diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..6b375e0
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,139 @@
+# NOTE: this workflow has never run. Authored 2026-08-25 and not
+# executable locally — the first real tag push is its first test.
+# Expect to adjust the toolchain step if the pinned OCaml/dune version
+# is not available on the runner image.
+
+name: release
+
+# Fires only on a version tag, so nothing is published by an ordinary
+# push. `workflow_dispatch` is a DRY RUN: it builds, verifies and reports
+# the glibc floor, but skips the tag guard (there is no tag) and skips
+# publishing. Use it to rehearse before tagging anything.
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+# The ONE line that replaces `gh auth login`: it widens the automatic
+# GITHUB_TOKEN so this job may write releases. No PAT, no secret to
+# rotate, and the token dies with the job.
+permissions:
+  contents: write
+
+jobs:
+  release:
+    # DELIBERATE, not a default. The release binaries link glibc
+    # dynamically, so the build host's glibc caps which symbol versions
+    # they can import — and that cap becomes the minimum glibc every
+    # user needs. Built on 24.04 (glibc 2.39) the floor is 2.39;
+    # built here on 22.04 (2.35) it is 2.35, which is the difference
+    # between excluding and including Ubuntu 22.04, Debian 12 and
+    # RHEL 9. Raise this image only with a reason, and update the
+    # supported-systems list in docs/examples/site/install/view.wo in
+    # the same change.
+    runs-on: ubuntu-22.04
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # setup-ocaml gives a compiler and opam. It does NOT give dune —
+      # dune is an ordinary opam package, and this project has no .opam
+      # file for it to infer one from, so nothing pulls it in. The first
+      # run failed here with `dune: command not found`.
+      - uses: ocaml/setup-ocaml@v3
+        with:
+          ocaml-compiler: '4.14'
+
+      # setup-ocaml may already have installed a dune (it uses one for its
+      # own cache), in which case asking for an exact older version is a
+      # DOWNGRADE the solver refuses — which is how the pinned
+      # `dune.3.14.0` failed. So: use whatever is there, and only install
+      # if there is nothing. Any dune >= 3.14 satisfies this project's
+      # `(lang dune 3.14)`.
+      - name: Ensure dune is available
+        run: |
+          opam exec -- dune --version || opam install -y dune
+          echo "dune: $(opam exec -- dune --version)"
+
+      # The tag is the release's identity; VERSION is what the binaries
+      # report. If they disagree the download URL would name a version
+      # nobody can install. mkdist.sh already guards VERSION against the
+      # binaries; this guards the tag against VERSION.
+      - name: Tag must match VERSION
+        if: github.event_name == 'push'
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          ver="$(cat VERSION)"
+          [ "$tag" = "$ver" ] || {
+            echo "tag $GITHUB_REF_NAME does not match VERSION $ver" >&2
+            exit 1
+          }
+
+      # `opam exec --` because mkdist.sh calls dune internally; without
+      # the opam environment on PATH the script cannot find it.
+      - name: Build the tarball
+        run: opam exec -- ./scripts/mkdist.sh
+
+      # The site links one exact filename. If mkdist ever changes its
+      # naming, the download button 404s for every visitor — so fail
+      # here instead.
+      - name: Asset name must match what the site links
+        run: |
+          ver="$(cat VERSION)"
+          asset="writeonce-${ver}-linux-amd64.tar.gz"
+          test -f "dist/$asset"
+          grep -q "$asset" docs/examples/site/install/view.wo || {
+            echo "$asset is not the filename /install links" >&2
+            exit 1
+          }
+
+      - name: Verify the digest
+        run: cd dist && sha256sum -c "writeonce-$(cat ../VERSION)-linux-amd64.tar.gz.sha256"
+
+      # Prove the ARTEFACT works, using the binaries inside it rather
+      # than the ones just built in the tree. This is what catches a
+      # tarball that packaged the wrong thing.
+      - name: Smoke-test the extracted toolchain
+        run: |
+          ver="$(cat VERSION)"
+          tmp="$(mktemp -d)"
+          tar -C "$tmp" -xzf "dist/writeonce-${ver}-linux-amd64.tar.gz"
+          export PATH="$tmp/writeonce/bin:$PATH"
+          woc version
+          wovm --version
+          mkdir -p "$tmp/hello"
+          cd "$tmp/hello"
+          printf 'name    = "hello"\nversion = "0.1.0"\n\n[runtime]\nwo = ">= 0.1"\n' > wo.toml
+          printf 'fn main() -> Int {\n  print("hello, writeonce");\n  return 0;\n}\n' > main.wo
+          woc .
+          out="$(./target/hello)"
+          [ "$out" = "hello, writeonce" ] || { echo "got: $out" >&2; exit 1; }
+
+      # Record the real glibc floor of what is about to ship, so the
+      # claim on /install can be checked against a build log rather
+      # than trusted.
+      - name: Report the glibc floor
+        run: |
+          ver="$(cat VERSION)"
+          tmp="$(mktemp -d)"
+          tar -C "$tmp" -xzf "dist/writeonce-${ver}-linux-amd64.tar.gz"
+          for b in "$tmp"/writeonce/bin/*; do
+            printf '%s needs %s\n' "$(basename "$b")" \
+              "$(objdump -T "$b" | grep -oE 'GLIBC_[0-9.]+' | sort -uV | tail -1)"
+          done
+
+      # gh is preinstalled on GitHub runners and reads GH_TOKEN from the
+      # environment, so there is no `gh auth login` anywhere in this file.
+      # Skipped on workflow_dispatch: a dry run must never publish.
+      - name: Publish
+        if: github.event_name == 'push'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          ver="$(cat VERSION)"
+          gh release create "$GITHUB_REF_NAME" \
+            "dist/writeonce-${ver}-linux-amd64.tar.gz" \
+            "dist/writeonce-${ver}-linux-amd64.tar.gz.sha256" \
+            --title "writeonce ${ver}" \
+            --generate-notes
diff --git a/README.md b/README.md
index 0878464..6abc206 100644
--- a/README.md
+++ b/README.md
@@ -25,16 +25,19 @@ program ships as one file that depends only on the system C library.
   mistyped field name is a **compile error**, not a runtime surprise. There is
   no SQL string anywhere in the shipped binary.
 - **One binary, no runtime dependencies.** `woc .` produces a self-contained
-  executable (~100 KB for the sample programs) that links only libc. Copy it to
-  a server and run it.
-- **Small on purpose.** No FFI, no package manager, no framework. The standard
-  library is a handful of OS modules. The language is designed to be read.
+  executable (160–260 KB for the sample programs in this repository) that links
+  only libc. Copy it to a server and run it.
+- **Small on purpose.** No FFI, no reflection, no package registry —
+  dependencies are exact-rev git URLs and nothing else. The standard library is
+  a handful of OS modules. The language is designed to be read.
 
-writeonce is **not** a web framework and does not (yet) serve HTTP, WebSockets,
-or a UI. It is a systems language whose distinguishing feature is the embedded
-database. If you have seen an older "writeonce" that served REST from `cargo
-run`, that was a separate, earlier runtime; this page documents the current
-`woc`/`wovm` toolchain.
+writeonce is a systems language whose distinguishing feature is the embedded
+database. HTTP/1.1 and WebSockets **do** work today — but as `.wo` libraries you
+consume through `[deps]` (`porch` for serving, `writeonce-view` for
+HTML), never as runtime features: the runtime stays framework-agnostic on
+purpose. TLS is always terminated by a proxy in front. If you have seen an older
+"writeonce" that served REST from `cargo run`, that was a separate, earlier
+runtime; this page documents the current `woc`/`wovm` toolchain.
 
 ---
 
@@ -139,8 +142,10 @@ has a known owner, memory is freed deterministically, and values that form
 cycles are collected by an inferred garbage collector (you never annotate GC-
 ness; the compiler infers it). The surface will look familiar:
 
-- **Types:** `Int`, `Text`, `Bool`, and user `class` types. `?T` marks an
-  optional (nullable) value; `nil` is the empty case.
+- **Types:** `Int`, `Float`, `Bool`, `Text`, `Bytes`, `Timestamp`, `Id`, and
+  user `class` types. `?T` marks an optional (nullable) value; `nil` is the
+  empty case. `Int` and `Float` never mix implicitly — `float` and `trunc` are
+  the only bridges.
 - **Containers:** `multi T` (a growable list) and `map<K, V>`. Literals:
   `[]`, `[a, b]`, `{}`.
 - **Classes & records:** classes with fields and methods, `static const` /
@@ -149,6 +154,11 @@ ness; the compiler infers it). The surface will look familiar:
   expressions, and `try { … } catch (e) { … }` (also an expression form).
 - **Strings:** interpolation with `${expr}` inside a `"…"` literal.
 - **Functions:** free functions and methods; arguments and returns are typed.
+- **Concurrency:** `spawn C { … }` starts an actor and yields an `actor M`
+  address; `send` is fire-and-forget, `call` parks the calling fiber until the
+  receive returns. A class becomes an actor by declaring `fn receive(msg: M)`.
+  Blocking stdlib calls park the fiber — there is no `async`, no `await`, and no
+  user-visible thread.
 
 ```
 fn classify(n: Int) -> Text {
@@ -166,14 +176,17 @@ A compact set of OS modules, reached by their reserved names — no imports:
 
 | Module | What it does |
 | --- | --- |
-| `fs` | `exists`, `list`, `stat`, `read_all`, `read_at`, `append` |
-| `time` | `sleep`, `now`, `local`, `iso` |
+| `fs` | `exists`, `list`, `stat`, `read_all`, `read_at`, `append` — read and append; a file cannot yet be replaced, truncated, deleted or renamed |
+| `time` | `sleep`, `now`, `ticks` (µs monotonic), `local`, `iso` |
 | `env` | `get`, `stopping` (a cooperative shutdown flag) |
-| `net` | TCP `listen` / `accept` / `read` / `write` / `close` (host + port) |
+| `net` | `listen` / `accept` / `read` / `write` / `close`, per-call deadline twins `read_dl` / `accept_dl` / `write_dl`, `listen_unix`, `peer`. Listeners only — there is no outbound `connect` |
 | `proc` | `run` a child process, capture stdout/stderr/exit |
 | `json` | `encode` / `decode` (`json.decode(t) as T` yields `?T`) |
 
 These are deliberately minimal — the surface a real program needs, and no more.
+Alongside them sit free builtins for text, containers, the `Float`/`Bytes`
+bridges, `base64`, and the digests `sha1` / `sha256` / `hmac_sha256`. The full
+list is `docs/guides/language-surface.md`.
 
 ---
 
@@ -269,14 +282,15 @@ dependencies, declared in the manifest:
 
 ```toml
 [deps]
-niceframework = { git = "https://github.com/shoneyj/niceframework", rev = "v0.1.0" }
+porch = { git = "https://github.com/shoneyj/porch", rev = "v0.1.0" }
 ```
 
-`woc` fetches each dep (via the `git` binary) into `.wo-deps/<name>/`, pins
-the resolved commit in `wo.lock`, and `use niceframework` (or
-`use niceframework/sub`) imports its public names like any module. Builds
-never touch the network once the lock is satisfied; a moved tag is reported,
-and `woc --update-deps myproject/` refreshes the lock deliberately. Flat
+**The `[deps]` key IS the module name** `use` imports — the repository name
+never appears in your source. `woc` fetches each dep (via the `git` binary)
+into `.wo-deps/<name>/`, pins the resolved commit in `wo.lock`, and `use porch`
+(or `use porch/router`) imports its public names like any module. Builds never
+touch the network once the lock is satisfied; a moved tag is reported, and
+`woc --update-deps myproject/` refreshes the lock deliberately. Flat
 dependencies only (a dep may not have its own `[deps]`) — honest and small,
 by design.
 
@@ -292,8 +306,9 @@ WO_DATA=./data ./target/myproject report     # a fresh process still sees the da
 
 ## Worked examples
 
-Two complete sample programs live in the repository and double as the language's
-acceptance tests:
+Thirteen sample programs live under `docs/examples/`; eight of them are wired to
+a `just` recipe and double as the language's acceptance tests. The three worth
+reading first:
 
 - **`docs/examples/employee/`** — departments and employees related by
   `ref`/`backlink`, `@unique`, foreign-key restrict on delete, per-department
@@ -303,7 +318,7 @@ acceptance tests:
   just employee            # compile + run every mode against a durable database
   ```
 
-- **`docs/examples/writeonce-framework/` + `docs/examples/web-app/`** — a web
+- **`docs/examples/porch/` + `docs/examples/web-app/`** — a web
   framework written in writeonce (HTTP/1.1 behind a TLS-terminating proxy,
   router with `:param` captures, interface-based handlers) and a storefront
   consuming it **as a `[deps]` dependency**, with `@table` persistence. Run:
@@ -319,7 +334,10 @@ acceptance tests:
   just log-watcher
   ```
 
-Read either program's `main.wo` for idiomatic, working writeonce.
+Read any of their `main.wo` files for idiomatic, working writeonce. The rest —
+`site` (the writeonce.de tutorial, server-rendered, `just site`), `fibers`,
+`db-actor`, `db-bench`, `gc-cycle`, `operators`, `shop` — cover the concurrency,
+GC and benchmark surfaces.
 
 ---
 
@@ -330,10 +348,16 @@ honest. These exist as design iterations and/or work-in-progress branches, not
 as features you can use today:
 
 - **Query aggregates** — `group … by … into g` with `count`/`avg`/`min`/`max`
-  and projection records. (Today the same result is written by hand from the
-  shipped primitives.)
-- **HTTP service layer** — `service` blocks that route requests to methods.
-- **Concurrency** — a shard-actor runtime and green-threaded fibers.
+  and projection records. The clause parses and is then refused by the
+  typechecker; today the same result is written by hand from the shipped
+  primitives.
+- **File mutation and outbound sockets** — `fs` can create, grow and read a
+  file but never replace, truncate, delete or rename one, and there is no
+  `net.connect` at all, so nothing reaches out (no OIDC, SMTP, object store or
+  webhook). Both are iteration 38.
+- **`service` blocks** — a declaration form that routes requests to methods,
+  lowering onto the framework library. Today you register routes as ordinary
+  framework calls, which works and is what every sample does.
 - **Cross-program database access** — one program attaching to another's
   database over a local channel, with keypair authentication and per-client
   rights.
@@ -341,8 +365,11 @@ as features you can use today:
 - **Compile-time metaprogramming** — `@derive(Json/Csv/Eq/…)` generated from a
   class's own metadata, no reflection.
 
-Known current limits worth naming: `net` is TCP host+port only; `proc.run` has
-no timeout or signal control; there is no stdin/stdout byte I/O and no FFI.
+Known current limits worth naming: `proc.run` has no timeout or signal control;
+there is no stdin/stdout byte I/O and no FFI; `map` lookup is a linear scan;
+actor mailboxes are bounded but there is no supervision tree yet; the WAL is
+append-only, so it grows and boot replays all of it; TLS is always a proxy's
+job.
 
 ---
 
diff --git a/compiler/README.md b/compiler/README.md
index 6ed42f2..2f043e3 100644
--- a/compiler/README.md
+++ b/compiler/README.md
@@ -2,7 +2,9 @@
 
 Lexer → parser → typechecker → ownership pass → bytecode emitter, for `.wo`. OCaml stdlib only (no Menhir, no ppx); dune is the build runner. Sibling of the C `wovm` bytecode VM ([`runtime/`](../runtime/README.md)) — the two halves of the OOP track's spec (`docs/superpowers/specs/2026-08-01-oop-compiler-vm-design.md`) meet at plan 3, where `woc`'s emitted `.wob` runs on `wovm`.
 
-**Stage: plan 3 (`docs/plan/compiler/2026-08-01-wob-emit-e2e-single-binary.md`) complete, Tasks 1–6 + 8** (Task 7, a parity harness against the Rust runtime, was deferred by explicit decision — the two stacks now diverge by design). `.wo` source compiles to `.wob` bytecode (`--emit`) and to a single self-contained executable (`build`) that runs `wovm` with no arguments and no repo-relative dependency. Milestone 1's acceptance gate — compile-time budget, the full conformance corpus under ASan, the single-binary smoke, both unit suites — is `just oop-accept`. Plan 2 (lexer through ownership pass) shipped first and is unchanged.
+**Stage: well past plan 3.** Plan 2 (lexer through ownership pass) and plan 3 (`docs/plan/compiler/2026-08-01-wob-emit-e2e-single-binary.md`, Tasks 1–6 + 8 — Task 7, a parity harness against the since-removed Rust runtime, was deferred by explicit decision) closed the milestone: `.wo` source compiles to `.wob` bytecode (`--emit`) and to a single self-contained executable (`build`) that runs `wovm` with no arguments and no repo-relative dependency. Milestone 1's acceptance gate — compile-time budget, the full conformance corpus under ASan, the single-binary smoke, both unit suites — is `just oop-accept`.
+
+Since then the front end has taken iterations **15** (`[deps]`, `wo.lock`, `--update-deps`), **17** (`kind = "library"`, entry-less check mode, `internal/` as WO-E108), **19** (`Float` and `Bytes`), **24** (`call`'s typed reply, WO-E226), **34** (digest builtins), **35** (net deadline seams), **36** (`not`, bitwise operators, hex/binary literals, compound assigns — `.wob` v6) and **37** (the backtick raw text literal with `{{ }}` auto-escaping). Current language surface: [`docs/guides/language-surface.md`](../docs/guides/language-surface.md). Current status: [the board](../docs/stories/00-status.md).
 
 ## Requirements
 
@@ -24,23 +26,30 @@ just woc-test    # same, from the repo root
 
 ```
 woc <path>                       # compile (lex, parse, typecheck, ownership-check); nothing prints on success
+woc <dir>                        # BUILDS instead, when <dir>/wo.toml exists — the primary mode
+woc version                      # e.g. "writeonce 0.1.0 linux/amd64"
+woc --emit <path> -o <out.wob>   # compile through to a .wob bytecode module, runnable by wovm
+woc build <dir> -o <app> [--runtime <path>]
+                                 # compile + append the .wob image to a copy of wovm (--runtime,
+                                 # else $WO_RUNTIME, a wovm beside this woc, or runtime/wovm)
+woc --update-deps <dir>          # re-fetch [deps] at their manifest revs, rewrite wo.lock
+woc -D <name> ...                # define a build flag for the #if/#else/#end token filter
 woc --dump-tokens <path>         # stdout: one line per lexed token
 woc --dump-ast <path>            # stdout: the declaration + body AST, indented
 woc --dump-owner <path>          # stdout: the ownership pass's four tables (moves, drops, rc, residual)
+woc --dump-gc <path>             # stdout: the inferred-GC pass's traced set
 woc --dump-bc <path>             # stdout: disassembled bytecode for every emitted method
-woc --emit <path> -o <out.wob>   # compile through to a .wob bytecode module, runnable by wovm
-woc build <dir> -o <app> [--runtime <path>]
-                                  # compile + append the .wob image to a copy of wovm (default
-                                  # runtime/wovm, or --runtime) into one self-contained <app>
 ```
 
-`<path>` is a single `.wo` file or a directory. A directory is discovered recursively for every `.wo` file under it — same contract as `wo run` (`crates/rt/src/lib.rs::discover`): dot-prefixed entries and `target`/`data`/`node_modules` are skipped, results are sorted by path. Every discovered file compiles as one program (declarations in one file resolve for bodies in another, regardless of discovery order); diagnostics from every file and every stage print sorted by `(file, line, col)`. For multi-file `--dump-*` output, each file's dump is preceded by a `=== path ===` header line (`compiler/src/dump.ml`'s `file_header`) — a single-file run never prints one.
+`woc <dir>` on a directory holding a `wo.toml` is the mode every sample and the install docs use: it reads the manifest's `name` plus the optional `[build]` runtime/target keys and produces `<target>/<name>` exactly as `woc build` would. A manifest with `kind = "library"` is checked entry-less and writes nothing.
+
+`<path>` is a single `.wo` file or a directory. A directory is discovered recursively for every `.wo` file under it: dot-prefixed entries and `target`/`data`/`node_modules` are skipped, results are sorted by path. Every discovered file compiles as one program (declarations in one file resolve for bodies in another, regardless of discovery order); diagnostics from every file and every stage print sorted by `(file, line, col)`. For multi-file `--dump-*` output, each file's dump is preceded by a `=== path ===` header line (`compiler/src/dump.ml`'s `file_header`) — a single-file run never prints one.
 
 Diagnostics render as `file:line:col: severity CODE: message` plus a source excerpt with a caret; every shipped code is cataloged in `docs/plan/oop-vm/01-error-catalog.md`. Exit codes: **0** clean compile, **1** diagnostics reported, **2** usage/IO failure.
 
 ## Layout
 
-- `src/` — one module per stage: `diag` (diagnostics, collector, exit-code decision), `token`/`lexer`, `ast`/`parser`, `types` (typechecker), `owner` (MVS ownership pass), `emit` (bytecode emitter, consumes `owner`'s four tables), `disasm` (bytecode disassembler, backs `--dump-bc`), `dump` (stable text dumps for all of the above)
+- `src/` — one module per stage: `diag` (diagnostics, collector, exit-code decision), `token`/`lexer`, `ast`/`parser`, `types` (typechecker), `gcinfer` (the inferred-GC pass, backs `--dump-gc`), `owner` (MVS ownership pass), `emit` (bytecode emitter, consumes `owner`'s four tables), `disasm` (bytecode disassembler, backs `--dump-bc`), `dump` (stable text dumps for all of the above)
 - `bin/` — the `woc` executable: CLI parsing, file discovery, the multi-file/cross-file driver, `--emit`/`build` output
 - `test/` — `runner.ml` (golden runner + CLI smoke) and `test_diag.ml` (diag.ml unit checks); `test/golden/<stage>/` holds one-file-per-fixture goldens (`tokens`, `ast`, `owner`, `owner-err`, `bc`); `test/fixtures/driver/` holds the multi-file CLI-smoke fixtures (directory discovery, cross-file symbols, diagnostic ordering) that don't fit the one-`.wo`-file-per-fixture golden shape
 
diff --git a/compiler/src/CODE-LOGIC.md b/compiler/src/CODE-LOGIC.md
index 4f8549e..b76bb12 100644
--- a/compiler/src/CODE-LOGIC.md
+++ b/compiler/src/CODE-LOGIC.md
@@ -295,3 +295,62 @@ a keyword, and visibility is name resolution at compile time.
   The `0x`/`0b` prefix commits only when a real base digit follows, so
   `0xg` stays `Int 0` + `Ident` — a parse error at its own position, no
   new lexer diagnostic. `_` separators are consumed only BETWEEN digits.
+
+## The raw text literal (iteration 37)
+
+Multi-line markup used to be impossible to write: a statement ends at a
+newline, so a page was one `h = h .. "<...>"` statement per line, every
+attribute single-quoted to dodge `\"`, and every piece of data wrapped
+in a hand-written `esc()` call. Backtick literals replace all three.
+Things worth knowing before editing them:
+
+- **It is a LEXER form, not a node.** A backtick literal emits exactly
+  the `Token.Str` (no holes) or `Token.InterpStr` (holes) a `"..."`
+  string emits, so `types.ml`, `owner.ml`, `emit.ml`, the `.wob` format
+  and the VM are all untouched — nothing downstream can tell the two
+  spellings apart. That is the whole reason the feature is small. A
+  design that introduced a `Markup`/`Element` AST variant instead would
+  have had to teach five files about it.
+- **No escape processing at all inside.** Quotes and backslashes are
+  content, which is the point. The cost is that the form cannot express
+  a literal backtick, a literal `${`, or a literal `{{` — those are
+  written by concatenating an ordinary `"..."` string with `..`. One
+  greppable door beats inventing an escape character for the one form
+  whose selling point is not having any. (`docs/examples/site/content.wo`
+  keeps two `code_block` samples as escaped `"..."` strings for exactly
+  this reason: they contain `\${`.)
+- **The margin is stripped at LEX time**, so the constant pool holds the
+  dedented text and there is no runtime cost. Java's text-block rule:
+  one newline right after the opening backtick is dropped, the smallest
+  leading whitespace run across non-blank lines is removed from every
+  line, and a whitespace-only closing line loses its whitespace but
+  keeps its newline. A literal with no newline is left alone — eating
+  the leading spaces of `` `  hi` `` would be a surprise, not a service.
+  The measuring pass runs over a SHADOW string where each hole is one
+  non-whitespace sentinel byte, so `    {{ x }}` counts as indent 4 and
+  as a non-blank line.
+- **`{{ e }}` desugars to `esc(${e})`, resolved by ordinary name
+  lookup.** `desugar_interp` in `parser.ml` builds a `Call` on an
+  `Ident "esc"` — precisely what a developer wrote by hand before. The
+  compiler learns nothing about HTML, `esc` stays writeonce-view's ordinary
+  `pub fn`, a typo'd field inside the hole is a normal name/type error,
+  and a locally defined `esc` shadows deliberately (a custom escaper is
+  a feature). `${ }` inside the same literal stays raw — that is the
+  greppable door for markup you built yourself. The one place the
+  desugar leaks: with no `esc` in scope the program fails on a name it
+  never typed, so `emit.ml`'s WO-E403 message carries a hint for that
+  one name.
+- **`{{` is special ONLY inside a backtick literal.** Inside `"..."` it
+  is still two braces, so CSS and JS text in existing samples lexes
+  byte-identically.
+- **WO-E005 closed a real hole.** The string scanner's catch-all used to
+  append a raw newline like any other byte, so a forgotten closing quote
+  silently swallowed the rest of the file with no diagnostic. Now the
+  scan stops at the newline WITHOUT consuming it — the `Newline` token
+  still terminates the statement, so recovery costs one line instead of
+  the file. The rt-parity silence for a plain unterminated string with
+  no newline is untouched, and `runner.ml` still pins it.
+- **The `..` line continuation stays.** A line ending in `..` still
+  swallows its newline. Raw literals took over the multi-line-markup job
+  that motivated it, but it remains the general way to spread a long
+  concatenation over several lines and has its own corpus fixture.
diff --git a/compiler/src/dump.ml b/compiler/src/dump.ml
index 95722d8..11ed6e2 100644
--- a/compiler/src/dump.ml
+++ b/compiler/src/dump.ml
@@ -34,6 +34,7 @@ let kind_label (k : Token.kind) : string =
     let part_str = function
       | Token.SText s -> Printf.sprintf "TEXT(%s)" s
       | Token.SExpr s -> Printf.sprintf "EXPR(%s)" s
+      | Token.SEsc s -> Printf.sprintf "ESC(%s)" s
     in
     Printf.sprintf "INTERP_STR(%s)" (String.concat "," (List.map part_str segs))
   | Token.KwType -> "KW_TYPE"
diff --git a/compiler/src/emit.ml b/compiler/src/emit.ml
index 32e9a45..5d1332c 100644
--- a/compiler/src/emit.ml
+++ b/compiler/src/emit.ml
@@ -3259,8 +3259,20 @@ and emit_call (p : pctx) (f : fstate) (v : views) ~(dst : int) ?expected (e : As
         | None ->
           if is_builtin_name name then emit_builtin p f v ~dst ?expected e name args
           else begin
+            (* iteration 37: `{{ e }}` in a raw text literal desugars to
+               a call to `esc`, so a program using that hole without an
+               `esc` in scope lands here with a name it never typed.
+               The caret is already on the literal; this says why. *)
+            let hint =
+              if name = "esc" then
+                " (a `{{ ... }}` hole calls it -- add `use html`, or \
+                 declare your own `fn esc(t: Text) -> Text`)"
+              else ""
+            in
             err p ~code:cannot_lower_code ~file:f.f_file ~pos:e.pos
-              ~message:(Printf.sprintf "call to `%s`, which is not a declared fn or a builtin" name);
+              ~message:
+                (Printf.sprintf "call to `%s`, which is not a declared fn or a builtin%s"
+                   name hint);
             put f (ins_abx op_loadk dst (const_int p 0))
           end)))
   | Field (base, mname) -> (
diff --git a/compiler/src/lexer.ml b/compiler/src/lexer.ml
index b9782ba..d5c4f72 100644
--- a/compiler/src/lexer.ml
+++ b/compiler/src/lexer.ml
@@ -55,6 +55,32 @@ let unknown_char_code = Diag.lexing_prefix ^ "01" (* WO-E001 *)
 let unterminated_escape_code = Diag.lexing_prefix ^ "02" (* WO-E002 *)
 let directive_code = Diag.lexing_prefix ^ "03" (* WO-E003: #if/#else/#end misuse *)
 
+(* iteration 37, the raw text literal (backtick-delimited, verbatim
+   content, no backslash escapes). Two codes, because the two shapes
+   are genuinely different situations:
+
+   WO-E004 — a raw literal that runs off the end of the file. Unlike a
+   plain "..." string (silent, rt parity, see above), this one IS
+   reported: multi-line is the raw literal's normal case, so a missing
+   closing backtick would otherwise swallow every remaining line of the
+   file with nothing to show for it. Reported at the OPENING backtick,
+   which is the only position that helps -- EOF tells the reader
+   nothing about which literal never closed.
+
+   WO-E005 — a raw newline inside a "..." or '...' string. This used to
+   be accepted silently: the string scanner's catch-all appended the
+   newline like any other byte, so a forgotten closing quote ate the
+   rest of the file with no diagnostic at all. Nothing in the repo ever
+   relied on it (zero of the .wo sources span a line inside quotes) and
+   the backtick literal is now the spelling for multi-line text, so the
+   accident becomes an error. The scan stops at the newline WITHOUT
+   consuming it, so the Newline token is still emitted and the
+   statement terminates -- one diagnostic, and the next line parses
+   normally instead of being swallowed. The rt-parity silence for a
+   plain unterminated string with no newline is untouched. *)
+let unterminated_raw_code = Diag.lexing_prefix ^ "04" (* WO-E004 *)
+let newline_in_string_code = Diag.lexing_prefix ^ "05" (* WO-E005 *)
+
 (* haxe-parity Task 8: build flags. `woc -D name` fills this before any
    tokenize call; undefined flags are false. A module-level ref because the
    compiler is a single-shot process — tests that care set it explicitly
@@ -269,6 +295,126 @@ let preprocess (collector : Diag.Collector.t) ~(file : string)
   go toks;
   List.rev !out
 
+(* ---- the raw literal's margin rule (iteration 37) -------------------
+
+   A render() body is written at its method's indentation, but that
+   indentation is an artifact of the SOURCE, not of the markup -- nobody
+   wants six leading spaces on every line of the served HTML. So the
+   common margin is removed here, at lex time: the constant pool holds
+   the dedented text, no downstream stage ever sees the source
+   indentation, and the whole rule costs nothing at run time.
+
+   The rule (Java's text blocks, which solved exactly this):
+     - one newline immediately after the opening backtick is dropped,
+       so the first markup line can start on its own line;
+     - the smallest leading run of spaces/tabs across all non-blank
+       lines is removed from every line (characters counted, tabs NOT
+       expanded -- mixing them is the author's problem, and expanding
+       would need a tab width the language does not have);
+     - a whitespace-only final line (the usual case: the closing
+       backtick sits on its own line) loses its whitespace but keeps
+       its newline.
+   A literal with no newline in it is left completely alone -- there is
+   no margin to speak of, and silently eating the leading spaces of
+   `  hi` would be a surprise, not a service.
+
+   Holes do not disturb any of this. A line's indentation is by
+   definition the run of whitespace at its start, and the only thing
+   that can split a line across segments is a hole, which ends that run
+   -- so an indentation run always lives whole inside one SText. The
+   measuring pass replaces each hole with a single non-whitespace
+   sentinel byte so that a line that is `    {{ x }}` correctly counts
+   as indent 4 and as NON-blank. *)
+
+let is_indent_char c = c = ' ' || c = '\t'
+
+let segments_shadow (segs : Token.str_part list) : string =
+  let b = Buffer.create 64 in
+  List.iter
+    (function
+      | Token.SText s -> Buffer.add_string b s
+      | Token.SExpr _ | Token.SEsc _ -> Buffer.add_char b '\001')
+    segs;
+  Buffer.contents b
+
+let min_indent (shadow : string) : int =
+  let m = ref max_int in
+  List.iter
+    (fun line ->
+      let n = String.length line in
+      let i = ref 0 in
+      while !i < n && is_indent_char line.[!i] do
+        incr i
+      done;
+      (* a blank (or whitespace-only) line never sets the margin *)
+      if !i < n && !i < !m then m := !i)
+    (String.split_on_char '\n' shadow);
+  if !m = max_int then 0 else !m
+
+let strip_margin (k : int) (segs : Token.str_part list) : Token.str_part list =
+  if k = 0 then segs
+  else begin
+    let at_line_start = ref true in
+    let one seg =
+      match seg with
+      | Token.SExpr _ | Token.SEsc _ ->
+        at_line_start := false;
+        seg
+      | Token.SText s ->
+        let n = String.length s in
+        let b = Buffer.create n in
+        let i = ref 0 in
+        while !i < n do
+          if !at_line_start then begin
+            let dropped = ref 0 in
+            while !dropped < k && !i < n && is_indent_char s.[!i] do
+              incr dropped;
+              incr i
+            done;
+            at_line_start := false
+          end
+          else begin
+            let c = s.[!i] in
+            Buffer.add_char b c;
+            if c = '\n' then at_line_start := true;
+            incr i
+          end
+        done;
+        Token.SText (Buffer.contents b)
+    in
+    (* fold_left, not List.map: `one` carries state across segments and
+       List.map's application order is unspecified. *)
+    List.rev (List.fold_left (fun acc seg -> one seg :: acc) [] segs)
+  end
+
+let drop_trailing_margin (segs : Token.str_part list) : Token.str_part list =
+  match List.rev segs with
+  | Token.SText s :: rest_rev ->
+    let n = String.length s in
+    let i = ref n in
+    while !i > 0 && is_indent_char s.[!i - 1] do
+      decr i
+    done;
+    (* only a run that directly follows a newline is a closing line *)
+    if !i < n && !i > 0 && s.[!i - 1] = '\n' then
+      List.rev (Token.SText (String.sub s 0 !i) :: rest_rev)
+    else segs
+  | _ -> segs
+
+let dedent (segs : Token.str_part list) : Token.str_part list =
+  let shadow = segments_shadow segs in
+  if not (String.contains shadow '\n') then segs
+  else begin
+    let segs =
+      match segs with
+      | Token.SText s :: rest when String.length s > 0 && s.[0] = '\n' ->
+        Token.SText (String.sub s 1 (String.length s - 1)) :: rest
+      | _ -> segs
+    in
+    let k = min_indent (segments_shadow segs) in
+    drop_trailing_margin (strip_margin k segs)
+  end
+
 let tokenize (collector : Diag.Collector.t) ~(file : string) (src : string) :
     Token.t list =
   let lx = make src in
@@ -279,6 +425,14 @@ let tokenize (collector : Diag.Collector.t) ~(file : string) (src : string) :
     | { Token.kind = Token.Newline; _ } :: _ -> true
     | _ -> false
   in
+  (* A line ending in `..` continues on the next line — the ONE newline
+     suppression in the language, so multi-line markup/text builds read
+     as one expression (the shop template's ask; story 37 rides it). *)
+  let last_is_dotdot () =
+    match !out with
+    | { Token.kind = Token.DotDot; _ } :: _ -> true
+    | _ -> false
+  in
   let report_unknown line col c =
     Diag.Collector.add collector
       (Diag.error ~code:unknown_char_code ~file ~line ~col
@@ -289,6 +443,18 @@ let tokenize (collector : Diag.Collector.t) ~(file : string) (src : string) :
       (Diag.error ~code:unterminated_escape_code ~file ~line ~col
          ~message:"unterminated string escape" ())
   in
+  let report_unterminated_raw line col =
+    Diag.Collector.add collector
+      (Diag.error ~code:unterminated_raw_code ~file ~line ~col
+         ~message:"unterminated raw text literal" ())
+  in
+  let report_newline_in_string line col =
+    Diag.Collector.add collector
+      (Diag.error ~code:newline_in_string_code ~file ~line ~col
+         ~message:
+           "newline in string literal (use a `...` raw text literal for \
+            multi-line text)" ())
+  in
   let running = ref true in
   while !running do
     match peek lx with
@@ -307,7 +473,8 @@ let tokenize (collector : Diag.Collector.t) ~(file : string) (src : string) :
       end
       else if c = '\n' then begin
         ignore (advance lx);
-        if not (last_is_newline ()) then emit Token.Newline line col
+        if not (last_is_newline ()) && not (last_is_dotdot ()) then
+          emit Token.Newline line col
       end
       else if c = ' ' || c = '\t' || c = '\r' then ignore (advance lx)
       else if c = '"' || c = '\'' then begin
@@ -374,6 +541,13 @@ let tokenize (collector : Diag.Collector.t) ~(file : string) (src : string) :
             | None ->
               report_unterminated_escape esc_line esc_col;
               scanning := false)
+          | Some '\n' ->
+            (* WO-E005. Deliberately NOT consumed: the outer loop turns
+               it into the Newline token that terminates the statement,
+               so recovery is one bad line rather than the rest of the
+               file. *)
+            report_newline_in_string lx.line lx.col;
+            scanning := false
           | Some other ->
             ignore (advance lx);
             Buffer.add_char buf other
@@ -384,6 +558,64 @@ let tokenize (collector : Diag.Collector.t) ~(file : string) (src : string) :
         | [ Token.SText s ] -> emit (Token.Str s) line col
         | segs -> emit (Token.InterpStr segs) line col)
       end
+      else if c = '`' then begin
+        (* iteration 37: the raw text literal. Everything up to the
+           closing backtick is content -- newlines included, and with NO
+           escape processing at all, which is the whole point: markup
+           carries quotes and backslashes verbatim. A literal backtick
+           (or a literal `{{`) is written by concatenating an ordinary
+           "..." string with `..`; that door is one greppable operator,
+           which beats inventing an escape character for the one form
+           whose selling point is not having any.
+
+           Two hole forms, and ONLY here -- inside "..." a `{{` is still
+           two literal braces, so existing CSS/JS text is untouched:
+             ${ expr }   raw, exactly like a "..." string's hole
+             {{ expr }}  HTML-escaped (the parser wraps it in esc()) *)
+        ignore (advance lx);
+        let buf = Buffer.create 64 in
+        let parts = ref [] in
+        let flush_text () =
+          parts := Token.SText (Buffer.contents buf) :: !parts;
+          Buffer.clear buf
+        in
+        let scanning = ref true in
+        while !scanning do
+          match peek lx with
+          | None ->
+            report_unterminated_raw line col;
+            scanning := false
+          | Some '`' ->
+            ignore (advance lx);
+            scanning := false
+          | Some '$' when peek_at lx 1 = Some '{' ->
+            flush_text ();
+            ignore (advance lx);
+            ignore (advance lx);
+            parts := Token.SExpr (read_interp_expr lx) :: !parts
+          | Some '{' when peek_at lx 1 = Some '{' ->
+            flush_text ();
+            ignore (advance lx);
+            ignore (advance lx);
+            (* read_interp_expr stops at the first `}` at depth 0 and
+               consumes it -- the second one closes this hole. Reusing it
+               means brace depth and nested string literals are already
+               handled, so `{{ Point{x:1}.x }}` scans correctly. *)
+            let raw = read_interp_expr lx in
+            (match peek lx with
+            | Some '}' -> ignore (advance lx)
+            | _ -> report_unterminated_raw line col);
+            parts := Token.SEsc raw :: !parts
+          | Some other ->
+            ignore (advance lx);
+            Buffer.add_char buf other
+        done;
+        flush_text ();
+        (match dedent (List.rev !parts) with
+        | [] -> emit (Token.Str "") line col
+        | [ Token.SText s ] -> emit (Token.Str s) line col
+        | segs -> emit (Token.InterpStr segs) line col)
+      end
       else if is_digit c then begin
         (* iteration 19: one scanner for both numeric worlds. The integer run
            is scanned into a buffer as well as accumulated, because a fraction
diff --git a/compiler/src/parser.ml b/compiler/src/parser.ml
index c1ecff0..8734d82 100644
--- a/compiler/src/parser.ml
+++ b/compiler/src/parser.ml
@@ -1332,6 +1332,19 @@ and parse_primary (st : state) : Ast.expr =
 and desugar_interp (st : state) (pos : Ast.pos) (segs : Token.str_part list) : Ast.expr =
   let mk_str s = { Ast.id = fresh_id st; pos; kind = Ast.StrLit s } in
   let mk_interp inner = { Ast.id = fresh_id st; pos; kind = Ast.Interp inner } in
+  (* iteration 37: `{{ e }}` in a raw text literal IS `esc(${e})` -- the
+     desugar builds exactly the call a developer writes by hand today
+     (docs/examples/shop/**/view.wo used `${esc(...)}` throughout), so
+     every later stage sees only Call/Interp/StrLit/Concat nodes it
+     already handles. No new AST variant, no new builtin, no VM change,
+     and a typo'd field inside the hole is an ordinary name/type error.
+     `esc` resolves by ordinary lookup (wo-html's `pub fn esc`, in scope
+     after `use html`); a locally defined `esc` shadows it deliberately
+     -- a custom escaper is a feature, not a collision. *)
+  let mk_esc inner =
+    let callee = { Ast.id = fresh_id st; pos; kind = Ast.Ident "esc" } in
+    { Ast.id = fresh_id st; pos; kind = Ast.Call (callee, [ mk_interp inner ]) }
+  in
   let parse_segment_expr (raw : string) : Ast.expr =
     let sub_collector = Diag.Collector.create () in
     let sub_toks = Lexer.tokenize sub_collector ~file:st.file raw in
@@ -1362,7 +1375,8 @@ and desugar_interp (st : state) (pos : Ast.pos) (segs : Token.str_part list) : A
       (function
         | Token.SText "" -> None
         | Token.SText s -> Some (mk_str s)
-        | Token.SExpr raw -> Some (mk_interp (parse_segment_expr raw)))
+        | Token.SExpr raw -> Some (mk_interp (parse_segment_expr raw))
+        | Token.SEsc raw -> Some (mk_esc (parse_segment_expr raw)))
       segs
   in
   match parts with
diff --git a/compiler/src/token.ml b/compiler/src/token.ml
index 5f71a0c..bf9515b 100644
--- a/compiler/src/token.ml
+++ b/compiler/src/token.ml
@@ -23,6 +23,13 @@
 type str_part =
   | SText of string (* literal text, escapes already applied *)
   | SExpr of string (* raw, unlexed source of one `${...}`'s body *)
+  (* iteration 37: the escaping half of the raw text literal. Same raw,
+     unlexed payload as SExpr -- what differs is only what the parser
+     wraps it in: `${...}` desugars to a bare Interp, `{{...}}` to an
+     `esc(Interp ...)` call. Produced ONLY by a backtick raw literal;
+     inside a "..." string `{{` stays two literal braces, so CSS and JS
+     text in existing samples lexes byte-identically. *)
+  | SEsc of string (* raw, unlexed source of one `{{...}}`'s body *)
 
 type kind =
   (* literals *)
diff --git a/compiler/test/golden/ast/raw-literal.expected b/compiler/test/golden/ast/raw-literal.expected
new file mode 100644
index 0000000..babebc8
--- /dev/null
+++ b/compiler/test/golden/ast/raw-literal.expected
@@ -0,0 +1,2 @@
+1:1 METHOD page(name: Text) -> Text
+  2:3 RETURN "<p>" .. INTERP(name) .. esc(INTERP(name)) .. "</p>"
diff --git a/compiler/test/golden/ast/raw-literal.wo b/compiler/test/golden/ast/raw-literal.wo
new file mode 100644
index 0000000..2d095f8
--- /dev/null
+++ b/compiler/test/golden/ast/raw-literal.wo
@@ -0,0 +1,3 @@
+fn page(name: Text) -> Text {
+  return `<p>${name}{{ name }}</p>`
+}
diff --git a/compiler/test/golden/tokens/raw-literal.expected b/compiler/test/golden/tokens/raw-literal.expected
new file mode 100644
index 0000000..163611a
--- /dev/null
+++ b/compiler/test/golden/tokens/raw-literal.expected
@@ -0,0 +1,42 @@
+1:71 NEWLINE
+4:1 KW_FN
+4:4 IDENT(page)
+4:8 LPAREN
+4:9 IDENT(name)
+4:13 COLON
+4:15 IDENT(Text)
+4:19 RPAREN
+4:21 ARROW
+4:24 IDENT(Text)
+4:29 LBRACE
+4:30 NEWLINE
+5:3 KW_LET
+5:7 IDENT(one)
+5:11 EQ
+5:13 STR(<div>hi</div>)
+5:28 NEWLINE
+6:3 KW_LET
+6:7 IDENT(verbatim)
+6:16 EQ
+6:18 STR(a"b\n)
+6:25 NEWLINE
+7:3 KW_LET
+7:7 IDENT(block)
+7:13 EQ
+7:15 STR(<div class="card">
+  many
+  line
+</div>
+)
+12:4 NEWLINE
+13:3 KW_LET
+13:7 IDENT(holes)
+13:13 EQ
+13:15 INTERP_STR(TEXT(<p>),EXPR(name),TEXT(),ESC( name ),TEXT(</p>))
+13:41 NEWLINE
+14:3 KW_RETURN
+14:10 IDENT(block)
+14:15 NEWLINE
+15:1 RBRACE
+15:2 NEWLINE
+16:1 EOF
diff --git a/compiler/test/golden/tokens/raw-literal.wo b/compiler/test/golden/tokens/raw-literal.wo
new file mode 100644
index 0000000..5680827
--- /dev/null
+++ b/compiler/test/golden/tokens/raw-literal.wo
@@ -0,0 +1,15 @@
+-- iteration 37: the backtick raw text literal. One token per literal,
+-- content verbatim (no escape processing), common margin removed at
+-- lex time, two hole forms -- ${} raw and {{}} escaped.
+fn page(name: Text) -> Text {
+  let one = `<div>hi</div>`
+  let verbatim = `a"b\n`
+  let block = `
+    <div class="card">
+      many
+      line
+    </div>
+  `
+  let holes = `<p>${name}{{ name }}</p>`
+  return block
+}
diff --git a/compiler/test/runner.ml b/compiler/test/runner.ml
index 61c8875..10e969d 100644
--- a/compiler/test/runner.ml
+++ b/compiler/test/runner.ml
@@ -236,6 +236,128 @@ let () =
   check "dash-continuation: a - b (spaced) lexes as Ident, Dash, Ident"
     (kinds = [ Token.Ident "a"; Token.Dash; Token.Ident "b"; Token.Eof ])
 
+(* ---- raw text literal, iteration 37 (not golden-diffed) ------------
+
+   golden/tokens/raw-literal.wo pins the token STREAM; these pin the
+   pieces a dump cannot show: that a backtick literal with no holes is
+   byte-identical to the Str a "..." string would have produced, that
+   the common margin is removed at LEX time (so no runtime cost and no
+   downstream stage ever sees the source indentation), and that the two
+   new diagnostics fire at the right position. *)
+
+let () =
+  let collector = Diag.Collector.create () in
+  let toks = Lexer.tokenize collector ~file:"raw.wo" "let t = `<div>hi</div>`" in
+  let kinds = List.map (fun (t : Token.t) -> t.kind) toks in
+  check "raw literal: no holes lexes as a plain Str"
+    (kinds
+    = [ Token.KwLet; Token.Ident "t"; Token.Eq; Token.Str "<div>hi</div>"; Token.Eof ]);
+  check_eq "raw literal: reports nothing" ~expected:0
+    ~actual:(List.length (Diag.Collector.diagnostics collector))
+    string_of_int
+
+let () =
+  (* Nothing between the backticks is escape-processed: a quote is a
+     quote and a backslash-n is two characters, which is the whole
+     point of the form: markup without quote-escape noise. *)
+  let collector = Diag.Collector.create () in
+  let toks = Lexer.tokenize collector ~file:"raw.wo" "`a\"b\\n`" in
+  let kinds = List.map (fun (t : Token.t) -> t.kind) toks in
+  check "raw literal: content is verbatim, no escape processing"
+    (kinds = [ Token.Str "a\"b\\n"; Token.Eof ])
+
+let () =
+  (* The margin case, written the way a render() body actually is:
+     opening newline dropped, the 4-space common margin removed from
+     every line, the whitespace-only closing line reduced to nothing
+     while its newline survives (Java text-block behavior). *)
+  let src = "let t = `\n    <div>\n      many\n    </div>\n  `" in
+  let collector = Diag.Collector.create () in
+  let toks = Lexer.tokenize collector ~file:"raw.wo" src in
+  let kinds = List.map (fun (t : Token.t) -> t.kind) toks in
+  check "raw literal: common margin stripped, leading newline dropped"
+    (kinds
+    = [
+        Token.KwLet;
+        Token.Ident "t";
+        Token.Eq;
+        Token.Str "<div>\n  many\n</div>\n";
+        Token.Eof;
+      ])
+
+let () =
+  (* Both hole forms in one literal. The payloads are raw and unlexed,
+     exactly as SExpr has always carried `${...}` -- the parser is what
+     tells them apart (SEsc gains the esc() wrapper). *)
+  let collector = Diag.Collector.create () in
+  let toks = Lexer.tokenize collector ~file:"raw.wo" "`<p>${a}{{ b }}</p>`" in
+  let kinds = List.map (fun (t : Token.t) -> t.kind) toks in
+  check "raw literal: ${} stays raw, {{}} becomes SEsc"
+    (kinds
+    = [
+        Token.InterpStr
+          [
+            Token.SText "<p>";
+            Token.SExpr "a";
+            (* the empty run between two adjacent holes, exactly as a
+               "..." string has always produced it -- the parser drops
+               empty SText segments in desugar_interp *)
+            Token.SText "";
+            Token.SEsc " b ";
+            Token.SText "</p>";
+          ];
+        Token.Eof;
+      ])
+
+let () =
+  (* Unlike a plain "..." string, an unterminated raw literal is an
+     error: multi-line is its normal case, so silently swallowing the
+     rest of the file would be a footgun, not rt parity. *)
+  let collector = Diag.Collector.create () in
+  let toks = Lexer.tokenize collector ~file:"raw.wo" "let t = `abc" in
+  let kinds = List.map (fun (t : Token.t) -> t.kind) toks in
+  check "unterminated raw literal: closes with what was collected"
+    (kinds = [ Token.KwLet; Token.Ident "t"; Token.Eq; Token.Str "abc"; Token.Eof ]);
+  let diags = Diag.Collector.diagnostics collector in
+  check_eq "unterminated raw literal: exactly one diagnostic reported" ~expected:1
+    ~actual:(List.length diags) string_of_int;
+  match diags with
+  | [ d ] ->
+    check "unterminated raw literal: WO-E004 at the backtick (line 1, col 9)"
+      (d.code = "WO-E004" && d.site.line = 1 && d.site.col = 9)
+  | _ -> check "unterminated raw literal: diagnostic shape" false
+
+let () =
+  (* A raw newline inside "..." used to be accepted silently (the
+     scanner's catch-all appended it like any other byte), which meant a
+     forgotten closing quote ate the rest of the file with no
+     diagnostic. Now that the backtick literal is the blessed spelling
+     for multi-line text, that newline is an error and the scan stops
+     WITHOUT consuming it, so the Newline token still terminates the
+     statement and the next line parses normally. *)
+  let collector = Diag.Collector.create () in
+  let toks = Lexer.tokenize collector ~file:"nl.wo" "let t = \"ab\ncd" in
+  let kinds = List.map (fun (t : Token.t) -> t.kind) toks in
+  check "newline in string: scan stops at the newline, which still tokenizes"
+    (kinds
+    = [
+        Token.KwLet;
+        Token.Ident "t";
+        Token.Eq;
+        Token.Str "ab";
+        Token.Newline;
+        Token.Ident "cd";
+        Token.Eof;
+      ]);
+  let diags = Diag.Collector.diagnostics collector in
+  check_eq "newline in string: exactly one diagnostic reported" ~expected:1
+    ~actual:(List.length diags) string_of_int;
+  match diags with
+  | [ d ] ->
+    check "newline in string: WO-E005 at the newline (line 1, col 12)"
+      (d.code = "WO-E005" && d.site.line = 1 && d.site.col = 12)
+  | _ -> check "newline in string: diagnostic shape" false
+
 (* ---- direct parser/AST assertions (Task 4, not golden-diffed) ------------
 
    golden/ast/*.wo fixtures already pin the AST *shape* via --dump-ast,
diff --git a/docs/00-code-review.md b/docs/00-code-review.md
index 8123503..e610a6b 100644
--- a/docs/00-code-review.md
+++ b/docs/00-code-review.md
@@ -18,6 +18,12 @@ Native speed — the big one. Everything is interpreted: ~40× behind Go on raw
 
 ## Verification 2026-08-20
 
+> **Read the 2026-08-26 re-verification at the bottom before quoting anything
+> from this section.** Eight of its rows have since been overtaken by shipped
+> work. The section is kept as written — it is a dated measurement, and
+> rewriting it would destroy the record of what was true when the iteration
+> order was re-sequenced against it.
+
 Every claim above was checked against the tree. **26 of 27 hold. One number
 does not, and two problems are worse than stated.**
 
@@ -79,7 +85,7 @@ the number or produce the benchmark.
 | 22's battery never run | 22 is ⬜ "needs a spec first"; no `bench/baseline.json`, no `just db-bench`; `runtime/bench/` is the retired C prototype's harness |
 | TSan covers one demo | only `scripts/fibers-accept.sh` builds and runs `wovm_tsan` |
 | no fuzzing, no CI | no `.github/`, no fuzz target |
-| one framework, five samples, one consumer | exact: `writeonce-framework`; employee, employee-list, fibers, gc-cycle, log-watcher; `web-app` |
+| one framework, five samples, one consumer | exact: `writeonce-serve`; employee, employee-list, fibers, gc-cycle, log-watcher; `web-app` |
 
 ### Consequence
 
@@ -87,3 +93,41 @@ The iteration order in
 [`stories/language-runtime-database/00-story.md`](stories/language-runtime-database/00-story.md)
 was re-sequenced against these findings on 2026-08-20 — Seq only, no `#`
 renumbered, no file moved. See that table's second re-sequencing note.
+
+---
+
+## Re-verification 2026-08-26
+
+Re-run against the tree, reading source rather than documents. **Eight rows
+have been overtaken by shipped work; the rest still hold.** Overtaken:
+
+| 2026-08-20 row | What the source says now |
+| --- | --- |
+| "no `Float`, no `Bytes`" | `types.ml`'s `builtin_scalars` is `["Int"; "Bool"; "Text"; "Timestamp"; "Id"; "Float"; "Bytes"]` — iteration 19, plus the `float`/`trunc` bridges and the `bytes_*`/`base64_*` builtins |
+| "`send` is one-way — `WO_B_SEND=69` is the last builtin (`WO_B_MAX 69u`)" | `WO_B_MAX` is `95u`; `WO_B_CALL = 88` is a send that parks the caller for a typed scalar reply (iteration 24, WO-E226) |
+| "no crypto primitives" | `WO_B_SHA1 = 85`, `WO_B_SHA256 = 86`, `WO_B_HMAC_SHA256 = 87`; `runtime/src/crypto.c`, vector-accepted in `test_crypto.c` (iteration 34) |
+| "unbounded mailboxes, no backpressure" | mailboxes are capped (`WO_MAILBOX`, default 1024) with a sender-side reserve and a catchable `WO_T_ACTOR` trap on overflow |
+| "no supervision, links, actor death" | **partly** overtaken: actor death landed with `call` — a dead or mid-call callee traps the caller instead of hanging it. `monitor` (id 89) and `time.after` (id 90) are still literal holes in the builtin enum; supervision trees remain absent |
+| "22's battery never run — no `bench/baseline.json`, no `just db-bench`" | `bench/baseline.json` exists with the campaign's metrics, `just db-bench`/`db-bench-quick` are recipes, `bench/results/` holds the runs, iteration 22 is done |
+| "no fuzzing, **no CI**" | `.github/workflows/release.yml` builds, verifies and publishes on a `v*` tag. Fuzzing is still absent, and CI is release-only — nothing runs the gates per change, which is iteration 30's remaining half |
+| "one framework, five samples, one consumer" | two libraries (`writeonce-serve`, `writeonce-view`) and 13 samples, 8 of them gated |
+| "The multi-shard DB gap is structural" (Understated) | closed by the arc's stage 3: the string `"database engine not initialized"` no longer exists in `runtime/src/`, worker statements marshal to the owner shard, and `just db-actor` gates it |
+
+Still true, re-checked at the source: interpreted-only with no JIT and no SIMD;
+the ceilings correction (`WO_STACK_SLOTS 4096`, `WO_MAX_REGS 64`,
+`WO_MAX_FRAMES 256`, `WO_MAX_SHARDS 64`); no generics beyond `multi`/`map`; no
+closures or function values; byte strings with no Unicode awareness; traps and
+`try` instead of Result values; `switch` without destructuring; round-robin
+placement with no work stealing; no timers beyond `time.sleep`; no TLS; no
+HTTP/2; observability is `print`/stderr with no counters, tracing or profiler; no
+debugger and no LSP; deps are git-rev-only with no registry, semver or transitive
+resolution; blue-green and migrations are futures; TSan covers one demo. And
+**`map<K,V>` lookup is still a linear scan** — `runtime/src/cont.h` says so in
+its own header comment, which keeps it the compute problem this document argued
+it was.
+
+Two capability gaps this re-run named that the original critique did not, now
+[iteration 38](stories/language-runtime-database/38-content-platform-capabilities.md):
+`fs` has six builtins (ids 40–45) and can create, grow and read a file but never
+replace, truncate, delete or rename one; and there is no `net.connect` anywhere
+in `runtime/src/`, so no program can open an outbound connection.
diff --git a/docs/00-dependency-graph.md b/docs/00-dependency-graph.md
index a610c6d..4f02db7 100644
--- a/docs/00-dependency-graph.md
+++ b/docs/00-dependency-graph.md
@@ -6,8 +6,12 @@
 > to pick the next implementation: anything whose incoming arrows are all
 > green is startable today. Rebuilt 2026-08-20 from a sweep of every
 > story/spec/plan markdown (the "misses" pass: iteration 17's outgoing
-> edges, the concurrency chain, the post-12 parked drain, 9b→10,
-> 14's gap fan-out, 20's fiber caveat).
+> edges, the concurrency chain, the parked drain, 9b→25, 28's gap
+> fan-out, 20's fiber caveat), and **refreshed 2026-08-26** against the
+> code and the story frontmatter: graph 1 had drifted a generation
+> behind — it still showed 17 parked and 18 as next, and it used the
+> pre-renumber ids 10/12/13/14 for what are now stories 25/26/29/28. All
+> iterations through 38 are now nodes.
 
 ## 1. Story iterations
 
@@ -26,23 +30,36 @@ flowchart TD
     I15["15 deps package manager"]:::done
     I16["16 web framework v1 core"]:::done
 
-    I17["17 library kind + internal/ (PARKED — spec+plan ready, branch library-internal)"]:::parked
-    FWREORG["framework internal/ reorg + check mode (kills the --emit workaround; WO-E108/E109 reserved)"]:::parked
-    I18["18 framework v2: transaction{} + cache/flags/jobs (spec APPROVED — the next implementation)"]:::specd
+    I17["17 library kind + internal/ ✅ 2026-08-20"]:::done
+    FWREORG["framework internal/ reorg + check mode ✅ landed with 17 (WO-E108/E109 shipped)"]:::done
+    I19["19 Float + Bytes ✅ 2026-08-20"]:::done
+    I37["37 wo-html components + raw text literal ✅ 2026-08-25"]:::done
+    I35["35 net runtime seams ✅ 2026-08-23"]:::done
+    I36["36 operator parity: not/bitwise/hex literals — code landed 2026-08-22, awaiting the manual pass"]:::specd
+    RELEASE["packaging + release pipeline ✅ 2026-08-25 (no story: VERSION, just dist, install-accept, release.yml)"]:::done
 
-    I9c["20 cross-program tables (half-built)"]:::open
-    I9d["21 keypair attach auth (half-built; crypto+handshake already on its branch)"]:::open
+    I18["18 framework v2: transaction{} + cache/flags/jobs (⏸ hold 2026-08-21; spec+plan approved, held intact)"]:::parked
+
+    I9c["20 cross-program tables (⏸ hold 2026-08-21; channel half-built)"]:::parked
+    I9d["21 keypair attach auth (⏸ hold 2026-08-21; crypto floor now exists via 34)"]:::parked
     I9e["22 durability + throughput baseline ✅ 2026-08-21"]:::done
     I8["8 shard-actor runtime ✅ 2026-08-21"]:::done
+    I24["24 chat + actor lifecycle 🔄 THE LIVE SLICE (absorbing 31 + 34)"]:::specd
+    I34["34 crypto builtins ✅ code landed as 24's T1 (ids 85-87)"]:::done
+    I31["31 actor lifecycle — call/mailbox-cap/death landed in 24; monitor + time.after (ids 89/90) open"]:::specd
     I9f["23 io_uring group-commit"]:::open
-    I10["10 HTTP service layer (lowers onto the framework)"]:::open
+    I32["32 WAL checkpoint (append-only today; bounds replay)"]:::open
+    I33["33 single-file store WO_DATA=<path>.db (driver-only, off-chain)"]:::open
+    I25["25 HTTP service layer — `service` blocks (⏸ hold 2026-08-21; story file removed, plan remains)"]:::parked
     I11["11 fibers ✅ 2026-08-21"]:::done
-    I12["12 blue-green deploy"]:::open
-    I13["13 metaprogramming @derive"]:::open
-    I14["14 skillhost workload (demoted)"]:::open
-    I9g["27 query grammar corpus (likely collapses)"]:::open
-    GAPS["14's gap fan-out: bounded subprocess, stdin/stdout transport, fs metadata, FFI-vs-out-of-process"]:::open
-    DRAIN["post-12 parked drain: pub(read)/using/#if, WO-E225, ADT roster, group-by"]:::parked
+    I26["26 blue-green deploy (⏸ hold)"]:::parked
+    I29["29 metaprogramming @derive (⏸ hold)"]:::parked
+    I28["28 skillhost workload (⏸ hold; demoted)"]:::parked
+    I38["38 content platform capabilities: fs mutation verbs + net.connect"]:::open
+    I9g["27 query grammar corpus (⏸ hold; likely collapses)"]:::parked
+    I30["30 observability, CI, fuzz — release-only CI exists; per-change gates + fuzz open (no story file)"]:::open
+    GAPS["28's gap fan-out: bounded subprocess, stdin/stdout transport, fs metadata, FFI-vs-out-of-process"]:::open
+    DRAIN["parked drain, what is LEFT of it: WO-E225 roster, ADT roster, group-by aggregates"]:::parked
 
     FOUND --> I7
     FOUND --> I9
@@ -53,34 +70,53 @@ flowchart TD
     I15 --> I17
     I16 --> I17
     I17 --> FWREORG
+    I16 --> I37
+    I19 --> I37
+    I17 --> RELEASE
     I9 --> I18
     I16 --> I18
     I9 --> I9c
     I9c --> I9d
-    I9c --> I10
-    I9b --> I10
-    I16 --> I10
+    I9c --> I25
+    I9b --> I25
+    I16 --> I25
     I9b --> I9e
     I7b --> I8
     I9e --> I9f
     I8 --> I9f
     I8 --> I11
-    I9 --> I12
-    I10 --> I12
-    I9g --> I14
-    I7 --> I14
-    I14 --> GAPS
-    I12 -.scope directive.-> I13
-    I12 -.scope directive.-> DRAIN
+    I19 --> I34
+    I34 --> I24
+    I8 --> I24
+    I11 --> I24
+    I35 --> I24
+    I31 --- I24
+    I9f --> I32
+    I32 --- I33
+    I9 --> I26
+    I25 --> I26
+    I9g --> I28
+    I7 --> I28
+    I28 --> GAPS
+    I16 --> I38
+    I32 --> I38
+    I36 -.reopens the pure-wo HMAC question.-> I34
+    I26 -.scope directive.-> I29
+    I26 -.scope directive.-> DRAIN
 ```
 
-Reading it: **18 is the only spec-approved open node with all
-prerequisites green — the next implementation.** After 18: 20/21 and 22
-are startable (chosen order: 20/21 first — half-built branches rot).
-17 unparks on directive: its prerequisites landed, its spec+plan wait on
-branch `library-internal`, and its landing brings the framework reorg
-node with it. 13 and the parked drain sit behind 12 by the 2026-08-08
-scope directive (dashed), not by any technical edge.
+Reading it: **the live slice is 24** (chat + actor lifecycle, absorbing 31
+and 34), and the chain behind it is 23 → 32. Everything else with all-green
+incoming arrows is startable: **33** (driver-only, off-chain), **38** (the
+fs-mutation and outbound-socket gaps), and **30**'s remaining half
+(per-change CI and fuzzing — the release pipeline covered only publishing).
+**36** needs no work, only the developer's manual pass over
+`docs/examples/operators/`. The held tail — 18, 20/21, 25, 26, 27, 28, 29 —
+resumes on its own precedence notes; 29 and what is left of the drain still
+sit behind 26 by the 2026-08-08 scope directive (dashed), not by any
+technical edge. Note what left the drain: `pub(read)`, `using` and `#if` all
+shipped, so only the WO-E225/ADT rosters and group-by aggregates remain in
+it.
 
 ## 2. The concurrency chain (iterations 8 / 23 / 11 and everything they gate)
 
diff --git a/docs/00-doc-audit.md b/docs/00-doc-audit.md
new file mode 100644
index 0000000..e474c1e
--- /dev/null
+++ b/docs/00-doc-audit.md
@@ -0,0 +1,535 @@
+# Documentation truth audit — 2026-08-26
+
+> **Status: findings resolved 2026-08-26, same day.** Every section below was
+> acted on; see [What was fixed](#what-was-fixed) at the end for the
+> disposition of each, including **one row where this audit was wrong and the
+> document it accused was right** (B3's `WO-W201` claim). The findings are kept
+> as written — a fix list whose findings have been edited away cannot be
+> checked. `just linkcheck` went from 77 broken paths to 23, and all 23 that
+> remain are in `.dev/`, which this repo does not author.
+>
+> A separate structural directive landed the same day and **removed the status
+> folders** (`done/`, `refine/`, `hold/`, `in-progress/`) — status now lives only
+> in frontmatter. Paths of the form `…/done/NN-*.md` quoted in the findings below
+> were correct when written and no longer resolve; see
+> [Structural change 2026-08-26](#structural-change-2026-08-26--status-folders-removed).
+
+Scope: every `*.md` that documents THIS repo — root `README.md`, the numbered
+`docs/0*.md`, `docs/guides/`, `docs/stories/`, `docs/plan/`, `docs/examples/`,
+`docs/superpowers/`, the code-directory READMEs and `CODE-LOGIC.md` files,
+`tests/corpus/README.md`, `bench/compare/go-sqlite/README.md`,
+`scripts/install-readme.tmpl.md`, `.claude/agents/database-developer.md`.
+
+Excluded, and why: `.dev/skills/` (vendored copies of plugin skills, not ours),
+`.dev/reference/` (other people's codebases), `.superpowers/sdd/` (dated task
+reports — snapshots, correct as history).
+
+Method: claims were checked against the tree, not read off prose. `woc`
+(`compiler/_build/default/bin/woc`) and `wovm` (`runtime/wovm`), both built
+2026-08-25, were run against every sample; `justfile` recipes, `wob.h`
+constants, `types.ml`'s builtin tables, story frontmatter and
+`scripts/linkcheck.py` were used as ground truth. Nothing in this report is
+inferred from another document.
+
+Verdict: **the deep reference docs are in good shape; the front door is not.**
+`docs/guides/language-surface.md`, `docs/plan/oop-vm/08-builtin-surface.md`, the
+three `CODE-LOGIC.md` files and the status board's tables track the code
+closely. The root `README.md`, `runtime/README.md`, `docs/00-code-review.md`,
+`docs/00-dependency-graph.md` and two example status banners describe a repo
+that stopped existing between one and six weeks ago.
+
+No document was changed by the audit pass itself — the findings below record the
+tree as it stood before any fix. What was then changed in response is listed in
+[What was fixed](#what-was-fixed).
+
+---
+
+## A. Wrong about shipped features (the highest-cost class)
+
+### A1. `README.md` — the Roadmap lists three landed features as unavailable
+
+`README.md:326-342` is headed "Planned, **not yet available**", and
+`README.md:10-14` promises "Features that are planned but **not yet available**
+are listed separately under Roadmap — they are not described as if they work."
+Three of its six entries have shipped:
+
+| README claim | Reality |
+| --- | --- |
+| `:336` "**Concurrency** — a shard-actor runtime and green-threaded fibers." | Both landed 2026-08-21 (iterations 8 and 11, both `done/`). `spawn` is a lexer keyword (`lexer.ml:163`); `send`/`call` are builtins (`WO_B_SEND=69`, `WO_B_CALL=88` in `wob.h`); `actor M` is a type (`types.ml`'s `TActor`). Gates exist and run: `just fibers`, `just db-actor`. `runtime/src/park.c` is the parking implementation; `runtime/test/test_fiber.c` and `test_mailbox.c` are its unit suites. |
+| `:335` "**HTTP service layer** — `service` blocks that route requests to methods." | The *`service` block syntax* is genuinely absent — that half is honest. But it sits under a banner that also denies HTTP entirely, which is false (see A2). |
+| `:332` "**Query aggregates** — `group … by … into g`" | **This one is correct.** `types.ml:2220,2241` rejects it: "group-by aggregation is not supported yet". Kept here only because `docs/guides/language-surface.md` contradicts it — see C1. |
+
+### A2. `README.md:33-37` — "does not serve HTTP, WebSockets, or a UI"
+
+> "writeonce is **not** a web framework and does not (yet) serve HTTP,
+> WebSockets, or a UI."
+
+Contradicted 30 lines later by its own §"Worked examples" (`:306-313`), which
+describes `docs/examples/porch/` as "a web framework written in
+writeonce (HTTP/1.1 …, router with `:param` captures, interface-based
+handlers)" and `just web-app` as its gate. Also contradicted by:
+
+- iteration 16 (web framework) and 37 (wo-html components), both `done/`;
+- `docs/examples/site/` — server-rendered pages, gated by `just site`;
+- WebSockets: `docs/examples/porch/http/ws.wo` (`ws_accept`, the 101
+  hijack sentinel) and `http/wsframe.wo` (a pure-`.wo` RFC 6455 frame codec),
+  both landed per `docs/in-progress/2026-08-23-chat-ws-lifecycle.md` (T6, T7).
+
+### A3. `README.md:30` — "no package manager"
+
+> "**Small on purpose.** No FFI, no package manager, no framework."
+
+Same page, `:265-281`, documents `[deps]`, `.wo-deps/<name>/`, `wo.lock` and
+`woc --update-deps`. Iteration 15 (deps package manager) is `done/`;
+`just deps-accept` is its gate. "No framework" is contradicted by `:306`.
+The intended claim is presumably "no *registry*" — which is true and is what
+`docs/00-code-review.md:77` says.
+
+### A4. `docs/examples/employee/README.md:3` — "does not compile on today's toolchain"
+
+> "**Status: target workload — does not compile on today's toolchain.** …
+> It becomes buildable when iteration 9 … and iteration 9b … land."
+
+Both landed. `woc docs/examples/employee/` exits 0. `just employee` is a
+first-class acceptance gate, and the `justfile:88-91` comment calls it "the
+database track's acceptance workload". The banner is ~2 weeks stale.
+
+### A5. `docs/examples/log-watcher/README.md:12-20` — same shape
+
+> "**Status: design artifact — the spec's forcing function.** The systems
+> track is approved, pre-implementation. Today's `woc` (milestone 1) …
+> diagnoses the adopted surface as WO-E101: `use`, `typedef`, standalone union
+> aliases …, `pub(read)`, `switch`, `try`."
+
+Every one of those forms is shipped (`docs/guides/language-surface.md` §2–§5,
+verified in `lexer.ml`/`parser.ml`). `woc docs/examples/log-watcher/` exits 0.
+`just log-watcher` is the gate the `justfile:82-87` calls "the test the whole
+track exists to pass".
+
+Same file, `:8-9`: "the five builtin stdlib modules — `fs`, `proc`, `net`,
+`time`, `json`". There are **six** (`types.ml:206`): `env` is missing.
+
+### A6. `runtime/README.md` — describes the pre-2026-08-18 world
+
+The directory's orientation README is still the old `wo-rt-c` prototype page
+with the VM bolted on at `:78`. Concretely wrong:
+
+- `:31` "Or from the repo root: `just rt-c-demo`" and `:60` "`just rt-c-bench`"
+  — **neither recipe exists.** The justfile has 16 recipes plus two `mod`s;
+  no `rt-c-*` among them.
+- `:5,:83` "the production Rust runtime (`crates/rt/`)", `:76` "This file is for
+  reading; `crates/rt` is for running writeonce" — the Rust runtime was removed
+  2026-08-18 (`docs/08-project-structure.md:11`).
+- `:3` `prototypes/wo-db/`, `:43` `docs/runtime/database/03-inmemory-engine.md`,
+  `:47` `docs/plan/09-concurrency-scaleout.md` — none of these paths exist
+  (also in the link audit's sections B/C/E).
+- `:84` "**`@gc` reference counting** + budgeted cycle collection … Bacon–Rajan
+  trial deletion" — retired by iteration 7b. `@gc` on a class is now
+  **rejected** (`docs/guides/language-surface.md:73`), and
+  `runtime/src/CODE-LOGIC.md` states the replacement outright: "incremental
+  tri-color mark-sweep … (iteration 7b — RC and Bacon–Rajan are gone)".
+- `:89` "`DB_STUB` traps 'engine not linked' until the DB engine binds (plan
+  5)" — the engine bound in iteration 9. The opcode survives
+  (`wob.h:232`, `vm.c:1806`) but the sentence reads as "no database yet".
+- `:89` builtin list "`now/print/print_int/words/multi_*/map_*`" — there are
+  now ~70 free builtins plus six module namespaces (`types.ml:784-849`).
+- File map (`:92-107`) omits four of the thirteen sources in `runtime/src/`:
+  `crypto.c/.h`, `json.c`, `park.c/.h`, `sysio.c`.
+- `:105` and `:117` "13 suites" / "one of the 13 ASan test binaries" — there
+  are **18** (`runtime/test/test_*.c`).
+- `:1` "now at **phase E**" vs `:57` "A → B → C → D → E → F, all ✅ shipped"
+  vs `:60` "Measured (phase F…)" — three answers in one file.
+
+Verified-correct in the same file, for contrast: `WO_HEAP_MB` / 64 MiB arena,
+the four `.vscode/launch.json` configs, the exit-code contract, and the
+`make -C runtime` targets.
+
+---
+
+## B. Verification tables that no longer verify
+
+### B1. `docs/00-code-review.md` — the 2026-08-20 table has decayed
+
+The doc's value is that it *checked* a critique line by line. Seven rows of
+`:55-82` are now false, and the doc carries no superseded banner:
+
+| Row | Then | Now |
+| --- | --- | --- |
+| "no `Float`, no `Bytes` \| absent from `compiler/src/types.ml`" | true | `types.ml:174` `builtin_scalars = ["Int";"Bool";"Text";"Timestamp";"Id";"Float";"Bytes"]` — iteration 19, `done/` |
+| "`send` is one-way \| `WO_B_SEND=69` is the last builtin (`WO_B_MAX 69u`)" | true | `WO_B_MAX 95u`; `WO_B_CALL = 88` is a send that parks for a typed reply |
+| "no crypto primitives \| none" | true | `WO_B_SHA1=85`, `WO_B_SHA256=86`, `WO_B_HMAC_SHA256=87`; `runtime/src/crypto.c`; `runtime/test/test_crypto.c` |
+| "22's battery never run \| … no `bench/baseline.json`, no `just db-bench`" | true | `bench/baseline.json` exists, `just db-bench` / `db-bench-quick` exist, 30+ result files in `bench/results/`, iteration 22 is `done/` |
+| "no fuzzing, no CI \| **no `.github/`**, no fuzz target" | true | `.github/workflows/release.yml` exists (fuzzing still absent) |
+| "one framework, five samples, one consumer" | true | 13 sample projects under `docs/examples/` |
+| "accept on one shard \| one listener, `SO_REUSEADDR` only" | true | iteration 35 landed `serve_conn` + fiber-per-connection |
+| `:46-51` "The multi-shard DB gap is structural … `wo_builtin_db` returns `WO_T_DB` 'database engine not initialized'" | true | that string is gone from `runtime/src/`; arc stage 3 landed the transparent DB actor, gated by `just db-actor` |
+
+Rows that still hold, checked: interpreted-only/no JIT, no SIMD, the
+`WO_STACK_SLOTS 4096` / `WO_MAX_REGS 64` / `WO_MAX_FRAMES 256` correction, no
+generics, no closures, byte strings, no Result type, switch-not-destructuring,
+no supervision, growable mailboxes, no `timerfd`, no TLS, no debugger/LSP,
+deps-are-git-rev-only, blue-green is a future, TSan covers one demo. And
+**`map<K,V>` lookup is still a linear scan** — `cont.h:1-6` says so in as many
+words.
+
+### B2. `docs/00-link-audit.md` — numbers and paths both stale
+
+Dated 2026-08-20. `just linkcheck` today reports **files=235, local=675,
+broken=77, bad anchors=0**; the doc's table says 206 / 569 / 88. Its own
+sections B–F sum to 77, not the 88 its prose claims twice (`:12`, `:145`) —
+an internal arithmetic error independent of the drift.
+
+Its repair table (`:29-37`) references paths that have since moved:
+`docs/00-status.md` (now `docs/stories/00-status.md`), and
+`refine/{08,11,19,20,21}` (now under `done/` and `hold/`).
+
+Two broken links exist today that the audit does not account for:
+
+- `docs/examples/employee-list/README.md:5,6` → `…/refine/20-cross-program-tables.md`
+  and `…/refine/21-keypair-attach-auth.md`; both files are now in `hold/`.
+- `docs/stories/language-runtime-database/hold/26-blue-green-deploy.md:9` →
+  `00-story.md`; the sibling stopped being a sibling when 26 moved into `hold/`.
+
+Conversely `docs/00-principles.md:57,77,78,87` — four links the audit lists as
+open — resolve now.
+
+### B3. `docs/plan/oop-vm/01-error-catalog.md` — not the complete catalog it claims
+
+`docs/guides/language-surface.md:8` calls it "every diagnostic";
+`compiler/README.md:39` says "every shipped code is cataloged" there. Ten
+codes the compiler emits are absent:
+
+| Code | Defined at | What it is |
+| --- | --- | --- |
+| `WO-E003` | `lexer.ml:56` | `#if`/`#else`/`#end` misuse |
+| `WO-E108` | `bin/main.ml:277` | `internal/` crossed at a `[deps]` boundary |
+| `WO-E109` | `bin/main.ml:275` | unknown `wo.toml` `kind` value |
+| `WO-E219`–`WO-E223` | `types.ml` | five type-pass codes |
+| `WO-E226` | `types.ml:443` | `call`'s reply type through actor-`M` erasure (iteration 24) |
+| `WO-E250` | `types.ml:435` | the whole query surface (iteration 9b) |
+
+`WO-E250` is the notable one: it is the only diagnostic the shipped query
+language produces, and it is the code a reader hits first when they mistype a
+query. Meanwhile `WO-W201` is still catalogued and no longer exists — the
+inferred-GC plan (`docs/superpowers/plans/2026-08-18-inferred-gc-mark-sweep.md:151`)
+listed "retire WO-W201" as an amendment; the code went, the catalog entry
+stayed.
+
+`WO-E004`/`WO-E005` (raw text literal, iteration 37) *are* catalogued —
+checked, since `language-surface.md:29,31` depends on them.
+
+---
+
+## C. Docs that disagree with each other
+
+### C1. Is group-by shipped? Two live docs, two answers
+
+- `README.md:332` — Roadmap, "not yet available". **Correct.**
+- `docs/guides/language-surface.md:175` — "Present today: from / where / order
+  / take / select **plus group-by aggregation**." **Wrong**, and the same page
+  opens (`:16-17`) with "Every form listed below was compiled and run against
+  `woc`/`wovm` while writing this page, not read off the parser and hoped for."
+  The `group … by … into` clause in its §6 grammar block *parses*
+  (`parser.ml:1137-1144`) and is then rejected by the typechecker
+  (`types.ml:2241` "group-by aggregation is not supported yet";
+  `types.ml:2222` for the navigation form).
+
+Reproduced: `docs/examples/employee-list/main.wo:38-41` uses `group e by
+e.dept into g` and fails to compile.
+
+`docs/00-dependency-graph.md:45` correctly still lists group-by under the
+parked drain.
+
+### C2. `docs/stories/00-status.md` — the narrative and the table disagree about iteration 24
+
+The board's *Current work* table is right: `:314` records "🔄 **iteration 24
+(absorbing 31 + 34): chat + actor lifecycle** — spec + plan approved
+2026-08-23 … executing on branch `chat-ws-lifecycle`" and links the marker.
+
+The ▶ NEXT PLAN narrative above it is not:
+
+- `:82-85` "Next slice: **iteration 31, actor lifecycle** — its spec brainstorm
+  is the next act". 31 was absorbed into 24 by directive, and its
+  actor-death half already landed (`docs/in-progress/2026-08-23-chat-ws-lifecycle.md:20-23`,
+  commit `ed69841`).
+- `:125` "**Next steps:** 31 (lifecycle spec brainstorm) → 24 (chat) → 23 → 32"
+  — same stale ordering.
+- `:286` iteration 24 marked "⬜ fourth in chain … after 31".
+- `:290` iteration 34 marked "⬜ off-chain but GATES 24". T1 crypto landed
+  (`d14fa9f`); `sha1`/`sha256`/`hmac_sha256` are in both `types.ml:847-849`
+  and `wob.h:461-463`. The gate is cleared —
+  `docs/00-dependency-graph.md:169` already says so.
+
+Also missing from the board entirely: the 2026-08-25 packaging/release track.
+`VERSION`, `scripts/mkdist.sh`, `just dist`, `just install-accept`,
+`.github/workflows/release.yml`, `docs/guides/releasing.md` and `dist/writeonce-0.1.0-linux-amd64.tar.gz`
+all exist; the last five commits are that work; no standup entry covers it.
+
+### C3. `docs/00-dependency-graph.md` — the main graph is a generation behind
+
+Its own header (`:3`) defers state to the board, but it paints state inline
+anyway, and the first mermaid graph paints it wrong:
+
+- `:29` `I17["17 library kind + internal/ (**PARKED** — spec+plan ready…)"]:::parked`
+  — story 17 is in `done/` with `status: done`; board `:302` reads
+  "✅ **landed 2026-08-20**".
+- `:31` `I18[… (spec APPROVED — **the next implementation**)]:::specd` — story
+  18 is in `hold/`; board `:303` reads "⏸ hold (2026-08-21)".
+- `:33,34` iterations 20/21 as `open` — both `hold/`.
+- `:38,40,41,42` use the pre-renumber ids: "10 HTTP service layer", "12
+  blue-green deploy", "13 metaprogramming @derive", "14 skillhost workload".
+  The stories are **26**-blue-green-deploy, **29**-compile-time-metaprogramming,
+  **28**-skillhost-host-workload; no story numbered 10, 12, 13 or 14 exists.
+- `:45` `DRAIN["post-12 parked drain: pub(read)/using/#if, …"]` — `pub(read)`
+  (`ast.ml:118-123`), `using` (`lexer.ml:164`) and `#if` (`lexer.ml:245-249`)
+  all shipped.
+- The main graph has no node for iterations 19, 24, 31, 32, 33, 35, 36 or 37.
+  Four of those are `done/`. The later sub-graphs *do* cover 34/35/36
+  correctly (`:141,164-170`), so the drift is confined to the first graph.
+
+---
+
+## D. Structural claims that don't match the tree
+
+### D1. `docs/08-project-structure.md` — "canonical map", four divergences
+
+- `:39` "`plan/` compiler-track docs: architecture.md + the woc plans" under
+  `compiler/`. **`compiler/plan/` does not exist**; those docs live at
+  `docs/plan/compiler/` — which the same file's `:49` links correctly.
+- `:22,76-77` `tests/corpus/` as "`run/`, `compile-fail/`, `trap/`, `gc/`".
+  There are nine directories: also `actor/`, `db/`, `lang/`, `sys/`,
+  `sample-logwatcher/` — all five **empty**. `tests/corpus/README.md:11-15`
+  documents them as planned per-plan additions, so the corpus README is the
+  honest one; the structure doc undercounts and neither mentions that five are
+  placeholders. (Live fixture counts: run 60, compile-fail 46, trap 5, gc 2.)
+- `:79-81` `scripts/` as "`oop-e2e.sh`, `mkdist.sh` + `install-accept.sh`, and
+  the per-sample acceptance scripts (`employee-accept.sh`,
+  `log-watcher-accept.sh`)". There are 14 scripts; unmentioned:
+  `db-actor-accept.sh`, `db-bench.py`, `deps-accept.sh`, `fibers-accept.sh`,
+  `linkcheck.py`, `single-binary-smoke.sh`, `site-accept.sh`,
+  `web-app-accept.sh`.
+- `:89` `examples/` as "log-watcher/, employee/, employee-list/ samples" —
+  there are 13.
+- `:87` puts status at the `docs/` root; it is `docs/stories/00-status.md`
+  (the file's own `:5` links it correctly). The root also has
+  `00-dependency-graph.md` and `00-link-audit.md`, unlisted.
+- The one-page map (`:17-29`) omits four tracked root entries: `bench/`,
+  `dist/`, `.github/`, `.claude/`.
+- `docs/examples/db-actor/` has `main.wo`, a `wo.toml` and a gate
+  (`just db-actor`) but **no README** — the only sample without one.
+
+Correct in the same file, checked: `runtime/wo-rt.c` exists; `.dev/` is
+gitignored except `.dev/README.md` (`git ls-files .dev` returns exactly one
+path) and `.dev/reference/` does hold `crates/`, `colibri/`, `llama-cpp/`,
+`linux/`, `go/`.
+
+### D2. `compiler/README.md` — stage banner and CLI list both behind
+
+- `:5` "**Stage: plan 3 … complete, Tasks 1–6 + 8**". Plan 3 closed in early
+  August; the front end has since taken iterations 15, 17, 19, 24, 34, 35, 36
+  and 37. A reader takes this page as the compiler's current extent.
+- `:26-34` "Running `woc`" omits four of the nine modes the binary's own
+  `usage_msg` prints: `--dump-gc`, `--update-deps <dir>`, `version`, and the
+  `woc <dir>` manifest build (the mode `README.md:111` teaches as the primary
+  one). `-D <name>`, the `#if` flag setter documented at
+  `language-surface.md:34`, is in neither the README nor `usage_msg` —
+  it exists at `bin/main.ml:1162`.
+- `:37` "same contract as `wo run` (`crates/rt/src/lib.rs::discover`)" — the
+  Rust runtime is gone. The identical stale sentence is also the doc comment
+  at `compiler/bin/main.ml:16-19`. *(Code, not markdown — noted, not
+  changed.)*
+
+Correct: the `=== path ===` multi-file header (`dump.ml:128`), the five golden
+stages, the exit-code contract, OCaml 4.14 / dune 3.14 (`dune-project` says
+`(lang dune 3.14)`).
+
+### D3. `runtime/src/CODE-LOGIC.md` — file table missing two sources
+
+`:12-25` is a complete-looking table of "the files, in dependency order" and
+omits `park.c/.h` (fiber parking — iteration 11, and central to how blocking
+builtins work) and `crypto.c/.h` (iteration 34). The doc is dated 2026-08-14,
+before both; nothing marks it as of-that-date beyond the first line.
+
+`database/src/CODE-LOGIC.md` and `compiler/src/CODE-LOGIC.md` were checked
+against their sources and hold up.
+
+---
+
+## E. Runbook and instruction errors
+
+`docs/guides/releasing.md`, authored 2026-08-25, contains steps that cannot be
+followed:
+
+- `:110` (step 11) "Remove `--draft`, commit, push." **`.github/workflows/release.yml`
+  contains no `--draft`** — `gh release create` at `:135-139` passes only the
+  two asset paths, `--title` and `--generate-notes`. Nothing to remove.
+- Steps 5, 6 and 10 disagree with each other. `:50-54` (step 5) says the
+  rehearsal is a `workflow_dispatch` run that "skips the tag guard and the
+  publish step"; `:56` (step 6) says "nothing to undo — a dry run creates no
+  tag and no release"; `:89-92` (step 10) then instructs
+  `gh release delete v0.0.0-test --yes` and two tag deletions. There is no
+  path in the workflow that creates `v0.0.0-test`.
+
+`.github/workflows/release.yml:1-2` — "this workflow has never run. Authored
+2026-08-25 and not executable locally" — is contradicted by `:43` of the same
+file ("The first run failed here with `dune: command not found`") and by
+commits `05fafd3`, `d66087d`, `4470f03`, which are fixes read off real runs.
+*(Code comment, not markdown.)*
+
+Verified correct against the workflow and the built binaries: the asset name
+`writeonce-0.1.0-linux-amd64.tar.gz`, the tag↔`VERSION` guard, the
+`ubuntu-22.04` pin and its glibc reasoning (this machine's binaries need
+`GLIBC_2.38`, matching `:8` step 8's "2.38 from this dev machine"), and
+`scripts/install-readme.tmpl.md:24-25` — `woc version` prints
+`writeonce 0.1.0 linux/amd64` and `wovm --version` prints `wovm 0.1.0`, exactly
+as documented.
+
+---
+
+## F. Small factual errors
+
+| Where | Claim | Actual |
+| --- | --- | --- |
+| `README.md:28` | "~100 KB for the sample programs" | 163–254 KB. Smallest built sample 163,117 B (`fibers`), largest 253,808 B (`site`); bare `wovm` is 161,848 B, so ~160 KB is the floor |
+| `README.md:142` | "**Types:** `Int`, `Text`, `Bool`, and user `class` types" | seven builtin scalars (`types.ml:174`): also `Float`, `Bytes`, `Timestamp`, `Id` |
+| `README.md:170` | `time` → "`sleep`, `now`, `local`, `iso`" | also `ticks` (µs monotonic, builtin 84 — iteration 22's one runtime addition) |
+| `README.md:172` | `net` → "TCP `listen`/`accept`/`read`/`write`/`close` (host + port)" | also `read_dl`, `accept_dl`, `write_dl`, `listen_unix`, `peer` (ids 91–95, iteration 35) |
+| `README.md:344` | "`net` is TCP host+port only" | `net.listen_unix` binds a unix socket (builtin 94) |
+| `README.md:272,276-277` | `[deps]` key `niceserve`, then "`use niceframework`" | the `[deps]` KEY *is* the module name — `docs/examples/web-app/wo.toml:19-20` keys it `serve` and `main.wo:9` says `use serve`. The example as written would not compile |
+| `README.md:295` vs `:298-320` | "**Two** complete sample programs" | three bullets follow; `:322` "Read **either** program's `main.wo`" compounds it. There are 13 samples, 8 of them gated |
+| `docs/guides/language-surface.md:36` | "**Keywords (35)**" | 37. The list printed immediately after is complete and correct against `lexer.ml:147-184` — only the count is wrong |
+| `docs/00-principles.md:104-105` | capabilities are "(`fs`, `proc`, `net`, `time`, `json`)" | six modules — `env` missing (`types.ml:206`) |
+| `docs/superpowers/plans/2026-08-18-inferred-gc-mark-sweep.md:153-154` | `[x]` "Add a `docs/examples/gc-cycle` acceptance script + `just gc-cycle` recipe" / `[x]` "Verify: `just gc-cycle` green" | **no `gc-cycle` recipe exists** and there is no `scripts/gc-cycle-accept.sh`. `docs/examples/gc-cycle/` has sources, a `target/` and a "Run status" section (`README.md:186`) but no gate. Two checked boxes for work that did not land |
+
+Forward references that are correctly labelled and are *not* findings:
+`just chat` (iteration 24, T9 — pending in the marker), `just oop-parity`
+(deferred by explicit decision, recorded at `compiler/README.md:5`), and
+`docs/examples/employee-list/`, whose banner honestly says it does not compile
+(confirmed: `woc` exits 2 on `[connect.employee]`, a section for the `hold/`
+iteration-20 feature).
+
+---
+
+## What to fix first
+
+1. **`README.md`** — it is the writeonce.de landing content
+   (`docs/08-project-structure.md:28`), so A1–A3, F's README rows and the
+   `use niceframework` example are the highest-value corrections in the repo.
+2. **The two example status banners** (A4, A5) — one line each, and they
+   currently tell a visitor that the repo's two flagship gates don't build.
+3. **`runtime/README.md`** (A6) — the largest single body of stale prose. It
+   wants splitting: `wo-rt.c` is a historical reference card, `runtime/src/` is
+   the shipped VM, and one page is trying to be both.
+4. **`docs/00-code-review.md`** and **`docs/00-link-audit.md`** (B1, B2) — both
+   are dated verifications whose value depends on being re-run. Either re-run
+   them or banner them as of-date.
+5. **`docs/plan/oop-vm/01-error-catalog.md`** (B3) — it is cited as normative by
+   two other docs; ten missing codes including the query surface's only one.
+6. **`docs/guides/language-surface.md:175`** (C1) — a single false clause on
+   an otherwise excellent page.
+7. **`docs/00-dependency-graph.md`** first graph (C3) and the board's NEXT PLAN
+   narrative (C2) — both trail their own companion tables.
+
+---
+
+## What was fixed
+
+All on branch `docs-truth-audit-fixes`, 2026-08-26. Docs only — no code changed,
+so no gate output changed.
+
+| Finding | Disposition |
+| --- | --- |
+| **A1** README roadmap listed shipped concurrency | Concurrency entry removed; `spawn`/`send`/`call`/`receive` documented under "Language at a glance" as shipped. The `service`-blocks entry stayed but now says what you write *instead* today. Group-by stayed — it was the one correct entry. |
+| **A2** "does not serve HTTP, WebSockets, or a UI" | Rewritten: both work, as `.wo` libraries consumed through `[deps]`, never as runtime features — which is the real (and more interesting) claim. TLS-by-proxy stated. |
+| **A3** "no package manager" | Now "no package **registry** — dependencies are exact-rev git URLs and nothing else", which is true and is the distinction the doc meant. |
+| **A4** `employee` README "does not compile" | Banner flipped to shipped, `just employee` named as the gate, with the one genuinely-ahead clause (`group … by … into`) called out rather than left to surprise a reader. |
+| **A5** `log-watcher` README "design artifact" | Banner flipped to shipped with iteration 7's actual acceptance evidence; the "five stdlib modules" list corrected to six. |
+| **A6** `runtime/README.md` a generation stale | **Restructured, not patched.** Leads with `wovm`; `wo-rt.c` demoted to a marked "Historical" section that keeps its measured numbers as the prototype record they are. Fixed: the two nonexistent recipes, `crates/rt`, `prototypes/wo-db`, the `@gc` refcount/Bacon–Rajan description (now inferred mark-sweep), `DB_STUB`, the builtin list, "13 suites" → 18, four missing source files, and the phase E/F contradiction. Three broken links went with it. |
+| **B1** `00-code-review.md` decayed | History kept intact with a pointer at the top; a **Re-verification 2026-08-26** section added listing the eight overtaken rows against source, the ~20 that still hold, and the two new gaps (now iteration 38). "No supervision/actor death" is marked *partly* overtaken — death landed, supervision did not. |
+| **B2** `00-link-audit.md` stale | Re-run and rewritten. The 48 dead-era exploration links are **resolved by de-linking, not re-pointing** — their prose names the retired plan by number, so re-targeting would have made each sentence lie. A successor map was added to `plan/discarded.md`, which is what that report's own "Still open" note asked for. Three more fixable breaks fixed. 77 → 23. |
+| **B3** ten codes missing from the error catalog | Added with definitions read from source: WO-E003, E108, E109, E219–E223, E226, E250. Header's "as of plan 3" scope line corrected. The Completeness method section now records *why* the sweep rotted — codes are built as `<stage>_prefix ^ "NN"`, so grepping for the literal `WO-E250` finds only a comment. **The `WO-W201` half of this finding was wrong:** the catalog already marked it *(retired, iteration 7b)* with "*(no longer emitted)*". The doc was right; the audit misread its own grep. |
+| **C1** `language-surface.md` claimed group-by works | Corrected in three places: the clause is marked in the grammar block, the "present today" list drops it, and the page's "every form was compiled and run" promise now names the exception. Keyword count 35 → 37. |
+| **C2** board narrative trailed its own tables | ▶ NEXT PLAN rewritten: the live slice is 24 (absorbing 31 + 34), not "31 next". Rows for 24, 31 and 34 updated — 31's remaining surface is cited as the *reserved holes at ids 89/90*, which is machine-checkable. A standup entry for the 2026-08-25 packaging/release track was added; it had none. |
+| **C3** dependency graph a generation behind | Graph 1 rebuilt: 17 → done, 18/20/21 → held, the pre-renumber ids 10/12/13/14 replaced by stories 25/26/29/28, nodes added for 19/24/30/31/32/33/34/35/36/37/38, and the parked drain reduced to what is actually left (`pub(read)`/`using`/`#if` all shipped). Node/edge references validated. |
+| **D1** `08-project-structure.md` "canonical map" | Fixed: the nonexistent `compiler/plan/`, the corpus's nine directories (four with fixtures, five reserved and empty, with counts), all 14 scripts, the `docs/` subtree, and the four missing root entries (`bench/`, `dist/`, `.github/`, `.claude/`). The sample-acceptance list now names all eight gates. |
+| **D2** `compiler/README.md` stage banner + CLI | Banner replaced with the eight iterations the front end has taken since plan 3. The CLI list gained `woc <dir>` (the primary mode), `version`, `--update-deps`, `--dump-gc` and `-D`. `crates/rt/src/lib.rs::discover` reference dropped. `gcinfer` added to the module list. |
+| **D3** `runtime/src/CODE-LOGIC.md` file table | `park.c/.h` and `crypto.c/.h` added, dated so the gap is visible rather than papered over. |
+| **E** `releasing.md` unfollowable steps | The `--draft` step and the phantom rehearsal cleanup deleted, remaining steps renumbered, and a paragraph added explaining why neither exists (plus how to opt into a draft if you want one). |
+| **F** small factual errors | All corrected: binary size ~100 KB → 160–260 KB (measured), the scalar list, `time.ticks`, the five missing `net` members, the `fs` read-and-append limit, the `[deps]` key/`use` mismatch (the example would not have compiled), "two samples" → 13 with 8 gated, the six-module count in `00-principles.md`, and the `just gc-cycle` recipe that two checked boxes claimed. |
+| **Later findings** | `00-story.md` gained the missing iteration 36 row; `docs/examples/db-actor/` gained the README it never had. |
+
+### Left deliberately unfixed
+
+- **23 broken links in `.dev/`** — vendored plugin-skill copies and reference
+  study trees. `.dev/` is gitignored (`git ls-files .dev` returns one path), so
+  these are per-developer notes. Fixing them means re-vendoring the skills with
+  their `references/` subdirectories.
+- **The `just gc-cycle` gate itself.** The false checkbox is now disclosed in
+  both the plan and the sample's README, but wiring the acceptance script is
+  work, not documentation, and belongs to whoever picks up that loose end.
+- **`tests/corpus/`'s five empty directories.** Documented as reserved with the
+  plan each was to be filled by; deleting or filling them is a test decision.
+- **Two stale references in code comments**, recorded here rather than edited
+  because this pass was scoped to markdown: `compiler/bin/main.ml:16-19` and
+  `compiler/src/parser.ml:202` both still cite `crates/rt/src/*.rs`, removed
+  2026-08-18; and `.github/workflows/release.yml:1-2` says "this workflow has
+  never run" while line 43 of the same file reports what its first run failed
+  with.
+
+---
+
+## Structural change 2026-08-26 — status folders removed
+
+Directive from the developer, applied after the fixes above: **`docs/` no longer
+uses directories to encode status.** The four story subfolders
+(`done/`, `refine/`, `hold/`, `in-progress/`) and top-level `docs/in-progress/`
+are gone. All 34 story iterations sit flat in
+`docs/stories/language-runtime-database/`, the slice marker sits flat in `docs/`
+as `active-slice-<date>-<topic>.md`, and each file's `status:` frontmatter key is
+the single place its state is recorded.
+
+This reverses the 2026-08-20/21 convention ("the folder move IS the status
+change"). The reason it is a good trade is visible in this repo's own history:
+under the old scheme a status change relocated the file, which invalidated every
+relative link in and to it — section A of the 2026-08-20 link audit was nine
+instances of exactly that, and B2 above found two more that had accumulated
+since. A status change is now a one-line edit that cannot break a link.
+
+What the move required, all verified with `just linkcheck` (23 broken, all in
+`.dev/`, unchanged from before the move):
+
+- 34 files relocated with `git mv` so history follows them.
+- **252 relative links recomputed in 70 files** — not by string substitution but
+  by resolving each link to an absolute path from its *old* location, remapping
+  through the move table, and re-deriving it relative to the file's *new*
+  location. String surgery would have mangled the `../` depth changes on the
+  moved files themselves.
+- Link *text* and backticked paths that named a status folder stripped
+  separately — a correct target under stale display text is still a lie.
+- Convention prose rewritten where it taught the old rule:
+  `stories/00-status.md`'s header, `stories/board-views.md` (including its Kanban
+  caveat, which described status changes as folder moves), and
+  `08-project-structure.md`'s map plus a new naming-convention entry.
+- Phrases of the form "moves to `done/`" rewritten as "sets `status: done`" in
+  the live docs — including the four open checkboxes in the active plan
+  `2026-08-23-chat-ws-lifecycle.md`, which would otherwise have instructed a
+  future session to recreate the folders.
+
+Two things surfaced that the move made visible rather than caused:
+
+1. **A frontmatter collision, caught and fixed.** Giving the marker doc
+   `iteration: "24"` would have put two files in the repo claiming to be
+   iteration 24 with contradicting `status:` values. The marker is a progress
+   log, not a status carrier, so it takes `slice: "24"` and points at the story
+   that owns the status.
+2. **Story 24's frontmatter said `refine` while the board said 🔄 live.** Under
+   the old scheme that drift was cheap to leave; under this one frontmatter *is*
+   the answer, so it is now `status: in-progress`. Iterations 31 and 34 keep
+   `refine` — they are absorbed into 24 but their own closeout is still pending,
+   which is what 24's T10 exists to do.
+
+Dated records were deliberately left naming the old paths: the findings sections
+of this document (which declare themselves a pre-fix snapshot), the history
+section of `00-link-audit.md` (which says every path in it is as it was on that
+date), and the "Files:" lists of closed plans. Rewriting those would destroy the
+record of what was true when each was written.
diff --git a/docs/00-link-audit.md b/docs/00-link-audit.md
index a159c67..81af0e8 100644
--- a/docs/00-link-audit.md
+++ b/docs/00-link-audit.md
@@ -1,154 +1,156 @@
-# Markdown link audit — 2026-08-20
+# Markdown link audit — re-run 2026-08-26
 
-Scope: every `*.md` in the repo (`.git` excluded).
-External URLs were not fetched (no network verification performed).
+Scope: every repo-authored `*.md`. `.git`, `target`, `dist`, `node_modules`,
+`_build` and — since 2026-08-26 — `.dev/` and `.superpowers/` are excluded; see
+the note under the table. External URLs are not fetched (no network
+verification).
 
 | | files | relative links | broken paths | bad anchors |
 |---|---|---|---|---|
-| first scan | 207 | 574 | 97 | 0 |
-| after section A fixes | 206 | 569 | **88** | 0 |
+| first scan (2026-08-20) | 207 | 574 | 97 | 0 |
+| after section A fixes (2026-08-20) | 206 | 569 | 88* | 0 |
+| **re-run 2026-08-26, before fixes** | 235 | 675 | 77 | 0 |
+| **re-run 2026-08-26, after fixes** | 237 | 652 | 23 | 0 |
+| **after scoping the gate to repo-authored docs** | 149 | 656 | **0** | **0** |
 
-Section A is repaired and verified. Sections B–F are pre-existing rot and
-still open — every one of the remaining 88 lives there.
+\* The 2026-08-20 report's prose said 88 twice while its own sections B–F summed
+to 77. The 77 was right; the 88 was an arithmetic slip, corrected here.
+
+**The gate is now clean: 0 broken, 0 bad anchors.**
+
+The last 23 were all in `.dev/` — vendored plugin-skill copies and cloned
+reference projects, neither of which this repo authors. `scripts/linkcheck.py`
+now skips `.dev/` and `.superpowers/` alongside `.git`/`target`/`dist`. That was
+forced by adding gofiber/fiber as a reference (2026-08-26): its own docs are
+Docusaurus pages whose links resolve at site-build time, not on disk, so the
+clone alone contributed 21 broken paths and 39 bad anchors. A gate that reports
+the same dozens of failures forever is a gate nobody reads. Everything the repo
+actually ships — `docs/`, `compiler/`, `runtime/`, `database/`, `tests/`,
+`bench/`, `scripts/`, the root README — is still scanned, and is clean.
 
 Re-check with `just linkcheck`.
 
-Tool: `linkcheck.py` — walks the tree, strips fenced/inline code, extracts inline
-links and reference definitions, resolves each relative target, and validates
-`#fragment` against GitHub-style heading slugs of the target file.
+Tool: `scripts/linkcheck.py` — walks the tree, strips fenced/inline code,
+extracts inline links and reference definitions, resolves each relative target,
+and validates `#fragment` against GitHub-style heading slugs of the target file.
 
 ---
 
-## A. Regressions from the in-flight renumber — FIXED 2026-08-20
+## What the 2026-08-26 re-run changed
 
-All nine broke because files moved in the working tree; each had a known
-successor. Repaired:
+### 1. The dead-era exploration links — RESOLVED (48 links, 15 files)
+
+Sections B and C of the 2026-08-20 report left a decision open: the studies under
+`docs/plan/exploration/` cite the old flat `docs/plan/NN-*.md` numbering and the
+`docs/runtime/database/` tree, both removed with the Rust track on 2026-08-18,
+and no successor map existed. That decision is now made.
+
+**De-linked, not re-pointed.** The link *text* in these studies names the retired
+plan by number — `[plan 09a]`, `[plan 11]`, ``[`12-engine-disk-cutover.md`]`` —
+so aiming those at a story would have made each sentence assert something false
+about a document that never said it. The targets were stripped and the text kept
+as plain code spans. The studies still read correctly as the dated records they
+are, and they no longer claim a file exists.
+
+The successor map lives in
+[`plan/discarded.md`](plan/discarded.md#successor-map-for-the-removed-rust-era-plan-paths)
+— one row per retired path, naming what carries that work now (or stating
+plainly that nothing does, as with `12-engine-disk-cutover.md` and
+`08-sendfile-static-assets.md`). That table is what the 2026-08-20 report's
+"Still open" note asked for.
+
+Files touched: `assembly/{00-overview,02-writeonce-stance}.md`,
+`c-runtime/{00-plan,01-architecture,02-single-binary}.md`,
+`linux/{01-epoll,02-eventfd,03-timerfd,04-signalfd,05-inotify,06-sendfile,07-io_uring,08-mmap,11-memfd_create,12-pwrite-fsync}.md`.
+
+### 2. `runtime/README.md` — RESOLVED (3 links)
+
+`prototypes/wo-db/`, `docs/runtime/database/03-inmemory-engine.md` and
+`docs/plan/09-concurrency-scaleout.md` all went when that README was restructured
+to lead with `wovm` and demote `wo-rt.c` to a clearly-marked historical section.
+It also carried two recipes that do not exist (`just rt-c-demo`,
+`just rt-c-bench`) — not a link problem, fixed in the same pass. See
+[`00-doc-audit.md`](00-doc-audit.md) §A6.
+
+### 3. Two breaks the 2026-08-20 report did not have — RESOLVED
+
+Both were caused by story files moving between status folders after that report:
 
 | Source | Was | Now |
 |---|---|---|
-| `docs/00-status.md:167` | `stories/language-runtime-database/05-language-surface.md` | `…/done/05-language-surface.md` |
-| `docs/00-status.md:187` | `stories/language-runtime-database/18-memory-db-features.md` | `…/hold/18-memory-db-features.md` |
-| `docs/stories/language-runtime-database/00-story.md:60` | `05-language-surface.md` | `done/05-language-surface.md` |
-| `docs/stories/language-runtime-database/00-story.md:69` | `18-memory-db-features.md` | `hold/18-memory-db-features.md` |
-| `docs/stories/language-runtime-database/25-http-service.md:4` | `../00-story.md` | `00-story.md` |
-| `docs/stories/language-runtime-database/26-blue-green-deploy.md:4` | `../00-story.md` | `00-story.md` |
-| `.../refine/08-shard-actor-runtime.md:98` | `../hold/09e-durability-throughput-scale.md` | `22-durability-throughput-scale.md` |
-| `.../refine/08-shard-actor-runtime.md:100` | `09f-io-uring-commit.md` | `23-io-uring-commit.md` |
-| `.../refine/20-cross-program-tables.md:143` | `../hold/09d-keypair-attach-auth.md` | `21-keypair-attach-auth.md` |
+| `docs/examples/employee-list/README.md:5,6` | `…/refine/20-cross-program-tables.md`, `…/refine/21-keypair-attach-auth.md` | `…/hold/…` (both stories moved to `hold/` 2026-08-21) |
+| `docs/stories/…/hold/26-blue-green-deploy.md:9` | `00-story.md` | `../00-story.md` (the sibling stopped being a sibling when 26 moved into `hold/`) |
 
-The `25`/`26` pair used `../00-story.md` while `00-story.md` is a sibling — the
-`refine/`-relative form pasted into files one level up.
+This is the recurring shape: **a story folder move breaks every relative link
+in and to that file.** Section A of the 2026-08-20 report was nine instances of
+it; these are two more. Worth a check in whatever moves a story.
 
-Link labels were renumbered with their targets, since the old IDs contradicted
-the new paths: `9e`→`22` and `9f`→`23` in `refine/08` (both the "Gated by the
-benchmark" note and settled decision 4, "Order: 22 → the 8+11 arc → 23").
+### 4. Stale paths inside the report itself — RESOLVED
 
-## B. Dead era: the old flat `docs/plan/NN-*.md` numbering (48 links)
+The 2026-08-20 repair table cited `docs/00-status.md` (now
+`docs/stories/00-status.md`) and `refine/{08,11,19,20,21}` (now under `done/` and
+`hold/`). That table has been retired into the history section below rather than
+carried forward with paths that no longer resolve.
 
-`docs/plan/` now holds only `compiler/`, `exploration/`, `oop-vm/`,
-`discarded.md`, `learnings.md`. Every flat-numbered plan doc is gone, and no
-successor path was recorded. Missing targets, by inbound count:
+### 5. Four links the report listed as open had already been fixed
 
-- `09-concurrency-scaleout.md` — 12
-- `11-wal-and-recovery.md` — 9
-- `12-engine-disk-cutover.md` — 8
-- `10-storage-foundations.md` — 8
-- `done/02-event-loop-epoll.md` — 4
-- `13-class-model-live-pricing.md` — 3
-- `07-inotify-content-watcher.md` — 3
-- `08-sendfile-static-assets.md` — 2
-- `15-mcp-streamable-http.md`, `16-postgres-mirror.md`,
-  `done/03-hand-rolled-http.md`, `done/04-cutover-remove-tokio-axum.md` — 1 each
-
-Inbound from: all of `docs/plan/exploration/{linux,postgresql,c-runtime,assembly}/`,
-plus `docs/00-principles.md:57,77,78`, `runtime/README.md:47`,
-`.dev/reference/README.md:55,56,58`.
-
-**Decision needed** — these exploration docs still cite a plan structure that no
-longer exists. Either map each to its story successor
-(e.g. concurrency-scaleout → `stories/.../refine/08-shard-actor-runtime.md`,
-wal/storage → `refine/22-durability-throughput-scale.md`,
-io_uring → `refine/23-io-uring-commit.md`) or strip the links and keep prose.
-
-## C. Dead era: the `docs/runtime/database/` tree (7 links)
-
-`docs/runtime/` does not exist. Missing targets:
-
-- `03-inmemory-engine.md` — 5 (incl. one `#recovery` anchor)
-- `02-wo-language.md` — 2 (incl. one `#concurrency-model` anchor)
-- `07-wo-seg-migration.md` — 1
-
-Inbound from `docs/plan/exploration/linux/{07-io_uring,08-mmap,11-memfd_create}.md`,
-`docs/plan/exploration/{assembly/02-writeonce-stance,c-runtime/02-single-binary}.md`,
-`runtime/README.md:43`, `.dev/reference/README.md:31`.
-
-## D. Never-created / removed siblings (5 links)
-
-| Source | Target | Note |
-|---|---|---|
-| `docs/plan/exploration/linux/06-sendfile.md:10` | `./07-splice.md` | slot 07 is `07-io_uring.md`; no splice doc was written |
-| `docs/plan/exploration/assembly/00-overview.md:19` | `../../../.dev/reference/go/src/runtime/atomic_amd64.s` | wrong depth **and** file absent from the vendored Go tree |
-| `docs/00-principles.md:87` | `examples/blog/README.md` | `docs/examples/blog/` never existed |
-| `.dev/reference/rest/README.md:76` | `../../docs/examples/blog/README.md` | same missing example |
-| `.dev/reference/README.md:41,59` | `../docs/plan/exploration/colibri/00-colibri-and-mixtral.md` | `exploration/colibri/` absent (2 links) |
-
-## E. `prototypes/` tree gone (4 links)
-
-`prototypes/` is not in the repo. Referenced as `prototypes/wo-db/` from
-`docs/plan/exploration/c-runtime/00-plan.md:88`, `02-single-binary.md:83`,
-`runtime/README.md:5`, and `prototypes/llama-moe-stream` from
-`.dev/reference/README.md:59`.
-
-## F. Vendored skill copies — not ours to fix (13 links)
-
-`.dev/skills/` holds flattened copies of plugin skills. The originals ship as
-directories with sibling reference files; flattening dropped them.
-
-- `.dev/skills/context-mode/context-mode.md:297-300` → `./references/{patterns-javascript,patterns-python,patterns-shell,anti-patterns}.md`
-- `.dev/skills/superpowers/requesting-code-review.md:34,95` → `code-reviewer.md`
-- `.dev/skills/superpowers/subagent-driven-development.md:232,300,345,400,410` → `implementer-prompt.md`, `task-reviewer-prompt.md`, `re-review-prompt.md` (×2), `../requesting-code-review/code-reviewer.md`
-- `.dev/skills/superpowers/test-driven-development.md:206` → `writing-good-tests.md`
-- `.dev/skills/superpowers/writing-skills.md:12,587` → `../using-superpowers/references/{codex,gemini}-tools.md`, `testing-skills-with-subagents.md`
-
-Leave as-is, or re-vendor the skills with their `references/` subdirectories.
+`docs/00-principles.md:57,77,78,87` resolved before this re-run — including the
+`examples/blog/README.md` reference that section D called a never-created file.
+Section D's other entries stand.
 
 ---
 
-## Structural problems found alongside the links
+## Out of gate scope — `.dev/` (was 23 links, now unscanned)
 
-1. **Iteration 19 was double-booked — RESOLVED.**
-   `refine/19-chat-websocket-workload.md` and `refine/24-chat-websocket-workload.md`
-   were the same document, differing only in the `# Iteration NN` heading, while
+Recorded so the knowledge is not lost, but no longer reported by
+`just linkcheck`. Not ours to fix, unchanged in character from the 2026-08-20
+report's section F.
+
+- **`.dev/skills/` (15 links)** — flattened copies of plugin skills. The
+  originals ship as directories with sibling `references/` files; flattening
+  dropped them. `context-mode.md:297-300`, `subagent-driven-development.md` (5),
+  `writing-skills.md` (3), `requesting-code-review.md` (2),
+  `test-driven-development.md:206`. Leave as-is, or re-vendor the skills with
+  their subdirectories.
+- **`.dev/reference/` (8 links)** — `README.md` (7) points at the removed
+  `docs/plan/{linux,assembly}/` and `15-mcp-streamable-http.md`, the absent
+  `exploration/colibri/`, and `prototypes/llama-moe-stream`;
+  `rest/README.md:76` points at `docs/examples/blog/`, which never existed.
+  `.dev/` is gitignored (`git ls-files .dev` returns only `.dev/README.md`), so
+  these are per-developer notes, not repo content.
+
+---
+
+## History — the 2026-08-20 first pass
+
+Kept for the record; every path below is as it was on that date.
+
+### A. Regressions from the in-flight renumber — FIXED 2026-08-20
+
+Nine links broke because files moved in the working tree; each had a known
+successor. Sources: `docs/00-status.md:167,187`,
+`docs/stories/language-runtime-database/00-story.md:60,69`, the `25`/`26` story
+pair (which used `../00-story.md` while `00-story.md` was a sibling — the
+`refine/`-relative form pasted into files one level up), `refine/08-shard-actor-runtime.md:98,100`,
+and `refine/20-cross-program-tables.md:143`. Link labels were renumbered with
+their targets, since the old IDs contradicted the new paths: `9e`→`22` and
+`9f`→`23`.
+
+### Structural problems found alongside the links
+
+1. **Iteration 19 was double-booked — RESOLVED.** `refine/19-chat-websocket-workload.md`
+   and `refine/24-chat-websocket-workload.md` were the same document while
    `19-missing-scalar-types.md` also claimed 19. `00-story.md`'s mapping line
-   (`24←19(chat)`) and table row 20 make **24 canonical**, so the 19 copy was
-   deleted. `refine/11-fibers.md:13` had been pointing at the 19 copy — repointed
-   to 24 first, so the delete broke nothing. Prose in `refine/08` that named
-   "iteration 19" for chat now says 24 (4 places).
-
-2. **`08-shard-actor-runtime.md` existed twice — RESOLVED.**
-   58 lines at the stories root vs 110 in `refine/`. The `refine/` copy supersedes
-   it outright: same acceptance criteria plus the 2026-08-20 settled decisions, the
-   inferred-GC restatement (7b retired `@gc`, which the root copy still required),
-   and the corrected substrate path (the root copy cited `runtime/wo-rt.c`, removed
-   with the Rust runtime). Root copy deleted; the one inbound link,
-   `docs/00-status.md:171`, now points at `refine/`. Six other referrers already did.
-
+   made **24** canonical, so the 19 copy was deleted after repointing
+   `refine/11-fibers.md:13` at 24.
+2. **`08-shard-actor-runtime.md` existed twice — RESOLVED.** 58 lines at the
+   stories root vs 110 in `refine/`. The `refine/` copy superseded it outright
+   (the root copy still required `@gc`, retired by 7b, and cited
+   `runtime/wo-rt.c`, removed with the Rust runtime). Root copy deleted.
 3. **Unresolved merge-conflict markers were committed** into
-   `refine/20-cross-program-tables.md:139-145` — `<<<<<<<< HEAD:… / ======== /
-   >>>>>>>> language-surface-strictness:…/hold/09c-cross-program-tables.md`, from a
-   rename-conflicted merge. This is what produced that file's broken `09d` link:
-   the stale side was still in the file. Resolved in favour of HEAD (the renumbered
-   `21` text). `grep` confirms no other conflict markers under `docs/`.
-
-## Still open
-
-- Sections B–F above: 88 broken links, all pre-existing.
-- `docs/plan/discarded.md` and `docs/plan/learnings.md` are the only survivors of
-  the old flat plan layout, which is why B and C have no successor map. A rename
-  table in one of them would let the exploration docs be repaired mechanically
-  rather than by guesswork.
-- `docs/00-status.md:171` still shows iteration 8 as ⬜ while `00-story.md:68`
-  records arc stages 1+2 as landed 2026-08-20. Not a link problem — a status
-  disagreement between the two index docs. Left alone.
-- `refine/23-io-uring-commit.md:26` still quotes the old order as
-  "9e → 8+11 → 9f" in a dated note. No link involved; left as historical record.
+   `refine/20-cross-program-tables.md:139-145`, from a rename-conflicted merge —
+   which is what produced that file's broken `09d` link. Resolved in favour of
+   HEAD. `grep` confirmed no other conflict markers under `docs/`.
+4. **A status disagreement, not a link problem:** `docs/00-status.md:171` showed
+   iteration 8 as ⬜ while `00-story.md:68` recorded arc stages 1+2 as landed.
+   Both now read landed.
diff --git a/docs/00-principles.md b/docs/00-principles.md
index 6c107e2..aaa6a3b 100644
--- a/docs/00-principles.md
+++ b/docs/00-principles.md
@@ -101,9 +101,10 @@ directly instead of the lowest common denominator.
 
 ## 10. Capabilities are typed builtins — no FFI
 
-Programs reach the system only through audited stdlib builtins (`fs`,
-`proc`, `net`, `time`, `json`): bounded reads, args-array-only process
-runs, handles that close on drop. There is no `extern`, no escape hatch.
+Programs reach the system only through audited stdlib builtins — six
+reserved namespaces (`fs`, `proc`, `net`, `time`, `json`, `env`): bounded
+reads, args-array-only process runs, handles that close on drop. There is
+no `extern`, no escape hatch.
 *Why:* one FFI hole voids the entire memory-safety and security story;
 typed capabilities make the safe path the only path.
 *Enforced by:* [the systems-track spec Parts 2–3](superpowers/specs/2026-08-01-systems-track-design.md).
diff --git a/docs/08-project-structure.md b/docs/08-project-structure.md
index 8aeb388..de32014 100644
--- a/docs/08-project-structure.md
+++ b/docs/08-project-structure.md
@@ -16,18 +16,25 @@ project.
 
 ```
 writeonce-all/
-├── compiler/     OCaml `woc` — lexer→parser→types→owner→emit; produces the compiler binary
-├── runtime/      C `wovm` — the register VM that runs .wob images (src/); phase A–F C reference (wo-rt.c, bench/)
+├── compiler/     OCaml `woc` — lexer→parser→types→gcinfer→owner→emit; produces the compiler binary
+├── runtime/      C `wovm` — the register VM that runs .wob images (src/); retired io_uring reference (wo-rt.c, bench/)
 ├── database/     C embedded engine — class-shaped tables, secondary indexes, typed WAL + recovery
-├── tests/        corpus/ — conformance fixtures: run / compile-fail / trap / gc
-├── scripts/      oop-e2e.sh (corpus runner), mkdist.sh / install-accept.sh (packaging), sample acceptance
-├── docs/         ALL documentation: numbered docs, stories/, plan/, examples/, superpowers/
+├── tests/        corpus/ — conformance fixtures: run / compile-fail / trap / gc (+ five reserved, still empty)
+├── scripts/      the corpus runner, packaging, linkcheck, and one acceptance script per sample
+├── bench/        baseline.json (the db-bench gate's thresholds) + results/ + compare/ (Go+SQLite peer)
+├── docs/         ALL documentation: numbered docs, stories/, plan/, examples/, guides/, superpowers/
+├── dist/         `just dist` output: writeonce-<ver>-linux-amd64.tar.gz + .sha256
+├── .github/      workflows/release.yml — builds, verifies and publishes on a `v*` tag push
+├── .claude/      agents/ — project subagent definitions (see docs/guides/database-developer-subagent.md)
 ├── .dev/         gitignored per-developer links + reference study trees (v1 crates, colibri, llama-cpp)
 ├── justfile      task runner: woc-/wovm-build, the *-test gates, oop-accept, dist, install-accept
 ├── VERSION       single-sourced toolchain version (stamped into woc/wovm; asserted by `just dist`)
 └── README.md     the getting-started front door (also the writeonce.de landing content)
 ```
 
+`target/` and `.vscode/` are local build and editor state, not part of the
+project layout.
+
 ## Root directories in detail
 
 ### `compiler/` — the OCaml `woc` compiler
@@ -36,13 +43,19 @@ writeonce-all/
 compiler/
 ├── dune-project
 ├── README.md            orientation: pipeline map, build/test commands
-├── plan/                compiler-track docs: architecture.md + the woc plans
 ├── src/                 one module per stage: diag, token, lexer, ast, parser,
-│                        types, owner, emit, disasm, dump
-├── bin/main.ml          the woc executable (check / --emit / build / version modes)
-└── test/                golden runner + golden/ fixtures per stage
+│                        types, gcinfer, owner, emit, disasm, dump
+├── bin/main.ml          the woc executable — check / build-from-manifest / --emit /
+│                        build / version / --update-deps / the --dump-* modes / -D
+└── test/                golden runner + golden/ fixtures per stage (tokens, ast,
+                         owner, owner-err, bc) + fixtures/driver/ CLI-smoke cases
 ```
 
+The compiler-track plan docs live under
+[`plan/compiler/`](plan/compiler/architecture.md) in this `docs/` tree, not
+inside `compiler/` — the repo rule below applies to the compiler like everything
+else.
+
 Doctrine: OCaml stdlib only — no Menhir, no ppx, no opam libraries; handwritten
 lexer and recursive-descent parser. Build: `just woc-build`; gate:
 `just woc-test`. Architecture map:
@@ -73,22 +86,34 @@ compiler (`emit.ml`), lowered to engine builtins — no SQL text in the image.
 
 ### `tests/`, `scripts/`
 
-- `tests/corpus/` — the conformance spine: `run/`, `compile-fail/`, `trap/`,
-  `gc/`. Exact-outcome matching: byte-equal stdout, exact `WO-E###`, exact trap
-  code. Driven by `scripts/oop-e2e.sh` (`just oop-e2e`).
-- `scripts/` — `oop-e2e.sh` (corpus), `mkdist.sh` + `install-accept.sh`
-  (tarball packaging), and the per-sample acceptance scripts
-  (`employee-accept.sh`, `log-watcher-accept.sh`).
+- `tests/corpus/` — the conformance spine. Four directories carry fixtures:
+  `run/` (60), `compile-fail/` (46), `trap/` (5), `gc/` (2). Five more —
+  `actor/`, `db/`, `lang/`, `sys/`, `sample-logwatcher/` — are reserved slots
+  from the original plan and still **empty**; see
+  [`tests/corpus/README.md`](../tests/corpus/README.md) for which plan each was
+  to be filled by. Exact-outcome matching: byte-equal stdout, exact `WO-E###`,
+  exact trap code. Driven by `scripts/oop-e2e.sh` (`just oop-e2e`).
+- `scripts/` — the corpus runner (`oop-e2e.sh`) and
+  `single-binary-smoke.sh`; packaging (`mkdist.sh`, `install-accept.sh`); the
+  docs gate (`linkcheck.py`); the benchmark campaign (`db-bench.py`); and one
+  acceptance script per sample — `employee-accept.sh`, `log-watcher-accept.sh`,
+  `web-app-accept.sh`, `site-accept.sh`, `fibers-accept.sh`,
+  `db-actor-accept.sh`, `deps-accept.sh`.
 
 ### `docs/` — all documentation
 
 ```
 docs/
-├── 00-*, 01-problem.md, 08-*.md   status / principles / code-review / problem / structure
-├── stories/                        the canonical iteration arc (language-runtime-database/)
-├── examples/                       log-watcher/, employee/, employee-list/ samples
+├── 00-*.md, 01-problem.md, 08-*.md principles / code-review / dependency-graph /
+│                                   link-audit / doc-audit / problem / structure
+├── stories/                        00-status.md (the board) + board-views.md +
+│                                   the canonical iteration arc (language-runtime-database/,
+│                                   FLAT — status lives in each story's frontmatter)
+├── active-slice-*.md               the live slice's one marker doc, deleted when it lands
+├── guides/                         runbooks: releasing, language-surface, subagents
+├── examples/                       13 sample projects, 8 of them wired to a `just` recipe
 ├── plan/                           compiler/ plans, oop-vm/ contracts, exploration/ studies,
-│                                   discarded.md + learnings.md registers
+│                                   perf-targets.md, discarded.md + learnings.md registers
 └── superpowers/                    specs/ (approved designs) + plans/ (implementation plans)
 ```
 
@@ -106,15 +131,25 @@ gates.
 
 `just woc-build` + `just wovm-build` produce the two binaries; `just oop-accept`
 runs the full milestone gate (compile-time budget, conformance corpus under
-ASan, single-binary smoke, both unit gates). Sample acceptance:
-`just employee` (database), `just log-watcher` (systems stdlib). Packaging:
-`just dist` → `writeonce-<ver>-linux-amd64.tar.gz`, proven by
-`just install-accept`.
+ASan, single-binary smoke, both unit gates). Sample acceptance: `just employee`
+(database), `just log-watcher` (systems stdlib), `just web-app` and `just site`
+(the framework consumed through `[deps]`), `just fibers` and `just db-actor`
+(the concurrency arc), `just deps-accept` (the package manager),
+`just db-bench` / `db-bench-quick` (the benchmark campaign, gated against
+`bench/baseline.json`). Docs gate: `just linkcheck`. Packaging: `just dist` →
+`writeonce-<ver>-linux-amd64.tar.gz`, proven by `just install-accept`;
+publishing is `.github/workflows/release.yml` on a `v*` tag
+(see [`guides/releasing.md`](guides/releasing.md)).
 
 ## Naming conventions
 
 - Binaries: `woc` (OCaml compiler), `wovm` (C VM); a `woc build` / `woc <dir>`
   output is named by the project's `wo.toml`.
+- Story iterations: `<NN>-<topic>.md`, flat in
+  `docs/stories/language-runtime-database/`. **No directory encodes status**
+  (directive 2026-08-26) — each story's `status:` frontmatter key is the only
+  place state is recorded, so a status change is a one-line edit and never
+  moves a file or breaks a link.
 - Plan/spec files: `YYYY-MM-DD-<topic>.md` under `docs/superpowers/{specs,plans}/`;
   compiler plans under `docs/plan/compiler/`; normative contracts under
   `docs/plan/oop-vm/`.
diff --git a/docs/in-progress/2026-08-23-chat-ws-lifecycle.md b/docs/active-slice-2026-08-23-chat-ws-lifecycle.md
similarity index 76%
rename from docs/in-progress/2026-08-23-chat-ws-lifecycle.md
rename to docs/active-slice-2026-08-23-chat-ws-lifecycle.md
index d5270c3..88897df 100644
--- a/docs/in-progress/2026-08-23-chat-ws-lifecycle.md
+++ b/docs/active-slice-2026-08-23-chat-ws-lifecycle.md
@@ -1,9 +1,15 @@
-# In progress — chat + actor lifecycle (iteration 24, absorbing 31 + 34)
+---
+slice: "24"          # the story that owns the status; see stories/24-chat-websocket-workload.md
+status: in-progress
+---
 
-Active slice, branch `chat-ws-lifecycle`. Spec:
-[`../superpowers/specs/2026-08-23-chat-websocket-actor-lifecycle-design.md`](../superpowers/specs/2026-08-23-chat-websocket-actor-lifecycle-design.md)
+# Active slice — chat + actor lifecycle (iteration 24, absorbing 31 + 34)
+
+Branch `chat-ws-lifecycle`. Spec:
+[`superpowers/specs/2026-08-23-chat-websocket-actor-lifecycle-design.md`](superpowers/specs/2026-08-23-chat-websocket-actor-lifecycle-design.md)
 · plan:
-[`../superpowers/plans/2026-08-23-chat-ws-lifecycle.md`](../superpowers/plans/2026-08-23-chat-ws-lifecycle.md).
+[`superpowers/plans/2026-08-23-chat-ws-lifecycle.md`](superpowers/plans/2026-08-23-chat-ws-lifecycle.md)
+· board: [`stories/00-status.md`](stories/00-status.md).
 
 ## Progress (2026-08-23)
 
@@ -49,4 +55,6 @@ Every landed task: full battery 12/12, fresh-built.
   standup entry, graph nodes, framework README ledger rows, runtime +
   chat CODE-LOGIC sections, delete this marker. Final battery.
 
-This file is deleted when the slice lands (board convention).
+This file is deleted when the slice lands (board convention). It lives flat in
+`docs/` rather than a status folder — since 2026-08-26 no directory in this repo
+encodes state; `status:` above is the only place it is recorded.
diff --git a/docs/examples/db-actor/README.md b/docs/examples/db-actor/README.md
new file mode 100644
index 0000000..ae5a252
--- /dev/null
+++ b/docs/examples/db-actor/README.md
@@ -0,0 +1,62 @@
+# `db-actor` — the database reached from any shard
+
+> **Status: shipped — arc stage 3's acceptance gate.** Run it with
+> `just db-actor`. Landed 2026-08-21 with the shard-fiber arc
+> ([story 8](../../stories/language-runtime-database/08-shard-actor-runtime.md)
+> · [plan](../../superpowers/plans/2026-08-20-shard-fiber-arc.md)).
+
+The database lives on **one** shard — the owner, shard 0 — because RAM is
+authoritative and a single writer is what makes the WAL's ordering meaningful.
+That is a problem the moment actors are placed round-robin across cores: a
+`spawn`ed actor has no say in which shard it lands on, and before stage 3 a
+worker-shard `insert` trapped `WO_T_DB` with "database engine not initialized".
+
+Stage 3's answer is a **transparent DB actor**: statements issued off the owner
+shard marshal to it, execute there, and materialize their replies back. The
+program's source says nothing about any of it — the same `insert` and the same
+`from … select` work wherever the actor happens to run. This sample exists to
+prove exactly that, which is why its acceptance criterion is *placement
+independence* rather than any particular output.
+
+## What it does
+
+`Note` is a `@table` with a secondary index on `tag`. `Writer` is an actor: each
+one inserts a row, then scans the whole table and prints the sum it sees. `main`
+spawns two writers, waits, then scans once itself.
+
+With the default shard count, round-robin placement puts at least one writer off
+the owner shard — so one of those inserts and one of those scans travel the RPC
+path under test, and the other does not. Both must produce the same shape.
+
+```bash
+just db-actor                       # the gate
+woc docs/examples/db-actor/         # or build it by hand
+WO_SHARDS=1 ./docs/examples/db-actor/target/db-actor   # force the local path
+```
+
+## What the gate proves
+
+`scripts/db-actor-accept.sh`, 8 checks:
+
+| Check | Why it is shaped that way |
+| --- | --- |
+| multi-shard, three rounds | The writer lines are asserted as a **set**, not a sequence — scheduling decides their order, and pinning it would be testing the scheduler, not the RPC. The `main` line is exact. |
+| both `WO_IO` backends forced | The reply park has to be plane-independent: io_uring and epoll must give the same answer, or the parking is leaking into semantics. |
+| single shard, byte-exact | The local path is untouched by stage 3. Any drift here means the RPC changed the non-RPC case. |
+| `WO_DATA` restart pair | A worker's insert must commit on the **owner's** WAL before its ack, so a restart replays it: 2 rows, then 2+2 after a second run. This is the durability claim the RPC could most easily break. |
+
+Run under `wovm_asan` and `wovm_tsan` as well — cross-shard message passing is
+exactly where a data race would hide, and TSan covering this demo is the one
+place it runs.
+
+## Read it for
+
+- **How little the source knows.** Compare `Writer.receive` here against the
+  same statements in [`employee`](../employee/): identical. Transparency is the
+  feature.
+- **Why `main` waits.** `main` is not an actor and has no mailbox, so it sleeps
+  rather than awaiting — the gap iteration 31's `call` closes for actors and
+  [24's marker](../../active-slice-2026-08-23-chat-ws-lifecycle.md) tracks.
+
+Reasoning under the engine side: [`database/src/CODE-LOGIC.md`](../../../database/src/CODE-LOGIC.md).
+Contract: [`plan/oop-vm/04-db-binding.md`](../../plan/oop-vm/04-db-binding.md).
diff --git a/docs/examples/db-actor/main.wo b/docs/examples/db-actor/main.wo
index e879608..b4b47c1 100644
--- a/docs/examples/db-actor/main.wo
+++ b/docs/examples/db-actor/main.wo
@@ -21,7 +21,6 @@ class Job {
 -- round-robin, so with two writers at default shards one lands off the
 -- primary — the RPC path under test.
 class Writer {
-  pad: Int
   fn receive(msg: Job) {
     insert Note { tag: "w", val: msg.n };
     let total = 0;
@@ -33,8 +32,8 @@ class Writer {
 }
 
 fn main() -> Int {
-  let a: actor Job = spawn Writer { pad: 0 };
-  let b: actor Job = spawn Writer { pad: 1 };
+  let a: actor Job = spawn Writer {};
+  let b: actor Job = spawn Writer {};
   send(a, Job { n: 1 });
   send(b, Job { n: 2 });
   -- no request/response surface yet (iteration 31): poll until both rows
diff --git a/docs/examples/employee-list/README.md b/docs/examples/employee-list/README.md
index b3ca75a..1bdd3e8 100644
--- a/docs/examples/employee-list/README.md
+++ b/docs/examples/employee-list/README.md
@@ -2,8 +2,8 @@
 
 > **Status: target workload — does not compile on today's toolchain.**
 > Written ahead of iterations
-> [20 (cross-program tables)](../../stories/language-runtime-database/refine/20-cross-program-tables.md)
-> and [21 (keypair attach auth)](../../stories/language-runtime-database/refine/21-keypair-attach-auth.md),
+> [9 (cross-program tables)](../../stories/databasev2/09-cross-program-tables.md)
+> and [10 (keypair attach auth)](../../stories/databasev2/10-keypair-attach-auth.md),
 > the way every acceptance sample here precedes its features. It also leans
 > on 9/9b (the [employee sample](../employee/) it attaches to must run
 > first).
diff --git a/docs/examples/employee/README.md b/docs/examples/employee/README.md
index 49ac282..a8ab066 100644
--- a/docs/examples/employee/README.md
+++ b/docs/examples/employee/README.md
@@ -1,14 +1,16 @@
 # employee — the database track's acceptance workload
 
-> **Status: target workload — does not compile on today's toolchain.**
-> This sample is written *ahead of* the features it exercises, exactly as
-> log-watcher was written ahead of iterations 5–7: the sample is the test,
-> and the plans compile toward it. It becomes buildable when iteration 9
-> (engine: [`2026-08-01-db-engine-binding.md`](../../superpowers/plans/2026-08-01-db-engine-binding.md))
+> **Status: shipped — this is the database track's acceptance gate.** Run it
+> with `just employee`. The sample was written *ahead of* the features it
+> exercises, exactly as log-watcher was written ahead of iterations 5–7: the
+> sample is the test, and the plans compiled toward it. Both landed — iteration
+> 9 (engine: [`2026-08-01-db-engine-binding.md`](../../superpowers/plans/2026-08-01-db-engine-binding.md))
 > and iteration 9b (query surface:
-> [`2026-08-15-employee-relations-query.md`](../../plan/compiler/2026-08-15-employee-relations-query.md))
-> land. Normative semantics:
+> [`2026-08-15-employee-relations-query.md`](../../plan/compiler/2026-08-15-employee-relations-query.md)).
+> Normative semantics:
 > [the 9b spec](../../superpowers/specs/2026-08-15-table-relations-query-design.md).
+> One clause below is still ahead of the compiler and marked where it appears:
+> `group … by … into` parses and is then refused by the typechecker.
 
 Two `@table` classes and every 9b feature load-bearing:
 
diff --git a/docs/examples/fibers/main.wo b/docs/examples/fibers/main.wo
index f7c4025..debb25d 100644
--- a/docs/examples/fibers/main.wo
+++ b/docs/examples/fibers/main.wo
@@ -31,7 +31,6 @@ class Counter {
 -- Part 2: an actor whose receive PARKS mid-message. The park releases
 -- the shard: main keeps ticking while this fiber sleeps.
 class Sleeper {
-  pad: Int
   fn receive(msg: Tick) {
     print("sleeper: down for ${msg.n}ms");
     time.sleep(msg.n);
@@ -61,7 +60,7 @@ fn main() -> Int {
   print("part1 done");
 
   -- ---- part 2: a parked fiber blocks nobody ----
-  let s: actor Tick = spawn Sleeper { pad: 0 };
+  let s: actor Tick = spawn Sleeper {};
   send(s, Tick { n: 150 });
   let t = 0;
   while t < 8 {
diff --git a/docs/examples/gc-cycle/README.md b/docs/examples/gc-cycle/README.md
index efe6d21..324367a 100644
--- a/docs/examples/gc-cycle/README.md
+++ b/docs/examples/gc-cycle/README.md
@@ -185,8 +185,15 @@ inferred). The developer writes no memory annotations for either.
 
 ## Run status
 
-Iteration 7b is landing in phases (plan:
+Iteration 7b landed 2026-08-18 (plan:
 [`../../superpowers/plans/2026-08-18-inferred-gc-mark-sweep.md`](../../superpowers/plans/2026-08-18-inferred-gc-mark-sweep.md)).
+This sample compiles and runs on today's toolchain — `woc
+docs/examples/gc-cycle/` then `./docs/examples/gc-cycle/target/gc-cycle`.
+
+> **It has no `just` recipe.** The plan's phase 4 checked off a
+> `just gc-cycle` acceptance that never landed; the sample is the one
+> compiling example in the repo with no gate behind it. Run it by hand,
+> and see the plan's 2026-08-26 disclosure note.
 
 **Phase 1 (landed).** The inference pass classifies each class; `woc --dump-gc
 docs/examples/gc-cycle` prints:
diff --git a/docs/examples/log-watcher/README.md b/docs/examples/log-watcher/README.md
index f39963b..c2e091c 100644
--- a/docs/examples/log-watcher/README.md
+++ b/docs/examples/log-watcher/README.md
@@ -6,17 +6,17 @@ ported file for file, per the approved
 (Part 4). A single-binary systems daemon: log-tail watcher, cron.d
 supervisor, flock/pgrep probes, hand-rolled MCP-over-HTTP server, JSONL
 detection sink. Program mode (`fn main`, blocking legal, one shard) plus the
-five builtin stdlib modules — `fs`, `proc`, `net`, `time`, `json` — carry
+stdlib modules it needs — `fs`, `proc`, `net`, `time`, `json`, `env` — carry
 all of it; read each `.wo` next to its `.hx` sibling.
 
-> **Status: design artifact — the spec's forcing function.** The systems
-> track is approved, pre-implementation. Today's `woc` (milestone 1)
-> recovers the `class`/`fn` skeletons in these files (`--dump-ast` lists
-> every Watcher method) but diagnoses the adopted surface as WO-E101:
-> `use`, `typedef`, standalone union aliases (`type CronResult = …`),
-> `pub(read)`, `switch`, `try`. This sample exists to force that grammar
-> (the blog/ecommerce/pricing precedent) and becomes the track's acceptance
-> test: it compiles and detects a real silent death when the track ships.
+> **Status: shipped — the systems track's acceptance gate.** Run it with
+> `just log-watcher` (`just log-watcher::build` / `::soak 60` for the rest).
+> Landed with iteration 7 on 2026-08-15: executable, not merely compilable —
+> zero ASan leaks in all three modes, SIGTERM ends parked syscalls, fds flat,
+> `LW_SOAK` gate. The sample existed to force the grammar it uses (the
+> blog/ecommerce/pricing precedent), and every form it needed — `use`,
+> `typedef`, standalone union aliases (`type CronResult = …`), `pub(read)`,
+> `switch`, `try` — is now shipped surface.
 
 ## The mapping
 
diff --git a/docs/examples/writeonce-framework/README.md b/docs/examples/porch/README.md
similarity index 69%
rename from docs/examples/writeonce-framework/README.md
rename to docs/examples/porch/README.md
index c799f9b..8fad15d 100644
--- a/docs/examples/writeonce-framework/README.md
+++ b/docs/examples/porch/README.md
@@ -1,11 +1,24 @@
-# writeonce-framework
+# porch — the writeonce web framework
+
+> **Named `porch` on 2026-08-26.** Rename history: `writeonce-framework`
+> (`use framework`) → `writeonce-serve` (`use serve`, 2026-08-25) → **`porch`**
+> (`use porch`). Stories, specs, plans and the audit reports dated before each
+> change still say the older name — they are dated records and were left as
+> written, which is the repo's convention.
+>
+> Why `porch`: the structure in front of the house you actually enter through,
+> and in writeonce the house *is* the database. The name appears only in `use`
+> lines and the `[deps]` key — names resolve bare through `use` edges, so no
+> handler body mentions it.
 
 A web framework **written in writeonce**, consumed as a `[deps]` dependency
-(iteration 15). Spec: `docs/superpowers/specs/2026-08-18-web-framework-design.md` §B.
+(iteration 15). Roadmap: [`docs/stories/porch/`](../../stories/porch/00-story.md)
+— its own track, eight iterations, numbered from 1, derived from
+[the Fiber parity study](../../plan/exploration/fiber/00-fiber-parity.md). Spec: `docs/superpowers/specs/2026-08-18-web-framework-design.md` §B.
 
 ```toml
 [deps]
-writeonce-framework = { git = "https://github.com/shoneyj/writeonce-framework", rev = "v0.1.0" }
+porch     = { git = "https://github.com/shoneyj/porch", rev = "v0.1.0" }
 ```
 
 ## What it is
@@ -82,6 +95,13 @@ first (pure `.wo` cannot express it yet).
 
 ### Transport
 
+> Parity reference: [the Fiber v3.5.0 study](../../plan/exploration/fiber/00-fiber-parity.md)
+> read all 32 of Fiber's middleware packages against this framework on
+> 2026-08-26. **Nine already have a working counterpart here** (CORS, basic
+> auth, key/bearer auth, security headers, ETag, static files, logger, host
+> authorization, recover-as-500). The rows below marked ⛔/⏸ are what it found
+> missing, each with an owner.
+
 | Item | State |
 | --- | --- |
 | HTTP/1.1 parsing | ✅ parses + 400-and-survive; duplicate `Content-Length` rejected outright (RFC 9112 §6.3, slice 2); BODY_MAX bounds headers and body |
@@ -149,7 +169,14 @@ first (pure `.wo` cannot express it yet).
 | --- | --- |
 | base64 | ✅ pure `.wo` (`http/auth.wo`) |
 | SHA-1 · SHA-256 · HMAC-SHA256 | ✅ C runtime builtins (iteration 34, ids 85–87, RFC-vector gated); SHA-512/CRC32 wait for a consumer |
-| Unlocks (signed cookies, CSRF, session integrity, webhook verification, JWT HS256) | ⬜ UNBLOCKED (the primitives exist since iteration 34); each is its own slice; **hard stop at JWT HS256** — no RS256, no JOSE zoo |
+| Unlocks — signed cookies, webhook verification, JWT HS256 **verification** | ⬜ genuinely unblocked (integrity only needs iteration 34's HMAC); each its own slice; **hard stop at JWT HS256** — no RS256, no JOSE zoo |
+| Unlocks — CSRF, session integrity, JWT **issuing** | ⛔ **BLOCKED, corrected 2026-08-26.** This row previously read "UNBLOCKED (the primitives exist since iteration 34)" and that was wrong: HMAC lets you *authenticate* a token, not *mint* one, and **writeonce has no source of randomness at all** (no `getrandom`, no CSPRNG builtin — grep the runtime). An HMAC over a guessable session id is a signed guess. A random-bytes builtin is [iteration 39](../../stories/language-runtime-database/39-web-framework-parity.md)'s first goal |
+| Cookies (read + `Set-Cookie`) | ⛔ absent in BOTH directions, and `Resp.headers` is a `map<Text,Text>` so it structurally cannot carry two `Set-Cookie` lines — [iteration 39](../../stories/language-runtime-database/39-web-framework-parity.md) |
+| Sessions · CSRF · rate limiting · idempotency | ⬜ [iteration 39](../../stories/language-runtime-database/39-web-framework-parity.md). Limiter and idempotency need only a `@table` + `time.ticks` and are the cheapest wins available; sessions and CSRF wait on randomness + cookies. `@table` gives all four a **durable** store, where Fiber ships in-memory and expects Redis |
+| Compression · SSE · byte ranges · chunked bodies | ⏸ all four sit on the parked streaming seam (`serialize()` always emits `Content-Length`). Chunked REQUEST bodies are deliberately refused today (`internal/parse.wo:153-157`, request-smuggling note) — that refusal must survive whoever implements them |
+| Typed binding of query/params/form/headers | ⏸ Fiber's `Bind` reflects over struct tags; principle 13 forbids reflection, so the answer is [iteration 29's `@derive`](../../stories/language-runtime-database/29-compile-time-metaprogramming.md). JSON bodies already work via `json.decode(t) as T` |
+| PATCH/OPTIONS/HEAD/ALL helpers · named routes · per-route body limit · request id · `Location`/`Vary`/`Attachment` | ⬜ [iteration 39](../../stories/language-runtime-database/39-web-framework-parity.md) — registration and response sugar; `BODY_MAX = 1048576` is currently one compile-time number for the whole server |
+| `proxy` middleware | ⛔ impossible today — no `net.connect` anywhere in the runtime ([iteration 38](../../stories/language-runtime-database/38-content-platform-capabilities.md)) |
 
 ## Layout and privacy (iteration 17)
 
@@ -167,7 +194,7 @@ naming the kind, unless a demo `main` is added (lib+bin is allowed).
 - **`internal/` — not importable by a consumer.** The connection-level request
   parser and carry-state record (`parse.wo`) and the serve loop, status text,
   and response serializer (`serve.wo`) live here. A consuming app that writes
-  `use writeonce-framework/internal` gets **WO-E108** at that `use`. The rule
+  `use porch/internal` gets **WO-E108** at that `use`. The rule
   is Go's: a path segment named `internal` is refused across the `[deps]`
   boundary only — the framework's own modules import it freely.
 
@@ -180,3 +207,20 @@ elimination); a consumer simply cannot name them.
 `docs/examples/web-app` — a small storefront importing this framework
 through `[deps]`. Its acceptance (`just web-app`) exercises the whole chain:
 fetch → lock → build → serve → durable restart.
+
+## Serving files
+
+`StaticFiles { dir, max_bytes }` mounts a directory on a wildcard route:
+
+```
+app.get("/assets/*path", StaticFiles { dir: "assets", max_bytes: 2097152 })
+app.get("/dl/*path",     StaticFiles { dir: "dist",   max_bytes: 16777216 })
+```
+
+Two rules, both refusals rather than repairs: a path containing `..` is a
+404 and never reaches the filesystem, and `max_bytes` is a hard ceiling —
+`fs.read_all` truncates above it, so set it above the largest file you
+mean to serve. Content types come from the extension; archives
+(`.tar.gz`, `.tgz`, `.zip`) also get `content-disposition: attachment`.
+Text is binary-safe in this language, so archives and images travel
+unchanged. Lifted out of the shop template 2026-08-25.
diff --git a/docs/examples/writeonce-framework/app.wo b/docs/examples/porch/app.wo
similarity index 98%
rename from docs/examples/writeonce-framework/app.wo
rename to docs/examples/porch/app.wo
index 78ec0b4..12a9cd4 100644
--- a/docs/examples/writeonce-framework/app.wo
+++ b/docs/examples/porch/app.wo
@@ -3,7 +3,7 @@
 --
 --   let app = App { middleware: [], gmw: [], afters: [], routes: [] };
 --   app.use_mw(Mw { m: Auth { token: t } });
---   app.use_after(Aw { a: SecurityHeaders { pad: 0 } });
+--   app.use_after(Aw { a: SecurityHeaders {} });
 --   app.add(Route { method: "GET", pattern: "/products/:id", h: Show {} });
 --   return app.serve("127.0.0.1", port);
 --
diff --git a/docs/examples/writeonce-framework/http/auth.wo b/docs/examples/porch/http/auth.wo
similarity index 100%
rename from docs/examples/writeonce-framework/http/auth.wo
rename to docs/examples/porch/http/auth.wo
diff --git a/docs/examples/porch/http/files.wo b/docs/examples/porch/http/files.wo
new file mode 100644
index 0000000..f382708
--- /dev/null
+++ b/docs/examples/porch/http/files.wo
@@ -0,0 +1,72 @@
+-- http/files.wo — serving a file from disk, the framework's answer to
+-- "let people download something". Lifted out of the shop template
+-- 2026-08-25, which had carried its own copy and said in a comment that
+-- this belonged here.
+--
+-- Mount it on a wildcard route and it answers that subtree:
+--
+--   app.get("/assets/*path", StaticFiles { dir: "assets",  max_bytes: 2097152 })
+--   app.get("/dl/*path",     StaticFiles { dir: "dist",    max_bytes: 8388608 })
+--
+-- Safety is two rules, both refusals rather than repairs: a path holding
+-- `..` is a 404 and never reaches the filesystem, and a file bigger than
+-- `max_bytes` is truncated by `fs.read_all` — so `max_bytes` is a real
+-- ceiling you must set above the largest file you intend to serve, not a
+-- hint. Text is binary-safe in this language, so archives and images
+-- travel unchanged.
+use fs
+
+pub class StaticFiles {
+  dir:       Text
+  max_bytes: Int
+
+  fn handle(req: Req) -> Resp {
+    let rel = req.params["path"];
+    if rel == nil {
+      return not_found();
+    }
+    -- Traversal: refuse, never normalise. A rewritten path is a second
+    -- chance to get it wrong.
+    if index_of("${rel}", "..") != -1 {
+      return not_found();
+    }
+    let body = try fs.read_all("${self.dir}/${rel}", self.max_bytes) catch (e) nil;
+    if body == nil {
+      return not_found();
+    }
+    let h: map<Text, Text> = {};
+    h["content-type"] = content_type("${rel}");
+    if is_download("${rel}") {
+      h["content-disposition"] = "attachment";
+    }
+    return Resp { status: 200, headers: h, body: "${body}" };
+  }
+}
+
+-- Extension to content type. Unknown extensions are octet-stream: a
+-- wrong guess is worse than no guess.
+pub fn content_type(name: Text) -> Text {
+  if ends_with(name, ".html") { return "text/html; charset=utf-8"; }
+  if ends_with(name, ".css") { return "text/css; charset=utf-8"; }
+  if ends_with(name, ".js") { return "text/javascript"; }
+  if ends_with(name, ".json") { return "application/json"; }
+  if ends_with(name, ".svg") { return "image/svg+xml"; }
+  if ends_with(name, ".png") { return "image/png"; }
+  if ends_with(name, ".webp") { return "image/webp"; }
+  if ends_with(name, ".ico") { return "image/x-icon"; }
+  if ends_with(name, ".woff2") { return "font/woff2"; }
+  if ends_with(name, ".txt") { return "text/plain; charset=utf-8"; }
+  if ends_with(name, ".sha256") { return "text/plain; charset=utf-8"; }
+  if ends_with(name, ".tar.gz") { return "application/gzip"; }
+  if ends_with(name, ".tgz") { return "application/gzip"; }
+  if ends_with(name, ".zip") { return "application/zip"; }
+  return "application/octet-stream";
+}
+
+-- Archives are offered as a save, not rendered into a tab.
+fn is_download(name: Text) -> Bool {
+  if ends_with(name, ".tar.gz") { return true; }
+  if ends_with(name, ".tgz") { return true; }
+  if ends_with(name, ".zip") { return true; }
+  return false;
+}
diff --git a/docs/examples/writeonce-framework/http/form.wo b/docs/examples/porch/http/form.wo
similarity index 100%
rename from docs/examples/writeonce-framework/http/form.wo
rename to docs/examples/porch/http/form.wo
diff --git a/docs/examples/writeonce-framework/http/multipart.wo b/docs/examples/porch/http/multipart.wo
similarity index 100%
rename from docs/examples/writeonce-framework/http/multipart.wo
rename to docs/examples/porch/http/multipart.wo
diff --git a/docs/examples/writeonce-framework/http/nego.wo b/docs/examples/porch/http/nego.wo
similarity index 100%
rename from docs/examples/writeonce-framework/http/nego.wo
rename to docs/examples/porch/http/nego.wo
diff --git a/docs/examples/writeonce-framework/http/secure.wo b/docs/examples/porch/http/secure.wo
similarity index 99%
rename from docs/examples/writeonce-framework/http/secure.wo
rename to docs/examples/porch/http/secure.wo
index 84aa26e..db8079e 100644
--- a/docs/examples/writeonce-framework/http/secure.wo
+++ b/docs/examples/porch/http/secure.wo
@@ -8,7 +8,6 @@
 -- framework's standing decision), so Strict-Transport-Security belongs
 -- in the proxy config next to the certificates.
 pub class SecurityHeaders {
-  pad: Int
   fn after(req: Req, mut r: Resp) {
     r.headers["x-content-type-options"] = "nosniff";
     r.headers["x-frame-options"] = "DENY";
diff --git a/docs/examples/writeonce-framework/http/types.wo b/docs/examples/porch/http/types.wo
similarity index 88%
rename from docs/examples/writeonce-framework/http/types.wo
rename to docs/examples/porch/http/types.wo
index 1287576..df2eb1a 100644
--- a/docs/examples/writeonce-framework/http/types.wo
+++ b/docs/examples/porch/http/types.wo
@@ -37,6 +37,17 @@ pub fn ok_text(body: Text) -> Resp {
   return Resp { status: 200, headers: h, body: body };
 }
 
+-- iteration 37: HTML is transport here, exactly like text and JSON —
+-- the status line and the content-type, nothing about rendering. It
+-- lives beside its two siblings because both HTML apps had hand-rolled
+-- the identical four lines; writeonce-view stays a pure Text library and never
+-- learns what a Resp is.
+pub fn ok_html(body: Text) -> Resp {
+  let h: map<Text, Text> = {};
+  h["content-type"] = "text/html; charset=utf-8";
+  return Resp { status: 200, headers: h, body: body };
+}
+
 pub fn ok_json(body: Text) -> Resp {
   let h: map<Text, Text> = {};
   h["content-type"] = "application/json";
diff --git a/docs/examples/writeonce-framework/http/ws.wo b/docs/examples/porch/http/ws.wo
similarity index 100%
rename from docs/examples/writeonce-framework/http/ws.wo
rename to docs/examples/porch/http/ws.wo
diff --git a/docs/examples/writeonce-framework/http/wsframe.wo b/docs/examples/porch/http/wsframe.wo
similarity index 100%
rename from docs/examples/writeonce-framework/http/wsframe.wo
rename to docs/examples/porch/http/wsframe.wo
diff --git a/docs/examples/writeonce-framework/internal/parse.wo b/docs/examples/porch/internal/parse.wo
similarity index 100%
rename from docs/examples/writeonce-framework/internal/parse.wo
rename to docs/examples/porch/internal/parse.wo
diff --git a/docs/examples/writeonce-framework/internal/serve.wo b/docs/examples/porch/internal/serve.wo
similarity index 100%
rename from docs/examples/writeonce-framework/internal/serve.wo
rename to docs/examples/porch/internal/serve.wo
diff --git a/docs/examples/writeonce-framework/router/router.wo b/docs/examples/porch/router/router.wo
similarity index 95%
rename from docs/examples/writeonce-framework/router/router.wo
rename to docs/examples/porch/router/router.wo
index 5a626cc..069df7b 100644
--- a/docs/examples/writeonce-framework/router/router.wo
+++ b/docs/examples/porch/router/router.wo
@@ -47,10 +47,10 @@ pub class Mw {
 }
 
 -- Request-line logging, the one middleware every framework ships: method +
--- path to stderr, never short-circuits. `pad` is the record-class ctor
--- convention (every stateless handler carries one Int field).
+-- path to stderr, never short-circuits. A stateless handler declares NO
+-- fields and constructs as `Logging {}` — an earlier convention gave every
+-- one of them a filler `pad: Int`, which the language never required.
 pub class Logging {
-  pad: Int
   fn before(mut req: Req) -> ?Resp {
     print_err("${req.method} ${req.path}");
     return nil;
diff --git a/docs/examples/writeonce-framework/wo.toml b/docs/examples/porch/wo.toml
similarity index 80%
rename from docs/examples/writeonce-framework/wo.toml
rename to docs/examples/porch/wo.toml
index 0e12d31..739f562 100644
--- a/docs/examples/writeonce-framework/wo.toml
+++ b/docs/examples/porch/wo.toml
@@ -1,4 +1,4 @@
-name        = "writeonce-framework"
+name        = "porch"
 kind        = "library"
 version     = "0.1.0"
 description = "A web framework written in writeonce: HTTP/1.1 keep-alive server core, router with :param captures, Handler/Middleware structural interfaces (iteration 16)"
@@ -9,4 +9,4 @@ wo = ">= 0.1"
 # A LIBRARY project (declared above since iteration 17): no `fn main` here —
 # the consuming app owns the entry. `woc <dir>` typechecks the whole project.
 # Apps import this repo through `wo.toml [deps]` (iteration 15) and
-# `use writeonce-framework` / `use writeonce-framework/http` / `.../router`.
+# `use porch` / `use porch/http` / `use porch/router`.
diff --git a/docs/examples/shop/README.md b/docs/examples/shop/README.md
new file mode 100644
index 0000000..e3bd455
--- /dev/null
+++ b/docs/examples/shop/README.md
@@ -0,0 +1,132 @@
+# shop — the writeonce program template
+
+A small store you can buy from, structured the way a real writeonce web
+app should be. **Copy this directory to start a new app**; every file
+has one concern, and the module system (one directory = one module,
+`pub` = the export line) enforces the separation the layout promises.
+
+## Run it
+
+```
+cd docs/examples/shop
+woc . && WO_DATA=./data ./target/shop 8080     # durable store
+./target/shop 8080                             # RAM-only (dev)
+```
+
+Browse http://127.0.0.1:8080/ — products → product page → buy (stock
+checked and decremented) → confirmation → /orders. With `WO_DATA`, kill
+it and restart: the orders are still there (WAL replay).
+
+The template builds and runs as written — the two `[deps]` resolve, the
+seed lands, and every route answers.
+
+## The view form
+
+A `render()` body is one backtick raw text literal. Markup is markup:
+real newlines, real double-quoted attributes, and the method's source
+indentation removed at compile time, so the served bytes carry the
+markup's own nesting and not the code's.
+
+```
+fn render() -> Text {
+  return `
+    <div class="card">
+      <h3><a href="/p/{{ self.sku }}">{{ self.name }}</a></h3>
+      <p class="price">€ ${self.price}</p>
+      ${stock}
+    </div>`;
+}
+```
+
+Every `render()` makes its class a **component** — writeonce-view's structural
+`Component` interface, satisfied by having the method, never declared.
+Parent components hold children directly (`cards: multi Component`) and
+render them with `render_all`, so `ProductListPage` knows nothing about
+`ProductCard` beyond `render()`. The document itself is a component too:
+`AppShell { title, content }` in `layout/app.wo`, which links a real
+stylesheet rather than inlining one — that is why it is its own shell and
+not writeonce-view's `Layout`.
+
+Two holes, and the difference is the whole escaping story:
+
+- `{{ expr }}` **HTML-escapes** — it compiles to a call to the `esc` in
+  scope (writeonce-view's, unless the app declares its own). Display data goes
+  here; a typo'd field is a compile error, not a broken page.
+- `${ expr }` is **raw** — for markup you built yourself, like the
+  `${stock}` fragment above or `${content}` in the app shell.
+
+Nothing is parsed at request time. The literal is a compile-time form:
+it produces exactly the string constant and concatenation chain the old
+hand-written version did, so there is no template engine to ship, warm
+up, or sandbox.
+
+## The file map (Angular equivalents)
+
+| this template | concern | Angular analog |
+| --- | --- | --- |
+| `types.wo` | MODEL — `@table` classes ARE the WAL database | `models/*.ts` (+ the entire database) |
+| `layout/app.wo` | app shell: document, header+footer composition, `ok_html`/`html_error` transport helpers | `app.component.html` |
+| `layout/header.wo` / `footer.wo` | shared chrome fragments | `header.html` / `footer.html` |
+| `product_list/view.wo` | VIEW — classes with `fn render() -> Text`, fields = exactly what is displayed | `product-list/view.html` |
+| `product_list/controller.wo` | CONTROLLER — query the model, fill the view, answer a `Resp`; beside its view in the same module | component `.ts` + service |
+| `product_page/`, `orders/` | one module per feature: `view.wo` + `controller.wo` | feature folders |
+| `/assets/*` | served by the framework's `StaticFiles` — the template no longer carries its own copy | `angular.json` assets |
+| `assets/style.css` | ONE real stylesheet, sectioned per feature | the `.scss` files |
+| the `render()` bodies | ONE raw text literal each: real newlines, real double-quoted attributes, source indentation removed at compile time, `${}` raw holes and `{{ }}` auto-escaping ones | Vue `<template>` (in-SFC) |
+| `layout/app.wo` → `AppShell` | the document, as a two-slot component | `app.component.html` |
+| `main.wo` | bootstrap: seed, routes, serve — nothing else | `app-routing.module.ts` + `main.ts` |
+
+Separation is compiler-enforced: one feature = one directory = one
+module, holding that feature's view AND its controller. A module sees
+only its own declarations plus what it `use`s, so a controller reaching
+into another feature has to say so. The `@table` classes sit in
+`types.wo` at the root and are reachable from every feature module
+without export — see gap #1 below for why that is not the contradiction
+it looks like.
+
+## What is deliberately different (doctrine)
+
+- **Templates compile or they don't exist (story 37).** See *The view
+  form* above: the markup is a compile-time literal, never a file
+  parsed per request. Gap #3 ("the language has NO multi-line
+  expression or literal", recorded while writing this template) is
+  CLOSED — the raw literal landed with story 37's compiler slice, and
+  this directory was its consumer. Styles stay a real CSS file, served
+  statically (there is no scss preprocessor).
+- **No closures, no DI.** A view is a class with fields + `render()`
+  (writeonce-view's `Component`); a controller is a class satisfying `Handler`.
+  Capture = a field.
+- **The MVC seam is enforced by where the query sits.** Controllers hold
+  every `from … select`; a view receives VALUES — for the list page, a
+  `multi Component` of already-filled cards. No view in this template
+  touches the database, and writeonce-view contains no query at all.
+- **No sessions/cart yet.** Buying is per-product (qty → order). A cart
+  needs a session story that does not exist yet.
+- **No client-side JS.** Every interaction is a form round trip.
+- **`pub` + `@table` cannot combine (recorded gap #1) — and it does not
+  matter.** `pub` in front of an annotated class is a parse error
+  (`WO-E101`), but no `@table` needs it: a CLASS is reachable across
+  module lines without being exported. Verified 2026-08-25 by building
+  and running all three shapes — a feature module querying a root
+  `@table`, a feature module using a root plain class, and an `@table`
+  declared inside a `types/` module and queried from the root. What IS
+  module-scoped is a free `fn` (`WO-E210`), so a query shared by two
+  features belongs on a class as a `static fn`. An earlier revision of
+  this file claimed the gap forced controllers into the root module and
+  made a `types/` module impossible; both were wrong, and the layout
+  below is what the language actually allows.
+- **`@view` projection classes (recorded gap #2):** today controllers
+  copy row fields into view classes by hand. The wished-for form —
+  `class ProductCard @view { ... }` filled by
+  `from p in Product select p.name, p.price` — needs projection
+  queries; recorded, not worked around.
+
+## Judging the DX — what to look at
+
+1. `types.wo` — the entire persistence layer is 20 lines.
+2. `orders.controller.wo` — the whole buying flow (validate, stock
+   check, decrement, durable insert, render) with no framework magic.
+3. `orders/view.wo` — the referendum, now answered: three render()
+   bodies, each one literal, no concatenation and no `esc()` calls, and
+   `OrdersPage` holding its rows as child components.
+4. `main.wo` — the app at a glance: five routes, one middleware, serve.
diff --git a/docs/examples/shop/assets/style.css b/docs/examples/shop/assets/style.css
new file mode 100644
index 0000000..715045e
--- /dev/null
+++ b/docs/examples/shop/assets/style.css
@@ -0,0 +1,47 @@
+/* shop/assets/style.css — one real stylesheet, sectioned per feature.
+   Served by static_files/controller.wo; AppShell links it. This file is
+   the .scss stand-in: the language ships no preprocessor, so styles are
+   plain CSS kept OUT of the markup code. */
+
+/* ---- layout (app.wo, header.wo, footer.wo) ---- */
+* { box-sizing: border-box; margin: 0; padding: 0; }
+body { font-family: system-ui, sans-serif; background: #f9fafb; color: #111827; line-height: 1.6; }
+.site-header { display: flex; align-items: center; justify-content: space-between;
+  padding: .75rem 1.5rem; background: #fff; border-bottom: 1px solid #e5e7eb;
+  position: sticky; top: 0; }
+.brand { font-size: 1.25rem; font-weight: 700; color: #111827; text-decoration: none; }
+.site-nav a { margin-left: 1rem; color: #2563eb; text-decoration: none; }
+.site-nav a:hover { text-decoration: underline; }
+.site-main { max-width: 64rem; margin: 0 auto; padding: 2rem 1rem; }
+.site-footer { border-top: 1px solid #e5e7eb; color: #6b7280; font-size: .875rem;
+  padding: 2rem 1rem; text-align: center; margin-top: 4rem; }
+h1 { margin-bottom: 1rem; }
+
+/* ---- product_list ---- */
+.grid { display: grid; grid-template-columns: repeat(3, 1fr); gap: 1.5rem; }
+@media (max-width: 640px) { .grid { grid-template-columns: 1fr; } }
+.card { background: #fff; border: 1px solid #e5e7eb; border-radius: .5rem;
+  padding: 1.5rem; box-shadow: 0 1px 2px rgba(0,0,0,.05); }
+.card h3 { margin-bottom: .5rem; }
+.card h3 a { color: #111827; text-decoration: none; }
+.card h3 a:hover { color: #2563eb; }
+.price { font-weight: 700; }
+.stock { color: #6b7280; font-size: .875rem; }
+.stock.out { color: #b91c1c; font-weight: 700; }
+
+/* ---- product_page ---- */
+.card.detail { max-width: 28rem; }
+.card.detail form { margin-top: 1rem; display: flex; flex-direction: column; gap: .5rem; }
+.card.detail label { font-size: .875rem; color: #374151; }
+.field { display: block; width: 100%; border: 1px solid #e5e7eb; border-radius: .25rem;
+  padding: .5rem; font-size: .875rem; }
+.btn { background: #2563eb; color: #fff; border: 0; border-radius: .25rem;
+  padding: .5rem 1rem; font-weight: 700; cursor: pointer; }
+.btn:hover { background: #1d4ed8; }
+
+/* ---- orders ---- */
+table.orders { width: 100%; border-collapse: collapse; background: #fff;
+  border: 1px solid #e5e7eb; border-radius: .5rem; }
+table.orders th, table.orders td { text-align: left; padding: .5rem .75rem;
+  border-bottom: 1px solid #e5e7eb; }
+table.orders th { background: #f9fafb; font-size: .875rem; color: #374151; }
diff --git a/docs/examples/shop/layout/app.wo b/docs/examples/shop/layout/app.wo
new file mode 100644
index 0000000..9d0309c
--- /dev/null
+++ b/docs/examples/shop/layout/app.wo
@@ -0,0 +1,50 @@
+-- layout/app.wo — the app shell (app.html's analog): one full document
+-- wrapping every page with the shared header and footer. Styles are NOT
+-- inlined — pages link /assets/style.css (served by static_files), so
+-- markup and styling stay separate files.
+use porch/http
+use view
+
+-- The app shell as a COMPONENT (writeonce-view's `Component`: fields in, Text
+-- out), the same shape as writeonce-view's own `Layout` — two slots instead of
+-- four, and its own document rather than `page()`'s, because this
+-- template deliberately LINKS a stylesheet instead of inlining one.
+-- That is the whole reason it is not just `Layout`: markup and styling
+-- stay separate files here.
+pub class AppShell {
+  title:   Text
+  content: Text
+
+  fn render() -> Text {
+    return `
+      <!doctype html>
+      <html>
+      <head>
+      <meta charset="utf-8">
+      <meta name="viewport" content="width=device-width,initial-scale=1">
+      <title>{{ self.title }}</title>
+      <link rel="stylesheet" href="/assets/style.css">
+      </head>
+      <body>
+        ${header()}
+        <main class="site-main">${self.content}</main>
+        ${footer()}
+      </body>
+      </html>`;
+  }
+}
+
+-- `ok_html` is the FRAMEWORK's (http/types.wo, beside ok_text/ok_json):
+-- a status line and a content-type is transport, not rendering, and both
+-- HTML samples had hand-rolled the identical four lines.
+
+pub fn html_error(status: Int, title: Text, msg: Text) -> Resp {
+  let content = `
+    <h1>{{ title }}</h1>
+    <p>{{ msg }}</p>
+    <p><a href="/">Back to products</a></p>`;
+  let shell = AppShell { title: "shop — ${title}", content: content };
+  let h: map<Text, Text> = {};
+  h["content-type"] = "text/html; charset=utf-8";
+  return Resp { status: status, headers: h, body: shell.render() };
+}
diff --git a/docs/examples/shop/layout/footer.wo b/docs/examples/shop/layout/footer.wo
new file mode 100644
index 0000000..6c4c268
--- /dev/null
+++ b/docs/examples/shop/layout/footer.wo
@@ -0,0 +1,4 @@
+-- layout/footer.wo — the footer fragment (footer.html's analog).
+pub fn footer() -> Text {
+  return `<footer class="site-footer">writeonce shop — one binary: server, database, these pages.</footer>`;
+}
diff --git a/docs/examples/shop/layout/header.wo b/docs/examples/shop/layout/header.wo
new file mode 100644
index 0000000..b1ae5d5
--- /dev/null
+++ b/docs/examples/shop/layout/header.wo
@@ -0,0 +1,8 @@
+-- layout/header.wo — the header fragment (header.html's analog).
+pub fn header() -> Text {
+  return `
+    <header class="site-header">
+      <a href="/" class="brand">writeonce shop</a>
+      <nav class="site-nav"><a href="/">Products</a> <a href="/orders">Orders</a></nav>
+    </header>`;
+}
diff --git a/docs/examples/shop/main.wo b/docs/examples/shop/main.wo
new file mode 100644
index 0000000..07672c5
--- /dev/null
+++ b/docs/examples/shop/main.wo
@@ -0,0 +1,51 @@
+-- shop/main.wo — the bootstrap (app-routing.module's analog): seed the
+-- store on first boot, wire routes to the feature controllers, serve.
+-- No rendering and no queries here beyond the seed.
+--
+--   WO_DATA=./data ./target/shop 8080     (run from the shop directory:
+--   /assets/* serves from ./assets)
+use porch
+use porch/http
+use porch/router
+use product_list
+use product_page
+use orders
+
+fn seed_if_empty() {
+  let n = 0;
+  for p in from x in Product take 1 select x {
+    n = n + 1;
+  }
+  if n > 0 {
+    return;
+  }
+  insert Product { sku: "keyb-75", name: "75% mechanical keyboard", price: 89.0, stock: 12 };
+  insert Product { sku: "mug-wal", name: "WAL-backed coffee mug", price: 14.5, stock: 40 };
+  insert Product { sku: "tee-own", name: "Ownership-checked t-shirt", price: 24.9, stock: 25 };
+  insert Product { sku: "desk-pad", name: "Deskmat (one binary edition)", price: 19.0, stock: 0 };
+}
+
+fn main(args: multi Text) -> Int {
+  if len(args) < 1 {
+    print_err("usage: shop <port>   (WO_DATA=<dir> makes the store durable)");
+    return 2;
+  }
+  let port = parse_int(args[0]);
+  if port == nil {
+    print_err("shop: <port> must be a number");
+    return 2;
+  }
+
+  seed_if_empty();
+
+  let app = App { middleware: [], routes: [] };
+  app.use_mw(Mw { m: Logging {} });
+  app.get("/",                ListProducts {});
+  app.get("/p/:sku",          ShowProduct {});
+  app.post("/orders/:sku",    CreateOrder {});
+  app.get("/orders",          ListOrders {});
+  -- the framework's file server (serve/http): 2 MiB ceiling is well
+  -- above this template's stylesheet.
+  app.get("/assets/*path",    StaticFiles { dir: "assets", max_bytes: 2097152 });
+  return app.serve("127.0.0.1", port);
+}
diff --git a/docs/examples/shop/orders/controller.wo b/docs/examples/shop/orders/controller.wo
new file mode 100644
index 0000000..edfc2e4
--- /dev/null
+++ b/docs/examples/shop/orders/controller.wo
@@ -0,0 +1,53 @@
+-- orders/controller.wo — the buying flow: stock-checked order creation
+-- (decrement + insert are each WAL-committed before they acknowledge)
+-- and the orders list (ref navigation: o.product.name).
+use porch/http
+use layout
+use time
+
+pub class CreateOrder {
+  fn handle(req: Req) -> Resp {
+    let sku = req.params["sku"];
+    if sku == nil {
+      return html_error(404, "No such product", "The order names no product.");
+    }
+    let f = form_values(req);
+    if f == nil {
+      return html_error(400, "Bad order", "The form did not arrive form-encoded.");
+    }
+    let qraw = f["qty"];
+    if qraw == nil {
+      return html_error(400, "Bad order", "How many? The qty field is missing.");
+    }
+    let qty = parse_int(trim("${qraw}"));
+    if qty == nil or qty < 1 {
+      return html_error(400, "Bad order", "qty must be a positive number.");
+    }
+    let hits = from p in Product where p.sku == sku take 1 select p;
+    if len(hits) == 0 {
+      return html_error(404, "No such product", "Nothing is listed under that sku.");
+    }
+    let p = hits[0];
+    if p.stock < qty {
+      return html_error(409, "Not enough stock", "Only ${p.stock} left of ${p.name}.");
+    }
+    let total = p.price * float(qty);
+    p.stock = p.stock - qty;
+    insert Order { product: p, qty: qty, total: total, placed: time.now(), status: "placed" };
+    let page = OrderOk { name: p.name, qty: qty, total: total };
+    let shell = AppShell { title: "shop — order placed", content: page.render() };
+    return ok_html(shell.render());
+  }
+}
+
+pub class ListOrders {
+  fn handle(req: Req) -> Resp {
+    let rows: multi Component = [];
+    for o in from x in Order select x {
+      push(rows, OrderRow { name: o.product.name, qty: o.qty, total: o.total, status: o.status });
+    }
+    let page = OrdersPage { rows: rows };
+    let shell = AppShell { title: "shop — orders", content: page.render() };
+    return ok_html(shell.render());
+  }
+}
diff --git a/docs/examples/shop/orders/view.wo b/docs/examples/shop/orders/view.wo
new file mode 100644
index 0000000..c717266
--- /dev/null
+++ b/docs/examples/shop/orders/view.wo
@@ -0,0 +1,54 @@
+-- orders/view.wo — the confirmation page and the orders table.
+-- Raw text literals for the bodies; see product_list/view.wo for the
+-- convention.
+use view
+
+pub class OrderOk {
+  name:  Text
+  qty:   Int
+  total: Float
+
+  fn render() -> Text {
+    return `
+      <div class="card">
+        <h1>Order placed</h1>
+        <p>${self.qty} × {{ self.name }} — total € ${self.total}</p>
+        <p><a href="/orders">See all orders</a> · <a href="/">Keep shopping</a></p>
+      </div>`;
+  }
+}
+
+pub class OrderRow {
+  name:   Text
+  qty:    Int
+  total:  Float
+  status: Text
+
+  fn render() -> Text {
+    return `
+      <tr>
+        <td>{{ self.name }}</td>
+        <td>${self.qty}</td>
+        <td>€ ${self.total}</td>
+        <td>{{ self.status }}</td>
+      </tr>`;
+  }
+}
+
+pub class OrdersPage {
+  rows: multi Component
+
+  fn render() -> Text {
+    if len(self.rows) == 0 {
+      return `
+        <h1>Orders</h1>
+        <p>No orders yet — <a href="/">go buy something</a>.</p>`;
+    }
+    return `
+      <h1>Orders</h1>
+      <table class="orders">
+        <tr><th>Product</th><th>Qty</th><th>Total</th><th>Status</th></tr>
+        ${render_all(self.rows)}
+      </table>`;
+  }
+}
diff --git a/docs/examples/shop/product_list/controller.wo b/docs/examples/shop/product_list/controller.wo
new file mode 100644
index 0000000..da69d39
--- /dev/null
+++ b/docs/examples/shop/product_list/controller.wo
@@ -0,0 +1,21 @@
+-- product_list/controller.wo — the CONTROLLER for /: query the model,
+-- fill the view components beside it, answer a Resp. One feature = one
+-- directory = one module, view and controller together. The @tables it
+-- queries live in the root module, which is fine: a CLASS is reachable
+-- across module lines (only free `fn`s are module-scoped).
+use porch/http
+use layout
+
+pub class ListProducts {
+  fn handle(req: Req) -> Resp {
+    -- The MVC seam: the query is HERE, and what crosses into the view is
+    -- a list of child components, never a cursor.
+    let cards: multi Component = [];
+    for p in from x in Product order by x.name select x {
+      push(cards, ProductCard { sku: p.sku, name: p.name, price: p.price, stock: p.stock });
+    }
+    let page = ProductListPage { cards: cards };
+    let shell = AppShell { title: "shop — products", content: page.render() };
+    return ok_html(shell.render());
+  }
+}
diff --git a/docs/examples/shop/product_list/view.wo b/docs/examples/shop/product_list/view.wo
new file mode 100644
index 0000000..067cac0
--- /dev/null
+++ b/docs/examples/shop/product_list/view.wo
@@ -0,0 +1,41 @@
+-- product_list/view.wo — the VIEW. Classes with `fn render() -> Text`;
+-- fields are exactly the values displayed, and a body is ONE raw text
+-- literal: markup written as markup, attributes in real double quotes,
+-- source indentation removed at compile time. `${}` interpolates raw,
+-- `{{ }}` HTML-escapes — so display data goes through `{{ }}` and never
+-- through a hand-written esc() call.
+use view
+
+pub class ProductCard {
+  sku:   Text
+  name:  Text
+  price: Float
+  stock: Int
+
+  fn render() -> Text {
+    let stock = `<p class="stock">${self.stock} in stock</p>`;
+    if self.stock == 0 {
+      stock = `<p class="stock out">sold out</p>`;
+    }
+    return `
+      <div class="card">
+        <h3><a href="/p/{{ self.sku }}">{{ self.name }}</a></h3>
+        <p class="price">€ ${self.price}</p>
+        ${stock}
+      </div>`;
+  }
+}
+
+-- A parent component: its `cards` are CHILDREN, held through the
+-- structural interface, and its render calls theirs. Nothing here knows
+-- that a card is a ProductCard — swapping in a different card component
+-- is a controller change, not a view rewrite.
+pub class ProductListPage {
+  cards: multi Component
+
+  fn render() -> Text {
+    return `
+      <h1>Products</h1>
+      <div class="grid">${render_all(self.cards)}</div>`;
+  }
+}
diff --git a/docs/examples/shop/product_page/controller.wo b/docs/examples/shop/product_page/controller.wo
new file mode 100644
index 0000000..f7ac6e6
--- /dev/null
+++ b/docs/examples/shop/product_page/controller.wo
@@ -0,0 +1,20 @@
+-- product_page/controller.wo — the CONTROLLER for /p/:sku.
+use porch/http
+use layout
+
+pub class ShowProduct {
+  fn handle(req: Req) -> Resp {
+    let sku = req.params["sku"];
+    if sku == nil {
+      return html_error(404, "No such product", "The address is missing a product.");
+    }
+    let hits = from p in Product where p.sku == sku take 1 select p;
+    if len(hits) == 0 {
+      return html_error(404, "No such product", "Nothing is listed under that sku.");
+    }
+    let p = hits[0];
+    let page = ProductPage { sku: p.sku, name: p.name, price: p.price, stock: p.stock };
+    let shell = AppShell { title: "shop — ${p.name}", content: page.render() };
+    return ok_html(shell.render());
+  }
+}
diff --git a/docs/examples/shop/product_page/view.wo b/docs/examples/shop/product_page/view.wo
new file mode 100644
index 0000000..f8449e3
--- /dev/null
+++ b/docs/examples/shop/product_page/view.wo
@@ -0,0 +1,31 @@
+-- product_page/view.wo — the product detail view with the order form.
+-- Raw text literals for the bodies; see product_list/view.wo for the
+-- convention.
+use view
+
+pub class ProductPage {
+  sku:   Text
+  name:  Text
+  price: Float
+  stock: Int
+
+  fn render() -> Text {
+    let action = `
+      <form method="POST" action="/orders/{{ self.sku }}">
+        <label>Quantity</label>
+        <input type="text" name="qty" value="1" class="field">
+        <button type="submit" class="btn">Buy</button>
+      </form>`;
+    if self.stock == 0 {
+      action = `<p class="stock out">sold out</p>`;
+    }
+    return `
+      <div class="card detail">
+        <h1>{{ self.name }}</h1>
+        <p class="price">€ ${self.price}</p>
+        <p class="stock">${self.stock} in stock</p>
+        ${action}
+      </div>
+      <p><a href="/">← all products</a></p>`;
+  }
+}
diff --git a/docs/examples/shop/types.wo b/docs/examples/shop/types.wo
new file mode 100644
index 0000000..2dd41a3
--- /dev/null
+++ b/docs/examples/shop/types.wo
@@ -0,0 +1,29 @@
+-- types.wo — the MODEL. Every @table class IS a WAL-backed table: rows
+-- persist under WO_DATA and replay on restart; without WO_DATA the
+-- store is RAM-only (handy while developing). Nothing else lives here —
+-- no rendering, no request handling.
+--
+-- Root module by NECESSITY, not choice: `pub` and `@table` cannot
+-- combine yet (recorded language gap), so tables cannot be exported to
+-- other modules — everything that queries them (the controllers) lives
+-- in the root module too. When the gap closes, this file becomes a
+-- `types/` module and the controllers move into their feature folders.
+
+@table(name: "products", index: [sku])
+class Product {
+  sku:   Text @unique
+  name:  Text
+  price: Float
+  stock: Int
+
+  orders: backlink Order.product
+}
+
+@table(name: "orders", index: [product])
+class Order {
+  product: ref Product
+  qty:     Int
+  total:   Float
+  placed:  Int    -- epoch ms (time.now at purchase)
+  status:  Text   -- "placed" in v1; a fulfilment flow would grow this
+}
diff --git a/docs/examples/shop/wo.toml b/docs/examples/shop/wo.toml
new file mode 100644
index 0000000..7f1b0a2
--- /dev/null
+++ b/docs/examples/shop/wo.toml
@@ -0,0 +1,12 @@
+name        = "shop"
+version     = "0.1.0"
+description = "The writeonce program template: an MVC-separated shop — @table model, render() view classes, controller handlers, static assets"
+
+[runtime]
+wo = ">= 0.1"
+
+# Two library dependencies, the site sample's proven shape. The [deps]
+# KEY is the module name `use` imports.
+[deps]
+porch     = { git = "https://github.com/shoneyj/porch", rev = "v0.1.0" }
+view      = { git = "https://github.com/shoneyj/writeonce-view", rev = "v0.1.0" }
diff --git a/docs/examples/site/CODE-LOGIC.md b/docs/examples/site/CODE-LOGIC.md
index fa17165..e52df55 100644
--- a/docs/examples/site/CODE-LOGIC.md
+++ b/docs/examples/site/CODE-LOGIC.md
@@ -1,36 +1,108 @@
 # site — how it is put together
 
-Written 2026-08-23, with the sample's landing. Three files, one binary.
+Written 2026-08-23 with the sample's landing; restructured 2026-08-25
+onto the program template's MVC layout (`docs/examples/shop`), so the two
+samples now read the same way.
 
-| file | what it owns |
-| --- | --- |
-| `main.wo` | the `Chapter` table, seed-if-empty, the HTML shell (header/nav), four handlers (Home, ShowChapter, AdminEdit, Health), `main` |
-| `content.wo` | the nine chapter bodies as functions returning HTML fragments, and `seed_chapters()` — same directory, so it shares `main.wo`'s declarations without `use` |
-| `wo.toml` | the two [deps]: `framework` (serving) and `html` (markup) |
+## The layout
 
-Decisions that are not obvious from the code:
+| file | layer | what it owns |
+| --- | --- | --- |
+| `types.wo` | MODEL | the `Chapter` `@table`, the `ChapterLink` projection, `Chapters.links()`, and `seed_if_empty()` |
+| `content.wo` | MODEL (content) | the nine chapter bodies as fragment-returning functions, plus `seed_chapters()` |
+| `layout/app.wo` | VIEW (chrome) | `AppShell` — the component that fills writeonce-view's `Layout` — the two named widths, and `html_error` |
+| `layout/header.wo`, `layout/footer.wo` | VIEW (chrome) | the shared nav bar (brand = mark + wordmark) and footer |
+| `layout/logo.wo` | VIEW (chrome) | the mark as inline SVG, plus the `<head>` links |
+| `install/view.wo`, `install/controller.wo` | VIEW + CONTROLLER | `/install` — the toolchain guide. Static copy, so `InstallPage` has no fields |
+| `packages/view.wo`, `packages/controller.wo` | VIEW + CONTROLLER | `/packages` and `/packages/:name` — the catalogue, its cards, and per-package usage |
+| `favicon/controller.wo` | CONTROLLER | `/favicon.svg` — builds its own `Resp` (image/svg+xml) |
+| `home/view.wo` | VIEW | `HomePage` and the homepage's code showcase |
+| `home/controller.wo` | CONTROLLER | `Home` — the `/` handler |
+| `chapter/view.wo` | VIEW | `ChapterNav`, `ChapterPage` |
+| `chapter/controller.wo` | CONTROLLER | `ShowChapter` — the `/ch/:slug` handler |
+| `admin/controller.wo` | CONTROLLER | `AdminEdit` — bearer-gated edit, answers a redirect (no view: it redirects) |
+| `health/controller.wo` | CONTROLLER | `Health` — the liveness probe (no view: it answers text) |
+| `main.wo` | BOOTSTRAP | seed, routes, serve. Nothing else |
+| `wo.toml` | — | the two `[deps]`: `framework` (serving) and `html` (markup) |
 
-- **Chapters are rows, not constants.** `seed_if_empty()` inserts them only
-  when the table answers empty, so a WAL restart keeps admin edits instead
-  of reseeding over them — the sample's own proof of chapter 6's claim.
-  The seed bodies are BUILT with wo-html's builders at boot; after that
-  the table is the truth and the builders are never consulted again.
+One feature = one directory = one module, holding that feature's view
+and its controller together. A module sees its own declarations plus
+what it `use`s, so `home/` reaching the chapter nav has to say `use
+chapter`.
+
+The model stays at the root and is reachable from everywhere: a CLASS
+crosses module lines without being exported, and only a free `fn` is
+module-scoped (`WO-E210`). That single rule explains the whole layout —
+`Chapter` and `ChapterLink` are classes, so the feature modules just
+name them; the shared query would have been a free fn, so it is a
+`static fn` on `Chapters` instead. (`pub` cannot prefix an `@table`
+class — recorded gap #1 — but nothing needs it to.)
+
+## Decisions that are not obvious from the code
+
+- **Chapters are rows, not constants.** `seed_if_empty()` inserts them
+  only when the table answers empty, so a WAL restart keeps admin edits
+  instead of reseeding over them — the sample's own proof of chapter 6's
+  claim. The seed bodies are BUILT with writeonce-view's builders at boot; after
+  that the table is the truth and the builders are never consulted again.
+- **The seam is enforced by where the query sits.** `Chapters.links()`
+  lives with the MODEL and hands the view a `multi ChapterLink` —
+  a projection, not a cursor. No component in this sample touches the
+  database, which is what lets `ChapterNav` be the same component on the
+  homepage and on every chapter page, differing only by `current`.
+- **`HomePage` and `ChapterPage` hold a `Component`, not chapter data.**
+  The nav arrives as an already-built child component in a slot, so
+  neither page knows what a chapter is. That is content projection —
+  Angular's `<ng-content>`, with the slot as an ordinary field.
+- **Two widths, named once.** `AppShell` carries a `container` field and
+  `layout/app.wo` exports `reading_shell` / `wide_shell`. The Tailwind
+  class strings appear in exactly one place instead of being repeated at
+  every call site.
 - **Auth is handler-side by doctrine.** The framework ships mechanism
   (`bearer_token`, constant-time `ct_eq`); which routes are gated and by
   which token is policy, so `AdminEdit` checks its own field. No global
   middleware — the public pages stay public.
+- **`ok_html` is the framework's**, beside `ok_text`/`ok_json`: a status
+  line plus a content-type is transport, not rendering.
 - **`\$` in chapter code samples.** Chapter sources show interpolation
   (`${port}`) inside string literals of a language that interpolates —
   the lexer's `\$` escape keeps them literal; `code_block()` then
-  HTML-escapes the result.
-- **One-line concat chains.** `..` does not straddle newlines (Go-style
-  implicit statement ends), so long fragments build accumulator-style
-  (`b = b .. "...";` per line) — the same shape serve.wo uses for
-  response heads.
-- **wo-html's sheet is static.** Tailwind's class NAMES, one hand-written
+  HTML-escapes the result. This is also why those two samples stay
+  escaped `"..."` strings rather than becoming raw literals: a raw
+  literal has no escape character, so it cannot spell a literal `${`.
+- **Concat spans lines two ways now.** A line ENDING in `..` continues on
+  the next (the one newline suppression in the language) — it never works
+  at the START of a line. For markup, prefer the backtick raw literal:
+  real newlines, real double-quoted attributes, source indentation
+  removed at compile time, `${ }` raw and `{{ }}` auto-escaping. The old
+  "`..` does not straddle newlines, so build accumulator-style" note is
+  obsolete and was removed.
+- **The logo is inline SVG, authored once.** `logo_svg(px)` goes in the
+  nav brand and `favicon_svg()` is served at `/favicon.svg` — a dark tile
+  with a two-stroke "W", white then accent blue. No asset pipeline, no
+  binary in the repo, and it stays legible at 16px. The `<head>` link
+  reaches the document through `Layout`'s `head` slot.
+- **A raw literal cannot contain a literal `{{`.** The packages page has
+  prose ABOUT `{{ }}` holes, and writing it directly would have made it a
+  hole; it is written with `&#123;` entities instead. This is the same
+  limitation the chapter code samples hit with `${`, and the reason both
+  doors exist.
+- **Downloads are the framework's, not the site's.** `/dl/*path` is
+  `StaticFiles` mounted in `main.wo` with a 16 MiB ceiling — no
+  controller, because there is no decision to make. `WO_DIST` says where
+  the tarballs are (default `./dist`). The install page offers the GitHub
+  release as primary and this as a mirror, with the `.sha256` beside it.
+- **The supported-systems list is read off the binaries**, not off a
+  wish list: `file` gives the triple, and the highest `GLIBC_` symbol
+  version they import gives the libc floor (2.38 today). Overstating
+  support costs a reader an afternoon.
+- **`SITE_HOST` picks the interface.** Loopback by default — right behind
+  a proxy — with the env var for reaching a dev instance across the LAN.
+  The bound address is printed at startup.
+- **writeonce-view's sheet is static.** Tailwind's class NAMES, one hand-written
   CSS string inlined per page by `page()` — self-contained responses, no
   toolchain; growing the sheet is appending a line in `tw_css()`.
 
-Gate: `just site` — see scripts/site-accept.sh (11 checks; the restart
+Gate: `just site` — see `scripts/site-accept.sh` (11 checks; the restart
 leg polls `/health` instead of sleeping, so it does not share
 web-app-accept's 0.5s boot race).
diff --git a/docs/examples/site/README.md b/docs/examples/site/README.md
index 82f0e1d..eff6c72 100644
--- a/docs/examples/site/README.md
+++ b/docs/examples/site/README.md
@@ -2,13 +2,13 @@
 
 The language tutorial, served BY the language. One binary carries the HTTP
 server, the router, the pages and the database; the chapters you read are
-rows in a `@table`, the markup is built by the `wo-html` dependency, and
+rows in a `@table`, the markup is built by the `writeonce-view` dependency, and
 the whole thing is chapter 9's own example.
 
 ```
 [deps]
-framework = { git = "https://github.com/shoneyj/writeonce-framework", rev = "v0.1.0" }
-html      = { git = "https://github.com/shoneyj/wo-html",             rev = "v0.1.0" }
+porch     = { git = "https://github.com/shoneyj/porch", rev = "v0.1.0" }
+view      = { git = "https://github.com/shoneyj/writeonce-view",             rev = "v0.1.0" }
 ```
 
 ## Run it
@@ -17,7 +17,21 @@ html      = { git = "https://github.com/shoneyj/wo-html",             rev = "v0.
 woc . && SITE_TOKEN=change-me WO_DATA=./data ./target/site 8080
 ```
 
-- `GET /` — the chapter index; `GET /ch/<slug>` — one chapter.
+It binds loopback by default. To reach it from another machine while
+developing, name the interface:
+
+```
+SITE_HOST=0.0.0.0 SITE_TOKEN=change-me WO_DATA=./data ./target/site 8080
+```
+
+- `GET /` — the homepage; `GET /ch/<slug>` — one chapter.
+- `GET /install` — the installation guide; `GET /packages` and
+  `GET /packages/<name>` — the package catalogue with copy-paste
+  `[deps]` lines and usage.
+- `GET /favicon.svg` — the mark, inline SVG, no asset pipeline.
+- `GET /dl/<file>` — release tarballs, served by the framework's
+  `StaticFiles` from `$WO_DIST` (default `./dist`, where `just dist`
+  writes them).
 - `POST /admin/ch/<slug>` — edit a chapter (`title`/`body`, form-encoded,
   `authorization: Bearer $SITE_TOKEN`). Edits are WAL-durable under
   `WO_DATA` and replay on restart — that is chapter 6, demonstrated by
@@ -28,6 +42,41 @@ The acceptance gate is `just site` (scripts/site-accept.sh): two file://
 dep remotes, build, the page matrix, 401, an authed edit, SIGTERM, and
 the edit surviving a restart.
 
+## The file map
+
+MVC, laid out exactly like the program template
+([`docs/examples/shop`](../shop/README.md)) so the two read the same way:
+
+| this app | layer |
+| --- | --- |
+| `types.wo` | MODEL — the `Chapter` `@table`, and seed-if-empty |
+| `content.wo` | the nine chapter bodies + `seed_chapters()` |
+| `layout/` | the chrome: `AppShell` (+ the two named widths), header, footer, `html_error` |
+| `home/`, `chapter/`, `install/`, `packages/` | one module per feature: its `view.wo` (components: fields in, Text out) and its `controller.wo` (query the model, fill the components, answer a `Resp`) |
+| `admin/`, `health/`, `favicon/` | controller-only features — a redirect, a text probe, an SVG |
+| `layout/logo.wo` | the mark as inline SVG: one source for the nav brand and `/favicon.svg` |
+| `main.wo` | bootstrap: seed, routes, serve — nothing else |
+
+Every `render()` makes its class a component (writeonce-view's structural
+`Component`). `HomePage` and `ChapterPage` each take the chapter nav as
+an already-built child component in a slot, so neither knows what a
+chapter is; `ChapterNav` is therefore literally the same component on the
+homepage and on every chapter page, differing only by which `ord` is
+current.
+
+The seam that keeps it honest: **every query lives in a controller.**
+`chapter_links()` sits in `chapter.controller.wo` and hands the views a
+`multi ChapterLink` projection — no component in this sample touches the
+database, and writeonce-view contains no query at all.
+
+One feature = one directory = one module, holding that feature's view
+and its controller. The `@table` lives in `types.wo` at the root and is
+reachable from every feature module without being exported — a CLASS
+crosses module lines, only a free `fn` is module-scoped (`WO-E210`).
+That is why the query both pages need is `Chapters.links()`, a `static
+fn` on a root class, rather than a free function one of them would have
+to import from the other.
+
 ## writeonce.de deployment
 
 The framework speaks HTTP/1.1 keep-alive and no TLS by design — terminate
@@ -44,11 +93,48 @@ server {
 Run the binary under systemd (`Restart=on-failure`, `Environment=SITE_TOKEN=...`,
 `Environment=WO_DATA=/var/lib/writeonce-site`); SIGTERM drains cleanly.
 
+### What to copy to the host
+
+The binary is self-contained — VM, bytecode and database engine are
+inside it — but two directories are read at RUNTIME and must travel
+with it:
+
+```
+/srv/writeonce-site/
+  site                     the binary (docs/examples/site/target/site)
+  dist/                    what /dl serves — the RELEASE assets:
+    writeonce-0.1.0-linux-amd64.tar.gz
+    writeonce-0.1.0-linux-amd64.tar.gz.sha256
+  data/                    WO_DATA — the WAL; create it, keep it
+```
+
+```
+SITE_TOKEN=<bearer for /admin>   required, the process refuses to start without it
+WO_DATA=/srv/writeonce-site/data durable chapters; omit for RAM-only
+WO_DIST=/srv/writeonce-site/dist where /dl reads from (default ./dist)
+SITE_HOST                        leave UNSET behind a proxy — loopback is the
+                                 right default; set it only to expose directly
+```
+
+Behind a proxy `SITE_HOST` stays unset, so the process binds
+`127.0.0.1` and is unreachable except through nginx. It prints the
+bound address at startup, which is the quickest way to confirm that.
+
+**Keep `dist/` the published release, not a local build.** `just dist`
+produces a different digest on every run, so a locally built tarball
+would not match the `.sha256` the release publishes and would make the
+mirror disagree with the GitHub download. Fetch the assets from the
+release instead:
+
+```
+gh release download v0.1.0 -D dist -R shoneyJ/writeonce
+```
+
 ## What it demonstrates
 
 Chapters 1–9 teach the language (values, containers, classes, optionals,
 tables, actors, deps, serving); the app itself exercises the framework's
 routing/:params, the Logging middleware, bearer auth (mechanism from
 `http/auth.wo`, policy here), `form_values`, `@table` + query + update by
-assignment, and `wo-html`'s escaping/builders/Tailwind-style utility
+assignment, and `writeonce-view`'s escaping/builders/Tailwind-style utility
 sheet — self-contained pages, no CDN, no JS, no build step.
diff --git a/docs/examples/site/admin/controller.wo b/docs/examples/site/admin/controller.wo
new file mode 100644
index 0000000..244a7bb
--- /dev/null
+++ b/docs/examples/site/admin/controller.wo
@@ -0,0 +1,33 @@
+-- admin.controller.wo — POST /admin/ch/:slug: title/body update,
+-- form-encoded, bearer-gated. Mechanism (bearer_token, constant-time
+-- ct_eq) is the framework's; POLICY — which routes, which token — is
+-- this app's, right here. No rendering: the answer is a redirect.
+use porch/http
+
+pub class AdminEdit {
+  token: Text
+
+  fn handle(req: Req) -> Resp {
+    let got = bearer_token(req);
+    if got == nil { return unauthorized(); }
+    if ct_eq("${got}", self.token) == false { return unauthorized(); }
+    let slug = req.params["slug"];
+    if slug == nil { return not_found(); }
+    let hits = from c in Chapter where c.slug == slug take 1 select c;
+    if len(hits) == 0 { return not_found(); }
+    let f = form_values(req);
+    if f == nil { return bad_request("body must be form-encoded (title, body)"); }
+    let title = f["title"];
+    let body = f["body"];
+    if title == nil and body == nil { return bad_request("nothing to update"); }
+    if title != nil {
+      let t = trim("${title}");
+      if t == "" { return bad_request("title must not be empty"); }
+      hits[0].title = t;
+    }
+    if body != nil {
+      hits[0].body = "${body}";
+    }
+    return redirect("/ch/${slug}");
+  }
+}
diff --git a/docs/examples/site/chapter/controller.wo b/docs/examples/site/chapter/controller.wo
new file mode 100644
index 0000000..36493f0
--- /dev/null
+++ b/docs/examples/site/chapter/controller.wo
@@ -0,0 +1,23 @@
+-- chapter/controller.wo — the CONTROLLER for `/ch/:slug`. It queries the
+-- model and fills the view components that sit beside it in this module;
+-- a view receives VALUES, never a cursor.
+use porch/http
+use layout
+
+pub class ShowChapter {
+  fn handle(req: Req) -> Resp {
+    let slug = req.params["slug"];
+    if slug == nil {
+      return html_error(404, "No such chapter", "The address names no chapter.");
+    }
+    let hits = from c in Chapter where c.slug == slug take 1 select c;
+    if len(hits) == 0 {
+      return html_error(404, "No such chapter", "Nothing is filed under that slug.");
+    }
+    let c = hits[0];
+    let nav = ChapterNav { items: Chapters.links(), current: c.ord };
+    let page = ChapterPage { ord: c.ord, title: c.title, body: c.body, chapter_nav: nav };
+    let shell = reading_shell("writeonce — ${c.title}", page.render());
+    return ok_html(shell.render());
+  }
+}
diff --git a/docs/examples/site/chapter/view.wo b/docs/examples/site/chapter/view.wo
new file mode 100644
index 0000000..bb9519c
--- /dev/null
+++ b/docs/examples/site/chapter/view.wo
@@ -0,0 +1,46 @@
+-- chapter/view.wo — the VIEW for `/ch/:slug`, plus the chapter nav that
+-- the homepage reuses.
+--
+-- The MVC seam in one place: these components RENDER, the controller
+-- QUERIES, and the two never meet. ChapterNav holds VALUES (a list of
+-- links), so it renders identically on the homepage and on a chapter
+-- page — the only difference is which ord is `current`. Reuse is the
+-- same component with different fields, never copied markup.
+use view
+
+-- `ChapterLink` is the MODEL's projection type (types.wo); a class is
+-- reachable across module lines, so the view just names it.
+
+pub class ChapterNav {
+  items:   multi ChapterLink
+  current: Int
+
+  fn render() -> Text {
+    let out = "";
+    for c in self.items {
+      let label = `${c.ord}. {{ c.title }}`;
+      if c.ord == self.current {
+        out = out .. el("li", "mb-2 font-bold text-gray-900", label);
+      } else {
+        out = out .. el("li", "mb-2", link("/ch/${c.slug}", "", label));
+      }
+    }
+    return el("ul", "list-disc pl-6", out);
+  }
+}
+
+-- One chapter. `body` is site-authored HTML held in the row, so it goes
+-- through the RAW hole; the title is data and goes through `{{ }}`.
+pub class ChapterPage {
+  ord:         Int
+  title:       Text
+  body:        Text
+  chapter_nav: Component
+
+  fn render() -> Text {
+    let head = el("h1", "text-3xl font-bold mb-4", `${self.ord}. {{ self.title }}`);
+    let art = el("div", "bg-white rounded-lg border shadow-sm p-6", head .. self.body);
+    let nav = el("div", "mt-8", el("h2", "text-lg font-bold mb-2", "Chapters") .. self.chapter_nav.render());
+    return art .. nav;
+  }
+}
diff --git a/docs/examples/site/content.wo b/docs/examples/site/content.wo
index 7026ec8..1d0486a 100644
--- a/docs/examples/site/content.wo
+++ b/docs/examples/site/content.wo
@@ -1,11 +1,12 @@
--- site/content.wo — the tutorial chapters, seeded into the Chapter table
--- on first boot (main.wo's seed_if_empty). Bodies are HTML fragments
--- BUILT with the wo-html dep — prose in el(), code samples through
+-- content.wo — the tutorial chapters, seeded into the Chapter table on
+-- first boot (types.wo's seed_if_empty). Model CONTENT, so it sits in
+-- the root module beside types.wo: it inserts rows. Bodies are HTML fragments
+-- BUILT with the writeonce-view dep — prose in el(), code samples through
 -- code_block() which escapes them. Editing a chapter later (the admin
 -- route) overwrites body/title in place; the WAL keeps the edit across
 -- restarts, which is exactly chapter 6's lesson demonstrated by the
 -- site that teaches it.
-use html
+use view
 
 fn ch_hello() -> Text {
   let b = el("p", "leading-relaxed mb-4",
@@ -32,7 +33,7 @@ fn ch_containers() -> Text {
 
 fn ch_classes() -> Text {
   let b = el("p", "leading-relaxed mb-4",
-    "Classes hold fields and methods. There are NO function values and NO closures — a " .. "deliberate doctrine: behavior travels as a class satisfying an interface, and " .. "satisfaction is structural (same method name and shape, Go-style, no " .. "<code>implements</code>). This is how the web framework takes handlers.");
+    "Classes hold fields and methods. There are NO function values and NO closures — a " .. "deliberate doctrine: behavior travels as a class satisfying an interface, and " .. "satisfaction is structural (same method name and shape, Go-style, no " .. "<code>implements</code>). This is how <code>porch</code>, the web framework, takes handlers.");
   b = b .. code_block("interface Handler {\n  fn handle(req: Req) -> Resp\n}\n\nclass Hello {\n  greeting: Text\n  fn handle(req: Req) -> Resp {\n    return ok_text(\"\${self.greeting}, \${req.path}\");\n  }\n}\n\n-- any class with a matching handle() satisfies Handler\napp.get(\"/hello\", Hello { greeting: \"hi\" });");
   return b;
 }
@@ -60,16 +61,26 @@ fn ch_actors() -> Text {
 
 fn ch_deps() -> Text {
   let b = el("p", "leading-relaxed mb-4",
-    "Dependencies are git repositories pinned in <code>wo.toml</code>; <code>wo.lock</code> " .. "records the exact revision, and locked builds work offline. The [deps] KEY names the " .. "module you <code>use</code>. This site has two: the web framework, and the wo-html " .. "library that rendered the page you are reading.");
-  b = b .. code_block("[deps]\nframework = { git = \"https://github.com/shoneyj/writeonce-framework\", rev = \"v0.1.0\" }\nhtml      = { git = \"https://github.com/shoneyj/wo-html\",              rev = \"v0.1.0\" }");
-  b = b .. code_block("use framework\nuse framework/http\nuse html\n\n-- html's builders + tailwind-style utilities, zero JS, no build step:\nlet body = el(\"h1\", \"text-3xl font-bold\", \"Hello\");\nreturn ok_html(page(\"Hello\", body));");
+    "Dependencies are git repositories pinned in <code>wo.toml</code>; <code>wo.lock</code> " .. "records the exact revision, and locked builds work offline. The [deps] KEY names the " .. "module you <code>use</code>. This site has two: <code>porch</code>, the writeonce web framework, and the writeonce-view " .. "library that rendered the page you are reading.");
+  b = b .. code_block(`
+    [deps]
+    porch     = { git = "https://github.com/shoneyj/porch", rev = "v0.1.0" }
+    view      = { git = "https://github.com/shoneyj/writeonce-view",              rev = "v0.1.0" }`);
+  b = b .. code_block(`
+    use porch
+    use porch/http
+    use view
+
+    -- html's builders + tailwind-style utilities, zero JS, no build step:
+    let body = el("h1", "text-3xl font-bold", "Hello");
+    return ok_html(page("Hello", body));`);
   return b;
 }
 
 fn ch_serving() -> Text {
   let b = el("p", "leading-relaxed mb-4",
     "The whole stack of this site: routes with <code>:param</code> captures, a middleware " .. "chain, handler classes, <code>@table</code> persistence, and server-rendered HTML — " .. "one binary behind a proxy. This is the site's own main, abbreviated:");
-  b = b .. code_block("fn main(args: multi Text) -> Int {\n  seed_if_empty();\n  let app = App { middleware: [], routes: [] };\n  app.use_mw(Mw { m: Logging { pad: 0 } });\n  app.get(\"/\",            Home { pad: 0 });\n  app.get(\"/ch/:slug\",    ShowChapter { pad: 0 });\n  app.post(\"/admin/ch/:slug\", AdminEdit { token: token });\n  return app.serve(\"127.0.0.1\", port);\n}");
+  b = b .. code_block("fn main(args: multi Text) -> Int {\n  seed_if_empty();\n  let app = App { middleware: [], routes: [] };\n  app.use_mw(Mw { m: Logging {} });\n  app.get(\"/\",            Home {});\n  app.get(\"/ch/:slug\",    ShowChapter {});\n  app.post(\"/admin/ch/:slug\", AdminEdit { token: token });\n  return app.serve(\"127.0.0.1\", port);\n}");
   b = b .. el("p", "leading-relaxed mt-4",
     "The admin route checks its bearer token in the handler — mechanism lives in the " .. "framework (<code>bearer_token</code>, constant-time <code>ct_eq</code>), POLICY stays " .. "in the app. Try editing this chapter: " .. "<code>curl -X POST -H \"authorization: Bearer ...\" -d \"title=...&amp;body=...\" /admin/ch/serving</code>.");
   return b;
diff --git a/docs/examples/site/favicon/controller.wo b/docs/examples/site/favicon/controller.wo
new file mode 100644
index 0000000..18b8dc6
--- /dev/null
+++ b/docs/examples/site/favicon/controller.wo
@@ -0,0 +1,13 @@
+-- favicon/controller.wo — GET /favicon.svg. The one route that answers
+-- something other than HTML or text, so it builds its own Resp.
+use porch/http
+use layout
+
+pub class Favicon {
+  fn handle(req: Req) -> Resp {
+    let h: map<Text, Text> = {};
+    h["content-type"] = "image/svg+xml";
+    h["cache-control"] = "public, max-age=86400";
+    return Resp { status: 200, headers: h, body: favicon_svg() };
+  }
+}
diff --git a/docs/examples/site/health/controller.wo b/docs/examples/site/health/controller.wo
new file mode 100644
index 0000000..dac52b2
--- /dev/null
+++ b/docs/examples/site/health/controller.wo
@@ -0,0 +1,9 @@
+-- health.controller.wo — GET /health: the liveness probe the accept
+-- script and any proxy poll. Text, not HTML, on purpose.
+use porch/http
+
+pub class Health {
+  fn handle(req: Req) -> Resp {
+    return ok_text("ok");
+  }
+}
diff --git a/docs/examples/site/home/controller.wo b/docs/examples/site/home/controller.wo
new file mode 100644
index 0000000..d5e16a4
--- /dev/null
+++ b/docs/examples/site/home/controller.wo
@@ -0,0 +1,19 @@
+-- home/controller.wo — the CONTROLLER for `/`: query the model, fill the
+-- view components that sit beside it, answer a Resp. One feature = one
+-- directory = one module, view and controller together.
+--
+-- It reaches the chapter nav through `use chapter` and the query through
+-- the model's `Chapters.links()` static — a class crosses module lines,
+-- a free fn does not.
+use porch/http
+use layout
+use chapter
+
+pub class Home {
+  fn handle(req: Req) -> Resp {
+    let nav = ChapterNav { items: Chapters.links(), current: 0 };
+    let page = HomePage { chapter_nav: nav };
+    let shell = wide_shell("writeonce — learn the language", page.render());
+    return ok_html(shell.render());
+  }
+}
diff --git a/docs/examples/site/home/view.wo b/docs/examples/site/home/view.wo
new file mode 100644
index 0000000..a4b3d4c
--- /dev/null
+++ b/docs/examples/site/home/view.wo
@@ -0,0 +1,53 @@
+-- home/view.wo — the VIEW for `/`. A component: fields in, Text out.
+-- Everything on this page is static copy EXCEPT the chapter list, so
+-- the one field is that list's already-built component — content
+-- projection, the same slot pattern writeonce-view's `Layout` uses. HomePage
+-- therefore knows nothing about chapters, the Chapter table, or how the
+-- nav decides which entry is current.
+use view
+
+pub class HomePage {
+  chapter_nav: Component
+
+  fn render() -> Text {
+    -- hero: tagline + the two CTAs (the go.dev shape, no JS anywhere)
+    let h1 = el("h1", "text-4xl font-bold mb-4", "One language. One runtime.<br>One database. One binary.");
+    let sub = el("p", "text-lg text-gray-700 leading-relaxed mb-6", "writeonce is a language whose compiler, runtime, web server and " .. "database ship as a single never-stopping Linux binary. Ownership-" .. "checked memory, inferred GC where ownership cannot reach, actors " .. "on every core — and the page you are reading is served by it.");
+    let ctas = el("div", "flex items-center justify-center gap-4", btn_link("/ch/hello", "Get started", true) .. btn_link("https://github.com/shoneyJ/writeonce", "View source", false));
+    let hero = el("div", "text-center py-16", h1 .. sub .. ctas);
+
+    -- code showcase: a real flavor of the language
+    let show_head = el("h2", "text-2xl font-bold mb-2 text-center", "An actor per chat room, rows in the built-in database");
+    let show_cap = el("p", "text-sm text-gray-500 text-center mb-4", "No broker, no ORM, no async keyword — ownership moves the message, the WAL makes the row durable.");
+    let showcase = el("div", "mx-auto max-w-3xl mb-8", show_head .. show_cap .. home_snippet());
+
+    -- why-cards (2x2 grid, collapses on small screens)
+    let cards = card("One binary", "woc build emits a self-contained executable: VM, your bytecode, the database engine. Deploys are a file copy; the runtime swaps code in place.");
+    cards = cards .. card("Memory safety, no tax", "Rust-shaped ownership checked at compile time; where ownership cannot express the shape, the compiler infers GC — per shard, no global pause.");
+    cards = cards .. card("The database is built in", "Every class is a table. Inserts are WAL-logged before they acknowledge; restart replays. No server to operate, no connection string.");
+    cards = cards .. card("Actors on every core", "spawn returns an address, send moves ownership. Fibers park on io_uring instead of blocking threads — no async/await, ever.");
+    let grid = el("div", "grid grid-cols-2 gap-6 mb-8", cards);
+
+    -- chapters (the gate's anchor string lives here)
+    let learn = el("h2", "text-2xl font-bold mb-4", "Learn writeonce");
+    let learn_p = el("p", "leading-relaxed mb-4", "The tutorial is written in the language and stored in its tables — work through the chapters in order:");
+    let chapters = el("div", "bg-white rounded-lg border shadow-sm p-6 mb-8", learn .. learn_p .. self.chapter_nav.render());
+
+    return hero .. showcase .. grid .. chapters;
+  }
+}
+
+-- The homepage's code showcase: a real flavor of the language — an
+-- actor per chat room, rows in the built-in database, one binary.
+-- Page copy, so it lives with the page, not with the seed data.
+fn home_snippet() -> Text {
+  let s = "@table\nclass Message {\n  room: Text\n  body: Text\n}\n\n";
+  s = s .. "class Room {\n  name: Text\n  fn receive(msg: Post) {\n";
+  s = s .. "    insert Message { room: self.name, body: msg.body };\n";
+  s = s .. "    print(\"[\${self.name}] \${msg.body}\");\n  }\n}\n\n";
+  s = s .. "fn main() -> Int {\n";
+  s = s .. "  let general: actor Post = spawn Room { name: \"general\" };\n";
+  s = s .. "  send(general, Post { body: \"hello, writeonce\" });\n";
+  s = s .. "  time.sleep(50);\n  return 0;\n}";
+  return code_block(s);
+}
diff --git a/docs/examples/site/install/controller.wo b/docs/examples/site/install/controller.wo
new file mode 100644
index 0000000..cd86c80
--- /dev/null
+++ b/docs/examples/site/install/controller.wo
@@ -0,0 +1,12 @@
+-- install/controller.wo — GET /install. Nothing to query: the page is
+-- static copy, so the controller only wraps it in the shell.
+use porch/http
+use layout
+
+pub class ShowInstall {
+  fn handle(req: Req) -> Resp {
+    let page = InstallPage {};
+    let shell = reading_shell("writeonce — install", page.render());
+    return ok_html(shell.render());
+  }
+}
diff --git a/docs/examples/site/install/view.wo b/docs/examples/site/install/view.wo
new file mode 100644
index 0000000..ebad827
--- /dev/null
+++ b/docs/examples/site/install/view.wo
@@ -0,0 +1,110 @@
+-- install/view.wo — the VIEW for /install. Static copy: no fields, so
+-- the component has none. It is still a component, and still renders
+-- through the same interface as every other page.
+use view
+
+pub class InstallPage {
+  fn render() -> Text {
+    let head = `
+      <h1 class="text-3xl font-bold mb-4">Install writeonce</h1>
+      <p class="leading-relaxed mb-6">Two native binaries — <code>woc</code>,
+      the compiler, and <code>wovm</code>, the runtime VM. Both depend only on
+      the system C library. There is no package manager to install, no
+      language runtime to install on the machines you deploy to, and no
+      build toolchain beyond these two files.</p>`;
+
+    let sys = supported();
+
+    let s1 = section("1. Download",
+      `<p class="leading-relaxed mb-4">One tarball, two binaries. Take it from
+      the GitHub release, or from this site as a mirror — they are the same
+      bytes, and the checksum below proves it:</p>
+      <p class="mb-4">
+        <a class="btn no-underline" href="https://github.com/shoneyj/writeonce/releases/download/v0.1.0/writeonce-0.1.0-linux-amd64.tar.gz">Download 0.1.0 (linux-amd64)</a>
+        <a class="btn-outline no-underline" href="/dl/writeonce-0.1.0-linux-amd64.tar.gz">Mirror</a>
+      </p>
+      <p class="leading-relaxed mb-4">Verify it before you extract it. The
+      expected digest is served beside the archive at
+      <a href="/dl/writeonce-0.1.0-linux-amd64.tar.gz.sha256">.sha256</a>:</p>`,
+      code_block("curl -O https://writeonce.de/dl/writeonce-0.1.0-linux-amd64.tar.gz\ncurl -O https://writeonce.de/dl/writeonce-0.1.0-linux-amd64.tar.gz.sha256\nsha256sum -c writeonce-0.1.0-linux-amd64.tar.gz.sha256"));
+
+    let s2 = section("2. Extract it",
+      `<p class="leading-relaxed mb-4">Extract into <code>/usr/local</code>,
+      replacing any previous install. Run this as root, or through
+      <code>sudo</code>:</p>`,
+      code_block("rm -rf /usr/local/writeonce\ntar -C /usr/local -xzf writeonce-0.1.0-linux-amd64.tar.gz"));
+
+    let s3 = section("3. Put it on your PATH",
+      `<p class="leading-relaxed mb-4">Add one line to your
+      <code>$HOME/.profile</code> (or <code>/etc/profile</code> for every user
+      on the box), then restart your shell:</p>`,
+      code_block("export PATH=$PATH:/usr/local/writeonce/bin"));
+
+    let s4 = section("4. Check it",
+      `<p class="leading-relaxed mb-4">Both should print the same version.
+      <code>woc</code> finds <code>wovm</code> beside itself, so a tarball
+      install needs no further configuration.</p>`,
+      code_block("woc version        # writeonce 0.1.0 linux/amd64\nwovm --version     # wovm 0.1.0"));
+
+    let s5 = section("5. Your first project",
+      `<p class="leading-relaxed mb-4">A project is a directory with a
+      <code>wo.toml</code> manifest and one or more <code>.wo</code> files.
+      Nothing else — no lockfile to create by hand, no scaffolding step.</p>`,
+      code_block("mkdir hello && cd hello\n\ncat > wo.toml <<'EOF'\nname    = \"hello\"\nversion = \"0.1.0\"\n\n[runtime]\nwo = \">= 0.1\"\nEOF\n\ncat > main.wo <<'EOF'\nfn main() -> Int {\n  print(\"hello, writeonce\");\n  return 0;\n}\nEOF"));
+
+    let s6 = section("6. Build and run",
+      `<p class="leading-relaxed mb-4"><code>woc &lt;dir&gt;</code> emits ONE
+      standalone binary at <code>target/&lt;name&gt;</code>. Copy that file to a
+      server and run it — the VM is inside it, and so is the database.</p>`,
+      code_block("woc .\n./target/hello        # hello, writeonce"));
+
+    let s7 = section("7. Add a dependency",
+      `<p class="leading-relaxed mb-4">Dependencies are git repositories pinned
+      by revision. The <code>[deps]</code> KEY is the module name your code
+      <code>use</code>s. <code>woc</code> writes a <code>wo.lock</code> with the
+      exact revision, and a locked build works offline. See
+      <a href="/packages">Packages</a> for what is available.</p>`,
+      code_block("[deps]\nview = { git = \"https://github.com/shoneyj/writeonce-view\", rev = \"v0.1.0\" }"));
+
+    let note = el("div", "bg-white rounded-lg border shadow-sm p-6 mt-8",
+      el("h2", "text-lg font-bold mb-2", "Where things go") ..
+      `<p class="leading-relaxed">The tarball installs to
+      <code>/usr/local/writeonce</code>: <code>bin/woc</code>,
+      <code>bin/wovm</code>, and a <code>VERSION</code> file. To point
+      <code>woc</code> at a different VM, set <code>$WO_RUNTIME</code> or add a
+      <code>[build] runtime = "..."</code> key to <code>wo.toml</code>. A
+      manifest may also require a minimum toolchain with
+      <code>[runtime] wo = "&gt;= 0.1"</code>; <code>woc</code> refuses to build
+      a project that needs a newer toolchain than itself.</p>`);
+
+    return head .. sys .. s1 .. s2 .. s3 .. s4 .. s5 .. s6 .. s7 .. note;
+  }
+}
+
+-- What the release actually runs on. Every claim here is read off the
+-- shipped binaries (`file`, and the highest GLIBC_ symbol version they
+-- import), not off a wish list — an install page that overstates its
+-- support costs someone an afternoon.
+fn supported() -> Text {
+  return `
+    <div class="bg-white rounded-lg border shadow-sm p-6 mb-8">
+      <h2 class="text-2xl font-bold mb-2">Supported systems</h2>
+      <ul class="list-disc pl-6 leading-relaxed">
+        <li class="mb-2"><b>Linux on x86-64</b> — the only target built today. There is no ARM, macOS or Windows build.</li>
+        <li class="mb-2"><b>glibc 2.35 or newer.</b> The binaries link the system C library dynamically: <code>woc</code> imports symbols up to <code>GLIBC_2.35</code> and <code>wovm</code> up to <code>GLIBC_2.34</code>, read off the published v0.1.0 release. That covers Ubuntu 22.04+, Debian 12+ and Fedora 36+. On RHEL 9 (2.34) the runtime works but the compiler does not — build elsewhere and copy the binary over, which is the point of a self-contained executable.</li>
+        <li class="mb-2"><b>Not musl.</b> Alpine needs a build against musl, which does not exist yet.</li>
+        <li class="mb-2"><b>Nothing else.</b> No JVM, no Node, no Python, no package manager. The two binaries and libc are the whole dependency list.</li>
+      </ul>
+      <p class="leading-relaxed mt-4 text-gray-700">Check yours with
+      <code>ldd --version</code>. If it is older than 2.35, build from source
+      until a wider-compatibility release exists. The floor is set by the
+      machine that BUILT the release, not by the language — the CI runner is
+      pinned to Ubuntu 22.04 to keep it this low.</p>
+    </div>`;
+}
+
+-- One numbered step: heading, prose, and the commands to run.
+fn section(title: Text, prose: Text, code: Text) -> Text {
+  return el("div", "mb-8",
+    el("h2", "text-2xl font-bold mb-2", title) .. prose .. code);
+}
diff --git a/docs/examples/site/layout/app.wo b/docs/examples/site/layout/app.wo
new file mode 100644
index 0000000..cb17852
--- /dev/null
+++ b/docs/examples/site/layout/app.wo
@@ -0,0 +1,49 @@
+-- layout/app.wo — the app shell: one component wrapping every page with
+-- the shared header and footer. Unlike the shop template, this site
+-- INLINES its stylesheet (writeonce-view's `page()` does that), so the shell
+-- fills writeonce-view's own `Layout` rather than writing its own document.
+--
+-- The only thing that varies between pages is the container width, so
+-- that is the one extra slot — and the two widths are named once, here,
+-- instead of as class strings scattered through the controllers.
+use porch/http
+use view
+
+pub class AppShell {
+  title:     Text
+  container: Text
+  content:   Text
+
+  fn render() -> Text {
+    let l = Layout {
+      title:   self.title,
+      head:    head_links(),
+      nav:     header(),
+      content: el("div", self.container, self.content),
+      footer:  footer()
+    };
+    return l.render();
+  }
+}
+
+-- Chapter pages keep a reading width.
+pub fn reading_shell(title: Text, content: Text) -> AppShell {
+  return AppShell { title: title, container: "mx-auto max-w-3xl px-4 py-8", content: content };
+}
+
+-- The homepage uses the wider container (the go.dev shape).
+pub fn wide_shell(title: Text, content: Text) -> AppShell {
+  return AppShell { title: title, container: "mx-auto max-w-5xl px-4", content: content };
+}
+
+-- Every non-200 HTML answer goes through here, so an error page is a
+-- real page: same chrome, same shell, just a different status.
+pub fn html_error(status: Int, title: Text, msg: Text) -> Resp {
+  let content = el("h1", "text-2xl font-bold mb-4", title) ..
+                el("p", "", msg) ..
+                el("p", "", link("/", "", "Back to the chapters"));
+  let shell = reading_shell("writeonce — ${title}", content);
+  let h: map<Text, Text> = {};
+  h["content-type"] = "text/html; charset=utf-8";
+  return Resp { status: status, headers: h, body: shell.render() };
+}
diff --git a/docs/examples/site/layout/footer.wo b/docs/examples/site/layout/footer.wo
new file mode 100644
index 0000000..552c765
--- /dev/null
+++ b/docs/examples/site/layout/footer.wo
@@ -0,0 +1,6 @@
+-- layout/footer.wo — the site footer, shared by every page.
+use view
+
+pub fn footer() -> Text {
+  return el("div", "footer", "writeonce.de — served by the language it teaches. " .. "One binary: compiler, runtime, database, this page.");
+}
diff --git a/docs/examples/site/layout/header.wo b/docs/examples/site/layout/header.wo
new file mode 100644
index 0000000..8b28ccd
--- /dev/null
+++ b/docs/examples/site/layout/header.wo
@@ -0,0 +1,13 @@
+-- layout/header.wo — the site navigation bar, shared by every page.
+use view
+
+pub fn header() -> Text {
+  let links = link("/install", "text-gray-700", "Install");
+  links = links .. link("/ch/hello", "text-gray-700", "Tutorial");
+  links = links .. link("/packages", "text-gray-700", "Packages");
+  links = links .. link("https://github.com/shoneyJ/writeonce", "text-gray-700", "GitHub");
+  -- The brand is the mark plus the wordmark, one inline-flex row so the
+  -- tile and the text share a baseline at any font size.
+  let brand = el("span", "flex items-center gap-2", logo_svg(28) .. "<span>writeonce.de</span>");
+  return nav_bar("/", brand, links);
+}
diff --git a/docs/examples/site/layout/logo.wo b/docs/examples/site/layout/logo.wo
new file mode 100644
index 0000000..1c2f2aa
--- /dev/null
+++ b/docs/examples/site/layout/logo.wo
@@ -0,0 +1,23 @@
+-- layout/logo.wo — the mark, authored as inline SVG so it needs no asset
+-- pipeline and no second request: a dark tile with a two-stroke "W", the
+-- first half white and the second the site's accent blue. One glyph, two
+-- colours, still legible at 16px.
+--
+-- One source, two consumers: the nav brand embeds it, and
+-- `favicon/controller.wo` serves the same bytes at /favicon.svg.
+
+pub fn logo_svg(px: Int) -> Text {
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="${px}" height="${px}" viewBox="0 0 64 64" role="img" aria-label="writeonce"><rect width="64" height="64" rx="14" fill="#111827"/><path d="M14 20 L22 44 L32 28" fill="none" stroke="#ffffff" stroke-width="7" stroke-linecap="round" stroke-linejoin="round"/><path d="M32 28 L42 44 L50 20" fill="none" stroke="#2563eb" stroke-width="7" stroke-linecap="round" stroke-linejoin="round"/></svg>`;
+}
+
+-- The favicon is the same mark without intrinsic width/height, so the
+-- browser scales it to whatever the tab needs.
+pub fn favicon_svg() -> Text {
+  return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect width="64" height="64" rx="14" fill="#111827"/><path d="M14 20 L22 44 L32 28" fill="none" stroke="#ffffff" stroke-width="7" stroke-linecap="round" stroke-linejoin="round"/><path d="M32 28 L42 44 L50 20" fill="none" stroke="#2563eb" stroke-width="7" stroke-linecap="round" stroke-linejoin="round"/></svg>`;
+}
+
+-- What goes in <head>. Inline SVG, no request, no cache question.
+pub fn head_links() -> Text {
+  return `<link rel="icon" href="/favicon.svg" type="image/svg+xml">
+    <meta name="description" content="writeonce — one language, one runtime, one database, one binary.">`;
+}
diff --git a/docs/examples/site/main.wo b/docs/examples/site/main.wo
index 52b7b24..fe3f66a 100644
--- a/docs/examples/site/main.wo
+++ b/docs/examples/site/main.wo
@@ -1,142 +1,30 @@
 -- site — writeonce.de: the language tutorial, served BY the language.
--- Full stack in one binary: writeonce-framework ([deps]) for HTTP/routing/
--- auth, wo-html ([deps]) for server-rendered pages with Tailwind-style
+-- Full stack in one binary: porch ([deps]) for HTTP/routing/
+-- auth, writeonce-view ([deps]) for server-rendered pages with Tailwind-style
 -- utilities, @table + WAL for the chapters themselves. The site is its own
 -- final chapter: /ch/serving shows this file's shape.
 --
 --   SITE_TOKEN=... WO_DATA=./data ./site 8080
+--   SITE_HOST=0.0.0.0 ... ./site 8080     (reachable from the network)
+--   WO_DIST=/srv/dist ...                  (where /dl serves tarballs from)
 --
 -- Behind nginx/caddy for writeonce.de: the proxy terminates TLS and
 -- forwards to 127.0.0.1:8080 (the framework speaks HTTP/1.1 keep-alive).
+--
+-- This file is the BOOTSTRAP and nothing else: seed, routes, serve. The
+-- model is types.wo; every feature is a directory holding its view and
+-- its controller.
 use env
-use framework
-use framework/http
-use framework/router
-use html
-
--- Every chapter is a row: slug is the URL, ord orders the nav, body is a
--- server-rendered HTML fragment. Edits (the admin route) persist through
--- the WAL under WO_DATA and replay on restart.
-@table(name: "chapters", index: [slug])
-class Chapter {
-  slug:  Text @unique
-  ord:   Int
-  title: Text
-  body:  Text
-}
-
-fn seed_if_empty() {
-  let n = 0;
-  for c in from x in Chapter take 1 select x {
-    n = n + 1;
-  }
-  if n == 0 {
-    seed_chapters();
-  }
-}
-
--- ---- rendering ---------------------------------------------------------
-
-fn ok_html(body: Text) -> Resp {
-  let h: map<Text, Text> = {};
-  h["content-type"] = "text/html; charset=utf-8";
-  return Resp { status: 200, headers: h, body: body };
-}
-
-fn site_header() -> Text {
-  let brand = link("/", "text-xl font-bold text-gray-900 no-underline", "writeonce.de");
-  let tag = el("span", "text-sm text-gray-500", "one language, one runtime, one database, one binary");
-  return el("div", "flex items-center justify-between mb-8", brand .. tag);
-}
-
-fn shell(title: Text, inner: Text) -> Text {
-  let body = el("div", "mx-auto max-w-3xl px-4 py-8", site_header() .. inner);
-  return page(title, body);
-}
-
-fn chapter_nav(current: Int) -> Text {
-  let items = "";
-  for c in from x in Chapter order by x.ord select x {
-    let label = "${c.ord}. ${esc(c.title)}";
-    if c.ord == current {
-      items = items .. el("li", "mb-2 font-bold text-gray-900", label);
-    } else {
-      items = items .. el("li", "mb-2", link("/ch/${c.slug}", "", label));
-    }
-  }
-  return el("ul", "list-disc pl-6", items);
-}
-
--- ---- handlers ----------------------------------------------------------
-
-class Home {
-  pad: Int
-  fn handle(req: Req) -> Resp {
-    let hero = el("h1", "text-3xl font-bold mb-4", "Learn writeonce");
-    let intro = el("p", "leading-relaxed mb-4", "A language where the runtime, the database and the web server are one thing. " .. "This site is written in it — every page you read here is a " .. "<code>Resp</code> built by <code>.wo</code> code, stored in the language's own " .. "tables, served by its own framework. Work through the chapters in order:");
-    let body = el("div", "bg-white rounded-lg border shadow-sm p-6", hero .. intro .. chapter_nav(0));
-    return ok_html(shell("writeonce — learn the language", body));
-  }
-}
-
-class ShowChapter {
-  pad: Int
-  fn handle(req: Req) -> Resp {
-    let slug = req.params["slug"];
-    if slug == nil { return not_found(); }
-    let hits = from c in Chapter where c.slug == slug take 1 select c;
-    if len(hits) == 0 {
-      let msg = el("h1", "text-2xl font-bold mb-4", "No such chapter");
-      let back = el("p", "", link("/", "", "Back to the chapters"));
-      let h: map<Text, Text> = {};
-      h["content-type"] = "text/html; charset=utf-8";
-      let nf = shell("writeonce — not found", msg .. back);
-      return Resp { status: 404, headers: h, body: nf };
-    }
-    let c = hits[0];
-    let head = el("h1", "text-3xl font-bold mb-4", "${c.ord}. ${esc(c.title)}");
-    let art = el("div", "bg-white rounded-lg border shadow-sm p-6", head .. c.body);
-    let nav = el("div", "mt-8", el("h2", "text-lg font-bold mb-2", "Chapters") .. chapter_nav(c.ord));
-    return ok_html(shell("writeonce — ${c.title}", art .. nav));
-  }
-}
-
--- POST /admin/ch/:slug — title/body update, form-encoded, bearer-gated.
--- Mechanism (bearer_token, constant-time ct_eq) is the framework's;
--- POLICY — which routes, which token — is this app's, right here.
-class AdminEdit {
-  token: Text
-  fn handle(req: Req) -> Resp {
-    let got = bearer_token(req);
-    if got == nil { return unauthorized(); }
-    if ct_eq("${got}", self.token) == false { return unauthorized(); }
-    let slug = req.params["slug"];
-    if slug == nil { return not_found(); }
-    let hits = from c in Chapter where c.slug == slug take 1 select c;
-    if len(hits) == 0 { return not_found(); }
-    let f = form_values(req);
-    if f == nil { return bad_request("body must be form-encoded (title, body)"); }
-    let title = f["title"];
-    let body = f["body"];
-    if title == nil and body == nil { return bad_request("nothing to update"); }
-    if title != nil {
-      let t = trim("${title}");
-      if t == "" { return bad_request("title must not be empty"); }
-      hits[0].title = t;
-    }
-    if body != nil {
-      hits[0].body = "${body}";
-    }
-    return redirect("/ch/${slug}");
-  }
-}
-
-class Health {
-  pad: Int
-  fn handle(req: Req) -> Resp {
-    return ok_text("ok");
-  }
-}
+use porch
+use porch/http
+use porch/router
+use home
+use chapter
+use install
+use packages
+use admin
+use health
+use favicon
 
 fn main(args: multi Text) -> Int {
   if len(args) < 1 {
@@ -154,13 +42,38 @@ fn main(args: multi Text) -> Int {
     return 2;
   }
 
+  -- Bind to loopback unless SITE_HOST says otherwise. Behind a proxy
+  -- loopback is right; SITE_HOST=0.0.0.0 (or a LAN address) is how you
+  -- reach it from another machine while developing.
+  let host = "127.0.0.1";
+  let h = env.get("SITE_HOST");
+  if h != nil {
+    host = "${h}";
+  }
+
+  -- Where the release tarballs live. `just dist` writes them to ./dist;
+  -- a deployment points WO_DIST at wherever it keeps them.
+  let dist = "dist";
+  let d = env.get("WO_DIST");
+  if d != nil {
+    dist = "${d}";
+  }
+
   seed_if_empty();
 
   let app = App { middleware: [], routes: [] };
-  app.use_mw(Mw { m: Logging { pad: 0 } });
-  app.get("/",             Home { pad: 0 });
-  app.get("/health",       Health { pad: 0 });
-  app.get("/ch/:slug",     ShowChapter { pad: 0 });
+  app.use_mw(Mw { m: Logging {} });
+  app.get("/",                Home {});
+  app.get("/install",         ShowInstall {});
+  app.get("/packages",        ShowPackages {});
+  app.get("/packages/:name",  ShowPackage {});
+  app.get("/health",          Health {});
+  app.get("/favicon.svg",     Favicon {});
+  -- 16 MiB ceiling: the toolchain tarball is under 1 MiB today, and
+  -- `max_bytes` is a hard truncation point, not a hint.
+  app.get("/dl/*path",        StaticFiles { dir: dist, max_bytes: 16777216 });
+  app.get("/ch/:slug",        ShowChapter {});
   app.post("/admin/ch/:slug", AdminEdit { token: "${token}" });
-  return app.serve("127.0.0.1", port);
+  print_err("site: listening on ${host}:${port}");
+  return app.serve(host, port);
 }
diff --git a/docs/examples/site/packages/controller.wo b/docs/examples/site/packages/controller.wo
new file mode 100644
index 0000000..311c56c
--- /dev/null
+++ b/docs/examples/site/packages/controller.wo
@@ -0,0 +1,90 @@
+-- packages/controller.wo — GET /packages and /packages/:name.
+--
+-- The catalogue is static data, not rows, so it lives here on the DATA
+-- side of the feature rather than in the view: the components are handed
+-- values exactly as they would be if this were a table one day.
+use porch/http
+use view
+use layout
+
+typedef PackageInfo = {
+  name:    Text,
+  summary: Text,
+  git:     Text,
+  rev:     Text,
+  what:    Text,
+  usage:   Text
+}
+
+pub class ShowPackages {
+  fn handle(req: Req) -> Resp {
+    let cards: multi Component = [];
+    for p in catalogue() {
+      push(cards, PackageCard { name: p.name, summary: p.summary });
+    }
+    let page = PackagesPage { cards: cards };
+    let shell = reading_shell("writeonce — packages", page.render());
+    return ok_html(shell.render());
+  }
+}
+
+pub class ShowPackage {
+  fn handle(req: Req) -> Resp {
+    let name = req.params["name"];
+    if name == nil {
+      return html_error(404, "No such package", "The address names no package.");
+    }
+    for p in catalogue() {
+      if p.name == name {
+        let page = PackagePage {
+          name: p.name, summary: p.summary, git: p.git, rev: p.rev,
+          what: p.what, usage: p.usage
+        };
+        let shell = reading_shell("writeonce — ${p.name}", page.render());
+        return ok_html(shell.render());
+      }
+    }
+    return html_error(404, "No such package", "Nothing is published under that name.");
+  }
+}
+
+-- The two libraries this site runs on. Both are `kind = "library"`
+-- projects: no `fn main`, imported through `[deps]`.
+fn catalogue() -> multi PackageInfo {
+  let out: multi PackageInfo = [];
+
+  push(out, PackageInfo {
+    name:    "porch",
+    summary: "The writeonce web framework: an HTTP/1.1 keep-alive server core, a router with :param captures, and Handler/Middleware structural interfaces. Imported as <code>use porch</code>.",
+    git:     "https://github.com/shoneyj/porch",
+    rev:     "v0.1.0",
+    what:    `
+      <ul class="list-disc pl-6 leading-relaxed">
+        <li class="mb-2"><code>App</code> — the route table and the middleware chains; <code>app.get</code>/<code>post</code>/<code>delete_</code>, <code>use_mw</code>, <code>use_after</code>, <code>mount</code>, <code>serve</code>.</li>
+        <li class="mb-2"><code>StaticFiles</code> — serve a directory over a wildcard route. Traversal is refused, not normalised; <code>max_bytes</code> is a hard ceiling. This site's <code>/dl</code> downloads run through it.</li>
+        <li class="mb-2"><code>Handler</code>, <code>Middleware</code>, <code>After</code> — structural interfaces. A handler is a CLASS; its fields are the closure this language does not have.</li>
+        <li class="mb-2"><code>Req</code>/<code>Resp</code> plus builders: <code>ok_text</code>, <code>ok_html</code>, <code>ok_json</code>, <code>created_json</code>, <code>not_found</code>, <code>bad_request</code>, <code>unauthorized</code>, <code>conflict</code>, <code>redirect</code>.</li>
+        <li class="mb-2">Auth MECHANISM only — <code>bearer_token</code>, <code>basic_credentials</code>, constant-time <code>ct_eq</code>. Which routes are gated stays your policy.</li>
+        <li class="mb-2">Bodies: <code>form_values</code>, <code>multipart_parts</code>, content negotiation, ETags, security headers, CORS, WebSocket frames.</li>
+      </ul>`,
+    usage:   code_block("use porch\nuse porch/http\nuse porch/router\n\nclass Hello {\n  fn handle(req: Req) -> Resp {\n    return ok_text(\"hello\");\n  }\n}\n\nfn main(args: multi Text) -> Int {\n  let app = App { middleware: [], routes: [] };\n  app.use_mw(Mw { m: Logging {} });\n  app.get(\"/\", Hello {});\n  return app.serve(\"127.0.0.1\", 8080);\n}")
+  });
+
+  push(out, PackageInfo {
+    name:    "view",
+    summary: "Server-rendered HTML as plain Text: escaping, element builders, a component layer, and a Tailwind-style utility stylesheet inlined into every page.",
+    git:     "https://github.com/shoneyj/writeonce-view",
+    rev:     "v0.1.0",
+    what:    `
+      <ul class="list-disc pl-6 leading-relaxed">
+        <li class="mb-2"><code>esc()</code> — escapes <code>&amp; &lt; &gt; "</code>. A <code>&#123;&#123; &#125;&#125;</code> hole in a raw text literal compiles to a call to it, so display data is escaped by construction. (Written with entities here: inside a raw literal, a real <code>&#123;&#123;</code> would BE a hole.)</li>
+        <li class="mb-2"><code>Component</code> — a class with fields and <code>fn render() -&gt; Text</code>, satisfied structurally. <code>multi Component</code> holds children directly; <code>render_all</code> renders them in order.</li>
+        <li class="mb-2"><code>Layout</code> — content projection: title, head, nav, content and footer as pre-rendered slots.</li>
+        <li class="mb-2">Builders: <code>el</code>, <code>link</code>, <code>card</code>, <code>nav_bar</code>, <code>code_block</code>, <code>form_post</code>, <code>text_input</code>, <code>text_area</code>, <code>submit_btn</code>, <code>btn_link</code>.</li>
+        <li class="mb-2"><code>tw_css()</code> + <code>page()</code> — one hand-written utility sheet, inlined, so a page is one self-contained response. No CDN, no build step, no JS.</li>
+      </ul>`,
+    usage:   code_block("use view\n\nclass Card {\n  name: Text\n  fn render() -> Text {\n    return `\n      <div class=\"card\">\n        <h3>{{ self.name }}</h3>\n      </div>`;\n  }\n}\n\n-- in a handler:\nlet c = Card { name: user_supplied };\nreturn ok_html(page(\"Hello\", c.render()));")
+  });
+
+  return out;
+}
diff --git a/docs/examples/site/packages/view.wo b/docs/examples/site/packages/view.wo
new file mode 100644
index 0000000..242495c
--- /dev/null
+++ b/docs/examples/site/packages/view.wo
@@ -0,0 +1,61 @@
+-- packages/view.wo — the VIEW for /packages and /packages/:name.
+--
+-- Three components: a card for the index, the index itself (holding its
+-- cards as CHILDREN through the structural interface), and the detail
+-- page. None of them knows where the catalogue came from.
+use view
+
+pub class PackageCard {
+  name:    Text
+  summary: Text
+
+  fn render() -> Text {
+    return `
+      <div class="bg-white rounded-lg border shadow-sm p-6">
+        <h3 class="text-lg font-bold mb-2"><a href="/packages/{{ self.name }}">{{ self.name }}</a></h3>
+        <p class="leading-relaxed text-gray-700">{{ self.summary }}</p>
+      </div>`;
+  }
+}
+
+pub class PackagesPage {
+  cards: multi Component
+
+  fn render() -> Text {
+    return `
+      <h1 class="text-3xl font-bold mb-4">Packages</h1>
+      <p class="leading-relaxed mb-6">A package is a git repository with a
+      <code>wo.toml</code> that says <code>kind = "library"</code>. There is no
+      registry and no publish step: you depend on a URL and a revision, and
+      <code>wo.lock</code> pins exactly what you built against. These are the
+      libraries this site itself is built on.</p>
+      <div class="grid grid-cols-2 gap-6 mb-8">${render_all(self.cards)}</div>`;
+  }
+}
+
+pub class PackagePage {
+  name:    Text
+  summary: Text
+  git:     Text
+  rev:     Text
+  what:    Text
+  usage:   Text
+
+  fn render() -> Text {
+    let dep = code_block("[deps]\n" .. self.name .. " = { git = \"" .. self.git .. "\", rev = \"" .. self.rev .. "\" }");
+    let head = `
+      <h1 class="text-3xl font-bold mb-2">{{ self.name }}</h1>
+      <p class="leading-relaxed text-gray-700 mb-6">{{ self.summary }}</p>
+      <h2 class="text-2xl font-bold mb-2">Install</h2>
+      <p class="leading-relaxed mb-4">Add it to your <code>wo.toml</code>. The
+      KEY is the module name — that is what <code>use</code> imports.</p>`;
+    let what = `
+      <h2 class="text-2xl font-bold mb-2 mt-8">What you get</h2>
+      ${self.what}`;
+    let usage = `
+      <h2 class="text-2xl font-bold mb-2 mt-8">Usage</h2>
+      ${self.usage}`;
+    let back = el("p", "mt-8", link("/packages", "", "← all packages"));
+    return head .. dep .. what .. usage .. back;
+  }
+}
diff --git a/docs/examples/site/types.wo b/docs/examples/site/types.wo
new file mode 100644
index 0000000..b1cb9fb
--- /dev/null
+++ b/docs/examples/site/types.wo
@@ -0,0 +1,52 @@
+-- types.wo — the MODEL. Every @table class IS a WAL-backed table: rows
+-- persist under WO_DATA and replay on restart; without WO_DATA the
+-- store is RAM-only. Nothing else lives here — no rendering, no request
+-- handling.
+--
+-- Root module by NECESSITY, not choice: `pub` and `@table` cannot
+-- combine yet (recorded language gap), so tables cannot be exported to
+-- other modules — everything that queries them (the controllers) lives
+-- in the root module too.
+
+-- Every chapter is a row: slug is the URL, ord orders the nav, body is a
+-- server-rendered HTML fragment. Edits (the admin route) persist through
+-- the WAL under WO_DATA and replay on restart.
+@table(name: "chapters", index: [slug])
+class Chapter {
+  slug:  Text @unique
+  ord:   Int
+  title: Text
+  body:  Text
+}
+
+-- One nav entry: a PROJECTION of a Chapter row, not the row itself. It
+-- lives with the model because that is what it is — the views merely
+-- consume it, and never hold a database handle.
+typedef ChapterLink = { ord: Int, title: Text, slug: Text }
+
+-- The chapter queries, on a class so every feature module can reach
+-- them: a free `fn` is scoped to the module that declares it (WO-E210),
+-- but a CLASS — and its statics — is reachable across module lines.
+-- That is what lets `home/` and `chapter/` share one query without one
+-- importing the other.
+class Chapters {
+  -- Every chapter as a nav entry, ordered. Two pages call this.
+  static fn links() -> multi ChapterLink {
+    let items: multi ChapterLink = [];
+    for c in from x in Chapter order by x.ord select x {
+      push(items, ChapterLink { ord: c.ord, title: c.title, slug: c.slug });
+    }
+    return items;
+  }
+}
+
+-- First boot only: an empty table gets the tutorial (content.wo).
+fn seed_if_empty() {
+  let n = 0;
+  for c in from x in Chapter take 1 select x {
+    n = n + 1;
+  }
+  if n == 0 {
+    seed_chapters();
+  }
+}
diff --git a/docs/examples/site/wo.toml b/docs/examples/site/wo.toml
index d2e15a5..1ce7a92 100644
--- a/docs/examples/site/wo.toml
+++ b/docs/examples/site/wo.toml
@@ -1,13 +1,13 @@
 name        = "site"
 version     = "0.1.0"
-description = "writeonce.de — the language tutorial served by the language: framework + wo-html [deps], @table chapters, server-rendered pages"
+description = "writeonce.de — the language tutorial served by the language: framework + writeonce-view [deps], @table chapters, server-rendered pages"
 
 [runtime]
 wo = ">= 0.1"
 
 # Two real dependencies (the gate substitutes file:// remotes built from
-# docs/examples/writeonce-framework and docs/examples/wo-html, so CI never
+# docs/examples/porch and docs/examples/writeonce-view, so CI never
 # touches the network). The [deps] KEY is the module name `use` imports.
 [deps]
-framework = { git = "https://github.com/shoneyj/writeonce-framework", rev = "v0.1.0" }
-html      = { git = "https://github.com/shoneyj/wo-html", rev = "v0.1.0" }
+porch     = { git = "https://github.com/shoneyj/porch", rev = "v0.1.0" }
+view      = { git = "https://github.com/shoneyj/writeonce-view", rev = "v0.1.0" }
diff --git a/docs/examples/web-app/README.md b/docs/examples/web-app/README.md
index 950b91e..54d68bb 100644
--- a/docs/examples/web-app/README.md
+++ b/docs/examples/web-app/README.md
@@ -1,7 +1,7 @@
 # web-app — the storefront sample
 
 A small store: `Product`/`Order` as `@table` classes, JSON routes, one auth
-middleware — built on [`writeonce-framework`](../writeonce-framework/), which
+middleware — built on [`porch`](../porch/), which
 it imports **through `[deps]`** (iteration 15). This app is iteration 16's
 acceptance workload: `just web-app` runs the whole chain — fetch → lock →
 build → serve → curl matrix → restart persistence → SIGTERM.
diff --git a/docs/examples/web-app/main.wo b/docs/examples/web-app/main.wo
index 76a9d81..e43419b 100644
--- a/docs/examples/web-app/main.wo
+++ b/docs/examples/web-app/main.wo
@@ -1,4 +1,4 @@
--- web-app — the storefront: writeonce-framework (via [deps]) + @table
+-- web-app — the storefront: porch (via [deps]) + @table
 -- persistence. Every handler is a class satisfying Handler; the auth gate is
 -- a Middleware; the data layer is the language's own database — no ORM, no
 -- separate process, one binary.
@@ -6,9 +6,9 @@ use env
 use json
 use net
 use time
-use framework
-use framework/http
-use framework/router
+use porch
+use porch/http
+use porch/router
 
 -- decode target for POST /products, encode shape for every product answer
 typedef ProductView = { name: Text, price: Float, stock: Int }
@@ -19,7 +19,6 @@ fn view_json(name: Text, price: Float, stock: Int) -> Text {
 }
 
 class ListProducts {
-  pad: Int
   fn handle(req: Req) -> Resp {
     let body = "[";
     let first = true;
@@ -33,7 +32,6 @@ class ListProducts {
 }
 
 class ShowProduct {
-  pad: Int
   fn handle(req: Req) -> Resp {
     let name = req.params["name"];
     if name == nil { return bad_request("no name"); }
@@ -54,7 +52,6 @@ fn create_product(name: Text, price: Float, stock: Int) -> Resp {
 }
 
 class CreateProduct {
-  pad: Int
   fn handle(req: Req) -> Resp {
     if media_type(req) == "multipart/form-data" {
       let ps = multipart_parts(req);
@@ -95,7 +92,6 @@ class CreateProduct {
 }
 
 class CreateOrder {
-  pad: Int
   fn handle(req: Req) -> Resp {
     let v = json.decode(req.body) as NewOrder;
     if v == nil { return bad_request("body must be {product, qty}"); }
@@ -108,7 +104,6 @@ class CreateOrder {
 }
 
 class DeleteProduct {
-  pad: Int
   fn handle(req: Req) -> Resp {
     let name = req.params["name"];
     if name == nil { return bad_request("no name"); }
@@ -146,7 +141,6 @@ class ConnWorker {
 
 -- a deliberately slow route: the concurrency proof's workload
 class Slow {
-  pad: Int
   fn handle(req: Req) -> Resp {
     time.sleep(400);
     return ok_text("slow done");
@@ -157,7 +151,6 @@ class Slow {
 
 -- wildcard capture: GET /files/*path echoes the rest
 class EchoPath {
-  pad: Int
   fn handle(req: Req) -> Resp {
     let p = req.params["path"];
     if p == nil { return ok_text("path="); }
@@ -167,7 +160,6 @@ class EchoPath {
 
 -- group middleware writes the request-scoped ctx bag; the handler reads it
 class StampCtx {
-  pad: Int
   fn before(mut req: Req) -> ?Resp {
     req.ctx["via"] = "api-group";
     return nil;
@@ -175,7 +167,6 @@ class StampCtx {
 }
 
 class ApiPing {
-  pad: Int
   fn handle(req: Req) -> Resp {
     let via = req.ctx["via"];
     if via == nil { return ok_text("pong via="); }
@@ -185,7 +176,6 @@ class ApiPing {
 
 -- ETag + conditional: same body = same tag; If-None-Match collapses to 304
 class EtagProbe {
-  pad: Int
   fn handle(req: Req) -> Resp {
     return with_etag(req, ok_json("{\"v\":1}"));
   }
@@ -193,7 +183,6 @@ class EtagProbe {
 
 -- response-side negotiation: JSON or nothing
 class NegoProbe {
-  pad: Int
   fn handle(req: Req) -> Resp {
     if accepts(req, "application/json") == false {
       let h: map<Text, Text> = {};
@@ -256,20 +245,20 @@ fn build_app(token: Text) -> App {
   app.use_mw(Mw { m: BearerAuth { token: "${token}", principal: "api" } });
   -- the response half: security headers + the CORS origin stamp on every
   -- response that leaves dispatch (404/405/401 included)
-  app.use_after(Aw { a: SecurityHeaders { pad: 0 } });
+  app.use_after(Aw { a: SecurityHeaders {} });
   app.use_after(Aw { a: Cors { allow_origin: "*" } });
-  app.get("/products",             ListProducts { pad: 0 });
-  app.get("/products/:name",       ShowProduct { pad: 0 });
-  app.post("/products",            CreateProduct { pad: 0 });
-  app.post("/orders",              CreateOrder { pad: 0 });
-  app.delete_("/products/:name",   DeleteProduct { pad: 0 });
-  app.get("/files/*path",          EchoPath { pad: 0 });
-  app.get("/etag-probe",           EtagProbe { pad: 0 });
-  app.get("/nego",                 NegoProbe { pad: 0 });
-  app.get("/slow",                 Slow { pad: 0 });
+  app.get("/products",             ListProducts {});
+  app.get("/products/:name",       ShowProduct {});
+  app.post("/products",            CreateProduct {});
+  app.post("/orders",              CreateOrder {});
+  app.delete_("/products/:name",   DeleteProduct {});
+  app.get("/files/*path",          EchoPath {});
+  app.get("/etag-probe",           EtagProbe {});
+  app.get("/nego",                 NegoProbe {});
+  app.get("/slow",                 Slow {});
   let g = Group { prefix: "/api" };
-  g.use_mw(Mw { m: StampCtx { pad: 0 } });
-  g.get("/ping", ApiPing { pad: 0 });
+  g.use_mw(Mw { m: StampCtx {} });
+  g.get("/ping", ApiPing {});
   app.mount(g);
   return app;
 }
diff --git a/docs/examples/web-app/wo.toml b/docs/examples/web-app/wo.toml
index 56c7e81..a7c00c6 100644
--- a/docs/examples/web-app/wo.toml
+++ b/docs/examples/web-app/wo.toml
@@ -1,6 +1,6 @@
 name        = "web-app"
 version     = "0.1.0"
-description = "Storefront sample: consumes writeonce-framework through [deps]; @table persistence; iteration 16's acceptance workload"
+description = "Storefront sample: consumes porch through [deps]; @table persistence; iteration 16's acceptance workload"
 
 [runtime]
 wo = ">= 0.1"
@@ -11,9 +11,14 @@ wo = ">= 0.1"
 # The framework is a real dependency, never a relative path — extraction of
 # the framework to its own repository changes only this URL. The acceptance
 # gate (scripts/web-app-accept.sh) substitutes a run-time file:// remote
-# built from docs/examples/writeonce-framework, so CI never needs the
+# built from docs/examples/porch, so CI never needs the
 # network and this repo never carries .wo-deps/wo.lock artifacts.
-# The [deps] KEY is the module name `use` imports (hyphens are not identifier
-# characters, so the key is `framework` while the repository keeps its name).
+# The [deps] KEY is the module name `use` imports — here `porch`, so the source
+# says `use porch`. The key must be a legal identifier, which per
+# compiler/src/lexer.ml's `is_ident_cont` DOES include `-` (an internal dash is
+# part of the identifier: `a-b` is one name, which is why binary minus needs
+# spaces around it). So a hyphenated key like `wo-serve` would be legal too;
+# `porch` is simply shorter. An earlier version of this comment claimed hyphens
+# were illegal and named a key this file has never used — both wrong.
 [deps]
-framework = { git = "https://github.com/shoneyj/writeonce-framework", rev = "v0.1.0" }
+porch     = { git = "https://github.com/shoneyj/porch", rev = "v0.1.0" }
diff --git a/docs/examples/wo-html/html.wo b/docs/examples/wo-html/html.wo
deleted file mode 100644
index e8a5ce8..0000000
--- a/docs/examples/wo-html/html.wo
+++ /dev/null
@@ -1,123 +0,0 @@
--- wo-html — server-rendered HTML as plain Text. Three layers, all pure:
---   esc()        HTML-escape untrusted text (the ONLY defense: use it on
---                everything that did not come from your own code)
---   el()/...     element builders — `el("h1", "text-3xl font-bold", t)`
---   tw_css()     a Tailwind-style utility stylesheet: the same class
---                names Tailwind popularized, hand-written as one static
---                sheet, inlined by page() so a page is one self-contained
---                response — no CDN, no build step, no JS
---
--- The language has no varargs and no closures (doctrine), so builders
--- take exactly (tag, classes, inner) and pages compose by `..` and by
--- functions returning Text. That constraint is the demo: an HTML layer
--- in writeonce is ordinary code, not a template dialect.
-
--- HTML-escape: & < > " (the four that matter in text and attributes).
-pub fn esc(t: Text) -> Text {
-  let out = "";
-  let i = 0;
-  let n = len(t);
-  while i < n {
-    let b = byte_at(t, i);
-    if b == 38 { out = out .. "&amp;"; }
-    else {
-      if b == 60 { out = out .. "&lt;"; }
-      else {
-        if b == 62 { out = out .. "&gt;"; }
-        else {
-          if b == 34 { out = out .. "&quot;"; }
-          else { out = out .. substr(t, i, 1); }
-        }
-      }
-    }
-    i = i + 1;
-  }
-  return out;
-}
-
--- One element. Empty class list = no attribute. The inner text is the
--- CALLER's business: pass esc(user_text) for data, raw markup for
--- fragments you built yourself.
-pub fn el(tag: Text, cls: Text, inner: Text) -> Text {
-  if cls == "" { return "<${tag}>${inner}</${tag}>"; }
-  return "<${tag} class=\"${cls}\">${inner}</${tag}>";
-}
-
--- An anchor: href is attribute context, so it is escaped here.
-pub fn link(href: Text, cls: Text, label: Text) -> Text {
-  if cls == "" { return "<a href=\"${esc(href)}\">${label}</a>"; }
-  return "<a href=\"${esc(href)}\" class=\"${cls}\">${label}</a>";
-}
-
--- A code block: content is ALWAYS escaped — code samples are exactly the
--- text that breaks HTML otherwise.
-pub fn code_block(src: Text) -> Text {
-  return el("pre", "code-block", el("code", "", esc(src)));
-}
-
-pub fn text_input(name: Text, value: Text) -> Text {
-  return "<input type=\"text\" name=\"${esc(name)}\" value=\"${esc(value)}\" class=\"field\">";
-}
-
-pub fn text_area(name: Text, value: Text, rows: Int) -> Text {
-  return "<textarea name=\"${esc(name)}\" rows=\"${rows}\" class=\"field\">${esc(value)}</textarea>";
-}
-
-pub fn submit_btn(label: Text) -> Text {
-  return "<button type=\"submit\" class=\"btn\">${esc(label)}</button>";
-}
-
-pub fn form_post(action: Text, inner: Text) -> Text {
-  return "<form method=\"POST\" action=\"${esc(action)}\" class=\"flex flex-col gap-2\">${inner}</form>";
-}
-
--- The utility sheet. Tailwind's names, one hand-written static sheet —
--- only the utilities this ecosystem's pages actually use; growing it is
--- adding a line, not adopting a toolchain. `.code-block`, `.field` and
--- `.btn` are the three composites the builders above rely on.
-pub fn tw_css() -> Text {
-  let c = "*{box-sizing:border-box;margin:0;padding:0}";
-  c = c .. "body{font-family:system-ui,sans-serif;background:#f9fafb;color:#111827;line-height:1.6}";
-  c = c .. ".mx-auto{margin-left:auto;margin-right:auto}";
-  c = c .. ".max-w-3xl{max-width:48rem}";
-  c = c .. ".p-4{padding:1rem}.p-6{padding:1.5rem}.px-4{padding-left:1rem;padding-right:1rem}";
-  c = c .. ".py-2{padding-top:.5rem;padding-bottom:.5rem}.py-8{padding-top:2rem;padding-bottom:2rem}";
-  c = c .. ".mb-2{margin-bottom:.5rem}.mb-4{margin-bottom:1rem}.mb-8{margin-bottom:2rem}";
-  c = c .. ".mt-4{margin-top:1rem}.mt-8{margin-top:2rem}";
-  c = c .. ".flex{display:flex}.flex-col{flex-direction:column}";
-  c = c .. ".items-center{align-items:center}.justify-between{justify-content:space-between}";
-  c = c .. ".gap-2{gap:.5rem}.gap-4{gap:1rem}";
-  c = c .. ".text-sm{font-size:.875rem}.text-lg{font-size:1.125rem}";
-  c = c .. ".text-xl{font-size:1.25rem}.text-2xl{font-size:1.5rem}.text-3xl{font-size:1.875rem}";
-  c = c .. ".font-bold{font-weight:700}.font-mono{font-family:ui-monospace,monospace}";
-  c = c .. ".text-gray-500{color:#6b7280}.text-gray-700{color:#374151}.text-gray-900{color:#111827}";
-  c = c .. ".text-blue-600{color:#2563eb}.text-white{color:#fff}";
-  c = c .. ".bg-white{background:#fff}.bg-gray-50{background:#f9fafb}";
-  c = c .. ".bg-gray-900{background:#111827}.bg-blue-600{background:#2563eb}";
-  c = c .. ".rounded{border-radius:.25rem}.rounded-lg{border-radius:.5rem}";
-  c = c .. ".border{border:1px solid #e5e7eb}.shadow-sm{box-shadow:0 1px 2px rgba(0,0,0,.05)}";
-  c = c .. ".block{display:block}.w-full{width:100%}.leading-relaxed{line-height:1.75}";
-  c = c .. ".underline{text-decoration:underline}.no-underline{text-decoration:none}";
-  c = c .. ".list-disc{list-style:disc}.pl-6{padding-left:1.5rem}";
-  c = c .. "a{color:#2563eb;text-decoration:none}a:hover{text-decoration:underline}";
-  c = c .. ".code-block{background:#111827;color:#e5e7eb;padding:1rem;border-radius:.5rem;";
-  c = c .. "overflow-x:auto;font-size:.875rem;line-height:1.6;margin:1rem 0}";
-  c = c .. ".code-block code{font-family:ui-monospace,monospace;white-space:pre}";
-  c = c .. ".field{display:block;width:100%;border:1px solid #e5e7eb;border-radius:.25rem;";
-  c = c .. "padding:.5rem;font-family:ui-monospace,monospace;font-size:.875rem}";
-  c = c .. ".btn{background:#2563eb;color:#fff;border:0;border-radius:.25rem;";
-  c = c .. "padding:.5rem 1rem;font-weight:700;cursor:pointer}";
-  return c;
-}
-
--- One full document: the sheet inlined, viewport set, body handed in.
--- Self-contained by construction — view-source shows everything.
-pub fn page(title: Text, body: Text) -> Text {
-  let d = "<!doctype html><html><head><meta charset=\"utf-8\">";
-  d = d .. "<meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">";
-  d = d .. "<title>${esc(title)}</title>";
-  d = d .. "<style>${tw_css()}</style></head><body>";
-  d = d .. body;
-  d = d .. "</body></html>";
-  return d;
-}
diff --git a/docs/examples/writeonce-view/README.md b/docs/examples/writeonce-view/README.md
new file mode 100644
index 0000000..d15b8fa
--- /dev/null
+++ b/docs/examples/writeonce-view/README.md
@@ -0,0 +1,108 @@
+# writeonce-view — server-rendered HTML as plain Text
+> Renamed 2026-08-25: this library was `wo-html`, imported as `use html`.
+> Stories, specs and plans dated before that still say the old name — they
+> are dated records and were left as written.
+
+A view library, not a framework and not a template engine. Everything in
+it is a pure function or a class with a `render()`; nothing here opens a
+socket, reads a file, or touches the database.
+
+```
+[deps]
+view = { git = "https://github.com/shoneyj/writeonce-view", rev = "v0.1.0" }
+```
+
+## The four layers
+
+| layer | what it is |
+| --- | --- |
+| `esc()` | HTML-escape `& < > "`. A `{{ }}` hole in a raw text literal compiles to a call to this, so display data is escaped by construction; calling it by hand is the fallback, not the norm |
+| `el()`, `link()`, `card()`, `form_post()`, … | element builders — `el("h1", "text-3xl font-bold", t)` |
+| `Component` / `Layout` / `render_all()` | the view unit and its composition |
+| `tw_css()` / `page()` | a hand-written Tailwind-style utility sheet, inlined into one self-contained document — no CDN, no build step, no JS |
+
+## Components
+
+A component is a class with fields and `fn render() -> Text`. Nothing
+declares that it implements `Component` — satisfaction is **structural**,
+exactly like the framework's `Handler`. Its fields ARE its inputs; the
+language has no closures, so a field is the capture.
+
+```
+class ProductCard {
+  sku:  Text
+  name: Text
+  fn render() -> Text {
+    return `
+      <div class="card">
+        <h3><a href="/p/{{ self.sku }}">{{ self.name }}</a></h3>
+      </div>`;
+  }
+}
+```
+
+Composition is nesting — a parent holds children and calls their render:
+
+```
+pub class ProductListPage {
+  cards: multi Component
+  fn render() -> Text {
+    return `<div class="grid">${render_all(self.cards)}</div>`;
+  }
+}
+```
+
+`multi Component` holds a heterogeneous list **directly**; no wrapper
+record is needed (the framework's `Mw`/`Aw` wrappers are not a language
+requirement). `render_all(cs)` renders children in order.
+
+`Layout { title, head, nav, content, footer }` is content projection —
+Angular's `<ng-content>` with the slots as ordinary pre-rendered `Text`.
+The caller passes `child.render()`, a raw literal, or a builder's output;
+the layout never learns which, which is precisely why it never needs the
+child's type. A page wanting a fixed-width column wraps its content
+before handing it over — deliberately no container knob here. `head` is
+the one slot that is not body markup: a favicon link or a meta tag has
+nowhere else to go, and `""` is the ordinary value (`page()` passes it
+for you).
+
+`Layout` renders through `page()`, so it inlines the utility sheet. An
+app that links a real stylesheet instead writes its own two-slot shell
+component — `docs/examples/shop/layout/app.wo` is that case, and it is a
+component like any other.
+
+## The MVC seam
+
+| | where it lives |
+| --- | --- |
+| **Model** | `@table` rows, queried in the HANDLER. This library contains no `from … select` anywhere and must not grow one |
+| **View** | components: fields in, Text out. No hidden state, no globals — a page is byte-deterministic from its fields |
+| **Controller** | the framework's `Handler`: it queries, fills the component's fields, and answers `ok_html(c.render())` |
+
+`ok_html` is the **framework's** (`framework/http`, beside `ok_text` and
+`ok_json`): a status line plus a content-type is transport, not
+rendering, so writeonce-view never learns what a `Resp` is.
+
+The seam is what makes a view testable without a server and a query
+testable without markup. Breaking it looks like one convenience — a
+component that queries "just this once" — and costs both.
+
+## Deliberately absent
+
+Client-side anything (change detection, event bindings, two-way binding,
+SPA routing, hydration): the no-JS posture stands, and interactivity is
+form round trips. A runtime template engine: reflection-free means an
+untyped `map<Text, Text>`, so templates compile to code at build time or
+they do not exist. Dependency injection: components are data-in,
+Text-out. Structural directives (`w:if` / `w:for`): the language's own
+`if` and `for` compose literals, and no sample has yet proven the need
+for a second control-flow dialect. Scoped CSS: the utility sheet stays
+one static string until the pain is measured.
+
+## Consumers
+
+- [`docs/examples/site`](../site) — the tutorial site: `Layout` +
+  a `ChapterNav` component reused on the homepage and every chapter page.
+  Gated by `just site`.
+- [`docs/examples/shop`](../shop/README.md) — the program template: its
+  own `AppShell` component, page components holding child components.
diff --git a/docs/examples/writeonce-view/html.wo b/docs/examples/writeonce-view/html.wo
new file mode 100644
index 0000000..23d45d7
--- /dev/null
+++ b/docs/examples/writeonce-view/html.wo
@@ -0,0 +1,239 @@
+-- writeonce-view — server-rendered HTML as plain Text. Four layers, all pure:
+--   esc()        HTML-escape untrusted text. `{{ }}` in a raw text
+--                literal compiles to a call to this, so display data is
+--                escaped by construction; esc() by hand is the fallback
+--   el()/...     element builders — `el("h1", "text-3xl font-bold", t)`
+--   Component    the view unit: a class with fields + `fn render() ->
+--                Text`, satisfied structurally (iteration 37)
+--   tw_css()     a Tailwind-style utility stylesheet: the same class
+--                names Tailwind popularized, hand-written as one static
+--                sheet, inlined by page() so a page is one self-contained
+--                response — no CDN, no build step, no JS
+--
+-- The language has no varargs and no closures (doctrine), so builders
+-- take exactly (tag, classes, inner) and pages compose by `..` and by
+-- functions returning Text. That constraint is the demo: an HTML layer
+-- in writeonce is ordinary code, not a template dialect.
+--
+-- ---- the MVC seam this library sits on --------------------------------
+--
+-- MODEL      `@table` rows. Queried in the HANDLER, never here — this
+--            library has no `from ... select` anywhere in it and must
+--            not grow one. A component receives VALUES, not a cursor.
+-- VIEW       components: fields in, Text out, no hidden state and no
+--            globals, so a page is byte-deterministic from its fields.
+-- CONTROLLER the framework's `Handler`: it queries, fills the component's
+--            fields, and answers `ok_html(c.render())`.
+--
+-- The seam is what makes a view testable without a server and a query
+-- testable without markup. Breaking it looks like one convenience —
+-- a component that queries "just this once" — and costs both.
+
+-- HTML-escape: & < > " (the four that matter in text and attributes).
+pub fn esc(t: Text) -> Text {
+  let out = "";
+  let i = 0;
+  let n = len(t);
+  while i < n {
+    let b = byte_at(t, i);
+    if b == 38 { out = out .. "&amp;"; }
+    else {
+      if b == 60 { out = out .. "&lt;"; }
+      else {
+        if b == 62 { out = out .. "&gt;"; }
+        else {
+          if b == 34 { out = out .. "&quot;"; }
+          else { out = out .. substr(t, i, 1); }
+        }
+      }
+    }
+    i = i + 1;
+  }
+  return out;
+}
+
+-- One element. Empty class list = no attribute. The inner text is the
+-- CALLER's business: pass esc(user_text) for data, raw markup for
+-- fragments you built yourself.
+pub fn el(tag: Text, cls: Text, inner: Text) -> Text {
+  if cls == "" { return `<${tag}>${inner}</${tag}>`; }
+  return `<${tag} class="${cls}">${inner}</${tag}>`;
+}
+
+-- An anchor: href is attribute context, so it is escaped here.
+pub fn link(href: Text, cls: Text, label: Text) -> Text {
+  if cls == "" { return `<a href="{{ href }}">${label}</a>`; }
+  return `<a href="{{ href }}" class="${cls}">${label}</a>`;
+}
+
+-- A code block: content is ALWAYS escaped — code samples are exactly the
+-- text that breaks HTML otherwise.
+pub fn code_block(src: Text) -> Text {
+  return el("pre", "code-block", el("code", "", esc(src)));
+}
+
+pub fn text_input(name: Text, value: Text) -> Text {
+  return `<input type="text" name="{{ name }}" value="{{ value }}" class="field">`;
+}
+
+pub fn text_area(name: Text, value: Text, rows: Int) -> Text {
+  return `<textarea name="{{ name }}" rows="${rows}" class="field">{{ value }}</textarea>`;
+}
+
+pub fn submit_btn(label: Text) -> Text {
+  return `<button type="submit" class="btn">{{ label }}</button>`;
+}
+
+pub fn form_post(action: Text, inner: Text) -> Text {
+  return `<form method="POST" action="{{ action }}" class="flex flex-col gap-2">${inner}</form>`;
+}
+
+-- A sticky top navigation bar: brand on the left, a prebuilt row of
+-- links on the right. The bar spans the viewport; the inner row shares
+-- the page's container widths.
+pub fn nav_bar(brand_href: Text, brand: Text, right: Text) -> Text {
+  let b = link(brand_href, "text-xl font-bold text-gray-900 no-underline", brand);
+  let row = el("div", "mx-auto max-w-5xl px-4 flex items-center justify-between", b .. el("div", "flex items-center gap-4", right));
+  return el("nav", "nav", row);
+}
+
+-- A titled card for feature grids.
+pub fn card(title: Text, body: Text) -> Text {
+  let t = el("h3", "text-lg font-bold mb-2", title);
+  return el("div", "bg-white rounded-lg border shadow-sm p-6", t .. el("p", "leading-relaxed text-gray-700", body));
+}
+
+-- A link styled as a button; primary = filled, otherwise outline.
+pub fn btn_link(href: Text, label: Text, primary: Bool) -> Text {
+  if primary {
+    return link(href, "btn no-underline", label);
+  }
+  return link(href, "btn-outline no-underline", label);
+}
+
+-- The utility sheet. Tailwind's names, one hand-written static sheet —
+-- only the utilities this ecosystem's pages actually use; growing it is
+-- adding a line, not adopting a toolchain. `.code-block`, `.field` and
+-- `.btn` are the three composites the builders above rely on.
+pub fn tw_css() -> Text {
+  let c = "*{box-sizing:border-box;margin:0;padding:0}";
+  c = c .. "body{font-family:system-ui,sans-serif;background:#f9fafb;color:#111827;line-height:1.6}";
+  c = c .. ".mx-auto{margin-left:auto;margin-right:auto}";
+  c = c .. ".max-w-3xl{max-width:48rem}";
+  c = c .. ".p-4{padding:1rem}.p-6{padding:1.5rem}.px-4{padding-left:1rem;padding-right:1rem}";
+  c = c .. ".py-2{padding-top:.5rem;padding-bottom:.5rem}.py-8{padding-top:2rem;padding-bottom:2rem}";
+  c = c .. ".mb-2{margin-bottom:.5rem}.mb-4{margin-bottom:1rem}.mb-8{margin-bottom:2rem}";
+  c = c .. ".mt-4{margin-top:1rem}.mt-8{margin-top:2rem}";
+  c = c .. ".flex{display:flex}.flex-col{flex-direction:column}";
+  c = c .. ".items-center{align-items:center}.justify-between{justify-content:space-between}";
+  c = c .. ".gap-2{gap:.5rem}.gap-4{gap:1rem}";
+  c = c .. ".text-sm{font-size:.875rem}.text-lg{font-size:1.125rem}";
+  c = c .. ".text-xl{font-size:1.25rem}.text-2xl{font-size:1.5rem}.text-3xl{font-size:1.875rem}";
+  c = c .. ".font-bold{font-weight:700}.font-mono{font-family:ui-monospace,monospace}";
+  c = c .. ".text-gray-500{color:#6b7280}.text-gray-700{color:#374151}.text-gray-900{color:#111827}";
+  c = c .. ".text-blue-600{color:#2563eb}.text-white{color:#fff}";
+  c = c .. ".bg-white{background:#fff}.bg-gray-50{background:#f9fafb}";
+  c = c .. ".bg-gray-900{background:#111827}.bg-blue-600{background:#2563eb}";
+  c = c .. ".rounded{border-radius:.25rem}.rounded-lg{border-radius:.5rem}";
+  c = c .. ".border{border:1px solid #e5e7eb}.shadow-sm{box-shadow:0 1px 2px rgba(0,0,0,.05)}";
+  c = c .. ".block{display:block}.w-full{width:100%}.leading-relaxed{line-height:1.75}";
+  c = c .. ".underline{text-decoration:underline}.no-underline{text-decoration:none}";
+  c = c .. ".list-disc{list-style:disc}.pl-6{padding-left:1.5rem}";
+  c = c .. "a{color:#2563eb;text-decoration:none}a:hover{text-decoration:underline}";
+  c = c .. ".code-block{background:#111827;color:#e5e7eb;padding:1rem;border-radius:.5rem;";
+  c = c .. "overflow-x:auto;font-size:.875rem;line-height:1.6;margin:1rem 0}";
+  c = c .. ".code-block code{font-family:ui-monospace,monospace;white-space:pre}";
+  c = c .. ".field{display:block;width:100%;border:1px solid #e5e7eb;border-radius:.25rem;";
+  c = c .. "padding:.5rem;font-family:ui-monospace,monospace;font-size:.875rem}";
+  c = c .. ".btn{background:#2563eb;color:#fff;border:0;border-radius:.25rem;";
+  c = c .. "padding:.5rem 1rem;font-weight:700;cursor:pointer}";
+  c = c .. "a.btn{color:#fff;display:inline-block}a.btn:hover{text-decoration:none;background:#1d4ed8}";
+  c = c .. ".btn-outline{display:inline-block;border:1px solid #2563eb;color:#2563eb;";
+  c = c .. "border-radius:.25rem;padding:.5rem 1rem;font-weight:700}";
+  c = c .. "a.btn-outline:hover{text-decoration:none;background:#eff6ff}";
+  c = c .. ".nav{position:sticky;top:0;background:#fff;border-bottom:1px solid #e5e7eb;";
+  c = c .. "padding:.75rem 0;z-index:10}";
+  c = c .. ".footer{border-top:1px solid #e5e7eb;color:#6b7280;font-size:.875rem;";
+  c = c .. "padding:2rem 1rem;text-align:center;margin-top:4rem}";
+  c = c .. ".max-w-5xl{max-width:64rem}.text-4xl{font-size:2.25rem;line-height:1.2}";
+  c = c .. ".py-16{padding-top:4rem;padding-bottom:4rem}.text-center{text-align:center}";
+  c = c .. ".mb-6{margin-bottom:1.5rem}.gap-6{gap:1.5rem}.justify-center{justify-content:center}";
+  c = c .. ".grid{display:grid}.grid-cols-2{grid-template-columns:repeat(2,1fr)}";
+  c = c .. "@media(max-width:640px){.grid-cols-2{grid-template-columns:1fr}}";
+  return c;
+}
+
+-- One full document: the sheet inlined, viewport set, body handed in.
+-- Self-contained by construction — view-source shows everything.
+pub fn page(title: Text, body: Text) -> Text {
+  return page_head(title, "", body);
+}
+
+-- The same document with extra <head> markup: a favicon link, a meta
+-- description, whatever the app needs up there. Kept RAW (`${}`) — head
+-- content is markup the app built, not data — and defaulted to "" by
+-- `page()` so no consumer has to care.
+pub fn page_head(title: Text, head: Text, body: Text) -> Text {
+  -- The whole document as one literal. Every newline here lands
+  -- inside <head>, where whitespace is insignificant; the body hole
+  -- and its closing tags share one line so nothing is inserted into
+  -- the rendered content.
+  return `
+    <!doctype html><html><head><meta charset="utf-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <title>{{ title }}</title>
+    ${head}
+    <style>${tw_css()}</style>
+    </head><body>${body}</body></html>`;
+}
+
+-- ---- components (iteration 37) ----------------------------------------
+
+-- The view twin of the framework's `Handler`: a class with fields and a
+-- render, satisfied STRUCTURALLY — nothing declares that it implements
+-- this, a class either has `fn render() -> Text` or it does not (a class
+-- missing it is WO-E205 at the use site). Composition is nesting: a
+-- parent's render calls its children's.
+--
+-- A component's fields ARE its inputs — the closure substitute this
+-- language's no-function-values doctrine forces, and the same shape the
+-- framework already proved for handlers. `multi Component` works
+-- directly, so a heterogeneous list of children needs no wrapper record.
+pub interface Component {
+  fn render() -> Text
+}
+
+-- Render children in order. The one place in this library where the
+-- interface is genuinely load-bearing: this function knows nothing about
+-- any of them beyond `render()`, and `multi Component` holds a
+-- heterogeneous list directly — no wrapper record, which the framework's
+-- Mw/Aw shape might lead you to expect.
+pub fn render_all(cs: multi Component) -> Text {
+  let out = "";
+  for c in cs {
+    out = out .. c.render();
+  }
+  return out;
+}
+
+-- Content projection, writeonce-shaped: Angular's `<ng-content>` is a
+-- slot the parent fills, and here a slot is just a pre-rendered `Text`
+-- field. The caller passes `child.render()`, a raw literal, or a
+-- builder's output — the layout never knows which, which is exactly why
+-- it never needs to know the child's type.
+--
+-- Deliberately no container/width field: a page that wants its content
+-- in a fixed-width column wraps it before passing it in. `head` is the
+-- one non-body slot — a favicon link or a meta tag has nowhere else to
+-- go, and "" is the ordinary value.
+pub class Layout {
+  title:   Text
+  head:    Text
+  nav:     Text
+  content: Text
+  footer:  Text
+
+  fn render() -> Text {
+    return page_head(self.title, self.head, self.nav .. self.content .. self.footer);
+  }
+}
diff --git a/docs/examples/wo-html/wo.toml b/docs/examples/writeonce-view/wo.toml
similarity index 74%
rename from docs/examples/wo-html/wo.toml
rename to docs/examples/writeonce-view/wo.toml
index a3cbd16..c2863a0 100644
--- a/docs/examples/wo-html/wo.toml
+++ b/docs/examples/writeonce-view/wo.toml
@@ -1,4 +1,4 @@
-name        = "wo-html"
+name        = "writeonce-view"
 kind        = "library"
 version     = "0.1.0"
 description = "HTML building for writeonce apps: escaping, element builders, and a Tailwind-style utility stylesheet — server-rendered pages as plain Text"
@@ -7,4 +7,4 @@ description = "HTML building for writeonce apps: escaping, element builders, and
 wo = ">= 0.1"
 
 # A LIBRARY project: no `fn main`. Apps import it through wo.toml [deps]
-# (the key names the module — `html = { git = ... }` gives `use html`).
+# (the key names the module — `view = { git = ... }` gives `use view`).
diff --git a/docs/guides/language-surface.md b/docs/guides/language-surface.md
new file mode 100644
index 0000000..b00153c
--- /dev/null
+++ b/docs/guides/language-surface.md
@@ -0,0 +1,253 @@
+# The writeonce language surface — everything a `.wo` file may contain
+
+Derived from the front end as it stands on 2026-08-24 and re-verified
+against it on 2026-08-26, by reading `compiler/src/lexer.ml`,
+`parser.ml`, `ast.ml` and `types.ml` — not a spec. Where this disagrees
+with the compiler, the compiler is right.
+The normative companions are
+[`08-builtin-surface.md`](../plan/oop-vm/08-builtin-surface.md) (what the
+runtime offers) and [`01-error-catalog.md`](../plan/oop-vm/01-error-catalog.md)
+(every diagnostic). The reasoning under the front end is
+[`compiler/src/CODE-LOGIC.md`](../../compiler/src/CODE-LOGIC.md).
+
+Read this as the answer to "what can I write?" — the last section is the
+matching answer to "what will the compiler refuse?", which is just as
+much part of the surface.
+
+Every form listed below was compiled and run against `woc`/`wovm` while
+writing this page, not read off the parser and hoped for — with the one
+exception §6 calls out by name (`group … by … into` parses and is then
+refused).
+
+---
+
+## 1. Lexical
+
+| thing | form | notes |
+| --- | --- | --- |
+| comment | `-- to end of line` | the only comment form; no block comment |
+| identifier | `[A-Za-z_][A-Za-z0-9_-]*` | **internal dashes are legal** — `a-b` is ONE identifier, so binary minus after an identifier needs spaces (`a - b`) |
+| integer | `42`, `0xFF`, `0b1011`, `1_000_000` | `_` only BETWEEN digits; hex/binary accumulate in 63-bit OCaml int, so a full-width `0xFFFF…FFFF` is out of reach (`-1` spells all-ones) |
+| float | `1.5`, `2e9`, `1.0e-3` | a bare digit run stays `Int`; only a fraction or exponent makes a `Float` |
+| text | `"..."` or `'...'` | escapes `\n \t \r \0 \\ \" \'`; anything else after `\` is that literal character. A raw newline inside is **WO-E005** |
+| interpolation | `"${expr}"` | desugars at parse time to a `..` chain; `\$` is a literal `$`, and a lone `$` not followed by `{` is literal |
+| raw text literal | `` `...` `` | iteration 37 — content verbatim (NO escape processing), newlines are content, common source margin removed at compile time. Holes: `${e}` raw, `{{ e }}` HTML-escaped |
+| booleans / nil | `true`, `false`, `nil` | |
+| newline | significant | terminates a statement (or `;`). A line ending in `..` continues on the next — the one newline suppression |
+| build flags | `#if name` / `#else` / `#end` | token-level filter, flag NAMES only (no expressions); nesting allowed; set with `woc -D name` |
+
+**Keywords** (37): `type class interface fn let mut take return if else
+while for in true false use spawn using pub break continue do const and
+or not inline switch case default typedef try catch nil as INSERT
+SELECT`.
+
+Deliberately NOT keywords, so they lex as ordinary identifiers: `self`,
+`me`, `subscribe`, `receive`, lowercase `insert`/`select`, and every
+query clause word (`from`, `where`, `group`, `by`, `into`, `order`,
+`desc`, `take`, `select`) plus every type constructor word (`ref`,
+`multi`, `map`, `backlink`, `actor`).
+
+## 2. File and module level
+
+A directory is a module; `pub` is the export line. A file may contain,
+in any order:
+
+| declaration | form |
+| --- | --- |
+| import | `use fs` (reserved stdlib namespace) or `use shared/util` (project-relative path) |
+| import + extension methods | `using shared/textutil` — the module's `pub` free fns whose first parameter matches a receiver become callable as methods on it (compile-time rewrite) |
+| class | `[pub] class Name { fields, methods, consts }` |
+| plain type | `[pub] type Name { ... }` — identical field grammar to `class`; methods parse for real in both |
+| structural record | `typedef Name = { field: T, ... }` — fields only, and two records of the same SHAPE are the same type |
+| tagged union | `type Name = A \| B \| C(x: Int, ...)` — bare variants lower to integer tags, payload variants to records. Construction is call-style and POSITIONAL: `C(1, 2)`, never `C { x: 1 }` |
+| interface | `[pub] interface Name { fn sig(...) -> T }` — signatures only, no fields, no bodies. Satisfaction is STRUCTURAL |
+| free function | `[pub] fn name(params) -> T { ... }` |
+| constant | `const NAME = <literal>` — substituted by the parser before typecheck; a local of the same name shadows it |
+
+The program entry is the free `fn main`, zero-argument or `fn
+main(args: multi Text) -> Int`.
+
+### Annotations
+
+| annotation | where | effect |
+| --- | --- | --- |
+| `@table(name: "…", index: [a], index: [b, c])` | on a `class`/`type` | the class IS a WAL-backed table |
+| `@unique` | on a field | uniqueness constraint |
+| `@gc` | on a class | **rejected** — GC-ness is inferred, never declared |
+
+Unknown annotation names parse and are ignored; argument lists on field
+annotations are consumed and discarded.
+
+## 3. Types
+
+| kind | spelling |
+| --- | --- |
+| scalars | `Int`, `Float`, `Bool`, `Text`, `Bytes`, `Timestamp`, `Id` |
+| nullable | `?T` — legal on any of the above and on heap shapes |
+| list | `multi T` |
+| map | `map<K, V>` |
+| row reference | `ref C` |
+| reverse relation | `backlink C.field` — the computed inverse of a `ref` |
+| actor address | `actor M` — M is the message type, inferred from the class's `receive` |
+| declared types | any `class` / `type` / `typedef` / union name |
+| stdlib types | `json.Value`, `net.Conn` |
+| predeclared records | `Stat`, `TimeParts`, `Proc`, `Error` — no source declares them; field ORDER is the contract with the C runtime |
+
+### Fields and parameters
+
+- Field: `name: T`, optionally `= <default>` and/or `@ann`.
+- `pub(read) name: T` — readable outside the declaring class, writable
+  only inside it.
+- Parameter conventions: **borrow is the default**; `mut x: T` for a
+  mutable borrow, `take x: T` to move ownership in. These apply to
+  NAMED parameters only.
+- **`self` is implicit** — never written in the parameter list, and
+  always writable inside its own class's methods (`self.total += 1`
+  needs no annotation). `self` is an ordinary identifier, not a keyword.
+- Methods may be `static fn`; class-level constants may be `static
+  const` or bare `const`.
+
+## 4. Statements
+
+| statement | form |
+| --- | --- |
+| binding | `let x = e`, `let x: T = e` |
+| assignment | `x = e`, `obj.f = e`, `m[k] = e` |
+| compound assignment | `x += e`, `-=`, `*=`, `/=`, `%=` — parse-time sugar for the written-out form (there are no bitwise compound assigns) |
+| conditional | `if c { } else if c { } else { }` |
+| while | `while c { }` |
+| do-while | `do { } while c` — body always runs once |
+| for | `for x in <multi \| query>`, `for k, v in <map>` |
+| loop control | `break`, `continue` — owned values alive in the body are dropped at the jump site |
+| return | `return` / `return e` |
+| database write | `insert C { f: v, ... }`, `delete e` |
+| expression | any expression in statement position |
+
+## 5. Expressions
+
+| form | spelling |
+| --- | --- |
+| literals | int, float, text, raw text, bool, `nil` |
+| container literals | `[]`, `[a, b, c]` (a `multi`), `{}` (an empty `map`) — a fresh container needs a destination of declared type |
+| constructor | `C { field: v, ... }` |
+| access | `x.f`, `c[i]` (a `multi` — out of range traps), `m[k]` (a `map` — a missing key is **nil**) |
+| call | `f(a, b)`, `x.m(a)`, `mod.member(a)` |
+| unary | `-e`, `not e` |
+| binary | see the ladder below |
+| checked conversion | `e as T` — its ONE meaning is decoding JSON text, yielding `?T`. There is no reinterpret cast |
+| actor spawn | `spawn C { fields }` → an `actor M` address |
+| trapping guard | `try <expr> catch (e) <expr-or-block>` — an EXPRESSION; `e` binds the `Error` record `{ code, line, method, msg }` |
+| multi-way choice | `switch e { case A: ...; default: ...; }` — an expression. Arms match VALUES; `case a, b:` fires for either. A union payload binds positionally: `case Rect(w, h): w * h`. `default` is required UNLESS the subject is a union whose variants are all covered |
+| query | `from … select …`, see below |
+| interpolation | inside `"…"` and `` `…` `` |
+
+### Operator precedence, loosest to tightest
+
+1. `or`
+2. `and`
+3. comparison — `== != < <= > >=`
+4. concatenation — `..`
+5. additive — `+ -` **and `|` `^`**
+6. multiplicative — `* / %` **and `&` `<<` `>>`**
+7. unary — `-`, `not`
+8. `as` conversion — binds to a postfix expression, so tighter than unary
+9. postfix — call, index, field
+
+Bitwise operators do not get their own tiers: `|`/`^` ride the additive
+rung and `&`/`<<`/`>>` the multiplicative one (Go's arrangement). They
+are Int-only on BOTH sides — there is no Float twin — and a literal
+shift count outside `0..63` is a compile error.
+
+`+` is arithmetic ONLY, never string addition. `and`/`or` are
+short-circuit, `Bool`-typed operands only — there is no truthiness, and
+no `&&`/`||`/`!`/`~` anywhere in the language.
+
+## 6. Queries (language-integrated, never SQL text)
+
+```
+from <var> in <source>
+  where <expr>            -- zero or more
+  group <expr> by <key> into <gvar>    -- PARSES, THEN REFUSED (see below)
+  order by <expr> [desc]
+  take <expr>
+  select <expr>
+```
+
+The source is either a table class (`from p in Product`) or a
+navigation (`from s in dept.staff` — a `backlink` or a `multi`). Present
+today: **from / where / order / take / select**. A query is an
+expression and is also what `for x in <query>` iterates.
+
+`group … by … into` is the one clause above that is grammar without
+semantics: the parser accepts it (`parser.ml`) and the typechecker then
+rejects it with WO-E250 — "group-by aggregation is not supported yet",
+or "group-by on a navigation query is not supported yet" for the
+navigation form (`types.ml`). It is listed because the syntax is
+settled, not because it runs. Joins are not in the slice at all.
+
+## 7. Concurrency
+
+- `spawn C { fields }` constructs the actor's state (fields MOVE in) and
+  starts it; the value is an `actor M` address.
+- `send(addr, msg)` — fire and forget; the message MOVES to the runtime.
+- `call(addr, msg) -> R` — a send that parks the calling fiber until the
+  receive returns. Every `receive` program-wide must agree on `R`, and
+  `R` must be a copyable scalar. A dead callee traps, never hangs.
+- A class becomes an actor by declaring `fn receive(msg: M)` — `receive`
+  is an ordinary identifier, not a keyword.
+- Blocking stdlib calls park the fiber. There is no `async`, no `await`,
+  and no user-visible thread.
+
+## 8. Builtins and the stdlib
+
+**Free builtins** (a user-declared `fn` of the same name always wins):
+`print`, `print_err`, `print_int`, `now`, `words`, `len`, `count`,
+`byte_at`, `char_of`, `substr`, `trim`, `to_lower`, `starts_with`,
+`ends_with`, `index_of`, `last_index_of`, `split`, `split_ws`, `join`,
+`parse_int`, `int_to_text`, `multi_new`, `map_new`, `push`, `get`,
+`set`, `has`, `remove`, `latest`, `pop`, `shift`, `slice`, `sort`,
+`reverse`, `key_at`, `val_at`, `send`, `call`, `sha1`, `sha256`,
+`hmac_sha256`, and the Float/Bytes bridges `float`, `trunc`,
+`parse_float`, `float_to_text`, `float_cmp`, `bytes_len`, `bytes_at`,
+`bytes_slice`, `bytes_eq`, `bytes_concat`, `bytes_of_text`,
+`text_of_bytes`, `base64_encode`, `base64_decode`.
+
+**Reserved module namespaces**, each resolving to builtins:
+
+| module | covers |
+| --- | --- |
+| `fs` | `exists`, `list`, `stat`, `read_all`, `read_at`, `append` |
+| `time` | `now`, `sleep`, `local`, `iso`, `ticks` |
+| `env` | `get`, `stopping` (the SIGTERM/SIGINT latch) |
+| `net` | `listen`, `listen_unix`, `accept`, `accept_dl`, `read`, `read_dl`, `write`, `write_dl`, `peer`, `close` |
+| `proc` | `run` |
+| `json` | `encode`, `decode` (paired with `as T`) |
+
+A failing syscall traps `IO` with errno's message; **absence is never a
+trap** — a missing path or an unset variable is nil.
+
+## 9. What the language deliberately does NOT have
+
+This list is doctrine, not a backlog. Each was considered and rejected.
+
+- **Closures and function values.** Capture is a field on a class. This
+  is why there is no dependency injection and no callback API anywhere.
+- **`&&`, `||`, `!`, `~`.** Word operators only (`and`, `or`, `not`);
+  complement is `-1 ^ x`.
+- **Inheritance.** Interfaces are structural; there is no `extends`.
+- **`inline fn`.** The keyword exists solely to produce a clear
+  rejection — optimization is the compiler's job.
+- **A reinterpret cast.** `as` decodes JSON and nothing else.
+- **Varargs, and generics beyond the built-in containers.**
+- **Truthiness.** A condition must be `Bool`.
+- **A block comment, and a `{{`/`${`/backtick escape inside a raw
+  literal.** Those three are written by concatenating an ordinary
+  `"..."` string with `..` — one greppable door.
+- **`async`/`await`.** Fibers park; the shard runs someone else.
+- **A runtime template engine.** Markup is a compile-time literal or it
+  does not exist.
+- **Non-empty map literals** (`{ k: v }` in expression position) —
+  indistinguishable from a constructor literal without lookahead nothing
+  else needs.
+- **A full-width 64-bit integer literal**, and **joins in queries** —
+  both real limits rather than doctrine.
diff --git a/docs/guides/releasing.md b/docs/guides/releasing.md
new file mode 100644
index 0000000..82a0e48
--- /dev/null
+++ b/docs/guides/releasing.md
@@ -0,0 +1,410 @@
+# Cutting a release — building the tarball and publishing it on GitHub
+
+The `/install` page on writeonce.de links a GitHub release asset by an
+exact URL. Publishing is therefore not "upload a file somewhere": the
+**asset filename has to match what the site links**, or the download
+button 404s. This runbook keeps the two in step.
+
+The URL the site links today:
+
+```
+https://github.com/shoneyj/writeonce/releases/download/v0.1.0/writeonce-0.1.0-linux-amd64.tar.gz
+```
+
+which decomposes as `<repo>/releases/download/<tag>/<asset-name>`. So the
+tag must be `v0.1.0` and the asset must be named exactly
+`writeonce-0.1.0-linux-amd64.tar.gz` — which is what `just dist` already
+produces.
+
+## Two routes
+
+**Automated (preferred).** `.github/workflows/release.yml` builds,
+verifies and publishes on a `v*` tag push. It needs no `gh auth login`
+and no secret: GitHub injects a per-job `GITHUB_TOKEN`, and the single
+line `permissions: contents: write` is what lets that token create a
+release. The token expires when the job ends, so there is nothing to
+rotate or leak. Skip to *Releasing from the pipeline* below.
+
+**Manual.** Everything from §0 onward — the path for a first release, or
+when the pipeline is broken and you need to ship anyway.
+
+## Making the pipeline ready (first time only)
+
+It does **not** build on your machine, and pushing to `master` does not
+release anything. The job runs on a GitHub-hosted runner, and only a
+`v*` TAG push starts it. Ordinary commits, PRs and branch pushes are
+ignored by this workflow.
+
+```
+ 1  Get the workflow onto GitHub — Actions only sees files in the repo.
+      git checkout master
+      git merge site-homepage          # or open a PR and merge it
+      git push origin master
+
+ 2  Repo -> Actions tab. If it offers to enable workflows, enable them.
+
+ 3  Repo -> Settings -> Actions -> General -> "Allow actions":
+      must permit actions/checkout and ocaml/setup-ocaml.
+      On "Allow select actions", add:  ocaml/setup-ocaml@*
+
+ 4  Same page -> "Workflow permissions". The workflow asks for
+    contents: write explicitly, which is normally enough. If the
+    publish step later fails with 403, come back and select
+    "Read and write permissions".
+
+ 5  REHEARSE with a dry run — no tag, no publish, no cleanup.
+    Actions tab -> "release" -> "Run workflow" -> master.
+    A workflow_dispatch run skips the tag guard and the publish step,
+    so it builds, verifies, smoke-tests the extracted tarball and
+    reports the glibc floor, and stops there.
+
+ 6  (nothing to undo — a dry run creates no tag and no release)
+
+ 7  Watch it: the Actions tab, or `gh run watch` once gh is
+    authenticated.
+
+ 8  Read the "Report the glibc floor" step. It prints what the
+    RUNNER-built binaries actually require. Expect 2.35-ish from
+    ubuntu-22.04, versus 2.38 from this dev machine.
+
+ 9  Update docs/examples/site/install/view.wo's supported-systems list
+    to whatever step 8 printed, and the distros that follow from it.
+    Publishing binaries whose floor differs from the page is the one
+    failure a user cannot debug.
+
+10  Ship for real:
+      git tag -a v0.1.0 -m "writeonce 0.1.0"
+      git push origin v0.1.0
+
+11  Verify the link a stranger clicks (should print 200):
+      curl -sIL -o /dev/null -w '%{http_code}\n' \
+        https://github.com/shoneyj/writeonce/releases/download/v0.1.0/writeonce-0.1.0-linux-amd64.tar.gz
+
+12  Refresh the site's mirror from $WO_DIST (section 7 below).
+```
+
+There is no rehearsal to clean up and no draft flag to remove: a
+`workflow_dispatch` run creates neither a tag nor a release, and
+`gh release create` in the workflow publishes directly — the file has never
+carried `--draft`. If you *want* a draft first, add `--draft` to that step
+yourself and remember to remove it again.
+
+Known first-run risks, in the order they are likely to bite:
+`ocaml/setup-ocaml@v3` resolving OCaml 4.14 on the 22.04 image; the
+`objdump` in the glibc-floor step needing `binutils` (present on GitHub
+runners, absent in slim containers); and a 403 on publish, which is
+step 4.
+
+## What the hosted runner costs
+
+**Public repository: nothing.** Standard GitHub-hosted runners are free
+with unlimited minutes on public repos. Only *larger* runners (4-core
+and up) are billed there, and this workflow does not ask for one.
+
+**Private repository:** each plan includes monthly minutes — 2,000 on
+Free, 3,000 on Pro and Team, 50,000 on Enterprise Cloud — then bills
+per minute. Linux counts ×1, Windows ×2, macOS ×10, so staying on Linux
+is also the cheap choice. Each *job* is rounded up to the next minute.
+
+This job is small either way. A cold `scripts/mkdist.sh` measured 3.4s
+on a 20-core workstation; on a 2-core runner call it well under a
+minute. The real cost is `ocaml/setup-ocaml`, which is minutes cold and
+under one when its opam cache hits — so budget roughly 3–10 minutes per
+release, and it only ever runs on a tag. Ten releases a month is a
+couple of percent of the smallest free allowance.
+
+Release assets do **not** count against Actions artifact storage; they
+live with the release. (Rates and allowances change — check the current
+billing page before making a decision that depends on them.)
+
+## Why the release job is NOT on a self-hosted runner
+
+A self-hosted runner would work — it needs no inbound ports, polls
+GitHub over outbound HTTPS, and honours `HTTPS_PROXY`/`NO_PROXY`, so a
+box behind a proxy is fine. Two reasons not to use one for THIS job:
+
+**It defeats the point of pinning the runner.** The release binaries
+link glibc dynamically, so the build host sets the floor every user
+must clear. `ubuntu-22.04` was chosen to keep that floor near 2.35. A
+runner on a developer machine (glibc 2.39 here) puts it back at 2.38+
+and silently drops Ubuntu 22.04, Debian 12 and RHEL 9 — the exact
+regression the pinned image prevents. If a self-hosted runner is
+unavoidable, build inside a container pinned to the oldest glibc you
+intend to support, not on the host.
+
+**A release built on a workstation is unattested.** "It built on my
+machine" is what a pipeline exists to stop being true.
+
+### If you do self-host, what you are accepting
+
+A runner executes workflow code **as the user that started it**, with
+that user's filesystem and network reach. On a personal workstation
+that means `~/.ssh`, `~/.config/gh`, cloud and cluster credentials,
+browser profiles, and every host reachable from it — including LAN
+services and anything named in `~/.ssh/config`, which on a work laptop
+is usually production. A job does not need to be malicious to leak;
+it needs to be careless once.
+
+The risk is highest on a **public** repository, where a pull request
+from a stranger can run arbitrary code on the runner. GitHub's own
+guidance is not to use self-hosted runners with public repositories.
+On a private repository the blast radius is smaller but not zero:
+anyone with write access, or one compromised token, reaches the same
+shell.
+
+If it is still the right call, make it boring:
+
+- a dedicated VM or container, never a workstation, on a network
+  segment that cannot reach production;
+- a separate unprivileged user with no SSH keys, no cloud config, and
+  no credentials of its own;
+- `--ephemeral` registration so each job gets a clean runner and a
+  poisoned toolchain cannot outlive one build;
+- `.credentials` under the runner's home is a long-lived credential to
+  act as that runner — treat the box as holding a secret;
+- restrict egress if the workload allows; the same outbound HTTPS the
+  runner needs is what exfiltration would use.
+
+A reasonable split: self-hosted for tests that need private-network
+access or unusual hardware, GitHub-hosted for the release artifact.
+
+## Releasing from the pipeline
+
+```
+git tag -a v0.1.0 -m "writeonce 0.1.0"
+git push origin v0.1.0
+```
+
+That is the whole release. The workflow then, in order: checks the tag
+matches `VERSION`, builds via `scripts/mkdist.sh`, asserts the produced
+filename is the one `/install` links, verifies the `.sha256`, extracts
+the tarball and builds a hello project **with the binaries inside it**,
+prints the glibc floor of what is about to ship, and publishes both
+files with `gh release create`.
+
+Two things about that file are deliberate:
+
+- **`runs-on: ubuntu-22.04`, not `ubuntu-latest`.** The binaries link
+  glibc dynamically, so the build host's glibc caps the symbol versions
+  they can import — and that cap becomes the minimum glibc every user
+  needs. On 24.04 (glibc 2.39) the floor is 2.39; on 22.04 (2.35) it is
+  2.35. That is the difference between excluding and including Ubuntu
+  22.04, Debian 12 and RHEL 9. Changing the image changes who can run
+  the release, so change `install/view.wo`'s supported-systems list in
+  the same commit.
+- **It fails rather than publishes** when the tag, `VERSION` and the
+  asset name disagree, because those three are what the download URL on
+  `/install` is built from.
+
+### Other CI (GitLab, Jenkins, Buildkite)
+
+No `gh auth login` there either — `gh` reads a token from the
+environment:
+
+```
+GH_TOKEN=$MY_SECRET gh release create v0.1.0 dist/*.tar.gz dist/*.sha256
+```
+
+The secret is a PAT with `repo` scope (classic) or **Contents: read and
+write** (fine-grained). Outside GitHub it is a long-lived credential you
+own and must rotate — which is exactly the cost `GITHUB_TOKEN` avoids,
+and the reason to prefer Actions for this one job even if the rest of
+your CI lives elsewhere.
+
+## 0. Authenticate `gh` (manual route only)
+
+`gh` keeps its own credential, separate from git's. SSH keys let you
+`git push`; they do **not** let `gh` call the API, so a machine that
+pushes fine can still fail to create a release.
+
+Check first — if this names your account, skip the rest of this section:
+
+```
+gh auth status
+```
+
+### The interactive flow (what to pick)
+
+```
+gh auth login
+```
+
+It asks five things:
+
+| prompt | answer |
+| --- | --- |
+| What account do you want to log into? | **GitHub.com** |
+| Preferred protocol for Git operations? | **SSH** — this repo's remote is already `git@github.com:shoneyJ/writeonce.git`, and answering HTTPS here rewrites how git talks to GitHub for every repo on the host |
+| Upload your SSH public key? | pick `~/.ssh/id_ed25519.pub`, or **Skip** if that key is already on your account |
+| How would you like to authenticate? | **Login with a web browser** |
+| One-time code | gh prints something like `ABCD-1234`; press Enter, paste it at <https://github.com/login/device>, authorise |
+
+The token lands in the system credential store, or in a plain file if
+there is no store (`gh auth status` prints the location; `--insecure-storage`
+forces the file). `-w`/`--web` skips straight to the browser step.
+
+**In a Claude Code session, prefix it with `!`** — `! gh auth login` — so
+the prompts are yours to answer and the output lands in the conversation.
+An agent cannot complete a device flow on your behalf.
+
+### No browser on that machine (server, container, CI)
+
+Create a personal access token at <https://github.com/settings/tokens>.
+Classic tokens need the scopes `repo`, `read:org` and `gist`;
+a fine-grained token needs **Contents: read and write** on the repo,
+which is what release assets are written through. Then:
+
+```
+printf '%s' "$TOKEN" | gh auth login --with-token
+```
+
+Read it from a `chmod 600` file rather than typing it inline — an
+argument on the command line lands in shell history and in `ps`. For
+automation, skip login entirely and export `GH_TOKEN`; gh picks it up and
+stores nothing.
+
+### Verify before you rely on it
+
+```
+gh auth status
+gh repo view shoneyJ/writeonce --json name,visibility
+```
+
+The second call is the real check: it proves the token can reach *this*
+repo, which a valid-but-wrong-account token would not.
+
+## 1. Before you build
+
+Check the tree is clean and the version is what you mean to ship —
+`VERSION` is the single source, and `mkdist.sh` refuses to build if
+`woc version` or `wovm --version` disagree with it:
+
+```
+git status --porcelain     # expect empty
+cat VERSION                # e.g. 0.1.0
+```
+
+## 2. Build the artifact
+
+```
+just dist
+```
+
+That builds both release binaries, runs the version drift guard, and
+writes two files:
+
+```
+dist/writeonce-<ver>-linux-amd64.tar.gz
+dist/writeonce-<ver>-linux-amd64.tar.gz.sha256
+```
+
+## 3. Verify it before anyone else can
+
+Two checks, both cheap, both worth it. First the digest:
+
+```
+cd dist && sha256sum -c writeonce-0.1.0-linux-amd64.tar.gz.sha256 && cd ..
+```
+
+Then prove the tarball actually works, using the binaries INSIDE it —
+not the ones in your build tree:
+
+```
+tmp=$(mktemp -d)
+tar -C "$tmp" -xzf dist/writeonce-0.1.0-linux-amd64.tar.gz
+export PATH="$tmp/writeonce/bin:$PATH"
+woc version && wovm --version
+
+mkdir -p "$tmp/hello" && cd "$tmp/hello"
+printf 'name    = "hello"\nversion = "0.1.0"\n\n[runtime]\nwo = ">= 0.1"\n' > wo.toml
+printf 'fn main() -> Int {\n  print("hello, writeonce");\n  return 0;\n}\n' > main.wo
+woc . && ./target/hello
+```
+
+If that prints `hello, writeonce`, the release is sound.
+
+## 4. Tag the commit
+
+The tag is what the download URL points at, so tag the exact commit the
+binaries were built from:
+
+```
+git tag -a v0.1.0 -m "writeonce 0.1.0"
+git push origin v0.1.0
+```
+
+## 5. Publish and upload
+
+One command creates the release and attaches both files:
+
+```
+gh release create v0.1.0 \
+  dist/writeonce-0.1.0-linux-amd64.tar.gz \
+  dist/writeonce-0.1.0-linux-amd64.tar.gz.sha256 \
+  --title "writeonce 0.1.0" \
+  --notes-file - <<'EOF'
+Linux x86-64, glibc 2.38 or newer. Two binaries — `woc` and `wovm` —
+depending only on the system C library.
+
+    rm -rf /usr/local/writeonce
+    tar -C /usr/local -xzf writeonce-0.1.0-linux-amd64.tar.gz
+    export PATH=$PATH:/usr/local/writeonce/bin
+
+Verify with the published `.sha256` before extracting.
+EOF
+```
+
+Add `--draft` to stage it without publishing, or `--prerelease` to mark
+it as one. If the release already exists and you only need to attach (or
+replace) files:
+
+```
+gh release upload v0.1.0 dist/writeonce-0.1.0-linux-amd64.tar.gz --clobber
+```
+
+Without `gh`, the same thing through the web UI: the repo's **Releases**
+page → *Draft a new release* → choose tag `v0.1.0` → drag both files
+into the attachment box → *Publish release*. Uploading by hand is where
+the filename usually drifts, so paste it rather than retyping it.
+
+## 6. Check the link the site actually uses
+
+```
+curl -sIL -o /dev/null -w '%{http_code} %{url_effective}\n' \
+  https://github.com/shoneyj/writeonce/releases/download/v0.1.0/writeonce-0.1.0-linux-amd64.tar.gz
+```
+
+A `200` means `/install`'s download button works for a stranger. Anything
+else means the tag, the asset name, or the repo path disagrees with the
+link in `docs/examples/site/install/view.wo`.
+
+## 7. Refresh the site's mirror
+
+`/install` offers this site as a mirror beside the GitHub link, served by
+the framework's `StaticFiles` out of `$WO_DIST` (default `./dist`). Copy
+the same two files there so the mirror is not stale:
+
+```
+scp dist/writeonce-0.1.0-linux-amd64.tar.gz* user@host:/srv/writeonce/dist/
+```
+
+Both copies are the same bytes, and the published `.sha256` covers
+either one — that is the point of shipping the digest beside the
+archive.
+
+## Notes
+
+- **`dist/` is gitignored** (`.gitignore:103`). The tarball is a build
+  artifact; the release is where it lives, not the repository.
+- **Repo path case.** The git remote is `shoneyJ/writeonce` while the
+  site links `shoneyj/writeonce`. GitHub paths are case-insensitive and
+  redirect, so both resolve — but keep them consistent when either
+  changes.
+- **Bumping the version** means editing `VERSION`, rebuilding, and
+  updating every place the site names the current release:
+  `docs/examples/site/install/view.wo` (the download links, the tar
+  command, and the `.sha256` link). The version appears there as literal
+  text, so grep for the old number before you publish.
+- **One target today.** `mkdist.sh` builds `linux-amd64` only; a cross
+  matrix is future work. Do not add architectures to the release notes
+  that no build produces.
diff --git a/docs/plan/compiler/architecture.md b/docs/plan/compiler/architecture.md
index c616774..0fc5ee1 100644
--- a/docs/plan/compiler/architecture.md
+++ b/docs/plan/compiler/architecture.md
@@ -154,10 +154,10 @@ Deliberately excluded: `.dev/reference/colibri`, `.dev/reference/llama-cpp`,
 ## 7. Governing docs
 
 - Spec: [`docs/superpowers/specs/2026-08-01-oop-compiler-vm-design.md`](../../superpowers/specs/2026-08-01-oop-compiler-vm-design.md)
-- Plan 2 — compiler front: [`2026-08-01-woc-compiler-front.md`](./2026-08-01-woc-compiler-front.md)
-- Plan 3 — emit + e2e + single binary: [`2026-08-01-wob-emit-e2e-single-binary.md`](./2026-08-01-wob-emit-e2e-single-binary.md)
-- Plan 8 — Haxe-parity language surface: [`2026-08-01-haxe-parity-language.md`](./2026-08-01-haxe-parity-language.md)
-- Format contract: [`docs/plan/oop-vm/00-wob-format.md`](../../plan/oop-vm/00-wob-format.md)
+- Plan 2 — compiler front: [`2026-08-01-woc-compiler-front.md`](2026-08-01-woc-compiler-front.md)
+- Plan 3 — emit + e2e + single binary: [`2026-08-01-wob-emit-e2e-single-binary.md`](2026-08-01-wob-emit-e2e-single-binary.md)
+- Plan 8 — Haxe-parity language surface: [`2026-08-01-haxe-parity-language.md`](2026-08-01-haxe-parity-language.md)
+- Format contract: [`docs/plan/oop-vm/00-wob-format.md`](../oop-vm/00-wob-format.md)
 - VM counterpart (shipped): [`docs/superpowers/plans/2026-08-01-wob-format-and-vm-core.md`](../../superpowers/plans/2026-08-01-wob-format-and-vm-core.md)
 
 > **Docs-location note:** compiler plan documents live here in
diff --git a/docs/plan/discarded.md b/docs/plan/discarded.md
index 90765a7..1b9e83a 100644
--- a/docs/plan/discarded.md
+++ b/docs/plan/discarded.md
@@ -52,7 +52,36 @@ Status board: [`00-status.md`](../stories/00-status.md) · Doctrine: [`../00-pri
 | **Per-example `principle.md` files** | 2026-08-08: one canonical repo-level [`docs/00-principles.md`](../00-principles.md) instead; examples link to it. |
 | **Minimal 3-file log-watcher sample** | Breaks the file-for-file `.hx` → `.wo` mapping and leaves the "could not express" column unproven — which is the sample's entire acceptance criterion. |
 | **Raw code in plan documents** | Plans carry concept, reason, and required behavior in words; the executor writes the code. |
-| **`##ui` / `.htmlx` LiveView frontend track** | 2026-08-17: removed the 9-doc `exploration/ui/` design set, the `14-mvc-ui-implementation` plan, and the `ui-htmlx-live` plan. All were built on the non-advancing Rust runtime (`.dev/reference/crates/wo-htmlx`, `cargo run`, WebSocket live-patches) and contradict the current woc/wovm direction. The 13d pricing-UI row went with them. Revisit only if a UI story is re-opened on the woc/wovm stack. |
+| **`##ui` / `.htmlx` LiveView frontend track** | 2026-08-17: removed the 9-doc `exploration/ui/` design set, the `14-mvc-ui-implementation` plan, and the `ui-htmlx-live` plan. All were built on the non-advancing Rust runtime (`.dev/reference/crates/writeonce-viewx`, `cargo run`, WebSocket live-patches) and contradict the current woc/wovm direction. The 13d pricing-UI row went with them. Revisit only if a UI story is re-opened on the woc/wovm stack. |
 | **Old-runtime "front door" + v1 design docs** | 2026-08-17: removed `writeonce-pl.md`, `runtime/wo-language.md`, `future-scope/ai-agents-content-management.md`, the numbered v1 set `02-recovery`/`03-data`/`04-ui`/`05-datalayer`/`06-markdown-render`/`07-ssl`, and `runtime/database/05-go-sdk.md`. They pitched the old Rust `wo` runtime (REST + LiveView + SQL/Cypher) as the current language and contradicted the shipped woc/wovm toolchain. |
 | **The 2026-08-01 shard-actor plan (epoll-based)** | 2026-08-21: [`superpowers/plans/2026-08-01-shard-actor-vm-runtime.md`](../superpowers/plans/2026-08-01-shard-actor-vm-runtime.md) marked discarded, file kept as reference. Superseded by the arc plan of record ([`2026-08-20-shard-fiber-arc.md`](../superpowers/plans/2026-08-20-shard-fiber-arc.md), stages 1+2 landed): io_uring is a MUST and the epoll-based approach is discarded — the old plan's "epoll now / io_uring later" premise is inverted, and its substrate (`runtime/wo-rt.c`) left with the Rust track 2026-08-18. |
 | **The entire Rust `wo` runtime track** | 2026-08-18: removed `crates/` (the Stage-2 Rust runtime), `Cargo.toml`/`Cargo.lock`, `prototypes/` (wo-rt-c stale duplicate + wo-db C++ ref), the `rt-c-*` justfile recipes, the Rust engineering plans (`docs/plan/05..16`, `docs/plan/done/`), and `docs/runtime/` (the old runtime overview + 7-phase DB design series + async/fibers/gc/surreal essays). It was the prior, abandoned architecture — fully independent of the woc/wovm stack. Master now reflects only the current single-language project; the removed track lives in git history if ever needed as reference. Kept: the syscall/postgres/assembly/c-runtime **exploration studies** (they fed the current C runtime) and the discarded/learnings registers. |
+
+### Successor map for the removed Rust-era plan paths
+
+Added 2026-08-26. The exploration studies under
+[`exploration/`](exploration/linux/00-linux.md) were written against the old
+flat `docs/plan/NN-*.md` numbering and the `docs/runtime/database/` tree, both
+removed with the Rust track above. Those 48 dangling links were **de-linked, not
+re-pointed** — their prose names the retired plan by number ("plan 09a", "plan
+11"), so aiming them at a story would have made the sentence lie. The studies
+still read correctly; the names are now plain text. This table is where a reader
+goes to find what took each one's place.
+
+| Retired path | What carries that work now |
+| --- | --- |
+| `09-concurrency-scaleout.md` | [`08-shard-actor-runtime.md`](../stories/language-runtime-database/08-shard-actor-runtime.md) + [`11-fibers.md`](../stories/language-runtime-database/11-fibers.md) — the arc, landed 2026-08-21 |
+| `10-storage-foundations.md`, `11-wal-and-recovery.md` | [`09-database-engine.md`](../stories/language-runtime-database/09-database-engine.md) (typed WAL + replay) and [`22-durability-throughput-scale.md`](../stories/language-runtime-database/22-durability-throughput-scale.md) (the measurements) |
+| `12-engine-disk-cutover.md` | Nothing — RAM stays authoritative by doctrine (principle 7). The disk story is the WAL; reclamation is [`databasev2 3, WAL checkpoint`](../stories/databasev2/03-wal-checkpoint.md) |
+| `13-class-model-live-pricing.md` | [`09b-table-relations-query.md`](../stories/language-runtime-database/09b-table-relations-query.md) — `@table`, `ref`/`backlink`, the compiler-checked query surface |
+| `07-inotify-content-watcher.md` | [`07-logwatcher-proof.md`](../stories/language-runtime-database/07-logwatcher-proof.md) — the log-watcher sample polls via `fs.stat`; inotify was never surfaced as a builtin |
+| `08-sendfile-static-assets.md` | Nothing. `sendfile` is not exposed; static assets are served as `Text` through `net.write` |
+| `15-mcp-streamable-http.md` | [`28-skillhost-host-workload.md`](../stories/language-runtime-database/28-skillhost-host-workload.md) — MCP transport is that story's Blocker B |
+| `16-postgres-mirror.md` | Nothing — the mirror-is-backup doctrine holds, but no iteration owns it and there are no outbound sockets to reach a mirror with ([`refine/38`](../stories/language-runtime-database/38-content-platform-capabilities.md)) |
+| `02-event-loop-epoll.md`, `03-hand-rolled-http.md` | `runtime/src/park.c` (io_uring with an epoll fallback) and the `.wo` framework `porch` |
+| `04-cutover-remove-tokio-axum.md` | Completed by the Rust-track removal itself — nothing left to cut over |
+| `runtime/database/03-inmemory-engine.md` | [`database/src/CODE-LOGIC.md`](../../database/src/CODE-LOGIC.md) + [`plan/oop-vm/04-db-binding.md`](oop-vm/04-db-binding.md) |
+| `runtime/database/02-wo-language.md` | [`docs/guides/language-surface.md`](../guides/language-surface.md) |
+| `runtime/database/07-wo-seg-migration.md` | Nothing — segment migration was a Rust-engine concept with no analogue here |
+| `prototypes/wo-db/` (C++ query-layer ref) | Removed with the Rust track. The query layer lives in `compiler/src/emit.ml`, lowered to engine builtins |
+| `exploration/linux/07-splice.md` | Never written. Slot 07 is `07-io_uring.md` |
diff --git a/docs/plan/exploration/assembly/00-overview.md b/docs/plan/exploration/assembly/00-overview.md
index c6aed04..d214d8e 100644
--- a/docs/plan/exploration/assembly/00-overview.md
+++ b/docs/plan/exploration/assembly/00-overview.md
@@ -16,7 +16,7 @@ The biggest category. The language's calling convention — how arguments are pa
 
 Atomics, memory barriers, and some hardware-accelerated primitives need specific instruction sequences. A compiler that sees `a = *b` can't know whether you wanted a relaxed load or an acquire fence without annotation — and the *right* instruction on x86 vs ARM vs RISC-V is different.
 
-**Atomic CAS / load-acquire / store-release.** On x86 it's `LOCK CMPXCHG`; on ARM it's `LDXR` / `STXR` with a retry loop; on RISC-V it's `LR.W.AQ` / `SC.W.RL`. Go emits these from [`reference/go/src/runtime/atomic_amd64.s`](../../../.dev/reference/go/src/runtime/atomic_amd64.s) (and its per-arch siblings) because a portable compiler can't.
+**Atomic CAS / load-acquire / store-release.** On x86 it's `LOCK CMPXCHG`; on ARM it's `LDXR` / `STXR` with a retry loop; on RISC-V it's `LR.W.AQ` / `SC.W.RL`. Go emits these from `reference/go/src/runtime/atomic_amd64.s` (and its per-arch siblings) because a portable compiler can't.
 
 **Memory barriers.** `MFENCE`, `LFENCE`, `SFENCE` on x86; `DMB` / `DSB` / `ISB` on ARM. Used by Go's `publicationBarrier`, `procyield`, and friends. Per-arch asm files carry them.
 
@@ -34,10 +34,10 @@ Go does these in asm because it cannot rely on libc — Go's scheduler needs to
 
 **Rust + libc covers all three categories** for the specific workload the `rt` crate serves. No custom scheduler means no stack switching. `std::sync::atomic::*` emits the right arch-specific instructions per target. `libc::syscall(SYS_*, ...)` hits the kernel through glibc's own trampolines — we don't need our own because we don't need fine-grained control over scheduler park/unpark (there's no scheduler to park). `signalfd` (see [`../linux/04-signalfd.md`](../linux/04-signalfd.md)) makes signal-handler asm unnecessary.
 
-The next document, [`01-go-runtime-asm.md`](./01-go-runtime-asm.md), catalogues Go's asm in concrete detail. The one after that, [`02-writeonce-stance.md`](./02-writeonce-stance.md), spells out the policy: **no custom assembly in `crates/rt`** — and lists the three edge cases where a future profiling run might force the decision.
+The next document, [`01-go-runtime-asm.md`](01-go-runtime-asm.md), catalogues Go's asm in concrete detail. The one after that, [`02-writeonce-stance.md`](02-writeonce-stance.md), spells out the policy: **no custom assembly in `crates/rt`** — and lists the three edge cases where a future profiling run might force the decision.
 
 ## Reading order
 
 1. **This doc** — the abstract "why asm exists in runtimes."
-2. [`01-go-runtime-asm.md`](./01-go-runtime-asm.md) — concrete Go inventory with reference paths.
-3. [`02-writeonce-stance.md`](./02-writeonce-stance.md) — the writeonce policy + escape hatches.
+2. [`01-go-runtime-asm.md`](01-go-runtime-asm.md) — concrete Go inventory with reference paths.
+3. [`02-writeonce-stance.md`](02-writeonce-stance.md) — the writeonce policy + escape hatches.
diff --git a/docs/plan/exploration/assembly/01-go-runtime-asm.md b/docs/plan/exploration/assembly/01-go-runtime-asm.md
index 454656f..617baee 100644
--- a/docs/plan/exploration/assembly/01-go-runtime-asm.md
+++ b/docs/plan/exploration/assembly/01-go-runtime-asm.md
@@ -1,6 +1,6 @@
 # 01 — Go's runtime assembly, catalogued
 
-The Go runtime ships ~72 `TEXT` functions in `asm_amd64.s` alone, ~43 in `sys_linux_amd64.s`, and per-architecture variants of both for `386`, `arm`, `arm64`, `loong64`, `mips(64)x`, `ppc64x`, `riscv64`, `s390x`, `wasm`. This doc inventories them by purpose so a reader can map each Go asm concern to the writeonce equivalent (spoiler: usually "Rust stdlib does it"). Follow-on reading: [`02-writeonce-stance.md`](./02-writeonce-stance.md).
+The Go runtime ships ~72 `TEXT` functions in `asm_amd64.s` alone, ~43 in `sys_linux_amd64.s`, and per-architecture variants of both for `386`, `arm`, `arm64`, `loong64`, `mips(64)x`, `ppc64x`, `riscv64`, `s390x`, `wasm`. This doc inventories them by purpose so a reader can map each Go asm concern to the writeonce equivalent (spoiler: usually "Rust stdlib does it"). Follow-on reading: [`02-writeonce-stance.md`](02-writeonce-stance.md).
 
 All paths are inside [`reference/go/src/runtime/`](../../../../.dev/reference/go/src/runtime/).
 
@@ -86,6 +86,6 @@ Hookable entry points for sanitisers. Not relevant to writeonce.
 
 ## What's NOT in asm
 
-Everything else in Go's runtime is plain Go: the scheduler's policy (`proc.go`), the garbage collector (`mgc.go` etc.), `netpoll` dispatch (`netpoll.go` — *Go code*; the platform-specific backends like `netpoll_epoll.go` are also pure Go that call into the asm `epollwait` trampoline). The asm is strictly the three categories in [`00-overview.md`](./00-overview.md): calling-convention-breaking operations, arch-specific instructions, and syscall trampolines.
+Everything else in Go's runtime is plain Go: the scheduler's policy (`proc.go`), the garbage collector (`mgc.go` etc.), `netpoll` dispatch (`netpoll.go` — *Go code*; the platform-specific backends like `netpoll_epoll.go` are also pure Go that call into the asm `epollwait` trampoline). The asm is strictly the three categories in [`00-overview.md`](00-overview.md): calling-convention-breaking operations, arch-specific instructions, and syscall trampolines.
 
 The three categories writeonce **also** needs a solution for — but writeonce gets all three from Rust stdlib + libc. The next doc catalogues those mappings.
diff --git a/docs/plan/exploration/assembly/02-writeonce-stance.md b/docs/plan/exploration/assembly/02-writeonce-stance.md
index b2ea4a2..3e4e003 100644
--- a/docs/plan/exploration/assembly/02-writeonce-stance.md
+++ b/docs/plan/exploration/assembly/02-writeonce-stance.md
@@ -4,11 +4,11 @@
 
 ## Why the policy works
 
-Each Go asm category from [`01-go-runtime-asm.md`](./01-go-runtime-asm.md) maps to a Rust-stdlib equivalent that is already correct on every supported architecture:
+Each Go asm category from [`01-go-runtime-asm.md`](01-go-runtime-asm.md) maps to a Rust-stdlib equivalent that is already correct on every supported architecture:
 
 | Go asm need | What writeonce uses | Why it covers the gap |
 | --- | --- | --- |
-| Scheduler stack switching (`gogo`, `mcall`, `systemstack`) | — nothing — | Single-threaded event loop through phases 02–08 (see Phase 2 [Concurrency Model](../../../runtime/database/02-wo-language.md#concurrency-model)). [Phase 09](../../09-concurrency-scaleout.md) introduces **thread-per-core** scaling for the 10k-user ecommerce workload — but still no Go-style stack switching: each thread runs its own event loop, connections are pinned for their lifetime, and cross-thread work is message-passing, not scheduler-stealing. No goroutines, no `g0`, even at scale. |
+| Scheduler stack switching (`gogo`, `mcall`, `systemstack`) | — nothing — | Single-threaded event loop through phases 02–08 (see Phase 2 `Concurrency Model`). `Phase 09` introduces **thread-per-core** scaling for the 10k-user ecommerce workload — but still no Go-style stack switching: each thread runs its own event loop, connections are pinned for their lifetime, and cross-thread work is message-passing, not scheduler-stealing. No goroutines, no `g0`, even at scale. |
 | Preemption (`asyncPreempt`) | — nothing — | No preemption through phases 02–08. Phase 09's thread-per-core model keeps this property: handlers run to completion on whichever thread owns their connection. |
 | Atomic operations (`Load`, `Store`, `Cas`, `Xadd`, ...) | [`std::sync::atomic`](https://doc.rust-lang.org/std/sync/atomic/) | The compiler emits the right instruction per target — `LOCK CMPXCHG` on x86, `LDXR/STXR` on ARM, `LR.W/SC.W` on RISC-V. Ordering is in the type signature (`Ordering::Acquire`, `Release`, `SeqCst`). |
 | Memory barriers (`MFENCE` etc.) | [`std::sync::atomic::fence(Ordering)`](https://doc.rust-lang.org/std/sync/atomic/fn.fence.html) | One call, one fence, arch-neutral. |
@@ -69,7 +69,7 @@ No asm has been written under this policy yet. The expectation is it stays that
 
 ## Cross-references
 
-- [`00-overview.md`](./00-overview.md) — why runtimes ever need asm at all (three categories).
-- [`01-go-runtime-asm.md`](./01-go-runtime-asm.md) — Go's asm inventory, by file.
+- [`00-overview.md`](00-overview.md) — why runtimes ever need asm at all (three categories).
+- [`01-go-runtime-asm.md`](01-go-runtime-asm.md) — Go's asm inventory, by file.
 - [`../linux/04-signalfd.md`](../linux/04-signalfd.md) — the specific primitive that obviates Go's `sigtramp` asm.
-- [`../02-event-loop-epoll.md`](../../done/02-event-loop-epoll.md) — phase 02, where the `runtime/` module actually lands.
+- `../02-event-loop-epoll.md` — phase 02, where the `runtime/` module actually lands.
diff --git a/docs/plan/exploration/c-runtime/00-plan.md b/docs/plan/exploration/c-runtime/00-plan.md
index f39af61..4027e16 100644
--- a/docs/plan/exploration/c-runtime/00-plan.md
+++ b/docs/plan/exploration/c-runtime/00-plan.md
@@ -2,7 +2,7 @@
 
 > **Status: ✅ done** — phases A–F all shipped with measured exit evidence below. Board: [00-status.md](../../../stories/00-status.md)
 
-**Context sources:** [`prototypes/wo-rt-c/wo-rt.c`](../../../../runtime/wo-rt.c) (phase 0 — the single-threaded epoll baseline), [`../../09-concurrency-scaleout.md`](../../09-concurrency-scaleout.md) (the thread-per-core doctrine every phase here miniaturizes), [`../../10-storage-foundations.md`](../../10-storage-foundations.md) / [`11-wal-and-recovery.md`](../../11-wal-and-recovery.md) / [`12-engine-disk-cutover.md`](../../12-engine-disk-cutover.md) (the storage track), kernel reference cards [`../linux/07-io_uring.md`](../linux/07-io_uring.md), [`08-mmap.md`](../linux/08-mmap.md), [`09-fallocate.md`](../linux/09-fallocate.md), [`12-pwrite-fsync.md`](../linux/12-pwrite-fsync.md), [`02-eventfd.md`](../linux/02-eventfd.md).
+**Context sources:** [`prototypes/wo-rt-c/wo-rt.c`](../../../../runtime/wo-rt.c) (phase 0 — the single-threaded epoll baseline), `../../09-concurrency-scaleout.md` (the thread-per-core doctrine every phase here miniaturizes), `../../10-storage-foundations.md` / `11-wal-and-recovery.md` / `12-engine-disk-cutover.md` (the storage track), kernel reference cards [`../linux/07-io_uring.md`](../linux/07-io_uring.md), [`08-mmap.md`](../linux/08-mmap.md), [`09-fallocate.md`](../linux/09-fallocate.md), [`12-pwrite-fsync.md`](../linux/12-pwrite-fsync.md), [`02-eventfd.md`](../linux/02-eventfd.md).
 
 ## Goal
 
@@ -21,7 +21,7 @@ Each phase is the executable proving ground for the matching Rust plan (09–12)
    - *Consistency* — invariants checked in-thread before the RAM apply; an aborted op writes nothing.
    - *Isolation* — one thread is one serial execution stream: per-shard serializability by construction.
    - *Durability* — the HTTP ack is sent only after the fsync completion for the commit's WAL tick.
-   Cross-shard transactions (2PC) belong to the Rust track ([plan 09e](../../09-concurrency-scaleout.md)) — non-scope here.
+   Cross-shard transactions (2PC) belong to the Rust track (`plan 09e`) — non-scope here.
 6. **Dual-write order.** Commit = apply to the RAM slot → append WAL record (write SQE) → one `fdatasync` SQE per loop tick covering all of that tick's commits (group commit) → ack. Boot = replay per-shard WAL/snapshot from disk into the arena, in parallel, before listeners open.
 
 ## Phase sequence
@@ -29,14 +29,14 @@ Each phase is the executable proving ground for the matching Rust plan (09–12)
 One phase per implementation pass; `make` + the smoke endpoints stay green after every phase.
 
 ### Phase A — thread-per-core skeleton — ✅ shipped
-*Maps to [plan 09a](../../09-concurrency-scaleout.md); cards: `SO_REUSEPORT`, [`eventfd`](../linux/02-eventfd.md).*
+*Maps to `plan 09a`; cards: `SO_REUSEPORT`, [`eventfd`](../linux/02-eventfd.md).*
 
 `WO_THREADS` pthreads, each pinned to its core; per-thread epoll loop (io_uring arrives in C), per-thread `SO_REUSEPORT` listener on the same port (kernel balances accepts by 4-tuple), per-thread `conns[]` and request counters. Shutdown: thread 0 owns the `signalfd`; on signal it writes each thread's `eventfd`, every loop exits, `pthread_join` all. Store stays per-thread arrays until B. Responses gain `"shard":t`; `/` reports `"threads":N` and per-shard counters.
 
 **Exit (met):** all endpoints green at `WO_THREADS=4`; `/proc/<pid>/task/*/status` shows each thread pinned to its own core (tid→cpu 0,1,2,3); `/` counters proved 200 concurrent requests spread `[68,36,44,53]` across 4 shards; SIGTERM broadcast joined all shards cleanly; `WO_THREADS=1` behaves like phase 0 (shard 0, sequential ids). Note ids are now interleaved per shard (t+1, t+1+N, …) for coordination-free global uniqueness.
 
 ### Phase B — the RAM arena — ✅ shipped
-*Maps to [plan 10](../../10-storage-foundations.md); cards: [`mmap`](../linux/08-mmap.md), [`fallocate`](../linux/09-fallocate.md).*
+*Maps to `plan 10`; cards: [`mmap`](../linux/08-mmap.md), [`fallocate`](../linux/09-fallocate.md).*
 
 One arena: a header page (magic, version, shard count, slot geometry) + N shard slices of fixed-size row slots + a per-shard allocation bitmap. `mmap(MAP_ANONYMOUS|MAP_PRIVATE [|MAP_HUGETLB], MAP_POPULATE)` then `mlock` (graceful fallback + warning if `RLIMIT_MEMLOCK` refuses). Rows move from arrays into slots; every access is a typed pointer into the owning thread's slice — decision 2 made literal.
 
@@ -50,21 +50,21 @@ Replace each thread's epoll loop with a raw ring: `io_uring_setup`, mmap SQ/CQ,
 **Exit (met):** four requests over one socket (`curl` reported `num_connects: 1, 0, 0, 0`), and a create+list pair on one connection lands on the same shard with both rows visible; `strace -c` over 60 keep-alive requests showed **124 `io_uring_enter` and zero `epoll_wait`/`recvfrom`/`sendto`/`accept`** — the only `read`/`write` calls were the signalfd/eventfd shutdown path; SIGTERM broadcast joined all shards cleanly. Raw ring (`io_uring_setup` + SINGLE_MMAP rings + `io_uring_enter`), multishot accept with `CQE_F_MORE` re-arm, one outstanding SQE per connection, pipelined-tail carry-over.
 
 ### Phase D — WAL dual write: RAM first, then the hard drive — ✅ shipped
-*Maps to [plan 11](../../11-wal-and-recovery.md) + 09c; cards: [`pwrite/fsync`](../linux/12-pwrite-fsync.md), [`fallocate`](../linux/09-fallocate.md).*
+*Maps to `plan 11` + 09c; cards: [`pwrite/fsync`](../linux/12-pwrite-fsync.md), [`fallocate`](../linux/09-fallocate.md).*
 
 Per-shard `shard-<t>.wal`, preallocated with `fallocate`. The commit path is decision 6 verbatim: RAM apply → framed record append (write SQE at the shard's tail offset) → one `fdatasync` SQE per tick → ack on the fsync CQE. CRC32 hand-rolled. Acks for all commits in a tick ride the same fsync — group commit, exactly the Rust runtime's doctrine.
 
 **Exit (met):** crash test — 60 concurrent POSTs, `kill -9` mid-stream — showed **60/60 acked writes present and CRC-valid in the WALs, zero acked-but-missing** (offline verification via the new `wo-rt wal-check <file>` mode, which is also phase E's replay skeleton); a copy truncated mid-record reported `TORN at byte 2584 — 17 whole records before it`, dropping the partial whole; 200 concurrent durable commits in 102 ms (~1,960 commits/s, curl-process-bound — each tick's fsync covers every commit staged that tick via double-buffered write→fsync `IOSQE_IO_LINK` pairs). Failed fsync closes the batch's connections without acking — a client never sees a 201 for a non-durable write. Phase D boots with `O_TRUNC` (fresh log); replay lands in E.
 
 ### Phase E — first load: hard drive → RAM — ✅ shipped
-*Maps to plans [11](../../11-wal-and-recovery.md)/[12](../../12-engine-disk-cutover.md).*
+*Maps to plans `11`/`12`.*
 
 Boot, before any listener opens: each thread replays its own WAL into its arena slice — parallel recovery — validating frame CRC + commit marker, truncating at the first torn record. Clean shutdown writes a snapshot (`pwrite` of live slots to `shard-<t>.data`) and truncates the WAL; boot prefers snapshot + WAL tail. Recovery time printed at startup.
 
 **Exit (met):** the full cycle verified — (1) 40 writes + `kill -9` + restart: `shard_used [10,7,15,8]` identical, replayed from WAL alone (`recovered 0 snapshot rows + N wal records in 1 ms` per shard); (2) SIGTERM wrote four snapshots and truncated the WALs; (3) restart loaded the snapshots instantly; (4) 5 more writes + `kill -9` + restart recovered **snapshot + WAL tail combined** (`recovered 7 snapshot rows + 2 wal records`), totals exact at 45/45; (5) a restart with `WO_THREADS=8` against a 4-shard data dir **refuses to boot** (`meta` guard — resharding is 09f, never silent data loss). Recovery 1–3 ms at demo geometry; large-arena timing rides phase F's harness, which can generate volume natively (geometry is `-D` overridable: `SLOTS_PER_SHARD`/`SLOT_SIZE`).
 
 ### Phase F — million-scale harness + ACID verification — ✅ shipped
-*Maps to [plan 09's verification-targets table](../../09-concurrency-scaleout.md).*
+*Maps to `plan 09's verification-targets table`.*
 
 `setrlimit(RLIMIT_NOFILE)` raised at boot. A small C load client under `prototypes/wo-rt-c/bench/` (keep-alive, pipelined GETs, latency timestamps — `wrk` would be an external dep). Measure honestly on the dev box and commit the numbers to the prototype README: aggregate read req/s across cores (goal order 10⁶/s on 8–16 cores), concurrent open connections (goal order 10⁵–10⁶; ~8 KB/conn + fd limits are the ceiling), commits/s under group fsync, p99 read latency under write load. ACID scripts: torn-WAL injection (atomicity), single-shard interleaving probe (isolation), the phase-D crash test under load (durability). A `just rt-c-bench` recipe runs it all.
 
@@ -80,9 +80,9 @@ Boot, before any listener opens: each thread replays its own WAL into its arena
 
 ## Cross-references
 
-- [`../../09-concurrency-scaleout.md`](../../09-concurrency-scaleout.md) — the doctrine; this prototype is its executable proving ground (A↔09a, C↔09 decision 4, D↔09c).
-- [`../../10-storage-foundations.md`](../../10-storage-foundations.md), [`11-wal-and-recovery.md`](../../11-wal-and-recovery.md), [`12-engine-disk-cutover.md`](../../12-engine-disk-cutover.md) — the storage track phases B/D/E miniaturize.
+- `../../09-concurrency-scaleout.md` — the doctrine; this prototype is its executable proving ground (A↔09a, C↔09 decision 4, D↔09c).
+- `../../10-storage-foundations.md`, `11-wal-and-recovery.md`, `12-engine-disk-cutover.md` — the storage track phases B/D/E miniaturize.
 - [`../../../../prototypes/wo-rt-c/README.md`](../../../../runtime/README.md) — current state and module map (phase 0).
-- [`./01-architecture.md`](./01-architecture.md) — the target architecture traced through one memory address at million-connection concurrency, plus improvement proposals (seqlock reads, registered buffers, SEND_ZC, SQPOLL) that slot into phases C/F.
-- [`./02-single-binary.md`](./02-single-binary.md) — the end goal: how the `wo build` single binary runs on this runtime environment (Go model, not JVM — the kernel is statically linked into every app; the embedding contract between compiler payload and runtime kernel).
-- [`../../../../prototypes/wo-db/`](../../../../prototypes/wo-db/) — the query-layer sibling; one day a phase-G could splice its engine on top of this runtime.
+- [`./01-architecture.md`](01-architecture.md) — the target architecture traced through one memory address at million-connection concurrency, plus improvement proposals (seqlock reads, registered buffers, SEND_ZC, SQPOLL) that slot into phases C/F.
+- [`./02-single-binary.md`](02-single-binary.md) — the end goal: how the `wo build` single binary runs on this runtime environment (Go model, not JVM — the kernel is statically linked into every app; the embedding contract between compiler payload and runtime kernel).
+- `../../../../prototypes/wo-db/` — the query-layer sibling; one day a phase-G could splice its engine on top of this runtime.
diff --git a/docs/plan/exploration/c-runtime/01-architecture.md b/docs/plan/exploration/c-runtime/01-architecture.md
index ae7d820..555d21a 100644
--- a/docs/plan/exploration/c-runtime/01-architecture.md
+++ b/docs/plan/exploration/c-runtime/01-architecture.md
@@ -1,6 +1,6 @@
 # wo-rt-c architecture — one memory address, two spaces, a million connections
 
-This document defines the runtime's architecture by following **one memory address** through user space, kernel space, and hardware, under a million connections reading and writing it concurrently — then suggests improvements. Companion docs: [`00-plan.md`](./00-plan.md) (the phases that build this), [`README.md`](../../../../runtime/README.md) (phase-0 module map).
+This document defines the runtime's architecture by following **one memory address** through user space, kernel space, and hardware, under a million connections reading and writing it concurrently — then suggests improvements. Companion docs: [`00-plan.md`](00-plan.md) (the phases that build this), [`README.md`](../../../../runtime/README.md) (phase-0 module map).
 
 ## The cast: one address
 
@@ -14,7 +14,7 @@ Three facts define everything that follows:
 
 1. **User space sees a virtual address.** `0x7f3a2c001000` is an entry in this process's page tables; the kernel resolved it to one physical RAM frame at fault time (`MAP_POPULATE` faults it in at boot, before any request).
 2. **The kernel pins the frame.** `mlock` guarantees the physical page is never swapped — a load from this address is always a RAM access, never disk I/O in disguise.
-3. **Exactly one thread owns writes to it.** The address lies inside shard 0's slice; thread 0 is the only code in the process that may store to it ([00-plan.md decision 2](./00-plan.md)). Data exists once — ownership, not copying, is the concurrency model.
+3. **Exactly one thread owns writes to it.** The address lies inside shard 0's slice; thread 0 is the only code in the process that may store to it ([00-plan.md decision 2](00-plan.md)). Data exists once — ownership, not copying, is the concurrency model.
 
 ## The two spaces
 
@@ -55,7 +55,7 @@ The arrows worth staring at: the thread's access to the database (`MOV`) and to
 
 ## Write path — the address changes
 
-One of the million connections POSTs a new value. Dual-write order per [00-plan.md decision 6](./00-plan.md): RAM first, then the hard drive, ack only after the disk confirms.
+One of the million connections POSTs a new value. Dual-write order per [00-plan.md decision 6](00-plan.md): RAM first, then the hard drive, ack only after the disk confirms.
 
 ```mermaid
 sequenceDiagram
@@ -110,7 +110,7 @@ do { v1 = atomic_load_acquire(&slot->ver);          /* spin only while odd */
 } while (v1 != v2 || (v1 & 1));
 ```
 
-A hot row becomes readable by all N cores **with zero duplication — same physical frame, same address** — and writes stay serial, so ACID isolation is untouched. Cost: two atomic increments per write, a retry loop per read (C11 atomics, no library). Doctrine note: this relaxes "only the owner touches the slice" to "only the owner *writes* the slice"; contrast with [plan 13e's hot-row read replicas](../../13-class-model-live-pricing.md), which solve the same bottleneck by *copying* rows per thread — seqlock is the no-duplication answer the replica design isn't.
+A hot row becomes readable by all N cores **with zero duplication — same physical frame, same address** — and writes stay serial, so ACID isolation is untouched. Cost: two atomic increments per write, a retry loop per read (C11 atomics, no library). Doctrine note: this relaxes "only the owner touches the slice" to "only the owner *writes* the slice"; contrast with `plan 13e's hot-row read replicas`, which solve the same bottleneck by *copying* rows per thread — seqlock is the no-duplication answer the replica design isn't.
 
 ### 2. Registered buffers and files (`IORING_REGISTER_BUFFERS` / `_FILES`)
 
@@ -138,12 +138,12 @@ On multi-socket boxes, bind each shard slice's pages to the owning core's NUMA n
 
 ### Deliberately not suggested
 
-Work stealing (breaks single-writer ACID), shared-heap locking (the doctrine exists to avoid it — and at 1M readers a mutex on the row would serialize everything the seqlock parallelizes), liburing (the prototype's value is the raw syscall sequence), and multi-node distribution (plan 09's single-box stance). See [plan 09 § Non-scope](../../09-concurrency-scaleout.md).
+Work stealing (breaks single-writer ACID), shared-heap locking (the doctrine exists to avoid it — and at 1M readers a mutex on the row would serialize everything the seqlock parallelizes), liburing (the prototype's value is the raw syscall sequence), and multi-node distribution (plan 09's single-box stance). See `plan 09 § Non-scope`.
 
 ## Cross-references
 
-- [`00-plan.md`](./00-plan.md) — phases A–F that build the architecture described here; improvements 1–7 slot into phases C/F or follow them.
-- [`../../docs/plan/09-concurrency-scaleout.md`](../../09-concurrency-scaleout.md) — the thread-per-core doctrine.
+- [`00-plan.md`](00-plan.md) — phases A–F that build the architecture described here; improvements 1–7 slot into phases C/F or follow them.
+- `../../docs/plan/09-concurrency-scaleout.md` — the thread-per-core doctrine.
 - [`../../docs/plan/exploration/linux/07-io_uring.md`](../linux/07-io_uring.md), [`08-mmap.md`](../linux/08-mmap.md) — the two shared-page mechanisms.
-- [`../../docs/plan/13-class-model-live-pricing.md`](../../13-class-model-live-pricing.md) — 13e's read-replica alternative, contrasted in improvement 1.
+- `../../docs/plan/13-class-model-live-pricing.md` — 13e's read-replica alternative, contrasted in improvement 1.
 - [`README.md`](../../../../README.md) — the C/assembly "one address" pedagogy the single-binary story extends to a full runtime.
diff --git a/docs/plan/exploration/c-runtime/02-single-binary.md b/docs/plan/exploration/c-runtime/02-single-binary.md
index 65e3bb2..ed9c460 100644
--- a/docs/plan/exploration/c-runtime/02-single-binary.md
+++ b/docs/plan/exploration/c-runtime/02-single-binary.md
@@ -1,6 +1,6 @@
 # 02 — The end goal: the writeonce single binary on this runtime environment
 
-**Context sources:** [`00-plan.md`](./00-plan.md) (the runtime-environment phases, A–B ✅), [`01-architecture.md`](./01-architecture.md) (the one-address trace), `../../../runtime/wo-language.md` ("one binary per project; no runtime to install on the target host"; `.wo` has "its own lexer, parser, analyzer, and bytecode"), [`../../09-concurrency-scaleout.md`](../../09-concurrency-scaleout.md)–[`12`](../../12-engine-disk-cutover.md) (the Rust product track this proves out), [`../../../runtime/database/02-wo-language.md`](../../../runtime/database/02-wo-language.md) (catalog + transaction semantics the payload carries).
+**Context sources:** [`00-plan.md`](00-plan.md) (the runtime-environment phases, A–B ✅), [`01-architecture.md`](01-architecture.md) (the one-address trace), `../../../runtime/wo-language.md` ("one binary per project; no runtime to install on the target host"; `.wo` has "its own lexer, parser, analyzer, and bytecode"), `../../09-concurrency-scaleout.md`–`12` (the Rust product track this proves out), `../../../runtime/database/02-wo-language.md` (catalog + transaction semantics the payload carries).
 
 ## The end goal, stated once
 
@@ -80,11 +80,11 @@ Steps 1–2 and 4–6 exist in `wo-rt-c` today with the notes store standing in
 
 - **`wo-rt-c` (C)** — proves each kernel syscall sequence first: threads/arena (✅), io_uring, WAL, recovery, bench. It will never parse `.wo`; its notes store is the stand-in payload.
 - **`crates/rt` (Rust)** — the product: owns the compiler front-end today (lexer→catalog, Stage 2 shipped) and absorbs each proven kernel sequence per plans 09–12, where ownership makes the shard discipline a compile-time guarantee.
-- **Optional phase G** (named in [`00-plan.md`](./00-plan.md)): splice the [`wo-db`](../../../../prototypes/wo-db/) C++ query engine onto `wo-rt-c` as an end-to-end C-family demonstrator of this document — valuable as proof, never the product.
+- **Optional phase G** (named in [`00-plan.md`](00-plan.md)): splice the `wo-db` C++ query engine onto `wo-rt-c` as an end-to-end C-family demonstrator of this document — valuable as proof, never the product.
 
 ## Cross-references
 
-- [`00-plan.md`](./00-plan.md) — the kernel phases; [`01-architecture.md`](./01-architecture.md) — the one-address trace through the same stack.
+- [`00-plan.md`](00-plan.md) — the kernel phases; [`01-architecture.md`](01-architecture.md) — the one-address trace through the same stack.
 - [`README.md`](../../../../README.md) — the user-facing single-binary promise this document implements.
-- [`../../13-class-model-live-pricing.md`](../../13-class-model-live-pricing.md) (13b methods) — the payload-side track.
-- [`../../09-concurrency-scaleout.md`](../../09-concurrency-scaleout.md) — shard-key routing and 2PC the contract defers to.
+- `../../13-class-model-live-pricing.md` (13b methods) — the payload-side track.
+- `../../09-concurrency-scaleout.md` — shard-key routing and 2PC the contract defers to.
diff --git a/docs/plan/exploration/fiber/00-fiber-parity.md b/docs/plan/exploration/fiber/00-fiber-parity.md
new file mode 100644
index 0000000..f37fc7f
--- /dev/null
+++ b/docs/plan/exploration/fiber/00-fiber-parity.md
@@ -0,0 +1,207 @@
+# Fiber parity study — what a mainstream Go web framework ships that `porch` does not
+
+Reference: [gofiber/fiber](https://github.com/gofiber/fiber) **v3.5.0**, read
+2026-08-26 from a shallow clone at `.dev/reference/fiber` (gitignored — re-clone
+with `git clone --depth 1 https://github.com/gofiber/fiber .dev/reference/fiber`).
+Read against `docs/examples/porch` as it stands the same day.
+
+Why Fiber and not Express or Axum: it is the closest structural analogue in the
+reference set. Compiled language, no runtime, one binary, an explicit
+`Ctx`-per-request, and middleware as an ordered chain — the same shape
+`porch` already has. Where it differs, the difference is a feature
+decision rather than a paradigm gap, which is what makes the comparison useful.
+Express would have contributed mostly "you have no closures".
+
+What was actually read: `app.go` (routing methods, the 53-field `Config`),
+`ctx.go` / `req.go` / `res.go` (the request and response surface), `bind.go`
+(binding), `hooks.go` (lifecycle), and the `Config` struct of every one of the
+**32** packages under `middleware/`.
+
+**Headline: `porch` is further along than its size suggests.** Of
+Fiber's 32 middleware packages, 9 already have a working `porch`
+counterpart (CORS, basic auth, key/bearer auth, helmet-style security headers,
+ETag, static files, logger, host authorization, recover-as-500). The gaps are
+real but they are mostly *breadth*, and they cluster around four things:
+**cookies** (absent entirely, and half the list sits on top of them),
+**streaming** (absent, and SSE/compression/chunked all sit on that),
+**binding** (blocked by doctrine until `@derive`), and **one missing runtime
+primitive nobody had noticed**.
+
+---
+
+## 0. The blocker the existing ledger gets wrong
+
+`docs/examples/porch/README.md`'s crypto row currently reads:
+
+> Unlocks (signed cookies, CSRF, session integrity, webhook verification, JWT
+> HS256) | ⬜ **UNBLOCKED** (the primitives exist since iteration 34)
+
+**That is not true for three of the five.** SHA-256 and HMAC-SHA256 let you
+*authenticate* a token. They do not let you *mint* one, because
+**writeonce has no source of randomness at all** — `grep -inE
+'random|rand|urandom|getrandom'` over `compiler/src/types.ml`,
+`runtime/src/wob.h`, `sysio.c` and `crypto.c` returns nothing. There is no
+`getrandom(2)`, no `/dev/urandom` read (`fs.read_at` could reach it, but `fs`
+has no way to open a character device meaningfully and the result would be a
+`Text` of raw bytes with no API contract), and no CSPRNG builtin.
+
+Fiber's session store defaults its `KeyGenerator` to a UUID; its CSRF
+middleware mints a token per request. Both are unguessability requirements, not
+integrity requirements. An HMAC over a *predictable* session id is not a
+session — it is a signed guess.
+
+So the honest dependency order is: **a random-bytes builtin comes before
+sessions and CSRF, not after them.** Signed cookies over an
+application-supplied value and webhook verification (where the secret comes
+from config and the nonce comes from the *sender*) genuinely are unblocked; JWT
+HS256 is unblocked for verification and blocked for issuing anything with a
+random `jti`.
+
+This is the study's most valuable single finding and it is the reason iteration
+39 leads with the primitive rather than the middleware.
+
+---
+
+## 1. Cookies — absent, and foundational
+
+`porch` has **no cookie support in either direction**. `Req` has
+`headers: map<Text, Text>` and nothing parses `Cookie:`; `Resp` has
+`headers: map<Text, Text>` and there is no `Set-Cookie` builder — and because
+`Resp.headers` is a *map*, it structurally cannot carry the two `Set-Cookie`
+lines a login-plus-flash response needs. That map is a real design constraint
+this iteration has to confront, not a missing function.
+
+Fiber, for comparison: `Req.Cookies(key)`, `Res.Cookie(*Cookie)` with
+`ClearCookie`, and a `Cookie` struct carrying Path, Domain, MaxAge, Expires,
+Secure, HTTPOnly, SameSite, Partitioned and SessionOnly.
+
+| Piece | Fiber | porch |
+| --- | --- | --- |
+| read request cookies | `Req.Cookies(key)` | — |
+| set a response cookie | `Res.Cookie(&Cookie{...})` | — |
+| clear | `Res.ClearCookie(key...)` | — |
+| attributes | Path/Domain/MaxAge/Expires/Secure/HTTPOnly/SameSite/Partitioned | — |
+| multiple `Set-Cookie` per response | native (header list) | **impossible** — `Resp.headers` is `map<Text,Text>` |
+| signed / encrypted | `encryptcookie` middleware | — (HMAC exists; see §0 for the minting problem) |
+
+Everything in §2 depends on this section landing first.
+
+## 2. Session, CSRF, rate limiting, idempotency — the store-backed chain
+
+All four are one shape in Fiber: a middleware plus a `Storage` interface. All
+four are pure-`.wo` work in writeonce *once cookies and randomness exist*, and
+writeonce has an unusual advantage here — `@table` gives a **durable,
+WAL-backed, crash-recoverable** store for free, where Fiber ships an in-memory
+default and makes you bolt on Redis for anything real.
+
+| Middleware | Fiber's config knobs (the shape to translate) | writeonce status |
+| --- | --- | --- |
+| `session` | Storage, KeyGenerator, IdleTimeout, AbsoluteTimeout, CookieDomain/Path/SameSite/Secure/HTTPOnly/SessionOnly, Extractor | absent; needs §0 + §1 |
+| `csrf` | Storage, Session, KeyGenerator, TrustedOrigins, SingleUseToken, CookieName + the cookie attrs, IdleTimeout, Extractor | absent; needs §0 + §1 |
+| `limiter` | Storage, Max, Expiration, KeyGenerator, LimitReached, SkipFailed/SkipSuccessful, DisableHeaders | absent; needs only a store + `time.ticks` — **unblocked today** |
+| `idempotency` | Storage, Lock, KeyHeader + validator, Lifetime, KeepResponseHeaders | absent; store + `time.ticks` — **unblocked today** |
+
+`limiter` and `idempotency` are the two cheapest real wins in this whole
+document: no new primitive, no cookie, just a `@table` and a clock that already
+exists.
+
+## 3. Streaming — absent, and three features sit on it
+
+`internal/serve.wo` builds a whole response as one `Text` and writes it with a
+single `net.write`; `serialize()` always emits `Content-Length`. There is no
+flush, no chunked framing, no way to write a response incrementally.
+`internal/parse.wo:153-157` **explicitly refuses** chunked request bodies, with
+a correct note that silently treating a chunked request as body-less is request
+smuggling — that refusal is good engineering and should stay until chunked is
+implemented properly.
+
+Blocked on this one seam:
+
+- **SSE** (Fiber: `middleware/sse` with Retry, HeartbeatInterval, OnClose) —
+  the natural fit for writeonce's actor model, since a room actor already has
+  the fan-out shape. Wants iteration 24's chat work beside it.
+- **Compression** (Fiber: `middleware/compress`, Level) — gzip/deflate/brotli.
+  Iteration 36 landed the bitwise operators, so a pure-`.wo` DEFLATE is now
+  *expressible*; whether it should be `.wo` or a C builtin is a genuine fork,
+  and the honest answer probably depends on whether anything else ever wants
+  zlib.
+- **`SendFile` / `SendStream` / byte ranges** — Fiber's static ships ByteRange,
+  Browse, MaxAge, CacheDuration, IndexNames, Download. `http/files.wo` serves
+  whole small files only. Range requests are what make video and large
+  downloads work.
+
+The framework README already lists "lazy body streaming + backpressure ·
+streaming responses · explicit commit point" as ⏸ unblocked-by-the-arc. This
+study's contribution is naming what *else* falls out of it.
+
+## 4. Binding — blocked by doctrine, and that is fine
+
+Fiber's `Bind` is 16 methods: `Body`, `JSON`, `XML`, `CBOR`, `MsgPack`, `Form`,
+`Query`, `URI`, `Header`, `Cookie`, `RespHeader`, `All`, `Custom`, plus
+validator hooks. It fills a struct by reflecting over tags.
+
+writeonce has `json.decode(t) as T` for JSON bodies and **nothing** for query,
+path params, form or header — those hand you `map<Text, Text>` and you assign
+field by field. Principle 13 forbids reflection, so this cannot be closed the
+way Fiber closes it.
+
+The right owner is **[iteration 29, `@derive`](../../../stories/language-runtime-database/29-compile-time-metaprogramming.md)**:
+compile-time generation from the class table gives typed binding with no
+runtime reflection. This is a genuine parity gap with a real answer that is
+already on the roadmap, so iteration 39 records it and does not attempt it.
+
+Same verdict, same reason, for the codec spread: Fiber ships XML, CBOR and
+MsgPack encoders/decoders in `Config`. writeonce ships JSON. That is the small
+stdlib doing its job, not a defect.
+
+## 5. Routing and response ergonomics — mostly sugar, cheap to close
+
+| Gap | Fiber | porch |
+| --- | --- | --- |
+| method helpers | Get/Post/Put/Delete/Patch/Head/Options/Trace/Connect/All/Add | `get`/`post`/`put`/`delete_` only — a `Route { method: "PATCH" }` literal works, so this is registration sugar, but its absence is felt |
+| route names + URL building | `Name()`, `GetRouteURL()` | — (no named routes, no reverse routing) |
+| route introspection | `GetRoutes()`, `Stack()`, `HandlersCount()` | — |
+| mount / sub-app | `Use(prefix, subApp)` | `Group { prefix }` covers the common case ✅ |
+| case sensitivity / strict slash | `CaseSensitive`, `StrictRouting` | — (always case-sensitive, always lenient) |
+| per-route body limit | `Config.BodyLimit` | `const BODY_MAX = 1048576` in `internal/parse.wo` — one compile-time number for the whole server |
+| per-handler timeout | `middleware/timeout` (Timeout, OnTimeout) | conn-level `read_ms`/`idle_ms` only; bounding a *handler* needs cancellation, which the README already parks |
+| `Location`, `Vary`, `Links`, `Append`, `Attachment`/`Download` | ✅ each a `Res` method | — (`set_header` by hand) |
+| `Format`/`AutoFormat` content negotiation on the way out | ✅ | `accepts()` exists; no format dispatch helper |
+| q-value **ranking** | ✅ | 🔶 already in the ledger: q-values stripped, not ranked |
+| request id | `middleware/requestid` (Header, Generator) | `req.ctx` bag exists to carry it; no generator — and see §0 |
+| healthcheck / favicon / redirect / rewrite / skip | five small middleware | — (each a handful of lines) |
+| `earlydata`, `paginate`, `responsetime`, `envvar`, `expvar`, `pprof` | ✅ | — (`expvar`/`pprof` belong to iteration 30, which has no story file) |
+| lifecycle hooks | 11 hook families (OnRoute, OnListen, OnPreShutdown, OnPostShutdown, …) | — README already notes "no user teardown hooks yet" 🔶 |
+| `proxy` middleware | ✅ | **impossible today** — no `net.connect`; owned by [iteration 38](../../../stories/language-runtime-database/38-content-platform-capabilities.md) |
+| `recover` with stack trace | `EnableStackTrace`, `StackTraceHandler` | trap → 500 and the server lives ✅; no backtrace primitive exists |
+
+## 6. Deliberate divergences — listed so nobody re-opens them
+
+Not gaps. Each was decided and the reasoning is on file.
+
+| Fiber feature | writeonce position |
+| --- | --- |
+| `Views` / `Render` / `ReloadViews` / `PassLocalsToViews` — a runtime template engine | **Rejected.** Markup is a compile-time literal (iteration 37's raw text literal + `writeonce-view`'s `Component`) or it does not exist. A per-request file read is the already-rejected engine — see `docs/plan/discarded.md`. |
+| TLS config, `SetTLSHandler`, HTTP/2 | **Proxy-terminated, forever** (principle: TLS is not the app's job). h2c stays parked behind iteration 23. |
+| `adaptor` (net/http interop) | No FFI, no foreign handler ecosystem to adapt to. |
+| `Concurrency`, `ReadBufferSize`, prefork/`OnFork` | The shard-actor runtime owns placement; there is no worker-pool knob to expose. |
+| Closures as handlers | Handlers are classes satisfying `Handler` (`router/router.wo`'s own note: "no function values in this language, by doctrine — a handler is a CLASS, its fields are the closure substitute"). |
+| `SharedState` / `Locals` as an untyped bag | `req.ctx` is `map<Text,Text>` on purpose; typed per-request state is a `@table` row or a field on the handler class. |
+
+## 7. What this study feeds
+
+The **[`porch` track](../../../stories/porch/00-story.md)** — eight iterations
+numbered from 1, which superseded language iteration 39 on the day this study
+was written. §0–§2 and the cheap half of §5 became porch 1–5, in dependency
+order because §0 gates §2 and §1 gates most of it; §3's streaming seam and what
+falls out of it became porch 6–8, so nothing in this study is now unscheduled
+except what the table below hands to someone else.
+
+Explicitly *not* iteration 39's, with owners:
+
+- streaming, SSE, compression, byte ranges (§3) — [porch 6](../../../stories/porch/06-streaming-core.md)–[8](../../../stories/porch/08-static-and-lifecycle.md), which unparked them
+- typed binding (§4) — [iteration 29](../../../stories/language-runtime-database/29-compile-time-metaprogramming.md)
+- TTL cache middleware — [iteration 18](../../../stories/language-runtime-database/18-memory-db-features.md)
+- `proxy` — [iteration 38](../../../stories/language-runtime-database/38-content-platform-capabilities.md)
+- `pprof`/`expvar`/metrics — iteration 30
+- everything in §6 — closed by doctrine
diff --git a/docs/plan/exploration/fibers/00-fibers.md b/docs/plan/exploration/fibers/00-fibers.md
index 66e8e0b..ad22dca 100644
--- a/docs/plan/exploration/fibers/00-fibers.md
+++ b/docs/plan/exploration/fibers/00-fibers.md
@@ -3,8 +3,8 @@
 > Exploration/reference note (no status banner by board convention).
 > The normative decisions live in the arc spec
 > ([`2026-08-20-shard-fiber-arc-design.md`](../../../superpowers/specs/2026-08-20-shard-fiber-arc-design.md))
-> and iterations [8](../../../stories/language-runtime-database/done/08-shard-actor-runtime.md) /
-> [11](../../../stories/language-runtime-database/done/11-fibers.md); this
+> and iterations [8](../../../stories/language-runtime-database/08-shard-actor-runtime.md) /
+> [11](../../../stories/language-runtime-database/11-fibers.md); this
 > page explains the WHY at doctrine depth. Written 2026-08-20, when this
 > file was also the target of a dangling reference from iteration 11 —
 > it exists now.
diff --git a/docs/plan/exploration/linux/00-linux.md b/docs/plan/exploration/linux/00-linux.md
index 2a00420..fcc6188 100644
--- a/docs/plan/exploration/linux/00-linux.md
+++ b/docs/plan/exploration/linux/00-linux.md
@@ -8,18 +8,18 @@ Each primitive has its own numbered file with the kernel source path (into [`ref
 
 | # | Primitive | Used by |
 | --- | --- | --- |
-| [01](./01-epoll.md)         | `epoll` — event-driven I/O multiplexing | every runtime phase |
-| [02](./02-eventfd.md)       | `eventfd` — counter as fd, cross-flow wake | phase 02, subscription wakeup |
-| [03](./03-timerfd.md)       | `timerfd` — timers as fds | phase 02, phase 07 debounce |
-| [04](./04-signalfd.md)      | `signalfd` — signals as fds, graceful shutdown | phase 04 |
-| [05](./05-inotify.md)       | `inotify` — filesystem events as fds | phase 07, future register! subscription |
-| [06](./06-sendfile.md)      | `sendfile` — zero-copy file → socket | phase 08 |
-| [07](./07-io_uring.md)      | `io_uring` — async I/O ring buffers | phase 3 (WAL fsync), future HTTP |
-| [08](./08-mmap.md)          | `mmap` + `madvise` — memory-mapped files, page-cache hints | phase 3 (storage engine) |
-| [09](./09-fallocate.md)     | `fallocate` + `pread` + `pwritev2` — positional I/O & pre-allocation | phase 3 (WAL + SSTables) |
-| [10](./10-pidfd.md)         | `pidfd` — process as fd, race-free supervision | future supervisor |
-| [11](./11-memfd_create.md)  | `memfd_create` — anonymous shared memory | phase 3 (index build) |
-| [12](./12-pwrite-fsync.md)  | `pwrite` + `fsync`/`fdatasync`/`sync_file_range`/`posix_fadvise` — durability barriers | phases 10, 11, 12 (storage foundations, WAL, engine cutover) |
+| [01](01-epoll.md)         | `epoll` — event-driven I/O multiplexing | every runtime phase |
+| [02](02-eventfd.md)       | `eventfd` — counter as fd, cross-flow wake | phase 02, subscription wakeup |
+| [03](03-timerfd.md)       | `timerfd` — timers as fds | phase 02, phase 07 debounce |
+| [04](04-signalfd.md)      | `signalfd` — signals as fds, graceful shutdown | phase 04 |
+| [05](05-inotify.md)       | `inotify` — filesystem events as fds | phase 07, future register! subscription |
+| [06](06-sendfile.md)      | `sendfile` — zero-copy file → socket | phase 08 |
+| [07](07-io_uring.md)      | `io_uring` — async I/O ring buffers | phase 3 (WAL fsync), future HTTP |
+| [08](08-mmap.md)          | `mmap` + `madvise` — memory-mapped files, page-cache hints | phase 3 (storage engine) |
+| [09](09-fallocate.md)     | `fallocate` + `pread` + `pwritev2` — positional I/O & pre-allocation | phase 3 (WAL + SSTables) |
+| [10](10-pidfd.md)         | `pidfd` — process as fd, race-free supervision | future supervisor |
+| [11](11-memfd_create.md)  | `memfd_create` — anonymous shared memory | phase 3 (index build) |
+| [12](12-pwrite-fsync.md)  | `pwrite` + `fsync`/`fdatasync`/`sync_file_range`/`posix_fadvise` — durability barriers | phases 10, 11, 12 (storage foundations, WAL, engine cutover) |
 
 The list below is the original overview kept for context and for a handful of adjacent primitives (`fanotify`, `splice`/`tee`) that don't yet have their own reference card.
 
diff --git a/docs/plan/exploration/linux/01-epoll.md b/docs/plan/exploration/linux/01-epoll.md
index 7f51300..f850d7e 100644
--- a/docs/plan/exploration/linux/01-epoll.md
+++ b/docs/plan/exploration/linux/01-epoll.md
@@ -68,7 +68,7 @@ unsafe {
 
 ## Used by
 
-Every runtime phase that touches I/O: [`02-event-loop-epoll.md`](../../done/02-event-loop-epoll.md), [`03-hand-rolled-http.md`](../../done/03-hand-rolled-http.md), [`07-inotify-content-watcher.md`](../../07-inotify-content-watcher.md), [`08-sendfile-static-assets.md`](../../08-sendfile-static-assets.md).
+Every runtime phase that touches I/O: `02-event-loop-epoll.md`, `03-hand-rolled-http.md`, `07-inotify-content-watcher.md`, `08-sendfile-static-assets.md`.
 
 ## v1 port source
 
diff --git a/docs/plan/exploration/linux/02-eventfd.md b/docs/plan/exploration/linux/02-eventfd.md
index 6704989..ff6f48c 100644
--- a/docs/plan/exploration/linux/02-eventfd.md
+++ b/docs/plan/exploration/linux/02-eventfd.md
@@ -55,11 +55,11 @@ unsafe {
 - **Always 8-byte `read` / `write`.** Short reads/writes return `EINVAL` — the counter is `u64`, full word or nothing.
 - **Writing `u64::MAX`** returns `EINVAL`; the counter can't hold more than `u64::MAX - 1`.
 - **Multiple writers are OK**; the kernel serialises. But reads race — use `EFD_SEMAPHORE` if you want one consumer per write.
-- **Not async-signal-safe.** Don't `write(fd, ...)` from a signal handler; use `signalfd` instead (see [04-signalfd.md](./04-signalfd.md)).
+- **Not async-signal-safe.** Don't `write(fd, ...)` from a signal handler; use `signalfd` instead (see [04-signalfd.md](04-signalfd.md)).
 
 ## Used by
 
-[`02-event-loop-epoll.md`](../../done/02-event-loop-epoll.md) — wake the loop for shutdown or internal work. Future `sub` crate ([`09-native-subscriptions`], not yet planned) uses it to signal that a subscriber queue has drained.
+`02-event-loop-epoll.md` — wake the loop for shutdown or internal work. Future `sub` crate ([`09-native-subscriptions`], not yet planned) uses it to signal that a subscriber queue has drained.
 
 ## v1 port source
 
diff --git a/docs/plan/exploration/linux/03-timerfd.md b/docs/plan/exploration/linux/03-timerfd.md
index cbf3883..932f279 100644
--- a/docs/plan/exploration/linux/03-timerfd.md
+++ b/docs/plan/exploration/linux/03-timerfd.md
@@ -70,7 +70,7 @@ unsafe {
 
 ## Used by
 
-[`02-event-loop-epoll.md`](../../done/02-event-loop-epoll.md) — housekeeping timers. [`07-inotify-content-watcher.md`](../../07-inotify-content-watcher.md) — 150 ms debounce window after an inotify burst. Future subscription phase — keepalive pings to long-lived connections.
+`02-event-loop-epoll.md` — housekeeping timers. `07-inotify-content-watcher.md` — 150 ms debounce window after an inotify burst. Future subscription phase — keepalive pings to long-lived connections.
 
 ## v1 port source
 
diff --git a/docs/plan/exploration/linux/04-signalfd.md b/docs/plan/exploration/linux/04-signalfd.md
index b703b0b..3bc118d 100644
--- a/docs/plan/exploration/linux/04-signalfd.md
+++ b/docs/plan/exploration/linux/04-signalfd.md
@@ -66,11 +66,11 @@ unsafe {
 - **Per-thread mask.** `sigprocmask` is per-thread. In a single-threaded runtime that's fine; if you ever spawn threads, use `pthread_sigmask` on each so the main loop gets the signals.
 - **`signalfd_siginfo` is big** (128 bytes). Read into an aligned buffer; partial reads return `EINVAL`.
 - **Doesn't catch `SIGKILL` or `SIGSTOP`.** Nothing does. Those bypass everything.
-- **Child exit notifications (`SIGCHLD`)** work via signalfd but `pidfd` (see [10-pidfd.md](./10-pidfd.md)) is usually the better fit for clean child supervision.
+- **Child exit notifications (`SIGCHLD`)** work via signalfd but `pidfd` (see [10-pidfd.md](10-pidfd.md)) is usually the better fit for clean child supervision.
 
 ## Used by
 
-[`04-cutover-remove-tokio-axum.md`](../../done/04-cutover-remove-tokio-axum.md) — replaces `tokio::signal::ctrl_c()` for graceful shutdown. Every subsequent phase inherits this pattern.
+`04-cutover-remove-tokio-axum.md` — replaces `tokio::signal::ctrl_c()` for graceful shutdown. Every subsequent phase inherits this pattern.
 
 ## v1 port source
 
diff --git a/docs/plan/exploration/linux/05-inotify.md b/docs/plan/exploration/linux/05-inotify.md
index 4d5a859..4cd331f 100644
--- a/docs/plan/exploration/linux/05-inotify.md
+++ b/docs/plan/exploration/linux/05-inotify.md
@@ -75,13 +75,13 @@ unsafe {
 - **Per-directory watches, not per-file.** Watching individual files wastes descriptors and misses `IN_CREATE`/`IN_DELETE` for new entries. Watch the directory; filter by event `name` in userspace.
 - **Recursive watching is manual.** Walk the tree at init and add a watch per directory. React to `IN_CREATE | IN_ISDIR` by adding a watch for the new subdirectory — and to `IN_MOVED_TO | IN_ISDIR` too.
 - **`fs.inotify.max_user_watches`** defaults to 8192 on most distros. Recursive watches over a big node_modules or target dir exhaust it fast. Filter aggressively before adding.
-- **Editors burst events.** Tmp-file + rename + delete is 3–4 events per logical save. Debounce 100–200 ms with [`timerfd`](./03-timerfd.md).
+- **Editors burst events.** Tmp-file + rename + delete is 3–4 events per logical save. Debounce 100–200 ms with [`timerfd`](03-timerfd.md).
 - **Reading less than a full event is an `EINVAL`.** Use a buffer ≥ `sizeof(inotify_event) + NAME_MAX + 1` (≈ 4 KiB is a safe size).
 - **`wd` is stable per-watch but reused after `rm_watch`.** Keep a `wd → path` map; remove from it on `IN_IGNORED`.
 
 ## Used by
 
-[`07-inotify-content-watcher.md`](../../07-inotify-content-watcher.md) — the Stage-3 hot-reload feature. Future `sub` crate — the register-macro subscription model in [`00-linux.md § Database Subscription`](./00-linux.md#database-subscription).
+`07-inotify-content-watcher.md` — the Stage-3 hot-reload feature. Future `sub` crate — the register-macro subscription model in [`00-linux.md § Database Subscription`](00-linux.md#database-subscription).
 
 ## v1 port source
 
diff --git a/docs/plan/exploration/linux/06-sendfile.md b/docs/plan/exploration/linux/06-sendfile.md
index 58bf6b3..861f7ed 100644
--- a/docs/plan/exploration/linux/06-sendfile.md
+++ b/docs/plan/exploration/linux/06-sendfile.md
@@ -7,7 +7,7 @@ Zero-copy transfer from a file fd to a socket fd. The kernel splices pages direc
 | Path | What |
 | --- | --- |
 | [`reference/linux/fs/read_write.c`](../../../../.dev/reference/linux/fs/read_write.c) | `SYSCALL_DEFINE4(sendfile, ...)` and `SYSCALL_DEFINE4(sendfile64, ...)`. Modern glibc aliases the first to the second; the syscalls are distinguished by the offset type. |
-| [`reference/linux/fs/splice.c`](../../../../.dev/reference/linux/fs/splice.c) | Internally `sendfile` delegates to `splice_direct_to_actor`. Related — see [07-splice.md](./07-splice.md) if you ever need the more general fd-to-fd pipe path. |
+| [`reference/linux/fs/splice.c`](../../../../.dev/reference/linux/fs/splice.c) | Internally `sendfile` delegates to `splice_direct_to_actor`. Related — see `07-splice.md` if you ever need the more general fd-to-fd pipe path. |
 
 ## Man pages
 
@@ -71,7 +71,7 @@ unsafe {
 
 ## Used by
 
-[`08-sendfile-static-assets.md`](../../08-sendfile-static-assets.md) — the `GET /static/...` handler. Future `##ui` SSR output bundles go through the same path.
+`08-sendfile-static-assets.md` — the `GET /static/...` handler. Future `##ui` SSR output bundles go through the same path.
 
 ## v1 port source
 
diff --git a/docs/plan/exploration/linux/07-io_uring.md b/docs/plan/exploration/linux/07-io_uring.md
index 0a9f5dc..4faa4c5 100644
--- a/docs/plan/exploration/linux/07-io_uring.md
+++ b/docs/plan/exploration/linux/07-io_uring.md
@@ -2,7 +2,7 @@
 
 Ring-buffer based async I/O (Linux 5.1+, mature 5.11+). Two lock-free SPSC rings shared between userspace and kernel: submissions (SQEs) go in one, completions (CQEs) come out of the other. Batched, zero-syscall submission (with SQPOLL), zero-copy where the underlying op allows. Successor to `epoll` + `libaio` for the storage engine's WAL fsync path and — eventually — the HTTP server's accept/recv/send path.
 
-**Not on the runtime's critical path in phases 02–08.** Phase 02 uses `epoll`. `io_uring` comes in during [Phase 3 — In-Memory Engine](../../../runtime/database/03-inmemory-engine.md) for the WAL's group-commit fsync loop. This card is the reference for that phase.
+**Not on the runtime's critical path in phases 02–08.** Phase 02 uses `epoll`. `io_uring` comes in during `Phase 3 — In-Memory Engine` for the WAL's group-commit fsync loop. This card is the reference for that phase.
 
 ## Kernel source
 
@@ -90,7 +90,7 @@ Full working code is ~200 LOC including error handling — see `liburing` source
 
 ## Used by
 
-Phase 3 of the database series — see [`docs/runtime/database/03-inmemory-engine.md`](../../../runtime/database/03-inmemory-engine.md). Specifically the WAL fsync path: link `WRITE` → `FSYNC` SQEs, submit many per tick, reap completions to ack committed transactions. Also the natural upgrade target for the HTTP server once Phase 4 adds the native wire protocol.
+Phase 3 of the database series — see `docs/runtime/database/03-inmemory-engine.md`. Specifically the WAL fsync path: link `WRITE` → `FSYNC` SQEs, submit many per tick, reap completions to ack committed transactions. Also the natural upgrade target for the HTTP server once Phase 4 adds the native wire protocol.
 
 ## v1 port source
 
diff --git a/docs/plan/exploration/linux/08-mmap.md b/docs/plan/exploration/linux/08-mmap.md
index 739fa72..40c1586 100644
--- a/docs/plan/exploration/linux/08-mmap.md
+++ b/docs/plan/exploration/linux/08-mmap.md
@@ -93,7 +93,7 @@ unsafe {
 
 ## Used by
 
-Phase 3 of the database series — see [`docs/runtime/database/03-inmemory-engine.md`](../../../runtime/database/03-inmemory-engine.md) § Linux Tuning Checklist. The relational B+ tree, the LSM memtables' on-disk segments, and the document store's arenas all live behind `mmap`.
+Phase 3 of the database series — see `docs/runtime/database/03-inmemory-engine.md` § Linux Tuning Checklist. The relational B+ tree, the LSM memtables' on-disk segments, and the document store's arenas all live behind `mmap`.
 
 ## v1 port source
 
diff --git a/docs/plan/exploration/linux/09-fallocate.md b/docs/plan/exploration/linux/09-fallocate.md
index 29dd88a..959f34c 100644
--- a/docs/plan/exploration/linux/09-fallocate.md
+++ b/docs/plan/exploration/linux/09-fallocate.md
@@ -2,7 +2,7 @@
 
 `fallocate` pre-allocates disk space for a file without writing any bytes — lets the filesystem commit to a contiguous extent, so later writes don't fragment and can't fail mid-operation due to disk pressure. `pread` / `pwritev2` read and write at an explicit offset without touching the file's cursor — letting many concurrent readers share one fd safely.
 
-Together they form the backbone of the storage engine's on-disk layout: segment files are pre-allocated to their target size at creation, then written into via `pwritev2`; readers hit them via `pread` or `mmap` (see [08-mmap.md](./08-mmap.md)).
+Together they form the backbone of the storage engine's on-disk layout: segment files are pre-allocated to their target size at creation, then written into via `pwritev2`; readers hit them via `pread` or `mmap` (see [08-mmap.md](08-mmap.md)).
 
 ## Kernel source
 
@@ -89,7 +89,7 @@ unsafe {
 
 ## Used by
 
-Phase 3 of the database series — WAL pre-allocation, SSTable extent reservation, segment punching for compaction. Also [`07-io_uring.md`](./07-io_uring.md) pairs beautifully with positional I/O: `IORING_OP_WRITE` / `IORING_OP_READ` take an offset, so they're `pwrite`/`pread` under the hood.
+Phase 3 of the database series — WAL pre-allocation, SSTable extent reservation, segment punching for compaction. Also [`07-io_uring.md`](07-io_uring.md) pairs beautifully with positional I/O: `IORING_OP_WRITE` / `IORING_OP_READ` take an offset, so they're `pwrite`/`pread` under the hood.
 
 ## v1 port source
 
diff --git a/docs/plan/exploration/linux/11-memfd_create.md b/docs/plan/exploration/linux/11-memfd_create.md
index 67ee4fe..2effd12 100644
--- a/docs/plan/exploration/linux/11-memfd_create.md
+++ b/docs/plan/exploration/linux/11-memfd_create.md
@@ -95,7 +95,7 @@ unsafe {
 
 ## Used by
 
-Phase 3 of the database series — index-build-then-swap (mentioned in [03-inmemory-engine.md § Recovery](../../../runtime/database/03-inmemory-engine.md#recovery) as "build a .seg index in memory before atomically swapping it to disk"). Also any future IPC story with worker processes (Phase 6 full-stack with multiple render workers, say).
+Phase 3 of the database series — index-build-then-swap (mentioned in `03-inmemory-engine.md § Recovery` as "build a .seg index in memory before atomically swapping it to disk"). Also any future IPC story with worker processes (Phase 6 full-stack with multiple render workers, say).
 
 ## v1 port source
 
diff --git a/docs/plan/exploration/linux/12-pwrite-fsync.md b/docs/plan/exploration/linux/12-pwrite-fsync.md
index 7e7ec04..6247ffd 100644
--- a/docs/plan/exploration/linux/12-pwrite-fsync.md
+++ b/docs/plan/exploration/linux/12-pwrite-fsync.md
@@ -1,6 +1,6 @@
 # 12 — `pwrite` + `fsync` durability syscalls
 
-The previous cards cover positional I/O ([`09-fallocate.md`](./09-fallocate.md)) and the page cache backstory ([`08-mmap.md`](./08-mmap.md)) but skip the actual durability primitives. This card fills the gap. Every persistent-storage phase (10, 11, 12) leans on these.
+The previous cards cover positional I/O ([`09-fallocate.md`](09-fallocate.md)) and the page cache backstory ([`08-mmap.md`](08-mmap.md)) but skip the actual durability primitives. This card fills the gap. Every persistent-storage phase (10, 11, 12) leans on these.
 
 ## The four syscalls
 
@@ -141,9 +141,9 @@ Writeonce trades the memcpy for the recovery speed and the simpler programming m
 
 ## Used by
 
-- [`docs/plan/10-storage-foundations.md`](../../10-storage-foundations.md) — segment append uses `pwrite` + later `fdatasync`.
-- [`docs/plan/11-wal-and-recovery.md`](../../11-wal-and-recovery.md) — group-commit uses `pwrite` + `fdatasync`; control file uses `fsync` + `rename` + parent-dir `fsync`.
-- [`docs/plan/12-engine-disk-cutover.md`](../../12-engine-disk-cutover.md) — checkpoint uses `fsync` per active segment fd.
+- `docs/plan/10-storage-foundations.md` — segment append uses `pwrite` + later `fdatasync`.
+- `docs/plan/11-wal-and-recovery.md` — group-commit uses `pwrite` + `fdatasync`; control file uses `fsync` + `rename` + parent-dir `fsync`.
+- `docs/plan/12-engine-disk-cutover.md` — checkpoint uses `fsync` per active segment fd.
 
 Pair with [`postgresql/wal.md`](../postgresql/wal.md), [`postgresql/buffer-and-checkpoint.md`](../postgresql/buffer-and-checkpoint.md) for the design context.
 
diff --git a/docs/plan/exploration/postgresql/00-postgresql.md b/docs/plan/exploration/postgresql/00-postgresql.md
index 49781ef..7d2780b 100644
--- a/docs/plan/exploration/postgresql/00-postgresql.md
+++ b/docs/plan/exploration/postgresql/00-postgresql.md
@@ -14,12 +14,12 @@ Gitignored — see [`.gitignore`](../../../../.gitignore). Pair it with [`refere
 
 | # | Postgres area | What writeonce takes | What writeonce skips |
 | --- | --- | --- | --- |
-| [wal](./wal.md)                                  | `access/transam/xlog*.c`              | append-only sequential log, LSN-as-byte-offset, segment rollover, group commit, `pwrite` + `fsync` at commit | replication/archiver, multi-process WAL writer, GUC matrix |
-| [smgr-and-md](./smgr-and-md.md)                  | `storage/smgr/{md,smgr,bulk_write}.c` | one file per relation, segments capped at `RELSEG_SIZE`, immediate vs deferred fsync | multi-fork abstraction (main/fsm/vm), shared-memory descriptor cache |
-| [buffer-and-checkpoint](./buffer-and-checkpoint.md) | `storage/buffer/{bufmgr,freelist}.c` + `postmaster/{checkpointer,bgwriter}.c` | page cache + dirty bit + LRU; checkpoint flushes then advances control-file LSN | shared-buffer pinning/unpinning, separate writer processes, latches |
-| [page-format](./page-format.md)                  | `storage/page/{bufpage,checksum}.c`   | page header (LSN, checksum, free-space markers); CRC32C trailers | MVCC visibility (xmin/xmax/ctid), access-method-specific opaque space |
-| [constraints-and-grammar](./constraints-and-grammar.md) | `parser/gram.y`, `catalog/pg_constraint.h`, `utils/adt/ri_triggers.c` | PK = blessed unique index; FK forward-only catalog + inline-check semantics; ON DELETE action set; backlink-implies-index (our improvement) | trigger machinery, deferrable constraints, MATCH PARTIAL, composite keys |
-| [indexing-and-point-lookup](./indexing-and-point-lookup.md) | `access/{nbtree,hash}/README`, `optimizer/path/costsize.c`, `storage/itemptr.h` | hash-bucket point lookup (expected O(1)), index-entry-as-row-address (TID ↔ our slot), selectivity beats seqscan by arithmetic | btree/gin/gist/spgist/brin AMs, cost-based planner, index paging |
+| [wal](wal.md)                                  | `access/transam/xlog*.c`              | append-only sequential log, LSN-as-byte-offset, segment rollover, group commit, `pwrite` + `fsync` at commit | replication/archiver, multi-process WAL writer, GUC matrix |
+| [smgr-and-md](smgr-and-md.md)                  | `storage/smgr/{md,smgr,bulk_write}.c` | one file per relation, segments capped at `RELSEG_SIZE`, immediate vs deferred fsync | multi-fork abstraction (main/fsm/vm), shared-memory descriptor cache |
+| [buffer-and-checkpoint](buffer-and-checkpoint.md) | `storage/buffer/{bufmgr,freelist}.c` + `postmaster/{checkpointer,bgwriter}.c` | page cache + dirty bit + LRU; checkpoint flushes then advances control-file LSN | shared-buffer pinning/unpinning, separate writer processes, latches |
+| [page-format](page-format.md)                  | `storage/page/{bufpage,checksum}.c`   | page header (LSN, checksum, free-space markers); CRC32C trailers | MVCC visibility (xmin/xmax/ctid), access-method-specific opaque space |
+| [constraints-and-grammar](constraints-and-grammar.md) | `parser/gram.y`, `catalog/pg_constraint.h`, `utils/adt/ri_triggers.c` | PK = blessed unique index; FK forward-only catalog + inline-check semantics; ON DELETE action set; backlink-implies-index (our improvement) | trigger machinery, deferrable constraints, MATCH PARTIAL, composite keys |
+| [indexing-and-point-lookup](indexing-and-point-lookup.md) | `access/{nbtree,hash}/README`, `optimizer/path/costsize.c`, `storage/itemptr.h` | hash-bucket point lookup (expected O(1)), index-entry-as-row-address (TID ↔ our slot), selectivity beats seqscan by arithmetic | btree/gin/gist/spgist/brin AMs, cost-based planner, index paging |
 
 ## The lift-vs-skip filter
 
@@ -46,11 +46,11 @@ The implementation phases that lean on this material:
 - The Rust-era consumers (plans 10/11/12: storage foundations, WAL and
   recovery, disk cutover) were removed with that track 2026-08-18; their
   ideas shipped in `database/src/` (typed WAL + replay) and the rest wait
-  on [iteration 32](../../../stories/language-runtime-database/refine/32-wal-checkpoint.md)
+  on [databasev2 3](../../../stories/databasev2/03-wal-checkpoint.md)
   (checkpoint) — the wal/buffer cards are its entry material.
-- Current consumers: [constraints-and-grammar](./constraints-and-grammar.md)
+- Current consumers: [constraints-and-grammar](constraints-and-grammar.md)
   (the `@table` PK/FK grammar direction) and
-  [indexing-and-point-lookup](./indexing-and-point-lookup.md) (the
+  [indexing-and-point-lookup](indexing-and-point-lookup.md) (the
   O(1) read-path slice iteration 22's numbers demand).
 
 Pair each card with [`docs/plan/exploration/linux/12-pwrite-fsync.md`](../linux/12-pwrite-fsync.md) for the actual syscalls — these cards are about *design patterns*, that one is about *kernel calls*.
diff --git a/docs/plan/exploration/postgresql/page-format.md b/docs/plan/exploration/postgresql/page-format.md
index 82fb931..d2f958e 100644
--- a/docs/plan/exploration/postgresql/page-format.md
+++ b/docs/plan/exploration/postgresql/page-format.md
@@ -79,4 +79,4 @@ Slotted pages are the answer when those assumptions break. Until then, the frami
 - `docs/plan/10-storage-foundations.md` (Rust-era, removed 2026-08-18) — record framing borrows the **header + checksum** pattern from `bufpage.h`.
 - `docs/plan/12-engine-disk-cutover.md` (Rust-era, removed 2026-08-18) — when reading rows back from disk, CRC verification is the silent-corruption safety net the page header gives Postgres.
 
-Pair with [`wal.md`](./wal.md) for the LSN convention and [`buffer-and-checkpoint.md`](./buffer-and-checkpoint.md) for the dirty-page semantics that pages need.
+Pair with [`wal.md`](wal.md) for the LSN convention and [`buffer-and-checkpoint.md`](buffer-and-checkpoint.md) for the dirty-page semantics that pages need.
diff --git a/docs/plan/oop-vm/01-error-catalog.md b/docs/plan/oop-vm/01-error-catalog.md
index 193b146..9d5bb47 100644
--- a/docs/plan/oop-vm/01-error-catalog.md
+++ b/docs/plan/oop-vm/01-error-catalog.md
@@ -1,7 +1,12 @@
 # The `woc` diagnostic catalog — normative reference
 
 Every `WO-E###`/`WO-W###` code the `woc` front end (`compiler/`) actually
-emits, as of plan 2 tasks 2–8 and plan 3 tasks 1–2. Code ranges are reserved
+emits, as of plan 2 tasks 2–8, plan 3 tasks 1–2, and the iterations that
+added codes afterwards — 9b (WO-E250), 15/17 (WO-E106–E109), the
+language-surface-strictness branch (WO-E219/E220), the shard-fiber arc
+(WO-E221/E222), 24 (WO-E226) and 36 (WO-E223). Re-swept against the source
+2026-08-26; the eight codes that sweep found missing are now in the tables
+below. Code ranges are reserved
 per stage (`compiler/src/diag.ml`): `WO-E0xx` lexing, `WO-E1xx` parsing,
 `WO-E2xx` types, `WO-E3xx` ownership, `WO-E4xx` the bytecode emitter,
 `WO-W2xx` warnings from the types stage. This
@@ -26,6 +31,9 @@ half of the story ("moved here" / "borrowed here" / etc.).
 | --- | --- | --- |
 | WO-E001 | an input byte the lexer doesn't recognize as the start of any token. Reported once per bad byte, which is then skipped — one bad byte never stops the whole file. | `unknown character '$'` |
 | WO-E002 | a string literal's backslash escape is the last byte of the file, with no character left to escape (a plain unterminated string with no dangling backslash is *not* an error — rt parity). | `unterminated string escape` |
+| WO-E003 | haxe-parity Task 8 (build flags). Misuse of the token-level `#if`/`#else`/`#end` filter: a `#if` with no flag name, a second `#else` in one section, a stray `#else`/`#end` with nothing open, a `#if` left open at end of file, or an unknown directive word. `Eof` always survives the filter so the parser still terminates after a reported error. Flags are NAMES only — no expressions — and are set with `woc -D <name>`. | ``unknown directive `#unless` — the build-flag directives are #if <flag>, #else, #end`` |
+| WO-E004 | a raw text literal (backtick-delimited) that runs off the end of the file. Reported at the OPENING backtick — unlike a plain `"..."` string this is never silent, because multi-line is this form's normal case and a missing close would swallow every remaining line. | `unterminated raw text literal` |
+| WO-E005 | a raw newline inside a `"..."` or `'...'` string. The scan stops at the newline without consuming it, so the `Newline` token still terminates the statement and only one line is lost. Multi-line text is spelled with a raw literal instead. | ``newline in string literal (use a `...` raw text literal for multi-line text)`` |
 
 ## WO-E1xx — parsing (Tasks 4–5, `compiler/src/parser.ml`; WO-E103 haxe-parity Task 2)
 
@@ -36,6 +44,8 @@ half of the story ("moved here" / "borrowed here" / etc.).
 | WO-E103 | haxe-parity Task 2. `inline fn ...` — the haxe keyword verdict table's own reject half of the `inline` row (`const` values are the adopted half). The whole declaration is discarded by the usual top-level recovery, same as any other bad declaration. | `` `inline fn` is rejected — optimization is the compiler's job `` |
 | WO-E106 | iteration 15 (deps, 2026-08-18). A dependency fetch/shape failure, driver-level: missing `git` binary, clone/checkout failure, a locked commit missing from the remote, cache/lock drift (a moved `rev` — the message names both SHAs and points at `woc --update-deps`), a fetched dep that is not a writeonce project, or a dep declaring its own `[deps]` (transitive — refused flat-only). One code; the message names the dependency and the failing step. | `` dependency `niceframework`: lock drift — wo.lock pins <sha> but .wo-deps has <sha> (a moved `rev`?); run `woc --update-deps` or remove .wo-deps/niceframework `` |
 | WO-E107 | iteration 15 (deps). A `[deps]` name collides with a local top-level module directory of the same name — `use <name>` would be ambiguous, so the build refuses instead of silently picking one. | `` dependency `niceframework` collides with the local module directory `niceframework/` `` |
+| WO-E108 | iteration 17 (library kind + `internal/`, 2026-08-20). A `use` path reaches a module under a dependency's `internal/` — Go's rule, enforced at the *consumer's* own `use` and only across the `[deps]` boundary: a library imports its own interior freely. Driver-level (`compiler/bin/main.ml`), reported at the offending `use`. | `` `serve/internal/parse` is internal to the dependency `serve` — a module under `internal/` is the library's own business and cannot be imported across the `[deps]` boundary `` |
+| WO-E109 | iteration 17. An unknown `kind` value in `wo.toml`. Manifest-level: printed directly and exits 2 rather than joining the collector, the same as WO-E106/E107. `program` is the default, so every manifest written before the key existed stays byte-identical. | ``woc: wo.toml: error WO-E109: unknown `kind` value `lib` — expected "program" (the default) or "library"`` |
 | WO-E105 | iteration 5 strictness (2026-08-18). A rejected Haxe keyword used where it would otherwise misparse — or, worst, compile clean (`return super.f()` used to): `extends`/`implements` after a class name, and `extends`/`implements`/`super`/`override`/`cast`/`Dynamic`/`untyped`/`macro`/`extern`/`operator` as an expression head or a top-level declaration head. Each cites the systems-track verdict table's doctrine reason. (`Dynamic`/`untyped` as a *type name* fire WO-E225 with the same doctrine message.) | `` `extends` is rejected: no inheritance, ever — is-a is a tagged union, has-a is composition, polymorphism is structural interfaces (principle 4) `` |
 | WO-E104 | iteration 7b. `@gc` on a class — the annotation is gone: GC-ness is inferred (structural cycles + demand promotion; `woc --dump-gc`). The annotation is skipped for recovery and the class classifies by inference. | `` `@gc` is not a valid annotation: GC-ness is inferred by the compiler (run `woc --dump-gc`). Remove it. `` |
 
@@ -62,6 +72,13 @@ half of the story ("moved here" / "borrowed here" / etc.).
 | WO-E217 | haxe-parity Task 1 (modules). A qualified reference (`alias.name(...)`) names a real declaration in a real, `use`d module, but that declaration has no `pub` marker — private to its own module. | `` `hidden` is not `pub` in module `secret` `` |
 | WO-E218 | haxe-parity Task 1 (modules). A bare (unqualified) name resolves as `pub` in *more than one* used module — "collisions diagnose rather than shadow silently" (the plan's own words): resolution never silently picks a winner among used modules, it fails loudly and names every alias that matched. | `` `thing` is ambiguous — exported `pub` by more than one used module (a, b) `` |
 | WO-E225 | a field's declared type name isn't a builtin scalar, a declared class (typedef records included), a declared interface, or (haxe-parity Task 4) a declared union. Also checked, same shape, on a payload variant's field types. A dotted name whose head is a reserved stdlib namespace (`json.Value`) is accepted as UNKNOWN-BUT-RESERVED — the same plan-9 convention `fs.stat(...)` calls get; any other dotted name is as unknown as a misspelling. Checked once per field declaration, at the field's own position. | `unknown type \`Wdiget\`` |
+| WO-E219 | language-surface-strictness branch. A `pub(read)` field written from outside its declaring class — the marker means readable anywhere, writable only inside. Reported at the write site. | `` field `total` of class `Cart` is pub(read) — readable anywhere, writable only inside `Cart` `` |
+| WO-E220 | language-surface-strictness branch. A name is both a real method of the receiver's class and a `using` extension in scope — an extension never overrides a method, so the collision is refused rather than silently resolved one way. | `` `render` is both a real method of `Page` and a `using` extension — rename one; an extension never overrides a method `` |
+| WO-E221 | the shard-fiber arc (iteration 8+11). A `spawn C { ... }` whose target class declares no `fn receive(msg: M)`, or declares one whose `M` is not a class, record or union. `receive` is an ordinary identifier, not a keyword — declaring it is what makes a class an actor. | `` `spawn Worker { ... }`: no `fn receive` — an actor is a class with `fn receive(msg: M)` where M is a class, record, or union `` |
+| WO-E222 | the shard-fiber arc. A traced (inferred-GC) type, or a type containing one, used as an actor message or as actor state. Aliased object graphs cannot cross shard heaps, and `spawn` placement makes every actor potentially remote, so this is refused statically rather than trapped at the send. | `` message type `Graph` is traced (or contains a traced class) — aliased graphs cannot cross shard heaps; spawn placement makes every actor potentially remote `` |
+| WO-E223 | iteration 36 (operators). A literal shift count outside `0..63` on `<<` or `>>`. A non-literal count is not caught here — the VM traps it at run time (`WOP_SHL`/`WOP_SHR`). | ``shift count is out of range 0..63 for `<<` `` |
+| WO-E226 | iteration 24 (`call`). `call`'s reply type has to survive actor-`M` erasure, so every `fn receive(msg: M)` program-wide must declare the SAME return type, and in v1 that type must be a copyable scalar. Fires when two `receive` declarations disagree, or when the agreed type is not scalar. | `` `call` on `actor Msg` needs one reply type, but `Room` and `Registry` declare different `receive` returns `` |
+| WO-E250 | iteration 9b (the query surface). Every diagnostic the language-integrated query grammar raises, one code: a `from v in C` whose `C` is not a declared table class, a navigation source that is not a `backlink`/`multi` of a table class, and the two not-yet-supported clauses — `group … by … into` on a table query and on a navigation query. The group-by rows are why the clause parses and still cannot run. | ``group-by aggregation is not supported yet`` |
 | WO-W202 *(warning)* | haxe-parity Task 1 (modules). A file's own `use` clause is never actually referenced — neither a bare name resolving through it nor a qualified `alias.name(...)` call — anywhere in that file's surviving parse tree. | `` unused `use fs` `` |
 | WO-W203 *(warning)* | haxe-parity Task 3 review fix (Critical 1). A `switch`'s `default` arm is not textually last — no longer a silent dead-code trap (`default` is lowered last regardless of source position, `Ast.switch_lowering_order`), but still surprising source; fired once per switch, at `default`'s own position. | `` `default` is not the last arm -- a `case` written after it still matches (this compiler evaluates `default` last regardless of source position), which reads as dead code `` |
 
@@ -163,3 +180,15 @@ enumeration, not a dig: `diag.ml` already reserves the numeric ranges,
 so the only open question per stage was *which* reserved codes actually
 fire — answered by exhaustive grep, not inspection of a handful of
 samples.
+
+**The method is sound; re-running it is the maintenance.** The sweep was
+not repeated between plan 3 and 2026-08-26, and eight codes accumulated
+outside the table in that window (WO-E003, E108, E109, E219–E223, E226,
+E250) — one of them, WO-E250, the only diagnostic the entire shipped query
+surface raises. Note the extra indirection the re-sweep had to follow:
+codes are built as `<stage>_prefix ^ "NN"`, so a grep for the literal
+string `WO-E250` finds only the comment beside the constant, never the
+emission. Sweep for `_prefix ^ "` and resolve each constant, plus the
+handful of driver codes that `Printf.eprintf` a literal `WO-E1NN` and exit
+2 without touching the collector at all (WO-E106/E107/E109). Any iteration
+that adds a code adds its row here in the same change.
diff --git a/docs/plan/oop-vm/03-concurrency-coroutines.md b/docs/plan/oop-vm/03-concurrency-coroutines.md
index 2c6d3f6..2470b38 100644
--- a/docs/plan/oop-vm/03-concurrency-coroutines.md
+++ b/docs/plan/oop-vm/03-concurrency-coroutines.md
@@ -145,8 +145,8 @@ stop is not a trap and cannot be caught.
 | concern | where it is normative |
 | --- | --- |
 | shards, envelopes, ownership-move sends, WO-E221/E222, placement | [arc spec](../../superpowers/specs/2026-08-20-shard-fiber-arc-design.md) + [arc plan deviations](../../superpowers/plans/2026-08-20-shard-fiber-arc.md) |
-| request/response, bounded mailboxes, actor death, timers | [iteration 31](../../stories/language-runtime-database/refine/31-actor-lifecycle.md) — not built yet |
-| the DB actor (stage 3) | [story 8's guarantee contract](../../stories/language-runtime-database/done/08-shard-actor-runtime.md) — landed 2026-08-21 |
+| request/response, bounded mailboxes, actor death, timers | [iteration 31](../../stories/language-runtime-database/31-actor-lifecycle.md) — not built yet |
+| the DB actor (stage 3) | [story 8's guarantee contract](../../stories/language-runtime-database/08-shard-actor-runtime.md) — landed 2026-08-21 |
 | builtin ids and their park behavior | [`08-builtin-surface.md`](08-builtin-surface.md) |
 
 ## 7. Rejected alternatives — settled, argue against the reason
diff --git a/docs/plan/oop-vm/08-builtin-surface.md b/docs/plan/oop-vm/08-builtin-surface.md
index ec4f0c3..8b624fa 100644
--- a/docs/plan/oop-vm/08-builtin-surface.md
+++ b/docs/plan/oop-vm/08-builtin-surface.md
@@ -182,6 +182,8 @@ Lowered by the emitter, not added to the format:
 | `a > b`, `a >= b` | `LT` / `LE` with the operands swapped |
 | `a == b` on `Text` | `EQS` (content equality); `EQ` otherwise |
 | `a .. b` | `CONCAT` — `+` is arithmetic only, never string addition |
+| `` `...${e}...` `` | the same `StrLit`/`Interp`/`CONCAT` chain a `"..."` string produces — the raw literal is a LEXER form (verbatim content, common margin removed at lex time), not a new node or opcode |
+| `` `...{{ e }}...` `` | `esc(${e})` — the parser wraps the interpolation in a call to whatever `esc` is in scope (writeonce-view's `pub fn esc`, or a local one that deliberately shadows it). No builtin, no opcode, no HTML knowledge in the compiler or the VM |
 | `a and b` | evaluate `a`; `JZ` past evaluating `b` (result stays `a`'s value); else evaluate `b` into the same register (haxe-parity Task 2) |
 | `a or b` | evaluate `a`; `JZ` + `JMP` past evaluating `b` when `a` is already true; else evaluate `b` (haxe-parity Task 2) |
 
diff --git a/docs/stories/00-status.md b/docs/stories/00-status.md
index c38305c..8ca6f94 100644
--- a/docs/stories/00-status.md
+++ b/docs/stories/00-status.md
@@ -7,38 +7,147 @@ incoming arrows is startable. This board carries the STATES.
 The single place to learn where this project stands. Organised in six buckets:
 **stories** (the narrative arc), **in progress**, **done**, **pending**,
 **discarded**, **learnings**. The buckets are **sections of this board, not
-folders** — a doc stays where it was authored when its work lands; only its
-banner and this board change. ONE exception by directive (2026-08-20):
-story iteration files move physically — landed ones into
-`stories/language-runtime-database/done/`, brainstorm-needing ones into
-`refine/`, held ones into `hold/`, the active slice's stories into
-`stories/language-runtime-database/in-progress/` (both 2026-08-21);
-ready ones stay at the root. Second exception (2026-08-21): the active
-slice's one marker doc lives in `docs/in-progress/` and is deleted when
-the slice lands. Every plan and phase doc opens with a
-`> **Status:**` banner linking back here; normative contracts
-(`plan/oop-vm/`), exploration studies, reference docs and the
-discarded/learnings registers carry none by design.
+folders** — a doc stays where it was authored, and only its frontmatter, its
+banner and this board change.
 
-Update this board in the same change that finishes work — move the item to done
-with _what actually landed_, set the next in-progress item, and record any
-rejection in [`discarded.md`](../plan/discarded.md) with its reason.
+**Three tracks** (2026-08-26):
+[`language-runtime-database/`](language-runtime-database/00-story.md) — the
+language and runtime; [`porch/`](porch/00-story.md) — the web framework written
+in it; [`databasev2/`](databasev2/00-story.md) — the database beyond RAM. Each
+numbers its iterations from 1, so a porch 3 is not a language 3; every non-language
+story carries `track:` in frontmatter, and moved ones keep
+`was_language_iteration:` so a search for the old number still finds them. Track
+folders are fine; **status** folders are not.
 
-Statuses: ✅ **done** · 🔄 **in progress** · ⬜ **pending** · ⏸ **hold**
+**Status lives in frontmatter, nowhere else** (directive 2026-08-26). Every
+story iteration file sits flat in its track folder and
+carries `status:` in its YAML header; the active slice's marker doc sits flat
+in `docs/`. **No directory anywhere encodes state.** This replaces the
+2026-08-20/21 convention under which files moved between `done/`, `refine/`,
+`hold/` and `in-progress/` — those folders are gone. A status change is now a
+one-line edit, not a move, which is the point: the old scheme broke every
+relative link in and to a file each time its status changed, and the two link
+audits ([`00-link-audit.md`](../00-link-audit.md)) were mostly that.
 
-Story files carry YAML frontmatter (`iteration`/`status`/`chain`) — the
-machine-readable truth behind this board; live Obsidian Dataview views:
+Every plan and phase doc opens with a `> **Status:**` banner linking back here;
+normative contracts (`plan/oop-vm/`), exploration studies, reference docs and
+the discarded/learnings registers carry none by design.
+
+Update this board in the same change that finishes work — set the item's
+`status:`, record _what actually landed_ here, set the next in-progress item,
+and record any rejection in [`discarded.md`](../plan/discarded.md) with its
+reason.
+
+Statuses, the closed set `status:` may take: `done` · `in-progress` · `refine`
+(needs a brainstorm before it can be planned) · `hold`. This board renders them
+as ✅ **done** · 🔄 **in progress** · ⬜ **pending** · ⏸ **hold**.
+
+Story frontmatter (`iteration`/`status`/`chain`) is the machine-readable truth
+behind this board; live Obsidian Dataview views:
 [`board-views.md`](board-views.md) (Kanban = view only, never edits status).
 
 ---
 
 ## ▶ NEXT PLAN
 
-**The concurrency + fiber chain — ✅ stage 3 → ✅ 22 → 31 → 24 → 23 → 32**
-(directive 2026-08-21). Next slice: **iteration 31, actor lifecycle** —
-its spec brainstorm is the next act (four forks in
-[the story](language-runtime-database/refine/31-actor-lifecycle.md);
-the mailbox-cap/ring decisions now HAVE their mutex-inbox number).
+### Landed 2026-08-25 — packaging + release pipeline (off-chain, no story)
+
+**Implemented last time (2026-08-25):** the toolchain became installable
+by a stranger. `VERSION` as the single source (0.1.0, asserted against
+both binaries by `scripts/mkdist.sh`), `just dist` producing
+`writeonce-<ver>-linux-amd64.tar.gz` + `.sha256` with
+`scripts/install-readme.tmpl.md` inside it, `just install-accept`
+proving a from-scratch project builds against the extracted tarball's
+own binaries, and `.github/workflows/release.yml` publishing on a `v*`
+tag push. Runbook: [`guides/releasing.md`](../guides/releasing.md).
+
+**Key findings (measured, not asserted):** the build host's glibc caps
+what the shipped binaries can import, and that cap becomes every user's
+floor — so `runs-on` is `ubuntu-22.04` (2.35) deliberately, not
+`ubuntu-latest`; built on this dev machine the binaries need
+`GLIBC_2.38`, which would silently exclude Ubuntu 22.04, Debian 12 and
+RHEL 9. `ocaml/setup-ocaml@v3` gives a compiler and opam but **not**
+dune, and pinning `dune.3.14.0` is a downgrade the solver refuses — take
+whatever it provides, since any dune ≥ 3.14 satisfies `(lang dune 3.14)`.
+
+**Learned:** the asset filename is load-bearing. `/install` links one
+exact URL, so the workflow asserts tag = `VERSION` = asset name and
+fails rather than publishing a download button that 404s. A measurement
+that only prints is not a gate — the glibc floor is printed from the
+artefact about to ship, so the claim on the page can be checked against
+a build log instead of trusted.
+
+**Dependencies unblocked:** nothing in the chain; this is the
+distribution seam. It does make `docs/examples/site`'s `/install` page
+truthful, which iteration 37's site restructure had left pointing at an
+asset nobody had built.
+
+**Next steps:** the live slice is iteration 24, untouched by this. CI is
+release-only — no workflow runs the gates per change, which remains the
+open half of iteration 30 (observability, CI, fuzz — still no story
+file).
+
+**`.dev/reference` used:** none — GitHub Actions' own docs and the
+runner images' glibc versions were the only sources.
+
+---
+
+### Landed 2026-08-25 — iteration 37, wo-html components (off-chain)
+
+**Implemented last time (2026-08-25):** iteration 37 CLOSED, both
+halves. The grammar half (2026-08-24) added the backtick raw text
+literal — content verbatim, common margin removed at lex time, `${ }`
+raw and `{{ }}` compiling to a call on the `esc` in scope — plus
+WO-E004/WO-E005. The library half (2026-08-25) added `Component`,
+`render_all` and `Layout` to wo-html, moved `ok_html` into
+`framework/http` beside `ok_text`/`ok_json`, and migrated BOTH HTML
+samples onto the component layer.
+
+**Key findings (measured, not asserted):** `multi Component` holds a
+heterogeneous list DIRECTLY — no wrapper record — so the framework's
+`Mw`/`Aw` shape is a local choice, not a language requirement; that is
+what made page components able to own their children. The whole
+escaping desugar needed zero compiler knowledge of HTML: `{{ e }}` is a
+`Call` on an ordinary in-scope `esc`, so typecheck, ownership, codegen,
+the `.wob` format and the VM were all untouched. `{{ }}` was proven
+byte-identical to the hand-written `esc()` calls it replaced, hostile
+input (`< > & "`) included, across all eight migrated builders.
+
+**Learned:** an interface that nothing consumes as a TYPE is
+decoration — `Component` only started earning its place once
+`render_all` and the page components held `multi Component`. And the
+shop template DOES build and run — an earlier note in this repo had that
+wrong, and wrong again about why: gap #1 (`pub` + `@table`) constrains
+neither the build NOR the layout. A class crosses module lines without
+export; only a free `fn` is module-scoped (`WO-E210`).
+
+**Dependencies unblocked:** shop README gap #3 ("no multi-line
+expression or literal") is closed. Separate `.html` templates, if ever
+wanted, now have exactly one honest shape — a COMPILE-TIME include
+feeding the raw-literal machinery; a per-request file read is the
+already-rejected engine.
+
+**Next steps:** the concurrency chain below is untouched by this and
+remains the live queue.
+
+**`.dev/reference` used:** none this slice (Angular's component format
+was studied from its public docs during the 2026-08-23 story write-up;
+no reference project was consulted for the implementation).
+
+---
+
+**The concurrency + fiber chain — ✅ stage 3 → ✅ 22 → 🔄 24 (absorbing
+31 + 34) → 23 → 32.** The chain's original order put 31 before 24; the
+2026-08-23 directive absorbed 31 INTO 24, and 34 resolved with it, so
+those three are one slice. **The live slice is iteration 24** — spec and
+plan approved 2026-08-23, executing on branch `chat-ws-lifecycle`, five
+of ten tasks landed. Its running state is the marker doc
+([`2026-08-23-chat-ws-lifecycle.md`](../active-slice-2026-08-23-chat-ws-lifecycle.md)),
+which is the file to read for what is done and what is next; stories
+[31](language-runtime-database/31-actor-lifecycle.md) and
+[34](language-runtime-database/34-crypto-builtins.md) keep
+`status: refine` until 24's T10 closeout sets all three to `status: done`
+together.
 
 **Implemented last time (2026-08-21):** **iteration 22 landed — the
 measurement backbone exists and every performance claim is now
@@ -78,7 +187,9 @@ numbers need a real disk.
 machinery), and every future optimization (the gate that catches
 regressions is live).
 
-**Next steps:** 31 (lifecycle spec brainstorm) → 24 (chat) → 23
+**Next steps:** finish 24 (T4 `monitor` id 89, T5 `time.after` id 90 —
+both still literal holes in `wob.h`'s builtin enum; then T8 the chat
+sample, T9 its gate, T10 closeout setting 24/31/34 to `status: done`) → 23
 (io_uring group-commit — target: close the 4.5k→297k durable gap) →
 32 (WAL checkpoint). Held tail resumes on its own precedence notes.
 
@@ -124,7 +235,7 @@ sees through Interp; same corpus pin). Body-parsing hooks: all three ✅.
 
 Scope split (2026-08-20): the surface above plus the remaining transport/
 routing/security gaps is **framework v1**, tracked item-by-item in the
-[framework README's status ledger](../examples/writeonce-framework/README.md)
+[framework README's status ledger](../examples/porch/README.md)
 (✅/🔶/⬜/⏸/🔧 per feature — timeouts and Unix sockets need `net` runtime
 seams, crypto hashes need C builtins since the language has no bitwise
 operators, streaming/cancellation park behind 8/11). The memory-rich
@@ -190,7 +301,7 @@ itself, and all six landed:
    quarantine warm-up.
 
 Plan: [`plan/compiler/2026-08-14-logwatcher-executable.md`](../plan/compiler/2026-08-14-logwatcher-executable.md) ·
-Story slice: [`docs/stories/language-runtime-database/done/07-logwatcher-proof.md`](language-runtime-database/done/07-logwatcher-proof.md)
+Story slice: [`docs/stories/language-runtime-database/07-logwatcher-proof.md`](language-runtime-database/07-logwatcher-proof.md)
 
 **Deferred by name, with the measurement that says so:**
 
@@ -224,38 +335,41 @@ that sequences its tasks. Read one, approve, then the next starts.
 
 | #   | Iteration                                                                                    | State                        |
 | --- | -------------------------------------------------------------------------------------------- | ---------------------------- | ---- |
-| 1   | [Principles doc](language-runtime-database/done/01-principles-doc.md)                     | ✅                           |
-| 2   | [VM core (`wovm`)](language-runtime-database/done/02-vm-core.md)                          | ✅                           |
-| 3   | [Compiler front (`woc`)](language-runtime-database/done/03-compiler-front.md)             | ✅ (known gaps below)        |
-| 4   | [Single binary end-to-end](language-runtime-database/done/04-single-binary-e2e.md)        | ✅ (known gaps below)        |
-| 5   | [Language surface](language-runtime-database/done/05-language-surface.md)                 | 🔄 grammar done; **`?T` forced handling ✅ + reject rows ✅ + WO-E205 ✅ (2026-08-18)**; `pub(read)`/`using`/`#if` still ⏸ |
-| 6   | [Program mode + stdlib](language-runtime-database/done/06-program-mode-stdlib.md)         | ✅ (the surface log-watcher uses) |
-| 7   | [log-watcher proof](language-runtime-database/done/07-logwatcher-proof.md)                | ✅ **landed 2026-08-15** — executable, not merely compilable: zero ASan leaks in all three modes, SIGTERM ends parked syscalls, fds flat, `LW_SOAK` gate; `just log-watcher` 7/0 |
-| 7b  | [Inferred GC + mark-sweep](language-runtime-database/done/07b-inferred-gc-mark-sweep.md)  | ✅ **landed 2026-08-18** — `@gc` gone (WO-E104), GC-ness inferred, RC replaced by incremental mark-sweep, `.wob` v4; supersedes iteration 2's RC memory model |
-| 8   | [Shard-actor runtime](language-runtime-database/done/08-shard-actor-runtime.md)           | ✅ **landed 2026-08-21** — the arc complete: stages 1+2 (fibers/budget/actors/io_uring plane, shards, envelopes, WO-E222) + stage 3's transparent DB actor (`just db-actor` 8/0, ASan/TSan clean, WAL replay pair) |
-| 9   | [Database engine](language-runtime-database/done/09-database-engine.md)                   | 🔄 engine complete (storage/WAL/indexes/insert-update-delete); reads land with 9b |
-| 9b  | [`@table`, relations, query](language-runtime-database/done/09b-table-relations-query.md) | 🔄 query surface + relations + FK done (branch query-surface); group-by parked |
-| 19  | [Float + Bytes](language-runtime-database/done/19-missing-scalar-types.md) | ✅ **landed 2026-08-20** — `.wob` v5: Float constant tag, field kinds 6/7, opcodes 34-41 (IEEE-quiet f64), builtins 70-83. Full stack: literals, arithmetic, `@table` column, WAL bit-exact replay, json fractions in / shortest-round-trip out, `?Float` reserved-NaN nil, total-order index (NaN last, `-0.0` == `+0.0`), Bytes + base64. No implicit Int/Float mixing (WO-E201); `float`/`trunc` are the only bridges. Proof: web-app price is a real Float (`{"price":9.99}`), `just web-app` 23/0; corpus 103/0 |
-| 11  | [Fibers](language-runtime-database/done/11-fibers.md)                                     | ✅ **landed 2026-08-21** with the arc (`just fibers` 10/0); fs-park re-scoped out of v1, disclosed in the story |
-| 22  | [Durability, throughput, scale](language-runtime-database/done/22-durability-throughput-scale.md) | ✅ **landed 2026-08-21** — db-bench + baseline.json (74 metrics) + restart/kill -9 proofs both shard counts; durable 4.5k vs ram 297k inserts/s, reads O(table), msgrate 13.4M/2.45M |
-| 31  | [Actor lifecycle](language-runtime-database/refine/31-actor-lifecycle.md) | ⬜ needs a spec first — third in chain (story written 2026-08-21) |
-| 24  | [chat: WebSocket workload](language-runtime-database/refine/24-chat-websocket-workload.md) | ⬜ fourth in chain — the arc's acceptance; after 31 |
-| 23  | [io_uring group-commit](language-runtime-database/refine/23-io-uring-commit.md)            | ⬜ fifth in chain, after stage 3 + 22 |
-| 32  | [WAL checkpoint](language-runtime-database/refine/32-wal-checkpoint.md)            | ⬜ last in chain, after 23 — disk reclamation + bounded replay (story written 2026-08-21) |
-| 33  | [Single-file store](language-runtime-database/refine/33-single-file-db.md)            | ⬜ off-chain, small — `WO_DATA=<path>.db` file form; driver-only (story written 2026-08-22) |
-| 34  | [Crypto builtins](language-runtime-database/refine/34-crypto-builtins.md)            | ⬜ off-chain but GATES 24 (WS handshake needs SHA-1) — digests + HMAC as vector-verified C builtins (story written 2026-08-22) |
-| 35  | [net runtime seams](language-runtime-database/refine/35-net-runtime-seams.md)            | ⬜ off-chain — fd deadlines on the park plane, Unix sockets, peer address; owns the ledger's three 🔧 rows (story written 2026-08-22) |
-| 20  | [Cross-program tables](language-runtime-database/hold/20-cross-program-tables.md)        | ⏸ hold (2026-08-21); channel done (branch ipc-attach keeps its manifest) |
-| 21  | [Keypair attach auth](language-runtime-database/hold/21-keypair-attach-auth.md)          | ⏸ hold (2026-08-21); crypto+handshake done (branch keypair-auth keeps its manifest) |
+| 1   | [Principles doc](language-runtime-database/01-principles-doc.md)                     | ✅                           |
+| 2   | [VM core (`wovm`)](language-runtime-database/02-vm-core.md)                          | ✅                           |
+| 3   | [Compiler front (`woc`)](language-runtime-database/03-compiler-front.md)             | ✅ (known gaps below)        |
+| 4   | [Single binary end-to-end](language-runtime-database/04-single-binary-e2e.md)        | ✅ (known gaps below)        |
+| 5   | [Language surface](language-runtime-database/05-language-surface.md)                 | 🔄 grammar done; **`?T` forced handling ✅ + reject rows ✅ + WO-E205 ✅ (2026-08-18)**; `pub(read)`/`using`/`#if` still ⏸ |
+| 6   | [Program mode + stdlib](language-runtime-database/06-program-mode-stdlib.md)         | ✅ (the surface log-watcher uses) |
+| 7   | [log-watcher proof](language-runtime-database/07-logwatcher-proof.md)                | ✅ **landed 2026-08-15** — executable, not merely compilable: zero ASan leaks in all three modes, SIGTERM ends parked syscalls, fds flat, `LW_SOAK` gate; `just log-watcher` 7/0 |
+| 7b  | [Inferred GC + mark-sweep](language-runtime-database/07b-inferred-gc-mark-sweep.md)  | ✅ **landed 2026-08-18** — `@gc` gone (WO-E104), GC-ness inferred, RC replaced by incremental mark-sweep, `.wob` v4; supersedes iteration 2's RC memory model |
+| 8   | [Shard-actor runtime](language-runtime-database/08-shard-actor-runtime.md)           | ✅ **landed 2026-08-21** — the arc complete: stages 1+2 (fibers/budget/actors/io_uring plane, shards, envelopes, WO-E222) + stage 3's transparent DB actor (`just db-actor` 8/0, ASan/TSan clean, WAL replay pair) |
+| 9   | [Database engine](language-runtime-database/09-database-engine.md)                   | 🔄 engine complete (storage/WAL/indexes/insert-update-delete); reads land with 9b |
+| 9b  | [`@table`, relations, query](language-runtime-database/09b-table-relations-query.md) | 🔄 query surface + relations + FK done (branch query-surface); group-by parked |
+| 19  | [Float + Bytes](language-runtime-database/19-missing-scalar-types.md) | ✅ **landed 2026-08-20** — `.wob` v5: Float constant tag, field kinds 6/7, opcodes 34-41 (IEEE-quiet f64), builtins 70-83. Full stack: literals, arithmetic, `@table` column, WAL bit-exact replay, json fractions in / shortest-round-trip out, `?Float` reserved-NaN nil, total-order index (NaN last, `-0.0` == `+0.0`), Bytes + base64. No implicit Int/Float mixing (WO-E201); `float`/`trunc` are the only bridges. Proof: web-app price is a real Float (`{"price":9.99}`), `just web-app` 23/0; corpus 103/0 |
+| 11  | [Fibers](language-runtime-database/11-fibers.md)                                     | ✅ **landed 2026-08-21** with the arc (`just fibers` 10/0); fs-park re-scoped out of v1, disclosed in the story |
+| 22  | [Durability, throughput, scale](language-runtime-database/22-durability-throughput-scale.md) | ✅ **landed 2026-08-21** — db-bench + baseline.json (74 metrics) + restart/kill -9 proofs both shard counts; durable 4.5k vs ram 297k inserts/s, reads O(table), msgrate 13.4M/2.45M |
+| 31  | [Actor lifecycle](language-runtime-database/31-actor-lifecycle.md) | 🔄 **absorbed into 24** (directive 2026-08-23) and half landed there: `call` request/response with a typed scalar reply (`WO_B_CALL = 88`, WO-E226), bounded mailboxes (`WO_MAILBOX`, cap 1024, catchable `WO_T_ACTOR`), and actor death that traps callers instead of hanging them. Still open: `monitor` and `time.after` — ids **89 and 90 are reserved holes** in `wob.h`, which is the machine-checkable proof of what is left. Supervision trees stay out of v1 |
+| 24  | [chat: WebSocket workload](language-runtime-database/24-chat-websocket-workload.md) | 🔄 **the live slice** (absorbing 31 + 34, directive 2026-08-23) — branch `chat-ws-lifecycle`, 5/10 tasks landed: crypto, bounded mailboxes, WS upgrade, frame codec, `call`/reply + actor death. Pending: `monitor`, `time.after`, the chat sample, its gate, closeout. State lives in [the marker](../active-slice-2026-08-23-chat-ws-lifecycle.md) |
+| 23  | [io_uring group-commit](databasev2/04-io-uring-commit.md)            | ⬜ fifth in chain, after stage 3 + 22 |
+| 32  | [WAL checkpoint](databasev2/03-wal-checkpoint.md)            | ⬜ last in chain, after 23 — disk reclamation + bounded replay (story written 2026-08-21) |
+| 33  | [Single-file store](databasev2/07-single-file-db.md)            | ⬜ off-chain, small — `WO_DATA=<path>.db` file form; driver-only (story written 2026-08-22) |
+| 34  | [Crypto builtins](language-runtime-database/34-crypto-builtins.md)            | 🔄 **code landed** as 24's T1 (`d14fa9f`): `sha1`/`sha256`/`hmac_sha256`, ids 85–87 in `wob.h`, `runtime/src/crypto.c`, RFC/FIPS vectors 18/0, corpus pin. The 24 gate that once needed it is cleared. Frontmatter keeps `status: refine` only until 24's T10 closeout sets it to `done` |
+| 38  | [Content platform capabilities](language-runtime-database/38-content-platform-capabilities.md) | ⬜ off-chain, needs a spec — the two capability families no iteration owns, confirmed against `runtime/src/wob.h`: `fs` mutation verbs (six fs builtins, ids 40–45; `append` creates-if-absent, so nothing is ever replaced, truncated, deleted or renamed) and `net.connect` (ids 51–55 + 91–95, no connect, and no `connect()` anywhere in `runtime/src/` — so no OIDC/SMTP/object-store/webhook/federation). Driven by a `docs/examples/vault` content-collaboration workload, in 28's mould. New builtins from 96 (89/90 reserved for 31); no `.wob` bump (`WOB_VERSION 6u`, last moved by 36). Story written 2026-08-26 from the "can it build a Nextcloud?" ask |
+| 39  | [Web framework parity](language-runtime-database/39-web-framework-parity.md) | ⬜ off-chain, needs a spec — from [the Fiber v3.5.0 study](../plan/exploration/fiber/00-fiber-parity.md) (all 32 of its middleware read against `porch`; **nine already have a counterpart**). Leads with a **random-bytes builtin**: the framework ledger claimed CSRF/sessions were unblocked by iteration 34's HMAC, but HMAC authenticates a token and cannot mint one — there is no RNG anywhere in the runtime. Then cookies (absent both ways; `Resp.headers` being a map cannot carry two `Set-Cookie` lines), then limiter/idempotency (cheapest wins — `@table` + `time.ticks`, nothing new), sessions, CSRF, and the routing/response sugar. Streaming/SSE/compression, `@derive` binding, TTL cache, `proxy` and metrics all excluded with owners named |
+| 37  | [wo-html components](language-runtime-database/37-wo-html-components.md) | ✅ off-chain — LANDED 2026-08-25. Raw text literal (backtick, margin stripped at lex time, `{{ }}` auto-escapes) + the component layer: `Component`/`render_all`/`Layout` in wo-html, `ok_html` moved into the framework, site and shop both migrated |
+| 35  | [net runtime seams](language-runtime-database/35-net-runtime-seams.md)            | ⬜ off-chain — fd deadlines on the park plane, Unix sockets, peer address; owns the ledger's three 🔧 rows (story written 2026-08-22) |
+| 20  | [Cross-program tables](databasev2/09-cross-program-tables.md)        | ⏸ hold (2026-08-21); channel done (branch ipc-attach keeps its manifest) |
+| 21  | [Keypair attach auth](databasev2/10-keypair-attach-auth.md)          | ⏸ hold (2026-08-21); crypto+handshake done (branch keypair-auth keeps its manifest) |
 | 25  | [HTTP service layer](../superpowers/plans/2026-08-01-http-service-layer.md)                   | ⏸ hold (2026-08-21) — story file removed; the plan doc remains |
-| 26  | [Blue-green deploy](language-runtime-database/hold/26-blue-green-deploy.md)               | ⏸ hold (2026-08-21)          |
-| 27  | [Query grammar corpus](language-runtime-database/hold/27-query-grammar-corpus.md) | ⏸ hold (2026-08-21)          |
-| 28  | [skillhost host workload](language-runtime-database/hold/28-skillhost-host-workload.md) | ⏸ hold (2026-08-21); gaps recorded (branch query-grammar found skillhost needs no new query grammar) |
-| 29  | [Compile-time metaprogramming](language-runtime-database/hold/29-compile-time-metaprogramming.md) | ⏸ hold (2026-08-21)          |
-| 15  | [deps: `wo.toml [deps]`](language-runtime-database/done/15-deps-package-manager.md) | ✅ **landed 2026-08-18** (branch web-framework): [deps] inline tables, git-binary fetch, wo.lock pinning, offline-when-locked, --update-deps, WO-E106/E107; `just deps-accept` 8/0 |
-| 16  | [web framework](language-runtime-database/done/16-web-framework.md) | ✅ **landed 2026-08-19** — writeonce-framework (HTTP/1.1 + router + Handler/Middleware) consumed by web-app through [deps]; h2c parked (§C) behind 8/23/11. **v1 polish landed 2026-08-20** (branch framework-v1): get/post/put/delete_ helpers, 405+Allow, HEAD, Logging middleware, set_header; `just web-app` 16/0; fixed the interp-borrowed-field emitter crash en route. **Auth-in-core landed 2026-08-20**: http/auth.wo (Bearer/Basic, ct_eq, req.principal), web-app dogfoods BearerAuth, gate 17/0 |
-| 17  | [library projects + `internal/`](language-runtime-database/done/17-library-projects-internal.md) | ✅ **landed 2026-08-20** — `kind = "library"` in `wo.toml` (default `program`, so every existing manifest is byte-identical; unknown value = WO-E109 exit 2); `woc <dir>` on a library runs the FULL pipeline entry-less and writes nothing, retiring iteration 16's `--emit` workaround; the no-entry build error names the kind; lib+bin dual works. Go's `internal/` rule as **WO-E108** at the consumer's own `use`, dep-boundary-only — the library imports its own interior freely. Framework reorganized: `internal/{parse,serve}.wo` behind the line, `http/form.wo` split out to keep `media_type`/`form_values` public. Driver-only change; VM/`.wob`/GC untouched. `just web-app` **26/0** (3 new checks), every standing gate unchanged |
-| 18  | [framework v2: memory-rich features](language-runtime-database/hold/18-memory-db-features.md) | ⏸ hold (2026-08-21); spec approved + plan authored, both held intact ([spec](../superpowers/specs/2026-08-20-memory-db-features-design.md), [plan](../superpowers/plans/2026-08-20-framework-v2-memory-features.md)): TTL cache + @table flags + durable job queue (drain-on-request) + `transaction { }` over the WAL's staged batch; pub/sub rejection expired with the arc (8/11 landed 2026-08-21) — revisit on unhold |
+| 26  | [Blue-green deploy](language-runtime-database/26-blue-green-deploy.md)               | ⏸ hold (2026-08-21)          |
+| 27  | [Query grammar corpus](databasev2/08-query-grammar-corpus.md) | ⏸ hold (2026-08-21)          |
+| 28  | [skillhost host workload](language-runtime-database/28-skillhost-host-workload.md) | ⏸ hold (2026-08-21); gaps recorded (branch query-grammar found skillhost needs no new query grammar) |
+| 29  | [Compile-time metaprogramming](language-runtime-database/29-compile-time-metaprogramming.md) | ⏸ hold (2026-08-21)          |
+| 15  | [deps: `wo.toml [deps]`](language-runtime-database/15-deps-package-manager.md) | ✅ **landed 2026-08-18** (branch web-framework): [deps] inline tables, git-binary fetch, wo.lock pinning, offline-when-locked, --update-deps, WO-E106/E107; `just deps-accept` 8/0 |
+| 16  | [web framework](language-runtime-database/16-web-framework.md) | ✅ **landed 2026-08-19** — writeonce-framework (HTTP/1.1 + router + Handler/Middleware) consumed by web-app through [deps]; h2c parked (§C) behind 8/23/11. **v1 polish landed 2026-08-20** (branch framework-v1): get/post/put/delete_ helpers, 405+Allow, HEAD, Logging middleware, set_header; `just web-app` 16/0; fixed the interp-borrowed-field emitter crash en route. **Auth-in-core landed 2026-08-20**: http/auth.wo (Bearer/Basic, ct_eq, req.principal), web-app dogfoods BearerAuth, gate 17/0 |
+| 17  | [library projects + `internal/`](language-runtime-database/17-library-projects-internal.md) | ✅ **landed 2026-08-20** — `kind = "library"` in `wo.toml` (default `program`, so every existing manifest is byte-identical; unknown value = WO-E109 exit 2); `woc <dir>` on a library runs the FULL pipeline entry-less and writes nothing, retiring iteration 16's `--emit` workaround; the no-entry build error names the kind; lib+bin dual works. Go's `internal/` rule as **WO-E108** at the consumer's own `use`, dep-boundary-only — the library imports its own interior freely. Framework reorganized: `internal/{parse,serve}.wo` behind the line, `http/form.wo` split out to keep `media_type`/`form_values` public. Driver-only change; VM/`.wob`/GC untouched. `just web-app` **26/0** (3 new checks), every standing gate unchanged |
+| 18  | [framework v2: memory-rich features](language-runtime-database/18-memory-db-features.md) | ⏸ hold (2026-08-21); spec approved + plan authored, both held intact ([spec](../superpowers/specs/2026-08-20-memory-db-features-design.md), [plan](../superpowers/plans/2026-08-20-framework-v2-memory-features.md)): TTL cache + @table flags + durable job queue (drain-on-request) + `transaction { }` over the WAL's staged batch; pub/sub rejection expired with the arc (8/11 landed 2026-08-21) — revisit on unhold |
 
 ---
 
@@ -263,14 +377,16 @@ that sequences its tasks. Read one, approve, then the next starts.
 
 | Track    | Item                                                                        | Where                                                      |
 | -------- | --------------------------------------------------------------------------- | ---------------------------------------------------------- |
-| Language | 🔄 [iteration 36 — operator parity](language-runtime-database/in-progress/36-operator-parity.md): `not`, bitwise `& \| ^ << >>`, hex/binary/`_` literals, compound assigns — CODE LANDED 2026-08-22 (branch operator-parity, `.wob` v6, all gates green; reference project `.dev/reference/go` drove the design). Awaiting the developer's MANUAL pass on `docs/examples/operators/` (no test fixtures by directive); unblocks story 34's pure-`.wo` HMAC question | [plan](../superpowers/plans/2026-08-22-operator-parity.md) |
+| Language | 🔄 [iteration 36 — operator parity](language-runtime-database/36-operator-parity.md): `not`, bitwise `& \| ^ << >>`, hex/binary/`_` literals, compound assigns — CODE LANDED 2026-08-22 (branch operator-parity, `.wob` v6, all gates green; reference project `.dev/reference/go` drove the design). Awaiting the developer's MANUAL pass on `docs/examples/operators/` (no test fixtures by directive); unblocks story 34's pure-`.wo` HMAC question | [plan](../superpowers/plans/2026-08-22-operator-parity.md) |
 | Language | the framework v1-polish slice landed 2026-08-20 (branch framework-v1, awaiting merge); next per the order: brainstorm 20/21's forks | [order](#implementation-order-re-sequenced-2026-08-21--concurrency-chain) |
 | Runtime  | ✅ **iteration 35 landed 2026-08-23** (branch `framework-v1b`, with framework v1 slice 2 + the serving slice): net deadlines/unix/peer (ids 91–95), fiber pooling, serve_conn + web-app fiber-per-connection — web-app gate 41/0, both WO_IO backends | [design](../superpowers/specs/2026-08-23-net-seams-park-design.md) |
-| Runtime  | 🔄 **iteration 24 (absorbing 31 + 34): chat + actor lifecycle** — spec + plan approved 2026-08-23 (24 absorbs 31 by directive; 34 resolved C-builtins); executing on branch `chat-ws-lifecycle` | [marker](../in-progress/2026-08-23-chat-ws-lifecycle.md) · [plan](../superpowers/plans/2026-08-23-chat-ws-lifecycle.md) |
+| Runtime  | 🔄 **iteration 24 (absorbing 31 + 34): chat + actor lifecycle** — spec + plan approved 2026-08-23 (24 absorbs 31 by directive; 34 resolved C-builtins); executing on branch `chat-ws-lifecycle` | [marker](../active-slice-2026-08-23-chat-ws-lifecycle.md) · [plan](../superpowers/plans/2026-08-23-chat-ws-lifecycle.md) |
 
-The active slice's marker doc lives in [`in-progress/`](../in-progress/) —
-one file, deleted when the slice lands. Everything else pending is the
-concurrency chain (see *Pending* below); the held tail is in `hold/`.
+The active slice's marker doc is
+[`docs/active-slice-2026-08-23-chat-ws-lifecycle.md`](../active-slice-2026-08-23-chat-ws-lifecycle.md)
+— one file, deleted when the slice lands. Everything else pending is the
+concurrency chain (see *Pending* below); the held tail is every story
+whose frontmatter reads `status: hold`.
 
 ### Landed 2026-08-14 — the compile-and-run milestone
 
@@ -315,6 +431,7 @@ Gates at the end of that session: corpus 71/0, `woc` runtest 565/0, every
 
 | Status | Item                                 | Doc                                                              | What actually landed                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
 | ------ | ------------------------------------ | ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ✅ | iteration 37 — wo-html components | [37](language-runtime-database/37-wo-html-components.md) | Two halves. **Grammar (2026-08-24):** the backtick raw text literal — content verbatim, common margin removed at lex time, `${ }` raw and `{{ }}` auto-escaping to a call on the `esc` in scope; WO-E004/WO-E005 added; lexer + one parser desugar only, nothing downstream. **Library (2026-08-25):** `Component`/`render_all`/`Layout` in wo-html, `ok_html` moved into `framework/http` beside `ok_text`/`ok_json`, site migrated onto `Layout` + a reused `ChapterNav`, shop onto `AppShell` + `multi Component` children with queries in the controllers; the site was then restructured onto the program template's MVC layout (model / layout / view modules / one controller per feature / bootstrap-only main). `multi Component` needs no wrapper record — the framework's Mw/Aw shape is not a language requirement. Gates: `just site` 11/0, `just web-app` 46/0, `woc-test` 556/0, `oop-e2e` 116/0 |
 | ✅     | Principles                           | [`../00-principles.md`](../00-principles.md)                        | 13 principles, each with a why and a link to the doc that enforces it                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | ✅     | `wovm` VM core                       | [plan 1](../superpowers/plans/2026-08-01-wob-format-and-vm-core.md) | `.wob` v1 loader with full static validation, register interpreter (computed-goto + ISO-C fallback), arena with size-class free lists, borrow word, RC + budgeted Bacon–Rajan cycle collector, drop-map trap unwinding, containers, builtins, ICALL, CLI. 13 suites × 2 dispatch flavors + CLI smoke, ASan/UBSan clean                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 | ✅     | `.wob` format contract               | [`oop-vm/00-wob-format.md`](../plan/oop-vm/00-wob-format.md)        | Normative; twinned with `runtime/src/wob.h`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
@@ -468,7 +585,7 @@ precedence notes for resumption.
    costs). It has never run — no `bench/baseline.json`, no `just db-bench`;
    the arc's stages 1+2 delta is recorded retroactively.
 3. **31** — actor lifecycle
-   ([story](language-runtime-database/refine/31-actor-lifecycle.md),
+   ([story](language-runtime-database/31-actor-lifecycle.md),
    written 2026-08-21): request/response (`send` is one-way and callers
    `sleep` to await), bounded mailboxes (the FIFO only grows), actor
    death/supervision, timers beyond `time.sleep`.
@@ -477,7 +594,7 @@ precedence notes for resumption.
 5. **23** — io_uring group-commit; the WAL's WRITE+FSYNC chains ride the
    arc's per-shard ring (T4); after 22's baseline — the payoff, measured.
 6. **32** — WAL checkpoint
-   ([story](language-runtime-database/refine/32-wal-checkpoint.md),
+   ([story](databasev2/03-wal-checkpoint.md),
    written 2026-08-21): the WAL is append-only forever — snapshot +
    truncate reclaims disk and bounds replay; after 23 (composes with
    group-commit), policy set by 22's aged-store numbers.
@@ -485,10 +602,61 @@ precedence notes for resumption.
 **30** — observability, CI, fuzz: named 2026-08-20, still row-only (no
 story file); slots in when scheduled — nothing in the chain depends on it.
 
+### ▸ databasev2 — the database beyond RAM
+
+New 2026-08-26. **The problem:** RAM is authoritative (principle 7) and nothing
+declares a budget. Rows live in `malloc`'d slabs whose addresses are stable
+forever; there is no eviction, spill or paging anywhere in `database/src/`; the
+WAL never checkpoints so boot replays all history; and durability is one
+process-global `WO_DATA`, so no table can say it matters more than another. An
+allocation failure *is* a clean catchable `WO_T_OOM` — but swap thrash arrives
+first and carries no error signal at all.
+
+**The lever** is per-table storage modes, which is why this track has a grammar
+iteration. Six pending iterations moved here from the language track (their old
+ids in the rows below); four are new. Done database work — 9, 9b, 22 — stays in
+the language arc as v1 history.
+
+| # | Iteration | State |
+| --- | --- | --- |
+| 1 | [RAM ceiling: measure the breaking point](databasev2/01-ram-ceiling-measurement.md) | ⬜ **first, and startable today** — nobody here can say what happens at 90% RAM. Curve not cliff: swap onset, latency departure, the three exits (checked trap / swap thrash / OOM killer), and `kill -9` durability *at exhaustion*. Output is `perf-targets.md` + baseline rows, not prose |
+| 2 | [`@table` storage modes](databasev2/02-table-storage-modes.md) | ⬜ **the language enrichment** — `mode: ram \| durable \| cold` per table, replacing the global switch. `durable` defaults so nothing changes silently; the compiler refuses a `durable` row holding a `ref` into a `ram` table. `.wob` format change. Grammar is small (`Ast.table_cfg` gains a key); semantics are the iteration |
+| 3 | [WAL checkpoint](databasev2/03-wal-checkpoint.md) *(was 32)* | ⬜ snapshot + truncate: disk reclaimed, replay bounded |
+| 4 | [io_uring group commit](databasev2/04-io-uring-commit.md) *(was 23)* | ⬜ close the 66× gap iteration 22 measured (durable 4.5k vs ram 297k inserts/s) |
+| 5 | [Bounded tables and eviction](databasev2/05-bounded-tables-eviction.md) | ⬜ a declared capacity + refuse/evict/back-pressure, and a process-level pressure signal that sheds **before** the allocator or OS gets involved — turning the invisible failure into a managed one |
+| 6 | [Cold tiering](databasev2/06-cold-tiering.md) | ⬜ the iteration that raises the ceiling, and the riskiest. Mostly forks: which shape, whether the index itself fits, whether the *language* surfaces the fault cost, and whether `@unique` on a cold table is refused outright. A paged B-tree stays rejected — if tiering needs one, reject tiering |
+| 7 | [Single-file store](databasev2/07-single-file-db.md) *(was 33)* | ⬜ `WO_DATA=<path>.db`; driver-only, independent |
+| 8 | [Query grammar from corpora](databasev2/08-query-grammar-corpus.md) *(was 27)* | ⬜ whole-query `count`, `exists`; independent |
+| 9 | [Cross-program tables](databasev2/09-cross-program-tables.md) *(was 20)* | ⏸ hold — attach to a running program's database over local IPC |
+| 10 | [Keypair attach auth](databasev2/10-keypair-attach-auth.md) *(was 21)* | ⏸ hold — program identity as a keypair; needs 9 |
+
+---
+
+### ▸ porch — the web framework track
+
+New 2026-08-26, from [the Fiber v3.5.0 parity study](../plan/exploration/fiber/00-fiber-parity.md).
+Supersedes language iteration 39, now a pointer. All eight are ⬜ `refine` —
+none has an approved spec yet. Ordered by dependency; the first slice is
+deliberately the cheapest so the store pattern and gate shape are proven before
+the runtime and `Resp` are touched.
+
+| # | Iteration | State |
+| --- | --- | --- |
+| 1 | [Store-backed middleware](porch/01-store-backed-middleware.md) | ⬜ **startable today** — rate limiter + idempotency over a `@table`; needs no new primitive, only `time.ticks`. Durable counters are the differentiator over Fiber's in-memory default, so the gate includes a restart |
+| 2 | [Randomness and cookies](porch/02-randomness-and-cookies.md) | ⬜ the foundation. Phase A is **language-track work**: a CSPRNG builtin (id 96+; 89/90 are iteration 31's reserved holes). Then repeated response headers — `Resp.headers` is a `map<Text,Text>` and structurally cannot emit two `Set-Cookie` lines — then `Cookie:` parsing and signed cookies |
+| 3 | [Sessions](porch/03-sessions.md) | ⬜ after 2. Server-side rows keyed by a random id, idle **and** absolute timeout, id rotation on login, revoke-all-for-principal, durable across restart |
+| 4 | [CSRF](porch/04-csrf.md) | ⬜ after 2 + 3. Session-bound tokens, trusted origins as the second layer, opt-in single use, and refusal classes that are distinguishable in logs |
+| 5 | [Routing + response ergonomics](porch/05-routing-response-ergonomics.md) | ⬜ **independent, any time** — `patch`/`options`/`head`/`all`, named routes + URL building, per-route body limit (today `BODY_MAX` is one compile-time number), request ids, `Location`/`Vary`/`Attachment`, and q-value ranking (retires a standing 🔶) |
+| 6 | [Streaming core](porch/06-streaming-core.md) | ⬜ the riskiest and highest-leverage slice: incremental writes + chunked framing + an explicit commit point. `serialize()` always emits `Content-Length` today. Chunked REQUEST bodies are deliberately refused (request smuggling) and that refusal must survive |
+| 7 | [SSE + compression](porch/07-sse-and-compression.md) | ⬜ after 6. SSE fits the actor/fiber model unusually well; compression carries a real fork — pure-`.wo` DEFLATE (now expressible after iteration 36's bit operators) vs a C builtin. CRC32 finally gets its consumer |
+| 8 | [Static files + lifecycle](porch/08-static-and-lifecycle.md) | ⬜ static half after 6. Byte ranges, `Last-Modified`/`Cache-Control`, index resolution, listing off-by-default, shutdown hooks (the ledger's "no user teardown hooks yet"), plus healthcheck/favicon/redirect/rewrite/skip |
+
+---
+
 ⏸ **Held** (2026-08-21, developer decision): 18, 20, 21, 25, 26, 27, 28,
-29 — stories in
-[`hold/`](language-runtime-database/hold/) (25's story file
-removed; its [plan doc](../superpowers/plans/2026-08-01-http-service-layer.md)
+29 — every story carrying `status: hold` in its frontmatter (25's story
+file removed; its
+[plan doc](../superpowers/plans/2026-08-01-http-service-layer.md)
 remains). Half-done branches (ipc-attach, keypair-auth) keep their
 manifests.
 
diff --git a/docs/stories/board-views.md b/docs/stories/board-views.md
index 604a7e1..bda9e01 100644
--- a/docs/stories/board-views.md
+++ b/docs/stories/board-views.md
@@ -5,21 +5,37 @@ is the source of truth**:
 
 ```yaml
 ---
-iteration: "8"        # immutable id (string: "7b", "9b" exist)
-status: in-progress   # done | in-progress | refine | hold — mirrors its folder
+track: porch          # OMITTED on language-runtime-database stories
+iteration: "8"        # immutable id, LOCAL TO ITS TRACK (string: "7b", "9b" exist)
+status: in-progress   # done | in-progress | refine | hold — the ONLY place status lives
 chain: 1              # concurrency-chain position, chain stories only (1–6)
 ---
 ```
 
-The folder move IS the status change: moving a story between `done/`,
-`in-progress/`, `refine/`, `hold/` must update its `status:` in the same
-change — the two never disagree. The prose board
-([`00-status.md`](00-status.md)) stays the standup narrative; these
-queries are the live views over the same facts.
+**Editing `status:` IS the status change.** Story files sit flat in
+`docs/stories/language-runtime-database/`; no directory encodes state, so
+there is nothing to move and nothing that can disagree. This replaced the
+2026-08-20/21 folder scheme on **2026-08-26** — under that scheme a status
+change moved the file, which broke every relative link in and to it, and
+the repo's two link audits were largely the cleanup.
+
+The closed set `status:` may take is `done`, `in-progress`, `refine` (needs
+a brainstorm before it can be planned) and `hold`. A value outside it will
+simply not appear in the lanes below, which is the cheapest possible
+validation. The prose board ([`00-status.md`](00-status.md)) stays the
+standup narrative; these queries are the live views over the same facts.
 
 Adjust the `FROM` path to your vault root (queries below assume the
 vault opens at the repo root).
 
+Three tracks now carry iterations, each numbered from 1:
+`language-runtime-database/` (the language and runtime), `porch/` (the web
+framework) and `databasev2/` (the database beyond RAM) — the latter two added
+2026-08-26. Iteration ids therefore repeat across tracks, so every query below is
+scoped by `FROM` path; non-language stories carry `track:`, and iterations moved
+between tracks keep `was_language_iteration:` so the old number stays
+searchable.
+
 ## Everything not done, chain order first
 
 ```dataview
@@ -60,7 +76,36 @@ WHERE status = "in-progress"
 The Kanban plugin stores board state in its own markdown file — a
 second copy of status. To keep frontmatter the single source of truth:
 **use Dataview for querying; treat any Kanban board as a VIEW, never
-the place status is edited.** Status changes happen by moving the story
-file between folders + updating its `status:` key (one commit); a
-Kanban card drag that only rewrites the Kanban file is a lie the next
-query won't see.
+the place status is edited.** A status change is one edit to one
+`status:` key; a Kanban card drag that only rewrites the Kanban file is a
+lie the next query won't see.
+
+## The databasev2 track
+
+```dataview
+TABLE iteration, status, was_language_iteration AS "was"
+FROM "docs/stories/databasev2"
+WHERE status != "done"
+SORT iteration ASC
+```
+
+## The porch track
+
+```dataview
+TABLE iteration, status
+FROM "docs/stories/porch"
+WHERE status != "done"
+SORT iteration ASC
+```
+
+## Both tracks at once, grouped
+
+Relies on `track:` being present on porch stories and absent on language ones,
+so the language track shows up under an empty group.
+
+```dataview
+TABLE rows.file.link AS story, rows.iteration AS iteration, rows.status AS status
+FROM "docs/stories"
+WHERE iteration AND status != "done"
+GROUP BY track
+```
diff --git a/docs/stories/databasev2/00-story.md b/docs/stories/databasev2/00-story.md
new file mode 100644
index 0000000..a4be9ab
--- /dev/null
+++ b/docs/stories/databasev2/00-story.md
@@ -0,0 +1,152 @@
+# Story — databasev2: the database beyond RAM
+
+The third track. `language-runtime-database/` built the engine;
+[`porch/`](../porch/00-story.md) is the framework on top; this track answers the
+question v1 deliberately deferred: **what happens when the data does not fit in
+memory.**
+
+Numbering restarts at 1, local to this track. Frontmatter carries
+`track: databasev2`, and iterations moved here keep their old id in
+`was_language_iteration:` so a search for "iteration 32" still finds the WAL
+checkpoint. Status stays where it belongs — the `status:` key, never a directory.
+
+## The problem, stated honestly
+
+Principle 7 says **RAM is authoritative; the WAL makes it durable.** That is a
+real design, not a shortcut: reads never touch disk, so latency is predictable,
+and durability is a sequential append rather than a storage engine bolted to the
+side. Iteration 22 measured what it buys — reads at 1.3M ops/s after the index
+probe landed, p50 1µs.
+
+The bill comes due at the ceiling. Read from the engine as it stands:
+
+- **Rows live in `malloc`'d slabs of 256, and their addresses are stable
+  forever** (`database/src/table.c`, `DB_SLAB_ROWS`). Slabs are allocated as a
+  table grows and freed only when the table is destroyed. The free-slot list
+  recycles removed slots, so a delete-heavy table plateaus — but a growing table
+  only grows.
+- **The ceiling is process RSS, not a configured number.** `WO_HEAP_MB` (default
+  64 MiB) bounds the VM object arena; table storage is separate `malloc`, so
+  nothing in the system declares a maximum dataset size. There is no knob that
+  says "this database may use at most N".
+- **There is no eviction, no spill, no paging, no LRU.** Grep
+  `database/src/` for any of them and nothing comes back. Every row ever
+  inserted and not deleted is resident.
+- **The WAL is append-only with no checkpoint.** Boot replays every record ever
+  written, so startup time is O(all writes in the file's history) and disk grows
+  without bound. That is databasev2 [3](03-wal-checkpoint.md).
+- **Durability is process-global.** `WO_DATA` is one environment variable that
+  turns on one `shard-0.wal` for the whole process (`runtime/src/main.c`). There
+  is no way to say "this table matters, that one is scratch".
+
+### What actually breaks first
+
+Worth being precise, because the failure mode determines the fix — and the good
+news is that the engine's own behaviour is clean:
+
+**An allocation failure is a catchable trap, not a crash.** Every `malloc` in
+the row encoder is checked and jumps to an `oom` label; `DB_ERR_OOM` maps to
+`WO_T_OOM`, which a program can `try`/`catch`. So a writeonce program that runs
+out of memory *refuses the insert* rather than corrupting or dying. That is a
+much better starting position than most engines have.
+
+**But the trap is almost never what a real deployment hits first.** Long before
+`malloc` returns NULL, the box starts swapping, and a RAM-authoritative database
+on swap is the worst of both worlds: it has paid for in-memory data structures
+and is now serving them from disk with no read path designed for that. On a
+cgroup-limited host the OOM killer arrives instead, and an external `SIGKILL` is
+the one shutdown path that skips every guarantee the WAL was written to provide —
+though ack-after-fsync means acked writes still survive; iteration 22's `kill -9`
+battery proves that much.
+
+So the honest problem statement is not "malloc fails". It is: **there is no
+declared budget, no back-pressure as the budget is approached, and no way to
+distinguish data that must be resident from data that merely is.** Iteration
+[1](01-ram-ceiling-measurement.md) exists to replace this paragraph with
+numbers before anything is designed on top of it.
+
+## The lever: per-table storage modes
+
+The developer's ask, and the reason this track has a grammar iteration.
+
+Today every `@table` is identical: resident, and durable if and only if
+`WO_DATA` is set for the whole process. Real applications are not uniform —
+a session table, a rate-limit counter and a page cache want *resident and
+disposable*; an orders table wants *resident and durable*; an audit log wants
+*durable and rarely read*. One global switch cannot express that, so it forces
+either "everything is precious" or "nothing is".
+
+Extending `@table` with a storage mode moves the decision into the language,
+where the compiler can act on it:
+
+- **`ram`** — resident, never WAL-logged, gone on restart. The compiler knows
+  no durability code is needed; the engine knows these rows are the first
+  candidates to shed under pressure; and — the part that matters — a program
+  that expects a `ram` table to survive a restart is now stating something the
+  compiler can refuse.
+- **`durable`** — today's behaviour: resident and WAL-logged, ack after fsync.
+- **`cold`** — durable, and *not* required to be resident. This is the mode that
+  actually raises the ceiling, and it is the one with real design work behind it
+  (iteration [6](06-cold-tiering.md)).
+
+The grammar change is small and the surface is already the right shape:
+`Ast.table_cfg` is `{ table_name; indexes }`, the parser's argument match
+already rejects unknown keys with a catalogued diagnostic
+(`unknown @table argument ... (supported: name, index)`), and adding one more
+key follows the path `index` already cut. The *semantics* are the work, not the
+syntax — which is exactly why it gets its own iteration
+([2](02-table-storage-modes.md)) and why it comes after the measurement.
+
+This is also the honest answer to "does this break principle 7?" It does not.
+RAM stays authoritative **for the tables that say so**. `cold` is a declared
+exception a developer opts into per table, with the trade written at the
+declaration site rather than buried in an operations runbook.
+
+## The sequence
+
+| # | Iteration | Delivers | Needs |
+| --- | --- | --- | --- |
+| 1 | [RAM ceiling: measure the breaking point](01-ram-ceiling-measurement.md) | what actually happens from 50% RAM to OOM — swap onset, latency cliff, trap behaviour, `kill -9` survival | nothing; extends iteration 22's harness |
+| 2 | [`@table` storage modes](02-table-storage-modes.md) | the grammar: `mode: ram \| durable \| cold`, per table, replacing the global `WO_DATA` all-or-nothing | 1 for its defaults |
+| 3 | [WAL checkpoint](03-wal-checkpoint.md) *(was language 32)* | snapshot + truncate: disk reclaimed, replay bounded | 4 composes |
+| 4 | [io_uring group commit](04-io-uring-commit.md) *(was language 23)* | close the 66× durable/RAM write gap (4.5k vs 297k inserts/s) | the arc (landed) |
+| 5 | [Bounded tables and eviction](05-bounded-tables-eviction.md) | a capacity a `ram` table may not exceed, and what happens when it does | 2 |
+| 6 | [Cold tiering](06-cold-tiering.md) | rows that leave RAM and come back — the iteration that raises the ceiling | 2, 3, 5 |
+| 7 | [Single-file store](07-single-file-db.md) *(was language 33)* | `WO_DATA=<path>.db` — a file path IS the store | independent |
+| 8 | [Query grammar from corpora](08-query-grammar-corpus.md) *(was language 27)* | whole-query `count`, `exists` | independent |
+| 9 | [Cross-program tables](09-cross-program-tables.md) *(was language 20)* | attach to a running program's database over local IPC | independent |
+| 10 | [Keypair attach auth](10-keypair-attach-auth.md) *(was language 21)* | program identity as a keypair; mutual challenge–response | 9 |
+
+```
+1 ──▶ 2 ──▶ 5 ──▶ 6
+      │            ▲
+      3 ──▶ 4 ─────┘
+7, 8 independent
+9 ──▶ 10
+```
+
+Order rationale: **1 before 2** because a mode's default should follow from a
+measurement, not a guess. **3 and 4 before 6** because tiering onto a log that
+never truncates would make the disk problem worse, not better. **5 before 6**
+because eviction from a bounded resident table is the simpler half of the same
+mechanism, and getting the policy right there de-risks the hard half.
+
+## What this track does NOT own
+
+| Not databasev2's | Owner |
+| --- | --- |
+| `transaction { }` and `@table` feature flags | language [iteration 18](../language-runtime-database/18-memory-db-features.md) — approved spec, left whole on purpose |
+| the TTL cache middleware | also language 18 (and [porch 1](../porch/01-store-backed-middleware.md) points there) |
+| typed binding of rows into app classes | language [iteration 29 `@derive`](../language-runtime-database/29-compile-time-metaprogramming.md) |
+| `fs` mutation verbs, outbound sockets | language [iteration 38](../language-runtime-database/38-content-platform-capabilities.md) |
+| benchmark harness and CI | iteration 22 (landed) built the harness; per-change CI is language iteration 30 |
+| a paged B-tree storage engine | **nobody, deliberately.** Recorded as rejected in [`discarded.md`](../../plan/discarded.md): the disk story is the WAL. `cold` tiering is not a licence to build SQLite. |
+
+## Review protocol
+
+The language track's, unchanged: one iteration read and approved before the next
+starts; every iteration an unsplittable slice with phases, per-phase tasks,
+Given/When/Then criteria and an out-of-scope list. Every engine change is gated
+by `just employee`, `just db-actor` and `just db-bench` against
+`bench/baseline.json` — and any iteration that claims a performance change must
+move a number in that baseline, or it did not happen.
diff --git a/docs/stories/databasev2/01-ram-ceiling-measurement.md b/docs/stories/databasev2/01-ram-ceiling-measurement.md
new file mode 100644
index 0000000..4234194
--- /dev/null
+++ b/docs/stories/databasev2/01-ram-ceiling-measurement.md
@@ -0,0 +1,148 @@
+---
+track: databasev2
+iteration: "1"
+status: refine
+---
+
+# databasev2 1 — the RAM ceiling: measure the breaking point before designing for it
+
+> Part of [Story — databasev2: the database beyond RAM](00-story.md).
+>
+> **First because the repo's own doctrine says so.** "Always inspect crashsites.
+> Always measure. Never assume." Every later iteration in this track — the
+> storage modes' defaults, the eviction policy, the tiering threshold — is a
+> decision that should follow from a number. Right now nobody in this project
+> can say what happens to a writeonce program at 90% of RAM, and designing
+> tiering without that is guessing with extra steps.
+
+## Goals
+
+- **Find the curve, not the cliff.** Not "does it die" — it dies, everything
+  does. What matters is the shape on the way down: at what fraction of RAM does
+  p99 read latency leave its 1µs baseline, what does insert throughput do as
+  slabs stop coming from a warm allocator, and how much warning is there between
+  "fine" and "unusable".
+- **Characterise all three exits.** The engine can leave the happy path three
+  ways and they are not equally survivable: a checked `malloc` failure
+  (`DB_ERR_OOM` → `WO_T_OOM`, a catchable trap — the clean one), swap thrash
+  (no trap, no error, just latency collapse — the dangerous one because nothing
+  reports it), and the external OOM killer (`SIGKILL`, skipping every shutdown
+  path). Establish which arrives first under realistic limits, because the
+  answer determines whether the fix is back-pressure or eviction.
+- **Prove the durability floor holds at the ceiling.** Iteration 22's `kill -9`
+  battery proved acked writes survive under load. Re-run it *at memory
+  exhaustion*, which is a different and nastier state — an allocation failure
+  mid-commit is exactly where an ack-before-durable bug would hide.
+- **Publish numbers others can build on.** The output is a section in
+  `perf-targets.md` and rows in `bench/baseline.json`, not a paragraph of
+  prose. A measurement that only printed once is not a measurement.
+
+## Phases
+
+### Phase A — a workload that can actually reach the ceiling
+
+- Extend `docs/examples/db-bench` with a growth mode: insert until a target RSS
+  fraction, holding row shape and index count constant so the variable is size
+  alone.
+- Run it under an explicit memory limit (a cgroup or `ulimit`) rather than on a
+  big box — "it survived on a 64 GB workstation" measures the workstation.
+- Record RSS against row count so the per-row overhead is known: slab headroom,
+  the id hash, the secondary-index multimaps and the per-row engine-owned values
+  (`db_text`, `db_rec`, `db_multi`, `db_map` are each their own allocation).
+- Verify: RSS growth is linear and its slope is written down; the run is
+  reproducible twice within the tolerance policy iteration 22 established.
+
+### Phase B — the latency and throughput curve
+
+- Sample read p50/p99, query p99 and insert throughput at fixed fractions of the
+  limit, so the result is a curve rather than two endpoints.
+- Separate the two effects deliberately: allocator pressure (still resident) and
+  swap (no longer resident). They have different fixes and conflating them would
+  send iteration 6 after the wrong one.
+- Include the DB-actor path, since a cross-shard statement's reply materialises
+  a copy — memory pressure and the actor RPC interact and nobody has looked.
+- Verify: the curve is recorded per metric class with iteration 22's per-class
+  tolerances; the swap onset point is identified, not interpolated.
+
+### Phase C — the three exits, deliberately triggered
+
+- Drive a checked allocation failure and confirm `WO_T_OOM` is catchable, the
+  insert is refused whole, no partial row or index entry is left, and the
+  process continues serving.
+- Drive swap thrash and record what a client sees. This is the case with no
+  error signal at all, and naming it is most of the value of this iteration.
+- Drive the OOM killer under a cgroup limit and confirm what survives: replay
+  the WAL and check every acked write is present.
+- Verify: the trap path leaves no torn state (row count and index agree after a
+  refused insert); replay after `SIGKILL` at exhaustion loses no acked write.
+
+### Phase D — write it down where decisions get made
+
+- A `perf-targets.md` section with the curve, the swap onset, the per-row
+  overhead and the exit characterisation.
+- Baseline rows for the growth metrics so a regression is caught by the existing
+  gate rather than by a person remembering.
+- A short statement of what the numbers *imply* for iterations 2, 5 and 6 —
+  which is the point of going first.
+- Verify: `just db-bench` green against the extended baseline; the gate bites
+  when a growth metric is doctored.
+
+## Acceptance Criteria
+
+- **Given** the growth workload under a fixed memory limit, **when** it runs
+  twice, **then** RSS-per-row agrees within the tolerance policy and the slope
+  is recorded in `perf-targets.md`.
+- **Given** the workload at rising RAM fractions, **when** latency is sampled,
+  **then** the fraction at which read p99 first leaves its baseline is
+  identified as a measured point, not an estimate.
+- **Given** a deliberately induced allocation failure, **when** an insert is
+  attempted, **then** it traps `WO_T_OOM` catchably, the table's row count is
+  unchanged, every index agrees with the slab contents, and the process keeps
+  serving subsequent requests.
+- **Given** swap thrash, **when** a client issues reads, **then** the observed
+  degradation is quantified and the fact that **no error is surfaced** is
+  recorded explicitly as a finding.
+- **Given** a cgroup limit and a workload that exceeds it, **when** the OOM
+  killer fires, **then** replaying the WAL shows every acked write present —
+  ack-after-fsync holding in the one shutdown path that skips all cleanup.
+- **Given** the extended baseline, **when** a growth metric is doctored, **then**
+  `just db-bench` fails on exactly that metric.
+
+## Out Of Scope
+
+- **Any fix.** This iteration measures. Eviction is
+  [5](05-bounded-tables-eviction.md), tiering is [6](06-cold-tiering.md),
+  declared budgets are [2](02-table-storage-modes.md). Shipping a fix inside the
+  measurement slice would remove the ability to tell whether it helped.
+- **Changing the OOM behaviour.** The checked-`malloc`-to-catchable-trap path is
+  good and should not be touched; if the measurement finds a hole in it, that is
+  a bug fix, reported separately.
+- **A memory profiler or allocator instrumentation.** Observability is language
+  iteration 30. RSS from the OS and the existing `time.ticks` are enough for a
+  curve.
+- **Multi-machine or sharded-across-hosts scaling.** One binary owns its data;
+  cross-process is [9](09-cross-program-tables.md).
+- **Comparing against SQLite at the ceiling.** `bench/compare/go-sqlite` exists
+  and the comparison would be interesting, but SQLite's whole architecture is
+  the paged design this project rejected — the numbers would not inform any
+  decision here.
+
+## Info
+
+Forks the spec must settle:
+
+1. **What is the limit mechanism for the harness?** A cgroup v2 `memory.max` is
+   the closest thing to how this would actually be deployed; `ulimit -v` is
+   simpler but bounds address space rather than resident set, which for an engine
+   that `malloc`s slabs is a materially different constraint. Leaning cgroup, and
+   the campaign already runs off the fast path so the setup cost is acceptable.
+2. **Which table shape is the reference?** Per-row overhead depends heavily on
+   whether fields are scalars or heap values — a `Text` column is a separate
+   `db_text` allocation per row, so a text-heavy table and an Int-only table
+   will produce very different slopes. Probably both, reported separately,
+   because "bytes per row" is meaningless without saying which row.
+3. **Is swap even in scope for the target deployment?** If the intended answer
+   is "run with swap off and let the OOM killer decide", the swap curve is
+   informational rather than load-bearing — but that stance should be stated in
+   the doctrine, not assumed. It also changes which exit iteration 5's
+   back-pressure is defending against.
diff --git a/docs/stories/databasev2/02-table-storage-modes.md b/docs/stories/databasev2/02-table-storage-modes.md
new file mode 100644
index 0000000..f2ad592
--- /dev/null
+++ b/docs/stories/databasev2/02-table-storage-modes.md
@@ -0,0 +1,188 @@
+---
+track: databasev2
+iteration: "2"
+status: refine
+---
+
+# databasev2 2 — `@table` storage modes: durability becomes a language decision
+
+> Part of [Story — databasev2: the database beyond RAM](00-story.md).
+> Needs [1](01-ram-ceiling-measurement.md) — a mode's default should follow from
+> a measurement, not a preference.
+>
+> **The developer's ask, and the language enrichment this track exists for.**
+> Today durability is one environment variable for a whole process: `WO_DATA` is
+> set and every `@table` is WAL-logged, or it is not and none are
+> (`runtime/src/main.c`). Real applications are not uniform. A session table, a
+> rate-limit counter and a page cache are resident and disposable; an orders
+> table is resident and precious; an audit log is precious and rarely read. One
+> global switch forces "everything is precious" or "nothing is", and the
+> developer pays for the wrong one either way.
+
+## Goals
+
+- **Move the storage decision to the declaration site.** `@table(mode: ...)`,
+  chosen per table, in the source, where the person who knows what the data is
+  worth is already writing. An operations runbook is the wrong place for a fact
+  the compiler could hold.
+- **Three modes, each earning its existence.** `ram` — resident, never logged,
+  gone on restart. `durable` — today's behaviour, resident and ack-after-fsync,
+  and the **default** so every existing program is byte-identical. `cold` —
+  durable and not required to be resident, declared here and *implemented* in
+  [6](06-cold-tiering.md), because a mode with no engine behind it is a promise.
+- **Make the compiler enforce what the mode means.** This is the part that makes
+  it a language feature rather than a config key. A program that inserts into a
+  `ram` table and expects the row after a restart is stating a contradiction, and
+  the compiler is the right place to say so — at minimum for the cases it can
+  see statically, with the diagnostic catalogued like every other.
+- **Let the engine act on it.** `ram` tables skip the WAL write entirely, which
+  is not merely a saving — it is the 66× gap iteration 22 measured (4.5k durable
+  vs 297k RAM inserts/s) becoming available per table instead of per process.
+  They also become the first candidates to shed under pressure, which is what
+  [5](05-bounded-tables-eviction.md) builds on.
+- **Keep principle 7 intact and say why.** RAM stays authoritative for every
+  table that says so. `cold` is a declared, per-table exception a developer opts
+  into with the trade visible at the declaration.
+
+## Phases
+
+### Phase A — the grammar
+
+- Extend the `@table` argument parser with `mode:`. The path is already cut:
+  the argument loop matches `name` and `index` and rejects anything else with a
+  catalogued diagnostic (`unknown @table argument ... (supported: name, index)`),
+  so this is one more arm plus an updated message.
+- Extend `Ast.table_cfg` — today `{ table_name; indexes }` — with the mode, and
+  give it the default so every existing `@table` keeps its meaning.
+- Reject the incoherent cases at parse time: `mode` given twice, an unknown mode
+  name. Both belong in the same diagnostic family as the existing `@table`
+  errors, and both go in the error catalog **in this change**, not later — that
+  catalog went stale once by exactly that omission.
+- Verify: golden AST fixtures for each mode; `woc-test` green; every existing
+  `@table` in every sample parses unchanged.
+
+### Phase B — the mode reaches the image and the engine
+
+- Carry the mode through the class descriptor into the `.wob` image so the
+  runtime knows it without re-deriving anything. This is a format change, so it
+  moves `WOB_VERSION` and the format contract in the same commit as the code.
+- The engine consults it at the one choke point that already exists: the
+  `INDEX HOOK` / WAL staging site in `wo_row_insert` / `wo_row_remove`, which
+  `database/src/CODE-LOGIC.md` names as the only place storage may be mutated.
+  A `ram` table stages nothing.
+- Replay must skip records for tables that are now `ram` — a WAL written when a
+  table was `durable` and replayed after the source changed is a real
+  migration case, and silently resurrecting rows into a `ram` table would be
+  worse than refusing.
+- Verify: a `ram` table's inserts produce no WAL growth (measured, not assumed);
+  a `durable` table is byte-identical to today; a mode change across a restart
+  is handled explicitly rather than by accident.
+
+### Phase C — the compiler's enforcement
+
+- Decide how far static checking goes (fork 2) and implement that much. The
+  floor: `WO_DATA` set with every table `ram` is a program that asked for a data
+  directory it will never write to — worth a warning at least.
+- The interesting case is a `ram` table participating in a `ref`/`backlink`
+  relation with a `durable` one. A durable row holding a foreign key into a
+  table that evaporates on restart is a dangling reference by construction, and
+  FK-restrict cannot save it. This is the check most worth having, and it is
+  statically visible from the class table.
+- Verify: corpus `compile-fail` fixtures for each refusal; each carries the
+  exact `WO-E###` the catalog now documents.
+
+### Phase D — prove it on a real workload
+
+- Give `docs/examples/employee` or the `db-bench` sample a mixed schema — at
+  least one `ram` table and one `durable` — and gate the distinction: after a
+  restart, the durable rows are present and the ram rows are gone. That single
+  assertion is the whole feature.
+- Extend the durability legs of `just db-bench` so the per-table write-path
+  saving appears as a baseline number, not a claim.
+- Verify: `just employee`, `just db-actor`, `just db-bench`, `oop-accept` green.
+
+### Phase E — document the contract
+
+- The `@table` mode surface in the language-surface guide and the db-binding
+  contract; the new diagnostics in the error catalog; the mode's effect on
+  replay in `database/src/CODE-LOGIC.md`.
+- Verify: `just linkcheck` clean; the language-surface guide's `@table` row
+  matches what the parser actually accepts.
+
+## Acceptance Criteria
+
+- **Given** every existing `@table` declaration in the repository, **when** it is
+  compiled after this change, **then** behaviour is byte-identical — `durable`
+  is the default and nothing opts in silently.
+- **Given** a table declared `mode: ram`, **when** rows are inserted with
+  `WO_DATA` set, **then** the WAL does not grow, and after a restart the table is
+  empty while `durable` tables in the same program replay intact.
+- **Given** `mode: ram` and a measured insert workload, **when** it runs against
+  the same shape as a `durable` table, **then** the write-path saving is visible
+  in `bench/baseline.json` — the per-table half of iteration 22's 66× gap.
+- **Given** an unknown mode name or `mode:` given twice, **when** it is compiled,
+  **then** it fails with the catalogued diagnostic naming the legal modes.
+- **Given** a `durable` table holding a `ref` into a `ram` table, **when** it is
+  compiled, **then** the compiler refuses (or warns, per fork 2) — a persistent
+  row cannot reference one that evaporates.
+- **Given** a WAL containing records for a table whose source now says `ram`,
+  **when** the program starts, **then** the situation is handled explicitly
+  (refuse, or skip and report) and never by silently loading rows into a table
+  declared not to have any.
+- **Given** the `.wob` format change, **when** an image from the previous version
+  is loaded, **then** the loader refuses it clearly on the version rather than
+  misreading a descriptor.
+
+## Out Of Scope
+
+- **Implementing `cold`.** Declared here so the mode set is settled and the
+  format carries it; the engine behaviour is [6](06-cold-tiering.md). Until then
+  a `cold` declaration must be refused rather than silently treated as
+  `durable` — accepting a mode that does nothing is how a feature becomes a lie.
+- **Per-table capacity limits and eviction** — [5](05-bounded-tables-eviction.md).
+  This iteration says what a table *is*; that one says how much of it there may
+  be.
+- **`@table` feature flags and `transaction { }`** — language
+  [iteration 18](../language-runtime-database/18-memory-db-features.md), whose
+  spec is approved and deliberately left whole.
+- **Per-table WAL files.** One log, one writer, shard 0 — the invariant stage 3
+  established and [7](07-single-file-db.md) depends on. Modes decide *whether* a
+  table logs, never *where*.
+- **Migrating an existing dataset between modes.** A schema-change story, and
+  the repo already records destructive migrations as a recorded future.
+- **Encryption at rest, compression of the WAL.** Neither has a consumer.
+
+## Info
+
+The grammar surface this touches, read from the source: the parser's `@table`
+argument loop and its `unknown @table argument` failure; `Ast.table_cfg` as
+`{ table_name : string option; indexes : string list list }`; and the class
+descriptor in `runtime/src/wob.h` that the loader validates. Adding a key is
+genuinely small — the semantics are the iteration.
+
+Forks the spec must settle:
+
+1. **What are the modes called?** `ram` / `durable` / `cold` is descriptive of
+   mechanism. `scratch` / `persistent` / `archived` is descriptive of intent and
+   is what a developer reasons about. The names are the API and are hard to
+   change later; leaning the intent-shaped set for the first two if a
+   short-enough pair can be found, since a developer choosing a mode is thinking
+   about what the data is *for*, not about where it sits.
+2. **How hard does the compiler push?** Three levels: warn on the suspicious
+   cases; refuse the provably-broken ones (a `durable`→`ram` `ref`); or a full
+   dataflow check that an insert into a `ram` table is never expected to persist.
+   The third is not statically decidable in general. Leaning: refuse the
+   relation case (provable, high value), warn on the `WO_DATA`-with-no-durable-
+   table case, and stop there.
+3. **What is the default, and does it depend on iteration 1?** `durable` keeps
+   every existing program identical, which is nearly decisive. But if iteration
+   1's numbers show the WAL write dominating a workload nobody wanted durable,
+   there is an argument for making the choice mandatory — no default, every
+   `@table` states its mode. That is a bigger source change and a better
+   language; the fork is whether the churn is worth it now or at 1.0.
+4. **Does `mode: ram` imply anything about the actor/DB-actor path?** Stage 3
+   marshals worker-shard statements to shard 0 because the owner shard holds the
+   store and the WAL. A `ram` table has no WAL — so does it still need to live on
+   the owner? A per-shard `ram` table would be dramatically faster and a
+   different consistency story. Tempting, out of scope here, and worth recording
+   as a candidate rather than deciding in passing.
diff --git a/docs/stories/language-runtime-database/refine/32-wal-checkpoint.md b/docs/stories/databasev2/03-wal-checkpoint.md
similarity index 88%
rename from docs/stories/language-runtime-database/refine/32-wal-checkpoint.md
rename to docs/stories/databasev2/03-wal-checkpoint.md
index 7f9d499..de775e1 100644
--- a/docs/stories/language-runtime-database/refine/32-wal-checkpoint.md
+++ b/docs/stories/databasev2/03-wal-checkpoint.md
@@ -1,20 +1,26 @@
 ---
-iteration: "32"
+track: databasev2
+iteration: "3"
+was_language_iteration: "32"
 status: refine
 chain: 6
 ---
 
-# Iteration 32 — WAL checkpoint: disk space reclamation and bounded replay
+# databasev2 3 — WAL checkpoint: disk space reclamation and bounded replay
+
+> **Moved 2026-08-26** from the language track, where this was iteration 32.
+> Part of [Story — the database beyond RAM](../language-runtime-database/00-story.md). Content unchanged by
+> the move; its dependencies are restated in that track index.
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](../language-runtime-database/00-story.md).
 >
 > **Inserted 2026-08-21** (stage-3 guarantee refinement found the hole):
 > the WAL is append-only FOREVER — no checkpoint, no truncation exists
 > in the engine or anywhere on the roadmap. Disk grows without bound and
 > replay time grows with history, so restart cost rises with every write
 > the program ever made. RAM reclamation already exists (deleted rows
-> free their slot — [`04-db-binding.md`](../../../plan/oop-vm/04-db-binding.md):
+> free their slot — [`04-db-binding.md`](../../plan/oop-vm/04-db-binding.md):
 > "Ids are never reused; slots are"); this iteration is the DISK half.
 > LAST in the concurrency chain:
 > **stage 3 → 22 → 31 → 24 → 23 → 32** — it wants 22's measured
@@ -87,7 +93,7 @@ Forks the spec must settle:
 4. **Composition with 23** — the snapshot's durability barrier rides
    the same per-shard ring (WRITE+FSYNC chain, then the truncate);
    ordering vs in-flight group commits must be stated normatively in
-   [`04-db-binding.md`](../../../plan/oop-vm/04-db-binding.md)'s WAL
+   [`04-db-binding.md`](../../plan/oop-vm/04-db-binding.md)'s WAL
    section.
 
 ## Proposed Solution
diff --git a/docs/stories/language-runtime-database/refine/23-io-uring-commit.md b/docs/stories/databasev2/04-io-uring-commit.md
similarity index 95%
rename from docs/stories/language-runtime-database/refine/23-io-uring-commit.md
rename to docs/stories/databasev2/04-io-uring-commit.md
index d4fa402..0dec19f 100644
--- a/docs/stories/language-runtime-database/refine/23-io-uring-commit.md
+++ b/docs/stories/databasev2/04-io-uring-commit.md
@@ -1,13 +1,19 @@
 ---
-iteration: "23"
+track: databasev2
+iteration: "4"
+was_language_iteration: "23"
 status: refine
 chain: 5
 ---
 
-# Iteration 23 — io_uring group-commit write path
+# databasev2 4 — io_uring group-commit write path
+
+> **Moved 2026-08-26** from the language track, where this was iteration 23.
+> Part of [Story — the database beyond RAM](../language-runtime-database/00-story.md). Content unchanged by
+> the move; its dependencies are restated in that track index.
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](../language-runtime-database/00-story.md).
 >
 > **Inserted 2026-08-15.** The write-path optimization, and deliberately the
 > LAST database performance iteration: it only earns its complexity once
diff --git a/docs/stories/databasev2/05-bounded-tables-eviction.md b/docs/stories/databasev2/05-bounded-tables-eviction.md
new file mode 100644
index 0000000..dc5010a
--- /dev/null
+++ b/docs/stories/databasev2/05-bounded-tables-eviction.md
@@ -0,0 +1,169 @@
+---
+track: databasev2
+iteration: "5"
+status: refine
+---
+
+# databasev2 5 — bounded tables and eviction: a declared budget, and back-pressure before the cliff
+
+> Part of [Story — databasev2: the database beyond RAM](00-story.md).
+> Needs [2](02-table-storage-modes.md) for the mode a bound attaches to, and
+> [1](01-ram-ceiling-measurement.md) for the numbers that set a sane default.
+>
+> **The simpler half of the hard problem, done first on purpose.** Evicting from
+> a bounded resident table and evicting to disk are the same policy question with
+> different destinations. Getting the policy right where the answer is "drop it"
+> de-risks [6](06-cold-tiering.md), where the answer is "write it somewhere and
+> be able to find it again".
+
+## Goals
+
+- **A table may declare a maximum.** Rows, bytes, or both — a `ram` table that
+  is a cache or a session store has a size the application is willing to spend,
+  and today it has no way to say so. Unbounded growth in a table nobody intended
+  to be large is the most common route to the ceiling iteration 1 measured.
+- **Something defined happens at the bound.** Today the answer is "grow until
+  the process dies". The candidates are eviction (drop the least valuable row),
+  refusal (trap, let the caller decide), and back-pressure (make the writer
+  wait). Each is right for a different table, which argues for the policy being
+  declared rather than chosen for the developer.
+- **Back-pressure before the cliff, not at it.** The dangerous exit iteration 1
+  characterises is swap thrash, which arrives with **no error signal at all**.
+  A budget that is enforced at 100% has already lost; the value is in acting at
+  a threshold, while there is still headroom to act.
+- **Eviction that respects the engine's actual invariants.** Rows have stable
+  addresses forever, the free-slot list recycles slots, ids are never reused, and
+  every secondary index and unique shadow must stay consistent with the slab.
+  Eviction is `wo_row_remove` with a policy in front — it must go through the
+  same choke point, not around it.
+
+## Phases
+
+### Phase A — declaring the bound
+
+- Extend the `@table` surface from [2](02-table-storage-modes.md) with a
+  capacity and a policy. One new grammar arm, the same catalogued-diagnostic
+  discipline, defaults that keep every existing table unbounded so nothing
+  changes silently.
+- Decide whether a bound is legal on a `durable` table (fork 1) — evicting a row
+  that was acked as durable is a promise being broken, and the answer is
+  probably "only with an explicit, differently-named policy".
+- Verify: golden fixtures per policy; existing tables unchanged; illegal
+  combinations refused at compile time with catalogued codes.
+
+### Phase B — the accounting
+
+- Track per-table size cheaply. Row count is free; bytes are not — per-row
+  footprint includes the slab slot plus each heap value's own allocation
+  (`db_text`, `db_rec`, `db_multi`, `db_map`), which iteration 1 will have
+  quantified. Decide what is counted and be honest that it is an estimate of RSS,
+  not RSS.
+- Expose it, because a budget nobody can observe is a budget nobody can tune.
+  How it is exposed is fork 3.
+- Verify: accounting tracks a known workload within a stated error bound;
+  deleting rows returns the accounting to its prior value (the free-slot list
+  already makes this true of slots).
+
+### Phase C — the policies
+
+- **Refuse**: the bound is a hard ceiling, an insert past it traps catchably.
+  The simplest correct behaviour and the right default for anything precious.
+- **Evict**: drop the least valuable row via `wo_row_remove` so indexes, unique
+  shadows and the free-slot list all stay honest. The recency metadata this needs
+  is fork 2 — and note the engine currently stores no per-row access time, so
+  true LRU is not free.
+- **Back-pressure**: at a threshold below the bound, slow or park the writer.
+  This composes with the fiber model (a parked writer blocks nobody) and is the
+  only policy that addresses the swap-thrash exit rather than the allocation
+  exit.
+- Verify: each policy behaves at the bound; after eviction every index agrees
+  with the slab; a parked writer resumes and does not deadlock the shard.
+
+### Phase D — the pressure signal
+
+- A process-level threshold, not just per-table: when total resident size
+  crosses a configured fraction, tables with an eviction policy start shedding
+  **before** the allocator or the OS gets involved. This is the iteration's real
+  contribution — turning an invisible failure into a managed one.
+- Decide precedence when several tables could shed (fork 4).
+- Verify: under the iteration-1 growth workload with the signal enabled, the
+  process holds a steady state instead of walking into swap; the latency curve
+  stays inside its baseline.
+
+### Phase E — gate it against the measurement
+
+- Re-run iteration 1's growth workload with bounds and policies configured. The
+  proof is a before/after on the same harness: previously the curve degraded and
+  the process died; now it plateaus.
+- Baseline rows for steady-state throughput under pressure.
+- Verify: `just employee`, `just db-actor`, `just db-bench` green; the gate bites
+  on a doctored pressure metric.
+
+## Acceptance Criteria
+
+- **Given** a table bounded at N rows with policy `refuse`, **when** the N+1st
+  insert is attempted, **then** it traps catchably, the row count stays N, and
+  every index agrees with the slab.
+- **Given** a table bounded at N rows with policy `evict`, **when** the N+1st
+  insert arrives, **then** exactly one row is evicted, the new row is present,
+  the count is N, and no index or unique shadow references the evicted row.
+- **Given** an evicted row's id, **when** it is looked up, **then** it is absent
+  — and its id is never reused by a later insert, preserving the invariant the
+  id hash's tombstone sentinel depends on.
+- **Given** a bound expressed in bytes, **when** rows of a known shape are
+  inserted, **then** the bound is honoured within the stated accounting error,
+  and that error is documented rather than implied.
+- **Given** back-pressure configured at a threshold, **when** the threshold is
+  crossed, **then** writers are slowed or parked, reads are unaffected, and no
+  shard deadlocks.
+- **Given** the process-level pressure signal and the iteration-1 growth
+  workload, **when** it runs to what previously exhausted memory, **then** the
+  process reaches a steady state and read p99 stays within its baseline — the
+  before/after that justifies the iteration.
+- **Given** a `durable` table, **when** an eviction policy is applied to it,
+  **then** either it is refused at compile time or it is a distinctly named
+  policy that says out loud it discards acked data.
+
+## Out Of Scope
+
+- **Writing evicted rows anywhere** — that is [6](06-cold-tiering.md). Here
+  eviction means the row is gone. Keeping the two apart is what makes the policy
+  work reviewable on its own.
+- **True LRU if it costs a write per read.** Touching per-row metadata on every
+  read would turn the 1µs read path into a write path — the same trap iteration
+  3's session touch has. An approximation (insertion order, a coarse clock, a
+  sampled counter) is very likely the right answer and fork 2 should say so
+  explicitly rather than defaulting to textbook LRU.
+- **The TTL cache middleware** — language
+  [iteration 18](../language-runtime-database/18-memory-db-features.md). Expiry
+  by *time* is that; bounding by *size* is this. They compose.
+- **Query-level result limits.** `take n` already exists in the query surface.
+- **Shrinking slabs back to the allocator.** Slab addresses are stable forever
+  by design and that invariant is load-bearing; reclaiming a slab whose rows were
+  all evicted is a separate, delicate change with its own iteration if anyone
+  wants it.
+
+## Info
+
+Forks the spec must settle:
+
+1. **May a `durable` table be bounded?** Evicting an acked row contradicts the
+   durability promise. But an audit table that must not grow forever is a real
+   need, and the honest form of it is probably archival (iteration 6) rather than
+   eviction. Leaning: bounds on `durable` are refused, and the need is redirected
+   to 6.
+2. **What is "least valuable"?** No per-row access time exists today, so LRU
+   costs a write per read. Candidates: insertion order (free — ids are already
+   monotonic per table), a coarse epoch stamped on write only, or sampled
+   approximation. Insertion order is FIFO not LRU, which is wrong for a cache
+   and fine for a queue — so the policy name should say which it is rather than
+   claiming "LRU" and delivering FIFO.
+3. **How is size observed?** Without observability (language iteration 30) there
+   is no metrics endpoint to publish it on. Options: a builtin returning a
+   table's current size, a `@table`-derived query, or stderr on threshold
+   crossing. A builtin is the smallest thing that makes the feature tunable by
+   the program that owns the budget.
+4. **Precedence when several tables can shed.** Largest first is simple; the
+   application's own priority order is more correct and needs a way to express
+   it. Proportional shedding is fairest and hardest to reason about. This
+   decides whether the pressure signal is predictable enough to trust.
diff --git a/docs/stories/databasev2/06-cold-tiering.md b/docs/stories/databasev2/06-cold-tiering.md
new file mode 100644
index 0000000..0ac6994
--- /dev/null
+++ b/docs/stories/databasev2/06-cold-tiering.md
@@ -0,0 +1,183 @@
+---
+track: databasev2
+iteration: "6"
+status: refine
+---
+
+# databasev2 6 — cold tiering: rows that leave RAM and come back
+
+> Part of [Story — databasev2: the database beyond RAM](00-story.md).
+> Needs [2](02-table-storage-modes.md) for the `cold` mode declaration,
+> [3](03-wal-checkpoint.md) so the log this builds on does not grow forever,
+> and [5](05-bounded-tables-eviction.md) for the policy machinery.
+>
+> **The iteration that actually raises the ceiling, and the one most likely to
+> go wrong.** Everything before it makes the limit visible, declared and
+> managed. This one removes it — for tables that opt in — and in doing so
+> touches the project's most load-bearing principle. It should be approached
+> with more suspicion than enthusiasm.
+
+## Goals
+
+- **A `cold` table may hold more rows than fit in memory.** Recently-used rows
+  are resident; the rest live on disk and are faulted back on access. This is
+  the whole feature and every other goal is a constraint on it.
+- **Do it without becoming a paged storage engine.** `discarded.md` records that
+  the disk story is the WAL and that a paged B-tree engine was rejected. `cold`
+  must not be a licence to rebuild SQLite inside `database/src`. The design that
+  respects the doctrine reuses the log that already exists plus an index into
+  it — a log-structured read path, not a page cache.
+- **Keep the resident path exactly as fast as it is.** A `durable` or `ram`
+  table must not pay one instruction for a feature it does not use. Iteration
+  22's 1.3M ops/s read baseline is the regression gate, and a measurable read
+  regression on non-`cold` tables is grounds to reject the design, not to tune
+  it.
+- **Be honest in the query surface about what a fault costs.** A scan over a
+  `cold` table can touch disk per row. The engine currently answers every read
+  from memory at p50 1µs; a `cold` scan is a different animal and the language
+  should not pretend otherwise — see fork 3, which is the most important
+  question in this iteration.
+- **Never lose an acked write.** Every guarantee iterations 9 and 22 established
+  holds byte-for-byte: ack-after-fsync, whole-or-nothing replay, torn tails
+  dropped by CRC. A tiering layer that weakens any of those is a regression
+  disguised as a feature.
+
+## Phases
+
+### Phase A — settle the design before writing any of it
+
+- This iteration needs a spec more than any other in the track. The candidate
+  shapes are genuinely different: (a) the WAL becomes the primary store with an
+  in-memory id→offset index and a resident row cache; (b) a separate
+  append-only row file per cold table, checkpointed by 3's machinery; (c)
+  eviction to disk with a free-space map, which is the paged engine wearing a
+  hat.
+- Whichever wins must state its read amplification, its recovery story, and what
+  happens when the index itself does not fit — an id→offset map for a billion
+  rows is not free either, and a design that only moves the ceiling is worth
+  knowing about before it is built.
+- Verify: the spec names the shape, the amplification, and the failure modes.
+  No code in this phase.
+
+### Phase B — the resident/cold boundary
+
+- Which rows are resident: reuse [5](05-bounded-tables-eviction.md)'s policy and
+  accounting rather than inventing a second notion of "least valuable".
+- Eviction becomes write-then-drop instead of drop, and it must be atomic with
+  respect to a concurrent reader — a row that is being written out must not be
+  briefly unreachable.
+- The fault path: a lookup that misses resident memory reads from disk,
+  materialises the row, and admits it under the resident policy.
+- Verify: a table larger than the resident bound serves correct rows for every
+  id; a row evicted and faulted back is byte-identical, including every heap
+  value (`db_text`, `db_rec`, `db_multi`, `db_map` each round-trip).
+
+### Phase C — indexes and constraints across the boundary
+
+- **The hard part, and the reason this is late in the track.** A secondary index
+  over a `cold` table either stays fully resident (bounding the table by index
+  size rather than row size — which may be the honest answer) or is itself
+  tiered. A `@unique` constraint must hold across rows nobody has in memory: the
+  shadow check cannot scan a slab that is not there.
+- Foreign-key restrict must also hold — a delete has to know whether any cold
+  row references it.
+- Verify: `@unique` refuses a duplicate whose only conflicting row is cold; FK
+  restrict refuses a delete whose only referrer is cold. These two criteria are
+  the correctness core of the iteration.
+
+### Phase D — recovery
+
+- Crash mid-eviction, crash mid-fault, crash mid-checkpoint-of-a-cold-table.
+  Each must recover to a consistent state with no acked write lost and no row
+  visible twice.
+- Interaction with [3](03-wal-checkpoint.md)'s snapshot: a cold table's on-disk
+  rows are part of the durable state a checkpoint must account for, not
+  something it can truncate past.
+- Verify: `kill -9` at each of the three points, replayed, with every acked write
+  present and the resident/cold split re-derived correctly.
+
+### Phase E — measure it, then decide whether to keep it
+
+- Read/write throughput and p99 for a `cold` table at several resident ratios,
+  and a **regression check that non-`cold` tables did not move**.
+- Publish the amplification honestly in `perf-targets.md`: how much slower a
+  cold fault is than a resident read, as a number.
+- Verify: `just db-bench` green with new cold-path rows; the resident baseline
+  unchanged; `just employee`, `just db-actor`, `oop-accept` green; ASan and TSan
+  clean on the fault path.
+
+## Acceptance Criteria
+
+- **Given** a `cold` table with more rows than the resident bound, **when** any
+  row is looked up by id, **then** it is returned correctly whether resident or
+  faulted, byte-identical including every heap-valued column.
+- **Given** a `cold` table under a read workload, **when** the resident set is
+  smaller than the working set, **then** the process holds steady state without
+  approaching the RAM ceiling iteration 1 measured.
+- **Given** a `@unique` column on a `cold` table, **when** a duplicate is
+  inserted whose conflicting row is **not resident**, **then** the insert is
+  refused — the constraint holds across the boundary or it does not hold.
+- **Given** a `ref` into a `cold` table, **when** the referenced row's owner is
+  deleted and the only referrer is cold, **then** FK restrict refuses the delete.
+- **Given** `kill -9` during an eviction, a fault, and a checkpoint, **when** the
+  program restarts, **then** every acked write is present, no row appears twice,
+  and the resident/cold split is re-derived correctly.
+- **Given** a `durable` or `ram` table, **when** the read benchmark runs after
+  this iteration, **then** its throughput and p99 are inside the existing
+  baseline tolerance — no cost for a feature not used.
+- **Given** a cold fault, **when** its latency is measured, **then** the
+  amplification versus a resident read is recorded in `perf-targets.md` as a
+  number a developer can plan around.
+
+## Out Of Scope
+
+- **A paged B-tree storage engine.** Explicitly rejected in
+  [`discarded.md`](../../plan/discarded.md) and not reopened by this iteration.
+  If the spec phase concludes that tiering *requires* one, the correct outcome is
+  to reject tiering and say so — not to quietly build the thing the project
+  decided against.
+- **Making `cold` the default, or applying it to a table that did not ask.**
+  Opt-in per table, forever.
+- **Tiering to anything but the local filesystem.** Object storage needs
+  outbound sockets (language
+  [iteration 38](../language-runtime-database/38-content-platform-capabilities.md))
+  and would change the latency story by orders of magnitude.
+- **Compression of cold rows.** Composes with
+  [porch 7](../porch/07-sse-and-compression.md)'s codec if that lands first;
+  not a dependency either way and not this slice.
+- **Cross-shard cold tables.** The owner shard owns the store and the WAL; a
+  cold table is more of the same. Per-shard storage is a separate architectural
+  question noted in [2](02-table-storage-modes.md)'s forks.
+- **Tiering the query planner's behaviour.** If a scan over a cold table is
+  expensive, the answer for now is that it is expensive and documented — not a
+  cost-based planner.
+
+## Info
+
+Forks the spec must settle — this iteration is mostly forks, which is why phase
+A produces no code:
+
+1. **Which shape?** WAL-as-primary-store with an id→offset index and a row
+   cache reuses machinery that exists and keeps the doctrine ("the disk story is
+   the WAL") literally true. A separate per-table row file is cleaner to reason
+   about and duplicates the log. Eviction with a free-space map is the rejected
+   paged design. Leaning (a), with the caveat in fork 2.
+2. **What if the index does not fit either?** An id→offset entry per row is far
+   smaller than a row, so this moves the ceiling by a large constant — but it
+   does not remove it. Say so plainly in the spec: `cold` buys an order of
+   magnitude, not infinity. A design sold as unlimited will be deployed as if it
+   were.
+3. **Does the language surface the cost?** Three positions. Silent — a cold
+   table reads like any other and the developer discovers the latency in
+   production. Annotated — the mode is at the declaration, so an attentive
+   reader knows, which is the status quo of this design. Or *explicit at the use
+   site*, where a query over a cold table must acknowledge it somehow. The third
+   is most in keeping with a language whose whole thesis is that the compiler
+   tells you the truth — and it is also the most intrusive. This is the fork with
+   the largest effect on what writeonce *is*, and it deserves the brainstorm more
+   than any implementation detail here.
+4. **Is `@unique` on a cold table simply refused?** Keeping a unique index fully
+   resident is a bound on the table by index size, which is honest and simple.
+   Refusing `@unique` on `cold` outright is even simpler and might be right for
+   a first version — a constraint that silently only checks resident rows would
+   be a correctness hole, and that is the one outcome that must not ship.
diff --git a/docs/stories/language-runtime-database/refine/33-single-file-db.md b/docs/stories/databasev2/07-single-file-db.md
similarity index 86%
rename from docs/stories/language-runtime-database/refine/33-single-file-db.md
rename to docs/stories/databasev2/07-single-file-db.md
index 1996435..7eeb598 100644
--- a/docs/stories/language-runtime-database/refine/33-single-file-db.md
+++ b/docs/stories/databasev2/07-single-file-db.md
@@ -1,12 +1,18 @@
 ---
-iteration: "33"
+track: databasev2
+iteration: "7"
+was_language_iteration: "33"
 status: refine
 ---
 
-# Iteration 33 — `WO_DATA=<path>.db`: the persistent store as one file
+# databasev2 7 — `WO_DATA=<path>.db`: the persistent store as one file
+
+> **Moved 2026-08-26** from the language track, where this was iteration 33.
+> Part of [Story — the database beyond RAM](../language-runtime-database/00-story.md). Content unchanged by
+> the move; its dependencies are restated in that track index.
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](../language-runtime-database/00-story.md).
 >
 > **Inserted 2026-08-22** (developer ask: "can the persistent db be in
 > file.db form?"). The truth is already almost there: `WO_DATA=<dir>`
@@ -46,7 +52,7 @@ status: refine
 
 - A paged database file (SQLite's shape) — RAM is authoritative; the
   disk story is the WAL, full stop.
-- Checkpoint/compaction — [iteration 32](32-wal-checkpoint.md)'s; its
+- Checkpoint/compaction — [iteration 32](03-wal-checkpoint.md)'s; its
   rename-swap (write snapshot+tail to a NEW file, fsync, `rename()`
   over the old) is exactly what keeps the single-file promise crash-safe
   when it lands. 33 before or after 32 works; landing 33 first means
diff --git a/docs/stories/language-runtime-database/hold/27-query-grammar-corpus.md b/docs/stories/databasev2/08-query-grammar-corpus.md
similarity index 95%
rename from docs/stories/language-runtime-database/hold/27-query-grammar-corpus.md
rename to docs/stories/databasev2/08-query-grammar-corpus.md
index d38ffa4..8113af6 100644
--- a/docs/stories/language-runtime-database/hold/27-query-grammar-corpus.md
+++ b/docs/stories/databasev2/08-query-grammar-corpus.md
@@ -1,12 +1,18 @@
 ---
-iteration: "27"
+track: databasev2
+iteration: "8"
+was_language_iteration: "27"
 status: hold
 ---
 
-# Iteration 27 — query grammar, driven by real embedded-DB corpora
+# databasev2 8 — query grammar, driven by real embedded-DB corpora
+
+> **Moved 2026-08-26** from the language track, where this was iteration 27.
+> Part of [Story — the database beyond RAM](../language-runtime-database/00-story.md). Content unchanged by
+> the move; its dependencies are restated in that track index.
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](../language-runtime-database/00-story.md).
 >
 > **Inserted 2026-08-16.** A query-surface iteration in the 9b family: the
 > language-integrated query grows to cover the grammar that *real
diff --git a/docs/stories/language-runtime-database/hold/20-cross-program-tables.md b/docs/stories/databasev2/09-cross-program-tables.md
similarity index 95%
rename from docs/stories/language-runtime-database/hold/20-cross-program-tables.md
rename to docs/stories/databasev2/09-cross-program-tables.md
index 490d986..86b9bff 100644
--- a/docs/stories/language-runtime-database/hold/20-cross-program-tables.md
+++ b/docs/stories/databasev2/09-cross-program-tables.md
@@ -1,12 +1,18 @@
 ---
-iteration: "20"
+track: databasev2
+iteration: "9"
+was_language_iteration: "20"
 status: hold
 ---
 
-# Iteration 20 — cross-program tables: attach to a running program's database
+# databasev2 9 — cross-program tables: attach to a running program's database
+
+> **Moved 2026-08-26** from the language track, where this was iteration 20.
+> Part of [Story — the database beyond RAM](../language-runtime-database/00-story.md). Content unchanged by
+> the move; its dependencies are restated in that track index.
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](../language-runtime-database/00-story.md).
 >
 > **Inserted 2026-08-15**, hence `20`. It follows 9b because a program
 > attaching to another's tables wants the same typed statements and queries
@@ -141,7 +147,7 @@ read or read+write (per-table refinement deferred until a workload needs
 it), and the registration is A's manifest so a grant is a config change +
 restart, not an API. **Superseded as the end state (2026-08-15):**
 identity is a keypair and grants name public keys — iteration
-[21](21-keypair-attach-auth.md) owns that; the uid check is only this
+[21](10-keypair-attach-auth.md) owns that; the uid check is only this
 iteration's bootstrap and must be flagged pre-21 wherever it ships.
 
 **4. What does B's statement actually block on?** B's insert crosses the
diff --git a/docs/stories/language-runtime-database/hold/21-keypair-attach-auth.md b/docs/stories/databasev2/10-keypair-attach-auth.md
similarity index 94%
rename from docs/stories/language-runtime-database/hold/21-keypair-attach-auth.md
rename to docs/stories/databasev2/10-keypair-attach-auth.md
index c0c76ba..b3bdc78 100644
--- a/docs/stories/language-runtime-database/hold/21-keypair-attach-auth.md
+++ b/docs/stories/databasev2/10-keypair-attach-auth.md
@@ -1,12 +1,18 @@
 ---
-iteration: "21"
+track: databasev2
+iteration: "10"
+was_language_iteration: "21"
 status: hold
 ---
 
-# Iteration 21 — keypair authentication for cross-program attach
+# databasev2 10 — keypair authentication for cross-program attach
+
+> **Moved 2026-08-26** from the language track, where this was iteration 21.
+> Part of [Story — the database beyond RAM](../language-runtime-database/00-story.md). Content unchanged by
+> the move; its dependencies are restated in that track index.
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](../language-runtime-database/00-story.md).
 >
 > **Inserted 2026-08-15.** Promotes iteration 20's identity fork (Info,
 > fork 3) to its own iteration: the name + unix-uid lean is the milestone
diff --git a/docs/stories/language-runtime-database/00-story.md b/docs/stories/language-runtime-database/00-story.md
index d7b515e..383e493 100644
--- a/docs/stories/language-runtime-database/00-story.md
+++ b/docs/stories/language-runtime-database/00-story.md
@@ -79,46 +79,45 @@ still pending IS the runtime-concurrency chain; order:
   measurement: a multi-shard program touching the database traps
   `WO_T_DB` today, and fixing that first lets one benchmark campaign
   cover single- and multi-shard honestly.
-- **31 has its story file** ([refine/31-actor-lifecycle.md](refine/31-actor-lifecycle.md));
+- **31 has its story file** ([31-actor-lifecycle.md](31-actor-lifecycle.md));
   30 stays a row until it is scheduled.
 - **Holds landed** (developer decision, 2026-08-21): 18, 20, 21, 26, 27,
-  28, 29 moved to `hold/`; 25's story file removed (its plan doc remains
+  28, 29 set to `status: hold`; 25's story file removed (its plan doc remains
   in superpowers). 19 landed 2026-08-20.
 
 | Seq | # | Iteration | Delivers |
 | --- | --- | --- | --- |
-| 1 | 1 | [Principles doc](done/01-principles-doc.md) | `docs/00-principles.md` — the doctrine page every later slice links back to |
-| 2 | 2 | [VM core](done/02-vm-core.md) | `wovm`: `.wob` loader, register interpreter, arena, borrow word, `@gc` collector |
-| 3 | 3 | [Compiler front](done/03-compiler-front.md) | `woc`: lexer → parser → typechecker → ownership pass, diagnostics |
-| 4 | 4 | [Single binary end-to-end](done/04-single-binary-e2e.md) | emitter + conformance corpus + `woc build` self-contained binary |
-| 5 | 5 | [Language surface](done/05-language-surface.md) | Haxe-parity adoptions, grammar + strictness halves (landed in waves through 2026-08-20) |
-| 6 | 6 | [Program mode + stdlib](done/06-program-mode-stdlib.md) | `fn main`, exit codes, `fs`/`proc`/`net`/`time`/`json` builtins |
-| 7 | 7 | [log-watcher proof](done/07-logwatcher-proof.md) | the driving workload compiled, executable, soak-proven (landed 2026-08-15) |
-| 8 | 7b | [Inferred GC + mark-sweep](done/07b-inferred-gc-mark-sweep.md) | `@gc` removed; GC-ness inferred; RC replaced by incremental per-shard tri-color mark-sweep |
-| 9 | 9 | [Database engine](done/09-database-engine.md) | class-shaped tables, typed WAL + recovery, `insert`/`select` execute |
-| 10 | 9b | [`@table`, relations, query](done/09b-table-relations-query.md) | `@table` real storage; `ref`/`backlink`/`multi`; compiler-checked queries |
-| 11 | 15 | [deps: `wo.toml [deps]`](done/15-deps-package-manager.md) | exact-rev git deps + `wo.lock` + `.wo-deps`; flat-only, offline once locked |
-| 12 | 16 | [web framework](done/16-web-framework.md) | the `.wo` framework v1 (router, middleware, auth, all three body hooks) consumed via `[deps]` |
-| 13 | 8+11 | [Shard-actor runtime](done/08-shard-actor-runtime.md) · [Fibers](done/11-fibers.md) | ✅ **THE ARC LANDED 2026-08-21** — stages 1+2 (fibers/budget/actors/io_uring plane; pinned shards, envelope sends, home-routed frees, WO-E222) + stage 3's transparent DB actor: worker statements marshal to shard 0, ack-after-owner-fsync, materialized replies (`just db-actor` 8/0, ASan/TSan, WAL replay pair). fs-park re-scoped out (disclosed in story 11). |
-| 14 | 22 | [Durability, throughput, scale](done/22-durability-throughput-scale.md) | ✅ **LANDED 2026-08-21** — db-bench sample + `time.ticks` (builtin 84) + campaign driver + `bench/baseline.json` (74 metrics, tolerance-tuned); restart + 3× kill -9 proofs at both shard counts, gate bites. Measured: durable 4.5k vs ram 297k inserts/s (23's case); reads O(table) ≈1.5k/s (new candidate slice); mixread 1,280→21 ops/s single→multi (the arc's price); msgrate 13.4M/2.45M (deviation 4's number). *(was 9e)* |
+| 1 | 1 | [Principles doc](01-principles-doc.md) | `docs/00-principles.md` — the doctrine page every later slice links back to |
+| 2 | 2 | [VM core](02-vm-core.md) | `wovm`: `.wob` loader, register interpreter, arena, borrow word, `@gc` collector |
+| 3 | 3 | [Compiler front](03-compiler-front.md) | `woc`: lexer → parser → typechecker → ownership pass, diagnostics |
+| 4 | 4 | [Single binary end-to-end](04-single-binary-e2e.md) | emitter + conformance corpus + `woc build` self-contained binary |
+| 5 | 5 | [Language surface](05-language-surface.md) | Haxe-parity adoptions, grammar + strictness halves (landed in waves through 2026-08-20) |
+| 6 | 6 | [Program mode + stdlib](06-program-mode-stdlib.md) | `fn main`, exit codes, `fs`/`proc`/`net`/`time`/`json` builtins |
+| 7 | 7 | [log-watcher proof](07-logwatcher-proof.md) | the driving workload compiled, executable, soak-proven (landed 2026-08-15) |
+| 8 | 7b | [Inferred GC + mark-sweep](07b-inferred-gc-mark-sweep.md) | `@gc` removed; GC-ness inferred; RC replaced by incremental per-shard tri-color mark-sweep |
+| 9 | 9 | [Database engine](09-database-engine.md) | class-shaped tables, typed WAL + recovery, `insert`/`select` execute |
+| 10 | 9b | [`@table`, relations, query](09b-table-relations-query.md) | `@table` real storage; `ref`/`backlink`/`multi`; compiler-checked queries |
+| 11 | 15 | [deps: `wo.toml [deps]`](15-deps-package-manager.md) | exact-rev git deps + `wo.lock` + `.wo-deps`; flat-only, offline once locked |
+| 12 | 16 | [web framework](16-web-framework.md) | the `.wo` framework v1 (router, middleware, auth, all three body hooks) consumed via `[deps]` |
+| 13 | 8+11 | [Shard-actor runtime](08-shard-actor-runtime.md) · [Fibers](11-fibers.md) | ✅ **THE ARC LANDED 2026-08-21** — stages 1+2 (fibers/budget/actors/io_uring plane; pinned shards, envelope sends, home-routed frees, WO-E222) + stage 3's transparent DB actor: worker statements marshal to shard 0, ack-after-owner-fsync, materialized replies (`just db-actor` 8/0, ASan/TSan, WAL replay pair). fs-park re-scoped out (disclosed in story 11). |
+| 14 | 22 | [Durability, throughput, scale](22-durability-throughput-scale.md) | ✅ **LANDED 2026-08-21** — db-bench sample + `time.ticks` (builtin 84) + campaign driver + `bench/baseline.json` (74 metrics, tolerance-tuned); restart + 3× kill -9 proofs at both shard counts, gate bites. Measured: durable 4.5k vs ram 297k inserts/s (23's case); reads O(table) ≈1.5k/s (new candidate slice); mixread 1,280→21 ops/s single→multi (the arc's price); msgrate 13.4M/2.45M (deviation 4's number). *(was 9e)* |
 | 15 | 30 | Observability, CI, fuzz *(no story file yet)* | **NEW** — runtime counters + a profiler hook, 22's harness wired to run per change instead of by hand, and a fuzz target on the parser and `.wob` loader. The whole proof-maturity gap had no iteration to point at. |
-| 16 | 19 | [Float + Bytes](done/19-missing-scalar-types.md) | **LANDED 2026-08-20** — `.wob` v5; the full stack: IEEE-quiet f64 through literals/VM/@table/WAL/json + Bytes as the binary carrier, no implicit mixing, total-order indexes. Unblocks 24 (WS frames) and the crypto fork (digests). *(was 20)* |
-| 17 | 31 | [Actor lifecycle](refine/31-actor-lifecycle.md) | request/response (today `send` is one-way and callers `sleep` to await), bounded mailboxes with backpressure (today the FIFO just grows), actor death/supervision, and timers beyond `time.sleep`. 24 cannot be written honestly without these. *(story written 2026-08-21)* |
-| 18 | 24 | [chat: WebSocket workload](refine/24-chat-websocket-workload.md) | the arc's acceptance: WS upgrade + frames (SHA-1 via crypto fork, Bytes via 19), rooms/broadcast, 1k clients, drain-clean. *(was 19)* |
-| 19 | 23 | [io_uring group-commit](refine/23-io-uring-commit.md) | WAL WRITE+FSYNC chains on the arc's per-shard rings; fsync fallback kept (after 22 + the arc). *(was 9f)* |
-| 20 | 32 | [WAL checkpoint](refine/32-wal-checkpoint.md) | **NEW 2026-08-21** (stage-3 guarantee refinement found the hole) — the WAL is append-only forever: snapshot + truncate reclaims disk and bounds replay time; every durability guarantee byte-identical; crash mid-checkpoint recovers from the previous snapshot + full tail. After 23 (composes with group-commit); RAM slot-reuse already contracted in `04-db-binding.md`. |
-| 21 | 33 | [Single-file store](refine/33-single-file-db.md) | **NEW 2026-08-22** — `WO_DATA=<path>.db`: a file path IS the wal (the store already lives in exactly one file; this makes the surface say so). Driver-only, independent of the chain; composes with 32's rename-swap. |
-| 22 | 34 | [Crypto builtins](refine/34-crypto-builtins.md) | **NEW 2026-08-22** — SHA-1/SHA-256/HMAC-SHA256 as C builtins over Bytes (no bitwise ops in the language, hand-rolled per doctrine, vector-verified). GATES 24's WS handshake; digest floor for held 21 and the ETag row. |
-| 23 | 35 | [net runtime seams](refine/35-net-runtime-seams.md) | **NEW 2026-08-22** — the ledger's three 🔧 rows owned: fd deadlines composing with the park plane, Unix-socket listeners, peer address (trusted-proxy check). Framework knobs stay framework slices; pairs naturally with 24 (dead-client eviction). |
+| 16 | 19 | [Float + Bytes](19-missing-scalar-types.md) | **LANDED 2026-08-20** — `.wob` v5; the full stack: IEEE-quiet f64 through literals/VM/@table/WAL/json + Bytes as the binary carrier, no implicit mixing, total-order indexes. Unblocks 24 (WS frames) and the crypto fork (digests). *(was 20)* |
+| 17 | 31 | [Actor lifecycle](31-actor-lifecycle.md) | request/response (today `send` is one-way and callers `sleep` to await), bounded mailboxes with backpressure (today the FIFO just grows), actor death/supervision, and timers beyond `time.sleep`. 24 cannot be written honestly without these. *(story written 2026-08-21)* |
+| 18 | 24 | [chat: WebSocket workload](24-chat-websocket-workload.md) | the arc's acceptance: WS upgrade + frames (SHA-1 via crypto fork, Bytes via 19), rooms/broadcast, 1k clients, drain-clean. *(was 19)* |
+| 22 | 34 | [Crypto builtins](34-crypto-builtins.md) | **NEW 2026-08-22** — SHA-1/SHA-256/HMAC-SHA256 as C builtins over Bytes (no bitwise ops in the language, hand-rolled per doctrine, vector-verified). GATES 24's WS handshake; digest floor for held 21 and the ETag row. |
+| 23 | 37 | [wo-html components](37-wo-html-components.md) | **NEW 2026-08-23** — an MVC-shaped view layer in the wo-html LIBRARY (framework stays micro): structural `Component` interface (`render() -> Text`), layout components with slots, the site sample migrated as acceptance. Angular's component FORMAT studied and translated to server-rendered no-JS `.wo`; DI/bindings rejected. **LANDED 2026-08-25.** Raw text literal 2026-08-24 (backtick, verbatim content, margin stripped at lex time, `${ }` raw / `{{ }}` auto-escaping; WO-E004/WO-E005) — lexer plus one parser desugar, nothing downstream. Component layer 2026-08-25: `Component`/`render_all`/`Layout` in wo-html, `ok_html` moved into the framework, site and shop both migrated. |
+| 23 | 35 | [net runtime seams](35-net-runtime-seams.md) | **NEW 2026-08-22** — the ledger's three 🔧 rows owned: fd deadlines composing with the park plane, Unix-socket listeners, peer address (trusted-proxy check). Framework knobs stay framework slices; pairs naturally with 24 (dead-client eviction). |
+| 23 | 36 | [operator parity](36-operator-parity.md) | **NEW 2026-08-22** — `not`, the five bitwise operators (`& \| ^ << >>`, Int-only, riding the additive/multiplicative rungs Go-style), hex/binary/`_` literals, and compound assigns wired to the written-out form. **Code landed 2026-08-22** on branch `operator-parity`: `.wob` v6, opcodes 42–46 with the 0..63 shift trap (WO-E223), all gates green; reference project `.dev/reference/go` drove the operator-precedence design. Awaiting the developer's MANUAL pass over `docs/examples/operators/` (no test fixtures, by directive). Unblocks story 34's pure-`.wo` HMAC question. |
 | 24 | 25 | [HTTP service layer](../../superpowers/plans/2026-08-01-http-service-layer.md) | `service` blocks lower onto the framework (after 9b + 20 by their own precedence notes). **HELD 2026-08-21** — story file removed; the plan doc remains. *(was 10)* |
-| 25 | 18 | [framework v2: memory-rich features](hold/18-memory-db-features.md) | spec+plan approved: TTL cache, @table flags, durable job queue, `transaction { }` over the WAL's staged batch. **Demoted from seq 14**: more surface on a framework with one consumer, and the cache still stores `Text` because there are no generics |
-| 26 | 27 | [Query grammar corpus](hold/27-query-grammar-corpus.md) | grow the query grammar from real corpora; likely collapses to "confirm `len(query)` + add `exists`"; precedes 28. *(was 9g)* |
-| 27 | 26 | [Blue-green deploy](hold/26-blue-green-deploy.md) | two VM slots, in-runtime compile, atomic switch, resident rollback (plan authored after 9 + 25). *(was 12)* |
-| 28 | 20 | [Cross-program tables](hold/20-cross-program-tables.md) | attach to a running program's database over local IPC; owner stays the single writer (channel half-built). **Demoted from seq 16**: new distribution surface while there is no TLS, no crypto, and the multi-shard DB still traps. *(was 9c)* |
-| 29 | 21 | [Keypair attach auth](hold/21-keypair-attach-auth.md) | program identity is a keypair; mutual challenge–response at attach (crypto half-built; plan folds into 20's). **Demoted with 20** — and it needs crypto primitives that do not exist. *(was 9d)* |
-| 30 | 28 | [skillhost host workload](hold/28-skillhost-host-workload.md) | host-shaped driving workload naming runtime gaps — demoted with the framework goal. *(was 14)* |
-| 31 | 29 | [Compile-time metaprogramming](hold/29-compile-time-metaprogramming.md) | `@derive(...)` from class-table metadata; held with the parked drain by the 2026-08-08 scope directive. *(was 13)* |
-| ✅ | 17 | [library projects + `internal/`](done/17-library-projects-internal.md) | **LANDED 2026-08-20** — `kind = "library"` + entry-less check mode (retires the `--emit` workaround) and Go's `internal/` rule as WO-E108 at the consumer's `use`; driver-only, VM/GC untouched. `just web-app` 26/0 |
+| 25 | 18 | [framework v2: memory-rich features](18-memory-db-features.md) | spec+plan approved: TTL cache, @table flags, durable job queue, `transaction { }` over the WAL's staged batch. **Demoted from seq 14**: more surface on a framework with one consumer, and the cache still stores `Text` because there are no generics |
+| 27 | 26 | [Blue-green deploy](26-blue-green-deploy.md) | two VM slots, in-runtime compile, atomic switch, resident rollback (plan authored after 9 + 25). *(was 12)* |
+| 30 | 28 | [skillhost host workload](28-skillhost-host-workload.md) | host-shaped driving workload naming runtime gaps — demoted with the framework goal. *(was 14)* |
+| 31 | 29 | [Compile-time metaprogramming](29-compile-time-metaprogramming.md) | `@derive(...)` from class-table metadata; held with the parked drain by the 2026-08-08 scope directive. *(was 13)* |
+| 32 | 38 | [Content platform capabilities](38-content-platform-capabilities.md) | **NEW 2026-08-26** — the two capability families nothing owns, read off `wob.h`: `fs` mutation (`write`/`remove`/`rename`/`mkdir` — the table holds exactly six fs builtins, ids 40–45, where `append` creates-if-absent and grows, so a file is never replaced, truncated, deleted or renamed) and `net.connect` (ids 51–55 + 91–95, no connect; no `connect()` call in `runtime/src/` at all — which is every identity/notification/federation story at once; 35 deferred connect-side timeouts as "no workload asks yet" — this is the ask). Driven by a `docs/examples/vault` content-collaboration workload in 28's mould; WebDAV, CRDT editing, previews and FTS each get a written verdict instead of an implication. New builtins start at 96 (89/90 are 31's reserved holes); no `.wob` bump. Off-chain, wants a spec. |
+| — | — | **[▸ the `databasev2` track](../databasev2/00-story.md)** | **Six pending database iterations moved out 2026-08-26** — WAL checkpoint *(was 32)*, io_uring group commit *(was 23)*, single-file store *(was 33)*, query grammar *(was 27)*, cross-program tables *(was 20)*, keypair attach auth *(was 21)* — renumbered 1–10 in that track alongside four new ones: the RAM-ceiling measurement, `@table` storage modes (the grammar that makes durability per-table instead of one global `WO_DATA`), bounded tables with eviction, and cold tiering. **Done database work stays here as v1 history:** 9 (engine), 9b (`@table`/relations/query) and 22 (durability baseline) are rows above and did not move. |
+| 33 | 39 | [Web framework parity](39-web-framework-parity.md) | **NEW 2026-08-26** — gofiber/fiber v3.5.0 added as the web-framework reference and read end to end ([the study](../../plan/exploration/fiber/00-fiber-parity.md)); nine of its 32 middleware already have a `porch` counterpart, so the gaps are breadth, not foundations — with one exception. The study's sharpest finding: the framework's own ledger said CSRF and sessions were UNBLOCKED because iteration 34 landed HMAC, but **there is no source of randomness in the runtime at all**, and an HMAC over a guessable session id is a signed guess. So 39 leads with a random-bytes builtin, then cookies (absent in both directions; `Resp.headers: map<Text,Text>` structurally cannot emit two `Set-Cookie` lines), then the store-backed chain — limiter and idempotency first since they need only `@table` + `time.ticks`. Off-chain, wants a spec. |
+| ✅ | 17 | [library projects + `internal/`](17-library-projects-internal.md) | **LANDED 2026-08-20** — `kind = "library"` + entry-less check mode (retires the `--emit` workaround) and Go's `internal/` rule as WO-E108 at the consumer's `use`; driver-only, VM/GC untouched. `just web-app` 26/0 |
 
 
 Review protocol: the developer reads one iteration, approves or amends;
diff --git a/docs/stories/language-runtime-database/done/01-principles-doc.md b/docs/stories/language-runtime-database/01-principles-doc.md
similarity index 99%
rename from docs/stories/language-runtime-database/done/01-principles-doc.md
rename to docs/stories/language-runtime-database/01-principles-doc.md
index 96222c3..e13c66a 100644
--- a/docs/stories/language-runtime-database/done/01-principles-doc.md
+++ b/docs/stories/language-runtime-database/01-principles-doc.md
@@ -6,7 +6,7 @@ status: done
 # Iteration 1 — the principles doc
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 
 ## Goals
 
diff --git a/docs/stories/language-runtime-database/done/02-vm-core.md b/docs/stories/language-runtime-database/02-vm-core.md
similarity index 99%
rename from docs/stories/language-runtime-database/done/02-vm-core.md
rename to docs/stories/language-runtime-database/02-vm-core.md
index 6ee7b10..3e57d1a 100644
--- a/docs/stories/language-runtime-database/done/02-vm-core.md
+++ b/docs/stories/language-runtime-database/02-vm-core.md
@@ -6,7 +6,7 @@ status: done
 # Iteration 2 — VM core (`wovm`)
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 
 ## Goals
 
diff --git a/docs/stories/language-runtime-database/done/03-compiler-front.md b/docs/stories/language-runtime-database/03-compiler-front.md
similarity index 99%
rename from docs/stories/language-runtime-database/done/03-compiler-front.md
rename to docs/stories/language-runtime-database/03-compiler-front.md
index e73dc64..606257a 100644
--- a/docs/stories/language-runtime-database/done/03-compiler-front.md
+++ b/docs/stories/language-runtime-database/03-compiler-front.md
@@ -6,7 +6,7 @@ status: done
 # Iteration 3 — compiler front (`woc`)
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 
 ## Goals
 
diff --git a/docs/stories/language-runtime-database/done/04-single-binary-e2e.md b/docs/stories/language-runtime-database/04-single-binary-e2e.md
similarity index 99%
rename from docs/stories/language-runtime-database/done/04-single-binary-e2e.md
rename to docs/stories/language-runtime-database/04-single-binary-e2e.md
index e45769a..3dc6c33 100644
--- a/docs/stories/language-runtime-database/done/04-single-binary-e2e.md
+++ b/docs/stories/language-runtime-database/04-single-binary-e2e.md
@@ -6,7 +6,7 @@ status: done
 # Iteration 4 — single binary end-to-end
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 
 ## Goals
 
diff --git a/docs/stories/language-runtime-database/done/05-language-surface.md b/docs/stories/language-runtime-database/05-language-surface.md
similarity index 99%
rename from docs/stories/language-runtime-database/done/05-language-surface.md
rename to docs/stories/language-runtime-database/05-language-surface.md
index 8ff1a38..fff573e 100644
--- a/docs/stories/language-runtime-database/done/05-language-surface.md
+++ b/docs/stories/language-runtime-database/05-language-surface.md
@@ -6,7 +6,7 @@ status: done
 # Iteration 5 — language surface (Haxe-parity adoptions)
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 
 
 > **Status: ✅ COMPLETE 2026-08-20.** The *grammar* half landed 2026-08-14 —
diff --git a/docs/stories/language-runtime-database/done/06-program-mode-stdlib.md b/docs/stories/language-runtime-database/06-program-mode-stdlib.md
similarity index 95%
rename from docs/stories/language-runtime-database/done/06-program-mode-stdlib.md
rename to docs/stories/language-runtime-database/06-program-mode-stdlib.md
index eb34aa2..46b80b9 100644
--- a/docs/stories/language-runtime-database/done/06-program-mode-stdlib.md
+++ b/docs/stories/language-runtime-database/06-program-mode-stdlib.md
@@ -6,7 +6,7 @@ status: done
 # Iteration 6 — program mode + systems stdlib
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 
 
 > **Status (2026-08-14):** ✅ landed for the surface the driving workload uses —
@@ -16,7 +16,7 @@ status: done
 > `Proc` records, plus `json` encode/decode over `.wob` v2 class metadata.
 > What the workload never calls was not written. Two lifetime defects found
 > here are being fixed as part of
-> [`plan/compiler/2026-08-14-logwatcher-executable.md`](../../../plan/compiler/2026-08-14-logwatcher-executable.md):
+> [`plan/compiler/2026-08-14-logwatcher-executable.md`](../../plan/compiler/2026-08-14-logwatcher-executable.md):
 > the runtime's own argv container is never freed, and blocking `accept`/`read`
 > ignore the stop signal.
 
diff --git a/docs/stories/language-runtime-database/done/07-logwatcher-proof.md b/docs/stories/language-runtime-database/07-logwatcher-proof.md
similarity index 93%
rename from docs/stories/language-runtime-database/done/07-logwatcher-proof.md
rename to docs/stories/language-runtime-database/07-logwatcher-proof.md
index 583940b..9c9d0af 100644
--- a/docs/stories/language-runtime-database/done/07-logwatcher-proof.md
+++ b/docs/stories/language-runtime-database/07-logwatcher-proof.md
@@ -6,7 +6,7 @@ status: done
 # Iteration 7 — log-watcher proof workload
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 
 ## Goals
 
@@ -24,7 +24,7 @@ status: done
 > SIGTERM ends parked syscalls, fds flat across 200 requests, and the
 > `LW_SOAK` gate holds RSS/descriptors flat under sustained load.
 > `just log-watcher`: 7 checks, 0 failures. The work is recorded in
-> [`plan/compiler/2026-08-14-logwatcher-executable.md`](../../../plan/compiler/2026-08-14-logwatcher-executable.md)
+> [`plan/compiler/2026-08-14-logwatcher-executable.md`](../../plan/compiler/2026-08-14-logwatcher-executable.md)
 > and nothing else blocks this iteration.
 
 ## Acceptance Criteria
@@ -74,7 +74,7 @@ status: done
 - The authoring plan (`docs/superpowers/plans/2026-08-01-log-watcher-sample.md`)
   is spent: the `.wo` files exist and compile.
 - What remains is
-  [`plan/compiler/2026-08-14-logwatcher-executable.md`](../../../plan/compiler/2026-08-14-logwatcher-executable.md)
+  [`plan/compiler/2026-08-14-logwatcher-executable.md`](../../plan/compiler/2026-08-14-logwatcher-executable.md)
   — six tasks, every one traced to a measurement on this sample: the ownership
   pass learning stdlib return types, dropping a projected temporary, the
   runtime's own argv container, honouring the stop signal in blocking calls,
diff --git a/docs/stories/language-runtime-database/done/07b-inferred-gc-mark-sweep.md b/docs/stories/language-runtime-database/07b-inferred-gc-mark-sweep.md
similarity index 95%
rename from docs/stories/language-runtime-database/done/07b-inferred-gc-mark-sweep.md
rename to docs/stories/language-runtime-database/07b-inferred-gc-mark-sweep.md
index 6481746..7f1bd9c 100644
--- a/docs/stories/language-runtime-database/done/07b-inferred-gc-mark-sweep.md
+++ b/docs/stories/language-runtime-database/07b-inferred-gc-mark-sweep.md
@@ -6,7 +6,7 @@ status: done
 # Iteration 7b — inferred GC + incremental mark-sweep
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **Inserted 2026-08-11**, after the plan was first drawn — hence `7b` rather
 > than a renumber. It sits here because the log-watcher critical path
@@ -15,13 +15,13 @@ status: done
 
 
 > **Status (2026-08-18): LANDED** (branch `inferred-gc`; plan
-> [`2026-08-18-inferred-gc-mark-sweep.md`](../../../superpowers/plans/2026-08-18-inferred-gc-mark-sweep.md)).
+> [`2026-08-18-inferred-gc-mark-sweep.md`](../../superpowers/plans/2026-08-18-inferred-gc-mark-sweep.md)).
 > The front end infers GC-ness (structural SCC + demand promotion,
 > `woc --dump-gc`), `@gc` in source is WO-E104, and the runtime's RC +
 > Bacon–Rajan collector is replaced by an incremental per-shard tri-color
 > mark-sweep with a Yuasa deletion barrier — `.wob` is v4, opcodes 27–28
 > reserved. The worked example is
-> [`docs/examples/gc-cycle`](../../../examples/gc-cycle/README.md): its ring
+> [`docs/examples/gc-cycle`](../../examples/gc-cycle/README.md): its ring
 > compiles with no annotation, runs, and is reclaimed in budgeted slices,
 > ASan-clean. All four recorded `@gc`/RC defects are deleted by
 > construction; `just oop-accept` is fully green (criterion 3's ASan clause
@@ -93,11 +93,11 @@ status: done
 
 ## Info
 
-- Governing spec: [`docs/superpowers/specs/2026-08-11-inferred-gc-mark-sweep-design.md`](../../../superpowers/specs/2026-08-11-inferred-gc-mark-sweep-design.md).
+- Governing spec: [`docs/superpowers/specs/2026-08-11-inferred-gc-mark-sweep-design.md`](../../superpowers/specs/2026-08-11-inferred-gc-mark-sweep-design.md).
 - **Gated by the benchmark (2026-08-15):** this is the "implement garbage
   collection" lever of the performance arc — tri-color mark-sweep replacing
   RC changes the write path's tail latency, so landing it means re-running
-  iteration [22](../done/22-durability-throughput-scale.md) and recording the
+  iteration [22](22-durability-throughput-scale.md) and recording the
   delta (does tracing help or hurt p99 under write load?).
 - **Constraint added by the database track (2026-08-15):** a GC-managed value
   in a `@table` field is a compile error (the engine/heap bulkhead — 9b
diff --git a/docs/stories/language-runtime-database/done/08-shard-actor-runtime.md b/docs/stories/language-runtime-database/08-shard-actor-runtime.md
similarity index 94%
rename from docs/stories/language-runtime-database/done/08-shard-actor-runtime.md
rename to docs/stories/language-runtime-database/08-shard-actor-runtime.md
index 7bd1aea..36d1358 100644
--- a/docs/stories/language-runtime-database/done/08-shard-actor-runtime.md
+++ b/docs/stories/language-runtime-database/08-shard-actor-runtime.md
@@ -7,7 +7,7 @@ chain: 1
 # Iteration 8 — shard-actor runtime (the 8+11 concurrency arc, part 1)
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **✅ LANDED 2026-08-21** — the arc is complete. Stage 3 closed the
 > `WO_T_DB` hole: worker-shard DB statements marshal to the owner shard
@@ -33,8 +33,8 @@ chain: 1
 >
 > **RE-SEQUENCED 2026-08-21** (developer decision): the brainstorm →
 > spec → plan happened. The arc's plan of record is
-> [`2026-08-20-shard-fiber-arc.md`](../../../superpowers/plans/2026-08-20-shard-fiber-arc.md)
-> (spec: [`2026-08-20-shard-fiber-arc-design.md`](../../../superpowers/specs/2026-08-20-shard-fiber-arc-design.md)),
+> [`2026-08-20-shard-fiber-arc.md`](../../superpowers/plans/2026-08-20-shard-fiber-arc.md)
+> (spec: [`2026-08-20-shard-fiber-arc-design.md`](../../superpowers/specs/2026-08-20-shard-fiber-arc-design.md)),
 > and **stages 1+2 LANDED 2026-08-20** on branch `concurrency-arc`
 > (T1–T6, seven disclosed deviations recorded in the plan). Remaining
 > scope: **stage 3, the transparent DB actor** — a correctness fix, not
@@ -163,7 +163,7 @@ the slice's marker doc when it landed):
 | Durability | ✅ fsync-per-commit, ack-after-durable; the ack crosses shards only AFTER the owner's fsync (`just db-actor`'s WAL pair). Power-loss rides fdatasync semantics; 22's kill battery is the scripted proof. |
 | Crash recovery | ✅ boot replay, torn-tail drop, index rebuild; replay completes on the primary before any worker serves (main.c boots the engine before the shards). 22 scripts the restart proof. |
 | Concurrency control | ✅ stage 3 — the DB actor serializes every statement; replies are materialized copies, no torn read by construction. Cross-statement snapshots arrive with 18. |
-| Space reclamation | RAM ✅ (deleted rows free their slot — ids never reused, slots are); disk ✖ → [story 32](../refine/32-wal-checkpoint.md), end of chain. |
+| Space reclamation | RAM ✅ (deleted rows free their slot — ids never reused, slots are); disk ✖ → [databasev2 story 3](../databasev2/03-wal-checkpoint.md), end of chain. |
 
 - The C proving ground (`docs/plan/exploration/c-runtime/`, phases A–F:
   epoll loops, eventfd mail) is the substrate this lifts into `wovm`.
@@ -172,19 +172,19 @@ the slice's marker doc when it landed):
 - The VM's object header has carried a shard id since iteration 2 — no
   relayout.
 - **Gated by the benchmark:** landing the arc means re-running
-  [22](../done/22-durability-throughput-scale.md) at the concurrency
+  [22](22-durability-throughput-scale.md) at the concurrency
   scale it unlocks and recording the before/after delta; it is also
-  where [23](../refine/23-io-uring-commit.md) gets a thread to overlap
+  where [4](../databasev2/04-io-uring-commit.md) gets a thread to overlap
   durability against.
 
 ## Proposed Solution
 
 Execute stage 3 of the plan of record
-([`2026-08-20-shard-fiber-arc.md`](../../../superpowers/plans/2026-08-20-shard-fiber-arc.md)):
+([`2026-08-20-shard-fiber-arc.md`](../../superpowers/plans/2026-08-20-shard-fiber-arc.md)):
 the DB-actor migration — engine calls off the owner shard become message
 sends with parked replies, closing the `WO_T_DB` hole. Stages 1+2
 (scheduler, fibers, unified spawn/send, WO-E222 traced-send rejection,
 cross-shard envelopes with home-routed frees) landed 2026-08-20. After
 stage 3: 22 measures, then iteration 24 proves the arc. Actor lifecycle
 (request/response, backpressure, supervision, timers) is deliberately
-NOT the arc's scope — it is [iteration 31](../refine/31-actor-lifecycle.md).
+NOT the arc's scope — it is [iteration 31](31-actor-lifecycle.md).
diff --git a/docs/stories/language-runtime-database/done/09-database-engine.md b/docs/stories/language-runtime-database/09-database-engine.md
similarity index 95%
rename from docs/stories/language-runtime-database/done/09-database-engine.md
rename to docs/stories/language-runtime-database/09-database-engine.md
index 051f94e..5206ce0 100644
--- a/docs/stories/language-runtime-database/done/09-database-engine.md
+++ b/docs/stories/language-runtime-database/09-database-engine.md
@@ -6,7 +6,7 @@ status: done
 # Iteration 9 — database engine
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 
 ## Goals
 
@@ -59,7 +59,7 @@ status: done
   counts references. The full analysis (row views as borrows without a
   runtime net, cursor stability, GC-pause interaction) lives in the 9b
   design's section 6:
-  [`2026-08-15-table-relations-query-design.md`](../../../superpowers/specs/2026-08-15-table-relations-query-design.md).
+  [`2026-08-15-table-relations-query-design.md`](../../superpowers/specs/2026-08-15-table-relations-query-design.md).
 
 ## Proposed Solution
 
diff --git a/docs/stories/language-runtime-database/done/09b-table-relations-query.md b/docs/stories/language-runtime-database/09b-table-relations-query.md
similarity index 97%
rename from docs/stories/language-runtime-database/done/09b-table-relations-query.md
rename to docs/stories/language-runtime-database/09b-table-relations-query.md
index 3f5b9e3..3611f0a 100644
--- a/docs/stories/language-runtime-database/done/09b-table-relations-query.md
+++ b/docs/stories/language-runtime-database/09b-table-relations-query.md
@@ -6,7 +6,7 @@ status: done
 # Iteration 9b — `@table`, relations, and language-integrated query
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **Inserted 2026-08-11**, hence `9b` rather than a renumber. It follows
 > iteration 9 because a query surface needs tables that actually execute, and
@@ -14,13 +14,13 @@ status: done
 > results.
 >
 > **Spec exists (2026-08-15):**
-> [`2026-08-15-table-relations-query-design.md`](../../../superpowers/specs/2026-08-15-table-relations-query-design.md)
+> [`2026-08-15-table-relations-query-design.md`](../../superpowers/specs/2026-08-15-table-relations-query-design.md)
 > settles the three forks recorded in *Info* below (kept as the decision
 > record): the SQL/Cypher layer is superseded as the program surface,
 > the syntax is a compiler-desugared comprehension, and the references
 > contribute vocabulary + semantics (System.Linq) and execution + integrity
 > vocabulary (PostgreSQL, surveyed with the spec). Plan:
-> [`2026-08-15-employee-relations-query.md`](../../../plan/compiler/2026-08-15-employee-relations-query.md).
+> [`2026-08-15-employee-relations-query.md`](../../plan/compiler/2026-08-15-employee-relations-query.md).
 
 ## Goals
 
diff --git a/docs/stories/language-runtime-database/done/11-fibers.md b/docs/stories/language-runtime-database/11-fibers.md
similarity index 90%
rename from docs/stories/language-runtime-database/done/11-fibers.md
rename to docs/stories/language-runtime-database/11-fibers.md
index df9098b..8fdcc66 100644
--- a/docs/stories/language-runtime-database/done/11-fibers.md
+++ b/docs/stories/language-runtime-database/11-fibers.md
@@ -7,7 +7,7 @@ chain: 1
 # Iteration 11 — fibers (the 8+11 concurrency arc, part 2)
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **✅ LANDED 2026-08-21** with the arc's stage 3 (fiber substance landed
 > stages 1+2; stage 3 added the plane-less reply park `WO_PARK_INBOX` —
@@ -26,7 +26,7 @@ chain: 1
 > The spawn-surface question below is SETTLED: one unified actor-address
 > surface (`spawn` returns an address, fiber or remote alike; `send`
 > moves ownership; same-heap sends take the cheap path). The arc's
-> driving workload is [iteration 24: chat](../refine/24-chat-websocket-workload.md)
+> driving workload is [iteration 24: chat](24-chat-websocket-workload.md)
 > — fiber-per-WebSocket-connection is the serving model that retires the
 > framework's close-when-idle keep-alive policy.
 >
@@ -43,7 +43,7 @@ chain: 1
 > move, round-robin placement, home-routed frees, WO-E222 on EVERY
 > spawn/send (placement makes any actor potentially remote), TID-verified
 > shard context. Deviations disclosed in the plan of record
-> ([`2026-08-20-shard-fiber-arc.md`](../../../superpowers/plans/2026-08-20-shard-fiber-arc.md)):
+> ([`2026-08-20-shard-fiber-arc.md`](../../superpowers/plans/2026-08-20-shard-fiber-arc.md)):
 > the inbox is a mutex-guarded list + eventfd (rings arrive only if
 > iteration 22 measures the mutex as a cost), the deterministic corpus
 > pins `WO_SHARDS=1`, two TSan races and one teardown SEGV fixed.
@@ -113,13 +113,13 @@ chain: 1
 
 - Normative contract (added 2026-08-21): stackless coroutine model,
   park/resume protocols, the no-`async` rule —
-  [`docs/plan/oop-vm/03-concurrency-coroutines.md`](../../../plan/oop-vm/03-concurrency-coroutines.md).
-- Research note: [`docs/plan/exploration/fibers/00-fibers.md`](../../../plan/exploration/fibers/00-fibers.md)
+  [`docs/plan/oop-vm/03-concurrency-coroutines.md`](../../plan/oop-vm/03-concurrency-coroutines.md).
+- Research note: [`docs/plan/exploration/fibers/00-fibers.md`](../../plan/exploration/fibers/00-fibers.md)
   — kernel's-eye evidence (task_struct costs, CFS collapse at high task
   counts) and the precedent survey (BEAM reductions adopted; Go stack
   copying and Tokio coloring rejected; Loom's park-under-blocking-API
   matches the stdlib posture).
-- Vision origin: [blue-green vision §3](../../../plan/exploration/blue-green-vm/00-vision.md);
+- Vision origin: [blue-green vision §3](../../plan/exploration/blue-green-vm/00-vision.md);
   iteration 8's scheduler is the substrate this extends.
 - Open questions — REDUCED AGAIN 2026-08-21: the spawn surface, budget
   size/granularity (back-edge accounting — see the plan's livelock
@@ -128,13 +128,13 @@ chain: 1
   implementation. Still open: how a parked fiber's borrow state interacts
   with the shard's GC safepoints — tracked for stage 3 / the collector's
   next pass. Lifecycle surface (request/response, backpressure,
-  supervision, timers) is [iteration 31](../refine/31-actor-lifecycle.md)'s, not
+  supervision, timers) is [iteration 31](31-actor-lifecycle.md)'s, not
   this story's.
 
 ## Proposed Solution
 
 - The plan exists and its fiber stages are landed:
-  [`2026-08-20-shard-fiber-arc.md`](../../../superpowers/plans/2026-08-20-shard-fiber-arc.md)
+  [`2026-08-20-shard-fiber-arc.md`](../../superpowers/plans/2026-08-20-shard-fiber-arc.md)
   (stages 1+2 complete 2026-08-20). This story closes when the arc's
   stage 3 lands and iteration 22 records the delta; the chat workload
-  ([iteration 24](../refine/24-chat-websocket-workload.md)) is the proof.
+  ([iteration 24](24-chat-websocket-workload.md)) is the proof.
diff --git a/docs/stories/language-runtime-database/done/15-deps-package-manager.md b/docs/stories/language-runtime-database/15-deps-package-manager.md
similarity index 94%
rename from docs/stories/language-runtime-database/done/15-deps-package-manager.md
rename to docs/stories/language-runtime-database/15-deps-package-manager.md
index 7fb2d09..30eb122 100644
--- a/docs/stories/language-runtime-database/done/15-deps-package-manager.md
+++ b/docs/stories/language-runtime-database/15-deps-package-manager.md
@@ -6,7 +6,7 @@ status: done
 # Iteration 15 — dependencies: `wo.toml [deps]`, git fetch, `wo.lock`
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **Inserted 2026-08-18. LANDED the same day** (branch `web-framework`): all
 > acceptance criteria met — `just deps-accept` 8/0 (cold fetch + lock, use
@@ -16,9 +16,9 @@ status: done
 > The enabler for code shared between writeonce repositories — the web
 > framework (iteration 16) is the driving consumer.
 >
-> **Spec exists:** [`2026-08-18-web-framework-design.md`](../../../superpowers/specs/2026-08-18-web-framework-design.md)
+> **Spec exists:** [`2026-08-18-web-framework-design.md`](../../superpowers/specs/2026-08-18-web-framework-design.md)
 > section A is normative for this iteration. **Plan:**
-> [`2026-08-18-deps-package-manager.md`](../../../superpowers/plans/2026-08-18-deps-package-manager.md)
+> [`2026-08-18-deps-package-manager.md`](../../superpowers/plans/2026-08-18-deps-package-manager.md)
 > (5 tasks: manifest inline-table + [deps]; resolver fetch/cache/lock;
 > multi-root discovery + module mapping + entry restriction; the
 > `just deps-accept` gate over file:// remotes; docs closeout).
diff --git a/docs/stories/language-runtime-database/done/16-web-framework.md b/docs/stories/language-runtime-database/16-web-framework.md
similarity index 97%
rename from docs/stories/language-runtime-database/done/16-web-framework.md
rename to docs/stories/language-runtime-database/16-web-framework.md
index db35cd3..cbcdf81 100644
--- a/docs/stories/language-runtime-database/done/16-web-framework.md
+++ b/docs/stories/language-runtime-database/16-web-framework.md
@@ -6,7 +6,7 @@ status: done
 # Iteration 16 — the web framework: a `.wo` library, HTTP/1.1 behind a proxy
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **Inserted 2026-08-18. LANDED 2026-08-19** (branch `web-framework`):
 > `just web-app` 14/0 — deps chain, auth middleware, CRUD with @unique 409 /
@@ -66,9 +66,9 @@ status: done
 > in the toolchain. h2c is the parked successor (after iterations 8/23/11,
 > when multiplexing has a scheduler to pay off on).
 >
-> **Spec exists:** [`2026-08-18-web-framework-design.md`](../../../superpowers/specs/2026-08-18-web-framework-design.md)
+> **Spec exists:** [`2026-08-18-web-framework-design.md`](../../superpowers/specs/2026-08-18-web-framework-design.md)
 > sections B (normative) and C (the parked h2c successor). **Plan:**
-> [`2026-08-19-web-framework.md`](../../../superpowers/plans/2026-08-19-web-framework.md)
+> [`2026-08-19-web-framework.md`](../../superpowers/plans/2026-08-19-web-framework.md)
 > (6 tasks: types/builders; HTTP/1.1 parse+serve; router+interfaces+App;
 > the web-app storefront; the `just web-app` gate; docs closeout). Two
 > enabling risks retired before planning: interface-field dispatch (probe)
diff --git a/docs/stories/language-runtime-database/done/17-library-projects-internal.md b/docs/stories/language-runtime-database/17-library-projects-internal.md
similarity index 99%
rename from docs/stories/language-runtime-database/done/17-library-projects-internal.md
rename to docs/stories/language-runtime-database/17-library-projects-internal.md
index f359bee..ce92a4c 100644
--- a/docs/stories/language-runtime-database/done/17-library-projects-internal.md
+++ b/docs/stories/language-runtime-database/17-library-projects-internal.md
@@ -6,7 +6,7 @@ status: done
 # Iteration 17 — library projects and dependency privacy (`kind`, `internal/`)
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **Inserted 2026-08-20, needs further refinement** (developer decision: keep
 > as an iteration, do not implement yet).
diff --git a/docs/stories/language-runtime-database/hold/18-memory-db-features.md b/docs/stories/language-runtime-database/18-memory-db-features.md
similarity index 89%
rename from docs/stories/language-runtime-database/hold/18-memory-db-features.md
rename to docs/stories/language-runtime-database/18-memory-db-features.md
index d1b51ba..c193f24 100644
--- a/docs/stories/language-runtime-database/hold/18-memory-db-features.md
+++ b/docs/stories/language-runtime-database/18-memory-db-features.md
@@ -7,12 +7,12 @@ status: hold
 
 > **Scope label (2026-08-20): this iteration is FRAMEWORK V2.** Framework
 > v1 is the transport/routing/body/security surface tracked in the
-> [framework README's status ledger](../../../examples/writeonce-framework/README.md);
+> [framework README's status ledger](../../examples/porch/README.md);
 > v2 is what the embedded store adds on top. v1 gaps land before or
 > alongside v2 as slices, per the ledger.
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **Inserted 2026-08-20, forks settled the same day** (developer decisions
 > below). Next step: spec + plan, implementation on approval — the
@@ -119,6 +119,17 @@ worked around.
   reads it, **then** the cached read reflects the write (bump
   invalidation), and `just web-app` stays green throughout.
 
+
+> **Not this iteration (noted 2026-08-26):** the Fiber v3.5.0 parity study
+> ([`plan/exploration/fiber/00-fiber-parity.md`](../../plan/exploration/fiber/00-fiber-parity.md))
+> found a second axis of framework gaps — cookies, sessions, CSRF, rate
+> limiting, idempotency, request ids, response helpers. Those went to
+> [iteration 39](39-web-framework-parity.md) rather than here, deliberately:
+> this iteration's spec is approved for the memory-rich half (TTL cache,
+> `@table` flags, durable job queue, `transaction { }`) and widening it would
+> invalidate that approval. The one overlap is the **TTL cache**, which stays
+> this iteration's — 39's out-of-scope list points back here for it.
+
 ## Out Of Scope
 
 Pub/sub and WebSockets (behind 8/11); streaming job payloads; cross-node
diff --git a/docs/stories/language-runtime-database/done/19-missing-scalar-types.md b/docs/stories/language-runtime-database/19-missing-scalar-types.md
similarity index 98%
rename from docs/stories/language-runtime-database/done/19-missing-scalar-types.md
rename to docs/stories/language-runtime-database/19-missing-scalar-types.md
index 0853efa..e0656c4 100644
--- a/docs/stories/language-runtime-database/done/19-missing-scalar-types.md
+++ b/docs/stories/language-runtime-database/19-missing-scalar-types.md
@@ -6,7 +6,7 @@ status: done
 # Iteration 19 — the missing scalar types: Float and Bytes
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **Inserted 2026-08-20, forks settled the same day** (developer
 > decisions below). Next: spec, then plan — a new storage kind touches
@@ -14,7 +14,7 @@ status: done
 >
 > **LANDED 2026-08-20.** Both scalars shipped full-stack as `.wob` v5. The
 > format decisions the story asked a spec for are recorded normatively in
-> [`docs/plan/oop-vm/00-wob-format.md`](../../../plan/oop-vm/00-wob-format.md)
+> [`docs/plan/oop-vm/00-wob-format.md`](../../plan/oop-vm/00-wob-format.md)
 > §"v5: Float and Bytes" — written in the same change as the code, per this
 > iteration's own last acceptance criterion — with the reasoning-under-the-code
 > in `runtime/src/CODE-LOGIC.md` and `compiler/src/CODE-LOGIC.md`. No separate
diff --git a/docs/stories/language-runtime-database/done/22-durability-throughput-scale.md b/docs/stories/language-runtime-database/22-durability-throughput-scale.md
similarity index 98%
rename from docs/stories/language-runtime-database/done/22-durability-throughput-scale.md
rename to docs/stories/language-runtime-database/22-durability-throughput-scale.md
index 2f39b4e..e54bf9e 100644
--- a/docs/stories/language-runtime-database/done/22-durability-throughput-scale.md
+++ b/docs/stories/language-runtime-database/22-durability-throughput-scale.md
@@ -7,7 +7,7 @@ chain: 2
 # Iteration 22 — durability proof, throughput, and scale under load
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **Inserted 2026-08-15.** The measurement backbone. Everything after the
 > functional engine (9/9b) is an *optimization*, and an optimization without
@@ -42,8 +42,8 @@ chain: 2
 > decisions: the vehicle is a NEW sample `docs/examples/db-bench`
 > (employee stays a teaching sample) and `time.ticks` (CLOCK_MONOTONIC
 > µs) is the iteration's one runtime addition. Spec:
-> [`2026-08-21-db-bench-design.md`](../../../superpowers/specs/2026-08-21-db-bench-design.md)
-> · plan: [`2026-08-21-db-bench.md`](../../../superpowers/plans/2026-08-21-db-bench.md)
+> [`2026-08-21-db-bench-design.md`](../../superpowers/specs/2026-08-21-db-bench-design.md)
+> · plan: [`2026-08-21-db-bench.md`](../../superpowers/plans/2026-08-21-db-bench.md)
 > — **in progress** (second slice of the chain).
 >
 > **RE-SEQUENCED 2026-08-21** (developer decision): runs AFTER the arc's
diff --git a/docs/stories/language-runtime-database/refine/24-chat-websocket-workload.md b/docs/stories/language-runtime-database/24-chat-websocket-workload.md
similarity index 99%
rename from docs/stories/language-runtime-database/refine/24-chat-websocket-workload.md
rename to docs/stories/language-runtime-database/24-chat-websocket-workload.md
index 57d3518..193f1c6 100644
--- a/docs/stories/language-runtime-database/refine/24-chat-websocket-workload.md
+++ b/docs/stories/language-runtime-database/24-chat-websocket-workload.md
@@ -1,13 +1,13 @@
 ---
 iteration: "24"
-status: refine
+status: in-progress
 chain: 4
 ---
 
 # Iteration 24 — chat: the WebSocket pub/sub driving workload
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **Inserted 2026-08-20** (concurrency-chain refinement): the 8+11 arc's
 > driving workload, the role log-watcher played for iterations 3–7. Needs
diff --git a/docs/stories/language-runtime-database/hold/26-blue-green-deploy.md b/docs/stories/language-runtime-database/26-blue-green-deploy.md
similarity index 100%
rename from docs/stories/language-runtime-database/hold/26-blue-green-deploy.md
rename to docs/stories/language-runtime-database/26-blue-green-deploy.md
diff --git a/docs/stories/language-runtime-database/hold/28-skillhost-host-workload.md b/docs/stories/language-runtime-database/28-skillhost-host-workload.md
similarity index 99%
rename from docs/stories/language-runtime-database/hold/28-skillhost-host-workload.md
rename to docs/stories/language-runtime-database/28-skillhost-host-workload.md
index 6f62ae5..d376597 100644
--- a/docs/stories/language-runtime-database/hold/28-skillhost-host-workload.md
+++ b/docs/stories/language-runtime-database/28-skillhost-host-workload.md
@@ -6,7 +6,7 @@ status: hold
 # Iteration 28 — skillhost: a host-shaped workload, and the capability gaps it exposes
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **Inserted 2026-08-16.** A driving-workload iteration, the way iteration 7's
 > log-watcher drove the systems stdlib. The workload is a writeonce port of
diff --git a/docs/stories/language-runtime-database/hold/29-compile-time-metaprogramming.md b/docs/stories/language-runtime-database/29-compile-time-metaprogramming.md
similarity index 99%
rename from docs/stories/language-runtime-database/hold/29-compile-time-metaprogramming.md
rename to docs/stories/language-runtime-database/29-compile-time-metaprogramming.md
index f93d1ac..826da92 100644
--- a/docs/stories/language-runtime-database/hold/29-compile-time-metaprogramming.md
+++ b/docs/stories/language-runtime-database/29-compile-time-metaprogramming.md
@@ -6,11 +6,11 @@ status: hold
 # Iteration 29 — compile-time metaprogramming (derive from the class table)
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **Inserted 2026-08-16.** A language-capability iteration, deliberately
 > numbered to echo the principle it lives inside:
-> [principle 13, "statically typed, all the way to the register"](../../../00-principles.md).
+> [principle 13, "statically typed, all the way to the register"](../../00-principles.md).
 > It comes late because it earns its keep only once there are enough
 > types worth deriving over (the `@table` classes of iteration 9/9b, the
 > records the query surface projects), and it must never be the excuse that
diff --git a/docs/stories/language-runtime-database/refine/31-actor-lifecycle.md b/docs/stories/language-runtime-database/31-actor-lifecycle.md
similarity index 95%
rename from docs/stories/language-runtime-database/refine/31-actor-lifecycle.md
rename to docs/stories/language-runtime-database/31-actor-lifecycle.md
index e3b27e9..c79f6d5 100644
--- a/docs/stories/language-runtime-database/refine/31-actor-lifecycle.md
+++ b/docs/stories/language-runtime-database/31-actor-lifecycle.md
@@ -7,7 +7,7 @@ chain: 3
 # Iteration 31 — actor lifecycle: request/response, backpressure, death, timers
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **Inserted 2026-08-21** (concurrency-chain re-sequence; the iteration
 > was named as "new 31" in the 2026-08-20 code-review re-sequence — this
@@ -98,10 +98,10 @@ Forks the spec must settle:
 
 Sources: the 2026-08-20 code-review findings (the gaps this iteration
 answers), the arc plan's stage-2 deviations
-([`2026-08-20-shard-fiber-arc.md`](../../../superpowers/plans/2026-08-20-shard-fiber-arc.md)
+([`2026-08-20-shard-fiber-arc.md`](../../superpowers/plans/2026-08-20-shard-fiber-arc.md)
 — the unbounded FIFO is deviation 4's mutex inbox), and BEAM precedent
 already surveyed in
-[`docs/plan/exploration/fibers/00-fibers.md`](../../../plan/exploration/fibers/00-fibers.md).
+[`docs/plan/exploration/fibers/00-fibers.md`](../../plan/exploration/fibers/00-fibers.md).
 
 ## Proposed Solution
 
diff --git a/docs/stories/language-runtime-database/refine/34-crypto-builtins.md b/docs/stories/language-runtime-database/34-crypto-builtins.md
similarity index 98%
rename from docs/stories/language-runtime-database/refine/34-crypto-builtins.md
rename to docs/stories/language-runtime-database/34-crypto-builtins.md
index e583676..2a8b32a 100644
--- a/docs/stories/language-runtime-database/refine/34-crypto-builtins.md
+++ b/docs/stories/language-runtime-database/34-crypto-builtins.md
@@ -6,7 +6,7 @@ status: refine
 # Iteration 34 — crypto builtins: digests and HMAC in the runtime
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **Inserted 2026-08-22** — the framework ledger's oldest unowned gap
 > gets an owner. PREMISE UPDATE (same day, post-merge): iteration 36
@@ -25,7 +25,7 @@ Four consumers already wait on it, none able to proceed:
 (`Sec-WebSocket-Accept` = base64(SHA-1(key + GUID)) — SHA-1
 specifically, not a choice); the framework's ETag/conditional-request
 row (wants a content hash); HMAC-signed tokens the auth core can grow;
-and held [iteration 21](../hold/21-keypair-attach-auth.md), whose
+and held [databasev2 10](../databasev2/10-keypair-attach-auth.md), whose
 challenge–response needs primitives that "do not exist" (its demotion
 note). Bytes and base64 landed with iteration 19 — the carriers exist,
 only the digests are missing.
diff --git a/docs/stories/language-runtime-database/done/35-net-runtime-seams.md b/docs/stories/language-runtime-database/35-net-runtime-seams.md
similarity index 96%
rename from docs/stories/language-runtime-database/done/35-net-runtime-seams.md
rename to docs/stories/language-runtime-database/35-net-runtime-seams.md
index c49b03a..d45db55 100644
--- a/docs/stories/language-runtime-database/done/35-net-runtime-seams.md
+++ b/docs/stories/language-runtime-database/35-net-runtime-seams.md
@@ -6,7 +6,7 @@ status: done
 # Iteration 35 — `net` runtime seams: timeouts, Unix sockets, peer address
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **LANDED 2026-08-23** (branch `framework-v1b`, with the serving slice
 > riding it): per-call `_dl` deadlines (nil/false = the expected
@@ -14,7 +14,7 @@ status: done
 > `net.peer` (id 95). Plane: shard-tick TIMEOUT + expiry sweep +
 > POLL_REMOVE tombstone on uring, extended deadline scan on epoll,
 > fibers POOLED against stale-CQE UAF — the full design in
-> [the review spec](../../../superpowers/specs/2026-08-23-net-seams-park-design.md).
+> [the review spec](../../superpowers/specs/2026-08-23-net-seams-park-design.md).
 > Proof: all five seams probe-verified on BOTH `WO_IO` backends;
 > `serve_conn` + web-app's fiber-per-connection pattern gate parallel
 > requests, idle eviction, and slow-loris tearing (web-app 41 checks).
@@ -100,7 +100,7 @@ Forks the spec must settle:
    POLL_ADD and a TIMEOUT in flight (io_uring linked ops vs two
    submissions + first-wins cancel; epoll fallback = the existing
    deadline scan). The park protocol contract
-   ([`03-concurrency-coroutines.md`](../../../plan/oop-vm/03-concurrency-coroutines.md))
+   ([`03-concurrency-coroutines.md`](../../plan/oop-vm/03-concurrency-coroutines.md))
    gains the rule.
 3. **Surface shape**: per-call deadline argument vs per-fd setting
    (`net.set_deadline(fd, ms)`); leaning per-call — no hidden fd state,
diff --git a/docs/stories/language-runtime-database/in-progress/36-operator-parity.md b/docs/stories/language-runtime-database/36-operator-parity.md
similarity index 98%
rename from docs/stories/language-runtime-database/in-progress/36-operator-parity.md
rename to docs/stories/language-runtime-database/36-operator-parity.md
index 865d5d7..42d7cfb 100644
--- a/docs/stories/language-runtime-database/in-progress/36-operator-parity.md
+++ b/docs/stories/language-runtime-database/36-operator-parity.md
@@ -6,7 +6,7 @@ status: in-progress
 # Iteration 36 — operator parity: `not`, bitwise, hex literals, compound assigns
 
 > Format: `product/story-iteration-template`. Part of
-> [Story — one language, one runtime, one database, one binary](../00-story.md).
+> [Story — one language, one runtime, one database, one binary](00-story.md).
 >
 > **Inserted 2026-08-22, forks settled the same day** (decisions below,
 > story-19 discipline). Driver: a gap survey of the operator surface
@@ -26,7 +26,7 @@ status: in-progress
 > pure-`.wo` base64 does with division/modulo what shifts and masks say
 > directly.
 >
-> **Plan:** [`2026-08-22-operator-parity.md`](../../../superpowers/plans/2026-08-22-operator-parity.md)
+> **Plan:** [`2026-08-22-operator-parity.md`](../../superpowers/plans/2026-08-22-operator-parity.md)
 > (5 tasks: lexer/tokens; AST/parser incl. compound-assign desugar;
 > type checker incl. literal shift-count rejection; emit + VM opcodes
 > `.wob` v6; corpus/gates/docs closeout).
diff --git a/docs/stories/language-runtime-database/37-wo-html-components.md b/docs/stories/language-runtime-database/37-wo-html-components.md
new file mode 100644
index 0000000..fb0ffb0
--- /dev/null
+++ b/docs/stories/language-runtime-database/37-wo-html-components.md
@@ -0,0 +1,265 @@
+---
+iteration: "37"
+status: done
+---
+
+# Iteration 37 — wo-html components: an MVC-shaped view layer (Angular's format, studied)
+
+> Format: `product/story-iteration-template`. Part of
+> [Story — one language, one runtime, one database, one binary](00-story.md).
+>
+> **Inserted 2026-08-23** (developer ask: "enhance wo-html like MVC;
+> understand Angular format"). Grows the wo-html LIBRARY, never the
+> framework — the 2026-08-20 micro-framework directive stands: routing/
+> middleware/`Req`/`Resp` stay MVC-free, and the view layer lives in its
+> own dependency (the site sample's two-dep lesson). Unscheduled —
+> independent of the concurrency chain; needs its spec brainstormed
+> first.
+>
+> **REDIRECTED 2026-08-23** (developer review of the shop template
+> against a Vue SFC): render()-as-string-concatenation failed the DX
+> referendum — markup must be markup-FIRST. **RE-POINTED 2026-08-24**
+> (developer counter-proposal): the leaning is now **in-class raw
+> template literals**, not separate `.html` files — `render()` RETURNS
+> a raw multi-line string literal whose `{{ expr }}` holes are
+> auto-escaped, compile-time-checked interpolations in class scope (a
+> typo'd field is a compile error). Compiler surface shrinks to one
+> lexer addition (the raw literal — a general language win: multi-line
+> text without `\"` noise) plus one desugar; no file pairing, no
+> `w:component` sections. Structural control stays the language's own
+> `if`/`for` composing literals; `w:if`/`w:for` attributes and separate
+> `.html` files are DEMOTED to a later option that can layer on without
+> breaking this form. Escaping: `{{ }}` always escapes; the raw/slot
+> spelling is the one greppable door. A runtime mustache-lite stays
+> REJECTED (reflection-free means untyped `map<Text, Text>`); client-
+> side reactivity (`ref`, `@click`, `v-model`) stays out under the
+> no-JS posture — forms and POSTs instead. Still a COMPILER iteration,
+> parked behind the standing "no compiler/VM/database changes yet"
+> directive. The shop template
+> ([`docs/examples/shop`](../../examples/shop/README.md)) is the
+> consumer: each `render()` body becomes one raw template literal, and
+> its README's recorded gaps ride along (gap #1: `pub` + `@table`
+> cannot combine — blocks a shared model module; gap #2: `@view`
+> projection classes).
+>
+> **CODE LANDED 2026-08-24** — the compiler slice only. Forks #1 and #3
+> are settled and shipped: the raw literal is BACKTICK-delimited with
+> verbatim content, `{{ }}` always HTML-escapes and `${ }` stays raw,
+> and the common source margin is removed at lex time. `{!! !!}` as the
+> raw slot is DISCARDED — `${ }` already was the raw spelling and a
+> second one would have been a synonym. The escaping desugar turned out
+> to need no compiler knowledge of HTML at all: `{{ e }}` becomes a
+> `Call` on whatever `esc` is in scope, so typecheck, ownership,
+> codegen, the `.wob` format and the VM are all untouched, and the
+> standing "no VM/database changes" directive was never in play. Two new
+> lexing diagnostics ride along (WO-E004 unterminated raw literal,
+> WO-E005 newline inside a quoted string — the latter closing a silent
+> file-swallowing hole that existed since Task 3). The COMPONENT half of
+> this story — the `Component` interface, `Layout` with slots, the site
+> migrating onto them — is untouched and still pending.
+>
+> **LANDED 2026-08-25** — the component half, and with it the iteration.
+> wo-html gained `Component` (structural, the view twin of the
+> framework's `Handler`), `render_all` and `Layout`; fork #4 is settled
+> by MOVING `ok_html` into the framework beside `ok_text`/`ok_json`
+> (transport, not rendering — both HTML samples had hand-rolled the same
+> four lines), and fork #5 by migrating BOTH samples. Fork #2 stands as
+> written: no directive surface ships. Layout slots are pre-rendered
+> `Text`, not `multi Component` — the compositional variant was proven
+> possible and deliberately not taken for the layout, though the PAGE
+> components do use it.
+
+## Why this iteration exists
+
+wo-html today is element builders + one utility sheet: pages are
+functions concatenating Text. That works (the site proves it) but has
+no unit of reuse bigger than a function — no way to say "this fragment
+owns its data, its markup, and its place in a layout" and hand it
+around. Angular's component FORMAT — a class declaring its inputs, a
+template rendering them, composition by nesting, structural directives
+for repetition and choice — is the studied precedent: the FORMAT
+translates to server-rendered `.wo`; the client-side half (change
+detection, event bindings, SPA router) deliberately does not.
+
+## What Angular's format maps to (the study, summarized)
+
+| Angular | wo-html translation | doctrine fit |
+| --- | --- | --- |
+| `@Component` class with `@Input()`s | a class whose FIELDS are the inputs, satisfying a structural `Component` interface (`fn render() -> Text`) | behavior-as-class; no closures needed |
+| template (`{{ expr }}`) | the render method's interpolation — `.wo` already has `${...}` in Text | no template dialect: templates ARE code |
+| `*ngFor` / `*ngIf` | explicit `for`/`if` in render() building Text — the language's own control flow | no structural-directive mini-language |
+| content projection (`<ng-content>`) | a layout component taking pre-rendered `Text` slots as fields | slots are ordinary values |
+| services/DI | no translation — a component reads its fields; queries stay in handlers (M and V stay separate) | rejected: DI needs function values |
+| event bindings `(click)` / two-way `[(ngModel)]` | no translation — server-rendered, no JS doctrine; forms stay `form_post` round trips | rejected surface |
+
+## Goals
+
+- **A `Component` interface in wo-html**: structural (`fn render() ->
+  Text`), so any class with fields + render satisfies it — the view
+  twin of the framework's `Handler`. Composition is nesting: a parent's
+  render calls children's render.
+- **The MVC seam stated**: Model = `@table` rows queried in the HANDLER,
+  moved into component fields; View = components rendering Text;
+  Controller = the framework handler wiring them. The library documents
+  the seam; it never queries.
+- **Layout components with slots**: the site's nav/shell/footer become
+  the proof — a `Layout { title, nav, content, footer }` component
+  replacing today's `shell()` functions, chapter pages and homepage
+  composing it.
+- **The site sample migrates** as acceptance: same rendered bytes (or
+  deliberately better), gate stays green — the library grew a floor, not
+  a rewrite.
+
+## Acceptance Criteria (draft — the spec refines)
+
+- **Given** a class with fields and `fn render() -> Text`, **when** a
+  handler moves data in and calls render, **then** the page it serves is
+  byte-deterministic from the fields — no hidden state, no globals.
+- **Given** nested components (layout → section → card), **when** the
+  outer render runs, **then** children render through the same
+  structural interface, and escaping stays the caller-explicit `esc()`
+  rule at every level.
+- **Given** the migrated site sample, **when** `just site` runs,
+  **then** 11/0 — the gate is the proof the component layer reproduces
+  the existing pages.
+- **Given** a component reused across two pages (the chapters card on
+  home and chapter pages), **when** either page changes its data,
+  **then** the other's markup is untouched — reuse is real, not copied.
+
+## Out Of Scope
+
+- Client-side anything: change detection, event/two-way bindings, SPA
+  routing, hydration — the no-JS posture stands; interactivity is form
+  round trips until a directive says otherwise.
+- A RUNTIME template engine (files parsed per request, mustache-style) —
+  rejected 2026-08-23: reflection-free means untyped `map<Text, Text>`
+  values. Templates compile to code at build time or they don't exist.
+- Dependency injection / services — components are data-in, Text-out.
+- Moving wo-html into the framework — settled 2026-08-23: separate
+  libraries, composed via `[deps]`.
+- CSS componentization (scoped styles) — the utility sheet stays one
+  static string; measure pain first.
+
+## Info
+
+Forks the spec must settle (REVISED 2026-08-23 for the compiled-template
+direction):
+
+1. ~~**The raw-literal spelling**~~ — SETTLED 2026-08-24 and landed:
+   backticks, content verbatim (no escape processing), common margin
+   removed at lex time, `${ }` raw and `{{ }}` escaping. A literal
+   backtick, `${` or `{{` is written by concatenating a `"..."` string
+   with `..` — one greppable door instead of an escape character in the
+   one form whose point is not having any.
+2. ~~**Directive surface**~~ — SETTLED 2026-08-25 as written: v1 ships
+   NONE. Structural control is `if`/`for` composing literals, and two
+   migrated samples produced no case that wanted more. `w:if`/`w:for`
+   and separate `.html` files remain the later option — and a
+   COMPILE-TIME include is the only shape either could honestly take,
+   since a file read per request is the rejected engine.
+3. ~~**Escaping default**~~ — SETTLED 2026-08-24 and landed: `{{ }}`
+   escapes ALWAYS, through whatever `esc` is in scope (wo-html's, or a
+   local one that shadows it deliberately). `${ }` is the raw door.
+   Proven byte-identical against the hand-written `esc()` calls it
+   replaces, hostile input included.
+4. ~~**The framework seam**~~ — SETTLED 2026-08-25: `ok_html` MOVED
+   into `framework/http/types.wo`; no `respond(c)` sugar, because
+   `ok_html(c.render())` already is it.
+5. ~~**Migration depth**~~ — SETTLED 2026-08-25: BOTH, site gated and
+   shop hand-driven; web-app stays HTML-less as the counter-example.
+
+Study sources: Angular's component/`@Input`/`ng-content` docs (format
+only; no Angular code enters the repo — candidate `.dev/reference`
+addition if deeper study is wanted), Go's `html/template` as the
+server-side contrast, and the site sample as the living consumer.
+
+## Landed 2026-08-24 — the raw text literal
+
+The compiler slice, and nothing else. `compiler/src/lexer.ml` gained one
+branch: a backtick opens a literal whose content is verbatim to the
+closing backtick, newlines included, with two hole forms — `${ }` raw
+and `{{ }}` escaped — and the common source margin removed before the
+token is emitted (Java's text-block rule). `token.ml` gained one
+`str_part` variant to carry the escaped hole; `parser.ml`'s
+`desugar_interp` wraps it in a call to `esc`; `dump.ml` labels it. That
+is the entire compiler surface. Nothing in typecheck, ownership,
+codegen, the `.wob` format or the VM changed, because the literal emits
+the same `Str`/`InterpStr` token a `"..."` string always did.
+
+Proven: `woc-test` 554/0 with new token and AST goldens; `oop-e2e`
+115/0 with a run fixture for the literal and a compile-fail fixture for
+WO-E004; `just site` 11/0 and `just web-app` 46/0 after wo-html's
+builders and the site's two chapter snippets migrated onto the form; a
+parity program comparing every migrated wo-html builder's old and new
+output on hostile input (`<`, `>`, `&`, `"`) — byte-identical in all
+eight. `page()` is the one deliberate byte change: four newlines now
+sit inside `<head>`, where whitespace is insignificant, and none inside
+`<body>`. Every `.wo` in the repo was re-lexed: no file gained a
+diagnostic.
+
+The shop template migrated too — five view files, every `render()` body
+now one literal with real double-quoted attributes and no `esc()` calls
+— verified by building it against local `file://` dep remotes and driving
+every route, since no `just` recipe gates it.
+
+## Landed 2026-08-25 — the component half
+
+`wo-html` grew three things and no more: `pub interface Component { fn
+render() -> Text }`, `pub fn render_all(cs: multi Component) -> Text`,
+and `pub class Layout { title, nav, content, footer }` whose slots are
+pre-rendered Text. The MVC seam is stated in the library's own header
+and README, and the library still contains no query.
+
+A finding that shaped the design: **`multi Component` holds a
+heterogeneous list directly** — no wrapper record. The framework's
+`Mw`/`Aw` wrappers had suggested otherwise; they are not a language
+requirement. That is what let a page component hold its children as
+`multi Component` and call `render_all` on them, which is where the
+interface actually earns its place — an interface nothing consumes as a
+TYPE would have been decoration.
+
+Fork #4 settled by moving: `ok_html` now lives in `framework/http/types.wo`
+beside `ok_text`/`ok_json`, and both duplicate copies are deleted. No
+`respond(c: Component)` sugar — `ok_html(c.render())` is already the
+whole thing, and a second spelling would earn nothing.
+
+The site migrated: `shell`/`shell_wide` fill `Layout` (byte-identical —
+`Layout.render()` is `page(title, nav .. content .. footer)`, exactly
+what the old functions built), and `chapter_nav` became a `ChapterNav`
+component whose query moved out into `chapter_links()`, called by the
+handlers. The homepage and every chapter page now render the SAME
+component with a different `current` — acceptance criterion 4, met by
+construction rather than by inspection.
+
+The shop migrated further than planned, because its views already had
+`render()`: `app_shell()` became an `AppShell` component, and
+`ProductListPage`/`OrdersPage` now hold `multi Component` children
+instead of a concatenated Text blob, with the queries in the
+controllers. `AppShell` is deliberately NOT `Layout` — the template
+links a real stylesheet where `Layout` inlines `tw_css()`, and that
+difference is the point of it having its own shell.
+
+**Restructured 2026-08-25 (follow-on):** the site sample was then laid
+out like the program template — `types.wo` for the model, a `layout/`
+module for the chrome, `home/` and `chapter/` view modules, one
+`*.controller.wo` per feature in the root module, and a `main.wo` that
+is bootstrap and nothing else. `main.wo` went from 231 lines holding
+everything to 44 lines holding routes. Both samples now read the same
+way, which was the point: the template teaches a shape, and the site
+should not contradict it.
+
+Proven: `just site` 11/0 (the gate, and the escape check still passes),
+`just web-app` 46/0 (the framework gained a function), `woc-test` and
+`oop-e2e` untouched and green. The shop was built against local `file://`
+dep remotes and driven through every route — product grid (4 cards
+rendered as child components), product page with its form, buy,
+`/orders` (rows as child components), the empty-orders branch, 404, 409,
+and `/assets/*`.
+
+## Proposed Solution
+
+Brainstorm → spec → plan (the superpowers path): settle the four forks,
+grow wo-html by the `Component` interface + a `Layout` proof, migrate
+the site sample as acceptance, keep the framework untouched. Ships
+independently of the concurrency chain; slots wherever the developer
+schedules it.
diff --git a/docs/stories/language-runtime-database/38-content-platform-capabilities.md b/docs/stories/language-runtime-database/38-content-platform-capabilities.md
new file mode 100644
index 0000000..6222b20
--- /dev/null
+++ b/docs/stories/language-runtime-database/38-content-platform-capabilities.md
@@ -0,0 +1,204 @@
+---
+iteration: "38"
+status: refine
+---
+
+# Iteration 38 — content collaboration workload: the file-mutation and outbound-socket gaps
+
+> Format: `product/story-iteration-template`. Part of
+> [Story — one language, one runtime, one database, one binary](00-story.md).
+>
+> **Inserted 2026-08-26** (developer ask: "can the language create an
+> application like Nextcloud, a content collaboration platform?"). The
+> answer was no, and the reason was not missing `.wo` effort: two whole
+> capability families are unowned by any iteration. Read off the runtime
+> contract, not off prose — `runtime/src/wob.h` allocates exactly six
+> `fs` builtins, ids 40–45 (`exists`, `list`, `stat`, `read_all`,
+> `read_at`, `append`; `append` "creates the file if absent"), so a file
+> can be **created and grown and then never replaced, truncated, deleted
+> or renamed**. It allocates ten `net` builtins — 51–55
+> (`listen`/`accept`/`read`/`write`/`close`) and 91–95 (the three `_dl`
+> deadline twins, `listen_unix`, `peer`) — and **no `connect`**;
+> `grep -rn 'connect(' runtime/src/` returns nothing, so a program cannot
+> open an outbound connection to anything, ever. This iteration is the
+> workload that forces both into the open, in the mould of
+> [iteration 28](28-skillhost-host-workload.md).
+
+## Goals
+
+- **A writeonce program shaped like a content platform.** `docs/examples/vault`:
+  authenticated users, folders and documents as `@table` classes related by
+  `ref`/`backlink`, multipart upload intake, content-addressed blobs, share
+  grants with expiry, a version chain per document, a trash bucket, an
+  activity feed, and a server-rendered UI over `porch` +
+  `writeonce-view`. Everything above the storage line is expressible on
+  today's toolchain and is the part that ships.
+- **`fs` grows the mutation verbs.** The gap is not ergonomic. A blob store
+  that can only `append` can never reclaim a byte: a cancelled upload, a
+  deleted document and a superseded version all leak their file forever,
+  and there is no atomic-publish primitive (write-temp-then-`rename`) so
+  every write is torn-visible to a concurrent reader. Name the minimum set
+  the workload actually needs and no more. The syscalls are not the work —
+  `sysio.c:669` already calls `unlink()` on the `listen_unix` path to clear
+  a stale socket, so `remove` is a builtin-table row over a call the
+  runtime already links.
+- **`net` grows the client side.** Every federation, identity and
+  notification story in a collaboration platform is an outbound call —
+  OIDC token exchange, SMTP for share mail, an object-store backend, a
+  webhook, an antivirus or preview service. All of them are one missing
+  builtin. [Iteration 35](35-net-runtime-seams.md) declared
+  connect-side timeouts out of scope "no workload asks yet" — this is the
+  workload asking.
+- **Block honestly on the rest, in writing.** WebDAV (the protocol every
+  desktop and mobile sync client speaks), collaborative editing, previews
+  and full-text search each get a named verdict in this story — owned
+  elsewhere, deliberately rejected, or deferred with the reason — so the
+  sample's README never implies a feature the stack cannot serve.
+
+## Acceptance Criteria
+
+- **Given** the `vault` sample and today's `fs`, **when** a user deletes a
+  document and the acceptance script inspects the blob directory, **then**
+  the blob is gone from disk and the disk footprint returns to its
+  pre-upload size — the criterion that is impossible today and is the
+  whole point of the fs half.
+- **Given** two concurrent readers of a document while a new version is
+  being written, **when** the write completes, **then** every read
+  returned either the whole old version or the whole new one and never a
+  partial file — atomic publish, proven by a racing reader, not asserted.
+- **Given** an upload that is abandoned mid-stream (client disconnect),
+  **when** the next request arrives, **then** no partial blob and no
+  orphan row survive — cleanup is reachable from `.wo`.
+- **Given** a share notification configured against a local SMTP sink and
+  an identity provider stub, **when** a share is created, **then** the
+  program opened an outbound connection, spoke the protocol and recorded
+  delivery — the connect half proven end to end, offline, with a fixture
+  server the gate starts itself (the `deps-accept`/`web-app` precedent:
+  no network in CI).
+- **Given** an outbound peer that accepts the connection and then never
+  answers, **when** the configured deadline expires, **then** the call
+  returns the expected-timeout shape, the fd is closed, and the fiber is
+  not parked forever — the same cleanup contract iteration 35 set for the
+  listen side.
+- **Given** the full sample under the standing battery, **when**
+  `oop-accept`, `web-app`, `site` and the new gate run, **then** all are
+  green and ASan-clean at both shard counts.
+
+## Out Of Scope
+
+- **Raw stdin/stdout byte I/O, bounded/killable subprocesses, recursive
+  directory walk, executable-bit and realpath confinement** — every one of
+  these is [iteration 28](28-skillhost-host-workload.md)'s
+  Blockers B and C and its gap list. This story must not re-own them. It
+  *does* depend on 28's killable-subprocess work for previews, which is
+  exactly why previews are deferred here rather than attempted.
+- **WAL checkpoint and disk reclamation** —
+  [databasev2 3](../databasev2/03-wal-checkpoint.md). A metadata store whose boot replays
+  every write ever made is a real ceiling for this workload, and naming it
+  here is the point; fixing it is 32's. This story's gate should record the
+  replay time it observes so 32 inherits a number.
+- **WebDAV.** Sync clients speak PROPFIND/PROPPATCH/MKCOL/MOVE/LOCK over
+  XML bodies. The language has `json` and no XML parser, and `MKCOL`/`MOVE`
+  have nothing to land on until the fs half exists. Verdict for the spec to
+  confirm: out of this slice, revisited only once file mutation ships, and
+  never as a compiler concern.
+- **Collaborative editing (OT/CRDT).** Wants ordered trees and cheap
+  lookups; `multi` is an array, `map` is a documented linear scan, there
+  are no closures and no generics beyond those two. Deliberately not
+  attempted in `.wo` at this stage — and the external-document-server
+  route Nextcloud itself takes is unreachable until `connect` lands.
+- **Full-text search.** The engine indexes equality probes on declared
+  columns; there is no prefix scan or FTS. Query-grammar growth is
+  [databasev2 8](../databasev2/08-query-grammar-corpus.md)'s.
+- **TLS** — proxy-terminated, by doctrine, unchanged. The outbound half
+  therefore speaks plaintext to a local sidecar or a trusted-network peer,
+  and the story says so out loud rather than implying HTTPS clients.
+- **A plugin/app ecosystem.** In-runtime recompile is
+  [iteration 26](26-blue-green-deploy.md)'s; nothing here loads
+  code at run time.
+- **Scale claims.** RAM is authoritative (64 MiB arena by default,
+  `WO_HEAP_MB`), so this is a team-scale platform and the README states the
+  row ceiling it was measured at.
+
+## Info
+
+The gap ledger this story exists to resolve, with current ownership:
+
+Every "today" cell below was read from the source named beside it, not
+from another document.
+
+| Capability | Today | Read from | Owner |
+| --- | --- | --- | --- |
+| overwrite / write-at-offset a file | absent; `append` (id 45) creates-if-absent and grows, nothing more | `wob.h:353-358` | **this story** |
+| remove, rename, mkdir, truncate | absent from the builtin table | `wob.h:353-358` | **this story** |
+| outbound TCP / unix connect | absent; no `connect()` call in the runtime at all | `wob.h:364-368,477-485`; `grep` over `runtime/src/` | **this story** |
+| outbound deadline + cleanup | `_dl` seam exists, listen side only (ids 91–93) | `wob.h:477-482` | **this story**, on 35's contract |
+| stdin/stdout bytes | no builtin; only `<stdint.h>` matches `stdin` | `sysio.c`, `wob.h` | 28, Blocker B |
+| bounded, killable subprocess | `proc.run` (id 56) takes `(cmd, args, cls)` — no deadline, no signal | `wob.h:369`; `sysio.c:718` | 28, Blocker C |
+| directory walk, `X_OK`, realpath | absent | `sysio.c` | 28, gap list |
+| WAL checkpoint / bounded replay | no checkpoint, snapshot or truncate anywhere in the WAL; `fdatasync` per commit | `wal.c:403`, `wal.h` | 32 |
+| io_uring on the WAL write path | rings exist in the fiber/net plane only; the WAL is plain `fdatasync` | `park.c:22-54` vs `wal.c:403` | 23 |
+| `WO_DATA` as a file | hardcoded `"%s/shard-0.wal"` directory form | `main.c:202` | 33 |
+| prefix scan / FTS / aggregates | equality probe only; group-by rejected in the typechecker | `types.ml:2220,2241` | 27, parked drain |
+
+Builtin id allocation, so this story's work does not collide: `WO_B_MAX`
+is `95u` and ids **89 and 90 are reserved holes** — iteration 31's
+`monitor` and `time.after`, named in the active slice's marker and absent
+from both `wob.h` and `types.ml`. New builtins here start at **96**. No
+`.wob` version bump is implied: `WOB_VERSION` is `6u` and moved last for
+iteration 36's opcodes 42–46; stdlib builtins are a table row, exactly as
+iteration 35's 91–95 were.
+
+What already exists and needs no new capability, verified against the tree:
+`http/multipart` and `http/auth` in `porch`; `sha1`/`sha256`/
+`hmac_sha256` (builtin ids 85–87) for content addressing, ETags and session
+tokens; `base64_encode`/`decode` and the `Bytes` carrier; `ws_accept` plus
+the pure-`.wo` RFC 6455 frame codec for the activity feed; `Component`/
+`Layout` with `{{ }}` escaping for the UI; `@table` with `@unique`, `ref`,
+`backlink` and FK-restrict for the whole permission and version model.
+
+Forks the spec must settle:
+
+1. **How small is the fs set?** Two candidate shapes. Minimal-atomic:
+   `fs.write` (create-or-replace whole file), `fs.remove`, `fs.rename`,
+   `fs.mkdir` — four verbs, no offsets, atomic publish by write-temp +
+   rename, and a blob store is expressible. Streaming: add
+   `fs.write_at`/`fs.truncate` so a large upload can be resumed and a
+   sparse file assembled. Leaning minimal-atomic: it closes the deletion
+   hole, it is the one shape that composes with 32's own rename-swap, and
+   offsets can be argued later by a workload that measures the need.
+2. **What does a handle look like — or is there one?** Today every `fs`
+   member takes a path and does the whole operation. A `write` that takes a
+   path keeps that property and keeps handles out of the ownership model;
+   a resumable upload wants an open fd, which means a droppable
+   `fs.File` scalar in the shape of `net.Conn`. This fork decides fork 1.
+3. **Does `connect` return `net.Conn` and nothing more?** Cheapest honest
+   answer is yes: `net.connect(host, port)` and `net.connect_unix(path)`
+   yielding the same fd-scalar `accept` already yields, so every existing
+   `read`/`write`/`close`/`_dl` member composes unchanged and the client
+   side costs two builtins, not a subsystem.
+4. **Path confinement.** A content platform maps user-supplied names onto
+   paths. Without realpath (28's gap) the sample must confine by
+   construction — content-addressed filenames the user never names — or the
+   fs half hands `.wo` code a traversal footgun the day it lands. This is
+   the security fork and it gates the fs half, not the sample.
+5. **Where does the workload stop?** The sample is the acceptance test, so
+   its edge is the story's edge. Leaning: upload / download / delete /
+   rename / version / share / trash / activity feed, one share
+   notification over `connect`, and no sync-client protocol at all.
+
+## Proposed Solution
+
+Two capability halves and a workload, and the workload is written first so
+the capability set is argued from a program that needs it rather than from
+a wish list. Order: brainstorm the five forks (fork 1 and 2 together, fork
+4 before any fs code), then the `vault` sample against today's toolchain to
+establish exactly where it blocks, then the fs verbs, then `connect`, each
+with corpus fixtures and its own gate leg. Big enough to want a spec and a
+plan document — this is not a bounded slice like
+[7](../databasev2/07-single-file-db.md).
+
+Precedence: independent of the concurrency chain (stage 3 → 22 → 31 → 24 →
+23 → 32) and startable beside it, with one caveat — the honest disk story
+needs [3](../databasev2/03-wal-checkpoint.md), so if this lands first its gate records
+the replay number rather than claiming the platform is operationally done.
diff --git a/docs/stories/language-runtime-database/39-web-framework-parity.md b/docs/stories/language-runtime-database/39-web-framework-parity.md
new file mode 100644
index 0000000..f4c2396
--- /dev/null
+++ b/docs/stories/language-runtime-database/39-web-framework-parity.md
@@ -0,0 +1,213 @@
+---
+iteration: "39"
+status: hold
+---
+
+# Iteration 39 — web framework parity *(superseded by the porch track)*
+
+> **⏸ SUPERSEDED 2026-08-26, the same day it was written.** Framework work now
+> lives in its own track: [`docs/stories/porch/`](../porch/00-story.md), numbered
+> from 1. This iteration's content was split across **porch 1–5** and is not
+> planned from here — the sequencing below survives, but as that track's
+> dependency order.
+>
+> | This iteration's goal | Now |
+> | --- | --- |
+> | limiter + idempotency (the cheap first slice) | [porch 1](../porch/01-store-backed-middleware.md) |
+> | random-bytes builtin, cookies, `Resp` repeated headers | [porch 2](../porch/02-randomness-and-cookies.md) |
+> | sessions | [porch 3](../porch/03-sessions.md) |
+> | CSRF | [porch 4](../porch/04-csrf.md) |
+> | method helpers, named routes, body limit, request id, response helpers | [porch 5](../porch/05-routing-response-ergonomics.md) |
+> | *(deferred here, now scheduled)* streaming, SSE, compression, byte ranges | [porch 6](../porch/06-streaming-core.md)–[8](../porch/08-static-and-lifecycle.md) |
+>
+> Kept rather than deleted because the [Fiber study](../../plan/exploration/fiber/00-fiber-parity.md)
+> cites it and because the reasoning below — especially why the randomness
+> blocker comes first — is what the porch track is built on. Original text
+> follows.
+
+## Original scope
+
+> Format: `product/story-iteration-template`. Part of
+> [Story — one language, one runtime, one database, one binary](00-story.md).
+>
+> **Inserted 2026-08-26** (developer ask: add gofiber/fiber as a reference and
+> find the basic features the web framework lacks). Derived from
+> [the Fiber v3.5.0 parity study](../../plan/exploration/fiber/00-fiber-parity.md),
+> which read Fiber's routing surface, `Req`/`Res` API, binder and all 32 of its
+> `middleware/` packages against `docs/examples/porch`. This iteration
+> takes that study's §0–§2 plus the cheap half of §5; the study names an owner
+> for everything it leaves out.
+
+## Goals
+
+- **A random-bytes builtin, first, because it gates the rest.** The framework
+  README's crypto row claims signed cookies, CSRF and session integrity are
+  "UNBLOCKED — the primitives exist since iteration 34". For CSRF and sessions
+  **that is wrong**: SHA-256 and HMAC let a program *authenticate* a token, not
+  *mint* one, and writeonce has no source of randomness anywhere — no
+  `getrandom(2)`, no CSPRNG builtin, nothing. An HMAC over a guessable session
+  id is a signed guess. Close this before writing a line of session code, and
+  correct the ledger row that says otherwise.
+- **Cookies, in both directions.** Absent entirely today: nothing parses a
+  `Cookie:` request header and there is no `Set-Cookie` builder. This is the
+  foundation the next goal stands on, and it forces a design decision the
+  framework has so far avoided — `Resp.headers` is a `map<Text, Text>`, so it
+  **structurally cannot** carry the two `Set-Cookie` lines a login-plus-flash
+  response needs. Deciding what replaces or supplements that map is the real
+  work of this goal; the parsing is the easy half.
+- **The store-backed middleware chain, in dependency order**: rate limiting and
+  idempotency first (they need only a store and `time.ticks`, both of which
+  exist — the cheapest real wins available), then sessions, then CSRF. Each is
+  an ordinary `.wo` middleware class, and each gets a **durable** store for
+  free from `@table` — where Fiber ships an in-memory default and expects you
+  to bolt on Redis. That is a genuine writeonce advantage and the samples should
+  show it.
+- **Close the routing and response sugar that is merely missing.** `PATCH` /
+  `OPTIONS` / `HEAD` / `ALL` registration helpers (a `Route { method: "PATCH" }`
+  literal already works, so this is registration ergonomics), a per-route body
+  limit instead of one compile-time `BODY_MAX = 1048576` for the whole server, a
+  request-id middleware, and the response helpers every framework has and this
+  one writes by hand: `Location`, `Vary`, `Attachment`/`Download`.
+- **Say what is still missing, with an owner.** The study's §3–§6 stay out of
+  scope; this iteration's closing act is updating the framework README's ledger
+  so each row points at whoever owns it rather than reading as an oversight.
+
+## Acceptance Criteria
+
+- **Given** the random-bytes builtin, **when** the acceptance script draws many
+  values across separate processes, **then** no value repeats and none is
+  derivable from the clock — and the builtin is refused, loudly, if the kernel
+  source is unavailable rather than silently falling back to something weaker.
+  A CSPRNG that degrades quietly is worse than no CSPRNG.
+- **Given** a login handler that sets a session cookie and a flash cookie on
+  one response, **when** the response is serialized, **then** **two** distinct
+  `Set-Cookie` headers reach the wire — the criterion the current
+  `map<Text, Text>` cannot satisfy, and the reason this iteration touches
+  `Resp`.
+- **Given** a request carrying a `Cookie:` header with several pairs, quoted
+  values and stray whitespace, **when** it is parsed, **then** each value is
+  recovered exactly, and a malformed header is a 400 rather than a silent
+  partial parse.
+- **Given** a session cookie whose HMAC is altered by one bit, **when** the
+  session middleware reads it, **then** the session is rejected in constant
+  time (`ct_eq`, which already exists) and the request proceeds unauthenticated
+  — never as a *different* user.
+- **Given** the limiter configured to N requests per window, **when** a client
+  exceeds it, **then** it receives 429 with the rate-limit headers set, the
+  window expires on `time.ticks`, and the counters **survive a restart** — the
+  durability the `@table` store buys, proven by a restart in the gate.
+- **Given** a CSRF-protected form flow, **when** a request arrives with a
+  missing, stale or foreign-origin token, **then** each is refused distinctly;
+  **when** the token is valid, the request proceeds. Single-use tokens are not
+  double-spendable.
+- **Given** the same POST replayed with an identical idempotency key, **when**
+  it is handled, **then** the stored response is returned and the handler does
+  not run twice — proven by a side effect that would be visible if it had.
+- **Given** a route registered with each new method helper and a per-route body
+  limit, **when** the matrix runs, **then** methods dispatch correctly, an
+  oversized body is refused per-route rather than per-server, and every standing
+  gate (`just web-app`, `just site`, `oop-accept`) is unchanged.
+
+## Out Of Scope
+
+Every item below is a real Fiber feature and a real writeonce gap. Each is
+excluded because someone else owns it — the study's §7 is the full map.
+
+- **Streaming, SSE, compression, byte-range requests** — all four sit on one
+  missing seam: `internal/serve.wo` builds a whole response as one `Text` and
+  `serialize()` always emits `Content-Length`. The framework README already
+  parks "lazy body streaming + backpressure · streaming responses · explicit
+  commit point"; these belong to that slice. Note `internal/parse.wo:153-157`
+  **deliberately refuses** chunked request bodies with a request-smuggling note
+  — that refusal is correct and must survive whoever implements chunked.
+- **Typed binding of query / params / form / headers into a class** — Fiber's
+  `Bind` reflects over struct tags; principle 13 forbids reflection, so the
+  answer is compile-time generation:
+  [iteration 29's `@derive`](29-compile-time-metaprogramming.md). Recorded, not
+  attempted. Same for XML/CBOR/MsgPack codecs — JSON only is the small stdlib
+  working as intended.
+- **TTL cache middleware** — [iteration 18](18-memory-db-features.md) owns it,
+  spec already approved.
+- **`proxy` middleware** — needs an outbound socket, which does not exist:
+  [iteration 38](38-content-platform-capabilities.md).
+- **`pprof` / `expvar` / metrics / stack traces on trap** — iteration 30
+  (observability, CI, fuzz — still no story file).
+- **Everything the study's §6 lists as a deliberate divergence**: a runtime
+  template engine (markup is a compile-time literal or it does not exist), TLS
+  and HTTP/2 (proxy-terminated by doctrine), `net/http` interop (no FFI),
+  prefork and buffer-size knobs (the shard runtime owns placement), closures as
+  handlers (a handler is a class; its fields are the closure substitute). These
+  are settled — the study lists them so nobody re-opens them as "missing".
+- **A radix-tree router.** Path matching is a linear scan, already 🔶 in the
+  ledger pending a *measurement*. Iteration 22 built the harness but benched the
+  database, not the router. Still waiting on a number, not on this iteration.
+
+## Info
+
+Fiber v3.5.0, `.dev/reference/fiber` (gitignored; the study carries the clone
+command). Of its 32 middleware packages, **nine already have a working
+`porch` counterpart** — CORS, basic auth, key/bearer auth,
+helmet-style security headers, ETag, static files, logger, host authorization,
+and recover-as-500. The framework is further along than its size suggests; the
+gaps are breadth, not foundations, with the single exception of randomness.
+
+Dependency order, which is the whole point of the iteration:
+
+```
+random bytes  ──▶  cookies  ──▶  sessions  ──▶  CSRF
+     │                 │
+     │                 └──▶  (signed cookies, JWT HS256 issuing)
+     └──▶  request-id
+
+limiter, idempotency  ──▶  need only @table + time.ticks (start here)
+```
+
+Forks the spec must settle:
+
+1. **What replaces `Resp.headers: map<Text, Text>`?** Options: a
+   `multi Text` of raw header lines beside the map; a dedicated
+   `cookies: multi Cookie` field on `Resp` that `serialize()` renders; or a
+   general repeated-header list. The first is smallest, the second is the most
+   typed, the third is the most honest about HTTP. This fork decides how much
+   of the framework's public surface moves, so it comes first.
+2. **What shape is the random builtin?** `random_bytes(n) -> Bytes` is the
+   obvious one and composes with everything iteration 19 and 34 added. Decide
+   whether a convenience `random_hex`/`random_id` rides along or whether
+   `base64_encode` is enough, and decide the failure mode when the kernel source
+   is unavailable — the criterion above says refuse, not degrade.
+3. **Is there a `Store` interface, or does each middleware own its `@table`?**
+   Fiber abstracts `Storage` so the same middleware runs on memory or Redis.
+   writeonce has one store, and interfaces are structural — an abstraction with
+   exactly one implementor is decoration (iteration 37 learned this the hard way
+   about `Component`). Leaning: concrete `@table` per middleware until a second
+   backend actually exists.
+4. **Where does session state live — cookie or table?** A signed cookie
+   carrying the whole payload needs no store and cannot be revoked; a table row
+   keyed by a random id can be revoked and costs a lookup. Leaning: table, since
+   `@table` is the language's whole thesis and revocation is not optional for a
+   real login.
+5. **Does the request-id middleware trust an inbound header?** Fiber's
+   `requestid` accepts one by default. Behind a trusted proxy that is what you
+   want; on an open port it lets a client forge correlation ids. `client_ip` and
+   `net.peer` already exist for the trust decision — reuse that judgement rather
+   than inventing a second one.
+
+## Proposed Solution
+
+Wants a spec: fork 1 changes public framework types, and fork 2 adds a runtime
+builtin. Order follows the dependency chain above, and the first slice is
+deliberately the *cheapest* rather than the most foundational — limiter and
+idempotency need nothing new, so they prove the store pattern and the gate shape
+before the risky work starts.
+
+Then: the random builtin (runtime, with its own corpus fixtures), cookies (the
+`Resp` decision plus parse and serialize), sessions, CSRF, and the routing and
+response sugar last since it is independent of everything else. Each slice ends
+green on `just web-app` and `just site`, and the closing act corrects the
+framework README's crypto row and re-points every ledger row this study touched
+at its actual owner.
+
+Off-chain and independent of the concurrency chain, with one caveat worth
+stating: the SSE work this study defers is a natural companion to
+[iteration 24's](24-chat-websocket-workload.md) chat sample, since a room actor
+already has the fan-out shape. If 24 lands first, SSE gets cheaper.
diff --git a/docs/stories/porch/00-story.md b/docs/stories/porch/00-story.md
new file mode 100644
index 0000000..5e7a4d6
--- /dev/null
+++ b/docs/stories/porch/00-story.md
@@ -0,0 +1,88 @@
+# Story — `porch`, the writeonce web framework
+
+The second track. Where
+[`language-runtime-database/`](../language-runtime-database/00-story.md) grows
+the *language*, this track grows the one library written **in** it:
+[`porch`](../../examples/porch/README.md), consumed by every serving sample
+through `wo.toml [deps]`.
+
+Numbering restarts at 1 and is local to this track. Frontmatter carries
+`track: porch` so a query over `docs/stories/` can tell a porch iteration 3 from
+a language iteration 3. Status rules are the repo's, unchanged: `status:` in
+frontmatter is the only place state lives, no directory encodes it.
+
+## Why a separate track
+
+Three reasons, all practical:
+
+1. **Different substrate, different gates.** porch is `.wo` source. Its
+   iterations are proven by `just web-app` and `just site`, never by the
+   conformance corpus or `oop-accept`. Mixing them into the language track's
+   sequence made both harder to read.
+2. **Different cadence.** A porch slice is days; a language slice that touches
+   `wob.h` and the VM is longer and riskier. Interleaving them in one numbering
+   forced false ordering decisions.
+3. **The framework is now the product surface.** `writeonce.de` is served by
+   porch. Its gaps are what a visitor hits first, so they deserve a roadmap that
+   is not buried behind runtime work.
+
+The language track stays upstream: when a porch iteration needs a new builtin,
+that half is called out explicitly and the language track owns it.
+
+## Where the sequence came from
+
+The [Fiber v3.5.0 parity study](../../plan/exploration/fiber/00-fiber-parity.md)
+— gofiber/fiber read end to end against porch's actual `.wo` source: its routing
+surface, `Req`/`Res` API, binder, lifecycle hooks and the `Config` of all 32 of
+its `middleware/` packages. Nine of those 32 already have a working porch
+counterpart, so this is a breadth roadmap, not a rescue.
+
+That study replaced language-track
+[iteration 39](../language-runtime-database/39-web-framework-parity.md), which is
+now a pointer here.
+
+## The sequence
+
+Ordered by dependency, not by importance — and the first slice is deliberately
+the *cheapest*, so the store pattern and the gate shape are proven before the
+risky work starts.
+
+| # | Iteration | Delivers | Needs |
+| --- | --- | --- | --- |
+| 1 | [Store-backed middleware](01-store-backed-middleware.md) | rate limiting + idempotency over a `@table` store | nothing new — starts today |
+| 2 | [Randomness and cookies](02-randomness-and-cookies.md) | a `random_bytes` runtime builtin, repeated response headers, `Cookie:` parsing, signed cookies | a language-track builtin (phase A) |
+| 3 | [Sessions](03-sessions.md) | server-side sessions, idle + absolute timeout, revocation | 2 |
+| 4 | [CSRF](04-csrf.md) | token mint/verify, trusted origins, single-use tokens | 2, 3 |
+| 5 | [Routing and response ergonomics](05-routing-response-ergonomics.md) | the remaining method helpers, named routes, per-route body limit, request ids, the missing response helpers | nothing — parallel to 2–4 |
+| 6 | [Streaming core](06-streaming-core.md) | incremental response writes and chunked framing — the seam three iterations wait on | nothing new, but it changes `Resp` |
+| 7 | [SSE and compression](07-sse-and-compression.md) | server-sent events, gzip/deflate | 6 |
+| 8 | [Static files and lifecycle](08-static-and-lifecycle.md) | byte ranges, cache headers, directory listing, lifecycle hooks, the small middleware everyone ships | 6 |
+
+```
+1 ─ independent, start here
+5 ─ independent, any time
+2 ──▶ 3 ──▶ 4
+6 ──▶ 7
+  └──▶ 8
+```
+
+## What this track does NOT own
+
+| Not porch's | Owner |
+| --- | --- |
+| typed binding of query/params/form into a class | language: [`@derive`](../language-runtime-database/29-compile-time-metaprogramming.md) — reflection is forbidden by principle 13 |
+| TTL cache, `transaction { }`, durable job queue | language: [iteration 18](../language-runtime-database/18-memory-db-features.md) |
+| a `proxy` middleware | language: [iteration 38](../language-runtime-database/38-content-platform-capabilities.md) — needs `net.connect`, which does not exist |
+| metrics, profiling, per-change CI, fuzzing | language iteration 30 (no story file yet) |
+| TLS, HTTP/2 | nobody — proxy-terminated by doctrine |
+| a runtime template engine | nobody — rejected; markup is a compile-time literal (`writeonce-view`) |
+| a radix-tree router | nobody yet — waiting on a *measurement*, not a decision |
+
+## Review protocol
+
+Same as the language track: the developer reads one iteration, approves or
+amends; the next starts only after approval. Each iteration is an unsplittable
+value slice with phases, per-phase tasks, Given/When/Then acceptance criteria,
+and an out-of-scope list. Every phase ends with both serving gates green —
+`just web-app` and `just site` — because porch has two consumers and a change
+that only satisfies one is not done.
diff --git a/docs/stories/porch/01-store-backed-middleware.md b/docs/stories/porch/01-store-backed-middleware.md
new file mode 100644
index 0000000..6e719f3
--- /dev/null
+++ b/docs/stories/porch/01-store-backed-middleware.md
@@ -0,0 +1,144 @@
+---
+track: porch
+iteration: "1"
+status: refine
+---
+
+# porch 1 — store-backed middleware: rate limiting and idempotency
+
+> Part of [Story — `porch`, the writeonce web framework](00-story.md).
+> Source: [the Fiber parity study](../../plan/exploration/fiber/00-fiber-parity.md) §2.
+>
+> **First deliberately because it is the cheapest.** Both features need only a
+> `@table` and `time.ticks`, both of which already exist — no new builtin, no
+> cookie, no change to `Resp`. It exists to prove the store pattern and the gate
+> shape on low-risk work before iterations 2–4 touch the runtime and the public
+> response type.
+
+## Goals
+
+- **A rate limiter that survives a restart.** Fixed-window counting keyed by
+  client, answering 429 with the conventional headers when the window is spent.
+  Fiber's `limiter` keeps counters in memory by default and expects Redis for
+  anything real; porch's live in a `@table`, so they are WAL-durable and
+  crash-recoverable for free. That is the difference worth demonstrating, and it
+  is why the acceptance criteria include a restart.
+- **Idempotent replay of unsafe requests.** A client resending a POST with the
+  same idempotency key gets the stored response and the handler does not run
+  twice. This is the correctness feature the storefront sample has silently
+  needed since it grew a checkout.
+- **Establish the store convention for iterations 2–4.** Sessions and CSRF will
+  want the same shape. Decide it once, here, on the cheap slice.
+
+## Phases
+
+### Phase A — the store convention
+
+- Decide the store shape (see Info fork 1) and write it down before any
+  middleware exists, because three later iterations inherit it.
+- Add the `@table` classes for a counter row and a stored-response row, with
+  the secondary indexes their lookups need — the read path is an equality
+  probe, which is the only index shape the engine has.
+- Decide and document the expiry discipline: rows are pruned lazily on access,
+  not by a background sweeper, because porch has no timer and iteration 30 owns
+  scheduled work.
+- Verify: `woc docs/examples/porch/` typechecks entry-less as a library; the
+  new tables appear in the WAL and replay across a restart.
+
+### Phase B — the rate limiter
+
+- A `Limiter` middleware class with a `before` that counts and either passes or
+  short-circuits with 429 — the `?Resp` short-circuit the chain already has.
+- Key selection: reuse `client_ip(req)` and the existing trusted-proxy
+  judgement rather than inventing a second one. A keyed-by-principal variant
+  falls out for free once `req.principal` is set by an auth middleware.
+- The response headers on both paths, and a `Retry-After` on the refusal.
+- Window arithmetic on `time.ticks` (µs monotonic), not `time.now` — a
+  wall-clock jump must not hand out a free window.
+- Verify: a burst crosses the threshold at exactly N, the window rolls, the
+  counters survive `SIGTERM` + restart.
+
+### Phase C — idempotency
+
+- An `Idempotent` middleware pair: `before` looks the key up and replays a hit;
+  `after` stores the response for a miss. This is the first real user of the
+  `after` chain for something other than headers, which is worth noting.
+- Decide what is part of the identity: the key header alone, or key plus a
+  digest of method+path+body (`sha256` exists). Replaying a stored response for
+  a *different* body under a reused key is the failure mode that matters.
+- In-flight collision handling: a second request arriving while the first is
+  still running. Fiber takes a lock; porch's shard model means the honest
+  answer is probably to refuse with 409 rather than to block.
+- Verify: replay returns the stored response, the handler's side effect happens
+  exactly once, a reused key with a different body is refused, concurrent
+  duplicates do not both execute.
+
+### Phase D — the gate and the ledger
+
+- Extend `scripts/web-app-accept.sh` with the checks above, including the
+  restart leg — a durability claim that no gate exercises is not a claim.
+- Update porch's README ledger rows for both features, and record in the
+  status board what landed versus what was planned.
+- Verify: `just web-app` and `just site` both green; `just linkcheck` clean.
+
+## Acceptance Criteria
+
+- **Given** a limiter of N requests per window, **when** a client sends N+1,
+  **then** the first N succeed and the last is 429 with `Retry-After` set.
+- **Given** counters at their limit, **when** the process is SIGTERMed and
+  restarted, **then** the client is still limited — the counters replayed from
+  the WAL rather than resetting to zero.
+- **Given** a window that has fully elapsed, **when** the same client returns,
+  **then** it is served, and the expired row is pruned on that access.
+- **Given** the system clock jumping backwards, **when** the window is
+  evaluated, **then** no extra allowance is granted (`time.ticks` is monotonic).
+- **Given** a POST with an idempotency key that has been seen, **when** it is
+  replayed, **then** the stored response is returned byte-identically and the
+  handler's side effect count is unchanged — proven by a row count, not by a
+  log line.
+- **Given** a reused idempotency key with a different request body, **when** it
+  arrives, **then** it is refused rather than answered with the other request's
+  response.
+- **Given** two identical keyed requests in flight at once, **when** both are
+  dispatched, **then** exactly one executes and the other gets the decided
+  answer (replay or 409), never a partial write.
+
+## Out Of Scope
+
+- **A pluggable `Storage` interface.** Fiber abstracts it so one middleware runs
+  on memory or Redis. porch has one store, and interfaces here are structural —
+  an abstraction with exactly one implementor is decoration, which iteration 37
+  learned the hard way about `Component`. Concrete `@table` until a second
+  backend actually exists.
+- **Sliding-window or token-bucket algorithms.** Fixed window is what the
+  sample needs; a better algorithm is a later slice with a measurement behind
+  it.
+- **Distributed limiting across processes.** One program owns its database;
+  cross-program state is language
+  [databasev2 9](../databasev2/09-cross-program-tables.md).
+- **A background expiry sweeper.** No timer exists (`time.after` is still a
+  reserved builtin id in `wob.h`). Lazy pruning on access, deliberately.
+- **The TTL cache middleware** — language
+  [iteration 18](../language-runtime-database/18-memory-db-features.md) owns it,
+  spec already approved. Do not build a second cache here.
+
+## Info
+
+Forks the spec must settle:
+
+1. **One store or two?** A single generic key/value/expiry table serving both
+   features, or a purpose-shaped table each. Leaning two: the columns genuinely
+   differ (a counter is an Int, a stored response is status + headers + body),
+   and a generic table would force everything through `Text`, which is how the
+   framework's cache ended up storing JSON strings.
+2. **What is the limiter's key when there is no auth?** `client_ip(req)` reads
+   `X-Forwarded-For`, which a direct client can forge. Behind the mandated TLS
+   proxy that is fine; on an open port it is not. `net.peer(fd)` gives the real
+   peer — decide which is authoritative and reuse whatever the trusted-proxy
+   slice concludes rather than deciding twice.
+3. **Does idempotency store headers?** Fiber has `KeepResponseHeaders` because
+   replaying `Set-Cookie` or a fresh `Date` is usually wrong. porch has no
+   cookies yet (iteration 2), so this is cheap to decide now and expensive to
+   retrofit later.
+
+Nothing here needs a new runtime primitive, which is the point of going first.
diff --git a/docs/stories/porch/02-randomness-and-cookies.md b/docs/stories/porch/02-randomness-and-cookies.md
new file mode 100644
index 0000000..be0dac8
--- /dev/null
+++ b/docs/stories/porch/02-randomness-and-cookies.md
@@ -0,0 +1,170 @@
+---
+track: porch
+iteration: "2"
+status: refine
+---
+
+# porch 2 — randomness and cookies: the foundation three iterations stand on
+
+> Part of [Story — `porch`, the writeonce web framework](00-story.md).
+> Source: [the Fiber parity study](../../plan/exploration/fiber/00-fiber-parity.md) §0–§1.
+>
+> **The study's sharpest finding lives here.** porch's own README claimed signed
+> cookies, CSRF and session integrity were "UNBLOCKED — the primitives exist
+> since iteration 34". For CSRF and sessions that is **wrong**: SHA-256 and HMAC
+> let a program *authenticate* a token, they cannot *mint* one, and writeonce has
+> no source of randomness anywhere. An HMAC over a guessable session id is a
+> signed guess. Phase A closes that before anything depends on it.
+
+## Goals
+
+- **A CSPRNG builtin in the runtime.** No `getrandom`, no `/dev/urandom` read,
+  no CSPRNG builtin exists today — grep the runtime and nothing comes back. This
+  is the one phase of this track that is **language-track work** (C, a new
+  builtin id, a corpus fixture); it is here because porch is what needs it and
+  splitting it across two tracks would hide the dependency.
+- **Repeated response headers, which `Resp` structurally cannot express.**
+  `Resp.headers` is a `map<Text, Text>`. A login response setting a session
+  cookie *and* a flash cookie needs two `Set-Cookie` lines and the map can hold
+  one. This is a change to porch's most public type, and deciding its shape is
+  the real work of this iteration — the cookie formatting is the easy half.
+- **Cookies in both directions.** Parse a `Cookie:` request header into
+  something typed; build a `Set-Cookie` with the attributes that matter for
+  security — `HttpOnly`, `Secure`, `SameSite`, `Max-Age`, `Path`, `Domain`.
+- **Signed cookies.** HMAC-SHA256 over the value with constant-time comparison
+  on the way back (`hmac_sha256` and `ct_eq` both already exist). This is the
+  half that genuinely *was* unblocked by iteration 34, and it is what makes a
+  cookie tamper-evident without a server-side lookup.
+- **Correct the ledger row that started this.** The README's crypto line, and
+  anything else claiming the sessions/CSRF path was already open.
+
+## Phases
+
+### Phase A — the runtime primitive (language-track work)
+
+- Add a random-bytes builtin at the next free id (89 and 90 are reserved holes
+  for language iteration 31's `monitor` and `time.after`, so this starts at 96).
+- Source it from the kernel. Decide the failure mode explicitly: if the source
+  is unavailable the builtin **refuses**, loudly. A CSPRNG that quietly degrades
+  to something weaker is worse than none, because every layer above it will
+  assume it worked.
+- Corpus fixtures: the builtin's arity and type contract, and the refusal path.
+  Statistical quality is not a corpus concern — the kernel's guarantee is the
+  guarantee.
+- Document it in the builtin-surface contract and the error catalog if it adds a
+  diagnostic, in the same change. Both of those went stale once before by not
+  doing this.
+- Verify: `oop-e2e` green; the value differs across separate processes and is
+  not derivable from the clock.
+
+### Phase B — repeated response headers
+
+- Settle fork 1 and change `Resp`. Every response builder
+  (`ok_text`/`ok_json`/`ok_html`/`created_json`/`not_found`/…) and
+  `serialize()` in `internal/serve.wo` move with it.
+- Keep the single-value path ergonomic: the overwhelmingly common case is one
+  value per header, and it must not get worse to write.
+- Verify: `serialize()` emits two distinct `Set-Cookie` lines for one response;
+  every existing header behaviour is byte-identical, proven by both serving
+  gates passing unchanged.
+
+### Phase C — reading request cookies
+
+- Parse the `Cookie:` header: multiple pairs, quoted values, stray whitespace,
+  and duplicate names.
+- Decide where parsed cookies live — a lazily-parsed field on `Req`, or a
+  helper the handler calls. `Req` already carries a `ctx` bag and a `params`
+  map, so the precedent exists either way.
+- A malformed header is a 400, not a silent partial parse. The parser's
+  existing discipline around duplicate `Content-Length` is the model.
+- Verify: values recovered exactly across the awkward cases above; malformed
+  input refused.
+
+### Phase D — writing and signing cookies
+
+- A `Set-Cookie` builder covering the attribute set, with `HttpOnly` and
+  `SameSite` defaulted to the safe choice rather than the permissive one — a
+  cookie API whose defaults are insecure is a footgun that ships.
+- Sign with `hmac_sha256`, verify with `ct_eq`. Decide the encoding (`base64` is
+  already available) and the payload framing so a value containing the delimiter
+  cannot forge a signature.
+- Clear-cookie support, which is its own case: the attributes must match or the
+  browser keeps the old one.
+- Verify: a one-bit change to value or signature is rejected; a valid cookie
+  round-trips; a cleared cookie is actually gone.
+
+### Phase E — prove it and correct the record
+
+- A login/logout flow in a sample exercising two cookies on one response, using
+  the signed-cookie path only — no sessions yet, that is iteration 3.
+- Correct porch's README crypto row and re-point the ledger rows this iteration
+  touched.
+- Verify: `just web-app`, `just site`, `oop-accept`, `just linkcheck` all green.
+
+## Acceptance Criteria
+
+- **Given** the random builtin, **when** many values are drawn across separate
+  processes, **then** none repeats and none is derivable from the clock; **and**
+  when the kernel source is unavailable, the builtin refuses loudly rather than
+  returning weak bytes.
+- **Given** a handler setting a session cookie and a flash cookie on one
+  response, **when** it is serialized, **then** **two** distinct `Set-Cookie`
+  headers reach the wire. This is the criterion today's `map<Text, Text>`
+  provably cannot satisfy.
+- **Given** every pre-existing response shape, **when** both serving gates run,
+  **then** output is byte-identical to before phase B — the `Resp` change is
+  additive or it is wrong.
+- **Given** a `Cookie:` header with several pairs, quoted values and stray
+  whitespace, **when** it is parsed, **then** each value is recovered exactly;
+  **and** a malformed header yields 400, never a partial parse.
+- **Given** a signed cookie altered by one bit in either the value or the
+  signature, **when** it is verified, **then** it is rejected in constant time.
+- **Given** a signed value that itself contains the payload delimiter, **when**
+  it round-trips, **then** it cannot be re-framed to forge a valid signature.
+- **Given** cookie defaults, **when** a cookie is created without explicit
+  attributes, **then** `HttpOnly` is on and `SameSite` is not `None`.
+
+## Out Of Scope
+
+- **Encrypted cookies.** Fiber's `encryptcookie` needs a symmetric cipher, and
+  the runtime has digests only. Signed-and-readable is honest and sufficient for
+  a session id; encrypting a payload is a separate ask with a separate primitive
+  behind it.
+- **Server-side session state** — iteration [3](03-sessions.md). This iteration
+  stops at a signed cookie carrying a value the app chose.
+- **CSRF** — iteration [4](04-csrf.md), which needs both this and 3.
+- **JWT.** Verification is already possible with `hmac_sha256`; issuing needs
+  phase A. Either way it is a library slice with a hard stop at HS256 — no
+  RS256, no JOSE — and not this iteration.
+- **Cookie-based *cache* keys.** Fiber's cache middleware has `KeyCookies`; the
+  cache belongs to language
+  [iteration 18](../language-runtime-database/18-memory-db-features.md).
+
+## Info
+
+Forks the spec must settle, in order of how much they move:
+
+1. **What replaces `Resp.headers: map<Text, Text>`?** Three candidate shapes: a
+   `multi Text` of raw extra header lines beside the existing map; a dedicated
+   typed `cookies` field on `Resp` that `serialize()` renders; or a general
+   repeated-header list replacing the map. The first is the smallest change, the
+   second the most typed, the third the most honest about HTTP — and the third
+   touches every builder and both consumers. This fork decides the size of the
+   whole iteration, so settle it first.
+2. **What shape is the builtin?** A bytes-returning primitive composes with
+   everything iterations 19 and 34 added (`Bytes`, `base64_encode`,
+   `hmac_sha256`), which argues for exactly one function and no convenience
+   wrappers. Decide whether a hex/id helper rides along or whether
+   `base64_encode` is enough.
+3. **Where do parsed cookies live?** A field on `Req` parsed eagerly costs every
+   request that has no cookies; a helper parsed on demand costs nothing but is
+   easy to call twice. `Req` is a `typedef` record, so adding a field is cheap —
+   the cost is the eager parse, not the shape.
+4. **Signed-cookie framing.** Value-then-signature with a delimiter is the
+   obvious encoding and the obvious place to get it wrong. Decide the framing so
+   that a value containing the delimiter cannot shift the boundary.
+
+Phase A is the only part of this track that is language-track work. It is
+sequenced here rather than filed as a language iteration because nothing else
+wants it yet, and a primitive with no consumer is how the `Component` interface
+became decoration.
diff --git a/docs/stories/porch/03-sessions.md b/docs/stories/porch/03-sessions.md
new file mode 100644
index 0000000..59d4b61
--- /dev/null
+++ b/docs/stories/porch/03-sessions.md
@@ -0,0 +1,129 @@
+---
+track: porch
+iteration: "3"
+status: refine
+---
+
+# porch 3 — sessions: server-side state, revocable, durable
+
+> Part of [Story — `porch`, the writeonce web framework](00-story.md).
+> Source: [the Fiber parity study](../../plan/exploration/fiber/00-fiber-parity.md) §2.
+> Needs [iteration 2](02-randomness-and-cookies.md) (a random session id and a
+> signed cookie to carry it) and inherits the store convention from
+> [iteration 1](01-store-backed-middleware.md).
+
+## Goals
+
+- **A session is a `@table` row keyed by a random id; the cookie carries only
+  the id.** The alternative — a signed cookie carrying the whole payload — needs
+  no store but cannot be revoked, and revocation is not optional for a real
+  login. This is the fork iteration 1's store convention exists to answer.
+- **Both timeouts, because they answer different questions.** Idle timeout
+  bounds "how long since you did anything"; absolute timeout bounds "how long
+  since you authenticated". Fiber ships both (`IdleTimeout`, `AbsoluteTimeout`)
+  and a session with only the first never expires for an active attacker.
+- **Durability is the differentiator.** Fiber's default store is in-memory: a
+  restart logs everyone out. porch's sessions ride the WAL, so they survive —
+  and the gate proves it, because an unexercised durability claim is not a
+  claim.
+- **Revocation that works.** Logout, and "log out everywhere for this
+  principal" — the second is what a password change needs, and it is nearly free
+  once sessions are rows with an owner column.
+
+## Phases
+
+### Phase A — the session table and its lifecycle
+
+- The `@table` class: random id, principal, created-at, last-seen, and whatever
+  payload shape fork 1 settles. Secondary index on principal, because
+  "revoke all for this user" is an equality probe and that is the only index
+  shape the engine has.
+- Create, touch, expire and delete, with expiry evaluated on access (the lazy
+  discipline iteration 1 established — there is still no timer).
+- Verify: rows replay across a restart; an expired row is pruned when touched.
+
+### Phase B — the middleware
+
+- A `Session` middleware whose `before` reads the signed cookie, loads the row,
+  checks both timeouts, and attaches identity. Decide whether it sets
+  `req.principal` or writes into `req.ctx` — `principal` is the field the
+  framework already means for identity, so it should be that unless the session
+  carries more than identity.
+- Rotate the id on privilege change (login especially). Session fixation is the
+  attack that a login which reuses the pre-login id walks straight into.
+- A missing, expired, unknown or tampered cookie all end at the same place —
+  unauthenticated — but for distinguishable reasons, because debugging a login
+  loop without that distinction is miserable.
+- Verify: each of those four cases behaves; the id changes across login.
+
+### Phase C — login, logout, revoke-all
+
+- The three flows end to end in a sample, using porch's existing auth pieces
+  (`bearer_token`, `basic_credentials`, `ct_eq`) for the credential check —
+  sessions are about *keeping* identity, not establishing it.
+- Logout deletes the row and clears the cookie with matching attributes.
+- Revoke-all deletes by principal and is proven with two concurrent sessions.
+- Verify: after logout the old cookie is inert even though it is still
+  well-signed — the point of server-side state.
+
+### Phase D — the gate and the ledger
+
+- Extend `scripts/site-accept.sh` rather than only the storefront: the site has
+  an admin route that currently checks a bearer token per request, which is
+  exactly the thing sessions replace.
+- Ledger rows, status board entry, and the standup questions answered.
+- Verify: `just web-app`, `just site`, `just linkcheck` green.
+
+## Acceptance Criteria
+
+- **Given** a valid session cookie, **when** a request arrives, **then**
+  identity is attached and the row's last-seen advances.
+- **Given** a session whose signature is valid but whose row was deleted,
+  **when** it is presented, **then** the request is unauthenticated — a
+  well-formed cookie is not authority.
+- **Given** an idle timeout of T, **when** a session is unused for longer than
+  T, **then** it is rejected and its row pruned on that access.
+- **Given** an absolute timeout of A, **when** a session is *continuously
+  active* past A, **then** it is still rejected — the criterion an idle-only
+  implementation fails.
+- **Given** an anonymous session id, **when** the user logs in, **then** the id
+  is rotated and the pre-login id is inert.
+- **Given** active sessions and a SIGTERM plus restart, **when** the same
+  cookies return, **then** the users are still logged in, replayed from the WAL.
+- **Given** two sessions for one principal, **when** revoke-all runs, **then**
+  both are inert and other principals are untouched.
+- **Given** logout, **when** the cleared cookie is compared to the one that set
+  it, **then** the attributes match, so the browser actually drops it.
+
+## Out Of Scope
+
+- **Flash messages and a general session bag.** A typed session with a known
+  shape first; an untyped `map<Text,Text>` payload is a decision to defer, not
+  a default to adopt.
+- **OAuth, OIDC, SSO, "log in with X".** Every one needs an outbound socket,
+  which does not exist — language
+  [iteration 38](../language-runtime-database/38-content-platform-capabilities.md).
+- **Remember-me tokens** — a second, longer-lived credential class with its own
+  rotation story. Its own slice.
+- **CSRF** — iteration [4](04-csrf.md). Sessions make CSRF *possible* to do
+  properly; they do not provide it.
+- **Sliding-window renewal of the absolute timeout.** That is not what absolute
+  means.
+
+## Info
+
+Forks the spec must settle:
+
+1. **What does the session row carry beyond identity?** Just principal, or a
+   payload? A payload wants a shape, and without generics the shape is either a
+   declared class per app or `Text`. The framework's cache already stores `Text`
+   and that is the compromise this repo dislikes most — so leaning: identity
+   plus declared columns, and apps that want more keep their own table keyed by
+   session id.
+2. **Idle-timeout writes on every request.** Touching last-seen means a WAL
+   write per request, which turns every read into a durable write. Options:
+   write at a coarser granularity, or accept the cost and say so with a number
+   from `just db-bench`. This is a real performance fork, not a detail.
+3. **Does `Session` set `req.principal` or `req.ctx`?** `principal` is the
+   framework's declared home for identity and auth middleware already writes it,
+   so two writers of one field need a documented precedence.
diff --git a/docs/stories/porch/04-csrf.md b/docs/stories/porch/04-csrf.md
new file mode 100644
index 0000000..d7f19ae
--- /dev/null
+++ b/docs/stories/porch/04-csrf.md
@@ -0,0 +1,130 @@
+---
+track: porch
+iteration: "4"
+status: refine
+---
+
+# porch 4 — CSRF: tokens that are unguessable, bound, and spendable once
+
+> Part of [Story — `porch`, the writeonce web framework](00-story.md).
+> Source: [the Fiber parity study](../../plan/exploration/fiber/00-fiber-parity.md) §2.
+> Needs [2](02-randomness-and-cookies.md) for randomness and cookies, and
+> [3](03-sessions.md) for something to bind a token to.
+
+## Goals
+
+- **Tokens that cannot be guessed or forged.** Minted from the iteration-2
+  builtin, verified with `ct_eq`. This is the iteration that could not have been
+  written honestly before phase A of 2 existed, which is the whole reason the
+  track is ordered this way.
+- **Bound to a session, not floating.** An unbound token is a token an attacker
+  can fetch for themselves and replay against a victim. Binding is what makes
+  the defence real, and it is why this follows sessions rather than preceding
+  them.
+- **Origin checking as the cheap second layer.** Fiber ships `TrustedOrigins`
+  alongside the token. Same-site cookies plus an origin check stop most of what
+  tokens stop, for almost no cost — and the two layers fail differently, which
+  is the argument for having both.
+- **Single-use where it matters.** Fiber's `SingleUseToken` exists because a
+  long-lived token in a browser history or a referrer header is a credential
+  left lying around. Decide which routes get it rather than making everything
+  pay.
+- **Refusals that are distinguishable.** Missing, stale, foreign-origin and
+  already-spent must be told apart in the logs, or nobody can debug a form that
+  stopped working.
+
+## Phases
+
+### Phase A — mint and verify
+
+- Token generation, storage keyed by session, and constant-time verification.
+- Decide the transport: a dedicated cookie plus a form field (double-submit), or
+  session-stored plus a form field. The second needs no second cookie and is the
+  stronger of the two once sessions exist.
+- Extraction from where forms and fetch clients actually put it: a form field, a
+  header, and decide whether a query parameter is ever allowed (it should not be
+  — it leaks into logs and referrers).
+- Verify: a valid token passes; altered, absent and foreign tokens each fail
+  distinctly.
+
+### Phase B — the middleware and safe-method policy
+
+- A `Csrf` middleware gating unsafe methods only. `GET`/`HEAD`/`OPTIONS` must
+  pass untouched or every link on the site breaks.
+- Origin and `Referer` checking against a configured trusted set, including the
+  awkward cases: absent origin, `null` origin, and a same-origin request that
+  arrives without the header.
+- Failure is a distinct status with a body that does not leak whether the token
+  was wrong or merely stale.
+- Verify: the site's admin edit flow works through the middleware; unsafe
+  methods without a token are refused; safe methods are unaffected.
+
+### Phase C — single use and rotation
+
+- Mark-spent-on-use for the routes that opt in, and decide what happens to a
+  double-submitted form (the user double-clicking is not an attack, and treating
+  it as one is a support ticket).
+- Rotate on privilege change, matching the session-id rotation from iteration 3.
+- Verify: a spent token is refused; a double-click produces a comprehensible
+  outcome rather than a raw 403.
+
+### Phase D — the gate and the ledger
+
+- Both serving gates: the site's admin edit is the natural CSRF subject, the
+  storefront's checkout the natural single-use subject.
+- Ledger and status board.
+- Verify: `just web-app`, `just site`, `just linkcheck` green.
+
+## Acceptance Criteria
+
+- **Given** an unsafe request with no token, **when** it is dispatched, **then**
+  it is refused and the handler never runs.
+- **Given** a token minted for session A, **when** it is presented with session
+  B's cookie, **then** it is refused — binding is enforced, not decorative.
+- **Given** a token altered by one bit, **when** it is verified, **then** it is
+  refused in constant time.
+- **Given** a request from an untrusted origin carrying an otherwise valid
+  token, **when** it arrives, **then** it is refused — the layers are
+  independent.
+- **Given** a safe method (`GET`, `HEAD`, `OPTIONS`), **when** it arrives with
+  no token, **then** it passes untouched.
+- **Given** a single-use token, **when** it is submitted twice, **then** the
+  second attempt is refused and the outcome is distinguishable from a forged
+  token in the logs.
+- **Given** login, **when** the session id rotates, **then** the outstanding
+  token for the old session is no longer valid.
+- **Given** each refusal class, **when** the logs are read, **then** missing,
+  stale, foreign-origin and spent are told apart — while the response body
+  tells the client none of it.
+
+## Out Of Scope
+
+- **CORS.** Already shipped (`Cors` before/after middleware). It is a different
+  problem — CORS decides who may *read* a response, CSRF stops a forged write.
+  Conflating them is the most common way both get misconfigured.
+- **Same-site cookie attributes as the whole answer.** Iteration 2 sets a safe
+  `SameSite` default and it does real work, but it is a browser behaviour, not a
+  server guarantee, and older clients ignore it.
+- **Captcha, rate-limited forms, bot defence.** Rate limiting shipped in
+  iteration [1](01-store-backed-middleware.md); the rest is not porch's.
+- **Encrypted or stateless tokens.** No symmetric cipher exists, and a
+  stateless token cannot be revoked or spent once.
+
+## Info
+
+Forks the spec must settle:
+
+1. **Double-submit cookie, or session-stored token?** Double-submit needs no
+   store and works without sessions; session-stored needs no second cookie and
+   is strictly stronger. Since iteration 3 lands first, leaning session-stored —
+   and if so, say plainly that porch has no CSRF story for sessionless apps
+   rather than shipping the weaker one silently.
+2. **Which routes default to single-use?** All of them is safest and the most
+   annoying; opt-in is pleasant and easy to forget on the one route that
+   mattered. Leaning opt-in with the checkout as the worked example, because a
+   default nobody can live with gets disabled wholesale.
+3. **What happens when a form is submitted twice by a human?** This is the fork
+   that decides whether the feature is usable. Iteration
+   [1](01-store-backed-middleware.md)'s idempotency machinery may be the honest
+   answer — the same key, replayed, gets the same response — which would make
+   these two features compose rather than collide.
diff --git a/docs/stories/porch/05-routing-response-ergonomics.md b/docs/stories/porch/05-routing-response-ergonomics.md
new file mode 100644
index 0000000..6535e2f
--- /dev/null
+++ b/docs/stories/porch/05-routing-response-ergonomics.md
@@ -0,0 +1,142 @@
+---
+track: porch
+iteration: "5"
+status: refine
+---
+
+# porch 5 — routing and response ergonomics: the parity that is merely missing
+
+> Part of [Story — `porch`, the writeonce web framework](00-story.md).
+> Source: [the Fiber parity study](../../plan/exploration/fiber/00-fiber-parity.md) §5.
+>
+> Independent of iterations 2–4 and of the streaming seam — startable at any
+> time, and a reasonable slice to interleave when the risky work needs a break.
+> Nothing here is hard; all of it is felt.
+
+## Goals
+
+- **The rest of the method helpers.** `App` has `get`/`post`/`put`/`delete_`.
+  A `Route { method: "PATCH" }` literal already works, so this is registration
+  ergonomics rather than capability — but writing the literal by hand for
+  `PATCH` while `get` exists is the kind of asymmetry that makes a framework
+  feel unfinished. Add `patch`, `options`, `head`, and an `all`.
+- **Named routes and reverse routing.** Fiber has `Name()` and `GetRouteURL()`.
+  porch has neither, so every link in the site is a hand-written string that no
+  compiler checks — and the site is exactly the app where a renamed path breaks
+  a page silently.
+- **A per-route body limit.** `BODY_MAX = 1048576` is one compile-time constant
+  for the whole server. An upload route and a JSON route want different numbers,
+  and the JSON route wants a much smaller one than the upload route can live
+  with.
+- **Request ids.** `req.ctx` already exists to carry one; there is no generator
+  and no middleware. With iteration 2's builtin available this is a few lines,
+  and it is the difference between logs you can correlate and logs you cannot.
+- **The response helpers written by hand today.** `Location`, `Vary`,
+  `Attachment`/`Download`, and a content-negotiated `format` dispatch on top of
+  the existing `accepts()`. Also q-value *ranking*, which the ledger has carried
+  as a known 🔶 since the negotiation slice landed.
+
+## Phases
+
+### Phase A — method helpers and route introspection
+
+- The missing registration helpers, including `all`, and decide whether `head`
+  auto-registers alongside `get` (Fiber has `DisableHeadAutoRegister`, which
+  tells you the default is auto and that people want it off).
+- Route introspection — list the table — because it is nearly free once routes
+  are already a `multi Route`, and it is what makes a startup banner or a
+  route-dump flag possible.
+- Verify: each method dispatches; `405` still carries a correct `Allow` built
+  from the real table; existing routes unchanged.
+
+### Phase B — named routes and URL building
+
+- A name on `Route`, a lookup, and a builder that fills `:param` captures.
+- Decide the failure mode for a missing or extra parameter. A silently wrong URL
+  is worse than a trap, and this is a compile-time-checkable shape only once
+  language iteration 29's `@derive` exists — so for now it is a runtime check
+  and should say so.
+- Migrate the site's internal links onto it, which is the proof it is usable.
+- Verify: every site link resolves through the builder; a wrong parameter set is
+  refused loudly.
+
+### Phase C — per-route body limits and request ids
+
+- Move the limit from a module constant to route-level configuration with the
+  current value as the default, so no existing app changes behaviour.
+- A request-id middleware writing into `req.ctx`, and settle whether an inbound
+  header is trusted (fork 2).
+- Thread the id into the logging middleware's output, since a request id nothing
+  logs is decoration.
+- Verify: an oversized body is refused per-route; the id appears in logs and is
+  stable across a request's lifetime.
+
+### Phase D — response helpers and negotiation ranking
+
+- `Location`, `Vary`, `Attachment`/`Download`, and a `format`-style dispatch
+  choosing a builder from `accepts()`.
+- Rank q-values properly instead of stripping them, retiring the ledger's 🔶.
+- Verify: `Vary` accumulates rather than overwrites (which the iteration-2
+  repeated-header work makes possible); negotiation picks the highest-q match,
+  not the first.
+
+### Phase E — the gate and the ledger
+
+- Both serving gates, the ledger rows, the board entry.
+- Verify: `just web-app`, `just site`, `just linkcheck` green.
+
+## Acceptance Criteria
+
+- **Given** a route registered with each new helper, **when** the matching
+  method arrives, **then** it dispatches; **and** an unmatched method still
+  yields `405` with an `Allow` listing exactly the registered methods.
+- **Given** `head` auto-registration, **when** a `HEAD` request hits a `GET`
+  route, **then** the response is headers-only with the `Content-Length` a `GET`
+  would have sent — the behaviour `serialize()` already implements, now
+  reachable by registration.
+- **Given** a named route with `:param` captures, **when** a URL is built with
+  the right parameters, **then** it matches that route's pattern exactly;
+  **and** a wrong or missing parameter is refused rather than producing a
+  plausible-looking wrong URL.
+- **Given** two routes with different body limits, **when** a body exceeding the
+  smaller arrives at each, **then** it is refused at the small route and
+  accepted at the large one.
+- **Given** no per-route limit, **when** a request arrives, **then** the
+  previous global limit applies unchanged.
+- **Given** a request-id middleware, **when** a request is handled, **then** the
+  same id appears in every log line for that request and in the response header.
+- **Given** an `Accept` header with q-values out of order, **when** negotiation
+  runs, **then** the highest-q acceptable type wins — not the first listed.
+- **Given** two `Vary` contributions from different middleware, **when** the
+  response leaves, **then** both appear.
+
+## Out Of Scope
+
+- **A radix-tree router.** Path matching is a linear scan and the ledger marks
+  it 🔶 pending a *measurement*. Language iteration 22 built the benchmark
+  harness but pointed it at the database. Until someone benches the router, this
+  is an optimisation without evidence.
+- **Case-insensitive or strict-slash routing.** Fiber exposes both as config.
+  porch is case-sensitive and lenient; changing that is a behaviour change for
+  existing apps and wants its own decision.
+- **Compile-time-checked URL building.** The typed version needs language
+  iteration [29](../language-runtime-database/29-compile-time-metaprogramming.md).
+  Runtime-checked now, upgraded later.
+- **Streaming responses, `SendFile`, byte ranges** — iterations
+  [6](06-streaming-core.md) and [8](08-static-and-lifecycle.md).
+- **Typed binding of params into a class** — language iteration 29 again.
+
+## Info
+
+Forks the spec must settle:
+
+1. **Does `head` auto-register?** Fiber's default is yes with an opt-out. Auto is
+   friendlier; explicit is more predictable and never surprises someone
+   debugging why a route they did not register is answering.
+2. **Is an inbound request-id header trusted?** Behind the mandated proxy,
+   trusting it is what makes tracing work across hops. On an open port it lets a
+   client forge correlation ids and poison logs. `client_ip` and `net.peer`
+   already exist for exactly this trust decision — reuse that conclusion.
+3. **Where does a route's body limit live?** A field on `Route` is the obvious
+   home but widens a record that the conformance corpus pins the ownership shape
+   of. Check that fixture before choosing.
diff --git a/docs/stories/porch/06-streaming-core.md b/docs/stories/porch/06-streaming-core.md
new file mode 100644
index 0000000..1002619
--- /dev/null
+++ b/docs/stories/porch/06-streaming-core.md
@@ -0,0 +1,155 @@
+---
+track: porch
+iteration: "6"
+status: refine
+---
+
+# porch 6 — streaming core: the seam three iterations wait on
+
+> Part of [Story — `porch`, the writeonce web framework](00-story.md).
+> Source: [the Fiber parity study](../../plan/exploration/fiber/00-fiber-parity.md) §3.
+>
+> The largest and riskiest slice in this track, and the one with the most
+> downstream value: iterations [7](07-sse-and-compression.md) and
+> [8](08-static-and-lifecycle.md) are both blocked on it, and porch's README has
+> carried "lazy body streaming · streaming responses · explicit commit point"
+> as parked since framework v1.
+
+## Goals
+
+- **A response that can be written incrementally.** Today `internal/serve.wo`
+  builds the whole response as one `Text` and hands it to a single `net.write`,
+  and `serialize()` always emits `Content-Length`. Nothing can produce output it
+  cannot first hold entirely in memory — which rules out large downloads,
+  server-sent events, and any response whose length is unknown when the first
+  byte is ready.
+- **Chunked transfer-encoding on the way out**, correctly framed and correctly
+  terminated, because a truncated chunked response is indistinguishable from a
+  network failure to the client and corrupts keep-alive for the connection.
+- **Chunked request bodies on the way in — carefully.**
+  `internal/parse.wo` **deliberately refuses** them today, with a correct note
+  that silently treating a chunked request as body-less is request smuggling.
+  That refusal is good engineering. It may only be lifted by an implementation
+  that handles the smuggling cases explicitly, and the refusal must remain the
+  behaviour for anything the parser is not certain about.
+- **An explicit commit point.** Once the first byte is written, the status and
+  headers are gone and no `after` middleware can change them. That is a real
+  semantic change to the middleware contract and it has to be stated, not
+  discovered — the `after` chain currently runs on *every* response and
+  security headers depend on it.
+
+## Phases
+
+### Phase A — the writer seam
+
+- Decide the shape (fork 1) and introduce a way for a handler to emit body
+  bytes progressively instead of returning a complete `Resp`. Handlers are
+  classes, so this is a second interface beside `Handler`, not a callback.
+- Keep the existing whole-response path as the default and unchanged: the
+  overwhelming majority of responses are small and should not pay for this.
+- Verify: the two paths coexist; every existing response is byte-identical.
+
+### Phase B — chunked responses
+
+- Chunk framing, the terminating zero-length chunk, and the interaction with
+  keep-alive — a connection whose chunked response was truncated must be closed,
+  not reused.
+- `Content-Length` and chunked are mutually exclusive; `serialize()` must pick
+  one and never emit both.
+- `HEAD` on a streaming route: headers only, and decide what `Content-Length`
+  claims when the length is unknown.
+- Verify: a chunked response reassembles byte-exactly; a mid-stream trap closes
+  the connection rather than leaving a half-frame; `HEAD` is coherent.
+
+### Phase C — the commit point and the middleware contract
+
+- Define and enforce when headers are locked. An `after` middleware that tries
+  to mutate a committed response must fail loudly in development rather than
+  silently doing nothing.
+- Decide what happens to `SecurityHeaders` and `Cors` — both are `after`
+  middleware and both must still apply to streamed responses, which means they
+  have to run *before* the commit for those routes.
+- Verify: security headers and CORS are present on a streamed response; a
+  post-commit mutation attempt is reported.
+
+### Phase D — chunked request bodies
+
+- Only if phase C is clean. Parse chunked request bodies with the smuggling
+  cases enumerated and tested: both `Content-Length` and `Transfer-Encoding`
+  present, duplicated `Transfer-Encoding`, unknown transfer codings, and
+  oversized or malformed chunk sizes.
+- Every ambiguous case stays a 400-and-close, matching the existing duplicate
+  `Content-Length` discipline.
+- Verify: a well-formed chunked upload arrives intact; every enumerated
+  smuggling shape is refused.
+
+### Phase E — the gate and the ledger
+
+- A streaming route in a sample, gated on both consumers, plus a large-body leg
+  proving memory does not scale with response size.
+- Retire the README's parked streaming rows; record the commit-point semantics
+  where a handler author will find them.
+- Verify: `just web-app`, `just site`, `just linkcheck` green; ASan clean.
+
+## Acceptance Criteria
+
+- **Given** a streaming handler emitting N chunks, **when** a client reads the
+  response, **then** the reassembled body is byte-exact and the framing is
+  well-formed.
+- **Given** a response far larger than the arena, **when** it is streamed,
+  **then** it completes and peak memory does not grow with the body — the
+  criterion that distinguishes streaming from buffering.
+- **Given** a handler that traps mid-stream, **when** the failure occurs,
+  **then** the connection is closed rather than reused, no half-frame is left
+  behind, and the server survives.
+- **Given** a streamed response, **when** it leaves, **then** the security and
+  CORS headers the `after` chain contributes are still present.
+- **Given** an `after` middleware attempting to change a committed response,
+  **when** it runs, **then** the attempt is reported rather than silently
+  dropped.
+- **Given** a `HEAD` request to a streaming route, **when** it is answered,
+  **then** the headers are coherent and no body is sent.
+- **Given** a request with both `Content-Length` and `Transfer-Encoding`,
+  **when** it is parsed, **then** it is refused with 400 and the connection is
+  closed — smuggling is refused, never guessed at.
+- **Given** every pre-existing non-streaming response, **when** both serving
+  gates run, **then** output is byte-identical to before this iteration.
+
+## Out Of Scope
+
+- **SSE** — iteration [7](07-sse-and-compression.md), the first consumer.
+- **Compression** — also [7](07-sse-and-compression.md); it composes with
+  chunking and should not be entangled with building it.
+- **Byte ranges and `SendFile`** — iteration
+  [8](08-static-and-lifecycle.md).
+- **Request-body backpressure as a general mechanism.** Reading a body slowly to
+  push back on a producer wants cancellation, which porch does not have and
+  which language iteration 31's actor lifecycle owns. This iteration streams
+  *out* and parses chunked *in*; it does not add flow control.
+- **WebSockets.** Already shipped (`ws_accept`, `wsframe`) and deliberately a
+  hijack that bypasses `serialize()` — that path must keep working untouched,
+  which is worth an explicit regression check.
+- **HTTP/2.** Proxy-terminated by doctrine, and parked behind language
+  iteration 23 regardless.
+
+## Info
+
+Forks the spec must settle:
+
+1. **What is the writer?** Candidates: a second interface whose method is
+   called repeatedly until it signals done; a `Resp` variant carrying a producer
+   object instead of a `Text` body; or a handler that receives the connection and
+   writes directly (which is what `ws_accept` already does via the 101 hijack
+   sentinel). The third is the least new machinery and the most footgun. The
+   first fits the no-closures doctrine best, since a producer is just another
+   class with fields.
+2. **Does the `after` chain still run for streamed responses?** It must, or
+   security headers regress. But it cannot run *after* the body. So either
+   `after` runs at commit time for streaming routes, or streaming routes declare
+   they opt out and the framework refuses to combine them with header-mutating
+   middleware. Silent partial application is the one unacceptable answer.
+3. **Is chunked request parsing in this iteration at all?** It is separable and
+   it is the riskiest security surface in the framework. Splitting phase D into
+   its own iteration is a legitimate outcome of the brainstorm — the study is
+   explicit that the current refusal is *correct*, so there is no pressure to
+   rush it.
diff --git a/docs/stories/porch/07-sse-and-compression.md b/docs/stories/porch/07-sse-and-compression.md
new file mode 100644
index 0000000..8518694
--- /dev/null
+++ b/docs/stories/porch/07-sse-and-compression.md
@@ -0,0 +1,144 @@
+---
+track: porch
+iteration: "7"
+status: refine
+---
+
+# porch 7 — server-sent events and compression
+
+> Part of [Story — `porch`, the writeonce web framework](00-story.md).
+> Source: [the Fiber parity study](../../plan/exploration/fiber/00-fiber-parity.md) §3.
+> Both halves need [iteration 6](06-streaming-core.md); neither is possible
+> before it.
+
+## Goals
+
+- **SSE, which fits this runtime unusually well.** A room actor already has the
+  fan-out shape a live feed needs, and a parked fiber per subscriber costs
+  almost nothing on the shard model — so the awkward part of SSE in most
+  frameworks (holding thousands of idle connections) is the part writeonce
+  already solved with iteration 35's idle deadlines and fiber-per-connection.
+  Fiber ships `Retry`, `HeartbeatInterval` and `OnClose`; all three matter,
+  because a proxy will silently drop an idle event stream.
+- **gzip/deflate, decided honestly.** Iteration 36 landed the bitwise operators,
+  so a pure-`.wo` DEFLATE is now *expressible* — the question is whether it
+  should be. A C builtin is faster and smaller to write; a `.wo` implementation
+  keeps the runtime doctrine intact and proves the language can do real
+  bit-level work. Fork 2 decides, and the answer should turn on whether anything
+  else will ever want zlib.
+- **Negotiate, never assume.** Compress only when the client said it accepts the
+  coding, only above a size threshold, and never for content that is already
+  compressed — a gzipped JPEG is bigger than the JPEG.
+
+## Phases
+
+### Phase A — SSE framing and lifecycle
+
+- The event framing (`data:`, `event:`, `id:`, `retry:`), the double-newline
+  terminator, and the `text/event-stream` content type with caching disabled.
+- Heartbeats, because an idle stream through a proxy dies quietly. Interacts
+  directly with iteration 35's `idle_ms` — a heartbeat interval longer than the
+  idle deadline evicts the client the heartbeat exists to keep.
+- Disconnect detection and cleanup: a write to a gone client must free the
+  fiber, the actor subscription and the fd, on every path.
+- Verify: a client receives ordered events; a heartbeat keeps an otherwise idle
+  stream alive past `idle_ms`; a disconnect releases everything (fd count flat).
+
+### Phase B — an SSE workload worth gating
+
+- A live feed in a sample fed by an actor, so the fan-out path is real rather
+  than a loop in one handler.
+- `Last-Event-ID` resumption, or an explicit statement that it is not supported
+  — silently ignoring it means clients think they resumed when they did not.
+- Verify: N concurrent subscribers all receive an event published once; fds and
+  memory flat across a churn of connect/disconnect.
+
+### Phase C — the compression codec
+
+- Implement or bind the codec per fork 2, with the framing gzip requires
+  (header, deflate stream, CRC32 and length trailer). Note CRC32 does not exist
+  yet — the crypto row lists it as waiting for a consumer, and this is that
+  consumer.
+- Correctness against a reference decompressor is the acceptance bar, on
+  awkward input: empty, highly repetitive, incompressible, and larger than any
+  internal buffer.
+- Verify: `gzip -d` reproduces the input byte-exactly for every case.
+
+### Phase D — the compression middleware
+
+- `Accept-Encoding` negotiation reusing the q-value ranking iteration
+  [5](05-routing-response-ergonomics.md) added, a minimum-size threshold, and a
+  content-type skip list.
+- `Vary: Accept-Encoding` on anything compressed, or every cache in front will
+  serve gzipped bytes to a client that cannot read them. This needs iteration
+  2's repeated-header work to accumulate correctly with other `Vary`
+  contributions.
+- Composition with chunked streaming: compress then chunk, and the ETag question
+  — an ETag computed over compressed bytes is a different entity than the same
+  resource uncompressed.
+- Verify: a compressed response decompresses to the original; `Vary` is present;
+  no double-compression; an already-compressed content type is skipped.
+
+### Phase E — the gate and the ledger
+
+- Both serving gates plus an ASan leg for the codec, which is the part most
+  likely to leak or over-read.
+- Retire the ledger's SSE and compression rows.
+- Verify: `just web-app`, `just site`, `just linkcheck` green; ASan clean.
+
+## Acceptance Criteria
+
+- **Given** an SSE endpoint and a subscribed client, **when** events are
+  published, **then** the client receives them in order with correct framing.
+- **Given** an idle SSE stream and a heartbeat interval shorter than `idle_ms`,
+  **when** it idles past the deadline, **then** it stays open.
+- **Given** a heartbeat interval *longer* than `idle_ms`, **when** the stream
+  idles, **then** the misconfiguration is evident rather than mysterious — the
+  interaction is documented and, ideally, refused at construction.
+- **Given** a client disconnecting mid-stream, **when** the next publish
+  occurs, **then** the write failure frees the fiber, the subscription and the
+  fd; fd count returns to baseline.
+- **Given** N concurrent subscribers, **when** one event is published, **then**
+  all N receive it and memory does not grow per event.
+- **Given** any input including empty, repetitive and incompressible, **when**
+  it is compressed, **then** a reference `gzip -d` reproduces it byte-exactly.
+- **Given** a client that did not send `Accept-Encoding`, **when** it requests a
+  compressible resource, **then** the response is uncompressed.
+- **Given** a compressed response, **when** it leaves, **then** `Vary:
+  Accept-Encoding` is set and coexists with any other `Vary` contribution.
+- **Given** an already-compressed content type, **when** it is served, **then**
+  it is not compressed again.
+
+## Out Of Scope
+
+- **Brotli and zstd.** One codec, proven, before a second. gzip is what every
+  client accepts.
+- **Request-body decompression.** A compressed *upload* is a separate surface
+  with its own decompression-bomb risk, and no workload asks yet.
+- **WebSockets as an SSE alternative.** Already shipped and a different tool;
+  SSE is the one-way, proxy-friendly, reconnect-by-default option.
+- **Compressing static files at rest.** Fiber's static has `Compress`;
+  precompressed-file serving belongs with iteration
+  [8](08-static-and-lifecycle.md).
+- **A general-purpose zlib library surface.** Whatever lands is what the
+  middleware needs. If a second consumer appears, it can argue for a library.
+
+## Info
+
+Forks the spec must settle:
+
+1. **Heartbeat versus idle deadline.** These two mechanisms can silently fight,
+   and the failure looks like a flaky network. Decide whether the framework
+   refuses an incoherent pair at construction — leaning yes, because a
+   configuration that cannot work should not be constructible.
+2. **`.wo` DEFLATE or a C builtin?** The honest tiebreaker is whether anything
+   else ever wants zlib. If compression is the only consumer forever, a `.wo`
+   implementation keeps the runtime small and is a genuine demonstration that
+   iteration 36's bit operators earned their place. If a second consumer is
+   plausible (precompressed assets, a WAL codec, an archive format), the builtin
+   wins. CRC32 comes along either way.
+3. **ETag over compressed or uncompressed bytes?** `etag_for` exists and is used
+   with `with_etag` for 304s. Compressing after the ETag is computed keeps the
+   entity identity stable across encodings, which is almost certainly right —
+   but it must be decided, because getting it wrong serves the wrong body for a
+   conditional request.
diff --git a/docs/stories/porch/08-static-and-lifecycle.md b/docs/stories/porch/08-static-and-lifecycle.md
new file mode 100644
index 0000000..40e8e7b
--- /dev/null
+++ b/docs/stories/porch/08-static-and-lifecycle.md
@@ -0,0 +1,153 @@
+---
+track: porch
+iteration: "8"
+status: refine
+---
+
+# porch 8 — static files, lifecycle hooks, and the small middleware everyone ships
+
+> Part of [Story — `porch`, the writeonce web framework](00-story.md).
+> Source: [the Fiber parity study](../../plan/exploration/fiber/00-fiber-parity.md) §3, §5.
+> The static half needs [iteration 6](06-streaming-core.md); the rest does not.
+>
+> The clean-up iteration. Individually every item is small; together they are
+> most of what makes a framework feel finished rather than adequate.
+
+## Goals
+
+- **Static files that can serve something large.** `StaticFiles` exists and is
+  already careful — traversal is refused rather than normalised, `max_bytes` is a
+  hard ceiling, and the site's `/dl` downloads run through it. What it cannot do
+  is serve a file it cannot hold in memory, resume a partial download, or let a
+  browser cache correctly. Fiber's static ships `ByteRange`, `MaxAge`,
+  `CacheDuration`, `IndexNames`, `Browse` and `Download`; the range support is
+  what makes video and large downloads work at all.
+- **Cache headers that let a client skip the request.** `etag_for`/`with_etag`
+  give conditional GETs; `Cache-Control`, `Last-Modified` and `If-Modified-Since`
+  are the other half, and `fs.stat` already returns the mtime they need.
+- **Lifecycle hooks.** The ledger records "no user teardown hooks yet" as a known
+  gap. Fiber has eleven hook families; porch needs a small handful — on-listen,
+  on-shutdown, and on-route-registered — and the shutdown one is the one that
+  matters, because an app with its own resources currently has nowhere to close
+  them.
+- **The small middleware every framework ships**: healthcheck, favicon,
+  redirect, rewrite, and a `skip` combinator. Each is a handful of lines and
+  their absence is felt immediately by anyone starting a new app.
+
+## Phases
+
+### Phase A — ranges and cache headers
+
+- `Range` request parsing (single range first; multi-range is a multipart
+  response and can wait), `206 Partial Content`, `Content-Range`, and
+  `Accept-Ranges`. An unsatisfiable range is `416`, not a truncated `200`.
+- `Last-Modified` from `fs.stat`'s mtime, `If-Modified-Since` handling, and
+  `Cache-Control` with a configurable max-age.
+- Serve the body through iteration 6's writer so file size stops bounding what
+  can be served.
+- Verify: a ranged request returns exactly the requested bytes; a file much
+  larger than the arena serves; a conditional request returns 304 with no body.
+
+### Phase B — directory behaviour
+
+- Index-file resolution (`index.html` and friends) and an optional directory
+  listing, defaulting **off** — a listing that is on by default is an
+  information leak the first time someone points it at the wrong directory.
+- `Download`/`Attachment` disposition, reusing the helper iteration
+  [5](05-routing-response-ergonomics.md) added.
+- Re-verify the traversal refusal against every new path (index resolution and
+  listing both construct paths, which is exactly where traversal creeps back
+  in).
+- Verify: index resolution works; listing is off unless asked for; traversal is
+  still refused on all new paths.
+
+### Phase C — lifecycle hooks
+
+- Decide the minimal set (fork 1) and the interface — hooks are classes, like
+  everything else here.
+- Wire the shutdown hook into the existing `env.stopping()` path so an app can
+  flush and close before the process exits, and guarantee it runs exactly once
+  even on a trapping path.
+- Verify: the shutdown hook fires on SIGTERM before the listener closes, once;
+  a trapping hook does not prevent shutdown.
+
+### Phase D — the small middleware set
+
+- Healthcheck (liveness and readiness are different questions — say which),
+  favicon, redirect (permanent and temporary), rewrite (internal, no round
+  trip), and `skip` wrapping another middleware with a predicate.
+- Verify: each behaves; `skip` composes with the existing chain in registration
+  order.
+
+### Phase E — the gate and the ledger
+
+- Both serving gates. The site is the natural subject: it already serves
+  `/favicon.svg`, `/health`, and `/dl` downloads through `StaticFiles`, so these
+  features have a real consumer rather than a synthetic one.
+- Close out the porch track's ledger rows and record what the whole track
+  actually landed versus what the Fiber study predicted.
+- Verify: `just web-app`, `just site`, `just linkcheck` green.
+
+## Acceptance Criteria
+
+- **Given** a `Range: bytes=a-b` request, **when** it is served, **then** the
+  response is `206` with exactly those bytes and a correct `Content-Range`.
+- **Given** an unsatisfiable range, **when** it is served, **then** the response
+  is `416`, never a truncated `200`.
+- **Given** a file larger than the heap, **when** it is requested, **then** it
+  serves completely and peak memory does not track file size.
+- **Given** `If-Modified-Since` matching the file's mtime, **when** the request
+  arrives, **then** the response is `304` with no body.
+- **Given** a directory with an index file, **when** the directory is requested,
+  **then** the index is served; **and** with no index and listing disabled, the
+  response is `404`, not a listing.
+- **Given** a traversal attempt through the index-resolution and listing paths,
+  **when** it is served, **then** it is refused — the existing guarantee, re-proven
+  against the new code paths.
+- **Given** a registered shutdown hook, **when** the process receives SIGTERM,
+  **then** the hook runs exactly once before the listener closes, and in-flight
+  requests still complete.
+- **Given** a hook that traps, **when** shutdown runs, **then** shutdown still
+  completes.
+- **Given** `skip` wrapping a middleware with a predicate, **when** the
+  predicate matches, **then** the wrapped middleware does not run and the chain
+  continues in order.
+
+## Out Of Scope
+
+- **Multi-range requests.** A multipart byte-range response is a separate
+  format; single ranges cover downloads and media seeking, which is what the
+  workload needs.
+- **Precompressed asset serving** (`file.gz` beside `file`). Composes with
+  iteration [7](07-sse-and-compression.md); worth doing once, later, when both
+  exist.
+- **A file-watching or hot-reload story.** Assets are read from disk per
+  request; a cache with invalidation is a different feature and language
+  iteration [18](../language-runtime-database/18-memory-db-features.md) owns
+  caching.
+- **`pprof`, `expvar`, metrics endpoints.** Language iteration 30 (no story file
+  yet). A healthcheck is not observability — it is one bit.
+- **Fiber's fork, mount and prefork hooks.** The shard runtime owns placement;
+  there is no worker-pool to hook.
+- **`SendFile` with kernel `sendfile(2)`.** No such builtin exists and no
+  iteration owns adding one; the streaming writer is the portable answer here.
+
+## Info
+
+Forks the spec must settle:
+
+1. **Which hooks, exactly?** Fiber has eleven families and porch needs the
+   fewest that are load-bearing. On-shutdown is clearly one — an app with open
+   resources has nowhere to close them today. On-listen is convenient for a
+   startup banner. On-route-registered is only useful for introspection, which
+   iteration [5](05-routing-response-ergonomics.md) may already cover. Fewer is
+   better; each hook is a contract forever.
+2. **Liveness or readiness for healthcheck?** They answer different questions
+   and conflating them is why deployments flap: liveness says "do not kill me",
+   readiness says "do not send me traffic yet". A framework shipping one
+   endpoint called `/health` should say which it is, and probably ships both.
+3. **Is directory listing available at all?** Off-by-default is not the same as
+   present-but-off. Shipping it at all means it will eventually be switched on
+   somewhere it should not be. Leaning: ship it, off, with the doc saying
+   plainly what it exposes — the alternative is every app hand-rolling a worse
+   one.
diff --git a/docs/superpowers/plans/2026-08-18-deps-package-manager.md b/docs/superpowers/plans/2026-08-18-deps-package-manager.md
index 54f399e..f48b0b1 100644
--- a/docs/superpowers/plans/2026-08-18-deps-package-manager.md
+++ b/docs/superpowers/plans/2026-08-18-deps-package-manager.md
@@ -25,7 +25,7 @@ toolchain may invoke). Acceptance via a shell gate over local `file://`
 remotes — the suite stays network-free.
 
 **Spec:** [`../specs/2026-08-18-web-framework-design.md`](../specs/2026-08-18-web-framework-design.md)
-section A (normative). Story: [`15-deps-package-manager.md`](../../stories/language-runtime-database/done/15-deps-package-manager.md).
+section A (normative). Story: [`15-deps-package-manager.md`](../../stories/language-runtime-database/15-deps-package-manager.md).
 
 ## Global Constraints
 
diff --git a/docs/superpowers/plans/2026-08-18-inferred-gc-mark-sweep.md b/docs/superpowers/plans/2026-08-18-inferred-gc-mark-sweep.md
index 62c96be..bbb4424 100644
--- a/docs/superpowers/plans/2026-08-18-inferred-gc-mark-sweep.md
+++ b/docs/superpowers/plans/2026-08-18-inferred-gc-mark-sweep.md
@@ -150,8 +150,18 @@ is the largest phase and lands with Phase 2's front-end.
 
 **Files:** `docs/00-principles.md` (principle 3), the OOP spec (decision table, §3 rule 5, §4 memory model), `docs/plan/oop-vm/00-wob-format.md`, `01-error-catalog.md` (retire WO-W201, update WO-E304 wording, add the new WO-E1xx), `08-builtin-surface.md` (delete the `push` special case + `set` gap), `docs/00-status.md` (record 7b superseding iteration 2's memory model), `docs/stories/language-runtime-database/done/07b-inferred-gc-mark-sweep.md` (status → done), `docs/examples/gc-cycle/README.md` (flip "Run status" to shipped + wire a `just gc-cycle` acceptance).
 
-- [x] Apply each amendment in the spec's §8 migration table. Add a `docs/examples/gc-cycle` acceptance script + `just gc-cycle` recipe running `--dump-gc` + ring/owned demos under `WO_GC_TRACE`.
-- [x] Verify: `just oop-accept` green; `just gc-cycle` green; `git grep '@gc' -- '*.wo'` returns nothing (success criterion 1). Commit.
+- [x] Apply each amendment in the spec's §8 migration table.
+- [ ] **NOT DONE** — add a `docs/examples/gc-cycle` acceptance script + `just gc-cycle` recipe running `--dump-gc` + ring/owned demos under `WO_GC_TRACE`.
+- [x] Verify: `just oop-accept` green; `git grep '@gc' -- '*.wo'` returns nothing (success criterion 1). Commit.
+
+> **Disclosure added 2026-08-26 (doc audit).** The two boxes above were both
+> checked when this plan closed, but the `gc-cycle` acceptance never landed:
+> there is no `just gc-cycle` recipe in the `justfile` and no
+> `scripts/gc-cycle-accept.sh`. `docs/examples/gc-cycle/` has its sources, a
+> `wo.toml` and a `target/`, and it compiles — it is simply ungated, the only
+> sample in that state besides the two that are deliberately ahead of the
+> toolchain. The rest of phase 4 did land, including the `WO-W201` retirement
+> and the `@gc` sweep. Wiring the gate is a loose end, not a regression.
 
 ---
 
diff --git a/docs/superpowers/plans/2026-08-19-web-framework.md b/docs/superpowers/plans/2026-08-19-web-framework.md
index cd21f42..adb7f12 100644
--- a/docs/superpowers/plans/2026-08-19-web-framework.md
+++ b/docs/superpowers/plans/2026-08-19-web-framework.md
@@ -39,7 +39,7 @@ keep-alive with `Content-Length` bodies only.
 
 **Spec:** [`../specs/2026-08-18-web-framework-design.md`](../specs/2026-08-18-web-framework-design.md)
 section B (normative; §C's h2c stays parked). Story:
-[`16-web-framework.md`](../../stories/language-runtime-database/done/16-web-framework.md).
+[`16-web-framework.md`](../../stories/language-runtime-database/16-web-framework.md).
 
 ## Global Constraints
 
diff --git a/docs/superpowers/plans/2026-08-20-framework-v2-memory-features.md b/docs/superpowers/plans/2026-08-20-framework-v2-memory-features.md
index 2177975..28c65b0 100644
--- a/docs/superpowers/plans/2026-08-20-framework-v2-memory-features.md
+++ b/docs/superpowers/plans/2026-08-20-framework-v2-memory-features.md
@@ -1,7 +1,7 @@
 # Iteration 18 — framework v2 (transaction{} + cache/flags/jobs): implementation plan
 
 > **Status: ⏸ hold (2026-08-21, developer decision)** — story iteration 18
-> sits in `stories/language-runtime-database/hold/`; plan was ready to
+> carries `status: hold`; plan was ready to
 > execute (2026-08-20) and stays intact for resumption. Board:
 > [docs/00-status.md](../../stories/00-status.md).
 
@@ -33,7 +33,7 @@ pure `.wo` (framework), bash gates.
 
 **Spec:** [`../specs/2026-08-20-memory-db-features-design.md`](../specs/2026-08-20-memory-db-features-design.md)
 (approved 2026-08-20, normative). Story:
-[`18-memory-db-features.md`](../../stories/language-runtime-database/hold/18-memory-db-features.md).
+[`18-memory-db-features.md`](../../stories/language-runtime-database/18-memory-db-features.md).
 
 ## Global Constraints
 
diff --git a/docs/superpowers/plans/2026-08-20-library-kind-internal.md b/docs/superpowers/plans/2026-08-20-library-kind-internal.md
index d461e73..8b45cc1 100644
--- a/docs/superpowers/plans/2026-08-20-library-kind-internal.md
+++ b/docs/superpowers/plans/2026-08-20-library-kind-internal.md
@@ -32,7 +32,7 @@ build path grows a check branch, and the dep-use resolution walk in
 
 **Spec:** [`../specs/2026-08-20-library-kind-internal-design.md`](../specs/2026-08-20-library-kind-internal-design.md)
 (normative). Story:
-[`17-library-projects-internal.md`](../../stories/language-runtime-database/done/17-library-projects-internal.md).
+[`17-library-projects-internal.md`](../../stories/language-runtime-database/17-library-projects-internal.md).
 
 ## Global Constraints
 
diff --git a/docs/superpowers/plans/2026-08-20-shard-fiber-arc.md b/docs/superpowers/plans/2026-08-20-shard-fiber-arc.md
index b523345..b374add 100644
--- a/docs/superpowers/plans/2026-08-20-shard-fiber-arc.md
+++ b/docs/superpowers/plans/2026-08-20-shard-fiber-arc.md
@@ -47,8 +47,8 @@ every standing gate green before the next begins.
 
 **Architecture:** see the spec (normative):
 [`../specs/2026-08-20-shard-fiber-arc-design.md`](../specs/2026-08-20-shard-fiber-arc-design.md).
-Stories: [8](../../stories/language-runtime-database/done/08-shard-actor-runtime.md) ·
-[11](../../stories/language-runtime-database/done/11-fibers.md).
+Stories: [8](../../stories/language-runtime-database/08-shard-actor-runtime.md) ·
+[11](../../stories/language-runtime-database/11-fibers.md).
 
 **Tech Stack:** C11 libc-only (`wovm`), OCaml stdlib-only (`woc`), bash
 gates; TSan added to the corpus harness at stage 2.
@@ -204,7 +204,7 @@ transitively-traced check), corpus + TSan.
 > primary before any worker serves; (3) statements are serialized by the
 > DB actor — replies are materialized copies, no torn reads under the
 > concurrent multi-shard corpus (TSan). The five-property map lives in
-> [story 8's guarantee contract](../../stories/language-runtime-database/done/08-shard-actor-runtime.md); disk
+> [story 8's guarantee contract](../../stories/language-runtime-database/08-shard-actor-runtime.md); disk
 > space reclamation is story 32, not this stage.
 
 ### Task 7 — transparent DB RPC
diff --git a/docs/superpowers/plans/2026-08-21-db-bench.md b/docs/superpowers/plans/2026-08-21-db-bench.md
index aaf4d39..64b357b 100644
--- a/docs/superpowers/plans/2026-08-21-db-bench.md
+++ b/docs/superpowers/plans/2026-08-21-db-bench.md
@@ -30,7 +30,7 @@ stdlib-only (one stdlib-table row).
 **Spec:** [`../specs/2026-08-21-db-bench-design.md`](../specs/2026-08-21-db-bench-design.md)
 (approved 2026-08-21, normative — the four forks + decisions 5/6 live
 there). Story:
-[`22-durability-throughput-scale.md`](../../stories/language-runtime-database/done/22-durability-throughput-scale.md).
+[`22-durability-throughput-scale.md`](../../stories/language-runtime-database/22-durability-throughput-scale.md).
 
 ## Global Constraints
 
diff --git a/docs/superpowers/plans/2026-08-22-operator-parity.md b/docs/superpowers/plans/2026-08-22-operator-parity.md
index cbf2332..4f1fdf2 100644
--- a/docs/superpowers/plans/2026-08-22-operator-parity.md
+++ b/docs/superpowers/plans/2026-08-22-operator-parity.md
@@ -21,7 +21,7 @@ time), `not` at the unary level beside minus.
 (`runtime/src/`), dune + just gates.
 
 **Spec:** the story IS the spec —
-`docs/stories/language-runtime-database/refine/36-operator-parity.md`
+`docs/stories/language-runtime-database/36-operator-parity.md`
 (story-19 deviation precedent: decisions recorded normatively there,
 reasoning-under-the-code lands in CODE-LOGIC.md as part of this plan).
 
@@ -240,7 +240,7 @@ frontmatter and folder in the same change), `docs/stories/00-status.md`
   CODE-LOGIC.md on both sides for the decisions that live in code
   (arithmetic SHR, trap-not-mask, `not` as EQ-zero, parse-time
   compound-assign desugar and its double-eval contract); story file
-  moved to `done/` with `status: done` and a landing blockquote in the
+  set to `status: done` with a landing blockquote in the
   story-15/16 voice; standup entry in `00-status.md` answering the six
   questions (reference project: `.dev/reference/go`).
 - [ ] Commit.
diff --git a/docs/superpowers/plans/2026-08-23-chat-ws-lifecycle.md b/docs/superpowers/plans/2026-08-23-chat-ws-lifecycle.md
index aa6eea1..8a89498 100644
--- a/docs/superpowers/plans/2026-08-23-chat-ws-lifecycle.md
+++ b/docs/superpowers/plans/2026-08-23-chat-ws-lifecycle.md
@@ -84,7 +84,7 @@ pure-`.wo` framework code, bash + python3-stdlib gates.
   fresh Bytes; C entry `wo_builtin_crypto(vm, R, ins, msg)` consumed by
   `builtin.c`'s dispatch. Task 6 consumes `crypto.sha1` from `.wo`.
 
-- [ ] Create the board marker `docs/in-progress/2026-08-23-chat-ws-lifecycle.md`
+- [ ] Create the board marker `docs/active-slice-2026-08-23-chat-ws-lifecycle.md`
   (slice active, links to spec+plan) and flip the board's In-progress
   Runtime row to this slice. Commit with the first code commit.
 - [ ] Digest cores in `crypto.c`: SHA-1 and SHA-256 over one buffer
@@ -371,10 +371,10 @@ pure-`.wo` framework code, bash + python3-stdlib gates.
 
 ### Task 10 — docs, stories, board, graph
 
-- [ ] Stories: 24 → `done/` with the landing banner (what landed, gate
+- [ ] Stories: 24 → `status: done` with the landing banner (what landed, gate
   numbers, the monitor three-argument deviation, the reply-agreement
-  rule); 31 → `done/` with a banner saying it landed INSIDE 24 (the
-  four forks and their decisions, link to the spec); 34 → `done/`
+  rule); 31 → `status: done` with a banner saying it landed INSIDE 24 (the
+  four forks and their decisions, link to the spec); 34 → `status: done`
   (C-builtin resolution, ids, vectors). Frontmatter status + folder
   move together (house rule).
 - [ ] Board: In-progress row cleared (marker doc deleted), Landed
diff --git a/docs/superpowers/specs/2026-08-03-blue-green-vm-design.md b/docs/superpowers/specs/2026-08-03-blue-green-vm-design.md
index 26b724d..893c9ae 100644
--- a/docs/superpowers/specs/2026-08-03-blue-green-vm-design.md
+++ b/docs/superpowers/specs/2026-08-03-blue-green-vm-design.md
@@ -1,7 +1,7 @@
 # Blue/Green VM deployment — design spec
 
 **Date:** 2026-08-03
-**Status:** approved (2026-08-03); ⏸ on hold (2026-08-21, developer decision — story iteration 26 moved to `stories/language-runtime-database/hold/`); implementation plan deferred until plans 5 + 6 ship
+**Status:** approved (2026-08-03); ⏸ on hold (2026-08-21, developer decision — story iteration 26 carries `status: hold`); implementation plan deferred until plans 5 + 6 ship
 **Scope:** the writeonce runtime's in-process deployment subsystem
 **Supersedes:** §5–§6 of [`docs/plan/exploration/blue-green-vm/00-vision.md`](../../plan/exploration/blue-green-vm/00-vision.md)
 
diff --git a/docs/superpowers/specs/2026-08-15-table-relations-query-design.md b/docs/superpowers/specs/2026-08-15-table-relations-query-design.md
index 60b4243..5bf8ff4 100644
--- a/docs/superpowers/specs/2026-08-15-table-relations-query-design.md
+++ b/docs/superpowers/specs/2026-08-15-table-relations-query-design.md
@@ -1,7 +1,7 @@
 # `@table`, Relations, and Language-Integrated Query — Design
 
 > **Status: proposed** (story iteration 9b). Settles the three forks recorded in
-> [`09b-table-relations-query.md`](../../stories/language-runtime-database/done/09b-table-relations-query.md).
+> [`09b-table-relations-query.md`](../../stories/language-runtime-database/09b-table-relations-query.md).
 > Plan: [`docs/plan/compiler/2026-08-15-employee-relations-query.md`](../../plan/compiler/2026-08-15-employee-relations-query.md).
 > Depends on iteration 9's engine plan
 > ([`2026-08-01-db-engine-binding.md`](../plans/2026-08-01-db-engine-binding.md))
diff --git a/docs/superpowers/specs/2026-08-20-library-kind-internal-design.md b/docs/superpowers/specs/2026-08-20-library-kind-internal-design.md
index d458203..1c28bf0 100644
--- a/docs/superpowers/specs/2026-08-20-library-kind-internal-design.md
+++ b/docs/superpowers/specs/2026-08-20-library-kind-internal-design.md
@@ -4,7 +4,7 @@
 > analysis held (driver-only, VM/`.wob`/GC untouched). Approved, then parked
 > the same day by directive, then unparked and executed. Decisions were
 > settled in
-> [the iteration](../../stories/language-runtime-database/done/17-library-projects-internal.md)
+> [the iteration](../../stories/language-runtime-database/17-library-projects-internal.md)
 > (four forks + impact analysis); this spec makes them buildable. The plan
 > follows after review. Board: [docs/00-status.md](../../stories/00-status.md).
 >
diff --git a/docs/superpowers/specs/2026-08-20-memory-db-features-design.md b/docs/superpowers/specs/2026-08-20-memory-db-features-design.md
index a178bd8..9135a61 100644
--- a/docs/superpowers/specs/2026-08-20-memory-db-features-design.md
+++ b/docs/superpowers/specs/2026-08-20-memory-db-features-design.md
@@ -6,8 +6,8 @@
 >
 > **Status: APPROVED 2026-08-20** (developer review); ⏸ on hold
 > (2026-08-21, developer decision — story iteration 18 sits in
-> `stories/language-runtime-database/hold/`). Decisions were settled in
-> [the iteration](../../stories/language-runtime-database/hold/18-memory-db-features.md);
+> its story carries `status: hold`). Decisions were settled in
+> [the iteration](../../stories/language-runtime-database/18-memory-db-features.md);
 > this spec makes them buildable. The plan is authored
 > ([framework v2 plan](../plans/2026-08-20-framework-v2-memory-features.md))
 > and held with it.
diff --git a/docs/superpowers/specs/2026-08-20-shard-fiber-arc-design.md b/docs/superpowers/specs/2026-08-20-shard-fiber-arc-design.md
index 36c7d65..8335b90 100644
--- a/docs/superpowers/specs/2026-08-20-shard-fiber-arc-design.md
+++ b/docs/superpowers/specs/2026-08-20-shard-fiber-arc-design.md
@@ -1,7 +1,7 @@
 # The 8+11 concurrency arc — shards, fibers, actors: design
 
 > **Status: spec, awaiting review (2026-08-20).** The arc's decisions were
-> settled in [iteration 8](../../stories/language-runtime-database/done/08-shard-actor-runtime.md)
+> settled in [iteration 8](../../stories/language-runtime-database/08-shard-actor-runtime.md)
 > (refined) and the brainstorm of 2026-08-20 (this document's Decisions).
 > Covers iterations 8 AND 11 as one arc; iteration 24 (chat) is its
 > acceptance workload and gets its own spec after this one. The plan
diff --git a/docs/superpowers/specs/2026-08-21-db-bench-design.md b/docs/superpowers/specs/2026-08-21-db-bench-design.md
index 3c5c1a0..1c6b917 100644
--- a/docs/superpowers/specs/2026-08-21-db-bench-design.md
+++ b/docs/superpowers/specs/2026-08-21-db-bench-design.md
@@ -8,9 +8,9 @@ Board: [docs/00-status.md](../../stories/00-status.md)
 **Scope:** the measurement backbone — a benchmark workload in `.wo`, a
 campaign driver script, a tracked baseline contract, and the durability
 proofs (restart persistence + crash battery), single- AND multi-shard.
-**Relates to:** [story 22](../../stories/language-runtime-database/done/22-durability-throughput-scale.md)
+**Relates to:** [story 22](../../stories/language-runtime-database/22-durability-throughput-scale.md)
 (the four forks settled below), the landed arc
-([story 8's guarantee contract](../../stories/language-runtime-database/done/08-shard-actor-runtime.md)
+([story 8's guarantee contract](../../stories/language-runtime-database/08-shard-actor-runtime.md)
 — the stage-3 delta this iteration records), iteration 23 (the durable
 write number it exists to beat), iteration 32 (the aged-store replay
 number its policy wants), stage-2 deviation 4 (the mutex-inbox number).
diff --git a/docs/superpowers/specs/2026-08-23-chat-websocket-actor-lifecycle-design.md b/docs/superpowers/specs/2026-08-23-chat-websocket-actor-lifecycle-design.md
index 86e0030..f541774 100644
--- a/docs/superpowers/specs/2026-08-23-chat-websocket-actor-lifecycle-design.md
+++ b/docs/superpowers/specs/2026-08-23-chat-websocket-actor-lifecycle-design.md
@@ -8,9 +8,9 @@
 > death notices, and timers as it needs them; the recorded chain
 > "31 → 24" collapses into "24". Story 34's fork is resolved here too
 > (C builtins, full set). Stories:
-> [24](../../stories/language-runtime-database/refine/24-chat-websocket-workload.md) ·
-> [31](../../stories/language-runtime-database/refine/31-actor-lifecycle.md) ·
-> [34](../../stories/language-runtime-database/refine/34-crypto-builtins.md).
+> [24](../../stories/language-runtime-database/24-chat-websocket-workload.md) ·
+> [31](../../stories/language-runtime-database/31-actor-lifecycle.md) ·
+> [34](../../stories/language-runtime-database/34-crypto-builtins.md).
 > Substrate: the landed 8+11 arc
 > ([spec](2026-08-20-shard-fiber-arc-design.md)); every decision below
 > reuses its machinery rather than growing parallel machinery.
diff --git a/justfile b/justfile
index 67a80f4..abbf48a 100644
--- a/justfile
+++ b/justfile
@@ -41,7 +41,7 @@ deps-accept:
     ./scripts/deps-accept.sh
 
 # web-app: iteration 16's gate — the whole chain at run time, network-free:
-# a temp git remote from docs/examples/writeonce-framework, file:// URL
+# a temp git remote from docs/examples/porch, file:// URL
 # substituted into a temp copy of docs/examples/web-app, then fetch -> lock
 # -> build -> serve -> the storefront matrix (auth/CRUD/@unique/FK/404/400/
 # pipelining) -> SIGTERM -> WAL restart persistence.
@@ -49,7 +49,7 @@ web-app:
     ./scripts/web-app-accept.sh
 
 # site: the writeonce.de tutorial (docs/examples/site) — TWO deps
-# (framework + wo-html), server-rendered pages, page matrix -> 401/edit
+# (porch + view), server-rendered pages, page matrix -> 401/edit
 # -> SIGTERM -> WAL restart persistence. `just site` runs it.
 site:
     ./scripts/site-accept.sh
diff --git a/runtime/README.md b/runtime/README.md
index 503dcf1..f45046b 100644
--- a/runtime/README.md
+++ b/runtime/README.md
@@ -1,136 +1,218 @@
-# `wo-rt-c` — the writeonce runtime environment, in C
+# `runtime/` — `wovm`, the writeonce bytecode VM
 
-A single-file C implementation of the **runtime layer** the writeonce language runs on — now at **phase E: a durable RAM database**. Writes follow the dual-write order — RAM apply, framed WAL record (`len|crc32|payload|COMMIT`) to a per-shard `fallocate`'d log, one group-commit `fdatasync` per loop tick, **HTTP ack only after the fsync completion**. Boot performs the **first load, hard drive → RAM**: each shard replays its snapshot + WAL tail into its arena slice in parallel before any accept arms; clean shutdown snapshots each slice and truncates the WAL; a `meta` file pins the shard count so a mismatched `WO_THREADS` refuses to boot. `./wo-rt wal-check <file>` validates a log offline. `WO_THREADS` pinned threads (default = online cores), each owning its own raw io_uring ring (`io_uring_setup` + mmap'd SQ/CQ rings + `io_uring_enter` — **no liburing**), its own `SO_REUSEPORT` listener (multishot accept), its own keep-alive connections, and its own slice of the one mlock'd mmap arena — shared-nothing, no locks. Steady state is one `io_uring_enter` syscall per loop tick. Thread 0 owns the `signalfd`; shutdown broadcasts through per-thread `eventfd`s, both watched via `POLL_ADD` SQEs. **Zero dependencies beyond libc + kernel uapi headers.** The kernel is the runtime.
+The C11 register VM that loads and runs `.wob` images. Sibling of the OCaml
+`woc` compiler ([`compiler/README.md`](../compiler/README.md)): `woc` emits the
+image, `wovm` executes it, and `woc build` appends an image to a copy of this
+binary to produce one self-contained executable. libc only, direct syscalls, no
+libraries.
 
-This is the runtime-layer sibling of [`prototypes/wo-db/`](../prototypes/wo-db/) (the C++ query-layer prototype): a reference card showing, with no abstraction in the way, exactly which kernel primitives the production Rust runtime (`crates/rt/`) drives through `libc`. Same role, different layer.
+The embedded database engine ([`database/`](../database/src/CODE-LOGIC.md)) is
+statically linked into every `wovm` and every test binary — one binary, no
+separate database process.
 
-```
-prototypes/wo-db/     C++   what the LANGUAGE executes   (parser, engine, transactions)
-runtime/              C     what the RUNTIME stands on   (epoll, signalfd, sockets)
-crates/rt/            Rust  the product — both layers, libc only
-```
+Reasoning under the code: [`src/CODE-LOGIC.md`](src/CODE-LOGIC.md). Normative
+contracts: [`docs/plan/oop-vm/00-wob-format.md`](../docs/plan/oop-vm/00-wob-format.md)
+(format, opcodes, builtin ids — `src/wob.h` is its machine-readable twin) and
+[`08-builtin-surface.md`](../docs/plan/oop-vm/08-builtin-surface.md) (what each
+builtin means in source terms).
 
-> **Moved from `prototypes/wo-rt-c/` to root-level `runtime/`** (monorepo layout, per the OOP compiler + VM design spec). `wo-rt.c` is untouched — it stays the event-loop reference described below. The **`wovm` bytecode VM now lives under `runtime/src/`** — see [The wovm bytecode VM](#the-wovm-bytecode-vm-runtimesrc) for what shipped and [Debugging](#debugging) for how to step through it.
+> `wo-rt.c` in this directory is **not** part of that toolchain. It is the
+> retired io_uring event-loop reference prototype the runtime's design was read
+> off, kept for reading. See the "Historical" section at the bottom of this page
+> — nothing in the shipped build compiles it.
 
-## Build, run, poke
+## Build, test
 
 ```bash
-make                 # cc -O2 -Wall -Wextra -std=c11 -pthread — no libraries
-./wo-rt              # 127.0.0.1:8085   (WO_PORT=9000 WO_THREADS=4 ./wo-rt to override)
+just wovm-build     # -> runtime/wovm (the release binary)
+just wovm-test      # unit suites, both dispatch flavors, + CLI smoke, ASan+UBSan
 
-curl localhost:8085/   # {"runtime":"wo-rt-c","loop":"epoll-et","threads":4,
-                       #  "shard":2,"shard_requests":[68,36,44,53]}
-curl -X POST localhost:8085/api/notes -d '{"title":"hello"}'
-                       # {"id":2,"title":"hello","shard":1}   ← ids interleave per shard
-curl localhost:8085/api/notes        # the connection's shard only — shared-nothing
-# ctrl-C → signalfd on shard 0 → eventfd broadcast → all shards join
+# in runtime/ directly:
+make wovm           # the release binary
+make test           # unit suites, computed-goto dispatch
+make test-iso       # the same suites under -DWO_ISO_C (plain switch)
+make wovm-asan      # a separate sanitized binary, for corpus fixtures needing a leak/UB proof
+make wovm-tsan      # thread-sanitized, for the fiber/actor demos
 ```
 
-Each connection hashes to one shard for life (`SO_REUSEPORT` 4-tuple): a list may land on a different shard than the create that preceded it. That is the architecture, not a bug — cross-shard reads are a later phase / design decision (see the [architecture doc's improvements](../docs/plan/exploration/c-runtime/01-architecture.md)).
+Across both halves of the toolchain: `just oop-e2e` (the `woc` + `wovm`
+conformance corpus) and `just oop-accept` (the full milestone gate — compile-time
+budget, corpus under ASan, single-binary smoke, both unit suites, one command).
 
-Or from the repo root: `just rt-c-demo`.
+## Shipped features
 
-## Module map
+- **Register interpreter** — fixed 32-bit instructions, Lua-style window-overlap
+  calls (callee r0 = caller slot A), dual dispatch: computed goto under GNU C,
+  `switch` under `-DWO_ISO_C`. Both flavors are gated so neither rots.
+- **Owned objects with a runtime borrow word** — shared-reader count /
+  exclusive sentinel in every 16-byte header; violations trap `T_BORROW`. The
+  compiler elides provable sites; the VM enforces the residual ones.
+- **Inferred GC, incremental tri-color mark-sweep** — GC-ness is a compiler
+  inference, never an annotation (`@gc` is rejected outright, WO-E104). Per-shard
+  traced list, snapshot-at-beginning roots, Yuasa deletion barrier, budgeted mark
+  and sweep slices — no stop-the-world by construction. Reference counting and
+  the Bacon–Rajan trial-deletion collector that shipped in iteration 2 were both
+  **removed** by iteration 7b. `wovm` pumps the collector to quiescence after the
+  entry returns (`WO_GC_BUDGET` steps per call, default 64; `WO_GC_TRACE=1`
+  prints one stderr line per step).
+- **Deterministic drops** — kind-directed drop plans (scalar/owned/gcref/text/
+  bytes/float/multi/map), recursive over class fields and container elements.
+- **Trap unwinding that never leaks** — per-method drop tables (pc → owned/gc
+  register masks); a trap walks every frame and frees what was live; structured
+  error `{code, line, method, msg}` via line tables, catchable with `try`/`catch`.
+- **Validating loader** — bounds-checked parse, aligned copies, const-string
+  interning, full static validation (opcodes, registers, indexes, jump targets,
+  terminators, builtin arity, call windows, sorted vtables). What the loader
+  accepts, the interpreter trusts — no UB on any input.
+- **Structural interfaces** — `ICALL` binary-searches sorted (class, slot,
+  method) vtable triples by receiver class.
+- **Fibers and shard actors** — reduction-budget preemption, pinned per-core
+  shards, ownership-move message sends, bounded mailboxes (`WO_MAILBOX`, default
+  cap 1024) with a catchable `WO_T_ACTOR` trap on overflow, `call` parking the
+  caller for a typed scalar reply, and actor death that traps callers rather than
+  hanging them. Blocking stdlib calls park the fiber; the shard runs someone else.
+- **The systems stdlib and the engine** — six module namespaces (`fs`, `time`,
+  `env`, `net`, `proc`, `json`) plus the free builtins: text and containers, the
+  `Float`/`Bytes` bridges, base64, and the digests `sha1`/`sha256`/`hmac_sha256`.
+  `WO_B_MAX` is 95. Database builtins reach the linked engine directly; the
+  legacy `DB_STUB` opcode survives only for images emitted against no engine.
+- **CLI contract** — `wovm app.wob`: exit 0 = ran; exit 1 = trap, one stderr
+  line `trap CODE in METHOD at line N: MESSAGE`; exit 2 = usage/load failure.
+  `wovm --version` prints `wovm <VERSION>`. `WO_HEAP_MB` overrides the 64 MiB
+  arena; `WO_DATA` opts into durability; `WO_SHARDS` sets the shard count. Run
+  with no `.wob` argument, `wovm` checks its own trailer for an appended image
+  (`woc build`'s single-binary output) — a recognized-but-corrupt trailer fails
+  clearly on exit 2, never a crash.
 
-Every block in `wo-rt.c` corresponds one-to-one to a module of the Rust runtime, which in turn mirrors Go's netpoller — the same lineage the docs trace:
+Interpreter ceilings, all in `src/wob.h`: 64 registers per frame
+(`WO_MAX_REGS`), a 4096-slot value stack (`WO_STACK_SLOTS`), 256 frames
+(`WO_MAX_FRAMES`), 64 shards (`WO_MAX_SHARDS`). The image format is at
+`WOB_VERSION 6` (iteration 36's bitwise opcodes 42–46 moved it last).
 
-| `wo-rt.c` block | Rust (`crates/rt/src/`) | Go (`.dev/reference/go/src/runtime/`) | Kernel reference card |
-| --- | --- | --- | --- |
-| `main` event loop (`epoll_create1` / `epoll_wait`, `EPOLLET`) | `runtime/netpoll_epoll.rs` | `netpoll_epoll.go` | [`linux/01-epoll.md`](../docs/plan/exploration/linux/01-epoll.md) |
-| `sig_setup` (`sigprocmask` + `signalfd`) | `runtime/signalfd.rs` | signal mask handling | [`linux/04-signalfd.md`](../docs/plan/exploration/linux/04-signalfd.md) |
-| `listener_bind` (`SOCK_NONBLOCK`, `accept4`-to-EAGAIN) | `http/listener.rs` | `net.Listen` + accept loop | `socket(7)` |
-| `conn_drive` (read-to-EAGAIN, one buffer per fd) | `http/connection.rs` | `conn.Read` loop | the edge-triggered contract |
-| `notes[]` store | `engine.rs` (BTreeMaps) | — | [`03-inmemory-engine.md`](../docs/runtime/database/03-inmemory-engine.md) |
-
-## What it demonstrates
-
-- **One thread owns each shard outright.** Accept, parse, store, respond — no locks, no worker pool, no connection migration. Scaling past one core is more shards ([`09-concurrency-scaleout.md`](../docs/plan/09-concurrency-scaleout.md)), never shared mutable state. The single cross-thread touch is the relaxed-atomic stats counters on `/` — monotonic, never on the data path.
-- **Edge-triggered discipline.** Every registration sets `EPOLLET`; every readiness event is drained to `EAGAIN` (the accept loop and the read loop both). Get this wrong and connections silently hang — the reason the Rust module documents the same contract at the top of `netpoll_epoll.rs`.
-- **Signals as fd events.** `SIGINT`/`SIGTERM` are blocked, then read from a `signalfd` on the same epoll — no async-signal-unsafe handler, no self-pipe trick.
-- **RAM is the read path.** `GET /api/notes` touches a C array. The production engine is the same idea with MVCC and a WAL behind it.
-
-## Architecture and roadmap
-
-Documentation lives under `docs/` (repo convention) — this README stays here as the directory's orientation page only:
-
-- [`docs/plan/exploration/c-runtime/01-architecture.md`](../docs/plan/exploration/c-runtime/01-architecture.md) — the runtime defined by tracing **one memory address** through user space, kernel space, and hardware under a million concurrent connections, plus seven improvement proposals (seqlock reads, registered buffers, zero-copy send, SQPOLL, …).
-- [`docs/plan/exploration/c-runtime/00-plan.md`](../docs/plan/exploration/c-runtime/00-plan.md) — the phase sequence: **A → B → C → D → E → F, all ✅ shipped.**
-- [`docs/plan/exploration/blue-green-vm/00-vision.md`](../docs/plan/exploration/blue-green-vm/00-vision.md) — where the runtime goes next: port-free transports, fibers, source embedded in the binary, agent-managed source over MCP, and the Blue/Green two-VM hot-swap deployment model.
-
-## Measured (phase F, 20-core Linux 6.14, tmpfs data dir, `just rt-c-bench`)
-
-Same C bench client (`bench/bench.c`, keep-alive, only 2xx counted) against both servers:
-
-| Benchmark | **wo-rt-c** (8 shards, durable WAL, io_uring + group commit) | **Go `net/http`** (go1.25.1, 20 cores, no durability) | **Rust `wo`** (release, 8 shards, durable WAL, io_uring group commit)¹ |
-| --- | --- | --- | --- |
-| `GET /healthz` | **859,033 req/s** · p50 71 µs · p99 159 µs | 336,444 req/s · p50 70 µs · p99 1,277 µs | 746,340 req/s · p50 73 µs · p99 186 µs |
-| `GET /` (JSON) | **671,312 req/s** · p99 180 µs | — | 692,671 req/s · p99 167 µs |
-| `POST` write (tmpfs) | **618,343 commits/s** — fsync-acked · p99 194 µs | 320,516 req/s — RAM only, no WAL · p99 1,581 µs | 330,285 commits/s — fsync-acked · p99 360 µs |
-| `POST` write (real ext4/NVMe) | — | — | **27,014 commits/s group commit vs 5,765 per-commit (4.7×)** · p50 2.2 ms |
-| 10,000 idle conns | 0 errors | 0 errors | 0 errors |
-
-¹ All numbers measured on a clean box with the same client (earlier parasite-contaminated runs superseded). The Rust column's history is the architecture roadmap, measured: 09a global mutex (74.9k writes/s) → 09b sharded engine (+51%) → 09c per-shard WAL (~1% durability cost) → **keep-alive: reads ×3.4 to 770k/s, durable writes ×1.9 to 331k/s, p99 under 350 µs everywhere**. Rust now beats Go on both columns *while fsyncing every write*, and sits within ~10% of the C prototype on reads — converging exactly as the same-architecture argument predicted. The one remaining C advantage is **group commit on io_uring** (one batched fsync + one syscall per tick vs per-commit fsync over epoll), which is the next port. Bonus finding: with `/tmp` accidentally full, the C runtime **refused to ack non-durable writes under ENOSPC** — the durability guarantee holding in an unplanned failure mode.
-
-wo-rt-c on 8 cores outpaces Go on 20 with ~8× tighter p99 (Go's GC shows there) — while fsyncing every write Go doesn't. Honest caveats: `net/http` does full general-purpose HTTP; our parser is minimal; .NET was not installed on the box. **ACID under load:** three crash rounds (`kill -9` mid-bench at ~2M commits) all showed WAL records ≥ acked; isolation probe: 300 concurrent commits → 300 distinct ids; torn-tail records drop whole by CRC.
-
-The crash-under-load test **found and fixed two real bugs** the lighter phase-D test missed: an ack-before-fsync race (`conn_continue` armed the send in the same tick the commit was staged) and an fd-reuse ABA hazard in ack parking (fixed with per-connection generation stamps). That is what phase F is for.
-- [`docs/plan/exploration/c-runtime/02-single-binary.md`](../docs/plan/exploration/c-runtime/02-single-binary.md) — the end goal: how the `wo build` **single binary** runs on this runtime environment — the runtime kernel is statically linked into every writeonce app (Go model, nothing to install), with the catalog/routes/bytecode payload consumed at boot.
-
-## Deliberate simplifications
-
-Single-shot RECV re-armed per request (multishot recv + buffer rings are a phase-F improvement), one outstanding SQE per connection, fixed-size buffers, naive `"title"` extraction instead of a JSON parser, no `timerfd`. Requires kernel ≥ 5.19 (multishot accept). This file is for reading; `crates/rt` is for running writeonce.
-
-## The wovm bytecode VM (runtime/src/)
-
-Milestone 1 of the OOP track (spec: [`docs/superpowers/specs/2026-08-01-oop-compiler-vm-design.md`](../docs/superpowers/specs/2026-08-01-oop-compiler-vm-design.md), plan 1: [`docs/superpowers/plans/2026-08-01-wob-format-and-vm-core.md`](../docs/superpowers/plans/2026-08-01-wob-format-and-vm-core.md)) — a register VM that executes `.wob` bytecode (format: [`docs/plan/oop-vm/00-wob-format.md`](../docs/plan/oop-vm/00-wob-format.md)) with the full milestone-1 memory model. C11, libc only, same doctrine as `wo-rt.c`. `wovm` doesn't produce `.wob` itself — that's the OCaml `woc` front end's job ([`compiler/README.md`](../compiler/README.md), plan 3); this directory is the VM, not the compiler.
-
-**Shipped features:**
-
-- **Register interpreter** — fixed 32-bit instructions, Lua-style window-overlap calls (callee r0 = caller slot A), dual dispatch: computed goto under GNU C, `switch` under `-DWO_ISO_C` (both flavors gated in CI so neither rots).
-- **Owned objects with a runtime borrow word** — shared-reader count / exclusive sentinel in every 16-byte header; violations trap `T_BORROW`. The compiler elides provable sites; the VM enforces the residual ones (hybrid model, spec §4).
-- **`@gc` reference counting + budgeted cycle collection** — rc at zero frees immediately; possible cycles buffer as candidates (Bacon–Rajan trial deletion), collected in budgeted epochs per shard — no stop-the-world by construction. The `wovm` CLI pumps the collector to quiescence after the entry method returns (`WO_GC_BUDGET` steps per call, default 64; `WO_GC_TRACE=1` prints one stderr line per step) — scheduler-paced stepping between requests is sub-project 2, not this milestone.
-- **Deterministic drops** — kind-directed drop plans (scalar/owned/gcref/text/multi/map), recursive over class fields and container elements.
-- **Trap unwinding that never leaks** — per-method drop tables (pc → owned/gc register masks); a trap walks every frame and frees what was live; structured error `{code, method, line, message}` via line tables.
-- **Validating loader** — bounds-checked parse, aligned copies, const-string interning, full static validation (opcodes, registers, indexes, jump targets, terminators, builtin arity, call windows, sorted vtables); what the loader accepts, the interpreter trusts — no UB on any input.
-- **Structural interfaces** — `ICALL` binary-searches sorted (class, slot, method) vtable triples by receiver class.
-- **Native containers + builtins** — `multi`/`map` with element-kind tags; `now/print/print_int/words/multi_*/map_*`; `DB_STUB` traps "engine not linked" until the DB engine binds (plan 5).
-- **CLI contract** — `wovm app.wob`: exit 0 = ran; exit 1 = trap, one stderr line `trap CODE in METHOD at line N: MESSAGE`; exit 2 = usage/load failure. `WO_HEAP_MB` overrides the 64 MiB arena. Run with no `.wob` argument, `wovm` also checks its own trailer for an appended image (`woc build`'s single-binary output, [`docs/plan/oop-vm/00-wob-format.md`](../docs/plan/oop-vm/00-wob-format.md)'s "single-binary trailer" section) — a recognized-but-corrupt trailer fails clearly on exit 2, never a crash.
-
-**File map:**
+## File map
 
 | File | What it is |
 | --- | --- |
-| `src/wob.h` | the `.wob` v1 contract: opcodes, field kinds, trap codes, builtin ids, limits, the 16-byte object header (machine-readable twin of the format doc) |
-| `src/obj.h/.c` | arena allocator (16-byte size-class free lists ≤ 1024 B, malloc above), `wo_rt` context, object creation, strings |
+| `src/wob.h` | the `.wob` contract: opcodes, field kinds, trap codes, builtin ids, limits, the 16-byte object header |
+| `src/obj.h/.c` | arena allocator (16-byte size-class free lists ≤ 1024 B, malloc above), `wo_rt` context, object creation, `wo_str` |
 | `src/borrow.h/.c` | the borrow word: acquire shared/exclusive, unconditional releases |
-| `src/cont.h/.c` | native containers: growable `multi`, linear-scan `map` (content-compared text keys) |
-| `src/gc.h/.c` | kind-directed drop dispatcher, rc inc/dec, cycle-candidate buffer, budgeted Bacon–Rajan collector |
-| `src/loader.h/.c` | `.wob` parse + full static validation + mmap file path |
-| `src/vm.h/.c` | the interpreter: dispatch, frames, traps, drop-map unwinding, `ICALL` |
-| `src/builtin.h/.c` | builtin dispatcher |
-| `src/main.c` | the `wovm` CLI: arg parsing, self-embedded-trailer detection, the post-exit gc pump |
+| `src/cont.h/.c` | native containers: growable `multi`, **linear-scan** `map` (content-compared text keys) — deliberate KISS, and O(n) per lookup |
+| `src/gc.h/.c` | the kind-directed drop dispatcher plus the incremental tri-color mark-sweep for traced objects |
+| `src/loader.h/.c` | `.wob` parse + full static validation + the mmap file path |
+| `src/vm.h/.c` | the interpreter: dispatch, frames, traps, drop-map unwinding, `ICALL`, shard/engine startup |
+| `src/builtin.h/.c` | the builtin dispatcher — the single entry point the interpreter calls, forwarding to `sysio.c` and `json.c` |
+| `src/sysio.c` | the OS half: `fs`, `time`, `env`, `net`, `proc` |
+| `src/json.c` | `json.encode` / `json.decode`, driven by class metadata |
+| `src/crypto.c/.h` | SHA-1, SHA-256, HMAC-SHA256 (iteration 34), vector-verified |
+| `src/park.c/.h` | the park plane: raw io_uring ABI (no liburing) and the epoll fallback, fiber parking, per-call deadlines |
+| `src/main.c` | the `wovm` CLI: find an image (argument or embedded trailer), build argv, call the entry, map its result to an exit code, pump the collector |
 | `test/t.h` | 20-line assert harness (no framework) |
-| `test/wob_build.h/.c` | in-memory `.wob` assembler — the second, independent encoding of the format; builder/loader disagreements fail tests |
-| `test/test_*.c` | 13 suites, one binary each, ASan+UBSan |
+| `test/wob_build.h/.c` | in-memory `.wob` assembler — a second, independent encoding of the format, so builder/loader disagreements fail tests |
+| `test/test_*.c` | 18 suites, one binary each, ASan+UBSan: arena, borrow, builtin, cont, crypto, cycle, fiber, icall, loader, mailbox, obj, objops, rc, table, unwind, vm, wal, wobbuild |
 | `test/mkwob.c` | fixture generator for the CLI smoke |
 | `test/cli_smoke.sh` | end-to-end exit-code/stderr-shape check |
 
-**Gates:** `just wovm-build` · `just wovm-test` (unit suites + ISO flavor + CLI smoke, all ASan-clean) · in `runtime/`: `make test`, `make test-iso`, `make wovm`, `make wovm-asan` (sanitized binary for corpus fixtures that need a leak/UB proof, e.g. `tests/corpus/gc/`). Across both halves: `just oop-e2e` (the `woc` + `wovm` conformance corpus, [`compiler/README.md`](../compiler/README.md)) and `just oop-accept` (milestone 1's full acceptance gate — spec success criteria + both unit suites, one command).
+Note where io_uring is and is not: `src/park.c` drives it for the fiber and
+network plane, while the WAL commit path in `database/src/wal.c` is still a plain
+per-commit `fdatasync`. Moving the WAL onto the rings is iteration 23.
 
 ## Debugging
 
-VS Code: `.vscode/launch.json` ships four configs (needs the *C/C++* extension, `ms-vscode.cpptools`):
+VS Code: `.vscode/launch.json` ships four configs (needs the *C/C++* extension,
+`ms-vscode.cpptools`):
 
-1. **wovm: debug hello.wob** — rebuilds `wovm` at `-O0 -g`, regenerates fixtures, breaks anywhere in the VM.
+1. **wovm: debug hello.wob** — rebuilds `wovm` at `-O0 -g`, regenerates
+   fixtures, breaks anywhere in the VM.
 2. **wovm: debug a .wob file** — same, prompts for the image path.
-3. **wovm: debug unit test** — pick one of the 13 ASan test binaries (already `-g`), step through it.
-4. **wo-rt: debug server** — the event-loop reference at `-O0 -g`, `WO_THREADS=1` so one shard owns everything.
+3. **wovm: debug unit test (ISO dispatch)** — pick one of the ASan test
+   binaries (already `-g`), step through it.
+4. **wo-rt: debug server (1 shard)** — the retired event-loop reference at
+   `-O0 -g`, `WO_THREADS=1` so one shard owns everything.
 
 How to work on the VM under a debugger:
 
-- **Step the ISO flavor, not the computed-goto one.** The goto interpreter jumps label-to-label and single-stepping is disorienting. Test binaries have an ISO twin (`build/iso_test_*`, plain `switch`) where `next`/`step` behave normally. For `wovm` itself, build `make -B wovm CFLAGS='-O0 -g -std=c11 -DWO_ISO_C'`.
-- **`break vm_trap`** — one breakpoint catches every trap at the moment of failure, with the trapping frame intact (`vm->frames[vm->depth-1]`, `pc` already rewound to the faulting instruction). `vm_unwind` is the next frame down if you're chasing a leak-on-trap.
-- **Other load-bearing breakpoints:** `wo_load_buf` (validation rejects), `recv_check` (residual field checks), `wo_builtin` (all builtins), `wo_gc_step` (cycle collection epochs).
-- **ASan under gdb:** `ASAN_OPTIONS=abort_on_error=1` makes the first report SIGABRT so the debugger stops on it with the full stack; without gdb the report alone usually names the exact free you missed.
-- **CLI knobs:** `WO_HEAP_MB=1 ./wovm app.wob` forces early `T_OOM` paths; exit codes 0/1/2 are stable for scripting.
-- **gdb without VS Code:** `gdb --args ./wovm build/hello.wob`, or `gdb ./build/iso_test_unwind`.
+- **Step the ISO flavor, not the computed-goto one.** The goto interpreter jumps
+  label-to-label and single-stepping is disorienting. Test binaries have an ISO
+  twin (`build/iso_test_*`, plain `switch`) where `next`/`step` behave normally.
+  For `wovm` itself, build
+  `make -B wovm CFLAGS='-O0 -g -std=c11 -DWO_ISO_C'`.
+- **`break vm_trap`** — one breakpoint catches every trap at the moment of
+  failure, with the trapping frame intact (`vm->frames[vm->depth-1]`, `pc`
+  already rewound to the faulting instruction). `vm_unwind` is the next frame
+  down if you're chasing a leak-on-trap.
+- **Other load-bearing breakpoints:** `wo_load_buf` (validation rejects),
+  `recv_check` (residual field checks), `wo_builtin` (all builtins), `wo_gc_step`
+  (mark-sweep slices).
+- **ASan under gdb:** `ASAN_OPTIONS=abort_on_error=1` makes the first report
+  SIGABRT so the debugger stops on it with the full stack; without gdb the report
+  alone usually names the exact free you missed.
+- **CLI knobs:** `WO_HEAP_MB=1 ./wovm app.wob` forces early `T_OOM` paths; exit
+  codes 0/1/2 are stable for scripting.
+- **gdb without VS Code:** `gdb --args ./wovm build/hello.wob`, or
+  `gdb ./build/iso_test_unwind`.
+
+---
+
+## Historical: `wo-rt.c`
+
+A single-file C server that was the **runtime-layer reference prototype** —
+built to find out which kernel primitives a writeonce runtime should stand on,
+by writing them with no abstraction in the way. Its design conclusions are what
+`src/park.c` and the shard model implement. It is not part of the toolchain, no
+gate builds it, and it shares no code with `wovm`.
+
+It reached phase F of its own plan
+([`docs/plan/exploration/c-runtime/00-plan.md`](../docs/plan/exploration/c-runtime/00-plan.md),
+phases A→F all shipped): `WO_THREADS` pinned threads, each owning a raw io_uring
+ring (`io_uring_setup` + mmap'd SQ/CQ rings + `io_uring_enter`, no liburing), its
+own `SO_REUSEPORT` listener with multishot accept, its own keep-alive
+connections, and its own slice of one mlock'd mmap arena — shared-nothing, no
+locks, one `io_uring_enter` per loop tick in steady state. Writes followed the
+dual-write order: RAM apply, framed WAL record to a per-shard `fallocate`'d log,
+one group-commit `fdatasync` per tick, **HTTP ack only after the fsync
+completes**. Boot replayed each shard's snapshot + WAL tail in parallel before
+any accept armed; `./wo-rt wal-check <file>` validated a log offline.
+
+Build and poke it, if you want to read it running:
+
+```bash
+make -C runtime wo-rt     # cc -O2 -Wall -Wextra -std=c11 -pthread, no libraries
+./runtime/wo-rt           # 127.0.0.1:8085 (WO_PORT=9000 WO_THREADS=4 to override)
+```
+
+Its measured numbers, kept as the historical record they are — bench client
+`bench/bench.c` (keep-alive, only 2xx counted), Go reference in `bench/goref/`,
+20-core Linux 6.14, tmpfs data dir. These are **not** `wovm` numbers; the
+shipped VM's measurements live in `bench/baseline.json` and
+[`docs/plan/perf-targets.md`](../docs/plan/perf-targets.md).
+
+| Benchmark | **wo-rt-c** (8 shards, durable WAL, io_uring group commit) | **Go `net/http`** (go1.25.1, 20 cores, no durability) |
+| --- | --- | --- |
+| `GET /healthz` | **859,033 req/s** · p50 71 µs · p99 159 µs | 336,444 req/s · p50 70 µs · p99 1,277 µs |
+| `GET /` (JSON) | **671,312 req/s** · p99 180 µs | — |
+| `POST` write (tmpfs) | **618,343 commits/s** — fsync-acked · p99 194 µs | 320,516 req/s — RAM only, no WAL · p99 1,581 µs |
+| 10,000 idle conns | 0 errors | 0 errors |
+
+Honest caveats as recorded then: `net/http` does full general-purpose HTTP and
+this parser was minimal; tmpfs makes fsync nearly free, so the durable column
+flatters itself. ACID probes: three `kill -9` rounds mid-bench at ~2M commits all
+showed WAL records ≥ acked; 300 concurrent commits → 300 distinct ids; torn-tail
+records dropped whole by CRC. The crash-under-load test found two real bugs the
+lighter phase-D test missed — an ack-before-fsync race and an fd-reuse ABA hazard
+in ack parking — which is what the phase existed for.
+
+Deliberate simplifications it never outgrew: single-shot RECV re-armed per
+request, one outstanding SQE per connection, fixed-size buffers, naive `"title"`
+extraction instead of a JSON parser, no `timerfd`. Requires kernel ≥ 5.19
+(multishot accept).
+
+Design docs it fed:
+[`c-runtime/01-architecture.md`](../docs/plan/exploration/c-runtime/01-architecture.md)
+(the runtime traced through one memory address, plus seven improvement
+proposals),
+[`c-runtime/02-single-binary.md`](../docs/plan/exploration/c-runtime/02-single-binary.md)
+(how a single binary runs on this runtime),
+[`blue-green-vm/00-vision.md`](../docs/plan/exploration/blue-green-vm/00-vision.md)
+(port-free transports, fibers, embedded source, two-VM hot swap), and the
+kernel-primitive cards under
+[`exploration/linux/`](../docs/plan/exploration/linux/00-linux.md).
diff --git a/runtime/src/CODE-LOGIC.md b/runtime/src/CODE-LOGIC.md
index c00223f..50318d5 100644
--- a/runtime/src/CODE-LOGIC.md
+++ b/runtime/src/CODE-LOGIC.md
@@ -1,6 +1,8 @@
 # `runtime/src` — how the VM is put together
 
-Written 2026-08-14, when the runtime grew the systems stdlib and json. Read
+Written 2026-08-14, when the runtime grew the systems stdlib and json; the
+file table was brought back in line with `src/` on 2026-08-26 (`park.c` and
+`crypto.c` had arrived with iterations 11/35 and 34 and were missing). Read
 this before changing a file here; the normative contracts are
 [`docs/plan/oop-vm/00-wob-format.md`](../../docs/plan/oop-vm/00-wob-format.md)
 (the `.wob` format, opcodes, builtin ids) and
@@ -22,6 +24,8 @@ the first: constants there and prose there must never disagree.
 | `builtin.h/.c` | the pure builtins: print, containers, text |
 | `sysio.c` | the OS half: `fs`, `time`, `env`, `net`, `proc` |
 | `json.c` | `json.encode` / `json.decode`, driven by class metadata |
+| `park.c/.h` | the park plane (iteration 11 + 35, added after this doc was first written): the raw io_uring ABI mirrored from uapi with no liburing, the epoll fallback, fiber parking and unparking, and the per-call deadlines the `_dl` net members lower to. This is where a blocking builtin becomes "the shard runs someone else" |
+| `crypto.c/.h` | SHA-1, SHA-256, HMAC-SHA256 (iteration 34, builtin ids 85–87): hand-rolled per the no-dependency doctrine, accepted against FIPS 180 / RFC 2202 / RFC 4231 vectors in `test/test_crypto.c` |
 | `main.c` | the CLI: find an image (argument or embedded trailer), build argv, call the entry, map its result to an exit code; post-exit gc pump (a rootless cycle frees everything unreachable, in budgeted slices) |
 
 `builtin.c`'s `wo_builtin` is the single entry point the interpreter calls; it
diff --git a/scripts/linkcheck.py b/scripts/linkcheck.py
index 60646a5..234d8d8 100644
--- a/scripts/linkcheck.py
+++ b/scripts/linkcheck.py
@@ -1,11 +1,19 @@
 #!/usr/bin/env python3
-"""Scan every .md in repo, extract links, report broken local targets + bad anchors."""
+"""Scan every repo-authored .md, extract links, report broken local targets + bad anchors.
+
+`.dev/` and `.superpowers/` are excluded: both are gitignored, per-developer
+material this repo does not author -- vendored plugin-skill copies and cloned
+reference projects (whose own docs use site-build-relative links that cannot
+resolve on disk). Including them made the gate report the same ~23 failures
+forever, which is a gate nobody reads. Everything the repo actually ships is
+still scanned.
+"""
 import os, re, sys, urllib.parse
 from collections import defaultdict
 
 ROOT = os.path.abspath(sys.argv[1] if len(sys.argv) > 1 else ".")
 
-SKIP_DIRS = {".git", "node_modules", "_build", "target", "dist"}
+SKIP_DIRS = {".git", "node_modules", "_build", "target", "dist", ".dev", ".superpowers"}
 
 INLINE = re.compile(r'(?<!!)\[([^\]\n]*)\]\(\s*<?([^)\s>]+)>?(?:\s+"[^"]*")?\s*\)')
 REFDEF = re.compile(r'^\s{0,3}\[([^\]]+)\]:\s*<?(\S+)>?', re.M)
diff --git a/scripts/site-accept.sh b/scripts/site-accept.sh
index 42c666b..b3d61fe 100755
--- a/scripts/site-accept.sh
+++ b/scripts/site-accept.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # scripts/site-accept.sh — the writeonce.de tutorial site's gate: TWO deps
-# (framework + wo-html) resolved from run-time file:// remotes, build,
+# (serve + view) resolved from run-time file:// remotes, build,
 # serve, the page matrix (render/escape/404/401/authed edit), SIGTERM,
 # and WAL restart persistence of an admin edit.
 set -uo pipefail
@@ -27,8 +27,8 @@ cleanup() {
 trap cleanup EXIT
 
 # ---- both deps as git remotes; the app pointed at them ----
-cp -r "$ROOT/docs/examples/writeonce-framework" "$W/fw"
-cp -r "$ROOT/docs/examples/wo-html" "$W/lib"
+cp -r "$ROOT/docs/examples/porch" "$W/fw"
+cp -r "$ROOT/docs/examples/writeonce-view" "$W/lib"
 for d in "$W/fw" "$W/lib"; do
   git -C "$d" init -q
   git -C "$d" add -A
@@ -36,9 +36,15 @@ for d in "$W/fw" "$W/lib"; do
   git -C "$d" tag v0.1.0
 done
 cp -r "$ROOT/docs/examples/site" "$W/app"
-sed -i "s|https://github.com/shoneyj/writeonce-framework|file://$W/fw|; s|https://github.com/shoneyj/wo-html|file://$W/lib|" "$W/app/wo.toml"
+sed -i "s|https://github.com/shoneyj/porch|file://$W/fw|; s|https://github.com/shoneyj/writeonce-view|file://$W/lib|" "$W/app/wo.toml"
 printf '[build]\nruntime = "%s"\n' "$WOVM" >> "$W/app/wo.toml"
 
+# a stand-in release tarball so /dl can be exercised without running
+# `just dist` first — the bytes do not matter, the serving path does
+mkdir -p "$W/app/dist"
+printf 'not-a-real-tarball' | gzip > "$W/app/dist/writeonce-0.1.0-linux-amd64.tar.gz"
+( cd "$W/app/dist" && sha256sum writeonce-0.1.0-linux-amd64.tar.gz > writeonce-0.1.0-linux-amd64.tar.gz.sha256 )
+
 # ---- 1. two-dep fetch + lock + build ----
 if "$WOC" "$W/app" >"$W/build.out" 2>&1 && [[ -x "$W/app/target/site" && -f "$W/app/wo.lock" ]]; then
   ok "deps chain: two remotes fetched + wo.lock + build"
@@ -69,6 +75,20 @@ except urllib.error.HTTPError as e:
 PYEOF
 }
 
+# binary-safe: status + content-type + byte count, no decoding. The
+# release tarball is gzip, which `hit` cannot represent.
+hit_bin() {
+  python3 - "$PORT" "$1" <<'PYEOF'
+import sys, urllib.request, urllib.error
+port, path = sys.argv[1], sys.argv[2]
+try:
+    r = urllib.request.urlopen(f"http://127.0.0.1:{port}{path}", timeout=5)
+    print(f"{r.status}|{r.headers.get('content-type','')}|{len(r.read())}")
+except urllib.error.HTTPError as e:
+    print(f"{e.code}|{e.headers.get('content-type','')}|{len(e.read())}")
+PYEOF
+}
+
 expect() { # name got want_status want_substr
   local name="$1" got="$2" want="$3" sub="$4"
   local st="${got%%|*}" body="${got#*|}"
@@ -93,6 +113,19 @@ expect "tailwind sheet inlined"         "$(hit /)"           200 ".btn{"
 expect "chapter renders a code sample"  "$(hit /ch/hello)"   200 "fn main"
 expect "escaped interpolation visible"  "$(hit /ch/values)"  200 '${port}'
 expect "unknown chapter is a 404 page"  "$(hit /ch/nope)"    404 "No such chapter"
+expect "install guide renders"          "$(hit /install)"    200 "tar -C /usr/local"
+expect "packages index lists both"      "$(hit /packages)"   200 "/packages/porch"
+expect "package detail shows its dep"   "$(hit /packages/view)" 200 "writeonce-view"
+expect "unknown package is a 404 page"  "$(hit /packages/nope)" 404 "No such package"
+expect "favicon is served as svg"       "$(hit /favicon.svg)" 200 "<svg"
+expect "install lists supported systems" "$(hit /install)"   200 "glibc 2.35 or newer"
+got="$(hit_bin /dl/writeonce-0.1.0-linux-amd64.tar.gz)"
+if [[ "$got" == 200\|application/gzip\|* && "${got##*|}" -gt 0 ]]; then
+  ok "the release tarball downloads as gzip"
+else bad "tarball download" "$got"; fi
+expect "its checksum downloads"          "$(hit /dl/writeonce-0.1.0-linux-amd64.tar.gz.sha256)" 200 "writeonce-0.1.0-linux-amd64.tar.gz"
+expect "traversal out of /dl is a 404"   "$(hit /dl/../wo.toml)" 404 ""
+expect "the logo is inline in the nav"  "$(hit /)"           200 "aria-label=\"writeonce\""
 expect "admin without token is 401"     "$(hit /admin/ch/hello POST "title=X")"  401 "unauthorized"
 expect "admin edit answers a redirect"  "$(hit /admin/ch/hello POST "title=Hello v2" s3cr3t)" 302 ""
 expect "the edit is live"               "$(hit /ch/hello)"   200 "Hello v2"
diff --git a/scripts/web-app-accept.sh b/scripts/web-app-accept.sh
index 517f9e3..da6854b 100755
--- a/scripts/web-app-accept.sh
+++ b/scripts/web-app-accept.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # scripts/web-app-accept.sh — iteration 16's acceptance gate. Proves the whole
 # chain at run time, network-free: a temp git remote is built from
-# docs/examples/writeonce-framework, its file:// URL is substituted into a
+# docs/examples/porch, its file:// URL is substituted into a
 # temp copy of docs/examples/web-app, then: fetch -> lock -> build -> serve ->
 # the storefront matrix -> SIGTERM -> restart persistence, plus iteration 17's
 # library-kind and internal/-boundary checks. The repo itself
@@ -33,13 +33,13 @@ cleanup() {
 trap cleanup EXIT
 
 # ---- the framework as a git remote; the app pointed at it ----
-cp -r "$ROOT/docs/examples/writeonce-framework" "$W/fw"
+cp -r "$ROOT/docs/examples/porch" "$W/fw"
 git -C "$W/fw" init -q
 git -C "$W/fw" add -A
 git -C "$W/fw" -c user.email=t@t -c user.name=t commit -qm v01
 git -C "$W/fw" tag v0.1.0
 cp -r "$ROOT/docs/examples/web-app" "$W/app"
-sed -i "s|https://github.com/shoneyj/writeonce-framework|file://$W/fw|" "$W/app/wo.toml"
+sed -i "s|https://github.com/shoneyj/porch|file://$W/fw|" "$W/app/wo.toml"
 printf '[build]\nruntime = "%s"\n' "$WOVM" >> "$W/app/wo.toml"
 
 # ---- 1. fetch + lock + build ----
@@ -63,10 +63,10 @@ fi
 # A consumer reaching past the privacy line is WO-E108 at its own `use`.
 cp -r "$W/app" "$W/app-internal"
 rm -rf "$W/app-internal/target" "$W/app-internal/wo.lock" "$W/app-internal/.wo-deps"
-sed -i '1i use framework/internal' "$W/app-internal/main.wo"
+sed -i '1i use porch/internal' "$W/app-internal/main.wo"
 out="$("$WOC" "$W/app-internal" 2>&1)"; rc=$?
 if [[ "$rc" == "1" ]] && printf '%s' "$out" | grep -q 'WO-E108'; then
-  ok "dep boundary: importing framework/internal is WO-E108"
+  ok "dep boundary: importing serve/internal is WO-E108"
 else
   bad "internal-boundary" "exit=$rc out=$(printf '%s' "$out" | head -1)"
 fi
diff --git a/tests/corpus/compile-fail/call-reply-disagree/fixture.wo b/tests/corpus/compile-fail/call-reply-disagree/fixture.wo
index 57cd582..0b1b680 100644
--- a/tests/corpus/compile-fail/call-reply-disagree/fixture.wo
+++ b/tests/corpus/compile-fail/call-reply-disagree/fixture.wo
@@ -7,21 +7,19 @@ class Q {
 }
 
 class IntAnswer {
-  pad: Int
   fn receive(msg: Q) -> Int {
     return msg.n;
   }
 }
 
 class BoolAnswer {
-  pad: Int
   fn receive(msg: Q) -> Bool {
     return msg.n > 0;
   }
 }
 
 fn main() -> Int {
-  let a: actor Q = spawn IntAnswer { pad: 0 };
+  let a: actor Q = spawn IntAnswer {};
   let r = call(a, Q { n: 1 });
   return r;
 }
diff --git a/tests/corpus/compile-fail/raw-literal-esc-missing/fixture.code b/tests/corpus/compile-fail/raw-literal-esc-missing/fixture.code
new file mode 100644
index 0000000..e261753
--- /dev/null
+++ b/tests/corpus/compile-fail/raw-literal-esc-missing/fixture.code
@@ -0,0 +1 @@
+WO-E403
diff --git a/tests/corpus/compile-fail/raw-literal-esc-missing/fixture.wo b/tests/corpus/compile-fail/raw-literal-esc-missing/fixture.wo
new file mode 100644
index 0000000..b75653d
--- /dev/null
+++ b/tests/corpus/compile-fail/raw-literal-esc-missing/fixture.wo
@@ -0,0 +1,8 @@
+-- A `{{ ... }}` hole desugars to a call to `esc`, so a program that
+-- uses one without an `esc` in scope fails at the literal's position
+-- with a name it never typed -- the diagnostic says why.
+fn main() -> Int {
+  let n = "x";
+  print(`<p>{{ n }}</p>`);
+  return 0;
+}
diff --git a/tests/corpus/compile-fail/raw-literal-unterminated/fixture.code b/tests/corpus/compile-fail/raw-literal-unterminated/fixture.code
new file mode 100644
index 0000000..287d8e7
--- /dev/null
+++ b/tests/corpus/compile-fail/raw-literal-unterminated/fixture.code
@@ -0,0 +1 @@
+WO-E004
diff --git a/tests/corpus/compile-fail/raw-literal-unterminated/fixture.wo b/tests/corpus/compile-fail/raw-literal-unterminated/fixture.wo
new file mode 100644
index 0000000..8bfeaf5
--- /dev/null
+++ b/tests/corpus/compile-fail/raw-literal-unterminated/fixture.wo
@@ -0,0 +1,10 @@
+-- WO-E004: a raw text literal with no closing backtick. Unlike a plain
+-- unterminated "..." string (silent, rt parity), this is reported --
+-- multi-line is this form's normal case, so the rest of the file would
+-- otherwise vanish into the literal with nothing said.
+fn main() -> Int {
+  let page = `<div>
+    never closed
+  print(page);
+  return 0;
+}
diff --git a/tests/corpus/compile-fail/send-after-move/fixture.wo b/tests/corpus/compile-fail/send-after-move/fixture.wo
index 4e65139..38c2249 100644
--- a/tests/corpus/compile-fail/send-after-move/fixture.wo
+++ b/tests/corpus/compile-fail/send-after-move/fixture.wo
@@ -5,14 +5,13 @@ class Note {
 }
 
 class Sink {
-  pad: Int
   fn receive(msg: Note) {
     print(msg.text);
   }
 }
 
 fn main() -> Int {
-  let a = spawn Sink { pad: 0 };
+  let a = spawn Sink {};
   let n = Note { text: "gone" };
   send(a, n);
   print(n.text);
diff --git a/tests/corpus/compile-fail/traced-send/fixture.wo b/tests/corpus/compile-fail/traced-send/fixture.wo
index 84c2d92..7ce980d 100644
--- a/tests/corpus/compile-fail/traced-send/fixture.wo
+++ b/tests/corpus/compile-fail/traced-send/fixture.wo
@@ -12,13 +12,12 @@ class Box {
 }
 
 class Keeper {
-  pad: Int
   fn receive(msg: Box) {
     if msg.head == nil { print("empty"); } else { print("full"); }
   }
 }
 
 fn main() -> Int {
-  let a = spawn Keeper { pad: 0 };
+  let a = spawn Keeper {};
   return 0;
 }
diff --git a/tests/corpus/run/call-dead-trap/fixture.wo b/tests/corpus/run/call-dead-trap/fixture.wo
index 7b4a7c6..26bc79f 100644
--- a/tests/corpus/run/call-dead-trap/fixture.wo
+++ b/tests/corpus/run/call-dead-trap/fixture.wo
@@ -8,7 +8,6 @@ class Q {
 }
 
 class Bomb {
-  pad: Int
   fn receive(msg: Q) -> Int {
     return msg.n / (msg.n - msg.n);   -- DIV0: the actor dies mid-call
   }
@@ -20,7 +19,7 @@ fn call_one(b: actor Q, n: Int) -> Text {
 }
 
 fn main() -> Int {
-  let b: actor Q = spawn Bomb { pad: 0 };
+  let b: actor Q = spawn Bomb {};
   let first = try call_one(b, 7) catch (e) e.msg;
   print("mid-call: ${first}");
   let second = try call_one(b, 8) catch (e) e.msg;
diff --git a/tests/corpus/run/dotdot-continuation/fixture.out b/tests/corpus/run/dotdot-continuation/fixture.out
new file mode 100644
index 0000000..d21d6cc
--- /dev/null
+++ b/tests/corpus/run/dotdot-continuation/fixture.out
@@ -0,0 +1,2 @@
+one two three
+n=1 done
diff --git a/tests/corpus/run/dotdot-continuation/fixture.wo b/tests/corpus/run/dotdot-continuation/fixture.wo
new file mode 100644
index 0000000..93d500a
--- /dev/null
+++ b/tests/corpus/run/dotdot-continuation/fixture.wo
@@ -0,0 +1,13 @@
+-- A line ending in `..` continues the expression on the next line —
+-- the one newline suppression in the language (multi-line HTML/text).
+fn main() -> Int {
+  let t = "one" ..
+          " two" ..
+          " three";
+  print(t);
+  let n = 1;
+  let u = "n=${n}" ..
+          " done";
+  print(u);
+  return 0;
+}
diff --git a/tests/corpus/run/mailbox-full-trap/fixture.wo b/tests/corpus/run/mailbox-full-trap/fixture.wo
index bc0a708..02246fc 100644
--- a/tests/corpus/run/mailbox-full-trap/fixture.wo
+++ b/tests/corpus/run/mailbox-full-trap/fixture.wo
@@ -11,7 +11,6 @@ class Tick {
 }
 
 class Sleeper {
-  pad: Int
   fn receive(msg: Tick) {
     time.sleep(5000);
   }
@@ -23,7 +22,7 @@ fn send_one(s: actor Tick, n: Int) -> Text {
 }
 
 fn main() -> Int {
-  let s: actor Tick = spawn Sleeper { pad: 0 };
+  let s: actor Tick = spawn Sleeper {};
   let sent = 0;
   let caught = "";
   let i = 0;
diff --git a/tests/corpus/run/raw-text-literal/fixture.out b/tests/corpus/run/raw-text-literal/fixture.out
new file mode 100644
index 0000000..7d9d5fb
--- /dev/null
+++ b/tests/corpus/run/raw-text-literal/fixture.out
@@ -0,0 +1,5 @@
+<div class="card">
+  <h3>&lt;script&gt;</h3>
+  <p><script></p>
+</div>
+no newline, no margin rule
diff --git a/tests/corpus/run/raw-text-literal/fixture.wo b/tests/corpus/run/raw-text-literal/fixture.wo
new file mode 100644
index 0000000..06588de
--- /dev/null
+++ b/tests/corpus/run/raw-text-literal/fixture.wo
@@ -0,0 +1,35 @@
+-- iteration 37: the backtick raw text literal. Markup is written as
+-- markup -- one literal, real newlines, quotes verbatim -- and the
+-- source indentation is removed at compile time, so the served bytes
+-- carry the markup's own nesting and not the method's.
+-- `${...}` interpolates raw; `{{ ... }}` HTML-escapes through the `esc`
+-- in scope (here a local one, which is exactly how a program overrides
+-- writeonce-view's).
+fn esc(t: Text) -> Text {
+  let out = "";
+  let i = 0;
+  let n = len(t);
+  while i < n {
+    let b = byte_at(t, i);
+    if b == 60 { out = out .. "&lt;"; }
+    else {
+      if b == 62 { out = out .. "&gt;"; }
+      else { out = out .. substr(t, i, 1); }
+    }
+    i = i + 1;
+  }
+  return out;
+}
+
+fn main() -> Int {
+  let name = "<script>";
+  let card = `
+    <div class="card">
+      <h3>{{ name }}</h3>
+      <p>${name}</p>
+    </div>`;
+  print(card);
+  let plain = `no newline, no margin rule`;
+  print(plain);
+  return 0;
+}