From c826272d9135e25cea3661ba32862d33af3f9fac Mon Sep 17 00:00:00 2001
From: sebi <gore.sebyx@yahoo.com>
Date: Fri, 9 Oct 2026 09:28:13 -0500
Subject: [PATCH 1/3] =?UTF-8?q?feat(cli):=20the=20directory=20form=20is=20?=
 =?UTF-8?q?the=20one=20layout=20=E2=80=94=20X=5FLAYOUT=5FSIBLING=5FMODULE;?=
 =?UTF-8?q?=20both=20tracked=20apps=20migrated=20(#710=20row=2010)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

x verify's boundaries step refuses a module X.ts beside a directory X/.
examples/dummy's and the demo's flat actions/jobs/live/mutator files are
split one primitive per file into actions/, live/, queries/, jobs/ and
tasks/, registered module by module; docs say the directory form is the
one layout.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                                  |   6 +-
 README.md                                     |   4 +-
 docs/architecture/12-generated-app.md         |   6 +-
 docs/architecture/15-adding-a-feature.md      |   2 +-
 .../.claude/agents/web-dev.md                 |   2 +-
 .../.claude/commands/planx.md                 |   2 +-
 dummy/social-media-clone/apps/web/README.md   |   5 +-
 .../social-media-clone/apps/web/api/tasks.ts  |  11 +-
 .../apps/web/app/friends/actions.ts           | 102 -------
 .../web/app/friends/actions/block-user.ts     |  23 ++
 .../web/app/friends/actions/request-friend.ts |  25 ++
 .../web/app/friends/actions/respond-friend.ts |  39 +++
 .../web/app/friends/actions/unblock-user.ts   |  36 +++
 .../apps/web/app/friends/views.ts             |  32 +++
 .../apps/web/app/messages/action.test.ts      |   2 +-
 .../{action.ts => actions/send-message.ts}    |   6 +-
 .../apps/web/app/messages/live.test.ts        |   2 +-
 .../messages/{live.ts => live/live-thread.ts} |   6 +-
 .../apps/web/app/messages/topics.ts           |   2 +-
 .../mark-notifications-read.ts}               |   4 +-
 .../web/app/notifications/mutator.test.ts     |   2 +-
 .../apps/web/app/notifications/page.tsx       |   2 +-
 .../{live.ts => queries/inbox.ts}             |   8 +-
 .../apps/web/app/notifications/topics.ts      |   2 +-
 .../apps/web/app/tasks/errors.ts              |   2 +-
 .../apps/web/app/tasks/instant.ts             |  11 +
 .../apps/web/app/tasks/jobs.test.ts           |   3 +-
 .../apps/web/app/tasks/jobs/reset-demo.ts     |  44 +++
 .../{jobs.ts => jobs/sweep-orphan-media.ts}   |  50 +---
 .../apps/web/app/tasks/schedule.test.ts       |   3 +-
 .../web/app/tasks/tasks/hourly-demo-reset.ts  |  24 ++
 .../hourly-media-sweep.ts}                    |  19 +-
 examples/dummy/CLAUDE.md                      |  17 +-
 examples/dummy/README.md                      |  50 ++--
 examples/dummy/apps/web/api/index.ts          | 183 ++++++++----
 .../dummy/apps/web/app/auth/actions.test.ts   |   2 +-
 .../{actions.ts => actions/end-session.ts}    |   2 +-
 .../{actions.ts => actions/contact-sales.ts}  |   4 +-
 .../{jobs.ts => jobs/send-sales-receipt.ts}   |   2 +-
 .../apps/web/app/digest/jobs.job.test.ts      |   3 +-
 .../web/app/digest/jobs/deliver-digest.ts     |  90 ++++++
 .../digest/{jobs.ts => jobs/send-digest.ts}   | 106 ++-----
 .../digest/tasks/nightly-digest.ts}           |  25 +-
 examples/dummy/apps/web/app/feed/live.ts      |   2 +-
 examples/dummy/apps/web/app/layout.tsx        |   4 +-
 .../dummy/apps/web/app/mcp/jobs.job.test.ts   |   2 +-
 .../purge-mcp-confirmations.ts}               |   2 +-
 .../apps/web/app/mcp/tasks/hourly-purge.ts    |  18 ++
 examples/dummy/apps/web/app/models.test.ts    |   3 +-
 .../web/app/orgs/actions.contract.test.ts     |   2 +-
 examples/dummy/apps/web/app/orgs/actions.ts   |  89 ------
 .../app/orgs/actions/grant-avatar-upload.ts   |  27 ++
 .../web/app/orgs/actions/invite-member.ts     |  32 +++
 .../web/app/orgs/actions/member-avatar.ts     |  22 ++
 .../apps/web/app/orgs/actions/upgrade-plan.ts |  26 ++
 .../dummy/apps/web/app/orgs/jobs.job.test.ts  |   7 +-
 .../app/orgs/{jobs.ts => jobs/onboard-org.ts} |  40 +--
 .../apps/web/app/orgs/jobs/send-invite.ts     |  35 +++
 examples/dummy/apps/web/app/orgs/service.ts   |   2 +-
 .../dummy/apps/web/app/posts/[id]/page.tsx    |   2 +-
 .../web/app/posts/actions.contract.test.ts    |   6 +-
 .../dummy/apps/web/app/posts/actions.test.ts  |   6 +-
 examples/dummy/apps/web/app/posts/actions.ts  | 266 ------------------
 .../web/app/posts/actions/create-comment.ts   |  42 +++
 .../apps/web/app/posts/actions/create-post.ts |  27 ++
 .../app/posts/actions/keep-draft-review.ts    |  27 ++
 .../apps/web/app/posts/actions/like-post.ts   |  35 +++
 .../move-post-status.ts}                      |  52 ++--
 .../web/app/posts/actions/publish-post.ts     |  49 ++++
 .../app/posts/actions/request-draft-review.ts |  32 +++
 .../app/posts/actions/request-posts-export.ts |  32 +++
 .../web/app/posts/actions/review-draft.ts     |  48 ++++
 .../web/app/posts/actions/summarize-posts.ts  |  41 +++
 .../apps/web/app/posts/actions/summarize.ts   |  40 +++
 .../dummy/apps/web/app/posts/channel-ref.ts   |   4 +-
 .../dummy/apps/web/app/posts/jobs.job.test.ts |   5 +-
 .../{notifiers.ts => jobs/comment-posted.ts}  |   4 +-
 .../apps/web/app/posts/jobs/export-posts.ts   |  46 +++
 .../{jobs.ts => jobs/notify-subscribers.ts}   |  58 +---
 .../web/app/posts/jobs/review-draft-later.ts  |  25 ++
 .../dummy/apps/web/app/posts/like-mutation.ts |   4 +-
 .../apps/web/app/posts/live.live.test.ts      |   4 +-
 .../apps/web/app/posts/live.page.test.ts      |   2 +-
 examples/dummy/apps/web/app/posts/live.ts     | 218 --------------
 .../apps/web/app/posts/live/live-feed.ts      |  47 ++++
 examples/dummy/apps/web/app/posts/mail.ts     |   2 +-
 .../web/app/posts/mcp-drive.contract.test.ts  |   3 +-
 .../dummy/apps/web/app/posts/mutator.test.ts  |   3 +-
 .../apps/web/app/posts/notifiers.job.test.ts  |   4 +-
 .../web/app/posts/post-by-id.contract.test.ts |   2 +-
 .../web/app/posts/prompts/review-draft.ts     |   2 +-
 .../apps/web/app/posts/prompts/summarize.ts   |   4 +-
 .../app/posts/public-slugs.contract.test.ts   |   2 +-
 .../web/app/posts/queries/feed-activity.ts    |  24 ++
 .../apps/web/app/posts/queries/org-posts.ts   |  22 ++
 .../apps/web/app/posts/queries/post-by-id.ts  |  22 ++
 .../web/app/posts/queries/post-by-slug.ts     |  42 +++
 .../apps/web/app/posts/queries/post-record.ts |  59 ++++
 .../apps/web/app/posts/queries/post-review.ts |  43 +++
 .../app/posts/queries/public-post-slugs.ts    |  22 ++
 .../apps/web/app/posts/queries/public-post.ts |  46 +++
 .../web/app/posts/queries/public-posts.ts     |  46 +++
 examples/dummy/apps/web/app/posts/repo.ts     |   8 +-
 .../apps/web/app/posts/review.job.test.ts     |   4 +-
 .../dummy/apps/web/app/runs/actions.test.ts   |  14 +-
 examples/dummy/apps/web/app/runs/actions.ts   |  94 -------
 .../web/app/runs/actions/answer-prompt.ts     |  37 +++
 .../apps/web/app/runs/actions/cancel-run.ts   |  25 ++
 .../apps/web/app/runs/actions/connect-site.ts |  24 ++
 .../web/app/runs/actions/issue-run-key.ts     |  24 ++
 .../web/app/runs/actions/revoke-run-key.ts    |  23 ++
 .../apps/web/app/runs/actions/start-run.ts    |  28 ++
 examples/dummy/apps/web/app/runs/jobs.test.ts |   2 +-
 .../runs/{jobs.ts => jobs/sync-connection.ts} |  16 +-
 .../dummy/apps/web/app/runs/live.live.test.ts |   2 +-
 examples/dummy/apps/web/app/runs/live.test.ts |   3 +-
 .../runs/{live.ts => live/live-run-events.ts} |  42 +--
 .../web/app/runs/queries/run-connections.ts   |  33 +++
 .../apps/web/app/runs/runs.contract.test.ts   |   4 +-
 .../dummy/apps/web/app/runs/runs.job.test.ts  |   2 +-
 examples/dummy/apps/web/app/runs/runs.test.ts |   5 +-
 examples/dummy/apps/web/app/runs/service.ts   |   2 +-
 .../web/app/settings/actions.contract.test.ts |   2 +-
 .../dummy/apps/web/app/settings/actions.ts    |  63 -----
 .../app/settings/actions/save-preferences.ts  |  44 +++
 .../web/app/settings/actions/set-theme.ts     |  48 ++++
 .../app/settings/actions/subscribe-push.ts    |  29 ++
 .../settings/actions/toggle-digest-opt-in.ts  |  40 +++
 .../app/settings/actions/unsubscribe-push.ts  |  24 ++
 .../apps/web/app/settings/mutator.test.ts     |   3 +-
 .../dummy/apps/web/app/settings/mutator.ts    |  76 -----
 .../dummy/apps/web/app/webhooks/actions.ts    |  37 ---
 .../webhooks/actions/add-webhook-endpoint.ts  |  23 ++
 .../actions/remove-webhook-endpoint.ts        |  23 ++
 .../apps/web/app/webhooks/endpoints.test.ts   |   3 +-
 .../apps/web/app/webhooks/jobs.job.test.ts    |   6 +-
 .../post-published-webhook.ts}                |   6 +-
 .../dummy/apps/web/app/webhooks/service.ts    |   2 +-
 examples/dummy/apps/web/shared/services.ts    |   4 +-
 examples/dummy/apps/web/site/pricing/page.tsx |   2 +-
 framework.manifest.json                       |   7 +-
 packages/ai/README.md                         |   2 +-
 packages/cli/src/app-layout.test.ts           |  39 +++
 packages/cli/src/app-layout.ts                |  35 +++
 packages/cli/src/boundary-findings.test.ts    |  15 +-
 packages/cli/src/boundary-findings.ts         |   2 +
 packages/cli/src/error-codes.ts               |   2 +
 packages/cli/src/mcp-errors.ts                |   2 +
 scripts/primitive-factories-used.test.ts      |   2 +-
 scripts/set-cookie-literals.test.ts           |   4 +-
 scripts/wiki-fences-backlog.ts                |   4 +-
 wiki/Actions.md                               |   9 +-
 wiki/Agents.md                                |   2 +-
 wiki/Client-Data.md                           |   8 +-
 wiki/Error-Codes.md                           |   1 +
 wiki/Policies-And-Authz.md                    |   2 +-
 wiki/Project-Layout.md                        |   8 +-
 157 files changed, 2240 insertions(+), 1485 deletions(-)
 delete mode 100644 dummy/social-media-clone/apps/web/app/friends/actions.ts
 create mode 100644 dummy/social-media-clone/apps/web/app/friends/actions/block-user.ts
 create mode 100644 dummy/social-media-clone/apps/web/app/friends/actions/request-friend.ts
 create mode 100644 dummy/social-media-clone/apps/web/app/friends/actions/respond-friend.ts
 create mode 100644 dummy/social-media-clone/apps/web/app/friends/actions/unblock-user.ts
 create mode 100644 dummy/social-media-clone/apps/web/app/friends/views.ts
 rename dummy/social-media-clone/apps/web/app/messages/{action.ts => actions/send-message.ts} (95%)
 rename dummy/social-media-clone/apps/web/app/messages/{live.ts => live/live-thread.ts} (95%)
 rename dummy/social-media-clone/apps/web/app/notifications/{mutator.ts => actions/mark-notifications-read.ts} (97%)
 rename dummy/social-media-clone/apps/web/app/notifications/{live.ts => queries/inbox.ts} (74%)
 create mode 100644 dummy/social-media-clone/apps/web/app/tasks/instant.ts
 create mode 100644 dummy/social-media-clone/apps/web/app/tasks/jobs/reset-demo.ts
 rename dummy/social-media-clone/apps/web/app/tasks/{jobs.ts => jobs/sweep-orphan-media.ts} (50%)
 create mode 100644 dummy/social-media-clone/apps/web/app/tasks/tasks/hourly-demo-reset.ts
 rename dummy/social-media-clone/apps/web/app/tasks/{schedule.ts => tasks/hourly-media-sweep.ts} (69%)
 rename examples/dummy/apps/web/app/auth/{actions.ts => actions/end-session.ts} (97%)
 rename examples/dummy/apps/web/app/contact/{actions.ts => actions/contact-sales.ts} (96%)
 rename examples/dummy/apps/web/app/contact/{jobs.ts => jobs/send-sales-receipt.ts} (98%)
 create mode 100644 examples/dummy/apps/web/app/digest/jobs/deliver-digest.ts
 rename examples/dummy/apps/web/app/digest/{jobs.ts => jobs/send-digest.ts} (53%)
 rename examples/dummy/apps/web/{api/tasks.ts => app/digest/tasks/nightly-digest.ts} (56%)
 rename examples/dummy/apps/web/app/mcp/{jobs.ts => jobs/purge-mcp-confirmations.ts} (94%)
 create mode 100644 examples/dummy/apps/web/app/mcp/tasks/hourly-purge.ts
 delete mode 100644 examples/dummy/apps/web/app/orgs/actions.ts
 create mode 100644 examples/dummy/apps/web/app/orgs/actions/grant-avatar-upload.ts
 create mode 100644 examples/dummy/apps/web/app/orgs/actions/invite-member.ts
 create mode 100644 examples/dummy/apps/web/app/orgs/actions/member-avatar.ts
 create mode 100644 examples/dummy/apps/web/app/orgs/actions/upgrade-plan.ts
 rename examples/dummy/apps/web/app/orgs/{jobs.ts => jobs/onboard-org.ts} (53%)
 create mode 100644 examples/dummy/apps/web/app/orgs/jobs/send-invite.ts
 delete mode 100644 examples/dummy/apps/web/app/posts/actions.ts
 create mode 100644 examples/dummy/apps/web/app/posts/actions/create-comment.ts
 create mode 100644 examples/dummy/apps/web/app/posts/actions/create-post.ts
 create mode 100644 examples/dummy/apps/web/app/posts/actions/keep-draft-review.ts
 create mode 100644 examples/dummy/apps/web/app/posts/actions/like-post.ts
 rename examples/dummy/apps/web/app/posts/{mutator.ts => actions/move-post-status.ts} (55%)
 create mode 100644 examples/dummy/apps/web/app/posts/actions/publish-post.ts
 create mode 100644 examples/dummy/apps/web/app/posts/actions/request-draft-review.ts
 create mode 100644 examples/dummy/apps/web/app/posts/actions/request-posts-export.ts
 create mode 100644 examples/dummy/apps/web/app/posts/actions/review-draft.ts
 create mode 100644 examples/dummy/apps/web/app/posts/actions/summarize-posts.ts
 create mode 100644 examples/dummy/apps/web/app/posts/actions/summarize.ts
 rename examples/dummy/apps/web/app/posts/{notifiers.ts => jobs/comment-posted.ts} (96%)
 create mode 100644 examples/dummy/apps/web/app/posts/jobs/export-posts.ts
 rename examples/dummy/apps/web/app/posts/{jobs.ts => jobs/notify-subscribers.ts} (62%)
 create mode 100644 examples/dummy/apps/web/app/posts/jobs/review-draft-later.ts
 delete mode 100644 examples/dummy/apps/web/app/posts/live.ts
 create mode 100644 examples/dummy/apps/web/app/posts/live/live-feed.ts
 create mode 100644 examples/dummy/apps/web/app/posts/queries/feed-activity.ts
 create mode 100644 examples/dummy/apps/web/app/posts/queries/org-posts.ts
 create mode 100644 examples/dummy/apps/web/app/posts/queries/post-by-id.ts
 create mode 100644 examples/dummy/apps/web/app/posts/queries/post-by-slug.ts
 create mode 100644 examples/dummy/apps/web/app/posts/queries/post-record.ts
 create mode 100644 examples/dummy/apps/web/app/posts/queries/post-review.ts
 create mode 100644 examples/dummy/apps/web/app/posts/queries/public-post-slugs.ts
 create mode 100644 examples/dummy/apps/web/app/posts/queries/public-post.ts
 create mode 100644 examples/dummy/apps/web/app/posts/queries/public-posts.ts
 delete mode 100644 examples/dummy/apps/web/app/runs/actions.ts
 create mode 100644 examples/dummy/apps/web/app/runs/actions/answer-prompt.ts
 create mode 100644 examples/dummy/apps/web/app/runs/actions/cancel-run.ts
 create mode 100644 examples/dummy/apps/web/app/runs/actions/connect-site.ts
 create mode 100644 examples/dummy/apps/web/app/runs/actions/issue-run-key.ts
 create mode 100644 examples/dummy/apps/web/app/runs/actions/revoke-run-key.ts
 create mode 100644 examples/dummy/apps/web/app/runs/actions/start-run.ts
 rename examples/dummy/apps/web/app/runs/{jobs.ts => jobs/sync-connection.ts} (96%)
 rename examples/dummy/apps/web/app/runs/{live.ts => live/live-run-events.ts} (50%)
 create mode 100644 examples/dummy/apps/web/app/runs/queries/run-connections.ts
 delete mode 100644 examples/dummy/apps/web/app/settings/actions.ts
 create mode 100644 examples/dummy/apps/web/app/settings/actions/save-preferences.ts
 create mode 100644 examples/dummy/apps/web/app/settings/actions/set-theme.ts
 create mode 100644 examples/dummy/apps/web/app/settings/actions/subscribe-push.ts
 create mode 100644 examples/dummy/apps/web/app/settings/actions/toggle-digest-opt-in.ts
 create mode 100644 examples/dummy/apps/web/app/settings/actions/unsubscribe-push.ts
 delete mode 100644 examples/dummy/apps/web/app/settings/mutator.ts
 delete mode 100644 examples/dummy/apps/web/app/webhooks/actions.ts
 create mode 100644 examples/dummy/apps/web/app/webhooks/actions/add-webhook-endpoint.ts
 create mode 100644 examples/dummy/apps/web/app/webhooks/actions/remove-webhook-endpoint.ts
 rename examples/dummy/apps/web/app/webhooks/{jobs.ts => jobs/post-published-webhook.ts} (95%)
 create mode 100644 packages/cli/src/app-layout.test.ts
 create mode 100644 packages/cli/src/app-layout.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 61c159d66..7cace0356 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,7 +8,11 @@ Semver applies from 1.0.0. A breaking change to a documented API needs a major 
 
 ## [Unreleased]
 
-Nothing yet.
+### Added
+
+Tier 5 — cli. Both tracked apps.
+
+- **The generator's directory form is the one layout (#710, owner decision 10).** One primitive per file, in its kind's directory — `<slice>/actions/<name>.ts`, `live/`, `queries/`, `jobs/`, `tasks/` — what `x g` writes. `x verify`'s `boundaries` step now refuses a module `X.ts` beside a directory `X/` in an app's surfaces (`X_LAYOUT_SIBLING_MODULE`): `./actions` resolves to the file and never the directory, so the two homes disagree silently. Both tracked apps migrated: `examples/dummy`'s 56 primitives and the demo's 11 each in their own file (`api/tasks.ts`'s two tasks moved into their slices' `tasks/`), registered module by module in `api/index.ts`. `docs/architecture/12-generated-app.md`, `wiki/Project-Layout.md` and `wiki/Actions.md` say so. An app that keeps `actions.ts` with no `actions/` beside it is not refused.
 
 ## 27.2.3 - 2026-10-09
 
diff --git a/README.md b/README.md
index 20f343340..05936858a 100644
--- a/README.md
+++ b/README.md
@@ -326,7 +326,7 @@ An agent's scarcest resource is context, and most of it goes on infrastructure t
 |---|---|
 | everything the author owns, 218 files | **9,712** code lines |
 | production only, tests excluded | **7,230** |
-| a fully-projected endpoint — input schema, output schema, policy, OpenAPI operation, MCP tool, typed client | **~16 code lines**, from 4 actions in [`app/friends/actions.ts`](dummy/social-media-clone/apps/web/app/friends/actions.ts) |
+| a fully-projected endpoint — input schema, output schema, policy, OpenAPI operation, MCP tool, typed client | **~16 code lines**, from 4 actions in [`app/friends/actions/`](dummy/social-media-clone/apps/web/app/friends/actions/) |
 | one action, 51 code lines | **179 lines** of committed generated interface — OpenAPI operation, two JSON Schemas, the manifest row — plus five handles it never declares |
 
 Re-derive it — `node_modules`, `.x/`, `dist/` and `coverage/` are gitignored, so `git ls-files` never enters them:
@@ -353,7 +353,7 @@ The 1,767 generated Lucide glyph files are excluded on purpose — leaving them
 | that the demo passes its own gate | it is **pinned red on 2 steps**, `As of 2026-09-23` — `boundaries` (`X_BOUNDARY_SITE_TO_APP` ×3, the static feed importing the authed post service) and `budgets` (`X_BUDGET_UNMEASURED`, no `.x/build-stats.json` has ever existed there). It was 3: `drift` came off when the migration reconciling its foreign keys landed. [`examples/dummy`](examples/dummy/README.md) is pinned on 1 step — `budgets`. The pins and their reasons are [`scripts/lib/gated-apps.ts`](scripts/lib/gated-apps.ts); `bun run scripts/reference-app-gate.ts` re-derives them |
 | that low lines means high leverage | partly it means **few features**. Roughly half of [`DOMAIN.md`](dummy/social-media-clone/DOMAIN.md) is a plan, not a build: `likes` and `comments` are entities with migrations and no write path |
 | that the framework wrote the auth | it did not. 13 non-test files hand-write argon2id parameters, `__Host-` cookie prefixes, session token hashing and a captcha, and **`@ultimat3/auth` is imported nowhere in that app**. `@ultimat3/storage` likewise, despite a media feature. The largest thing the framework could have projected and did not |
-| that live messaging works | the thread's live query ([`app/messages/live.ts`](dummy/social-media-clone/apps/web/app/messages/live.ts)) and its channel ([`app/messages/topics.ts`](dummy/social-media-clone/apps/web/app/messages/topics.ts)) are declared and tested against a real hub, and **no island subscribes to either** — there is no `useChannel` or `useQuery` in the app — and the deployed stack runs no `sync` role, `As of 2026-09-23` |
+| that live messaging works | the thread's live query ([`app/messages/live/`](dummy/social-media-clone/apps/web/app/messages/live/)) and its channel ([`app/messages/topics.ts`](dummy/social-media-clone/apps/web/app/messages/topics.ts)) are declared and tested against a real hub, and **no island subscribes to either** — there is no `useChannel` or `useQuery` in the app — and the deployed stack runs no `sync` role, `As of 2026-09-23` |
 | that the typed client is proven | it is projected and unused. There is **no `.client()` call in either tracked app**; the demo's forms post HTML |
 
 **The larger win is not the lines** — it is that a bug is found once, here, where the fix reaches every app at once. The sweeps in [`CHANGELOG.md`](CHANGELOG.md) closed defects of exactly that kind:
diff --git a/docs/architecture/12-generated-app.md b/docs/architecture/12-generated-app.md
index 1ee4c2419..ae64b5941 100644
--- a/docs/architecture/12-generated-app.md
+++ b/docs/architecture/12-generated-app.md
@@ -120,10 +120,10 @@ apps/web/app/<features>/page.tsx the route, at the plural URL
 | `queries/` | one `query` per file, not subscribable | writes |
 | `jobs/` | one `job` per file | inline slow work in an action |
 | `tasks/` | one `task` per file — a cron trigger that enqueues a job | doing the work itself |
-| `ui.tsx`, `ui/` | Solid components | fetching, business logic, its own authz |
+| `ui.tsx` or `ui/` | Solid components | fetching, business logic, its own authz |
 | `admin/resource.ts` | list columns, title key, page size | a second authz path |
 
-`x g` writes one primitive per file: `actions/<verb>-post.ts`, `live/<name>.ts`, `queries/<name>.ts`, `jobs/<verb>-post.ts`, `tasks/<name>.ts`. A primitive is registered by `defineApi()` and found by the module scan, never by its filename, so a feature may equally keep several declarations in one file — `examples/dummy` keeps one `actions.ts` per feature — and nothing enforces either layout ([Project layout](../../wiki/Project-Layout.md#feature-slicing-inside-a-surface) names the filenames that ARE enforced). The flat files are the ones there is exactly one of per feature.
+`x g` writes one primitive per file: `actions/<verb>-post.ts`, `live/<name>.ts`, `queries/<name>.ts`, `jobs/<verb>-post.ts`, `tasks/<name>.ts`, each named for its export in kebab case. **That directory form is the one layout** (`As of 2026-10`, owner decision 10 of #648): both tracked apps use it, and a module `X.ts` beside a directory `X/` is refused — `X_LAYOUT_SIBLING_MODULE`, in the `boundaries` step — because `./actions` resolves to the file and never the directory. A factory's kind decides its directory: a mutator, a `transition()` and an `llm()`/`agent()`/`hive()` call are actions; a `backfill()` keeps `backfills/`, and every other job factory is a job. A primitive is registered by `defineApi()` and found by the module scan, never by its filename ([Project layout](../../wiki/Project-Layout.md#feature-slicing-inside-a-surface) names the filenames that ARE enforced). The flat files are the ones there is exactly one of per feature.
 
 The folder is the name passed to `x g resource`; the route is its plural, because a collection URL is plural — `x g resource post` writes the slice to `apps/web/app/post/` and the page to `apps/web/app/posts/page.tsx`.
 
@@ -152,7 +152,7 @@ this file a route?" mechanically decidable from the filename alone.
 
 **`api/` holds the action and query projections, and no route file.** An action, mutator, query,
 job or task reaches HTTP through `defineApi()`, not through a filename: those modules keep whatever
-name their feature gives them (`app/posts/actions.ts`, `app/digest/jobs.ts`, …) and
+name their feature gives them (`app/posts/actions/create-post.ts`, `app/digest/jobs/send-digest.ts`, …) and
 `apps/web/api/index.ts` collects them into one `defineApi()` call, which projects the HTTP routes,
 `openapi.json`, the typed client and the job handles.
 
diff --git a/docs/architecture/15-adding-a-feature.md b/docs/architecture/15-adding-a-feature.md
index ae97f2958..9481593a2 100644
--- a/docs/architecture/15-adding-a-feature.md
+++ b/docs/architecture/15-adding-a-feature.md
@@ -43,7 +43,7 @@ x g resource post --admin
 
 Generates schema, entity, repo, service, policy, actions, live query, job stub, components, the form island, the `posts` page, i18n keys, admin screens, MCP entries, and the tests beside each. The page is reachable as written: its `load` reads the list through the slice's query as the request's actor, `AsyncRegion` renders ready, empty and refused, and the form island posts to `createPost`. `x g` ends by printing what the new table owes (`x db gen`, `x db migrate`) and the build that weighs the page against its budget. Everything below is *editing* generated files — not creating them.
 
-`x g` writes one primitive per file: `actions/<verb>-post.ts`, `live/<name>.ts`, `queries/<name>.ts`, `jobs/<verb>-post.ts`, `tasks/<name>.ts`. A primitive is registered by `defineApi()` and found by the module scan, never by its filename, so a feature may equally keep several declarations in one file — `examples/dummy` keeps one `actions.ts` per feature — and nothing enforces either layout ([Project layout](../../wiki/Project-Layout.md#feature-slicing-inside-a-surface) names the filenames that ARE enforced). `x g resource <name>` takes no `--feature`: the name is the slice (`X_CLI_BAD_FLAG`).
+`x g` writes one primitive per file: `actions/<verb>-post.ts`, `live/<name>.ts`, `queries/<name>.ts`, `jobs/<verb>-post.ts`, `tasks/<name>.ts`. That directory form is the one layout: a second primitive is a second file, and a module `X.ts` beside a directory `X/` is `X_LAYOUT_SIBLING_MODULE` ([Project layout](../../wiki/Project-Layout.md#feature-slicing-inside-a-surface) names the filenames that ARE enforced). `x g resource <name>` takes no `--feature`: the name is the slice (`X_CLI_BAD_FLAG`).
 
 ## 2. Entity + invariants
 
diff --git a/dummy/social-media-clone/.claude/agents/web-dev.md b/dummy/social-media-clone/.claude/agents/web-dev.md
index 3c695aa98..36f87de91 100644
--- a/dummy/social-media-clone/.claude/agents/web-dev.md
+++ b/dummy/social-media-clone/.claude/agents/web-dev.md
@@ -6,7 +6,7 @@ tools: Read, Edit, Write, Bash, Grep, Glob
 
 You own `apps/web/site/**`, `apps/web/app/**/page.tsx`, `apps/web/app/**/ui/**`, `*.module.scss`,
 `apps/web/shared/tokens.scss` and `packages/i18n/catalogs/**`. You do **not** own `policy.ts`,
-`actions.ts`, `live.ts`, `jobs.ts`, `repo.ts` or `packages/db` — stop and report if you need them.
+`actions/`, `live/`, `queries/`, `jobs/`, `tasks/`, `repo.ts` or `packages/db` — stop and report if you need them.
 
 **The surface decides the rules.**
 
diff --git a/dummy/social-media-clone/.claude/commands/planx.md b/dummy/social-media-clone/.claude/commands/planx.md
index 141477083..449f0e5b2 100644
--- a/dummy/social-media-clone/.claude/commands/planx.md
+++ b/dummy/social-media-clone/.claude/commands/planx.md
@@ -39,7 +39,7 @@ One or two sentences: what, and why.
 
 ## Context
 - Only the facts the executor needs.
-- Pattern to follow: `apps/web/app/posts/actions.ts:33` — copy this shape.
+- Pattern to follow: `apps/web/app/friends/actions/request-friend.ts` — copy this shape.
 
 ## Slices (execute in order)
 1. [`01-<aspect>.md`](01-<aspect>.md) — one line, and the exclusive file set it owns.
diff --git a/dummy/social-media-clone/apps/web/README.md b/dummy/social-media-clone/apps/web/README.md
index a5ac53e02..49bba7df6 100644
--- a/dummy/social-media-clone/apps/web/README.md
+++ b/dummy/social-media-clone/apps/web/README.md
@@ -16,8 +16,9 @@ applies migrations and exits.
 **The directory is the URL.** `app/posts/[id]/page.tsx` is `/posts/:id`. The filename never
 contributes — `page.tsx` on `site/`/`app/`, `route.ts` on `api/`, and nothing else is a route.
 
-A feature slice is one directory holding `entity.ts`, `policy.ts`, `actions.ts`, `mutator.ts`,
-`live.ts`, `jobs.ts`, `service.ts`, `repo.ts`, `errors.ts` and `ui/`. Each file has one job, and
+A feature slice is one directory holding `entity.ts`, `policy.ts`, `service.ts`, `repo.ts`,
+`errors.ts`, `ui/`, and one primitive per file under `actions/`, `live/`, `queries/`, `jobs/` and
+`tasks/` — the layout `x g` writes, and the only one (`X_LAYOUT_SIBLING_MODULE`). Each file has one job, and
 only `repo.ts` writes SQL. There is no `lib/`, `utils/` or `helpers/` — those names mean the code
 has no owner.
 
diff --git a/dummy/social-media-clone/apps/web/api/tasks.ts b/dummy/social-media-clone/apps/web/api/tasks.ts
index 159ed5ba5..baa9dd6cf 100644
--- a/dummy/social-media-clone/apps/web/api/tasks.ts
+++ b/dummy/social-media-clone/apps/web/api/tasks.ts
@@ -4,7 +4,12 @@
 // `defineApi`'s own ordering, because a task descriptor lists the jobs it enqueues by name.
 
 import { defineApi } from '@ultimat3/action';
-import * as taskJobs from '../app/tasks/jobs';
-import * as taskSchedule from '../app/tasks/schedule';
+import * as resetDemo from '../app/tasks/jobs/reset-demo';
+import * as sweepOrphanMedia from '../app/tasks/jobs/sweep-orphan-media';
+import * as hourlyDemoReset from '../app/tasks/tasks/hourly-demo-reset';
+import * as hourlyMediaSweep from '../app/tasks/tasks/hourly-media-sweep';
 
-export const scheduledApi = defineApi({ jobs: taskJobs, tasks: taskSchedule });
+export const scheduledApi = defineApi({
+  jobs: [sweepOrphanMedia, resetDemo],
+  tasks: [hourlyMediaSweep, hourlyDemoReset],
+});
diff --git a/dummy/social-media-clone/apps/web/app/friends/actions.ts b/dummy/social-media-clone/apps/web/app/friends/actions.ts
deleted file mode 100644
index 6e44fb781..000000000
--- a/dummy/social-media-clone/apps/web/app/friends/actions.ts
+++ /dev/null
@@ -1,102 +0,0 @@
-// The social graph's four commands. Declarations only — every body delegates to `./service`, so the
-// same logic runs whether the caller is HTTP, the typed client, a job, an MCP tool or admin.
-//
-// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package. Each
-// `row:` loader is the async half authz is not allowed to have — it runs once per invocation, and
-// the predicate that reads its result stays synchronous.
-
-import { FRIENDSHIP_STATUSES } from '@social-media-clone/domain';
-import { action, t } from '@ultimat3/action';
-import type { BlockRow, FriendshipRow, PersonRow } from './policy';
-import { blockCreate, blockDelete, friendRequest, friendRespond } from './policy';
-import { blockEdge, friendshipEdge, personById } from './repo';
-import { blockPerson, requestFriendship, respondToFriendship, unblockPerson } from './service';
-
-/** The row shape every friendship command answers with. Derived from the entity's own columns. */
-const FriendshipView = t.object({
-  requesterId: t.uuid,
-  addresseeId: t.uuid,
-  status: t.enumerated(...FRIENDSHIP_STATUSES),
-  respondedAt: t.nullable(t.date),
-  createdAt: t.date,
-});
-
-const BlockView = t.object({ blockerId: t.uuid, blockedId: t.uuid, createdAt: t.date });
-
-/**
- * The loader narrows to exactly what the rule reads. Handing the whole `User` row to a policy would
- * put a bio and an email inside an authz decision, and a denial `reason` is allowed to name a
- * permission but never row data.
- */
-const personRow = async ({ input }: { input: { userId: string } }): Promise<PersonRow | null> => {
-  const person = await personById(input.userId);
-  return person === null ? null : { id: person.id };
-};
-
-export const requestFriend = action({
-  input: t.object({ userId: t.uuid }),
-  output: FriendshipView,
-  policy: friendRequest,
-  // `null` here means "no such person", which is a denial and not a 404 later: the rule decides
-  // once, and a surface that passed no row cannot slip past it.
-  row: personRow,
-  idempotent: true,
-  mcp: { expose: true, description: 'Ask another user to be friends' },
-  handle: ({ input, ctx }) => requestFriendship(ctx.actor.id, input.userId, ctx.now()),
-});
-
-export const respondFriend = action({
-  // `decision` is a string, not a boolean: this action is reachable from a plain HTML form (the
-  // screen has no client JS), and a form sends "true", not `true`. A string the schema already
-  // constrains beats a boolean that only a JSON client can spell.
-  input: t.object({ requesterId: t.uuid, decision: t.enumerated('accept', 'decline') }),
-  output: FriendshipView,
-  policy: friendRespond,
-  /**
-   * Loaded by `addresseeId = the caller`, which is what makes "only the addressee may answer"
-   * structural as well as declared: a request addressed to somebody else resolves to `null` here
-   * and `friendRespond` denies on it, so the rule never has to trust the input's word for it.
-   */
-  row: async ({ input, ctx }): Promise<FriendshipRow | null> => {
-    const row = await friendshipEdge(input.requesterId, ctx.actor.id);
-    return row === null
-      ? null
-      : { requesterId: row.requesterId, addresseeId: row.addresseeId, status: row.status };
-  },
-  idempotent: true,
-  mcp: { expose: true, description: 'Accept or decline a friend request addressed to the caller' },
-  handle: ({ input, ctx }) =>
-    respondToFriendship(ctx.actor.id, input.requesterId, input.decision === 'accept', ctx.now()),
-});
-
-export const blockUser = action({
-  input: t.object({ userId: t.uuid }),
-  output: BlockView,
-  policy: blockCreate,
-  row: personRow,
-  idempotent: true,
-  mcp: { expose: true, description: 'Block a user and decline any friendship between them' },
-  handle: ({ input, ctx }) => blockPerson(ctx.actor.id, input.userId, ctx.now()),
-});
-
-/**
- * The mirror of `blockUser`. The UI decides whether to render an "Unblock" control from
- * `blockDelete` with this same row, and one decision both renders the button and answers the call.
- *
- * The output is the PAIR, not whether a row went: the action is idempotent, so a second submit —
- * a double click, a retry, a queued MCP call — has to answer the same document as the first.
- */
-export const unblockUser = action({
-  input: t.object({ userId: t.uuid }),
-  output: t.object({ blockerId: t.uuid, blockedId: t.uuid }),
-  policy: blockDelete,
-  row: async ({ input, ctx }): Promise<BlockRow | null> => {
-    const row = await blockEdge(ctx.actor.id, input.userId);
-    return row === null ? null : { blockerId: row.blockerId, blockedId: row.blockedId };
-  },
-  mcp: { expose: true, description: 'Lift a block this user placed' },
-  handle: async ({ input, ctx }) => {
-    await unblockPerson(ctx.actor.id, input.userId);
-    return { blockerId: ctx.actor.id, blockedId: input.userId };
-  },
-});
diff --git a/dummy/social-media-clone/apps/web/app/friends/actions/block-user.ts b/dummy/social-media-clone/apps/web/app/friends/actions/block-user.ts
new file mode 100644
index 000000000..27b787c53
--- /dev/null
+++ b/dummy/social-media-clone/apps/web/app/friends/actions/block-user.ts
@@ -0,0 +1,23 @@
+// `blockUser`, the friends slice's action — one primitive per file, the layout `x g` writes.
+//
+// The social graph's four commands. Declarations only — every body delegates to `./service`, so the
+// same logic runs whether the caller is HTTP, the typed client, a job, an MCP tool or admin.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package. Each
+// `row:` loader is the async half authz is not allowed to have — it runs once per invocation, and
+// the predicate that reads its result stays synchronous.
+
+import { action, t } from '@ultimat3/action';
+import { blockCreate } from '../policy';
+import { blockPerson } from '../service';
+import { BlockView, personRow } from '../views';
+
+export const blockUser = action({
+  input: t.object({ userId: t.uuid }),
+  output: BlockView,
+  policy: blockCreate,
+  row: personRow,
+  idempotent: true,
+  mcp: { expose: true, description: 'Block a user and decline any friendship between them' },
+  handle: ({ input, ctx }) => blockPerson(ctx.actor.id, input.userId, ctx.now()),
+});
diff --git a/dummy/social-media-clone/apps/web/app/friends/actions/request-friend.ts b/dummy/social-media-clone/apps/web/app/friends/actions/request-friend.ts
new file mode 100644
index 000000000..337ecee05
--- /dev/null
+++ b/dummy/social-media-clone/apps/web/app/friends/actions/request-friend.ts
@@ -0,0 +1,25 @@
+// `requestFriend`, the friends slice's action — one primitive per file, the layout `x g` writes.
+//
+// The social graph's four commands. Declarations only — every body delegates to `./service`, so the
+// same logic runs whether the caller is HTTP, the typed client, a job, an MCP tool or admin.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package. Each
+// `row:` loader is the async half authz is not allowed to have — it runs once per invocation, and
+// the predicate that reads its result stays synchronous.
+
+import { action, t } from '@ultimat3/action';
+import { friendRequest } from '../policy';
+import { requestFriendship } from '../service';
+import { FriendshipView, personRow } from '../views';
+
+export const requestFriend = action({
+  input: t.object({ userId: t.uuid }),
+  output: FriendshipView,
+  policy: friendRequest,
+  // `null` here means "no such person", which is a denial and not a 404 later: the rule decides
+  // once, and a surface that passed no row cannot slip past it.
+  row: personRow,
+  idempotent: true,
+  mcp: { expose: true, description: 'Ask another user to be friends' },
+  handle: ({ input, ctx }) => requestFriendship(ctx.actor.id, input.userId, ctx.now()),
+});
diff --git a/dummy/social-media-clone/apps/web/app/friends/actions/respond-friend.ts b/dummy/social-media-clone/apps/web/app/friends/actions/respond-friend.ts
new file mode 100644
index 000000000..4f21b82c1
--- /dev/null
+++ b/dummy/social-media-clone/apps/web/app/friends/actions/respond-friend.ts
@@ -0,0 +1,39 @@
+// `respondFriend`, the friends slice's action — one primitive per file, the layout `x g` writes.
+//
+// The social graph's four commands. Declarations only — every body delegates to `./service`, so the
+// same logic runs whether the caller is HTTP, the typed client, a job, an MCP tool or admin.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package. Each
+// `row:` loader is the async half authz is not allowed to have — it runs once per invocation, and
+// the predicate that reads its result stays synchronous.
+
+import { action, t } from '@ultimat3/action';
+import type { FriendshipRow } from '../policy';
+import { friendRespond } from '../policy';
+import { friendshipEdge } from '../repo';
+import { respondToFriendship } from '../service';
+import { FriendshipView } from '../views';
+
+export const respondFriend = action({
+  // `decision` is a string, not a boolean: this action is reachable from a plain HTML form (the
+  // screen has no client JS), and a form sends "true", not `true`. A string the schema already
+  // constrains beats a boolean that only a JSON client can spell.
+  input: t.object({ requesterId: t.uuid, decision: t.enumerated('accept', 'decline') }),
+  output: FriendshipView,
+  policy: friendRespond,
+  /**
+   * Loaded by `addresseeId = the caller`, which is what makes "only the addressee may answer"
+   * structural as well as declared: a request addressed to somebody else resolves to `null` here
+   * and `friendRespond` denies on it, so the rule never has to trust the input's word for it.
+   */
+  row: async ({ input, ctx }): Promise<FriendshipRow | null> => {
+    const row = await friendshipEdge(input.requesterId, ctx.actor.id);
+    return row === null
+      ? null
+      : { requesterId: row.requesterId, addresseeId: row.addresseeId, status: row.status };
+  },
+  idempotent: true,
+  mcp: { expose: true, description: 'Accept or decline a friend request addressed to the caller' },
+  handle: ({ input, ctx }) =>
+    respondToFriendship(ctx.actor.id, input.requesterId, input.decision === 'accept', ctx.now()),
+});
diff --git a/dummy/social-media-clone/apps/web/app/friends/actions/unblock-user.ts b/dummy/social-media-clone/apps/web/app/friends/actions/unblock-user.ts
new file mode 100644
index 000000000..cb0297be6
--- /dev/null
+++ b/dummy/social-media-clone/apps/web/app/friends/actions/unblock-user.ts
@@ -0,0 +1,36 @@
+// `unblockUser`, the friends slice's action — one primitive per file, the layout `x g` writes.
+//
+// The social graph's four commands. Declarations only — every body delegates to `./service`, so the
+// same logic runs whether the caller is HTTP, the typed client, a job, an MCP tool or admin.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package. Each
+// `row:` loader is the async half authz is not allowed to have — it runs once per invocation, and
+// the predicate that reads its result stays synchronous.
+
+import { action, t } from '@ultimat3/action';
+import type { BlockRow } from '../policy';
+import { blockDelete } from '../policy';
+import { blockEdge } from '../repo';
+import { unblockPerson } from '../service';
+
+/**
+ * The mirror of `blockUser`. The UI decides whether to render an "Unblock" control from
+ * `blockDelete` with this same row, and one decision both renders the button and answers the call.
+ *
+ * The output is the PAIR, not whether a row went: the action is idempotent, so a second submit —
+ * a double click, a retry, a queued MCP call — has to answer the same document as the first.
+ */
+export const unblockUser = action({
+  input: t.object({ userId: t.uuid }),
+  output: t.object({ blockerId: t.uuid, blockedId: t.uuid }),
+  policy: blockDelete,
+  row: async ({ input, ctx }): Promise<BlockRow | null> => {
+    const row = await blockEdge(ctx.actor.id, input.userId);
+    return row === null ? null : { blockerId: row.blockerId, blockedId: row.blockedId };
+  },
+  mcp: { expose: true, description: 'Lift a block this user placed' },
+  handle: async ({ input, ctx }) => {
+    await unblockPerson(ctx.actor.id, input.userId);
+    return { blockerId: ctx.actor.id, blockedId: input.userId };
+  },
+});
diff --git a/dummy/social-media-clone/apps/web/app/friends/views.ts b/dummy/social-media-clone/apps/web/app/friends/views.ts
new file mode 100644
index 000000000..10ec29f88
--- /dev/null
+++ b/dummy/social-media-clone/apps/web/app/friends/views.ts
@@ -0,0 +1,32 @@
+// The friends slice's action outputs, shared by its actions: what a friendship and a block
+// answer as, and the person row both name.
+
+import { FRIENDSHIP_STATUSES } from '@social-media-clone/domain';
+import { t } from '@ultimat3/action';
+import type { PersonRow } from './policy';
+import { personById } from './repo';
+
+/** The row shape every friendship command answers with. Derived from the entity's own columns. */
+export const FriendshipView = t.object({
+  requesterId: t.uuid,
+  addresseeId: t.uuid,
+  status: t.enumerated(...FRIENDSHIP_STATUSES),
+  respondedAt: t.nullable(t.date),
+  createdAt: t.date,
+});
+
+export const BlockView = t.object({ blockerId: t.uuid, blockedId: t.uuid, createdAt: t.date });
+
+/**
+ * The loader narrows to exactly what the rule reads. Handing the whole `User` row to a policy would
+ * put a bio and an email inside an authz decision, and a denial `reason` is allowed to name a
+ * permission but never row data.
+ */
+export const personRow = async ({
+  input,
+}: {
+  input: { userId: string };
+}): Promise<PersonRow | null> => {
+  const person = await personById(input.userId);
+  return person === null ? null : { id: person.id };
+};
diff --git a/dummy/social-media-clone/apps/web/app/messages/action.test.ts b/dummy/social-media-clone/apps/web/app/messages/action.test.ts
index 022eed4c6..f9b0ef015 100644
--- a/dummy/social-media-clone/apps/web/app/messages/action.test.ts
+++ b/dummy/social-media-clone/apps/web/app/messages/action.test.ts
@@ -9,7 +9,7 @@ import { db } from '@social-media-clone/db';
 import { ctxOf, isUltimateError, userActor } from '@ultimat3/core';
 import type { Actor } from '@ultimat3/policy';
 import { expect, unitTest } from '@ultimat3/testing';
-import { sendMessage } from './action';
+import { sendMessage } from './actions/send-message';
 import * as repo from './repo';
 
 const ADA = '00000000-0000-4000-8000-0000000000a1';
diff --git a/dummy/social-media-clone/apps/web/app/messages/action.ts b/dummy/social-media-clone/apps/web/app/messages/actions/send-message.ts
similarity index 95%
rename from dummy/social-media-clone/apps/web/app/messages/action.ts
rename to dummy/social-media-clone/apps/web/app/messages/actions/send-message.ts
index f4e589317..a62ea4045 100644
--- a/dummy/social-media-clone/apps/web/app/messages/action.ts
+++ b/dummy/social-media-clone/apps/web/app/messages/actions/send-message.ts
@@ -7,9 +7,9 @@
 import { BODY_MAX } from '@social-media-clone/domain';
 import { action, t } from '@ultimat3/action';
 import { actorOf } from '@ultimat3/core';
-import * as notifications from '../notifications/repo';
-import { messageSend } from './policy';
-import * as repo from './repo';
+import * as notifications from '../../notifications/repo';
+import { messageSend } from '../policy';
+import * as repo from '../repo';
 
 export const sendMessage = action({
   input: t.object({
diff --git a/dummy/social-media-clone/apps/web/app/messages/live.test.ts b/dummy/social-media-clone/apps/web/app/messages/live.test.ts
index 4a3cd9492..a52ebdfae 100644
--- a/dummy/social-media-clone/apps/web/app/messages/live.test.ts
+++ b/dummy/social-media-clone/apps/web/app/messages/live.test.ts
@@ -8,7 +8,7 @@
 import { ctxOf, userActor } from '@ultimat3/core';
 import type { Actor } from '@ultimat3/policy';
 import { expect, liveTest, unitTest } from '@ultimat3/testing';
-import { liveThread } from './live';
+import { liveThread } from './live/live-thread';
 import { THREAD_PAGE } from './repo';
 
 const ROOM = '00000000-0000-4000-8000-0000000000f3';
diff --git a/dummy/social-media-clone/apps/web/app/messages/live.ts b/dummy/social-media-clone/apps/web/app/messages/live/live-thread.ts
similarity index 95%
rename from dummy/social-media-clone/apps/web/app/messages/live.ts
rename to dummy/social-media-clone/apps/web/app/messages/live/live-thread.ts
index bc52dea79..27bad358c 100644
--- a/dummy/social-media-clone/apps/web/app/messages/live.ts
+++ b/dummy/social-media-clone/apps/web/app/messages/live/live-thread.ts
@@ -13,9 +13,9 @@
 // `t` comes from @ultimat3/query, not @ultimat3/schema: a query file imports one package.
 
 import { from, query, t } from '@ultimat3/query';
-import { threadRead } from './policy';
-import type { Message } from './repo';
-import * as repo from './repo';
+import { threadRead } from '../policy';
+import type { Message } from '../repo';
+import * as repo from '../repo';
 
 export const liveThread = query({
   input: t.object({ conversationId: t.uuid }),
diff --git a/dummy/social-media-clone/apps/web/app/messages/topics.ts b/dummy/social-media-clone/apps/web/app/messages/topics.ts
index 7a4972077..86c164c8f 100644
--- a/dummy/social-media-clone/apps/web/app/messages/topics.ts
+++ b/dummy/social-media-clone/apps/web/app/messages/topics.ts
@@ -7,7 +7,7 @@
 
 import { schema } from '@social-media-clone/db';
 import { channel } from '@ultimat3/realtime';
-import { liveThread } from './live';
+import { liveThread } from './live/live-thread';
 import { threadRead } from './policy';
 import * as repo from './repo';
 
diff --git a/dummy/social-media-clone/apps/web/app/notifications/mutator.ts b/dummy/social-media-clone/apps/web/app/notifications/actions/mark-notifications-read.ts
similarity index 97%
rename from dummy/social-media-clone/apps/web/app/notifications/mutator.ts
rename to dummy/social-media-clone/apps/web/app/notifications/actions/mark-notifications-read.ts
index b39d0de1d..95230139c 100644
--- a/dummy/social-media-clone/apps/web/app/notifications/mutator.ts
+++ b/dummy/social-media-clone/apps/web/app/notifications/actions/mark-notifications-read.ts
@@ -6,8 +6,8 @@
 
 import { mutator, t } from '@ultimat3/action';
 import { actorOf } from '@ultimat3/core';
-import { notificationMarkRead } from './policy';
-import * as repo from './repo';
+import { notificationMarkRead } from '../policy';
+import * as repo from '../repo';
 
 /**
  * The local twin's row shape, keyed by the entity's table so the optimistic row and the server row
diff --git a/dummy/social-media-clone/apps/web/app/notifications/mutator.test.ts b/dummy/social-media-clone/apps/web/app/notifications/mutator.test.ts
index 009028a0a..586d8381b 100644
--- a/dummy/social-media-clone/apps/web/app/notifications/mutator.test.ts
+++ b/dummy/social-media-clone/apps/web/app/notifications/mutator.test.ts
@@ -10,7 +10,7 @@ import type { LocalTable, LocalTx } from '@ultimat3/action';
 import { ctxOf, isUltimateError, userActor } from '@ultimat3/core';
 import type { Actor } from '@ultimat3/policy';
 import { expect, unitTest } from '@ultimat3/testing';
-import { markNotificationsRead } from './mutator';
+import { markNotificationsRead } from './actions/mark-notifications-read';
 import * as repo from './repo';
 import { unreadFor } from './service';
 
diff --git a/dummy/social-media-clone/apps/web/app/notifications/page.tsx b/dummy/social-media-clone/apps/web/app/notifications/page.tsx
index 3c569f339..3c7bd1cd5 100644
--- a/dummy/social-media-clone/apps/web/app/notifications/page.tsx
+++ b/dummy/social-media-clone/apps/web/app/notifications/page.tsx
@@ -3,7 +3,7 @@
 // `useMutation(markNotificationsRead)` and the badge is rendered once, on the server.
 //
 // The count is DERIVED (`readAt is null`), never stored and never decremented, which is the same
-// property that makes the offline twin in `mutator.ts` safe to replay.
+// property that makes the offline twin in `actions/mark-notifications-read.ts` safe to replay.
 
 import { actorOf, useContext } from '@ultimat3/core';
 import { t } from '@ultimat3/i18n';
diff --git a/dummy/social-media-clone/apps/web/app/notifications/live.ts b/dummy/social-media-clone/apps/web/app/notifications/queries/inbox.ts
similarity index 74%
rename from dummy/social-media-clone/apps/web/app/notifications/live.ts
rename to dummy/social-media-clone/apps/web/app/notifications/queries/inbox.ts
index 85f164571..baa8cbc7a 100644
--- a/dummy/social-media-clone/apps/web/app/notifications/live.ts
+++ b/dummy/social-media-clone/apps/web/app/notifications/queries/inbox.ts
@@ -1,13 +1,13 @@
 // The inbox, as a declared read — what the inbox channel's client re-reads after a `replay-gap`.
 // Same page `inboxFor` renders, `(createdAt desc, id)` so the order is total, and the bound is a
-// constant for the reason `messages/live.ts` gives: a client-chosen bound is a client-chosen budget.
+// constant for the reason `messages/live/` gives: a client-chosen bound is a client-chosen budget.
 //
 // `t` comes from @ultimat3/query, not @ultimat3/schema: a query file imports one package.
 
 import { from, query, t } from '@ultimat3/query';
-import { notificationRead } from './policy';
-import type { Notification } from './repo';
-import * as repo from './repo';
+import { notificationRead } from '../policy';
+import type { Notification } from '../repo';
+import * as repo from '../repo';
 
 export const inbox = query({
   input: t.object({ userId: t.uuid }),
diff --git a/dummy/social-media-clone/apps/web/app/notifications/topics.ts b/dummy/social-media-clone/apps/web/app/notifications/topics.ts
index 9c145e0e5..38828882a 100644
--- a/dummy/social-media-clone/apps/web/app/notifications/topics.ts
+++ b/dummy/social-media-clone/apps/web/app/notifications/topics.ts
@@ -7,7 +7,7 @@
 import { schema } from '@social-media-clone/db';
 import { can } from '@ultimat3/policy';
 import { channel } from '@ultimat3/realtime';
-import { inbox } from './live';
+import { inbox } from './queries/inbox';
 
 /**
  * Your own inbox and nobody else's. An admin is not exempted: `admin:read` is a moderation grant
diff --git a/dummy/social-media-clone/apps/web/app/tasks/errors.ts b/dummy/social-media-clone/apps/web/app/tasks/errors.ts
index bd2cfb929..806d76465 100644
--- a/dummy/social-media-clone/apps/web/app/tasks/errors.ts
+++ b/dummy/social-media-clone/apps/web/app/tasks/errors.ts
@@ -32,7 +32,7 @@ export class DemoResetUnsafeError extends UltimateError {
     super({
       code: 'X_DEMO_RESET_UNSAFE',
       cause: `this database does not hold the demo's seeded accounts (missing ${init.missing.join(', ')}), so it is not the demo's — and resetDemo deletes every post, comment, upload, message and notification before re-seeding`,
-      fix: 'delete hourlyDemoReset from apps/web/app/tasks/schedule.ts if DATABASE_URL points at a database whose rows matter; if this IS the demo, seed it with `bun run packages/db/src/seed.ts` and the next occurrence runs',
+      fix: 'delete hourlyDemoReset from apps/web/app/tasks/tasks/hourly-demo-reset.ts if DATABASE_URL points at a database whose rows matter; if this IS the demo, seed it with `bun run packages/db/src/seed.ts` and the next occurrence runs',
       meta: { missing: init.missing },
     });
   }
diff --git a/dummy/social-media-clone/apps/web/app/tasks/instant.ts b/dummy/social-media-clone/apps/web/app/tasks/instant.ts
new file mode 100644
index 000000000..af6e47dc6
--- /dev/null
+++ b/dummy/social-media-clone/apps/web/app/tasks/instant.ts
@@ -0,0 +1,11 @@
+import { t } from '@ultimat3/jobs';
+
+/**
+ * An instant on the wire is an ISO-8601 string, not a `Date`. The queue round-trips input through
+ * JSON, so a `Date` input would reach `idempotencyKeyFor` as a `Date` on the enqueue side and as a
+ * string on the replay side — two spellings of one key, which is no key at all.
+ */
+export const instant = t.string;
+
+/** An occurrence's instant as the ISO-8601 string `instant` reads. */
+export const iso = (ms: number): string => new Date(ms).toISOString();
diff --git a/dummy/social-media-clone/apps/web/app/tasks/jobs.test.ts b/dummy/social-media-clone/apps/web/app/tasks/jobs.test.ts
index 8e24b3ee4..5d9eb90b0 100644
--- a/dummy/social-media-clone/apps/web/app/tasks/jobs.test.ts
+++ b/dummy/social-media-clone/apps/web/app/tasks/jobs.test.ts
@@ -6,7 +6,8 @@ import { afterAll, beforeEach, expect, test } from 'bun:test';
 import { db, driver, seedDemo } from '@social-media-clone/db';
 import { seedId } from '@ultimat3/entity';
 import { type RunJobs, testJobs } from '@ultimat3/testing';
-import { resetDemo, sweepOrphanMedia } from './jobs';
+import { resetDemo } from './jobs/reset-demo';
+import { sweepOrphanMedia } from './jobs/sweep-orphan-media';
 import { mediaById, missingDemoMarkers, pendingMediaBefore } from './repo';
 
 /** The seed's deliberate orphan, and the attached row that must survive every sweep. */
diff --git a/dummy/social-media-clone/apps/web/app/tasks/jobs/reset-demo.ts b/dummy/social-media-clone/apps/web/app/tasks/jobs/reset-demo.ts
new file mode 100644
index 000000000..7e25884c2
--- /dev/null
+++ b/dummy/social-media-clone/apps/web/app/tasks/jobs/reset-demo.ts
@@ -0,0 +1,44 @@
+// `resetDemo`, the tasks slice's job — one primitive per file, the layout `x g` writes.
+//
+// The two jobs the schedule enqueues. Work lives HERE and never in a `task`: a task runs on the
+// scheduler, which is single-instance and unretried, so anything that can fail belongs on the queue.
+//
+// Both keys derive from `input` alone. A key that read the clock would make every retry of the same
+// occurrence a brand-new job, which is the one bug `idempotencyKey` exists to delete.
+
+import { logger } from '@ultimat3/core';
+import { job, t } from '@ultimat3/jobs';
+import { DemoResetUnsafeError } from '../errors';
+import { instant } from '../instant';
+import { missingDemoMarkers, restoreSeededGraph } from '../repo';
+
+/**
+ * Restore the public demo. `occurrence` is in the input for one reason: it is what makes the key
+ * distinguish one hour's reset from the next while a retry of THIS hour deduplicates.
+ */
+export const resetDemo = job({
+  input: t.object({ occurrence: instant }),
+  idempotencyKey: (input) => `demo-reset:${input.occurrence}`,
+  /** Same reason as the sweep above: this app has no tenant column, and a reset owns every row. */
+  tenant: 'none',
+  // One attempt more than a transient blip needs, and no more: a reset that keeps failing should
+  // dead-letter loudly rather than delete the demo four more times.
+  retry: { attempts: 3, backoff: 'exponential', delay: '30s' },
+  async run({ input }) {
+    // Checked in the job, not in the task: a task only enqueues, and the guard has to hold for a
+    // manual `resetDemo.enqueue(...)` and a backfill exactly as it does for the cron.
+    //
+    // The store is asked, not the environment. `DATABASE_URL is set` was the old test, and it
+    // stopped meaning "not the demo" the day the demo got a database of its own
+    // (packages/db/src/client.ts) — it would have dead-lettered this job on every occurrence.
+    const missing = await missingDemoMarkers();
+    if (missing.length > 0) throw new DemoResetUnsafeError({ missing });
+
+    const purged = await restoreSeededGraph();
+    logger.info('tasks.demo.reset', {
+      occurrence: input.occurrence,
+      purged: Object.fromEntries(purged.map((entry) => [entry.table, entry.removed])),
+    });
+    return { purged };
+  },
+});
diff --git a/dummy/social-media-clone/apps/web/app/tasks/jobs.ts b/dummy/social-media-clone/apps/web/app/tasks/jobs/sweep-orphan-media.ts
similarity index 50%
rename from dummy/social-media-clone/apps/web/app/tasks/jobs.ts
rename to dummy/social-media-clone/apps/web/app/tasks/jobs/sweep-orphan-media.ts
index 12324fa2f..5a7043b9a 100644
--- a/dummy/social-media-clone/apps/web/app/tasks/jobs.ts
+++ b/dummy/social-media-clone/apps/web/app/tasks/jobs/sweep-orphan-media.ts
@@ -1,3 +1,5 @@
+// `sweepOrphanMedia`, the tasks slice's job — one primitive per file, the layout `x g` writes.
+//
 // The two jobs the schedule enqueues. Work lives HERE and never in a `task`: a task runs on the
 // scheduler, which is single-instance and unretried, so anything that can fail belongs on the queue.
 //
@@ -6,21 +8,8 @@
 
 import { logger } from '@ultimat3/core';
 import { job, t } from '@ultimat3/jobs';
-import { DemoResetUnsafeError } from './errors';
-import {
-  markOrphan,
-  missingDemoMarkers,
-  pendingMediaBefore,
-  restoreSeededGraph,
-  SWEEP_PAGE,
-} from './repo';
-
-/**
- * An instant on the wire is an ISO-8601 string, not a `Date`. The queue round-trips input through
- * JSON, so a `Date` input would reach `idempotencyKeyFor` as a `Date` on the enqueue side and as a
- * string on the replay side — two spellings of one key, which is no key at all.
- */
-const instant = t.string;
+import { instant } from '../instant';
+import { markOrphan, pendingMediaBefore, SWEEP_PAGE } from '../repo';
 
 /**
  * The cutoff is INPUT, computed by the task from the occurrence it is firing for — never read from
@@ -52,34 +41,3 @@ export const sweepOrphanMedia = job({
     return { collected: stale.length, keys: stale.map((row) => row.key) };
   },
 });
-
-/**
- * Restore the public demo. `occurrence` is in the input for one reason: it is what makes the key
- * distinguish one hour's reset from the next while a retry of THIS hour deduplicates.
- */
-export const resetDemo = job({
-  input: t.object({ occurrence: instant }),
-  idempotencyKey: (input) => `demo-reset:${input.occurrence}`,
-  /** Same reason as the sweep above: this app has no tenant column, and a reset owns every row. */
-  tenant: 'none',
-  // One attempt more than a transient blip needs, and no more: a reset that keeps failing should
-  // dead-letter loudly rather than delete the demo four more times.
-  retry: { attempts: 3, backoff: 'exponential', delay: '30s' },
-  async run({ input }) {
-    // Checked in the job, not in the task: a task only enqueues, and the guard has to hold for a
-    // manual `resetDemo.enqueue(...)` and a backfill exactly as it does for the cron.
-    //
-    // The store is asked, not the environment. `DATABASE_URL is set` was the old test, and it
-    // stopped meaning "not the demo" the day the demo got a database of its own
-    // (packages/db/src/client.ts) — it would have dead-lettered this job on every occurrence.
-    const missing = await missingDemoMarkers();
-    if (missing.length > 0) throw new DemoResetUnsafeError({ missing });
-
-    const purged = await restoreSeededGraph();
-    logger.info('tasks.demo.reset', {
-      occurrence: input.occurrence,
-      purged: Object.fromEntries(purged.map((entry) => [entry.table, entry.removed])),
-    });
-    return { purged };
-  },
-});
diff --git a/dummy/social-media-clone/apps/web/app/tasks/schedule.test.ts b/dummy/social-media-clone/apps/web/app/tasks/schedule.test.ts
index 13b2fc5f1..ff703539b 100644
--- a/dummy/social-media-clone/apps/web/app/tasks/schedule.test.ts
+++ b/dummy/social-media-clone/apps/web/app/tasks/schedule.test.ts
@@ -7,7 +7,8 @@
 import { expect, test } from 'bun:test';
 import { task } from '@ultimat3/jobs';
 import { scheduledApi } from '../../api/tasks';
-import { hourlyDemoReset, hourlyMediaSweep } from './schedule';
+import { hourlyDemoReset } from './tasks/hourly-demo-reset';
+import { hourlyMediaSweep } from './tasks/hourly-media-sweep';
 
 test('a task declared without a tz is rejected — an unzoned cron is a bug waiting for March', () => {
   // @ts-expect-error — `tz` is REQUIRED by TaskDefinition. This line failing to error is itself
diff --git a/dummy/social-media-clone/apps/web/app/tasks/tasks/hourly-demo-reset.ts b/dummy/social-media-clone/apps/web/app/tasks/tasks/hourly-demo-reset.ts
new file mode 100644
index 000000000..e34206fdb
--- /dev/null
+++ b/dummy/social-media-clone/apps/web/app/tasks/tasks/hourly-demo-reset.ts
@@ -0,0 +1,24 @@
+// `hourlyDemoReset`, the tasks slice's task — one primitive per file, the layout `x g` writes.
+//
+// The app's cron. A task ONLY enqueues — the payload is built here, the work happens on the queue.
+//
+// `tz: 'UTC'` on both, said out loud: there is no ambient zone to inherit, and an unzoned
+// `0 * * * *` runs twice or zero times on a DST switch day, and the scheduler's occurrence key
+// would then dedupe two different hours onto one. UTC has no transitions, which is the property these two want — neither is a thing a
+// reader reads at a local hour.
+
+import { task } from '@ultimat3/jobs';
+import { iso } from '../instant';
+import { resetDemo } from '../jobs/reset-demo';
+
+/**
+ * Hourly demo reset. `catchUp: 'skip'` (the default, said out loud): after an outage the demo wants
+ * ONE restore at the next occurrence, not one per hour the process was down — every missed run
+ * would do the identical work, so replaying them is pure deletion.
+ */
+export const hourlyDemoReset = task({
+  cron: '30 * * * *',
+  tz: 'UTC',
+  catchUp: 'skip',
+  enqueue: (occurrenceMs) => [[resetDemo, { occurrence: iso(occurrenceMs) }]],
+});
diff --git a/dummy/social-media-clone/apps/web/app/tasks/schedule.ts b/dummy/social-media-clone/apps/web/app/tasks/tasks/hourly-media-sweep.ts
similarity index 69%
rename from dummy/social-media-clone/apps/web/app/tasks/schedule.ts
rename to dummy/social-media-clone/apps/web/app/tasks/tasks/hourly-media-sweep.ts
index 5867723b5..8329c769e 100644
--- a/dummy/social-media-clone/apps/web/app/tasks/schedule.ts
+++ b/dummy/social-media-clone/apps/web/app/tasks/tasks/hourly-media-sweep.ts
@@ -1,3 +1,5 @@
+// `hourlyMediaSweep`, the tasks slice's task — one primitive per file, the layout `x g` writes.
+//
 // The app's cron. A task ONLY enqueues — the payload is built here, the work happens on the queue.
 //
 // `tz: 'UTC'` on both, said out loud: there is no ambient zone to inherit, and an unzoned
@@ -6,7 +8,8 @@
 // reader reads at a local hour.
 
 import { task } from '@ultimat3/jobs';
-import { resetDemo, sweepOrphanMedia } from './jobs';
+import { iso } from '../instant';
+import { sweepOrphanMedia } from '../jobs/sweep-orphan-media';
 
 /**
  * How long an upload may sit unclaimed before it counts as abandoned. An hour: long enough that a
@@ -15,8 +18,6 @@ import { resetDemo, sweepOrphanMedia } from './jobs';
  */
 const CLAIM_GRACE_MS = 60 * 60 * 1_000;
 
-const iso = (ms: number): string => new Date(ms).toISOString();
-
 /**
  * Hourly orphan sweep.
  *
@@ -29,15 +30,3 @@ export const hourlyMediaSweep = task({
   tz: 'UTC',
   enqueue: (occurrenceMs) => [[sweepOrphanMedia, { before: iso(occurrenceMs - CLAIM_GRACE_MS) }]],
 });
-
-/**
- * Hourly demo reset. `catchUp: 'skip'` (the default, said out loud): after an outage the demo wants
- * ONE restore at the next occurrence, not one per hour the process was down — every missed run
- * would do the identical work, so replaying them is pure deletion.
- */
-export const hourlyDemoReset = task({
-  cron: '30 * * * *',
-  tz: 'UTC',
-  catchUp: 'skip',
-  enqueue: (occurrenceMs) => [[resetDemo, { occurrence: iso(occurrenceMs) }]],
-});
diff --git a/examples/dummy/CLAUDE.md b/examples/dummy/CLAUDE.md
index c29ed57fd..33d2a4fd3 100644
--- a/examples/dummy/CLAUDE.md
+++ b/examples/dummy/CLAUDE.md
@@ -51,7 +51,7 @@ the module graph, which is what makes the framework's boot scan load it once for
 other stylesheet in the app emits top-level CSS: every module is its own Sass compilation, so a
 second emitter would duplicate the `:root` block. A document that carries none is
 `X_STYLES_GLOBAL_MISSING` from the gate's `budgets` step. **There is no `/signin` or `/signup`**
-(sign-OUT is the `endSession` action, `app/auth/actions.ts`: it sets the demo cookie to
+(sign-OUT is the `endSession` action, `app/auth/actions/end-session.ts`: it sets the demo cookie to
 `signed-out` and redirects, and the layout's native form posts to it) — this file claimed all three were mounted "by the wrapped Better Auth integration"
 until 2026-08, which contradicted its own gotcha twelve lines down: `app/auth/login.ts`'s two route
 descriptors are declared, tested and **not served**, and there is no Better Auth wrapper in this
@@ -85,10 +85,9 @@ plus `backfills/<name>.ts` for a one-pass table sweep.
 | `entity.ts` | view schemas + invariants for this feature | I/O, policy |
 | `repo.ts` | SQL for this feature | business rules, HTTP |
 | `service.ts` | business logic composed from repos | HTTP, rendering, raw SQL |
-| `actions.ts` | `action` declarations | logic — delegate to `service.ts` |
-| `mutator.ts` | `mutator` declarations — `server`, `policy`, `conflict` | I/O inside `local`; DECLARING `local`, which lives one file over |
-| `live.ts` | `query` declarations | writes |
-| `jobs.ts` | `job` declarations | inline slow work |
+| `actions/<name>.ts` | one `action` or `mutator` per file — a mutator's `server`, `policy`, `conflict` | logic — delegate to `service.ts`; DECLARING `local`, which lives one file over |
+| `live/<name>.ts` · `queries/<name>.ts` | one `query` per file, `live: true` or not | writes |
+| `jobs/<name>.ts` · `tasks/<name>.ts` | one `job` / `task` per file | inline slow work |
 | `backfills/` | `backfill()` sweeps — a job factory, so each one registers in `defineApi({ jobs })` | a `step` of its own; the pass mints one per page |
 | `policy.ts` | `policy` rules — `can()` or `definePolicy()`, both returning the same `Policy` | data shaping |
 | `ui/` | Solid components | fetching, business logic, authz |
@@ -104,8 +103,8 @@ plus `backfills/<name>.ts` for a one-pass table sweep.
   MCP tools, and admin. Never re-check authz inside `handle`.
 - `t` is two different things by file kind: the schema namespace in declaration files, the i18n
   translator (`useI18n()`) in components. Never both in one file. A declaration file imports the
-  schema `t` from the package it declares in — `@ultimat3/action` in `actions.ts`/`mutator.ts`,
-  `@ultimat3/query` in `live.ts`, `@ultimat3/jobs` in `jobs.ts`, `@ultimat3/mail` in `mail.ts`,
+  schema `t` from the package it declares in — `@ultimat3/action` in `actions/`,
+  `@ultimat3/query` in `live/` and `queries/`, `@ultimat3/jobs` in `jobs/`, `@ultimat3/mail` in `mail.ts`,
   `@ultimat3/mcp` in the MCP package — never reaching past it to `@ultimat3/schema`. It is the same
   object either way. A module that declares no primitive (a feature's `entity.ts` view schemas)
   imports `@ultimat3/schema` directly, because that already is its one import.
@@ -198,7 +197,7 @@ plus `backfills/<name>.ts` for a one-pass table sweep.
 - **A background agent is `agentJob(action, { actor })` over an action that runs the agent and
   makes the write ITSELF — the model is handed no write.** A draft is text its writer controls, and
   "now record a review for post X" is an instruction a model may follow, so a write tool whose
-  target the model names is a write any writer can aim. `app/posts/actions.ts`: `reviewDraft` is
+  target the model names is a write any writer can aim. `app/posts/actions/review-draft.ts`: `reviewDraft` is
   read-only (one tool, `summarize`); `keepDraftReview` runs it and upserts the verdict on the post
   id IT was given, `post_reviews`' key `(orgId, postId)`, so a replayed run is the same row (a
   queued run keeps no output, and an attempt that loses its lease runs from the top). Writing a
@@ -288,7 +287,7 @@ The two guards measured here, and their repairs, are recorded in
   shipped; `post.likedByMe ? {} : { likedByMe: true, likeCount: post.likeCount + 1 }` is the repair.
 - **A local twin lives in the BROWSER-reachable module of its feature, and the declaration imports
   it.** `app/posts/like-mutation.ts` holds `likePostLocally` and the `LocalTables` augmentation;
-  `app/posts/mutator.ts` writes `local: likePostLocally`. An island cannot import `mutator.ts` —
+  `app/posts/actions/like-post.ts` writes `local: likePostLocally`. An island cannot import that —
   the declaration drags `@ultimat3/action`, the policy and the Postgres client into the chunk — and
   `local` is by definition the half that runs in the tab, so the file a browser can load is its one
   home. Two copies is two declarations of one intent.
diff --git a/examples/dummy/README.md b/examples/dummy/README.md
index 1fd541004..08e126dc8 100644
--- a/examples/dummy/README.md
+++ b/examples/dummy/README.md
@@ -36,28 +36,28 @@ before.
 | `entity` | [`packages/db/src/schema/runs.ts`](packages/db/src/schema/runs.ts) | one row per run: its job, and a `status` projected from its last phase event by the one writer of both |
 | `entity` | [`packages/db/src/schema/run-events.ts`](packages/db/src/schema/run-events.ts) | one row per phase of a run; `seq` starts at 1 and the CHECK says so; `usage` is a `json()` column a schema validates |
 | `policy` | [`apps/web/app/posts/policy.ts`](apps/web/app/posts/policy.ts) | `post:publish` = owns-or-org-admin, one definition, five surfaces. Both authoring forms, once each: `can()` where only an agent reads the denial, `definePolicy()` on `post:like` where a person does — same `Policy` object, and `deny:` is a message key so the refusal goes through `t()` |
-| `action` | [`apps/web/app/posts/actions.ts`](apps/web/app/posts/actions.ts) | `createPost`, `publishPost`, and `summarize` — an `llm()` model call, which is an action factory rather than a ninth primitive |
-| `action` | [`apps/web/app/orgs/actions.ts`](apps/web/app/orgs/actions.ts) | `inviteMember`, `upgradePlan` (minor-unit arithmetic), `grantAvatarUpload` — a presigned PUT whose key and signature are `@ultimat3/storage`'s ([`avatar.ts`](apps/web/app/orgs/avatar.ts)) |
-| `action` | [`apps/web/app/settings/actions.ts`](apps/web/app/settings/actions.ts) | `savePreferences` — a one-action slice still gets an `actions.ts` · `subscribePush` / `unsubscribePush` — `pushSubscribe()` / `pushUnsubscribe()` from `@ultimat3/pwa`: this browser's Web Push subscription, stored against the member the request ran as |
-| `action` | [`apps/web/app/runs/actions.ts`](apps/web/app/runs/actions.ts) | `startRun`, `answerPrompt`, `cancelRun` — each an MCP tool by one line, and served to machine callers under `/v1` by the bearer mount in [`api/index.ts`](apps/web/api/index.ts); `issueRunKey` mints the key |
+| `action` | [`apps/web/app/posts/actions/`](apps/web/app/posts/actions/) | `createPost`, `publishPost`, and `summarize` — an `llm()` model call, which is an action factory rather than a ninth primitive |
+| `action` | [`apps/web/app/orgs/actions/`](apps/web/app/orgs/actions/) | `inviteMember`, `upgradePlan` (minor-unit arithmetic), `grantAvatarUpload` — a presigned PUT whose key and signature are `@ultimat3/storage`'s ([`avatar.ts`](apps/web/app/orgs/avatar.ts)) |
+| `action` | [`apps/web/app/settings/actions/`](apps/web/app/settings/actions/) | `savePreferences` — every action its own file, the layout `x g` writes · `subscribePush` / `unsubscribePush` — `pushSubscribe()` / `pushUnsubscribe()` from `@ultimat3/pwa`: this browser's Web Push subscription, stored against the member the request ran as |
+| `action` | [`apps/web/app/runs/actions/`](apps/web/app/runs/actions/) | `startRun`, `answerPrompt`, `cancelRun` — each an MCP tool by one line, and served to machine callers under `/v1` by the bearer mount in [`api/index.ts`](apps/web/api/index.ts); `issueRunKey` mints the key |
 | `policy` | [`apps/web/app/runs/policy.ts`](apps/web/app/runs/policy.ts) | rules that read `actor.orgId`, so a member, an agent and an API key pass the same predicate; `row === null` denies an answer or a cancel for a run nobody loaded |
-| `mutator` | [`apps/web/app/posts/mutator.ts`](apps/web/app/posts/mutator.ts) | `likePost` — optimistic local twin, offline queue, `conflict: 'server-wins'` |
-| `mutator` | [`apps/web/app/settings/mutator.ts`](apps/web/app/settings/mutator.ts) | `setTheme` (`'last-write-wins'`) and `toggleDigestOptIn` (`custom`, sticky unsubscribe) — the other two conflict strategies |
-| `query` | [`apps/web/app/posts/live.ts`](apps/web/app/posts/live.ts) | `liveFeed` (`live: true`) + non-live `postBySlug` |
-| `query` | [`apps/web/app/runs/live.ts`](apps/web/app/runs/live.ts) | `liveRunEvents` — a run's events in `seq` order, pushed as the job writes them |
-| `job` | [`apps/web/app/orgs/jobs.ts`](apps/web/app/orgs/jobs.ts) | `onboardOrg` — durable steps + `step.sleep('3d')` |
-| `job` | [`apps/web/app/posts/jobs.ts`](apps/web/app/posts/jobs.ts) | `notifySubscribers` — fanout, `concurrency: 1` (one in flight across the fleet) |
-| `job` | [`apps/web/app/digest/jobs.ts`](apps/web/app/digest/jobs.ts) | `sendDigest` — 09:00 **local per member**, DST-correct, delivered one (org, zone) group at a time |
+| `mutator` | [`apps/web/app/posts/actions/like-post.ts`](apps/web/app/posts/actions/like-post.ts) | `likePost` — optimistic local twin, offline queue, `conflict: 'server-wins'` |
+| `mutator` | [`apps/web/app/settings/actions/`](apps/web/app/settings/actions/) | `setTheme` (`'last-write-wins'`) and `toggleDigestOptIn` (`custom`, sticky unsubscribe) — the other two conflict strategies |
+| `query` | [`apps/web/app/posts/live/live-feed.ts`](apps/web/app/posts/live/live-feed.ts) | `liveFeed` (`live: true`) + non-live `postBySlug` ([`queries/`](apps/web/app/posts/queries/): a read that is not subscribable is not in `live/`) |
+| `query` | [`apps/web/app/runs/live/live-run-events.ts`](apps/web/app/runs/live/live-run-events.ts) | `liveRunEvents` — a run's events in `seq` order, pushed as the job writes them |
+| `job` | [`apps/web/app/orgs/jobs/onboard-org.ts`](apps/web/app/orgs/jobs/onboard-org.ts) | `onboardOrg` — durable steps + `step.sleep('3d')` |
+| `job` | [`apps/web/app/posts/jobs/notify-subscribers.ts`](apps/web/app/posts/jobs/notify-subscribers.ts) | `notifySubscribers` — fanout, `concurrency: 1` (one in flight across the fleet) |
+| `job` | [`apps/web/app/digest/jobs/send-digest.ts`](apps/web/app/digest/jobs/send-digest.ts) | `sendDigest` — 09:00 **local per member**, DST-correct, delivered one (org, zone) group at a time |
 | `job` | [`apps/web/app/posts/backfills/post-excerpts.ts`](apps/web/app/posts/backfills/post-excerpts.ts) | `postExcerpts` — `backfill()` is a **job factory**, not a ninth primitive: one pass over the rows that are behind, every page in its own `step.run`, the checkpoint a cursor and never the page, the handler idempotent because `handle` is at-least-once |
-| `job` | [`apps/web/app/runs/jobs.ts`](apps/web/app/runs/jobs.ts) | `syncConnection` — `scrape()` is a **job factory**: a recorded site (`fixtureBrowser`), `egress` looked up in the worker, one run per connection (`concurrency: { key, whenBusy: 'fail' }` → `X_JOB_KEY_BUSY`), a sealed stored session, a prompt a person answers mid-run over the event bus, and `onSettled` recording how each run ended and what it used |
-| `action` | [`apps/web/app/posts/actions.ts`](apps/web/app/posts/actions.ts) | `summarizePosts` — `hive()`, a fan-out as one action: one `summarize` member per post, in the order asked, a foreign post failing alone · `reviewDraft` — `agent()`, a tool loop as one action, read-only, its one tool the `summarize` action under the same actor · `keepDraftReview` runs it and upserts the verdict on the post id the CODE was given — never a write the model can aim · `reviewDraftLater` — `agentJob()` over `keepDraftReview`: `actor` re-reads the member who asked on every attempt (a served worker is nobody), and the kept row is the answer because a queued run keeps no output · `requestPostsExport` enqueues the export below |
-| `mutator` | [`apps/web/app/posts/mutator.ts`](apps/web/app/posts/mutator.ts) | `movePostStatus` — `transition()` over `posts.status`'s declared machine: one compare-and-set statement, `draft` ⇄ `scheduled`, `published` reachable only through `publishPost`; a `row:` loader so scheduling is owns-or-org-admin, as publishing is |
-| `job` | [`apps/web/app/posts/jobs.ts`](apps/web/app/posts/jobs.ts) | `exportPosts` — `exportRows()`: an org's posts to CSV parts plus a manifest on the app's disk, a page at a time |
-| `job` | [`apps/web/app/posts/notifiers.ts`](apps/web/app/posts/notifiers.ts) | `commentPosted` — `notifier()`: the post's author is mailed about a comment, and pushed to every browser she subscribed (`pushChannel({ pusher: webPush() })`, each in its own locale, tagged by post), once per comment, through the delivery ledger |
-| `job` | [`apps/web/app/webhooks/jobs.ts`](apps/web/app/webhooks/jobs.ts) | `postPublishedWebhook` — `webhook()`: one signed `post.published` delivery per live endpoint of the publishing org (`ctx.webhooks.announcePublished`, from `publishPost`), the org on the input so `tenant` and both seams name it, every attempt on [`ledger.ts`](apps/web/app/webhooks/ledger.ts) over `webhook_deliveries`, and an endpoint switched off after ten failures in a row · `addWebhookEndpoint` registers one (its URL screened by the delivery screen's rules) and answers its secret once; `removeWebhookEndpoint` revokes it |
-| `job` | [`apps/web/app/mcp/jobs.ts`](apps/web/app/mcp/jobs.ts) | `purgeMcpConfirmations` — `purge()`: a month of MCP confirmations kept, the rest deleted hourly (`hourlyPurge` in `api/tasks.ts`) |
+| `job` | [`apps/web/app/runs/jobs/sync-connection.ts`](apps/web/app/runs/jobs/sync-connection.ts) | `syncConnection` — `scrape()` is a **job factory**: a recorded site (`fixtureBrowser`), `egress` looked up in the worker, one run per connection (`concurrency: { key, whenBusy: 'fail' }` → `X_JOB_KEY_BUSY`), a sealed stored session, a prompt a person answers mid-run over the event bus, and `onSettled` recording how each run ended and what it used |
+| `action` | [`apps/web/app/posts/actions/`](apps/web/app/posts/actions/) | `summarizePosts` — `hive()`, a fan-out as one action: one `summarize` member per post, in the order asked, a foreign post failing alone · `reviewDraft` — `agent()`, a tool loop as one action, read-only, its one tool the `summarize` action under the same actor · `keepDraftReview` runs it and upserts the verdict on the post id the CODE was given — never a write the model can aim · `reviewDraftLater` — `agentJob()` over `keepDraftReview`: `actor` re-reads the member who asked on every attempt (a served worker is nobody), and the kept row is the answer because a queued run keeps no output · `requestPostsExport` enqueues the export below |
+| `mutator` | [`apps/web/app/posts/actions/move-post-status.ts`](apps/web/app/posts/actions/move-post-status.ts) | `movePostStatus` — `transition()` over `posts.status`'s declared machine: one compare-and-set statement, `draft` ⇄ `scheduled`, `published` reachable only through `publishPost`; a `row:` loader so scheduling is owns-or-org-admin, as publishing is |
+| `job` | [`apps/web/app/posts/jobs/export-posts.ts`](apps/web/app/posts/jobs/export-posts.ts) | `exportPosts` — `exportRows()`: an org's posts to CSV parts plus a manifest on the app's disk, a page at a time |
+| `job` | [`apps/web/app/posts/jobs/comment-posted.ts`](apps/web/app/posts/jobs/comment-posted.ts) | `commentPosted` — `notifier()`: the post's author is mailed about a comment, and pushed to every browser she subscribed (`pushChannel({ pusher: webPush() })`, each in its own locale, tagged by post), once per comment, through the delivery ledger |
+| `job` | [`apps/web/app/webhooks/jobs/post-published-webhook.ts`](apps/web/app/webhooks/jobs/post-published-webhook.ts) | `postPublishedWebhook` — `webhook()`: one signed `post.published` delivery per live endpoint of the publishing org (`ctx.webhooks.announcePublished`, from `publishPost`), the org on the input so `tenant` and both seams name it, every attempt on [`ledger.ts`](apps/web/app/webhooks/ledger.ts) over `webhook_deliveries`, and an endpoint switched off after ten failures in a row · `addWebhookEndpoint` registers one (its URL screened by the delivery screen's rules) and answers its secret once; `removeWebhookEndpoint` revokes it |
+| `job` | [`apps/web/app/mcp/jobs/purge-mcp-confirmations.ts`](apps/web/app/mcp/jobs/purge-mcp-confirmations.ts) | `purgeMcpConfirmations` — `purge()`: a month of MCP confirmations kept, the rest deleted hourly (`hourlyPurge` in `app/mcp/tasks/hourly-purge.ts`) |
 | `action` | [`packages/mcp/src/confirmations.ts`](packages/mcp/src/confirmations.ts) | `confirmAgentPublish` — `mcpConfirmations()`: an agent's `publishPost` waits for a person to view and approve that exact call |
-| `task` | [`apps/web/api/tasks.ts`](apps/web/api/tasks.ts) | `nightlyDigest` cron with an explicit `tz` |
+| `task` | [`apps/web/app/digest/tasks/nightly-digest.ts`](apps/web/app/digest/tasks/nightly-digest.ts) | `nightlyDigest` cron with an explicit `tz` |
 | `route` | [`apps/web/site/page.tsx`](apps/web/site/page.tsx) | `static`, `hydrate: 'never'`, 0kb JS |
 | `route` | [`apps/web/site/pricing/page.tsx`](apps/web/site/pricing/page.tsx) | `isr`, money formatted at the edge |
 | `route` | [`apps/web/site/blog/[slug]/page.tsx`](apps/web/site/blog/%5Bslug%5D/page.tsx) | `isr` + `prerender()` + `ld.Article` |
@@ -93,13 +93,13 @@ apps/web/site/     static/isr, 0kb JS, SEO-critical   — cannot import app/
 apps/web/app/      auth'd, stream/spa, realtime       — imports api/ types only
 apps/web/api/      actions + tasks, no rendering
 apps/web/shared/   tokens, policies, entity types     — leaf, importable by both
-apps/web/app/<feature>/{entity,repo,service,actions,mutator,live,jobs,policy,ui}.ts
+apps/web/app/<feature>/{entity,repo,service,policy}.ts + {actions,live,queries,jobs,tasks}/<name>.ts + ui/
 ```
 
-A primitive is registered by `defineApi()` and found by the module scan, never by its filename, so
-this app's one `actions.ts` per feature and the `actions/<verb>-<name>.ts` that `x g` writes are
-the same primitives in two valid module layouts — nothing enforces either ([Project
-layout](../../wiki/Project-Layout.md#feature-slicing-inside-a-surface)).
+One primitive per file, in its kind's directory — the layout `x g` writes, and the only one: a
+module `actions.ts` beside `actions/` is `X_LAYOUT_SIBLING_MODULE` ([Project
+layout](../../wiki/Project-Layout.md#feature-slicing-inside-a-surface)). A mutator, a transition and
+an `llm()`/`agent()`/`hive()` call live in `actions/`; every job factory but `backfill()` in `jobs/`.
 
 ## Cross-cutting checklist
 
@@ -109,7 +109,7 @@ layout](../../wiki/Project-Layout.md#feature-slicing-inside-a-surface)).
 | **Dark theme** | [`apps/web/shared/global.scss`](apps/web/shared/global.scss) | every colour is `var(--color-*)`; no raw hex in any `.tsx` or `.scss`; the `:root` blocks that define those properties reach the document through [`shared/global.ts`](apps/web/shared/global.ts) |
 | **Timezones** | [`packages/core/src/digest-schedule.ts`](packages/core/src/digest-schedule.ts) | member `tz` drives every `<DateTime>`; digest fires 09:00 local, DST-correct across the March/November transitions |
 | **Money** | [`packages/core/src/billing.ts`](packages/core/src/billing.ts) | integer minor units, USD + EUR, arithmetic never leaves minor units, `Intl` only at the edge |
-| **Offline** | [`apps/web/app/posts/mutator.ts`](apps/web/app/posts/mutator.ts) | `likePost` queues offline and reconciles; feed reads from the persisted store; [`site/offline/page.tsx`](apps/web/site/offline/page.tsx) is the required fallback |
+| **Offline** | [`apps/web/app/posts/actions/like-post.ts`](apps/web/app/posts/actions/like-post.ts) | `likePost` queues offline and reconciles; feed reads from the persisted store; [`site/offline/page.tsx`](apps/web/site/offline/page.tsx) is the required fallback |
 | **Realtime** | [`apps/web/app/posts/[id]/page.tsx`](apps/web/app/posts/%5Bid%5D/page.tsx) | one record, many places — two islands read `posts:<id>` from the page's store; `useChannel(ORG_POSTS)` keeps it current, `useMutation(LIKE_POST)` writes it over HTTP |
 | **Auth** | [`apps/web/app/auth/login.ts`](apps/web/app/auth/login.ts) | "log in with GitHub" is `defineAuth` + `oauthLogin`, ~12 lines; the round trip — 302 with an S256 challenge, a forged `state` refused, a session `authenticate()` resolves — is asserted in [`login.test.ts`](apps/web/app/auth/login.test.ts) against a stubbed provider, because no client id exists in CI. **Not yet reachable in a browser:** see the gotcha in [`CLAUDE.md`](CLAUDE.md) |
 | **AI-first** | [`packages/mcp/src/tools.ts`](packages/mcp/src/tools.ts) | every exposed action is an MCP tool with the *same* policy; admin ships its own MCP surface |
diff --git a/examples/dummy/apps/web/api/index.ts b/examples/dummy/apps/web/api/index.ts
index ba8d326d7..c68ce858e 100644
--- a/examples/dummy/apps/web/api/index.ts
+++ b/examples/dummy/apps/web/api/index.ts
@@ -25,77 +25,142 @@
 // server, which snapshots the registry and must load after this call, never inside it.
 import * as mcpConfirmationActions from '@postly/mcp/confirmations';
 import { defineApi } from '@ultimat3/action';
-import * as authActions from '../app/auth/actions';
-import * as contactActions from '../app/contact/actions';
-import * as contactJobs from '../app/contact/jobs';
-import * as digestJobs from '../app/digest/jobs';
-import * as orgActions from '../app/orgs/actions';
-import * as orgJobs from '../app/orgs/jobs';
-// `defineService('orgs', ...)` / `defineService('posts', ...)` run on import — the same
-// "importing IS the boot" rule as the registration below, so `ctx.orgs` and `ctx.posts` are
-// installed wherever this module has run, including tests.
+// One module per primitive — the directory form `x g` writes (`<slice>/actions/<name>.ts`), each
+// bound under its own file's name. A factory's kind decides its list, never its file: a mutator,
+// a transition and an `llm()`/`agent()`/`hive()` call are actions; a backfill, a notifier, a
+// scrape, a webhook delivery, an export and an `agentJob()` are jobs.
+import * as endSession from '../app/auth/actions/end-session';
+import * as contactSales from '../app/contact/actions/contact-sales';
+import * as sendSalesReceipt from '../app/contact/jobs/send-sales-receipt';
+import * as deliverDigest from '../app/digest/jobs/deliver-digest';
+import * as sendDigest from '../app/digest/jobs/send-digest';
+import * as nightlyDigest from '../app/digest/tasks/nightly-digest';
+import * as purgeMcpConfirmations from '../app/mcp/jobs/purge-mcp-confirmations';
+import * as hourlyPurge from '../app/mcp/tasks/hourly-purge';
+import * as grantAvatarUpload from '../app/orgs/actions/grant-avatar-upload';
+import * as inviteMember from '../app/orgs/actions/invite-member';
+import * as memberAvatar from '../app/orgs/actions/member-avatar';
+import * as upgradePlan from '../app/orgs/actions/upgrade-plan';
+import * as onboardOrg from '../app/orgs/jobs/onboard-org';
+import * as sendInvite from '../app/orgs/jobs/send-invite';
+import * as createComment from '../app/posts/actions/create-comment';
+import * as createPost from '../app/posts/actions/create-post';
+import * as keepDraftReview from '../app/posts/actions/keep-draft-review';
+import * as likePost from '../app/posts/actions/like-post';
+import * as movePostStatus from '../app/posts/actions/move-post-status';
+import * as publishPost from '../app/posts/actions/publish-post';
+import * as requestDraftReview from '../app/posts/actions/request-draft-review';
+import * as requestPostsExport from '../app/posts/actions/request-posts-export';
+import * as reviewDraft from '../app/posts/actions/review-draft';
+import * as summarize from '../app/posts/actions/summarize';
+import * as summarizePosts from '../app/posts/actions/summarize-posts';
+import * as postExcerpts from '../app/posts/backfills/post-excerpts';
+import * as commentPosted from '../app/posts/jobs/comment-posted';
+import * as exportPosts from '../app/posts/jobs/export-posts';
+import * as notifySubscribers from '../app/posts/jobs/notify-subscribers';
+import * as reviewDraftLater from '../app/posts/jobs/review-draft-later';
+import * as liveFeed from '../app/posts/live/live-feed';
+import * as feedActivity from '../app/posts/queries/feed-activity';
+import * as orgPosts from '../app/posts/queries/org-posts';
+import * as postById from '../app/posts/queries/post-by-id';
+import * as postBySlug from '../app/posts/queries/post-by-slug';
+import * as postRecord from '../app/posts/queries/post-record';
+import * as postReview from '../app/posts/queries/post-review';
+import * as publicPost from '../app/posts/queries/public-post';
+import * as publicPostSlugs from '../app/posts/queries/public-post-slugs';
+import * as publicPosts from '../app/posts/queries/public-posts';
+import * as answerPrompt from '../app/runs/actions/answer-prompt';
+import * as cancelRun from '../app/runs/actions/cancel-run';
+import * as connectSite from '../app/runs/actions/connect-site';
+import * as issueRunKey from '../app/runs/actions/issue-run-key';
+import * as revokeRunKey from '../app/runs/actions/revoke-run-key';
+import * as startRun from '../app/runs/actions/start-run';
+import * as syncConnection from '../app/runs/jobs/sync-connection';
+import { RUN_KEY_SCOPES, resolveRunKey } from '../app/runs/keys';
+import * as liveRunEvents from '../app/runs/live/live-run-events';
+import * as runConnections from '../app/runs/queries/run-connections';
+import * as savePreferences from '../app/settings/actions/save-preferences';
+import * as setTheme from '../app/settings/actions/set-theme';
+import * as subscribePush from '../app/settings/actions/subscribe-push';
+import * as toggleDigestOptIn from '../app/settings/actions/toggle-digest-opt-in';
+import * as unsubscribePush from '../app/settings/actions/unsubscribe-push';
+import * as addWebhookEndpoint from '../app/webhooks/actions/add-webhook-endpoint';
+import * as removeWebhookEndpoint from '../app/webhooks/actions/remove-webhook-endpoint';
+import * as postPublishedWebhook from '../app/webhooks/jobs/post-published-webhook';
+// `defineService(...)` and the channel declaration run on import — the same "importing IS the
+// boot" rule as the registration below, so `ctx.orgs`, `ctx.posts`, `ctx.runs` and `ctx.webhooks`
+// are installed wherever this module has run, including tests.
 import '../app/orgs/service';
-import * as postActions from '../app/posts/actions';
 import '../app/posts/channels';
-// A backfill IS a job — `backfill()` is a factory over `job()` — so it registers in the `jobs`
-// list and nowhere else. It carries its own `name`, unlike a plain job whose export name becomes
-// its queue key, because a sweep's name is a durable key the `x_backfills` ledger already holds.
-import * as postBackfills from '../app/posts/backfills/post-excerpts';
-import * as postJobs from '../app/posts/jobs';
-import * as postQueries from '../app/posts/live';
-// A mutator IS an action, so it registers as one: the optimistic local twin rides on the same
-// declaration instead of living in a parallel registry with a parallel authz path.
-import * as postMutators from '../app/posts/mutator';
-// `notifier()` is a job factory, so a notification registers in the `jobs` list.
-import * as postNotifiers from '../app/posts/notifiers';
 import '../app/posts/service';
-import * as mcpJobs from '../app/mcp/jobs';
-import * as runActions from '../app/runs/actions';
-// `scrape()` is a job factory, so the sync registers in the `jobs` list like any other job. It
-// names itself (`runs.sync`): a scrape's name is a durable queue key, never an export name.
-import * as runJobs from '../app/runs/jobs';
-import { RUN_KEY_SCOPES, resolveRunKey } from '../app/runs/keys';
-import * as runQueries from '../app/runs/live';
 import '../app/runs/service';
-import * as settingsActions from '../app/settings/actions';
-// A mutator IS an action, exactly like `postMutators` above.
-import * as settingsMutators from '../app/settings/mutator';
-import * as webhookActions from '../app/webhooks/actions';
-// `webhook()` is a job factory, so a delivery registers in the `jobs` list. It names itself
-// (`posts.published.webhook`): a delivery's name is a durable queue key, never an export name.
-import * as webhookJobs from '../app/webhooks/jobs';
 import '../app/webhooks/service';
-import * as scheduledTasks from './tasks';
 
 export const api = defineApi({
   actions: [
-    postActions,
-    orgActions,
-    settingsActions,
-    contactActions,
-    authActions,
-    runActions,
-    webhookActions,
+    endSession,
+    contactSales,
+    inviteMember,
+    upgradePlan,
+    grantAvatarUpload,
+    memberAvatar,
+    createPost,
+    publishPost,
+    createComment,
+    requestPostsExport,
+    summarize,
+    summarizePosts,
+    reviewDraft,
+    keepDraftReview,
+    requestDraftReview,
+    connectSite,
+    startRun,
+    answerPrompt,
+    cancelRun,
+    issueRunKey,
+    revokeRunKey,
+    savePreferences,
+    subscribePush,
+    unsubscribePush,
+    addWebhookEndpoint,
+    removeWebhookEndpoint,
     mcpConfirmationActions,
   ],
-  mutators: [postMutators, settingsMutators],
-  queries: [postQueries, runQueries],
+  // A mutator IS an action, so it registers as one: the optimistic local twin rides on the same
+  // declaration instead of living in a parallel registry with a parallel authz path.
+  mutators: [likePost, movePostStatus, setTheme, toggleDigestOptIn],
+  queries: [
+    liveFeed,
+    orgPosts,
+    postRecord,
+    postById,
+    feedActivity,
+    postReview,
+    publicPost,
+    publicPosts,
+    publicPostSlugs,
+    postBySlug,
+    liveRunEvents,
+    runConnections,
+  ],
+  // Named jobs keep their own durable names (`runs.sync`, `posts.published.webhook`, a backfill's
+  // ledger key); every other job's export name is its queue key.
   jobs: [
-    postJobs,
-    postNotifiers,
-    postBackfills,
-    orgJobs,
-    digestJobs,
-    contactJobs,
-    runJobs,
-    mcpJobs,
-    webhookJobs,
-    // `agentJob()` is a job factory declared BESIDE the agent it wraps (`reviewDraftLater`, which
-    // reads `reviewDraft` at module scope), so the actions module is handed over here too. Each
-    // registrar takes only its own kind, so neither list double-registers anything.
-    postActions,
+    notifySubscribers,
+    exportPosts,
+    commentPosted,
+    reviewDraftLater,
+    postExcerpts,
+    onboardOrg,
+    sendInvite,
+    sendDigest,
+    deliverDigest,
+    sendSalesReceipt,
+    syncConnection,
+    purgeMcpConfirmations,
+    postPublishedWebhook,
   ],
-  tasks: [scheduledTasks],
+  tasks: [nightlyDigest, hourlyPurge],
   // A second door for machine callers, onto the run actions a browser already calls: same
   // handler, same policy, a bearer key instead of a session. `/api/runs/start` is `/v1/runs/start`.
   http: { mounts: [{ prefix: '/v1', scopes: RUN_KEY_SCOPES, resolveToken: resolveRunKey }] },
diff --git a/examples/dummy/apps/web/app/auth/actions.test.ts b/examples/dummy/apps/web/app/auth/actions.test.ts
index c5a2332f6..29b441bdf 100644
--- a/examples/dummy/apps/web/app/auth/actions.test.ts
+++ b/examples/dummy/apps/web/app/auth/actions.test.ts
@@ -4,7 +4,7 @@
 import { runWithContext } from '@ultimat3/core';
 import { asCtx, defineHttpConfig, requestContext } from '@ultimat3/http';
 import { describe, expect, test } from '@ultimat3/testing';
-import { AFTER_SIGN_OUT, endSession } from './actions';
+import { AFTER_SIGN_OUT, endSession } from './actions/end-session';
 import { DEMO_MEMBER_COOKIE, DEMO_SIGNED_OUT } from './demo-actor';
 
 const signOut = async (accept: string) => {
diff --git a/examples/dummy/apps/web/app/auth/actions.ts b/examples/dummy/apps/web/app/auth/actions/end-session.ts
similarity index 97%
rename from examples/dummy/apps/web/app/auth/actions.ts
rename to examples/dummy/apps/web/app/auth/actions/end-session.ts
index e611117c1..d17ca740b 100644
--- a/examples/dummy/apps/web/app/auth/actions.ts
+++ b/examples/dummy/apps/web/app/auth/actions/end-session.ts
@@ -13,7 +13,7 @@ import { action, t } from '@ultimat3/action';
 import { signOutHeaders } from '@ultimat3/auth';
 import { setCookie, setRedirect, useRequestHeader } from '@ultimat3/http';
 import { allow } from '@ultimat3/policy';
-import { DEMO_MEMBER_COOKIE, DEMO_SIGNED_OUT } from './demo-actor';
+import { DEMO_MEMBER_COOKIE, DEMO_SIGNED_OUT } from '../demo-actor';
 
 /** Where a signed-out reader lands: the public site, which asks nothing of a session. */
 export const AFTER_SIGN_OUT = '/';
diff --git a/examples/dummy/apps/web/app/contact/actions.ts b/examples/dummy/apps/web/app/contact/actions/contact-sales.ts
similarity index 96%
rename from examples/dummy/apps/web/app/contact/actions.ts
rename to examples/dummy/apps/web/app/contact/actions/contact-sales.ts
index f29554b9f..e3f61c373 100644
--- a/examples/dummy/apps/web/app/contact/actions.ts
+++ b/examples/dummy/apps/web/app/contact/actions/contact-sales.ts
@@ -8,8 +8,8 @@
 
 import { BILLING_CURRENCIES, PLAN_CODES, SUPPORTED_LOCALES } from '@postly/domain';
 import { action, t } from '@ultimat3/action';
-import { contactSubmit } from '../../shared/policies';
-import { sendSalesReceipt } from './jobs';
+import { contactSubmit } from '../../../shared/policies';
+import { sendSalesReceipt } from '../jobs/send-sales-receipt';
 
 /** Long enough for a real question, short enough that the row and the idempotency key stay sane. */
 export const ENQUIRY_MAX = 2_000;
diff --git a/examples/dummy/apps/web/app/contact/jobs.ts b/examples/dummy/apps/web/app/contact/jobs/send-sales-receipt.ts
similarity index 98%
rename from examples/dummy/apps/web/app/contact/jobs.ts
rename to examples/dummy/apps/web/app/contact/jobs/send-sales-receipt.ts
index dbc8e0e55..74f2e0bb2 100644
--- a/examples/dummy/apps/web/app/contact/jobs.ts
+++ b/examples/dummy/apps/web/app/contact/jobs/send-sales-receipt.ts
@@ -8,7 +8,7 @@
 
 import { job, t } from '@ultimat3/jobs';
 import { send } from '@ultimat3/mail';
-import { salesReceiptEmail } from './mail';
+import { salesReceiptEmail } from '../mail';
 
 export const sendSalesReceipt = job({
   // The locale rides in the payload rather than being read off a request: the worker renders this
diff --git a/examples/dummy/apps/web/app/digest/jobs.job.test.ts b/examples/dummy/apps/web/app/digest/jobs.job.test.ts
index 0a69587a5..a1796f046 100644
--- a/examples/dummy/apps/web/app/digest/jobs.job.test.ts
+++ b/examples/dummy/apps/web/app/digest/jobs.job.test.ts
@@ -29,7 +29,8 @@ import {
   setMailDriver,
   tryMailDriver,
 } from '@ultimat3/mail';
-import { deliverDigest, digestEnabled, sendDigest } from './jobs';
+import { deliverDigest } from './jobs/deliver-digest';
+import { digestEnabled, sendDigest } from './jobs/send-digest';
 
 const TINTA = '00000000-0000-4000-8000-00000000e001';
 const NUBE = '00000000-0000-4000-8000-00000000e002';
diff --git a/examples/dummy/apps/web/app/digest/jobs/deliver-digest.ts b/examples/dummy/apps/web/app/digest/jobs/deliver-digest.ts
new file mode 100644
index 000000000..eabac5719
--- /dev/null
+++ b/examples/dummy/apps/web/app/digest/jobs/deliver-digest.ts
@@ -0,0 +1,90 @@
+// `deliverDigest`, the digest slice's job — one primitive per file, the layout `x g` writes.
+//
+// The nightly digest. The scheduler fires once, in UTC; the *delivery* is per member, at 09:00
+// on their own wall clock. That is why this is two jobs: one fan-out that computes slots, and one
+// delivery whose idempotency key is the slot it is for.
+//
+// The delivery's unit is one (org, zone) group, not one member. Both halves of that follow from
+// what a digest costs: the post window is org-scoped and bounded by the group's own instant, so a
+// per-member delivery re-ran the identical `publishedSince` once per reader and re-read the row
+// it was handed the id of. A group runs each of those once and mails everybody from the result.
+// The member's promise is unchanged — every member of a group shares a zone, so 09:00 still means
+// 09:00 where they are.
+//
+// `t` comes from @ultimat3/jobs, not @ultimat3/schema: a job file imports one package.
+
+import { previousDigestAt } from '@postly/core';
+import { SUPPORTED_ZONES, orgId as toOrgId } from '@postly/domain';
+import { job, t } from '@ultimat3/jobs';
+import { send } from '@ultimat3/mail';
+import { digestEmail } from '../mail';
+
+export const deliverDigest = job({
+  /**
+   * `slotAt` is the instant this digest is FOR — the group's 09:00, in epoch ms. It travels in
+   * the payload because the queue is allowed to be late: four attempts of exponential backoff
+   * put `ctx.now()` hours past the slot, and a window measured from *then* would load a later
+   * day's posts than the `localDate` the email prints.
+   *
+   * `orgId` and `zone` travel for the same reason the window does: they are what the delivery is
+   * FOR. Reading them back off a member row is the read this payload exists to delete.
+   */
+  input: t.object({
+    orgId: t.uuid,
+    zone: t.enumerated(...SUPPORTED_ZONES),
+    localDate: t.string,
+    slotAt: t.number.int(),
+  }),
+  /** Local date, not UTC date: two zones inside one org are two different digests. */
+  idempotencyKey: ({ orgId, zone, localDate }) => `digest:${orgId}:${zone}:${localDate}`,
+  /** One group is one org: the posts, the org row and the readers are all read under this id. */
+  tenant: ({ orgId }) => orgId,
+  retry: { attempts: 4, backoff: 'exponential' },
+  queue: 'mail',
+  /** One group in flight at a time, so a retry cannot race its own first attempt. */
+  concurrency: 1,
+  async run({ input, step, ctx }) {
+    const orgId = toOrgId(input.orgId);
+
+    // The window ends at the slot, never at execution time: the digest dated `localDate` must
+    // contain the posts of that day whether it went out on time or after three retries. It OPENS
+    // at the previous slot — the same calendar math, not `slotAt - 86_400_000`, because
+    // consecutive slots are 23h apart on spring-forward and 25h on autumn-back, and a fixed day
+    // of milliseconds mails those posts twice in March and to nobody in October. Same window
+    // `postly.digestPreview` promises.
+    //
+    // ONE read for every reader of this digest, which is the whole reason the group exists.
+    const since = previousDigestAt(new Date(input.slotAt), input.zone);
+    const posts = await step.run('load-posts', () => ctx.posts.publishedSince(orgId, since));
+
+    // An empty digest is not a digest. Skipping still records the step, so a retry does not
+    // re-query — and it skips the two reads below, so an org with nothing to say costs one
+    // statement in total.
+    if (posts.length === 0) return { sent: 0 };
+
+    // The org's NAME, because the mail's `{org}` is a name slot.
+    const org = await step.run('load-org', () => ctx.orgs.byId(orgId));
+
+    // Read at the slot rather than carried from the fan-out, and that is the point: a member who
+    // opted out during the night is gone from this list, and a page of rows in a job payload is
+    // the thing this repo refuses everywhere else. One statement, whatever the group's size.
+    const recipients = await step.run('load-recipients', async () =>
+      (await ctx.orgs.digestRecipients(orgId)).filter((member) => member.tz === input.zone),
+    );
+
+    for (const member of recipients) {
+      // One step per member: the step IS the retry unit, so a provider blip on reader 40 of 50
+      // re-sends reader 40 and replays the other 39 from storage in microseconds. The member's
+      // id names it because the id is what survives a replay — a loop index does not.
+      await step.run(`send:${member.id}`, () =>
+        send(
+          digestEmail,
+          { member, posts, localDate: input.localDate, org: org.name },
+          { to: member.email, locale: member.locale, tz: member.tz },
+        ),
+      );
+    }
+
+    return { sent: recipients.length };
+  },
+});
diff --git a/examples/dummy/apps/web/app/digest/jobs.ts b/examples/dummy/apps/web/app/digest/jobs/send-digest.ts
similarity index 53%
rename from examples/dummy/apps/web/app/digest/jobs.ts
rename to examples/dummy/apps/web/app/digest/jobs/send-digest.ts
index 438cc6e49..ede6782d0 100644
--- a/examples/dummy/apps/web/app/digest/jobs.ts
+++ b/examples/dummy/apps/web/app/digest/jobs/send-digest.ts
@@ -1,25 +1,23 @@
-/**
- * The nightly digest. The scheduler fires once, in UTC; the *delivery* is per member, at 09:00
- * on their own wall clock. That is why this is two jobs: one fan-out that computes slots, and one
- * delivery whose idempotency key is the slot it is for.
- *
- * The delivery's unit is one (org, zone) group, not one member. Both halves of that follow from
- * what a digest costs: the post window is org-scoped and bounded by the group's own instant, so a
- * per-member delivery re-ran the identical `publishedSince` once per reader and re-read the row
- * it was handed the id of. A group runs each of those once and mails everybody from the result.
- * The member's promise is unchanged — every member of a group shares a zone, so 09:00 still means
- * 09:00 where they are.
- *
- * `t` comes from @ultimat3/jobs, not @ultimat3/schema: a job file imports one package.
- */
-
-import { localDateIn, previousDigestAt, scheduleByOrgAndZone } from '@postly/core';
-import { SUPPORTED_ZONES, orgId as toOrgId } from '@postly/domain';
+// `sendDigest`, the digest slice's job — one primitive per file, the layout `x g` writes.
+//
+// The nightly digest. The scheduler fires once, in UTC; the *delivery* is per member, at 09:00
+// on their own wall clock. That is why this is two jobs: one fan-out that computes slots, and one
+// delivery whose idempotency key is the slot it is for.
+//
+// The delivery's unit is one (org, zone) group, not one member. Both halves of that follow from
+// what a digest costs: the post window is org-scoped and bounded by the group's own instant, so a
+// per-member delivery re-ran the identical `publishedSince` once per reader and re-read the row
+// it was handed the id of. A group runs each of those once and mails everybody from the result.
+// The member's promise is unchanged — every member of a group shares a zone, so 09:00 still means
+// 09:00 where they are.
+//
+// `t` comes from @ultimat3/jobs, not @ultimat3/schema: a job file imports one package.
+
+import { localDateIn, scheduleByOrgAndZone } from '@postly/core';
 import { assert } from '@ultimat3/core';
 import { defineFlag, isEnabled } from '@ultimat3/flags';
 import { job, t } from '@ultimat3/jobs';
-import { send } from '@ultimat3/mail';
-import { digestEmail } from './mail';
+import { deliverDigest } from './deliver-digest';
 
 /** The shape the nightly task sends, and the only one the slot arithmetic below can read. */
 const RUN_DATE = /^\d{4}-\d{2}-\d{2}$/;
@@ -115,73 +113,3 @@ export const sendDigest = job({
     return { runDate: input.runDate, groups: groups.length };
   },
 });
-
-export const deliverDigest = job({
-  /**
-   * `slotAt` is the instant this digest is FOR — the group's 09:00, in epoch ms. It travels in
-   * the payload because the queue is allowed to be late: four attempts of exponential backoff
-   * put `ctx.now()` hours past the slot, and a window measured from *then* would load a later
-   * day's posts than the `localDate` the email prints.
-   *
-   * `orgId` and `zone` travel for the same reason the window does: they are what the delivery is
-   * FOR. Reading them back off a member row is the read this payload exists to delete.
-   */
-  input: t.object({
-    orgId: t.uuid,
-    zone: t.enumerated(...SUPPORTED_ZONES),
-    localDate: t.string,
-    slotAt: t.number.int(),
-  }),
-  /** Local date, not UTC date: two zones inside one org are two different digests. */
-  idempotencyKey: ({ orgId, zone, localDate }) => `digest:${orgId}:${zone}:${localDate}`,
-  /** One group is one org: the posts, the org row and the readers are all read under this id. */
-  tenant: ({ orgId }) => orgId,
-  retry: { attempts: 4, backoff: 'exponential' },
-  queue: 'mail',
-  /** One group in flight at a time, so a retry cannot race its own first attempt. */
-  concurrency: 1,
-  async run({ input, step, ctx }) {
-    const orgId = toOrgId(input.orgId);
-
-    // The window ends at the slot, never at execution time: the digest dated `localDate` must
-    // contain the posts of that day whether it went out on time or after three retries. It OPENS
-    // at the previous slot — the same calendar math, not `slotAt - 86_400_000`, because
-    // consecutive slots are 23h apart on spring-forward and 25h on autumn-back, and a fixed day
-    // of milliseconds mails those posts twice in March and to nobody in October. Same window
-    // `postly.digestPreview` promises.
-    //
-    // ONE read for every reader of this digest, which is the whole reason the group exists.
-    const since = previousDigestAt(new Date(input.slotAt), input.zone);
-    const posts = await step.run('load-posts', () => ctx.posts.publishedSince(orgId, since));
-
-    // An empty digest is not a digest. Skipping still records the step, so a retry does not
-    // re-query — and it skips the two reads below, so an org with nothing to say costs one
-    // statement in total.
-    if (posts.length === 0) return { sent: 0 };
-
-    // The org's NAME, because the mail's `{org}` is a name slot.
-    const org = await step.run('load-org', () => ctx.orgs.byId(orgId));
-
-    // Read at the slot rather than carried from the fan-out, and that is the point: a member who
-    // opted out during the night is gone from this list, and a page of rows in a job payload is
-    // the thing this repo refuses everywhere else. One statement, whatever the group's size.
-    const recipients = await step.run('load-recipients', async () =>
-      (await ctx.orgs.digestRecipients(orgId)).filter((member) => member.tz === input.zone),
-    );
-
-    for (const member of recipients) {
-      // One step per member: the step IS the retry unit, so a provider blip on reader 40 of 50
-      // re-sends reader 40 and replays the other 39 from storage in microseconds. The member's
-      // id names it because the id is what survives a replay — a loop index does not.
-      await step.run(`send:${member.id}`, () =>
-        send(
-          digestEmail,
-          { member, posts, localDate: input.localDate, org: org.name },
-          { to: member.email, locale: member.locale, tz: member.tz },
-        ),
-      );
-    }
-
-    return { sent: recipients.length };
-  },
-});
diff --git a/examples/dummy/apps/web/api/tasks.ts b/examples/dummy/apps/web/app/digest/tasks/nightly-digest.ts
similarity index 56%
rename from examples/dummy/apps/web/api/tasks.ts
rename to examples/dummy/apps/web/app/digest/tasks/nightly-digest.ts
index 121ce4c6a..5c7b810ff 100644
--- a/examples/dummy/apps/web/api/tasks.ts
+++ b/examples/dummy/apps/web/app/digest/tasks/nightly-digest.ts
@@ -1,13 +1,12 @@
-/**
- * Scheduled triggers. A task only enqueues — if it does work, it is a job. The `scheduler` role
- * is a single instance elected by a Postgres advisory lock; a missed tick fires late rather than
- * being skipped, and the job's idempotency key absorbs a double fire during handover.
- */
+// `nightlyDigest`, the api slice's task — one primitive per file, the layout `x g` writes.
+//
+// Scheduled triggers. A task only enqueues — if it does work, it is a job. The `scheduler` role
+// is a single instance elected by a Postgres advisory lock; a missed tick fires late rather than
+// being skipped, and the job's idempotency key absorbs a double fire during handover.
 
 import { localDateIn } from '@postly/core';
-import { DEFAULT_PURGE_CRON, task } from '@ultimat3/jobs';
-import { sendDigest } from '../app/digest/jobs';
-import { purgeMcpConfirmations } from '../app/mcp/jobs';
+import { task } from '@ultimat3/jobs';
+import { sendDigest } from '../jobs/send-digest';
 
 /**
  * Fires once, in UTC, before any member's 09:00 — the fan-out then schedules each member for
@@ -25,13 +24,3 @@ export const nightlyDigest = task({
     [sendDigest, { runDate: localDateIn(new Date(occurrenceMs), 'UTC') }],
   ],
 });
-
-/**
- * The retention sweep, hourly at the framework's own minute (`DEFAULT_PURGE_CRON`). The job's key
- * is fixed, so a tick that fires while the last pass is still running is that same pass.
- */
-export const hourlyPurge = task({
-  cron: DEFAULT_PURGE_CRON,
-  tz: 'UTC',
-  enqueue: () => [[purgeMcpConfirmations, {}]],
-});
diff --git a/examples/dummy/apps/web/app/feed/live.ts b/examples/dummy/apps/web/app/feed/live.ts
index 7d14dcd38..1f059f766 100644
--- a/examples/dummy/apps/web/app/feed/live.ts
+++ b/examples/dummy/apps/web/app/feed/live.ts
@@ -2,7 +2,7 @@
  * The feed's live query, as the BROWSER can name it.
  *
  * `useQuery({ name: LIVE_FEED, live: true }, { orgId })` takes a name and the declaration's
- * live-ness — never the query VALUE: importing `liveFeed` drags `app/posts/live.ts` → `repo.ts` →
+ * live-ness — never the query VALUE: importing `liveFeed` drags `app/posts/live/live-feed.ts` → `repo.ts` →
  * the whole read path into the client bundle. Measured, `Bun.build --target browser` over the old
  * `./hooks.ts`: **698,801 bytes**, against this route's 60 kB budget. The name crosses, the
  * implementation never does — the same seam `shared/client.ts` uses for reads and writes.
diff --git a/examples/dummy/apps/web/app/layout.tsx b/examples/dummy/apps/web/app/layout.tsx
index 715bc98d1..297dab37c 100644
--- a/examples/dummy/apps/web/app/layout.tsx
+++ b/examples/dummy/apps/web/app/layout.tsx
@@ -22,7 +22,7 @@ import { viewerOf } from '../shared/viewer';
 import styles from './layout.module.scss';
 import { ViewerProvider } from './viewer-context';
 
-/** `endSession` → `POST /api/sessions/end`, derived — `app/auth/actions.ts` sets the cookie. */
+/** `endSession` → `POST /api/sessions/end`, derived — `app/auth/actions/end-session.ts` sets the cookie. */
 const SIGN_OUT_ENDPOINT = derivePath('endSession' satisfies keyof Api['actions']).path;
 
 const BANNER_PROPS = ['label', 'action'] as const;
@@ -59,7 +59,7 @@ export function Layout(props: {
           {/*
             No org switcher yet. `@postly/ui`'s `OrgSwitcher` posts a native form to a path nothing
             serves (`/_x/session/org`, until 2026-08). A session write IS an action's to make —
-            `app/auth/actions.ts`' sign-out below sets its cookie on `ctx.headers` — so switching
+            `app/auth/actions/`' sign-out below sets its cookie on `ctx.headers` — so switching
             org is the same shape, one more action, when an org switcher earns its place.
           */}
           <nav class={styles.nav} aria-label={t('app.nav.org')}>
diff --git a/examples/dummy/apps/web/app/mcp/jobs.job.test.ts b/examples/dummy/apps/web/app/mcp/jobs.job.test.ts
index f588e519c..fd743424a 100644
--- a/examples/dummy/apps/web/app/mcp/jobs.job.test.ts
+++ b/examples/dummy/apps/web/app/mcp/jobs.job.test.ts
@@ -7,7 +7,7 @@
 
 import { confirmationStore } from '@postly/mcp/confirmations';
 import { expect, jobTest } from '@ultimat3/testing';
-import { CONFIRMATION_RETENTION_MS, purgeMcpConfirmations } from './jobs';
+import { CONFIRMATION_RETENTION_MS, purgeMcpConfirmations } from './jobs/purge-mcp-confirmations';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
 
diff --git a/examples/dummy/apps/web/app/mcp/jobs.ts b/examples/dummy/apps/web/app/mcp/jobs/purge-mcp-confirmations.ts
similarity index 94%
rename from examples/dummy/apps/web/app/mcp/jobs.ts
rename to examples/dummy/apps/web/app/mcp/jobs/purge-mcp-confirmations.ts
index 5a4b1ff4d..fec4dbc75 100644
--- a/examples/dummy/apps/web/app/mcp/jobs.ts
+++ b/examples/dummy/apps/web/app/mcp/jobs/purge-mcp-confirmations.ts
@@ -3,7 +3,7 @@
  * (`@postly/mcp`'s `confirmAgentPublish`) and nothing deletes one, so the table grows with every
  * request an agent ever made. `purge()` is the job factory for exactly that: one durable step per
  * target, one clock reading per pass, and at-least-once is safe because a replayed delete removes
- * rows that are already gone. `api/tasks.ts` fires it.
+ * rows that are already gone. `mcp/tasks/hourly-purge.ts` fires it.
  *
  * `t` would come from @ultimat3/jobs; this file declares no input of its own.
  */
diff --git a/examples/dummy/apps/web/app/mcp/tasks/hourly-purge.ts b/examples/dummy/apps/web/app/mcp/tasks/hourly-purge.ts
new file mode 100644
index 000000000..cb7c2c8fc
--- /dev/null
+++ b/examples/dummy/apps/web/app/mcp/tasks/hourly-purge.ts
@@ -0,0 +1,18 @@
+// `hourlyPurge`, the api slice's task — one primitive per file, the layout `x g` writes.
+//
+// Scheduled triggers. A task only enqueues — if it does work, it is a job. The `scheduler` role
+// is a single instance elected by a Postgres advisory lock; a missed tick fires late rather than
+// being skipped, and the job's idempotency key absorbs a double fire during handover.
+
+import { DEFAULT_PURGE_CRON, task } from '@ultimat3/jobs';
+import { purgeMcpConfirmations } from '../jobs/purge-mcp-confirmations';
+
+/**
+ * The retention sweep, hourly at the framework's own minute (`DEFAULT_PURGE_CRON`). The job's key
+ * is fixed, so a tick that fires while the last pass is still running is that same pass.
+ */
+export const hourlyPurge = task({
+  cron: DEFAULT_PURGE_CRON,
+  tz: 'UTC',
+  enqueue: () => [[purgeMcpConfirmations, {}]],
+});
diff --git a/examples/dummy/apps/web/app/models.test.ts b/examples/dummy/apps/web/app/models.test.ts
index 41512d6bb..1cd63ef50 100644
--- a/examples/dummy/apps/web/app/models.test.ts
+++ b/examples/dummy/apps/web/app/models.test.ts
@@ -7,7 +7,8 @@
 import { configureAi, echoProvider, modelSpec, providerGateway } from '@ultimat3/ai';
 import { expect, test } from '@ultimat3/testing';
 import { APP_MODELS, CLAUDE_SONNET_5, claudeSonnet5 } from './models';
-import { reviewDraft, summarize } from './posts/actions';
+import { reviewDraft } from './posts/actions/review-draft';
+import { summarize } from './posts/actions/summarize';
 import { reviewDraftPrompt } from './posts/prompts/review-draft';
 import { summarizePrompt } from './posts/prompts/summarize';
 
diff --git a/examples/dummy/apps/web/app/orgs/actions.contract.test.ts b/examples/dummy/apps/web/app/orgs/actions.contract.test.ts
index 6e962a2cb..98b366f2c 100644
--- a/examples/dummy/apps/web/app/orgs/actions.contract.test.ts
+++ b/examples/dummy/apps/web/app/orgs/actions.contract.test.ts
@@ -14,7 +14,7 @@
 
 import { orgId, priceOf, seatLimit } from '@postly/domain';
 import { expect, test } from '@ultimat3/testing';
-import { upgradePlan } from './actions';
+import { upgradePlan } from './actions/upgrade-plan';
 import { orgById } from './repo';
 
 test('upgradePlan moves the plan and answers a receipt in the org’s own currency', async ({
diff --git a/examples/dummy/apps/web/app/orgs/actions.ts b/examples/dummy/apps/web/app/orgs/actions.ts
deleted file mode 100644
index f78974284..000000000
--- a/examples/dummy/apps/web/app/orgs/actions.ts
+++ /dev/null
@@ -1,89 +0,0 @@
-/**
- * Org commands. `inviteMember` is where the seat limit bites; `upgradePlan` is where money is
- * handled — in integer minor units, quoted by `@postly/core`, formatted by nobody here.
- *
- * `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
- */
-
-import { tag } from '@postly/db';
-import { memberId, PLAN_CODES } from '@postly/domain';
-import { action, t } from '@ultimat3/action';
-import { AvatarUploadGrant, AvatarView, InviteInput, MemberView, UpgradeReceipt } from './entity';
-import { sendInvite } from './jobs';
-import { memberSelf, orgAdminister, orgInvite } from './policy';
-
-export const inviteMember = action({
-  // orgId rides in the input because `orgInvite` decides on it — the rule reads the declaration,
-  // never the database.
-  input: InviteInput.extend({ orgId: t.uuid }),
-  output: MemberView,
-  policy: orgInvite,
-  cache: { invalidates: [tag.member, tag.org] },
-  mcp: { expose: true, description: 'Invite a person to the actor’s organisation' },
-  async handle({ input, ctx }) {
-    const member = await ctx.orgs.invite(input);
-    // The job enqueues itself, in the same transaction as the insert: a rolled-back invite never
-    // mails anyone.
-    // The org comes off the row that was just written, never off the input: `ctx.orgs.invite`
-    // seats the member in the ACTOR's org, and that is the tenant the job has to run as.
-    await sendInvite.enqueue({ memberId: memberId(member.id), orgId: member.orgId });
-    return member;
-  },
-});
-
-export const upgradePlan = action({
-  input: t.object({ orgId: t.uuid, plan: t.enumerated(...PLAN_CODES) }),
-  output: UpgradeReceipt,
-  policy: orgAdminister,
-  cache: { invalidates: [tag.org, tag.plan] },
-  mcp: {
-    expose: true,
-    description: 'Move the organisation to a higher plan and return the prorated receipt',
-  },
-  async handle({ input, ctx }) {
-    return ctx.orgs.upgrade(input.plan);
-  },
-});
-
-/**
- * The upload half of an avatar, and an `action` rather than a `route` because nothing but JSON
- * crosses here: the bytes go straight from the browser to the disk through the URL this mints.
- * No `orgId` in the input — the key is built from the ACTOR's org, and a tenant read off the
- * request is exactly the bypass `grantUpload` exists to prevent.
- *
- * Not an MCP tool. A presigned PUT is a capability, and an agent that cannot hold the bytes has
- * no use for one.
- */
-export const grantAvatarUpload = action({
-  input: t.object({
-    /** Used for its extension and nothing else — the stored name is opaque. */
-    filename: t.string.max(255),
-    contentType: t.string.max(255),
-    /** The client's own count, trusted for nothing: it only buys an early refusal. */
-    size: t.number.int().min(0).optional(),
-  }),
-  output: AvatarUploadGrant,
-  policy: memberSelf,
-  async handle({ input, ctx }) {
-    return ctx.orgs.grantAvatarUpload(input);
-  },
-});
-
-/**
- * The read half. An `action` and not a `query` for the same reason it takes no cache tag: every
- * call mints a fresh capability that expires, so a cached answer is a URL that has already died —
- * or worse, one actor's capability served to another.
- *
- * No `mcp` block, deliberately: the answer is a signed GET, which is a bearer capability — anyone
- * holding the string reads the bytes until it expires. A browser drops it on the next render; a
- * tool call copies it into a transcript that outlives it, for a picture no agent can look at.
- * `grantAvatarUpload` is closed to agents for the same reason, one exposure lower.
- */
-export const memberAvatar = action({
-  input: t.object({}),
-  output: AvatarView,
-  policy: memberSelf,
-  async handle({ ctx }) {
-    return { url: await ctx.orgs.avatarUrl() };
-  },
-});
diff --git a/examples/dummy/apps/web/app/orgs/actions/grant-avatar-upload.ts b/examples/dummy/apps/web/app/orgs/actions/grant-avatar-upload.ts
new file mode 100644
index 000000000..78ac6a9be
--- /dev/null
+++ b/examples/dummy/apps/web/app/orgs/actions/grant-avatar-upload.ts
@@ -0,0 +1,27 @@
+import { action, t } from '@ultimat3/action';
+import { AvatarUploadGrant } from '../entity';
+import { memberSelf } from '../policy';
+
+/**
+ * The upload half of an avatar, and an `action` rather than a `route` because nothing but JSON
+ * crosses here: the bytes go straight from the browser to the disk through the URL this mints.
+ * No `orgId` in the input — the key is built from the ACTOR's org, and a tenant read off the
+ * request is exactly the bypass `grantUpload` exists to prevent.
+ *
+ * Not an MCP tool. A presigned PUT is a capability, and an agent that cannot hold the bytes has
+ * no use for one.
+ */
+export const grantAvatarUpload = action({
+  input: t.object({
+    /** Used for its extension and nothing else — the stored name is opaque. */
+    filename: t.string.max(255),
+    contentType: t.string.max(255),
+    /** The client's own count, trusted for nothing: it only buys an early refusal. */
+    size: t.number.int().min(0).optional(),
+  }),
+  output: AvatarUploadGrant,
+  policy: memberSelf,
+  async handle({ input, ctx }) {
+    return ctx.orgs.grantAvatarUpload(input);
+  },
+});
diff --git a/examples/dummy/apps/web/app/orgs/actions/invite-member.ts b/examples/dummy/apps/web/app/orgs/actions/invite-member.ts
new file mode 100644
index 000000000..f1d374121
--- /dev/null
+++ b/examples/dummy/apps/web/app/orgs/actions/invite-member.ts
@@ -0,0 +1,32 @@
+// `inviteMember`, the orgs slice's action — one primitive per file, the layout `x g` writes.
+//
+// Org commands. `inviteMember` is where the seat limit bites; `upgradePlan` is where money is
+// handled — in integer minor units, quoted by `@postly/core`, formatted by nobody here.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+
+import { tag } from '@postly/db';
+import { memberId } from '@postly/domain';
+import { action, t } from '@ultimat3/action';
+import { InviteInput, MemberView } from '../entity';
+import { sendInvite } from '../jobs/send-invite';
+import { orgInvite } from '../policy';
+
+export const inviteMember = action({
+  // orgId rides in the input because `orgInvite` decides on it — the rule reads the declaration,
+  // never the database.
+  input: InviteInput.extend({ orgId: t.uuid }),
+  output: MemberView,
+  policy: orgInvite,
+  cache: { invalidates: [tag.member, tag.org] },
+  mcp: { expose: true, description: 'Invite a person to the actor’s organisation' },
+  async handle({ input, ctx }) {
+    const member = await ctx.orgs.invite(input);
+    // The job enqueues itself, in the same transaction as the insert: a rolled-back invite never
+    // mails anyone.
+    // The org comes off the row that was just written, never off the input: `ctx.orgs.invite`
+    // seats the member in the ACTOR's org, and that is the tenant the job has to run as.
+    await sendInvite.enqueue({ memberId: memberId(member.id), orgId: member.orgId });
+    return member;
+  },
+});
diff --git a/examples/dummy/apps/web/app/orgs/actions/member-avatar.ts b/examples/dummy/apps/web/app/orgs/actions/member-avatar.ts
new file mode 100644
index 000000000..b948dbea4
--- /dev/null
+++ b/examples/dummy/apps/web/app/orgs/actions/member-avatar.ts
@@ -0,0 +1,22 @@
+import { action, t } from '@ultimat3/action';
+import { AvatarView } from '../entity';
+import { memberSelf } from '../policy';
+
+/**
+ * The read half. An `action` and not a `query` for the same reason it takes no cache tag: every
+ * call mints a fresh capability that expires, so a cached answer is a URL that has already died —
+ * or worse, one actor's capability served to another.
+ *
+ * No `mcp` block, deliberately: the answer is a signed GET, which is a bearer capability — anyone
+ * holding the string reads the bytes until it expires. A browser drops it on the next render; a
+ * tool call copies it into a transcript that outlives it, for a picture no agent can look at.
+ * `grantAvatarUpload` is closed to agents for the same reason, one exposure lower.
+ */
+export const memberAvatar = action({
+  input: t.object({}),
+  output: AvatarView,
+  policy: memberSelf,
+  async handle({ ctx }) {
+    return { url: await ctx.orgs.avatarUrl() };
+  },
+});
diff --git a/examples/dummy/apps/web/app/orgs/actions/upgrade-plan.ts b/examples/dummy/apps/web/app/orgs/actions/upgrade-plan.ts
new file mode 100644
index 000000000..59e29ae82
--- /dev/null
+++ b/examples/dummy/apps/web/app/orgs/actions/upgrade-plan.ts
@@ -0,0 +1,26 @@
+// `upgradePlan`, the orgs slice's action — one primitive per file, the layout `x g` writes.
+//
+// Org commands. `inviteMember` is where the seat limit bites; `upgradePlan` is where money is
+// handled — in integer minor units, quoted by `@postly/core`, formatted by nobody here.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+
+import { tag } from '@postly/db';
+import { PLAN_CODES } from '@postly/domain';
+import { action, t } from '@ultimat3/action';
+import { UpgradeReceipt } from '../entity';
+import { orgAdminister } from '../policy';
+
+export const upgradePlan = action({
+  input: t.object({ orgId: t.uuid, plan: t.enumerated(...PLAN_CODES) }),
+  output: UpgradeReceipt,
+  policy: orgAdminister,
+  cache: { invalidates: [tag.org, tag.plan] },
+  mcp: {
+    expose: true,
+    description: 'Move the organisation to a higher plan and return the prorated receipt',
+  },
+  async handle({ input, ctx }) {
+    return ctx.orgs.upgrade(input.plan);
+  },
+});
diff --git a/examples/dummy/apps/web/app/orgs/jobs.job.test.ts b/examples/dummy/apps/web/app/orgs/jobs.job.test.ts
index f99df63ba..3e16ab0a0 100644
--- a/examples/dummy/apps/web/app/orgs/jobs.job.test.ts
+++ b/examples/dummy/apps/web/app/orgs/jobs.job.test.ts
@@ -5,8 +5,9 @@
 
 import { assert } from '@ultimat3/core';
 import { expect, type JobRunTrace, test } from '@ultimat3/testing';
-import { inviteMember } from './actions';
-import { onboardOrg, sendInvite } from './jobs';
+import { inviteMember } from './actions/invite-member';
+import { onboardOrg } from './jobs/onboard-org';
+import { sendInvite } from './jobs/send-invite';
 import { nudgeEmail } from './mail';
 
 /**
@@ -22,7 +23,7 @@ const executionsOf = (trace: JobRunTrace, step: string): number => {
   assert(
     tally !== undefined,
     `this run took no step named "${step}" — it took: ${Object.keys(trace.steps).join(', ')}`,
-    'check the step name against the step.run(...) calls in apps/web/app/orgs/jobs.ts',
+    'check the step name against the step.run(...) calls in apps/web/app/orgs/jobs/',
   );
   return tally.executions;
 };
diff --git a/examples/dummy/apps/web/app/orgs/jobs.ts b/examples/dummy/apps/web/app/orgs/jobs/onboard-org.ts
similarity index 53%
rename from examples/dummy/apps/web/app/orgs/jobs.ts
rename to examples/dummy/apps/web/app/orgs/jobs/onboard-org.ts
index df4fcbaf5..41d2f6ebb 100644
--- a/examples/dummy/apps/web/app/orgs/jobs.ts
+++ b/examples/dummy/apps/web/app/orgs/jobs/onboard-org.ts
@@ -1,14 +1,14 @@
-/**
- * Durable org work. `onboardOrg` spans three days: `step.sleep` persists a wake time and releases
- * the worker, so nothing is held open and the job resumes in a different process.
- *
- * `t` comes from @ultimat3/jobs, not @ultimat3/schema: a job file imports one package.
- */
+// `onboardOrg`, the orgs slice's job — one primitive per file, the layout `x g` writes.
+//
+// Durable org work. `onboardOrg` spans three days: `step.sleep` persists a wake time and releases
+// the worker, so nothing is held open and the job resumes in a different process.
+//
+// `t` comes from @ultimat3/jobs, not @ultimat3/schema: a job file imports one package.
 
-import { memberId as toMemberId, orgId as toOrgId } from '@postly/domain';
+import { orgId as toOrgId } from '@postly/domain';
 import { job, t } from '@ultimat3/jobs';
 import { send } from '@ultimat3/mail';
-import { inviteEmail, nudgeEmail, welcomeEmail } from './mail';
+import { nudgeEmail, welcomeEmail } from '../mail';
 
 export const onboardOrg = job({
   // The recipient rides in the payload: a job resumed three days later must not depend on a
@@ -35,27 +35,3 @@ export const onboardOrg = job({
     await step.run('nudge', () => send(nudgeEmail, org, recipient));
   },
 });
-
-export const sendInvite = job({
-  /**
-   * `orgId` rides beside the member id because `members` is tenant-scoped and the org is not
-   * recoverable from a member id without already being inside the tenant. It is also the org the
-   * read NAMES — `ctx.orgs.memberIn`, never `memberById`, which needs an acting member, and a
-   * served worker's actor is nobody: it carries the org this declaration put there and no more. `inviteMember` takes it off the row it just wrote, which is the org the member
-   * actually landed in.
-   */
-  input: t.object({ memberId: t.uuid, orgId: t.uuid }),
-  /** The member id alone: it is a uuid primary key, so the org would narrow nothing. */
-  idempotencyKey: ({ memberId }) => `invite:${memberId}`,
-  tenant: ({ orgId }) => orgId,
-  retry: { attempts: 3, backoff: 'exponential' },
-  queue: 'mail',
-  async run({ input, step, ctx }) {
-    const member = await step.run('load-member', () =>
-      ctx.orgs.memberIn(toOrgId(input.orgId), toMemberId(input.memberId)),
-    );
-    await step.run('send', () =>
-      send(inviteEmail, member, { to: member.email, locale: member.locale }),
-    );
-  },
-});
diff --git a/examples/dummy/apps/web/app/orgs/jobs/send-invite.ts b/examples/dummy/apps/web/app/orgs/jobs/send-invite.ts
new file mode 100644
index 000000000..daa47561f
--- /dev/null
+++ b/examples/dummy/apps/web/app/orgs/jobs/send-invite.ts
@@ -0,0 +1,35 @@
+// `sendInvite`, the orgs slice's job — one primitive per file, the layout `x g` writes.
+//
+// Durable org work. `onboardOrg` spans three days: `step.sleep` persists a wake time and releases
+// the worker, so nothing is held open and the job resumes in a different process.
+//
+// `t` comes from @ultimat3/jobs, not @ultimat3/schema: a job file imports one package.
+
+import { memberId as toMemberId, orgId as toOrgId } from '@postly/domain';
+import { job, t } from '@ultimat3/jobs';
+import { send } from '@ultimat3/mail';
+import { inviteEmail } from '../mail';
+
+export const sendInvite = job({
+  /**
+   * `orgId` rides beside the member id because `members` is tenant-scoped and the org is not
+   * recoverable from a member id without already being inside the tenant. It is also the org the
+   * read NAMES — `ctx.orgs.memberIn`, never `memberById`, which needs an acting member, and a
+   * served worker's actor is nobody: it carries the org this declaration put there and no more. `inviteMember` takes it off the row it just wrote, which is the org the member
+   * actually landed in.
+   */
+  input: t.object({ memberId: t.uuid, orgId: t.uuid }),
+  /** The member id alone: it is a uuid primary key, so the org would narrow nothing. */
+  idempotencyKey: ({ memberId }) => `invite:${memberId}`,
+  tenant: ({ orgId }) => orgId,
+  retry: { attempts: 3, backoff: 'exponential' },
+  queue: 'mail',
+  async run({ input, step, ctx }) {
+    const member = await step.run('load-member', () =>
+      ctx.orgs.memberIn(toOrgId(input.orgId), toMemberId(input.memberId)),
+    );
+    await step.run('send', () =>
+      send(inviteEmail, member, { to: member.email, locale: member.locale }),
+    );
+  },
+});
diff --git a/examples/dummy/apps/web/app/orgs/service.ts b/examples/dummy/apps/web/app/orgs/service.ts
index eaec66fb1..75aaec208 100644
--- a/examples/dummy/apps/web/app/orgs/service.ts
+++ b/examples/dummy/apps/web/app/orgs/service.ts
@@ -140,7 +140,7 @@ export const orgsService = defineService('orgs', (ctx) => ({
 
   /**
    * The member a background run acts FOR, and their org, re-read on every attempt — the half of an
-   * `agentJob`'s `actor` an app owns (`app/posts/actions.ts`'s `reviewDraftLater`). No acting
+   * `agentJob`'s `actor` an app owns (`app/posts/jobs/review-draft-later.ts`'s `reviewDraftLater`). No acting
    * member is required, because the caller is a job whose actor carries only the org it DECLARED;
    * the org is named, and the entity guard refuses a read outside the actor's own, so a request
    * cannot use this to reach another tenant. A member who left is `X_ORG_NOT_FOUND`, never trusted
diff --git a/examples/dummy/apps/web/app/posts/[id]/page.tsx b/examples/dummy/apps/web/app/posts/[id]/page.tsx
index 7a7c8e48d..cd1ddabc3 100644
--- a/examples/dummy/apps/web/app/posts/[id]/page.tsx
+++ b/examples/dummy/apps/web/app/posts/[id]/page.tsx
@@ -4,7 +4,7 @@
  * `offline: 'runtime'` — network first, the device's copy only when the network fails — so a post
  * read once opens again in a tunnel, which is what the offline like on this page is for. A render
  * cached on the device is one principal's view, and it can only ever be shown to that principal:
- * sign-out (`endSession`, `app/auth/actions.ts`) answers `Clear-Site-Data: "cache", "storage"`,
+ * sign-out (`endSession`, `app/auth/actions/end-session.ts`) answers `Clear-Site-Data: "cache", "storage"`,
  * which drops the service worker's caches, and the page boot wipes any other principal's stored
  * record scopes before it reads one. It was `network-only` while neither was true.
  */
diff --git a/examples/dummy/apps/web/app/posts/actions.contract.test.ts b/examples/dummy/apps/web/app/posts/actions.contract.test.ts
index ade7d838c..e659b8db9 100644
--- a/examples/dummy/apps/web/app/posts/actions.contract.test.ts
+++ b/examples/dummy/apps/web/app/posts/actions.contract.test.ts
@@ -9,8 +9,10 @@
  */
 
 import { contractTest, expect, test } from '@ultimat3/testing';
-import { createComment, createPost, publishPost } from './actions';
-import { notifySubscribers } from './jobs';
+import { createComment } from './actions/create-comment';
+import { createPost } from './actions/create-post';
+import { publishPost } from './actions/publish-post';
+import { notifySubscribers } from './jobs/notify-subscribers';
 
 const ORG = '00000000-0000-4000-8000-000000000002';
 const NOT_A_UUID = 'not-a-uuid';
diff --git a/examples/dummy/apps/web/app/posts/actions.test.ts b/examples/dummy/apps/web/app/posts/actions.test.ts
index c179848b1..8ee4feac6 100644
--- a/examples/dummy/apps/web/app/posts/actions.test.ts
+++ b/examples/dummy/apps/web/app/posts/actions.test.ts
@@ -8,8 +8,10 @@
 
 import { configureAi, echoProvider, providerGateway } from '@ultimat3/ai';
 import { beforeEach, expect, test } from '@ultimat3/testing';
-import { requestPostsExport, reviewDraft, summarizePosts } from './actions';
-import { exportPosts, postsExportPrefix } from './jobs';
+import { requestPostsExport } from './actions/request-posts-export';
+import { reviewDraft } from './actions/review-draft';
+import { summarizePosts } from './actions/summarize-posts';
+import { exportPosts, postsExportPrefix } from './jobs/export-posts';
 
 /** Every prompt the provider was sent, so a refusal can be shown to have cost nothing. */
 const sent: string[] = [];
diff --git a/examples/dummy/apps/web/app/posts/actions.ts b/examples/dummy/apps/web/app/posts/actions.ts
deleted file mode 100644
index fdfe72add..000000000
--- a/examples/dummy/apps/web/app/posts/actions.ts
+++ /dev/null
@@ -1,266 +0,0 @@
-/**
- * The posts feature's commands. Declarations only — every body delegates to `ctx.posts`, so the
- * same logic runs whether the caller is HTTP, the typed client, a job, an MCP tool or admin.
- *
- * `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
- * `llm`, `agent` and `hive` are the other framework imports here, and none is a second primitive:
- * each is a factory that RETURNS an `action`, so `summarize`, `reviewDraft` and `summarizePosts`
- * belong in this file for the same reason the rest do — see `docs/idea/09-ai-first.md`.
- */
-
-import { COMMENT_MAX, tag } from '@postly/db';
-import { memberId, orgId, postId } from '@postly/domain';
-import { action, t } from '@ultimat3/action';
-import { agent, agentJob, hive, llm } from '@ultimat3/ai';
-import { postlyActor } from '../../shared/actor';
-import { CommentView, CreatePostInput, DraftReview, PostView, ReviewView } from './entity';
-import { exportPosts, notifySubscribers, postsExportPrefix } from './jobs';
-import { commentPosted } from './notifiers';
-import { postCreate, postExport, postPublish, postRead, postReviewKeep } from './policy';
-import { reviewDraftPrompt } from './prompts/review-draft';
-import { summarizePrompt } from './prompts/summarize';
-
-export const createPost = action({
-  // orgId is part of the input because the policy decides on it — authz reads the declaration,
-  // never the database. A predicate that fetched a row would cost one query per live subscriber.
-  input: CreatePostInput.extend({ orgId: t.uuid }),
-  output: PostView,
-  policy: postCreate,
-  cache: { invalidates: [tag.feed] },
-  mcp: { expose: true, description: 'Create a draft post in the actor’s organisation' },
-  async handle({ input, ctx }) {
-    return ctx.posts.createDraft(input);
-  },
-});
-
-export const publishPost = action({
-  input: t.object({ postId: t.uuid, orgId: t.uuid, notify: t.boolean.default(true) }),
-  output: PostView,
-  policy: postPublish,
-  // `postPublish` decides about a post, not just about an org, so the post has to be loaded
-  // before the guard rather than inside it — the predicate stays synchronous, and this runs once
-  // per invocation instead of once per live subscriber.
-  //
-  // The loader runs BEFORE any policy, which is the ordering that decides the scope: the service
-  // reads inside the ACTING member's org and answers `null` for anyone without one, so a foreign
-  // caller reaches the rule with `row: null` and is denied. Scoping it to `input.orgId` instead
-  // put a tenancy error (`X_TENANCY_ACTOR_MISMATCH`, or `X_TENANCY_ACTOR_ORG_REQUIRED` for an
-  // anonymous caller) in front of the denial — an unscoped read is `X_TENANCY_UNSCOPED`, and
-  // neither is the `X_FORBIDDEN` this action's contract promises.
-  row: ({ input: { postId: id }, ctx }) => ctx.posts.authorship(postId(id)),
-  // `blog` too: publishing is the ONE write that puts a post on the public, anonymous blog, and
-  // `site/blog/*` sets `revalidate: { tags: [tag.blog] }`. Omitting it left those ISR pages
-  // pinned to whatever the build saw — the tag existed, nothing ever evicted it.
-  cache: { invalidates: [tag.post, tag.feed, tag.blog] },
-  mcp: { expose: true, description: 'Publish a draft post' },
-  async handle({ input, ctx }) {
-    const post = await ctx.posts.publish(postId(input.postId));
-    // The job enqueues itself through its own handle, in the same transaction as the publish: a
-    // rolled-back publish never mails anybody and a committed one always does.
-    // The org the policy already decided on, carried into the payload: the fanout's reads are
-    // tenant-scoped and a job has no request behind it to derive one from.
-    if (input.notify) await notifySubscribers.enqueue({ postId: post.id, orgId: input.orgId });
-    // The org's webhook receivers hear it too: one delivery per endpoint, in this same transaction.
-    await ctx.webhooks.announcePublished(post);
-    return post;
-  },
-});
-
-export const createComment = action({
-  input: t.object({ postId: t.uuid, orgId: t.uuid, body: t.string.min(1).max(COMMENT_MAX) }),
-  output: CommentView,
-  policy: postRead,
-  cache: { invalidates: [tag.comment, tag.post] },
-  mcp: { expose: true, description: 'Comment on a post the actor can read' },
-  async handle({ input, ctx }) {
-    const comment = await ctx.posts.comment(postId(input.postId), input.body);
-    // The author hears about it (`commentPosted`, a notifier — a job), enqueued in this request's
-    // transaction: a rolled-back comment mails nobody. The two names ride in the payload because
-    // the mail renders on a worker with no request to read them through.
-    const [post, me] = await Promise.all([ctx.posts.byId(postId(input.postId)), ctx.orgs.me()]);
-    await commentPosted.enqueue({
-      params: {
-        postId: post.id,
-        orgId: input.orgId,
-        commentId: comment.id,
-        commenterId: me.id,
-        title: post.title,
-        commenter: me.name,
-      },
-    });
-    return comment;
-  },
-});
-
-/**
- * Start an export of every post in the org. The work is `exportPosts`, a job, enqueued in this
- * request's transaction; the answer is where the artifact will land — `manifest.json` under
- * `prefix` once the job has written it. The id is minted here, so one request is one artifact and
- * a retried request (same idempotency key) is the same one.
- */
-export const requestPostsExport = action({
-  input: t.object({ orgId: t.uuid }),
-  output: t.object({ exportId: t.uuid, prefix: t.string }),
-  policy: postExport,
-  idempotent: true,
-  mcp: { expose: true, description: 'Export every post of the actor’s org as CSV to storage' },
-  async handle({ input }) {
-    const target = { orgId: input.orgId, exportId: crypto.randomUUID() };
-    await exportPosts.enqueue(target);
-    return { exportId: target.exportId, prefix: postsExportPrefix(target) };
-  },
-});
-
-/**
- * The one model call in Postly. There is no `llm` primitive — the framework has eight and a model
- * call is not one of them — so this is an `action` built by a factory, which is what gives it the
- * same policy, the same MCP projection, the same OpenAPI operation and the same contract tests as
- * every other command in this file.
- *
- * `orgId` is in the input for the usual reason: `postRead` decides on it. The named rule matters
- * more here than elsewhere — an inline `can('post:read')` would carry the grant and drop the
- * tenancy predicate, and "summarise any post by id" is exactly the read that must not cross an org.
- */
-export const summarize = llm({
-  input: t.object({ postId: t.uuid, orgId: t.uuid }),
-  output: t.object({ summary: t.string, tags: t.array(t.string) }),
-  policy: postRead,
-  prompt: summarizePrompt,
-  // The one declared place a model call loads data: the input is an id, the prompt needs the row
-  // behind it, and a reader can see exactly what was sent.
-  vars: async ({ input, ctx }) => {
-    const post = await ctx.posts.byId(postId(input.postId));
-    return { title: post.title, body: post.body, locale: ctx.locale };
-  },
-  // No `scope`, and that is now the safe answer: the default partitions on the calling ACTOR.
-  // Cosine similarity has no notion of a tenant, so the old `'global'` default answered one org
-  // with another's summary — a shared store has to be written down (`scope: () => 'global'`).
-  cache: { semantic: { threshold: 0.97, ttl: '7d' } },
-  // Refused before a token is spent, never truncated after — a runaway loop costs one refusal
-  // instead of a bill.
-  budget: { tokensIn: 8000, costPerCall: { minor: 5, currency: 'USD' } },
-  // The answer is two sentences and four tags. Left at the 4,096-token default, the pre-flight
-  // estimate — the WHOLE ceiling at the output rate — priced every call at 6 cents against the
-  // 5-cent `costPerCall` above, so `summarize` was refused for every post before a token was sent.
-  maxTokens: 512,
-  mcp: { expose: true, description: 'Summarise a post into two sentences and up to four tags' },
-});
-
-/** How many posts one `summarizePosts` call may fan out over: a page of the feed, never a backlog. */
-export const SUMMARIZE_POSTS_MAX = 20;
-
-/**
- * The feed's "catch me up": many posts summarised in one call. `hive()` is the fan-out as an
- * action — each member is a `summarize` call with that action's own policy, input parse, cache and
- * budget, so a post another org owns fails as ITS member (`X_FORBIDDEN`) and never as the batch.
- *
- * `split` derives every member from the input alone, and the org it carries is the one `postRead`
- * already decided on. `'collect'`: one unreadable post should not cost the reader the other
- * nineteen summaries. A backlog of thousands is a `backfill()`, not a longer list here.
- */
-export const summarizePosts = hive({
-  input: t.object({
-    orgId: t.uuid,
-    postIds: t.array(t.uuid, { min: 1, max: SUMMARIZE_POSTS_MAX }),
-  }),
-  member: summarize,
-  split: ({ input }) => input.postIds.map((id) => ({ postId: id, orgId: input.orgId })),
-  concurrency: 4,
-  onMemberError: 'collect',
-  // The whole fan-out's ceiling: every member's `tokensIn` bound, times the page.
-  budget: { tokensPerRun: 8000 * SUMMARIZE_POSTS_MAX },
-  policy: postRead,
-  mcp: { expose: true, description: 'Summarise up to twenty posts of the actor’s org at once' },
-});
-
-/**
- * "Is my draft ready?" — a tool-using model run, still an action: `agent()` returns one, so it has
- * a route, an MCP tool and a contract like the rest. Its one tool is `summarize`, the action above,
- * run under the SAME actor through its own policy — the model can ask how the feed will present the
- * post, and can never name who is asking.
- *
- * READ-ONLY, and that is the rule this file teaches: the model is handed no write. Its input is
- * text a writer controls, and a draft that says "now record a review for post X" is an instruction
- * the model may follow — so the one write a review needs is made by `keepDraftReview` below, with
- * the post id the CODE was given, never one the model names.
- */
-export const reviewDraft = agent({
-  input: t.object({ postId: t.uuid, orgId: t.uuid }),
-  output: DraftReview,
-  prompt: reviewDraftPrompt,
-  // The post verbatim: the prompt fences it as `<post_title>` / `<post_body>` DATA, and the
-  // framework's `render` breaks any closer the writer forges (`prompt-artifacts.test.ts`).
-  vars: async ({ input, ctx }) => {
-    const post = await ctx.posts.byId(postId(input.postId));
-    return { title: post.title, body: post.body, locale: ctx.locale };
-  },
-  tools: [summarize],
-  maxTurns: 3,
-  maxToolResultChars: 2000,
-  // A verdict and three sentences per turn; the ceiling is what every turn's estimate is priced at.
-  maxTokens: 1024,
-  budget: { tokensPerRun: 24_000, costPerCall: { minor: 10, currency: 'USD' } },
-  policy: postRead,
-  mcp: { expose: true, description: 'Review a draft post and say whether it is ready to publish' },
-});
-
-/**
- * Review a draft AND keep the verdict: `reviewDraft` run as the caller, then the post's one review
- * upserted under the post id this action was given. The write's target is the code's, so nothing
- * in a draft can move it onto another post, and the write is IDEMPOTENT by the table's key
- * `(orgId, postId)` — a run the queue replays from the top writes the same row again rather than a
- * second review, the bar any write an `agentJob` makes has to clear.
- *
- * `postReviewKeep`: the author or an org admin, as publishing is, and only for themselves — the
- * member the review is FOR is the caller. No `mcp`: an agent asks with `requestDraftReview`.
- */
-export const keepDraftReview = action({
-  input: t.object({ postId: t.uuid, orgId: t.uuid, memberId: t.uuid }),
-  output: ReviewView,
-  policy: postReviewKeep,
-  // Loaded before the guard, as `publishPost` loads its row: the rule decides on authorship.
-  row: ({ input: { postId: id }, ctx }) => ctx.posts.authorship(postId(id)),
-  async handle({ input, ctx }) {
-    const review = await reviewDraft.as(ctx.actor, { postId: input.postId, orgId: input.orgId });
-    return ctx.posts.recordReview(postId(input.postId), review);
-  },
-});
-
-/**
- * `keepDraftReview`, queued: the review an author asks for and reads back later from `postReview`.
- * `agentJob()` is a factory over `job()`, and it wraps ANY action — here the one that runs the
- * agent and keeps its answer, because a queued run's own output is not stored. Declared beside
- * what it wraps (it reads it at module scope) and registered in `api/index.ts`'s `jobs` list
- * through this module.
- *
- * `actor`: a worker's own actor is nobody, so the run re-reads the member its input names, inside
- * the org `tenant` declared, on EVERY attempt — a member who left, or lost the right, is refused
- * by the same rule a request meets rather than trusted from the payload that queued it.
- */
-export const reviewDraftLater = agentJob(keepDraftReview, {
-  name: 'posts.review',
-  tenant: (input) => input.orgId,
-  retry: { attempts: 3, backoff: 'exponential' },
-  // One queued review per post and member; a second request while one is live is the same run.
-  idempotencyKey: (input) => `review:${input.postId}:${input.memberId}`,
-  actor: async ({ input, ctx }) =>
-    postlyActor(await ctx.orgs.actingFor(orgId(input.orgId), memberId(input.memberId))),
-});
-
-/**
- * Ask for a kept review in the background — the author's or an org admin's right, as publishing
- * is (`postPublish`, on the row loaded before the guard). The member is the caller's own, read off
- * the actor — never a field of the input — and the run is enqueued in this request's transaction.
- */
-export const requestDraftReview = action({
-  input: t.object({ postId: t.uuid, orgId: t.uuid }),
-  output: t.object({ jobId: t.string }),
-  policy: postPublish,
-  row: ({ input: { postId: id }, ctx }) => ctx.posts.authorship(postId(id)),
-  mcp: { expose: true, description: 'Queue a review of your draft; read it back with postReview' },
-  async handle({ input, ctx }) {
-    const me = await ctx.orgs.me();
-    const queued = await reviewDraftLater.enqueue({ ...input, memberId: me.id });
-    return { jobId: queued.id };
-  },
-});
diff --git a/examples/dummy/apps/web/app/posts/actions/create-comment.ts b/examples/dummy/apps/web/app/posts/actions/create-comment.ts
new file mode 100644
index 000000000..d9d2e186c
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/actions/create-comment.ts
@@ -0,0 +1,42 @@
+// `createComment`, the posts slice's action — one primitive per file, the layout `x g` writes.
+//
+// The posts feature's commands. Declarations only — every body delegates to `ctx.posts`, so the
+// same logic runs whether the caller is HTTP, the typed client, a job, an MCP tool or admin.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+// `llm`, `agent` and `hive` are the other framework imports here, and none is a second primitive:
+// each is a factory that RETURNS an `action`, so `summarize`, `reviewDraft` and `summarizePosts`
+// belong in this file for the same reason the rest do — see `docs/idea/09-ai-first.md`.
+
+import { COMMENT_MAX, tag } from '@postly/db';
+import { postId } from '@postly/domain';
+import { action, t } from '@ultimat3/action';
+import { CommentView } from '../entity';
+import { commentPosted } from '../jobs/comment-posted';
+import { postRead } from '../policy';
+
+export const createComment = action({
+  input: t.object({ postId: t.uuid, orgId: t.uuid, body: t.string.min(1).max(COMMENT_MAX) }),
+  output: CommentView,
+  policy: postRead,
+  cache: { invalidates: [tag.comment, tag.post] },
+  mcp: { expose: true, description: 'Comment on a post the actor can read' },
+  async handle({ input, ctx }) {
+    const comment = await ctx.posts.comment(postId(input.postId), input.body);
+    // The author hears about it (`commentPosted`, a notifier — a job), enqueued in this request's
+    // transaction: a rolled-back comment mails nobody. The two names ride in the payload because
+    // the mail renders on a worker with no request to read them through.
+    const [post, me] = await Promise.all([ctx.posts.byId(postId(input.postId)), ctx.orgs.me()]);
+    await commentPosted.enqueue({
+      params: {
+        postId: post.id,
+        orgId: input.orgId,
+        commentId: comment.id,
+        commenterId: me.id,
+        title: post.title,
+        commenter: me.name,
+      },
+    });
+    return comment;
+  },
+});
diff --git a/examples/dummy/apps/web/app/posts/actions/create-post.ts b/examples/dummy/apps/web/app/posts/actions/create-post.ts
new file mode 100644
index 000000000..f90087258
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/actions/create-post.ts
@@ -0,0 +1,27 @@
+// `createPost`, the posts slice's action — one primitive per file, the layout `x g` writes.
+//
+// The posts feature's commands. Declarations only — every body delegates to `ctx.posts`, so the
+// same logic runs whether the caller is HTTP, the typed client, a job, an MCP tool or admin.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+// `llm`, `agent` and `hive` are the other framework imports here, and none is a second primitive:
+// each is a factory that RETURNS an `action`, so `summarize`, `reviewDraft` and `summarizePosts`
+// belong in this file for the same reason the rest do — see `docs/idea/09-ai-first.md`.
+
+import { tag } from '@postly/db';
+import { action, t } from '@ultimat3/action';
+import { CreatePostInput, PostView } from '../entity';
+import { postCreate } from '../policy';
+
+export const createPost = action({
+  // orgId is part of the input because the policy decides on it — authz reads the declaration,
+  // never the database. A predicate that fetched a row would cost one query per live subscriber.
+  input: CreatePostInput.extend({ orgId: t.uuid }),
+  output: PostView,
+  policy: postCreate,
+  cache: { invalidates: [tag.feed] },
+  mcp: { expose: true, description: 'Create a draft post in the actor’s organisation' },
+  async handle({ input, ctx }) {
+    return ctx.posts.createDraft(input);
+  },
+});
diff --git a/examples/dummy/apps/web/app/posts/actions/keep-draft-review.ts b/examples/dummy/apps/web/app/posts/actions/keep-draft-review.ts
new file mode 100644
index 000000000..d26c4845b
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/actions/keep-draft-review.ts
@@ -0,0 +1,27 @@
+import { postId } from '@postly/domain';
+import { action, t } from '@ultimat3/action';
+import { ReviewView } from '../entity';
+import { postReviewKeep } from '../policy';
+import { reviewDraft } from './review-draft';
+
+/**
+ * Review a draft AND keep the verdict: `reviewDraft` run as the caller, then the post's one review
+ * upserted under the post id this action was given. The write's target is the code's, so nothing
+ * in a draft can move it onto another post, and the write is IDEMPOTENT by the table's key
+ * `(orgId, postId)` — a run the queue replays from the top writes the same row again rather than a
+ * second review, the bar any write an `agentJob` makes has to clear.
+ *
+ * `postReviewKeep`: the author or an org admin, as publishing is, and only for themselves — the
+ * member the review is FOR is the caller. No `mcp`: an agent asks with `requestDraftReview`.
+ */
+export const keepDraftReview = action({
+  input: t.object({ postId: t.uuid, orgId: t.uuid, memberId: t.uuid }),
+  output: ReviewView,
+  policy: postReviewKeep,
+  // Loaded before the guard, as `publishPost` loads its row: the rule decides on authorship.
+  row: ({ input: { postId: id }, ctx }) => ctx.posts.authorship(postId(id)),
+  async handle({ input, ctx }) {
+    const review = await reviewDraft.as(ctx.actor, { postId: input.postId, orgId: input.orgId });
+    return ctx.posts.recordReview(postId(input.postId), review);
+  },
+});
diff --git a/examples/dummy/apps/web/app/posts/actions/like-post.ts b/examples/dummy/apps/web/app/posts/actions/like-post.ts
new file mode 100644
index 000000000..5c2e903ca
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/actions/like-post.ts
@@ -0,0 +1,35 @@
+// `likePost`, the posts slice's mutator — one primitive per file, the layout `x g` writes.
+//
+// Liking a post. A `mutator` rather than an `action` because it must work in a tunnel: `local`
+// runs against the durable client store immediately, `server` is authoritative, and `conflict`
+// says who wins when they disagree.
+//
+// `local` is replayed on every rebase, so it must stay a pure function of (tx, input):
+// no I/O, no `Date.now()`, no `Math.random()`. Its body — and the `LocalTables` row shape it
+// writes — live in `../like-mutation.ts`, because that is the module a BROWSER can load: an island
+// cannot import this file (it drags `@ultimat3/action`, the policy and the Postgres client into the
+// chunk), and a twin declared in both places is two declarations of one intent. One import, one
+// copy, and `likePostLocally` is what actually runs on both sides.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: a mutator file imports one package.
+
+import { tag } from '@postly/db';
+import { postId as toPostId } from '@postly/domain';
+import { mutator, t } from '@ultimat3/action';
+import { PostView } from '../entity';
+import { likePostLocally } from '../like-mutation';
+import { postLike } from '../policy';
+
+export const likePost = mutator({
+  input: t.object({ postId: t.uuid, orgId: t.uuid }),
+  output: PostView,
+  policy: postLike,
+  idempotent: true,
+  cache: { invalidates: [tag.post, tag.feed] },
+  mcp: { expose: true, description: 'Like a post on behalf of the acting member' },
+  local: likePostLocally,
+  async server(ctx, { postId }) {
+    return ctx.posts.like(toPostId(postId));
+  },
+  conflict: 'server-wins', // | 'last-write-wins' | custom(merge)
+});
diff --git a/examples/dummy/apps/web/app/posts/mutator.ts b/examples/dummy/apps/web/app/posts/actions/move-post-status.ts
similarity index 55%
rename from examples/dummy/apps/web/app/posts/mutator.ts
rename to examples/dummy/apps/web/app/posts/actions/move-post-status.ts
index 4cc13788f..facbe8372 100644
--- a/examples/dummy/apps/web/app/posts/mutator.ts
+++ b/examples/dummy/apps/web/app/posts/actions/move-post-status.ts
@@ -1,39 +1,23 @@
-/**
- * Liking a post. A `mutator` rather than an `action` because it must work in a tunnel: `local`
- * runs against the durable client store immediately, `server` is authoritative, and `conflict`
- * says who wins when they disagree.
- *
- * `local` is replayed on every rebase, so it must stay a pure function of (tx, input):
- * no I/O, no `Date.now()`, no `Math.random()`. Its body — and the `LocalTables` row shape it
- * writes — live in `../like-mutation.ts`, because that is the module a BROWSER can load: an island
- * cannot import this file (it drags `@ultimat3/action`, the policy and the Postgres client into the
- * chunk), and a twin declared in both places is two declarations of one intent. One import, one
- * copy, and `likePostLocally` is what actually runs on both sides.
- *
- * `t` comes from @ultimat3/action, not @ultimat3/schema: a mutator file imports one package.
- */
+// `movePostStatus`, the posts slice's transition (a mutator) — one primitive per file, the layout `x g` writes.
+//
+// Liking a post. A `mutator` rather than an `action` because it must work in a tunnel: `local`
+// runs against the durable client store immediately, `server` is authoritative, and `conflict`
+// says who wins when they disagree.
+//
+// `local` is replayed on every rebase, so it must stay a pure function of (tx, input):
+// no I/O, no `Date.now()`, no `Math.random()`. Its body — and the `LocalTables` row shape it
+// writes — live in `../like-mutation.ts`, because that is the module a BROWSER can load: an island
+// cannot import this file (it drags `@ultimat3/action`, the policy and the Postgres client into the
+// chunk), and a twin declared in both places is two declarations of one intent. One import, one
+// copy, and `likePostLocally` is what actually runs on both sides.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: a mutator file imports one package.
 
-import { posts, tag } from '@postly/db';
+import { posts } from '@postly/db';
 import { POST_STATUSES, postId as toPostId } from '@postly/domain';
-import { mutator, t, transition } from '@ultimat3/action';
-import { PostView } from './entity';
-import { likePostLocally } from './like-mutation';
-import { postLike, postSchedule } from './policy';
-import { postStatus } from './repo';
-
-export const likePost = mutator({
-  input: t.object({ postId: t.uuid, orgId: t.uuid }),
-  output: PostView,
-  policy: postLike,
-  idempotent: true,
-  cache: { invalidates: [tag.post, tag.feed] },
-  mcp: { expose: true, description: 'Like a post on behalf of the acting member' },
-  local: likePostLocally,
-  async server(ctx, { postId }) {
-    return ctx.posts.like(toPostId(postId));
-  },
-  conflict: 'server-wins', // | 'last-write-wins' | custom(merge)
-});
+import { transition } from '@ultimat3/action';
+import { postSchedule } from '../policy';
+import { postStatus } from '../repo';
 
 /** The states a caller may move a post between here — every one except the terminal `published`. */
 const SCHEDULABLE = POST_STATUSES.filter((status) => status !== 'published') as [
diff --git a/examples/dummy/apps/web/app/posts/actions/publish-post.ts b/examples/dummy/apps/web/app/posts/actions/publish-post.ts
new file mode 100644
index 000000000..8f8a1762a
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/actions/publish-post.ts
@@ -0,0 +1,49 @@
+// `publishPost`, the posts slice's action — one primitive per file, the layout `x g` writes.
+//
+// The posts feature's commands. Declarations only — every body delegates to `ctx.posts`, so the
+// same logic runs whether the caller is HTTP, the typed client, a job, an MCP tool or admin.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+// `llm`, `agent` and `hive` are the other framework imports here, and none is a second primitive:
+// each is a factory that RETURNS an `action`, so `summarize`, `reviewDraft` and `summarizePosts`
+// belong in this file for the same reason the rest do — see `docs/idea/09-ai-first.md`.
+
+import { tag } from '@postly/db';
+import { postId } from '@postly/domain';
+import { action, t } from '@ultimat3/action';
+import { PostView } from '../entity';
+import { notifySubscribers } from '../jobs/notify-subscribers';
+import { postPublish } from '../policy';
+
+export const publishPost = action({
+  input: t.object({ postId: t.uuid, orgId: t.uuid, notify: t.boolean.default(true) }),
+  output: PostView,
+  policy: postPublish,
+  // `postPublish` decides about a post, not just about an org, so the post has to be loaded
+  // before the guard rather than inside it — the predicate stays synchronous, and this runs once
+  // per invocation instead of once per live subscriber.
+  //
+  // The loader runs BEFORE any policy, which is the ordering that decides the scope: the service
+  // reads inside the ACTING member's org and answers `null` for anyone without one, so a foreign
+  // caller reaches the rule with `row: null` and is denied. Scoping it to `input.orgId` instead
+  // put a tenancy error (`X_TENANCY_ACTOR_MISMATCH`, or `X_TENANCY_ACTOR_ORG_REQUIRED` for an
+  // anonymous caller) in front of the denial — an unscoped read is `X_TENANCY_UNSCOPED`, and
+  // neither is the `X_FORBIDDEN` this action's contract promises.
+  row: ({ input: { postId: id }, ctx }) => ctx.posts.authorship(postId(id)),
+  // `blog` too: publishing is the ONE write that puts a post on the public, anonymous blog, and
+  // `site/blog/*` sets `revalidate: { tags: [tag.blog] }`. Omitting it left those ISR pages
+  // pinned to whatever the build saw — the tag existed, nothing ever evicted it.
+  cache: { invalidates: [tag.post, tag.feed, tag.blog] },
+  mcp: { expose: true, description: 'Publish a draft post' },
+  async handle({ input, ctx }) {
+    const post = await ctx.posts.publish(postId(input.postId));
+    // The job enqueues itself through its own handle, in the same transaction as the publish: a
+    // rolled-back publish never mails anybody and a committed one always does.
+    // The org the policy already decided on, carried into the payload: the fanout's reads are
+    // tenant-scoped and a job has no request behind it to derive one from.
+    if (input.notify) await notifySubscribers.enqueue({ postId: post.id, orgId: input.orgId });
+    // The org's webhook receivers hear it too: one delivery per endpoint, in this same transaction.
+    await ctx.webhooks.announcePublished(post);
+    return post;
+  },
+});
diff --git a/examples/dummy/apps/web/app/posts/actions/request-draft-review.ts b/examples/dummy/apps/web/app/posts/actions/request-draft-review.ts
new file mode 100644
index 000000000..e5674ae01
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/actions/request-draft-review.ts
@@ -0,0 +1,32 @@
+// `requestDraftReview`, the posts slice's action — one primitive per file, the layout `x g` writes.
+//
+// The posts feature's commands. Declarations only — every body delegates to `ctx.posts`, so the
+// same logic runs whether the caller is HTTP, the typed client, a job, an MCP tool or admin.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+// `llm`, `agent` and `hive` are the other framework imports here, and none is a second primitive:
+// each is a factory that RETURNS an `action`, so `summarize`, `reviewDraft` and `summarizePosts`
+// belong in this file for the same reason the rest do — see `docs/idea/09-ai-first.md`.
+
+import { postId } from '@postly/domain';
+import { action, t } from '@ultimat3/action';
+import { reviewDraftLater } from '../jobs/review-draft-later';
+import { postPublish } from '../policy';
+
+/**
+ * Ask for a kept review in the background — the author's or an org admin's right, as publishing
+ * is (`postPublish`, on the row loaded before the guard). The member is the caller's own, read off
+ * the actor — never a field of the input — and the run is enqueued in this request's transaction.
+ */
+export const requestDraftReview = action({
+  input: t.object({ postId: t.uuid, orgId: t.uuid }),
+  output: t.object({ jobId: t.string }),
+  policy: postPublish,
+  row: ({ input: { postId: id }, ctx }) => ctx.posts.authorship(postId(id)),
+  mcp: { expose: true, description: 'Queue a review of your draft; read it back with postReview' },
+  async handle({ input, ctx }) {
+    const me = await ctx.orgs.me();
+    const queued = await reviewDraftLater.enqueue({ ...input, memberId: me.id });
+    return { jobId: queued.id };
+  },
+});
diff --git a/examples/dummy/apps/web/app/posts/actions/request-posts-export.ts b/examples/dummy/apps/web/app/posts/actions/request-posts-export.ts
new file mode 100644
index 000000000..f968f7cc3
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/actions/request-posts-export.ts
@@ -0,0 +1,32 @@
+// `requestPostsExport`, the posts slice's action — one primitive per file, the layout `x g` writes.
+//
+// The posts feature's commands. Declarations only — every body delegates to `ctx.posts`, so the
+// same logic runs whether the caller is HTTP, the typed client, a job, an MCP tool or admin.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+// `llm`, `agent` and `hive` are the other framework imports here, and none is a second primitive:
+// each is a factory that RETURNS an `action`, so `summarize`, `reviewDraft` and `summarizePosts`
+// belong in this file for the same reason the rest do — see `docs/idea/09-ai-first.md`.
+
+import { action, t } from '@ultimat3/action';
+import { exportPosts, postsExportPrefix } from '../jobs/export-posts';
+import { postExport } from '../policy';
+
+/**
+ * Start an export of every post in the org. The work is `exportPosts`, a job, enqueued in this
+ * request's transaction; the answer is where the artifact will land — `manifest.json` under
+ * `prefix` once the job has written it. The id is minted here, so one request is one artifact and
+ * a retried request (same idempotency key) is the same one.
+ */
+export const requestPostsExport = action({
+  input: t.object({ orgId: t.uuid }),
+  output: t.object({ exportId: t.uuid, prefix: t.string }),
+  policy: postExport,
+  idempotent: true,
+  mcp: { expose: true, description: 'Export every post of the actor’s org as CSV to storage' },
+  async handle({ input }) {
+    const target = { orgId: input.orgId, exportId: crypto.randomUUID() };
+    await exportPosts.enqueue(target);
+    return { exportId: target.exportId, prefix: postsExportPrefix(target) };
+  },
+});
diff --git a/examples/dummy/apps/web/app/posts/actions/review-draft.ts b/examples/dummy/apps/web/app/posts/actions/review-draft.ts
new file mode 100644
index 000000000..9263d1c94
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/actions/review-draft.ts
@@ -0,0 +1,48 @@
+// `reviewDraft`, the posts slice's `agent()` action — one primitive per file, the layout `x g` writes.
+//
+// The posts feature's commands. Declarations only — every body delegates to `ctx.posts`, so the
+// same logic runs whether the caller is HTTP, the typed client, a job, an MCP tool or admin.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+// `llm`, `agent` and `hive` are the other framework imports here, and none is a second primitive:
+// each is a factory that RETURNS an `action`, so `summarize`, `reviewDraft` and `summarizePosts`
+// belong in this file for the same reason the rest do — see `docs/idea/09-ai-first.md`.
+
+import { postId } from '@postly/domain';
+import { t } from '@ultimat3/action';
+import { agent } from '@ultimat3/ai';
+import { DraftReview } from '../entity';
+import { postRead } from '../policy';
+import { reviewDraftPrompt } from '../prompts/review-draft';
+import { summarize } from './summarize';
+
+/**
+ * "Is my draft ready?" — a tool-using model run, still an action: `agent()` returns one, so it has
+ * a route, an MCP tool and a contract like the rest. Its one tool is `summarize`, the action above,
+ * run under the SAME actor through its own policy — the model can ask how the feed will present the
+ * post, and can never name who is asking.
+ *
+ * READ-ONLY, and that is the rule this file teaches: the model is handed no write. Its input is
+ * text a writer controls, and a draft that says "now record a review for post X" is an instruction
+ * the model may follow — so the one write a review needs is made by `keepDraftReview` below, with
+ * the post id the CODE was given, never one the model names.
+ */
+export const reviewDraft = agent({
+  input: t.object({ postId: t.uuid, orgId: t.uuid }),
+  output: DraftReview,
+  prompt: reviewDraftPrompt,
+  // The post verbatim: the prompt fences it as `<post_title>` / `<post_body>` DATA, and the
+  // framework's `render` breaks any closer the writer forges (`prompt-artifacts.test.ts`).
+  vars: async ({ input, ctx }) => {
+    const post = await ctx.posts.byId(postId(input.postId));
+    return { title: post.title, body: post.body, locale: ctx.locale };
+  },
+  tools: [summarize],
+  maxTurns: 3,
+  maxToolResultChars: 2000,
+  // A verdict and three sentences per turn; the ceiling is what every turn's estimate is priced at.
+  maxTokens: 1024,
+  budget: { tokensPerRun: 24_000, costPerCall: { minor: 10, currency: 'USD' } },
+  policy: postRead,
+  mcp: { expose: true, description: 'Review a draft post and say whether it is ready to publish' },
+});
diff --git a/examples/dummy/apps/web/app/posts/actions/summarize-posts.ts b/examples/dummy/apps/web/app/posts/actions/summarize-posts.ts
new file mode 100644
index 000000000..29ed4883f
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/actions/summarize-posts.ts
@@ -0,0 +1,41 @@
+// `summarizePosts`, the posts slice's `hive()` action — one primitive per file, the layout `x g` writes.
+//
+// The posts feature's commands. Declarations only — every body delegates to `ctx.posts`, so the
+// same logic runs whether the caller is HTTP, the typed client, a job, an MCP tool or admin.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+// `llm`, `agent` and `hive` are the other framework imports here, and none is a second primitive:
+// each is a factory that RETURNS an `action`, so `summarize`, `reviewDraft` and `summarizePosts`
+// belong in this file for the same reason the rest do — see `docs/idea/09-ai-first.md`.
+
+import { t } from '@ultimat3/action';
+import { hive } from '@ultimat3/ai';
+import { postRead } from '../policy';
+import { summarize } from './summarize';
+
+/** How many posts one `summarizePosts` call may fan out over: a page of the feed, never a backlog. */
+export const SUMMARIZE_POSTS_MAX = 20;
+
+/**
+ * The feed's "catch me up": many posts summarised in one call. `hive()` is the fan-out as an
+ * action — each member is a `summarize` call with that action's own policy, input parse, cache and
+ * budget, so a post another org owns fails as ITS member (`X_FORBIDDEN`) and never as the batch.
+ *
+ * `split` derives every member from the input alone, and the org it carries is the one `postRead`
+ * already decided on. `'collect'`: one unreadable post should not cost the reader the other
+ * nineteen summaries. A backlog of thousands is a `backfill()`, not a longer list here.
+ */
+export const summarizePosts = hive({
+  input: t.object({
+    orgId: t.uuid,
+    postIds: t.array(t.uuid, { min: 1, max: SUMMARIZE_POSTS_MAX }),
+  }),
+  member: summarize,
+  split: ({ input }) => input.postIds.map((id) => ({ postId: id, orgId: input.orgId })),
+  concurrency: 4,
+  onMemberError: 'collect',
+  // The whole fan-out's ceiling: every member's `tokensIn` bound, times the page.
+  budget: { tokensPerRun: 8000 * SUMMARIZE_POSTS_MAX },
+  policy: postRead,
+  mcp: { expose: true, description: 'Summarise up to twenty posts of the actor’s org at once' },
+});
diff --git a/examples/dummy/apps/web/app/posts/actions/summarize.ts b/examples/dummy/apps/web/app/posts/actions/summarize.ts
new file mode 100644
index 000000000..af393d0a1
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/actions/summarize.ts
@@ -0,0 +1,40 @@
+import { postId } from '@postly/domain';
+import { t } from '@ultimat3/action';
+import { llm } from '@ultimat3/ai';
+import { postRead } from '../policy';
+import { summarizePrompt } from '../prompts/summarize';
+
+/**
+ * The one model call in Postly. There is no `llm` primitive — the framework has eight and a model
+ * call is not one of them — so this is an `action` built by a factory, which is what gives it the
+ * same policy, the same MCP projection, the same OpenAPI operation and the same contract tests as
+ * every other command in this file.
+ *
+ * `orgId` is in the input for the usual reason: `postRead` decides on it. The named rule matters
+ * more here than elsewhere — an inline `can('post:read')` would carry the grant and drop the
+ * tenancy predicate, and "summarise any post by id" is exactly the read that must not cross an org.
+ */
+export const summarize = llm({
+  input: t.object({ postId: t.uuid, orgId: t.uuid }),
+  output: t.object({ summary: t.string, tags: t.array(t.string) }),
+  policy: postRead,
+  prompt: summarizePrompt,
+  // The one declared place a model call loads data: the input is an id, the prompt needs the row
+  // behind it, and a reader can see exactly what was sent.
+  vars: async ({ input, ctx }) => {
+    const post = await ctx.posts.byId(postId(input.postId));
+    return { title: post.title, body: post.body, locale: ctx.locale };
+  },
+  // No `scope`, and that is now the safe answer: the default partitions on the calling ACTOR.
+  // Cosine similarity has no notion of a tenant, so the old `'global'` default answered one org
+  // with another's summary — a shared store has to be written down (`scope: () => 'global'`).
+  cache: { semantic: { threshold: 0.97, ttl: '7d' } },
+  // Refused before a token is spent, never truncated after — a runaway loop costs one refusal
+  // instead of a bill.
+  budget: { tokensIn: 8000, costPerCall: { minor: 5, currency: 'USD' } },
+  // The answer is two sentences and four tags. Left at the 4,096-token default, the pre-flight
+  // estimate — the WHOLE ceiling at the output rate — priced every call at 6 cents against the
+  // 5-cent `costPerCall` above, so `summarize` was refused for every post before a token was sent.
+  maxTokens: 512,
+  mcp: { expose: true, description: 'Summarise a post into two sentences and up to four tags' },
+});
diff --git a/examples/dummy/apps/web/app/posts/channel-ref.ts b/examples/dummy/apps/web/app/posts/channel-ref.ts
index fcccf22ac..9eaabb197 100644
--- a/examples/dummy/apps/web/app/posts/channel-ref.ts
+++ b/examples/dummy/apps/web/app/posts/channel-ref.ts
@@ -10,10 +10,10 @@
 import { channelRef } from '@ultimat3/realtime';
 import type { Api } from '../../api';
 
-/** The catch-up read: the org's recent posts as whole rows (`live.ts`). */
+/** The catch-up read: the org's recent posts as whole rows (`queries/org-posts.ts`). */
 export const ORG_POSTS_READ: keyof Api['queries'] = 'orgPosts';
 
-/** One post as its whole row — what an island seeds its record from (`live.ts`). */
+/** One post as its whole row — what an island seeds its record from (`queries/post-record.ts`). */
 export const POST_RECORD_READ: keyof Api['queries'] = 'postRecord';
 
 /** `org-posts.<orgId>`: every committed `posts` row of that org reaches its members as a record. */
diff --git a/examples/dummy/apps/web/app/posts/jobs.job.test.ts b/examples/dummy/apps/web/app/posts/jobs.job.test.ts
index 5f6a4a16f..3ff44a3ed 100644
--- a/examples/dummy/apps/web/app/posts/jobs.job.test.ts
+++ b/examples/dummy/apps/web/app/posts/jobs.job.test.ts
@@ -22,8 +22,9 @@ import {
 } from '@ultimat3/mail';
 import { defineStorage, disk, memoryStorageDriver, resetStorage } from '@ultimat3/storage';
 import { jobTest } from '@ultimat3/testing';
-import { publishPost } from './actions';
-import { exportPosts, notifySubscribers, postsExportPrefix } from './jobs';
+import { publishPost } from './actions/publish-post';
+import { exportPosts, postsExportPrefix } from './jobs/export-posts';
+import { notifySubscribers } from './jobs/notify-subscribers';
 
 const ORG = '00000000-0000-4000-8000-00000000f001';
 const POST = '00000000-0000-4000-8000-00000000f0a1';
diff --git a/examples/dummy/apps/web/app/posts/notifiers.ts b/examples/dummy/apps/web/app/posts/jobs/comment-posted.ts
similarity index 96%
rename from examples/dummy/apps/web/app/posts/notifiers.ts
rename to examples/dummy/apps/web/app/posts/jobs/comment-posted.ts
index 847b9943b..5b826bc57 100644
--- a/examples/dummy/apps/web/app/posts/notifiers.ts
+++ b/examples/dummy/apps/web/app/posts/jobs/comment-posted.ts
@@ -1,6 +1,6 @@
 /**
  * Notifications the posts feature sends. `notifier()` is a job factory: a notification inherits the
- * queue's retry, dead letter and cancellation, plus what a hand-rolled fan-out job (`./jobs.ts`'s
+ * queue's retry, dead letter and cancellation, plus what a hand-rolled fan-out job (`./notify-subscribers.ts`'s
  * `notifySubscribers`) writes by hand — one durable step per recipient and channel, a delivery
  * ledger that makes a replayed run send nothing twice, and a preference gate.
  *
@@ -16,7 +16,7 @@ import '@postly/i18n';
 import { send } from '@ultimat3/mail';
 import { mailChannel, notifier, pushChannel, t } from '@ultimat3/notify';
 import { webPush } from '@ultimat3/pwa';
-import { type CommentPostedData, commentPostedMail } from './mail';
+import { type CommentPostedData, commentPostedMail } from '../mail';
 
 /** What `createComment` enqueues: the ids the audience is resolved from, and the mail's two names. */
 export interface CommentPosted extends CommentPostedData {
diff --git a/examples/dummy/apps/web/app/posts/jobs/export-posts.ts b/examples/dummy/apps/web/app/posts/jobs/export-posts.ts
new file mode 100644
index 000000000..950f02e99
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/jobs/export-posts.ts
@@ -0,0 +1,46 @@
+// `exportPosts`, the posts slice's `exportRows()` job — one primitive per file, the layout `x g` writes.
+//
+// Work that must outlive the request that caused it. `publishPost` enqueues this in the same
+// transaction as the publish, so a rolled-back publish never mails anybody and a committed one
+// always does.
+//
+// `t` comes from @ultimat3/jobs, not @ultimat3/schema: a job file imports one package.
+
+import { orgId as toOrgId } from '@postly/domain';
+import { exportRows, t } from '@ultimat3/jobs';
+import { disk } from '@ultimat3/storage';
+import { exportSource } from '../repo';
+
+/** Where one export's parts and manifest land: under its org, so a key names its tenant. */
+export const postsExportPrefix = ({ orgId, exportId }: { orgId: string; exportId: string }) =>
+  `org/${orgId}/exports/posts/${exportId}`;
+
+/**
+ * Every post an org has written, as CSV parts plus a manifest on the app's disk — `exportRows()`,
+ * a job factory, because "all rows to a file" is the job that OOM-kills a pod at two million rows
+ * when written as one read and one put. `requestPostsExport` (`../actions/request-posts-export.ts`) enqueues it.
+ *
+ * `tenant` is the security boundary of the whole feature: an export concentrates one org's posts
+ * into one downloadable object, and the source read runs scoped to that org. Instants leave as ISO
+ * 8601 UTC — machine data for a spreadsheet or an import, never a date formatted for a reader.
+ */
+export const exportPosts = exportRows({
+  name: 'posts.export',
+  input: t.object({ orgId: t.uuid, exportId: t.uuid }),
+  tenant: ({ orgId }) => orgId,
+  prefix: postsExportPrefix,
+  source: ({ input }) => exportSource(toOrgId(input.orgId)),
+  format: 'csv',
+  columns: ['id', 'slug', 'title', 'status', 'likeCount', 'publishedAt', 'createdAt'],
+  row: (post) => ({
+    id: post.id,
+    slug: post.slug,
+    title: post.title,
+    status: post.status,
+    likeCount: post.likeCount,
+    publishedAt: post.publishedAt === null ? null : post.publishedAt.toISOString(),
+    createdAt: post.createdAt.toISOString(),
+  }),
+  // A thunk, read per write: this line runs at import, before boot has built the disk.
+  sink: () => disk(),
+});
diff --git a/examples/dummy/apps/web/app/posts/jobs.ts b/examples/dummy/apps/web/app/posts/jobs/notify-subscribers.ts
similarity index 62%
rename from examples/dummy/apps/web/app/posts/jobs.ts
rename to examples/dummy/apps/web/app/posts/jobs/notify-subscribers.ts
index 8f542a8bd..b834f2921 100644
--- a/examples/dummy/apps/web/app/posts/jobs.ts
+++ b/examples/dummy/apps/web/app/posts/jobs/notify-subscribers.ts
@@ -1,18 +1,16 @@
-/**
- * Work that must outlive the request that caused it. `publishPost` enqueues this in the same
- * transaction as the publish, so a rolled-back publish never mails anybody and a committed one
- * always does.
- *
- * `t` comes from @ultimat3/jobs, not @ultimat3/schema: a job file imports one package.
- */
+// `notifySubscribers`, the posts slice's job — one primitive per file, the layout `x g` writes.
+//
+// Work that must outlive the request that caused it. `publishPost` enqueues this in the same
+// transaction as the publish, so a rolled-back publish never mails anybody and a committed one
+// always does.
+//
+// `t` comes from @ultimat3/jobs, not @ultimat3/schema: a job file imports one package.
 
 import { orgId as toOrgId, postId as toPostId } from '@postly/domain';
-import { exportRows, job, t } from '@ultimat3/jobs';
+import { job, t } from '@ultimat3/jobs';
 import { send } from '@ultimat3/mail';
-import { disk } from '@ultimat3/storage';
-import { PostNotFound } from './errors';
-import { postPublished } from './mail';
-import { exportSource } from './repo';
+import { PostNotFound } from '../errors';
+import { postPublished } from '../mail';
 
 export const notifySubscribers = job({
   /**
@@ -44,7 +42,7 @@ export const notifySubscribers = job({
     // packages/cli/src/role-sync.ts) and there is no seam by which an app reaches it — a worker
     // building its own would publish onto a transport nothing bridges. This step used to call
     // `ctx.channel(...)`, a service nothing registered, so every run of this job dead-lettered on
-    // a `TypeError` before it mailed anybody. The feed stays live through `live.ts`'s
+    // a `TypeError` before it mailed anybody. The feed stays live through `live/live-feed.ts`'s
     // `query({ live: true })`, which is the path that does work.
     const recipients = await step.run('load-recipients', () =>
       ctx.orgs.digestRecipients(toOrgId(post.orgId)),
@@ -70,37 +68,3 @@ export const notifySubscribers = job({
     }
   },
 });
-
-/** Where one export's parts and manifest land: under its org, so a key names its tenant. */
-export const postsExportPrefix = ({ orgId, exportId }: { orgId: string; exportId: string }) =>
-  `org/${orgId}/exports/posts/${exportId}`;
-
-/**
- * Every post an org has written, as CSV parts plus a manifest on the app's disk — `exportRows()`,
- * a job factory, because "all rows to a file" is the job that OOM-kills a pod at two million rows
- * when written as one read and one put. `requestPostsExport` (`./actions.ts`) enqueues it.
- *
- * `tenant` is the security boundary of the whole feature: an export concentrates one org's posts
- * into one downloadable object, and the source read runs scoped to that org. Instants leave as ISO
- * 8601 UTC — machine data for a spreadsheet or an import, never a date formatted for a reader.
- */
-export const exportPosts = exportRows({
-  name: 'posts.export',
-  input: t.object({ orgId: t.uuid, exportId: t.uuid }),
-  tenant: ({ orgId }) => orgId,
-  prefix: postsExportPrefix,
-  source: ({ input }) => exportSource(toOrgId(input.orgId)),
-  format: 'csv',
-  columns: ['id', 'slug', 'title', 'status', 'likeCount', 'publishedAt', 'createdAt'],
-  row: (post) => ({
-    id: post.id,
-    slug: post.slug,
-    title: post.title,
-    status: post.status,
-    likeCount: post.likeCount,
-    publishedAt: post.publishedAt === null ? null : post.publishedAt.toISOString(),
-    createdAt: post.createdAt.toISOString(),
-  }),
-  // A thunk, read per write: this line runs at import, before boot has built the disk.
-  sink: () => disk(),
-});
diff --git a/examples/dummy/apps/web/app/posts/jobs/review-draft-later.ts b/examples/dummy/apps/web/app/posts/jobs/review-draft-later.ts
new file mode 100644
index 000000000..7f184ab50
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/jobs/review-draft-later.ts
@@ -0,0 +1,25 @@
+import { memberId, orgId } from '@postly/domain';
+import { agentJob } from '@ultimat3/ai';
+import { postlyActor } from '../../../shared/actor';
+import { keepDraftReview } from '../actions/keep-draft-review';
+
+/**
+ * `keepDraftReview`, queued: the review an author asks for and reads back later from `postReview`.
+ * `agentJob()` is a factory over `job()`, and it wraps ANY action — here the one that runs the
+ * agent and keeps its answer, because a queued run's own output is not stored. Declared beside
+ * what it wraps (it reads it at module scope) and registered in `api/index.ts`'s `jobs` list
+ * through this module.
+ *
+ * `actor`: a worker's own actor is nobody, so the run re-reads the member its input names, inside
+ * the org `tenant` declared, on EVERY attempt — a member who left, or lost the right, is refused
+ * by the same rule a request meets rather than trusted from the payload that queued it.
+ */
+export const reviewDraftLater = agentJob(keepDraftReview, {
+  name: 'posts.review',
+  tenant: (input) => input.orgId,
+  retry: { attempts: 3, backoff: 'exponential' },
+  // One queued review per post and member; a second request while one is live is the same run.
+  idempotencyKey: (input) => `review:${input.postId}:${input.memberId}`,
+  actor: async ({ input, ctx }) =>
+    postlyActor(await ctx.orgs.actingFor(orgId(input.orgId), memberId(input.memberId))),
+});
diff --git a/examples/dummy/apps/web/app/posts/like-mutation.ts b/examples/dummy/apps/web/app/posts/like-mutation.ts
index 2b58a6a38..68c26430e 100644
--- a/examples/dummy/apps/web/app/posts/like-mutation.ts
+++ b/examples/dummy/apps/web/app/posts/like-mutation.ts
@@ -2,7 +2,7 @@
  * `likePost`, as the BROWSER can name and APPLY it — the same seam `app/feed/live.ts` is for
  * `liveFeed`, one step further along.
  *
- * An island cannot import `./mutator.ts`: the declaration reaches `@ultimat3/action`, the policy,
+ * An island cannot import `./actions/like-post.ts`: the declaration reaches `@ultimat3/action`, the policy,
  * `@postly/db`'s tag table and through it the Postgres client, none of which belong in a chunk a
  * browser downloads. `useMutation` takes anything carrying a `name`, so the name crosses and the
  * declaration never does.
@@ -11,7 +11,7 @@
  * string: a mutator IS an action, so `defineApi` registers it in `Api['actions']` under its export
  * name, and `Api` is imported as a TYPE — no module edge exists.
  *
- * **The local twin lives HERE, and `mutator.ts` imports it.** It used to live in `mutator.ts` and
+ * **The local twin lives HERE, and `actions/like-post.ts` imports it.** It used to live beside the declaration and
  * this file said a twin here "would be a second copy" — true, and it had the direction backwards:
  * `local` is browser code by definition (it runs against the client's store, in the tab, on every
  * rebase), and the only module of this feature a browser can load is this one. So the twin's one
diff --git a/examples/dummy/apps/web/app/posts/live.live.test.ts b/examples/dummy/apps/web/app/posts/live.live.test.ts
index d7f58939b..b51e2e06a 100644
--- a/examples/dummy/apps/web/app/posts/live.live.test.ts
+++ b/examples/dummy/apps/web/app/posts/live.live.test.ts
@@ -16,9 +16,9 @@
  */
 
 import { expect, test } from '@ultimat3/testing';
-import { publishPost } from './actions';
+import { publishPost } from './actions/publish-post';
 import type { PostSummary } from './entity';
-import { liveFeed } from './live';
+import { liveFeed } from './live/live-feed';
 
 test('the initial snapshot is scoped to the actor’s org', async ({ seed, actorFor, subscribe }) => {
   const { ada, acme } = await seed('dev').pick({ ada: 'member:ada', acme: 'org:acme' });
diff --git a/examples/dummy/apps/web/app/posts/live.page.test.ts b/examples/dummy/apps/web/app/posts/live.page.test.ts
index 75ecaa2d0..f01483c74 100644
--- a/examples/dummy/apps/web/app/posts/live.page.test.ts
+++ b/examples/dummy/apps/web/app/posts/live.page.test.ts
@@ -14,7 +14,7 @@ import { defineHttpConfig, httpServer } from '@ultimat3/http';
 import { toQueryRoute } from '@ultimat3/query';
 import { expect, test } from '@ultimat3/testing';
 import type { PostSummary } from './entity';
-import { liveFeed } from './live';
+import { liveFeed } from './live/live-feed';
 
 interface FeedPage {
   readonly rows: readonly PostSummary[];
diff --git a/examples/dummy/apps/web/app/posts/live.ts b/examples/dummy/apps/web/app/posts/live.ts
deleted file mode 100644
index 2215c4e6a..000000000
--- a/examples/dummy/apps/web/app/posts/live.ts
+++ /dev/null
@@ -1,218 +0,0 @@
-/**
- * The posts feature's reads. `liveFeed` is `live: true`, so the feed is pushed a patch per change
- * over the socket instead of polling, and its rows are records of the page's store. `posts` is
- * declared `persist: true` (`@postly/db`), so those records are on the device's disk too, per
- * principal, and a reload offline still shows them. `publicPost` is a plain cached read: the
- * public blog does not need a socket.
- *
- * `t` comes from @ultimat3/query, not @ultimat3/schema: a query file imports one package.
- *
- * Every read is ordered and bounded. `live: true` requires it — an unbounded live query is a
- * memory leak that only shows up under load — and the others keep the shape so promoting one
- * later is a one-line change.
- *
- * Every order ends with a key that is unique in the row shape, and that is not decoration: the
- * live matcher computes a row's insertion position and decides whether a change moved it from
- * this `orderBy` list alone. `createdAt desc` by itself is a partial order, so two posts written
- * in the same millisecond can swap places between evaluations and a bounded page can drop or
- * repeat one at the boundary. `repo.ts` gets its tail key for free — @ultimat3/entity appends the
- * primary key to every plan — but `from()` builds the shape declared here, so it is written out.
- * Ascending, to match the direction the repo appends.
- */
-
-import { memberOf, NotAMember } from '@postly/core';
-import { type Post, posts, tag } from '@postly/db';
-import { type MemberId, orgId as toOrgId, postId as toPostId } from '@postly/domain';
-import { publicPostRead } from '@postly/web/shared/policies';
-import { from, query, t } from '@ultimat3/query';
-import type { PostSummary, PostView, ReviewView } from './entity';
-import { feedRead, postRead } from './policy';
-import type { ActivitySummary, PostWithComments, PublishedSlug } from './repo';
-import * as repo from './repo';
-
-/**
- * The member reading, for a read whose answer is theirs alone. `postRead` has already required a
- * membership, so `null` is broken wiring — refused the way `ctx.posts` refuses it, never read as
- * "likes nothing".
- */
-const readerOf = (actor: Parameters<typeof memberOf>[0]): MemberId => {
-  const member = memberOf(actor);
-  if (member === null) throw new NotAMember(actor?.id ?? '');
-  return member.memberId;
-};
-
-export const liveFeed = query({
-  input: t.object({ orgId: t.uuid, limit: t.number.int().min(1).max(50).default(50) }),
-  policy: feedRead,
-  live: true,
-  // The relation this read is patched from, said out loud: it lives inside `sql:` below, which no
-  // generator can invoke without valid input, so `x db gen` reads THIS to emit
-  // `alter table "posts" replica identity full` — without which logical replication carries no old
-  // row on an UPDATE and `@ultimat3/realtime` can compute no patch. Machine-checked against the
-  // resolved `shape.entity` on the first subscribe, so a stale name is X_QUERY_SUBSCRIBES_DRIFT.
-  subscribes: ['posts'],
-  sql: ({ orgId, limit }) =>
-    // 'posts' — the entity's snake_case table, not the feature name: `from()` quotes the
-    // identifier straight into the SQL text an agent reads back.
-    from<PostSummary>('posts', () => repo.feedPage(toOrgId(orgId), limit))
-      .where({ orgId })
-      .orderBy('createdAt', 'desc')
-      .orderBy('id')
-      .limit(limit),
-});
-
-/**
- * The org's recent posts as whole ROWS — the `org-posts` channel's catch-up read (`channels.ts`).
- * `rows: posts.$schema` is what makes the answer a record envelope, so a client re-reading after a
- * `replay-gap` lands the rows in the page's store and every island showing one re-renders.
- */
-export const orgPosts = query({
-  input: t.object({ orgId: t.uuid }),
-  policy: feedRead,
-  rows: posts.$schema,
-  sql: ({ orgId }) =>
-    from<Post>('posts', () => repo.recentRows(toOrgId(orgId), 50))
-      .where({ orgId })
-      .orderBy('createdAt', 'desc')
-      .orderBy('id')
-      .limit(50),
-});
-
-/**
- * One post as its whole ROW, the record `useRecord('posts', id)` reads — how the like islands on
- * `/posts/{id}` seed the store before a channel frame has anything to say about it. The row carries
- * the reader's own `likedByMe` beside its columns (`repo.recordById`): the like twin reads it, and
- * without it a member's repeat like painted +1 and dropped back. `from<Post>` and not the wider
- * row: `rows:` is the entity's schema, and the flag is not one of its columns.
- */
-export const postRecord = query({
-  input: t.object({ orgId: t.uuid, postId: t.uuid }),
-  policy: postRead,
-  rows: posts.$schema,
-  sql: ({ orgId, postId }, ctx) =>
-    from<Post>('posts', () =>
-      repo.recordById(toOrgId(orgId), toPostId(postId), readerOf(ctx.actor)),
-    )
-      .where({ orgId, id: postId })
-      .orderBy('id')
-      .limit(1),
-});
-
-/** The single post page. Comments come with it: one round trip, one cache entry, two tags. */
-export const postById = query({
-  input: t.object({ orgId: t.uuid, postId: t.uuid }),
-  policy: postRead,
-  cache: { tags: [tag.post, tag.comment], ttlMs: 60_000 },
-  mcp: { expose: true, description: 'Read one post with its comments' },
-  sql: ({ orgId, postId }) =>
-    // Ordered by `id` alone: the row is ONE post, found by its key, and a `PostView` carries no
-    // `createdAt`. The `orderBy('createdAt')` that stood here sorted on a column the rows lack, and
-    // `from()` refuses that now (X_QUERY_COLUMN_UNSELECTED) — which took `/posts/{id}` down.
-    from<PostWithComments>('posts', () => repo.withComments(toOrgId(orgId), toPostId(postId)))
-      .where({ orgId, id: postId })
-      .orderBy('id')
-      .limit(1),
-});
-
-/**
- * The feed's activity badge: how many posts this org has published, not live and not bundled
- * with `liveFeed` — its own read, its own cache tag, so `app/feed/page.tsx` can stream it in a
- * `<Suspense>` boundary independently of the rows, which arrive over the socket and never through
- * this client.
- */
-export const feedActivity = query({
-  input: t.object({ orgId: t.uuid }),
-  policy: feedRead,
-  cache: { tags: [tag.post], ttlMs: 60_000 },
-  mcp: { expose: true, description: 'How many posts this org has published' },
-  sql: ({ orgId }) =>
-    from<ActivitySummary>('posts', () => repo.activitySummary(toOrgId(orgId)))
-      .where({ orgId })
-      .orderBy('orgId')
-      .limit(1),
-});
-
-/**
- * A post's latest review — what `keepDraftReview` kept, which is the only place a queued
- * `reviewDraftLater` run's verdict lands. Not cached: a review that just landed has to be the one
- * read back, and a tag for it would be a second invalidation to keep in step with the upsert.
- */
-export const postReview = query({
-  input: t.object({ orgId: t.uuid, postId: t.uuid }),
-  policy: postRead,
-  mcp: { expose: true, description: 'Read the latest review of a post' },
-  sql: ({ orgId, postId }) =>
-    from<ReviewView>('post_reviews', () => repo.reviewRows(toOrgId(orgId), toPostId(postId)))
-      .where({ orgId, postId })
-      .orderBy('postId')
-      .limit(1),
-});
-
-/**
- * The public blog's reads. Anonymous by policy — `publicPostRead` is written down in
- * `shared/policies.ts` rather than being the absence of a rule. "Published only" is the `where`
- * below, not the policy: a policy owns the yes/no, a query owns the rows. `site/` reaches these
- * through the typed client, never by importing this file.
- */
-export const publicPost = query({
-  input: t.object({ slug: t.string }),
-  policy: publicPostRead,
-  cache: { tags: [tag.blog], ttlMs: 3_600_000 },
-  mcp: { expose: true, description: 'Read one published post from the public blog' },
-  sql: ({ slug }) =>
-    from<PostView>('posts', () => repo.publishedBySlug(slug))
-      .where({ slug, status: 'published' })
-      .orderBy('publishedAt', 'desc')
-      .orderBy('id')
-      .limit(1),
-});
-
-/**
- * The public blog index. A `PostSummary`, not a slug: the index renders the same `<PostCard>` the
- * org feed does, and a card needs a title, an excerpt and a byline. `publicPostSlugs` below stays
- * what it is — the prerender enumeration — because a URL list and a page of cards are two reads
- * with two cache lifetimes, not one read used twice.
- */
-export const publicPosts = query({
-  input: t.object({ limit: t.number.int().min(1).max(50).default(20) }),
-  policy: publicPostRead,
-  cache: { tags: [tag.blog], ttlMs: 3_600_000 },
-  mcp: { expose: true, description: 'List the published posts on the public blog' },
-  sql: ({ limit }) =>
-    from<PostSummary>('posts', () => repo.publishedPage(limit))
-      .where({ status: 'published' })
-      .orderBy('publishedAt', 'desc')
-      .orderBy('id')
-      .limit(limit),
-});
-
-/**
- * Feeds `prerender()` on the blog route: one row per page the build must emit. The tail key is
- * `slug`, not `id` — this projection has no `id` column to sort on, and `slug` is unique across
- * every org by invariant, which is the same property the public URL relies on.
- */
-export const publicPostSlugs = query({
-  input: t.object({}),
-  policy: publicPostRead,
-  cache: { tags: [tag.blog], ttlMs: 3_600_000 },
-  sql: () =>
-    from<PublishedSlug>('posts', repo.publishedSlugs)
-      .where({ status: 'published' })
-      .orderBy('publishedAt', 'desc')
-      .orderBy('slug')
-      .limit(1000),
-});
-
-/** The signed-in read of a published post by slug — same row, tenant-scoped, different policy. */
-export const postBySlug = query({
-  input: t.object({ orgId: t.uuid, slug: t.string }),
-  policy: feedRead,
-  cache: { tags: [tag.post], ttlMs: 300_000 },
-  mcp: { expose: true, description: 'Read one published post by slug' },
-  sql: ({ orgId, slug }) =>
-    from<PostView>('posts', () => repo.publishedBySlugInOrg(toOrgId(orgId), slug))
-      .where({ orgId, slug, status: 'published' })
-      .orderBy('publishedAt', 'desc')
-      .orderBy('id')
-      .limit(1),
-});
diff --git a/examples/dummy/apps/web/app/posts/live/live-feed.ts b/examples/dummy/apps/web/app/posts/live/live-feed.ts
new file mode 100644
index 000000000..604442da6
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/live/live-feed.ts
@@ -0,0 +1,47 @@
+// `liveFeed`, the posts slice's query — one primitive per file, the layout `x g` writes.
+//
+// The posts feature's reads. `liveFeed` is `live: true`, so the feed is pushed a patch per change
+// over the socket instead of polling, and its rows are records of the page's store. `posts` is
+// declared `persist: true` (`@postly/db`), so those records are on the device's disk too, per
+// principal, and a reload offline still shows them. `publicPost` is a plain cached read: the
+// public blog does not need a socket.
+//
+// `t` comes from @ultimat3/query, not @ultimat3/schema: a query file imports one package.
+//
+// Every read is ordered and bounded. `live: true` requires it — an unbounded live query is a
+// memory leak that only shows up under load — and the others keep the shape so promoting one
+// later is a one-line change.
+//
+// Every order ends with a key that is unique in the row shape, and that is not decoration: the
+// live matcher computes a row's insertion position and decides whether a change moved it from
+// this `orderBy` list alone. `createdAt desc` by itself is a partial order, so two posts written
+// in the same millisecond can swap places between evaluations and a bounded page can drop or
+// repeat one at the boundary. `repo.ts` gets its tail key for free — @ultimat3/entity appends the
+// primary key to every plan — but `from()` builds the shape declared here, so it is written out.
+// Ascending, to match the direction the repo appends.
+
+import { orgId as toOrgId } from '@postly/domain';
+import { from, query, t } from '@ultimat3/query';
+import type { PostSummary } from '../entity';
+import { feedRead } from '../policy';
+import * as repo from '../repo';
+
+export const liveFeed = query({
+  input: t.object({ orgId: t.uuid, limit: t.number.int().min(1).max(50).default(50) }),
+  policy: feedRead,
+  live: true,
+  // The relation this read is patched from, said out loud: it lives inside `sql:` below, which no
+  // generator can invoke without valid input, so `x db gen` reads THIS to emit
+  // `alter table "posts" replica identity full` — without which logical replication carries no old
+  // row on an UPDATE and `@ultimat3/realtime` can compute no patch. Machine-checked against the
+  // resolved `shape.entity` on the first subscribe, so a stale name is X_QUERY_SUBSCRIBES_DRIFT.
+  subscribes: ['posts'],
+  sql: ({ orgId, limit }) =>
+    // 'posts' — the entity's snake_case table, not the feature name: `from()` quotes the
+    // identifier straight into the SQL text an agent reads back.
+    from<PostSummary>('posts', () => repo.feedPage(toOrgId(orgId), limit))
+      .where({ orgId })
+      .orderBy('createdAt', 'desc')
+      .orderBy('id')
+      .limit(limit),
+});
diff --git a/examples/dummy/apps/web/app/posts/mail.ts b/examples/dummy/apps/web/app/posts/mail.ts
index 798975339..53ac1fbed 100644
--- a/examples/dummy/apps/web/app/posts/mail.ts
+++ b/examples/dummy/apps/web/app/posts/mail.ts
@@ -36,7 +36,7 @@ export const postPublished = defineMail<PostPublishedData>({
 });
 
 /**
- * "Someone commented on your post" — what `commentPosted` (`./notifiers.ts`) mails the author.
+ * "Someone commented on your post" — what `commentPosted` (`./jobs/comment-posted.ts`) mails the author.
  * Names, not ids, in the slots: the payload is rendered on the worker with no request to look a
  * name up through, so the comment's action puts the two names in at enqueue.
  */
diff --git a/examples/dummy/apps/web/app/posts/mcp-drive.contract.test.ts b/examples/dummy/apps/web/app/posts/mcp-drive.contract.test.ts
index d0d3aa0ef..31aa3870a 100644
--- a/examples/dummy/apps/web/app/posts/mcp-drive.contract.test.ts
+++ b/examples/dummy/apps/web/app/posts/mcp-drive.contract.test.ts
@@ -21,7 +21,8 @@
 import { postlyMcp } from '@postly/mcp';
 import { agentActor } from '@ultimat3/core';
 import { expect, test } from '@ultimat3/testing';
-import { createComment, createPost } from './actions';
+import { createComment } from './actions/create-comment';
+import { createPost } from './actions/create-post';
 
 interface Member {
   readonly id: string;
diff --git a/examples/dummy/apps/web/app/posts/mutator.test.ts b/examples/dummy/apps/web/app/posts/mutator.test.ts
index 23b2b80f0..823443703 100644
--- a/examples/dummy/apps/web/app/posts/mutator.test.ts
+++ b/examples/dummy/apps/web/app/posts/mutator.test.ts
@@ -10,7 +10,8 @@
 
 import type { LocalTables } from '@ultimat3/action';
 import { expect, memoryLocalTx, test, unitTest } from '@ultimat3/testing';
-import { likePost, movePostStatus } from './mutator';
+import { likePost } from './actions/like-post';
+import { movePostStatus } from './actions/move-post-status';
 
 type LocalPost = LocalTables['posts'];
 
diff --git a/examples/dummy/apps/web/app/posts/notifiers.job.test.ts b/examples/dummy/apps/web/app/posts/notifiers.job.test.ts
index 5e15ec767..d71f293a5 100644
--- a/examples/dummy/apps/web/app/posts/notifiers.job.test.ts
+++ b/examples/dummy/apps/web/app/posts/notifiers.job.test.ts
@@ -7,8 +7,8 @@
  */
 
 import { expect, jobTest } from '@ultimat3/testing';
-import { createComment } from './actions';
-import { commentPosted } from './notifiers';
+import { createComment } from './actions/create-comment';
+import { commentPosted } from './jobs/comment-posted';
 
 jobTest(
   'a comment on someone else’s post mails its author and pushes to her browser, once',
diff --git a/examples/dummy/apps/web/app/posts/post-by-id.contract.test.ts b/examples/dummy/apps/web/app/posts/post-by-id.contract.test.ts
index fad3b51ca..025bb881e 100644
--- a/examples/dummy/apps/web/app/posts/post-by-id.contract.test.ts
+++ b/examples/dummy/apps/web/app/posts/post-by-id.contract.test.ts
@@ -7,7 +7,7 @@
 import { defineHttpConfig, httpServer } from '@ultimat3/http';
 import { toQueryRoute } from '@ultimat3/query';
 import { expect, test } from '@ultimat3/testing';
-import { postById } from './live';
+import { postById } from './queries/post-by-id';
 
 test('a member reads one of their org’s posts, with its comments', async ({ seed, actorFor }) => {
   const { ada, post } = await seed('dev').pick({ ada: 'member:ada', post: 'post:tenancy' });
diff --git a/examples/dummy/apps/web/app/posts/prompts/review-draft.ts b/examples/dummy/apps/web/app/posts/prompts/review-draft.ts
index 9d6fc02b7..819857be9 100644
--- a/examples/dummy/apps/web/app/posts/prompts/review-draft.ts
+++ b/examples/dummy/apps/web/app/posts/prompts/review-draft.ts
@@ -1,5 +1,5 @@
 /**
- * The prompt artifact behind the `reviewDraft` agent (`../actions.ts`), and nothing else — the
+ * The prompt artifact behind the `reviewDraft` agent (`../actions/review-draft.ts`), and nothing else — the
  * same split `summarize.ts` makes: the agent is an action and lives with the actions; the artifact,
  * its eval and its recorded baseline live here.
  */
diff --git a/examples/dummy/apps/web/app/posts/prompts/summarize.ts b/examples/dummy/apps/web/app/posts/prompts/summarize.ts
index d7ea583fa..f01e65ef9 100644
--- a/examples/dummy/apps/web/app/posts/prompts/summarize.ts
+++ b/examples/dummy/apps/web/app/posts/prompts/summarize.ts
@@ -5,8 +5,8 @@
  * prompt's identity, which keys the semantic cache and appears in every trace, so a summary can
  * always be attributed to the exact text that produced it. Bumping `version` changes the hash.
  *
- * The `llm()` declaration that uses it lives in `../actions.ts`, because `llm()` returns an
- * `action` and an action is only ever declared in `api/` or a feature's `actions.ts`. What lives
+ * The `llm()` declaration that uses it lives in `../actions/summarize.ts`, because `llm()` returns
+ * an `action` and an action is only ever declared in a feature's `actions/`. What lives
  * beside this file is the rest of the artifact: `summarize.v5.md`, `summarize.evals.ts` and
  * `summarize.v5.baseline.json`. Earlier versions (`summarize.v3.md`, `summarize.v4.md`, their
  * baselines) stay on disk unchanged — old traces cite them, and rollback is a version number, not a restore from git.
diff --git a/examples/dummy/apps/web/app/posts/public-slugs.contract.test.ts b/examples/dummy/apps/web/app/posts/public-slugs.contract.test.ts
index 8970b9063..921cb04dd 100644
--- a/examples/dummy/apps/web/app/posts/public-slugs.contract.test.ts
+++ b/examples/dummy/apps/web/app/posts/public-slugs.contract.test.ts
@@ -8,7 +8,7 @@
 import { defineHttpConfig, httpServer } from '@ultimat3/http';
 import { toQueryRoute } from '@ultimat3/query';
 import { expect, test } from '@ultimat3/testing';
-import { publicPostSlugs } from './live';
+import { publicPostSlugs } from './queries/public-post-slugs';
 
 test('every published post is a prerendered URL, newest first, and a draft is not', async ({
   seed,
diff --git a/examples/dummy/apps/web/app/posts/queries/feed-activity.ts b/examples/dummy/apps/web/app/posts/queries/feed-activity.ts
new file mode 100644
index 000000000..9c13be0f2
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/queries/feed-activity.ts
@@ -0,0 +1,24 @@
+import { tag } from '@postly/db';
+import { orgId as toOrgId } from '@postly/domain';
+import { from, query, t } from '@ultimat3/query';
+import { feedRead } from '../policy';
+import type { ActivitySummary } from '../repo';
+import * as repo from '../repo';
+
+/**
+ * The feed's activity badge: how many posts this org has published, not live and not bundled
+ * with `liveFeed` — its own read, its own cache tag, so `app/feed/page.tsx` can stream it in a
+ * `<Suspense>` boundary independently of the rows, which arrive over the socket and never through
+ * this client.
+ */
+export const feedActivity = query({
+  input: t.object({ orgId: t.uuid }),
+  policy: feedRead,
+  cache: { tags: [tag.post], ttlMs: 60_000 },
+  mcp: { expose: true, description: 'How many posts this org has published' },
+  sql: ({ orgId }) =>
+    from<ActivitySummary>('posts', () => repo.activitySummary(toOrgId(orgId)))
+      .where({ orgId })
+      .orderBy('orgId')
+      .limit(1),
+});
diff --git a/examples/dummy/apps/web/app/posts/queries/org-posts.ts b/examples/dummy/apps/web/app/posts/queries/org-posts.ts
new file mode 100644
index 000000000..808338b85
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/queries/org-posts.ts
@@ -0,0 +1,22 @@
+import { type Post, posts } from '@postly/db';
+import { orgId as toOrgId } from '@postly/domain';
+import { from, query, t } from '@ultimat3/query';
+import { feedRead } from '../policy';
+import * as repo from '../repo';
+
+/**
+ * The org's recent posts as whole ROWS — the `org-posts` channel's catch-up read (`channels.ts`).
+ * `rows: posts.$schema` is what makes the answer a record envelope, so a client re-reading after a
+ * `replay-gap` lands the rows in the page's store and every island showing one re-renders.
+ */
+export const orgPosts = query({
+  input: t.object({ orgId: t.uuid }),
+  policy: feedRead,
+  rows: posts.$schema,
+  sql: ({ orgId }) =>
+    from<Post>('posts', () => repo.recentRows(toOrgId(orgId), 50))
+      .where({ orgId })
+      .orderBy('createdAt', 'desc')
+      .orderBy('id')
+      .limit(50),
+});
diff --git a/examples/dummy/apps/web/app/posts/queries/post-by-id.ts b/examples/dummy/apps/web/app/posts/queries/post-by-id.ts
new file mode 100644
index 000000000..feac417ea
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/queries/post-by-id.ts
@@ -0,0 +1,22 @@
+import { tag } from '@postly/db';
+import { orgId as toOrgId, postId as toPostId } from '@postly/domain';
+import { from, query, t } from '@ultimat3/query';
+import { postRead } from '../policy';
+import type { PostWithComments } from '../repo';
+import * as repo from '../repo';
+
+/** The single post page. Comments come with it: one round trip, one cache entry, two tags. */
+export const postById = query({
+  input: t.object({ orgId: t.uuid, postId: t.uuid }),
+  policy: postRead,
+  cache: { tags: [tag.post, tag.comment], ttlMs: 60_000 },
+  mcp: { expose: true, description: 'Read one post with its comments' },
+  sql: ({ orgId, postId }) =>
+    // Ordered by `id` alone: the row is ONE post, found by its key, and a `PostView` carries no
+    // `createdAt`. The `orderBy('createdAt')` that stood here sorted on a column the rows lack, and
+    // `from()` refuses that now (X_QUERY_COLUMN_UNSELECTED) — which took `/posts/{id}` down.
+    from<PostWithComments>('posts', () => repo.withComments(toOrgId(orgId), toPostId(postId)))
+      .where({ orgId, id: postId })
+      .orderBy('id')
+      .limit(1),
+});
diff --git a/examples/dummy/apps/web/app/posts/queries/post-by-slug.ts b/examples/dummy/apps/web/app/posts/queries/post-by-slug.ts
new file mode 100644
index 000000000..dd8e7d93a
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/queries/post-by-slug.ts
@@ -0,0 +1,42 @@
+// `postBySlug`, the posts slice's query — one primitive per file, the layout `x g` writes.
+//
+// The posts feature's reads. `liveFeed` is `live: true`, so the feed is pushed a patch per change
+// over the socket instead of polling, and its rows are records of the page's store. `posts` is
+// declared `persist: true` (`@postly/db`), so those records are on the device's disk too, per
+// principal, and a reload offline still shows them. `publicPost` is a plain cached read: the
+// public blog does not need a socket.
+//
+// `t` comes from @ultimat3/query, not @ultimat3/schema: a query file imports one package.
+//
+// Every read is ordered and bounded. `live: true` requires it — an unbounded live query is a
+// memory leak that only shows up under load — and the others keep the shape so promoting one
+// later is a one-line change.
+//
+// Every order ends with a key that is unique in the row shape, and that is not decoration: the
+// live matcher computes a row's insertion position and decides whether a change moved it from
+// this `orderBy` list alone. `createdAt desc` by itself is a partial order, so two posts written
+// in the same millisecond can swap places between evaluations and a bounded page can drop or
+// repeat one at the boundary. `repo.ts` gets its tail key for free — @ultimat3/entity appends the
+// primary key to every plan — but `from()` builds the shape declared here, so it is written out.
+// Ascending, to match the direction the repo appends.
+
+import { tag } from '@postly/db';
+import { orgId as toOrgId } from '@postly/domain';
+import { from, query, t } from '@ultimat3/query';
+import type { PostView } from '../entity';
+import { feedRead } from '../policy';
+import * as repo from '../repo';
+
+/** The signed-in read of a published post by slug — same row, tenant-scoped, different policy. */
+export const postBySlug = query({
+  input: t.object({ orgId: t.uuid, slug: t.string }),
+  policy: feedRead,
+  cache: { tags: [tag.post], ttlMs: 300_000 },
+  mcp: { expose: true, description: 'Read one published post by slug' },
+  sql: ({ orgId, slug }) =>
+    from<PostView>('posts', () => repo.publishedBySlugInOrg(toOrgId(orgId), slug))
+      .where({ orgId, slug, status: 'published' })
+      .orderBy('publishedAt', 'desc')
+      .orderBy('id')
+      .limit(1),
+});
diff --git a/examples/dummy/apps/web/app/posts/queries/post-record.ts b/examples/dummy/apps/web/app/posts/queries/post-record.ts
new file mode 100644
index 000000000..81c68e5bc
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/queries/post-record.ts
@@ -0,0 +1,59 @@
+// `postRecord`, the posts slice's query — one primitive per file, the layout `x g` writes.
+//
+// The posts feature's reads. `liveFeed` is `live: true`, so the feed is pushed a patch per change
+// over the socket instead of polling, and its rows are records of the page's store. `posts` is
+// declared `persist: true` (`@postly/db`), so those records are on the device's disk too, per
+// principal, and a reload offline still shows them. `publicPost` is a plain cached read: the
+// public blog does not need a socket.
+//
+// `t` comes from @ultimat3/query, not @ultimat3/schema: a query file imports one package.
+//
+// Every read is ordered and bounded. `live: true` requires it — an unbounded live query is a
+// memory leak that only shows up under load — and the others keep the shape so promoting one
+// later is a one-line change.
+//
+// Every order ends with a key that is unique in the row shape, and that is not decoration: the
+// live matcher computes a row's insertion position and decides whether a change moved it from
+// this `orderBy` list alone. `createdAt desc` by itself is a partial order, so two posts written
+// in the same millisecond can swap places between evaluations and a bounded page can drop or
+// repeat one at the boundary. `repo.ts` gets its tail key for free — @ultimat3/entity appends the
+// primary key to every plan — but `from()` builds the shape declared here, so it is written out.
+// Ascending, to match the direction the repo appends.
+
+import { memberOf, NotAMember } from '@postly/core';
+import { type Post, posts } from '@postly/db';
+import { type MemberId, orgId as toOrgId, postId as toPostId } from '@postly/domain';
+import { from, query, t } from '@ultimat3/query';
+import { postRead } from '../policy';
+import * as repo from '../repo';
+
+/**
+ * The member reading, for a read whose answer is theirs alone. `postRead` has already required a
+ * membership, so `null` is broken wiring — refused the way `ctx.posts` refuses it, never read as
+ * "likes nothing".
+ */
+const readerOf = (actor: Parameters<typeof memberOf>[0]): MemberId => {
+  const member = memberOf(actor);
+  if (member === null) throw new NotAMember(actor?.id ?? '');
+  return member.memberId;
+};
+
+/**
+ * One post as its whole ROW, the record `useRecord('posts', id)` reads — how the like islands on
+ * `/posts/{id}` seed the store before a channel frame has anything to say about it. The row carries
+ * the reader's own `likedByMe` beside its columns (`repo.recordById`): the like twin reads it, and
+ * without it a member's repeat like painted +1 and dropped back. `from<Post>` and not the wider
+ * row: `rows:` is the entity's schema, and the flag is not one of its columns.
+ */
+export const postRecord = query({
+  input: t.object({ orgId: t.uuid, postId: t.uuid }),
+  policy: postRead,
+  rows: posts.$schema,
+  sql: ({ orgId, postId }, ctx) =>
+    from<Post>('posts', () =>
+      repo.recordById(toOrgId(orgId), toPostId(postId), readerOf(ctx.actor)),
+    )
+      .where({ orgId, id: postId })
+      .orderBy('id')
+      .limit(1),
+});
diff --git a/examples/dummy/apps/web/app/posts/queries/post-review.ts b/examples/dummy/apps/web/app/posts/queries/post-review.ts
new file mode 100644
index 000000000..fd6efce52
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/queries/post-review.ts
@@ -0,0 +1,43 @@
+// `postReview`, the posts slice's query — one primitive per file, the layout `x g` writes.
+//
+// The posts feature's reads. `liveFeed` is `live: true`, so the feed is pushed a patch per change
+// over the socket instead of polling, and its rows are records of the page's store. `posts` is
+// declared `persist: true` (`@postly/db`), so those records are on the device's disk too, per
+// principal, and a reload offline still shows them. `publicPost` is a plain cached read: the
+// public blog does not need a socket.
+//
+// `t` comes from @ultimat3/query, not @ultimat3/schema: a query file imports one package.
+//
+// Every read is ordered and bounded. `live: true` requires it — an unbounded live query is a
+// memory leak that only shows up under load — and the others keep the shape so promoting one
+// later is a one-line change.
+//
+// Every order ends with a key that is unique in the row shape, and that is not decoration: the
+// live matcher computes a row's insertion position and decides whether a change moved it from
+// this `orderBy` list alone. `createdAt desc` by itself is a partial order, so two posts written
+// in the same millisecond can swap places between evaluations and a bounded page can drop or
+// repeat one at the boundary. `repo.ts` gets its tail key for free — @ultimat3/entity appends the
+// primary key to every plan — but `from()` builds the shape declared here, so it is written out.
+// Ascending, to match the direction the repo appends.
+
+import { orgId as toOrgId, postId as toPostId } from '@postly/domain';
+import { from, query, t } from '@ultimat3/query';
+import type { ReviewView } from '../entity';
+import { postRead } from '../policy';
+import * as repo from '../repo';
+
+/**
+ * A post's latest review — what `keepDraftReview` kept, which is the only place a queued
+ * `reviewDraftLater` run's verdict lands. Not cached: a review that just landed has to be the one
+ * read back, and a tag for it would be a second invalidation to keep in step with the upsert.
+ */
+export const postReview = query({
+  input: t.object({ orgId: t.uuid, postId: t.uuid }),
+  policy: postRead,
+  mcp: { expose: true, description: 'Read the latest review of a post' },
+  sql: ({ orgId, postId }) =>
+    from<ReviewView>('post_reviews', () => repo.reviewRows(toOrgId(orgId), toPostId(postId)))
+      .where({ orgId, postId })
+      .orderBy('postId')
+      .limit(1),
+});
diff --git a/examples/dummy/apps/web/app/posts/queries/public-post-slugs.ts b/examples/dummy/apps/web/app/posts/queries/public-post-slugs.ts
new file mode 100644
index 000000000..8a2f09c30
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/queries/public-post-slugs.ts
@@ -0,0 +1,22 @@
+import { tag } from '@postly/db';
+import { publicPostRead } from '@postly/web/shared/policies';
+import { from, query, t } from '@ultimat3/query';
+import type { PublishedSlug } from '../repo';
+import * as repo from '../repo';
+
+/**
+ * Feeds `prerender()` on the blog route: one row per page the build must emit. The tail key is
+ * `slug`, not `id` — this projection has no `id` column to sort on, and `slug` is unique across
+ * every org by invariant, which is the same property the public URL relies on.
+ */
+export const publicPostSlugs = query({
+  input: t.object({}),
+  policy: publicPostRead,
+  cache: { tags: [tag.blog], ttlMs: 3_600_000 },
+  sql: () =>
+    from<PublishedSlug>('posts', repo.publishedSlugs)
+      .where({ status: 'published' })
+      .orderBy('publishedAt', 'desc')
+      .orderBy('slug')
+      .limit(1000),
+});
diff --git a/examples/dummy/apps/web/app/posts/queries/public-post.ts b/examples/dummy/apps/web/app/posts/queries/public-post.ts
new file mode 100644
index 000000000..00966b959
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/queries/public-post.ts
@@ -0,0 +1,46 @@
+// `publicPost`, the posts slice's query — one primitive per file, the layout `x g` writes.
+//
+// The posts feature's reads. `liveFeed` is `live: true`, so the feed is pushed a patch per change
+// over the socket instead of polling, and its rows are records of the page's store. `posts` is
+// declared `persist: true` (`@postly/db`), so those records are on the device's disk too, per
+// principal, and a reload offline still shows them. `publicPost` is a plain cached read: the
+// public blog does not need a socket.
+//
+// `t` comes from @ultimat3/query, not @ultimat3/schema: a query file imports one package.
+//
+// Every read is ordered and bounded. `live: true` requires it — an unbounded live query is a
+// memory leak that only shows up under load — and the others keep the shape so promoting one
+// later is a one-line change.
+//
+// Every order ends with a key that is unique in the row shape, and that is not decoration: the
+// live matcher computes a row's insertion position and decides whether a change moved it from
+// this `orderBy` list alone. `createdAt desc` by itself is a partial order, so two posts written
+// in the same millisecond can swap places between evaluations and a bounded page can drop or
+// repeat one at the boundary. `repo.ts` gets its tail key for free — @ultimat3/entity appends the
+// primary key to every plan — but `from()` builds the shape declared here, so it is written out.
+// Ascending, to match the direction the repo appends.
+
+import { tag } from '@postly/db';
+import { publicPostRead } from '@postly/web/shared/policies';
+import { from, query, t } from '@ultimat3/query';
+import type { PostView } from '../entity';
+import * as repo from '../repo';
+
+/**
+ * The public blog's reads. Anonymous by policy — `publicPostRead` is written down in
+ * `shared/policies.ts` rather than being the absence of a rule. "Published only" is the `where`
+ * below, not the policy: a policy owns the yes/no, a query owns the rows. `site/` reaches these
+ * through the typed client, never by importing this file.
+ */
+export const publicPost = query({
+  input: t.object({ slug: t.string }),
+  policy: publicPostRead,
+  cache: { tags: [tag.blog], ttlMs: 3_600_000 },
+  mcp: { expose: true, description: 'Read one published post from the public blog' },
+  sql: ({ slug }) =>
+    from<PostView>('posts', () => repo.publishedBySlug(slug))
+      .where({ slug, status: 'published' })
+      .orderBy('publishedAt', 'desc')
+      .orderBy('id')
+      .limit(1),
+});
diff --git a/examples/dummy/apps/web/app/posts/queries/public-posts.ts b/examples/dummy/apps/web/app/posts/queries/public-posts.ts
new file mode 100644
index 000000000..cc4bfcd81
--- /dev/null
+++ b/examples/dummy/apps/web/app/posts/queries/public-posts.ts
@@ -0,0 +1,46 @@
+// `publicPosts`, the posts slice's query — one primitive per file, the layout `x g` writes.
+//
+// The posts feature's reads. `liveFeed` is `live: true`, so the feed is pushed a patch per change
+// over the socket instead of polling, and its rows are records of the page's store. `posts` is
+// declared `persist: true` (`@postly/db`), so those records are on the device's disk too, per
+// principal, and a reload offline still shows them. `publicPost` is a plain cached read: the
+// public blog does not need a socket.
+//
+// `t` comes from @ultimat3/query, not @ultimat3/schema: a query file imports one package.
+//
+// Every read is ordered and bounded. `live: true` requires it — an unbounded live query is a
+// memory leak that only shows up under load — and the others keep the shape so promoting one
+// later is a one-line change.
+//
+// Every order ends with a key that is unique in the row shape, and that is not decoration: the
+// live matcher computes a row's insertion position and decides whether a change moved it from
+// this `orderBy` list alone. `createdAt desc` by itself is a partial order, so two posts written
+// in the same millisecond can swap places between evaluations and a bounded page can drop or
+// repeat one at the boundary. `repo.ts` gets its tail key for free — @ultimat3/entity appends the
+// primary key to every plan — but `from()` builds the shape declared here, so it is written out.
+// Ascending, to match the direction the repo appends.
+
+import { tag } from '@postly/db';
+import { publicPostRead } from '@postly/web/shared/policies';
+import { from, query, t } from '@ultimat3/query';
+import type { PostSummary } from '../entity';
+import * as repo from '../repo';
+
+/**
+ * The public blog index. A `PostSummary`, not a slug: the index renders the same `<PostCard>` the
+ * org feed does, and a card needs a title, an excerpt and a byline. `publicPostSlugs` below stays
+ * what it is — the prerender enumeration — because a URL list and a page of cards are two reads
+ * with two cache lifetimes, not one read used twice.
+ */
+export const publicPosts = query({
+  input: t.object({ limit: t.number.int().min(1).max(50).default(20) }),
+  policy: publicPostRead,
+  cache: { tags: [tag.blog], ttlMs: 3_600_000 },
+  mcp: { expose: true, description: 'List the published posts on the public blog' },
+  sql: ({ limit }) =>
+    from<PostSummary>('posts', () => repo.publishedPage(limit))
+      .where({ status: 'published' })
+      .orderBy('publishedAt', 'desc')
+      .orderBy('id')
+      .limit(limit),
+});
diff --git a/examples/dummy/apps/web/app/posts/repo.ts b/examples/dummy/apps/web/app/posts/repo.ts
index c06a085f1..8725e56b0 100644
--- a/examples/dummy/apps/web/app/posts/repo.ts
+++ b/examples/dummy/apps/web/app/posts/repo.ts
@@ -167,7 +167,7 @@ export const byId = async (orgId: OrgId, id: PostId): Promise<PostView | null> =
 /**
  * Whole `posts` rows — RECORDS, not views: what the page's store holds under `posts:<id>`, so the
  * read answering them and the channel frame updating them write one object. `orgPosts` and
- * `postRecord` in `live.ts` answer these, declared `rows: posts.$schema`.
+ * `postRecord` in `queries/` answer these, declared `rows: posts.$schema`.
  */
 export const recentRows = async (orgId: OrgId, limit: number): Promise<Post[]> => [
   ...(await db.posts.where({ orgId }).orderBy('createdAt', 'desc').limit(limit).all()),
@@ -221,7 +221,7 @@ export const insertDraft = async (row: {
 }): Promise<PostView> => writeView(await db.posts.insert(row));
 
 /**
- * Every post of one org, as `exportPosts` pages it (`jobs.ts`): the chain, never the rows — the
+ * Every post of one org, as `exportPosts` pages it (`jobs/export-posts.ts`): the chain, never the rows — the
  * export reads it a batch at a time, so the org's whole history is never one array in the heap.
  */
 export const exportSource = (orgId: OrgId): ReadBuilder<Post> => db.posts.where({ orgId });
@@ -286,7 +286,7 @@ export const publishedSince = async (orgId: OrgId, since: Date): Promise<PostSum
   ).map(summaryView);
 
 /**
- * One row, one statement, for the feed's streamed activity badge — `feedActivity` in `live.ts`
+ * One row, one statement, for the feed's streamed activity badge — `feedActivity` in `queries/feed-activity.ts`
  * wraps this so the count arrives independently of the feed itself, which reads over the socket.
  */
 export const activitySummary = async (orgId: OrgId): Promise<ActivitySummary[]> => {
@@ -308,7 +308,7 @@ export const insertComment = async (row: {
  * appends the primary key to every plan (`plan.ts`, `totalOrder`) precisely so a cursor page has a
  * total order. Repeating it would be a second declaration of the same rule, and an ascending `id`
  * spelled `desc` by hand would silently disagree with the page the driver actually returns. The
- * live query in `live.ts` does write it out, because `from()` builds its shape from that call.
+ * live query in `live/live-feed.ts` does write it out, because `from()` builds its shape from that call.
  */
 export const feedPage = async (orgId: OrgId, limit: number): Promise<PostSummary[]> =>
   (
diff --git a/examples/dummy/apps/web/app/posts/review.job.test.ts b/examples/dummy/apps/web/app/posts/review.job.test.ts
index bd0d77f1a..a25724041 100644
--- a/examples/dummy/apps/web/app/posts/review.job.test.ts
+++ b/examples/dummy/apps/web/app/posts/review.job.test.ts
@@ -17,7 +17,9 @@ import {
 } from '@ultimat3/ai';
 import { beforeEach, expect, jobTest } from '@ultimat3/testing';
 import { CLAUDE_SONNET_5 } from '../models';
-import { keepDraftReview, requestDraftReview, reviewDraftLater } from './actions';
+import { keepDraftReview } from './actions/keep-draft-review';
+import { requestDraftReview } from './actions/request-draft-review';
+import { reviewDraftLater } from './jobs/review-draft-later';
 
 const USAGE = { inputTokens: 40, outputTokens: 20, cacheReadTokens: 0, cacheWriteTokens: 0 };
 
diff --git a/examples/dummy/apps/web/app/runs/actions.test.ts b/examples/dummy/apps/web/app/runs/actions.test.ts
index 4dbe41bbe..e799e7d9b 100644
--- a/examples/dummy/apps/web/app/runs/actions.test.ts
+++ b/examples/dummy/apps/web/app/runs/actions.test.ts
@@ -6,14 +6,12 @@ import { ctxOf, runWithContext } from '@ultimat3/core';
 import { jobDriver, memoryJobDriver, resetJobDriver, setJobDriver } from '@ultimat3/jobs';
 import { testActor } from '@ultimat3/policy';
 import { afterEach, expect, unitTest } from '@ultimat3/testing';
-import {
-  answerPrompt,
-  cancelRun,
-  connectSite,
-  issueRunKey,
-  revokeRunKey,
-  startRun,
-} from './actions';
+import { answerPrompt } from './actions/answer-prompt';
+import { cancelRun } from './actions/cancel-run';
+import { connectSite } from './actions/connect-site';
+import { issueRunKey } from './actions/issue-run-key';
+import { revokeRunKey } from './actions/revoke-run-key';
+import { startRun } from './actions/start-run';
 import { resolveRunKey } from './keys';
 import * as repo from './repo';
 
diff --git a/examples/dummy/apps/web/app/runs/actions.ts b/examples/dummy/apps/web/app/runs/actions.ts
deleted file mode 100644
index b332ad922..000000000
--- a/examples/dummy/apps/web/app/runs/actions.ts
+++ /dev/null
@@ -1,94 +0,0 @@
-/**
- * The runs feature's commands. Declarations only — every body delegates to `ctx.runs`, so the
- * same code runs whether the caller is the console, a machine holding a run key or an MCP agent.
- *
- * `orgId` is in every input because the policy decides on it, and the two commands that act on
- * ONE run load the fact their rule reads — the prompt's row, the run's row — before the guard: a
- * run id is a handle a caller typed, never evidence the run is theirs.
- *
- * `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
- */
-
-import { action, t } from '@ultimat3/action';
-import { ConnectInput, ConnectionView, RunKeyIssued, RunStarted } from './entity';
-import { canRunAct, canRunKey, canRunKeyRevoke, canRunWrite } from './policy';
-
-/** An answer is a short code a person typed; anything longer is not one. */
-const ANSWER_MAX = 64;
-
-export const connectSite = action({
-  input: ConnectInput,
-  output: ConnectionView,
-  policy: canRunWrite,
-  // No `mcp`: the input carries a credential, and an agent's transcript is the wrong place for one.
-  async handle({ input, ctx }) {
-    return ctx.runs.connect(input);
-  },
-});
-
-export const startRun = action({
-  input: t.object({ orgId: t.uuid, connectionId: t.uuid }),
-  output: RunStarted,
-  policy: canRunWrite,
-  mcp: {
-    expose: true,
-    description:
-      'Start one sync of a connection. Answers the run id its events and prompts are keyed by; a second run of a busy connection settles failed with X_JOB_KEY_BUSY',
-  },
-  async handle({ input, ctx }) {
-    return ctx.runs.start(input.orgId, input.connectionId);
-  },
-});
-
-export const answerPrompt = action({
-  input: t.object({
-    orgId: t.uuid,
-    runId: t.uuid,
-    prompt: t.number.int().min(1),
-    answer: t.string.min(1).max(ANSWER_MAX),
-  }),
-  output: t.object({ runId: t.uuid, prompt: t.number.int() }),
-  policy: canRunAct,
-  row: ({ input, ctx }) => ctx.runs.promptOwner(input.runId, input.prompt),
-  mcp: {
-    expose: true,
-    description:
-      'Answer the prompt a run is waiting on — the code the site asked for. The run resumes with its browser still open',
-  },
-  async handle({ input, ctx }) {
-    await ctx.runs.answer(input.runId, input.prompt, input.answer);
-    return { runId: input.runId, prompt: input.prompt };
-  },
-});
-
-export const cancelRun = action({
-  input: t.object({ orgId: t.uuid, runId: t.uuid }),
-  output: t.object({ runId: t.uuid }),
-  policy: canRunAct,
-  row: ({ input, ctx }) => ctx.runs.runOwner(input.runId),
-  mcp: { expose: true, description: 'Cancel a run that is queued or in flight' },
-  async handle({ input, ctx }) {
-    await ctx.runs.cancel(input.runId);
-    return { runId: input.runId };
-  },
-});
-
-export const issueRunKey = action({
-  input: t.object({ orgId: t.uuid }),
-  output: RunKeyIssued,
-  policy: canRunKey,
-  // No `mcp`: the answer is a credential, shown once, and a tool result is kept in a transcript.
-  async handle({ input, ctx }) {
-    return ctx.runs.issueKey(input.orgId);
-  },
-});
-
-export const revokeRunKey = action({
-  input: t.object({ orgId: t.uuid, keyId: t.string.min(1) }),
-  output: t.object({ revoked: t.boolean }),
-  policy: canRunKeyRevoke,
-  row: ({ input, ctx }) => ctx.runs.keyOwner(input.keyId),
-  async handle({ input, ctx }) {
-    return { revoked: await ctx.runs.revokeKey(input.keyId) };
-  },
-});
diff --git a/examples/dummy/apps/web/app/runs/actions/answer-prompt.ts b/examples/dummy/apps/web/app/runs/actions/answer-prompt.ts
new file mode 100644
index 000000000..a0e1613be
--- /dev/null
+++ b/examples/dummy/apps/web/app/runs/actions/answer-prompt.ts
@@ -0,0 +1,37 @@
+// `answerPrompt`, the runs slice's action — one primitive per file, the layout `x g` writes.
+//
+// The runs feature's commands. Declarations only — every body delegates to `ctx.runs`, so the
+// same code runs whether the caller is the console, a machine holding a run key or an MCP agent.
+//
+// `orgId` is in every input because the policy decides on it, and the two commands that act on
+// ONE run load the fact their rule reads — the prompt's row, the run's row — before the guard: a
+// run id is a handle a caller typed, never evidence the run is theirs.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+
+import { action, t } from '@ultimat3/action';
+import { canRunAct } from '../policy';
+
+/** An answer is a short code a person typed; anything longer is not one. */
+const ANSWER_MAX = 64;
+
+export const answerPrompt = action({
+  input: t.object({
+    orgId: t.uuid,
+    runId: t.uuid,
+    prompt: t.number.int().min(1),
+    answer: t.string.min(1).max(ANSWER_MAX),
+  }),
+  output: t.object({ runId: t.uuid, prompt: t.number.int() }),
+  policy: canRunAct,
+  row: ({ input, ctx }) => ctx.runs.promptOwner(input.runId, input.prompt),
+  mcp: {
+    expose: true,
+    description:
+      'Answer the prompt a run is waiting on — the code the site asked for. The run resumes with its browser still open',
+  },
+  async handle({ input, ctx }) {
+    await ctx.runs.answer(input.runId, input.prompt, input.answer);
+    return { runId: input.runId, prompt: input.prompt };
+  },
+});
diff --git a/examples/dummy/apps/web/app/runs/actions/cancel-run.ts b/examples/dummy/apps/web/app/runs/actions/cancel-run.ts
new file mode 100644
index 000000000..f254b5918
--- /dev/null
+++ b/examples/dummy/apps/web/app/runs/actions/cancel-run.ts
@@ -0,0 +1,25 @@
+// `cancelRun`, the runs slice's action — one primitive per file, the layout `x g` writes.
+//
+// The runs feature's commands. Declarations only — every body delegates to `ctx.runs`, so the
+// same code runs whether the caller is the console, a machine holding a run key or an MCP agent.
+//
+// `orgId` is in every input because the policy decides on it, and the two commands that act on
+// ONE run load the fact their rule reads — the prompt's row, the run's row — before the guard: a
+// run id is a handle a caller typed, never evidence the run is theirs.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+
+import { action, t } from '@ultimat3/action';
+import { canRunAct } from '../policy';
+
+export const cancelRun = action({
+  input: t.object({ orgId: t.uuid, runId: t.uuid }),
+  output: t.object({ runId: t.uuid }),
+  policy: canRunAct,
+  row: ({ input, ctx }) => ctx.runs.runOwner(input.runId),
+  mcp: { expose: true, description: 'Cancel a run that is queued or in flight' },
+  async handle({ input, ctx }) {
+    await ctx.runs.cancel(input.runId);
+    return { runId: input.runId };
+  },
+});
diff --git a/examples/dummy/apps/web/app/runs/actions/connect-site.ts b/examples/dummy/apps/web/app/runs/actions/connect-site.ts
new file mode 100644
index 000000000..14cd70174
--- /dev/null
+++ b/examples/dummy/apps/web/app/runs/actions/connect-site.ts
@@ -0,0 +1,24 @@
+// `connectSite`, the runs slice's action — one primitive per file, the layout `x g` writes.
+//
+// The runs feature's commands. Declarations only — every body delegates to `ctx.runs`, so the
+// same code runs whether the caller is the console, a machine holding a run key or an MCP agent.
+//
+// `orgId` is in every input because the policy decides on it, and the two commands that act on
+// ONE run load the fact their rule reads — the prompt's row, the run's row — before the guard: a
+// run id is a handle a caller typed, never evidence the run is theirs.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+
+import { action } from '@ultimat3/action';
+import { ConnectInput, ConnectionView } from '../entity';
+import { canRunWrite } from '../policy';
+
+export const connectSite = action({
+  input: ConnectInput,
+  output: ConnectionView,
+  policy: canRunWrite,
+  // No `mcp`: the input carries a credential, and an agent's transcript is the wrong place for one.
+  async handle({ input, ctx }) {
+    return ctx.runs.connect(input);
+  },
+});
diff --git a/examples/dummy/apps/web/app/runs/actions/issue-run-key.ts b/examples/dummy/apps/web/app/runs/actions/issue-run-key.ts
new file mode 100644
index 000000000..feb511bef
--- /dev/null
+++ b/examples/dummy/apps/web/app/runs/actions/issue-run-key.ts
@@ -0,0 +1,24 @@
+// `issueRunKey`, the runs slice's action — one primitive per file, the layout `x g` writes.
+//
+// The runs feature's commands. Declarations only — every body delegates to `ctx.runs`, so the
+// same code runs whether the caller is the console, a machine holding a run key or an MCP agent.
+//
+// `orgId` is in every input because the policy decides on it, and the two commands that act on
+// ONE run load the fact their rule reads — the prompt's row, the run's row — before the guard: a
+// run id is a handle a caller typed, never evidence the run is theirs.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+
+import { action, t } from '@ultimat3/action';
+import { RunKeyIssued } from '../entity';
+import { canRunKey } from '../policy';
+
+export const issueRunKey = action({
+  input: t.object({ orgId: t.uuid }),
+  output: RunKeyIssued,
+  policy: canRunKey,
+  // No `mcp`: the answer is a credential, shown once, and a tool result is kept in a transcript.
+  async handle({ input, ctx }) {
+    return ctx.runs.issueKey(input.orgId);
+  },
+});
diff --git a/examples/dummy/apps/web/app/runs/actions/revoke-run-key.ts b/examples/dummy/apps/web/app/runs/actions/revoke-run-key.ts
new file mode 100644
index 000000000..03211eb54
--- /dev/null
+++ b/examples/dummy/apps/web/app/runs/actions/revoke-run-key.ts
@@ -0,0 +1,23 @@
+// `revokeRunKey`, the runs slice's action — one primitive per file, the layout `x g` writes.
+//
+// The runs feature's commands. Declarations only — every body delegates to `ctx.runs`, so the
+// same code runs whether the caller is the console, a machine holding a run key or an MCP agent.
+//
+// `orgId` is in every input because the policy decides on it, and the two commands that act on
+// ONE run load the fact their rule reads — the prompt's row, the run's row — before the guard: a
+// run id is a handle a caller typed, never evidence the run is theirs.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+
+import { action, t } from '@ultimat3/action';
+import { canRunKeyRevoke } from '../policy';
+
+export const revokeRunKey = action({
+  input: t.object({ orgId: t.uuid, keyId: t.string.min(1) }),
+  output: t.object({ revoked: t.boolean }),
+  policy: canRunKeyRevoke,
+  row: ({ input, ctx }) => ctx.runs.keyOwner(input.keyId),
+  async handle({ input, ctx }) {
+    return { revoked: await ctx.runs.revokeKey(input.keyId) };
+  },
+});
diff --git a/examples/dummy/apps/web/app/runs/actions/start-run.ts b/examples/dummy/apps/web/app/runs/actions/start-run.ts
new file mode 100644
index 000000000..0dbe33c9b
--- /dev/null
+++ b/examples/dummy/apps/web/app/runs/actions/start-run.ts
@@ -0,0 +1,28 @@
+// `startRun`, the runs slice's action — one primitive per file, the layout `x g` writes.
+//
+// The runs feature's commands. Declarations only — every body delegates to `ctx.runs`, so the
+// same code runs whether the caller is the console, a machine holding a run key or an MCP agent.
+//
+// `orgId` is in every input because the policy decides on it, and the two commands that act on
+// ONE run load the fact their rule reads — the prompt's row, the run's row — before the guard: a
+// run id is a handle a caller typed, never evidence the run is theirs.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+
+import { action, t } from '@ultimat3/action';
+import { RunStarted } from '../entity';
+import { canRunWrite } from '../policy';
+
+export const startRun = action({
+  input: t.object({ orgId: t.uuid, connectionId: t.uuid }),
+  output: RunStarted,
+  policy: canRunWrite,
+  mcp: {
+    expose: true,
+    description:
+      'Start one sync of a connection. Answers the run id its events and prompts are keyed by; a second run of a busy connection settles failed with X_JOB_KEY_BUSY',
+  },
+  async handle({ input, ctx }) {
+    return ctx.runs.start(input.orgId, input.connectionId);
+  },
+});
diff --git a/examples/dummy/apps/web/app/runs/jobs.test.ts b/examples/dummy/apps/web/app/runs/jobs.test.ts
index 373753f9a..183ec1754 100644
--- a/examples/dummy/apps/web/app/runs/jobs.test.ts
+++ b/examples/dummy/apps/web/app/runs/jobs.test.ts
@@ -7,7 +7,7 @@ import type { Ctx } from '@ultimat3/core';
 import { ctxOf, runWithContext, userActor } from '@ultimat3/core';
 import { answerPrompt, noWaitClock } from '@ultimat3/scraping';
 import { afterEach, beforeEach, expect, unitTest } from '@ultimat3/testing';
-import { askConsole, PROMPT_LABEL, recordedUsage, syncConnection } from './jobs';
+import { askConsole, PROMPT_LABEL, recordedUsage, syncConnection } from './jobs/sync-connection';
 import * as repo from './repo';
 
 const ORG = '00000000-0000-4000-8000-0000000000a1';
diff --git a/examples/dummy/apps/web/app/runs/jobs.ts b/examples/dummy/apps/web/app/runs/jobs/sync-connection.ts
similarity index 96%
rename from examples/dummy/apps/web/app/runs/jobs.ts
rename to examples/dummy/apps/web/app/runs/jobs/sync-connection.ts
index 4bfb17984..9375a0399 100644
--- a/examples/dummy/apps/web/app/runs/jobs.ts
+++ b/examples/dummy/apps/web/app/runs/jobs/sync-connection.ts
@@ -9,7 +9,7 @@
  * refused — are written by `onSettled`, which is told how every run ended, and so is what the
  * run used: `ScrapeReport.usage` on completion, the last attempt's on a failure.
  *
- * The site is a RECORDING (`./fixtures`): this app has no browser to rent, so the driver replays
+ * The site is a RECORDING (`../fixtures`): this app has no browser to rent, so the driver replays
  * one directory for both legs — the browser login and the HTTP read.
  *
  * `t` comes from @ultimat3/jobs, not @ultimat3/schema: a job file imports one package for it.
@@ -20,24 +20,31 @@ import { type Infer, t } from '@ultimat3/jobs';
 import type { PromptRequest, ScrapeUsage } from '@ultimat3/scraping';
 import { eventPrompt, fixtureBrowser, scrape, storageSessionStore } from '@ultimat3/scraping';
 import { disk } from '@ultimat3/storage';
-import { ConnectionNotFound } from './errors';
-import * as repo from './repo';
+import { ConnectionNotFound } from '../errors';
+import * as repo from '../repo';
 
 const SITE = 'ledger.example';
+
 const LOGIN = `https://${SITE}/login`;
+
 const ACCOUNTS = `https://${SITE}/accounts`;
+
 const ACCOUNTS_API = `https://${SITE}/api/accounts`;
 
 /** How long the site's question waits for a person. Past it the run fails; nothing retries it. */
 export const PROMPT_TIMEOUT_MS = 300_000;
+
 /** How often the run looks for the answer: one indexed read and one browser round trip each. */
 export const PROMPT_POLL_MS = 250;
+
 /** What the site asks for after the password. The console shows its own translated wording. */
 export const PROMPT_LABEL = 'one-time code';
+
 /** What a failure with no `X_*` code of its own is recorded as. */
 const UNCLASSIFIED = 'X_INTERNAL';
 
 const Account = t.object({ id: t.string, name: t.string });
+
 const AccountPage = t.object({ rows: t.array(Account) });
 
 /** What a run is queued with: ids only. The credential and the exit stay on the connection row. */
@@ -47,6 +54,7 @@ const SyncInput = t.object({
   /** One per `startRun` call: two starts on one connection are two runs, never one deduped. */
   requestId: t.uuid,
 });
+
 type SyncInput = Infer<typeof SyncInput>;
 
 /** The counts the run's `usage` event holds — `RunUsage`, which names no rented-browser cost. */
@@ -76,7 +84,7 @@ export const syncConnection = scrape({
   idempotencyKey: ({ requestId }) => `runs.sync:${requestId}`,
   tenant: ({ orgId }) => orgId,
   allowHosts: [SITE],
-  driver: fixtureBrowser(`${import.meta.dir}/fixtures`),
+  driver: fixtureBrowser(`${import.meta.dir}/../fixtures`),
   robots: { ignore: 'a recorded site: there is no origin to ask' },
   // A recording has no origin to be polite to; the default one navigation a second is for a site.
   rate: 20,
diff --git a/examples/dummy/apps/web/app/runs/live.live.test.ts b/examples/dummy/apps/web/app/runs/live.live.test.ts
index 4b8782d07..bbd5cf5c1 100644
--- a/examples/dummy/apps/web/app/runs/live.live.test.ts
+++ b/examples/dummy/apps/web/app/runs/live.live.test.ts
@@ -11,7 +11,7 @@
 import type { RunEvent } from '@postly/db';
 import { ctxOf, runWithContext } from '@ultimat3/core';
 import { expect, test } from '@ultimat3/testing';
-import { liveRunEvents } from './live';
+import { liveRunEvents } from './live/live-run-events';
 import * as repo from './repo';
 
 const RUN = '00000000-0000-4000-8000-0000000000b1';
diff --git a/examples/dummy/apps/web/app/runs/live.test.ts b/examples/dummy/apps/web/app/runs/live.test.ts
index 5bfee390c..ee6766561 100644
--- a/examples/dummy/apps/web/app/runs/live.test.ts
+++ b/examples/dummy/apps/web/app/runs/live.test.ts
@@ -5,7 +5,8 @@ import { ctxOf, runWithContext, userActor } from '@ultimat3/core';
 import { testActor } from '@ultimat3/policy';
 import { sourceFor } from '@ultimat3/query';
 import { afterEach, expect, unitTest } from '@ultimat3/testing';
-import { liveRunEvents, runConnections } from './live';
+import { liveRunEvents } from './live/live-run-events';
+import { runConnections } from './queries/run-connections';
 import * as repo from './repo';
 
 const ORG = '00000000-0000-4000-8000-0000000000a1';
diff --git a/examples/dummy/apps/web/app/runs/live.ts b/examples/dummy/apps/web/app/runs/live/live-run-events.ts
similarity index 50%
rename from examples/dummy/apps/web/app/runs/live.ts
rename to examples/dummy/apps/web/app/runs/live/live-run-events.ts
index 8dbab4310..3a7f4a8a7 100644
--- a/examples/dummy/apps/web/app/runs/live.ts
+++ b/examples/dummy/apps/web/app/runs/live/live-run-events.ts
@@ -1,18 +1,17 @@
-/**
- * The runs feature's reads. `liveRunEvents` is `live: true`: a row the job writes reaches every
- * open console over the page's one socket, with the policy evaluated per subscriber.
- *
- * Ordered by `seq` and bounded, with `id` last so the order is total — the live matcher places a
- * row by this list alone.
- *
- * `t` comes from @ultimat3/query, not @ultimat3/schema: a query file imports one package.
- */
+// `liveRunEvents`, the runs slice's query — one primitive per file, the layout `x g` writes.
+//
+// The runs feature's reads. `liveRunEvents` is `live: true`: a row the job writes reaches every
+// open console over the page's one socket, with the policy evaluated per subscriber.
+//
+// Ordered by `seq` and bounded, with `id` last so the order is total — the live matcher places a
+// row by this list alone.
+//
+// `t` comes from @ultimat3/query, not @ultimat3/schema: a query file imports one package.
 
 import type { RunEvent } from '@postly/db';
 import { from, query, t } from '@ultimat3/query';
-import { CONNECTION_PAGE, type ConnectionView } from './entity';
-import { canRunRead } from './policy';
-import * as repo from './repo';
+import { canRunRead } from '../policy';
+import * as repo from '../repo';
 
 /** More events than one run writes; the bound a live read is required to state. */
 const EVENT_LIMIT = 200;
@@ -36,22 +35,3 @@ export const liveRunEvents = query({
       .orderBy('id')
       .limit(limit),
 });
-
-/** The connections the console can start a run on. Not live: a refetch after a write is enough. */
-export const runConnections = query({
-  input: t.object({ orgId: t.uuid }),
-  policy: canRunRead,
-  sql: ({ orgId }) =>
-    from<ConnectionView & { readonly orgId: string }>('connections', async () =>
-      (await repo.listConnections(CONNECTION_PAGE)).map((row) => ({
-        id: row.id,
-        orgId: row.orgId,
-        label: row.label,
-        createdAt: row.createdAt,
-      })),
-    )
-      .where({ orgId })
-      .orderBy('createdAt', 'desc')
-      .orderBy('id')
-      .limit(CONNECTION_PAGE),
-});
diff --git a/examples/dummy/apps/web/app/runs/queries/run-connections.ts b/examples/dummy/apps/web/app/runs/queries/run-connections.ts
new file mode 100644
index 000000000..d4790bf4a
--- /dev/null
+++ b/examples/dummy/apps/web/app/runs/queries/run-connections.ts
@@ -0,0 +1,33 @@
+// `runConnections`, the runs slice's query — one primitive per file, the layout `x g` writes.
+//
+// The runs feature's reads. `liveRunEvents` is `live: true`: a row the job writes reaches every
+// open console over the page's one socket, with the policy evaluated per subscriber.
+//
+// Ordered by `seq` and bounded, with `id` last so the order is total — the live matcher places a
+// row by this list alone.
+//
+// `t` comes from @ultimat3/query, not @ultimat3/schema: a query file imports one package.
+
+import { from, query, t } from '@ultimat3/query';
+import { CONNECTION_PAGE, type ConnectionView } from '../entity';
+import { canRunRead } from '../policy';
+import * as repo from '../repo';
+
+/** The connections the console can start a run on. Not live: a refetch after a write is enough. */
+export const runConnections = query({
+  input: t.object({ orgId: t.uuid }),
+  policy: canRunRead,
+  sql: ({ orgId }) =>
+    from<ConnectionView & { readonly orgId: string }>('connections', async () =>
+      (await repo.listConnections(CONNECTION_PAGE)).map((row) => ({
+        id: row.id,
+        orgId: row.orgId,
+        label: row.label,
+        createdAt: row.createdAt,
+      })),
+    )
+      .where({ orgId })
+      .orderBy('createdAt', 'desc')
+      .orderBy('id')
+      .limit(CONNECTION_PAGE),
+});
diff --git a/examples/dummy/apps/web/app/runs/runs.contract.test.ts b/examples/dummy/apps/web/app/runs/runs.contract.test.ts
index 002fc1ee0..2fef9c732 100644
--- a/examples/dummy/apps/web/app/runs/runs.contract.test.ts
+++ b/examples/dummy/apps/web/app/runs/runs.contract.test.ts
@@ -14,7 +14,9 @@ import { defineHttpConfig, httpServer, mountedPath } from '@ultimat3/http';
 import { jobDriver, memoryJobDriver, resetJobDriver, setJobDriver } from '@ultimat3/jobs';
 import { testActor } from '@ultimat3/policy';
 import { afterEach, beforeEach, expect, test } from '@ultimat3/testing';
-import { connectSite, issueRunKey, revokeRunKey } from './actions';
+import { connectSite } from './actions/connect-site';
+import { issueRunKey } from './actions/issue-run-key';
+import { revokeRunKey } from './actions/revoke-run-key';
 
 const ORG = '00000000-0000-4000-8000-0000000000a1';
 const OTHER_ORG = '00000000-0000-4000-8000-0000000000a9';
diff --git a/examples/dummy/apps/web/app/runs/runs.job.test.ts b/examples/dummy/apps/web/app/runs/runs.job.test.ts
index 176b72242..e27e44c50 100644
--- a/examples/dummy/apps/web/app/runs/runs.job.test.ts
+++ b/examples/dummy/apps/web/app/runs/runs.job.test.ts
@@ -11,7 +11,7 @@ import { answerPrompt, noWaitClock, resetScrapeClock, setScrapeClock } from '@ul
 import type { MemoryStorageDriver } from '@ultimat3/storage';
 import { defineStorage, memoryStorageDriver, resetStorage } from '@ultimat3/storage';
 import { afterEach, beforeEach, expect, type JobRunTrace, jobTest } from '@ultimat3/testing';
-import { PROMPT_LABEL, syncConnection } from './jobs';
+import { PROMPT_LABEL, syncConnection } from './jobs/sync-connection';
 import * as repo from './repo';
 
 const ORG = '00000000-0000-4000-8000-0000000000a1';
diff --git a/examples/dummy/apps/web/app/runs/runs.test.ts b/examples/dummy/apps/web/app/runs/runs.test.ts
index 5c3d18040..9feb45602 100644
--- a/examples/dummy/apps/web/app/runs/runs.test.ts
+++ b/examples/dummy/apps/web/app/runs/runs.test.ts
@@ -13,7 +13,10 @@ import { testActor } from '@ultimat3/policy';
 import { noWaitClock, resetScrapeClock, setScrapeClock } from '@ultimat3/scraping';
 import { defineStorage, memoryStorageDriver, resetStorage } from '@ultimat3/storage';
 import { afterEach, beforeEach, describe, expect, test, testName } from '@ultimat3/testing';
-import { answerPrompt, cancelRun, connectSite, startRun } from './actions';
+import { answerPrompt } from './actions/answer-prompt';
+import { cancelRun } from './actions/cancel-run';
+import { connectSite } from './actions/connect-site';
+import { startRun } from './actions/start-run';
 import { canRunAct, canRunKey, canRunKeyRevoke, canRunRead, canRunWrite } from './policy';
 import * as repo from './repo';
 
diff --git a/examples/dummy/apps/web/app/runs/service.ts b/examples/dummy/apps/web/app/runs/service.ts
index 47ba19ced..ae05ecb6d 100644
--- a/examples/dummy/apps/web/app/runs/service.ts
+++ b/examples/dummy/apps/web/app/runs/service.ts
@@ -13,7 +13,7 @@ import { cancelJob, jobDriver } from '@ultimat3/jobs';
 import { answerPrompt as publishAnswer } from '@ultimat3/scraping';
 import type { ConnectInput, ConnectionView, RunKeyIssued, RunStarted } from './entity';
 import { ConnectionNotFound, RunNotFound, RunQueueUnavailable } from './errors';
-import { syncConnection } from './jobs';
+import { syncConnection } from './jobs/sync-connection';
 import { issueRunKeyFor, revokeRunKeyById, runKeyOwner } from './keys';
 import type { RunOwner } from './policy';
 import * as repo from './repo';
diff --git a/examples/dummy/apps/web/app/settings/actions.contract.test.ts b/examples/dummy/apps/web/app/settings/actions.contract.test.ts
index 4c2af9725..af9f8f91f 100644
--- a/examples/dummy/apps/web/app/settings/actions.contract.test.ts
+++ b/examples/dummy/apps/web/app/settings/actions.contract.test.ts
@@ -11,7 +11,7 @@
  */
 
 import { expect, test } from '@ultimat3/testing';
-import { savePreferences } from './actions';
+import { savePreferences } from './actions/save-preferences';
 
 test('savePreferences writes the member row and answers it as stored', async ({
   seed,
diff --git a/examples/dummy/apps/web/app/settings/actions.ts b/examples/dummy/apps/web/app/settings/actions.ts
deleted file mode 100644
index bfd762a21..000000000
--- a/examples/dummy/apps/web/app/settings/actions.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-/**
- * Preference writes. Settings are a thin edit of the member row, but "thin" is not a location:
- * an `action` is only ever declared in `api/` or in a feature's `actions.ts`, so the settings
- * slice gets one rather than a loose `settings-actions.ts` beside the page.
- *
- * Theme and digest opt-in ALSO have their own mutators in `mutator.ts` — `setTheme` and
- * `toggleDigestOptIn` — because both want to apply instantly and survive offline, unlike locale
- * and timezone, which stay behind a deliberate "Save" click (changing either mid-session
- * reformats every date and string on the page, which is not worth applying before the member
- * confirms it). Narrowing this action's input to drop them would be a breaking contract change
- * for no reason: both paths write the same partial `orgs.savePreferences`, so a caller who still
- * saves all four in one request keeps working exactly as before.
- *
- * `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
- */
-
-import { memberOf } from '@postly/core';
-import { members, tag } from '@postly/db';
-import { SUPPORTED_LOCALES, SUPPORTED_ZONES, THEMES } from '@postly/domain';
-import { action, t } from '@ultimat3/action';
-import { pushSubscribe, pushUnsubscribe } from '@ultimat3/pwa';
-import { memberSelf } from '../orgs/policy';
-
-export const savePreferences = action({
-  input: t.object({
-    locale: t.enumerated(...SUPPORTED_LOCALES),
-    /** IANA zone from the curated list; an arbitrary string would defeat the CHECK constraint. */
-    tz: t.enumerated(...SUPPORTED_ZONES),
-    /** Stored on the member, not in localStorage: the same person, the same theme, every device. */
-    theme: t.enumerated(...THEMES),
-    digestOptIn: t.boolean.default(true),
-  }),
-  // The whole `members` row, because that is what `updatePreferences` returns: an entity row
-  // schema is what makes the answer a RECORD the page store adopts (plan 101), where the
-  // hand-written `MemberView` was a partial projection no store could safely merge.
-  output: members.$schema,
-  policy: memberSelf,
-  cache: { invalidates: [tag.member] },
-  mcp: {
-    expose: true,
-    description: 'Update the acting member’s locale, timezone, theme and digest opt-in',
-  },
-  async handle({ input, ctx }) {
-    return ctx.orgs.savePreferences(input);
-  },
-});
-
-/**
- * Web Push for this browser. Factories over `action` — each one is a real action with its route,
- * typed client and contract tests — storing the subscription against the member the request ran as
- * (never an id the body names). `member:self` because subscribing is a preference of your own; the
- * framework refuses an agent whatever the permission says.
- */
-export const subscribePush = pushSubscribe({
-  permission: 'member:self',
-  check: ({ actor }) => memberOf(actor) !== null,
-});
-
-/** Forget this browser — the caller's own subscription only. */
-export const unsubscribePush = pushUnsubscribe({
-  permission: 'member:self',
-  check: ({ actor }) => memberOf(actor) !== null,
-});
diff --git a/examples/dummy/apps/web/app/settings/actions/save-preferences.ts b/examples/dummy/apps/web/app/settings/actions/save-preferences.ts
new file mode 100644
index 000000000..a436102eb
--- /dev/null
+++ b/examples/dummy/apps/web/app/settings/actions/save-preferences.ts
@@ -0,0 +1,44 @@
+// `savePreferences`, the settings slice's action — one primitive per file, the layout `x g` writes.
+//
+// Preference writes. Settings are a thin edit of the member row, but "thin" is not a location:
+// an `action` is only ever declared in a feature's `actions/`, so the settings slice gets one
+// rather than a loose `settings-actions.ts` beside the page.
+//
+// Theme and digest opt-in ALSO have their own mutators beside this file — `setTheme` and
+// `toggleDigestOptIn` — because both want to apply instantly and survive offline, unlike locale
+// and timezone, which stay behind a deliberate "Save" click (changing either mid-session
+// reformats every date and string on the page, which is not worth applying before the member
+// confirms it). Narrowing this action's input to drop them would be a breaking contract change
+// for no reason: both paths write the same partial `orgs.savePreferences`, so a caller who still
+// saves all four in one request keeps working exactly as before.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+
+import { members, tag } from '@postly/db';
+import { SUPPORTED_LOCALES, SUPPORTED_ZONES, THEMES } from '@postly/domain';
+import { action, t } from '@ultimat3/action';
+import { memberSelf } from '../../orgs/policy';
+
+export const savePreferences = action({
+  input: t.object({
+    locale: t.enumerated(...SUPPORTED_LOCALES),
+    /** IANA zone from the curated list; an arbitrary string would defeat the CHECK constraint. */
+    tz: t.enumerated(...SUPPORTED_ZONES),
+    /** Stored on the member, not in localStorage: the same person, the same theme, every device. */
+    theme: t.enumerated(...THEMES),
+    digestOptIn: t.boolean.default(true),
+  }),
+  // The whole `members` row, because that is what `updatePreferences` returns: an entity row
+  // schema is what makes the answer a RECORD the page store adopts (plan 101), where the
+  // hand-written `MemberView` was a partial projection no store could safely merge.
+  output: members.$schema,
+  policy: memberSelf,
+  cache: { invalidates: [tag.member] },
+  mcp: {
+    expose: true,
+    description: 'Update the acting member’s locale, timezone, theme and digest opt-in',
+  },
+  async handle({ input, ctx }) {
+    return ctx.orgs.savePreferences(input);
+  },
+});
diff --git a/examples/dummy/apps/web/app/settings/actions/set-theme.ts b/examples/dummy/apps/web/app/settings/actions/set-theme.ts
new file mode 100644
index 000000000..2c86348fb
--- /dev/null
+++ b/examples/dummy/apps/web/app/settings/actions/set-theme.ts
@@ -0,0 +1,48 @@
+// `setTheme`, the settings slice's mutator — one primitive per file, the layout `x g` writes.
+//
+// The two preference toggles that want to feel instant and survive offline — unlike the bulk
+// form `savePreferences` submits, which is a deliberate "Save" click. Both route through the same
+// `orgs.savePreferences` partial write that action uses, so there is exactly one place a
+// preference lands in the database however it got there.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: a mutator file imports one package.
+
+import { members, tag } from '@postly/db';
+import { THEMES } from '@postly/domain';
+import { mutator, t } from '@ultimat3/action';
+import { memberSelf } from '../../orgs/policy';
+
+/**
+ * The local twin's row shape, keyed by the member's own id — the same id the mutator's input
+ * carries, because `local()` gets no `ctx` to read the acting member off.
+ */
+declare module '@ultimat3/action' {
+  interface LocalTables {
+    member: { readonly id: string; readonly theme: string; readonly digestOptIn: boolean };
+  }
+}
+
+/**
+ * Both mutators answer the whole `members` row — what `orgs.savePreferences` returns — so the
+ * response is a record the page store adopts, the same as `savePreferences`'s.
+ */
+export const setTheme = mutator({
+  input: t.object({ memberId: t.uuid, theme: t.enumerated(...THEMES) }),
+  output: members.$schema,
+  policy: memberSelf,
+  idempotent: true,
+  cache: { invalidates: [tag.member] },
+  mcp: { expose: true, description: 'Set the acting member’s theme' },
+  local(tx, { memberId, theme }) {
+    tx.member.update(memberId, () => ({ theme }));
+  },
+  async server(ctx, { theme }) {
+    return ctx.orgs.savePreferences({ theme });
+  },
+  // `server-wins`, stated rather than implied. This was `last-write-wins`, which compares a
+  // server-written clock — and `MemberView` carries no `updatedAt`, so it could never prove the
+  // local write newer and ALWAYS answered the server row anyway. A policy that reads one way and
+  // behaves another is worse than the plain one; the theme is cosmetic and the next click re-sets
+  // it. Add `updatedAt` to `MemberView` first if "the device that set it last wins" is ever wanted.
+  conflict: 'server-wins',
+});
diff --git a/examples/dummy/apps/web/app/settings/actions/subscribe-push.ts b/examples/dummy/apps/web/app/settings/actions/subscribe-push.ts
new file mode 100644
index 000000000..5309ddf43
--- /dev/null
+++ b/examples/dummy/apps/web/app/settings/actions/subscribe-push.ts
@@ -0,0 +1,29 @@
+// `subscribePush`, the settings slice's `pushSubscribe()` action — one primitive per file, the layout `x g` writes.
+//
+// Preference writes. Settings are a thin edit of the member row, but "thin" is not a location:
+// an `action` is only ever declared in a feature's `actions/`, so the settings slice gets one
+// rather than a loose `settings-actions.ts` beside the page.
+//
+// Theme and digest opt-in ALSO have their own mutators beside this file — `setTheme` and
+// `toggleDigestOptIn` — because both want to apply instantly and survive offline, unlike locale
+// and timezone, which stay behind a deliberate "Save" click (changing either mid-session
+// reformats every date and string on the page, which is not worth applying before the member
+// confirms it). Narrowing this action's input to drop them would be a breaking contract change
+// for no reason: both paths write the same partial `orgs.savePreferences`, so a caller who still
+// saves all four in one request keeps working exactly as before.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+
+import { memberOf } from '@postly/core';
+import { pushSubscribe } from '@ultimat3/pwa';
+
+/**
+ * Web Push for this browser. Factories over `action` — each one is a real action with its route,
+ * typed client and contract tests — storing the subscription against the member the request ran as
+ * (never an id the body names). `member:self` because subscribing is a preference of your own; the
+ * framework refuses an agent whatever the permission says.
+ */
+export const subscribePush = pushSubscribe({
+  permission: 'member:self',
+  check: ({ actor }) => memberOf(actor) !== null,
+});
diff --git a/examples/dummy/apps/web/app/settings/actions/toggle-digest-opt-in.ts b/examples/dummy/apps/web/app/settings/actions/toggle-digest-opt-in.ts
new file mode 100644
index 000000000..63faf2afb
--- /dev/null
+++ b/examples/dummy/apps/web/app/settings/actions/toggle-digest-opt-in.ts
@@ -0,0 +1,40 @@
+// `toggleDigestOptIn`, the settings slice's mutator — one primitive per file, the layout `x g` writes.
+//
+// The two preference toggles that want to feel instant and survive offline — unlike the bulk
+// form `savePreferences` submits, which is a deliberate "Save" click. Both route through the same
+// `orgs.savePreferences` partial write that action uses, so there is exactly one place a
+// preference lands in the database however it got there.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: a mutator file imports one package.
+
+import { members, tag } from '@postly/db';
+import { custom, mutator, t } from '@ultimat3/action';
+import type { MemberView } from '../../orgs/entity';
+import { memberSelf } from '../../orgs/policy';
+
+export const toggleDigestOptIn = mutator({
+  input: t.object({ memberId: t.uuid, digestOptIn: t.boolean }),
+  output: members.$schema,
+  policy: memberSelf,
+  idempotent: true,
+  cache: { invalidates: [tag.member] },
+  mcp: { expose: true, description: 'Toggle the acting member’s digest subscription' },
+  local(tx, { memberId, digestOptIn }) {
+    tx.member.update(memberId, () => ({ digestOptIn }));
+  },
+  async server(ctx, { digestOptIn }) {
+    return ctx.orgs.savePreferences({ digestOptIn });
+  },
+  // Compliance, not preference — the one place `last-write-wins` is the wrong default. An
+  // unsubscribe the server already recorded must stay unsubscribed even if a stale offline
+  // toggle races it back on; a resubscribe has no such rule, so only the `false` side is sticky.
+  //
+  // The server row is the base and one field is resolved on top of it. Returning `local` whole
+  // handed back every OTHER field as this device last saw it — a theme, a locale or a role
+  // changed elsewhere while the toggle sat in the offline queue would be reverted by a mutator
+  // that is about a subscription. A conflict resolver owns the field it is for, not the row.
+  conflict: custom<MemberView>((local, server) => ({
+    ...server,
+    digestOptIn: server.digestOptIn ? local.digestOptIn : false,
+  })),
+});
diff --git a/examples/dummy/apps/web/app/settings/actions/unsubscribe-push.ts b/examples/dummy/apps/web/app/settings/actions/unsubscribe-push.ts
new file mode 100644
index 000000000..cbcdfe4eb
--- /dev/null
+++ b/examples/dummy/apps/web/app/settings/actions/unsubscribe-push.ts
@@ -0,0 +1,24 @@
+// `unsubscribePush`, the settings slice's `pushUnsubscribe()` action — one primitive per file, the layout `x g` writes.
+//
+// Preference writes. Settings are a thin edit of the member row, but "thin" is not a location:
+// an `action` is only ever declared in a feature's `actions/`, so the settings slice gets one
+// rather than a loose `settings-actions.ts` beside the page.
+//
+// Theme and digest opt-in ALSO have their own mutators beside this file — `setTheme` and
+// `toggleDigestOptIn` — because both want to apply instantly and survive offline, unlike locale
+// and timezone, which stay behind a deliberate "Save" click (changing either mid-session
+// reformats every date and string on the page, which is not worth applying before the member
+// confirms it). Narrowing this action's input to drop them would be a breaking contract change
+// for no reason: both paths write the same partial `orgs.savePreferences`, so a caller who still
+// saves all four in one request keeps working exactly as before.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+
+import { memberOf } from '@postly/core';
+import { pushUnsubscribe } from '@ultimat3/pwa';
+
+/** Forget this browser — the caller's own subscription only. */
+export const unsubscribePush = pushUnsubscribe({
+  permission: 'member:self',
+  check: ({ actor }) => memberOf(actor) !== null,
+});
diff --git a/examples/dummy/apps/web/app/settings/mutator.test.ts b/examples/dummy/apps/web/app/settings/mutator.test.ts
index 6eab6dc11..99e27576c 100644
--- a/examples/dummy/apps/web/app/settings/mutator.test.ts
+++ b/examples/dummy/apps/web/app/settings/mutator.test.ts
@@ -8,7 +8,8 @@ import { expect, test } from 'bun:test';
 import { resolveConflict } from '@ultimat3/core';
 import { parse } from '@ultimat3/schema';
 import { MemberView } from '../orgs/entity';
-import { setTheme, toggleDigestOptIn } from './mutator';
+import { setTheme } from './actions/set-theme';
+import { toggleDigestOptIn } from './actions/toggle-digest-opt-in';
 
 const member = (patch: Partial<MemberView> = {}): MemberView => ({
   id: '00000000-0000-4000-8000-0000000000a1',
diff --git a/examples/dummy/apps/web/app/settings/mutator.ts b/examples/dummy/apps/web/app/settings/mutator.ts
deleted file mode 100644
index c0d4f1c6e..000000000
--- a/examples/dummy/apps/web/app/settings/mutator.ts
+++ /dev/null
@@ -1,76 +0,0 @@
-/**
- * The two preference toggles that want to feel instant and survive offline — unlike the bulk
- * form in `actions.ts`, which is a deliberate "Save" click. Both route through the same
- * `orgs.savePreferences` partial write `actions.ts` uses, so there is exactly one place a
- * preference lands in the database however it got there.
- *
- * `t` comes from @ultimat3/action, not @ultimat3/schema: a mutator file imports one package.
- */
-
-import { members, tag } from '@postly/db';
-import { THEMES } from '@postly/domain';
-import { custom, mutator, t } from '@ultimat3/action';
-import type { MemberView } from '../orgs/entity';
-import { memberSelf } from '../orgs/policy';
-
-/**
- * The local twin's row shape, keyed by the member's own id — the same id the mutator's input
- * carries, because `local()` gets no `ctx` to read the acting member off.
- */
-declare module '@ultimat3/action' {
-  interface LocalTables {
-    member: { readonly id: string; readonly theme: string; readonly digestOptIn: boolean };
-  }
-}
-
-/**
- * Both mutators answer the whole `members` row — what `orgs.savePreferences` returns — so the
- * response is a record the page store adopts, the same as `savePreferences`'s.
- */
-export const setTheme = mutator({
-  input: t.object({ memberId: t.uuid, theme: t.enumerated(...THEMES) }),
-  output: members.$schema,
-  policy: memberSelf,
-  idempotent: true,
-  cache: { invalidates: [tag.member] },
-  mcp: { expose: true, description: 'Set the acting member’s theme' },
-  local(tx, { memberId, theme }) {
-    tx.member.update(memberId, () => ({ theme }));
-  },
-  async server(ctx, { theme }) {
-    return ctx.orgs.savePreferences({ theme });
-  },
-  // `server-wins`, stated rather than implied. This was `last-write-wins`, which compares a
-  // server-written clock — and `MemberView` carries no `updatedAt`, so it could never prove the
-  // local write newer and ALWAYS answered the server row anyway. A policy that reads one way and
-  // behaves another is worse than the plain one; the theme is cosmetic and the next click re-sets
-  // it. Add `updatedAt` to `MemberView` first if "the device that set it last wins" is ever wanted.
-  conflict: 'server-wins',
-});
-
-export const toggleDigestOptIn = mutator({
-  input: t.object({ memberId: t.uuid, digestOptIn: t.boolean }),
-  output: members.$schema,
-  policy: memberSelf,
-  idempotent: true,
-  cache: { invalidates: [tag.member] },
-  mcp: { expose: true, description: 'Toggle the acting member’s digest subscription' },
-  local(tx, { memberId, digestOptIn }) {
-    tx.member.update(memberId, () => ({ digestOptIn }));
-  },
-  async server(ctx, { digestOptIn }) {
-    return ctx.orgs.savePreferences({ digestOptIn });
-  },
-  // Compliance, not preference — the one place `last-write-wins` is the wrong default. An
-  // unsubscribe the server already recorded must stay unsubscribed even if a stale offline
-  // toggle races it back on; a resubscribe has no such rule, so only the `false` side is sticky.
-  //
-  // The server row is the base and one field is resolved on top of it. Returning `local` whole
-  // handed back every OTHER field as this device last saw it — a theme, a locale or a role
-  // changed elsewhere while the toggle sat in the offline queue would be reverted by a mutator
-  // that is about a subscription. A conflict resolver owns the field it is for, not the row.
-  conflict: custom<MemberView>((local, server) => ({
-    ...server,
-    digestOptIn: server.digestOptIn ? local.digestOptIn : false,
-  })),
-});
diff --git a/examples/dummy/apps/web/app/webhooks/actions.ts b/examples/dummy/apps/web/app/webhooks/actions.ts
deleted file mode 100644
index f64218577..000000000
--- a/examples/dummy/apps/web/app/webhooks/actions.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-/**
- * The webhooks feature's two commands — register a receiver, revoke one. Declarations only — the body delegates to `ctx.webhooks`.
- *
- * `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
- */
-
-import { action, t } from '@ultimat3/action';
-import { orgAdminister } from '../orgs/policy';
-import { AddEndpointInput, EndpointIssued, RemoveEndpointInput } from './entity';
-
-/**
- * Register a receiver for the org's `post.published` deliveries. The org's administrator's right —
- * an endpoint is where the org's publications are sent. No `mcp`: the answer carries the secret,
- * shown once, and a tool result is kept in a transcript.
- */
-export const addWebhookEndpoint = action({
-  input: AddEndpointInput,
-  output: EndpointIssued,
-  policy: orgAdminister,
-  async handle({ input, ctx }) {
-    return ctx.webhooks.addEndpoint(input);
-  },
-});
-
-/**
- * Revoke a receiver — the only remedy for a leaked secret, so the same right that registers one:
- * the org's administrator. No `mcp`, as `addWebhookEndpoint` has none: an agent that can drop the
- * org's integrations is an agent a prompt can talk into dropping them.
- */
-export const removeWebhookEndpoint = action({
-  input: RemoveEndpointInput,
-  output: t.object({ endpointId: t.uuid }),
-  policy: orgAdminister,
-  async handle({ input, ctx }) {
-    return ctx.webhooks.removeEndpoint(input);
-  },
-});
diff --git a/examples/dummy/apps/web/app/webhooks/actions/add-webhook-endpoint.ts b/examples/dummy/apps/web/app/webhooks/actions/add-webhook-endpoint.ts
new file mode 100644
index 000000000..993324afb
--- /dev/null
+++ b/examples/dummy/apps/web/app/webhooks/actions/add-webhook-endpoint.ts
@@ -0,0 +1,23 @@
+// `addWebhookEndpoint`, the webhooks slice's action — one primitive per file, the layout `x g` writes.
+//
+// The webhooks feature's two commands — register a receiver, revoke one. Declarations only — the body delegates to `ctx.webhooks`.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+
+import { action } from '@ultimat3/action';
+import { orgAdminister } from '../../orgs/policy';
+import { AddEndpointInput, EndpointIssued } from '../entity';
+
+/**
+ * Register a receiver for the org's `post.published` deliveries. The org's administrator's right —
+ * an endpoint is where the org's publications are sent. No `mcp`: the answer carries the secret,
+ * shown once, and a tool result is kept in a transcript.
+ */
+export const addWebhookEndpoint = action({
+  input: AddEndpointInput,
+  output: EndpointIssued,
+  policy: orgAdminister,
+  async handle({ input, ctx }) {
+    return ctx.webhooks.addEndpoint(input);
+  },
+});
diff --git a/examples/dummy/apps/web/app/webhooks/actions/remove-webhook-endpoint.ts b/examples/dummy/apps/web/app/webhooks/actions/remove-webhook-endpoint.ts
new file mode 100644
index 000000000..2d9e47f06
--- /dev/null
+++ b/examples/dummy/apps/web/app/webhooks/actions/remove-webhook-endpoint.ts
@@ -0,0 +1,23 @@
+// `removeWebhookEndpoint`, the webhooks slice's action — one primitive per file, the layout `x g` writes.
+//
+// The webhooks feature's two commands — register a receiver, revoke one. Declarations only — the body delegates to `ctx.webhooks`.
+//
+// `t` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
+
+import { action, t } from '@ultimat3/action';
+import { orgAdminister } from '../../orgs/policy';
+import { RemoveEndpointInput } from '../entity';
+
+/**
+ * Revoke a receiver — the only remedy for a leaked secret, so the same right that registers one:
+ * the org's administrator. No `mcp`, as `addWebhookEndpoint` has none: an agent that can drop the
+ * org's integrations is an agent a prompt can talk into dropping them.
+ */
+export const removeWebhookEndpoint = action({
+  input: RemoveEndpointInput,
+  output: t.object({ endpointId: t.uuid }),
+  policy: orgAdminister,
+  async handle({ input, ctx }) {
+    return ctx.webhooks.removeEndpoint(input);
+  },
+});
diff --git a/examples/dummy/apps/web/app/webhooks/endpoints.test.ts b/examples/dummy/apps/web/app/webhooks/endpoints.test.ts
index cbc3a0df5..65f484180 100644
--- a/examples/dummy/apps/web/app/webhooks/endpoints.test.ts
+++ b/examples/dummy/apps/web/app/webhooks/endpoints.test.ts
@@ -7,7 +7,8 @@
 
 import { db } from '@postly/db';
 import { expect, test } from '@ultimat3/testing';
-import { addWebhookEndpoint, removeWebhookEndpoint } from './actions';
+import { addWebhookEndpoint } from './actions/add-webhook-endpoint';
+import { removeWebhookEndpoint } from './actions/remove-webhook-endpoint';
 import { ENDPOINTS_PER_ORG } from './entity';
 
 const receiver = (n: number): string => `https://hooks.example.com/postly/${n}`;
diff --git a/examples/dummy/apps/web/app/webhooks/jobs.job.test.ts b/examples/dummy/apps/web/app/webhooks/jobs.job.test.ts
index aa1870ba5..05537bdff 100644
--- a/examples/dummy/apps/web/app/webhooks/jobs.job.test.ts
+++ b/examples/dummy/apps/web/app/webhooks/jobs.job.test.ts
@@ -11,9 +11,9 @@
 
 import { db } from '@postly/db';
 import { expect, jobTest } from '@ultimat3/testing';
-import { publishPost } from '../posts/actions';
-import { addWebhookEndpoint } from './actions';
-import { POST_PUBLISHED, postPublishedWebhook } from './jobs';
+import { publishPost } from '../posts/actions/publish-post';
+import { addWebhookEndpoint } from './actions/add-webhook-endpoint';
+import { POST_PUBLISHED, postPublishedWebhook } from './jobs/post-published-webhook';
 
 const RECEIVER = 'https://hooks.postly.invalid/inbox';
 
diff --git a/examples/dummy/apps/web/app/webhooks/jobs.ts b/examples/dummy/apps/web/app/webhooks/jobs/post-published-webhook.ts
similarity index 95%
rename from examples/dummy/apps/web/app/webhooks/jobs.ts
rename to examples/dummy/apps/web/app/webhooks/jobs/post-published-webhook.ts
index a31ff8bba..9083cc6b5 100644
--- a/examples/dummy/apps/web/app/webhooks/jobs.ts
+++ b/examples/dummy/apps/web/app/webhooks/jobs/post-published-webhook.ts
@@ -9,9 +9,9 @@
 
 import { orgId as toOrgId, postId as toPostId } from '@postly/domain';
 import { webhook } from '@ultimat3/jobs';
-import type { PublishedPayload } from './entity';
-import { postlyWebhookLedger } from './ledger';
-import { endpointIn } from './repo';
+import type { PublishedPayload } from '../entity';
+import { postlyWebhookLedger } from '../ledger';
+import { endpointIn } from '../repo';
 
 /** The topic every receiver routes on. Postly's taxonomy, signed into each delivery. */
 export const POST_PUBLISHED = 'post.published';
diff --git a/examples/dummy/apps/web/app/webhooks/service.ts b/examples/dummy/apps/web/app/webhooks/service.ts
index 9a35bcad1..c0e549dbf 100644
--- a/examples/dummy/apps/web/app/webhooks/service.ts
+++ b/examples/dummy/apps/web/app/webhooks/service.ts
@@ -17,7 +17,7 @@ import {
   type RemoveEndpointInput,
 } from './entity';
 import { EndpointLimitReached, EndpointNotFound } from './errors';
-import { postPublishedWebhook } from './jobs';
+import { postPublishedWebhook } from './jobs/post-published-webhook';
 import { deleteEndpoint, insertEndpoint, liveEndpoints, usedSlots } from './repo';
 import { screenEndpointUrl } from './url-screen';
 
diff --git a/examples/dummy/apps/web/shared/services.ts b/examples/dummy/apps/web/shared/services.ts
index 1af32e55e..670475fe1 100644
--- a/examples/dummy/apps/web/shared/services.ts
+++ b/examples/dummy/apps/web/shared/services.ts
@@ -68,7 +68,7 @@ export interface OrgsService {
   invite(input: InviteInput): Promise<MemberView>;
   upgrade(plan: PlanCode): Promise<UpgradeReceipt>;
   /**
-   * Every field optional: `actions.ts`'s bulk save writes all four, but `mutator.ts`'s `setTheme`
+   * Every field optional: `savePreferences`'s bulk save writes all four, but the mutators `setTheme`
    * and `toggleDigestOptIn` each write one — a partial write is what keeps the field a single
    * mutator owns from also needing a second, competing write path through this method.
    */
@@ -136,7 +136,7 @@ export interface WebhooksService {
  * `CtxServices` carries a string index signature, so `ctx.session` compiled and was `undefined` at
  * runtime, and a declaration nothing installs is a lie the type system helps tell. The member row
  * moved onto the actor's own facts (`shared/actor.ts`); the channel publish is gone from
- * `app/posts/jobs.ts` with the reason it cannot exist yet.
+ * `app/posts/jobs/` with the reason it cannot exist yet.
  */
 declare module '@ultimat3/core' {
   interface CtxServices {
diff --git a/examples/dummy/apps/web/site/pricing/page.tsx b/examples/dummy/apps/web/site/pricing/page.tsx
index 9c484edc2..012caca46 100644
--- a/examples/dummy/apps/web/site/pricing/page.tsx
+++ b/examples/dummy/apps/web/site/pricing/page.tsx
@@ -31,7 +31,7 @@ import styles from './page.module.scss';
 /**
  * The action the form posts to, named once and checked by the compiler. `satisfies` is what makes
  * the string safe: a renamed action is a build error here, while `import type` keeps the value
- * edge absent — a `site/` page that imported `app/contact/actions.ts` would drag the whole feature
+ * edge absent — a `site/` page that imported `app/contact/actions/` would drag the whole feature
  * across the boundary and fail `x verify` with `X_BOUNDARY_VIOLATION`.
  */
 const CONTACT_ACTION = 'contactSales' satisfies keyof Api['actions'];
diff --git a/framework.manifest.json b/framework.manifest.json
index 6f111a0e9..38e95ed7d 100644
--- a/framework.manifest.json
+++ b/framework.manifest.json
@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "buildId": "87145628d1ce2094dafed748bc68b2a5af11a1a6f9e6c7fcdbba4fdd2bf82986",
+  "buildId": "90afa0cb58b1b39d19e4d4e50fccc9875942b459a2b0f1ce1fe45006bce4ad03",
   "tiers": {
     "0": [
       "core",
@@ -2109,6 +2109,11 @@
       "owner": "scripts",
       "at": "scripts/known-gaps-links.ts"
     },
+    {
+      "code": "X_LAYOUT_SIBLING_MODULE",
+      "owner": "cli",
+      "at": "packages/cli/src/error-codes.ts"
+    },
     {
       "code": "X_LD_INVALID",
       "owner": "seo",
diff --git a/packages/ai/README.md b/packages/ai/README.md
index ddb5d040f..60ba50fe8 100644
--- a/packages/ai/README.md
+++ b/packages/ai/README.md
@@ -523,7 +523,7 @@ whose result must be KEPT is queued through an action that runs it and makes the
 else wrote — a draft, a ticket, a page — and "now record this for record X" is an instruction a
 model may follow, so a write tool is a write that text can aim. The action binds the target from
 its OWN input, and the agent stays read-only. The reference app's `keepDraftReview` →
-`reviewDraftLater` (`examples/dummy/apps/web/app/posts/actions.ts`, tested on the production
+`reviewDraftLater` (`examples/dummy/apps/web/app/posts/jobs/review-draft-later.ts`, tested on the production
 worker in `review.job.test.ts`) is the worked call:
 
 ```ts
diff --git a/packages/cli/src/app-layout.test.ts b/packages/cli/src/app-layout.test.ts
new file mode 100644
index 000000000..54d366148
--- /dev/null
+++ b/packages/cli/src/app-layout.test.ts
@@ -0,0 +1,39 @@
+// The sibling refusal: `X.ts` beside `X/` is a finding naming the file; the directory form alone,
+// a test beside a directory and a file whose directory holds nothing are not.
+
+import { describe, expect, test } from 'bun:test';
+import { siblingModuleFindings } from './app-layout';
+
+const files = (...paths: string[]) => paths.map((path) => ({ path, source: '' }));
+
+describe('siblingModuleFindings', () => {
+  test('a module beside a directory of its own name is refused, by file', () => {
+    const found = siblingModuleFindings(
+      files(
+        'apps/web/app/posts/actions.ts',
+        'apps/web/app/posts/actions/create-post.ts',
+        'apps/web/app/posts/ui.tsx',
+        'apps/web/app/posts/ui/card.tsx',
+      ),
+    );
+    expect(found.map((finding) => [finding.code, finding.at])).toEqual([
+      ['X_LAYOUT_SIBLING_MODULE', 'apps/web/app/posts/actions.ts'],
+      ['X_LAYOUT_SIBLING_MODULE', 'apps/web/app/posts/ui.tsx'],
+    ]);
+    expect(found[0]?.cause).toContain('apps/web/app/posts/actions/');
+  });
+
+  test('the directory form alone, and a same-named file elsewhere, are fine', () => {
+    expect(
+      siblingModuleFindings(
+        files(
+          'apps/web/app/posts/actions/create-post.ts',
+          'apps/web/app/posts/actions/delete-post.ts',
+          'apps/web/app/posts/page.tsx',
+          'apps/web/app/feed/actions.ts',
+          'apps/web/app/posts/[id]/page.tsx',
+        ),
+      ),
+    ).toEqual([]);
+  });
+});
diff --git a/packages/cli/src/app-layout.ts b/packages/cli/src/app-layout.ts
new file mode 100644
index 000000000..7d80442d9
--- /dev/null
+++ b/packages/cli/src/app-layout.ts
@@ -0,0 +1,35 @@
+// The one feature layout, made a build error: a module `X.ts` beside a directory `X/` in the same
+// folder is refused. `x g` writes the directory form — `<slice>/actions/<name>.ts`, one primitive
+// per file — and an app that also keeps `actions.ts` has two homes for one kind of thing, where
+// `./actions` resolves to the file and never the directory: the reader opens the wrong one.
+
+import { ERROR_DOCS_URL } from '@ultimat3/core';
+import type { SourceFile } from './app-boundaries';
+import type { Finding } from './output';
+
+const MODULE = /^(?<stem>.+)\.(?:ts|tsx)$/;
+
+/** Every `X.ts`/`X.tsx` among `files` that has a directory `X/` holding another of them. */
+export function siblingModuleFindings(files: readonly SourceFile[]): readonly Finding[] {
+  const directories = new Set<string>();
+  for (const { path } of files) {
+    const parts = path.split('/');
+    for (let depth = 1; depth < parts.length; depth += 1) {
+      directories.add(parts.slice(0, depth).join('/'));
+    }
+  }
+  return files.flatMap(({ path }): Finding[] => {
+    const stem = MODULE.exec(path)?.groups?.['stem'];
+    if (stem === undefined || !directories.has(stem)) return [];
+    const name = stem.split('/').at(-1) ?? stem;
+    return [
+      {
+        code: 'X_LAYOUT_SIBLING_MODULE',
+        cause: `${path} sits beside the directory ${stem}/ — \`./${name}\` resolves to the file, and the directory form is the one layout`,
+        fix: `x verify --only boundaries --json   # move each declaration in ${path} to ${stem}/<its-export-in-kebab-case>.ts, then delete ${path}`,
+        docs: ERROR_DOCS_URL,
+        at: path,
+      },
+    ];
+  });
+}
diff --git a/packages/cli/src/boundary-findings.test.ts b/packages/cli/src/boundary-findings.test.ts
index 9cda0f47c..c57afd7f0 100644
--- a/packages/cli/src/boundary-findings.test.ts
+++ b/packages/cli/src/boundary-findings.test.ts
@@ -4,7 +4,7 @@
 import { describe, expect, test } from 'bun:test';
 import type { SourceFile } from './app-boundaries';
 import { appImportGraph, checkImportRules } from './app-boundaries';
-import { withCutEdits } from './boundary-findings';
+import { appBoundaryFindings, withCutEdits } from './boundary-findings';
 
 const file = (path: string, source: string): SourceFile => ({ path, source });
 
@@ -28,3 +28,16 @@ describe('unit · a boundary finding names the concrete edit', () => {
     expect(withCutEdits(findings, appImportGraph(files))).toEqual(findings);
   });
 });
+
+describe('unit · the boundaries step refuses a second layout', () => {
+  test('a module beside a directory of its own name is a finding of the step', async () => {
+    const files = [
+      file('apps/web/app/posts/actions.ts', 'export const legacy = 1;'),
+      file('apps/web/app/posts/actions/create-post.ts', 'export const createPost = 1;'),
+    ];
+    const found = await appBoundaryFindings('/nowhere', files);
+    expect(found.map((finding) => [finding.code, finding.at])).toEqual([
+      ['X_LAYOUT_SIBLING_MODULE', 'apps/web/app/posts/actions.ts'],
+    ]);
+  });
+});
diff --git a/packages/cli/src/boundary-findings.ts b/packages/cli/src/boundary-findings.ts
index 137ab6838..fd53c8a80 100644
--- a/packages/cli/src/boundary-findings.ts
+++ b/packages/cli/src/boundary-findings.ts
@@ -5,6 +5,7 @@
 
 import type { SourceFile } from './app-boundaries';
 import { appImportGraph, checkImportRules, readAppSources } from './app-boundaries';
+import { siblingModuleFindings } from './app-layout';
 import { appTransportFindings } from './app-transport';
 import { planBoundaryCuts } from './boundary-cuts';
 import type { Finding } from './output';
@@ -44,5 +45,6 @@ export async function appBoundaryFindings(
   return [
     ...withCutEdits(checkImportRules(files), appImportGraph(files)),
     ...(await appTransportFindings(root, files)),
+    ...siblingModuleFindings(files),
   ];
 }
diff --git a/packages/cli/src/error-codes.ts b/packages/cli/src/error-codes.ts
index 381a7fcac..e573c79db 100644
--- a/packages/cli/src/error-codes.ts
+++ b/packages/cli/src/error-codes.ts
@@ -232,6 +232,7 @@ export const CLI_OWNED_ERROR_CODES = [
   'X_PACKAGE_TEST_ONLY_SHIPPED',
   'X_ISLAND_MODULE_DUPLICATED',
   'X_BACKFILL_SLICE_ENTITY',
+  'X_LAYOUT_SIBLING_MODULE',
 ] as const;
 
 /**
@@ -420,6 +421,7 @@ export const CLI_ERROR_TITLES: Readonly<Record<CliOwnedErrorCode, string>> = {
   X_PACKAGE_TEST_ONLY_SHIPPED: 'a test-only module ships in the tarball',
   X_ISLAND_MODULE_DUPLICATED: 'An island chunk bundles one module more than once',
   X_BACKFILL_SLICE_ENTITY: 'the slice holds no entity a generated backfill can sweep',
+  X_LAYOUT_SIBLING_MODULE: 'a module beside a directory of the same name',
 };
 
 // One unconditional call, so a second package claiming one of the CLI's codes throws
diff --git a/packages/cli/src/mcp-errors.ts b/packages/cli/src/mcp-errors.ts
index cee80c01e..4cea8ea3f 100644
--- a/packages/cli/src/mcp-errors.ts
+++ b/packages/cli/src/mcp-errors.ts
@@ -302,6 +302,8 @@ const CLI_FIXES: Readonly<Record<CliErrorCode, string>> = {
     'gh issue create --repo developerz-ai/ultimate --title "X_ISLAND_MODULE_DUPLICATED"   # paste this error\'s --json as the body: the framework bundled one of its own modules twice',
   X_BACKFILL_SLICE_ENTITY:
     'x errors explain X_BACKFILL_SLICE_ENTITY --json   # the refusal itself names the x g job line for this slice',
+  X_LAYOUT_SIBLING_MODULE:
+    'x verify --only boundaries --json   # then move each declaration in X.ts to X/<name>.ts, one primitive per file',
 };
 
 const isCliCode = (code: string): code is CliErrorCode =>
diff --git a/scripts/primitive-factories-used.test.ts b/scripts/primitive-factories-used.test.ts
index b4cb12448..889dd3d0a 100644
--- a/scripts/primitive-factories-used.test.ts
+++ b/scripts/primitive-factories-used.test.ts
@@ -72,7 +72,7 @@ describe('unit · the reference app uses every primitive factory', () => {
     // first test's logic only when the pending list happened to cover it — and fail it otherwise
     // with the wrong instruction.
     expect(usedBy({ factory: 'llm', pkg: '@ultimat3/ai' })).toContain(
-      `${REFERENCE_APP}/apps/web/app/posts/actions.ts`,
+      `${REFERENCE_APP}/apps/web/app/posts/actions/summarize.ts`,
     );
     expect(app.some((file) => file.path.includes('.test.'))).toBe(false);
   });
diff --git a/scripts/set-cookie-literals.test.ts b/scripts/set-cookie-literals.test.ts
index 150b001fd..925468af2 100644
--- a/scripts/set-cookie-literals.test.ts
+++ b/scripts/set-cookie-literals.test.ts
@@ -40,7 +40,9 @@ describe('a Set-Cookie spelled by hand', () => {
 
   test('a demo cookie appended straight onto the header bag is reported', () => {
     const source = "ctx.headers.append('set-cookie', `${NAME}=${OUT}; Path=/; SameSite=Lax`);";
-    expect(quoted(source, 'examples/dummy/apps/web/app/auth/actions.ts')).toHaveLength(1);
+    expect(quoted(source, 'examples/dummy/apps/web/app/auth/actions/end-session.ts')).toHaveLength(
+      1,
+    );
   });
 
   test('a standalone name=value attribute is read in any case — joined parts are a cookie too', () => {
diff --git a/scripts/wiki-fences-backlog.ts b/scripts/wiki-fences-backlog.ts
index fab75744f..5980a3e6f 100644
--- a/scripts/wiki-fences-backlog.ts
+++ b/scripts/wiki-fences-backlog.ts
@@ -41,7 +41,9 @@ export const WIKI_FENCE_BACKLOG: Readonly<Record<string, number>> = {
   'Caching-And-Invalidation: // action': 1,
   'Caching-And-Invalidation: export const summarize = llm({': 1,
   'Caching-And-Invalidation: export const tag = tags({': 1,
-  'Client-Data: // app/posts/actions.ts': 1,
+  // why: the `// app/posts/actions.ts` row, renamed with the layout it shows (#710) — the same
+  // fence, failing for the same feature-relative imports a snippet cannot resolve.
+  'Client-Data: // app/posts/actions/rename-post.ts': 1,
   'Client-Data: // app/posts/queries.ts': 1,
   'Client-Data: // app/posts/rename.island.tsx': 1,
   'Client-Data: // shared/browser-client.ts — type-only import of the api, so no server code reaches the island': 1,
diff --git a/wiki/Actions.md b/wiki/Actions.md
index fcbdd9e40..e1ff4c3fd 100644
--- a/wiki/Actions.md
+++ b/wiki/Actions.md
@@ -17,7 +17,7 @@ export const publishPost = action({
 });
 ```
 
-Declared in `api/` or a feature's `actions.ts`. Named export, never default. The export name is the identity, and it must be globally unique. Only the HTTP path is *derived* from it (`publishPost` → `POST /api/posts/publish`); the OpenAPI `operationId` and the **MCP tool name are the export name verbatim** — `publishPost`, never `publish_post`. `As of 2026-08` that holds on every surface at once: what `tools/call` accepts, what `defineAppMcp`'s `scopes:` map is keyed on, what the LLM tool list offers, what `openapi.json`'s `x-ultimate.mcpTool` publishes, and what `describe().mcp.tool` reports.
+Declared one per file in a feature's `actions/` (`actions/publish-post.ts`, what `x g` writes). Named export, never default. The export name is the identity, and it must be globally unique. Only the HTTP path is *derived* from it (`publishPost` → `POST /api/posts/publish`); the OpenAPI `operationId` and the **MCP tool name are the export name verbatim** — `publishPost`, never `publish_post`. `As of 2026-08` that holds on every surface at once: what `tools/call` accepts, what `defineAppMcp`'s `scopes:` map is keyed on, what the LLM tool list offers, what `openapi.json`'s `x-ultimate.mcpTool` publishes, and what `describe().mcp.tool` reports.
 
 ## Fields
 
@@ -115,9 +115,9 @@ Rejected by that rule: an MCP-specific permission table, a "trusted tool" mode,
 - render, redirect, or return HTML
 - perform its own authorization inside `handle` — that belongs in `policy`
 - do slow work inline — enqueue a `job`
-- be defined outside `api/` or a feature's `actions.ts`
+- share a file with another primitive — one per file, in the feature's `actions/`
 
-Logic lives in `service.ts`; `actions.ts` holds declarations. An action whose `handle` is more than a few lines of orchestration is a service waiting to be extracted.
+Logic lives in `service.ts`; `actions/` holds declarations. An action whose `handle` is more than a few lines of orchestration is a service waiting to be extracted.
 
 ## `mutator` — action + optimistic twin
 
@@ -164,7 +164,8 @@ export const likePost = mutator({
 | `X_MUTATOR_NOT_IDEMPOTENT` | a `mutator` declared without `idempotent: true` | add `idempotent: true` to the definition |
 | `X_CONTRACT_DRIFT` | client build id ≠ server build id, or a breaking published-contract change | reload the client / bump the action version |
 | `X_TENANCY_UNSCOPED` | a query inside `handle` had no tenant predicate | scope it through the repo, never raw SQL |
-| `X_BOUNDARY_VIOLATION` | action declared outside `api/` or `<feature>/actions.ts` | move the file, or `x fix boundary <file>` |
+| `X_BOUNDARY_VIOLATION` | action declared outside `api/` or `<feature>/actions/` | move the file, or `x fix boundary <file>` |
+| `X_LAYOUT_SIBLING_MODULE` | a module `actions.ts` beside the directory `actions/` | move each declaration to `actions/<name>.ts`, then delete the file |
 
 ```
 X_ACTION_POLICY_MISSING: action registered without a policy
diff --git a/wiki/Agents.md b/wiki/Agents.md
index e54f6f9da..fabcacda2 100644
--- a/wiki/Agents.md
+++ b/wiki/Agents.md
@@ -371,7 +371,7 @@ It composes `job()` rather than imitating a handle, so `.enqueue()`, the outbox,
 
 > **Rule: never hand the model a write tool whose target it chooses.** The model reads text someone else wrote — a draft, a ticket, a scraped page — and "now record this for record X" is an instruction a model may follow. A write tool is a write that text can aim. The wrapping action binds the target from its OWN input.
 
-Worked example: the reference app's `keepDraftReview` → `reviewDraftLater` (`examples/dummy/apps/web/app/posts/actions.ts`). `reviewDraft` is an agent with one read tool; `keepDraftReview` runs it and upserts the verdict on the post id it was given — `(orgId, postId)` is the key, so a replayed run is the same row — under `postReviewKeep`, the publishing right, never `post:read`; `reviewDraftLater = agentJob(keepDraftReview, { actor })`; the `postReview` query reads it back. `review.job.test.ts` drives it on the production worker, with a model that tries to write onto another post and has nothing to write with.
+Worked example: the reference app's `keepDraftReview` → `reviewDraftLater` (`examples/dummy/apps/web/app/posts/actions/keep-draft-review.ts`, `jobs/review-draft-later.ts`). `reviewDraft` is an agent with one read tool; `keepDraftReview` runs it and upserts the verdict on the post id it was given — `(orgId, postId)` is the key, so a replayed run is the same row — under `postReviewKeep`, the publishing right, never `post:read`; `reviewDraftLater = agentJob(keepDraftReview, { actor })`; the `postReview` query reads it back. `review.job.test.ts` drives it on the production worker, with a model that tries to write onto another post and has nothing to write with.
 
 ### The at-least-once trap
 
diff --git a/wiki/Client-Data.md b/wiki/Client-Data.md
index add59eac9..54177de66 100644
--- a/wiki/Client-Data.md
+++ b/wiki/Client-Data.md
@@ -68,11 +68,11 @@ Nothing else is declared.
 ## 2. An action that returns the row
 
 ```ts
-// app/posts/actions.ts
+// app/posts/actions/rename-post.ts
 import { action, t } from '@ultimat3/action';
-import { Post } from './entity';
-import { postWrite } from './policies';
-import { repo } from './repo';
+import { Post } from '../entity';
+import { postWrite } from '../policies';
+import { repo } from '../repo';
 
 export const renamePost = action({
   input: t.object({ postId: t.uuid, title: t.string }),
diff --git a/wiki/Error-Codes.md b/wiki/Error-Codes.md
index 3661509e4..c1a6fcc6f 100644
--- a/wiki/Error-Codes.md
+++ b/wiki/Error-Codes.md
@@ -1148,6 +1148,7 @@ Two sets override the table, in `failures.ts`:
 | `X_PACKAGE_TEST_ONLY_SHIPPED` | a test-only module ships in the tarball | a src/ module imported only by tests is not named *-fixture.ts, so the package files list publishes it — test scaffolding (fakes, probes, bun:test imports) in every install | `bun run x -- verify --only package-shape --json   # then rename each listed module to <name>-fixture.ts and update its importers` |
 | `X_ISLAND_MODULE_DUPLICATED` | An island chunk bundles one module more than once | the island build shipped one framework module twice — one file under two path spellings, or a second @ultimat3/* copy — so its bytes and its module state are duplicated in the chunk | `gh issue create --repo developerz-ai/ultimate --title "X_ISLAND_MODULE_DUPLICATED"` — paste this error's --json as the body: the framework bundled one of its own modules twice |
 | `X_BACKFILL_SLICE_ENTITY` | the slice holds no entity a generated backfill can sweep | x g backfill --feature <slice> writes a sweep over the slice's own scaffolded table (db.<plural>, its title column); the slice exists and its entity.ts declares other tables, so the generated files would not compile | `x g job <name> --feature <slice>` — then wrap its body in backfill({ source: db.<your table>, … }) from @ultimat3/jobs |
+| `X_LAYOUT_SIBLING_MODULE` | a module beside a directory of the same name | X.ts and X/ in one folder — `./X` resolves to the file, and the directory form is the one layout | `x verify --only boundaries --json` — then move each declaration in X.ts to X/<name>.ts, one primitive per file |
 
 ## Reserved codes
 
diff --git a/wiki/Policies-And-Authz.md b/wiki/Policies-And-Authz.md
index 2313807dc..f93a1d890 100644
--- a/wiki/Policies-And-Authz.md
+++ b/wiki/Policies-And-Authz.md
@@ -22,7 +22,7 @@ policy: can('post:publish', ({ input, actor }) => ownsPost(actor, input.postId))
 | `row` | `R \| null` | the already-loaded row a row-level rule decides about; `null` when the rule decides on input alone. Never pass a row through `input` |
 | `ctx` | `Ctx` | repos for lookups, `ctx.tz`, `ctx.logger`. Read-only use |
 
-Policies live in `<feature>/policy.ts` and are referenced by name from `actions.ts` and `live.ts`. `agent` is a first-class actor kind: an MCP caller goes through this same function, with no separate path.
+Policies live in `<feature>/policy.ts` and are referenced by name from the feature's `actions/` and `live/` modules. `agent` is a first-class actor kind: an MCP caller goes through this same function, with no separate path.
 
 ## Where a policy is evaluated
 
diff --git a/wiki/Project-Layout.md b/wiki/Project-Layout.md
index 12e15f3fc..71fcb4fd7 100644
--- a/wiki/Project-Layout.md
+++ b/wiki/Project-Layout.md
@@ -94,7 +94,7 @@ apps/web/app/<feature>/{actions,live,queries,jobs,tasks}/<name>.ts   # one per f
 apps/web/app/<feature>/ui/                                           # components
 ```
 
-**A primitive is registered by `defineApi()` and found by the module scan, never by its filename**, so a feature may keep one declaration per file (`actions/<verb>-<name>.ts` — what `x g` writes) or several in one (`actions.ts` — what `examples/dummy` keeps); nothing enforces either, `As of 2026-10`. The filenames that ARE enforced:
+**One primitive per file, in its kind's directory** — `actions/<verb>-<name>.ts`, what `x g` writes, and what both tracked apps keep (`As of 2026-10`, owner decision 10 of #648). A primitive is registered by `defineApi()` and found by the module scan, never by its filename; what IS refused is a module `X.ts` beside a directory `X/` (`X_LAYOUT_SIBLING_MODULE`, the `boundaries` step), because `./actions` resolves to the file and never the directory. The filenames that ARE enforced:
 
 | File | Owns | Never — and the error |
 |---|---|---|
@@ -102,9 +102,9 @@ apps/web/app/<feature>/ui/                                           # component
 | `repo.ts` | the feature's reads and writes, through the typed handle | a raw SQL literal the handle can express — `guards/repo-raw-sql.ts` |
 | `service.ts` | business logic, composed from repos | an HTTP import — `X_BOUNDARY_SERVICE_TO_HTTP` |
 | `page.tsx` · `layout.tsx` | a URL | a database import — `X_BOUNDARY_ROUTE_TO_DB` |
-| `actions/` · `actions.ts` | `action` / `mutator` declarations | logic (delegate to `service.ts`) |
-| `live/` · `queries/` · `live.ts` | `query` declarations | writes |
-| `jobs/` · `tasks/` · `jobs.ts` | `job` / `task` declarations | inline slow work in an action |
+| `actions/` | `action` / `mutator` declarations, one per file | logic (delegate to `service.ts`) |
+| `live/` · `queries/` | `query` declarations, one per file | writes |
+| `jobs/` · `tasks/` | `job` / `task` declarations, one per file | inline slow work in an action |
 | `policy.ts` | `policy` rules for this feature | data shaping |
 | `ui/` | Solid components | fetching, business logic, its own authz |
 

From a4816c28e0a38035a75dbb64fb6e7f748a6b3913 Mon Sep 17 00:00:00 2001
From: sebi <gore.sebyx@yahoo.com>
Date: Fri, 9 Oct 2026 10:08:23 -0500
Subject: [PATCH 2/3] =?UTF-8?q?fix(cli):=20the=20sibling=20refusal=20reads?=
 =?UTF-8?q?=20the=20primitive=20directories=20only=20=E2=80=94=20x=20g=20r?=
 =?UTF-8?q?esource=20writes=20ui.tsx=20beside=20ui/?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                             |  2 +-
 docs/architecture/12-generated-app.md    |  4 ++--
 docs/architecture/15-adding-a-feature.md |  2 +-
 packages/cli/src/app-layout.test.ts      | 11 +++++++++--
 packages/cli/src/app-layout.ts           | 25 +++++++++++++++++-------
 packages/cli/src/error-codes.ts          |  2 +-
 wiki/Error-Codes.md                      |  2 +-
 wiki/Project-Layout.md                   |  2 +-
 8 files changed, 34 insertions(+), 16 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c8ab18f2e..28477c15c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,7 +12,7 @@ Semver applies from 1.0.0. A breaking change to a documented API needs a major 
 
 Tier 5 — cli. Both tracked apps.
 
-- **The generator's directory form is the one layout (#710, owner decision 10).** One primitive per file, in its kind's directory — `<slice>/actions/<name>.ts`, `live/`, `queries/`, `jobs/`, `tasks/` — what `x g` writes. `x verify`'s `boundaries` step now refuses a module `X.ts` beside a directory `X/` in an app's surfaces (`X_LAYOUT_SIBLING_MODULE`): `./actions` resolves to the file and never the directory, so the two homes disagree silently. Both tracked apps migrated: `examples/dummy`'s 56 primitives and the demo's 11 each in their own file (`api/tasks.ts`'s two tasks moved into their slices' `tasks/`), registered module by module in `api/index.ts`. `docs/architecture/12-generated-app.md`, `wiki/Project-Layout.md` and `wiki/Actions.md` say so. An app that keeps `actions.ts` with no `actions/` beside it is not refused.
+- **The generator's directory form is the one layout (#710, owner decision 10).** One primitive per file, in its kind's directory — `<slice>/actions/<name>.ts`, `live/`, `queries/`, `jobs/`, `tasks/` — what `x g` writes. `x verify`'s `boundaries` step now refuses a primitive module beside its directory in an app's surfaces — `actions.ts` with `actions/`, or `live`, `queries`, `jobs`, `tasks` (`X_LAYOUT_SIBLING_MODULE`); a component module beside its folder (`ui.tsx` + `ui/`, what `x g resource` writes) is not one: `./actions` resolves to the file and never the directory, so the two homes disagree silently. Both tracked apps migrated: `examples/dummy`'s 56 primitives and the demo's 11 each in their own file (`api/tasks.ts`'s two tasks moved into their slices' `tasks/`), registered module by module in `api/index.ts`. `docs/architecture/12-generated-app.md`, `wiki/Project-Layout.md` and `wiki/Actions.md` say so. An app that keeps `actions.ts` with no `actions/` beside it is not refused.
 
 ## 27.3.0 - 2026-10-09
 
diff --git a/docs/architecture/12-generated-app.md b/docs/architecture/12-generated-app.md
index ae64b5941..4422de475 100644
--- a/docs/architecture/12-generated-app.md
+++ b/docs/architecture/12-generated-app.md
@@ -120,10 +120,10 @@ apps/web/app/<features>/page.tsx the route, at the plural URL
 | `queries/` | one `query` per file, not subscribable | writes |
 | `jobs/` | one `job` per file | inline slow work in an action |
 | `tasks/` | one `task` per file — a cron trigger that enqueues a job | doing the work itself |
-| `ui.tsx` or `ui/` | Solid components | fetching, business logic, its own authz |
+| `ui.tsx`, `ui/` | Solid components | fetching, business logic, its own authz |
 | `admin/resource.ts` | list columns, title key, page size | a second authz path |
 
-`x g` writes one primitive per file: `actions/<verb>-post.ts`, `live/<name>.ts`, `queries/<name>.ts`, `jobs/<verb>-post.ts`, `tasks/<name>.ts`, each named for its export in kebab case. **That directory form is the one layout** (`As of 2026-10`, owner decision 10 of #648): both tracked apps use it, and a module `X.ts` beside a directory `X/` is refused — `X_LAYOUT_SIBLING_MODULE`, in the `boundaries` step — because `./actions` resolves to the file and never the directory. A factory's kind decides its directory: a mutator, a `transition()` and an `llm()`/`agent()`/`hive()` call are actions; a `backfill()` keeps `backfills/`, and every other job factory is a job. A primitive is registered by `defineApi()` and found by the module scan, never by its filename ([Project layout](../../wiki/Project-Layout.md#feature-slicing-inside-a-surface) names the filenames that ARE enforced). The flat files are the ones there is exactly one of per feature.
+`x g` writes one primitive per file: `actions/<verb>-post.ts`, `live/<name>.ts`, `queries/<name>.ts`, `jobs/<verb>-post.ts`, `tasks/<name>.ts`, each named for its export in kebab case. **That directory form is the one layout** (`As of 2026-10`, owner decision 10 of #648): both tracked apps use it, and a primitive module beside its directory (`actions.ts` with `actions/`, or `live`, `queries`, `jobs`, `tasks`) is refused — `X_LAYOUT_SIBLING_MODULE`, in the `boundaries` step — because `./actions` resolves to the file and never the directory. A factory's kind decides its directory: a mutator, a `transition()` and an `llm()`/`agent()`/`hive()` call are actions; a `backfill()` keeps `backfills/`, and every other job factory is a job. A primitive is registered by `defineApi()` and found by the module scan, never by its filename ([Project layout](../../wiki/Project-Layout.md#feature-slicing-inside-a-surface) names the filenames that ARE enforced). The flat files are the ones there is exactly one of per feature.
 
 The folder is the name passed to `x g resource`; the route is its plural, because a collection URL is plural — `x g resource post` writes the slice to `apps/web/app/post/` and the page to `apps/web/app/posts/page.tsx`.
 
diff --git a/docs/architecture/15-adding-a-feature.md b/docs/architecture/15-adding-a-feature.md
index 9481593a2..04f0e77c1 100644
--- a/docs/architecture/15-adding-a-feature.md
+++ b/docs/architecture/15-adding-a-feature.md
@@ -43,7 +43,7 @@ x g resource post --admin
 
 Generates schema, entity, repo, service, policy, actions, live query, job stub, components, the form island, the `posts` page, i18n keys, admin screens, MCP entries, and the tests beside each. The page is reachable as written: its `load` reads the list through the slice's query as the request's actor, `AsyncRegion` renders ready, empty and refused, and the form island posts to `createPost`. `x g` ends by printing what the new table owes (`x db gen`, `x db migrate`) and the build that weighs the page against its budget. Everything below is *editing* generated files — not creating them.
 
-`x g` writes one primitive per file: `actions/<verb>-post.ts`, `live/<name>.ts`, `queries/<name>.ts`, `jobs/<verb>-post.ts`, `tasks/<name>.ts`. That directory form is the one layout: a second primitive is a second file, and a module `X.ts` beside a directory `X/` is `X_LAYOUT_SIBLING_MODULE` ([Project layout](../../wiki/Project-Layout.md#feature-slicing-inside-a-surface) names the filenames that ARE enforced). `x g resource <name>` takes no `--feature`: the name is the slice (`X_CLI_BAD_FLAG`).
+`x g` writes one primitive per file: `actions/<verb>-post.ts`, `live/<name>.ts`, `queries/<name>.ts`, `jobs/<verb>-post.ts`, `tasks/<name>.ts`. That directory form is the one layout: a second primitive is a second file, and a primitive module beside its directory (`actions.ts` with `actions/`) is `X_LAYOUT_SIBLING_MODULE` ([Project layout](../../wiki/Project-Layout.md#feature-slicing-inside-a-surface) names the filenames that ARE enforced). `x g resource <name>` takes no `--feature`: the name is the slice (`X_CLI_BAD_FLAG`).
 
 ## 2. Entity + invariants
 
diff --git a/packages/cli/src/app-layout.test.ts b/packages/cli/src/app-layout.test.ts
index 54d366148..7430c19cd 100644
--- a/packages/cli/src/app-layout.test.ts
+++ b/packages/cli/src/app-layout.test.ts
@@ -7,7 +7,7 @@ import { siblingModuleFindings } from './app-layout';
 const files = (...paths: string[]) => paths.map((path) => ({ path, source: '' }));
 
 describe('siblingModuleFindings', () => {
-  test('a module beside a directory of its own name is refused, by file', () => {
+  test('a primitive module beside its directory is refused, a component module beside its folder is not', () => {
     const found = siblingModuleFindings(
       files(
         'apps/web/app/posts/actions.ts',
@@ -18,7 +18,6 @@ describe('siblingModuleFindings', () => {
     );
     expect(found.map((finding) => [finding.code, finding.at])).toEqual([
       ['X_LAYOUT_SIBLING_MODULE', 'apps/web/app/posts/actions.ts'],
-      ['X_LAYOUT_SIBLING_MODULE', 'apps/web/app/posts/ui.tsx'],
     ]);
     expect(found[0]?.cause).toContain('apps/web/app/posts/actions/');
   });
@@ -37,3 +36,11 @@ describe('siblingModuleFindings', () => {
     ).toEqual([]);
   });
 });
+
+test('every primitive directory is read', () => {
+  const paths = ['actions', 'live', 'queries', 'jobs', 'tasks'].flatMap((dir) => [
+    `apps/web/app/posts/${dir}.ts`,
+    `apps/web/app/posts/${dir}/one.ts`,
+  ]);
+  expect(siblingModuleFindings(files(...paths))).toHaveLength(5);
+});
diff --git a/packages/cli/src/app-layout.ts b/packages/cli/src/app-layout.ts
index 7d80442d9..0a32b5726 100644
--- a/packages/cli/src/app-layout.ts
+++ b/packages/cli/src/app-layout.ts
@@ -1,15 +1,26 @@
-// The one feature layout, made a build error: a module `X.ts` beside a directory `X/` in the same
-// folder is refused. `x g` writes the directory form — `<slice>/actions/<name>.ts`, one primitive
-// per file — and an app that also keeps `actions.ts` has two homes for one kind of thing, where
-// `./actions` resolves to the file and never the directory: the reader opens the wrong one.
+// The one feature layout, made a build error: a primitive module `actions.ts` (or `live`,
+// `queries`, `jobs`, `tasks`) beside the directory of the same name is refused. `x g` writes the
+// directory form — `<slice>/actions/<name>.ts`, one primitive per file — and an app that also keeps
+// `actions.ts` has two homes for one kind of thing, where `./actions` resolves to the file and never
+// the directory. A component module beside its folder (`ui.tsx` + `ui/`) is not a primitive's home,
+// and `x g resource` writes exactly that pair.
 
 import { ERROR_DOCS_URL } from '@ultimat3/core';
 import type { SourceFile } from './app-boundaries';
 import type { Finding } from './output';
 
+/** The directories `x g` writes primitives into — the only names the refusal reads. */
+export const PRIMITIVE_DIRS: ReadonlySet<string> = new Set([
+  'actions',
+  'live',
+  'queries',
+  'jobs',
+  'tasks',
+]);
+
 const MODULE = /^(?<stem>.+)\.(?:ts|tsx)$/;
 
-/** Every `X.ts`/`X.tsx` among `files` that has a directory `X/` holding another of them. */
+/** Every primitive module `X.ts` among `files` beside a directory `X/` holding another of them. */
 export function siblingModuleFindings(files: readonly SourceFile[]): readonly Finding[] {
   const directories = new Set<string>();
   for (const { path } of files) {
@@ -20,8 +31,8 @@ export function siblingModuleFindings(files: readonly SourceFile[]): readonly Fi
   }
   return files.flatMap(({ path }): Finding[] => {
     const stem = MODULE.exec(path)?.groups?.['stem'];
-    if (stem === undefined || !directories.has(stem)) return [];
-    const name = stem.split('/').at(-1) ?? stem;
+    const name = stem?.split('/').at(-1) ?? '';
+    if (stem === undefined || !PRIMITIVE_DIRS.has(name) || !directories.has(stem)) return [];
     return [
       {
         code: 'X_LAYOUT_SIBLING_MODULE',
diff --git a/packages/cli/src/error-codes.ts b/packages/cli/src/error-codes.ts
index e573c79db..329e7247f 100644
--- a/packages/cli/src/error-codes.ts
+++ b/packages/cli/src/error-codes.ts
@@ -421,7 +421,7 @@ export const CLI_ERROR_TITLES: Readonly<Record<CliOwnedErrorCode, string>> = {
   X_PACKAGE_TEST_ONLY_SHIPPED: 'a test-only module ships in the tarball',
   X_ISLAND_MODULE_DUPLICATED: 'An island chunk bundles one module more than once',
   X_BACKFILL_SLICE_ENTITY: 'the slice holds no entity a generated backfill can sweep',
-  X_LAYOUT_SIBLING_MODULE: 'a module beside a directory of the same name',
+  X_LAYOUT_SIBLING_MODULE: 'a primitive module beside its directory',
 };
 
 // One unconditional call, so a second package claiming one of the CLI's codes throws
diff --git a/wiki/Error-Codes.md b/wiki/Error-Codes.md
index c1a6fcc6f..662a6624c 100644
--- a/wiki/Error-Codes.md
+++ b/wiki/Error-Codes.md
@@ -1148,7 +1148,7 @@ Two sets override the table, in `failures.ts`:
 | `X_PACKAGE_TEST_ONLY_SHIPPED` | a test-only module ships in the tarball | a src/ module imported only by tests is not named *-fixture.ts, so the package files list publishes it — test scaffolding (fakes, probes, bun:test imports) in every install | `bun run x -- verify --only package-shape --json   # then rename each listed module to <name>-fixture.ts and update its importers` |
 | `X_ISLAND_MODULE_DUPLICATED` | An island chunk bundles one module more than once | the island build shipped one framework module twice — one file under two path spellings, or a second @ultimat3/* copy — so its bytes and its module state are duplicated in the chunk | `gh issue create --repo developerz-ai/ultimate --title "X_ISLAND_MODULE_DUPLICATED"` — paste this error's --json as the body: the framework bundled one of its own modules twice |
 | `X_BACKFILL_SLICE_ENTITY` | the slice holds no entity a generated backfill can sweep | x g backfill --feature <slice> writes a sweep over the slice's own scaffolded table (db.<plural>, its title column); the slice exists and its entity.ts declares other tables, so the generated files would not compile | `x g job <name> --feature <slice>` — then wrap its body in backfill({ source: db.<your table>, … }) from @ultimat3/jobs |
-| `X_LAYOUT_SIBLING_MODULE` | a module beside a directory of the same name | X.ts and X/ in one folder — `./X` resolves to the file, and the directory form is the one layout | `x verify --only boundaries --json` — then move each declaration in X.ts to X/<name>.ts, one primitive per file |
+| `X_LAYOUT_SIBLING_MODULE` | a primitive module beside its directory | `actions.ts` and `actions/` (or live, queries, jobs, tasks) in one slice — `./actions` resolves to the file, and the directory form is the one layout | `x verify --only boundaries --json` — then move each declaration in X.ts to X/<name>.ts, one primitive per file |
 
 ## Reserved codes
 
diff --git a/wiki/Project-Layout.md b/wiki/Project-Layout.md
index 71fcb4fd7..9a427b4d9 100644
--- a/wiki/Project-Layout.md
+++ b/wiki/Project-Layout.md
@@ -94,7 +94,7 @@ apps/web/app/<feature>/{actions,live,queries,jobs,tasks}/<name>.ts   # one per f
 apps/web/app/<feature>/ui/                                           # components
 ```
 
-**One primitive per file, in its kind's directory** — `actions/<verb>-<name>.ts`, what `x g` writes, and what both tracked apps keep (`As of 2026-10`, owner decision 10 of #648). A primitive is registered by `defineApi()` and found by the module scan, never by its filename; what IS refused is a module `X.ts` beside a directory `X/` (`X_LAYOUT_SIBLING_MODULE`, the `boundaries` step), because `./actions` resolves to the file and never the directory. The filenames that ARE enforced:
+**One primitive per file, in its kind's directory** — `actions/<verb>-<name>.ts`, what `x g` writes, and what both tracked apps keep (`As of 2026-10`, owner decision 10 of #648). A primitive is registered by `defineApi()` and found by the module scan, never by its filename; what IS refused is a primitive module beside its directory — `actions.ts` with `actions/`, or `live`, `queries`, `jobs`, `tasks` — (`X_LAYOUT_SIBLING_MODULE`, the `boundaries` step), because `./actions` resolves to the file and never the directory. The filenames that ARE enforced:
 
 | File | Owns | Never — and the error |
 |---|---|---|

From 0852a254cda011109f10b74ed121b5654decc1cc Mon Sep 17 00:00:00 2001
From: sebi <gore.sebyx@yahoo.com>
Date: Fri, 9 Oct 2026 10:29:26 -0500
Subject: [PATCH 3/3] chore(examples): raise the coverage floor to the measured
 74% of lines

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 examples/dummy/x.verify.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/dummy/x.verify.json b/examples/dummy/x.verify.json
index 5f9778696..fac3ff882 100644
--- a/examples/dummy/x.verify.json
+++ b/examples/dummy/x.verify.json
@@ -21,9 +21,9 @@
     "seo"
   ],
   "coverage": {
-    "lines": 73,
+    "lines": 74,
     "funcs": 68,
-    "why": "Measured 2026-10-06 after the #684 review (plan 101 sweep 10d: the review eval's scorers unit-tested, the draft-data escape tested): 73.9% of lines and 68.8% of functions locally; the floor is 73 / 68, under both and within the 1.5-point stale window of each. Earlier the same day, with the factory uses B16 added: 74.3% / 68.3% locally, 73.7% / 68.1% in CI (CI runs fewer live services, so less is reached) — 68 is under that CI figure too. Before: 72.7% of lines and 67.6% of functions, with the e2e suites' own fixtures excluded (see exclude) — they run in the e2e step against a real browser, and a browser-side helper added for #507's proof had pushed functions to 64.9%. Before that, 2026-10-02: 71.5% / 65.0% over 138 source files. What is not run: page renders (app/posts/[id]/page.tsx, site/pricing/page.tsx, site/blog/[slug]/page.tsx), the event handlers and mount() of every island (a unit test drives them through the built chunk, never this source), posts/service.ts past its first branch, and digest/jobs.ts, which the job suite runs and the unit suite does not. Each slice that adds a unit test raises this floor in the same commit.",
+    "why": "Measured 2026-10-09 (#710, one primitive per file): 74.7% of lines and 68.7% of functions — the deleted shared/wire.ts and shared/ui-strings*.ts were loaded by no unit test, and every split module is now its own file; the floor is 74 / 68. Measured 2026-10-06 after the #684 review (plan 101 sweep 10d: the review eval's scorers unit-tested, the draft-data escape tested): 73.9% of lines and 68.8% of functions locally; the floor is 73 / 68, under both and within the 1.5-point stale window of each. Earlier the same day, with the factory uses B16 added: 74.3% / 68.3% locally, 73.7% / 68.1% in CI (CI runs fewer live services, so less is reached) — 68 is under that CI figure too. Before: 72.7% of lines and 67.6% of functions, with the e2e suites' own fixtures excluded (see exclude) — they run in the e2e step against a real browser, and a browser-side helper added for #507's proof had pushed functions to 64.9%. Before that, 2026-10-02: 71.5% / 65.0% over 138 source files. What is not run: page renders (app/posts/[id]/page.tsx, site/pricing/page.tsx, site/blog/[slug]/page.tsx), the event handlers and mount() of every island (a unit test drives them through the built chunk, never this source), posts/service.ts past its first branch, and digest/jobs.ts, which the job suite runs and the unit suite does not. Each slice that adds a unit test raises this floor in the same commit.",
     "exclude": [
       {
         "glob": "apps/web/e2e/**",