b"
+  (list
+    (crdt-op-update "p" "text" "Edited" 5 2)
+    (crdt-op-insert
+      "x"
+      "text"
+      (crdt-pos 3 0)
+      (list (list "text" "X"))
+      6
+      2))
+  5)
+
+;; ── durability ──
+(content-test
+  "replica a version"
+  (crdt/replica-version B "doc" "a")
+  2)
+(content-test
+  "replica b version"
+  (crdt/replica-version B "doc" "b")
+  2)
+(content-test
+  "replica a ops len"
+  (len (crdt/replica-ops B "doc" "a"))
+  2)
+
+;; ── single-replica replay ──
+(content-test
+  "replay a order"
+  (crdt-order (crdt/replay B "doc" "a"))
+  (list "h" "p"))
+(content-test
+  "replay a == apply-all"
+  (same?
+    (crdt/replay B "doc" "a")
+    (crdt-apply-all (crdt-empty) (crdt/replica-ops B "doc" "a")))
+  true)
+
+;; ── converge ──
+(content-test
+  "converge order"
+  (crdt/order B "doc" (list "a" "b"))
+  (list "h" "p" "x"))
+(content-test
+  "converge replica-order-independent"
+  (same?
+    (crdt/converge B "doc" (list "a" "b"))
+    (crdt/converge B "doc" (list "b" "a")))
+  true)
+(content-test
+  "converge LWW p edited"
+  (str
+    (blk-send (doc-find (crdt/document B "doc" (list "a" "b")) "p") "text"))
+  "Edited")
+(content-test
+  "converged document render"
+  (asHTML (crdt/document B "doc" (list "a" "b")))
+  "<h1>T</h1><p>Edited</p><p>X</p>")
+
+;; ── duplicate delivery is idempotent ──
+(crdt/commit!
+  B
+  "doc"
+  "a"
+  (crdt-op-insert
+    "p"
+    "text"
+    (crdt-pos 2 0)
+    (list (list "text" "Body"))
+    1
+    1)
+  1)
+(content-test
+  "duplicate op no effect on converge"
+  (crdt/order B "doc" (list "a" "b"))
+  (list "h" "p" "x"))
+(content-test
+  "duplicate keeps LWW value"
+  (str
+    (blk-send (doc-find (crdt/document B "doc" (list "a" "b")) "p") "text"))
+  "Edited")
+
+;; ── new op on a replica is reflected after re-converge ──
+(crdt/commit! B "doc" "b" (crdt-op-delete "h") 9)
+(content-test
+  "delete reflected after reconverge"
+  (crdt/order B "doc" (list "a" "b"))
+  (list "p" "x"))
+
+;; ── isolation: unknown doc converges to empty ──
+(content-test
+  "unknown doc empty"
+  (crdt/order B "other" (list "a" "b"))
+  (list))
+(content-test
+  "unknown replica empty ops"
+  (len (crdt/replica-ops B "doc" "zzz"))
+  0)

lib/content/tests/crdt-tree.sx

@@ -0,0 +1,289 @@
+;; Extension — nested-tree CvRDT. Sections nest and merge collaboratively;
+;; convergence is order/replica/duplicate-insensitive like the flat layer.
+
+(st-bootstrap-classes!)
+(content-bootstrap-blocks!)
+(content-bootstrap-doc!)
+(content-bootstrap-render!)
+(content-bootstrap-section!)
+
+(define same? (fn (a b) (= (get a :elements) (get b :elements))))
+
+;; base: a section "s" at root, with one child heading.
+(define
+  base
+  (crdt-tree-insert
+    (crdt-tree-insert
+      (crdt-empty)
+      "s"
+      "section"
+      (crdt-pos 1 0)
+      ""
+      (list)
+      1
+      0)
+    "h"
+    "heading"
+    (crdt-pos 1 0)
+    "s"
+    (list (list "level" 2) (list "text" "Sub"))
+    1
+    0))
+
+;; ── materialise rebuilds the tree ──
+(content-test "tree order root" (crdt-tree-order base) (list "s"))
+(content-test
+  "tree materialize ids"
+  (doc-tree-ids (crdt-tree-materialize "d" base))
+  (list "s" "h"))
+(content-test
+  "tree render"
+  (asHTML (crdt-tree-materialize "d" base))
+  "<section><h2>Sub</h2></section>")
+
+;; ── concurrent inserts into the SAME section converge + order by pos ──
+(define
+  rA
+  (crdt-tree-insert
+    base
+    "a"
+    "text"
+    (crdt-pos 5 1)
+    "s"
+    (list (list "text" "A"))
+    2
+    1))
+(define
+  rB
+  (crdt-tree-insert
+    base
+    "b"
+    "text"
+    (crdt-pos 5 2)
+    "s"
+    (list (list "text" "B"))
+    2
+    2))
+(content-test
+  "same-parent merge commutes"
+  (same? (crdt-tree-merge rA rB) (crdt-tree-merge rB rA))
+  true)
+(content-test
+  "same-parent order deterministic"
+  (doc-tree-ids (crdt-tree-materialize "d" (crdt-tree-merge rA rB)))
+  (list "s" "h" "a" "b"))
+
+;; ── concurrent inserts into DIFFERENT parents converge ──
+(define
+  base2
+  (crdt-tree-insert
+    (crdt-tree-insert
+      (crdt-empty)
+      "s1"
+      "section"
+      (crdt-pos 1 0)
+      ""
+      (list)
+      1
+      0)
+    "s2"
+    "section"
+    (crdt-pos 2 0)
+    ""
+    (list)
+    1
+    0))
+(define
+  x
+  (crdt-tree-insert
+    base2
+    "x"
+    "text"
+    (crdt-pos 1 0)
+    "s1"
+    (list (list "text" "X"))
+    2
+    1))
+(define
+  y
+  (crdt-tree-insert
+    base2
+    "y"
+    "text"
+    (crdt-pos 1 0)
+    "s2"
+    (list (list "text" "Y"))
+    2
+    2))
+(define m (crdt-tree-merge x y))
+(content-test
+  "different-parent commutes"
+  (same? m (crdt-tree-merge y x))
+  true)
+(content-test
+  "different-parent tree"
+  (doc-tree-ids (crdt-tree-materialize "d" m))
+  (list "s1" "x" "s2" "y"))
+(content-test
+  "different-parent render"
+  (asHTML (crdt-tree-materialize "d" m))
+  "<section><p>X</p></section><section><p>Y</p></section>")
+
+;; ── nested sections (section inside section) ──
+(define
+  nested
+  (crdt-tree-apply-all
+    (crdt-empty)
+    (list
+      (crdt-tree-op-insert
+        "outer"
+        "section"
+        (crdt-pos 1 0)
+        ""
+        (list)
+        1
+        0)
+      (crdt-tree-op-insert
+        "inner"
+        "section"
+        (crdt-pos 1 0)
+        "outer"
+        (list)
+        1
+        0)
+      (crdt-tree-op-insert
+        "leaf"
+        "text"
+        (crdt-pos 1 0)
+        "inner"
+        (list (list "text" "deep"))
+        1
+        0))))
+(content-test
+  "nested tree ids"
+  (doc-tree-ids (crdt-tree-materialize "d" nested))
+  (list "outer" "inner" "leaf"))
+(content-test
+  "nested render"
+  (asHTML (crdt-tree-materialize "d" nested))
+  "<section><section><p>deep</p></section></section>")
+
+;; ── ops in any order converge (commutative) ──
+(define
+  opA
+  (crdt-tree-op-insert
+    "p"
+    "text"
+    (crdt-pos 6 0)
+    "s"
+    (list (list "text" "P"))
+    3
+    1))
+(define opB (crdt-tree-op-update "h" "text" "Edited" 5 1))
+(define opC (crdt-tree-op-delete "h"))
+(content-test
+  "ops commute"
+  (same?
+    (crdt-tree-apply-all base (list opA opB opC))
+    (crdt-tree-apply-all base (list opC opB opA)))
+  true)
+(content-test
+  "ops idempotent"
+  (same?
+    (crdt-tree-apply-all base (list opA opB))
+    (crdt-tree-apply-all
+      (crdt-tree-apply-all base (list opA opB))
+      (list opA opB)))
+  true)
+
+;; ── update into a section + LWW ──
+(define u1 (crdt-tree-update base "h" "text" "v5" 5 1))
+(define u2 (crdt-tree-update base "h" "text" "v7" 7 2))
+(content-test
+  "tree LWW higher ts"
+  (str
+    (blk-send
+      (doc-deep-find (crdt-tree-materialize "d" (crdt-tree-merge u1 u2)) "h")
+      "text"))
+  "v7")
+
+;; ── delete inside a section ──
+(content-test
+  "delete in section"
+  (doc-tree-ids (crdt-tree-materialize "d" (crdt-tree-delete base "h")))
+  (list "s"))
+
+;; ── merge idempotence ──
+(content-test "merge idempotent self" (same? (crdt-tree-merge m m) m) true)
+
+;; ── full convergence: two replicas, divergent edits in different sections ──
+(define
+  repl1
+  (crdt-tree-apply-all
+    base2
+    (list
+      (crdt-tree-op-insert
+        "p1"
+        "text"
+        (crdt-pos 1 0)
+        "s1"
+        (list (list "text" "from1"))
+        5
+        1))))
+(define
+  repl2
+  (crdt-tree-apply-all
+    base2
+    (list
+      (crdt-tree-op-insert
+        "p2"
+        "text"
+        (crdt-pos 1 0)
+        "s2"
+        (list (list "text" "from2"))
+        6
+        2))))
+(content-test
+  "two-replica tree converges"
+  (same? (crdt-tree-merge repl1 repl2) (crdt-tree-merge repl2 repl1))
+  true)
+(content-test
+  "two-replica tree ids"
+  (doc-tree-ids (crdt-tree-materialize "d" (crdt-tree-merge repl1 repl2)))
+  (list "s1" "p1" "s2" "p2"))
+
+;; ── orphan reparenting: concurrent delete-section + insert-child ──
+;; A deletes section s; B inserts a child into s. After merge, s is gone but the
+;; child must survive (reparented to root), not silently vanish.
+(define delA (crdt-tree-delete base "s"))
+(define
+  insB
+  (crdt-tree-insert
+    base
+    "c"
+    "text"
+    (crdt-pos 9 0)
+    "s"
+    (list (list "text" "kept"))
+    5
+    2))
+(define orphan-merge (crdt-tree-merge delA insB))
+(content-test
+  "orphan survives delete-section"
+  (doc-tree-ids (crdt-tree-materialize "d" orphan-merge))
+  (list "h" "c"))
+(content-test
+  "orphan reparent commutes"
+  (same? orphan-merge (crdt-tree-merge insB delA))
+  true)
+(content-test
+  "orphan content preserved"
+  (str
+    (blk-send
+      (doc-deep-find (crdt-tree-materialize "d" orphan-merge) "c")
+      "text"))
+  "kept")
+(content-test
+  "orphan render at root"
+  (asHTML (crdt-tree-materialize "d" orphan-merge))
+  "<h2>Sub</h2><p>kept</p>")

lib/content/tests/crdt.sx

@@ -0,0 +1,315 @@
+;; Phase 3 — collaborative merge (CvRDT). The merge is a join: commutative,
+;; associative, idempotent. Tests apply ops in any order, twice, and merge
+;; replicas both ways — all must converge to identical state.
+
+(st-bootstrap-classes!)
+(content-bootstrap-blocks!)
+(content-bootstrap-doc!)
+(content-bootstrap-render!)
+
+(define same? (fn (a b) (= (get a :elements) (get b :elements))))
+
+;; ── position order (Logoot) ──
+(content-test
+  "pos lt"
+  (crdt-pos-compare
+    (crdt-pos 1 0)
+    (crdt-pos 2 0))
+  -1)
+(content-test
+  "pos gt"
+  (crdt-pos-compare
+    (crdt-pos 2 0)
+    (crdt-pos 1 0))
+  1)
+(content-test
+  "pos eq"
+  (crdt-pos-compare
+    (crdt-pos 1 0)
+    (crdt-pos 1 0))
+  0)
+(content-test
+  "pos actor tiebreak"
+  (crdt-pos-compare
+    (crdt-pos 1 1)
+    (crdt-pos 1 2))
+  -1)
+(content-test
+  "between > left"
+  (<
+    (crdt-pos-compare
+      (crdt-pos 1 0)
+      (crdt-pos-between
+        (crdt-pos 1 0)
+        (crdt-pos 2 0)
+        9))
+    0)
+  true)
+(content-test
+  "between < right"
+  (<
+    (crdt-pos-compare
+      (crdt-pos-between
+        (crdt-pos 1 0)
+        (crdt-pos 2 0)
+        9)
+      (crdt-pos 2 0))
+    0)
+  true)
+(content-test
+  "between start < right"
+  (<
+    (crdt-pos-compare
+      (crdt-pos-between nil (crdt-pos 5 0) 9)
+      (crdt-pos 5 0))
+    0)
+  true)
+(content-test
+  "between end > left"
+  (<
+    (crdt-pos-compare
+      (crdt-pos 5 0)
+      (crdt-pos-between (crdt-pos 5 0) nil 9))
+    0)
+  true)
+
+;; ── build + materialise ──
+(define
+  base
+  (crdt-insert
+    (crdt-insert
+      (crdt-empty)
+      "h"
+      "heading"
+      (crdt-pos 1 0)
+      (list (list "level" 1) (list "text" "Title"))
+      1
+      0)
+    "p"
+    "text"
+    (crdt-pos 2 0)
+    (list (list "text" "Body"))
+    1
+    0))
+
+(content-test "order" (crdt-order base) (list "h" "p"))
+(content-test
+  "materialize ids"
+  (doc-ids (crdt-materialize "d" base))
+  (list "h" "p"))
+(content-test
+  "materialize render"
+  (asHTML (crdt-materialize "d" base))
+  "<h1>Title</h1><p>Body</p>")
+
+;; ── commutativity: ops in any order converge ──
+(define
+  opA
+  (crdt-op-insert
+    "x"
+    "text"
+    (crdt-pos 3 0)
+    (list (list "text" "X"))
+    2
+    1))
+(define opB (crdt-op-update "p" "text" "Edited" 5 1))
+(define opC (crdt-op-delete "h"))
+(define s-abc (crdt-apply-all base (list opA opB opC)))
+(define s-cba (crdt-apply-all base (list opC opB opA)))
+(define s-bca (crdt-apply-all base (list opB opC opA)))
+(content-test "commutative abc=cba" (same? s-abc s-cba) true)
+(content-test "commutative abc=bca" (same? s-abc s-bca) true)
+(content-test "commutative result order" (crdt-order s-abc) (list "p" "x"))
+
+;; ── idempotence: applying ops twice changes nothing ──
+(content-test
+  "idempotent ops"
+  (same? s-abc (crdt-apply-all s-abc (list opA opB opC)))
+  true)
+
+;; ── update-before-insert is not lost ──
+(define
+  ub
+  (crdt-apply-all
+    (crdt-empty)
+    (list
+      (crdt-op-update "z" "text" "late" 3 1)
+      (crdt-op-insert
+        "z"
+        "text"
+        (crdt-pos 1 0)
+        (list (list "text" "orig"))
+        1
+        1))))
+(content-test
+  "update before insert kept"
+  (str (blk-send (doc-find (crdt-materialize "d" ub) "z") "text"))
+  "late")
+
+;; ── delete-before-insert: remove-wins ──
+(define
+  db
+  (crdt-apply-all
+    (crdt-empty)
+    (list
+      (crdt-op-delete "k")
+      (crdt-op-insert
+        "k"
+        "text"
+        (crdt-pos 1 0)
+        (list (list "text" "x"))
+        1
+        1))))
+(content-test "delete before insert removes" (crdt-order db) (list))
+
+;; ── concurrent inserts converge + deterministic order ──
+(define
+  rA
+  (crdt-insert
+    base
+    "a1"
+    "text"
+    (crdt-pos 5 1)
+    (list (list "text" "A"))
+    2
+    1))
+(define
+  rB
+  (crdt-insert
+    base
+    "b1"
+    "text"
+    (crdt-pos 5 2)
+    (list (list "text" "B"))
+    2
+    2))
+(content-test
+  "merge commutes"
+  (same? (crdt-merge rA rB) (crdt-merge rB rA))
+  true)
+(content-test
+  "merge order deterministic AB"
+  (crdt-order (crdt-merge rA rB))
+  (list "h" "p" "a1" "b1"))
+(content-test
+  "merge order deterministic BA"
+  (crdt-order (crdt-merge rB rA))
+  (list "h" "p" "a1" "b1"))
+
+;; ── merge idempotence ──
+(define mAB (crdt-merge rA rB))
+(content-test "merge idempotent self" (same? (crdt-merge mAB mAB) mAB) true)
+(content-test
+  "merge idempotent remerge"
+  (same? (crdt-merge mAB rA) mAB)
+  true)
+
+;; ── concurrent same-field update: LWW by (ts, actor) ──
+(define u1 (crdt-update base "p" "text" "v-ts5" 5 1))
+(define u2 (crdt-update base "p" "text" "v-ts7" 7 2))
+(content-test
+  "LWW higher ts wins"
+  (str
+    (blk-send
+      (doc-find (crdt-materialize "d" (crdt-merge u1 u2)) "p")
+      "text"))
+  "v-ts7")
+(content-test
+  "LWW commutes"
+  (same? (crdt-merge u1 u2) (crdt-merge u2 u1))
+  true)
+(define t1 (crdt-update base "p" "text" "actor1" 9 1))
+(define t2 (crdt-update base "p" "text" "actor2" 9 2))
+(content-test
+  "LWW tie -> actor wins"
+  (str
+    (blk-send
+      (doc-find (crdt-materialize "d" (crdt-merge t1 t2)) "p")
+      "text"))
+  "actor2")
+
+;; ── concurrent disjoint-field updates both survive ──
+(define f1 (crdt-update base "h" "text" "NewTitle" 5 1))
+(define f2 (crdt-update base "h" "level" 3 5 2))
+(define fm (crdt-merge f1 f2))
+(content-test
+  "disjoint field text"
+  (str (blk-send (doc-find (crdt-materialize "d" fm) "h") "text"))
+  "NewTitle")
+(content-test
+  "disjoint field level"
+  (blk-send (doc-find (crdt-materialize "d" fm) "h") "level")
+  3)
+(content-test "disjoint commutes" (same? fm (crdt-merge f2 f1)) true)
+
+;; ── associativity ──
+(define c1 (crdt-update base "p" "text" "c1" 4 1))
+(define
+  c2
+  (crdt-insert
+    base
+    "n2"
+    "text"
+    (crdt-pos 6 0)
+    (list (list "text" "N"))
+    2
+    2))
+(define c3 (crdt-delete base "h"))
+(content-test
+  "associative"
+  (same?
+    (crdt-merge (crdt-merge c1 c2) c3)
+    (crdt-merge c1 (crdt-merge c2 c3)))
+  true)
+(content-test
+  "merge-all = fold"
+  (same?
+    (crdt-merge-all (list c1 c2 c3))
+    (crdt-merge c1 (crdt-merge c2 c3)))
+  true)
+
+;; ── full convergence: two replicas, divergent edits, merge both ways ──
+(define
+  repl-1
+  (crdt-apply-all
+    base
+    (list
+      (crdt-op-update "p" "text" "from-1" 5 1)
+      (crdt-op-insert
+        "img"
+        "image"
+        (crdt-pos-between
+          (crdt-pos 1 0)
+          (crdt-pos 2 0)
+          1)
+        (list (list "src" "/a.png") (list "alt" "a"))
+        6
+        1))))
+(define
+  repl-2
+  (crdt-apply-all
+    base
+    (list
+      (crdt-op-delete "h")
+      (crdt-op-update "p" "text" "from-2" 7 2))))
+(content-test
+  "two-replica converges"
+  (same? (crdt-merge repl-1 repl-2) (crdt-merge repl-2 repl-1))
+  true)
+(content-test
+  "two-replica result order"
+  (crdt-order (crdt-merge repl-1 repl-2))
+  (list "img" "p"))
+(content-test
+  "two-replica LWW field"
+  (str
+    (blk-send
+      (doc-find (crdt-materialize "d" (crdt-merge repl-1 repl-2)) "p")
+      "text"))
+  "from-2")
+(content-test
+  "two-replica idempotent"
+  (same?
+    (crdt-merge (crdt-merge repl-1 repl-2) repl-1)
+    (crdt-merge repl-1 repl-2))
+  true)

lib/content/tests/data.sx

@@ -0,0 +1,116 @@
+;; Extension — portable data serialization (to-data / from-data round-trip).
+
+(st-bootstrap-classes!)
+(content/bootstrap!)
+(content-bootstrap-text!)
+(content-bootstrap-markdown!)
+(content-bootstrap-section!)
+(content-bootstrap-table!)
+(content-bootstrap-callout!)
+(content-bootstrap-media!)
+
+;; ── block->data shape ──
+(define h (mk-heading "h" 2 "Hi"))
+(content-test "block->data id" (get (block->data h) :id) "h")
+(content-test "block->data type" (get (block->data h) :type) "heading")
+(content-test "block->data fields" (get (block->data h) :fields) {:text "Hi" :level 2})
+
+;; ── round-trip a mixed document with metadata ──
+(define
+  d
+  (doc-with-meta
+    (doc-append
+      (doc-append
+        (doc-append
+          (doc-append (doc-empty "post") (mk-heading "h" 1 "Title"))
+          (mk-text "p" "Body"))
+        (mk-image "img" "/c.png" "cat"))
+      (mk-list "l" true (list "a" "b")))
+    {:slug "s" :title "T" :tags (list "x" "y")}))
+
+(define rt (content/from-data (content/to-data d)))
+(content-test "rt id" (doc-id rt) "post")
+(content-test "rt title" (doc-title rt) "T")
+(content-test "rt slug" (doc-slug rt) "s")
+(content-test "rt tags" (doc-tags rt) (list "x" "y"))
+(content-test "rt ids" (doc-ids rt) (list "h" "p" "img" "l"))
+(content-test "rt render" (asHTML rt) (asHTML d))
+(content-test
+  "rt heading level"
+  (blk-send (doc-find rt "h") "level")
+  1)
+(content-test
+  "rt list items"
+  (blk-send (doc-find rt "l") "items")
+  (list "a" "b"))
+
+;; ── nested sections round-trip ──
+(define
+  ds
+  (doc-append
+    (doc-empty "d")
+    (mk-section
+      "s"
+      (list
+        (mk-heading "nh" 2 "N")
+        (mk-section "i" (list (mk-text "x" "deep")))))))
+(define rts (content/from-data (content/to-data ds)))
+(content-test "rt nested render" (asHTML rts) (asHTML ds))
+(content-test "rt nested tree-ids" (doc-tree-ids rts) (doc-tree-ids ds))
+(content-test
+  "rt nested deep-find"
+  (str (blk-send (doc-deep-find rts "x") "text"))
+  "deep")
+
+;; ── table round-trip ──
+(define
+  dtb
+  (doc-append
+    (doc-empty "d")
+    (mk-table "t" (list "A" "B") (list (list "1" "2")))))
+(define rtt (content/from-data (content/to-data dtb)))
+(content-test "rt table render" (asHTML rtt) (asHTML dtb))
+(content-test
+  "rt table headers"
+  (table-headers (doc-find rtt "t"))
+  (list "A" "B"))
+
+;; ── callout + media round-trip (regression: ct-class-for-type must know them) ──
+(define
+  dcm
+  (doc-append
+    (doc-append (doc-empty "d") (mk-callout "co" "warning" "careful"))
+    (mk-video "vid" "/clip.mp4")))
+(define rtcm (content/from-data (content/to-data dcm)))
+(content-test "rt callout+media render" (asHTML rtcm) (asHTML dcm))
+(content-test
+  "rt callout kind"
+  (str (blk-send (doc-find rtcm "co") "kind"))
+  "warning")
+(content-test
+  "rt media kind"
+  (str (blk-send (doc-find rtcm "vid") "kind"))
+  "video")
+(content-test
+  "rt callout+media types"
+  (doc-types rtcm)
+  (list "callout" "media"))
+
+;; ── data is plain (no st-instance markers at top level) ──
+(define dat (content/to-data d))
+(content-test "data id field" (get dat :id) "post")
+(content-test "data block count" (len (get dat :blocks)) 4)
+(content-test
+  "data first block type"
+  (get (first (get dat :blocks)) :type)
+  "heading")
+
+;; ── empty doc round-trip ──
+(content-test
+  "rt empty ids"
+  (doc-ids (content/from-data (content/to-data (doc-empty "e"))))
+  (list))
+(content-test
+  "rt no-meta title nil"
+  (doc-title (content/from-data (content/to-data (doc-empty "e"))))
+  nil)