diff --git a/frameworks/aspnet-minimal-iouring/AppData.cs b/frameworks/aspnet-minimal-iouring/AppData.cs
deleted file mode 100644
index 40db06841..000000000
--- a/frameworks/aspnet-minimal-iouring/AppData.cs
+++ /dev/null
@@ -1,70 +0,0 @@
-using System.Text.Json;
-using Npgsql;
-using StackExchange.Redis;
-
-static class AppData
-{
-    public static readonly JsonSerializerOptions JsonOptions = new()
-    {
-        PropertyNameCaseInsensitive = true,
-        PropertyNamingPolicy = JsonNamingPolicy.CamelCase
-    };
-
-    public static List<DatasetItem>? DatasetItems;
-
-    public static NpgsqlDataSource? PgDataSource;
-
-    // Optional Redis cache for the crud profile. When REDIS_URL is set,
-    // crud handlers use Redis as a shared cache; otherwise they use the
-    // in-process IMemoryCache. Mirrors hono-bun's pattern so frameworks
-    // can be compared apples-to-apples on the same cache topology.
-    public static IDatabase? RedisDb;
-
-    public static void Load()
-    {
-        LoadDataset();
-        OpenPgPool();
-        OpenRedis();
-    }
-
-    static void LoadDataset()
-    {
-        var path = Environment.GetEnvironmentVariable("DATASET_PATH") ?? "/data/dataset.json";
-        if (!File.Exists(path)) return;
-        DatasetItems = JsonSerializer.Deserialize<List<DatasetItem>>(File.ReadAllText(path), JsonOptions);
-    }
-
-    static void OpenPgPool()
-    {
-        var dbUrl = Environment.GetEnvironmentVariable("DATABASE_URL");
-        if (string.IsNullOrEmpty(dbUrl)) return;
-        try
-        {
-            var uri = new Uri(dbUrl);
-            var userInfo = uri.UserInfo.Split(':');
-            var maxConn = int.TryParse(Environment.GetEnvironmentVariable("DATABASE_MAX_CONN"), out var p) && p > 0 ? p : 256;
-            var minConn = Math.Min(64, maxConn);
-            var connStr = $"Host={uri.Host};Port={uri.Port};Username={userInfo[0]};Password={userInfo[1]};Database={uri.AbsolutePath.TrimStart('/')};Maximum Pool Size={maxConn};Minimum Pool Size={minConn};Multiplexing=true;No Reset On Close=true;Max Auto Prepare=20;Auto Prepare Min Usages=1";
-            var builder = new NpgsqlDataSourceBuilder(connStr);
-            PgDataSource = builder.Build();
-        }
-        catch { }
-    }
-
-    static void OpenRedis()
-    {
-        var redisUrl = Environment.GetEnvironmentVariable("REDIS_URL");
-        if (string.IsNullOrEmpty(redisUrl)) return;
-        try
-        {
-            // REDIS_URL is "redis://host:port" — convert to StackExchange's
-            // "host:port" configuration string.
-            var uri = new Uri(redisUrl);
-            var config = ConfigurationOptions.Parse($"{uri.Host}:{uri.Port}");
-            config.AbortOnConnectFail = false;
-            var muxer = ConnectionMultiplexer.Connect(config);
-            RedisDb = muxer.GetDatabase();
-        }
-        catch { }
-    }
-}
diff --git a/frameworks/aspnet-minimal-iouring/Dockerfile b/frameworks/aspnet-minimal-iouring/Dockerfile
deleted file mode 100644
index eafc27cce..000000000
--- a/frameworks/aspnet-minimal-iouring/Dockerfile
+++ /dev/null
@@ -1,55 +0,0 @@
-# Stage 1: Build the custom .NET runtime with io_uring socket engine
-FROM mcr.microsoft.com/dotnet/sdk:11.0-preview AS runtime-build
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git cmake clang lld llvm python3 ninja-build \
-    libicu-dev libssl-dev libkrb5-dev zlib1g-dev \
-    liblttng-ust-dev libunwind-dev \
-    && rm -rf /var/lib/apt/lists/*
-WORKDIR /runtime
-COPY frameworks/aspnet-minimal-iouring/patch-iouring.py /tmp/patch-iouring.py
-RUN git clone --depth 1 --branch io_uring https://github.com/benaadams/runtime.git . \
-    && python3 /tmp/patch-iouring.py \
-    && ./build.sh -subset clr+libs -c Release -bl \
-    && echo "=== Build artifacts ===" \
-    && ls -la /runtime/artifacts/bin/runtime/ \
-    && echo "=== System.Net.Sockets.dll location ===" \
-    && find /runtime/artifacts -name "System.Net.Sockets.dll" -type f 2>/dev/null
-
-# Stage 2: Build the app using the official SDK
-FROM mcr.microsoft.com/dotnet/sdk:11.0-preview AS app-build
-WORKDIR /app
-COPY frameworks/aspnet-minimal-iouring/*.csproj ./
-RUN dotnet restore
-COPY frameworks/aspnet-minimal-iouring/ .
-# MapStaticAssets() bakes files from wwwroot/ into a manifest at publish time.
-# aspnet-minimal serves /static/{filename} from there, so data/static/ must be
-# staged into wwwroot/static/ before `dotnet publish` runs.
-COPY data/static/ wwwroot/static/
-RUN dotnet publish -c Release -o out
-
-# Stage 3: Final image — patch the runtime with io_uring binaries
-FROM mcr.microsoft.com/dotnet/aspnet:11.0-preview
-
-# Install libmsquic for HTTP/3
-ADD https://packages.microsoft.com/config/debian/12/packages-microsoft-prod.deb /packages-microsoft-prod.deb
-RUN dpkg -i packages-microsoft-prod.deb && rm packages-microsoft-prod.deb \
-    && apt-get update \
-    && apt-get install -y --no-install-recommends libmsquic \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*
-
-# Overlay custom runtime libraries (io_uring socket engine)
-COPY --from=runtime-build /runtime/artifacts/bin/runtime/net11.0-linux-Release-x64/ /tmp/iouring-runtime/
-RUN cp -f /tmp/iouring-runtime/* /usr/share/dotnet/shared/Microsoft.NETCore.App/11.0.0-preview.*/ \
-    && rm -rf /tmp/iouring-runtime \
-    && echo "=== Overlay applied to ===" && ls -d /usr/share/dotnet/shared/Microsoft.NETCore.App/11.0.0-preview.*
-
-WORKDIR /app
-COPY --from=app-build /app/out .
-EXPOSE 8080 8443/tcp 8443/udp
-
-# Enable io_uring socket engine with SQPOLL (kernel-side polling)
-ENV DOTNET_SYSTEM_NET_SOCKETS_IO_URING=1
-ENV DOTNET_SYSTEM_NET_SOCKETS_IO_URING_SQPOLL=1
-
-ENTRYPOINT ["dotnet", "aspnet-minimal-iouring.dll"]
diff --git a/frameworks/aspnet-minimal-iouring/Handlers.cs b/frameworks/aspnet-minimal-iouring/Handlers.cs
deleted file mode 100644
index 856c6e638..000000000
--- a/frameworks/aspnet-minimal-iouring/Handlers.cs
+++ /dev/null
@@ -1,319 +0,0 @@
-using System.Text.Json;
-using System.Buffers;
-using System.Text.Json.Serialization;
-using Microsoft.AspNetCore.Http.HttpResults;
-using Microsoft.Extensions.Caching.Memory;
-using StackExchange.Redis;
-
-
-[JsonSerializable(typeof(ResponseDto<ProcessedItem>))]
-[JsonSerializable(typeof(ResponseDto<DbResponseItemDto>))]
-[JsonSerializable(typeof(DbResponseItemDto))]
-[JsonSerializable(typeof(ProcessedItem))]
-[JsonSerializable(typeof(RatingInfo))]
-[JsonSerializable(typeof(List<string>))]
-[JsonSerializable(typeof(CrudListResponse))]
-[JsonSerializable(typeof(CrudWriteResponse))]
-[JsonSourceGenerationOptions(PropertyNamingPolicy = JsonKnownNamingPolicy.CamelCase)]
-partial class AppJsonContext : JsonSerializerContext { }
-
-static class Handlers
-{
-    // Returning `string` makes ASP.NET minimal APIs set Content-Type to
-    // text/plain automatically. Returning `int` defaults to JSON and
-    // serializes the bare number — which violates the baseline contract.
-    public static string Sum(int a, int b) => (a + b).ToString();
-
-    public static async ValueTask<string> SumBody(int a, int b, HttpRequest req)
-    {
-        using var reader = new StreamReader(req.Body);
-        return (a + b + int.Parse(await reader.ReadToEndAsync())).ToString();
-    }
-
-    public static string Text() => "ok";
-
-    public static async ValueTask<string> Upload(HttpRequest req)
-    {
-        long size = 0;
-        var buffer = ArrayPool<byte>.Shared.Rent(65536);
-        try
-        {
-            int read;
-            while ((read = await req.Body.ReadAsync(buffer.AsMemory(0, buffer.Length))) > 0)
-            {
-                size += read;
-            }
-        }
-        finally
-        {
-            ArrayPool<byte>.Shared.Return(buffer);
-        }
-
-        return size.ToString();
-    }
-
-    public static Results<JsonHttpResult<ResponseDto<ProcessedItem>>, ProblemHttpResult> Json(int count, HttpRequest req)
-    {
-        var source = AppData.DatasetItems;
-        if (source == null)
-            return TypedResults.Problem("Dataset not loaded");
-
-        if (count > source.Count) count = source.Count;
-        if (count < 0) count = 0;
-
-        int m = 1;
-        if (req.Query.TryGetValue("m", out var mVal) && int.TryParse(mVal, out var pm)) m = pm;
-
-        var items = new ProcessedItem[count];
-
-        for (int i = 0; i < count; i++)
-        {
-            var item = source[i];
-            items[i] = new ProcessedItem
-            {
-                Id = item.Id,
-                Name = item.Name,
-                Category = item.Category,
-                Price = item.Price,
-                Quantity = item.Quantity,
-                Active = item.Active,
-                Tags = item.Tags,
-                Rating = item.Rating,
-                Total = item.Price * item.Quantity * m
-            };
-        }
-
-        return TypedResults.Json(new ResponseDto<ProcessedItem>(items, count), AppJsonContext.Default.ResponseDtoProcessedItem);
-    }
-
-    public static async Task<Results<JsonHttpResult<ResponseDto<DbResponseItemDto>>, ProblemHttpResult>> AsyncDatabase(HttpRequest req)
-    {
-        if (AppData.PgDataSource == null)
-            return TypedResults.Problem("DB not available");
-
-        // Query Parsing
-        double min = 10, max = 50;
-        int limit = 50;
-        var query = req.Query;
-        if (query.TryGetValue("min", out var minVal) && double.TryParse(minVal, out var pmin)) min = pmin;
-        if (query.TryGetValue("max", out var maxVal) && double.TryParse(maxVal, out var pmax)) max = pmax;
-        if (query.TryGetValue("limit", out var limVal) && int.TryParse(limVal, out var plim)) limit = Math.Clamp(plim, 1, 50);
-
-        await using var cmd = AppData.PgDataSource.CreateCommand(
-            "SELECT id, name, category, price, quantity, active, tags, rating_score, rating_count FROM items WHERE price BETWEEN $1 AND $2 LIMIT $3");
-        
-        cmd.Parameters.AddWithValue(min);
-        cmd.Parameters.AddWithValue(max);
-        cmd.Parameters.AddWithValue(limit);
-
-        await using var reader = await cmd.ExecuteReaderAsync();
-
-        var items = new List<DbResponseItemDto>(limit);
-
-        while (await reader.ReadAsync())
-        {
-            items.Add(new DbResponseItemDto
-            {
-                Id = reader.GetInt32(0),
-                Name = reader.GetString(1),
-                Category = reader.GetString(2),
-                Price = (int)reader.GetDouble(3),
-                Quantity = reader.GetInt32(4),
-                Active = reader.GetBoolean(5),
-                Tags = JsonSerializer.Deserialize(reader.GetString(6), AppJsonContext.Default.ListString)!,
-                Rating = new RatingInfo { Score = (int)reader.GetDouble(7), Count = reader.GetInt32(8) }
-            });
-        }
-
-        return TypedResults.Json(new ResponseDto<DbResponseItemDto>(items, items.Count), AppJsonContext.Default.ResponseDtoDbResponseItemDto);
-    }
-
-    // ── CRUD handlers ──────────────────────────────────────────────────
-    //
-    // Realistic REST API with paginated list, cached single-item read,
-    // create, and update. Cache-aside on single-item reads with 200ms TTL,
-    // invalidated on PUT. List queries always hit Postgres.
-
-    private static readonly MemoryCacheEntryOptions _crudCacheOpts =
-        new() { AbsoluteExpirationRelativeToNow = TimeSpan.FromMilliseconds(200) };
-
-    private static readonly JsonSerializerOptions _crudJsonOpts =
-        new(JsonSerializerDefaults.Web);
-
-    // GET /crud/items?category=X&page=N&limit=M — paginated list (always DB, never cached)
-    public static async Task<IResult> CrudList(HttpRequest req)
-    {
-        if (AppData.PgDataSource is null)
-            return TypedResults.Problem("DB not available");
-
-        var query = req.Query;
-        var category = query["category"].ToString();
-        if (string.IsNullOrEmpty(category)) category = "electronics";
-        int.TryParse(query["page"], out var page);
-        if (page < 1) page = 1;
-        int.TryParse(query["limit"], out var limit);
-        if (limit < 1 || limit > 50) limit = 10;
-        var offset = (page - 1) * limit;
-
-        // Single data query. The previous COUNT(*) pass was 90%+ of PG CPU
-        // because concurrent writes kept the visibility map dirty, forcing
-        // heap fetches on every index-only scan. "Load more" pagination
-        // (return page size, no total) is a realistic alternative that
-        // removes that dominant cost.
-        await using var cmd = AppData.PgDataSource.CreateCommand(
-            "SELECT id, name, category, price, quantity, active, tags, rating_score, rating_count " +
-            "FROM items WHERE category = $1 ORDER BY id LIMIT $2 OFFSET $3");
-        cmd.Parameters.AddWithValue(category);
-        cmd.Parameters.AddWithValue(limit);
-        cmd.Parameters.AddWithValue(offset);
-
-        await using var reader = await cmd.ExecuteReaderAsync();
-        var items = new List<DbResponseItemDto>();
-        while (await reader.ReadAsync())
-        {
-            items.Add(new DbResponseItemDto
-            {
-                Id       = reader.GetInt32(0),
-                Name     = reader.GetString(1),
-                Category = reader.GetString(2),
-                Price    = reader.GetInt32(3),
-                Quantity = reader.GetInt32(4),
-                Active   = reader.GetBoolean(5),
-                Tags     = JsonSerializer.Deserialize(reader.GetString(6), AppJsonContext.Default.ListString)!,
-                Rating   = new RatingInfo { Score = (int)reader.GetDouble(7), Count = reader.GetInt32(8) }
-            });
-        }
-
-        return TypedResults.Json(new CrudListResponse { Items = items, Total = items.Count, Page = page, Limit = limit },
-            AppJsonContext.Default.CrudListResponse);
-    }
-
-    // GET /crud/items/{id} — single item, cached with 200ms TTL.
-    // Redis when REDIS_URL is set (cache stores pre-serialized JSON string so
-    // HIT path skips a Serialize+Deserialize round trip); else in-process
-    // IMemoryCache (caches the typed DTO).
-    public static async Task<IResult> CrudRead(int id, IMemoryCache cache, HttpContext ctx)
-    {
-        if (AppData.PgDataSource is null)
-            return TypedResults.Problem("DB not available");
-
-        var cacheKey = $"crud:{id}";
-
-        if (AppData.RedisDb is not null)
-        {
-            var cachedJson = await AppData.RedisDb.StringGetAsync(cacheKey);
-            if (cachedJson.HasValue)
-            {
-                ctx.Response.Headers["X-Cache"] = "HIT";
-                return Results.Content((string)cachedJson!, "application/json");
-            }
-
-            var item = await FetchItemByIdAsync(id);
-            if (item is null) return TypedResults.NotFound();
-
-            var json = JsonSerializer.Serialize(item, AppJsonContext.Default.DbResponseItemDto);
-            await AppData.RedisDb.StringSetAsync(cacheKey, json, TimeSpan.FromMilliseconds(200));
-            ctx.Response.Headers["X-Cache"] = "MISS";
-            return Results.Content(json, "application/json");
-        }
-
-        if (cache.TryGetValue(cacheKey, out DbResponseItemDto? cached))
-        {
-            ctx.Response.Headers["X-Cache"] = "HIT";
-            return TypedResults.Json(cached, AppJsonContext.Default.DbResponseItemDto);
-        }
-
-        var dto = await FetchItemByIdAsync(id);
-        if (dto is null) return TypedResults.NotFound();
-
-        cache.Set(cacheKey, dto, _crudCacheOpts);
-        ctx.Response.Headers["X-Cache"] = "MISS";
-        return TypedResults.Json(dto, AppJsonContext.Default.DbResponseItemDto);
-    }
-
-    private static async Task<DbResponseItemDto?> FetchItemByIdAsync(int id)
-    {
-        await using var cmd = AppData.PgDataSource!.CreateCommand(
-            "SELECT id, name, category, price, quantity, active, tags, rating_score, rating_count " +
-            "FROM items WHERE id = $1 LIMIT 1");
-        cmd.Parameters.AddWithValue(id);
-
-        await using var reader = await cmd.ExecuteReaderAsync();
-        if (!await reader.ReadAsync()) return null;
-
-        return new DbResponseItemDto
-        {
-            Id       = reader.GetInt32(0),
-            Name     = reader.GetString(1),
-            Category = reader.GetString(2),
-            Price    = reader.GetInt32(3),
-            Quantity = reader.GetInt32(4),
-            Active   = reader.GetBoolean(5),
-            Tags     = JsonSerializer.Deserialize(reader.GetString(6), AppJsonContext.Default.ListString)!,
-            Rating   = new RatingInfo { Score = (int)reader.GetDouble(7), Count = reader.GetInt32(8) }
-        };
-    }
-
-    // POST /crud/items — create item, return 201
-    public static async Task<IResult> CrudCreate(HttpRequest req)
-    {
-        if (AppData.PgDataSource is null)
-            return TypedResults.Problem("DB not available");
-
-        using var sr = new StreamReader(req.Body);
-        var body = await sr.ReadToEndAsync();
-        var input = JsonSerializer.Deserialize<CrudItemInput>(body, _crudJsonOpts);
-        if (input is null)
-            return TypedResults.BadRequest();
-
-        await using var cmd = AppData.PgDataSource.CreateCommand(
-            "INSERT INTO items (id, name, category, price, quantity, active, tags, rating_score, rating_count) " +
-            "VALUES ($1, $2, $3, $4, $5, true, '[\"bench\"]', 0, 0) " +
-            "ON CONFLICT (id) DO UPDATE SET name = $2, price = $4, quantity = $5 " +
-            "RETURNING id");
-        cmd.Parameters.AddWithValue(input.Id);
-        cmd.Parameters.AddWithValue(input.Name ?? "New Product");
-        cmd.Parameters.AddWithValue(input.Category ?? "test");
-        cmd.Parameters.AddWithValue(input.Price);
-        cmd.Parameters.AddWithValue(input.Quantity);
-
-        var newId = (int)(await cmd.ExecuteScalarAsync())!;
-        return TypedResults.Json(
-            new CrudWriteResponse { Id = newId, Name = input.Name, Category = input.Category, Price = input.Price, Quantity = input.Quantity },
-            AppJsonContext.Default.CrudWriteResponse, statusCode: 201);
-    }
-
-    // PUT /crud/items/{id} — update item, invalidate cache
-    public static async Task<IResult> CrudUpdate(int id, HttpRequest req, IMemoryCache cache)
-    {
-        if (AppData.PgDataSource is null)
-            return TypedResults.Problem("DB not available");
-
-        using var sr = new StreamReader(req.Body);
-        var body = await sr.ReadToEndAsync();
-        var input = JsonSerializer.Deserialize<CrudItemInput>(body, _crudJsonOpts);
-        if (input is null)
-            return TypedResults.BadRequest();
-
-        await using var cmd = AppData.PgDataSource.CreateCommand(
-            "UPDATE items SET name = $1, price = $2, quantity = $3 WHERE id = $4");
-        cmd.Parameters.AddWithValue(input.Name ?? "Updated");
-        cmd.Parameters.AddWithValue(input.Price);
-        cmd.Parameters.AddWithValue(input.Quantity);
-        cmd.Parameters.AddWithValue(id);
-
-        var affected = await cmd.ExecuteNonQueryAsync();
-        if (affected == 0) return TypedResults.NotFound();
-
-        var cacheKey = $"crud:{id}";
-        if (AppData.RedisDb is not null)
-            await AppData.RedisDb.KeyDeleteAsync(cacheKey);
-        else
-            cache.Remove(cacheKey);
-        return TypedResults.Json(
-            new CrudWriteResponse { Id = id, Name = input.Name, Price = input.Price, Quantity = input.Quantity },
-            AppJsonContext.Default.CrudWriteResponse);
-    }
-}
-
-record CrudItemInput(int Id, string? Name, string? Category, int Price, int Quantity);
\ No newline at end of file
diff --git a/frameworks/aspnet-minimal-iouring/Models.cs b/frameworks/aspnet-minimal-iouring/Models.cs
deleted file mode 100644
index 3f12c8ea4..000000000
--- a/frameworks/aspnet-minimal-iouring/Models.cs
+++ /dev/null
@@ -1,62 +0,0 @@
-sealed record ResponseDto<T>(IReadOnlyList<T> Items, int Count);
-
-
-sealed class DbResponseItemDto
-{
-    public int Id { get; set; }
-    public string Name { get; set; } = "";
-    public string Category { get; set; } = "";
-    public int Price { get; set; }
-    public int Quantity { get; set; }
-    public bool Active { get; set; }
-    public List<string> Tags { get; set; } = [];
-    public RatingInfo Rating { get; set; } = new();
-}
-
-sealed class DatasetItem
-{
-    public int Id { get; set; }
-    public string Name { get; set; } = "";
-    public string Category { get; set; } = "";
-    public int Price { get; set; }
-    public int Quantity { get; set; }
-    public bool Active { get; set; }
-    public List<string> Tags { get; set; } = [];
-    public RatingInfo Rating { get; set; } = new();
-}
-
-sealed class ProcessedItem
-{
-    public int Id { get; set; }
-    public string Name { get; set; } = "";
-    public string Category { get; set; } = "";
-    public int Price { get; set; }
-    public int Quantity { get; set; }
-    public bool Active { get; set; }
-    public List<string> Tags { get; set; } = [];
-    public RatingInfo Rating { get; set; } = new();
-    public long Total { get; set; }
-}
-
-sealed class RatingInfo
-{
-    public int Score { get; set; }
-    public int Count { get; set; }
-}
-
-sealed class CrudListResponse
-{
-    public List<DbResponseItemDto> Items { get; set; } = [];
-    public long Total { get; set; }
-    public int Page { get; set; }
-    public int Limit { get; set; }
-}
-
-sealed class CrudWriteResponse
-{
-    public int Id { get; set; }
-    public string? Name { get; set; }
-    public string? Category { get; set; }
-    public int Price { get; set; }
-    public int Quantity { get; set; }
-}
diff --git a/frameworks/aspnet-minimal-iouring/Program.cs b/frameworks/aspnet-minimal-iouring/Program.cs
deleted file mode 100644
index add2723ac..000000000
--- a/frameworks/aspnet-minimal-iouring/Program.cs
+++ /dev/null
@@ -1,108 +0,0 @@
-using System.Security.Cryptography.X509Certificates;
-
-using Microsoft.AspNetCore.ResponseCompression;
-using Microsoft.AspNetCore.Server.Kestrel.Core;
-using Microsoft.AspNetCore.StaticFiles;
-using Microsoft.Extensions.Caching.Memory;
-
-// Turn on the io_uring socket engine with kernel-side SQPOLL before the
-// runtime wires up System.Net.Sockets. This AppContext switch must be
-// set before any Socket is created — doing it at the very top of Main
-// guarantees ordering.
-AppContext.SetSwitch("System.Net.Sockets.UseIoUringSqPoll", true);
-
-var builder = WebApplication.CreateBuilder(args);
-builder.Logging.ClearProviders();
-builder.Services.AddMemoryCache();
-
-var certPath = Environment.GetEnvironmentVariable("TLS_CERT") ?? "/certs/server.crt";
-var keyPath = Environment.GetEnvironmentVariable("TLS_KEY") ?? "/certs/server.key";
-var hasCert = File.Exists(certPath) && File.Exists(keyPath);
-
-builder.WebHost.ConfigureKestrel(options =>
-{
-    options.Limits.Http2.MaxStreamsPerConnection = 256;
-    options.Limits.Http2.InitialConnectionWindowSize = 2 * 1024 * 1024;
-    options.Limits.Http2.InitialStreamWindowSize = 1024 * 1024;
-
-    options.ListenAnyIP(8080, lo =>
-    {
-        lo.Protocols = HttpProtocols.Http1;
-    });
-
-    if (hasCert)
-    {
-        options.ListenAnyIP(8443, lo =>
-        {
-            lo.Protocols = HttpProtocols.Http1AndHttp2AndHttp3;
-            lo.UseHttps(X509Certificate2.CreateFromPemFile(certPath, keyPath));
-        });
-
-        // HTTP/1.1-only TLS listener for the json-tls profile. Kestrel
-        // advertises http/1.1 via ALPN so HTTP/1.1-only clients (wrk) negotiate
-        // correctly and never upgrade to h2.
-        options.ListenAnyIP(8081, lo =>
-        {
-            lo.Protocols = HttpProtocols.Http1;
-            lo.UseHttps(X509Certificate2.CreateFromPemFile(certPath, keyPath));
-        });
-    }
-});
-
-// Explicit provider registration — the custom benaadams/runtime io_uring
-// branch is based on a .NET 11 snapshot that predates ZstandardCompressionOptions
-// in System.IO.Compression. AddResponseCompression()'s default factory tries
-// to instantiate all three providers (Brotli, Gzip, Zstandard) and throws
-// TypeLoadException at startup when Zstandard's type is missing. Register
-// only the two providers the json-comp profile exercises to avoid that.
-builder.Services.AddResponseCompression(options =>
-{
-    options.Providers.Add<BrotliCompressionProvider>();
-    options.Providers.Add<GzipCompressionProvider>();
-});
-
-var app = builder.Build();
-
-app.UseResponseCompression();
-
-app.Use((ctx, next) =>
-{
-    ctx.Response.Headers.Server = "aspnet-minimal-iouring";
-    return next();
-});
-
-AppData.Load();
-
-// Report whether the custom io_uring runtime overlay is actually in effect,
-// visible in `docker logs httparena-bench-aspnet-minimal-iouring` for sanity.
-var ioUringEnv = Environment.GetEnvironmentVariable("DOTNET_SYSTEM_NET_SOCKETS_IO_URING");
-Console.WriteLine($"[io_uring] DOTNET_SYSTEM_NET_SOCKETS_IO_URING={ioUringEnv ?? "(not set)"}");
-var socketAsm = typeof(System.Net.Sockets.Socket).Assembly;
-var ioUringType = socketAsm.GetTypes()
-    .FirstOrDefault(t => t.Name.Contains("IOUring", StringComparison.OrdinalIgnoreCase));
-Console.WriteLine(ioUringType != null
-    ? $"[io_uring] Runtime type found: {ioUringType.FullName} — io_uring is ACTIVE"
-    : "[io_uring] No io_uring types in runtime — falling back to epoll");
-
-app.MapGet("/pipeline", Handlers.Text);
-
-app.MapGet("/baseline11", Handlers.Sum);
-app.MapPost("/baseline11", Handlers.SumBody);
-app.MapGet("/baseline2", Handlers.Sum);
-
-app.MapPost("/upload", Handlers.Upload);
-app.MapGet("/json/{count}", Handlers.Json);
-app.MapGet("/async-db", Handlers.AsyncDatabase);
-
-// ── CRUD endpoints ─────────────────────────────────────────────────────────
-// Realistic REST API: paginated list, cached single-item read, create, update.
-// In-process IMemoryCache with 1s TTL on single-item reads, invalidated on PUT.
-
-app.MapGet("/crud/items", Handlers.CrudList);
-app.MapGet("/crud/items/{id:int}", Handlers.CrudRead);
-app.MapPost("/crud/items", Handlers.CrudCreate);
-app.MapPut("/crud/items/{id:int}", Handlers.CrudUpdate);
-
-app.MapStaticAssets();
-
-app.Run();
diff --git a/frameworks/aspnet-minimal-iouring/aspnet-minimal-iouring.csproj b/frameworks/aspnet-minimal-iouring/aspnet-minimal-iouring.csproj
deleted file mode 100644
index a0df238dc..000000000
--- a/frameworks/aspnet-minimal-iouring/aspnet-minimal-iouring.csproj
+++ /dev/null
@@ -1,12 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk.Web">
-  <PropertyGroup>
-    <TargetFramework>net11.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-    <ServerGarbageCollection>true</ServerGarbageCollection>
-  </PropertyGroup>
-  <ItemGroup>
-    <PackageReference Include="Npgsql" Version="*" />
-    <PackageReference Include="StackExchange.Redis" Version="2.8.22" />
-  </ItemGroup>
-</Project>
diff --git a/frameworks/aspnet-minimal-iouring/build.sh b/frameworks/aspnet-minimal-iouring/build.sh
deleted file mode 100755
index 6462b022b..000000000
--- a/frameworks/aspnet-minimal-iouring/build.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-ROOT_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
-docker build -t httparena-aspnet-minimal-iouring -f "$SCRIPT_DIR/Dockerfile" "$ROOT_DIR"
diff --git a/frameworks/aspnet-minimal-iouring/meta.json b/frameworks/aspnet-minimal-iouring/meta.json
deleted file mode 100644
index 425d9014d..000000000
--- a/frameworks/aspnet-minimal-iouring/meta.json
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  "display_name": "aspnet-minimal-iouring",
-  "language": "C#",
-  "type": "flagship",
-  "mode": "tuned",
-  "engine": "io_uring",
-  "description": "ASP.NET Core minimal API with experimental io_uring socket engine (dotnet/runtime#124374). Replaces epoll with io_uring for socket I/O on Linux 6.1+.",
-  "repo": "https://github.com/benaadams/runtime/tree/io_uring",
-  "enabled": true,
-  "tests": [
-    "baseline",
-    "pipelined",
-    "limited-conn",
-    "json",
-    "json-comp",
-    "json-tls",
-    "upload",
-    "api-4",
-    "api-16",
-    "static",
-    "async-db",
-    "crud",
-    "baseline-h2",
-    "static-h2",
-    "baseline-h3",
-    "static-h3"
-  ],
-  "maintainers": []
-}
\ No newline at end of file
diff --git a/frameworks/aspnet-minimal-iouring/patch-iouring.py b/frameworks/aspnet-minimal-iouring/patch-iouring.py
deleted file mode 100644
index 6a20aa918..000000000
--- a/frameworks/aspnet-minimal-iouring/patch-iouring.py
+++ /dev/null
@@ -1,132 +0,0 @@
-#!/usr/bin/env python3
-"""Patch io_uring branch for build errors."""
-
-# Patch 1: Fix csproj — add Intrinsics reference + suppress warnings
-csproj = 'src/libraries/System.Net.Sockets/src/System.Net.Sockets.csproj'
-with open(csproj) as f:
-    text = f.read()
-
-if 'System.Runtime.Intrinsics' not in text:
-    text = text.replace(
-        'System.Runtime.InteropServices.csproj" />',
-        'System.Runtime.InteropServices.csproj" />\n    <ProjectReference Include="$(LibrariesProjectRoot)System.Runtime.Intrinsics\\src\\System.Runtime.Intrinsics.csproj" />',
-        1)
-    print('Patched: added System.Runtime.Intrinsics reference')
-
-if 'IDE0059' not in text:
-    text = text.replace(
-        '</PropertyGroup>',
-        '  <NoWarn>$(NoWarn);IDE0059;CA1822;CA1823;CS0219</NoWarn>\n  </PropertyGroup>',
-        1)
-    print('Patched: suppressed analyzer warnings')
-
-with open(csproj, 'w') as f:
-    f.write(text)
-
-# Patch 2: Fix CS0212 in SocketAsyncEngine.Linux.cs
-# The 4 errors are all `&result` used in methods with `out int result` parameter.
-# Fix: change `out int result` to a local variable pattern.
-# Simple approach: find every line with `&result` and replace with `&_result`,
-# then find the method bodies and add the local var + assignment.
-src_file = 'src/libraries/System.Net.Sockets/src/System/Net/Sockets/SocketAsyncEngine.Linux.cs'
-with open(src_file) as f:
-    lines = f.readlines()
-
-# First pass: find all line numbers that contain '&result' (the problematic ones)
-problem_lines = set()
-for i, line in enumerate(lines):
-    if '&result)' in line or '&result ;' in line:
-        problem_lines.add(i)
-
-print(f'Found {len(problem_lines)} lines with &result')
-
-# Find the methods containing these lines by scanning backwards for 'out int result'
-method_starts = {}  # line_num -> list of problem lines in that method
-for pl in problem_lines:
-    # Scan backwards to find 'out int result)'
-    for j in range(pl, max(pl - 30, 0), -1):
-        if 'out int result)' in lines[j]:
-            if j not in method_starts:
-                method_starts[j] = []
-            method_starts[j].append(pl)
-            break
-
-print(f'Found {len(method_starts)} methods to patch')
-
-# For each method, find its opening brace, add local var, replace &result, add assignment
-# Work backwards to preserve line numbers
-for sig_line in sorted(method_starts.keys(), reverse=True):
-    # Find opening brace after signature
-    brace_line = None
-    for j in range(sig_line, min(sig_line + 10, len(lines))):
-        stripped = lines[j].strip()
-        if stripped == '{':
-            brace_line = j
-            break
-        if '{' in stripped and 'out int result)' not in stripped:
-            brace_line = j
-            break
-
-    if brace_line is None:
-        print(f'  WARNING: could not find opening brace for method at line {sig_line}')
-        continue
-
-    # Find closing brace
-    depth = 0
-    close_line = None
-    for j in range(brace_line, len(lines)):
-        depth += lines[j].count('{') - lines[j].count('}')
-        if depth == 0:
-            close_line = j
-            break
-
-    if close_line is None:
-        print(f'  WARNING: could not find closing brace for method at line {sig_line}')
-        continue
-
-    # Get indentation
-    indent = ' ' * (len(lines[brace_line + 1]) - len(lines[brace_line + 1].lstrip()))
-
-    # Replace &result with &_result in the method body
-    for j in range(brace_line + 1, close_line):
-        if '&result' in lines[j]:
-            lines[j] = lines[j].replace('&result', '&_result')
-
-    # Add 'result = _result;' before each 'return err;' in the method
-    for j in range(close_line - 1, brace_line, -1):
-        if 'return err;' in lines[j]:
-            ret_indent = ' ' * (len(lines[j]) - len(lines[j].lstrip()))
-            lines.insert(j, f'{ret_indent}result = _result;\n')
-
-    # Add local variable after opening brace
-    lines.insert(brace_line + 1, f'{indent}int _result = 0;\n')
-
-    print(f'  Patched method at line {sig_line + 1}')
-
-with open(src_file, 'w') as f:
-    f.writelines(lines)
-print('Done patching SocketAsyncEngine')
-
-# Patch 3: Fix "Destination is too short" in FinishOperationAccept
-# io_uring accept returns full sockaddr_storage (128 bytes) but the
-# remoteSocketAddress buffer is sized for the specific address family.
-# Fix: clamp copy length to destination size.
-saea_file = 'src/libraries/System.Net.Sockets/src/System/Net/Sockets/SocketAsyncEventArgs.Unix.cs'
-with open(saea_file) as f:
-    saea_text = f.read()
-
-old_copy = 'new ReadOnlySpan<byte>(_acceptBuffer, 0, _acceptAddressBufferCount).CopyTo(remoteSocketAddress.Buffer.Span);'
-new_copy = ('int _copyLen = Math.Min(_acceptAddressBufferCount, remoteSocketAddress.Buffer.Length);\n'
-            '            new ReadOnlySpan<byte>(_acceptBuffer, 0, _copyLen).CopyTo(remoteSocketAddress.Buffer.Span);')
-
-if old_copy in saea_text:
-    saea_text = saea_text.replace(old_copy, new_copy)
-    # Also fix the Size assignment to use clamped length
-    saea_text = saea_text.replace(
-        'remoteSocketAddress.Size = _acceptAddressBufferCount;',
-        'remoteSocketAddress.Size = _copyLen;')
-    with open(saea_file, 'w') as f:
-        f.write(saea_text)
-    print('Patched: FinishOperationAccept buffer overflow fix')
-else:
-    print('WARNING: could not find FinishOperationAccept CopyTo pattern')
diff --git a/frameworks/bananabread/.dockerignore b/frameworks/bananabread/.dockerignore
deleted file mode 100644
index f9b345977..000000000
--- a/frameworks/bananabread/.dockerignore
+++ /dev/null
@@ -1,3 +0,0 @@
-seagreen/
-node_modules/
-bun.lockb
diff --git a/frameworks/bananabread/.gitignore b/frameworks/bananabread/.gitignore
deleted file mode 100644
index 5fc766605..000000000
--- a/frameworks/bananabread/.gitignore
+++ /dev/null
@@ -1,4 +0,0 @@
-seagreen/
-node_modules/
-bun.lockb
-.DS_Store
diff --git a/frameworks/bananabread/Dockerfile b/frameworks/bananabread/Dockerfile
deleted file mode 100644
index 7bf70c21f..000000000
--- a/frameworks/bananabread/Dockerfile
+++ /dev/null
@@ -1,32 +0,0 @@
-# The oven/bun x64 images ship the "baseline" (non-AVX2) Bun build for CPU portability. In Bun
-# 1.3.x that baseline build has a code-generation bug that miscompiles Seagreen's layout router:
-# request dispatch for routes past roughly the fifth entry in a layout 404s even though the
-# handlers are registered (/async-db and the deeper /crud routes break). The AVX2 build — the
-# flavor `bun.sh/install` selects on an AVX2 CPU, and the one that runs correctly on the host —
-# routes them correctly and is faster besides. So we take the Debian (glibc) image for its
-# tooling and replace bun with the AVX2 build. glibc, not alpine/musl, because the prebuilt
-# AVX2 binary the installer fetches here is glibc-linked.
-FROM oven/bun:1
-RUN apt-get update \
- && apt-get install -y --no-install-recommends git ca-certificates curl unzip \
- && rm -rf /var/lib/apt/lists/* \
- && curl -fsSL https://bun.sh/install | bash -s "bun-v1.3.14" \
- && cp -f /root/.bun/bin/bun "$(command -v bun)" \
- && rm -rf /root/.bun \
- && echo "bun build flavor: $(bun -e 'throw 0' 2>&1 | grep -o 'Linux x64[^)]*')"
-WORKDIR /app
-
-# App deps (reflect-metadata powers the decorator-based webservice routing).
-COPY package.json ./
-RUN bun install
-
-COPY tsconfig.json ./
-COPY src ./src
-
-# Seagreen (the TypeScript GenHTTP port) is consumed by relative import from ./seagreen.
-# Cloned at build time from its public repo; bare imports (reflect-metadata) resolve from /app.
-RUN git clone --depth 1 https://github.com/dotnet-web-stack/Seagreen.git seagreen
-
-EXPOSE 8080
-# Bun runs the TypeScript directly (no build step); main.ts forks one worker per core.
-ENTRYPOINT ["bun", "run", "src/main.ts"]
diff --git a/frameworks/bananabread/README.md b/frameworks/bananabread/README.md
deleted file mode 100644
index 97ac431d4..000000000
--- a/frameworks/bananabread/README.md
+++ /dev/null
@@ -1,41 +0,0 @@
-# bananabread
-
-A HttpArena entry for **Seagreen** — a TypeScript port of [GenHTTP](https://github.com/Kaliumhexacyanoferrat/GenHTTP)
-on the [Bun](https://bun.sh) runtime (the TypeScript sibling of the Kotlin port, `fishcake`/CodeGreen).
-It runs GenHTTP's own internal HTTP/1.1 engine, built on `Bun.listen` raw TCP (not `Bun.serve`).
-
-## Stack
-
-- **Language:** TypeScript / Bun
-- **Framework:** Seagreen (TypeScript port of GenHTTP)
-- **Engine:** Seagreen internal engine (raw TCP via `Bun.listen`)
-- **Database:** Bun's built-in SQL client (`Bun.SQL`) for PostgreSQL
-- **Multi-core:** one worker process per core, sharing the port via `SO_REUSEPORT`
-- **Build:** none — Bun runs the TypeScript directly; Seagreen is cloned at image build time
-
-## Endpoints
-
-| Endpoint | Method | Description |
-|----------|--------|-------------|
-| `/pipeline` | GET | Returns `ok` |
-| `/baseline11` | GET / POST | Sums `a` + `b` (POST adds a body value) |
-| `/baseline2` | GET | Sums `a` + `b` |
-| `/json/{count}` | GET | Processes `count` dataset items; `?m=` scales the total (default 1) |
-| `/upload` | POST | Streams the body, returns the byte count |
-| `/async-db` | GET | `price BETWEEN min AND max` range query |
-| `/crud/items` | GET | Paged listing by category |
-| `/crud/items/{id}` | GET | Cached read (`X-Cache: HIT\|MISS`) |
-| `/crud/items` | POST | Upsert → `201 Created` |
-| `/crud/items/{id}` | PUT | Update, `404` when unknown |
-
-Declared profiles (`meta.json`): `baseline`, `pipelined`, `limited-conn`, `json`, `upload`,
-`async-db`, `crud`, `api-4`, `api-16`. TLS/HTTP-2, compression, static files, websockets and
-gRPC are omitted (those Seagreen modules are not ported yet).
-
-## Notes
-
-- The single-item CRUD read uses an in-process 200 ms TTL cache (mirrors GenHTTP's `MemoryCache`).
-- `DATABASE_URL`, `DATASET_PATH` follow the standard HttpArena contract; without `DATABASE_URL`
-  the database-backed endpoints degrade gracefully (empty results / `404`).
-- The image clones Seagreen from `main` (public repo `dotnet-web-stack/Seagreen`), so that branch
-  must contain the current engine (including the `workers()` API and the multi-worker spawn fix).
diff --git a/frameworks/bananabread/bun.lock b/frameworks/bananabread/bun.lock
deleted file mode 100644
index 8dd8e31b8..000000000
--- a/frameworks/bananabread/bun.lock
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  "lockfileVersion": 1,
-  "configVersion": 1,
-  "workspaces": {
-    "": {
-      "name": "bananabread",
-      "dependencies": {
-        "reflect-metadata": "^0.2.2",
-        "zod": "^3.24.0",
-      },
-    },
-  },
-  "packages": {
-    "reflect-metadata": ["reflect-metadata@0.2.2", "", {}, "sha512-urBwgfrvVP/eAyXx4hluJivBKzuEbSQs9rKWCrCkbSxNv8mxPcUZKeuoF3Uy4mJl3Lwprp6yy5/39VWigZ4K6Q=="],
-
-    "zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
-  }
-}
diff --git a/frameworks/bananabread/meta.json b/frameworks/bananabread/meta.json
deleted file mode 100644
index e0a536103..000000000
--- a/frameworks/bananabread/meta.json
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  "display_name": "bananabread",
-  "language": "TypeScript",
-  "type": "emerging",
-  "mode": "standard",
-  "engine": "seagreen",
-  "description": "Seagreen — a TypeScript port of GenHTTP — on Bun's raw-TCP engine, with kotlinx-style decorators and Bun's built-in SQL.",
-  "repo": "https://github.com/dotnet-web-stack/Seagreen",
-  "enabled": true,
-  "tests": [
-    "baseline",
-    "pipelined",
-    "limited-conn",
-    "json",
-    "upload",
-    "async-db",
-    "crud",
-    "api-4",
-    "api-16"
-  ],
-  "maintainers": []
-}
diff --git a/frameworks/bananabread/package.json b/frameworks/bananabread/package.json
deleted file mode 100644
index 356a59e13..000000000
--- a/frameworks/bananabread/package.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "name": "bananabread",
-  "private": true,
-  "type": "module",
-  "description": "HttpArena entry: Seagreen (TypeScript GenHTTP port) on Bun.",
-  "dependencies": {
-    "reflect-metadata": "^0.2.2",
-    "zod": "^3.24.0"
-  }
-}
diff --git a/frameworks/bananabread/seagreen b/frameworks/bananabread/seagreen
deleted file mode 120000
index 92efc2840..000000000
--- a/frameworks/bananabread/seagreen
+++ /dev/null
@@ -1 +0,0 @@
-/home/diogo/Desktop/Socket/Seagreen
\ No newline at end of file
diff --git a/frameworks/bananabread/src/data.ts b/frameworks/bananabread/src/data.ts
deleted file mode 100644
index 37cd8c74f..000000000
--- a/frameworks/bananabread/src/data.ts
+++ /dev/null
@@ -1,75 +0,0 @@
-/**
- * Data layer: the `/json` dataset (from DATASET_PATH) and PostgreSQL access via Bun's built-in
- * SQL client (Bun.SQL). When DATABASE_URL is unset, the DB queries return empty so the
- * database-backed endpoints degrade gracefully.
- */
-import { SQL } from "bun";
-import type { CrudCreateRequest, CrudUpdateRequest, DatasetItem, DbItem } from "./model.ts";
-
-const datasetFile = Bun.file(process.env.DATASET_PATH ?? "/data/dataset.json");
-export const dataset: DatasetItem[] = (await datasetFile.exists()) ? ((await datasetFile.json()) as DatasetItem[]) : [];
-
-// One Bun.SQL pool lives per worker process (Seagreen forks one worker per core), and the pools
-// must collectively stay under PostgreSQL's max_connections (the harness caps it at 256). The
-// default per-pool size (~10) × ~64 workers ≈ 640 connections blows past that, and the overflow
-// fails to open under load — surfacing as 5xx (and reconnect storms that wreck throughput). Size
-// each worker's pool so workers × poolMax stays well under 256 (~200, leaving headroom for
-// reserved/health connections); this matches the worker count main.ts derives.
-const workerCount = Number(process.env.WORKERS) || navigator.hardwareConcurrency || 1;
-const poolMax = Math.max(1, Math.floor(200 / workerCount));
-const sql = process.env.DATABASE_URL ? new SQL(process.env.DATABASE_URL, { max: poolMax }) : null;
-export const dbAvailable = sql !== null;
-
-// biome-ignore lint/suspicious/noExplicitAny: Bun.SQL rows are untyped records
-function toDbItem(r: any): DbItem {
-  return {
-    id: r.id,
-    name: r.name,
-    category: r.category,
-    price: r.price,
-    quantity: r.quantity,
-    active: r.active,
-    tags: r.tags ?? [],
-    rating: { score: r.rating_score, count: r.rating_count },
-  };
-}
-
-export async function rangeByPrice(min: number, max: number, limit: number): Promise<DbItem[]> {
-  if (!sql) return [];
-  const rows = await sql`SELECT id, name, category, price, quantity, active, tags, rating_score, rating_count
-                         FROM items WHERE price BETWEEN ${min} AND ${max} LIMIT ${limit}`;
-  return rows.map(toDbItem);
-}
-
-export async function listByCategory(category: string, limit: number, offset: number): Promise<DbItem[]> {
-  if (!sql) return [];
-  const rows = await sql`SELECT id, name, category, price, quantity, active, tags, rating_score, rating_count
-                         FROM items WHERE category = ${category} ORDER BY id LIMIT ${limit} OFFSET ${offset}`;
-  return rows.map(toDbItem);
-}
-
-export async function findById(id: number): Promise<DbItem | null> {
-  if (!sql) return null;
-  const rows = await sql`SELECT id, name, category, price, quantity, active, tags, rating_score, rating_count
-                         FROM items WHERE id = ${id} LIMIT 1`;
-  return rows.length ? toDbItem(rows[0]) : null;
-}
-
-export async function upsert(req: CrudCreateRequest): Promise<void> {
-  if (!sql) return;
-  const tags = JSON.stringify(req.tags ?? ["bench"]);
-  await sql`INSERT INTO items (id, name, category, price, quantity, active, tags, rating_score, rating_count)
-            VALUES (${req.id}, ${req.name}, ${req.category}, ${req.price}, ${req.quantity}, ${req.active ?? true}, ${tags}::jsonb, 0, 0)
-            ON CONFLICT (id) DO UPDATE SET name = EXCLUDED.name, category = EXCLUDED.category,
-              price = EXCLUDED.price, quantity = EXCLUDED.quantity, active = EXCLUDED.active, tags = EXCLUDED.tags`;
-}
-
-export async function update(id: number, req: CrudUpdateRequest): Promise<boolean> {
-  if (!sql) return false;
-  const rows = await sql`UPDATE items SET
-              name = COALESCE(${req.name ?? null}, name),
-              price = COALESCE(${req.price ?? null}, price),
-              quantity = COALESCE(${req.quantity ?? null}, quantity)
-            WHERE id = ${id} RETURNING id`;
-  return rows.length > 0;
-}
diff --git a/frameworks/bananabread/src/main.ts b/frameworks/bananabread/src/main.ts
deleted file mode 100644
index 670f22dab..000000000
--- a/frameworks/bananabread/src/main.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-import { Host } from "../seagreen/src/engine/internal/index.ts";
-import { dbAvailable } from "./data.ts";
-import { createApp } from "./project.ts";
-
-const port = Number(process.env.PORT ?? 8080);
-const workers = Number(process.env.WORKERS) || navigator.hardwareConcurrency || 1;
-
-if (!process.env.SEAGREEN_WORKER) {
-  console.log(`bananabread (Seagreen) → :${port}, ${workers} workers, database: ${dbAvailable ? "connected" : "disabled"}`);
-}
-
-await Host.create().handler(createApp()).port(port).workers(workers).run();
diff --git a/frameworks/bananabread/src/model.ts b/frameworks/bananabread/src/model.ts
deleted file mode 100644
index e5063b5a1..000000000
--- a/frameworks/bananabread/src/model.ts
+++ /dev/null
@@ -1,54 +0,0 @@
-export interface RatingInfo {
-  score: number;
-  count: number;
-}
-
-export interface DatasetItem {
-  id: number;
-  name: string;
-  category: string;
-  price: number;
-  quantity: number;
-  active: boolean;
-  tags: string[];
-  rating: RatingInfo;
-}
-
-export interface ProcessedItem extends DatasetItem {
-  total: number;
-}
-
-export interface DbItem {
-  id: number;
-  name: string;
-  category: string;
-  price: number;
-  quantity: number;
-  active: boolean;
-  tags: string[];
-  rating: RatingInfo;
-}
-
-export interface CrudCreateRequest {
-  id: number;
-  name: string;
-  category: string;
-  price: number;
-  quantity: number;
-  active?: boolean;
-  tags?: string[];
-}
-
-export interface CrudUpdateRequest {
-  name?: string;
-  price?: number;
-  quantity?: number;
-}
-
-/** Serialized as `{ "items": [...], "count": N }`. */
-export class ListWithCount<T> {
-  readonly count: number;
-  constructor(readonly items: T[]) {
-    this.count = items.length;
-  }
-}
diff --git a/frameworks/bananabread/src/project.ts b/frameworks/bananabread/src/project.ts
deleted file mode 100644
index cbbf92ee2..000000000
--- a/frameworks/bananabread/src/project.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import { Content, Resource } from "../seagreen/src/modules/io/index.ts";
-import { Layout, type LayoutBuilder } from "../seagreen/src/modules/layouting/index.ts";
-import { Service } from "../seagreen/src/modules/webservices/index.ts";
-import { AsyncDatabase, Baseline, Crud, JsonService, Upload } from "./services.ts";
-
-export function createApp(): LayoutBuilder {
-  return Layout.create()
-    .add("pipeline", Content.from(Resource.fromString("ok")))
-    .add("baseline11", Service.from(Baseline))
-    .add("baseline2", Service.from(Baseline))
-    .add("upload", Service.from(Upload))
-    .add("json", Service.from(JsonService))
-    .add("async-db", Service.from(AsyncDatabase))
-    .add("crud", Layout.create().add("items", Service.from(Crud)));
-}
diff --git a/frameworks/bananabread/src/services.ts b/frameworks/bananabread/src/services.ts
deleted file mode 100644
index 8b5526acf..000000000
--- a/frameworks/bananabread/src/services.ts
+++ /dev/null
@@ -1,173 +0,0 @@
-/**
- * Webservices for the HttpArena workloads, on Seagreen's decorator-based reflection stack.
- */
-import { RedisClient } from "bun";
-import {
-  ContentType,
-  ProviderException,
-  type Request,
-  type RequestBody,
-  type Response,
-  ResponseStatus,
-} from "../seagreen/src/api/index.ts";
-import { StringContent } from "../seagreen/src/modules/io/index.ts";
-import {
-  FromBody,
-  FromContent,
-  FromPath,
-  FromQuery,
-  FromStream,
-  Inject,
-  ResourceMethod,
-  Result,
-} from "../seagreen/src/modules/webservices/index.ts";
-import * as Data from "./data.ts";
-import { type CrudCreateRequest, type CrudUpdateRequest, type DbItem, ListWithCount, type ProcessedItem } from "./model.ts";
-
-/**
- * Single-item read cache for the cache-aside workload. The validation harness fires its two
- * cache probes on separate connections, which `SO_REUSEPORT` may route to different worker
- * processes — so a per-process map would report MISS twice. When REDIS_URL is provided the cache
- * is backed by Redis (Bun's built-in client) and therefore shared across workers; otherwise it
- * falls back to an in-process TTL map (correct for a single worker).
- */
-interface ItemCache {
-  get(id: number): Promise<string | undefined>;
-  set(id: number, body: string): Promise<void>;
-  invalidate(id: number): Promise<void>;
-}
-
-class InProcessCache implements ItemCache {
-  private readonly map = new Map<number, { body: string; expiresAt: number }>();
-  constructor(private readonly ttlMs: number) {}
-  async get(id: number): Promise<string | undefined> {
-    const e = this.map.get(id);
-    if (!e) return undefined;
-    if (e.expiresAt <= performance.now()) {
-      this.map.delete(id);
-      return undefined;
-    }
-    return e.body;
-  }
-  async set(id: number, body: string): Promise<void> {
-    this.map.set(id, { body, expiresAt: performance.now() + this.ttlMs });
-  }
-  async invalidate(id: number): Promise<void> {
-    this.map.delete(id);
-  }
-}
-
-class RedisCache implements ItemCache {
-  private readonly client: RedisClient;
-  constructor(
-    url: string,
-    private readonly ttlMs: number,
-  ) {
-    this.client = new RedisClient(url);
-  }
-  private key(id: number): string {
-    return `crud:item:${id}`;
-  }
-  async get(id: number): Promise<string | undefined> {
-    return (await this.client.get(this.key(id))) ?? undefined;
-  }
-  async set(id: number, body: string): Promise<void> {
-    await this.client.send("SET", [this.key(id), body, "PX", String(this.ttlMs)]);
-  }
-  async invalidate(id: number): Promise<void> {
-    await this.client.del(this.key(id));
-  }
-}
-
-const CACHE_TTL_MS = 1000;
-const cache: ItemCache = process.env.REDIS_URL
-  ? new RedisCache(process.env.REDIS_URL, CACHE_TTL_MS)
-  : new InProcessCache(CACHE_TTL_MS);
-
-export class Baseline {
-  @ResourceMethod("GET")
-  sum(@FromQuery("a") a: number, @FromQuery("b") b: number): number {
-    return a + b;
-  }
-
-  @ResourceMethod("POST")
-  sumBody(@FromQuery("a") a: number, @FromQuery("b") b: number, @FromBody() c: number): number {
-    return a + b + c;
-  }
-}
-
-export class Upload {
-  @ResourceMethod("POST")
-  async compute(@FromStream() body: RequestBody): Promise<number> {
-    let total = 0;
-    for await (const chunk of body.chunks()) total += chunk.length;
-    return total;
-  }
-}
-
-export class JsonService {
-  @ResourceMethod("GET", ":count")
-  compute(@FromPath("count") count: number, @FromQuery("m") m = 1): ListWithCount<ProcessedItem> {
-    if (Data.dataset.length === 0) throw new ProviderException(ResponseStatus.InternalServerError, "No dataset");
-    const take = Math.max(0, Math.min(count, Data.dataset.length));
-    const items = Data.dataset.slice(0, take).map((d) => ({ ...d, total: d.price * d.quantity * m }));
-    return new ListWithCount(items);
-  }
-}
-
-export class AsyncDatabase {
-  @ResourceMethod("GET")
-  async compute(@FromQuery("min") min = 10, @FromQuery("max") max = 50, @FromQuery("limit") limit = 50): Promise<ListWithCount<DbItem>> {
-    return new ListWithCount(await Data.rangeByPrice(min, max, Math.min(50, Math.max(1, limit))));
-  }
-}
-
-export class Crud {
-  @ResourceMethod("GET")
-  async list(@FromQuery("category") category = "electronics", @FromQuery("page") page = 1, @FromQuery("limit") limit = 10) {
-    const p = Math.max(1, page);
-    const l = Math.min(50, Math.max(1, limit));
-    const items = await Data.listByCategory(category, l, (p - 1) * l);
-    return { items, total: items.length, page: p, limit: l };
-  }
-
-  @ResourceMethod("GET", ":id")
-  async get(@FromPath("id") id: number, @Inject() request: Request): Promise<Response> {
-    const cached = await cache.get(id);
-    if (cached !== undefined) {
-      return request.respond().content(new StringContent(cached, ContentType.ApplicationJson)).header("X-Cache", "HIT").build();
-    }
-    const item = await Data.findById(id);
-    if (!item) throw new ProviderException(ResponseStatus.NotFound, `Item with ID ${id} does not exist`);
-    const json = JSON.stringify(item);
-    await cache.set(id, json);
-    return request.respond().content(new StringContent(json, ContentType.ApplicationJson)).header("X-Cache", "MISS").build();
-  }
-
-  @ResourceMethod("POST")
-  async create(@FromContent() item: CrudCreateRequest): Promise<Result<DbItem>> {
-    await Data.upsert(item);
-    await cache.invalidate(item.id);
-    const created: DbItem = {
-      id: item.id,
-      name: item.name,
-      category: item.category,
-      price: item.price,
-      quantity: item.quantity,
-      active: item.active ?? true,
-      tags: item.tags ?? ["bench"],
-      rating: { score: 0, count: 0 },
-    };
-    return new Result(created).status(ResponseStatus.Created);
-  }
-
-  @ResourceMethod("PUT", ":id")
-  async update(@FromPath("id") id: number, @FromContent() item: CrudUpdateRequest): Promise<DbItem> {
-    const ok = await Data.update(id, item);
-    await cache.invalidate(id);
-    if (!ok) throw new ProviderException(ResponseStatus.NotFound, `Item with ID ${id} does not exist`);
-    const updated = await Data.findById(id);
-    if (!updated) throw new ProviderException(ResponseStatus.NotFound, `Item with ID ${id} does not exist`);
-    return updated;
-  }
-}
diff --git a/frameworks/bananabread/tsconfig.json b/frameworks/bananabread/tsconfig.json
deleted file mode 100644
index c6eec70ba..000000000
--- a/frameworks/bananabread/tsconfig.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ESNext",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "allowImportingTsExtensions": true,
-    "types": ["bun"],
-    "strict": true,
-    "experimentalDecorators": true,
-    "emitDecoratorMetadata": true,
-    "skipLibCheck": true,
-    "noEmit": true
-  }
-}
diff --git a/scripts/lib/validate/assert.sh b/scripts/lib/validate/assert.sh
new file mode 100644
index 000000000..2d707d9f7
--- /dev/null
+++ b/scripts/lib/validate/assert.sh
@@ -0,0 +1,331 @@
+# scripts/lib/validate/assert.sh — DOCS_BASE, check helpers, wait_h2, static-freshness probe
+# Part of the validate.sh suite — sourced by scripts/validate.sh, not run directly.
+
+# ───── Helpers ─────
+
+DOCS_BASE="https://www.http-arena.com/#doc=test-profiles"
+
+fail_with_link() {
+    local msg="$1"
+    local docs_url="$2"
+    echo "  FAIL $msg"
+    if [ -n "$docs_url" ]; then
+        echo "        → $docs_url"
+    fi
+    FAIL=$((FAIL + 1))
+}
+
+dump_debug() {
+    local trace="$1"
+    local response="$2"
+    if [ -n "$trace" ] && [ -s "$trace" ]; then
+        echo "        ─── wire trace ───"
+        sed 's/^/        /' "$trace"
+    fi
+    if [ -n "$response" ]; then
+        echo "        ─── response ───"
+        printf '%s\n' "$response" | sed 's/^/        /'
+    fi
+    [ -n "$trace" ] && rm -f "$trace"
+}
+
+check() {
+    local label="$1"
+    local expected_body="$2"
+    local docs_url="$3"
+    shift 3
+    local response trace
+    trace=$(mktemp)
+    response=$(curl -s --max-time 30 -D- --trace-ascii "$trace" "$@" || true)
+    local body
+    body=$(echo "$response" | tail -1)
+
+    if [ "$body" = "$expected_body" ]; then
+        echo "  PASS [$label]"
+        PASS=$((PASS + 1))
+        rm -f "$trace"
+    else
+        fail_with_link "[$label]: expected body '$expected_body', got '$body'" "$docs_url"
+        dump_debug "$trace" "$response"
+    fi
+}
+
+check_status() {
+    local label="$1"
+    local expected_status="$2"
+    local docs_url="$3"
+    shift 3
+    local http_code trace body_file
+    trace=$(mktemp)
+    body_file=$(mktemp)
+    http_code=$(curl -s --max-time 30 -o "$body_file" -D "$body_file.hdr" -w '%{http_code}' --trace-ascii "$trace" "$@" || true)
+
+    if [ "$http_code" = "$expected_status" ]; then
+        echo "  PASS [$label] (HTTP $http_code)"
+        PASS=$((PASS + 1))
+        rm -f "$trace" "$body_file" "$body_file.hdr"
+    else
+        fail_with_link "[$label]: expected HTTP $expected_status, got HTTP $http_code" "$docs_url"
+        local response=""
+        [ -s "$body_file.hdr" ] && response=$(cat "$body_file.hdr")
+        [ -s "$body_file" ] && response="${response}$(cat "$body_file")"
+        dump_debug "$trace" "$response"
+        rm -f "$body_file" "$body_file.hdr"
+    fi
+}
+
+check_fragmented() {
+    # Send an HTTP request in multiple TCP writes with small pauses between
+    # them so the server's read loop sees partial, incomplete buffers and
+    # must reassemble across recv() calls. Exercises HTTP parser correctness
+    # under realistic network fragmentation (slow clients, small MTU, etc.).
+    #
+    # Usage: check_fragmented <label> <expected_body> <docs_url> <frag1> <frag2> [frag3...]
+    # Use $'...' literal form in the caller to embed CR/LF inside fragments.
+    local label="$1"
+    local expected_body="$2"
+    local docs_url="$3"
+    shift 3
+    local body trace
+    trace=$(mktemp)
+    body=$(PORT="$PORT" TRACE="$trace" python3 -c '
+import os, socket, sys, time
+port = int(os.environ["PORT"])
+trace_path = os.environ.get("TRACE", "")
+frags = sys.argv[1:]
+sent = b""
+buf = b""
+wire_error = ""
+s = None
+try:
+    s = socket.create_connection(("localhost", port), timeout=5)
+    s.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)  # no Nagle coalescing
+    for i, f in enumerate(frags):
+        data = f.encode("latin-1")
+        s.sendall(data)
+        sent += data
+        if i < len(frags) - 1:
+            time.sleep(0.03)
+    while True:
+        chunk = s.recv(4096)
+        if not chunk: break
+        buf += chunk
+except socket.timeout:
+    wire_error = "socket.timeout (server never closed; client blocked in recv)"
+except Exception as e:
+    wire_error = type(e).__name__ + ": " + str(e)
+finally:
+    if s is not None:
+        try: s.close()
+        except Exception: pass
+    # Always write the trace — even (especially) on failure. Without this
+    # the wire dump is empty on the exact error paths where you need it.
+    if trace_path:
+        try:
+            with open(trace_path, "w") as tf:
+                tf.write("=> Send (" + str(len(sent)) + " bytes across " + str(len(frags)) + " fragment(s))\n")
+                tf.write(sent.decode("latin-1", errors="replace"))
+                tf.write("\n<= Recv (" + str(len(buf)) + " bytes)\n")
+                tf.write(buf.decode("latin-1", errors="replace"))
+                if wire_error:
+                    tf.write("\n<!> " + wire_error + "\n")
+                else:
+                    tf.write("\n")
+        except Exception:
+            pass
+resp = buf.decode("latin-1", errors="replace")
+try:
+    head, raw = resp.split("\r\n\r\n", 1)
+except ValueError:
+    sys.stdout.write("")
+    sys.exit(0)
+
+# Parse headers (case-insensitive)
+hdrs = {}
+for line in head.split("\r\n")[1:]:
+    if ":" in line:
+        k, v = line.split(":", 1)
+        hdrs[k.strip().lower()] = v.strip()
+
+# If the response is chunked, decode the frames; otherwise honor Content-Length
+# when present, else just return the raw remaining bytes.
+if hdrs.get("transfer-encoding", "").lower() == "chunked":
+    parts, rest = [], raw
+    while rest:
+        nl = rest.find("\r\n")
+        if nl < 0: break
+        try:
+            size = int(rest[:nl].split(";", 1)[0], 16)  # ignore chunk extensions
+        except ValueError:
+            break
+        rest = rest[nl+2:]
+        if size == 0: break
+        parts.append(rest[:size])
+        rest = rest[size+2:]  # skip trailing CRLF
+    body = "".join(parts)
+elif "content-length" in hdrs:
+    try:
+        body = raw[:int(hdrs["content-length"])]
+    except ValueError:
+        body = raw
+else:
+    body = raw
+
+sys.stdout.write(body.strip())
+' "$@" 2>/dev/null || echo "")
+
+    if [ "$body" = "$expected_body" ]; then
+        echo "  PASS [$label]"
+        PASS=$((PASS + 1))
+        rm -f "$trace"
+    else
+        fail_with_link "[$label]: expected body '$expected_body', got '$body'" "$docs_url"
+        dump_debug "$trace" ""
+    fi
+}
+
+check_header() {
+    local label="$1"
+    local header_name="$2"
+    local expected_value="$3"
+    local docs_url="$4"
+    shift 4
+    local headers trace
+    trace=$(mktemp)
+    headers=$(curl -s --max-time 30 -D- -o /dev/null --trace-ascii "$trace" "$@" || true)
+    local value
+    value=$(echo "$headers" | grep -i "^${header_name}:" | sed 's/^[^:]*: *//' | tr -d '\r' || true)
+
+    # Normalize: text/javascript and application/javascript are equivalent (RFC 9239)
+    local norm_value norm_expected
+    norm_value=$(echo "$value" | sed 's|text/javascript|application/javascript|')
+    norm_expected=$(echo "$expected_value" | sed 's|text/javascript|application/javascript|')
+    if [ "$value" = "$expected_value" ] || [[ "$value" == "$expected_value;"* ]] || [ "$norm_value" = "$norm_expected" ] || [[ "$norm_value" == "$norm_expected;"* ]]; then
+        echo "  PASS [$label] ($header_name: $value)"
+        PASS=$((PASS + 1))
+        rm -f "$trace"
+    else
+        fail_with_link "[$label]: expected $header_name '$expected_value', got '$value'" "$docs_url"
+        dump_debug "$trace" "$headers"
+    fi
+}
+
+wait_h2() {
+    echo "[wait] Waiting for HTTPS port..."
+    for i in $(seq 1 15); do
+        if curl -sk --max-time 30 --http2 -o /dev/null "https://localhost:$H2PORT/baseline2?a=1&b=1" 2>/dev/null; then
+            return 0
+        fi
+        if [ "$i" -eq 15 ]; then
+            echo "  FAIL: HTTPS port $H2PORT not responding"
+            FAIL=$((FAIL + 1))
+            return 1
+        fi
+        sleep 1
+    done
+}
+
+
+# Static freshness / anti-pre-cache probe. The static rules (standard AND tuned)
+# require every static response to reflect the CURRENT file on disk — no
+# pre-loading file contents/responses into memory. This probe first primes the
+# server with the ORIGINAL file (so a lazy "cache on first request" path is
+# populated with the old bytes), then rewrites reset.css and its .gz/.br siblings
+# on disk with a unique sentinel WHILE THE SERVER IS RUNNING, and re-requests each
+# encoding. A server that reads from disk (or revalidates) serves the new bytes; a
+# server that cached the file at startup or on first request serves stale content
+# and fails. Originals are restored afterwards (and via the EXIT trap on abort).
+#
+# Usage: check_static_freshness <label> <docs_url> <base_url> [extra curl args...]
+check_static_freshness() {
+    local label="$1" docs="$2" base="$3"; shift 3
+    # Engine / infrastructure entries are ranked separately and exempt.
+    case "$FW_TYPE" in
+        engine|infrastructure)
+            echo "  SKIP [$label] (type=$FW_TYPE is exempt from the static pre-cache rule)"
+            return 0 ;;
+    esac
+    local sdir="$DATA_DIR/static" f="reset.css"
+    if [ ! -f "$sdir/$f" ]; then
+        echo "  SKIP [$label] (no $f in static dir)"
+        return 0
+    fi
+
+    # Prime: fetch the ORIGINAL through every encoding so any lazy first-request
+    # cache is populated with the pre-change bytes.
+    local e
+    for e in identity gzip br; do
+        curl -s --max-time 30 "$@" -H "Accept-Encoding: $e" -o /dev/null "$base/static/$f" || true
+    done
+
+    # Back up originals, then overwrite identity + precompressed siblings with a
+    # unique sentinel so every serving strategy must surface the new bytes.
+    STATIC_FRESH_BACKUP=$(mktemp -d)
+    local v
+    for v in "$f" "$f.gz" "$f.br"; do
+        if [ -f "$sdir/$v" ]; then cp -p "$sdir/$v" "$STATIC_FRESH_BACKUP/$v"; fi
+    done
+    local token="HTTPARENA_FRESHNESS_$$_$(date +%s%N 2>/dev/null || echo x)"
+    local marker="/* $token */"
+    printf '%s' "$marker" > "$sdir/$f"
+    if [ -f "$STATIC_FRESH_BACKUP/$f.gz" ]; then
+        printf '%s' "$marker" | gzip -9 -n > "$sdir/$f.gz"
+    fi
+    if [ -f "$STATIC_FRESH_BACKUP/$f.br" ]; then
+        printf '%s' "$marker" | python3 -c 'import sys,brotli; sys.stdout.buffer.write(brotli.compress(sys.stdin.buffer.read()))' > "$sdir/$f.br"
+    fi
+    sync 2>/dev/null || true
+
+    # Poll until every served encoding reflects the change, or the grace window
+    # elapses. A short revalidating cache (e.g. fasthttp.FS, nginx open_file_cache)
+    # legitimately reflects on-disk changes after a delay; a permanent pre-cache
+    # (startup load / build-time manifest) never does. The window separates them.
+    local grace="${STATIC_FRESHNESS_GRACE:-30}"
+    local start now fresh=0 detail="" hdr body ce decoded
+    start=$(date +%s)
+    while :; do
+        fresh=1; detail=""
+        for e in identity gzip br; do
+            if [ "$e" = "gzip" ] && [ ! -f "$STATIC_FRESH_BACKUP/$f.gz" ]; then continue; fi
+            if [ "$e" = "br" ]   && [ ! -f "$STATIC_FRESH_BACKUP/$f.br" ]; then continue; fi
+            hdr=$(mktemp); body=$(mktemp)
+            curl -s --max-time 30 "$@" -H "Accept-Encoding: $e" -D "$hdr" -o "$body" "$base/static/$f" || true
+            ce=$(grep -i '^content-encoding:' "$hdr" | sed 's/^[^:]*: *//' | tr -d '\r' | awk '{print tolower($1)}' || true)
+            case "$ce" in
+                gzip) decoded=$(gzip -dc < "$body" 2>/dev/null || true) ;;
+                br)   decoded=$(python3 -c 'import sys,brotli; sys.stdout.buffer.write(brotli.decompress(sys.stdin.buffer.read()))' < "$body" 2>/dev/null || true) ;;
+                *)    decoded=$(cat "$body" 2>/dev/null || true) ;;
+            esac
+            rm -f "$hdr" "$body"
+            if [[ "$decoded" != *"$token"* ]]; then
+                fresh=0
+                detail="$detail [Accept-Encoding:$e -> Content-Encoding:${ce:-none} still stale]"
+            fi
+        done
+        [ "$fresh" = 1 ] && break
+        now=$(date +%s); [ "$((now - start))" -ge "$grace" ] && break
+        sleep 1
+    done
+    local elapsed=$(( $(date +%s) - start ))
+
+    # Restore originals.
+    for v in "$f" "$f.gz" "$f.br"; do
+        if [ -f "$STATIC_FRESH_BACKUP/$v" ]; then cp -f "$STATIC_FRESH_BACKUP/$v" "$sdir/$v"; fi
+    done
+    rm -rf "$STATIC_FRESH_BACKUP"; STATIC_FRESH_BACKUP=""
+
+    if [ "$fresh" = 1 ]; then
+        if [ "$elapsed" -le 1 ]; then
+            echo "  PASS [$label] (reflects on-disk changes immediately)"
+        else
+            echo "  PASS [$label] (reflected on-disk change after ~${elapsed}s — revalidating cache, within ${grace}s window)"
+        fi
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[$label]: static response never reflected the on-disk change within ${grace}s — permanent pre-loading/caching of static files is not allowed (standard or tuned).$detail" "$docs"
+    fi
+}
+
+
+# keep `source` exit status 0 so the orchestrator continues (set -e stays active inside)
+true
diff --git a/scripts/lib/validate/build.sh b/scripts/lib/validate/build.sh
new file mode 100644
index 000000000..8e185c2c4
--- /dev/null
+++ b/scripts/lib/validate/build.sh
@@ -0,0 +1,24 @@
+# scripts/lib/validate/build.sh — build the framework Docker image (unless gateway-only)
+# Part of the validate.sh suite — sourced by scripts/validate.sh, not run directly.
+
+# Build — skip standalone build if framework only subscribes to compose profiles
+# (gateway-64, gateway-h3, production-stack) and has no isolated tests.
+GATEWAY_ONLY=true
+for t in $TESTS; do
+    case "$t" in
+        gateway-64|gateway-h3|production-stack) ;;
+        *) GATEWAY_ONLY=false ;;
+    esac
+done
+
+if [ "$GATEWAY_ONLY" = "false" ]; then
+    echo "[build] Building Docker image..."
+    if [ -x "frameworks/$FRAMEWORK/build.sh" ]; then
+        "frameworks/$FRAMEWORK/build.sh" || { echo "FAIL: Docker build failed"; exit 1; }
+    else
+        docker build --no-cache -t "$IMAGE_NAME" "frameworks/$FRAMEWORK" || { echo "FAIL: Docker build failed"; exit 1; }
+    fi
+fi
+
+# keep `source` exit status 0 so the orchestrator continues (set -e stays active inside)
+true
diff --git a/scripts/lib/validate/checks/connection.sh b/scripts/lib/validate/checks/connection.sh
new file mode 100644
index 000000000..c19f39a2d
--- /dev/null
+++ b/scripts/lib/validate/checks/connection.sh
@@ -0,0 +1,88 @@
+# checks/connection.sh — baseline, pipelined
+# Part of the validate.sh suite — sourced by scripts/validate.sh, not run directly.
+
+# ───── Baseline (GET/POST /baseline11) ─────
+
+if has_test "baseline" || has_test "limited-conn" || has_test "api-4" || has_test "api-16"; then
+    BASELINE_DOCS="$DOCS_BASE/h1/isolated/baseline/validation"
+    echo "[test] baseline endpoints"
+    check "GET /baseline11?a=13&b=42" "55" "$BASELINE_DOCS" \
+        "http://localhost:$PORT/baseline11?a=13&b=42"
+
+    check "POST /baseline11?a=13&b=42 body=20" "75" "$BASELINE_DOCS" \
+        -X POST -H "Content-Type: text/plain" -d "20" \
+        "http://localhost:$PORT/baseline11?a=13&b=42"
+
+    check "POST /baseline11?a=13&b=42 chunked body=20" "75" "$BASELINE_DOCS" \
+        -X POST -H "Content-Type: text/plain" -H "Transfer-Encoding: chunked" -d "20" \
+        "http://localhost:$PORT/baseline11?a=13&b=42"
+
+    # Response Content-Type must be text/plain (bare or with ;charset=…). A
+    # missing header or application/json is a spec violation. Issue #526.
+    check_header "GET /baseline11 Content-Type" "Content-Type" "text/plain" "$BASELINE_DOCS" \
+        "http://localhost:$PORT/baseline11?a=13&b=42"
+    check_header "POST /baseline11 Content-Type" "Content-Type" "text/plain" "$BASELINE_DOCS" \
+        -X POST -H "Content-Type: text/plain" -d "20" \
+        "http://localhost:$PORT/baseline11?a=13&b=42"
+
+    # Anti-cheat: randomized inputs to detect hardcoded responses
+    echo "[test] baseline anti-cheat (randomized inputs)"
+    A1=$((RANDOM % 900 + 100))
+    B1=$((RANDOM % 900 + 100))
+    check "GET /baseline11?a=$A1&b=$B1 (random)" "$((A1 + B1))" "$BASELINE_DOCS" \
+        "http://localhost:$PORT/baseline11?a=$A1&b=$B1"
+
+    BODY1=$((RANDOM % 900 + 100))
+    BODY2=$((RANDOM % 900 + 100))
+    while [ "$BODY1" -eq "$BODY2" ]; do BODY2=$((RANDOM % 900 + 100)); done
+    check "POST body=$BODY1 (cache check 1)" "$((13 + 42 + BODY1))" "$BASELINE_DOCS" \
+        -X POST -H "Content-Type: text/plain" -d "$BODY1" \
+        "http://localhost:$PORT/baseline11?a=13&b=42"
+    check "POST body=$BODY2 (cache check 2)" "$((13 + 42 + BODY2))" "$BASELINE_DOCS" \
+        -X POST -H "Content-Type: text/plain" -d "$BODY2" \
+        "http://localhost:$PORT/baseline11?a=13&b=42"
+
+    # TCP fragmentation: send each request in multiple small writes with a
+    # short pause between, so the server's HTTP parser sees partial buffers
+    # and must reassemble across recv() calls. Exercises parser correctness
+    # under realistic network conditions (slow clients, small MTU).
+    echo "[test] baseline TCP fragmentation"
+    # Split 1: break the request line mid-path
+    check_fragmented "GET /baseline11 — split request line" "55" "$BASELINE_DOCS" \
+        "GET /baseli" \
+        $'ne11?a=13&b=42 HTTP/1.1\r\n' \
+        $'Host: localhost\r\nConnection: close\r\n\r\n'
+
+    # Split 2: break between request line and headers
+    check_fragmented "GET /baseline11 — split before headers" "55" "$BASELINE_DOCS" \
+        $'GET /baseline11?a=13&b=42 HTTP/1.1\r\n' \
+        $'Host: localhost\r\n' \
+        $'User-Agent: arena-frag/1.0\r\n' \
+        $'Connection: close\r\n\r\n'
+
+    # Split 3: POST with headers and body in separate writes
+    check_fragmented "POST /baseline11 — split headers/body" "75" "$BASELINE_DOCS" \
+        $'POST /baseline11?a=13&b=42 HTTP/1.1\r\nHost: localhost\r\nContent-Type: text/plain\r\nContent-Length: 2\r\nConnection: close\r\n\r\n' \
+        "20"
+
+    # Split 4: POST with body split across two writes (body = "20", split to "2" + "0")
+    check_fragmented "POST /baseline11 — split body bytes" "75" "$BASELINE_DOCS" \
+        $'POST /baseline11?a=13&b=42 HTTP/1.1\r\nHost: localhost\r\nContent-Type: text/plain\r\nContent-Length: 2\r\nConnection: close\r\n\r\n' \
+        "2" \
+        "0"
+fi
+
+# ───── Pipelined (GET /pipeline) ─────
+
+if has_test "pipelined"; then
+    PIPELINED_DOCS="$DOCS_BASE/h1/isolated/pipelined/validation"
+    echo "[test] pipelined endpoint"
+    check "GET /pipeline" "ok" "$PIPELINED_DOCS" \
+        "http://localhost:$PORT/pipeline"
+    check_header "GET /pipeline Content-Type" "Content-Type" "text/plain" "$PIPELINED_DOCS" \
+        "http://localhost:$PORT/pipeline"
+fi
+
+
+# keep `source` exit status 0 so the orchestrator continues (set -e stays active inside)
+true
diff --git a/scripts/lib/validate/checks/database.sh b/scripts/lib/validate/checks/database.sh
new file mode 100644
index 000000000..6bf100e80
--- /dev/null
+++ b/scripts/lib/validate/checks/database.sh
@@ -0,0 +1,213 @@
+# checks/database.sh — async-db, fortunes, crud
+# Part of the validate.sh suite — sourced by scripts/validate.sh, not run directly.
+
+# ───── Async Database (GET /async-db) ─────
+
+if has_test "async-db" || has_test "crud" || has_test "api-4" || has_test "api-16"; then
+    ASYNCDB_DOCS="$DOCS_BASE/h1/isolated/async-database/validation"
+    echo "[test] async-db endpoint"
+    asyncdb_fail=false
+    db_params=("min=5&max=80&limit=7" "min=20&max=150&limit=18" "min=100&max=400&limit=33" "min=10&max=50&limit=50")
+    for dbp in "${db_params[@]}"; do
+        dblimit=$(echo "$dbp" | grep -oP 'limit=\K[0-9]+')
+        response=$(curl -s --max-time 30 "http://localhost:$PORT/async-db?$dbp" || true)
+        pgdb_result=$(echo "$response" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+count = d.get('count', 0)
+items = d.get('items', [])
+has_rating = all('rating' in item and 'score' in item['rating'] for item in items) if items else False
+has_tags = all(isinstance(item.get('tags'), list) for item in items) if items else False
+has_active_bool = all(isinstance(item.get('active'), bool) for item in items) if items else False
+print(f'{count} {has_rating} {has_tags} {has_active_bool}')
+" 2>/dev/null || echo "0 False False False")
+        pgdb_count=$(echo "$pgdb_result" | cut -d' ' -f1)
+        pgdb_rating=$(echo "$pgdb_result" | cut -d' ' -f2)
+        pgdb_tags=$(echo "$pgdb_result" | cut -d' ' -f3)
+        pgdb_active=$(echo "$pgdb_result" | cut -d' ' -f4)
+
+        if [ "$pgdb_count" = "$dblimit" ] && [ "$pgdb_rating" = "True" ] && [ "$pgdb_tags" = "True" ] && [ "$pgdb_active" = "True" ]; then
+            :
+        else
+            fail_with_link "[GET /async-db?limit=$dblimit]: count=$pgdb_count, rating=$pgdb_rating, tags=$pgdb_tags, active=$pgdb_active" "$ASYNCDB_DOCS"
+            asyncdb_fail=true
+        fi
+    done
+    if [ "$asyncdb_fail" = "false" ]; then
+        echo "  PASS [GET /async-db?limit=N] (4 limits verified, correct structure)"
+        PASS=$((PASS + 1))
+    fi
+
+    check_header "GET /async-db Content-Type" "Content-Type" "application/json" "$ASYNCDB_DOCS" \
+        "http://localhost:$PORT/async-db?min=10&max=50&limit=50"
+
+    # Anti-cheat: empty range should return 0 items
+    response_empty=$(curl -s --max-time 30 "http://localhost:$PORT/async-db?min=9999&max=9999&limit=50" || true)
+    pgdb_empty=$(echo "$response_empty" | python3 -c "import sys,json; print(json.load(sys.stdin).get('count','-1'))" 2>/dev/null || echo "-1")
+    if [ "$pgdb_empty" = "0" ]; then
+        echo "  PASS [GET /async-db empty range] (count=0)"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[GET /async-db empty range]: expected count=0, got $pgdb_empty" "$ASYNCDB_DOCS"
+    fi
+fi
+
+# ───── Fortunes (GET /fortunes) — template-engine benchmark ─────
+#
+# Feature-based validation, not byte-exact. Engines disagree on whitespace
+# and attribute formatting; what matters is that the rendered HTML actually
+# loops the DB rows, includes the runtime-injected row, escapes user
+# content, and is sized like a real page (not stripped to win the bench).
+
+if has_test "fortunes"; then
+    FORTUNES_DOCS="$DOCS_BASE/h1/isolated/fortunes/validation"
+    echo "[test] fortunes endpoint"
+
+    body=$(curl -s --max-time 30 "http://localhost:$PORT/fortunes" || true)
+
+    check_header "GET /fortunes Content-Type" "Content-Type" "text/html" "$FORTUNES_DOCS" \
+        "http://localhost:$PORT/fortunes"
+
+    if echo "$body" | grep -qi '<!doctype html>'; then
+        echo "  PASS [GET /fortunes <!DOCTYPE html>]"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[GET /fortunes <!DOCTYPE html>]: missing — layout/partial likely not rendered" "$FORTUNES_DOCS"
+    fi
+
+    # Each row in the rendered table must produce a <tr>. 201 data rows are
+    # required (200 seeded + 1 runtime-injected); a header row is allowed
+    # but not required, so the band is 201–210 to absorb implementation-
+    # specific extras (footer rows, etc.).
+    tr_count=$(echo "$body" | grep -oi '<tr' | wc -l)
+    if [ "$tr_count" -ge 201 ] && [ "$tr_count" -le 210 ]; then
+        echo "  PASS [GET /fortunes <tr> count=$tr_count]"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[GET /fortunes <tr> count]: expected 201–210, got $tr_count" "$FORTUNES_DOCS"
+    fi
+
+    # Runtime-injected row text — proves the handler appended id=0 in memory
+    # rather than caching a pre-rendered page from the DB rows alone.
+    if echo "$body" | grep -qF 'Additional fortune added at request time.'; then
+        echo "  PASS [GET /fortunes runtime-injected row]"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[GET /fortunes runtime-injected row]: missing 'Additional fortune added at request time.'" "$FORTUNES_DOCS"
+    fi
+
+    # XSS escape — load-bearing check. Row 11 contains a raw <script> tag
+    # in the DB; the rendered output must encode it as &lt;script&gt; and
+    # must NOT contain the raw <script>alert sequence anywhere.
+    if echo "$body" | grep -qF '&lt;script&gt;' && ! echo "$body" | grep -qF '<script>alert'; then
+        echo "  PASS [GET /fortunes XSS escape]"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[GET /fortunes XSS escape]: <script> in row 11 not properly HTML-escaped" "$FORTUNES_DOCS"
+    fi
+
+    # Size sanity — catches stripped pages and empty bodies. A 201-row
+    # table plus a layout typically lands between 18 KB and 40 KB; the band
+    # is generous to absorb whitespace and per-engine formatting, but
+    # rejects empty / fragment / pathologically-large outputs.
+    size=${#body}
+    if [ "$size" -ge 18432 ] && [ "$size" -le 65536 ]; then
+        echo "  PASS [GET /fortunes body size=${size}B]"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[GET /fortunes body size]: expected 18432–65536 bytes, got $size" "$FORTUNES_DOCS"
+    fi
+fi
+
+# ───── CRUD (list + read + create + update /crud/items) ─────
+
+if has_test "crud"; then
+    CRUD_DOCS="$DOCS_BASE/h1/isolated/crud/validation"
+    echo "[test] crud endpoints"
+
+    # 1. GET list — paginated with category filter
+    crud_list=$(curl -s --max-time 30 "http://localhost:$PORT/crud/items?category=electronics&page=1&limit=5" || true)
+    crud_list_result=$(echo "$crud_list" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+items = d.get('items', [])
+total = d.get('total', 0)
+page = d.get('page', 0)
+has_rating = all('rating' in i for i in items) if items else False
+print(f'{len(items)} {total} {page} {has_rating}')
+" 2>/dev/null || echo "0 0 0 False")
+    crud_list_count=$(echo "$crud_list_result" | cut -d' ' -f1)
+    crud_list_total=$(echo "$crud_list_result" | cut -d' ' -f2)
+    crud_list_page=$(echo "$crud_list_result" | cut -d' ' -f3)
+    crud_list_rating=$(echo "$crud_list_result" | cut -d' ' -f4)
+    if [ "$crud_list_count" = "5" ] && [ "$crud_list_total" -gt 0 ] 2>/dev/null && [ "$crud_list_page" = "1" ] && [ "$crud_list_rating" = "True" ]; then
+        echo "  PASS [GET /crud/items?category=electronics] ($crud_list_count items, total=$crud_list_total, page=$crud_list_page)"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[GET /crud/items list]: count=$crud_list_count, total=$crud_list_total, page=$crud_list_page, rating=$crud_list_rating" "$CRUD_DOCS"
+    fi
+
+    # 2. GET single item — with cache check
+    crud_get=$(curl -s --max-time 30 "http://localhost:$PORT/crud/items/1" || true)
+    crud_get_id=$(echo "$crud_get" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id','-1'))" 2>/dev/null || echo "-1")
+    if [ "$crud_get_id" = "1" ]; then
+        echo "  PASS [GET /crud/items/1] (returned id=1)"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[GET /crud/items/1]: expected id=1, got $crud_get_id" "$CRUD_DOCS"
+    fi
+
+    # 3. Cache-aside check — first call MISS, second call HIT
+    crud_cache1=$(curl -s --max-time 30 -D- -o /dev/null "http://localhost:$PORT/crud/items/42" | grep -i "^x-cache:" | tr -d '\r' | awk '{print $2}')
+    crud_cache2=$(curl -s --max-time 30 -D- -o /dev/null "http://localhost:$PORT/crud/items/42" | grep -i "^x-cache:" | tr -d '\r' | awk '{print $2}')
+    if [ "$crud_cache1" = "MISS" ] && [ "$crud_cache2" = "HIT" ]; then
+        echo "  PASS [crud cache-aside] (first=MISS, second=HIT)"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[crud cache-aside]: expected MISS then HIT, got '$crud_cache1' then '$crud_cache2'" "$CRUD_DOCS"
+    fi
+
+    # 4. GET non-existent item — 404
+    check_status "GET /crud/items/999999 (not found)" "404" "$CRUD_DOCS" \
+        -s --max-time 30 "http://localhost:$PORT/crud/items/999999"
+
+    # 5. POST — create a new item
+    crud_post_status=$(curl -s --max-time 30 -o /tmp/crud-post.json -w '%{http_code}' \
+        -X POST -H "Content-Type: application/json" \
+        -d '{"id":200001,"name":"ValidateItem","category":"test","price":42,"quantity":7}' \
+        "http://localhost:$PORT/crud/items" || echo "0")
+    if [ "$crud_post_status" = "201" ]; then
+        echo "  PASS [POST /crud/items] (201 Created)"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[POST /crud/items]: expected 201, got $crud_post_status" "$CRUD_DOCS"
+    fi
+
+    # 6. GET back the created item
+    crud_verify=$(curl -s --max-time 30 "http://localhost:$PORT/crud/items/200001" || true)
+    crud_verify_id=$(echo "$crud_verify" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id','-1'))" 2>/dev/null || echo "-1")
+    if [ "$crud_verify_id" = "200001" ]; then
+        echo "  PASS [GET /crud/items/200001] (read back created item)"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[GET /crud/items/200001]: expected id=200001, got $crud_verify_id" "$CRUD_DOCS"
+    fi
+
+    # 7. PUT — update, then verify cache was invalidated
+    curl -s --max-time 30 -o /dev/null "http://localhost:$PORT/crud/items/200001"  # warm cache
+    crud_put_status=$(curl -s --max-time 30 -o /dev/null -w '%{http_code}' \
+        -X PUT -H "Content-Type: application/json" \
+        -d '{"name":"UpdatedItem","category":"test","price":99,"quantity":1}' \
+        "http://localhost:$PORT/crud/items/200001" || echo "0")
+    crud_after_put=$(curl -s --max-time 30 -D- -o /dev/null "http://localhost:$PORT/crud/items/200001" | grep -i "^x-cache:" | tr -d '\r' | awk '{print $2}')
+    if [ "$crud_put_status" = "200" ] && [ "$crud_after_put" = "MISS" ]; then
+        echo "  PASS [PUT /crud/items/200001] (200 OK, cache invalidated)"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[PUT /crud/items/200001]: status=$crud_put_status, cache_after=$crud_after_put" "$CRUD_DOCS"
+    fi
+fi
+
+
+# keep `source` exit status 0 so the orchestrator continues (set -e stays active inside)
+true
diff --git a/scripts/lib/validate/checks/gateway.sh b/scripts/lib/validate/checks/gateway.sh
new file mode 100644
index 000000000..0c158ea7f
--- /dev/null
+++ b/scripts/lib/validate/checks/gateway.sh
@@ -0,0 +1,415 @@
+# checks/gateway.sh — gateway-64, gateway-h3, production-stack
+# Part of the validate.sh suite — sourced by scripts/validate.sh, not run directly.
+
+# ───── Gateway profiles (reverse proxy + server, shared validation flow) ─────
+#
+# Both gateway-64 (h2) and gateway-h3 (h3 at the edge) use the same endpoint
+# surface (/static, /json/{count}, /async-db, /baseline2) so validation is
+# identical — only the compose file and docs URL change. Factored here so
+# we don't duplicate ~150 lines of curl checks per profile.
+#
+# The h3 profile is validated via curl's --http2 path even though the test
+# runs over QUIC at benchmark time, because curl builds don't reliably ship
+# h3 support. Caddy (and most h3-capable proxies) answer h2 and h3 on the
+# same port, so endpoint correctness is still covered. If h3 itself is
+# broken, h2load-h3 will catch it at benchmark time with 0 rps.
+_validate_gateway() {
+    local profile="$1"
+    local compose_file="$2"
+    local gateway_docs="$3"
+
+    echo "[test] $profile endpoints"
+
+    local gw_project="httparena-validate-gw-${profile}-${FRAMEWORK}"
+    if [ -f "$compose_file" ]; then
+        echo "[gateway] Building and starting compose stack..."
+        CERTS_DIR="$CERTS_DIR" DATA_DIR="$DATA_DIR" DATABASE_URL="postgres://bench:bench@localhost:5432/benchmark" \
+            docker compose -f "$compose_file" -p "$gw_project" up --build -d || { echo "FAIL: gateway compose up"; FAIL=$((FAIL + 1)); return; }
+    else
+        echo "  FAIL [$profile]: compose file not found at $compose_file"
+        FAIL=$((FAIL + 1))
+        return
+    fi
+
+    local GW_PORT=$H2PORT
+
+    echo "[wait] Waiting for gateway HTTPS port..."
+    local gw_ready=false i
+    for i in $(seq 1 30); do
+        if curl -sk --max-time 2 --http2 -o /dev/null "https://localhost:$GW_PORT/static/reset.css" 2>/dev/null; then
+            gw_ready=true
+            break
+        fi
+        sleep 1
+    done
+
+    if [ "$gw_ready" = "true" ]; then
+        # 1. HTTP/2 protocol negotiation (works for h2 and h3-capable proxies
+        #    that still speak h2 on the same port — Caddy, nginx-quic, etc.)
+        local gw_proto
+        gw_proto=$(curl -sk --max-time 30 --http2 -o /dev/null -w '%{http_version}' "https://localhost:$GW_PORT/static/reset.css" || echo "0")
+        if [ "$gw_proto" = "2" ]; then
+            echo "  PASS [gateway HTTP/2 negotiation] (HTTP/$gw_proto)"
+            PASS=$((PASS + 1))
+        else
+            fail_with_link "[gateway HTTP/2 negotiation]: got HTTP/$gw_proto" "$gateway_docs"
+        fi
+
+        # 2. Static file — correct Content-Type
+        check_header "gateway /static/reset.css Content-Type" "Content-Type" "text/css" "$gateway_docs" \
+            -sk --http2 "https://localhost:$GW_PORT/static/reset.css"
+
+        check_header "gateway /static/app.js Content-Type" "Content-Type" "application/javascript" "$gateway_docs" \
+            -sk --http2 "https://localhost:$GW_PORT/static/app.js"
+
+        # 3. Static file — non-zero size
+        local gw_static_size
+        gw_static_size=$(curl -sk --max-time 30 --http2 -o /dev/null -w '%{size_download}' "https://localhost:$GW_PORT/static/app.js" || echo "0")
+        if [ "$gw_static_size" -gt 0 ]; then
+            echo "  PASS [gateway static file size] ($gw_static_size bytes)"
+            PASS=$((PASS + 1))
+        else
+            fail_with_link "[gateway static file size]: empty response for /static/app.js" "$gateway_docs"
+        fi
+
+        # 4. Static file — 404 for missing files
+        check_status "gateway /static/nonexistent.txt" "404" "$gateway_docs" \
+            -sk --http2 "https://localhost:$GW_PORT/static/nonexistent.txt"
+
+        # 5. JSON endpoint — valid JSON with computed totals
+        local gw_json_response gw_json_result gw_json_count gw_json_valid gw_json_correct
+        gw_json_response=$(curl -sk --max-time 30 --http2 "https://localhost:$GW_PORT/json/50" || true)
+        gw_json_result=$(echo "$gw_json_response" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+count = d.get('count', 0)
+items = d.get('items', [])
+def valid_item(it):
+    r = it.get('rating')
+    return ('id' in it and 'name' in it and 'category' in it and 'price' in it
+            and 'quantity' in it and 'total' in it
+            and isinstance(it.get('tags'), list) and isinstance(it.get('active'), bool)
+            and isinstance(r, dict) and 'score' in r and 'count' in r)
+valid = all(valid_item(it) for it in items) if items else False
+correct_totals = True
+for item in items:
+    expected = round(item.get('price', 0) * item.get('quantity', 0), 2)
+    if abs(item.get('total', 0) - expected) > 0.02:
+        correct_totals = False
+        break
+print(f'{count} {valid} {correct_totals}')
+" 2>/dev/null || echo "0 False False")
+        gw_json_count=$(echo "$gw_json_result" | cut -d' ' -f1)
+        gw_json_valid=$(echo "$gw_json_result" | cut -d' ' -f2)
+        gw_json_correct=$(echo "$gw_json_result" | cut -d' ' -f3)
+
+        if [ "$gw_json_count" = "50" ] && [ "$gw_json_valid" = "True" ] && [ "$gw_json_correct" = "True" ]; then
+            echo "  PASS [gateway /json] (50 items, full schema, totals correct)"
+            PASS=$((PASS + 1))
+        else
+            fail_with_link "[gateway /json]: count=$gw_json_count, schema=$gw_json_valid, correct=$gw_json_correct" "$gateway_docs"
+        fi
+
+        check_header "gateway /json Content-Type" "Content-Type" "application/json" "$gateway_docs" \
+            -sk --http2 "https://localhost:$GW_PORT/json/50"
+
+        # 6. Async database endpoint — valid result set
+        local gw_db_response gw_db_result gw_db_count gw_db_rating gw_db_tags gw_db_active
+        gw_db_response=$(curl -sk --max-time 30 --http2 "https://localhost:$GW_PORT/async-db?min=10&max=50&limit=50" || true)
+        gw_db_result=$(echo "$gw_db_response" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+count = d.get('count', 0)
+items = d.get('items', [])
+has_rating = all('rating' in item and 'score' in item['rating'] for item in items) if items else False
+has_tags = all(isinstance(item.get('tags'), list) for item in items) if items else False
+has_active_bool = all(isinstance(item.get('active'), bool) for item in items) if items else False
+print(f'{count} {has_rating} {has_tags} {has_active_bool}')
+" 2>/dev/null || echo "0 False False False")
+        gw_db_count=$(echo "$gw_db_result" | cut -d' ' -f1)
+        gw_db_rating=$(echo "$gw_db_result" | cut -d' ' -f2)
+        gw_db_tags=$(echo "$gw_db_result" | cut -d' ' -f3)
+        gw_db_active=$(echo "$gw_db_result" | cut -d' ' -f4)
+
+        if [ "$gw_db_count" -gt 0 ] && [ "$gw_db_count" -le 50 ] && [ "$gw_db_rating" = "True" ] && [ "$gw_db_tags" = "True" ] && [ "$gw_db_active" = "True" ]; then
+            echo "  PASS [gateway /async-db] ($gw_db_count items, correct structure)"
+            PASS=$((PASS + 1))
+        else
+            fail_with_link "[gateway /async-db]: count=$gw_db_count, rating=$gw_db_rating, tags=$gw_db_tags, active=$gw_db_active" "$gateway_docs"
+        fi
+
+        check_header "gateway /async-db Content-Type" "Content-Type" "application/json" "$gateway_docs" \
+            -sk --http2 "https://localhost:$GW_PORT/async-db?min=10&max=50&limit=50"
+
+        # 7. Async-db anti-cheat: empty range
+        local gw_db_empty
+        gw_db_empty=$(curl -sk --max-time 30 --http2 "https://localhost:$GW_PORT/async-db?min=9999&max=9999&limit=50" | python3 -c "import sys,json; print(json.load(sys.stdin).get('count','-1'))" 2>/dev/null || echo "-1")
+        if [ "$gw_db_empty" = "0" ]; then
+            echo "  PASS [gateway /async-db empty range] (count=0)"
+            PASS=$((PASS + 1))
+        else
+            fail_with_link "[gateway /async-db empty range]: expected count=0, got $gw_db_empty" "$gateway_docs"
+        fi
+
+        # 8. Baseline2 endpoint
+        check "gateway /baseline2?a=13&b=42" "55" "$gateway_docs" \
+            -sk --http2 "https://localhost:$GW_PORT/baseline2?a=13&b=42"
+
+        # 9. Baseline2 anti-cheat: randomized inputs
+        local GW_A=$((RANDOM % 900 + 100))
+        local GW_B=$((RANDOM % 900 + 100))
+        check "gateway /baseline2?a=$GW_A&b=$GW_B (random)" "$((GW_A + GW_B))" "$gateway_docs" \
+            -sk --http2 "https://localhost:$GW_PORT/baseline2?a=$GW_A&b=$GW_B"
+    else
+        echo "  FAIL: Gateway HTTPS port $GW_PORT not responding after 30s"
+        FAIL=$((FAIL + 1))
+    fi
+
+    # Cleanup gateway compose stack
+    if [ -f "$compose_file" ]; then
+        CERTS_DIR="$CERTS_DIR" DATA_DIR="$DATA_DIR" DATABASE_URL="postgres://bench:bench@localhost:5432/benchmark" \
+            docker compose -f "$compose_file" -p "$gw_project" down --remove-orphans 2>/dev/null || true
+    fi
+}
+
+# ───── Gateway H2 (h2 at the edge) ─────
+
+if has_test "gateway-64"; then
+    _validate_gateway "gateway-64" \
+        "$ROOT_DIR/frameworks/$FRAMEWORK/compose.gateway.yml" \
+        "$DOCS_BASE/gateway/gateway-h2/validation"
+fi
+
+# ───── Gateway H3 (h3/QUIC at the edge) ─────
+
+if has_test "gateway-h3"; then
+    _validate_gateway "gateway-h3" \
+        "$ROOT_DIR/frameworks/$FRAMEWORK/compose.gateway-h3.yml" \
+        "$DOCS_BASE/gateway/gateway-h3/validation"
+fi
+
+# ───── Production-stack (edge + authsvc + cache + server) ─────
+#
+# Distinct endpoint surface from the gateway profiles: /public/* is
+# unauthenticated compute, /api/* is behind an edge auth_request → Redis
+# session lookup. We validate both the anonymous path (public works,
+# api returns 401 without a cookie) and the authenticated path (api
+# returns 200 with a pre-seeded session cookie).
+
+_validate_production_stack() {
+    local compose_file="$1"
+    local docs_url="$2"
+    local profile="production-stack"
+
+    echo "[test] $profile endpoints"
+
+    local gw_project="httparena-validate-gw-${profile}-${FRAMEWORK}"
+    if [ -f "$compose_file" ]; then
+        echo "[$profile] Building and starting compose stack..."
+        CERTS_DIR="$CERTS_DIR" DATA_DIR="$DATA_DIR" DATABASE_URL="postgres://bench:bench@localhost:5432/benchmark" \
+            docker compose -f "$compose_file" -p "$gw_project" up --build -d || { echo "FAIL: $profile compose up"; FAIL=$((FAIL + 1)); return; }
+    else
+        echo "  FAIL [$profile]: compose file not found at $compose_file"
+        FAIL=$((FAIL + 1))
+        return
+    fi
+
+    local GW_PORT=$H2PORT
+
+    # Wait for the edge to answer. Also gives the Redis seed step time to
+    # finish — without seeded sessions, /api/* would all return 401.
+    echo "[wait] Waiting for $profile HTTPS port..."
+    local gw_ready=false i
+    for i in $(seq 1 60); do
+        if curl -sk --max-time 2 --http2 -o /dev/null "https://localhost:$GW_PORT/static/reset.css" 2>/dev/null; then
+            gw_ready=true
+            break
+        fi
+        sleep 1
+    done
+
+    if [ "$gw_ready" = "true" ]; then
+        # 1. HTTP/2 protocol negotiation
+        local gw_proto
+        gw_proto=$(curl -sk --max-time 30 --http2 -o /dev/null -w '%{http_version}' "https://localhost:$GW_PORT/static/reset.css" || echo "0")
+        if [ "$gw_proto" = "2" ]; then
+            echo "  PASS [$profile HTTP/2 negotiation] (HTTP/$gw_proto)"
+            PASS=$((PASS + 1))
+        else
+            fail_with_link "[$profile HTTP/2 negotiation]: got HTTP/$gw_proto" "$docs_url"
+        fi
+
+        # 2. Static file served by edge
+        check_header "$profile /static/reset.css Content-Type" "Content-Type" "text/css" "$docs_url" \
+            -sk --http2 "https://localhost:$GW_PORT/static/reset.css"
+
+        local gw_static_size
+        gw_static_size=$(curl -sk --max-time 30 --http2 -o /dev/null -w '%{size_download}' "https://localhost:$GW_PORT/static/app.js" || echo "0")
+        if [ "$gw_static_size" -gt 0 ]; then
+            echo "  PASS [$profile static file size] ($gw_static_size bytes)"
+            PASS=$((PASS + 1))
+        else
+            fail_with_link "[$profile static file size]: empty response for /static/app.js" "$docs_url"
+        fi
+
+        # 3. Public baseline — no auth, no cache
+        check "$profile /public/baseline?a=13&b=42" "55" "$docs_url" \
+            -sk --http2 "https://localhost:$GW_PORT/public/baseline?a=13&b=42"
+
+        local GW_A=$((RANDOM % 900 + 100))
+        local GW_B=$((RANDOM % 900 + 100))
+        check "$profile /public/baseline?a=$GW_A&b=$GW_B (random)" "$((GW_A + GW_B))" "$docs_url" \
+            -sk --http2 "https://localhost:$GW_PORT/public/baseline?a=$GW_A&b=$GW_B"
+
+        # 4. Public JSON — no auth, no cache, returns count items with totals
+        local gw_json_response gw_json_result gw_json_count gw_json_valid gw_json_correct
+        gw_json_response=$(curl -sk --max-time 30 --http2 "https://localhost:$GW_PORT/public/json/25" || true)
+        gw_json_result=$(echo "$gw_json_response" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+count = d.get('count', 0)
+items = d.get('items', [])
+def valid_item(it):
+    r = it.get('rating')
+    return ('id' in it and 'name' in it and 'category' in it and 'price' in it
+            and 'quantity' in it and 'total' in it
+            and isinstance(it.get('tags'), list) and isinstance(it.get('active'), bool)
+            and isinstance(r, dict) and 'score' in r and 'count' in r)
+valid = all(valid_item(it) for it in items) if items else False
+correct_totals = True
+for item in items:
+    expected = round(item.get('price', 0) * item.get('quantity', 0), 2)
+    if abs(item.get('total', 0) - expected) > 0.02:
+        correct_totals = False
+        break
+print(f'{count} {valid} {correct_totals}')
+" 2>/dev/null || echo "0 False False")
+        gw_json_count=$(echo "$gw_json_result" | cut -d' ' -f1)
+        gw_json_valid=$(echo "$gw_json_result" | cut -d' ' -f2)
+        gw_json_correct=$(echo "$gw_json_result" | cut -d' ' -f3)
+
+        if [ "$gw_json_count" = "25" ] && [ "$gw_json_valid" = "True" ] && [ "$gw_json_correct" = "True" ]; then
+            echo "  PASS [$profile /public/json/25] (25 items, full schema, totals correct)"
+            PASS=$((PASS + 1))
+        else
+            fail_with_link "[$profile /public/json/25]: count=$gw_json_count, schema=$gw_json_valid, correct=$gw_json_correct" "$docs_url"
+        fi
+
+        # 5. Auth wall (GET) — /api/* without a cookie must return 401
+        check_status "$profile GET /api/items no-token" "401" "$docs_url" \
+            -sk --http2 "https://localhost:$GW_PORT/api/items/1"
+
+        # 6. Auth wall (GET) — /api/* with a bogus cookie must also return 401
+        check_status "$profile GET /api/items bogus-cookie" "401" "$docs_url" \
+            -sk --http2 -H "Authorization: Bearer invalid.token.here" "https://localhost:$GW_PORT/api/items/1"
+
+        # 7. Auth wall (POST) — the write path MUST also reject unauth calls,
+        #    otherwise an anonymous client could UPDATE rows in Postgres.
+        #    If nginx forgot to apply auth_request to the POST branch, or if
+        #    the framework ignored the edge's 401 and processed the body, this
+        #    check catches it. Body matters less than status — a bogus body
+        #    is fine because the server should reject at auth before parsing.
+        check_status "$profile POST /api/items no-token" "401" "$docs_url" \
+            -sk --http2 -X POST -H "Content-Type: application/json" \
+            -d '{"name":"unauth","price":1,"quantity":1}' \
+            "https://localhost:$GW_PORT/api/items/1"
+
+        # 8. Auth wall (POST) — bogus cookie must also return 401
+        check_status "$profile POST /api/items bogus-cookie" "401" "$docs_url" \
+            -sk --http2 -X POST -H "Content-Type: application/json" \
+            -H "Authorization: Bearer invalid.token.here" \
+            -d '{"name":"unauth","price":1,"quantity":1}' \
+            "https://localhost:$GW_PORT/api/items/1"
+
+        # 7. Authenticated /api/items/{id} — cache-aside returns item JSON
+        local gw_item_response gw_item_id
+        gw_item_response=$(curl -sk --max-time 30 --http2 -H "Authorization: Bearer $(cat $ROOT_DIR/data/jwt-token.txt)" "https://localhost:$GW_PORT/api/items/1" || true)
+        gw_item_id=$(echo "$gw_item_response" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id','-1'))" 2>/dev/null || echo "-1")
+        if [ "$gw_item_id" = "1" ]; then
+            echo "  PASS [$profile /api/items/1] (authenticated, returned id=1)"
+            PASS=$((PASS + 1))
+        else
+            fail_with_link "[$profile /api/items/1]: expected id=1, got $gw_item_id" "$docs_url"
+        fi
+
+        # 8. Cache-aside HIT after MISS — pick a previously-unread id, first
+        #    call must be MISS, immediate second call must be HIT. Proves
+        #    SetStringAsync populated the cache on miss.
+        local first_cache second_cache
+        first_cache=$(curl -sk --max-time 30 --http2 -H "Authorization: Bearer $(cat $ROOT_DIR/data/jwt-token.txt)" \
+            -D- -o /dev/null "https://localhost:$GW_PORT/api/items/7" | grep -i "^x-cache:" | tr -d '\r' | awk '{print $2}')
+        second_cache=$(curl -sk --max-time 30 --http2 -H "Authorization: Bearer $(cat $ROOT_DIR/data/jwt-token.txt)" \
+            -D- -o /dev/null "https://localhost:$GW_PORT/api/items/7" | grep -i "^x-cache:" | tr -d '\r' | awk '{print $2}')
+        if [ "$first_cache" = "MISS" ] && [ "$second_cache" = "HIT" ]; then
+            echo "  PASS [$profile cache-aside] (first=MISS, second=HIT)"
+            PASS=$((PASS + 1))
+        else
+            fail_with_link "[$profile cache-aside]: expected first=MISS second=HIT, got first='$first_cache' second='$second_cache'" "$docs_url"
+        fi
+
+        # 9. POST /api/items/{id} — write path + cache invalidation.
+        #    After POST, the next GET on the same id must be MISS (because
+        #    the cache was invalidated).
+        local post_status invalidated_cache
+        post_status=$(curl -sk --max-time 30 --http2 -X POST \
+            -H "Authorization: Bearer $(cat $ROOT_DIR/data/jwt-token.txt)" \
+            -H "Content-Type: application/json" \
+            -d '{"name":"validate-updated","price":777,"quantity":99}' \
+            -o /dev/null -w '%{http_code}' \
+            "https://localhost:$GW_PORT/api/items/2" || echo "0")
+        if [ "$post_status" = "204" ]; then
+            echo "  PASS [$profile POST /api/items/2] (204 No Content)"
+            PASS=$((PASS + 1))
+        else
+            fail_with_link "[$profile POST /api/items/2]: expected 204, got $post_status" "$docs_url"
+        fi
+
+        # 10. Warm the cache for item 2, then invalidate via POST, then
+        #     confirm the cache is MISS again (proving RemoveAsync worked).
+        curl -sk --max-time 30 --http2 -H "Authorization: Bearer $(cat $ROOT_DIR/data/jwt-token.txt)" \
+            -o /dev/null "https://localhost:$GW_PORT/api/items/3"  # warm
+        curl -sk --max-time 30 --http2 -X POST \
+            -H "Authorization: Bearer $(cat $ROOT_DIR/data/jwt-token.txt)" \
+            -H "Content-Type: application/json" \
+            -d '{"name":"validate-invalidated","price":111,"quantity":22}' \
+            -o /dev/null "https://localhost:$GW_PORT/api/items/3" # invalidate
+        invalidated_cache=$(curl -sk --max-time 30 --http2 -H "Authorization: Bearer $(cat $ROOT_DIR/data/jwt-token.txt)" \
+            -D- -o /dev/null "https://localhost:$GW_PORT/api/items/3" | grep -i "^x-cache:" | tr -d '\r' | awk '{print $2}')
+        if [ "$invalidated_cache" = "MISS" ]; then
+            echo "  PASS [$profile POST invalidation] (GET after POST shows MISS)"
+            PASS=$((PASS + 1))
+        else
+            fail_with_link "[$profile POST invalidation]: expected MISS after POST, got '$invalidated_cache'" "$docs_url"
+        fi
+
+        # 11. Authenticated /api/me — cache-aside from users table
+        local gw_me_response gw_me_id
+        gw_me_response=$(curl -sk --max-time 30 --http2 -H "Authorization: Bearer $(cat $ROOT_DIR/data/jwt-token.txt)" "https://localhost:$GW_PORT/api/me" || true)
+        gw_me_id=$(echo "$gw_me_response" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id','-1'))" 2>/dev/null || echo "-1")
+        if [ "$gw_me_id" = "42" ]; then
+            echo "  PASS [$profile /api/me] (authenticated, returned user 42)"
+            PASS=$((PASS + 1))
+        else
+            fail_with_link "[$profile /api/me]: expected user id 42, got $gw_me_id" "$docs_url"
+        fi
+    else
+        echo "  FAIL: $profile HTTPS port $GW_PORT not responding after 60s"
+        FAIL=$((FAIL + 1))
+    fi
+
+    # Cleanup
+    if [ -f "$compose_file" ]; then
+        CERTS_DIR="$CERTS_DIR" DATA_DIR="$DATA_DIR" DATABASE_URL="postgres://bench:bench@localhost:5432/benchmark" \
+            docker compose -f "$compose_file" -p "$gw_project" down --remove-orphans 2>/dev/null || true
+    fi
+}
+
+if has_test "production-stack"; then
+    _validate_production_stack \
+        "$ROOT_DIR/frameworks/$FRAMEWORK/compose.production-stack.yml" \
+        "$DOCS_BASE/gateway/production-stack/validation"
+fi
+
+
+# keep `source` exit status 0 so the orchestrator continues (set -e stays active inside)
+true
diff --git a/scripts/lib/validate/checks/http2.sh b/scripts/lib/validate/checks/http2.sh
new file mode 100644
index 000000000..d8fed5065
--- /dev/null
+++ b/scripts/lib/validate/checks/http2.sh
@@ -0,0 +1,163 @@
+# checks/http2.sh — baseline-h2, baseline-h2c, json-h2c
+# Part of the validate.sh suite — sourced by scripts/validate.sh, not run directly.
+
+# ───── Baseline H2 (GET /baseline2 over HTTP/2 + TLS) ─────
+
+if has_test "baseline-h2"; then
+    H2_DOCS="$DOCS_BASE/h2/baseline-h2/validation"
+    echo "[test] baseline-h2 endpoint"
+    if wait_h2; then
+        # Verify server actually speaks HTTP/2
+        h2_proto=$(curl -sk --max-time 30 --http2 -o /dev/null -w '%{http_version}' "https://localhost:$H2PORT/baseline2?a=1&b=1" || echo "0")
+        if [ "$h2_proto" = "2" ]; then
+            echo "  PASS [HTTP/2 protocol negotiation] (HTTP/$h2_proto)"
+            PASS=$((PASS + 1))
+        else
+            fail_with_link "[HTTP/2 protocol negotiation]: server responded with HTTP/$h2_proto" "$H2_DOCS"
+        fi
+
+        check "GET /baseline2?a=13&b=42 over HTTP/2" "55" "$H2_DOCS" \
+            -sk --http2 "https://localhost:$H2PORT/baseline2?a=13&b=42"
+
+        # Anti-cheat: randomized query params
+        A3=$((RANDOM % 900 + 100))
+        B3=$((RANDOM % 900 + 100))
+        check "GET /baseline2?a=$A3&b=$B3 over HTTP/2 (random)" "$((A3 + B3))" "$H2_DOCS" \
+            -sk --http2 "https://localhost:$H2PORT/baseline2?a=$A3&b=$B3"
+
+        check_header "GET /baseline2 Content-Type" "Content-Type" "text/plain" "$H2_DOCS" \
+            -sk --http2 "https://localhost:$H2PORT/baseline2?a=1&b=1"
+    fi
+fi
+
+# ───── Baseline H2c (GET /baseline2 over HTTP/2 cleartext, prior-knowledge) ─────
+
+if has_test "baseline-h2c"; then
+    H2C_DOCS="$DOCS_BASE/h2/baseline-h2c/validation"
+    echo "[test] baseline-h2c endpoint"
+
+    # Wait briefly for the h2c listener to be up — the main probe waited on
+    # :8080 or :8443, not :8082. One shot with a short timeout is enough
+    # because the container has already been up for the earlier tests.
+    for i in $(seq 1 10); do
+        if curl -s --http2-prior-knowledge --max-time 2 -o /dev/null \
+             "http://localhost:$H2C_PORT/baseline2?a=1&b=1" 2>/dev/null; then
+            break
+        fi
+        sleep 1
+    done
+
+    # Anti-cheat #1: require HTTP/2 on the wire. Forces prior-knowledge so
+    # a server that naively accepts an HTTP/1.1 request on the same port
+    # can't pass by answering plain h1 — %{http_version} reports the actual
+    # negotiated protocol.
+    h2c_proto=$(curl -s --max-time 30 --http2-prior-knowledge \
+        -o /dev/null -w '%{http_version}' \
+        "http://localhost:$H2C_PORT/baseline2?a=1&b=1" 2>/dev/null || echo "0")
+    if [ "$h2c_proto" = "2" ]; then
+        echo "  PASS [HTTP/2 cleartext (prior-knowledge)] (HTTP/$h2c_proto)"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[HTTP/2 cleartext (prior-knowledge)]: server responded with HTTP/$h2c_proto, expected HTTP/2" "$H2C_DOCS"
+    fi
+
+    # Anti-cheat #2: the same port MUST NOT also serve HTTP/1.1. If it did,
+    # the benchmark could be measuring h1 throughput (much higher on some
+    # stacks) while labeled as h2c. --http1.1 forces curl to refuse the
+    # h2 preface; we check that the server didn't happily answer.
+    h1_code=$(curl -s --max-time 5 --http1.1 \
+        -o /dev/null -w '%{http_code}' \
+        "http://localhost:$H2C_PORT/baseline2?a=1&b=1" 2>/dev/null || echo "000")
+    if [ "$h1_code" != "200" ]; then
+        echo "  PASS [h2c-only: port $H2C_PORT rejects plain HTTP/1.1] (got $h1_code)"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[h2c-only]: port $H2C_PORT also answered HTTP/1.1 with 200 — dual-serving lets the benchmark measure h1 throughput instead of h2c. The h2c listener must refuse HTTP/1.1 requests." "$H2C_DOCS"
+    fi
+
+    check "GET /baseline2?a=13&b=42 over h2c" "55" "$H2C_DOCS" \
+        -s --http2-prior-knowledge "http://localhost:$H2C_PORT/baseline2?a=13&b=42"
+
+    # Anti-cheat #3: randomized sum
+    A4=$((RANDOM % 900 + 100))
+    B4=$((RANDOM % 900 + 100))
+    check "GET /baseline2?a=$A4&b=$B4 over h2c (random)" "$((A4 + B4))" "$H2C_DOCS" \
+        -s --http2-prior-knowledge "http://localhost:$H2C_PORT/baseline2?a=$A4&b=$B4"
+
+    check_header "GET /baseline2 Content-Type (h2c)" "Content-Type" "text/plain" "$H2C_DOCS" \
+        -s --http2-prior-knowledge "http://localhost:$H2C_PORT/baseline2?a=1&b=1"
+fi
+
+# ───── JSON H2c (GET /json/{count}?m=M over HTTP/2 cleartext) ─────
+
+if has_test "json-h2c"; then
+    JSON_H2C_DOCS="$DOCS_BASE/h2/json-h2c/validation"
+    echo "[test] json-h2c endpoint"
+
+    # Still re-assert HTTP/2 on the wire for the /json path specifically —
+    # a server could in theory route /baseline2 through h2c and /json
+    # through an h1 fallback handler.
+    h2c_json_proto=$(curl -s --max-time 30 --http2-prior-knowledge \
+        -o /dev/null -w '%{http_version}' \
+        "http://localhost:$H2C_PORT/json/1?m=1" 2>/dev/null || echo "0")
+    if [ "$h2c_json_proto" = "2" ]; then
+        echo "  PASS [/json HTTP/2 cleartext] (HTTP/$h2c_json_proto)"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[/json HTTP/2 cleartext]: server responded with HTTP/$h2c_json_proto on /json" "$JSON_H2C_DOCS"
+    fi
+
+    check_header "GET /json Content-Type (h2c)" "Content-Type" "application/json" "$JSON_H2C_DOCS" \
+        -s --http2-prior-knowledge "http://localhost:$H2C_PORT/json/1?m=1"
+
+    # Same (count, m) validator as the h1 json profile — count field must
+    # match and items.length equals count. Uses 4 distinct pairs that
+    # differ from the benchmark rotation so caching-by-key gets punished.
+    json_h2c_fail=false
+    for jp in "12:3" "22:7" "31:2" "50:5"; do
+        jcount="${jp%%:*}"
+        jm="${jp##*:}"
+        resp=$(curl -s --max-time 30 --http2-prior-knowledge \
+            "http://localhost:$H2C_PORT/json/$jcount?m=$jm" 2>/dev/null || true)
+        parsed=$(echo "$resp" | python3 -c "
+import sys, json
+m = $jm
+d = json.load(sys.stdin)
+count = d.get('count', -1)
+items = d.get('items', [])
+items_n = len(items)
+def valid_item(it):
+    r = it.get('rating')
+    return ('id' in it and 'name' in it and 'category' in it and 'price' in it
+            and 'quantity' in it and 'total' in it
+            and isinstance(it.get('tags'), list) and isinstance(it.get('active'), bool)
+            and isinstance(r, dict) and 'score' in r and 'count' in r)
+valid = all(valid_item(it) for it in items) if items else False
+correct_totals = True
+for item in items:
+    expected = item.get('price', 0) * item.get('quantity', 0) * m
+    if item.get('total', 0) != expected:
+        correct_totals = False
+        break
+print(f'{count} {items_n} {valid} {correct_totals}')
+" 2>/dev/null || echo "-1 -1 False False")
+        pc=$(echo "$parsed" | cut -d' ' -f1)
+        pn=$(echo "$parsed" | cut -d' ' -f2)
+        pv=$(echo "$parsed" | cut -d' ' -f3)
+        ptot=$(echo "$parsed" | cut -d' ' -f4)
+        if [ "$pc" = "$jcount" ] && [ "$pn" = "$jcount" ] && [ "$pv" = "True" ] && [ "$ptot" = "True" ]; then
+            :
+        else
+            fail_with_link "[GET /json/$jcount?m=$jm (h2c)]: count=$pc, items=$pn, schema=$pv, correct_totals=$ptot, expected $jcount" "$JSON_H2C_DOCS"
+            json_h2c_fail=true
+        fi
+    done
+    if [ "$json_h2c_fail" = "false" ]; then
+        echo "  PASS [GET /json/{count}?m=X over h2c] (4 counts × multipliers, full item schema + totals)"
+        PASS=$((PASS + 1))
+    fi
+fi
+
+
+# keep `source` exit status 0 so the orchestrator continues (set -e stays active inside)
+true
diff --git a/scripts/lib/validate/checks/json.sh b/scripts/lib/validate/checks/json.sh
new file mode 100644
index 000000000..dc3782a13
--- /dev/null
+++ b/scripts/lib/validate/checks/json.sh
@@ -0,0 +1,198 @@
+# checks/json.sh — json, json-comp, json-tls
+# Part of the validate.sh suite — sourced by scripts/validate.sh, not run directly.
+
+# ───── JSON Processing (GET /json) ─────
+
+if has_test "json" || has_test "api-4" || has_test "api-16"; then
+    JSON_DOCS="$DOCS_BASE/h1/isolated/json-processing/validation"
+    echo "[test] json endpoint"
+    json_fail=false
+    json_params=("12:3" "22:7" "31:2" "50:5")
+    for jp in "${json_params[@]}"; do
+        jcount="${jp%%:*}"
+        jm="${jp##*:}"
+        response=$(curl -s --max-time 30 "http://localhost:$PORT/json/$jcount?m=$jm" || true)
+        json_result=$(echo "$response" | python3 -c "
+import sys, json
+m = $jm
+d = json.load(sys.stdin)
+count = d.get('count', 0)
+items = d.get('items', [])
+def valid_item(it):
+    r = it.get('rating')
+    return ('id' in it and 'name' in it and 'category' in it and 'price' in it
+            and 'quantity' in it and 'total' in it
+            and isinstance(it.get('tags'), list) and isinstance(it.get('active'), bool)
+            and isinstance(r, dict) and 'score' in r and 'count' in r)
+valid = all(valid_item(it) for it in items) if items else False
+correct_totals = True
+for item in items:
+    expected = item.get('price', 0) * item.get('quantity', 0) * m
+    if item.get('total', 0) != expected:
+        correct_totals = False
+        break
+print(f'{count} {valid} {correct_totals}')
+" 2>/dev/null || echo "0 False False")
+        json_count=$(echo "$json_result" | cut -d' ' -f1)
+        json_valid=$(echo "$json_result" | cut -d' ' -f2)
+        json_correct=$(echo "$json_result" | cut -d' ' -f3)
+
+        if [ "$json_count" = "$jcount" ] && [ "$json_valid" = "True" ] && [ "$json_correct" = "True" ]; then
+            :
+        else
+            fail_with_link "[GET /json/$jcount?m=$jm]: count=$json_count, schema=$json_valid, correct_totals=$json_correct" "$JSON_DOCS"
+            json_fail=true
+        fi
+    done
+    if [ "$json_fail" = "false" ]; then
+        echo "  PASS [GET /json/{count}?m=X] (4 counts × multipliers + full item schema verified)"
+        PASS=$((PASS + 1))
+    fi
+
+    # Check Content-Type header
+    check_header "GET /json Content-Type" "Content-Type" "application/json" "$JSON_DOCS" \
+        "http://localhost:$PORT/json/50?m=1"
+fi
+
+# ───── JSON Compressed (GET /json/{count}?m=X with Accept-Encoding) ─────
+
+if has_test "json-comp"; then
+    JSONCOMP_DOCS="$DOCS_BASE/h1/isolated/json-processing/validation"
+    echo "[test] json-comp endpoint"
+
+    # Must return Content-Encoding: gzip or br when Accept-Encoding is sent
+    jc_headers=$(curl -s --max-time 30 -D- -o /dev/null -H "Accept-Encoding: gzip, br" "http://localhost:$PORT/json/50?m=1" || true)
+    jc_encoding=$(echo "$jc_headers" | grep -i "^content-encoding:" | sed 's/^[^:]*: *//' | tr -d '\r' | awk '{print tolower($1)}' || true)
+    if [ "$jc_encoding" = "gzip" ] || [ "$jc_encoding" = "br" ]; then
+        echo "  PASS [json-comp Content-Encoding: $jc_encoding]"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[json-comp]: expected Content-Encoding gzip or br, got '$jc_encoding'" "$JSONCOMP_DOCS"
+    fi
+
+    # Verify compressed response with varying counts and multipliers
+    jc_fail=false
+    jc_params=("25:3" "40:7" "50:2")
+    for jcp in "${jc_params[@]}"; do
+        jccount="${jcp%%:*}"
+        jcm="${jcp##*:}"
+        jc_response=$(curl -s --max-time 30 --compressed -H "Accept-Encoding: gzip, br" "http://localhost:$PORT/json/$jccount?m=$jcm" || true)
+        jc_result=$(echo "$jc_response" | python3 -c "
+import sys, json
+m = $jcm
+d = json.load(sys.stdin)
+count = d.get('count', 0)
+items = d.get('items', [])
+def valid_item(it):
+    r = it.get('rating')
+    return ('id' in it and 'name' in it and 'category' in it and 'price' in it
+            and 'quantity' in it and 'total' in it
+            and isinstance(it.get('tags'), list) and isinstance(it.get('active'), bool)
+            and isinstance(r, dict) and 'score' in r and 'count' in r)
+valid = all(valid_item(it) for it in items) if items else False
+correct_totals = True
+for item in items:
+    expected = item.get('price', 0) * item.get('quantity', 0) * m
+    if item.get('total', 0) != expected:
+        correct_totals = False
+        break
+print(f'{count} {valid} {correct_totals}')
+" 2>/dev/null || echo "0 False False")
+        jc_count=$(echo "$jc_result" | cut -d' ' -f1)
+        jc_valid=$(echo "$jc_result" | cut -d' ' -f2)
+        jc_correct=$(echo "$jc_result" | cut -d' ' -f3)
+
+        if [ "$jc_count" = "$jccount" ] && [ "$jc_valid" = "True" ] && [ "$jc_correct" = "True" ]; then
+            :
+        else
+            fail_with_link "[json-comp /json/$jccount?m=$jcm]: count=$jc_count, schema=$jc_valid, correct=$jc_correct" "$JSONCOMP_DOCS"
+            jc_fail=true
+        fi
+    done
+    if [ "$jc_fail" = "false" ]; then
+        echo "  PASS [json-comp response] (3 counts × multipliers, compressed, full item schema)"
+        PASS=$((PASS + 1))
+    fi
+
+    # Without Accept-Encoding must NOT return Content-Encoding
+    jc_no_enc=$(curl -s --max-time 30 -D- -o /dev/null "http://localhost:$PORT/json/50?m=1" | grep -i "^content-encoding:" | tr -d '\r' || true)
+    if [ -z "$jc_no_enc" ]; then
+        echo "  PASS [json-comp per-request] (no Content-Encoding without Accept-Encoding)"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[json-comp per-request]: got $jc_no_enc without Accept-Encoding" "$JSONCOMP_DOCS"
+    fi
+fi
+
+# ───── JSON TLS (GET /json/{count}?m=X over HTTP/1.1 + TLS on :8081) ─────
+
+if has_test "json-tls"; then
+    JSONTLS_DOCS="$DOCS_BASE/h1/isolated/json-tls/validation"
+    echo "[test] json-tls endpoint"
+
+    # Must negotiate HTTP/1.1 (not h2) via ALPN on :8081
+    jt_proto=$(curl -sk --max-time 30 --http1.1 -o /dev/null -w '%{http_version}' "https://localhost:$H1TLS_PORT/json/1?m=1" 2>/dev/null || echo "0")
+    if [ "$jt_proto" = "1.1" ]; then
+        echo "  PASS [json-tls protocol negotiation] (HTTP/$jt_proto over TLS)"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[json-tls protocol negotiation]: expected 1.1, got HTTP/$jt_proto" "$JSONTLS_DOCS"
+    fi
+
+    # Response body correctness across 3 (count, m) pairs (different from json-comp so a caller can't share state)
+    jt_fail=false
+    jt_params=("7:2" "23:11" "50:1")
+    for jtp in "${jt_params[@]}"; do
+        jtcount="${jtp%%:*}"
+        jtm="${jtp##*:}"
+        jt_response=$(curl -sk --max-time 30 "https://localhost:$H1TLS_PORT/json/$jtcount?m=$jtm" || true)
+        jt_result=$(echo "$jt_response" | python3 -c "
+import sys, json
+m = $jtm
+d = json.load(sys.stdin)
+count = d.get('count', 0)
+items = d.get('items', [])
+def valid_item(it):
+    r = it.get('rating')
+    return ('id' in it and 'name' in it and 'category' in it and 'price' in it
+            and 'quantity' in it and 'total' in it
+            and isinstance(it.get('tags'), list) and isinstance(it.get('active'), bool)
+            and isinstance(r, dict) and 'score' in r and 'count' in r)
+valid = all(valid_item(it) for it in items) if items else False
+correct_totals = True
+for item in items:
+    expected = item.get('price', 0) * item.get('quantity', 0) * m
+    if item.get('total', 0) != expected:
+        correct_totals = False
+        break
+print(f'{count} {valid} {correct_totals}')
+" 2>/dev/null || echo "0 False False")
+        jt_count=$(echo "$jt_result" | cut -d' ' -f1)
+        jt_valid=$(echo "$jt_result" | cut -d' ' -f2)
+        jt_correct=$(echo "$jt_result" | cut -d' ' -f3)
+
+        if [ "$jt_count" = "$jtcount" ] && [ "$jt_valid" = "True" ] && [ "$jt_correct" = "True" ]; then
+            :
+        else
+            fail_with_link "[json-tls /json/$jtcount?m=$jtm]: count=$jt_count, schema=$jt_valid, correct=$jt_correct" "$JSONTLS_DOCS"
+            jt_fail=true
+        fi
+    done
+    if [ "$jt_fail" = "false" ]; then
+        echo "  PASS [json-tls response] (3 (count, m) pairs over TLS, full item schema)"
+        PASS=$((PASS + 1))
+    fi
+
+    # Content-Type must be application/json
+    jt_ct=$(curl -sk --max-time 30 -D- -o /dev/null "https://localhost:$H1TLS_PORT/json/1?m=1" | grep -i "^content-type:" | tr -d '\r' || true)
+    if echo "$jt_ct" | grep -qi 'application/json'; then
+        echo "  PASS [json-tls Content-Type: application/json]"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[json-tls Content-Type]: expected application/json, got '$jt_ct'" "$JSONTLS_DOCS"
+    fi
+fi
+
+
+# keep `source` exit status 0 so the orchestrator continues (set -e stays active inside)
+true
diff --git a/scripts/lib/validate/checks/static.sh b/scripts/lib/validate/checks/static.sh
new file mode 100644
index 000000000..560c38659
--- /dev/null
+++ b/scripts/lib/validate/checks/static.sh
@@ -0,0 +1,113 @@
+# checks/static.sh — static (H1), static-h2
+# Part of the validate.sh suite — sourced by scripts/validate.sh, not run directly.
+
+# ───── Static Files H1 (GET /static/* over HTTP/1.1) ─────
+
+if has_test "static"; then
+    STATIC_DOCS="$DOCS_BASE/h1/isolated/static/validation"
+    echo "[test] static endpoint"
+    check_header "GET /static/reset.css Content-Type" "Content-Type" "text/css" "$STATIC_DOCS" \
+        -s "http://localhost:$PORT/static/reset.css"
+
+    check_header "GET /static/app.js Content-Type" "Content-Type" "application/javascript" "$STATIC_DOCS" \
+        -s "http://localhost:$PORT/static/app.js"
+
+    check_header "GET /static/manifest.json Content-Type" "Content-Type" "application/json" "$STATIC_DOCS" \
+        -s "http://localhost:$PORT/static/manifest.json"
+
+    # Verify file sizes match actual files on disk
+    static_fail=false
+    for sf in reset.css layout.css theme.css components.css utilities.css analytics.js helpers.js app.js vendor.js router.js header.html footer.html regular.woff2 bold.woff2 logo.svg icon-sprite.svg hero.webp thumb1.webp thumb2.webp manifest.json; do
+        expected_size=$(wc -c < "$DATA_DIR/static/$sf" 2>/dev/null || echo "0")
+        actual_size=$(curl -s --max-time 30 -o /dev/null -w '%{size_download}' "http://localhost:$PORT/static/$sf" || echo "0")
+        if [ "$actual_size" -eq "$expected_size" ] 2>/dev/null; then
+            true
+        else
+            fail_with_link "[static/$sf size]: expected $expected_size bytes, got $actual_size" "$STATIC_DOCS"
+            static_fail=true
+        fi
+    done
+    if [ "$static_fail" = "false" ]; then
+        echo "  PASS [static file sizes] (20 files verified)"
+        PASS=$((PASS + 1))
+    fi
+
+    # Verify compression works when Accept-Encoding is sent — for each file, if server compresses, decompressed size must match original
+    static_comp_fail=false
+    static_comp_count=0
+    static_comp_skip=0
+    for sf in reset.css layout.css theme.css components.css utilities.css analytics.js helpers.js app.js vendor.js router.js header.html footer.html regular.woff2 bold.woff2 logo.svg icon-sprite.svg hero.webp thumb1.webp thumb2.webp manifest.json; do
+        expected_size=$(wc -c < "$DATA_DIR/static/$sf" 2>/dev/null || echo "0")
+        _hdr_tmp=$(mktemp)
+        _body_tmp=$(mktemp)
+        curl -s --max-time 30 --compressed -D "$_hdr_tmp" -o "$_body_tmp" "http://localhost:$PORT/static/$sf" || true
+        comp_enc=$(grep -i "^content-encoding:" "$_hdr_tmp" | sed 's/^[^:]*: *//' | tr -d '\r' | awk '{print tolower($1)}' || true)
+        decompressed=$(wc -c < "$_body_tmp")
+        rm -f "$_hdr_tmp" "$_body_tmp"
+        if [ -n "$comp_enc" ]; then
+            if [ "$decompressed" -eq "$expected_size" ] 2>/dev/null; then
+                static_comp_count=$((static_comp_count + 1))
+            else
+                fail_with_link "[static/$sf compression]: Content-Encoding: $comp_enc but decompressed size $decompressed != expected $expected_size" "$STATIC_DOCS"
+                static_comp_fail=true
+            fi
+        else
+            static_comp_skip=$((static_comp_skip + 1))
+        fi
+    done
+    if [ "$static_comp_fail" = "false" ]; then
+        if [ "$static_comp_count" -gt 0 ]; then
+            echo "  PASS [static compression] ($static_comp_count files compressed, $static_comp_skip skipped)"
+            PASS=$((PASS + 1))
+        else
+            echo "  SKIP [static compression] (server does not compress static files)"
+        fi
+    fi
+
+    check_status "GET /static/nonexistent.txt" "404" "$STATIC_DOCS" \
+        -s "http://localhost:$PORT/static/nonexistent.txt"
+
+    # Anti-pre-cache: mutate the file on disk mid-run and require the change to show.
+    check_static_freshness "static freshness (no pre-caching)" "$STATIC_DOCS" "http://localhost:$PORT"
+fi
+
+
+# ───── Static Files H2 (GET /static/* over HTTP/2 + TLS) ─────
+
+if has_test "static-h2"; then
+    STATIC_H2_DOCS="$DOCS_BASE/h2/static-h2/validation"
+    echo "[test] static-h2 endpoint"
+    if wait_h2; then
+        # Check a few static files exist and return correct Content-Type
+        check_header "GET /static/reset.css Content-Type" "Content-Type" "text/css" "$STATIC_H2_DOCS" \
+            -sk --http2 "https://localhost:$H2PORT/static/reset.css"
+
+        check_header "GET /static/app.js Content-Type" "Content-Type" "application/javascript" "$STATIC_H2_DOCS" \
+            -sk --http2 "https://localhost:$H2PORT/static/app.js"
+
+        check_header "GET /static/manifest.json Content-Type" "Content-Type" "application/json" "$STATIC_H2_DOCS" \
+            -sk --http2 "https://localhost:$H2PORT/static/manifest.json"
+
+        # Check response size is non-zero
+        static_size=$(curl -sk --max-time 30 --http2 -o /dev/null -w '%{size_download}' "https://localhost:$H2PORT/static/reset.css" || echo "0")
+        if [ "$static_size" -gt 0 ]; then
+            echo "  PASS [static-h2 response size] ($static_size bytes)"
+            PASS=$((PASS + 1))
+        else
+            fail_with_link "[static-h2 response size]: empty response" "$STATIC_H2_DOCS"
+        fi
+
+        # 404 for missing files
+        check_status "GET /static/nonexistent.txt" "404" "$STATIC_H2_DOCS" \
+            -sk --http2 "https://localhost:$H2PORT/static/nonexistent.txt"
+
+        # Anti-pre-cache: only run here if the H1 static test didn't already (h2-only entries).
+        if ! has_test "static"; then
+            check_static_freshness "static-h2 freshness (no pre-caching)" "$STATIC_H2_DOCS" "https://localhost:$H2PORT" -k --http2
+        fi
+    fi
+fi
+
+
+# keep `source` exit status 0 so the orchestrator continues (set -e stays active inside)
+true
diff --git a/scripts/lib/validate/checks/upload.sh b/scripts/lib/validate/checks/upload.sh
new file mode 100644
index 000000000..a0cda9e7a
--- /dev/null
+++ b/scripts/lib/validate/checks/upload.sh
@@ -0,0 +1,49 @@
+# checks/upload.sh — upload
+# Part of the validate.sh suite — sourced by scripts/validate.sh, not run directly.
+
+# ───── Upload (POST /upload) ─────
+
+if has_test "upload"; then
+    UPLOAD_DOCS="$DOCS_BASE/h1/isolated/upload/validation"
+    echo "[test] upload endpoint"
+    # Small upload: returns byte count
+    UPLOAD_BODY="Hello, HttpArena!"
+    EXPECTED_LEN=${#UPLOAD_BODY}
+    check "POST /upload small body" "$EXPECTED_LEN" "$UPLOAD_DOCS" \
+        -X POST -H "Content-Type: application/octet-stream" --data-binary "$UPLOAD_BODY" \
+        "http://localhost:$PORT/upload"
+
+    # Anti-cheat: random body to detect hardcoded responses
+    RANDOM_BODY=$(head -c 64 /dev/urandom | base64 | head -c 48)
+    EXPECTED_RANDOM_LEN=${#RANDOM_BODY}
+    ACTUAL_LEN=$(curl -s --max-time 30 -X POST -H "Content-Type: application/octet-stream" --data-binary "$RANDOM_BODY" "http://localhost:$PORT/upload" || true)
+    if [ "$ACTUAL_LEN" = "$EXPECTED_RANDOM_LEN" ]; then
+        echo "  PASS [POST /upload random body] (bytes: $ACTUAL_LEN)"
+        PASS=$((PASS + 1))
+    else
+        fail_with_link "[POST /upload random body]: expected '$EXPECTED_RANDOM_LEN', got '$ACTUAL_LEN'" "$UPLOAD_DOCS"
+    fi
+
+    # Varying upload sizes
+    upload_fail=false
+    for upload_spec in "500K:512000" "2M:2097152" "10M:10485760" "20M:20971520"; do
+        upload_label="${upload_spec%%:*}"
+        upload_size="${upload_spec##*:}"
+        upload_bs=$((upload_size / 1024))
+        ACTUAL_LARGE=$( { dd if=/dev/urandom bs=1024 count=$upload_bs 2>/dev/null | curl -s --max-time 60 -X POST -H "Content-Type: application/octet-stream" --data-binary @- "http://localhost:$PORT/upload"; } || true )
+        if [ "$ACTUAL_LARGE" = "$upload_size" ]; then
+            :
+        else
+            fail_with_link "[POST /upload $upload_label]: expected '$upload_size', got '$ACTUAL_LARGE'" "$UPLOAD_DOCS"
+            upload_fail=true
+        fi
+    done
+    if [ "$upload_fail" = "false" ]; then
+        echo "  PASS [POST /upload] (4 sizes verified: 500K, 2M, 10M, 20M)"
+        PASS=$((PASS + 1))
+    fi
+fi
+
+
+# keep `source` exit status 0 so the orchestrator continues (set -e stays active inside)
+true
diff --git a/scripts/lib/validate/checks/websocket.sh b/scripts/lib/validate/checks/websocket.sh
new file mode 100644
index 000000000..7800b7144
--- /dev/null
+++ b/scripts/lib/validate/checks/websocket.sh
@@ -0,0 +1,24 @@
+# checks/websocket.sh — websocket echo
+# Part of the validate.sh suite — sourced by scripts/validate.sh, not run directly.
+
+# ───── WebSocket Echo (ws://localhost/ws) ─────
+
+if has_test "echo-ws"; then
+    WS_DOCS="$DOCS_BASE/ws/echo/validation"
+    echo "[test] echo-ws endpoint"
+    WS_OUTPUT=$(python3 "$SCRIPT_DIR/validate-ws.py" localhost "$PORT" /ws 2>&1) || true
+    echo "$WS_OUTPUT"
+
+    # Parse pass/fail counts from the script output
+    WS_PASS=$(echo "$WS_OUTPUT" | grep -oP '(\d+) passed' | grep -oP '\d+')
+    WS_FAIL=$(echo "$WS_OUTPUT" | grep -oP '(\d+) failed' | grep -oP '\d+')
+    PASS=$((PASS + ${WS_PASS:-0}))
+    FAIL=$((FAIL + ${WS_FAIL:-0}))
+    if [ "${WS_FAIL:-0}" -gt 0 ]; then
+        echo "        → $WS_DOCS"
+    fi
+fi
+
+
+# keep `source` exit status 0 so the orchestrator continues (set -e stays active inside)
+true
diff --git a/scripts/lib/validate/container.sh b/scripts/lib/validate/container.sh
new file mode 100644
index 000000000..ab1d91170
--- /dev/null
+++ b/scripts/lib/validate/container.sh
@@ -0,0 +1,188 @@
+# scripts/lib/validate/container.sh — volume mounts, Postgres/Redis sidecars, container start, readiness wait
+# Part of the validate.sh suite — sourced by scripts/validate.sh, not run directly.
+
+
+# Mount volumes based on subscribed tests
+HARD_NOFILE=$(ulimit -Hn 2>/dev/null || echo 1048576)
+# Docker --ulimit nofile rejects "unlimited"; fall back to a large numeric cap
+[[ "$HARD_NOFILE" =~ ^[0-9]+$ ]] || HARD_NOFILE=1048576
+if has_test "async-db" || has_test "crud" || has_test "api-4" || has_test "api-16" || has_test "gateway-64" || has_test "gateway-h3" || has_test "production-stack" || has_test "fortunes"; then
+    docker_args=(-d --name "$CONTAINER_NAME" --network host --security-opt seccomp=unconfined
+        --ulimit memlock=-1:-1 --ulimit nofile="$HARD_NOFILE:$HARD_NOFILE")
+else
+    docker_args=(-d --name "$CONTAINER_NAME" -p "$PORT:8080" --security-opt seccomp=unconfined
+        --ulimit memlock=-1:-1 --ulimit nofile="$HARD_NOFILE:$HARD_NOFILE")
+fi
+docker_args+=(-v "$DATA_DIR/dataset.json:/data/dataset.json:ro")
+
+needs_h2=false
+if has_test "baseline-h2" || has_test "static-h2" || has_test "baseline-h3" || has_test "static-h3" || has_test "gateway-64" || has_test "gateway-h3" || has_test "production-stack"; then
+    needs_h2=true
+fi
+
+needs_h1tls=false
+if has_test "json-tls"; then
+    needs_h1tls=true
+fi
+
+needs_h2c=false
+if has_test "baseline-h2c" || has_test "json-h2c"; then
+    needs_h2c=true
+fi
+
+if ($needs_h2 || $needs_h1tls) && [ -d "$CERTS_DIR" ]; then
+    docker_args+=(-v "$CERTS_DIR:/certs:ro")
+    $needs_h2     && docker_args+=(-p "$H2PORT:8443")
+    $needs_h1tls  && docker_args+=(-p "$H1TLS_PORT:8081")
+fi
+
+# h2c uses no TLS so no certs mount needed; just expose the port.
+$needs_h2c && docker_args+=(-p "$H2C_PORT:8082")
+
+if has_test "gateway-64" || has_test "gateway-h3"; then
+    docker_args+=(-v "$DATA_DIR/dataset-large.json:/data/dataset-large.json:ro")
+fi
+
+if has_test "static" || has_test "static-h2" || has_test "static-h3" || has_test "gateway-64" || has_test "gateway-h3" || has_test "production-stack"; then
+    docker_args+=(-v "$DATA_DIR/static:/data/static:ro")
+fi
+
+# Note: --security-opt seccomp=unconfined is applied unconditionally in both
+# container-launch branches above. io_uring (and other syscalls some runtimes
+# rely on) are blocked by Docker's default seccomp profile, and a framework
+# shouldn't have to advertise engine=="io_uring" to be testable — many need it
+# transitively (e.g. an engine built on io_uring under another name). This
+# mirrors benchmark.sh, which always runs framework containers unconfined.
+
+# Start Postgres sidecar if async-db is needed
+if has_test "async-db" || has_test "crud" || has_test "api-4" || has_test "api-16" || has_test "gateway-64" || has_test "gateway-h3" || has_test "production-stack" || has_test "fortunes"; then
+    echo "[postgres] Starting Postgres sidecar for validation..."
+    docker rm -f "$PG_CONTAINER" 2>/dev/null || true
+    docker run -d --name "$PG_CONTAINER" --network host \
+        -e POSTGRES_USER=bench \
+        -e POSTGRES_PASSWORD=bench \
+        -e POSTGRES_DB=benchmark \
+        -v "$DATA_DIR/pgdb-seed.sql:/docker-entrypoint-initdb.d/seed.sql:ro" \
+        postgres:18 \
+        -c max_connections=256
+    for i in $(seq 1 60); do
+        if docker exec "$PG_CONTAINER" pg_isready -U bench -d benchmark >/dev/null 2>&1; then
+            # Ensure seed data is loaded (pg_isready fires before init scripts finish)
+            if docker exec "$PG_CONTAINER" psql -U bench -d benchmark -tAc "SELECT 1 FROM items LIMIT 1" 2>/dev/null | grep -q 1; then
+                echo "[postgres] Ready"
+                break
+            fi
+        fi
+        [ "$i" -eq 60 ] && { echo "FAIL: Postgres sidecar not ready"; exit 1; }
+        sleep 1
+    done
+    docker_args+=(-e "DATABASE_URL=postgres://bench:bench@localhost:5432/benchmark")
+    docker_args+=(-e "DATABASE_MAX_CONN=256")
+fi
+
+# Start Redis sidecar if needed
+if has_test "crud"; then
+
+    REDIS_CONTAINER="httparena-redis"
+    REDIS_URL="redis://localhost:6379"
+    # Validation is correctness-only, so the Redis sidecar is not pinned to specific
+    # cores by default (benchmarking pins it via scripts/lib/redis.sh). Set REDIS_CPUSET
+    # explicitly to restore pinning; left unset it runs unpinned and works on any host.
+    REDIS_CPUSET="${REDIS_CPUSET:-}"
+
+    echo "[redis] Starting Redis sidecar${REDIS_CPUSET:+ (cpuset=$REDIS_CPUSET)}"
+    docker rm -f "$REDIS_CONTAINER" 2>/dev/null || true
+    docker run -d --rm --name "$REDIS_CONTAINER" --network host \
+        ${REDIS_CPUSET:+--cpuset-cpus="$REDIS_CPUSET"} \
+        --ulimit memlock=-1:-1 \
+        --ulimit nofile=1048576:1048576 \
+        redis:7-alpine \
+        redis-server \
+            --protected-mode no \
+            --bind 0.0.0.0 \
+            --port 6379 \
+            --save "" \
+            --appendonly no \
+            --maxmemory 512mb \
+            --maxmemory-policy allkeys-lru \
+            --io-threads 1 \
+            >/dev/null
+
+    # Wait for PING to succeed.
+    for i in $(seq 1 30); do
+        if docker exec "$REDIS_CONTAINER" redis-cli ping 2>/dev/null | grep -q PONG; then
+            echo "[redis] Ready"
+            break
+        fi
+        [ "$i" -eq 30 ] && { echo "FAIL: Redis sidecar not ready"; exit 1; }
+        sleep 1
+    done
+    docker_args+=(-e "REDIS_URL=$REDIS_URL")
+fi
+
+# Start container (skip for gateway-only — compose handles it later)
+if [ "$GATEWAY_ONLY" = "false" ]; then
+    docker rm -f "$CONTAINER_NAME" 2>/dev/null || true
+    docker run "${docker_args[@]}" "$IMAGE_NAME"
+
+    # Wait for server to start.
+    #
+    # Primary probe is GET /baseline11 over plaintext HTTP/1.1 on $PORT — that
+    # works for the vast majority of frameworks, which all listen on 8080.
+    # H/2-only or H/3-only frameworks (e.g. wtx, which speaks h2c on 8080 or
+    # h2/h3 on 8443 depending on build) never respond to an HTTP/1.1 request
+    # and would otherwise time out. Fall back to GET /baseline2 over HTTPS
+    # with ALPN h2 on $H2PORT when the framework subscribes to any h2 or h3
+    # profile. H/3 servers still advertise h2 on the same TLS listener via
+    # ALPN, so this single fallback covers both cases without requiring
+    # curl to be built with HTTP/3 support.
+    need_tls_probe=false
+    if has_test "baseline-h2" || has_test "static-h2" \
+       || has_test "baseline-h3" || has_test "static-h3"; then
+        need_tls_probe=true
+    fi
+
+    need_h2c_probe=false
+    if has_test "baseline-h2c" || has_test "json-h2c"; then
+        need_h2c_probe=true
+    fi
+
+    # Pure-WebSocket frameworks (e.g. Fleck) don't speak HTTP at all, so the
+    # curl probes below would never succeed. Skip the wait when every
+    # subscribed test is a WS-only profile.
+    _ws_only=true
+    for _t in $TESTS; do
+        case "$_t" in
+            echo-ws|echo-ws-pipeline) ;;
+            *) _ws_only=false; break ;;
+        esac
+    done
+    if [ "$_ws_only" = "true" ] && [ -n "$TESTS" ]; then
+        echo "[wait] ws-only framework — skipping readiness probe"
+    else
+        echo "[wait] Waiting for server..."
+        for i in $(seq 1 30); do
+            if curl -s --max-time 2 -o /dev/null -w '' "http://localhost:$PORT/baseline11?a=1&b=1" 2>/dev/null; then
+                break
+            fi
+            if [ "$need_tls_probe" = "true" ] && \
+               curl -sk --http2 --max-time 2 -o /dev/null -w '' "https://localhost:$H2PORT/baseline2?a=1&b=1" 2>/dev/null; then
+                break
+            fi
+            if [ "$need_h2c_probe" = "true" ] && \
+               curl -s --http2-prior-knowledge --max-time 2 -o /dev/null -w '' "http://localhost:$H2C_PORT/baseline2?a=1&b=1" 2>/dev/null; then
+                break
+            fi
+            if [ "$i" -eq 30 ]; then
+                echo "FAIL: Server did not start within 30s"
+                exit 1
+            fi
+            sleep 1
+        done
+        echo "[ready] Server is up"
+    fi
+fi
+
+
+# keep `source` exit status 0 so the orchestrator continues (set -e stays active inside)
+true
diff --git a/scripts/lib/validate/setup.sh b/scripts/lib/validate/setup.sh
new file mode 100644
index 000000000..881fbfecc
--- /dev/null
+++ b/scripts/lib/validate/setup.sh
@@ -0,0 +1,87 @@
+# scripts/lib/validate/setup.sh — args, globals, cleanup trap, watchdog, meta parse, has_test
+# Part of the validate.sh suite — sourced by scripts/validate.sh, not run directly.
+
+#!/usr/bin/env bash
+set -euo pipefail
+
+FRAMEWORK="$1"
+IMAGE_NAME="httparena-${FRAMEWORK}"
+CONTAINER_NAME="httparena-validate-${FRAMEWORK}"
+PORT=8080
+H2PORT=8443
+H1TLS_PORT=8081
+H2C_PORT=8082
+PASS=0
+FAIL=0
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ROOT_DIR="$SCRIPT_DIR/.."
+META_FILE="$ROOT_DIR/frameworks/$FRAMEWORK/meta.json"
+CERTS_DIR="$ROOT_DIR/certs"
+DATA_DIR="$ROOT_DIR/data"
+
+PG_CONTAINER="httparena-validate-postgres"
+PG_NETWORK="httparena-validate-net"
+
+cleanup() {
+    # Kill watchdog if still running
+    [ -n "${WATCHDOG_PID:-}" ] && kill "$WATCHDOG_PID" 2>/dev/null || true
+    # Restore any static files the freshness probe mutated (in case it aborted).
+    if [ -n "${STATIC_FRESH_BACKUP:-}" ] && [ -d "${STATIC_FRESH_BACKUP:-}" ]; then
+        for _b in "$STATIC_FRESH_BACKUP"/*; do
+            [ -e "$_b" ] && cp -f "$_b" "$DATA_DIR/static/$(basename "$_b")" 2>/dev/null || true
+        done
+        rm -rf "$STATIC_FRESH_BACKUP" 2>/dev/null || true
+        STATIC_FRESH_BACKUP=""
+    fi
+    docker rm -f "$CONTAINER_NAME" 2>/dev/null || true
+    # Stop any multi-container compose stacks that may be running.
+    # Each profile has its own compose file + project namespace.
+    local cp_profile cp_compose
+    for cp_profile in gateway-64 gateway-h3 production-stack; do
+        if [ "$cp_profile" = "gateway-64" ]; then
+            cp_compose="$ROOT_DIR/frameworks/$FRAMEWORK/compose.gateway.yml"
+        else
+            cp_compose="$ROOT_DIR/frameworks/$FRAMEWORK/compose.$cp_profile.yml"
+        fi
+        if [ -f "$cp_compose" ]; then
+            CERTS_DIR="${CERTS_DIR:-$ROOT_DIR/certs}" DATA_DIR="${DATA_DIR:-$ROOT_DIR/data}" DATABASE_URL="${DATABASE_URL:-}" \
+                docker compose -f "$cp_compose" -p "httparena-validate-gw-${cp_profile}-${FRAMEWORK}" down --remove-orphans 2>/dev/null || true
+        fi
+    done
+    docker rm -f "$PG_CONTAINER" 2>/dev/null || true
+    docker network rm "$PG_NETWORK" 2>/dev/null || true
+}
+trap cleanup EXIT
+
+# 5-minute overall timeout
+VALIDATE_TIMEOUT=${VALIDATE_TIMEOUT:-300}
+( trap 'exit 0' TERM; sleep "$VALIDATE_TIMEOUT"; echo ""; echo "FAIL: Validation timed out after ${VALIDATE_TIMEOUT}s"; kill -TERM $$ 2>/dev/null ) &
+WATCHDOG_PID=$!
+
+echo "=== Validating: $FRAMEWORK ==="
+
+# Read subscribed tests from meta.json
+if [ ! -f "$META_FILE" ]; then
+    echo "SKIP: meta.json not found (framework removed)"
+    exit 0
+fi
+TESTS=$(python3 -c "import json; print(' '.join(json.load(open('$META_FILE'))['tests']))")
+echo "[info] Subscribed tests: $TESTS"
+
+# Type/mode drive the static freshness probe (engine/infrastructure are exempt).
+FW_TYPE=$(python3 -c "import json; print(json.load(open('$META_FILE')).get('type',''))" 2>/dev/null || echo "")
+FW_MODE=$(python3 -c "import json; print(json.load(open('$META_FILE')).get('mode','standard'))" 2>/dev/null || echo "standard")
+STATIC_FRESH_BACKUP=""   # set by check_static_freshness; restored by cleanup() on exit
+
+has_test() {
+    # Exact whole-token match. `grep -qw` treats "-" as a word boundary
+    # and matches "baseline" against "baseline-h2c" / "baseline-h2", and
+    # "json" against "json-h2c" / "json-tls" / "json-comp" — all false
+    # positives. Bash pattern match on the space-padded string is exact.
+    [[ " $TESTS " == *" $1 "* ]]
+}
+
+
+# keep `source` exit status 0 so the orchestrator continues (set -e stays active inside)
+true
diff --git a/scripts/lib/validate/summary.sh b/scripts/lib/validate/summary.sh
new file mode 100644
index 000000000..1445ed7bf
--- /dev/null
+++ b/scripts/lib/validate/summary.sh
@@ -0,0 +1,8 @@
+# summary.sh — print results + exit code
+# Part of the validate.sh suite — sourced by scripts/validate.sh, not run directly.
+
+# ───── Summary ─────
+
+echo ""
+echo "=== Results: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ] || exit 1
diff --git a/scripts/validate.sh b/scripts/validate.sh
index d2887e65f..5f1da5265 100755
--- a/scripts/validate.sh
+++ b/scripts/validate.sh
@@ -1,1704 +1,37 @@
 #!/usr/bin/env bash
-set -euo pipefail
-
-FRAMEWORK="$1"
-IMAGE_NAME="httparena-${FRAMEWORK}"
-CONTAINER_NAME="httparena-validate-${FRAMEWORK}"
-PORT=8080
-H2PORT=8443
-H1TLS_PORT=8081
-H2C_PORT=8082
-PASS=0
-FAIL=0
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-ROOT_DIR="$SCRIPT_DIR/.."
-META_FILE="$ROOT_DIR/frameworks/$FRAMEWORK/meta.json"
-CERTS_DIR="$ROOT_DIR/certs"
-DATA_DIR="$ROOT_DIR/data"
-
-PG_CONTAINER="httparena-validate-postgres"
-PG_NETWORK="httparena-validate-net"
-
-cleanup() {
-    # Kill watchdog if still running
-    [ -n "${WATCHDOG_PID:-}" ] && kill "$WATCHDOG_PID" 2>/dev/null || true
-    docker rm -f "$CONTAINER_NAME" 2>/dev/null || true
-    # Stop any multi-container compose stacks that may be running.
-    # Each profile has its own compose file + project namespace.
-    local cp_profile cp_compose
-    for cp_profile in gateway-64 gateway-h3 production-stack; do
-        if [ "$cp_profile" = "gateway-64" ]; then
-            cp_compose="$ROOT_DIR/frameworks/$FRAMEWORK/compose.gateway.yml"
-        else
-            cp_compose="$ROOT_DIR/frameworks/$FRAMEWORK/compose.$cp_profile.yml"
-        fi
-        if [ -f "$cp_compose" ]; then
-            CERTS_DIR="${CERTS_DIR:-$ROOT_DIR/certs}" DATA_DIR="${DATA_DIR:-$ROOT_DIR/data}" DATABASE_URL="${DATABASE_URL:-}" \
-                docker compose -f "$cp_compose" -p "httparena-validate-gw-${cp_profile}-${FRAMEWORK}" down --remove-orphans 2>/dev/null || true
-        fi
-    done
-    docker rm -f "$PG_CONTAINER" 2>/dev/null || true
-    docker network rm "$PG_NETWORK" 2>/dev/null || true
-}
-trap cleanup EXIT
-
-# 5-minute overall timeout
-VALIDATE_TIMEOUT=${VALIDATE_TIMEOUT:-300}
-( trap 'exit 0' TERM; sleep "$VALIDATE_TIMEOUT"; echo ""; echo "FAIL: Validation timed out after ${VALIDATE_TIMEOUT}s"; kill -TERM $$ 2>/dev/null ) &
-WATCHDOG_PID=$!
-
-echo "=== Validating: $FRAMEWORK ==="
-
-# Read subscribed tests from meta.json
-if [ ! -f "$META_FILE" ]; then
-    echo "SKIP: meta.json not found (framework removed)"
-    exit 0
-fi
-TESTS=$(python3 -c "import json; print(' '.join(json.load(open('$META_FILE'))['tests']))")
-echo "[info] Subscribed tests: $TESTS"
-
-has_test() {
-    # Exact whole-token match. `grep -qw` treats "-" as a word boundary
-    # and matches "baseline" against "baseline-h2c" / "baseline-h2", and
-    # "json" against "json-h2c" / "json-tls" / "json-comp" — all false
-    # positives. Bash pattern match on the space-padded string is exact.
-    [[ " $TESTS " == *" $1 "* ]]
-}
-
-# Build — skip standalone build if framework only subscribes to compose profiles
-# (gateway-64, gateway-h3, production-stack) and has no isolated tests.
-GATEWAY_ONLY=true
-for t in $TESTS; do
-    case "$t" in
-        gateway-64|gateway-h3|production-stack) ;;
-        *) GATEWAY_ONLY=false ;;
-    esac
-done
-
-if [ "$GATEWAY_ONLY" = "false" ]; then
-    echo "[build] Building Docker image..."
-    if [ -x "frameworks/$FRAMEWORK/build.sh" ]; then
-        "frameworks/$FRAMEWORK/build.sh" || { echo "FAIL: Docker build failed"; exit 1; }
-    else
-        docker build --no-cache -t "$IMAGE_NAME" "frameworks/$FRAMEWORK" || { echo "FAIL: Docker build failed"; exit 1; }
-    fi
-fi
-
-# Mount volumes based on subscribed tests
-HARD_NOFILE=$(ulimit -Hn 2>/dev/null || echo 1048576)
-# Docker --ulimit nofile rejects "unlimited"; fall back to a large numeric cap
-[[ "$HARD_NOFILE" =~ ^[0-9]+$ ]] || HARD_NOFILE=1048576
-if has_test "async-db" || has_test "crud" || has_test "api-4" || has_test "api-16" || has_test "gateway-64" || has_test "gateway-h3" || has_test "production-stack" || has_test "fortunes"; then
-    docker_args=(-d --name "$CONTAINER_NAME" --network host --security-opt seccomp=unconfined
-        --ulimit memlock=-1:-1 --ulimit nofile="$HARD_NOFILE:$HARD_NOFILE")
-else
-    docker_args=(-d --name "$CONTAINER_NAME" -p "$PORT:8080" --security-opt seccomp=unconfined
-        --ulimit memlock=-1:-1 --ulimit nofile="$HARD_NOFILE:$HARD_NOFILE")
-fi
-docker_args+=(-v "$DATA_DIR/dataset.json:/data/dataset.json:ro")
-
-needs_h2=false
-if has_test "baseline-h2" || has_test "static-h2" || has_test "baseline-h3" || has_test "static-h3" || has_test "gateway-64" || has_test "gateway-h3" || has_test "production-stack"; then
-    needs_h2=true
-fi
-
-needs_h1tls=false
-if has_test "json-tls"; then
-    needs_h1tls=true
-fi
-
-needs_h2c=false
-if has_test "baseline-h2c" || has_test "json-h2c"; then
-    needs_h2c=true
-fi
-
-if ($needs_h2 || $needs_h1tls) && [ -d "$CERTS_DIR" ]; then
-    docker_args+=(-v "$CERTS_DIR:/certs:ro")
-    $needs_h2     && docker_args+=(-p "$H2PORT:8443")
-    $needs_h1tls  && docker_args+=(-p "$H1TLS_PORT:8081")
-fi
-
-# h2c uses no TLS so no certs mount needed; just expose the port.
-$needs_h2c && docker_args+=(-p "$H2C_PORT:8082")
-
-if has_test "gateway-64" || has_test "gateway-h3"; then
-    docker_args+=(-v "$DATA_DIR/dataset-large.json:/data/dataset-large.json:ro")
-fi
-
-if has_test "static" || has_test "static-h2" || has_test "static-h3" || has_test "gateway-64" || has_test "gateway-h3" || has_test "production-stack"; then
-    docker_args+=(-v "$DATA_DIR/static:/data/static:ro")
-fi
-
-# Note: --security-opt seccomp=unconfined is applied unconditionally in both
-# container-launch branches above. io_uring (and other syscalls some runtimes
-# rely on) are blocked by Docker's default seccomp profile, and a framework
-# shouldn't have to advertise engine=="io_uring" to be testable — many need it
-# transitively (e.g. an engine built on io_uring under another name). This
-# mirrors benchmark.sh, which always runs framework containers unconfined.
-
-# Start Postgres sidecar if async-db is needed
-if has_test "async-db" || has_test "crud" || has_test "api-4" || has_test "api-16" || has_test "gateway-64" || has_test "gateway-h3" || has_test "production-stack" || has_test "fortunes"; then
-    echo "[postgres] Starting Postgres sidecar for validation..."
-    docker rm -f "$PG_CONTAINER" 2>/dev/null || true
-    docker run -d --name "$PG_CONTAINER" --network host \
-        -e POSTGRES_USER=bench \
-        -e POSTGRES_PASSWORD=bench \
-        -e POSTGRES_DB=benchmark \
-        -v "$DATA_DIR/pgdb-seed.sql:/docker-entrypoint-initdb.d/seed.sql:ro" \
-        postgres:18 \
-        -c max_connections=256
-    for i in $(seq 1 60); do
-        if docker exec "$PG_CONTAINER" pg_isready -U bench -d benchmark >/dev/null 2>&1; then
-            # Ensure seed data is loaded (pg_isready fires before init scripts finish)
-            if docker exec "$PG_CONTAINER" psql -U bench -d benchmark -tAc "SELECT 1 FROM items LIMIT 1" 2>/dev/null | grep -q 1; then
-                echo "[postgres] Ready"
-                break
-            fi
-        fi
-        [ "$i" -eq 60 ] && { echo "FAIL: Postgres sidecar not ready"; exit 1; }
-        sleep 1
-    done
-    docker_args+=(-e "DATABASE_URL=postgres://bench:bench@localhost:5432/benchmark")
-    docker_args+=(-e "DATABASE_MAX_CONN=256")
-fi
-
-# Start Redis sidecar if needed
-if has_test "crud"; then
-
-    REDIS_CONTAINER="httparena-redis"
-    REDIS_URL="redis://localhost:6379"
-    # Validation is correctness-only, so the Redis sidecar is not pinned to specific
-    # cores by default (benchmarking pins it via scripts/lib/redis.sh). Set REDIS_CPUSET
-    # explicitly to restore pinning; left unset it runs unpinned and works on any host.
-    REDIS_CPUSET="${REDIS_CPUSET:-}"
-
-    echo "[redis] Starting Redis sidecar${REDIS_CPUSET:+ (cpuset=$REDIS_CPUSET)}"
-    docker rm -f "$REDIS_CONTAINER" 2>/dev/null || true
-    docker run -d --rm --name "$REDIS_CONTAINER" --network host \
-        ${REDIS_CPUSET:+--cpuset-cpus="$REDIS_CPUSET"} \
-        --ulimit memlock=-1:-1 \
-        --ulimit nofile=1048576:1048576 \
-        redis:7-alpine \
-        redis-server \
-            --protected-mode no \
-            --bind 0.0.0.0 \
-            --port 6379 \
-            --save "" \
-            --appendonly no \
-            --maxmemory 512mb \
-            --maxmemory-policy allkeys-lru \
-            --io-threads 1 \
-            >/dev/null
-
-    # Wait for PING to succeed.
-    for i in $(seq 1 30); do
-        if docker exec "$REDIS_CONTAINER" redis-cli ping 2>/dev/null | grep -q PONG; then
-            echo "[redis] Ready"
-            break
-        fi
-        [ "$i" -eq 30 ] && { echo "FAIL: Redis sidecar not ready"; exit 1; }
-        sleep 1
-    done
-    docker_args+=(-e "REDIS_URL=$REDIS_URL")
-fi
-
-# Start container (skip for gateway-only — compose handles it later)
-if [ "$GATEWAY_ONLY" = "false" ]; then
-    docker rm -f "$CONTAINER_NAME" 2>/dev/null || true
-    docker run "${docker_args[@]}" "$IMAGE_NAME"
-
-    # Wait for server to start.
-    #
-    # Primary probe is GET /baseline11 over plaintext HTTP/1.1 on $PORT — that
-    # works for the vast majority of frameworks, which all listen on 8080.
-    # H/2-only or H/3-only frameworks (e.g. wtx, which speaks h2c on 8080 or
-    # h2/h3 on 8443 depending on build) never respond to an HTTP/1.1 request
-    # and would otherwise time out. Fall back to GET /baseline2 over HTTPS
-    # with ALPN h2 on $H2PORT when the framework subscribes to any h2 or h3
-    # profile. H/3 servers still advertise h2 on the same TLS listener via
-    # ALPN, so this single fallback covers both cases without requiring
-    # curl to be built with HTTP/3 support.
-    need_tls_probe=false
-    if has_test "baseline-h2" || has_test "static-h2" \
-       || has_test "baseline-h3" || has_test "static-h3"; then
-        need_tls_probe=true
-    fi
-
-    need_h2c_probe=false
-    if has_test "baseline-h2c" || has_test "json-h2c"; then
-        need_h2c_probe=true
-    fi
-
-    # Pure-WebSocket frameworks (e.g. Fleck) don't speak HTTP at all, so the
-    # curl probes below would never succeed. Skip the wait when every
-    # subscribed test is a WS-only profile.
-    _ws_only=true
-    for _t in $TESTS; do
-        case "$_t" in
-            echo-ws|echo-ws-pipeline) ;;
-            *) _ws_only=false; break ;;
-        esac
-    done
-    if [ "$_ws_only" = "true" ] && [ -n "$TESTS" ]; then
-        echo "[wait] ws-only framework — skipping readiness probe"
-    else
-        echo "[wait] Waiting for server..."
-        for i in $(seq 1 30); do
-            if curl -s --max-time 2 -o /dev/null -w '' "http://localhost:$PORT/baseline11?a=1&b=1" 2>/dev/null; then
-                break
-            fi
-            if [ "$need_tls_probe" = "true" ] && \
-               curl -sk --http2 --max-time 2 -o /dev/null -w '' "https://localhost:$H2PORT/baseline2?a=1&b=1" 2>/dev/null; then
-                break
-            fi
-            if [ "$need_h2c_probe" = "true" ] && \
-               curl -s --http2-prior-knowledge --max-time 2 -o /dev/null -w '' "http://localhost:$H2C_PORT/baseline2?a=1&b=1" 2>/dev/null; then
-                break
-            fi
-            if [ "$i" -eq 30 ]; then
-                echo "FAIL: Server did not start within 30s"
-                exit 1
-            fi
-            sleep 1
-        done
-        echo "[ready] Server is up"
-    fi
-fi
-
-# ───── Helpers ─────
-
-DOCS_BASE="https://www.http-arena.com/#doc=test-profiles"
-
-fail_with_link() {
-    local msg="$1"
-    local docs_url="$2"
-    echo "  FAIL $msg"
-    if [ -n "$docs_url" ]; then
-        echo "        → $docs_url"
-    fi
-    FAIL=$((FAIL + 1))
-}
-
-dump_debug() {
-    local trace="$1"
-    local response="$2"
-    if [ -n "$trace" ] && [ -s "$trace" ]; then
-        echo "        ─── wire trace ───"
-        sed 's/^/        /' "$trace"
-    fi
-    if [ -n "$response" ]; then
-        echo "        ─── response ───"
-        printf '%s\n' "$response" | sed 's/^/        /'
-    fi
-    [ -n "$trace" ] && rm -f "$trace"
-}
-
-check() {
-    local label="$1"
-    local expected_body="$2"
-    local docs_url="$3"
-    shift 3
-    local response trace
-    trace=$(mktemp)
-    response=$(curl -s --max-time 30 -D- --trace-ascii "$trace" "$@" || true)
-    local body
-    body=$(echo "$response" | tail -1)
-
-    if [ "$body" = "$expected_body" ]; then
-        echo "  PASS [$label]"
-        PASS=$((PASS + 1))
-        rm -f "$trace"
-    else
-        fail_with_link "[$label]: expected body '$expected_body', got '$body'" "$docs_url"
-        dump_debug "$trace" "$response"
-    fi
-}
-
-check_status() {
-    local label="$1"
-    local expected_status="$2"
-    local docs_url="$3"
-    shift 3
-    local http_code trace body_file
-    trace=$(mktemp)
-    body_file=$(mktemp)
-    http_code=$(curl -s --max-time 30 -o "$body_file" -D "$body_file.hdr" -w '%{http_code}' --trace-ascii "$trace" "$@" || true)
-
-    if [ "$http_code" = "$expected_status" ]; then
-        echo "  PASS [$label] (HTTP $http_code)"
-        PASS=$((PASS + 1))
-        rm -f "$trace" "$body_file" "$body_file.hdr"
-    else
-        fail_with_link "[$label]: expected HTTP $expected_status, got HTTP $http_code" "$docs_url"
-        local response=""
-        [ -s "$body_file.hdr" ] && response=$(cat "$body_file.hdr")
-        [ -s "$body_file" ] && response="${response}$(cat "$body_file")"
-        dump_debug "$trace" "$response"
-        rm -f "$body_file" "$body_file.hdr"
-    fi
-}
-
-check_fragmented() {
-    # Send an HTTP request in multiple TCP writes with small pauses between
-    # them so the server's read loop sees partial, incomplete buffers and
-    # must reassemble across recv() calls. Exercises HTTP parser correctness
-    # under realistic network fragmentation (slow clients, small MTU, etc.).
-    #
-    # Usage: check_fragmented <label> <expected_body> <docs_url> <frag1> <frag2> [frag3...]
-    # Use $'...' literal form in the caller to embed CR/LF inside fragments.
-    local label="$1"
-    local expected_body="$2"
-    local docs_url="$3"
-    shift 3
-    local body trace
-    trace=$(mktemp)
-    body=$(PORT="$PORT" TRACE="$trace" python3 -c '
-import os, socket, sys, time
-port = int(os.environ["PORT"])
-trace_path = os.environ.get("TRACE", "")
-frags = sys.argv[1:]
-sent = b""
-buf = b""
-wire_error = ""
-s = None
-try:
-    s = socket.create_connection(("localhost", port), timeout=5)
-    s.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)  # no Nagle coalescing
-    for i, f in enumerate(frags):
-        data = f.encode("latin-1")
-        s.sendall(data)
-        sent += data
-        if i < len(frags) - 1:
-            time.sleep(0.03)
-    while True:
-        chunk = s.recv(4096)
-        if not chunk: break
-        buf += chunk
-except socket.timeout:
-    wire_error = "socket.timeout (server never closed; client blocked in recv)"
-except Exception as e:
-    wire_error = type(e).__name__ + ": " + str(e)
-finally:
-    if s is not None:
-        try: s.close()
-        except Exception: pass
-    # Always write the trace — even (especially) on failure. Without this
-    # the wire dump is empty on the exact error paths where you need it.
-    if trace_path:
-        try:
-            with open(trace_path, "w") as tf:
-                tf.write("=> Send (" + str(len(sent)) + " bytes across " + str(len(frags)) + " fragment(s))\n")
-                tf.write(sent.decode("latin-1", errors="replace"))
-                tf.write("\n<= Recv (" + str(len(buf)) + " bytes)\n")
-                tf.write(buf.decode("latin-1", errors="replace"))
-                if wire_error:
-                    tf.write("\n<!> " + wire_error + "\n")
-                else:
-                    tf.write("\n")
-        except Exception:
-            pass
-resp = buf.decode("latin-1", errors="replace")
-try:
-    head, raw = resp.split("\r\n\r\n", 1)
-except ValueError:
-    sys.stdout.write("")
-    sys.exit(0)
-
-# Parse headers (case-insensitive)
-hdrs = {}
-for line in head.split("\r\n")[1:]:
-    if ":" in line:
-        k, v = line.split(":", 1)
-        hdrs[k.strip().lower()] = v.strip()
-
-# If the response is chunked, decode the frames; otherwise honor Content-Length
-# when present, else just return the raw remaining bytes.
-if hdrs.get("transfer-encoding", "").lower() == "chunked":
-    parts, rest = [], raw
-    while rest:
-        nl = rest.find("\r\n")
-        if nl < 0: break
-        try:
-            size = int(rest[:nl].split(";", 1)[0], 16)  # ignore chunk extensions
-        except ValueError:
-            break
-        rest = rest[nl+2:]
-        if size == 0: break
-        parts.append(rest[:size])
-        rest = rest[size+2:]  # skip trailing CRLF
-    body = "".join(parts)
-elif "content-length" in hdrs:
-    try:
-        body = raw[:int(hdrs["content-length"])]
-    except ValueError:
-        body = raw
-else:
-    body = raw
-
-sys.stdout.write(body.strip())
-' "$@" 2>/dev/null || echo "")
-
-    if [ "$body" = "$expected_body" ]; then
-        echo "  PASS [$label]"
-        PASS=$((PASS + 1))
-        rm -f "$trace"
-    else
-        fail_with_link "[$label]: expected body '$expected_body', got '$body'" "$docs_url"
-        dump_debug "$trace" ""
-    fi
-}
-
-check_header() {
-    local label="$1"
-    local header_name="$2"
-    local expected_value="$3"
-    local docs_url="$4"
-    shift 4
-    local headers trace
-    trace=$(mktemp)
-    headers=$(curl -s --max-time 30 -D- -o /dev/null --trace-ascii "$trace" "$@" || true)
-    local value
-    value=$(echo "$headers" | grep -i "^${header_name}:" | sed 's/^[^:]*: *//' | tr -d '\r' || true)
-
-    # Normalize: text/javascript and application/javascript are equivalent (RFC 9239)
-    local norm_value norm_expected
-    norm_value=$(echo "$value" | sed 's|text/javascript|application/javascript|')
-    norm_expected=$(echo "$expected_value" | sed 's|text/javascript|application/javascript|')
-    if [ "$value" = "$expected_value" ] || [[ "$value" == "$expected_value;"* ]] || [ "$norm_value" = "$norm_expected" ] || [[ "$norm_value" == "$norm_expected;"* ]]; then
-        echo "  PASS [$label] ($header_name: $value)"
-        PASS=$((PASS + 1))
-        rm -f "$trace"
-    else
-        fail_with_link "[$label]: expected $header_name '$expected_value', got '$value'" "$docs_url"
-        dump_debug "$trace" "$headers"
-    fi
-}
-
-wait_h2() {
-    echo "[wait] Waiting for HTTPS port..."
-    for i in $(seq 1 15); do
-        if curl -sk --max-time 30 --http2 -o /dev/null "https://localhost:$H2PORT/baseline2?a=1&b=1" 2>/dev/null; then
-            return 0
-        fi
-        if [ "$i" -eq 15 ]; then
-            echo "  FAIL: HTTPS port $H2PORT not responding"
-            FAIL=$((FAIL + 1))
-            return 1
-        fi
-        sleep 1
-    done
-}
-
-# ───── Baseline (GET/POST /baseline11) ─────
-
-if has_test "baseline" || has_test "limited-conn" || has_test "api-4" || has_test "api-16"; then
-    BASELINE_DOCS="$DOCS_BASE/h1/isolated/baseline/validation"
-    echo "[test] baseline endpoints"
-    check "GET /baseline11?a=13&b=42" "55" "$BASELINE_DOCS" \
-        "http://localhost:$PORT/baseline11?a=13&b=42"
-
-    check "POST /baseline11?a=13&b=42 body=20" "75" "$BASELINE_DOCS" \
-        -X POST -H "Content-Type: text/plain" -d "20" \
-        "http://localhost:$PORT/baseline11?a=13&b=42"
-
-    check "POST /baseline11?a=13&b=42 chunked body=20" "75" "$BASELINE_DOCS" \
-        -X POST -H "Content-Type: text/plain" -H "Transfer-Encoding: chunked" -d "20" \
-        "http://localhost:$PORT/baseline11?a=13&b=42"
-
-    # Response Content-Type must be text/plain (bare or with ;charset=…). A
-    # missing header or application/json is a spec violation. Issue #526.
-    check_header "GET /baseline11 Content-Type" "Content-Type" "text/plain" "$BASELINE_DOCS" \
-        "http://localhost:$PORT/baseline11?a=13&b=42"
-    check_header "POST /baseline11 Content-Type" "Content-Type" "text/plain" "$BASELINE_DOCS" \
-        -X POST -H "Content-Type: text/plain" -d "20" \
-        "http://localhost:$PORT/baseline11?a=13&b=42"
-
-    # Anti-cheat: randomized inputs to detect hardcoded responses
-    echo "[test] baseline anti-cheat (randomized inputs)"
-    A1=$((RANDOM % 900 + 100))
-    B1=$((RANDOM % 900 + 100))
-    check "GET /baseline11?a=$A1&b=$B1 (random)" "$((A1 + B1))" "$BASELINE_DOCS" \
-        "http://localhost:$PORT/baseline11?a=$A1&b=$B1"
-
-    BODY1=$((RANDOM % 900 + 100))
-    BODY2=$((RANDOM % 900 + 100))
-    while [ "$BODY1" -eq "$BODY2" ]; do BODY2=$((RANDOM % 900 + 100)); done
-    check "POST body=$BODY1 (cache check 1)" "$((13 + 42 + BODY1))" "$BASELINE_DOCS" \
-        -X POST -H "Content-Type: text/plain" -d "$BODY1" \
-        "http://localhost:$PORT/baseline11?a=13&b=42"
-    check "POST body=$BODY2 (cache check 2)" "$((13 + 42 + BODY2))" "$BASELINE_DOCS" \
-        -X POST -H "Content-Type: text/plain" -d "$BODY2" \
-        "http://localhost:$PORT/baseline11?a=13&b=42"
-
-    # TCP fragmentation: send each request in multiple small writes with a
-    # short pause between, so the server's HTTP parser sees partial buffers
-    # and must reassemble across recv() calls. Exercises parser correctness
-    # under realistic network conditions (slow clients, small MTU).
-    echo "[test] baseline TCP fragmentation"
-    # Split 1: break the request line mid-path
-    check_fragmented "GET /baseline11 — split request line" "55" "$BASELINE_DOCS" \
-        "GET /baseli" \
-        $'ne11?a=13&b=42 HTTP/1.1\r\n' \
-        $'Host: localhost\r\nConnection: close\r\n\r\n'
-
-    # Split 2: break between request line and headers
-    check_fragmented "GET /baseline11 — split before headers" "55" "$BASELINE_DOCS" \
-        $'GET /baseline11?a=13&b=42 HTTP/1.1\r\n' \
-        $'Host: localhost\r\n' \
-        $'User-Agent: arena-frag/1.0\r\n' \
-        $'Connection: close\r\n\r\n'
-
-    # Split 3: POST with headers and body in separate writes
-    check_fragmented "POST /baseline11 — split headers/body" "75" "$BASELINE_DOCS" \
-        $'POST /baseline11?a=13&b=42 HTTP/1.1\r\nHost: localhost\r\nContent-Type: text/plain\r\nContent-Length: 2\r\nConnection: close\r\n\r\n' \
-        "20"
-
-    # Split 4: POST with body split across two writes (body = "20", split to "2" + "0")
-    check_fragmented "POST /baseline11 — split body bytes" "75" "$BASELINE_DOCS" \
-        $'POST /baseline11?a=13&b=42 HTTP/1.1\r\nHost: localhost\r\nContent-Type: text/plain\r\nContent-Length: 2\r\nConnection: close\r\n\r\n' \
-        "2" \
-        "0"
-fi
-
-# ───── Pipelined (GET /pipeline) ─────
-
-if has_test "pipelined"; then
-    PIPELINED_DOCS="$DOCS_BASE/h1/isolated/pipelined/validation"
-    echo "[test] pipelined endpoint"
-    check "GET /pipeline" "ok" "$PIPELINED_DOCS" \
-        "http://localhost:$PORT/pipeline"
-    check_header "GET /pipeline Content-Type" "Content-Type" "text/plain" "$PIPELINED_DOCS" \
-        "http://localhost:$PORT/pipeline"
-fi
-
-# ───── JSON Processing (GET /json) ─────
-
-if has_test "json" || has_test "api-4" || has_test "api-16"; then
-    JSON_DOCS="$DOCS_BASE/h1/isolated/json-processing/validation"
-    echo "[test] json endpoint"
-    json_fail=false
-    json_params=("12:3" "22:7" "31:2" "50:5")
-    for jp in "${json_params[@]}"; do
-        jcount="${jp%%:*}"
-        jm="${jp##*:}"
-        response=$(curl -s --max-time 30 "http://localhost:$PORT/json/$jcount?m=$jm" || true)
-        json_result=$(echo "$response" | python3 -c "
-import sys, json
-m = $jm
-d = json.load(sys.stdin)
-count = d.get('count', 0)
-items = d.get('items', [])
-def valid_item(it):
-    r = it.get('rating')
-    return ('id' in it and 'name' in it and 'category' in it and 'price' in it
-            and 'quantity' in it and 'total' in it
-            and isinstance(it.get('tags'), list) and isinstance(it.get('active'), bool)
-            and isinstance(r, dict) and 'score' in r and 'count' in r)
-valid = all(valid_item(it) for it in items) if items else False
-correct_totals = True
-for item in items:
-    expected = item.get('price', 0) * item.get('quantity', 0) * m
-    if item.get('total', 0) != expected:
-        correct_totals = False
-        break
-print(f'{count} {valid} {correct_totals}')
-" 2>/dev/null || echo "0 False False")
-        json_count=$(echo "$json_result" | cut -d' ' -f1)
-        json_valid=$(echo "$json_result" | cut -d' ' -f2)
-        json_correct=$(echo "$json_result" | cut -d' ' -f3)
-
-        if [ "$json_count" = "$jcount" ] && [ "$json_valid" = "True" ] && [ "$json_correct" = "True" ]; then
-            :
-        else
-            fail_with_link "[GET /json/$jcount?m=$jm]: count=$json_count, schema=$json_valid, correct_totals=$json_correct" "$JSON_DOCS"
-            json_fail=true
-        fi
-    done
-    if [ "$json_fail" = "false" ]; then
-        echo "  PASS [GET /json/{count}?m=X] (4 counts × multipliers + full item schema verified)"
-        PASS=$((PASS + 1))
-    fi
-
-    # Check Content-Type header
-    check_header "GET /json Content-Type" "Content-Type" "application/json" "$JSON_DOCS" \
-        "http://localhost:$PORT/json/50?m=1"
-fi
-
-# ───── JSON Compressed (GET /json/{count}?m=X with Accept-Encoding) ─────
-
-if has_test "json-comp"; then
-    JSONCOMP_DOCS="$DOCS_BASE/h1/isolated/json-processing/validation"
-    echo "[test] json-comp endpoint"
-
-    # Must return Content-Encoding: gzip or br when Accept-Encoding is sent
-    jc_headers=$(curl -s --max-time 30 -D- -o /dev/null -H "Accept-Encoding: gzip, br" "http://localhost:$PORT/json/50?m=1" || true)
-    jc_encoding=$(echo "$jc_headers" | grep -i "^content-encoding:" | sed 's/^[^:]*: *//' | tr -d '\r' | awk '{print tolower($1)}' || true)
-    if [ "$jc_encoding" = "gzip" ] || [ "$jc_encoding" = "br" ]; then
-        echo "  PASS [json-comp Content-Encoding: $jc_encoding]"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[json-comp]: expected Content-Encoding gzip or br, got '$jc_encoding'" "$JSONCOMP_DOCS"
-    fi
-
-    # Verify compressed response with varying counts and multipliers
-    jc_fail=false
-    jc_params=("25:3" "40:7" "50:2")
-    for jcp in "${jc_params[@]}"; do
-        jccount="${jcp%%:*}"
-        jcm="${jcp##*:}"
-        jc_response=$(curl -s --max-time 30 --compressed -H "Accept-Encoding: gzip, br" "http://localhost:$PORT/json/$jccount?m=$jcm" || true)
-        jc_result=$(echo "$jc_response" | python3 -c "
-import sys, json
-m = $jcm
-d = json.load(sys.stdin)
-count = d.get('count', 0)
-items = d.get('items', [])
-def valid_item(it):
-    r = it.get('rating')
-    return ('id' in it and 'name' in it and 'category' in it and 'price' in it
-            and 'quantity' in it and 'total' in it
-            and isinstance(it.get('tags'), list) and isinstance(it.get('active'), bool)
-            and isinstance(r, dict) and 'score' in r and 'count' in r)
-valid = all(valid_item(it) for it in items) if items else False
-correct_totals = True
-for item in items:
-    expected = item.get('price', 0) * item.get('quantity', 0) * m
-    if item.get('total', 0) != expected:
-        correct_totals = False
-        break
-print(f'{count} {valid} {correct_totals}')
-" 2>/dev/null || echo "0 False False")
-        jc_count=$(echo "$jc_result" | cut -d' ' -f1)
-        jc_valid=$(echo "$jc_result" | cut -d' ' -f2)
-        jc_correct=$(echo "$jc_result" | cut -d' ' -f3)
-
-        if [ "$jc_count" = "$jccount" ] && [ "$jc_valid" = "True" ] && [ "$jc_correct" = "True" ]; then
-            :
-        else
-            fail_with_link "[json-comp /json/$jccount?m=$jcm]: count=$jc_count, schema=$jc_valid, correct=$jc_correct" "$JSONCOMP_DOCS"
-            jc_fail=true
-        fi
-    done
-    if [ "$jc_fail" = "false" ]; then
-        echo "  PASS [json-comp response] (3 counts × multipliers, compressed, full item schema)"
-        PASS=$((PASS + 1))
-    fi
-
-    # Without Accept-Encoding must NOT return Content-Encoding
-    jc_no_enc=$(curl -s --max-time 30 -D- -o /dev/null "http://localhost:$PORT/json/50?m=1" | grep -i "^content-encoding:" | tr -d '\r' || true)
-    if [ -z "$jc_no_enc" ]; then
-        echo "  PASS [json-comp per-request] (no Content-Encoding without Accept-Encoding)"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[json-comp per-request]: got $jc_no_enc without Accept-Encoding" "$JSONCOMP_DOCS"
-    fi
-fi
-
-# ───── JSON TLS (GET /json/{count}?m=X over HTTP/1.1 + TLS on :8081) ─────
-
-if has_test "json-tls"; then
-    JSONTLS_DOCS="$DOCS_BASE/h1/isolated/json-tls/validation"
-    echo "[test] json-tls endpoint"
-
-    # Must negotiate HTTP/1.1 (not h2) via ALPN on :8081
-    jt_proto=$(curl -sk --max-time 30 --http1.1 -o /dev/null -w '%{http_version}' "https://localhost:$H1TLS_PORT/json/1?m=1" 2>/dev/null || echo "0")
-    if [ "$jt_proto" = "1.1" ]; then
-        echo "  PASS [json-tls protocol negotiation] (HTTP/$jt_proto over TLS)"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[json-tls protocol negotiation]: expected 1.1, got HTTP/$jt_proto" "$JSONTLS_DOCS"
-    fi
-
-    # Response body correctness across 3 (count, m) pairs (different from json-comp so a caller can't share state)
-    jt_fail=false
-    jt_params=("7:2" "23:11" "50:1")
-    for jtp in "${jt_params[@]}"; do
-        jtcount="${jtp%%:*}"
-        jtm="${jtp##*:}"
-        jt_response=$(curl -sk --max-time 30 "https://localhost:$H1TLS_PORT/json/$jtcount?m=$jtm" || true)
-        jt_result=$(echo "$jt_response" | python3 -c "
-import sys, json
-m = $jtm
-d = json.load(sys.stdin)
-count = d.get('count', 0)
-items = d.get('items', [])
-def valid_item(it):
-    r = it.get('rating')
-    return ('id' in it and 'name' in it and 'category' in it and 'price' in it
-            and 'quantity' in it and 'total' in it
-            and isinstance(it.get('tags'), list) and isinstance(it.get('active'), bool)
-            and isinstance(r, dict) and 'score' in r and 'count' in r)
-valid = all(valid_item(it) for it in items) if items else False
-correct_totals = True
-for item in items:
-    expected = item.get('price', 0) * item.get('quantity', 0) * m
-    if item.get('total', 0) != expected:
-        correct_totals = False
-        break
-print(f'{count} {valid} {correct_totals}')
-" 2>/dev/null || echo "0 False False")
-        jt_count=$(echo "$jt_result" | cut -d' ' -f1)
-        jt_valid=$(echo "$jt_result" | cut -d' ' -f2)
-        jt_correct=$(echo "$jt_result" | cut -d' ' -f3)
-
-        if [ "$jt_count" = "$jtcount" ] && [ "$jt_valid" = "True" ] && [ "$jt_correct" = "True" ]; then
-            :
-        else
-            fail_with_link "[json-tls /json/$jtcount?m=$jtm]: count=$jt_count, schema=$jt_valid, correct=$jt_correct" "$JSONTLS_DOCS"
-            jt_fail=true
-        fi
-    done
-    if [ "$jt_fail" = "false" ]; then
-        echo "  PASS [json-tls response] (3 (count, m) pairs over TLS, full item schema)"
-        PASS=$((PASS + 1))
-    fi
-
-    # Content-Type must be application/json
-    jt_ct=$(curl -sk --max-time 30 -D- -o /dev/null "https://localhost:$H1TLS_PORT/json/1?m=1" | grep -i "^content-type:" | tr -d '\r' || true)
-    if echo "$jt_ct" | grep -qi 'application/json'; then
-        echo "  PASS [json-tls Content-Type: application/json]"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[json-tls Content-Type]: expected application/json, got '$jt_ct'" "$JSONTLS_DOCS"
-    fi
-fi
-
-# ───── Upload (POST /upload) ─────
-
-if has_test "upload"; then
-    UPLOAD_DOCS="$DOCS_BASE/h1/isolated/upload/validation"
-    echo "[test] upload endpoint"
-    # Small upload: returns byte count
-    UPLOAD_BODY="Hello, HttpArena!"
-    EXPECTED_LEN=${#UPLOAD_BODY}
-    check "POST /upload small body" "$EXPECTED_LEN" "$UPLOAD_DOCS" \
-        -X POST -H "Content-Type: application/octet-stream" --data-binary "$UPLOAD_BODY" \
-        "http://localhost:$PORT/upload"
-
-    # Anti-cheat: random body to detect hardcoded responses
-    RANDOM_BODY=$(head -c 64 /dev/urandom | base64 | head -c 48)
-    EXPECTED_RANDOM_LEN=${#RANDOM_BODY}
-    ACTUAL_LEN=$(curl -s --max-time 30 -X POST -H "Content-Type: application/octet-stream" --data-binary "$RANDOM_BODY" "http://localhost:$PORT/upload" || true)
-    if [ "$ACTUAL_LEN" = "$EXPECTED_RANDOM_LEN" ]; then
-        echo "  PASS [POST /upload random body] (bytes: $ACTUAL_LEN)"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[POST /upload random body]: expected '$EXPECTED_RANDOM_LEN', got '$ACTUAL_LEN'" "$UPLOAD_DOCS"
-    fi
-
-    # Varying upload sizes
-    upload_fail=false
-    for upload_spec in "500K:512000" "2M:2097152" "10M:10485760" "20M:20971520"; do
-        upload_label="${upload_spec%%:*}"
-        upload_size="${upload_spec##*:}"
-        upload_bs=$((upload_size / 1024))
-        ACTUAL_LARGE=$( { dd if=/dev/urandom bs=1024 count=$upload_bs 2>/dev/null | curl -s --max-time 60 -X POST -H "Content-Type: application/octet-stream" --data-binary @- "http://localhost:$PORT/upload"; } || true )
-        if [ "$ACTUAL_LARGE" = "$upload_size" ]; then
-            :
-        else
-            fail_with_link "[POST /upload $upload_label]: expected '$upload_size', got '$ACTUAL_LARGE'" "$UPLOAD_DOCS"
-            upload_fail=true
-        fi
-    done
-    if [ "$upload_fail" = "false" ]; then
-        echo "  PASS [POST /upload] (4 sizes verified: 500K, 2M, 10M, 20M)"
-        PASS=$((PASS + 1))
-    fi
-fi
-
-# ───── Baseline H2 (GET /baseline2 over HTTP/2 + TLS) ─────
-
-if has_test "baseline-h2"; then
-    H2_DOCS="$DOCS_BASE/h2/baseline-h2/validation"
-    echo "[test] baseline-h2 endpoint"
-    if wait_h2; then
-        # Verify server actually speaks HTTP/2
-        h2_proto=$(curl -sk --max-time 30 --http2 -o /dev/null -w '%{http_version}' "https://localhost:$H2PORT/baseline2?a=1&b=1" || echo "0")
-        if [ "$h2_proto" = "2" ]; then
-            echo "  PASS [HTTP/2 protocol negotiation] (HTTP/$h2_proto)"
-            PASS=$((PASS + 1))
-        else
-            fail_with_link "[HTTP/2 protocol negotiation]: server responded with HTTP/$h2_proto" "$H2_DOCS"
-        fi
-
-        check "GET /baseline2?a=13&b=42 over HTTP/2" "55" "$H2_DOCS" \
-            -sk --http2 "https://localhost:$H2PORT/baseline2?a=13&b=42"
-
-        # Anti-cheat: randomized query params
-        A3=$((RANDOM % 900 + 100))
-        B3=$((RANDOM % 900 + 100))
-        check "GET /baseline2?a=$A3&b=$B3 over HTTP/2 (random)" "$((A3 + B3))" "$H2_DOCS" \
-            -sk --http2 "https://localhost:$H2PORT/baseline2?a=$A3&b=$B3"
-
-        check_header "GET /baseline2 Content-Type" "Content-Type" "text/plain" "$H2_DOCS" \
-            -sk --http2 "https://localhost:$H2PORT/baseline2?a=1&b=1"
-    fi
-fi
-
-# ───── Baseline H2c (GET /baseline2 over HTTP/2 cleartext, prior-knowledge) ─────
-
-if has_test "baseline-h2c"; then
-    H2C_DOCS="$DOCS_BASE/h2/baseline-h2c/validation"
-    echo "[test] baseline-h2c endpoint"
-
-    # Wait briefly for the h2c listener to be up — the main probe waited on
-    # :8080 or :8443, not :8082. One shot with a short timeout is enough
-    # because the container has already been up for the earlier tests.
-    for i in $(seq 1 10); do
-        if curl -s --http2-prior-knowledge --max-time 2 -o /dev/null \
-             "http://localhost:$H2C_PORT/baseline2?a=1&b=1" 2>/dev/null; then
-            break
-        fi
-        sleep 1
-    done
-
-    # Anti-cheat #1: require HTTP/2 on the wire. Forces prior-knowledge so
-    # a server that naively accepts an HTTP/1.1 request on the same port
-    # can't pass by answering plain h1 — %{http_version} reports the actual
-    # negotiated protocol.
-    h2c_proto=$(curl -s --max-time 30 --http2-prior-knowledge \
-        -o /dev/null -w '%{http_version}' \
-        "http://localhost:$H2C_PORT/baseline2?a=1&b=1" 2>/dev/null || echo "0")
-    if [ "$h2c_proto" = "2" ]; then
-        echo "  PASS [HTTP/2 cleartext (prior-knowledge)] (HTTP/$h2c_proto)"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[HTTP/2 cleartext (prior-knowledge)]: server responded with HTTP/$h2c_proto, expected HTTP/2" "$H2C_DOCS"
-    fi
-
-    # Anti-cheat #2: the same port MUST NOT also serve HTTP/1.1. If it did,
-    # the benchmark could be measuring h1 throughput (much higher on some
-    # stacks) while labeled as h2c. --http1.1 forces curl to refuse the
-    # h2 preface; we check that the server didn't happily answer.
-    h1_code=$(curl -s --max-time 5 --http1.1 \
-        -o /dev/null -w '%{http_code}' \
-        "http://localhost:$H2C_PORT/baseline2?a=1&b=1" 2>/dev/null || echo "000")
-    if [ "$h1_code" != "200" ]; then
-        echo "  PASS [h2c-only: port $H2C_PORT rejects plain HTTP/1.1] (got $h1_code)"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[h2c-only]: port $H2C_PORT also answered HTTP/1.1 with 200 — dual-serving lets the benchmark measure h1 throughput instead of h2c. The h2c listener must refuse HTTP/1.1 requests." "$H2C_DOCS"
-    fi
-
-    check "GET /baseline2?a=13&b=42 over h2c" "55" "$H2C_DOCS" \
-        -s --http2-prior-knowledge "http://localhost:$H2C_PORT/baseline2?a=13&b=42"
-
-    # Anti-cheat #3: randomized sum
-    A4=$((RANDOM % 900 + 100))
-    B4=$((RANDOM % 900 + 100))
-    check "GET /baseline2?a=$A4&b=$B4 over h2c (random)" "$((A4 + B4))" "$H2C_DOCS" \
-        -s --http2-prior-knowledge "http://localhost:$H2C_PORT/baseline2?a=$A4&b=$B4"
-
-    check_header "GET /baseline2 Content-Type (h2c)" "Content-Type" "text/plain" "$H2C_DOCS" \
-        -s --http2-prior-knowledge "http://localhost:$H2C_PORT/baseline2?a=1&b=1"
-fi
-
-# ───── JSON H2c (GET /json/{count}?m=M over HTTP/2 cleartext) ─────
-
-if has_test "json-h2c"; then
-    JSON_H2C_DOCS="$DOCS_BASE/h2/json-h2c/validation"
-    echo "[test] json-h2c endpoint"
-
-    # Still re-assert HTTP/2 on the wire for the /json path specifically —
-    # a server could in theory route /baseline2 through h2c and /json
-    # through an h1 fallback handler.
-    h2c_json_proto=$(curl -s --max-time 30 --http2-prior-knowledge \
-        -o /dev/null -w '%{http_version}' \
-        "http://localhost:$H2C_PORT/json/1?m=1" 2>/dev/null || echo "0")
-    if [ "$h2c_json_proto" = "2" ]; then
-        echo "  PASS [/json HTTP/2 cleartext] (HTTP/$h2c_json_proto)"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[/json HTTP/2 cleartext]: server responded with HTTP/$h2c_json_proto on /json" "$JSON_H2C_DOCS"
-    fi
-
-    check_header "GET /json Content-Type (h2c)" "Content-Type" "application/json" "$JSON_H2C_DOCS" \
-        -s --http2-prior-knowledge "http://localhost:$H2C_PORT/json/1?m=1"
-
-    # Same (count, m) validator as the h1 json profile — count field must
-    # match and items.length equals count. Uses 4 distinct pairs that
-    # differ from the benchmark rotation so caching-by-key gets punished.
-    json_h2c_fail=false
-    for jp in "12:3" "22:7" "31:2" "50:5"; do
-        jcount="${jp%%:*}"
-        jm="${jp##*:}"
-        resp=$(curl -s --max-time 30 --http2-prior-knowledge \
-            "http://localhost:$H2C_PORT/json/$jcount?m=$jm" 2>/dev/null || true)
-        parsed=$(echo "$resp" | python3 -c "
-import sys, json
-m = $jm
-d = json.load(sys.stdin)
-count = d.get('count', -1)
-items = d.get('items', [])
-items_n = len(items)
-def valid_item(it):
-    r = it.get('rating')
-    return ('id' in it and 'name' in it and 'category' in it and 'price' in it
-            and 'quantity' in it and 'total' in it
-            and isinstance(it.get('tags'), list) and isinstance(it.get('active'), bool)
-            and isinstance(r, dict) and 'score' in r and 'count' in r)
-valid = all(valid_item(it) for it in items) if items else False
-correct_totals = True
-for item in items:
-    expected = item.get('price', 0) * item.get('quantity', 0) * m
-    if item.get('total', 0) != expected:
-        correct_totals = False
-        break
-print(f'{count} {items_n} {valid} {correct_totals}')
-" 2>/dev/null || echo "-1 -1 False False")
-        pc=$(echo "$parsed" | cut -d' ' -f1)
-        pn=$(echo "$parsed" | cut -d' ' -f2)
-        pv=$(echo "$parsed" | cut -d' ' -f3)
-        ptot=$(echo "$parsed" | cut -d' ' -f4)
-        if [ "$pc" = "$jcount" ] && [ "$pn" = "$jcount" ] && [ "$pv" = "True" ] && [ "$ptot" = "True" ]; then
-            :
-        else
-            fail_with_link "[GET /json/$jcount?m=$jm (h2c)]: count=$pc, items=$pn, schema=$pv, correct_totals=$ptot, expected $jcount" "$JSON_H2C_DOCS"
-            json_h2c_fail=true
-        fi
-    done
-    if [ "$json_h2c_fail" = "false" ]; then
-        echo "  PASS [GET /json/{count}?m=X over h2c] (4 counts × multipliers, full item schema + totals)"
-        PASS=$((PASS + 1))
-    fi
-fi
-
-# ───── Static Files H1 (GET /static/* over HTTP/1.1) ─────
-
-if has_test "static"; then
-    STATIC_DOCS="$DOCS_BASE/h1/isolated/static/validation"
-    echo "[test] static endpoint"
-    check_header "GET /static/reset.css Content-Type" "Content-Type" "text/css" "$STATIC_DOCS" \
-        -s "http://localhost:$PORT/static/reset.css"
-
-    check_header "GET /static/app.js Content-Type" "Content-Type" "application/javascript" "$STATIC_DOCS" \
-        -s "http://localhost:$PORT/static/app.js"
-
-    check_header "GET /static/manifest.json Content-Type" "Content-Type" "application/json" "$STATIC_DOCS" \
-        -s "http://localhost:$PORT/static/manifest.json"
-
-    # Verify file sizes match actual files on disk
-    static_fail=false
-    for sf in reset.css layout.css theme.css components.css utilities.css analytics.js helpers.js app.js vendor.js router.js header.html footer.html regular.woff2 bold.woff2 logo.svg icon-sprite.svg hero.webp thumb1.webp thumb2.webp manifest.json; do
-        expected_size=$(wc -c < "$DATA_DIR/static/$sf" 2>/dev/null || echo "0")
-        actual_size=$(curl -s --max-time 30 -o /dev/null -w '%{size_download}' "http://localhost:$PORT/static/$sf" || echo "0")
-        if [ "$actual_size" -eq "$expected_size" ] 2>/dev/null; then
-            true
-        else
-            fail_with_link "[static/$sf size]: expected $expected_size bytes, got $actual_size" "$STATIC_DOCS"
-            static_fail=true
-        fi
-    done
-    if [ "$static_fail" = "false" ]; then
-        echo "  PASS [static file sizes] (20 files verified)"
-        PASS=$((PASS + 1))
-    fi
-
-    # Verify compression works when Accept-Encoding is sent — for each file, if server compresses, decompressed size must match original
-    static_comp_fail=false
-    static_comp_count=0
-    static_comp_skip=0
-    for sf in reset.css layout.css theme.css components.css utilities.css analytics.js helpers.js app.js vendor.js router.js header.html footer.html regular.woff2 bold.woff2 logo.svg icon-sprite.svg hero.webp thumb1.webp thumb2.webp manifest.json; do
-        expected_size=$(wc -c < "$DATA_DIR/static/$sf" 2>/dev/null || echo "0")
-        _hdr_tmp=$(mktemp)
-        _body_tmp=$(mktemp)
-        curl -s --max-time 30 --compressed -D "$_hdr_tmp" -o "$_body_tmp" "http://localhost:$PORT/static/$sf" || true
-        comp_enc=$(grep -i "^content-encoding:" "$_hdr_tmp" | sed 's/^[^:]*: *//' | tr -d '\r' | awk '{print tolower($1)}' || true)
-        decompressed=$(wc -c < "$_body_tmp")
-        rm -f "$_hdr_tmp" "$_body_tmp"
-        if [ -n "$comp_enc" ]; then
-            if [ "$decompressed" -eq "$expected_size" ] 2>/dev/null; then
-                static_comp_count=$((static_comp_count + 1))
-            else
-                fail_with_link "[static/$sf compression]: Content-Encoding: $comp_enc but decompressed size $decompressed != expected $expected_size" "$STATIC_DOCS"
-                static_comp_fail=true
-            fi
-        else
-            static_comp_skip=$((static_comp_skip + 1))
-        fi
-    done
-    if [ "$static_comp_fail" = "false" ]; then
-        if [ "$static_comp_count" -gt 0 ]; then
-            echo "  PASS [static compression] ($static_comp_count files compressed, $static_comp_skip skipped)"
-            PASS=$((PASS + 1))
-        else
-            echo "  SKIP [static compression] (server does not compress static files)"
-        fi
-    fi
-
-    check_status "GET /static/nonexistent.txt" "404" "$STATIC_DOCS" \
-        -s "http://localhost:$PORT/static/nonexistent.txt"
-fi
-
-
-# ───── Static Files H2 (GET /static/* over HTTP/2 + TLS) ─────
-
-if has_test "static-h2"; then
-    STATIC_H2_DOCS="$DOCS_BASE/h2/static-h2/validation"
-    echo "[test] static-h2 endpoint"
-    if wait_h2; then
-        # Check a few static files exist and return correct Content-Type
-        check_header "GET /static/reset.css Content-Type" "Content-Type" "text/css" "$STATIC_H2_DOCS" \
-            -sk --http2 "https://localhost:$H2PORT/static/reset.css"
-
-        check_header "GET /static/app.js Content-Type" "Content-Type" "application/javascript" "$STATIC_H2_DOCS" \
-            -sk --http2 "https://localhost:$H2PORT/static/app.js"
-
-        check_header "GET /static/manifest.json Content-Type" "Content-Type" "application/json" "$STATIC_H2_DOCS" \
-            -sk --http2 "https://localhost:$H2PORT/static/manifest.json"
-
-        # Check response size is non-zero
-        static_size=$(curl -sk --max-time 30 --http2 -o /dev/null -w '%{size_download}' "https://localhost:$H2PORT/static/reset.css" || echo "0")
-        if [ "$static_size" -gt 0 ]; then
-            echo "  PASS [static-h2 response size] ($static_size bytes)"
-            PASS=$((PASS + 1))
-        else
-            fail_with_link "[static-h2 response size]: empty response" "$STATIC_H2_DOCS"
-        fi
-
-        # 404 for missing files
-        check_status "GET /static/nonexistent.txt" "404" "$STATIC_H2_DOCS" \
-            -sk --http2 "https://localhost:$H2PORT/static/nonexistent.txt"
-    fi
-fi
-
-# ───── Async Database (GET /async-db) ─────
-
-if has_test "async-db" || has_test "crud" || has_test "api-4" || has_test "api-16"; then
-    ASYNCDB_DOCS="$DOCS_BASE/h1/isolated/async-database/validation"
-    echo "[test] async-db endpoint"
-    asyncdb_fail=false
-    db_params=("min=5&max=80&limit=7" "min=20&max=150&limit=18" "min=100&max=400&limit=33" "min=10&max=50&limit=50")
-    for dbp in "${db_params[@]}"; do
-        dblimit=$(echo "$dbp" | grep -oP 'limit=\K[0-9]+')
-        response=$(curl -s --max-time 30 "http://localhost:$PORT/async-db?$dbp" || true)
-        pgdb_result=$(echo "$response" | python3 -c "
-import sys, json
-d = json.load(sys.stdin)
-count = d.get('count', 0)
-items = d.get('items', [])
-has_rating = all('rating' in item and 'score' in item['rating'] for item in items) if items else False
-has_tags = all(isinstance(item.get('tags'), list) for item in items) if items else False
-has_active_bool = all(isinstance(item.get('active'), bool) for item in items) if items else False
-print(f'{count} {has_rating} {has_tags} {has_active_bool}')
-" 2>/dev/null || echo "0 False False False")
-        pgdb_count=$(echo "$pgdb_result" | cut -d' ' -f1)
-        pgdb_rating=$(echo "$pgdb_result" | cut -d' ' -f2)
-        pgdb_tags=$(echo "$pgdb_result" | cut -d' ' -f3)
-        pgdb_active=$(echo "$pgdb_result" | cut -d' ' -f4)
-
-        if [ "$pgdb_count" = "$dblimit" ] && [ "$pgdb_rating" = "True" ] && [ "$pgdb_tags" = "True" ] && [ "$pgdb_active" = "True" ]; then
-            :
-        else
-            fail_with_link "[GET /async-db?limit=$dblimit]: count=$pgdb_count, rating=$pgdb_rating, tags=$pgdb_tags, active=$pgdb_active" "$ASYNCDB_DOCS"
-            asyncdb_fail=true
-        fi
-    done
-    if [ "$asyncdb_fail" = "false" ]; then
-        echo "  PASS [GET /async-db?limit=N] (4 limits verified, correct structure)"
-        PASS=$((PASS + 1))
-    fi
-
-    check_header "GET /async-db Content-Type" "Content-Type" "application/json" "$ASYNCDB_DOCS" \
-        "http://localhost:$PORT/async-db?min=10&max=50&limit=50"
-
-    # Anti-cheat: empty range should return 0 items
-    response_empty=$(curl -s --max-time 30 "http://localhost:$PORT/async-db?min=9999&max=9999&limit=50" || true)
-    pgdb_empty=$(echo "$response_empty" | python3 -c "import sys,json; print(json.load(sys.stdin).get('count','-1'))" 2>/dev/null || echo "-1")
-    if [ "$pgdb_empty" = "0" ]; then
-        echo "  PASS [GET /async-db empty range] (count=0)"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[GET /async-db empty range]: expected count=0, got $pgdb_empty" "$ASYNCDB_DOCS"
-    fi
-fi
-
-# ───── Fortunes (GET /fortunes) — template-engine benchmark ─────
+# HttpArena framework validation — orchestrator.
 #
-# Feature-based validation, not byte-exact. Engines disagree on whitespace
-# and attribute formatting; what matters is that the rendered HTML actually
-# loops the DB rows, includes the runtime-injected row, escapes user
-# content, and is sized like a real page (not stripped to win the bench).
-
-if has_test "fortunes"; then
-    FORTUNES_DOCS="$DOCS_BASE/h1/isolated/fortunes/validation"
-    echo "[test] fortunes endpoint"
-
-    body=$(curl -s --max-time 30 "http://localhost:$PORT/fortunes" || true)
-
-    check_header "GET /fortunes Content-Type" "Content-Type" "text/html" "$FORTUNES_DOCS" \
-        "http://localhost:$PORT/fortunes"
-
-    if echo "$body" | grep -qi '<!doctype html>'; then
-        echo "  PASS [GET /fortunes <!DOCTYPE html>]"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[GET /fortunes <!DOCTYPE html>]: missing — layout/partial likely not rendered" "$FORTUNES_DOCS"
-    fi
-
-    # Each row in the rendered table must produce a <tr>. 201 data rows are
-    # required (200 seeded + 1 runtime-injected); a header row is allowed
-    # but not required, so the band is 201–210 to absorb implementation-
-    # specific extras (footer rows, etc.).
-    tr_count=$(echo "$body" | grep -oi '<tr' | wc -l)
-    if [ "$tr_count" -ge 201 ] && [ "$tr_count" -le 210 ]; then
-        echo "  PASS [GET /fortunes <tr> count=$tr_count]"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[GET /fortunes <tr> count]: expected 201–210, got $tr_count" "$FORTUNES_DOCS"
-    fi
-
-    # Runtime-injected row text — proves the handler appended id=0 in memory
-    # rather than caching a pre-rendered page from the DB rows alone.
-    if echo "$body" | grep -qF 'Additional fortune added at request time.'; then
-        echo "  PASS [GET /fortunes runtime-injected row]"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[GET /fortunes runtime-injected row]: missing 'Additional fortune added at request time.'" "$FORTUNES_DOCS"
-    fi
-
-    # XSS escape — load-bearing check. Row 11 contains a raw <script> tag
-    # in the DB; the rendered output must encode it as &lt;script&gt; and
-    # must NOT contain the raw <script>alert sequence anywhere.
-    if echo "$body" | grep -qF '&lt;script&gt;' && ! echo "$body" | grep -qF '<script>alert'; then
-        echo "  PASS [GET /fortunes XSS escape]"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[GET /fortunes XSS escape]: <script> in row 11 not properly HTML-escaped" "$FORTUNES_DOCS"
-    fi
-
-    # Size sanity — catches stripped pages and empty bodies. A 201-row
-    # table plus a layout typically lands between 18 KB and 40 KB; the band
-    # is generous to absorb whitespace and per-engine formatting, but
-    # rejects empty / fragment / pathologically-large outputs.
-    size=${#body}
-    if [ "$size" -ge 18432 ] && [ "$size" -le 65536 ]; then
-        echo "  PASS [GET /fortunes body size=${size}B]"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[GET /fortunes body size]: expected 18432–65536 bytes, got $size" "$FORTUNES_DOCS"
-    fi
-fi
-
-# ───── CRUD (list + read + create + update /crud/items) ─────
-
-if has_test "crud"; then
-    CRUD_DOCS="$DOCS_BASE/h1/isolated/crud/validation"
-    echo "[test] crud endpoints"
-
-    # 1. GET list — paginated with category filter
-    crud_list=$(curl -s --max-time 30 "http://localhost:$PORT/crud/items?category=electronics&page=1&limit=5" || true)
-    crud_list_result=$(echo "$crud_list" | python3 -c "
-import sys, json
-d = json.load(sys.stdin)
-items = d.get('items', [])
-total = d.get('total', 0)
-page = d.get('page', 0)
-has_rating = all('rating' in i for i in items) if items else False
-print(f'{len(items)} {total} {page} {has_rating}')
-" 2>/dev/null || echo "0 0 0 False")
-    crud_list_count=$(echo "$crud_list_result" | cut -d' ' -f1)
-    crud_list_total=$(echo "$crud_list_result" | cut -d' ' -f2)
-    crud_list_page=$(echo "$crud_list_result" | cut -d' ' -f3)
-    crud_list_rating=$(echo "$crud_list_result" | cut -d' ' -f4)
-    if [ "$crud_list_count" = "5" ] && [ "$crud_list_total" -gt 0 ] 2>/dev/null && [ "$crud_list_page" = "1" ] && [ "$crud_list_rating" = "True" ]; then
-        echo "  PASS [GET /crud/items?category=electronics] ($crud_list_count items, total=$crud_list_total, page=$crud_list_page)"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[GET /crud/items list]: count=$crud_list_count, total=$crud_list_total, page=$crud_list_page, rating=$crud_list_rating" "$CRUD_DOCS"
-    fi
-
-    # 2. GET single item — with cache check
-    crud_get=$(curl -s --max-time 30 "http://localhost:$PORT/crud/items/1" || true)
-    crud_get_id=$(echo "$crud_get" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id','-1'))" 2>/dev/null || echo "-1")
-    if [ "$crud_get_id" = "1" ]; then
-        echo "  PASS [GET /crud/items/1] (returned id=1)"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[GET /crud/items/1]: expected id=1, got $crud_get_id" "$CRUD_DOCS"
-    fi
-
-    # 3. Cache-aside check — first call MISS, second call HIT
-    crud_cache1=$(curl -s --max-time 30 -D- -o /dev/null "http://localhost:$PORT/crud/items/42" | grep -i "^x-cache:" | tr -d '\r' | awk '{print $2}')
-    crud_cache2=$(curl -s --max-time 30 -D- -o /dev/null "http://localhost:$PORT/crud/items/42" | grep -i "^x-cache:" | tr -d '\r' | awk '{print $2}')
-    if [ "$crud_cache1" = "MISS" ] && [ "$crud_cache2" = "HIT" ]; then
-        echo "  PASS [crud cache-aside] (first=MISS, second=HIT)"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[crud cache-aside]: expected MISS then HIT, got '$crud_cache1' then '$crud_cache2'" "$CRUD_DOCS"
-    fi
-
-    # 4. GET non-existent item — 404
-    check_status "GET /crud/items/999999 (not found)" "404" "$CRUD_DOCS" \
-        -s --max-time 30 "http://localhost:$PORT/crud/items/999999"
-
-    # 5. POST — create a new item
-    crud_post_status=$(curl -s --max-time 30 -o /tmp/crud-post.json -w '%{http_code}' \
-        -X POST -H "Content-Type: application/json" \
-        -d '{"id":200001,"name":"ValidateItem","category":"test","price":42,"quantity":7}' \
-        "http://localhost:$PORT/crud/items" || echo "0")
-    if [ "$crud_post_status" = "201" ]; then
-        echo "  PASS [POST /crud/items] (201 Created)"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[POST /crud/items]: expected 201, got $crud_post_status" "$CRUD_DOCS"
-    fi
-
-    # 6. GET back the created item
-    crud_verify=$(curl -s --max-time 30 "http://localhost:$PORT/crud/items/200001" || true)
-    crud_verify_id=$(echo "$crud_verify" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id','-1'))" 2>/dev/null || echo "-1")
-    if [ "$crud_verify_id" = "200001" ]; then
-        echo "  PASS [GET /crud/items/200001] (read back created item)"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[GET /crud/items/200001]: expected id=200001, got $crud_verify_id" "$CRUD_DOCS"
-    fi
-
-    # 7. PUT — update, then verify cache was invalidated
-    curl -s --max-time 30 -o /dev/null "http://localhost:$PORT/crud/items/200001"  # warm cache
-    crud_put_status=$(curl -s --max-time 30 -o /dev/null -w '%{http_code}' \
-        -X PUT -H "Content-Type: application/json" \
-        -d '{"name":"UpdatedItem","category":"test","price":99,"quantity":1}' \
-        "http://localhost:$PORT/crud/items/200001" || echo "0")
-    crud_after_put=$(curl -s --max-time 30 -D- -o /dev/null "http://localhost:$PORT/crud/items/200001" | grep -i "^x-cache:" | tr -d '\r' | awk '{print $2}')
-    if [ "$crud_put_status" = "200" ] && [ "$crud_after_put" = "MISS" ]; then
-        echo "  PASS [PUT /crud/items/200001] (200 OK, cache invalidated)"
-        PASS=$((PASS + 1))
-    else
-        fail_with_link "[PUT /crud/items/200001]: status=$crud_put_status, cache_after=$crud_after_put" "$CRUD_DOCS"
-    fi
-fi
-
-# ───── WebSocket Echo (ws://localhost/ws) ─────
-
-if has_test "echo-ws"; then
-    WS_DOCS="$DOCS_BASE/ws/echo/validation"
-    echo "[test] echo-ws endpoint"
-    WS_OUTPUT=$(python3 "$SCRIPT_DIR/validate-ws.py" localhost "$PORT" /ws 2>&1) || true
-    echo "$WS_OUTPUT"
-
-    # Parse pass/fail counts from the script output
-    WS_PASS=$(echo "$WS_OUTPUT" | grep -oP '(\d+) passed' | grep -oP '\d+')
-    WS_FAIL=$(echo "$WS_OUTPUT" | grep -oP '(\d+) failed' | grep -oP '\d+')
-    PASS=$((PASS + ${WS_PASS:-0}))
-    FAIL=$((FAIL + ${WS_FAIL:-0}))
-    if [ "${WS_FAIL:-0}" -gt 0 ]; then
-        echo "        → $WS_DOCS"
-    fi
-fi
-
-# ───── Gateway profiles (reverse proxy + server, shared validation flow) ─────
+# The suite lives in scripts/lib/validate/ and is sourced (not executed) in the
+# order below, so every module shares one shell: globals, the cleanup trap, the
+# PASS/FAIL counters, and the check_* helpers are all visible across modules.
 #
-# Both gateway-64 (h2) and gateway-h3 (h3 at the edge) use the same endpoint
-# surface (/static, /json/{count}, /async-db, /baseline2) so validation is
-# identical — only the compose file and docs URL change. Factored here so
-# we don't duplicate ~150 lines of curl checks per profile.
+#   setup.sh      args, globals, cleanup trap, watchdog, meta parse, has_test
+#   build.sh      build the framework image (skipped for gateway-only entries)
+#   container.sh  volume mounts, Postgres/Redis sidecars, container start, readiness
+#   assert.sh     DOCS_BASE, check helpers (check/check_status/...), wait_h2,
+#                 check_static_freshness
+#   checks/*.sh   per-profile validation blocks, each guarded by has_test
+#   summary.sh    print "Results: N passed, M failed" and set the exit code
 #
-# The h3 profile is validated via curl's --http2 path even though the test
-# runs over QUIC at benchmark time, because curl builds don't reliably ship
-# h3 support. Caddy (and most h3-capable proxies) answer h2 and h3 on the
-# same port, so endpoint correctness is still covered. If h3 itself is
-# broken, h2load-h3 will catch it at benchmark time with 0 rps.
-_validate_gateway() {
-    local profile="$1"
-    local compose_file="$2"
-    local gateway_docs="$3"
-
-    echo "[test] $profile endpoints"
-
-    local gw_project="httparena-validate-gw-${profile}-${FRAMEWORK}"
-    if [ -f "$compose_file" ]; then
-        echo "[gateway] Building and starting compose stack..."
-        CERTS_DIR="$CERTS_DIR" DATA_DIR="$DATA_DIR" DATABASE_URL="postgres://bench:bench@localhost:5432/benchmark" \
-            docker compose -f "$compose_file" -p "$gw_project" up --build -d || { echo "FAIL: gateway compose up"; FAIL=$((FAIL + 1)); return; }
-    else
-        echo "  FAIL [$profile]: compose file not found at $compose_file"
-        FAIL=$((FAIL + 1))
-        return
-    fi
-
-    local GW_PORT=$H2PORT
-
-    echo "[wait] Waiting for gateway HTTPS port..."
-    local gw_ready=false i
-    for i in $(seq 1 30); do
-        if curl -sk --max-time 2 --http2 -o /dev/null "https://localhost:$GW_PORT/static/reset.css" 2>/dev/null; then
-            gw_ready=true
-            break
-        fi
-        sleep 1
-    done
-
-    if [ "$gw_ready" = "true" ]; then
-        # 1. HTTP/2 protocol negotiation (works for h2 and h3-capable proxies
-        #    that still speak h2 on the same port — Caddy, nginx-quic, etc.)
-        local gw_proto
-        gw_proto=$(curl -sk --max-time 30 --http2 -o /dev/null -w '%{http_version}' "https://localhost:$GW_PORT/static/reset.css" || echo "0")
-        if [ "$gw_proto" = "2" ]; then
-            echo "  PASS [gateway HTTP/2 negotiation] (HTTP/$gw_proto)"
-            PASS=$((PASS + 1))
-        else
-            fail_with_link "[gateway HTTP/2 negotiation]: got HTTP/$gw_proto" "$gateway_docs"
-        fi
-
-        # 2. Static file — correct Content-Type
-        check_header "gateway /static/reset.css Content-Type" "Content-Type" "text/css" "$gateway_docs" \
-            -sk --http2 "https://localhost:$GW_PORT/static/reset.css"
-
-        check_header "gateway /static/app.js Content-Type" "Content-Type" "application/javascript" "$gateway_docs" \
-            -sk --http2 "https://localhost:$GW_PORT/static/app.js"
-
-        # 3. Static file — non-zero size
-        local gw_static_size
-        gw_static_size=$(curl -sk --max-time 30 --http2 -o /dev/null -w '%{size_download}' "https://localhost:$GW_PORT/static/app.js" || echo "0")
-        if [ "$gw_static_size" -gt 0 ]; then
-            echo "  PASS [gateway static file size] ($gw_static_size bytes)"
-            PASS=$((PASS + 1))
-        else
-            fail_with_link "[gateway static file size]: empty response for /static/app.js" "$gateway_docs"
-        fi
-
-        # 4. Static file — 404 for missing files
-        check_status "gateway /static/nonexistent.txt" "404" "$gateway_docs" \
-            -sk --http2 "https://localhost:$GW_PORT/static/nonexistent.txt"
-
-        # 5. JSON endpoint — valid JSON with computed totals
-        local gw_json_response gw_json_result gw_json_count gw_json_valid gw_json_correct
-        gw_json_response=$(curl -sk --max-time 30 --http2 "https://localhost:$GW_PORT/json/50" || true)
-        gw_json_result=$(echo "$gw_json_response" | python3 -c "
-import sys, json
-d = json.load(sys.stdin)
-count = d.get('count', 0)
-items = d.get('items', [])
-def valid_item(it):
-    r = it.get('rating')
-    return ('id' in it and 'name' in it and 'category' in it and 'price' in it
-            and 'quantity' in it and 'total' in it
-            and isinstance(it.get('tags'), list) and isinstance(it.get('active'), bool)
-            and isinstance(r, dict) and 'score' in r and 'count' in r)
-valid = all(valid_item(it) for it in items) if items else False
-correct_totals = True
-for item in items:
-    expected = round(item.get('price', 0) * item.get('quantity', 0), 2)
-    if abs(item.get('total', 0) - expected) > 0.02:
-        correct_totals = False
-        break
-print(f'{count} {valid} {correct_totals}')
-" 2>/dev/null || echo "0 False False")
-        gw_json_count=$(echo "$gw_json_result" | cut -d' ' -f1)
-        gw_json_valid=$(echo "$gw_json_result" | cut -d' ' -f2)
-        gw_json_correct=$(echo "$gw_json_result" | cut -d' ' -f3)
-
-        if [ "$gw_json_count" = "50" ] && [ "$gw_json_valid" = "True" ] && [ "$gw_json_correct" = "True" ]; then
-            echo "  PASS [gateway /json] (50 items, full schema, totals correct)"
-            PASS=$((PASS + 1))
-        else
-            fail_with_link "[gateway /json]: count=$gw_json_count, schema=$gw_json_valid, correct=$gw_json_correct" "$gateway_docs"
-        fi
-
-        check_header "gateway /json Content-Type" "Content-Type" "application/json" "$gateway_docs" \
-            -sk --http2 "https://localhost:$GW_PORT/json/50"
-
-        # 6. Async database endpoint — valid result set
-        local gw_db_response gw_db_result gw_db_count gw_db_rating gw_db_tags gw_db_active
-        gw_db_response=$(curl -sk --max-time 30 --http2 "https://localhost:$GW_PORT/async-db?min=10&max=50&limit=50" || true)
-        gw_db_result=$(echo "$gw_db_response" | python3 -c "
-import sys, json
-d = json.load(sys.stdin)
-count = d.get('count', 0)
-items = d.get('items', [])
-has_rating = all('rating' in item and 'score' in item['rating'] for item in items) if items else False
-has_tags = all(isinstance(item.get('tags'), list) for item in items) if items else False
-has_active_bool = all(isinstance(item.get('active'), bool) for item in items) if items else False
-print(f'{count} {has_rating} {has_tags} {has_active_bool}')
-" 2>/dev/null || echo "0 False False False")
-        gw_db_count=$(echo "$gw_db_result" | cut -d' ' -f1)
-        gw_db_rating=$(echo "$gw_db_result" | cut -d' ' -f2)
-        gw_db_tags=$(echo "$gw_db_result" | cut -d' ' -f3)
-        gw_db_active=$(echo "$gw_db_result" | cut -d' ' -f4)
-
-        if [ "$gw_db_count" -gt 0 ] && [ "$gw_db_count" -le 50 ] && [ "$gw_db_rating" = "True" ] && [ "$gw_db_tags" = "True" ] && [ "$gw_db_active" = "True" ]; then
-            echo "  PASS [gateway /async-db] ($gw_db_count items, correct structure)"
-            PASS=$((PASS + 1))
-        else
-            fail_with_link "[gateway /async-db]: count=$gw_db_count, rating=$gw_db_rating, tags=$gw_db_tags, active=$gw_db_active" "$gateway_docs"
-        fi
-
-        check_header "gateway /async-db Content-Type" "Content-Type" "application/json" "$gateway_docs" \
-            -sk --http2 "https://localhost:$GW_PORT/async-db?min=10&max=50&limit=50"
-
-        # 7. Async-db anti-cheat: empty range
-        local gw_db_empty
-        gw_db_empty=$(curl -sk --max-time 30 --http2 "https://localhost:$GW_PORT/async-db?min=9999&max=9999&limit=50" | python3 -c "import sys,json; print(json.load(sys.stdin).get('count','-1'))" 2>/dev/null || echo "-1")
-        if [ "$gw_db_empty" = "0" ]; then
-            echo "  PASS [gateway /async-db empty range] (count=0)"
-            PASS=$((PASS + 1))
-        else
-            fail_with_link "[gateway /async-db empty range]: expected count=0, got $gw_db_empty" "$gateway_docs"
-        fi
-
-        # 8. Baseline2 endpoint
-        check "gateway /baseline2?a=13&b=42" "55" "$gateway_docs" \
-            -sk --http2 "https://localhost:$GW_PORT/baseline2?a=13&b=42"
-
-        # 9. Baseline2 anti-cheat: randomized inputs
-        local GW_A=$((RANDOM % 900 + 100))
-        local GW_B=$((RANDOM % 900 + 100))
-        check "gateway /baseline2?a=$GW_A&b=$GW_B (random)" "$((GW_A + GW_B))" "$gateway_docs" \
-            -sk --http2 "https://localhost:$GW_PORT/baseline2?a=$GW_A&b=$GW_B"
-    else
-        echo "  FAIL: Gateway HTTPS port $GW_PORT not responding after 30s"
-        FAIL=$((FAIL + 1))
-    fi
-
-    # Cleanup gateway compose stack
-    if [ -f "$compose_file" ]; then
-        CERTS_DIR="$CERTS_DIR" DATA_DIR="$DATA_DIR" DATABASE_URL="postgres://bench:bench@localhost:5432/benchmark" \
-            docker compose -f "$compose_file" -p "$gw_project" down --remove-orphans 2>/dev/null || true
-    fi
-}
-
-# ───── Gateway H2 (h2 at the edge) ─────
-
-if has_test "gateway-64"; then
-    _validate_gateway "gateway-64" \
-        "$ROOT_DIR/frameworks/$FRAMEWORK/compose.gateway.yml" \
-        "$DOCS_BASE/gateway/gateway-h2/validation"
-fi
-
-# ───── Gateway H3 (h3/QUIC at the edge) ─────
+# Run from the repo root:  ./scripts/validate.sh <framework>
+set -euo pipefail
 
-if has_test "gateway-h3"; then
-    _validate_gateway "gateway-h3" \
-        "$ROOT_DIR/frameworks/$FRAMEWORK/compose.gateway-h3.yml" \
-        "$DOCS_BASE/gateway/gateway-h3/validation"
+if [ "$#" -lt 1 ]; then
+    echo "usage: $0 <framework>" >&2
+    exit 2
 fi
 
-# ───── Production-stack (edge + authsvc + cache + server) ─────
-#
-# Distinct endpoint surface from the gateway profiles: /public/* is
-# unauthenticated compute, /api/* is behind an edge auth_request → Redis
-# session lookup. We validate both the anonymous path (public works,
-# api returns 401 without a cookie) and the authenticated path (api
-# returns 200 with a pre-seeded session cookie).
-
-_validate_production_stack() {
-    local compose_file="$1"
-    local docs_url="$2"
-    local profile="production-stack"
-
-    echo "[test] $profile endpoints"
-
-    local gw_project="httparena-validate-gw-${profile}-${FRAMEWORK}"
-    if [ -f "$compose_file" ]; then
-        echo "[$profile] Building and starting compose stack..."
-        CERTS_DIR="$CERTS_DIR" DATA_DIR="$DATA_DIR" DATABASE_URL="postgres://bench:bench@localhost:5432/benchmark" \
-            docker compose -f "$compose_file" -p "$gw_project" up --build -d || { echo "FAIL: $profile compose up"; FAIL=$((FAIL + 1)); return; }
-    else
-        echo "  FAIL [$profile]: compose file not found at $compose_file"
-        FAIL=$((FAIL + 1))
-        return
-    fi
-
-    local GW_PORT=$H2PORT
-
-    # Wait for the edge to answer. Also gives the Redis seed step time to
-    # finish — without seeded sessions, /api/* would all return 401.
-    echo "[wait] Waiting for $profile HTTPS port..."
-    local gw_ready=false i
-    for i in $(seq 1 60); do
-        if curl -sk --max-time 2 --http2 -o /dev/null "https://localhost:$GW_PORT/static/reset.css" 2>/dev/null; then
-            gw_ready=true
-            break
-        fi
-        sleep 1
-    done
-
-    if [ "$gw_ready" = "true" ]; then
-        # 1. HTTP/2 protocol negotiation
-        local gw_proto
-        gw_proto=$(curl -sk --max-time 30 --http2 -o /dev/null -w '%{http_version}' "https://localhost:$GW_PORT/static/reset.css" || echo "0")
-        if [ "$gw_proto" = "2" ]; then
-            echo "  PASS [$profile HTTP/2 negotiation] (HTTP/$gw_proto)"
-            PASS=$((PASS + 1))
-        else
-            fail_with_link "[$profile HTTP/2 negotiation]: got HTTP/$gw_proto" "$docs_url"
-        fi
-
-        # 2. Static file served by edge
-        check_header "$profile /static/reset.css Content-Type" "Content-Type" "text/css" "$docs_url" \
-            -sk --http2 "https://localhost:$GW_PORT/static/reset.css"
-
-        local gw_static_size
-        gw_static_size=$(curl -sk --max-time 30 --http2 -o /dev/null -w '%{size_download}' "https://localhost:$GW_PORT/static/app.js" || echo "0")
-        if [ "$gw_static_size" -gt 0 ]; then
-            echo "  PASS [$profile static file size] ($gw_static_size bytes)"
-            PASS=$((PASS + 1))
-        else
-            fail_with_link "[$profile static file size]: empty response for /static/app.js" "$docs_url"
-        fi
-
-        # 3. Public baseline — no auth, no cache
-        check "$profile /public/baseline?a=13&b=42" "55" "$docs_url" \
-            -sk --http2 "https://localhost:$GW_PORT/public/baseline?a=13&b=42"
-
-        local GW_A=$((RANDOM % 900 + 100))
-        local GW_B=$((RANDOM % 900 + 100))
-        check "$profile /public/baseline?a=$GW_A&b=$GW_B (random)" "$((GW_A + GW_B))" "$docs_url" \
-            -sk --http2 "https://localhost:$GW_PORT/public/baseline?a=$GW_A&b=$GW_B"
-
-        # 4. Public JSON — no auth, no cache, returns count items with totals
-        local gw_json_response gw_json_result gw_json_count gw_json_valid gw_json_correct
-        gw_json_response=$(curl -sk --max-time 30 --http2 "https://localhost:$GW_PORT/public/json/25" || true)
-        gw_json_result=$(echo "$gw_json_response" | python3 -c "
-import sys, json
-d = json.load(sys.stdin)
-count = d.get('count', 0)
-items = d.get('items', [])
-def valid_item(it):
-    r = it.get('rating')
-    return ('id' in it and 'name' in it and 'category' in it and 'price' in it
-            and 'quantity' in it and 'total' in it
-            and isinstance(it.get('tags'), list) and isinstance(it.get('active'), bool)
-            and isinstance(r, dict) and 'score' in r and 'count' in r)
-valid = all(valid_item(it) for it in items) if items else False
-correct_totals = True
-for item in items:
-    expected = round(item.get('price', 0) * item.get('quantity', 0), 2)
-    if abs(item.get('total', 0) - expected) > 0.02:
-        correct_totals = False
-        break
-print(f'{count} {valid} {correct_totals}')
-" 2>/dev/null || echo "0 False False")
-        gw_json_count=$(echo "$gw_json_result" | cut -d' ' -f1)
-        gw_json_valid=$(echo "$gw_json_result" | cut -d' ' -f2)
-        gw_json_correct=$(echo "$gw_json_result" | cut -d' ' -f3)
+VALIDATE_LIB="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/validate"
 
-        if [ "$gw_json_count" = "25" ] && [ "$gw_json_valid" = "True" ] && [ "$gw_json_correct" = "True" ]; then
-            echo "  PASS [$profile /public/json/25] (25 items, full schema, totals correct)"
-            PASS=$((PASS + 1))
-        else
-            fail_with_link "[$profile /public/json/25]: count=$gw_json_count, schema=$gw_json_valid, correct=$gw_json_correct" "$docs_url"
-        fi
+source "$VALIDATE_LIB/setup.sh"
+source "$VALIDATE_LIB/build.sh"
+source "$VALIDATE_LIB/container.sh"
+source "$VALIDATE_LIB/assert.sh"
 
-        # 5. Auth wall (GET) — /api/* without a cookie must return 401
-        check_status "$profile GET /api/items no-token" "401" "$docs_url" \
-            -sk --http2 "https://localhost:$GW_PORT/api/items/1"
-
-        # 6. Auth wall (GET) — /api/* with a bogus cookie must also return 401
-        check_status "$profile GET /api/items bogus-cookie" "401" "$docs_url" \
-            -sk --http2 -H "Authorization: Bearer invalid.token.here" "https://localhost:$GW_PORT/api/items/1"
-
-        # 7. Auth wall (POST) — the write path MUST also reject unauth calls,
-        #    otherwise an anonymous client could UPDATE rows in Postgres.
-        #    If nginx forgot to apply auth_request to the POST branch, or if
-        #    the framework ignored the edge's 401 and processed the body, this
-        #    check catches it. Body matters less than status — a bogus body
-        #    is fine because the server should reject at auth before parsing.
-        check_status "$profile POST /api/items no-token" "401" "$docs_url" \
-            -sk --http2 -X POST -H "Content-Type: application/json" \
-            -d '{"name":"unauth","price":1,"quantity":1}' \
-            "https://localhost:$GW_PORT/api/items/1"
-
-        # 8. Auth wall (POST) — bogus cookie must also return 401
-        check_status "$profile POST /api/items bogus-cookie" "401" "$docs_url" \
-            -sk --http2 -X POST -H "Content-Type: application/json" \
-            -H "Authorization: Bearer invalid.token.here" \
-            -d '{"name":"unauth","price":1,"quantity":1}' \
-            "https://localhost:$GW_PORT/api/items/1"
-
-        # 7. Authenticated /api/items/{id} — cache-aside returns item JSON
-        local gw_item_response gw_item_id
-        gw_item_response=$(curl -sk --max-time 30 --http2 -H "Authorization: Bearer $(cat $ROOT_DIR/data/jwt-token.txt)" "https://localhost:$GW_PORT/api/items/1" || true)
-        gw_item_id=$(echo "$gw_item_response" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id','-1'))" 2>/dev/null || echo "-1")
-        if [ "$gw_item_id" = "1" ]; then
-            echo "  PASS [$profile /api/items/1] (authenticated, returned id=1)"
-            PASS=$((PASS + 1))
-        else
-            fail_with_link "[$profile /api/items/1]: expected id=1, got $gw_item_id" "$docs_url"
-        fi
-
-        # 8. Cache-aside HIT after MISS — pick a previously-unread id, first
-        #    call must be MISS, immediate second call must be HIT. Proves
-        #    SetStringAsync populated the cache on miss.
-        local first_cache second_cache
-        first_cache=$(curl -sk --max-time 30 --http2 -H "Authorization: Bearer $(cat $ROOT_DIR/data/jwt-token.txt)" \
-            -D- -o /dev/null "https://localhost:$GW_PORT/api/items/7" | grep -i "^x-cache:" | tr -d '\r' | awk '{print $2}')
-        second_cache=$(curl -sk --max-time 30 --http2 -H "Authorization: Bearer $(cat $ROOT_DIR/data/jwt-token.txt)" \
-            -D- -o /dev/null "https://localhost:$GW_PORT/api/items/7" | grep -i "^x-cache:" | tr -d '\r' | awk '{print $2}')
-        if [ "$first_cache" = "MISS" ] && [ "$second_cache" = "HIT" ]; then
-            echo "  PASS [$profile cache-aside] (first=MISS, second=HIT)"
-            PASS=$((PASS + 1))
-        else
-            fail_with_link "[$profile cache-aside]: expected first=MISS second=HIT, got first='$first_cache' second='$second_cache'" "$docs_url"
-        fi
-
-        # 9. POST /api/items/{id} — write path + cache invalidation.
-        #    After POST, the next GET on the same id must be MISS (because
-        #    the cache was invalidated).
-        local post_status invalidated_cache
-        post_status=$(curl -sk --max-time 30 --http2 -X POST \
-            -H "Authorization: Bearer $(cat $ROOT_DIR/data/jwt-token.txt)" \
-            -H "Content-Type: application/json" \
-            -d '{"name":"validate-updated","price":777,"quantity":99}' \
-            -o /dev/null -w '%{http_code}' \
-            "https://localhost:$GW_PORT/api/items/2" || echo "0")
-        if [ "$post_status" = "204" ]; then
-            echo "  PASS [$profile POST /api/items/2] (204 No Content)"
-            PASS=$((PASS + 1))
-        else
-            fail_with_link "[$profile POST /api/items/2]: expected 204, got $post_status" "$docs_url"
-        fi
-
-        # 10. Warm the cache for item 2, then invalidate via POST, then
-        #     confirm the cache is MISS again (proving RemoveAsync worked).
-        curl -sk --max-time 30 --http2 -H "Authorization: Bearer $(cat $ROOT_DIR/data/jwt-token.txt)" \
-            -o /dev/null "https://localhost:$GW_PORT/api/items/3"  # warm
-        curl -sk --max-time 30 --http2 -X POST \
-            -H "Authorization: Bearer $(cat $ROOT_DIR/data/jwt-token.txt)" \
-            -H "Content-Type: application/json" \
-            -d '{"name":"validate-invalidated","price":111,"quantity":22}' \
-            -o /dev/null "https://localhost:$GW_PORT/api/items/3" # invalidate
-        invalidated_cache=$(curl -sk --max-time 30 --http2 -H "Authorization: Bearer $(cat $ROOT_DIR/data/jwt-token.txt)" \
-            -D- -o /dev/null "https://localhost:$GW_PORT/api/items/3" | grep -i "^x-cache:" | tr -d '\r' | awk '{print $2}')
-        if [ "$invalidated_cache" = "MISS" ]; then
-            echo "  PASS [$profile POST invalidation] (GET after POST shows MISS)"
-            PASS=$((PASS + 1))
-        else
-            fail_with_link "[$profile POST invalidation]: expected MISS after POST, got '$invalidated_cache'" "$docs_url"
-        fi
-
-        # 11. Authenticated /api/me — cache-aside from users table
-        local gw_me_response gw_me_id
-        gw_me_response=$(curl -sk --max-time 30 --http2 -H "Authorization: Bearer $(cat $ROOT_DIR/data/jwt-token.txt)" "https://localhost:$GW_PORT/api/me" || true)
-        gw_me_id=$(echo "$gw_me_response" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id','-1'))" 2>/dev/null || echo "-1")
-        if [ "$gw_me_id" = "42" ]; then
-            echo "  PASS [$profile /api/me] (authenticated, returned user 42)"
-            PASS=$((PASS + 1))
-        else
-            fail_with_link "[$profile /api/me]: expected user id 42, got $gw_me_id" "$docs_url"
-        fi
-    else
-        echo "  FAIL: $profile HTTPS port $GW_PORT not responding after 60s"
-        FAIL=$((FAIL + 1))
-    fi
-
-    # Cleanup
-    if [ -f "$compose_file" ]; then
-        CERTS_DIR="$CERTS_DIR" DATA_DIR="$DATA_DIR" DATABASE_URL="postgres://bench:bench@localhost:5432/benchmark" \
-            docker compose -f "$compose_file" -p "$gw_project" down --remove-orphans 2>/dev/null || true
-    fi
-}
-
-if has_test "production-stack"; then
-    _validate_production_stack \
-        "$ROOT_DIR/frameworks/$FRAMEWORK/compose.production-stack.yml" \
-        "$DOCS_BASE/gateway/production-stack/validation"
-fi
-
-# ───── Summary ─────
+# Per-profile checks, sourced in the original execution order. Each module runs
+# only the blocks whose tests the framework subscribes to (has_test guards).
+for _check_module in connection json upload http2 static database websocket gateway; do
+    source "$VALIDATE_LIB/checks/$_check_module.sh"
+done
 
-echo ""
-echo "=== Results: $PASS passed, $FAIL failed ==="
-[ "$FAIL" -eq 0 ] || exit 1
+source "$VALIDATE_LIB/summary.sh"
diff --git a/site/content/docs/add-framework/implementation-rules/frameworks/tuned.md b/site/content/docs/add-framework/implementation-rules/frameworks/tuned.md
index 1a85aa870..170581f87 100644
--- a/site/content/docs/add-framework/implementation-rules/frameworks/tuned.md
+++ b/site/content/docs/add-framework/implementation-rules/frameworks/tuned.md
@@ -10,7 +10,7 @@ Tuned mode (`mode: tuned`) gives a framework entry more freedom. It can use non-
 - Alternative JSON serializers (simd-json, sonic-json, etc.)
 - Custom buffer sizes and TCP socket options
 - Experimental or unstable framework flags
-- Memory-mapped files and in-memory static file caching
+- Memory-mapped files (the mapping must reflect the current file on disk)
 - Custom thread pools and worker configurations
 - Non-default GC settings without documentation requirement
 - Framework-specific performance flags not recommended for production
@@ -20,6 +20,7 @@ Tuned mode (`mode: tuned`) gives a framework entry more freedom. It can use non-
 
 - **Pre-computed response bodies** - serializing a fixed response at startup and returning the same bytes per request (e.g. caching a JSON blob and writing it back unchanged). The serialization + compression work is the workload; bypassing it defeats the measurement.
 - **Response caching** - memoizing the full HTTP response body keyed by URL/params and replaying it. This is distinct from upstream data caching (DB query results, JWT verification, etc.), which remains allowed where the profile calls for it (e.g. the CRUD profile's read cache).
+- **Permanent pre-caching of static files** - loading static files (or their `.gz`/`.br` siblings) into memory at startup or first request and serving them so later changes to the file on disk are *never* reflected. A short revalidating cache that picks up on-disk changes within a grace window (e.g. `fasthttp.FS`, nginx `open_file_cache`) is fine; a frozen startup or build-time-manifest cache is not. `validate.sh` enforces this with a freshness probe that rewrites the files mid-run and polls for the change for `STATIC_FRESHNESS_GRACE` seconds (default 30) — see [static implementation guidelines](/docs/test-profiles/h1/isolated/static/implementation/). Serving pre-compressed `.gz`/`.br` from disk and using any compression approach remain allowed, provided the bytes track the current on-disk file.
 
 ## What is still required
 
diff --git a/site/content/docs/test-profiles/h1/isolated/static/implementation.md b/site/content/docs/test-profiles/h1/isolated/static/implementation.md
index 742a371ee..90d5e0b85 100644
--- a/site/content/docs/test-profiles/h1/isolated/static/implementation.md
+++ b/site/content/docs/test-profiles/h1/isolated/static/implementation.md
@@ -1,7 +1,7 @@
 ---
 title: Implementation Guidelines
 ---
-{{< type-rules production="Must load files from disk on every request. No in-memory caching, no memory-mapped files, no pre-loaded file buffers. Compression must use the framework's standard middleware or built-in static file handler - no handmade compression code. Serving pre-compressed `.br`/`.gz` variants from disk **is allowed**, but only through a documented framework API (e.g. ASP.NET `MapStaticAssets`, nginx `gzip_static` / `brotli_static`, Caddy `precompressed`). No custom file-suffix lookup logic." tuned="May cache files in memory at startup, use memory-mapped files, pre-rendered response headers, or any caching strategy. May serve pre-compressed files (.gz, .br) from disk via any mechanism. Free to use any compression approach." engine="No specific rules." >}}
+{{< type-rules production="Must load files from disk on every request. No in-memory caching, no memory-mapped files, no pre-loaded file buffers. Compression must use the framework's standard middleware or built-in static file handler - no handmade compression code. Serving pre-compressed `.br`/`.gz` variants from disk **is allowed**, but only through a documented framework API (e.g. ASP.NET `MapStaticAssets`, nginx `gzip_static` / `brotli_static`, Caddy `precompressed`). No custom file-suffix lookup logic." tuned="Static responses must reflect on-disk changes within a short window: a revalidating cache (e.g. a few-second file cache) is fine, but permanently pre-loading file contents/responses into memory so changes are never reflected is not. A runtime freshness probe in validate.sh rewrites the files mid-run and polls for the change (grace window STATIC_FRESHNESS_GRACE, default 30s). May serve pre-compressed (.gz, .br) files from disk via any mechanism (custom suffix lookup allowed) and use any compression approach." engine="No specific rules." >}}
 
 
 Serves 20 static files of various types and sizes over HTTP/1.1, simulating a realistic page load with diverse file types and sizes.
diff --git a/site/content/docs/test-profiles/h1/isolated/static/validation.md b/site/content/docs/test-profiles/h1/isolated/static/validation.md
index e4a9aecc2..ae1fe75a8 100644
--- a/site/content/docs/test-profiles/h1/isolated/static/validation.md
+++ b/site/content/docs/test-profiles/h1/isolated/static/validation.md
@@ -32,3 +32,18 @@ Requests all 20 static files **with** `Accept-Encoding: br;q=1, gzip;q=0.8` and
 ## 404 for nonexistent file
 
 Sends `GET /static/nonexistent.txt` and verifies the server returns **HTTP 404**.
+
+## Static freshness (no pre-caching)
+
+Confirms the server reflects on-disk changes to static files instead of permanently pre-loading them into memory. `engine` and `infrastructure` types are ranked separately and **exempt** — the check is skipped for them. It applies to every other type, in both `standard` and `tuned` modes.
+
+Using `reset.css`, the probe:
+
+1. **Primes** the server by requesting the original file through every `Accept-Encoding` (`identity`, `gzip`, `br`), so any lazy first-request cache is populated with the pre-change bytes.
+2. **Rewrites** `reset.css` — and its precompressed `.gz`/`.br` siblings, if present — on disk with a unique sentinel token **while the server is running**.
+3. **Polls** once per second, re-requesting the file under each `Accept-Encoding` and decoding the response by its `Content-Encoding`, until every encoding returns the new token or the grace window elapses.
+4. **Restores** the original files afterwards (also via the cleanup trap if the run aborts).
+
+The grace window is `STATIC_FRESHNESS_GRACE` (default **30s**). A short revalidating cache (e.g. `fasthttp.FS`, nginx `open_file_cache`) legitimately reflects the change after a brief delay and passes; a permanent pre-cache (startup load or build-time manifest) never reflects it and fails — the window is what separates the two.
+
+**PASS** if every served encoding reflects the change within the window (reported as immediate when ≤1s, otherwise as a revalidating cache). **SKIP** for `engine`/`infrastructure` types, or if `reset.css` is absent. **FAIL** if any encoding still serves stale content after the grace window — permanent pre-loading/caching of static files is not allowed (`standard` or `tuned`).
diff --git a/site/content/docs/test-profiles/h2/static-h2/implementation.md b/site/content/docs/test-profiles/h2/static-h2/implementation.md
index 74f912768..91eb76d8f 100644
--- a/site/content/docs/test-profiles/h2/static-h2/implementation.md
+++ b/site/content/docs/test-profiles/h2/static-h2/implementation.md
@@ -1,7 +1,7 @@
 ---
 title: Implementation Guidelines
 ---
-{{< type-rules production="Must load files from disk on every request. No in-memory caching, no memory-mapped files, no pre-loaded file buffers. Compression must use the framework's standard middleware or built-in static file handler - no handmade compression code. Serving pre-compressed `.br`/`.gz` variants from disk **is allowed**, but only through a documented framework API (e.g. ASP.NET `MapStaticAssets`, nginx `gzip_static` / `brotli_static`, Caddy `precompressed`). No custom file-suffix lookup logic." tuned="May cache files in memory at startup, use memory-mapped files, pre-rendered response headers, or any caching strategy. May serve pre-compressed files (.gz, .br) from disk via any mechanism. Free to use any compression approach." engine="No specific rules. Ranked separately from frameworks." >}}
+{{< type-rules production="Must load files from disk on every request. No in-memory caching, no memory-mapped files, no pre-loaded file buffers. Compression must use the framework's standard middleware or built-in static file handler - no handmade compression code. Serving pre-compressed `.br`/`.gz` variants from disk **is allowed**, but only through a documented framework API (e.g. ASP.NET `MapStaticAssets`, nginx `gzip_static` / `brotli_static`, Caddy `precompressed`). No custom file-suffix lookup logic." tuned="Static responses must reflect on-disk changes within a short window: a revalidating cache (e.g. a few-second file cache) is fine, but permanently pre-loading file contents/responses into memory so changes are never reflected is not. A runtime freshness probe in validate.sh rewrites the files mid-run and polls for the change (grace window STATIC_FRESHNESS_GRACE, default 30s). May serve pre-compressed (.gz, .br) files from disk via any mechanism (custom suffix lookup allowed) and use any compression approach." engine="No specific rules. Ranked separately from frameworks." >}}
 
 
 Serves 20 static files of various types and sizes over HTTP/2 with TLS, simulating a realistic browser page load with multiplexed streams.
diff --git a/site/content/docs/test-profiles/h2/static-h2/validation.md b/site/content/docs/test-profiles/h2/static-h2/validation.md
index 10318d4fd..7d6561cde 100644
--- a/site/content/docs/test-profiles/h2/static-h2/validation.md
+++ b/site/content/docs/test-profiles/h2/static-h2/validation.md
@@ -21,3 +21,11 @@ Requests `GET /static/reset.css` over HTTP/2 and verifies the response size is g
 ## 404 for nonexistent file
 
 Sends `GET /static/nonexistent.txt` over HTTP/2 and verifies the server returns **HTTP 404**.
+
+## Static freshness (no pre-caching)
+
+The same anti-pre-cache probe as the [HTTP/1.1 static validation](../../h1/isolated/static/validation) also runs over HTTP/2 on port 8443: it rewrites `reset.css` (and its `.gz`/`.br` siblings) on disk mid-run and polls each `Accept-Encoding` until the response reflects the change or the `STATIC_FRESHNESS_GRACE` window (default **30s**) elapses. `engine` and `infrastructure` types are **exempt** (skipped).
+
+It runs here **only for entries subscribed to `static-h2` but not `static`** — when a framework also subscribes to the HTTP/1.1 `static` test, that test's freshness check already covers it, so the HTTP/2 probe is not repeated.
+
+**PASS** if every served encoding reflects the change within the window. **FAIL** if any stays stale after it.
diff --git a/site/content/docs/test-profiles/h3/static-h3/implementation.md b/site/content/docs/test-profiles/h3/static-h3/implementation.md
index 56dc02f71..c3b4b48d9 100644
--- a/site/content/docs/test-profiles/h3/static-h3/implementation.md
+++ b/site/content/docs/test-profiles/h3/static-h3/implementation.md
@@ -1,7 +1,7 @@
 ---
 title: Implementation Guidelines
 ---
-{{< type-rules production="Must load files from disk on every request. No in-memory caching, no memory-mapped files, no pre-loaded file buffers. Compression must use the framework's standard middleware or built-in static file handler - no handmade compression code. Serving pre-compressed `.br`/`.gz` variants from disk **is allowed**, but only through a documented framework API (e.g. ASP.NET `MapStaticAssets`, nginx `gzip_static` / `brotli_static`, Caddy `precompressed`). No custom file-suffix lookup logic." tuned="May cache files in memory at startup, use memory-mapped files, pre-rendered response headers, or any caching strategy. May serve pre-compressed files (.gz, .br) from disk via any mechanism. Free to use any compression approach." engine="No specific rules. Ranked separately from frameworks." >}}
+{{< type-rules production="Must load files from disk on every request. No in-memory caching, no memory-mapped files, no pre-loaded file buffers. Compression must use the framework's standard middleware or built-in static file handler - no handmade compression code. Serving pre-compressed `.br`/`.gz` variants from disk **is allowed**, but only through a documented framework API (e.g. ASP.NET `MapStaticAssets`, nginx `gzip_static` / `brotli_static`, Caddy `precompressed`). No custom file-suffix lookup logic." tuned="Static responses must reflect on-disk changes within a short window: a revalidating cache (e.g. a few-second file cache) is fine, but permanently pre-loading file contents/responses into memory so changes are never reflected is not. A runtime freshness probe in validate.sh rewrites the files mid-run and polls for the change (grace window STATIC_FRESHNESS_GRACE, default 30s). May serve pre-compressed (.gz, .br) files from disk via any mechanism (custom suffix lookup allowed) and use any compression approach." engine="No specific rules. Ranked separately from frameworks." >}}
 
 
 The HTTP/3 Static Files profile serves 20 static files of various types over QUIC, simulating a browser loading page assets over HTTP/3.
diff --git a/site/content/docs/test-profiles/h3/static-h3/validation.md b/site/content/docs/test-profiles/h3/static-h3/validation.md
index 3dc5e5680..287139663 100644
--- a/site/content/docs/test-profiles/h3/static-h3/validation.md
+++ b/site/content/docs/test-profiles/h3/static-h3/validation.md
@@ -4,7 +4,7 @@ title: Validation
 
 The HTTP/3 static files profile does not have dedicated validation checks in `validate.sh`. HTTP/3 (QUIC) validation relies on:
 
-- The [HTTP/2 Static Files validation](../../h2/static-h2/validation) checks, which verify Content-Type headers, response sizes, and 404 handling over HTTPS on port 8443
+- The [HTTP/2 Static Files validation](../../h2/static-h2/validation) checks, which verify Content-Type headers, response sizes, 404 handling, and static freshness over HTTPS on port 8443
 - The benchmark runner itself, which confirms the framework responds to HTTP/3 requests via `oha`
 
 The static file endpoints are shared between HTTP/2 and HTTP/3 profiles - both serve on port 8443 with TLS.