Full pass reconciling spec.md against the current code: - Frontend rewritten: single-document SPA (shell + client router + mount/destroy views, instant soft-nav, per-view caches), the owned Bun.build (content-hashed, compressed, immutable-cached), and the service worker (cache-control-mirroring strategy, offline shell, SWR-capped tail cache). Was "no build tooling, Bun serves the HTML" (an MPA). - Rendering: syntax highlighting now streams the active block (was documented as deferred to a Web Worker, never per token); Shiki + KaTeX are built via the lazy enrich.js split, not "not built yet". - Non-goals: build is owned (still no framework); offline read via the SW, offline write still not. - Tools header reconciled from "designed, not built" to "mostly built" (the Stack table already said built); only the approval gate + wiring the executor as a sandboxed tool remain. - Sandbox: documents the shipped docker/gVisor Executor (remote over DOCKER_HOST) and reframes the spindle-broker microVM as explored-but-set-aside. - Stack table: updated Frontend and Code-highlight rows; added Client build, Delivery (service worker), and Math render rows; rewrote the Tool sandbox row.