docs(website): add cookieless Umami analytics + a privacy page

Wire self-hosted Umami (umami.oliversturm.com) into the site head:
- data-domains=relplay.org so the preview/staging deploys don't pollute
  the production stats
- data-do-not-track so DNT visitors aren't counted
- the Website ID is public by design (ships in every page)

Add a short /privacy page (footer-linked, kept out of the sidebar)
explaining the no-cookies / no-personal-data / no-cross-site-tracking
posture and the DNT behaviour. No cookie banner is needed: the tracker
stores nothing on the device, and first-party statistical analytics is
exempt from PECR consent under the Data (Use and Access) Act 2025.

docs/handoff/20260621-website-handoff-3.md

@@ -0,0 +1,130 @@
+# Website-branch handoff — 2026-06-21 (website-3)
+
+Third handoff for the **website** work (separate sequence from `main`'s
+`YYYYMMDD-handoff-NN.md`). Read **website-2** (2026-06-11) first for the
+scaffolding, cast pipeline, and the no-advertising constraint; this note covers
+everything since, and — importantly — the state has moved on (see §1).
+
+## §1. State (read this first)
+
+- **Branch:** `website`. **HEAD `dff7841`.** Working tree **clean**.
+- **Pushed:** `origin/website` == `dff7841` (this session's work is pushed).
+- **Already merged into `main`:** `dff7841` is an ancestor of `main` — every
+  website change below is in `main`. **`main` has since advanced ~20 commits**
+  (now `56e3456`, handoff 75) with **v0.2.0 + install/packaging** work. So
+  **`website` is ~20 commits behind `main`.**
+- **Consequence for the next session:** start by **merging `main` into
+  `website` again** (or rebranching `website` off `main`). There is real new
+  user-facing surface to document — see §4.
+- **Agent limitation:** this machine's SSH key for `git.lazyeval.net` was **not
+  available to the agent** — `git fetch`/`push` fail from inside the session.
+  **Push and fetch are the user's steps.** Local merges work fine.
+
+## §2. What shipped this session (all in `main` now)
+
+The website lives in **`website/`**; living style guide **`website/STYLE.md`**;
+decisions **`docs/website/adr/20260604-adr-website-001.md`**.
+
+**CI / deployment — the big one (ADR-website-001 §4):**
+- **`.gitea/workflows/website.yaml`** — on a push to `main` or `website` that
+  touches `website/**`, build the Astro site with pnpm and `wrangler pages
+  deploy website/dist` to the Cloudflare **Pages project `relplay`** (Direct
+  Upload, no Git integration). `--branch` selects environment vs the project's
+  production branch (`main`): **`main` → production (`relplay.org`)**,
+  **`website` → preview (`website.relplay.pages.dev`)**.
+- Pure-Node build (the `.cast` files are committed, so no cargo). Runs on the
+  bare `ci-public` runner (node present; pnpm via corepack, pinned by
+  `package.json`'s `packageManager: pnpm@10.30.3`).
+- **Secrets (set in repo Actions settings):** `CLOUDFLARE_API_TOKEN` (Pages:
+  Edit) + `CLOUDFLARE_ACCOUNT_ID`. Pages project created with production branch
+  = `main`.
+- **`ci.yaml` gate** now skips website-only pushes (`paths-ignore` += `website/**`,
+  `.gitea/workflows/website.yaml`).
+- **`staging.relplay.org`** (optional): attach the custom domain to the `website`
+  branch alias — add it in the Pages dashboard, then point its **proxied**
+  CNAME at `website.relplay.pages.dev` (external/unproxied DNS falls through to
+  production). Cloudflare Pages maps branches to **subdomains, not sub-folders**.
+
+**Content updates (from two `main` merges that landed seed/readline/hint/etc.):**
+- **Seed page** (`reference/generating-sample-data.mdx`) refreshed for **#33/#34**:
+  year-as-int columns (`*_year`/`published` → plausible years), built-in value
+  sets (`priority`/`severity`/`rating`), advisory now **status-only**. All output
+  blocks re-captured; the seed cast reflects it.
+- **`hint` feature** (ADR-0053) documented: `getting-help.md` → **`.mdx`** with a
+  "Hints" section (F1 = tier-3 live-input hint; `hint` command = last-error hint)
+  + the real rendered block; `the-assistive-editor.mdx` points at F1.
+- **Readline keys (#29)** + **cross-mode history recall (#30)** documented on
+  `the-assistive-editor.mdx`; "Planned" narrowed to multi-line entry only.
+- **Landing** (`index.mdx`): the redundant plain **`<h1>` "RDBMS Playground"** is
+  hidden (kept for SEO/a11y via a **title-only hero**, landing-scoped in
+  `global.css`); the **Wordmark + tagline + buttons** render in the body so the
+  lockup sits where the title was and content rises above the fold (it was nearly
+  hidden on an iPad).
+- **All 10 casts re-recorded** + a **new `hint` cast** (11 total) against the
+  current app.
+
+**Casts — the F1 trick (important for future hint/keybinding casts):**
+- autocast **cannot send F1** (or arrows/function keys — escape sequences split
+  by the per-key delay). Solution shipped on `main`: **ADR-0047 Amendment 1** —
+  in `--demo` mode **Ctrl-G aliases F1** and **badges AS `[F1]`**, so a cast looks
+  like a real F1 press. The cast generator gained `CtrlG: '^G'`.
+- The **hint cast** uses it realistically: type `add column `, pause, **F1**
+  (Ctrl-G) mid-command to recall the syntax, finish the command from the example,
+  then later a failed command + `hint` for the error.
+
+**Hint-vs-docs audit (user-requested):** one genuine conflict found —
+`hint.cmd.create_table.example` declared a 3-column compound PK; **fixed upstream**
+(`5a37437`, now `create table Customers with pk id(serial)`). Everything else
+(export/import, indexes, constraints, DML, SQL forms, error hints, terminology)
+was consistent.
+
+## §3. Verification status
+
+- `cd website && pnpm build` → **clean, 27 pages**. Forbidden-terms grep clean
+  (`DSL`/`SQLite`/`STRICT`/`rusqlite`/`PRAGMA`). Output-table box-drawing intact;
+  anchors resolve; hint cast content verified (`[F1]` badge + both hint blocks).
+- **NOT done — needs a human visual pass:** the new **landing spacing/aesthetics**
+  (couldn't be eyeballed by the agent) and the **11 re-recorded casts** (verified
+  programmatically only). Do this in staging/production before relying on them.
+
+## §4. NEXT WORK — priority order
+
+1. **Re-merge `main` into `website`** (it's ~20 behind) — or rebranch off `main`.
+2. **Reconcile the installation / getting-started docs with what `main` actually
+   shipped (v0.2.0):** the website branch's `installation.md` predates several
+   real install methods now live —
+   - **crates.io v0.2.0** (`cargo install rdbms-playground`, `cargo binstall`),
+   - the **curl | sh installer** (ADR-0055),
+   - **Windows `install.ps1`** (`fix(install)` commits),
+   - **package managers**: Scoop / Homebrew / **winget** (ADR-0056; winget via
+     komac). `installation.md` mentions brew/scoop but **not** winget, the
+     curl|sh installer, or binstall — reconcile against the shipped reality
+     (check ADR-0055/0056 + handoffs 74/75 + the `publish.yaml` workflow).
+   - There's also `--version`/`-V` + an in-app `version` command (ADR-0054) — a
+     line on the command-line-options page may be warranted.
+3. **Visual sweep** (§3): landing + casts; final caption review (website-2 §2).
+4. **Carryover from website-2:** light/dark player theme (deferred), open STYLE
+   decisions (#7/#8 mostly resolved; recheck), output-pane-scroll cast still
+   blocked (PgUp/PgDn unsendable — would need a typeable scroll key like #24).
+
+## §5. Process pins
+
+- **Commits:** user-confirmed (show the message first), **no AI attribution**,
+  **append-only** (no amend/rebase/force-push). **Push/fetch are the user's
+  steps** (and the agent can't reach the remote anyway — §1).
+- **Ground every page in source** (`src/dsl/*`, `src/friendly/strings/en-US.yaml`,
+  the ADRs) — not `requirements.md` markers. No engine name, no "DSL" in copy.
+- **Output blocks captured from the real app**, never hand-drawn (STYLE.md). The
+  capture recipe (throwaway in-crate/`it` test → render → paste → delete) and the
+  cast pipeline (`pnpm casts [name]`, needs `../target/debug`) are in website-2.
+- **Cast stance (revised 2026-06-12):** default to a cast; justify its *absence*.
+- **Issues** via `tea` (repo `oli/rdbms-playground` on `git.lazyeval.net`;
+  append `< /dev/null` + `timeout 30`). This session filed **#33** (year ints)
+  and **#34** (enum value sets) — both **implemented** on `main` now.
+
+## §6. Footnote — a git oddity in this branch's history
+
+`c84a640 "docs(website): document the hint feature with a cast"` is an **empty
+rename commit** (a `git add` tooling slip staged only the `.md`→`.mdx` rename);
+its actual content is in the **next** commit `028d324`. Harmless, left in place
+per the append-only rule (user-approved). No action needed.

website/astro.config.mjs

@@ -58,6 +58,25 @@ export default defineConfig({
 				},
 				{ tag: 'meta', attrs: { name: 'twitter:card', content: 'summary_large_image' } },
 				{ tag: 'meta', attrs: { name: 'twitter:image', content: 'https://relplay.org/og-card.png' } },
+				// Privacy-friendly, cookieless analytics (self-hosted Umami). The
+				// Website ID is public by design (it ships in every page). The script
+				// loads from the Umami host, which also becomes the data destination,
+				// so no `data-host-url` is needed.
+				//   - data-domains: only run on the production apex, so the
+				//     `website.relplay.pages.dev` preview and `staging.relplay.org`
+				//     don't pollute the stats.
+				//   - data-do-not-track: honour the browser's Do-Not-Track signal
+				//     (those visits are not counted at all). See /privacy.
+				{
+					tag: 'script',
+					attrs: {
+						defer: true,
+						src: 'https://umami.oliversturm.com/script.js',
+						'data-website-id': 'fd77cfa5-cffe-4fc8-addb-1c6d7b6d9939',
+						'data-domains': 'relplay.org',
+						'data-do-not-track': true,
+					},
+				},
 			],
 			// Register the simple-mode command grammar with Expressive Code (Shiki).
 			expressiveCode: { shiki: { langs: [rdbmsLang, rdbmsSyntax] } },

website/src/components/Footer.astro

@@ -15,6 +15,8 @@ import Default from '@astrojs/starlight/components/Footer.astro';
 		Made by <a href="https://www.lazyevaluation.biz/">Lazy Evaluation Ltd</a>
 		<span class="sep">·</span>
 		<a href="https://git.lazyeval.net/oli/rdbms-playground">Source &amp; issues</a>
+		<span class="sep">·</span>
+		<a href="/privacy/">Privacy</a>
 	</p>
 </div>
 

website/src/components/InstallOsDetect.astro

@@ -0,0 +1,39 @@
+---
+// Pre-selects the install-instructions tab that matches the visitor's OS.
+//
+// This piggybacks on Starlight's synced-tabs mechanism rather than fighting it.
+// A `<Tabs syncKey="install-os">` restores its active tab from
+// `localStorage["starlight-synced-tabs__install-os"]` via a script Starlight
+// inlines *before* the tabs render (so there is no flash of the wrong tab). All
+// we do here is seed that same key with the detected OS — and only when the
+// visitor has not already chosen a tab themselves, so a manual choice always wins.
+//
+// Requirements (mirrors Starlight's own restore script):
+//   - Must be placed *before* the `<Tabs>` it targets, so this runs first.
+//   - The stored value must equal one of the TabItem labels exactly
+//     ("Linux" / "macOS" / "Windows").
+//   - Inlined, so it runs during parse before the restore script's
+//     connectedCallback and paint.
+---
+
+<script is:inline>
+	(() => {
+		const KEY = 'starlight-synced-tabs__install-os';
+		try {
+			// A previously stored value is a deliberate user choice — never override it.
+			if (localStorage.getItem(KEY)) return;
+			const data = navigator.userAgentData;
+			const platform = ((data && data.platform) || navigator.platform || '').toLowerCase();
+			const ua = (navigator.userAgent || '').toLowerCase();
+			let os = null;
+			if (platform.includes('win') || ua.includes('windows')) os = 'Windows';
+			else if (platform.includes('mac') || ua.includes('mac os x')) os = 'macOS';
+			else if (platform.includes('linux') || platform.includes('x11') || ua.includes('linux'))
+				os = 'Linux';
+			if (os) localStorage.setItem(KEY, os);
+		} catch (e) {
+			// localStorage unavailable (private mode, blocked cookies, …) — silently
+			// fall back to the default first tab. No detection, no harm.
+		}
+	})();
+</script>

website/src/content/docs/getting-started/installation.md

@@ -1,64 +0,0 @@
----
-title: Installation
-description: Install RDBMS Playground from a prebuilt binary or a package manager, and run it for the first time.
-sidebar:
-  order: 1
----
-
-RDBMS Playground is a single self-contained program. There is nothing to
-configure and no separate database to install — everything it needs is
-built in.
-
-## Prebuilt binaries
-
-Download the binary for your platform, make it executable if needed, and
-put it somewhere on your `PATH`.
-
-:::note
-Download links are published with each release. They are added here when the
-first public version ships.
-:::
-
-## Package managers
-
-Once published, the playground will be installable through common package
-managers:
-
-```sh
-# macOS / Linux (Homebrew)
-brew install rdbms-playground
-
-# Windows (Scoop)
-scoop install rdbms-playground
-```
-
-:::note
-Package-manager availability lands with the first public release; the exact
-names are confirmed here at that time.
-:::
-
-## Run it
-
-Start the playground with no arguments and it opens a fresh, automatically
-named temporary project so you can start experimenting immediately:
-
-```sh
-rdbms-playground
-```
-
-To open an existing project, pass its path:
-
-```sh
-rdbms-playground path/to/project
-```
-
-Useful options (run `rdbms-playground --help` for the full list):
-
-| Option | What it does |
-|---|---|
-| `--resume` | Reopen the most recently used project. |
-| `--data-dir <PATH>` | Use a different location for stored projects. |
-| `--theme <light\|dark>` | Force a theme instead of auto-detecting. |
-| `--mode <simple\|advanced>` | Start in a specific input mode. |
-
-Next: [create your first project](/getting-started/first-project/).

website/src/content/docs/getting-started/installation.mdx

@@ -0,0 +1,148 @@
+---
+title: Installation
+description: Install RDBMS Playground with a one-line installer, a package manager, cargo, or a prebuilt binary.
+sidebar:
+  order: 1
+---
+
+import { Tabs, TabItem } from '@astrojs/starlight/components';
+import InstallOsDetect from '../../../components/InstallOsDetect.astro';
+
+RDBMS Playground is a single self-contained program. There is nothing to
+configure and no separate database to install — everything it needs is
+built in.
+
+Pick the tab for your platform — we try to select it automatically — then
+use whichever method you prefer. The one-line installers are the quickest if
+you just want to get going.
+
+<InstallOsDetect />
+
+<Tabs syncKey="install-os">
+<TabItem label="Linux">
+
+**One-line installer**
+
+```sh
+curl -fsSL https://git.lazyeval.net/oli/rdbms-playground/raw/branch/main/scripts/install.sh | sh
+```
+
+It detects your CPU, installs to `~/.local/bin`, and prints a hint if that
+directory isn't on your `PATH`. Set `RDBMS_INSTALL_DIR` to install elsewhere,
+or `RDBMS_VERSION=vX.Y.Z` to pin a version. Prefer to read a script before
+running it? It lives at
+[`scripts/install.sh`](https://git.lazyeval.net/oli/rdbms-playground/raw/branch/main/scripts/install.sh).
+
+**Homebrew**
+
+```sh
+brew tap lazyeval/tap https://git.lazyeval.net/lazyeval/homebrew-tap
+brew install lazyeval/tap/rdbms-playground
+```
+
+</TabItem>
+<TabItem label="macOS">
+
+**One-line installer**
+
+```sh
+curl -fsSL https://git.lazyeval.net/oli/rdbms-playground/raw/branch/main/scripts/install.sh | sh
+```
+
+It detects your CPU (Apple Silicon or Intel), installs to `~/.local/bin`, and
+prints a hint if that directory isn't on your `PATH`. Set `RDBMS_INSTALL_DIR`
+to install elsewhere, or `RDBMS_VERSION=vX.Y.Z` to pin a version. Prefer to
+read a script before running it? It lives at
+[`scripts/install.sh`](https://git.lazyeval.net/oli/rdbms-playground/raw/branch/main/scripts/install.sh).
+
+**Homebrew**
+
+```sh
+brew tap lazyeval/tap https://git.lazyeval.net/lazyeval/homebrew-tap
+brew install lazyeval/tap/rdbms-playground
+```
+
+</TabItem>
+<TabItem label="Windows">
+
+**One-line installer (PowerShell)**
+
+```powershell
+irm https://git.lazyeval.net/oli/rdbms-playground/raw/branch/main/scripts/install.ps1 | iex
+```
+
+It downloads the matching `.exe`, verifies its checksum, installs to
+`%LOCALAPPDATA%\Programs\rdbms-playground`, and adds that folder to your user
+`PATH`. Use `-InstallDir` to choose a different location or `-Version` to pin
+a release.
+
+**Scoop**
+
+```sh
+scoop bucket add lazyeval https://git.lazyeval.net/lazyeval/scoop-bucket
+scoop install rdbms-playground
+```
+
+**winget**
+
+A winget package (`winget install LazyEvaluation.RdbmsPlayground`) is on its
+way and awaiting review in the public winget catalogue. Until it lands, use
+Scoop or the PowerShell one-liner above.
+
+</TabItem>
+</Tabs>
+
+## With cargo
+
+These work on any platform with a Rust toolchain. Install from
+[crates.io](https://crates.io/crates/rdbms-playground):
+
+```sh
+cargo install rdbms-playground
+```
+
+For a faster install that fetches a prebuilt binary instead of compiling, use
+[`cargo-binstall`](https://github.com/cargo-bins/cargo-binstall) (install it
+first — it is not part of `cargo` itself):
+
+```sh
+cargo binstall rdbms-playground
+```
+
+## Prebuilt binaries
+
+Every release publishes static Linux, standalone Windows, and macOS binaries
+(x86_64 and aarch64), each with a `.sha256` checksum, on the
+[releases page](https://git.lazyeval.net/oli/rdbms-playground/releases).
+Download the one for your platform, make it executable if needed, and put it
+somewhere on your `PATH`.
+
+## Run it
+
+Start the playground with no arguments and it opens a fresh, automatically
+named temporary project so you can start experimenting immediately:
+
+```sh
+rdbms-playground
+```
+
+To open an existing project, pass its path:
+
+```sh
+rdbms-playground path/to/project
+```
+
+Useful options (run `rdbms-playground --help` for the full list):
+
+| Option | What it does |
+|---|---|
+| `--resume` | Reopen the most recently used project. |
+| `--data-dir <PATH>` | Use a different location for stored projects. |
+| `--theme <light\|dark>` | Force a theme instead of auto-detecting. |
+| `--mode <simple\|advanced>` | Start in a specific input mode. |
+| `--version` | Print the version and exit. |
+
+The full list, with examples, is on the
+[command-line options](/using-the-playground/command-line-options/) page.
+
+Next: [create your first project](/getting-started/first-project/).

website/src/content/docs/privacy.md

@@ -0,0 +1,51 @@
+---
+title: Privacy
+description: What we measure on this site, and what we don't. No cookies, no personal data.
+tableOfContents: false
+---
+
+This site is run as a free teaching tool, not a business that profiles its
+visitors. We keep the analytics deliberately minimal.
+
+## What we collect
+
+We measure aggregate usage with **[Umami](https://umami.is/)**, a
+privacy-friendly analytics tool that we **host ourselves** (on
+`umami.oliversturm.com`). Nothing is sent to a third-party advertising
+network.
+
+For each page view we record:
+
+- the page you viewed and the site you arrived from (the referrer),
+- your browser, operating system, and device type,
+- an approximate **country**.
+
+That's it. The numbers are aggregated into counts — how many people read a
+page, which pages are popular — and are never combined into a profile of an
+individual.
+
+## What we don't do
+
+- **No cookies, and nothing stored on your device.** The tracker sets no
+  cookies and writes nothing to local storage. You can confirm this in your
+  browser's developer tools — there are no entries to clear.
+- **No personal data.** Your IP address is used for a moment on our own
+  server to derive the approximate country and to tell repeated page-loads
+  apart within a single day; it is **not stored**.
+- **No cross-site tracking.** We cannot and do not follow you to other sites,
+  and we never sell or share what we measure.
+
+## Your choices
+
+If your browser sends a **Do Not Track** signal, we honour it: those visits
+are not counted at all.
+
+Because the analytics use no cookies and store nothing on your device, there
+is no cookie banner to dismiss — there is simply nothing to consent to.
+
+## Questions
+
+This site and its analytics are operated by
+[Lazy Evaluation Ltd](https://www.lazyevaluation.biz/). If you have any
+questions about what we measure, get in touch through the contact details
+there.

website/src/content/docs/using-the-playground/command-line-options.md

@@ -29,8 +29,13 @@ rdbms-playground path/to/project
 | `--no-undo` | Disable the undo machinery for this run — no snapshot is taken before each change (see [Undo, redo & history](/using-the-playground/undo-and-history/)). |
 | `--demo` | Turn on demonstration mode — a teaching aid that briefly shows an on-screen badge for keys that otherwise leave no visible mark (Tab, Enter, the arrows, and the like). Useful for screencasts and for demonstrating the playground to a class. Off by default. |
 | `--log-file <PATH>` | Write diagnostic logging to `PATH`. |
+| `-V`, `--version` | Print the version and exit. |
 | `-h`, `--help` | Print the usage banner and exit. |
 
+Once the playground is running, the `version` command prints the same
+version line into the output panel — handy when you want to note which
+version you're on without leaving the app.
+
 ## Examples
 
 ```sh