wiki-formant 0.97.1 → 0.98.1

package/README.md

@@ -1,26 +1,28 @@
 # wiki-formant
 
-The portable half of a wiki: derived taxonomy, a spec-correct MCP transport, markdown twins, and the conditional-GET plumbing an agent surface needs.
+The portable half of a wiki: a page store, derived taxonomy, a spec-correct MCP transport, markdown twins, block rendering and editing, and the conditional-GET plumbing an agent surface needs.
 
-The editor, history, sanitiser, chart and passkey modules bring their libraries as dependencies (`@tiptap/*`, `fast-diff`, `sanitize-html`, `lightweight-charts`, `@simplewebauthn/*`), since every wiki here uses all five. What only some apps use stays an optional peer: `pg`, `react`, `jose` and `@radixdlt/rola` for ROLA, `sharp` and `@vercel/blob` for uploads. Web-standard `Request`/`Response`, so it runs unchanged on Next route handlers, Hono, Bun, Deno and workers.
+The editor, history, sanitiser, chart and passkey modules bring their libraries as dependencies (`@tiptap/*`, `fast-diff`, `sanitize-html`, `lightweight-charts`, `@simplewebauthn/*`). What only some apps use is an optional peer: `pg`, `react`, `jose` and `@radixdlt/rola` for ROLA, `sharp` and `@vercel/blob` for uploads. Web-standard `Request`/`Response` throughout, so it runs on Next route handlers, Hono, Bun, Deno and workers.
 
 ```bash
 npm install wiki-formant
 ```
 
-## What this is, and what it deliberately is not
+What stays the app's: its design system, its block types beyond the core, its connection, cache and auth. Everything else here is shared.
 
-Every wiki needs a design system and a set of block types beyond the core. Those are the parts you must own: they encode your brand and your content model, and a package that tried to own them would fight you.
+## API
 
-The page store is no longer one of them. Three wikis kept their own pages and revisions on three schemas that had drifted apart (cuid ids against int ids, a version column on one, no author on another, a tenant key on the third), and each wrote its page and its revision its own way. The tables are now the package's (`prisma/wiki.prisma`), and so is the SQL that reads and writes them (`wiki-formant/store`), so one wiki engine serves a standalone wiki and a multi-tenant host alike. The connection, the cache and the auth stay the app's.
+Every module has a subpath (`wiki-formant/taxonomy`, `wiki-formant/mcp`, …) and there is no root export: a barrel loads every module for the one symbol a route wanted. The emitted `.d.ts` files are the reference; this README shows one use of each subpath and the rules a signature cannot say. A function a module uses only itself is marked `@internal` and left out of the `.d.ts`.
 
-What every wiki *also* needs, rebuilds by hand, and then lets drift, is the layer above: the second browsing axis derived from metadata you are already storing, the HTML→markdown converter behind every `.md` twin, the JSON-RPC edges that decide whether an MCP client can talk to you at all, and the ETag arithmetic that turns a recrawl into a 304.
+`wiki-formant/tsconfig.base.json` is the compiler floor: an app's `tsconfig.json` extends it and keeps only `paths`, `include`, `exclude` and any licensed extra, since tsconfig resolves those against the file that declares them.
 
-This package was extracted from three production wikis that had each grown their own copy. By the time it was lifted, the copies had already diverged — one had lost the alphabetical index and the related-page ranking; one had `ToolAnnotations` the others lacked; one had MCP prompts the others lacked. Everything here is the union, with tests pinning the specific bugs that shipped.
+```json
+{ "extends": "wiki-formant/tsconfig.base.json", "compilerOptions": { "paths": { "@/*": ["./src/*"] } }, "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", "src/app/.well-known/**/*.ts", ".next/types/**/*.ts", ".next/dev/types/**/*.ts"], "exclude": ["node_modules"] }
+```
 
 ## Store
 
-`wikiStore` reads and writes `WikiPage` and `WikiRevision` through one `Sql` function the app binds to its own client, scoped to one site.
+`wiki-formant/store`: `wikiStore` reads and writes `WikiPage` and `WikiRevision` through one `Sql` function the app binds to its own client, scoped to one site.
 
 ```ts
 import { wikiStore } from 'wiki-formant/store';
@@ -32,23 +34,21 @@ const store = wikiStore({
 });
 
 const page = await store.get('contents/tech', 'radix-engine');
-const cards = await store.list('contents/tech', { sort: 'recent' });
 const { items, total } = await store.search('validators', { take: 20 });
 await store.save({ tagPath, slug, content, authorId, message, baseVersion: page.version });
 ```
 
-- **A save is one statement.** The page update and its revision are a data-modifying CTE guarded on the version the save read. A save that lost a race writes nothing and throws a 409 `HttpError`; pass `baseVersion` and a save opened on an old version, or on a page deleted since, is refused the same way, instead of erasing the edit in between or re-creating the page. A rename onto a slug another save took meanwhile is a 409 too.
-- **The bump is the diff's.** Added, removed or moved blocks are `major`, changed prose or title `minor`; `change` overrides it for a script that knows better. A metadata-only save moves no version and writes no revision.
-- **History is diffed on read.** A revision stores the page as it was saved, never a diff, so a script's revision and the editor's carry the same history. `history(pageId, { limit })` reads one row more than it returns, so the oldest entry shown is diffed against its real predecessor. It and `revision` answer only for a page of the store's own site.
-- **Listings carry a snippet, not the article.** `list`, `recent` and `byIds` drop `content` for one line of it; a category of 200 cards otherwise ships 200 block arrays.
-- **Search is four tiers**: title prefix, title, literal prose, then full text on `search_tsv` with Postgres' own headline as the snippet. Hidden paths are left out unless the search names one; `content: true` keeps each row's blocks.
-- **A path under a hidden one is hidden too**, in every listing, whether or not the tree names it.
-- **`branch` is an agent's walk**: a path and everything under it, newest first or A–Z, with the total a pager needs and an optional `since`. `counts` is pages per tag path, the back office and the home page left out.
-- Ids and timestamps default in the database, so the store's SQL and a Prisma client write the same rows. Copy the models with `npx prisma-models wiki` (a tenant-keyed app checks its own copy with `--tenant`), then build the full-text column with `npx fts-ddl '"WikiPage"'`.
+- **A save is one statement**: the page update and its revision in a CTE guarded on the version read. A lost race, a stale `baseVersion`, a page deleted since or a rename onto a taken slug writes nothing and throws a 409 `HttpError`.
+- **The bump is the diff's**: added, removed or moved blocks are `major`, changed prose or title `minor`; `change` overrides it. A metadata-only save moves no version and writes no revision.
+- **History is diffed on read.** A revision stores the page as saved. `history(pageId, { limit })` reads one row more than it returns, so the oldest entry shown has its real predecessor.
+- **Listings carry a snippet, not the article**: `list`, `recent` and `byIds` drop `content`.
+- **Search is four tiers**: title prefix, title, literal prose, then full text on `search_tsv` with Postgres' headline as the snippet. Hidden paths, and paths under them, are left out unless named.
+- `branch` is an agent's walk of a path and everything under it; `counts` is pages per tag path.
+- Copy the models with `npx prisma-models wiki` (`--tenant` for a tenant-keyed copy), then build the full-text column with `npx fts-ddl '"WikiPage"'`.
 
 ## Tree
 
-`createTree` is the category tree every wiki declares, and the walks each had written by hand.
+`wiki-formant/tree`: the category tree a wiki declares, and its walks.
 
 ```ts
 import { createTree, parseWikiPath } from 'wiki-formant/tree';
@@ -59,13 +59,13 @@ parseWikiPath(tree, ['contents', 'tech', 'radix-engine', 'history']);
 // { type: 'page', tagPath: 'contents/tech', slug: 'radix-engine', mode: 'history' }
 ```
 
-- Metadata keys accumulate down the trail; `sort`, `mainArticle` and `hidden` are inherited, the nearest declaration winning. A field only one wiki reads (an XRD threshold, a band) rides on the node, and the app folds it from `trail`.
-- A path that is itself a category wins over a mode suffix, so a category named `history` stays reachable. The empty slug is a category's hub article, and `/<category>/edit` edits it.
-- `crumbs` makes one crumb per URL segment, linked only where the tree knows the segment, so a trail can never be shorter than the address bar.
+- Metadata keys accumulate down the trail; `sort`, `mainArticle` and `hidden` inherit, the nearest declaration winning. A field only one wiki reads rides on the node.
+- A path that is itself a category wins over a mode suffix. The empty slug is a category's hub article.
+- `crumbs` makes one crumb per URL segment, linked only where the tree knows it.
 
 ## Category view
 
-`categoryView` is a category page as radix.wiki browses one, from the tree, the taxonomy and anything that reads like the store: the count, a sort that shows only once the set needs an A–Z index (by a `date` key where the category declares one), the facets its `select` keys give, a letter that exists, and a card per visible section listing its own pages, then its sections.
+`wiki-formant/category`: a category page from the tree, the taxonomy and anything that reads like the store.
 
 ```ts
 import { categoryView } from 'wiki-formant/category';
@@ -74,33 +74,30 @@ const view = await categoryView({ tree, taxonomy, pages: store }, 'ecosystem', s
 // { sort, total, pages, all, filters, letter, facets, letters, sortable, clearHref, sortHref, sections }
 ```
 
-- `pages` is the store, or the app's cached and decorated wrapper over its `list` and `subtree`.
-- A link carries `sort` only when it is not the category's own, so the bare category and its default are one address.
+A link carries `sort` only when it is not the category's default, so the bare category and its default are one address.
 
 ## Wiki read tools
 
-`wikiReadTools` is the read half of a wiki's MCP server over its store and tree: `search_wiki`, `get_page`, `get_pages`, `list_pages`, `get_categories`, `get_recent_changes`, `get_full_corpus` and `get_page_history`. `searchWiki` is the same rows for an app's plain-GET `?q=` and its search page, so the three never disagree.
+`wiki-formant/wiki-tools`: the read half of a wiki's MCP server: `search_wiki`, `get_page`, `get_pages`, `list_pages`, `get_categories`, `get_recent_changes`, `get_full_corpus` and `get_page_history`. `searchWiki` is the same rows for a plain-GET `?q=` and a search page.
 
 ```ts
-import { wikiReadTools, searchWiki } from 'wiki-formant/wiki-tools';
+import { wikiReadTools, searchWiki, type CorpusSection } from 'wiki-formant/wiki-tools';
 
 const reading = { store, tree, url: (tagPath, slug) => `${SITE}/${tagPath}/${slug}`, text: extractText, noun: 'the Radix Wiki', corpusTitle: 'Radix Wiki' };
 const tools = [...wikiReadTools(reading), ...myOwnTools];
 const { items, total } = await searchWiki(reading, 'validators', { page: 1, size: 20 });
 ```
 
-- Every row carries `path`, which every read tool takes back, and `chars` where the page's text was read. A pasted URL resolves, with `pathPrefix` stripped; a category's path reads its hub article; a miss names the nearest pages.
-- Every row carries the page `id` too, which a `pageList` block takes. `get_page` with `blocks: true` returns the stored blocks, the page `id`, its whole metadata and `version`: what an edit starts from. `forEdit` adds what the app's write tool takes beside them, and `authors` names each revision's author in `get_page_history`.
-- `text` should be the serializer the page's markdown twin uses, and `resolve` the resolver its page uses to fill what is read live (a page list's pages): `get_page`, `get_pages` and the default corpus read text through both, so a page reads the same over MCP as at its twin, which `twinParity` checks.
-- `privateHidden` closes the back office to every tool; without it a hidden page is unlisted but readable by path, as its URL is.
-- `metadata`, `label`, `corpus`, `noMatch` and `skills` are the app's: what a row adds, how a category is named, the sections `get_full_corpus` slices, what an empty search says, and the A2A skills.
-- Writes stay with each app, because who may write is the one thing no two of them agree on.
+- Every row carries `path`, which every read tool takes back, its `id` (what a `pageList` block takes), and `chars` where the text was read. A pasted URL resolves, with `pathPrefix` stripped; a miss names the nearest pages.
+- `get_page` with `blocks: true` returns the stored blocks, `id`, metadata and `version`: what an edit starts from. `forEdit` adds the app's own edit fields; `authors` names revision authors.
+- `text` should be the twin's serializer and `resolve` the page's live resolver, so a page reads the same over MCP as at its twin.
+- `get_full_corpus` is a `sizeOnly` preflight, then page-aligned slices under `maxChars` (`CORPUS_BUDGET`) with `truncated`, `nextSkip` and `clippedPage`. `corpus` returns the app's own `CorpusSection`s.
+- `privateHidden` closes the back office to every tool. `metadata`, `label`, `noMatch` and `skills` are the app's.
+- Writes stay with each app.
 
 ## Taxonomy
 
-`tagPath` puts a page in exactly one place in a tree. The `select`-typed metadata it already carries is a *cross-cutting* axis — and it is almost always stored, rendered once in an infobox as dead text, and never made pressable. The failure mode is a 141-page category rendered as one flat grid while the data to split it sits unread in a JSON column.
-
-The tree is yours; supply `getMetadataKeys` and the rest is derived.
+`wiki-formant/taxonomy`: the cross-cutting browsing axis derived from the `select` metadata pages already carry. The tree is yours; supply `getMetadataKeys` and one `href` builder.
 
 ```ts
 import { createTaxonomy } from 'wiki-formant/taxonomy';
@@ -109,70 +106,40 @@ const taxonomy = createTaxonomy({
   getMetadataKeys: tagPath => TAGS[tagPath]?.metadataKeys ?? [],
   href: (tagPath, { sort, filters, letter }) => /* your URL contract */,
 });
-
-const filters = taxonomy.facetFilters('ecosystem', searchParams);
-const pages   = taxonomy.filterPages(allPages, filters, letter);
-const facets  = taxonomy.buildFacets('ecosystem', allPages, filters, letter);
-const index   = taxonomy.needsAlphaIndex(allPages.length)
-  ? taxonomy.alphaIndex(allPages, filters) : [];
+const state   = { sort, filters, letter: taxonomy.resolveLetter(all, filters, query.letter) };
+const groups  = taxonomy.facetControls('ecosystem', all, state);  // [{ key, label, options }]
+const letters = taxonomy.alphaControls('ecosystem', all, state);  // [] below the threshold
 ```
 
-Four behaviours worth knowing, because each replaces a plausible wrong answer:
-
-- **Each facet is counted over the set narrowed by every *other* active filter**, so its own options stay switchable instead of collapsing to the one already chosen.
-- **Values come from the data, not from the declared `options`.** A key that declares four values while the pages hold seven would otherwise hide three behind a bar claiming to cover everything. Render what is there and the drift becomes visible.
-- **A single-valued facet hides — unless it is the active one.** An infobox row can set a filter the chips never offered; without its chip the reader lands on a narrowed list with nothing to press to widen it.
-- **`metadataRows` returns rows, not markup.** A page's populated keys in schema order, with `href` set exactly on the facet ones. The three wikis each rendered this selection their own way — an HTML table folded into a block, a React `<aside>`, a markdown twin — and differed only in how a *value* is formatted; which keys appear and where each links is the part they had rebuilt three times.
-- **`rankRelated` ranks by shared facet values** and returns the shared axis as `{key, value}`, so the *See also* heading can be the link into the filtered set. The behaviour it replaces — `pages.slice(0, 5)` — shows every page in a large category the same five links.
-
-One `href` builder is passed in and used by every chip, letter and sort button. A sort button that drops the active filters is the tell that a project grew a second one.
-
-### The controls, not just the counts
-
-`buildFacets` and `alphaIndex` hand back numbers; something still has to turn each one into a pressable thing with a destination. That step was rebuilt in all three wikis, and by the time this was written they no longer agreed on what the row *contains*: one shipped no A–Z index at all, one had no way back to the unfiltered set, and two marked the active chip with `aria-pressed` on an `<a>` — which is not a toggle button and does not take that attribute.
-
-```ts
-const state  = { sort, filters, letter: taxonomy.resolveLetter(all, filters, query.letter) };
-const groups = taxonomy.facetControls('ecosystem', all, state);  // [{key, label, options}]
-const letters = taxonomy.alphaControls('ecosystem', all, state); // [] below the threshold
-```
-
-Every control arrives as `{value, label, count, href, active}`, its `href` already built through your one builder with **every other axis carried along** — the arithmetic that, done by hand, drops the reader's letter the first time they press a chip.
-
-- **The reset control leads the row**, flagged `reset`, so a consumer that maps the array cannot ship a narrowed view with nothing to press to widen it.
-- **`alphaControls` returns `[]` below the index threshold**, folding in `needsAlphaIndex` — one call is either the index you needed or nothing, rather than a decision each caller makes and one caller forgets. A hub's sort toggle reads the same predicate over the same unfiltered count (`needsAlphaIndex(all.length)`; 40 pages unless `alphaIndexMinPages` says otherwise), so a set small enough to need no index offers no sort either.
-- **`resolveLetter` drops a letter no page starts with.** A stray `?letter=Q` would otherwise empty the grid with no control marked to explain why.
-
+- Each facet is counted over the set narrowed by every *other* filter, so its options stay switchable.
+- Values come from the data, not the declared `options`. A single-valued facet hides unless it is active.
+- Every control is `{ value, label, count, href, active }` with every other axis carried in `href`. The reset control leads the row, flagged `reset`.
+- `alphaControls` is `[]` below `needsAlphaIndex` (40 pages unless `alphaIndexMinPages`); `resolveLetter` drops a letter no page starts with.
+- `metadataRows` returns a page's populated keys as rows with `href` on the facet ones; `rankRelated` ranks by shared facet values and returns the shared axis for the *See also* heading.
 
 ## Headings
 
-Heading ids, permalink anchors, and the list an "on this page" rail renders — one pass over the HTML you already have.
+`wiki-formant/headings`: heading ids, permalink anchors, and the list an "on this page" rail renders.
 
 ```ts
-import { injectHeadingIds, headingsFrom } from 'wiki-formant/headings';
-
-const html = injectHeadingIds(page.body);   // ids + anchors, idempotent
-const toc  = headingsFrom(html);            // [{ id, text, level }]
-```
+import { articleHtml, headingsFrom } from 'wiki-formant/headings';
 
-Two behaviours worth knowing:
-
-- **The slug rule is a parameter.** A heading id is a live URL — readers link to `#the-shape-of-a-code`, and so does the page's own permalink anchor. The two wikis this was lifted from had drifted onto different rules, and unifying them would have silently moved every published anchor on whichever one lost. Pass `slug` to keep the rule you already ship.
-- **Deduping is not a parameter, but its scope is.** Two headings with the same text otherwise mint the same id twice, and every link to the second lands on the first. The unit that must be unique is the page, so a block wiki that injects block by block passes one `used` set to every call — seeded with any id the template renders itself, such as the title's. All three consumers once passed none, and a heading repeated across two blocks shipped two identical ids.
-
-```ts
 const used = new Set([slug(page.title)]);
-const blocks = page.blocks.map(b => ({ ...b, text: injectHeadingIds(b.text, { used }) }));
+const blocks = page.blocks.map(b => ({ ...b, text: articleHtml(b.text, { used, links: { selfHost: 'radix.wiki' } }) }));
+const toc = headingsFrom(blocks.map(b => b.text).join(''));   // [{ id, text, level }]
 ```
 
-`headingsFrom` reads the string, not the rendered DOM — possible only where the body IS a string at render time. A wiki whose content streams in as blocks after mount has to query the DOM, and uses only the injector.
+- `injectHeadingIds` is idempotent; `slug` is a parameter, since a heading id is a published URL.
+- Pass one `used` set across a page's blocks, seeded with ids the template renders, or a repeated heading mints a duplicate id.
+- `articleHtml` is the render-path chain: heading ids, `scrollTables`, and with `links` the link pass: an internal link loses `target` and `rel`, an external one gets them, and a bare-URL anchor gets readable text.
 
 ## MCP
 
-A minimal [Model Context Protocol](https://modelcontextprotocol.io) server over Streamable HTTP, with the transport edges most implementations get wrong.
+`wiki-formant/mcp`: a [Model Context Protocol](https://modelcontextprotocol.io) server over Streamable HTTP.
 
 ```ts
 import { mcpResponse, mcpGet, mcpOptions, McpToolError } from 'wiki-formant/mcp';
+import { MCP_RATE_LIMIT } from 'wiki-formant/rate-limit';
 
 const config = {
   serverInfo: { name: 'my-wiki', version: '1.4.0' },
@@ -181,14 +148,11 @@ const config = {
   tools: [{
     name: 'search_pages',
     description: 'Full-text search across the wiki.',
-    inputSchema: {
-      type: 'object',
-      properties: { q: { type: 'string', description: 'query' } },
-      required: ['q'],
-    },
+    inputSchema: { type: 'object', properties: { q: { type: 'string', description: 'query' } }, required: ['q'] },
     annotations: { readOnlyHint: true },
     handler: async ({ q }) => search(String(q)),
   }],
+  rateLimit: MCP_RATE_LIMIT,
   onCall: (req, body) => track(req, body),
 };
 
@@ -197,153 +161,93 @@ export const GET  = () => mcpGet(config.docsUrl);
 export const OPTIONS = () => mcpOptions();
 ```
 
-What it gets right:
-
-- **A caller-fixable mistake is a tool result with `isError`, never `-32603`.** Bad arguments come back naming every bad field at once, quoting the legal values and appending the schema, so one retry can fix all of them.
-- **Capabilities advertise only what the config populates.** An advertised `resources` whose list comes back empty reads as a bug, not as honesty. The `-32601` method list narrows the same way.
-- **A notification-only POST answers a bare `202`**, not a `200` carrying JSON `null`.
-- **Malformed JSON is `-32700` with a `400`**, never a 500.
-- **`GET` is an explicit 405 with CORS headers.** A framework's automatic 405 carries none, so a browser client cannot even read the refusal.
-- **The preflight allow-list includes `Accept` and `Mcp-Protocol-Version`.** One missing entry fails the preflight rather than the POST, which presents as "the server is down".
-- **Batches are capped** (default 20) with a teaching error, because the rate limiter charges one token per HTTP request before the body is parsed. From 2025-06-18 on they are refused outright, because that revision removed them.
-- **Both protocol eras, one endpoint.** A request carrying `io.modelcontextprotocol/protocolVersion` in `params._meta` is served as `2026-07-28`: `server/discover`, per-request version and header validation (`-32022` naming every version spoken, `-32020` on a routing header that disagrees with the body), `resultType` and cache hints on results, and 404 for the methods that revision removed. Everything else is the legacy era, where `initialize` echoes the client's version when it is one of `2025-11-25`, `2025-06-18`, `2025-03-26` or `2024-11-05` and offers the newest otherwise. The spec permits a dual-era server, and it is the only way to adopt the new revision without failing the handshake of every client already in the field.
-- **The A2A call an agent card invites is answered.** Every card names this endpoint as its JSON-RPC `url`, so `message/send` (v0.3) and `SendMessage` (v1.0) get a message back: the result of the tool `answer` names (`{ tool: 'search_wiki', argument: 'query' }`), or `instructions` and the tool names without one. The task methods are `-32001`, since no task is ever created; streaming and push are `-32004`.
-- **The version is negotiated, not asserted.** Every response carries it back in `MCP-Protocol-Version`. Answering a constant is legal and still costs the caller structured output, tool titles and `_meta` without ever saying so.
-- **`Access-Control-Expose-Headers` is set.** Allow-Headers governs what a browser may send, Expose-Headers what it may read — without the second a browser client cannot see `Retry-After` on a 429, and a rate limit presents as a hang.
-- **The rate limit is declared, not wired.** Put `rateLimit: {capacity, refillPerSec}` on the config and `mcpResponse` enforces it before parsing the body, refuses with a JSON-RPC envelope, and states `RateLimit-Limit`/`-Remaining`/`-Reset` on every answer. Four routes had each transcribed that by hand through three differently-named local helpers, which is how a headroom header gets added to one surface and forgotten on the next.
-- **`mcpRateLimited(retryAfterSec)` is a JSON-RPC envelope.** A 429 whose body is `{"error": "..."}` is a string where the client's parser expects `{code, message}`, on the one response an agent meets exactly when it is working hard.
-
-### Structured output, `_meta`, and the envelope gate
-
-**Every object a handler returns comes back as `structuredContent` beside the text block**, so a client reads the answer rather than scraping prose for it. This used to be gated on declaring an `outputSchema`, and the result was that across four live servers and thirty-two tools — every one of them answering in JSON — not a single response ever carried it. `outputSchema` remains the stronger contract, because a client validates against it; it is no longer the price of admission. A handler returning a string is left alone.
-
-`inputSchema.requireOneOf` names a set of which at least one must be present. `required` cannot express "query or popular", so the one tool needing it checked in its handler and the caller learned at execution time — the single class of argument mistake this module was otherwise catching before dispatch.
-
-A handler's second argument is its context:
-
-```ts
-handler: async (args, ctx) => {
-  ctx.meta;                                      // params._meta, as it arrived
-  ctx.setMeta('x402/payment-response', receipt); // rides back on result._meta
-  return { hits: 2 };
-}
-```
-
-`config.gate` is envelope-level middleware: it may withhold entries before dispatch and merge its own responses back afterwards. A payment gate has to sit there rather than in a handler, because the demand *replaces* the call and the receipt rides on the envelope. `RpcRequest` and `toolText` are exported for a gate to build with; acuiq2's x402 gate is the one that does.
-
-### Agent feedback
-
-`feedbackTool(record, noun)` is `send_feedback`: an agent says what it needed and did not find, what is wrong or what broke (`kind` is `missing`, `wrong`, `broken` or `suggestion`), in `FEEDBACK_MAX` characters. It asks for something to act on rather than for a rating, which an agent answers with praise. List it among a server's tools and the transport does the inviting: `initialize` appends `FEEDBACK_INVITE` to `instructions`, and an empty `listEnvelope` page or an `McpToolError` carries a one-line `feedback` pointer, because a miss is when an agent knows what it was after. A tool whose miss has another shape quotes `FEEDBACK_NUDGE` in its own note. A server without the tool mentions it nowhere. Pass `tracker.trackFeedback` as `record` and each report is an "Agent Feedback" event, listed newest first in the digest's `agent_feedback`. Nothing is published: a report is a stranger's text, read as data.
-
-```ts
-tools: [...TOOLS, feedbackTool(tracker.trackFeedback, 'the Radix Wiki')]
-```
-
-### Tool arguments and the corpus tool
-
-`readArgs` reads a tool's raw arguments as typed, clamped values and records every value it had to override, so a result can say `adjustments: [{ param: 'limit', requested: -4, used: 1, … }]` instead of silently answering a different question. Defaults belong in the tool description; the result echoes only overrides.
-
-`wiki-formant/corpus` is the arithmetic behind a `get_full_corpus` tool: a `sizeOnly` preflight with per-branch and largest-page breakdowns, then page-aligned slices under a `maxChars` budget (`CORPUS_BUDGET`) with `truncated`, `nextSkip` and `clippedPage`. The corpus itself — which rows, how a page becomes a section — is the wiki's; `sliceCorpus` takes the sections it builds.
+- A caller-fixable mistake is a tool result with `isError`, never `-32603`: bad arguments name every bad field, quote legal values and append the schema. Throw `McpToolError(message, details)` from a handler for the same.
+- Capabilities, and the `-32601` method list, advertise only what the config populates.
+- A notification-only POST is a bare `202`; malformed JSON is `-32700` with a `400`; `GET` is an explicit 405 with CORS; the preflight allow-list and `Access-Control-Expose-Headers` cover what MCP clients send and read.
+- Batches are capped (`DEFAULT_MAX_BATCH`, 20) and refused from 2025-06-18 on.
+- Both protocol eras on one endpoint: a request with `io.modelcontextprotocol/protocolVersion` in `params._meta` is served as `2026-07-28` (`server/discover`, per-request version checks, `resultType` and cache hints); everything else is the legacy era, which echoes a supported client version. Every response carries `MCP-Protocol-Version`.
+- The A2A call an agent card invites (`message/send`, `SendMessage`) is answered from the tool `answer` names.
+- `rateLimit: { capacity, refillPerSec }` is enforced before the body is parsed, with `RateLimit-*` headers on every answer; `mcpRateLimited(sec)` is the JSON-RPC 429.
+- Every object a handler returns comes back as `structuredContent` beside the text; `outputSchema` is the stronger contract when declared. `inputSchema.requireOneOf` names a set of which one must be present.
+- A handler's second argument is its context: `ctx.meta` (the request's `params._meta`) and `ctx.setMeta(key, value)` (onto `result._meta`). `config.gate` is envelope-level middleware, for a payment gate whose demand replaces the call.
+- `readArgs` reads raw arguments as typed, clamped values and records every override; `withAdjustments` puts them on the result as `adjustments`.
+- `feedbackTool(record, noun)` is `send_feedback`. Listed, `initialize` appends `FEEDBACK_INVITE` and an empty `listEnvelope` page or an `McpToolError` carries a one-line pointer to it.
 
 ## Conformance
 
-`wiki-formant/conformance` is the half of an MCP conformance run that is not about any one server's tools: a JSON-RPC client that backs off on a 429, the transport assertions (CORS preflight, `GET`→405, a notification answering 202 with no body, `-32700`, the batch cap, honest `capabilities`, version negotiation), version coherence across every descriptor a surface publishes, A2A card parity, conditional-GET and `robots` checks, and a pass/fail table with an exit code.
+`wiki-formant/conformance`: the half of an MCP conformance run that is not about one server's tools. Every value it compares against is imported from `wiki-formant/mcp`.
 
 ```ts
+import { createTester, standardSuite, wikiReadChecks } from 'wiki-formant/conformance';
+
 const t = createTester({ base: 'https://example.com', clientName: 'my-mcp-test' });
-await transportChecks(t, 'my-mcp-test');
-await annotationChecks(t, { writes: ['create_page'] });
-await payloadBudget(t, [{ name: 'search', args: { query: 'x' } }]);
+const init = await standardSuite(t, {
+  version: serverManifest.version,
+  openapi: ['/openapi.json', '/.well-known/openapi.json'],
+  writes: ['create_page', 'send_feedback'],
+  manifest: { writeAuth: true },
+  budget: [{ name: 'search_wiki', args: { query: 'x' } }, { name: 'get_full_corpus', maxBytes: 260_000 }],
+  conditionalGet: ['llms.txt'],
+  robots: ['/api/mcp', '/llms.txt', '/.well-known/agent-card.json'],
+});
+const { first } = await wikiReadChecks(t, { query: 'radix', address: r => ({ tagPath: r.tagPath, slug: r.slug }), twin: r => `${r.path}.md` });
 process.exit(t.summary());
 ```
 
-What stays in your repo is fixtures: which tools you expect, what a good answer from each looks like, and which text surfaces you publish. `payloadBudget` weighs every listed call **and** every read-only tool that takes no required arguments, because the one tool nobody thought to list is the one that answers with 3.3 MB; pass a per-call `maxBytes` for a bulk-export tool that is deliberately large. It also asserts that a JSON answer arrived with `structuredContent`.
+`standardSuite(t, cfg)` runs the suites every surface runs, in order: `transportChecks` (CORS preflight, `GET`→405, 202 for a notification, `-32700`, the batch cap, honest capabilities, version negotiation), `versionCoherence` over `standardVersionSources`, `agentCardParity`, `annotationChecks`, `manifestParity`, `payloadBudget`, `conditionalGetChecks`, `descriptorChecks` (default `S10_DESCRIPTORS`) and `robotsChecks`. `budget`, `conditionalGet` and `robots` run only when given, for a surface whose fixtures exist only later in its run. It returns the `initialize` response. Each suite is exported for a surface that needs it alone.
 
-The drift checks hold an MCP server to what its own site does, so a tool cannot describe, accept or return something the site does not:
+`wikiReadChecks(t, opts)` checks the `wiki-tools` read tools: categories, a search and the page it finds (by `address`, default `{ path }`), its twin (given `twin`), a listing, recent changes, a corpus preflight and a slice that is cut and resumes when the corpus exceeds `corpusChars`, and the teaching answers to no hits, a missing argument, an unknown tool and a missing page. `endpoint` and `label` run it against a second server. It returns `{ rows, first, page }`.
 
-- `manifestParity(t, { writeAuth? })`: `/.well-known/mcp.json` is `tools/list` tool for tool, names the endpoint under test, and states write auth only where a write tool is listed (both ways, given `writeAuth`).
-- `rowParity(t, label, mcp, rest)`: a tool's answer and the GET API's or `?q=` page's are identical, and not both empty.
-- `twinParity(t, label, twinUrl, text)`: a read tool's text is the page's markdown twin, past its frontmatter and the title line.
-- `editReadChecks(t, { path, rows?, validate?, endpoint? })`: rows carry page ids, `get_page` with `blocks: true` returns blocks the site's own `validate` accepts and a version, and `get_page_history`'s newest revision is that version.
-- `roundTrip(t, label, { read, write })`: what a read tool hands out, the write tool takes back unchanged, and the next read matches.
-- `openapiWriteParity(t, [[path, method, tool], …])`: every field an OpenAPI write documents, the matching tool takes.
-- `rolaOriginCheck(t)`: a challenge tool's ROLA recipe names the origin under test.
-- `freshAfterWriteChecks(t, urls, write, { shows?, gone? })`: each URL is read, `write` runs, and each then carries `shows` and not `gone`. It catches a twin or `llms.txt` the CDN keeps past the save that changed it, which every check that reads a surface once passes. Run it against a deployment: with no CDN in front it passes trivially.
+- `payloadBudget` weighs every listed call and every read-only tool with no required arguments, and asserts a JSON answer carries `structuredContent`.
+- `conditionalGetChecks` wants a 304 on `If-None-Match` (alone and in a list) and a `Last-Modified`; `descriptorChecks` wants an ETag and a `max-age` on a JSON descriptor.
+- `t.rpcAt(endpoint, …)` and `t.callAt` drive another endpoint with the same backoff, User-Agent and tally.
 
-`standardVersionSources(t, openapiPaths)` is the `versionCoherence` map every S10 surface serves — both agent-card paths, `mcp.json`, the server card and each path the OpenAPI document answers at — so a suite names only the paths it adds. `t.rpcAt(endpoint, …)` and `t.callAt` drive a second MCP endpoint on the same surface with the same backoff, User-Agent and tally.
+The drift checks hold a server to what its own site does:
 
-```ts
-await versionCoherence(t, server.version, standardVersionSources(t, ['/openapi.json', '/api/openapi.json']), init.result?.serverInfo?.version);
-```
-
-`descriptorChecks(t)` defaults to `S10_DESCRIPTORS`, the six JSON descriptors every surface here serves.
+- `manifestParity(t, { writeAuth? })`: `/.well-known/mcp.json` is `tools/list`, names the endpoint, and states write auth only beside a write tool.
+- `rowParity(t, label, mcp, rest)`: a tool's rows and the GET API's are identical and not empty.
+- `twinParity(t, label, twinUrl, text)`: a tool's text is the page's markdown twin, past frontmatter and title.
+- `editReadChecks(t, { path, rows?, validate?, endpoint?, label? })`: rows carry ids, `get_page` with `blocks: true` returns blocks the site's `validate` accepts, and the history's newest revision is that version.
+- `roundTrip(t, label, { read, write })`: a write takes its read back unchanged.
+- `openapiWriteParity(t, [[path, method, tool], …], specUrl?)`: every field an OpenAPI write documents, the tool takes.
+- `rolaOriginCheck(t)`: the ROLA recipe names the origin under test.
+- `freshAfterWriteChecks(t, urls, write, { shows?, gone? })`: each URL shows the write within five seconds. Run it against a deployment, since with no CDN it passes trivially.
 
 ## Markdown twins
 
-Pass an `etag` and answer `notModified` before rendering: a twin is the single most recrawled URL a page has, so a twin with no validator is a full render on every pass, forever — the same arithmetic that justifies the corpus ETag, applied per page.
-
-`htmlToMarkdown` preserves the structure an agent cites by — headings, lists, tables, code, emphasis — rather than flattening to prose. Tables convert first so the generic rules cannot eat their markup, ordered lists number per list, pipes inside cells are escaped, and a headerless table gets a synthesised header because GFM has no other form.
+`wiki-formant/markdown`: `htmlToMarkdown` keeps the structure an agent cites by (headings, lists, tables, code, emphasis); `markdownDocument` adds the frontmatter.
 
 ```ts
 import { htmlToMarkdown, markdownDocument } from 'wiki-formant/markdown';
+import { markdownHeaders, cacheTagHeaders, VARY_ACCEPT } from 'wiki-formant/http';
 
-return new Response(
+return notModified(request, etag, lastModified) ?? new Response(
   markdownDocument(
-    { title: page.title, url, updated: page.updatedAt, lastVerified: page.lastVerifiedAt,
-      license: { spdx: 'CC-BY-4.0', url: 'https://creativecommons.org/licenses/by/4.0/' } },
-    blocksToMarkdown(page.content), // your block types, your function
+    { title: page.title, url, updated: page.updatedAt, lastVerified: page.lastVerifiedAt, license },
+    blocksToMarkdown(page.content),
   ),
-  { headers: markdownHeaders(lastModified, { etag, noindex: true }) },
+  { headers: markdownHeaders(lastModified, { etag, noindex: true, extra: { ...VARY_ACCEPT, ...cacheTagHeaders(pageTag(path)) } }) },
 );
 ```
 
-`noindex` sends `X-Robots-Tag: noindex`, for a twin of an HTML page: a search engine that reads it has the page already. A document with no HTML page, an AGENTS.md, leaves it off.
-
-Put `cacheTagHeaders(tags)` in `extra`, with the tags your save path already revalidates. A route handler is held at Vercel's CDN by its `s-maxage` alone, so without `Vercel-Cache-Tag` the twin outlives every save by its edge window while the ISR page beside it is fresh. The same goes for `llms.txt`, a search index and a sitemap: any text an agent reads back after writing.
-
-```ts
-headers: markdownHeaders(lastModified, { etag, noindex: true, extra: { ...VARY_ACCEPT, ...cacheTagHeaders(pageTag(path)) } })
-```
-
-Block trees stay in your app — every project owns its own type set. Give this module HTML and it gives you markdown.
-
-> A trap worth naming: if you serve twins via a rewrite, Next drops the destination query string. The rewrite must carry the `.md` extension through to the destination path, or the twin silently serves JSON.
-
-## Conditional GET
-
-`llms.txt` and the markdown twins are the most-recrawled URLs a wiki serves, and a corpus export the most expensive to render. Without a corpus-derived ETag, every AI crawler pays full price on every pass, forever.
-
-A URL that answers JSON or markdown by `Accept` asks `wantsMarkdown(request)` and sends `VARY_ACCEPT` on both branches. Without the Vary, a shared cache hands one client the other's format.
+- Tables convert first, ordered lists number per list, cell pipes are escaped, and a headerless table gets a header.
+- `noindex` is for a twin of an HTML page; a document with no HTML page (AGENTS.md) leaves it off.
+- `cacheTagHeaders(tags)` with the tags the save path revalidates, or the CDN holds a route handler's twin past every save. The same goes for `llms.txt`, a search index and a sitemap.
+- Next drops a rewrite destination's query string, so a twin rewrite carries the `.md` extension through to its destination.
 
-```ts
-import { corpusEtag, notModified, textHeaders } from 'wiki-formant/http';
-
-const etag = corpusEtag([pageCount, newestUpdatedAt]);
-const lastModified = newestUpdatedAt.toUTCString();
-
-export async function GET(request: Request) {
-  return notModified(request, etag, lastModified)
-    ?? new Response(buildCorpus(), { headers: textHeaders(etag, lastModified) });
-}
-```
+## Conditional GET and route errors
 
-`descriptorResponse` and `descriptorHandler` serve a JSON descriptor (an agent card, a manifest, an OpenAPI document) with its own ETag and `Access-Control-Allow-Origin: *`, since every descriptor is public and browser agents read them; six of nine routes had passed the header by hand.
-
-`corpusValidatorsFrom(seed, stamps)` is that pair from an aggregate: the newest of `stamps` (the epoch when every one is null), appended to `seed` for the tag. `corpusRoute(validators, build)` is the whole handler, and skips the build on a 304.
+`wiki-formant/http`: validators, the headers of every text surface, and the answers a route gives when it is not answering with data.
 
 ```ts
-const agg = await prisma.page.aggregate({ _count: true, _max: { updatedAt: true } });
-corpusValidatorsFrom([depth, agg._count], [agg._max.updatedAt]);
-```
-
-### Route errors
-
-`json`, `errors` and `handleRoute` are the answers a route handler gives when it is not answering with data, as web-standard `Response`s a Next handler returns as they are. Every error body is `{ error, ...extra }`: one origin had these helpers, one had a second convention with a third copy inside a single route, and two answered with whatever `Response.json` was nearest, so one mistake came back three ways depending on the origin.
+import { corpusValidatorsFrom, corpusRoute, errors, handleRoute, HttpError } from 'wiki-formant/http';
 
-```ts
-import { errors, handleRoute, HttpError } from 'wiki-formant/http';
+export const GET = corpusRoute(async () => {
+  const agg = await prisma.page.aggregate({ _count: true, _max: { updatedAt: true } });
+  return corpusValidatorsFrom([agg._count], [agg._max.updatedAt]);
+}, buildCorpus);
 
-export const GET = (req: Request) => handleRoute(async () => {
+export const POST = (req: Request) => handleRoute(async () => {
   const q = new URL(req.url).searchParams.get('q');
   if (!q) return errors.badRequest('q is required');
   if (q.length > 200) throw new HttpError(400, 'q is too long', { code: 'INVALID_PARAMS' });
@@ -351,325 +255,238 @@ export const GET = (req: Request) => handleRoute(async () => {
 }, 'Search failed');
 ```
 
-A thrown `HttpError` answers with its own status and message. Anything else thrown is logged and answered with a 500 carrying only `errorMsg`, so an exception's text — a database error naming a table — never reaches the caller. `errors.tooManyRequests(sec)` states `Retry-After`.
+- `corpusEtag`, `notModified` and `textHeaders` are the parts; `corpusRoute` skips the build on a 304.
+- A URL answering JSON or markdown by `Accept` asks `wantsMarkdown(request)` and sends `VARY_ACCEPT` on both branches.
+- `descriptorResponse` serves a JSON descriptor with its own ETag and `Access-Control-Allow-Origin: *` (`descriptorHandler` in `wiki-formant/well-known` is the route).
+- Every error body is `{ error, ...extra }`. A thrown `HttpError` answers with its status; anything else is logged and answered with a 500 carrying only the handler's message (`'Search failed'`), so no exception text reaches a caller. `errors.tooManyRequests(sec)` states `Retry-After`.
 
-## Response headers
+## Response headers and the Next config
 
-`wiki-formant/headers` holds the six headers every route sends and the Content-Security-Policy they share, for `next.config.ts` to import:
+`wiki-formant/headers`: the headers every route sends, the shared CSP, and the Next config defaults. It imports nothing, so `next.config.ts` pays for nothing it does not use.
 
 ```ts
-import { contentSecurityPolicy, securityHeaders } from 'wiki-formant/headers';
+import type { NextConfig } from 'next';
+import { contentSecurityPolicy, withWikiDefaults } from 'wiki-formant/headers';
 
 const csp = contentSecurityPolicy({ 'connect-src': ["'self'", 'https://*.radixdlt.com'] });
-
-const nextConfig = {
-  async headers() {
-    return [{ source: '/:path*', headers: securityHeaders(process.env.NODE_ENV === 'production' ? csp : null) }];
-  },
-};
+export default withWikiDefaults({ async redirects() { /* … */ } } satisfies NextConfig, { csp });
 ```
 
-Four configs had restated these by hand on the grounds that a config could not import an ESM-only package. It could not because no subpath had a `default` condition, and Next resolves a config's imports the way `require` does; every subpath has one now, and Node 24 loads the module there unchanged.
+`withWikiDefaults(config, { csp })` adds:
 
-`withWikiDefaults(config, { csp })` wraps the whole config: the headers on every route with `csp` enforced in production, AVIF before WebP from the image optimiser, Turbopack's build cache off (Vercel restored a stale one and shipped a stylesheet two commits old), and `distDir` from `STUDIO_DIST_DIR` for radix-studio's second dev server. What the app sets wins, and its own `headers()` follow these.
+- `securityHeaders` on every route, `csp` enforced in production only (Next's dev runtime is inline and `eval`); an origin with a per-request nonce passes none.
+- `/openapi.json` rewritten to `/.well-known/openapi.json` first in `beforeFiles`, merged with the app's own `rewrites()` in either form.
+- AVIF before WebP, `turbopackFileSystemCacheForBuild: false` (Vercel restores a stale build cache), and `distDir` from `STUDIO_DIST_DIR` for radix-studio's second dev server.
 
-```ts
-export default withWikiDefaults<NextConfig>({ async redirects() { /* … */ } }, { csp });
-```
-
-`contentSecurityPolicy` starts from the policy all four origins shared line for line, and each directive passed replaces its default rather than appending, so the call site reads as the whole list. An empty list drops a directive.
+What the app sets wins, and its `headers()` follow these. `contentSecurityPolicy` starts from the shared base and each directive passed replaces its default; an empty list drops one. The default `frame-src` is `DEFAULT_IFRAME_HOSTS`, the sanitiser's default `iframeHosts`, so an embed that clears one clears the other; a site with its own hosts passes the same list to both.
 
-The default `frame-src` is `DEFAULT_IFRAME_HOSTS`, the same list the sanitiser's `iframeHosts` defaults to. The sanitiser's comment had asked every config to keep the two matched by hand, and one did not: its policy lacked the bare `youtube.com` and `youtube-nocookie.com` its sanitiser kept, so those embeds survived cleaning and then rendered blank. A site with its own host list passes it to the sanitiser and states the same hosts in its `frame-src`.
+## Pagination, versioning and rate limits
 
-## Pagination and versioning
+```ts
+import { parsePagination, paginatedResponse, listEnvelope } from 'wiki-formant/pagination';
+import { bump, parseVersion } from 'wiki-formant/versioning';
+import { limitClient, rateLimitedResponse } from 'wiki-formant/rate-limit';
 
-`parsePagination` clamps `page ≥ 1` and `pageSize` to 1–100; `paginatedResponse` always carries `totalPages`. Reshaping that response is a breaking change to every client that pages, which is why it lives here rather than being re-typed per repo.
+const { page, pageSize } = parsePagination(searchParams);            // page ≥ 1, pageSize 1–100
+return Response.json(paginatedResponse(items, total, page, pageSize)); // always carries totalPages
 
-`parseVersion` / `bump` handle revision semver tolerantly — a page always has a version, even when the column holds `null` or junk.
+bump(page.version, 'minor');                                           // tolerant of null or junk
 
-## React
+const limit = limitClient('search', request.headers, { capacity: 30, refillPerSec: 0.5 });
+if (!limit.ok) return rateLimitedResponse(limit.retryAfterSec);
+```
 
-`wiki-formant/react` is the one part that needs React, so it is the one part behind its own subpath, and React is an *optional* peer. What is shared is behaviour; every class name and icon is passed in, because these wikis style their rails differently and always will.
+- `listEnvelope` is the shape every list tool answers with, its `note` on an empty page.
+- `rateLimit` is an in-memory token bucket; `blockMs` blocks an abusive key outright across every bucket naming it. `clientIp` reads `x-real-ip` first, then the leftmost `x-forwarded-for`. `MCP_RATE_LIMIT` is the MCP servers' budget.
 
-`SidebarProvider` / `useSidebar` hold the rail's collapse state — remembered across loads, defaulted from the viewport only when the reader has never chosen. Pair it with `sidebarBootScript` from `wiki-formant/sidebar` (framework-free, so a server component can stamp it into `<head>`) or a remembered-closed rail paints open and animates shut on every load. `TableOfContents` is the "on this page" list, with scroll-spy, reading either headings you already know or the rendered article.
+## React
 
-The rail's breakpoint is necessarily known twice — `matchMedia` here, a media query in a stylesheet — because a media query cannot read a JS constant and a JS constant cannot read a media query. `base.css` holds the CSS half: with `RailShell prefix="wiki-sidebar"` inside a `.wiki-layout` beside a `.wiki-layout__main`, the rail is a sticky column from 1024px and, below it, a drawer stacked above the article that the same open/closed choice shows or removes, table of contents included. 1024 is the default `breakpoint` of `SidebarProvider` and `sidebarBootScript`, so a wiki on `base.css`'s rail passes none. It is measured: an 18rem rail, a full `--measure` of prose (63ch of Inter is 636px) and the page gutters need 972px, and 1024 is the gutter tier above that. The site supplies `--rail-top` (what the sticky rail clears), `--rail-border` (the rule beside the column, which becomes the drawer's foot) and the surface, padding and gap.
+`wiki-formant/react` carries `'use client'`. What is shared is behaviour; class names and icons are passed in.
 
-What the two halves can be stopped from doing is parting in silence. `base.css` sets `--rail-floating: 1` inside its media query, and the hook checks the two agree on every breakpoint crossing, in development, naming both sides and the number to change. A wiki that lays its rail out itself opts in the same way:
+```tsx
+import { LinkPreviewCard, SidebarProvider, RailShell, TableOfContents, useLinkPreview } from 'wiki-formant/react';
 
-```css
-@media (max-width: 767px) {          /* the edge of breakpoint={768} */
-  :root { --rail-floating: 1; }
-  .sidebar { /* … however this wiki lays its rail out */ }
+function LinkPreview() {
+  const { preview, cardProps } = useLinkPreview<Preview>({ eligible, fetch: fetchPreview, cardHeight: 200 });
+  return preview && <LinkPreviewCard {...cardProps} title={preview.title} excerpt={preview.excerpt} bannerImage={preview.bannerImage} />;
 }
 ```
 
-Without the property the check stays quiet, since a package cannot require CSS it does not ship. The mechanism is `railBreakpointMismatch` and `readRailFloating` from `wiki-formant/sidebar`, both exported, the first pure.
-
-`useTypeahead` is the search field's state machine. Five surfaces across the three wikis had three implementations and no two agreed on what a search field does; this is their union, because each had a piece the others lacked:
-
-```ts
-const { query, setQuery, items, highlight, setHighlight, onKeyDown, reset } =
-  useTypeahead({ fetch: searchPages, onPick: page => router.push(page.href) });
-```
-
-- **A request-id guard**, so a slow response cannot paint over a newer one. Two of the five surfaces had none: type fast enough and you are reading results for a query you have already replaced.
-- **Keyboard navigation.** Two surfaces had none — including the header dropdown of a wiki whose search *is* its primary navigation.
-- **Abort and a per-query cache**, which only the third had. The cache is per mount, so a stale result cannot outlive the page.
+- `SidebarProvider` / `useSidebar` hold the rail's collapse state, remembered across loads and defaulted from the viewport only when the reader never chose. Pair it with `sidebarBootScript` (`wiki-formant/sidebar`) in `<head>`, or a remembered-closed rail paints open first.
+- `RailShell` renders the rail's landmark, scroll wrapper and collapse states, and closes a mobile drawer on a followed link; mark the active link with `isRailLinkActive`. With `RailShell prefix="wiki-sidebar"` in a `.wiki-layout` beside `.wiki-layout__main`, `base.css` lays it out: a sticky column from 1024px, a drawer above the article below it. The site supplies `--rail-top`, `--rail-border` and the surface.
+- The breakpoint is known twice, in `matchMedia` and in CSS. `base.css` sets `--rail-floating: 1` inside its media query and the hook warns in development when the two disagree; a rail laid out by its own CSS sets the property the same way. `railBreakpointMismatch` and `readRailFloating` (`wiki-formant/sidebar`) are the mechanism.
+- `TableOfContents` is the "on this page" list with scroll-spy.
+- `useLinkPreview` is the hover card: one delegated listener, an intent delay, a grace period into the card, viewport clamping and a per-href cache. `LinkPreviewCard` is its markup (`link-preview-card`, `-banner`, `-body`, `-title`, `-excerpt`); a caller that must move the card passes its own `style`.
+- `useTypeahead` is the search field's state machine: a request-id guard, keyboard navigation, abort and a per-mount cache. `fetch` must be referentially stable. Its `combobox(listKey)` hands out `inputProps`, `listProps` and `optionProps(i)`, with `aria-activedescendant` omitted rather than emptied; `listKey` keeps two rendered lists' ids apart. The arithmetic is `wiki-formant/combobox`, which imports nothing.
+- `useSnapRow` is a carousel as a scroll-snapped row: `step`, `go(i)` and `at`, no markup.
+- `useClickOutside` ignores a container hidden at the current breakpoint (`offsetParent`).
+- `useUnsavedChanges(dirty)` asks before leaving and returns `confirmLeave()` for a client-side navigation; `useSaveShortcut(save)` binds ⌘S / Ctrl+S; `useSearchShortcut(open)` is "/" to search, with `focusShown(input)`.
+- `SortHeader` renders `useTableSort`'s `headerProps(key)` as a `<th aria-sort>` holding a `<button>`, the markup `sortTables` writes.
+- `useBlockOperations(blocks, setBlocks, { duplicate })` and `BlockActions` are a block list's five edits and their buttons; `useRevisionRestore(restore, { onRestored })` confirms and restores, `restoreViaPost(endpoint)` being the usual `restore`.
+- `useArticlePasses(ref, [blocks])` runs `wiki-formant/dom`'s passes and `renderMath` (KaTeX, an optional peer, loaded only when a page has `$$…$$`, `\[…\]` or `\(…\)`).
+- `<Beacon />` sends page views and outbound clicks to `wiki-formant/analytics`.
 
-`fetch` must be referentially stable; it is an effect dependency. Its `signal` is optional to implement — forward it from a REST fetcher, ignore it in a server action.
+`useClickOutside`, `useSnapRow` and the editor hooks ship no class names.
 
-`useLinkPreview` is the Wikipedia-style hover card: one delegated listener rather than a component per link, which is what makes it viable over an article holding hundreds of anchors. Two wikis had written the same ninety lines — same intent delay, same grace period for the cursor to cross into the card, same clamp arithmetic, same cache. They differed in three things, and those three are the options: which anchors are eligible, what fetches a preview, and how tall the card is.
+## Server components
 
-`useSnapRow` is a carousel as a row scrolled sideways under `scroll-snap-type: x mandatory`, so a finger swipes it with no script; AcuiQ's protocol card, which swapped one point for the next in state, could not be swiped at all. The hook is the rest: `step` for arrows and arrow keys, wrapping round at either end, `go(i)` for a dot or for opening a lightbox on the picture clicked, and `at` for the counter. It ships no markup and no class names, since miow's rows hold pictures and AcuiQ's hold whole acupoints.
+`wiki-formant/react-server`: the same React without the directive, for parts that are pure functions of their props. Each takes the router's link component, since a bare `<a>` turns every press into a full load.
 
 ```tsx
-const { ref, onScroll, at, step, go } = useSnapRow();
-<div ref={ref} onScroll={onScroll} className="row">{items}</div>
-```
-
-`useClickOutside` is fifteen lines and was in all three. Only one had the `offsetParent` check, and without it a container hidden at the current breakpoint still answers outside-clicks — so on a phone, a tap anywhere dismisses the popover the reader is looking at, because the hidden desktop copy got there first.
-
-`useUnsavedChanges(dirty)` asks before an edit with unsaved changes is left: the browser's own prompt on a reload or a closed tab, and the `confirmLeave()` it returns for a Back link or Cancel, which a client-side navigation never sends through `beforeunload`. If a save leaves by a full page load, pass false once it has landed, or the save's own exit asks. `useSaveShortcut(save)` binds ⌘S and Ctrl+S, reading `save` when the key is pressed. `useSearchShortcut(open)` is Wikipedia's "/" to search, ignored while the reader types in a field: `open` focuses the field or opens what holds it, and returns false to leave the key alone, which `focusShown(input)` does for a field hidden at this width.
-
-### The listbox contract
-
-`useTypeahead` shared the state machine across five surfaces and left the ARIA
-behind, so all five drifted into different wrongness: one put `aria-selected` on
-a plain `<button>`, which is not a role that takes it; one gave the rows
-`role="option"` and the container no `role="listbox"`, so the options had no
-owner; two had no roles at all; one used a `data-highlighted` attribute, which
-nothing reads. None of the five set `aria-activedescendant`, which is the
-attribute that announces the highlighted row as the reader arrows through it.
+import Link from 'next/link';
+import { Breadcrumbs, FacetBar, FacetSummary, InfoboxFacts, JsonLd, Pager } from 'wiki-formant/react-server';
 
-```tsx
-const { items, highlight, setHighlight, combobox } = useTypeahead({ fetch, onPick });
-const { inputProps, listProps, optionProps } = combobox();
-
-<input {...inputProps} />
-<ul {...listProps}>
-  {items.map((item, i) => (
-    <li key={item.id} {...optionProps(i)} onMouseEnter={() => setHighlight(i)}>…</li>
-  ))}
-</ul>
+<Breadcrumbs link={Link} items={tree.crumbs(path)} base={SITE_URL} />
+<FacetBar link={Link} facets={groups} letters={letters} alphaFirst />
+<Pager href={p => `?page=${p}`} page={page} total={totalPages} noun="Page" />
 ```
 
-- **`aria-activedescendant` is omitted, never emptied.** An id resolving to no
-  element is worse than no attribute: the field claims an active option and the
-  reader announces nothing.
-- **`combobox(listKey)` takes a key** because one hook often feeds two rendered
-  lists — a header with a desktop field and a mobile one puts both in the same
-  document, and a single id set duplicates every option id.
+- `FacetBar` renders `facetControls` and `alphaControls`; `letterRow`, `letterControl`, `text` and `letterCounts="title"` separate the A–Z row and let a label truncate while its count stays.
+- `Breadcrumbs` renders the trail and its `BreadcrumbList` JSON-LD together; `base` makes the URLs absolute.
+- `JsonLd` escapes every `<`, so an authored `</script>` cannot close the tag.
+- `Pager` steps by links (`href`) or buttons (`onPage`, `wrap`); a step with nowhere to go stays in place, inert. `SnapDots` are a snap row's dots.
+- `FacetSummary` is the count and Clear line under the facets; `RelatedPages` the see-also aside; `InfoboxAside` the facts landmark with its series line; `InfoboxFacts` renders `metadataRows` with `formatFactValue` as its default cell.
+- `RevisionChanges` renders `withChanges` rows; `MaintenanceQueues` renders `maintenanceQueues`; `Cite` is an article's citation in a `<details>`.
 
-The arithmetic is `wiki-formant/combobox`, which imports nothing, so the rules
-are unit-tested without a DOM.
+## Block trees
 
-`SortHeader` is the React half of `sortTables`: spread `useTableSort`'s `headerProps(key)` onto it and it renders a `<th aria-sort>` holding a `<button>`, the markup `sortTables` writes into stored tables, so one stylesheet rule draws both arrows. One of the copies it replaced put `onClick` on the cell, which no keyboard can reach.
+`wiki-formant/blocks`: the two core containers (`columns[i].blocks`, an infobox's `blocks`), the walks over them, and the core leaves' text, markdown and defaults.
 
-`useBlockOperations(blocks, setBlocks, { duplicate })` is the five list edits every block editor makes, with ref-stable callbacks, and `BlockActions` is their button bar — every button named, the moves disabled at the ends, clicks kept from bubbling into a row that selects on click. `useRevisionRestore(restore, { onRestored })` confirms, restores and reports an error; `restoreViaPost(endpoint)` is the `restore` for a wiki whose route takes `{ revisionId }`. Of the three restores it replaced, one asked no confirmation and one dropped a failure silently.
+```ts
+import { coreBlockShape, mapBlockTree, coreAtomicToMarkdown, coreBlockDefaults } from 'wiki-formant/blocks';
 
-## Server components
+export const BLOCK_SHAPE = coreBlockShape<Block>();
+mapBlockTree(blocks, processLeaf, BLOCK_SHAPE);
 
-`wiki-formant/react` carries `'use client'`, and that is a module-level boundary: anything exported from it hydrates in the consumer's tree whether or not it uses a hook. `wiki-formant/react-server` is the same React, without the directive — for the parts of a wiki that are pure functions of their props and should ship no JavaScript at all.
+switch (block.type) {
+  case 'content': case 'codeTabs': case 'banner': case 'references':
+  case 'stats': case 'linkGrid': case 'recentPages': case 'pageList':
+    return coreAtomicToMarkdown(block, { siteUrl: SITE_URL, referencesTitle: 'Sources' });
+  case 'corpusStats':
+    return block.resolvedHtml ? htmlToMarkdown(block.resolvedHtml) : '';
+}
+```
 
-`FacetBar` renders the rows `createTaxonomy` already produces. This is why the taxonomy exports a rows model rather than markup: the rows could always cross the boundary and, until this subpath existed, the markup could not, so all three wikis hand-rendered it and two put `aria-pressed` on an `<a>`. `Breadcrumbs` renders the trail and its `BreadcrumbList` JSON-LD together, because a trail whose structured data is written somewhere else is a trail that will one day disagree with its own markup — which is the case Google penalises. It takes a `base` origin: structured-data URLs must be absolute and a package cannot know the site.
-`FacetBar` takes a `count` class to render each count as its own element, and `alphaFirst` to lead with the A–Z row. A chip row above the grid and a panel beside it are the same markup laid out by different stylesheets, so the class names are what tell them apart: `letterRow`, `letterControl` and `letterControlActive` style the A–Z row apart from the facet rows (each falls back to `row`, `control` or `controlActive`); a `text` class wraps each label in its own element and gives a facet option its value as `title`, so a long value can truncate while its count stays in view; and `letterCounts="title"` keeps each letter a bare glyph with its count in the tooltip. With none of them set the markup is what it was. Its JSON-LD goes out through `JsonLd`, which is exported for every other payload a page emits: it re-encodes each `<` as `\u003c`, because these payloads carry authored titles and an authored `</script>` would otherwise close the tag.
+- The dispatch over a repo's own union stays in that repo, so a new type is a compile error there; the core bodies come from here (`coreAtomicText`, `coreAtomicToMarkdown`, `coreBlockDefaults`).
+- The core leaves are `content`, `codeTabs`, `banner`, `references`, `stats`, `linkGrid`, `testimonial`, `events`, `locations`, `recentPages`, `pageList` and `list`. `CoreLeafBlock` is their union (less the list and containers) and `CoreLeafType` its types; a wiki's atomic union is `CoreLeafBlock | ListBlock | its native types`, and a leaf added here fails to compile in every wiki until wired.
+- `coreAtomicToMarkdown` makes a resolved page's `href` absolute with `siteUrl`, since a twin is read off-site.
+- A `codeTabs` tab's `code` is source text: escaped by its view, fenced verbatim by the twin. Pass `highlighted` to the view for server-highlighted markup. `CODE_LANGS` and `DEFAULT_LANG` are the language list.
+- `recentPages`, `pageList` and `list` resolve to `ResolvedPageRef`s built with `pageRef(page, now)`.
+- `ListBlock` is the pages under a section (`source: 'under'`), the newest (`'newest'`, `count`) or chosen ones (`'chosen'`, `pages`), shown as links or cards.
+- An `events` item is `{ id, date, end?, text }`, dated to the year, month or day (`EVENT_DATE`); `splitEvents`, `eventWhen`, `eventBegun` and `eventEnded` split upcoming from past by a `day`, which the browser re-splits by the visitor's own.
+- A `testimonial` is `{ quote, author, role?, avatarUrl? }`. A `locations` item carries an address, `hours` rows of `{ days, opens, closes }` and a `timeZone`.
 
-`Pager` is the "← Previous · Page 2 of 9 · Next →" line, for paged results and for a carousel. Pass `href` and the steps are links (pair it with `paginatedResponse`'s `page` and `totalPages`); pass `onPage` and they are buttons, `wrap` stepping round from either end as a snap row does. A step with nowhere to go stays in place, inert, so the count never jumps sideways, and `spread` puts the steps at the ends of the line. `noun` names what a page is ("Point 2 of 21", "Previous point"). `SnapDots` is a snap row's dots: with `onGo` (`useSnapRow`'s `go`) each is a named button, without it they only count and are hidden from assistive technology. Three sites had written the pager by hand, each stopping at the ends differently, and two had drawn their own dots around the shared hook. `base.css` lays both out; the colours are the site's, the dots' through `--snap-dot` and `--snap-dot-on`.
+## Validation
 
-`RailShell` stays in `wiki-formant/react`, because it calls `useSidebar` and genuinely is a client component. It renders the rail's landmark, its scroll wrapper and the three collapse states — including the `--instant` class that keeps a remembered-closed rail from animating shut on first paint, and the close-on-navigate that a mobile drawer needs. Only a followed link closes it: a search field or a table-of-contents entry inside the drawer leaves it open. Compose your own rail inside it and mark the active link with `isRailLinkActive`; all three wikis do, and the pre-composed component that used to sit here had one consumer and had already lost both of those behaviours.
+`wiki-formant/validation`: the block model in one declaration, and the checks under it.
 
-`FacetSummary` is the line under the facet bar — how much of the section is showing, and a Clear link when anything is narrowed — with the filtered-empty and empty-section states. `RelatedPages` is the see-also list: a labelled `<aside>` over a `<ul>`, its heading linked to the set `rankRelated` found in common. `InfoboxAside` is the facts panel's named landmark with its "Part of a series on" line, and `InfoboxFacts` renders `metadataRows` as a row-headed table. That table was an HTML string in two wikis, injected as a fake content block; one re-escaped a `"` before each href by hand and the other did not. As React nodes there is nothing to escape. `formatFactValue` is its default cell: a date as its day, a URL or bare domain as an outbound link, `<br>`-separated values as lines.
+```ts
+import { defineBlocks, describeBlockIssues } from 'wiki-formant/validation';
+import { coreBlockDefaults } from 'wiki-formant/blocks';
 
-All three take the router's link component as a prop:
+const model = defineBlocks<Block>({
+  defaults: { ...coreBlockDefaults(), corpusStats: () => ({ type: 'corpusStats', view: 'sourceTiers' }) },
+  checks: { corpusStats: b => isCorpusView(b.view), list: (b, core) => core(b) && isSection(b.under) },
+});
+export const { shape: BLOCK_SHAPE, createBlock, duplicateBlock, validateBlocks, blockIssues } = model;
 
-```tsx
-import Link from 'next/link';
-<FacetBar link={Link} facets={facets} letters={letters} />
+const issues = blockIssues(body.content);
+if (issues.length) return errors.badRequest(`Invalid content: ${describeBlockIssues(issues)}`);
+// Invalid content: [2].columns[0].blocks[1]: malformed linkGrid block
 ```
 
-There is no `next` peer dependency here and there is not going to be one, but a rail that falls back to a bare `<a>` turns every press into a full page load — which is the whole reason a wiki has a persistent rail. So the router arrives through the door.
+- A check for a core type narrows the package's (`core` is passed in). `coreAtomicValidator` and `createBlockValidator` are the parts.
+- `MAX_BLOCK_ROWS` caps `recentPages.limit` and `pageIds`, since both end in a database `take:`; `blockLimit` is the read side.
+- `safeLinkHref` and `okUrl` are the link checks the views rely on.
 
-## AI crawlers
+## Block views
 
-Every wiki kept this roster twice — once in the proxy, keyed by user-agent, to
-count an `AI Bot Visit`; once in `robots.ts`, as the agents that get their own
-group. Both copies were byte-identical across three repos, and they were
-different lists.
+`wiki-formant/block-views`: the views of the core leaves, as client components that render server-side.
 
-```ts
-import { trackAiBot, crawlerRules } from 'wiki-formant/crawlers';
+```tsx
+import { CodeTabsView, ColumnsView, LinkGridView, PageRefsView, StatsView, EventsView, LocationsView, BannerView } from 'wiki-formant/block-views';
 
-trackAiBot(request, event, () => import('@/lib/track'));   // in proxy.ts: whether it counted
-const rules = crawlerRules({ allow: '/', disallow, aiAllow });
+case 'codeTabs': return <CodeTabsView tabs={block.tabs} />;
+case 'columns':  return <ColumnsView columns={block.columns} gap={block.gap} render={renderBlock} />;
+case 'pageList': return <PageRefsView refs={block.items} link={Link} renderItem={row} />;
 ```
 
-Only one direction of that difference was deliberate: `Applebot-Extended` never
-fetches a page, so it belongs in robots and not in the matcher. The other
-direction was not. Bytespider, CCBot, cohere-ai, Claude-Web and
-Meta-ExternalFetcher were matched by every proxy and named by no robots.txt —
-and a crawler obeys only its most-specific matching group, so an agent with no
-group of its own falls through to `*`. Three wikis were measuring five crawlers
-they had never addressed.
-
-Every agent group also allows the agent surface — `/api/mcp`, `/llms.txt`, `/openapi.json`, `/.well-known/` — without being told. `aiAllow` is what an origin serves beyond that.
-
-`crawlerRules` returns every group robots.txt needs: the wildcard, one per AI crawler, and one for each search engine. Search engines get the HTML site and none of its twins — `/*.md$` always, plus `searchDisallow` — because the `*` group keeps the machine surface open to agents, and for Google a twin is a page it already has. Two origins wrote that group by hand and the third never did, so Google crawled its twins. The `<Link>` prefetch payload (`?_rsc=`) is refused in every group.
-
-`trackAiBot(request, event, load)` counts an `AI Bot Visit` inside `event.waitUntil`: a crawler on the roster wherever it goes, and anything but a search engine that asks for what only agents read (a `.md` twin or `Accept: text/markdown`, the `llms` exports, `/openapi.json`, `/.well-known/`), since most agents are on no roster. Its user agent is kept, so `digest` can name it. `load` is a dynamic import because the tracker pulls in a database client, which a static import would load for every request the proxy sees.
+- `ColumnsView` states its gap and alignment as data attributes and an inactive code tab is `hidden`, so no view needs Tailwind to scan the package.
+- `TestimonialView` is `figure.testimonial`; pass `photo` for sized images.
+- `EventsView` sets upcoming soonest first and past latest first, with "Now on" beside one begun; `day` fills the server's split.
+- `LocationsView` draws each place's address, week (`PlaceHours`), note and map; the browser adds whether it is open by the place's clock, once a minute. `wiki-formant/hours` holds those rules (`hoursRows`, `openState`, `clock`, `hoursLd`, `mapHref`, `mapEmbed`) for a twin or structured data; a closing time at or before the opening one is the next morning, and `DEFAULT_ZONE` is `Europe/London`.
+- `BannerView` shows `BANNER_MESSAGES` (`wiki-formant/text`) unless `message` overrides it.
 
-## IndexNow
+## Text
 
-Bing, Yandex, Seznam, Naver and Yep take a POST of changed URLs instead of waiting to recrawl. The `indexnow` bin reads an origin's live sitemap and posts the rows whose `lastModified` falls inside the window, so the editor, the MCP write tools and the sweep scripts that write straight to the database are all covered with no hook in any of them. It runs where the sweeps run, never as a cron on the host: a submission costs the origin one sitemap render and no scheduled function. The sitemap must render per request. A cached one froze at the last deploy and listed none of the pages edited since, so this bin submitted nothing.
+`wiki-formant/text`: a block tree as plain prose, for an LLM export or a description.
 
-The key is public by design, since an engine checks it by fetching `/<key>.txt`. The file in the app's `public/` is the only copy, and the bin finds it there, so run it from the app's root. It checks that the live origin serves the key before posting anything.
+```ts
+import { openingText, plainText, stripHtml } from 'wiki-formant/text';
+import { describe } from 'wiki-formant/metadata';
 
-```sh
-npx indexnow https://radix.wiki              # rows modified in the last 24 hours
-npx indexnow https://radix.wiki --hours 6
-npx indexnow https://radix.wiki --all        # every row: a new origin or a new key
+const description = describe(page.metadata?.excerpt || openingText(page.content));
 ```
 
-Rows with no `lastModified` go only in a full submission. A 403 or 422 from the engine exits 1. A sitemap index is read one level down, as `check-pages` reads it.
+`openingText` is the first top-level `content` block with prose once headings are out, so a page opening on an infobox is not described by its table. `matchSnippet` is a search hit's line.
 
 ## Page metadata
 
-`wiki-formant/metadata`'s `pageMetadata` builds a page's canonical, markdown-twin alternate, Open Graph and Twitter card from one input. Next replaces those objects per route segment rather than merging them, and fills a missing twitter card from `openGraph` only when no `twitter` object was inherited — so under a layout that sets its own card, a page that sets one and forgets the other shows the layout's. Two wikis wrote a helper around that, covering different halves.
+`wiki-formant/metadata`: a page's canonical, markdown alternate, Open Graph and Twitter card from one input, and the schema.org nodes beside them.
 
 ```ts
 export const generateMetadata = () => ({
   title,
   ...pageMetadata({ title, description, url, type: 'article', image: ogImageUrl(title), siteName, handle, markdownTwin: true }),
 });
+<JsonLd data={articleLd({ headline: title, url, image, published, modified, publisher: SITE.publisher, citation: citationsFromReferences(refs) })} />
 ```
 
-The schema.org nodes sit beside it, because they state the same facts to a different reader. `articleLd` requires `image` — two of three wikis shipped articles without one while their og:image named a card — so pass it the card `pageMetadata` got. `collectionLd` is an index page over an `ItemList`, and `citationsFromReferences` turns a `references` block into `Article.citation`.
-
-```tsx
-<JsonLd data={articleLd({ headline: title, url, image, published, modified, publisher: { '@id': `${SITE_URL}/#organization` }, citation: citationsFromReferences(refs) })} />
-```
-
-`questionPairs(html)` reads a page's FAQ out of its own headings: every `h2`/`h3` ending in `?`, answered by the text beneath it. It never rewrites a statement heading as a question, so a page earns `FAQPage` by being written as one. `faqPageLd(pairs, url)` is that node, or null under two pairs, and takes an authored list just as well.
-
-```tsx
-const faq = faqPageLd(questionPairs(html), url);
-{faq && <JsonLd data={faq} />}
-```
-
-`describe(text)` is a page's meta description from any prose, HTML, markdown or plain: tags, entities, link targets and bare URLs go, and the rest fits `DESCRIPTION_LIMIT` (160) as whole sentences where they fill half of it, else cut at a word with an ellipsis. Four sites had four rules, one cutting mid-word at 150 and one slicing at 160 with no mark. `openingText(blocks)` (`wiki-formant/text`) is what a page without an excerpt is described by: its first top-level `content` block with prose once the headings are out, since a page that opens with an infobox would otherwise be described by its metadata table.
-
-```ts
-const description = describe(page.metadata?.excerpt || openingText(page.content));
-```
-
-`sitePageMetadata({ siteName, handle })` binds the three fields Next drops from every page that sets its own card, with `locale` defaulting to `en_US`. `siteGraphLd` is the Organization, WebSite (with its `SearchAction`) and `WebAPI` as one `@graph` for the root layout, every node carrying an `@id`, and `siteRefs(url)` hands out the same ids for a page's `publisher` and `isPartOf` — so no page writes an inline copy of the publisher that can disagree with the layout's.
-
-```ts
-export const card = sitePageMetadata({ siteName: SITE_NAME, handle: '@example' });
-export const SITE = siteRefs(SITE_URL);
-<JsonLd data={siteGraphLd({ name, url: SITE_URL, logo, sameAs, searchUrl, api })} />
-```
+- Next replaces `openGraph` and `twitter` per segment rather than merging, so `pageMetadata` sets both; `sitePageMetadata({ siteName, handle })` binds the fields every page's card needs.
+- `articleLd` requires `image`. `collectionLd` is an index over an `ItemList`. `siteGraphLd` is the Organization, WebSite and `WebAPI` `@graph` for the root layout, and `siteRefs(url)` hands out the same `@id`s for a page's `publisher` and `isPartOf`.
+- `questionPairs(html)` reads a FAQ from headings ending in `?`; `faqPageLd(pairs, url)` is null under two pairs.
+- `describe(text)` is a meta description from any prose within `DESCRIPTION_LIMIT` (160): whole sentences where they fill half, else cut at a word with an ellipsis.
 
 ## Social cards
 
-`wiki-formant/og` is the card at `/og`, as the element `next/og`'s `ImageResponse` takes. `SocialCard` is the frame: an eyebrow, a title fitted with `describe`, anything under it, then the description and the site's mark along the foot, bottom-aligned on a 1200×630 field. The field and the art are arguments, because they were all that differed: two wikis had each written the same seeded gradient with translucent circles, which is `bubbles(rand, { field, colors })`, and a third draws its own art and passes it as `art`. `cardRandom(...text)` seeds either from the page, so one page always draws the same card. `OG_SIZE` and `OG_HEADERS` (a day at the CDN, a week stale) go on the response.
+`wiki-formant/og`: the `/og` card, as the element `next/og`'s `ImageResponse` takes.
 
 ```tsx
-const rand = cardRandom(title, eyebrow);
-const { background, art } = bubbles(rand, { field: [BG, NAVY], colors: [GREEN, ORANGE] });
-return new ImageResponse(<SocialCard {...{ title, eyebrow, description, background, art }} mark="example.org" colors={{ text, muted, accent }} fontFamily="Inter" />, { ...OG_SIZE, headers: OG_HEADERS, fonts: await fonts });
-```
-
-Fonts stay with the site: Next traces a font file into the function only from a literal path in the app's own code, and satori reads TTF or OTF, never the woff2 `next/font` serves. The frame never sets a style key to `undefined`, which satori throws on rather than skipping; `scrim` darkens the foot for art that is a photograph.
+import { SocialCard, bannerField, bubbles, cardRandom, OG_SIZE, OG_HEADERS } from 'wiki-formant/og';
 
-**A page's banner is its card.** The generated field exists so a page with no banner still unfurls with something; it never stands in for a banner the page has. Every route picks the same way, and every page's metadata passes its banner to the card URL, the homepage and category hubs included:
-
-```tsx
 const field = (await bannerField(searchParams.get('banner'), /\.public\.blob\.vercel-storage\.com$/))
-  ?? bubbles(cardRandom(title), { field, colors });
-return new ImageResponse(<SocialCard {...{ title, description }} {...field} colors={colors} />, { ...OG_SIZE, headers: OG_HEADERS });
-```
-
-`bannerField` fetches the banner only from the hosts you name, so `/og` is no proxy to any URL a caller writes, crops it to cover the card, inlines it as PNG (satori decodes no WebP or AVIF) and turns the scrim on. A missing, foreign or undecodable banner returns null and the generated field draws instead. It loads `sharp`, an optional peer, so the route runs on Node.
-
-## Revisions
-
-What changed between two versions of a page, and therefore which semver bump to
-ask for. Both wikis had written it and `extractBlocks` was byte-identical
-between the copies; they differed only in what each had learned since.
-
-```ts
-const diff = computeRevisionDiff({
-  currentVersion: page.version,
-  oldContent, newContent, oldTitle, newTitle,
-  // containers: defaults to coreBlockGroups — `columns.i.blocks` and an infobox's `blocks`
-});
+  ?? bubbles(cardRandom(title), { field: [BG, NAVY], colors: [GREEN, ORANGE] });
+return new ImageResponse(<SocialCard {...{ title, eyebrow, description }} {...field} mark="example.org" colors={colors} fontFamily="Inter" />, { ...OG_SIZE, headers: OG_HEADERS, fonts });
 ```
 
-- **Blocks match by id**, so a block that moved is one `moved` and not a removal
-  plus an addition.
-- **Container keys are never diffed as attributes.** They are walked as their own
-  entries, and comparing them here would report an infobox as edited every time
-  anything inside it changed — turning a prose edit into a structural bump.
-- **The path segment is part of the contract**, because `root.1.columns.0.blocks.2`
-  is what a reviewing UI anchors on. A wiki with a container beyond the core two
-  passes its own `containers` and says how it is addressed.
+- A page's banner is its card; the generated field is for a page without one. `bannerField` fetches only from the hosts named, crops, inlines PNG and turns the scrim on, or returns null. It loads `sharp`.
+- Fonts stay with the site: Next traces a font file only from a literal path in the app, and satori reads TTF or OTF.
+- `wiki-formant/seeded`'s `hashStr` and `seededRandom` are the deterministic randomness the art draws from, identical on server and browser.
 
-One copy also built two Maps keyed by a recursive `JSON.stringify` of every
-block, on every save, and never read either one. Matching is by id and always
-was. That half is not here.
+## Revisions and history
 
-## History
-
-What each revision changed, as a history view shows it. `revisions` stays free
-of dependencies because every save imports it; this is the reading half, and it
-needs `fast-diff`.
+`wiki-formant/revisions`: what changed between two versions of a page, and which bump to ask for. `wiki-formant/history`: what each revision changed, as a history view shows it.
 
 ```tsx
+import { computeRevisionDiff } from 'wiki-formant/revisions';
 import { withChanges } from 'wiki-formant/history';
-import { RevisionChanges } from 'wiki-formant/react-server';
 
-const rows = withChanges(revisionsNewestFirst); // each row needs its `content`
+const diff = computeRevisionDiff({ currentVersion: page.version, oldContent, newContent, oldTitle, newTitle });
+const rows = withChanges(revisionsNewestFirst);   // each row needs its `content`; it leaves without it
 <RevisionChanges changes={rows[0].changes} label={type => BLOCK_LABELS[type]} />
 ```
 
-- **Diffed on the server, from stored content.** radix-wiki used to send both
-  HTML bodies of every modified block to the browser and diff them there: 887 KB
-  of payload for a 13-revision page whose drawn diffs came to 25 KB. A row
-  leaves `withChanges` without its content.
-- **Words, not letters.** Semantic cleanup is on, so a rewritten sentence reads
-  as the old words struck and the new ones added.
-- **Leaves only.** A container's own entry restates its children. A leaf whose
-  type changed is a replacement and gets no text diff. `leafText` names the prose
-  field of a block beyond the core `content` one.
-- **A window diffs against what precedes it.** The oldest row is diffed against
-  an empty page, so fetch one revision more than you show and drop the last row.
-
-`RevisionChanges` marks struck and added text as `<del>` and `<ins>` and keys
-each change on `data-action`; `base.css` only resets the list.
+- Blocks match by id, so a moved block is one `moved`. Container keys are walked as their own entries, never diffed as attributes. A path like `root.1.columns.0.blocks.2` is part of the contract; pass `containers` beyond the core two.
+- `withChanges` diffs on the server, by words, leaves only. The oldest row is diffed against an empty page, so fetch one more than you show.
 
-## Feeds
-
-Three repos, four feeds, 47 of 64 significant lines identical — including,
-verbatim in two of them, the comment explaining why the apostrophe escapes
-numerically. `feedResponse` is the union.
+## Feeds and sitemaps
 
 ```ts
-export const GET = async (request: Request) => feedResponse(request, channel, await items());
-```
-
-`feedResponse` renders the channel and answers a conditional GET: the ETag is the XML's own, Last-Modified the build date. All four feeds used to return the XML bare, so a poller could never be told the channel was unchanged.
-
-**`lastBuildDate` comes from the newest item, not the clock.** One copy stamped
-`new Date()` on every request, telling every poller the feed had changed when it
-had not — the recrawl the conditional-GET helpers exist to prevent. An empty feed
-carries no build date rather than a fictional one.
+import { feedResponse } from 'wiki-formant/feed';
+import { treeSitemap, tagPrefixes } from 'wiki-formant/sitemap';
 
-## Sitemaps
-
-`treeSitemap(pages, { sections, sectionRow, pageRow })` returns the rows a wiki's tree adds to its sitemap: a row per section, dated by the newest page at or beneath it, then a row per page, dated by its own `updatedAt`. All three wikis listed their sections, and each dated them differently. One used the newest page beneath, one did the same from a derived tree, and one used no date at all. A section with no page beneath it carries no date rather than an invented one.
+export const GET = async (request: Request) => feedResponse(request, channel, await items());
 
-```ts
 ...treeSitemap(pages, {
   sections: tagPrefixes(pages.map(p => p.tagPath)),
   sectionRow: path => ({ url: `${SITE_URL}/wiki/${path}`, changeFrequency: 'weekly', priority: 0.6 }),
@@ -677,147 +494,117 @@ carries no build date rather than a fictional one.
 }),
 ```
 
-Every URL appears once. An empty-slug page is its section's own article, so it dates the section and gets no row of its own. A section whose URL a page already holds is served as that page, so the section row is dropped. `tagPrefixes` lists every path at or above the given ones, for a wiki whose sections are wherever its pages sit rather than a configured list. Which sections exist, the URLs, and each row's frequency and priority stay with the caller.
-
-## Licence declarations
-
+- `feedResponse` answers a conditional GET; `lastBuildDate` is the newest item's date, and an empty feed carries none.
+- A section is dated by the newest page at or beneath it, or not at all. Every URL appears once: an empty-slug page dates its section and gets no row.
 
-S10 wants a licence on every surface, and each repo satisfied that by writing the
-same block again. What is genuinely per-project is the *scope* — which half of a
-site the grant covers and what it excludes — so that is the parameter.
+## Licences and the X account
 
 ```ts
+import { ccBy40, licenseBlock, openApiLicense } from 'wiki-formant/license';
+import { xAccount, followLines, followNote, followLinkProps } from 'wiki-formant/social';
+
 const license = ccBy40({ siteName: 'AcuiQ', siteUrl: SITE_URL });
 const block = licenseBlock({ license, scope: 'The protocol compilation and prose', excludes });
-```
-
-The same `License` goes to `agentCard({ license, licenseScope })` and to `openApiLicense(license)` for a spec's `info.license`. The three cards and three specs here had each projected it differently, one from a hand-typed name.
-
-## The X account
-
-A site names its X account in five places: the footer link, the JSON-LD `sameAs`, llms.txt, AGENTS.md and the MCP `initialize` instructions. Written by hand, one repo's `sameAs` still pointed at twitter.com, and only one site told an agent the account existed. `wiki-formant/social` builds all five from the handle and a fragment saying what the account posts.
-
-```ts
 export const X = xAccount({ siteName: 'AcuiQ', handle: '@acu_iq', posts: "a named trial's prescription with its citation" });
 ```
 
-`X.url` goes to `sameAs`, `X.handle` to `sitePageMetadata`, `followLines(X)` into llms.txt and AGENTS.md, and `followNote(X)` into the MCP instructions. The note tells an agent to give the link to the person it is helping, since an agent cannot follow an account. The footer is `<a {...followLinkProps(X)}>{X.label}</a>`, whose `rel="me"` confirms the `sameAs` claim from the page the account points back at.
+- One `License` goes to `licenseBlock`, `agentCard({ license, licenseScope })` and `openApiLicense` for `info.license`.
+- `X.url` is the `sameAs`, `X.handle` the card's, `followLines(X)` goes into llms.txt and AGENTS.md, `followNote(X)` into the MCP instructions, and `<a {...followLinkProps(X)}>` is the footer link with `rel="me"`.
 
-## Rendered-article passes
+## Agent descriptors
 
-`wiki-formant/dom` holds what runs against an article element after it is in the document. Not React, so not in `react.tsx`.
+`wiki-formant/well-known`: the A2A agent card, the MCP manifest and server card, and the registry's domain proof.
 
 ```ts
-addCopyButtons(el);            // every <pre> gets one, once
-sortTables(el);                // every column-headed table sorts by its headers
-hydrateTweetEmbeds(el);        // placeholders get a live src
-const off = onTweetResize((h, source) => sizeTweetEmbed(el, h, source));
-```
-
-`addCopyButton` was **byte-identical** in two BlockRenderers, down to the SVG path data. Its idempotence guard now lives inside the function rather than in a `pre:not(:has(…))` at the call site, where it can be — and was — retyped.
-
-In React, `useArticlePasses(ref, [blocks])` (`wiki-formant/react`) runs them all, the embed pair included, and typesets maths: `renderMath` (also `wiki-formant/react`, since its stylesheet import cannot sit in a module server code reaches) sets `$$…$$` and `\[…\]` as a display and `\(…\)` inline. KaTeX is an optional peer: an app installs `katex`, and a page with no delimiter never fetches it. There is no single-`$` delimiter, since prose writes $XRD. Three renderers had the effect written out and disagreed on its dependencies: two ran once on mount, so a page swapped in without a remount kept its old tables unsortable.
-
-`activateTabGroups` turns stored `[data-tabs]` markup into a working tab group. The editor persists tabs as nested divs, which is the right thing to store — it survives a markdown twin, a plain HTML render and a reader with JavaScript off, all of which show every tab in order. Making one of them pressable is a reader-side job, and it sits beside the other passes rather than inside a component.
+import { agentCard, mcpManifest, skillsFromTools, wellKnownHandler, serverCardHandler } from 'wiki-formant/well-known';
 
-`sortTables` makes the tables stored in article HTML sortable by their headers. They arrive as a string a `dangerouslySetInnerHTML` wrote, so React never sees their rows and cannot sort them. A column is dates if every filled cell starts with one, numbers if every one does, and text otherwise — one stray value makes the whole column text, which beats sorting half of it by one rule and half by another. A third press restores the author's order, which is often chronological or ranked and otherwise needs a reload. Label/value tables and tables with merged cells are left alone. The markup it writes — `aria-sort` on the cell, a `.sort-header` button inside it — is the markup a React sortable header should write too, so both kinds of table draw their arrows from one stylesheet rule.
-
-`scrollTables(html)` is the one table pass that runs on the string, before render: it wraps each stored table in a `.table-scroll` box, and `base.css` lets that box scroll sideways. A table box ignores `overflow`, so a table with an address or a URL in a cell is as wide as that token whatever its column, and a scroll box added by an effect would arrive after the table had already been laid out too wide. Call it on the render path beside `injectHeadingIds`. A table already in a box keeps it, so it is safe on HTML that has been through it once. `articleHtml(html, { used, slug, anchor, links })` (`wiki-formant/headings`) is that chain: heading ids, the scroll boxes, and, given `links`, `normaliseLinks`.
-
-The embed's origin is written down once. It is both the embed host and the allow-list `onTweetResize` checks before believing a posted height, and it had been spelled out at four call sites across two repos. Any page can `postMessage`; only the embed host may size the embed. Every embed on a page posts to the same listener, so `onTweetResize` hands over the window that posted, and `sizeTweetEmbed` sizes only that one's iframe: two posts on a page had both been drawn at whichever height arrived last.
-
-## Search
+const AGENT_CARD = agentCard({ name, description, url: `${SITE_URL}/api/mcp`, version, skills: skillsFromTools(TOOLS), license });
+// src/app/.well-known/[doc]/route.ts
+export const GET = wellKnownHandler({ agentCard: AGENT_CARD, mcpManifest: mcpManifest({ … }), openapi: SPEC });
+```
 
-`proseSql`, `HEADLINE_OPTIONS` and `FTS_RANK_NORMALIZATION` are what a literal tier and a full-text tier must agree on. `searchTsvDdl(table)` is the statements that build the generated `search_tsv` column and its index — dropped and re-added in one transaction every run, because a skip-if-present script is blind to a changed expression.
+The card is served identically at `agent-card.json` and `agent.json`, and its `url` is the MCP endpoint, which answers A2A. `registryAuthHandler` serves `MCP_REGISTRY_PUBLIC_KEY` at `/.well-known/mcp-registry-auth`, 404 when unset.
 
-## Block trees
+## AI crawlers
 
-Every wiki here stores the same two containers the same way — `columns[i].blocks` and an infobox's `blocks` — and between them had hand-written that walk seven times. Bind it once and hand it to every walk:
+`wiki-formant/crawlers`: one roster of AI crawlers, for the proxy that counts them and the robots.txt that addresses them.
 
 ```ts
-import { coreBlockShape, leafBlocks, mapBlockTree } from 'wiki-formant/blocks';
+import { trackAiBot, crawlerRules } from 'wiki-formant/crawlers';
 
-export const BLOCK_SHAPE = coreBlockShape<Block>();
-mapBlockTree(blocks, processLeaf, BLOCK_SHAPE);
-leafBlocks(blocks, BLOCK_SHAPE.containers);
+trackAiBot(request, event, () => import('@/lib/track'));   // in proxy.ts
+const rules = crawlerRules({ allow: '/', disallow, aiAllow });
 ```
 
-`computeRevisionDiff` defaults to the same shape, path-addressed, so a repo whose containers are the core two passes none.
+- Every agent group allows `AGENT_SURFACE_PATHS` (`/api/mcp`, `/llms.txt`, `/openapi.json`, `/.well-known/`); `aiAllow` adds the origin's own.
+- Search engines get the HTML site and no twins (`/*.md$`, plus `searchDisallow`). The `?_rsc=` prefetch payload is refused in every group.
+- `trackAiBot` counts a rostered crawler anywhere, and anything but a search engine asking for what only agents read. `load` is a dynamic import so the proxy does not load a database client.
 
-The dispatch over a repo's own block union stays in that repo; the bodies come from here. `coreAtomicText` has a prose body for every core leaf — the stats, link-grid and page-list bodies joined the originals when two of the three wikis turned out to extract nothing from them, so their MCP `get_page` answered a hub page as nearly empty.
+## Rendered-article passes
 
-The core leaves — `content`, `codeTabs`, `banner`, `references`, `stats`, `linkGrid`, `testimonial`, `events`, `locations`, `recentPages`, `pageList`, and `list`, which does what the two page lists do between them — had the same case bodies in every wiki's text export, markdown twin, validator and new-block record. A repo's switch hands those cases over and keeps its own, so it stays exhaustive over its union:
+`wiki-formant/dom`: what runs against an article element once it is in the document.
 
 ```ts
-import { coreAtomicText, coreAtomicToMarkdown, coreBlockDefaults } from 'wiki-formant/blocks';
-import { coreAtomicValidator } from 'wiki-formant/validation';
-
-switch (block.type) {
-  case 'content': case 'codeTabs': case 'banner': case 'references':
-  case 'stats': case 'linkGrid': case 'recentPages': case 'pageList':
-    return coreAtomicToMarkdown(block, { siteUrl: SITE_URL, referencesTitle: 'Sources' });
-  case 'corpusStats':
-    return block.resolvedHtml ? htmlToMarkdown(block.resolvedHtml) : '';
-}
+import { addCopyButtons, sortTables, activateTabGroups, hydrateTweetEmbeds, onTweetResize, sizeTweetEmbed } from 'wiki-formant/dom';
 
-const BLOCK_DEFAULTS = { ...coreBlockDefaults({ stats }), daoTimeline: () => ({ type: 'daoTimeline', limit: 25 }) };
-const core = coreAtomicValidator({ pageId: id => /^\d{1,9}$/.test(id) });
-// validateAtomic: b => { switch (b.type) { case 'daoTimeline': …; default: return core(b); } }
+addCopyButtons(el);
+sortTables(el);
+activateTabGroups(el);
+hydrateTweetEmbeds(el);
+const off = onTweetResize((h, source) => sizeTweetEmbed(el, h, source));
 ```
 
-`coreAtomicToMarkdown` joins a resolved page's site-relative `href` to `siteUrl`, because a twin is read off-site; a wiki whose lists hold its own page rows keeps those two cases. `coreAtomicValidator` caps `recentPages.limit` and `pageIds` at `MAX_BLOCK_ROWS`, a whole number of rows, because both end in a database `take:`; `blockLimit` is the same bound on the read side.
+- Each pass is idempotent.
+- `sortTables` sorts a column as dates, numbers or text (one stray value makes it text), restores the author's order on a third press, and leaves label/value and merged-cell tables alone.
+- `activateTabGroups` makes stored `[data-tabs]` markup a working tab group; without script every tab shows in order.
+- `onTweetResize` believes only the embed host and hands over the posting window, so `sizeTweetEmbed` sizes that iframe alone.
+- `scrollTables(html)` (`wiki-formant/headings`) wraps each table in a `.table-scroll` box on the string, before layout.
+- `track(name, props)` sends a browser event to the analytics beacon.
 
-`defineBlocks` (in `wiki-formant/validation`) is the whole model in one declaration: the shape, the types, `createBlock`, `duplicateBlock`, `validateBlocks` and `blockIssues`, from a record of defaults and the wiki's own leaf checks. A check for a core type narrows the package's: `list: (b, core) => core(b) && isSection(b.under)`. `BlockTree<Atomic>` is the union over the two containers.
-
-```ts
-const model = defineBlocks<Block>({ defaults: { ...coreBlockDefaults(), corpusStats: () => ({ type: 'corpusStats', view: 'sourceTiers' }) }, checks: { corpusStats: b => isCorpusView(b.view) } });
-export const { shape: BLOCK_SHAPE, createBlock, duplicateBlock, validateBlocks, blockIssues } = model;
-```
+## Search
 
-`createBlockValidator` returns `blockIssues` beside the boolean validators: the same walk, reporting where each failure is.
+`wiki-formant/search`: what a literal tier and a full-text tier must agree on: `proseSql`, `HEADLINE_OPTIONS`, `FTS_RANK_NORMALIZATION`, and `searchTsvDdl(table)`, the statements that drop and re-add the generated `search_tsv` column and its index in one transaction.
 
 ```ts
-const issues = blockIssues(body.content);
-if (issues.length) return badRequest(`Invalid content: ${describeBlockIssues(issues)}`);
-// Invalid content: [2].columns[0].blocks[1]: malformed linkGrid block
+const { column, index } = searchTsvDdl('"WikiPage"');
 ```
 
-A `codeTabs` tab's `code` is source text in every wiki here, and every view treats it that way: `CodeTabsView` escapes it into a `<pre><code>`, the sanitiser leaves it alone, the markdown twin fences it verbatim. A wiki that escapes and highlights on the server passes `highlighted` to the view. The package used to assume editors stored highlighted markup; none ever had, and every twin printed `Vec<u8>` as `Vec`.
-
-`recentPages`, `pageList` and a `list` resolve to `ResolvedPageRef`s — build each with `pageRef(page, now)`, which carries the ISO date a `<time>` needs — and `PageRefsView` renders them as a list, with a `renderItem` slot for a wiki that has its own row.
-
-## Dates
+## Dates, freshness and the maintenance queues
 
-`relativeTime(then, now, { style })` is `compact` (`3h`), `short` (`3h ago`) or `long` (`3 days ago`, day-grained for pages cached for hours), with `absoluteAfterDays` to hand over to the date itself. `now` is always passed in, never read, so a server render and its hydration agree. `formatDay` is always UTC: a stored day formatted in the server's zone, or the browser's, is the previous day for half the world. It reads `en-US` unless given a `locale`: `formatDay(day, { locale: 'en-GB', month: 'long' })` is `19 September 2026`. Both are in `wiki-formant/freshness`, with `isoDate`.
+`wiki-formant/freshness` and `wiki-formant/queues`.
 
-## Freshness and the maintenance queues
-
-`freshnessBanner(page, nowMs, { maxAgeDays, against })` is the synthetic `outdated` banner a page carries once it has gone unchecked for `maxAgeDays` (180), or null. Its notice asks the reader to re-check the facts against `current sources`; the two Radix wikis pass `against: 'current sources and the live ledger'`, which a shop's wiki has no use for.
+```ts
+import { relativeTime, formatDay, freshnessBanner } from 'wiki-formant/freshness';
+import { maintenanceQueues } from 'wiki-formant/queues';
 
-`wiki-formant/queues` gathers the signals each page shows into Wikipedia's tracking categories: `maintenanceQueues(pages, { href, required, nowMs, verify, listedIds })` returns the outdated, orphaned, unsourced and missing-facts queues, empty ones dropped, from one pass over the pages' content. Pass every page but the home page and the back office, since an orphan is a page no other page links to. `href` is a page's address as its links name it, `required` the facts its category requires, `verify` how a page is stamped as checked here (it closes the outdated queue's sentence), and `listedIds` the ids a list block names its pages by. `MaintenanceQueues` (`wiki-formant/react-server`) draws them, a heading and a count each, under classes `maintenance-*`; the page around them is the wiki's, `noindex`. All four apps serve one at `/maintenance` (on miow, the owner page).
+relativeTime(then, now, { style: 'short' });        // '3h ago'; `now` is always passed in
+formatDay(day, { locale: 'en-GB', month: 'long' }); // '19 September 2026', always UTC
+const banner = freshnessBanner(page, Date.now(), { against: 'current sources and the live ledger' });
+const queues = maintenanceQueues(pages, { href, required, nowMs, verify, listedIds });
+```
 
-`Cite` (`wiki-formant/react-server`) is "Cite" in an article's meta line, a `<details>` opening on `citation({ publisher, title, date, url })`: `AcuiQ. "Point codes." October 2, 2026. https://…`.
+- `freshnessBanner` is the `outdated` banner once a page goes unchecked for `maxAgeDays` (180), or null.
+- `maintenanceQueues` returns the outdated, orphaned, unsourced and missing-facts queues, empty ones dropped. Pass every page but the home page and the back office. `MaintenanceQueues` draws them on a `noindex` page.
+- `citation({ publisher, title, date, url })` (`wiki-formant/react-server`) is the line `Cite` shows.
 
 ## Sanitising stored HTML
 
-`wiki-formant/sanitize` is the allowlist between an author's saved HTML and a reader's browser. The block views render four HTML fields themselves — `linkGrid` descriptions, `references` and `events` text, and a place's note — and a repo renders `content.text` beside them, so the guard ships with the renderer. `codeTabs` is not one of them: its code is source. Run it server-side, on the render path, so it covers rows written before it existed and no sanitiser ships to the client.
+`wiki-formant/sanitize`: the allowlist between saved HTML and a reader's browser. Run it server-side on the render path.
 
 ```ts
 import { createHtmlSanitizer, sanitizeCoreLeaf } from 'wiki-formant/sanitize';
 
-const clean = createHtmlSanitizer({ iframeHosts: FRAME_HOSTS });   // and the same hosts in the CSP's frame-src
+const clean = createHtmlSanitizer({ iframeHosts: FRAME_HOSTS });   // the same hosts in the CSP's frame-src
 const safe = mapBlockTree(blocks, b => sanitizeCoreLeaf(b, clean), BLOCK_SHAPE);
 ```
 
-The default list is derived from what the editor nodes in `wiki-formant/tiptap` store — the embed wrappers' data attributes, the tab markup `activateTabGroups` reads back, the table classes — plus the presentational SVG subset the infographics pipeline embeds. Extend it with `tags`, `attributes`, `classes` and `schemesByTag` derived from your stored HTML, never from memory: a list written from memory erases content on the first render.
-
-A YouTube iframe comes out as the `YouTube` node's markup, `<div data-youtube-video><iframe …></iframe></div>`, whoever wrote it: an agent, an import, a pasted embed code. The editor then opens it as that node, and `base.css` draws it as the same full-width 16:9 player as one the editor wrote, as it does a map embed. Two wikis had drawn that player in their own stylesheets and a third drew any iframe its own way; spacing, corners, borders and the editor's selection ring stay the site's.
-
-Classes pass by name only. Limiting `style` to layout and paint is worth nothing while `class` is free, because every site's own stylesheet ships `fixed inset-0 z-50`, and those draw a fake prompt over the chrome as well as `position` does.
+- The default list is what `wiki-formant/tiptap`'s nodes store plus a presentational SVG subset. Extend `tags`, `attributes`, `classes` and `schemesByTag` from your stored HTML, never from memory.
+- A YouTube iframe comes out as the `YouTube` node's markup, whoever wrote it, and `base.css` draws it as a 16:9 player.
+- Classes pass by name only, since a site's own utilities can draw over the chrome.
 
 ## Image uploads
 
-`wiki-formant/upload` is the route an editor's image upload posts to. Two wikis had written it and their limits had drifted: one took 25 MB with no cap on decoded pixels and trusted the Content-Type the client sent, the other 4 MB, 40 megapixels and the file's own leading bytes. These are the second one's defaults.
+`wiki-formant/upload`: the route an editor's image upload posts to.
 
 ```ts
 // src/app/api/upload/route.ts
@@ -828,62 +615,67 @@ export const POST = uploadHandler({
 });
 ```
 
-The bytes say what the file is, never the name or type, and SVG is refused. Every image is re-encoded, upright, so nothing from the source's metadata is kept, a phone's GPS position included; the bytes as sent are never stored. `encode` is the re-encode, the sniffed format by default; a wiki with an image standard resizes and converts there. Each uploader has a budget keyed on `authorize`'s id and address, and each address one of its own, so an id minted fresh per burst (a self-signed wallet) refills nothing. `maxBytes`, `maxPixels` and `rateLimit` take other limits, and `store` replaces Vercel Blob. `sharp` and `@vercel/blob` are optional peers. `normalizeImage(bytes, { maxPixels, encode })` is the same sniff, cap and re-encode without the route, for images that arrive another way – a server action, or a picture copied in from another site; it resolves to `{ buffer, format, contentType }` and throws a message fit to show the uploader.
+- The file's own bytes say what it is; SVG is refused. Every image is re-encoded upright, so no source metadata (GPS included) is kept. Defaults: 4 MB, 40 megapixels.
+- Each uploader has a budget on `authorize`'s id and address, and each address its own.
+- `encode`, `maxBytes`, `maxPixels`, `rateLimit` and `store` (Vercel Blob by default) are options. `normalizeImage(bytes, opts)` is the sniff, cap and re-encode without the route.
 
-## Editor nodes
+## Maps
 
-`wiki-formant/tiptap` carries the custom nodes both wiki editors had written twice: `Iframe`, `YouTube` (the stock extension plus the paste rule it does not ship with), `TwitterEmbed`, `createMapEmbed`, `createCodeBlock` and `createTabs`. `embedNodes({ resolveMapUrl })` is the first four as one list, which an editor puts in its `nodes`: a pasted YouTube, X or map link becomes its player as it lands, and the toolbar's embed prompt has a node for every link it recognises. `resolveMapUrl` defaults to `wiki-formant/maps`', through `/api/resolve-map`. `Iframe` and `createMapEmbed` draw a frame only for an https src on `DEFAULT_IFRAME_HOSTS` (`embedSrc`), since an editor draws stored HTML where its author is signed in, and a `javascript:` src runs there under any CSP that allows inline script.
+`wiki-formant/maps`: a pasted Google or Apple Maps URL as one an `<iframe>` accepts.
 
 ```ts
-const CodeBlock = createCodeBlock({
-  classNames: { button: 'lang-btn', option: 'lang-option', optionActive: 'text-accent' },
-  icons: { chevron: open => <ChevronDown className={open ? 'rotate-180' : ''} /> },
-});
+import { toMapEmbedUrl, resolveMapHandler } from 'wiki-formant/maps';
+
+toMapEmbedUrl('https://maps.apple.com/?ll=51.5,-0.12');
+export const GET = resolveMapHandler({ authorize: async () => !!(await currentUser()) });   // /api/resolve-map
 ```
 
-The language list defaults to `CODE_LANGS` and `DEFAULT_LANG` from `wiki-formant/blocks`, which two wikis had typed identically; a wiki with its own passes `langs` and `defaultLang`. The ones that take config take it because that is exactly where the two copies differed — class tokens, the language list, and the API route a shortened map URL has to be resolved through. Injecting them is what lets one wiki keep `text-jupiter` and the other `text-accent` without either forking the node, and it keeps this file from dragging an icon library in behind it.
+A short link resolves through the wiki's own route (`resolveMapUrl` is the client half): exact shortener hosts, one hop, an allowlisted landing host, a timeout and your sign-in check.
+
+## Editor nodes
+
+`wiki-formant/tiptap`: the custom nodes: `Iframe`, `YouTube` (with its paste rule), `TwitterEmbed`, `createMapEmbed`, `createCodeBlock`, `createTabs` and `createHeadingIds`.
+
+```ts
+import { embedNodes, createCodeBlock, createTabs, createHeadingIds } from 'wiki-formant/tiptap';
+
+const { TabGroup, TabItem } = createTabs();
+const nodes = [...embedNodes({ resolveMapUrl }), createCodeBlock({ classNames, icons }), TabGroup, TabItem, createHeadingIds({ slug })];
+```
 
-Both node views draw in default classes (`code-block…`, `tabs-editor`, `tab-button`…) that `base.css` styles plainly enough for any site, the editor's rule showing the tab the writer picked included; pass `classNames` and `icons` to draw them your own way. `createTabs` returns `TabGroup` and `TabItem` together: `tabGroup`'s content expression is `tabItem+`, so registering one without the other leaves a node type the schema cannot satisfy. A pasted short map link inserts immediately with `about:blank` and swaps its `src` when the redirect resolves — pasting must not block on a network hop, and the node has to exist for the reader to see anything happen.
+- `embedNodes` turns a pasted YouTube, X or map link into its player. `Iframe` and the map node draw only an https src on `DEFAULT_IFRAME_HOSTS` (`embedSrc`), since the editor draws stored HTML where its author is signed in.
+- The node views draw in default classes `base.css` styles; `classNames` and `icons` replace them.
+- `createTabs` returns both nodes, since one is unsatisfiable without the other. A short map link inserts at once and swaps its `src` when it resolves.
+- `createHeadingIds` gives each heading the id its published copy will carry.
 
-`createHeadingIds({ slug })` decorates each heading in the editor with the id its published copy will carry, through `uniqueHeadingId` — the dedupe `injectHeadingIds` uses — so a rail listing headings mid-edit links to the anchors readers will get. `uploadImageTo('/api/upload')` is the `uploadImage` two editors had written identically.
+## Editor
 
-`WikiToolbar` shows what the editor can do and nothing else: each command whose node, mark or command the editor's extensions include, so an app's buttons follow from its nodes and no app keeps a second list. They come in groups – undo and redo; bold, italic, inline code and link; the three headings; lists, quote and code block; then upload (given `onUpload`), embed (where there are embed nodes), table, tabs and divider – with Remove link after Link while the cursor is in a link, and the table controls while it is in a table. Four apps had each listed buttons by hand: one had no numbered list, one had a code-block node and no button for it, and only one had undo. Every button is a `ToolbarButton`, named and `aria-pressed`; the icons, the classes and anything after the buttons (`children`) are yours.
+`wiki-formant/editor`: the rich-text editor's engine, minus its chrome.
 
 ```tsx
+import { useWikiEditor, useUrlPrompt, WikiToolbar, UrlPromptField, WikiLine, uploadImageTo } from 'wiki-formant/editor';
+
+const url = useUrlPrompt(editor, { resolveMapUrl });
 <WikiToolbar editor={editor} prompt={url} onUpload={triggerUpload}
   icons={{ ...ICONS, unlink: <Unlink />, upload: <Upload />, embed: <Globe /> }}
   classNames={{ toolbar: 'toolbar', button: 'toolbar-btn', pressed: 'toolbar-btn-on', divider: 'toolbar-divider' }} />
 <UrlPromptField prompt={url} classNames={{ row: 'row', input: 'input', apply: 'btn', cancel: 'btn-quiet' }} />
-```
-
-`WikiLine` is a one-line field – a title, a heading, a caption, a button – edited in the element that shows it. Its schema is the line and the `marks` it may keep (`bold`, `italic`, `link`), so a typed "- " makes no list and a pasted heading runs into the line; its value is that HTML, or plain text with no marks. It has its own undo, and `onFocus` hands over its editor, so one `WikiToolbar` can drive whichever field was last touched. `base.css` gives it a placeholder from `data-placeholder`.
-
-```tsx
 <WikiLine as="h1" value={title} onChange={setTitle} placeholder="The page's title" />
-<WikiLine as="p" marks={['bold', 'italic', 'link']} value={note} onChange={setNote} placeholder="A note" />
 ```
 
-`useUrlPrompt(editor, { resolveMapUrl })` is the link and embed address field under a toolbar, in place of a `window.prompt` that blocks the page and cannot show the link the cursor is in. Three editors had written it and one still used the prompt; only one copy both opened a link field on the current address and unlinked on an emptied one. The hook carries both, closes the field when the editor it serves changes (a toolbar shared between blocks would otherwise apply it to the wrong one), and leaves the markup to you.
-
-`UrlPromptField` is its markup: an address input on which Enter applies and Escape closes, and Apply and Cancel.
-
-A link is stored as its `href` and the `link` class, nothing else. Stock Tiptap writes `target="_blank" rel="noopener noreferrer nofollow"` onto every link, internal ones included, which on a site throws away its own link equity and opens in-site navigation in new tabs. Whether a link is external depends on the host serving the page, so `normaliseLinks` decides it at render time. A legacy link loses both attributes the next time its page is saved.
-
-The redirect resolves through the wiki's own route, because the editor cannot read it cross-origin. `resolveMapUrl` is the client half and `resolveMapHandler` the whole route: exact shortener hosts, one hop, an allowlisted landing host, a timeout, and your sign-in check as `authorize`. One of the two copies it replaced matched `goo.gl` as a substring and followed every redirect for anyone who asked.
-
-```ts
-export const GET = resolveMapHandler({ authorize: async () => !!(await currentUser()) });
-```
+- `WikiToolbar` shows each command the editor's extensions support (`supports`) and nothing else, in fixed groups, with the table controls while the cursor is in a table.
+- `useUrlPrompt` is the link and embed field: it opens on the current link, unlinks on an emptied one, and closes when its editor changes.
+- `WikiLine` is a one-line field with its own `marks`, undo and `onFocus`, so one toolbar can drive the field last touched.
+- A link is stored as its `href` and the `link` class only; whether it is external is decided at render by `articleHtml`'s `links` pass. `uploadImageTo('/api/upload')` is the `uploadImage` an editor passes.
 
 ## Block editor
 
-`wiki-formant/block-editor` is the block list an author edits and the fields of the core types. Three wikis had written it, 500 to 700 lines each, and had drifted: one dropped a stored code language its list did not name, one let a typed count run past the row cap, one named every remove button "Remove", one never marked the block being edited. The behaviour is here once, and so is the chrome: each block is a card with a toolbar (its name, then add below, move, duplicate and delete, shown while the block is in hand and always on a touch screen), and every add menu is two tight columns of names, each type's `hint` its tooltip, drawn by `base.css` on the `--ui-*` tokens. An option's `group` lists it under that heading, groups in the order they first appear; a menu of more than eight opens on a box that finds a type by name, Enter taking the first found (on a touch screen it waits to be tapped, so the keyboard does not cover the sheet). The fields' look arrives as a kit.
+`wiki-formant/block-editor`: the block list an author edits and the fields of the core types. The look arrives as a kit.
 
 ```tsx
 const KIT: BlockEditorKit = {
-  classNames: { action: 'icon-btn', input: 'input', row: 'row', stack: 'stack-sm', … },
+  classNames: { action: 'icon-btn', input: 'input', row: 'row', stack: 'stack-sm' },
   icons: { add: <Plus />, up: <ChevronUp />, down: <ChevronDown />, duplicate: <Copy />, remove: <Trash2 /> },
-  Choice: ToggleGroup,   // optional: a <select> otherwise
 };
 const SCHEMA: BlockSchema<Block> = {
   meta: type => BLOCK_META[type], create: createBlock, duplicate: duplicateBlock,
@@ -893,116 +685,39 @@ const SCHEMA: BlockSchema<Block> = {
       case 'codeTabs': return <CodeTabsFields block={block} onUpdate={onUpdate} />;
       case 'columns': return <ColumnsFields block={block} onUpdate={onUpdate} />;
       case 'daoTimeline': return <DaoTimelineEdit block={block} onUpdate={onUpdate} />;
-      …
     }
   },
 };
 <BlockEditor blocks={blocks} onChange={setBlocks} schema={SCHEMA} kit={KIT} />
 ```
 
-The dispatch stays a `switch` over the wiki's own union, so a new type is a compile error there. `CodeTabsFields`, `StatsFields`, `TestimonialFields`, `EventsFields`, `LocationsFields`, `ReferencesFields`, `LinkGridFields`, `BannerFields`, `PageListFields`, `ListFields`, `ColumnsFields` and `InfoboxFields` take the core blocks `wiki-formant/blocks` declares; the two containers hold the same list, offering `nestedTypes`. `Field`, `Choice` and `LimitField` are exported for a wiki's own editors, so its native types wear the same kit. A card is marked `data-selected` while it is being edited and `data-nested` inside a container; a type the build does not know is shown by its raw type and carried through untouched. Keep the kit and the schema stable — a module constant or a `useMemo` — since both reach every card through context, and a fresh one re-renders every card on every keystroke.
-
-An editor that draws each block in place, with a list of its own (miow's), hosts the same fields in `<BlockFieldsKit kit={KIT}>`, without `<BlockEditor>`. Only the two container fields need the full editor, since they hold a block list. It wears the same chrome: `<BlockToolbar>` over each block (an editor's own controls go in as `children`, before add below) and `<AddBlockMenu>` at a list's foot, each offering `BlockOption`s.
-
-A `testimonial` is `{ quote, author, role?, avatarUrl? }`, drawn by `TestimonialView` as `figure.testimonial`: the words in a `blockquote`, then a `figcaption` holding the photo and a `span` of `strong` (who) and `small` (their role). radix-wiki and miow each had one under its own field names; a site with sized images passes `photo`, the `<img>` attributes (`src`, `srcSet`, `sizes`) it made from `avatarUrl`. They are data, because a server component renders the view.
-
-An `events` block is `{ upcoming?, past?, items: [{ id, date, end?, text }] }`: exhibitions, shows, talks, each dated as precisely as it is known (`EVENT_DATE`: `2026`, `2026-11` or `2026-11-12`), its end no earlier than its start, and its `text` inline HTML saying what and where. The items are stored in any order. `EventsView` sets those to come or on now soonest first under `upcoming` ("Upcoming"), with "Now on" beside one that has begun, and those that have ended latest first under `past` ("Past"), as `section.events` holding an `h2` and an `ol.event-list` for each; `base.css` gives every row's dates one column, shared by both lists. A date compares at its own precision, so `2026-08` is on until August ends. The page is split twice: by `day`, the day it was rendered (`today()` on the server), and again in the browser by the visitor's own day, because a cached page can be a day old and a show that closed since then is past. A wiki whose renderer is a client component fills `day` on the server when the page is read (it is never stored), so hydration matches what the server drew. `splitEvents`, `eventWhen` ("12 – 18 Nov 2026"), `eventBegun`, `eventEnded` and `eventEndsBefore` are the same rules for a twin, a feed or an editor; `coreAtomicText` and `coreAtomicToMarkdown` split by `day` too. `EventsFields` edits the rows in the order they were written, each with how its dates read and where the page sets it today, and `sanitizeCoreLeaf` cleans each event's text. miow had it first.
-
-A `locations` block is `{ heading?, map?, items: [{ id, name?, image?, address?, map?, phone?, email?, hours?, timeZone?, note? }] }`: where a business is and when it is open, each place with its address or its hours. `hours` are rows of `{ days, opens, closes }`, days `mon` to `sun` and times 24-hour; a closing time at or before the opening one is the next morning, and one equal to it is open all day. `LocationsView` draws `section.locations` holding `ul.places`, as many to a row as fit: each place's picture, name (an `h2`, or an `h3` under `heading`), address linked to its map (`mapHref`: the link it was given, or a search for its words), its week as grouped rows ("Mon–Fri 8am–6pm", "Sun Closed"), its note, phone and email, and with `map` an embedded map (`mapEmbed`, from a host on `DEFAULT_IFRAME_HOSTS`). Whether it is open and which row is today depend on the moment it is read, so the server draws the hours alone and the browser adds `.place-state` ("Open · closes 6pm", "Closed · opens Mon 8am") and the row's `aria-current`, by the place's own clock (`timeZone`, `DEFAULT_ZONE` `Europe/London` unset), once a minute. `wiki-formant/hours` holds those rules — `hoursRows`, `openState`, `clock`, `hoursLd` (schema.org's `OpeningHoursSpecification`), `DAYS`, `TIME`, `isZone` — for a twin, a feed or structured data. `LocationsFields` edits the places, their hours day by day; `sanitizeCoreLeaf` cleans each note. A site whose places are its own business states each as a `LocalBusiness` with `hoursLd`; a wiki describing places does not, since they are not the wiki's own. miow had it first.
-
-A banner with no text of its own shows `BANNER_MESSAGES` from `wiki-formant/text`, a sentence per variant that names no wiki; `BannerView` takes it unless `message` overrides it.
-
-The core blocks are `ContentBlock`, `CodeTabsBlock`, `StatsBlock`, `LinkGridBlock`, `ReferencesBlock`, `BannerBlock`, `TestimonialBlock`, `EventsBlock`, `LocationsBlock`, `ListBlock`, `ColumnsBlock<A>` and `InfoboxBlock<A>`, `A` being the wiki's atomic union. `CoreLeafBlock` is every one of them but the list and the containers, as one union, and `CoreLeafType` its types. A wiki builds its atomic union from it, `CoreLeafBlock | ListBlock | its native types`, with its own `list` holding its own page rows, and derives its `BlockType` from the result. A leaf added here then reaches every wiki with the release, and fails to compile there until its label, its view and its fields are wired: a `Record` keyed by the block types is missing a key, and a switch closed with `block satisfies never` has a case left over. miow, whose union is zod's, asserts that it carries every `CoreLeafType`.
-
-`ListBlock` is one list of the wiki's pages where those two were two: the pages in a section (`source: 'under'`), the newest, in a section or across the wiki (`'newest'`, `count`), or pages picked by hand (`'chosen'`, `pages`, keyed as the wiki keys a page, an id or a path), shown as links with their age or as cards (`show`). A wiki resolves it to `items` as it does a page list. `ListFields` edits it, with `pages` to pick from and `sections` to name; a wiki with a source of its own, a shop's products say, passes it in `sources` and draws its fields as `children`.
+- Each block is a card with a toolbar (name, add below, move, duplicate, delete); an add menu of more than eight types opens on a filter box. An option's `group` heads it.
+- The core fields are `CodeTabsFields`, `StatsFields`, `TestimonialFields`, `EventsFields`, `LocationsFields`, `ReferencesFields`, `LinkGridFields`, `BannerFields`, `PageListFields`, `ListFields`, `ColumnsFields` and `InfoboxFields`. `Field`, `Choice` and `LimitField` are for a wiki's own types.
+- A type the build does not know is shown by its raw type and carried through untouched.
+- Keep the kit and schema stable (a module constant or `useMemo`): both reach every card through context.
+- An editor that draws blocks in place hosts the fields in `<BlockFieldsKit kit={KIT}>` with `<BlockToolbar>` and `<AddBlockMenu>`.
 
 ## Analytics
 
-Page views and events, counted in the site's own Postgres instead of a hosted
-service. No cookie is set and no address is kept: a visitor is a hash of the
-address and browser under a salt that is replaced every UTC day, and the old
-salt is deleted, so a visitor is told apart within a day and never followed
-into the next. Rows are kept 400 days. The package owns the SQL and the app
-owns the connection: `Sql` is one function that runs a statement with `$1, $2…`
-placeholders, and the four tables it needs ship as Prisma models in
-`prisma/analytics.prisma` (see `prisma-models` below). The fourth, `ViewDay`, holds days a site counted
-elsewhere before it counted its own; `digest` adds them to any window that
-reaches back that far, and a site with no such history leaves it empty.
+`wiki-formant/analytics`: page views and events in the site's own Postgres. No cookie and no stored address: a visitor is a hash of address and browser under a salt replaced every UTC day. Rows are kept 400 days. The tables ship in `prisma/analytics.prisma`; `ViewDay` holds days a site counted elsewhere first.
 
 ```ts
 // src/lib/track.ts
 const sql: Sql = (query, ...values) => prisma.$queryRawUnsafe(query, ...values);
-export const { trackEvent, trackMcpCall, trackSearch, viewRoute } =
-  createTracker({ sql, defer: after, siteUrl: SITE_URL });
+export const { trackEvent, trackMcpCall, trackFeedback, trackSearch, viewRoute } = createTracker({ sql, defer: after, siteUrl: SITE_URL });
 
-// src/app/api/view/route.ts – the whole beacon route
+// src/app/api/view/route.ts
 export const POST = viewRoute();
-
-// the root layout, once
-<Beacon />
-```
-
-`createTracker` records only on a Vercel production deployment unless told
-otherwise (`enabled`), because dev and previews write to production's
-database. `trackMcpCall(request, body, server?)` fits `McpServerConfig.onCall`;
-`trackSearch(headers, query, results, surface?)` takes the headers or Next's
-`headers` itself, which it reads inside the deferred write. `viewRoute({ site })`
-passes a site resolver to `collect`. The module that builds the tracker
-imports the app's database client, so a proxy reaches it through a dynamic
-`import()` inside `event.waitUntil`, never a static one.
-
-`<Beacon>` (`wiki-formant/react`) sends a view each time the path changes,
-client-side moves included, and a click on a link to another host as an
-"Outbound Link: Click" event; `track(name, props)` (`wiki-formant/dom`) sends
-any other browser event. Underneath the tracker, server code calls
-`recordEvent` and leaves the deferral to the framework, so this package keeps
-its zero-dependency guarantee:
-
-```ts
-after(() => recordEvent(sql, { name: 'Signup', props: { plan }, url, headers }));
 ```
 
-`mcpCallProps` reads a tool name out of a JSON-RPC envelope that is untrusted
-and may be a batch; `trackSearch` normalises a search box's free text so
-the same question aggregates as one row, and drops an empty one. Pass the request's headers and the
-event joins whoever sent it, person or agent.
-
-`digest(sql, { days })` reads a site back as one JSON object: visitors, agents,
-page views, bounce rate, visit length, sources (a link's `utm_source`, else the
-referring host), top and entry pages, countries, devices, visitors and agents by
-day, the agents by name, MCP tool calls, and the searches that found nothing.
-An agent is counted as a visitor is, one address and user agent a day, from its
-`AI Bot Visit` and `MCP Call` events; it runs no page script, so it is never
-among the visitors, and `visitors_incl_agents` counts the two at once.
-`ownAgents` leaves the site's own out of both. A visit is a run of one
-visitor's views with no gap over 30 minutes, and a bounce is a visit of one view
-with no event of the reader's inside it: a search that keeps the path, a click
-out or a share makes the visit count. A browser under automation
-(`navigator.webdriver`) sends no beacon at all. A multi-tenant app passes a `site`
-key to every call and a `site` resolver to `collect`.
-
-Instrumenting the agent lane and not the human one is the easy mistake: it
-leaves a wiki able to say what every crawler asked for and nothing about what
-its readers asked for. The queries that return zero rows are the valuable ones
-– they name a gap in the corpus in the reader's own words.
+- `createTracker` records only on a Vercel production deployment unless `enabled` says otherwise. `trackMcpCall` fits `McpServerConfig.onCall`; `trackSearch` normalises a query and drops an empty one; `recordEvent` is the undeferred write.
+- A proxy reaches the tracker through a dynamic `import()` inside `event.waitUntil`, since it imports the database client.
+- `digest(sql, { days })` is the site as one JSON object: visitors, agents, views, bounce rate, visit length, sources, pages, countries, devices, by day, agents by name, MCP calls and searches that found nothing. A visit is a run of views with no gap over 30 minutes; a bounce is a one-view visit with no event of the reader's. `ownAgents` leaves the site's own out. A multi-tenant app passes `site`.
+- A browser under automation (`navigator.webdriver`) sends no beacon.
 
 ## Passkeys and the stats page
 
-`wiki-formant/passkey` is the door to a site's own admin pages: a passkey and
-nothing else, no account, password or email. `createPasskeyGate({ sql, rpName })`
-returns the whole of it. `gate.route` is the sign-in route, `gate.signOut` the
-sign-out route, `gate.signedIn(cookieValue)` is the check a page makes,
-`gate.allows(request)` the same check for a write route's own request, and
-`gate.cookie` is the cookie's name. An editor with one writer needs no
-other door: acuiq2's wiki editor opens on the passkey that opens its stats. The two tables (`Passkey`, `PasskeyToken`) ship as Prisma
-models in `prisma/passkey.prisma`, and every token is kept only as its hash.
-
-There is no sign-up. Every passkey, the first among them, is saved from a
-single-use link that the `passkey-invite` bin prints from a machine holding
-`DATABASE_URL`, so a fresh deployment cannot be claimed by whoever reaches it
-first. A passkey is bound to the host it was saved on, so localhost needs its
-own. A session names the passkey that signed in: deleting a `Passkey` row signs
-out every session it opened.
+`wiki-formant/passkey`: the door to a site's own admin pages, a passkey and nothing else. `wiki-formant/stats`: the stats page behind it.
 
 ```ts
 // src/lib/admin.ts
@@ -1013,7 +728,7 @@ export const POST = gate.route;
 export const DELETE = gate.signOut;
 
 // src/app/stats/page.tsx
-const q = statsQuery(params); // ?days= (1, 7, 30, 90, 365 or all, else 30), ?agents=apart and the filters
+const q = statsQuery(params);
 return (
   <StatsGate gate={gate} session={(await cookies()).get(gate.cookie)?.value} invite={params.invite} host="caper.network">
     {async () => <Stats digest={await digest(sql, q)} {...q} link={Link} />}
@@ -1021,207 +736,73 @@ return (
 );
 ```
 
-`StatsGate` (`wiki-formant/stats`) renders `children` and a sign-out button for a signed-in reader and, for anyone else, the line saying what the prompt will do and the passkey button that does it; `classNames` places the text, the button's box, the button and its error. Those buttons are the browser half of `wiki-formant/passkey`, and they have no subpath of their own.
-
-`Stats` (`wiki-formant/stats`) renders a `digest` as one page: the
-headline figures, each with its change from the window before
-(`.stats-delta[data-better]`, a share or for the bounce rate points, for the
-site's stylesheet to colour), one of them by day, week or month (a count's
-total, a rate's mean), every non-empty
-ranked list, and `?days=` links between windows, all time among them, pinned in
-the chart's frame as its own buttons are (`TimeChart`'s `controls`). Each
-figure is a button that charts it: visitors, page views, bounce rate,
-visit length and clicks to X. Visitors count agents while the switch beside the windows, drawn as a robot's
-head, is lit; turning it off (`?agents=apart`) splits them into people and agents, and every
-other link on the page keeps the choice. `digest`'s `by_day` carries every
-one of those per UTC day, a visit on the day it began, so the days add up to the
-totals. A day with no visits has no bounce rate or visit length and is left out
-of those charts rather than drawn as zero. Everything but the figures and the
-chart is server-rendered. Every link on the page is `link`, a bare `<a>` unless
-the site passes its router's: with `next/link` a window, the switch or a
-narrowing re-renders the page in place rather than reloading it, and the chart
-keeps its figure and step.
-
-Every row in a list is a link that narrows the page to it, and the narrowings
-stack: `?page=`, `?entry=`, `?source=`, `?country=` and `?device=`, each shown as
-a chip that drops it. A narrowing keeps the visits that pass – that saw the
-page, began on it, came from the source, or were made from the country or
-device – and recounts every figure, list and day from those visits alone, with
-events only from their visitors. Agent tool calls and missed searches are
-events no visit reaches, so their rows are not links. `ViewDay` keeps totals,
-not visits, so a narrowed page starts at `counted_from`, the first day the site
-counted itself, says so, and drops the comparison with the window before. The chart is `TimeChart` with a count
-axis from zero.
+- There is no sign-up: every passkey is saved from a single-use link `npx passkey-invite` prints. A passkey is bound to its host. Deleting a `Passkey` row signs out every session it opened. Tokens are kept only as hashes (`prisma/passkey.prisma`).
+- `gate.signedIn(cookie)` is a page's check and `gate.allows(request)` a write route's.
+- `statsQuery` reads `?days=` (1, 7, 30, 90, 365 or all), `?agents=apart` and the narrowings `?page=`, `?entry=`, `?source=`, `?country=`, `?device=`, which stack and recount every figure from the visits that pass.
+- Each headline figure shows its change from the window before (`.stats-delta[data-better]`) and charts on press. A narrowed page over `ViewDay` totals starts at `counted_from` and says so.
 
 ## ROLA sign-in
 
-`wiki-formant/rola` is the part of a Radix wallet sign-in two sites had each written: a single-use challenge, the wallet's proof of it, and the HS256 token a verified address is handed. How a site keeps the session stays with it, because the two keep it differently: radix-wiki a `Session` row behind a seven-day cookie, caper a stateless token it slides forward, with a short one for agents.
+`wiki-formant/rola`: a Radix wallet sign-in up to the token: a single-use challenge, the wallet's proof, the HS256 session, and the two MCP tools that sign an agent in. How a site keeps the session stays with it.
 
 ```ts
+import { createRola, sessionSecret, signSession, verifySession, bearerToken, rolaLoginTools } from 'wiki-formant/rola';
+
 const rola = createRola({ expectedOrigin, dAppDefinitionAddress, networkId, applicationName, challenges: prisma.challenge });
-const { challenge } = await rola.generateChallenge();
 const v = await rola.verifySignedChallenge(signed);        // { isValid, error? }
-
 const secret = sessionSecret(process.env.JWT_SECRET);      // throws under 32 characters
 const token = await signSession({ id: signed.address }, secret, 7 * 86400);
 const claims = await verifySession<{ id: string }>(bearerToken(request.headers) ?? cookie, secret);
+
+const tools = rolaLoginTools({
+  site: 'the wiki', dAppDefinitionAddress, origin: SITE_URL, tokenTtlSec: 7 * 86400, writeTools: 'create_page / edit_page',
+  generateChallenge: rola.generateChallenge,
+  login: async signed => issueToken(signed),   // { token, expiresAt, ...shown }; throw McpToolError to refuse
+  notes: { sign: { address: 'your virtual account; its key must be an on-ledger owner_keys entry' } },
+});
 ```
 
-Where the two copies differed, this takes the stricter. A challenge is spent by one conditional delete, so two requests racing with one signature cannot both pass, and it is spent whatever the outcome; making one purges the expired. Only an account proof signs in. Verification pins HS256. `jose` and `@radixdlt/rola` are optional peers.
+- A challenge is spent by one conditional delete whatever the outcome, so one signature cannot pass twice; making one purges the expired. Only an account proof signs in. Verification pins HS256.
+- `rolaLoginTools` gives `get_challenge` (the exact message to sign, naming the dApp definition address and the origin `rolaOriginCheck` looks for) and `login`, whose refusal says to fetch a new challenge. `notes.challenge`, `notes.sign` and `notes.address` add a surface's own lines.
 
 ## Charts
 
-`TimeChart` (`wiki-formant/chart`) is every time-series chart on the four sites:
-token prices, ledger activity, a caper's price, visitors per day. One area
-series in the box's own `color`, its axis in `--chart-axis` if set, with range
-buttons — 24H, 7D, 30D, 90D, 1Y, All — then, after a rule, the day, week and
-month steps. The steps show wherever a range is drawn by day, so the buttons
-never shift; every one is enabled, however few points it makes, so 90D draws
-monthly as readily as daily (none under 24H and 7D, which are drawn by the hour
-and the four hours, and none finer than the points: weekly readings have no
-day). The default is the finest that makes 200 or fewer, so a year opens weekly
-and five years monthly, and a step picked holds across the ranges.
-
-```tsx
-// Daily points: the chart slices and steps them itself; 30D up.
-<TimeChart series={days} label="Transactions" aggregate="sum" fromZero />
-
-// A loader: asked for 'hour' (24H), '4h' (7D) or 'day' from 0 (every longer
-// range), once each.
-<TimeChart series={load} label="Price" format={formatPrice} range="30d" candles />
-```
-
-A price point may carry `open`, `high` and `low` (its `value` is the close)
-and `volume`. Points that carry the candle get a candles switch, a candlestick icon
-pressed while they show, opening on candles with `candles`; points that carry volume get a volume pane under the
-price, a fifth of the height. Candles take `--chart-up` and `--chart-down` from
-the canvas box, else its `color`. A week of candles opens on its first, closes
-on its last, spans the highest high and lowest low, and sums its volume. A point
-with a volume of zero is a stretch nothing traded in: its candle and bar leave
-the slot empty, except the last, which is the price now. A price's line is
-straight between closes and a count's is curved.
-
-`aggregate` is how a week or month is made from its days: `last` for a price,
-`sum` for a count, so a week reads as the week's total, and `mean` for a rate,
-which no total makes sense of. A stepped range starts on a whole week or month,
-so its first point is not a few days of one; the week in progress is its total
-so far. `fromZero` starts a count's axis at zero and stops it there, with
-no negative ticks under it. A single range draws no range buttons and shows every point.
-No step is finer than the points' own spacing, so weekly readings offer W and M
-and draw on the days they were taken. `chartSteps` is exported for a chart drawn elsewhere.
-
-`format` writes the axis and the crosshair label. An axis tick also gets the
-spacing between ticks as a second argument, so a formatter can write every tick
-to the same precision and two never read alike: `stepDecimals(step)` is the
-decimal places that takes, and `formatChartValue`, the default, uses it.
-
-`markers` are events, `{ time, label }`, each drawn as an arrow on the last
-point at or before it, so one mid-week lands on its week and two on one point
-share it. No words go on the plot: the label is a tooltip (`.chart-tip`) while
-the crosshair is on the point, one line an event, so it can be the event's full
-name. `step` opens on a step where the range can make it, and `onView` hears the
-range, and the step the reader picked (null while the chart picks its own), once
-the points are in and on every change, for a page that keeps them in its URL:
+`wiki-formant/chart`: `TimeChart`, every time-series chart: one area series in the box's `color`, range buttons (24H to All) and day, week and month steps.
 
 ```tsx
 <TimeChart series={days} label="Transactions" aggregate="sum" fromZero
   markers={[{ time: haltAt, label: 'Network halt' }]} step="month" onView={v => keep(v)} />
+<TimeChart series={load} label="Price" format={formatPrice} range="30d" candles />
 ```
-`base.css` pins the buttons (`.chart-controls button[aria-pressed]`) to the
-canvas's top-left corner, rules a line between groups and dims a disabled step;
-the site's stylesheet gives them and the box a look.
+
+- `series` is the points or a loader asked for `'hour'` (24H), `'4h'` (7D) or `'day'`, once each.
+- The default step is the finest that makes 200 points or fewer; no step is finer than the points. `aggregate` is `last` for a price, `sum` for a count, `mean` for a rate. A stepped range starts on a whole week or month.
+- Points with `open`, `high` and `low` get a candles switch; with `volume`, a volume pane. A zero-volume point leaves its slot empty.
+- `format` gets the tick spacing too; `stepDecimals` and `formatChartValue` keep ticks at one precision. `markers` are tooltips on the last point at or before each event.
+- `chartSteps` is exported for a chart drawn elsewhere.
 
 ## Base stylesheet
 
-`wiki-formant/base.css` is the layout the package's markup does not work without, and nothing else: columns that stack until there is room, stored tab panels that show one at a time, a copy button pinned to its block's corner and visible on focus and on touch, a table's scroll box, the stats block's grid, the events block's shared date column, the locations block's row of places, the code-tab strip, the banner's row and the infobox's wrapping, the breadcrumb row, the `aria-sort` arrow as a mask over `currentColor`, the stats page's grid and bars, and the chart's height and pinned buttons. It also carries the shape and motion of the primitives every site re-implemented and forked — `.spinner` (a `currentColor` ring sized by `--spinner-size`), `.skeleton`'s pulse, `.empty-state`, the wrap rule for long tokens in inline `code` — and the reduced-motion guard none of them had. No colour and no scale, so a design system's own rules override it at equal specificity. The one set of tokens it declares is the page frame every site lays out by: `--content-width` (72rem, gutters inside), `--sidebar-width` (18rem) and `--page-pad` (16 / 24 / 32px at base / 640 / 1024). They sit in the components layer, so a site never restates them in `@theme`, which would lose; an element that must differ sets its own.
+`wiki-formant/base.css`: the layout the package's markup needs and the package's components drawn on eleven `--ui-*` tokens (`--ui-surface`, `--ui-surface-2`, `--ui-border`, `--ui-radius`, `--ui-pad`, `--ui-small`, `--ui-muted`, `--ui-accent`, `--ui-on-accent`, `--ui-up`, `--ui-down`) a site maps from its palette in `:root`. No colour and no scale, so a design system's rules override it at equal specificity.
 
 ```css
 @import "wiki-formant/base.css" layer(components);
 ```
 
-Since 0.86 it also draws the package's components — the infobox, section and stat cards, see-also and page-ref lists, the hover card, the maintenance queues, the chart's frame and buttons, code tabs, the editorial banner, references, heading anchors, link grids, revision diffs and the rail's contents — on eleven `--ui-*` tokens (`--ui-surface`, `--ui-surface-2`, `--ui-border`, `--ui-radius`, `--ui-pad`, `--ui-small`, `--ui-muted`, `--ui-accent`, `--ui-on-accent`, `--ui-up`, `--ui-down`) that a site maps from its own palette in `:root`. Four stylesheets had restated sixty of those classes with four token vocabularies; now a site states the rule only where it differs. The split of a page beside its infobox stays the site's, as does the rail's surface.
-
-No view emits a Tailwind utility any more — `ColumnsView` states its gap and alignment as data attributes, and an inactive code tab is `hidden` — so a site no longer needs its Tailwind to scan this package for the markup to work.
+It declares the page frame (`--content-width` 72rem, `--sidebar-width` 18rem, `--page-pad` 16/24/32px) in the components layer, so a site never restates them in `@theme`; the primitives `.spinner`, `.skeleton`, `.empty-state`; and the reduced-motion guard. The split of a page beside its infobox and the rail's surface stay the site's.
 
-## API
-
-Every module has a subpath — `wiki-formant/taxonomy`, `wiki-formant/mcp`, and so on —
-and there is no root export: `import … from 'wiki-formant'` does not resolve. A
-barrel loads every module it names for the one symbol a route wanted, and had
-already re-exported one module twice. The emitted `.d.ts` files are the reference.
-There is no hand-maintained symbol list here, because the one that used to be here
-drifted from them. A function a module uses only itself is marked `@internal`: the
-package's tests still reach it, and the `.d.ts` leaves it out.
+## Database and scripts
 
-`wiki-formant/tsconfig.base.json` is the compiler floor: an app's `tsconfig.json` extends it and keeps only `paths`, `include`, `exclude` and any licensed extra, since tsconfig resolves those against the file that declares them.
-
-```json
-{ "extends": "wiki-formant/tsconfig.base.json", "compilerOptions": { "paths": { "@/*": ["./src/*"] } }, "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", "src/app/.well-known/**/*.ts", ".next/types/**/*.ts", ".next/dev/types/**/*.ts"], "exclude": ["node_modules"] }
-```
-
-`wiki-formant/db` holds `pgPoolConfig(url)`, the options every app here hands to
-`new pg.Pool()`: ten clients on Supabase's 6543 transaction pooler, three on the
-5432 session pooler, whose fifteen-client cap a build's workers share. It also
-holds `prismaConfig(root, schema?)`, what an app's prisma.config.ts hands
-`defineConfig`: `.env` loaded from `root`, the schema folder (or one file) and
-migrations under it, and DIRECT_URL preferred, because the Prisma CLI's
-connections hang on the transaction pooler.
+`wiki-formant/db`: `pgPoolConfig(url)`, ten clients on the 6543 transaction pooler and three on the 5432 session pooler, and `prismaConfig(root, schema?)`, which prefers `DIRECT_URL`, since the Prisma CLI hangs on the transaction pooler.
 
 ```ts
 // prisma.config.ts
 import { defineConfig } from 'prisma/config';
 import { prismaConfig } from 'wiki-formant/db';
-
 export default defineConfig(prismaConfig(import.meta.dirname));
 ```
 
-`rateLimit` takes `blockMs` (and a `blockKey`, default the bucket's own) for a
-caller already shown to be abusive: running dry blocks the key outright for that
-long, across every bucket that names it, rather than letting the refill trickle
-one token through at a time. `clientIp` reads `x-real-ip` first — Vercel sets it
-and overwrites any inbound copy — and the leftmost `x-forwarded-for` only where no
-`x-real-ip` was set, since a proxy that appends hands the client that slot.
-`limitClient(prefix, headers, opts)` is the per-address gate, `rateLimit` over
-`clientKey`, which a dozen call sites had written out.
-
-## A bin
-
-`check-classes` fails a build on a `className` token that resolves to nothing, and counts the inverse fault — 3+ Tailwind utilities inline, which is a component class that was never named. Both sets are derived from the emitted stylesheets rather than listed, so nothing has to be maintained per project. Run it from a repo root after a build:
-
-```sh
-npx check-classes                # exit 1 on any dead token
-npx check-classes --warn         # report and exit 0
-npx check-classes --compositions # also fail on the inline compositions
-```
-
-`analytics-digest` prints a site's `digest` as JSON for a script outside the app. Run it from the app's root, where `pg` is installed and `.env` holds `DATABASE_URL`:
-
-```sh
-npx analytics-digest --days 7
-npx analytics-digest --days 30 --handle radixwiki --siblings caper.network,acuiq.com
-npx analytics-digest --days 7 --gap "Symptom Miss:term"   # adds an event to the search gaps
-```
-
-`passkey-invite` prints a single-use link that saves a passkey for the page it names, good for a day (`--days n` for longer). No routine calls it: the site's owner runs it by hand, from an app's checkout, for the first passkey and whenever another device or person needs into the stats page. Run it the same way:
-
-```sh
-npx passkey-invite https://caper.network/stats
-```
-
-`prisma-models` copies the models the analytics and passkey SQL reads, `prisma/analytics.prisma` and `prisma/passkey.prisma`, into an app's schema folder, and `--check` exits 1 when a copy is missing or has drifted. Prisma reads a schema split across one folder's files, so the app moves `prisma/schema.prisma` into `prisma/schema/`, points `prisma.config.ts`'s `schema` at the folder, and keeps its generator, datasource and own models there beside the shipped files. A generator `output` is relative to the file that declares it, so it gains a `../`.
-
-```sh
-npx prisma-models            # write both into prisma/schema
-npx prisma-models --check    # in the build, before prisma generate
-```
-
-An app that keeps one schema file and writes the models into it by hand, because each needs a relation the shipped one cannot carry, checks them in place: `--in` names the file and compares model by model, ignoring comments and spacing, and `--tenant` lets each `siteId` drop its default and gain a `@relation` on it.
-
-```sh
-npx prisma-models analytics --check --in prisma/schema.prisma --tenant   # miow
-```
-
-`wiki-formant/scripts` is what a seed or sweep script shares with the next one: `withClient` (a `pg` client on `DATABASE_URL` that rolls back on a throw and expires the wiki's cache tag after a write), `readPage` and `writeRevision` (one revision over a page the script read, refused if the page moved on), `upsertWikiPage`, the block builders `content`, `banner` and `infobox`, and `assertLinkShapes`, which refuses a link or reference the views would silently drop. radix-wiki and caper had each written it in a different language.
+`wiki-formant/scripts`: what a seed or sweep script shares: `withClient` (a `pg` client that rolls back on a throw and expires the cache tag after a write), `readPage`, `writeRevision` (refused if the page moved on), `upsertWikiPage`, the block builders `content`, `banner` and `infobox`, and `assertLinkShapes`.
 
 ```ts
 import { withClient, readPage, writeRevision } from 'wiki-formant/scripts';
@@ -1231,31 +812,35 @@ await withClient(async client => {
 }, { tag: 'wiki' });
 ```
 
-`wiki-formant/link-check`'s `auditLinks` is the walk every dead-link checker makes — each link once, with the pages that carry it, probed with `probeExternal` or the checker's own — and `printLinkAudit` its first lines; what a checker keeps is its live paths, its special cases and the rest of its report.
+`wiki-formant/link-check`: `auditLinks`, each link once with the pages that carry it, probed with `probeExternal` or the checker's own, and `printLinkAudit`.
 
-`wiki-formant/knip` is the knip configuration the apps share, spread into each one's `knip.ts` with what is its own.
+`wiki-formant/knip`: the shared knip configuration, spread into each app's `knip.ts`.
 
-`fts-ddl <table>` rebuilds a table's `search_tsv` generated column and its GIN index from the expression `wiki-formant/search` queries, over `DIRECT_URL` (else `DATABASE_URL` on 5432). Run it before declaring the column in `schema.prisma`; the bin's header says why. A PascalCase Prisma table goes in quoted, as SQL names it.
+## Bins
 
-```sh
-npx fts-ddl pages
-npx fts-ddl '"WikiPage"'
-```
-
-`mark-verified` stamps `lastVerifiedAt` on pages a sweep checked and found current, so `freshnessBanner` stops calling them outdated, and `maintenance-log` is the state I/O of a wiki-sweep routine whose memory lives in one page's `metadata.state`: `read`, `write` (the whole state, or `-` for stdin), `compact` and `backlog-add`, which is how another routine files an item. Every mode holds the row lock from read to write, and `backlog-add` records what it filed in `state.filed`, so a `write` of a state read before the filing merges the item back in rather than dropping it (`lateBacklog`). Only `metadata.state` is written; the page's other metadata is kept. Every write compacts and re-renders the page, holding at most as many FLAG FOR A HUMAN items as the page shows; a revision is written at most once a day. `write` refuses a state whose `totalRuns` is below the stored one, which is a state read before another run wrote. Both work on the package's own `WikiPage` and `WikiRevision`. Run them from the app's root, like `passkey-invite`:
+Run each from the app's root, where `.env` holds `DATABASE_URL`.
 
 ```sh
-npx mark-verified contents/tech/radix-engine scrypto       # one page
-npx mark-verified --all ecosystem --invalidate wiki        # a tag path, then the cache tag
-npx maintenance-log read --at contents/tech/operations/wiki-maintenance-log --routine wiki-sweep --author <id>
-npx maintenance-log backlog-add '[{"item": "…"}]' --at operations/wiki-maintenance-log --routine caper-wiki-sweep
-```
-
-`--site <siteId>` names the wiki in a multi-tenant app (default `""`), and `--invalidate <tag>` runs `vercel cache invalidate` after a write.
+npx check-classes [--warn] [--compositions]   # a className token no stylesheet defines; 3+ inline utilities
+npx check-pages https://radix.wiki            # the served HTML of every sitemap page
+npx analytics-digest --days 7 [--gap "Symptom Miss:term"]
+npx passkey-invite https://caper.network/stats [--days n]
+npx prisma-models [analytics|passkey|wiki] [--check] [--in prisma/schema.prisma --tenant]
+npx fts-ddl '"WikiPage"'                      # rebuild search_tsv and its index over DIRECT_URL
+npx indexnow https://radix.wiki [--hours 6 | --all]
+npx mark-verified <tagPath> <slug> | --all <tagPath> [--invalidate wiki]
+npx maintenance-log read|write|compact|backlog-add --at <path> --routine <name> [--author <id>]
+```
+
+- `prisma-models` copies the shipped models into `prisma/schema/` (Prisma reads a folder of files; a generator `output` gains a `../`), and `--check` fails on a missing or drifted copy. `--in` compares models in one file, and `--tenant` lets `siteId` drop its default and gain a relation.
+- `fts-ddl` runs before the column is declared in `schema.prisma`; a PascalCase table goes in quoted.
+- `indexnow` posts the sitemap rows modified in the window to IndexNow, after checking the origin serves the key file in `public/`. The sitemap must render per request.
+- `mark-verified` stamps `lastVerifiedAt` so `freshnessBanner` stops calling a page outdated.
+- `maintenance-log` is the state of a sweep routine kept in one page's `metadata.state`: every mode holds the row lock from read to write, `backlog-add` files an item another routine raised and a stale `write` merges it back, and a `write` whose `totalRuns` is below the stored one is refused. `--site` names the wiki in a multi-tenant app.
 
 ## A reusable workflow
 
-`.github/workflows/publish-mcp-registry.yml` republishes an origin's server to the MCP registry when the version in its `server.json` moves. Each app keeps its own trigger and calls it with its domain:
+`.github/workflows/publish-mcp-registry.yml` republishes an origin's server to the MCP registry when its `server.json` version moves.
 
 ```yaml
 on: