diff --git a/README.md b/README.md
index e1cc1a6..b2874de 100644
--- a/README.md
+++ b/README.md
@@ -45,6 +45,7 @@ or miss one that does. A test fails the build when it drifts.
 | `moshcode pwd` <br>`where` | system | show the current directory and git context |
 | `moshcode engines` | engines | list engines and installation status |
 | `moshcode tools` | tools | list workflow tools and installation status |
+| `moshcode trade` | tools | look up markets and trade through Alpaca |
 | `moshcode commands` | script | list built-in moshscript commands |
 | `moshcode completion` | extend | print a shell completion script |
 | `moshcode run` | script | run a moshscript |
@@ -154,6 +155,59 @@ native setup and authentication commands. CoinPay currently requires Node.js
 In the TUI, use `/tools`, `/ugig [args…]`, or `/coinpay [args…]`. The native CLI
 owns the terminal until it exits, then MoshCode returns to the pit.
 
+### Alpaca trading
+
+Alpaca is a workflow tool, not a coding engine. Install its official Go CLI,
+use `alpaca` for exact native passthrough, or use `trade` for the shorter market
+and order vocabulary:
+
+```sh
+moshcode install alpaca            # go install github.com/alpacahq/cli/cmd/alpaca@latest
+moshcode trade login               # Alpaca profile login; paper trading is the default
+moshcode trade ticker AAPL         # asset get --symbol-or-asset-id AAPL
+moshcode trade quote AAPL          # latest quote
+moshcode trade analysis AAPL       # quote/trade/bar snapshot for analysis
+moshcode trade watch               # list watchlists
+moshcode trade positions           # list open positions
+moshcode trade orders              # list open orders
+```
+
+`buy` and `sell` are safe previews unless `--submit` is explicit. Other Alpaca
+order flags pass through, including limit prices and its separate live-trading
+opt-in:
+
+```sh
+moshcode trade buy AAPL 1                          # adds --type market --dry-run
+moshcode trade buy AAPL 1 --type limit --limit-price 185
+moshcode trade buy AAPL --notional 100              # preview a $100 market buy
+moshcode trade buy AAPL 1 --submit                 # places the paper order
+moshcode trade raw data news --symbol AAPL         # any native Alpaca command
+moshcode alpaca order submit --help                # exact native passthrough
+```
+
+The same facade is `/trade …` in the pit and `trade(…)` in moshscript.
+Alpaca's CLI has no confirmation prompts; `--submit` intentionally removes
+MoshCode's preview guard. Live trading additionally requires Alpaca's `--live`
+opt-in or corresponding environment setting.
+
+### Social posting from the pit
+
+The pit can hand a prepared post to Bluesky or Nostr without storing either
+account's credentials in MoshCode:
+
+```text
+/socials
+/post bsky "shipped it 🤘"
+/post nostr "shipped it 🤘"
+```
+
+Bluesky opens its official compose intent. Nostr opens the MoshCode composer,
+connects to a NIP-07 browser signer (or a NIP-46 bunker through
+[`window.nostr.js`](https://github.com/fiatjaf/window.nostr.js)), signs a kind-1
+event, and publishes it to the displayed relays. Both flows leave the final
+confirmation in the browser. If the pit is remote or headless, `/post` prints
+the composer URL instead.
+
 ## Browser terminal (`moshcode console`)
 
 A real terminal in the browser — arrow keys, history, full-screen TUIs — because
diff --git a/apps/pwa/src/lib/moshpit-name.mjs b/apps/pwa/src/lib/moshpit-name.mjs
index f7be06c..7b52d1a 100644
--- a/apps/pwa/src/lib/moshpit-name.mjs
+++ b/apps/pwa/src/lib/moshpit-name.mjs
@@ -95,6 +95,68 @@ export function parseMoshpitName(input) {
   return { label: normalizedLabel, tld: normalizedTld };
 }
 
+/**
+ * A label as the records table may hold it: an ordinary label, or the wildcard
+ * form `*.<label>`.
+ *
+ * `*` is legal as the whole leftmost label of a record name and nowhere else.
+ * `*.chovy` is "every name under chovy", which is a thing DNS has always been
+ * able to say; `ch*vy` or `*.*` is nothing, and a parser that guessed at it
+ * would publish a record no resolver will ever match.
+ *
+ * Registration does not use this — moshpit_names stays strictly one label, and
+ * normalizeLabel is still the only door into it. This is for the paths that
+ * read and write DNS records, where a wildcard is a record name, not a name.
+ */
+export function normalizeRecordLabel(input) {
+  const raw = String(input ?? "").trim().toLowerCase();
+  if (!raw.startsWith("*.")) return normalizeLabel(raw);
+  const parent = normalizeLabel(raw.slice(2));
+  return parent ? `*.${parent}` : null;
+}
+
+/**
+ * A name as the record and resolve paths may see it: everything
+ * parseMoshpitName accepts, plus one more label on the left.
+ *
+ * `foo.chovy.hacker` comes back as tld "hacker", label "foo.chovy" — the
+ * records table keys on (tld, label), so a third-level name needs no new
+ * shape, only a second dot in the label half. The wildcard spelling
+ * `*.chovy.hacker` is the same with `*` as the leftmost label, and it is the
+ * only place `*` may stand.
+ *
+ * Returned alongside: `sub`, the leftmost label as written (null for a
+ * two-label name), and `parent`, the registered name the wildcard hangs off —
+ * `foo.chovy.hacker` is answered by the records of `*.chovy`, never by
+ * registering `foo.chovy`, because registration stays two labels.
+ *
+ * parseMoshpitName is deliberately untouched: registration, pricing and the
+ * bulk-claim list all keep the strict two-label rule, and only the paths that
+ * answer DNS questions take this one.
+ */
+export function parseMoshpitQueryName(input) {
+  const raw = String(input ?? "").trim().toLowerCase().replace(/^\.+/, "").replace(/\.+$/, "");
+  if (!raw) return null;
+  const parts = raw.split(".");
+  if (parts.length === 2) {
+    const name = parseMoshpitName(raw);
+    return name ? { ...name, sub: null, parent: name.label, wildcard: false } : null;
+  }
+  if (parts.length !== 3) return null;
+  const [sub, parentLabel, ending] = parts;
+  const parent = normalizeLabel(parentLabel);
+  const tld = normalizeTld(ending);
+  if (!parent || !tld) return null;
+  if (sub !== "*" && !normalizeLabel(sub)) return null;
+
+  // The same IPv4-literal guard parseMoshpitName applies, on the registered
+  // half: `foo.1.420` reads as an address with something in front of it.
+  if (/^\d+$/.test(parent) && /^\d+$/.test(tld)) return null;
+
+  const left = sub === "*" ? "*" : normalizeLabel(sub);
+  return { label: `${left}.${parent}`, tld, sub: left, parent, wildcard: sub === "*" };
+}
+
 /**
  * Labels worth offering under an ending that has nothing under it yet.
  *
diff --git a/apps/pwa/src/moshpit.mjs b/apps/pwa/src/moshpit.mjs
index 91d2b6d..bce788a 100644
--- a/apps/pwa/src/moshpit.mjs
+++ b/apps/pwa/src/moshpit.mjs
@@ -19,8 +19,10 @@ import {
   MAX_BULK_TLDS,
   MAX_CHILD_PRICE_USD,
   normalizeLabel,
+  normalizeRecordLabel,
   normalizeTld,
   parseMoshpitName,
+  parseMoshpitQueryName,
   parseTldList,
   tldRejection,
 } from "./lib/moshpit-name.mjs";
@@ -32,8 +34,8 @@ import {
 } from "./lib/moshpit-records.mjs";
 
 export {
-  RESERVED_TLDS, RESOLVE_MODES, MAX_BULK_TLDS, BULK_CHUNK, BULK_TIME_BUDGET_MS, shortCount, DEFAULT_TLD_PRICE_USD, MAX_CHILD_PRICE_USD, CHILD_PRICE_USD, ENDING_PRICE_USD, normalizeLabel, normalizeTld, parseMoshpitName,
-  parseTldList, tldRejection, normalizeMode, resolutionPreference, STARTER_LABELS, suggestedLabels,
+  RESERVED_TLDS, RESOLVE_MODES, MAX_BULK_TLDS, BULK_CHUNK, BULK_TIME_BUDGET_MS, shortCount, DEFAULT_TLD_PRICE_USD, MAX_CHILD_PRICE_USD, CHILD_PRICE_USD, ENDING_PRICE_USD, normalizeLabel, normalizeRecordLabel, normalizeTld, parseMoshpitName,
+  parseMoshpitQueryName, parseTldList, tldRejection, normalizeMode, resolutionPreference, STARTER_LABELS, suggestedLabels,
 } from "./lib/moshpit-name.mjs";
 
 export {
@@ -380,7 +382,11 @@ export async function releaseName({ tld: tldInput, label: labelInput, userId })
   await run(`DELETE FROM moshpit_name_pins WHERE tld = ? AND label = ?`, [owned.tld, owned.label]);
   // Records go with the name for the same reason, and it matters more: an
   // inherited MX would route the next holder's mail to the last one's server.
-  await run(`DELETE FROM moshpit_records WHERE tld = ? AND label = ?`, [owned.tld, owned.label]);
+  // The wildcard hangs off the name rather than existing beside it, so
+  // `*.chovy`'s records go too — an inherited one would answer for every
+  // subdomain of a name whose owner just changed.
+  await run(`DELETE FROM moshpit_records WHERE tld = ? AND (label = ? OR label = ?)`,
+    [owned.tld, owned.label, `*.${owned.label}`]);
   await run(`DELETE FROM moshpit_names WHERE tld = ? AND label = ?`, [owned.tld, owned.label]);
   await logAction(owned.tld, userId, `unname:${owned.label}`);
   return { ok: true };
@@ -396,6 +402,23 @@ async function ownedName(tldInput, labelInput, userId) {
   return { ok: true, tld, label };
 }
 
+/**
+ * Ownership of the name a record goes on — including the wildcard form.
+ *
+ * Records for `*.chovy` are authorized by owning `chovy`: the wildcard answers
+ * for everything under the name, so it belongs to whoever the name belongs to.
+ * The wildcard label itself is what comes back, because that is the key the
+ * records table stores — the parent only decided whether you may write there.
+ */
+async function ownedRecordName(tldInput, labelInput, userId) {
+  const tld = normalizeTld(tldInput);
+  const label = normalizeRecordLabel(labelInput);
+  if (!tld || !label) return { ok: false, error: "not a valid name" };
+  const owned = await ownedName(tld, label.startsWith("*.") ? label.slice(2) : label, userId);
+  if (!owned.ok) return owned;
+  return { ok: true, tld, label };
+}
+
 /* ---- selling names under a TLD ---- */
 
 /**
@@ -611,13 +634,20 @@ export async function listNamePurchases(userId, limit = 50) {
  * under it keeps its own identity on the other side.
  */
 export async function resolveMoshpitName(input) {
-  const parsed = parseMoshpitName(input);
+  const parsed = parseMoshpitQueryName(input);
   if (!parsed) return null;
   const { label, tld } = parsed;
   const name = `${label}.${tld}`;
 
   const owner = await getTld(tld);
-  if (!owner) return { name, resolved: name, aliased: false, registered: false, name_registered: false, target: null };
+  if (!owner) {
+    // A third-level name under an ending nobody holds is not a name at all:
+    // null, so the API's callers say "not a Moshpit name" rather than parking
+    // something the pit has no authority over. Two-label names keep the old
+    // answer — the extension's precedence rule reads `registered` off it.
+    if (parsed.sub) return null;
+    return { name, resolved: name, aliased: false, registered: false, name_registered: false, target: null };
+  }
 
   // Where the name ends up: itself, unless the TLD points elsewhere and this
   // name is not held back from that alias. Exemption is checked at read time,
@@ -626,6 +656,28 @@ export async function resolveMoshpitName(input) {
   const resolvedTld = aliased ? owner.alias_of : tld;
   const resolved = `${label}.${resolvedTld}`;
 
+  // A third-level name has no moshpit_names row — registration is strictly two
+  // labels. What it can have is records: its own exact set, or the wildcard
+  // set of its parent. With neither it does not exist at all, and null is how
+  // a resolver hears NXDOMAIN rather than "parked" — a parked answer would
+  // send every typo under a real name to the for-sale page.
+  if (parsed.sub) {
+    const found = await recordsWithWildcard(resolvedTld, label);
+    if (!found.records.length) return null;
+    return {
+      name,
+      resolved,
+      aliased,
+      registered: true,
+      // The name "exists" in the only way a third-level name can: something
+      // answers for it. `target` is derived from those records the same way
+      // addRecord derives it for a registered name, so a wildcard AAAA is the
+      // address answer exactly as an exact AAAA would be.
+      name_registered: true,
+      target: effectiveTarget(null, found.records),
+    };
+  }
+
   // The name is looked up on the TLD it actually resolves to -- that is the one
   // whose operator mints names there, so it is the only place the answer can
   // legitimately come from.
@@ -777,12 +829,40 @@ const RECORD_ORDER = `CASE type WHEN 'AAAA' THEN 0 WHEN 'CNAME' THEN 1 WHEN 'MX'
 
 export async function listRecords(tldInput, labelInput) {
   const tld = normalizeTld(tldInput);
-  const label = normalizeLabel(labelInput);
-  if (!tld || !label) return [];
+  // Read by the label exactly as stored — an ordinary label, the wildcard
+  // `*.chovy`, or a third-level `foo.chovy` on the exact side of a wildcard
+  // lookup. Writes are the strict half (normalizeRecordLabel, in addRecord);
+  // a read that re-validated the key could never see a third-level row at all.
+  const label = String(labelInput ?? "").trim().toLowerCase();
+  if (!tld || !label || label.length > 127) return [];
   return all(`SELECT ${RECORD_COLS} FROM moshpit_records WHERE tld = ? AND label = ?
               ORDER BY ${RECORD_ORDER}`, [tld, label]);
 }
 
+/**
+ * The set a query for (tld, label) answers with, wildcard and all.
+ *
+ * Lookup order is DNS's own: the exact name first, then the wildcard of the
+ * parent. `foo.chovy` under `hacker` is answered by records stored as
+ * (hacker, "foo.chovy") when it has any — there normally are none, because a
+ * third-level name cannot be registered and only the wildcard form can be
+ * published — and otherwise by (hacker, "*.chovy"), answered AS the asked
+ * name, which is what a wildcard means everywhere else in DNS too.
+ *
+ * A two-label name and the wildcard name itself are exact lookups: `*.chovy`
+ * does not answer for `chovy`, and nothing answers for `*.chovy` but its own
+ * records.
+ */
+export async function recordsWithWildcard(tld, label) {
+  if (!String(label).includes(".") || String(label).startsWith("*.")) {
+    return { label, records: await listRecords(tld, label) };
+  }
+  const exact = await listRecords(tld, label);
+  if (exact.length) return { label, records: exact };
+  const wildcard = `*.${String(label).slice(String(label).indexOf(".") + 1)}`;
+  return { label: wildcard, records: await listRecords(tld, wildcard) };
+}
+
 /**
  * The records a resolver should answer with for `scrambled.eggs`.
  *
@@ -798,7 +878,7 @@ export async function recordsForName(input) {
   const resolution = await resolveMoshpitName(input);
   if (!resolution || !resolution.registered) return null;
 
-  const parsed = parseMoshpitName(resolution.resolved);
+  const parsed = parseMoshpitQueryName(resolution.resolved);
   if (!parsed) return null;
 
   return {
@@ -808,7 +888,7 @@ export async function recordsForName(input) {
     label: parsed.label,
     name_registered: resolution.name_registered,
     target: resolution.target,
-    records: await listRecords(parsed.tld, parsed.label),
+    records: (await recordsWithWildcard(parsed.tld, parsed.label)).records,
   };
 }
 
@@ -825,7 +905,7 @@ export async function recordsForName(input) {
  * what they wanted.
  */
 export async function addRecord({ tld: tldInput, label: labelInput, type, value, ttl, priority, userId }) {
-  const owned = await ownedName(tldInput, labelInput, userId);
+  const owned = await ownedRecordName(tldInput, labelInput, userId);
   if (!owned.ok) return owned;
 
   const name = `${owned.label}.${owned.tld}`;
@@ -860,7 +940,13 @@ export async function addRecord({ tld: tldInput, label: labelInput, type, value,
   // name with a perfectly good AAAA record would still resolve to the parking
   // page. Never the other way: an owner who typed a target is not overruled by
   // a record they added afterwards.
-  if (!(await getName(owned.tld, owned.label))?.target) {
+  //
+  // A wildcard has no moshpit_names row to mirror into — `*.chovy` is not a
+  // registered name, and writing the parent's target would answer for the
+  // parent itself, which the wildcard deliberately does not do. Its address
+  // answer is derived from the records at resolve time instead, by
+  // resolveMoshpitName, through the same effectiveTarget rule.
+  if (!owned.label.startsWith("*.") && !(await getName(owned.tld, owned.label))?.target) {
     const target = effectiveTarget(null, await listRecords(owned.tld, owned.label));
     if (target) await run(`UPDATE moshpit_names SET target = ? WHERE tld = ? AND label = ?`, [target, owned.tld, owned.label]);
   }
@@ -877,7 +963,7 @@ export async function addRecord({ tld: tldInput, label: labelInput, type, value,
  * that already knows exactly which record it means.
  */
 export async function removeRecord({ tld: tldInput, label: labelInput, type, value, userId }) {
-  const owned = await ownedName(tldInput, labelInput, userId);
+  const owned = await ownedRecordName(tldInput, labelInput, userId);
   if (!owned.ok) return owned;
 
   const wanted = normalizeRecordType(type);
diff --git a/apps/pwa/src/routes/moshpit.mjs b/apps/pwa/src/routes/moshpit.mjs
index b567d43..9be06fb 100644
--- a/apps/pwa/src/routes/moshpit.mjs
+++ b/apps/pwa/src/routes/moshpit.mjs
@@ -61,9 +61,11 @@ import {
   normalizeLabel,
   normalizeMode,
   normalizePinKind,
+  normalizeRecordLabel,
   normalizeTld,
   openNamePurchase,
   parseMoshpitName,
+  parseMoshpitQueryName,
   PIN_KINDS,
   pinsForName,
   popularLabels,
@@ -71,6 +73,7 @@ import {
   RECORD_HELP,
   RECORD_TYPES,
   recordsForName,
+  recordsWithWildcard,
   registerName,
   registerTld,
   registerTlds,
@@ -348,7 +351,9 @@ moshpitRouter.get("/api/moshpit/records", async (req, res) => {
 /** GET /api/moshpit/tlds/:tld/records?label=blue — public, unresolved and exact. */
 moshpitRouter.get("/api/moshpit/tlds/:tld/records", async (req, res) => {
   const tld = normalizeTld(req.params.tld);
-  const label = normalizeLabel(req.query.label);
+  // normalizeRecordLabel, not normalizeLabel: `*.chovy` is a name this table
+  // can hold, and the owner reads it back through the same route they wrote it.
+  const label = normalizeRecordLabel(req.query.label);
   if (!tld) return bad(res, "not a valid TLD");
   if (!label) return bad(res, "which name? pass ?label=");
   res.json({ tld, label, records: await listRecords(tld, label) });
@@ -371,7 +376,7 @@ moshpitRouter.post("/api/moshpit/tlds/:tld/records", async (req, res) => {
     const conflict = /CNAME/.test(result.error || "");
     return bad(res, result.error || "could not publish that record", conflict ? 409 : 400);
   }
-  res.status(201).json({ tld: normalizeTld(req.params.tld), label: normalizeLabel(req.body?.label), record: result.record });
+  res.status(201).json({ tld: normalizeTld(req.params.tld), label: normalizeRecordLabel(req.body?.label), record: result.record });
 });
 
 /** DELETE /api/moshpit/tlds/:tld/records { label, type, value } */
@@ -382,7 +387,7 @@ moshpitRouter.delete("/api/moshpit/tlds/:tld/records", async (req, res) => {
     type: req.body?.type, value: req.body?.value,
   });
   if (!result.ok) return bad(res, result.error || "could not withdraw that record", 404);
-  res.json({ tld: normalizeTld(req.params.tld), label: normalizeLabel(req.body?.label), removed: true });
+  res.json({ tld: normalizeTld(req.params.tld), label: normalizeRecordLabel(req.body?.label), removed: true });
 });
 
 /* ---- serving a name over the clearnet ---- */
@@ -1064,9 +1069,13 @@ moshpitRouter.get("/api/moshpit/resolve", async (req, res) => {
   // wants an address (which is all the bridge and the DoH server ask for) must
   // not pay for a lookup it will throw away. Callers that want the whole set
   // ask for it, or use /api/moshpit/records.
-  const resolved = parseMoshpitName(resolution.resolved);
+  //
+  // recordsWithWildcard rather than listRecords: a third-level name answers
+  // with its own records when it has them and its parent's wildcard set
+  // otherwise, and the answer has to be the same one recordsForName gives.
+  const resolved = parseMoshpitQueryName(resolution.resolved);
   const records = req.query.records && resolution.name_registered && resolved
-    ? await listRecords(resolved.tld, resolved.label)
+    ? (await recordsWithWildcard(resolved.tld, resolved.label)).records
     : null;
 
   res.json({
diff --git a/apps/pwa/src/routes/socials.mjs b/apps/pwa/src/routes/socials.mjs
new file mode 100644
index 0000000..760ca1b
--- /dev/null
+++ b/apps/pwa/src/routes/socials.mjs
@@ -0,0 +1,124 @@
+// Browser-side social composers. The CLI only hands a draft to these pages;
+// account authorization and the final publish stay in the user's browser.
+import { Router } from "express";
+import { page, footer } from "../lib/html.mjs";
+
+export const socialsRouter = Router();
+
+export const NOSTR_RELAYS = [
+  "wss://relay.damus.io",
+  "wss://nos.lol",
+  "wss://relay.primal.net",
+];
+
+export function nostrComposerPage() {
+  const relays = JSON.stringify(NOSTR_RELAYS);
+  const body = `
+  <header class="bar"><div class="wrap bar-inner">
+    <a class="brand" href="/"><span class="mark">M</span>MOSHCODE<span class="app">socials</span></a>
+    <a class="btn" href="/">Back to the pit</a>
+  </div></header>
+  <main class="wrap" style="max-width:760px;padding:44px 0 64px">
+    <div class="label acid" style="margin-bottom:10px">NOSTR · KIND 1</div>
+    <h1 style="font-size:2rem;margin:0 0 10px">Post from the pit.</h1>
+    <p class="dim mono" style="margin:0 0 24px;line-height:1.65">Your draft stayed in the URL fragment—it was never sent to MoshCode. Connect a browser signer, review the text, then publish it to the relays below.</p>
+
+    <div class="card">
+      <div class="card-head"><span class="h">Draft</span><span class="pill" id="count">0 chars</span></div>
+      <div class="card-body">
+        <textarea id="message" rows="8" autofocus placeholder="what's moshing?" style="width:100%;resize:vertical"></textarea>
+        <div style="display:flex;gap:10px;align-items:center;flex-wrap:wrap;margin-top:14px">
+          <button class="btn acid" id="publish" type="button">Connect signer + publish</button>
+          <span class="mono dim" id="status" role="status" aria-live="polite">nothing is posted until you click</span>
+        </div>
+      </div>
+    </div>
+
+    <div class="card" style="margin-top:18px">
+      <div class="card-head"><span class="h">Relays</span><span class="pill">publish to any that accept</span></div>
+      <div class="card-body mono dim" style="font-size:.78rem;line-height:1.8">
+        ${NOSTR_RELAYS.map((relay) => `<div><span class="beat"></span> ${relay}</div>`).join("")}
+      </div>
+    </div>
+  </main>${footer}
+
+  <script>
+    window.wnjParams = { position: "bottom", accent: "green", compactMode: true };
+  </script>
+  <script src="https://cdn.jsdelivr.net/npm/window.nostr.js@0.5.0/dist/window.nostr.min.js"></script>
+  <script>
+    (function () {
+      var RELAYS = ${relays};
+      var message = document.getElementById("message");
+      var publish = document.getElementById("publish");
+      var status = document.getElementById("status");
+      var count = document.getElementById("count");
+      message.value = new URLSearchParams(location.hash.slice(1)).get("text") || "";
+
+      function recount() { count.textContent = Array.from(message.value).length + " chars" }
+      recount();
+      message.addEventListener("input", recount);
+
+      function sendToRelay(relay, event) {
+        return new Promise(function (resolve) {
+          var settled = false;
+          var ws;
+          function done(ok, detail) {
+            if (settled) return;
+            settled = true;
+            clearTimeout(timer);
+            try { ws.close() } catch (_) {}
+            resolve({ relay: relay, ok: ok, detail: detail || "" });
+          }
+          var timer = setTimeout(function () { done(false, "timeout") }, 8000);
+          try { ws = new WebSocket(relay) } catch (error) { done(false, error.message); return }
+          ws.addEventListener("open", function () { ws.send(JSON.stringify(["EVENT", event])) });
+          ws.addEventListener("message", function (incoming) {
+            try {
+              var reply = JSON.parse(incoming.data);
+              if (reply[0] === "OK" && reply[1] === event.id) done(Boolean(reply[2]), String(reply[3] || ""));
+            } catch (_) {}
+          });
+          ws.addEventListener("error", function () { done(false, "connection failed") });
+          ws.addEventListener("close", function () { done(false, "closed without an acknowledgement") });
+        });
+      }
+
+      publish.addEventListener("click", async function () {
+        var content = message.value.trim();
+        if (!content) { status.textContent = "write something first"; message.focus(); return }
+        publish.disabled = true;
+        status.textContent = "waiting for your signer…";
+        try {
+          if (!window.nostr) throw new Error("no Nostr signer is available in this browser");
+          var pubkey = await window.nostr.getPublicKey();
+          var event = await window.nostr.signEvent({
+            kind: 1,
+            created_at: Math.floor(Date.now() / 1000),
+            tags: [],
+            content: content,
+            pubkey: pubkey
+          });
+          status.textContent = "signed—publishing to relays…";
+          var results = await Promise.all(RELAYS.map(function (relay) { return sendToRelay(relay, event) }));
+          var accepted = results.filter(function (result) { return result.ok });
+          if (!accepted.length) {
+            var reasons = results.map(function (result) { return result.relay + ": " + result.detail }).join(" · ");
+            throw new Error("no relay accepted the event (" + reasons + ")");
+          }
+          status.textContent = "published to " + accepted.length + "/" + RELAYS.length + " relays 🤘";
+          publish.textContent = "Published";
+        } catch (error) {
+          status.textContent = error && error.message ? error.message : String(error);
+          publish.disabled = false;
+        }
+      });
+    })();
+  </script>`;
+
+  return page({ title: "moshcode ▸ post to Nostr", body });
+}
+
+socialsRouter.get("/socials/nostr", (_req, res) => {
+  res.type("html").send(nostrComposerPage());
+});
diff --git a/apps/pwa/src/server.mjs b/apps/pwa/src/server.mjs
index 7b94e90..9cc8dd7 100644
--- a/apps/pwa/src/server.mjs
+++ b/apps/pwa/src/server.mjs
@@ -14,6 +14,7 @@ import { cliRouter } from "./routes/cli.mjs";
 import { sessionsRouter } from "./routes/sessions.mjs";
 import { pagesRouter } from "./routes/pages.mjs";
 import { moshpitRouter } from "./routes/moshpit.mjs";
+import { socialsRouter } from "./routes/socials.mjs";
 
 const app = express();
 app.disable("x-powered-by");
@@ -54,6 +55,7 @@ app.use(creditsRouter);
 app.use(cliRouter);       // /cli/authorize, /cli/token, /api/me
 app.use(sessionsRouter);  // /sessions (live CLI mirror) + /api/sessions
 app.use(pagesRouter);     // /app, /settings
+app.use(socialsRouter);   // public browser composers used by /post
 app.use(moshpitRouter);  // /pit + /api/moshpit/* — the namespace
 
 app.use((req, res) => res.status(404).type("html").send(
diff --git a/apps/pwa/test/moshpit-name.test.mjs b/apps/pwa/test/moshpit-name.test.mjs
index 7357bf6..dbd794c 100644
--- a/apps/pwa/test/moshpit-name.test.mjs
+++ b/apps/pwa/test/moshpit-name.test.mjs
@@ -5,8 +5,8 @@ import assert from "node:assert/strict";
 import test from "node:test";
 
 import {
-  RESERVED_TLDS, normalizeLabel, normalizeTld, tldRejection, parseMoshpitName,
-  normalizeMode, resolutionPreference,
+  RESERVED_TLDS, normalizeLabel, normalizeRecordLabel, normalizeTld, tldRejection, parseMoshpitName,
+  parseMoshpitQueryName, normalizeMode, resolutionPreference,
 } from "../src/lib/moshpit-name.mjs";
 
 test("normalizeTld accepts what people actually type", () => {
@@ -65,6 +65,38 @@ test("parseMoshpitName splits exactly one dot", () => {
   assert.equal(parseMoshpitName("-bad.agentic"), null);
 });
 
+test("parseMoshpitQueryName takes one more label on the left, for the record paths only", () => {
+  assert.deepEqual(parseMoshpitQueryName("blue.eggs"),
+    { label: "blue", tld: "eggs", sub: null, parent: "blue", wildcard: false });
+  // The records table keys on (tld, label), so a third-level name is a dotted
+  // label — no new shape, and `parent` names the registered name it hangs off.
+  assert.deepEqual(parseMoshpitQueryName("foo.chovy.hacker"),
+    { label: "foo.chovy", tld: "hacker", sub: "foo", parent: "chovy", wildcard: false });
+  assert.deepEqual(parseMoshpitQueryName("*.chovy.hacker"),
+    { label: "*.chovy", tld: "hacker", sub: "*", parent: "chovy", wildcard: true });
+
+  // `*` is the whole leftmost label or it is nothing.
+  assert.equal(parseMoshpitQueryName("f*.chovy.hacker"), null);
+  assert.equal(parseMoshpitQueryName("foo.*.hacker"), null);
+  assert.equal(parseMoshpitQueryName("*.*.hacker"), null);
+  assert.equal(parseMoshpitQueryName("a.b.c.d"), null, "two levels deep at most");
+  assert.equal(parseMoshpitQueryName("foo.1.420"), null, "the IPv4-literal guard still holds");
+
+  // Registration is not weakened: the strict parser still refuses all of this.
+  assert.equal(parseMoshpitName("foo.chovy.hacker"), null);
+  assert.equal(parseMoshpitName("*.chovy.hacker"), null);
+});
+
+test("normalizeRecordLabel takes a label or the wildcard form of one", () => {
+  assert.equal(normalizeRecordLabel("chovy"), "chovy");
+  assert.equal(normalizeRecordLabel("*.chovy"), "*.chovy");
+  assert.equal(normalizeRecordLabel("*.CHOVY"), "*.chovy");
+  assert.equal(normalizeRecordLabel("*"), null);
+  assert.equal(normalizeRecordLabel("ch*vy"), null);
+  assert.equal(normalizeRecordLabel("*.*"), null);
+  assert.equal(normalizeRecordLabel(""), null);
+});
+
 /* ---- resolution precedence: the tronbrowser.dev setting ---- */
 
 test("mode defaults to clearnet, including for junk input", () => {
diff --git a/apps/pwa/test/moshpit-records.test.mjs b/apps/pwa/test/moshpit-records.test.mjs
index c8809f2..948aaf8 100644
--- a/apps/pwa/test/moshpit-records.test.mjs
+++ b/apps/pwa/test/moshpit-records.test.mjs
@@ -266,3 +266,105 @@ test("moshpit records: publishing them", { skip: installed ? false : "pwa depend
 
   await run(`DELETE FROM moshpit_records`);
 });
+
+/* ---------- the wildcard: records for everything under a name ---------- */
+
+test("moshpit records: the wildcard", { skip: installed ? false : "pwa dependencies not installed" }, async (t) => {
+  const { moshpit, run } = await boot();
+
+  const claimed = await moshpit.registerTld({ tld: "hacker", userId: ALICE, ownerEmail: "alice@example.com" });
+  assert.equal(claimed.ok, true, claimed.error);
+  await moshpit.registerName({ tld: "hacker", label: "chovy", userId: ALICE });
+
+  await t.test("the parent's owner publishes it, stored as `*.chovy`", async () => {
+    const added = await moshpit.addRecord({ tld: "hacker", label: "*.chovy", userId: ALICE, type: "AAAA", value: V6 });
+    assert.equal(added.ok, true, added.error);
+    const records = await moshpit.listRecords("hacker", "*.chovy");
+    assert.deepEqual(records.map((r) => [r.type, r.value]), [["AAAA", V6]]);
+
+    // The wildcard is not the parent: the apex itself publishes nothing, and
+    // no target is mirrored onto it — `*.chovy` answers for what is under
+    // chovy, never for chovy.
+    assert.deepEqual(await moshpit.listRecords("hacker", "chovy"), []);
+    assert.equal((await moshpit.getName("hacker", "chovy")).target, null);
+  });
+
+  await t.test("only the parent's owner may publish or withdraw it", async () => {
+    const added = await moshpit.addRecord({ tld: "hacker", label: "*.chovy", userId: BOB, type: "TXT", value: "mine" });
+    assert.equal(added.ok, false);
+    assert.match(added.error, /do not own/);
+
+    const removed = await moshpit.removeRecord({ tld: "hacker", label: "*.chovy", userId: BOB, type: "AAAA", value: V6 });
+    assert.equal(removed.ok, false);
+    assert.match(removed.error, /do not own/);
+    assert.equal((await moshpit.listRecords("hacker", "*.chovy")).length, 1, "bob withdrew nothing");
+  });
+
+  await t.test("`*` is a whole leftmost label or it is refused", async () => {
+    for (const label of ["*", "ch*vy", "*.*", "foo.*"]) {
+      const result = await moshpit.addRecord({ tld: "hacker", label, userId: ALICE, type: "TXT", value: "x" });
+      assert.equal(result.ok, false, `${label} was accepted`);
+    }
+    // Registration keeps refusing it everywhere — a wildcard is a record name,
+    // never a name.
+    assert.equal((await moshpit.registerName({ tld: "hacker", label: "*", userId: ALICE })).ok, false);
+  });
+
+  await t.test("every name under chovy answers with the wildcard's records, as itself", async () => {
+    const found = await moshpit.recordsForName("foo.chovy.hacker");
+    assert.equal(found.name, "foo.chovy.hacker");
+    assert.equal(found.name_registered, true);
+    assert.deepEqual(found.records.map((r) => [r.type, r.value]), [["AAAA", V6]]);
+
+    // The wildcard's address is the effective target, through the same
+    // effectiveTarget rule a registered name's first AAAA takes.
+    const resolution = await moshpit.resolveMoshpitName("foo.chovy.hacker");
+    assert.equal(resolution.target, V6);
+    assert.equal(resolution.name_registered, true);
+  });
+
+  await t.test("an exact third-level record beats the wildcard", async () => {
+    // No route publishes one — a third-level name cannot be registered — but
+    // the table can hold it and the lookup order is DNS's own: exact, then
+    // wildcard.
+    await run(`INSERT INTO moshpit_records (tld, label, type, value, ttl, priority, user_id, created_at)
+               VALUES ('hacker', 'foo.chovy', 'TXT', 'exact', 300, NULL, ?, ?)`, [ALICE, Date.now()]);
+
+    const found = await moshpit.recordsForName("foo.chovy.hacker");
+    assert.deepEqual(found.records.map((r) => r.value), ["exact"]);
+    // A sibling without its own records still gets the wildcard's answer.
+    const other = await moshpit.recordsForName("bar.chovy.hacker");
+    assert.deepEqual(other.records.map((r) => r.value), [V6]);
+  });
+
+  await t.test("no wildcard is not-exists, even when the parent is real", async () => {
+    await moshpit.registerName({ tld: "hacker", label: "plain", userId: ALICE });
+    assert.equal(await moshpit.resolveMoshpitName("foo.plain.hacker"), null);
+    assert.equal(await moshpit.recordsForName("foo.plain.hacker"), null);
+  });
+
+  await t.test("the wildcard's own name answers with its own records", async () => {
+    const found = await moshpit.recordsForName("*.chovy.hacker");
+    assert.deepEqual(found.records.map((r) => r.value), [V6]);
+  });
+
+  await t.test("withdrawing the wildcard's record makes the subdomains not-exists again", async () => {
+    const gone = await moshpit.removeRecord({ tld: "hacker", label: "*.chovy", userId: ALICE, type: "AAAA", value: V6 });
+    assert.equal(gone.ok, true, gone.error);
+    // foo.chovy still has its exact TXT, so it answers; bar has nothing left.
+    assert.equal(await moshpit.resolveMoshpitName("bar.chovy.hacker"), null);
+    assert.equal((await moshpit.recordsForName("foo.chovy.hacker")).records.length, 1);
+  });
+
+  await t.test("a released name takes its wildcard with it", async () => {
+    await moshpit.registerName({ tld: "hacker", label: "temp", userId: ALICE });
+    await moshpit.addRecord({ tld: "hacker", label: "*.temp", userId: ALICE, type: "TXT", value: "gone soon" });
+    await moshpit.releaseName({ tld: "hacker", label: "temp", userId: ALICE });
+
+    // Same rule as the records on the name itself: the next holder of temp
+    // must not inherit answers for everything under it.
+    assert.deepEqual(await moshpit.listRecords("hacker", "*.temp"), []);
+  });
+
+  await run(`DELETE FROM moshpit_records WHERE tld = 'hacker'`);
+});
diff --git a/apps/pwa/test/socials.test.mjs b/apps/pwa/test/socials.test.mjs
new file mode 100644
index 0000000..1cf36bd
--- /dev/null
+++ b/apps/pwa/test/socials.test.mjs
@@ -0,0 +1,24 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { NOSTR_RELAYS, nostrComposerPage } from "../src/routes/socials.mjs";
+
+test("Nostr composer loads the pinned NIP-07/NIP-46 bridge", () => {
+  const html = nostrComposerPage();
+  assert.match(html, /window\.nostr\.js@0\.5\.0\/dist\/window\.nostr\.min\.js/);
+  assert.match(html, /window\.nostr\.getPublicKey\(\)/);
+  assert.match(html, /window\.nostr\.signEvent\(/);
+});
+
+test("Nostr composer creates kind-1 events and publishes to every named relay", () => {
+  const html = nostrComposerPage();
+  assert.match(html, /kind: 1/);
+  assert.match(html, /\["EVENT", event\]/);
+  for (const relay of NOSTR_RELAYS) assert.ok(html.includes(relay), `${relay} is not rendered`);
+});
+
+test("Nostr composer reads the draft from the fragment", () => {
+  const html = nostrComposerPage();
+  assert.match(html, /location\.hash\.slice\(1\)/);
+  assert.doesNotMatch(html, /location\.search/);
+});
diff --git a/bin/moshcode.mjs b/bin/moshcode.mjs
index 32b3f73..855adea 100755
--- a/bin/moshcode.mjs
+++ b/bin/moshcode.mjs
@@ -15,6 +15,7 @@ import {
   runCmd,
 } from "../src/engines.mjs";
 import { TOOLS, toolList, toolStatus, resolveTool, openTool } from "../src/tools.mjs";
+import { tradeArgs, tradeUsage } from "../src/trade.mjs";
 import { runUpgrade } from "../src/upgrade.mjs";
 import { selfUpdateCommand } from "../src/selfupdate.mjs";
 import { describeUninstall, uninstallPlan } from "../src/uninstall.mjs";
@@ -317,6 +318,29 @@ async function main() {
     }
     return;
   }
+  if (cmd === "trade") {
+    const translated = tradeArgs(rest);
+    if (translated.usage) {
+      console.log(tradeUsage());
+      return;
+    }
+    if (translated.error) {
+      console.error(`${translated.error}\n\n${tradeUsage()}`);
+      process.exitCode = 1;
+      return;
+    }
+    const tool = TOOLS.alpaca;
+    const r = await openTool(tool, translated.args);
+    if (!r.ok) {
+      console.error(r.error?.code === "ENOENT"
+        ? `alpaca isn't installed (\`${tool.bin}\`). run: moshcode install alpaca`
+        : `launch failed: ${r.error?.message || r.error}`);
+      process.exitCode = 1;
+      return;
+    }
+    propagateExit(r.code, r.signal);
+    return;
+  }
   if (cmd === "console") {
     const code = await consoleCommand(rest);
     if (code) process.exitCode = code;
@@ -345,6 +369,7 @@ async function main() {
     const result = await runCmd(install.cmd, install.args);
     if (!result.ok) {
       console.error(`install failed: ${result.error?.message || result.error || "unknown error"}`);
+      if (result.error?.code === "ENOENT" && entry.installHelp) console.error(entry.installHelp);
       process.exitCode = 1;
       return;
     }
diff --git a/docs/hosting-a-moshpit-name.md b/docs/hosting-a-moshpit-name.md
index b357b09..af03583 100644
--- a/docs/hosting-a-moshpit-name.md
+++ b/docs/hosting-a-moshpit-name.md
@@ -153,8 +153,12 @@ the resolver will go to port 80 regardless of what the target says.
   colleague who hasn't installed it, not Googlebot, not a webhook from a payment
   provider. `pit.moshcode.sh/n/foo.whatever` is the URL to send people who have
   installed nothing — it fetches the target server-side and hands back the page.
-- **One level deep.** `foo.whatever` resolves; `www.foo.whatever` does not.
-  Moshpit names are exactly one label and one ending.
+- **One level deep, plus a wildcard.** `foo.whatever` resolves; `www.foo.whatever`
+  does not — unless you publish a record on `*.foo.whatever`, in which case
+  every name under yours answers with it, as the name that was asked. The
+  wildcard is a record name, not a name: registration stays exactly one label
+  and one ending, and `*` is legal only there. A name under yours with no
+  wildcard covering it is NXDOMAIN, even when `foo.whatever` itself is real.
 - **The gateway is not a file host.** It gives the origin 10 seconds and caps
   the body at 5 MB, strips cookies and `Authorization` in both directions, and
   sandboxes the result with CSP.
diff --git a/src/cli-schema.mjs b/src/cli-schema.mjs
index f97255a..d9c9914 100644
--- a/src/cli-schema.mjs
+++ b/src/cli-schema.mjs
@@ -267,6 +267,21 @@ export const CORE_CLI_COMMANDS = [
     flags: [["--json", "machine-readable, and suppresses the trailing note", ""]],
     seeAlso: ["install"],
   },
+  {
+    name: "trade",
+    group: "tools",
+    description: "look up markets and trade through Alpaca",
+    synopsis: [["moshcode trade <verb> [args…]", "paper trading is Alpaca's default"]],
+    verbs: "TRADE_VERBS",
+    examples: [
+      ["moshcode trade ticker AAPL", "asset lookup"],
+      ["moshcode trade analysis AAPL", "quote/trade/bar snapshot"],
+      ["moshcode trade buy AAPL 1", "preview a market order"],
+      ["moshcode trade buy AAPL 1 --submit", "place it"],
+    ],
+    seeAlso: ["tools", "install"],
+    note: "buy/sell inject --dry-run unless --submit is present. Alpaca defaults to paper trading; live trading requires its separate --live opt-in.",
+  },
   {
     name: "commands",
     group: "script",
@@ -395,6 +410,35 @@ export const UPGRADE_TARGETS = [
   { name: "tools", description: "update all installed workflow tools" },
 ];
 
+export const TRADE_VERBS = [
+  { name: "ticker", description: "look up an asset by ticker", synopsis: [["moshcode trade ticker <symbol> [flags…]", ""]] },
+  { name: "quote", description: "get the latest quote", synopsis: [["moshcode trade quote <symbol> [flags…]", ""]] },
+  { name: "analysis", description: "get an analysis-ready market snapshot", synopsis: [["moshcode trade analysis <symbol> [flags…]", ""]] },
+  {
+    name: "buy", description: "preview or submit a buy order",
+    synopsis: [
+      ["moshcode trade buy <symbol> <qty> [alpaca flags…] [--submit]", "share quantity"],
+      ["moshcode trade buy <symbol> --notional <usd> [--submit]", "dollar amount"],
+    ],
+    flags: [["--submit", "place the order instead of injecting --dry-run", "preview"]],
+  },
+  {
+    name: "sell", description: "preview or submit a sell order",
+    synopsis: [
+      ["moshcode trade sell <symbol> <qty> [alpaca flags…] [--submit]", "share quantity"],
+      ["moshcode trade sell <symbol> --notional <usd> [--submit]", "dollar amount"],
+    ],
+    flags: [["--submit", "place the order instead of injecting --dry-run", "preview"]],
+  },
+  { name: "watch", description: "manage watchlists", synopsis: [["moshcode trade watch [list|create|get|add|remove|delete] [args…]", ""]] },
+  { name: "positions", description: "list, inspect, or close positions", synopsis: [["moshcode trade positions [verb] [args…]", "default: list"]] },
+  { name: "orders", description: "list, inspect, replace, or cancel orders", synopsis: [["moshcode trade orders [verb] [args…]", "default: list"]] },
+  { name: "account", description: "show account details", synopsis: [["moshcode trade account [args…]", ""]] },
+  { name: "login", description: "authenticate an Alpaca profile", synopsis: [["moshcode trade login [alpaca profile flags…]", "paper by default"]] },
+  { name: "clock", description: "show market status and next open/close", synopsis: [["moshcode trade clock [args…]", ""]] },
+  { name: "raw", description: "invoke the native Alpaca command tree", synopsis: [["moshcode trade raw <alpaca args…>", ""]] },
+];
+
 /**
  * `dns` sub-verbs.
  *
@@ -421,6 +465,7 @@ export const VERB_TABLES = {
   SKILL_VERBS,
   UPGRADE_TARGETS,
   DNS_VERBS,
+  TRADE_VERBS,
 };
 
 /**
@@ -443,6 +488,12 @@ export const PIT_COMMANDS = [
     description: "raw launch; inject no engine arguments" },
   { name: "tools", args: "[name] [args…]", cli: "tools",
     description: "list workflow tools, or run one" },
+  { name: "trade", args: "<verb> [args…]", cli: "trade",
+    description: "look up markets and preview/place Alpaca orders" },
+  { name: "socials", aliases: ["social"], pitOnly: true,
+    description: "list social networks available for posting" },
+  { name: "post", args: '<social> "message"', pitOnly: true,
+    description: "open a social composer with a prepared post" },
   { name: "install", args: "<engine|tool>", cli: "install",
     description: "install an engine or workflow tool" },
   { name: "upgrade", aliases: ["update"], args: "[name…]", cli: "upgrade",
diff --git a/src/commands.mjs b/src/commands.mjs
index f3a0785..c87247e 100644
--- a/src/commands.mjs
+++ b/src/commands.mjs
@@ -248,6 +248,8 @@ const COMMANDS = [
   cliVerb("doctl", "drive the DigitalOcean CLI (droplets, apps, databases)"),
   cliVerb("turso", "drive the Turso CLI (auth, databases, replicas)"),
   cliVerb("tailscale", "drive the Tailscale CLI (mesh VPN: up, status, ssh, serve)"),
+  cliVerb("alpaca", "drive the native Alpaca trading CLI"),
+  cliVerb("trade", "look up tickers, inspect markets, and preview/place Alpaca orders"),
   cliVerb("pwd", "print the current repo/location"),
 ];
 
diff --git a/src/completion.mjs b/src/completion.mjs
index 953b7a7..3f51bc2 100644
--- a/src/completion.mjs
+++ b/src/completion.mjs
@@ -2,6 +2,7 @@ import {
   CORE_CLI_COMMANDS,
   MCP_VERBS,
   SKILL_VERBS,
+  TRADE_VERBS,
   UPGRADE_TARGETS,
 } from "./cli-schema.mjs";
 import { ENGINES, ENGINE_ALIASES } from "./engines.mjs";
@@ -53,6 +54,16 @@ export function completionModel() {
     mcp: uniqueEntries(MCP_VERBS),
     mcpServerSpecs: uniqueEntries(MCP_VERBS.filter(({ acceptsServerSpec }) => acceptsServerSpec)),
     skills: uniqueEntries(SKILL_VERBS),
+    trade: uniqueEntries(TRADE_VERBS),
+    tradeOrderOptions: uniqueEntries([
+      entry("--submit", "place the order instead of previewing"),
+      entry("--qty", "share quantity"),
+      entry("--notional", "dollar amount"),
+      entry("--type", "market, limit, stop, stop_limit, or trailing_stop"),
+      entry("--limit-price", "limit price"),
+      entry("--stop-price", "stop price"),
+      entry("--time-in-force", "order time in force"),
+    ]),
     skillSources: uniqueEntries(SKILL_VERBS.filter(({ acceptsSource }) => acceptsSource)),
     shells: COMPLETION_SHELLS.map((name) => entry(name, `generate ${name} completion`)),
     // `moshcode help <topic>` accepts anything help can answer for: a command,
@@ -119,6 +130,8 @@ ${powershellEntries("MoshcodeCompletionUpgrade", model.upgrade)}
 ${powershellEntries("MoshcodeCompletionMcp", model.mcp)}
 ${powershellEntries("MoshcodeCompletionMcpServerSpecs", model.mcpServerSpecs)}
 ${powershellEntries("MoshcodeCompletionSkills", model.skills)}
+${powershellEntries("MoshcodeCompletionTrade", model.trade)}
+${powershellEntries("MoshcodeCompletionTradeOrderOptions", model.tradeOrderOptions)}
 ${powershellEntries("MoshcodeCompletionSkillSources", model.skillSources)}
 ${powershellEntries("MoshcodeCompletionShells", model.shells)}
 ${powershellEntries("MoshcodeCompletionHelpTopics", model.helpTopics)}
@@ -190,6 +203,13 @@ Register-ArgumentCompleter -Native -CommandName moshcode -ScriptBlock {
           $choices = $script:MoshcodeCompletionSkillOptions
         }
       }
+      'trade' {
+        if ($argumentIndex -eq 2) {
+          $choices = $script:MoshcodeCompletionTrade
+        } elseif ($nested -in @('buy', 'sell') -and $wordToComplete.StartsWith('-')) {
+          $choices = $script:MoshcodeCompletionTradeOrderOptions
+        }
+      }
       'login' { if ($wordToComplete.StartsWith('-')) { $choices = $script:MoshcodeCompletionLogin } }
       { $_ -in @('engines', 'tools', 'commands') } {
         if ($wordToComplete.StartsWith('-')) { $choices = $script:MoshcodeCompletionJson }
@@ -282,6 +302,13 @@ _moshcode_completion() {
           choices="--name"
         fi
         ;;
+      trade)
+        if (( COMP_CWORD == 2 )); then
+          choices="${names(model.trade)}"
+        elif [[ "$nested" == "buy" || "$nested" == "sell" ]] && [[ "$cur" == -* ]]; then
+          choices="${names(model.tradeOrderOptions)}"
+        fi
+        ;;
       login)
         [[ "$cur" == -* ]] && choices="--browser -b --device -d"
         ;;
@@ -402,6 +429,17 @@ _moshcode() {
         if [[ "$PREFIX" == -* ]]; then _values "skill option" --name; else _files; fi
       fi
       ;;
+    trade)
+      if (( CURRENT == 3 )); then
+        choices=(${zshValues(model.trade)})
+        _describe "trade command" choices
+      elif [[ "\${words[3]}" == "buy" || "\${words[3]}" == "sell" ]] && [[ "$PREFIX" == -* ]]; then
+        choices=(${zshValues(model.tradeOrderOptions)})
+        _describe "trade order option" choices
+      else
+        _files
+      fi
+      ;;
     login)
       _values "login option" --browser -b --device -d
       ;;
@@ -491,6 +529,8 @@ ${fishEntries(atSecondToken("completion"), model.shells)}
 ${fishEntries(atSecondToken("help"), model.helpTopics)}
 ${fishEntries(atSecondToken("mcp"), model.mcp)}
 ${fishEntries(atSecondToken("skill skills"), model.skills)}
+${fishEntries(atSecondToken("trade"), model.trade)}
+${fishEntries("__moshcode_nested_is trade buy; or __moshcode_nested_is trade sell", model.tradeOrderOptions)}
 complete -c moshcode -n '__moshcode_nested_is mcp list' -l json -d 'print JSON'
 complete -c moshcode -n '__moshcode_nested_is skill list; or __moshcode_nested_is skills list' -l json -d 'print JSON'
 complete -c moshcode -n '__moshcode_command_is login' -l browser -s b -d 'use browser authentication'
diff --git a/src/dns.mjs b/src/dns.mjs
index fb08f6c..369f960 100644
--- a/src/dns.mjs
+++ b/src/dns.mjs
@@ -374,13 +374,21 @@ export function buildResponse(query, buf, address, ttl = DEFAULT_TTL, exists = B
 
 /* ------------------------------------------------------------------ registry */
 
-/** Names the registry can hold: exactly one label and one TLD. */
+/**
+ * Names the registry can hold: exactly one label and one TLD, or a third label
+ * under such a name — including `*` as the whole leftmost label, the wildcard
+ * an owner publishes for everything under their name.
+ *
+ * A third-level answer is shaped { sub, label, tld } — `foo.chovy.hacker` is
+ * sub "foo" under the registered name label "chovy" — because the wildcard
+ * question it may fall back to is built from those parts: `*.chovy.hacker`.
+ */
 export function parseRegistryName(hostname) {
   const host = String(hostname || "").trim().toLowerCase().replace(/\.$/, "");
   if (!host || host.includes(":")) return null;
   if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) return null;
   const parts = host.split(".");
-  if (parts.length !== 2) return null;
+  if (parts.length !== 2 && parts.length !== 3) return null;
   // Letters and digits only, matching the registry. A dash is the cheapest way
   // to mint a look-alike of an ending someone else holds, and in a namespace
   // one level deep and first come first served there is nowhere to retreat to.
@@ -388,6 +396,14 @@ export function parseRegistryName(hostname) {
   // rule itself: a name this bridge accepts and the registry rejects resolves
   // to a page that says it does not exist.
   const LABEL = /^[a-z0-9]{1,63}$/;
+  if (parts.length === 3) {
+    const [sub, label, tld] = parts;
+    // `*` is a label only whole and only leftmost — `f*.chovy.hacker` and
+    // `foo.*.hacker` are not names the registry can be asked about.
+    if (sub !== "*" && !LABEL.test(sub)) return null;
+    if (!LABEL.test(label) || !LABEL.test(tld)) return null;
+    return { sub, label, tld };
+  }
   const [label, tld] = parts;
   if (!LABEL.test(label) || !LABEL.test(tld)) return null;
   return { label, tld };
@@ -446,6 +462,10 @@ export async function fetchTlds({ registryBase = DEFAULT_REGISTRY_BASE, fetchImp
  * name with no target is NOT an error, it is a name waiting to be pointed
  * somewhere. Handing back the parking host means `curl california.oranges`
  * reaches a page that explains itself instead of failing to resolve.
+ *
+ * A third-level name adds a fourth: it exists only through its parent or a
+ * wildcard the parent published, so missing both is NXDOMAIN — there is
+ * nothing to park it to.
  */
 export async function resolveName(
   name,
@@ -454,15 +474,42 @@ export async function resolveName(
   const parsed = parseRegistryName(name);
   if (!parsed) return { status: "not-a-name", target: null, records: [] };
 
+  const full = `${parsed.sub ? `${parsed.sub}.` : ""}${parsed.label}.${parsed.tld}`;
+  const ask = (asked) => askRegistry(asked, { registryBase, fetchImpl, timeoutMs, records });
+
+  let result = await ask(full);
+  // A third-level name the registry does not hold may still be covered by a
+  // wildcard its owner published. The registry applies that match itself;
+  // asking for the literal `*.parent` is the fallback for one old enough to
+  // only know the wildcard as a name of its own. A bare label keeps parking on
+  // a miss — a sub-name has nothing to park to, so missing everywhere is
+  // NXDOMAIN. The answer keeps the asked name either way: the wire codec
+  // writes the question's name into every owner field, as a wildcard answer
+  // should.
+  const missed = (r) => r.status === "parked" && r.registered === false;
+  if (parsed.sub && missed(result)) {
+    if (parsed.sub !== "*") result = await ask(`*.${parsed.label}.${parsed.tld}`);
+    if (missed(result)) {
+      return { status: "nxdomain", target: null, ...(records ? { records: [] } : {}) };
+    }
+  }
+  return result;
+}
+
+/**
+ * One question to the registry's resolve endpoint.
+ *
+ * `&records=1` only when the question needs the whole set. Every address
+ * lookup on the machine comes through here, and the registry does a second
+ * query to answer it — a browser opening a page must not pay for records it
+ * will never read.
+ */
+async function askRegistry(asked, { registryBase, fetchImpl, timeoutMs, records }) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    // `&records=1` only when the question needs the whole set. Every address
-    // lookup on the machine comes through here, and the registry does a second
-    // query to answer it — a browser opening a page must not pay for records it
-    // will never read.
     const url = `${registryBase.replace(/\/+$/, "")}/api/moshpit/resolve?name=${encodeURIComponent(
-      `${parsed.label}.${parsed.tld}`,
+      asked,
     )}${records ? "&records=1" : ""}`;
     const res = await fetchImpl(url, { signal: controller.signal });
     if (!res.ok) return { status: "unreachable", target: null };
@@ -619,8 +666,11 @@ export async function addressAnswer(name, options = {}) {
   if (!exists) return { exists: false, kind: "nxdomain", records: [], address: null, cname: null };
 
   // Parking is checked before anything the registry published: a parked name's
-  // whole job is to reach the page explaining that it is for sale.
-  if (result.status === "parked") {
+  // whole job is to reach the page explaining that it is for sale. A third-level
+  // name is never for sale — it exists only through a wildcard its parent
+  // published — so "parked" there means the wildcard has no address to give,
+  // and the records it published are the answer.
+  if (result.status === "parked" && !parseRegistryName(name)?.sub) {
     return parkingAddress ? plan("address", { address: parkingAddress }) : plan("nodata");
   }
 
@@ -1136,8 +1186,10 @@ export function createServer(options = {}) {
  *
  * The probe name has three labels on purpose. A two-label name is a Moshpit
  * name to any build: an older bridge answers it with the parking address, an
- * answer, which would read as working forwarding. Three labels cannot be a
- * Moshpit name, so only a bridge that forwards can produce an answer at all.
+ * answer, which would read as working forwarding. A name under an ending
+ * nobody can claim — `.sh` is clearnet, not a Moshpit TLD anyone holds — is
+ * never ours to answer, so only a bridge that forwards can produce an answer
+ * at all.
  */
 export const CLEARNET_PROBE = "pit.moshcode.sh";
 
@@ -2065,8 +2117,9 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
     const explain = {
       live: () => `${name} → ${result.target}`,
       parked: () => `${name} → ${pitUrl}  [parked — claimed but not pointed at an IP]`,
+      nxdomain: () => `${name} → NXDOMAIN  [not held — not exactly, and not by a wildcard on its parent]`,
       unreachable: () => `${name} → NXDOMAIN  [registry unreachable — not parking a name we could not look up]`,
-      "not-a-name": () => `${name} → NXDOMAIN  [not a Moshpit name: needs exactly one label and one TLD]`,
+      "not-a-name": () => `${name} → NXDOMAIN  [not a Moshpit name: one label and one TLD, or one more under such a name]`,
     };
     if (asJson) {
       out(JSON.stringify({
diff --git a/src/socials.mjs b/src/socials.mjs
new file mode 100644
index 0000000..d8b4337
--- /dev/null
+++ b/src/socials.mjs
@@ -0,0 +1,72 @@
+import { canOpenBrowser, openBrowser } from "./open-url.mjs";
+
+const DEFAULT_APP = "https://app.moshcode.sh";
+
+export const SOCIALS = [
+  {
+    name: "bluesky",
+    aliases: ["bsky"],
+    description: "official Bluesky browser composer",
+  },
+  {
+    name: "nostr",
+    aliases: [],
+    description: "NIP-07/NIP-46 browser signer + relay publish",
+  },
+];
+
+export function resolveSocial(name) {
+  const wanted = String(name ?? "").trim().toLowerCase();
+  return SOCIALS.find((social) =>
+    social.name === wanted || social.aliases.includes(wanted)) ?? null;
+}
+
+function appOrigin(env = process.env) {
+  return String(env.MOSHCODE_API || DEFAULT_APP).replace(/\/+$/, "");
+}
+
+/**
+ * Build the browser hand-off without opening anything. Nostr keeps the draft
+ * in the fragment so it never reaches app.moshcode.sh access logs or Referer
+ * headers; the composer reads it entirely in the browser.
+ */
+export function socialPostUrl(name, message, { env = process.env } = {}) {
+  const social = resolveSocial(name);
+  if (!social) return null;
+  const text = String(message ?? "");
+  if (social.name === "bluesky") {
+    return `https://bsky.app/intent/compose?${new URLSearchParams({ text })}`;
+  }
+  return `${appOrigin(env)}/socials/nostr#${new URLSearchParams({ text })}`;
+}
+
+export function socialRoster() {
+  return SOCIALS.map((social) => ({ ...social, aliases: [...social.aliases] }));
+}
+
+/**
+ * Open a provider composer. Posting remains an explicit browser confirmation:
+ * Bluesky requires it, and Nostr asks the browser signer before relay publish.
+ */
+export function postSocial(args, {
+  env = process.env,
+  canOpen = canOpenBrowser,
+  open = openBrowser,
+} = {}) {
+  const [requested, ...words] = Array.isArray(args) ? args : [];
+  const social = resolveSocial(requested);
+  if (!requested) return { ok: false, error: 'usage: /post <social> "message"' };
+  if (!social) {
+    return {
+      ok: false,
+      error: `unknown social "${requested}". try: ${SOCIALS.map((entry) => entry.name).join(", ")}`,
+    };
+  }
+
+  const message = words.join(" ").trim();
+  if (!message) return { ok: false, error: 'usage: /post <social> "message"' };
+
+  const url = socialPostUrl(social.name, message, { env });
+  const opened = Boolean(canOpen() && open(url));
+  return { ok: true, social: social.name, message, url, opened };
+}
diff --git a/src/tools.mjs b/src/tools.mjs
index 2a40918..50a6251 100644
--- a/src/tools.mjs
+++ b/src/tools.mjs
@@ -114,6 +114,19 @@ export const TOOLS = {
     // silently re-adding package repos.
     upgrade: { cmd: "tailscale", args: ["update"] },
   },
+  alpaca: {
+    desc: "Alpaca — paper/live trading, market data, positions, and watchlists",
+    bin: "alpaca",
+    // Official Go install documented by Alpaca. Go writes to $GOBIN when set,
+    // otherwise $GOPATH/bin (normally ~/go/bin); binDirs covers that default in
+    // an already-running shell whose PATH has not picked it up yet.
+    binDirs: [path.join(homedir(), "go", "bin")],
+    install: {
+      cmd: "go",
+      args: ["install", "github.com/alpacahq/cli/cmd/alpaca@latest"],
+    },
+    installHelp: "Go is required to install Alpaca; install Go, then retry `moshcode install alpaca`.",
+  },
 };
 
 /** Resolve a name to `[key, tool]`, or null. */
diff --git a/src/trade.mjs b/src/trade.mjs
new file mode 100644
index 0000000..984fa91
--- /dev/null
+++ b/src/trade.mjs
@@ -0,0 +1,137 @@
+// Friendly trading vocabulary over Alpaca's native CLI.
+//
+// Alpaca remains a workflow tool: authentication, API calls, structured output,
+// and the full command tree all belong to the `alpaca` binary. This module only
+// translates a small, memorable `moshcode trade` surface into native argv.
+// `moshcode alpaca ...` remains the escape hatch for every command not covered
+// here.
+
+const USAGE = `usage: moshcode trade <command> [args…]
+
+  ticker <symbol> [flags…]        look up a tradable asset
+  quote <symbol> [flags…]         get the latest quote
+  analysis <symbol> [flags…]      get an analysis-ready market snapshot
+  buy <symbol> <qty> [flags…]     preview a buy; add --submit to place it
+  buy <symbol> --notional <usd>    preview a dollar-value buy
+  sell <symbol> <qty> [flags…]    preview a sell; add --submit to place it
+  watch <verb> [args…]            manage Alpaca watchlists
+  positions [verb] [args…]        list/get/close positions
+  orders [verb] [args…]           list/get/replace/cancel orders
+  account [args…]                 show account details
+  login [args…]                   authenticate an Alpaca profile (paper by default)
+  clock [args…]                   show market status and next open/close
+  raw <alpaca args…>              invoke the native Alpaca command tree
+
+Orders are previews by default. --submit removes the injected --dry-run;
+live trading still requires Alpaca's separate --live opt-in.`;
+
+export function tradeUsage() {
+  return USAGE;
+}
+
+function symbolCommand(native, args) {
+  const [symbol, ...rest] = args;
+  if (!symbol || String(symbol).startsWith("-")) {
+    return { error: `trade ${native.label} requires a ticker symbol` };
+  }
+  return { args: [...native.argv, "--symbol", String(symbol).toUpperCase(), ...rest] };
+}
+
+function optionValue(args, name) {
+  const exact = args.indexOf(name);
+  if (exact >= 0) return { value: args[exact + 1], missing: args[exact + 1] == null || String(args[exact + 1]).startsWith("-") };
+  const prefix = `${name}=`;
+  const joined = args.find((arg) => String(arg).startsWith(prefix));
+  return joined == null ? null : { value: String(joined).slice(prefix.length), missing: String(joined).slice(prefix.length) === "" };
+}
+
+function positiveNumber(value) {
+  return value != null && Number.isFinite(Number(value)) && Number(value) > 0;
+}
+
+function orderCommand(side, args) {
+  const [symbol, ...afterSymbol] = args;
+  if (!symbol || String(symbol).startsWith("-")) {
+    return { error: `trade ${side} requires a ticker symbol and quantity or --notional` };
+  }
+
+  const positionalQty = afterSymbol[0] != null && !String(afterSymbol[0]).startsWith("-")
+    ? String(afterSymbol[0])
+    : null;
+  const tail = positionalQty == null ? afterSymbol : afterSymbol.slice(1);
+  const qtyOption = optionValue(tail, "--qty");
+  const notionalOption = optionValue(tail, "--notional");
+  const supplied = [positionalQty != null, qtyOption != null, notionalOption != null].filter(Boolean).length;
+  if (supplied === 0) {
+    return { error: `trade ${side} requires a positive quantity or --notional amount` };
+  }
+  if (supplied > 1) {
+    return { error: `trade ${side} accepts one of positional quantity, --qty, or --notional` };
+  }
+  if (qtyOption?.missing) return { error: `trade ${side} --qty requires a positive number` };
+  if (notionalOption?.missing) return { error: `trade ${side} --notional requires a positive number` };
+  const amount = positionalQty ?? qtyOption?.value ?? notionalOption?.value;
+  if (!positiveNumber(amount)) {
+    return { error: `trade ${side} ${notionalOption ? "notional amount" : "quantity"} must be a positive number` };
+  }
+
+  // Placing an order is the one place where a friendly shortcut should be
+  // safer than its native equivalent. Alpaca deliberately has no confirmation
+  // prompts, so buy/sell previews unless the caller explicitly says --submit.
+  const submit = tail.includes("--submit");
+  const nativeTail = tail.filter((arg) => arg !== "--submit");
+  const hasType = nativeTail.some((arg) => arg === "--type" || String(arg).startsWith("--type="));
+  const hasDryRun = nativeTail.includes("--dry-run");
+  return {
+    args: [
+      "order", "submit",
+      "--symbol", String(symbol).toUpperCase(),
+      "--side", side,
+      ...(positionalQty == null ? [] : ["--qty", positionalQty]),
+      ...(hasType ? [] : ["--type", "market"]),
+      ...nativeTail,
+      ...(!submit && !hasDryRun ? ["--dry-run"] : []),
+    ],
+    preview: !submit || hasDryRun,
+  };
+}
+
+/** Translate `trade` arguments into argv for the native `alpaca` binary. */
+export function tradeArgs(input = []) {
+  const [rawCommand, ...rest] = input.map(String);
+  const command = rawCommand?.toLowerCase();
+  if (!command) return { usage: true };
+
+  if (command === "ticker" || command === "lookup" || command === "asset") {
+    const [symbol, ...tail] = rest;
+    if (!symbol || String(symbol).startsWith("-")) return { error: "trade ticker requires a ticker symbol" };
+    // Unlike market-data commands, Alpaca asset get names its lookup argument
+    // --symbol-or-asset-id (verified against v0.0.13's actual command tree).
+    return { args: ["asset", "get", "--symbol-or-asset-id", String(symbol).toUpperCase(), ...tail] };
+  }
+  if (command === "quote") {
+    return symbolCommand({ label: "quote", argv: ["data", "latest-quote"] }, rest);
+  }
+  if (command === "analysis" || command === "analyze") {
+    return symbolCommand({ label: "analysis", argv: ["data", "snapshot"] }, rest);
+  }
+  if (command === "buy" || command === "sell") return orderCommand(command, rest);
+
+  if (command === "watch" || command === "watchlist") {
+    return { args: ["watchlist", ...(rest.length ? rest : ["list"])] };
+  }
+  if (command === "positions" || command === "position") {
+    return { args: ["position", ...(rest.length ? rest : ["list"])] };
+  }
+  if (command === "orders" || command === "order") {
+    return { args: ["order", ...(rest.length ? rest : ["list"])] };
+  }
+  if (command === "account") return { args: ["account", ...(rest.length ? rest : ["get"])] };
+  if (command === "login") return { args: ["profile", "login", ...rest] };
+  if (command === "clock") return { args: ["clock", ...rest] };
+  if (command === "raw" || command === "alpaca") {
+    return rest.length ? { args: rest } : { error: "trade raw requires an Alpaca command" };
+  }
+
+  return { error: `unknown trade command ${JSON.stringify(rawCommand)}` };
+}
diff --git a/src/tui.mjs b/src/tui.mjs
index a7032ac..fbf337d 100644
--- a/src/tui.mjs
+++ b/src/tui.mjs
@@ -9,6 +9,8 @@ import os from "node:os";
 import path from "node:path";
 import { ENGINES, agentLaunchArgs, resolveEngine, engineStatus, openSession } from "./engines.mjs";
 import { TOOLS, resolveTool, toolStatus, openTool } from "./tools.mjs";
+import { tradeArgs, tradeUsage } from "./trade.mjs";
+import { postSocial, socialRoster } from "./socials.mjs";
 import { runUpgrade } from "./upgrade.mjs";
 import { locate, tilde } from "./pwd.mjs";
 import { createPrd, listPrds, authoringPrompt } from "./prd.mjs";
@@ -145,6 +147,15 @@ function printTools() {
   console.log(ash("   → ") + acid("https://dev.profullstack.com/"));
 }
 
+function printSocials() {
+  console.log(bone("  socials") + ash("  — compose with ") + acid('/post <social> "message"'));
+  for (const social of socialRoster()) {
+    const aliases = social.aliases.length ? ` (${social.aliases.join(", ")})` : "";
+    console.log(`   ${acid("●")} ${bone(social.name.padEnd(9))} ${ash(social.description + aliases)}`);
+  }
+  console.log(ash("   the browser always asks you to confirm before anything is published"));
+}
+
 /**
  * The moshscript vocabulary, split the way the CLI's help splits it.
  *
@@ -370,7 +381,12 @@ function installTarget(key) {
     console.log(info(`installing ${key}: ${target.install.cmd} ${target.install.args.join(" ")}`));
     console.log(hr());
     const child = spawn(target.install.cmd, target.install.args, { stdio: "inherit" });
-    child.on("error", (e) => { console.log(hr()); console.log(err(`install failed: ${e.message}`)); resolve(); });
+    child.on("error", (e) => {
+      console.log(hr());
+      console.log(err(`install failed: ${e.message}`));
+      if (e.code === "ENOENT" && target.installHelp) console.log(info(target.installHelp));
+      resolve();
+    });
     child.on("exit", (code) => { console.log(hr()); console.log(code === 0 ? ok(`${key} installed. 🤘`) : err(`install exited ${code}`)); resolve(); });
   });
 }
@@ -603,6 +619,34 @@ export async function tui() {
       rl = mkrl();
       continue;
     }
+    if (cmd === "trade") {
+      const translated = tradeArgs(rest);
+      if (translated.usage) { console.log(tradeUsage()); continue; }
+      if (translated.error) { console.log(err(translated.error)); continue; }
+      rl.close();
+      const tool = TOOLS.alpaca;
+      await openWorkflowTool("alpaca", {
+        ...tool,
+        installed: toolStatus().find((entry) => entry.key === "alpaca")?.installed,
+      }, translated.args);
+      rl = mkrl();
+      continue;
+    }
+    if (cmd === "socials" || cmd === "social") {
+      printSocials();
+      continue;
+    }
+    if (cmd === "post") {
+      const result = postSocial(rest);
+      if (!result.ok) { console.log(err(result.error)); continue; }
+      if (result.opened) {
+        console.log(ok(`opened the ${result.social} composer — confirm the post in your browser 🤘`));
+      } else {
+        console.log(info(`open this ${result.social} composer in a browser:`));
+        console.log(`  ${result.url}`);
+      }
+      continue;
+    }
     // Bare engine name → open it.
     const resolved = resolveEngine(cmd);
     if (resolved) {
diff --git a/src/uninstall.mjs b/src/uninstall.mjs
index 91a90a1..215ba21 100644
--- a/src/uninstall.mjs
+++ b/src/uninstall.mjs
@@ -37,6 +37,7 @@ export function safePrefixes(home = homedir()) {
     `${home}/bin`,
     `${home}/.npm-global/bin`,
     `${home}/.volta/bin`,
+    `${home}/go/bin`,
     "/usr/local/bin",
     "/opt/homebrew/bin",
   ];
diff --git a/test/cli.test.mjs b/test/cli.test.mjs
index 9905830..b9efbdd 100644
--- a/test/cli.test.mjs
+++ b/test/cli.test.mjs
@@ -92,7 +92,7 @@ test("runMoshcode stringifies args and never spawns under dry-run", async () =>
 
 test("the CLI capabilities are all registered as verbs", () => {
   const reg = moshVocabulary();
-  for (const name of ["agents", "start", "install", "upgrade", "mcp", "skill", "prd", "ugig", "coinpay", "c0mpute", "secrets", "pwd", "ai"]) {
+  for (const name of ["agents", "start", "install", "upgrade", "mcp", "skill", "prd", "ugig", "coinpay", "c0mpute", "secrets", "alpaca", "trade", "pwd", "ai"]) {
     assert.ok(reg.has(name), `expected ${name}() in the vocabulary`);
   }
 });
@@ -114,6 +114,8 @@ const VERB_ARGV_CASES = [
   { verb: "coinpay", args: ["wallet", "balance"],            expect: /moshcode coinpay wallet balance/ },
   { verb: "c0mpute", args: ["status"],                       expect: /moshcode c0mpute status/ },
   { verb: "secrets", args: ["teams", "list"],               expect: /moshcode secrets teams list/ },
+  { verb: "alpaca", args: ["asset", "get", "--symbol-or-asset-id", "AAPL"], expect: /moshcode alpaca asset get --symbol-or-asset-id AAPL/ },
+  { verb: "trade",  args: ["ticker", "AAPL"],               expect: /moshcode trade ticker AAPL/ },
   { verb: "pwd",     args: [],                               expect: /moshcode pwd/ },
   { verb: "run",     args: ["setup.mosh"],                   expect: /moshcode run setup\.mosh/ },
 ];
@@ -131,7 +133,7 @@ for (const { verb, args, expect: pattern } of VERB_ARGV_CASES) {
 
 // Verify CLI verbs return { ok, dryRun } under dry-run (no real spawn).
 test("all CLI verbs return { ok: true, dryRun: true } in dry-run mode", () => {
-  const cliNames = ["agents", "start", "install", "upgrade", "mcp", "skill", "prd", "ugig", "coinpay", "c0mpute", "secrets", "pwd", "run"];
+  const cliNames = ["agents", "start", "install", "upgrade", "mcp", "skill", "prd", "ugig", "coinpay", "c0mpute", "secrets", "alpaca", "trade", "pwd", "run"];
   for (const name of cliNames) {
     const ctx = dryCtx();
     const cmd = moshVocabulary().get(name);
diff --git a/test/completion.test.mjs b/test/completion.test.mjs
index a073a4c..5085c06 100644
--- a/test/completion.test.mjs
+++ b/test/completion.test.mjs
@@ -9,7 +9,7 @@ import {
   completionModel,
   completionScript,
 } from "../src/completion.mjs";
-import { MCP_VERBS, UPGRADE_TARGETS } from "../src/cli-schema.mjs";
+import { MCP_VERBS, TRADE_VERBS, UPGRADE_TARGETS } from "../src/cli-schema.mjs";
 import { ENGINE_ALIASES, ENGINES } from "../src/engines.mjs";
 import { TOOLS } from "../src/tools.mjs";
 
@@ -66,6 +66,7 @@ test("completion model derives engines, aliases, and tools from their registries
     new Set(names(model.mcpServerSpecs)),
     new Set(MCP_VERBS.filter(({ acceptsServerSpec }) => acceptsServerSpec).map(({ name }) => name)),
   );
+  assert.deepEqual(names(model.trade), [...TRADE_VERBS].map(({ name }) => name).sort());
 });
 
 test("completion schema covers every explicitly dispatched CLI command", () => {
@@ -126,6 +127,15 @@ test("bash completion respects argument depth and preserves file fallbacks", ()
   assert.ok(bashCompletions(["moshcode", "mcp", "list", "--"]).includes("--json"));
   assert.deepEqual(bashCompletions(["moshcode", "mcp", "install", ""]), []);
 
+  const trade = bashCompletions(["moshcode", "trade", ""]);
+  assert.ok(trade.includes("ticker"));
+  assert.ok(trade.includes("buy"));
+  assert.ok(trade.includes("watch"));
+  const tradeOrder = bashCompletions(["moshcode", "trade", "buy", "AAPL", "1", "--"]);
+  assert.ok(tradeOrder.includes("--submit"));
+  assert.ok(tradeOrder.includes("--notional"));
+  assert.ok(tradeOrder.includes("--limit-price"));
+
   assert.ok(bashCompletions(["moshcode", "skill", "list", "--"]).includes("--json"));
   assert.ok(bashCompletions(["moshcode", "skills", "list", "--"]).includes("--json"));
 
diff --git a/test/dns-address-answer.test.mjs b/test/dns-address-answer.test.mjs
index eacfd23..730d9fa 100644
--- a/test/dns-address-answer.test.mjs
+++ b/test/dns-address-answer.test.mjs
@@ -293,3 +293,75 @@ test("a name the registry does not hold is still NXDOMAIN on an address question
   const reply = await ask(server, query("scrambled.eggs"));
   assert.equal(rcode(reply), RCODE_NXDOMAIN);
 });
+
+/* ------------------------------------------------------------------ wildcards */
+
+/**
+ * A registry that holds `*.chovy.hacker` and nothing under it — dumber than
+ * the real pit on purpose, so the exact-then-wildcard fallback on this side of
+ * HTTP is what produces the answer.
+ */
+function wildcardOnly({ target = null, records = [] } = {}) {
+  const calls = [];
+  const fetchImpl = async (url) => {
+    calls.push(url);
+    const wants = url.includes("records=1");
+    const asked = decodeURIComponent(new URL(url).searchParams.get("name"));
+    const held = asked === "*.chovy.hacker";
+    return {
+      ok: true,
+      json: async () => ({
+        name_registered: held,
+        target: held ? target : null,
+        ...(wants ? { records: held ? records : [] } : {}),
+      }),
+    };
+  };
+  return { fetchImpl, calls };
+}
+
+test("a wildcard AAAA answers a third-level address question, as the asked name", async (t) => {
+  // The primary use of the feature: `*.chovy.hacker` publishes the owner's
+  // IPv6, and every name under chovy answers with it.
+  const server = await serve(t, wildcardOnly({ target: "2606:4700:4700::1111" }));
+  const reply = await ask(server, query("foo.chovy.hacker", { type: TYPE_AAAA }));
+
+  assert.equal(rcode(reply), RCODE_OK);
+  const [record] = readAnswers(reply, "foo.chovy.hacker");
+  assert.equal(record.owner, "foo.chovy.hacker", "the answer carries the asked name, not the wildcard");
+  assert.equal(record.type, TYPE_AAAA);
+  assert.equal(record.rdata.readUInt16BE(0), 0x2606);
+});
+
+test("a wildcard AAAA record answers when the wildcard has no target of its own", async (t) => {
+  // The registry need not mirror the record into `target`: the records path
+  // finds the address exactly as it does for a registered name.
+  const server = await serve(t, wildcardOnly({
+    records: [{ type: "AAAA", value: "2606:4700:4700::1111", ttl: 300 }],
+  }));
+  const reply = await ask(server, query("foo.chovy.hacker", { type: TYPE_AAAA }));
+
+  assert.equal(rcode(reply), RCODE_OK);
+  const [record] = readAnswers(reply, "foo.chovy.hacker");
+  assert.equal(record.type, TYPE_AAAA);
+  assert.equal(record.rdata.readUInt16BE(0), 0x2606);
+});
+
+test("a third-level name is never parked", async (t) => {
+  // Parking is for names that are for sale, and a sub-name is never for sale —
+  // it exists only through a wildcard. A wildcard that exists but has no
+  // address to give is NODATA, and sending it to the for-sale page would be
+  // the one answer that is always wrong.
+  const reg = wildcardOnly({});
+  const plan = await addressAnswer("foo.chovy.hacker", {
+    fetchImpl: reg.fetchImpl,
+    parkingAddress: "198.51.100.9",
+  });
+  assert.equal(plan.kind, "nodata");
+  assert.notEqual(plan.address, "198.51.100.9");
+
+  const server = await serve(t, reg);
+  const reply = await ask(server, query("foo.chovy.hacker", { type: TYPE_AAAA }));
+  assert.equal(rcode(reply), RCODE_OK);
+  assert.equal(answers(reply), 0);
+});
diff --git a/test/dns-nodata.test.mjs b/test/dns-nodata.test.mjs
index f55c762..eaeb84e 100644
--- a/test/dns-nodata.test.mjs
+++ b/test/dns-nodata.test.mjs
@@ -143,7 +143,9 @@ test("a name the registry cannot hold is still NXDOMAIN, on every type", async (
   const reg = parked();
   const server = await serve(t, reg);
   for (const type of [TYPE_A, TYPE_HTTPS]) {
-    const reply = await ask(server, query("deep.sub.eggs", { type }));
+    // Four labels: three is a name under a name now and is looked up, so it no
+    // longer proves the bridge refuses a shape on sight.
+    const reply = await ask(server, query("too.deep.sub.eggs", { type }));
     assert.equal(rcode(reply), RCODE_NXDOMAIN, `type ${type} on a non-name`);
   }
   assert.equal(reg.calls.length, 0, "a shape the registry cannot hold is never looked up");
diff --git a/test/dns-records.test.mjs b/test/dns-records.test.mjs
index 6499424..21b88c6 100644
--- a/test/dns-records.test.mjs
+++ b/test/dns-records.test.mjs
@@ -224,12 +224,17 @@ test("an unregistered name under a claimed ending is parked, not denied", async
   assert.equal(count(reply), 0);
 });
 
-test("a record question about something that is not a name at all is NXDOMAIN", async (t) => {
-  // Three labels cannot be a Moshpit name — the namespace is one level deep —
-  // so there is nothing here to be waiting to be pointed.
-  const server = await serve(t, registry({ records: [] }));
+test("a record question about a third-level name nobody holds is NXDOMAIN", async (t) => {
+  // Three labels is a name under a name now, so it cannot be refused on sight
+  // anymore — but a name the registry does not hold, exactly or by wildcard,
+  // has nothing to park to and is NXDOMAIN rather than parked.
+  const reg = registry({ records: [], registered: false });
+  const server = await serve(t, reg);
   const reply = await ask(server, query("not.a.name", { type: TYPE_TXT }));
   assert.equal(rcode(reply), RCODE_NXDOMAIN);
+  // The wildcard got its chance before the name was denied: exact first, then
+  // `*.a.name`, and only then NXDOMAIN.
+  assert.ok(reg.calls.some((u) => u.includes("name=*.a.name")), "the wildcard was never asked");
 });
 
 test("a published CNAME answers the address question that had nothing to say", async (t) => {
@@ -280,11 +285,13 @@ test("answerRecords separates 'no such record' from 'no such name'", async () =>
   assert.deepEqual(await answerRecords("blue.eggs", { fetchImpl: here.fetchImpl, type: "MX" }),
     { exists: true, records: [] });
 
-  // Not a name this registry can be asked about at all.
-  const reg = registry({ records: [] });
+  // A third-level name nobody holds — not exactly, and not by wildcard. It can
+  // no longer be rejected on sight (three labels are a name under a name now),
+  // so it costs the exact question and the wildcard one, and no more.
+  const reg = registry({ records: [], registered: false });
   assert.deepEqual(await answerRecords("not.a.name", { fetchImpl: reg.fetchImpl, type: "MX" }),
     { exists: false, records: [] });
-  assert.equal(reg.calls.length, 0, "a name it could reject on sight still cost a round trip");
+  assert.equal(reg.calls.length, 2, "exact name, then the wildcard, then done");
 });
 
 test("answerRecords asks the registry for the record set exactly once", async () => {
@@ -320,3 +327,93 @@ test("DoH follows a published CNAME on an address question too", async () => {
   const [answer] = readAnswers(res.body, "blue.eggs");
   assert.equal(answer.type, TYPE_CNAME, "the two resolvers disagree, which is the bug DoH exists to avoid");
 });
+
+/* ------------------------------------------------------------------ wildcards */
+
+/**
+ * A registry that holds `*.chovy.hacker` and nothing under it.
+ *
+ * Deliberately dumber than the real pit, which applies the wildcard match
+ * itself: this one knows the wildcard only as a name of its own, so the
+ * exact-then-wildcard fallback in resolveName is what makes the answer — which
+ * is the half of the feature that lives on this side of HTTP.
+ */
+function wildcardOnly({ target = null, records = [] } = {}) {
+  const calls = [];
+  const fetchImpl = async (url) => {
+    calls.push(url);
+    const wants = url.includes("records=1");
+    const asked = decodeURIComponent(new URL(url).searchParams.get("name"));
+    const held = asked === "*.chovy.hacker";
+    return {
+      ok: true,
+      json: async () => ({
+        name_registered: held,
+        target: held ? target : null,
+        ...(wants ? { records: held ? records : [] } : {}),
+      }),
+    };
+  };
+  return { fetchImpl, calls };
+}
+
+test("a third-level name is answered by its parent's wildcard, as the asked name", async (t) => {
+  const reg = wildcardOnly({ records: [{ type: "TXT", value: "wild", ttl: 300, priority: null }] });
+  const server = await serve(t, reg);
+  const reply = await ask(server, query("foo.chovy.hacker", { type: TYPE_TXT }));
+
+  assert.equal(rcode(reply), RCODE_OK);
+  const [answer] = readAnswers(reply, "foo.chovy.hacker");
+  // readAnswers asserts the owner is the question's name — a wildcard answer
+  // names what was asked, never the `*.chovy.hacker` it came from.
+  assert.equal(answer.value, "wild");
+  assert.ok(reg.calls.some((u) => u.includes("name=*.chovy.hacker")), "the wildcard was never asked");
+});
+
+test("an exact third-level answer beats the wildcard, which is never asked", async (t) => {
+  // Exact first, always: a name with its own records does not fall through to
+  // the wildcard that would otherwise cover it.
+  const calls = [];
+  const fetchImpl = async (url) => {
+    calls.push(url);
+    const wants = url.includes("records=1");
+    const asked = decodeURIComponent(new URL(url).searchParams.get("name"));
+    const exact = asked === "foo.chovy.hacker";
+    return {
+      ok: true,
+      json: async () => ({
+        name_registered: true,
+        target: null,
+        ...(wants ? { records: [{ type: "TXT", value: exact ? "exact" : "wild", ttl: 300, priority: null }] } : {}),
+      }),
+    };
+  };
+  const server = await serve(t, { fetchImpl, calls });
+  const reply = await ask(server, query("foo.chovy.hacker", { type: TYPE_TXT }));
+
+  const [answer] = readAnswers(reply, "foo.chovy.hacker");
+  assert.equal(answer.value, "exact");
+  assert.ok(!calls.some((u) => u.includes("name=*")), "the wildcard was asked despite an exact answer");
+});
+
+test("a two-label name never pays for the wildcard question", async (t) => {
+  // The fallback is for names under names. An unregistered two-label name is
+  // parked on one question, exactly as before.
+  const reg = registry({ records: [], registered: false });
+  const server = await serve(t, reg);
+  await ask(server, query("nobody.eggs", { type: TYPE_TXT }));
+  assert.equal(reg.calls.length, 1);
+  assert.ok(!reg.calls.some((u) => u.includes("name=*")));
+});
+
+test("DoH answers a third-level name by wildcard exactly as the bridge does", async () => {
+  // The one invariant this endpoint exists under: the two resolvers must not
+  // disagree, or DoH reintroduces the gap it was built to close.
+  const reg = wildcardOnly({ records: [{ type: "TXT", value: "wild", ttl: 300, priority: null }] });
+  const handle = createDohHandler({ fetchImpl: reg.fetchImpl, tldSet: new Set(["hacker"]) });
+
+  const res = await handle({ method: "POST", body: query("foo.chovy.hacker", { type: TYPE_TXT }), address: "203.0.113.9" });
+  assert.equal(res.status, 200);
+  const [answer] = readAnswers(res.body, "foo.chovy.hacker");
+  assert.equal(answer.value, "wild");
+});
diff --git a/test/dns-resolve-json.test.mjs b/test/dns-resolve-json.test.mjs
index 97ceb32..a58fc6a 100644
--- a/test/dns-resolve-json.test.mjs
+++ b/test/dns-resolve-json.test.mjs
@@ -82,10 +82,12 @@ test("JSON preserves failure statuses and exit codes", async (t) => {
 
   await t.test("invalid Moshpit name", async () => {
     globalThis.fetch = async () => { throw new Error("must not fetch"); };
-    const { code, value } = await run("three.part.name");
+    // Four labels: three is a name under a name now, so it no longer proves
+    // the parser refused anything.
+    const { code, value } = await run("four.part.name.here");
     assert.equal(code, 1);
     assert.deepEqual(value, {
-      name: "three.part.name",
+      name: "four.part.name.here",
       status: "not-a-name",
       target: null,
       pitUrl: null,
diff --git a/test/dns.test.mjs b/test/dns.test.mjs
index d10ed06..d9742c8 100644
--- a/test/dns.test.mjs
+++ b/test/dns.test.mjs
@@ -80,7 +80,15 @@ test("buildResponse says NXDOMAIN when there is no address", () => {
 
 test("only registry-shaped names are ours to answer", () => {
   assert.deepEqual(parseRegistryName("california.oranges"), { label: "california", tld: "oranges" });
-  assert.equal(parseRegistryName("a.b.c"), null);
+  // A third label is a name under a name — the shape a wildcard answers for.
+  assert.deepEqual(parseRegistryName("foo.california.oranges"),
+    { sub: "foo", label: "california", tld: "oranges" });
+  // `*` is the wildcard, whole and leftmost or not at all.
+  assert.deepEqual(parseRegistryName("*.california.oranges"),
+    { sub: "*", label: "california", tld: "oranges" });
+  assert.equal(parseRegistryName("f*.california.oranges"), null);
+  assert.equal(parseRegistryName("foo.*.oranges"), null);
+  assert.equal(parseRegistryName("a.b.c.d"), null, "the namespace is two levels deep at most");
   assert.equal(parseRegistryName("localhost"), null);
   assert.equal(parseRegistryName("127.0.0.1"), null);
 });
diff --git a/test/doh.test.mjs b/test/doh.test.mjs
index eed0d3f..ae85078 100644
--- a/test/doh.test.mjs
+++ b/test/doh.test.mjs
@@ -109,3 +109,49 @@ test("IPv6 clients are limited by /64, as on the UDP side", async () => {
   const next = await handle({ method: "POST", body: query("blue.eggs"), address: "2001:db8:1:2::99" });
   assert.equal(rcode(next.body), 5, "moving within the prefix does not buy a fresh bucket");
 });
+
+/* ------------------------------------------------------------------ wildcards */
+
+/** A registry holding `*.chovy.hacker` and nothing under it. */
+const wildcardRegistry = (target) => async (url) => {
+  const wants = url.includes("records=1");
+  const asked = decodeURIComponent(new URL(url).searchParams.get("name"));
+  const held = asked === "*.chovy.hacker";
+  return {
+    ok: true,
+    json: async () => ({
+      name_registered: held,
+      target: held ? target : null,
+      ...(wants ? { records: [] } : {}),
+    }),
+  };
+};
+
+test("a third-level name is answered by its parent's wildcard, as the asked name", async () => {
+  // The UDP bridge answers the same question the same way — dns-records.test
+  // holds that half — and the two must never disagree.
+  const handle = createDohHandler({
+    tldSet: new Set(["hacker"]),
+    fetchImpl: wildcardRegistry("2606:4700:4700::1111"),
+  });
+  const res = await handle({ method: "POST", body: query("foo.chovy.hacker", TYPE_AAAA) });
+  assert.equal(res.status, 200);
+  assert.equal(answers(res.body), 1);
+  // The answer's owner is the question's name (the 0xc00c pointer readAnswers
+  // asserts on the bridge side), and the address is the wildcard's.
+  assert.deepEqual([...res.body.subarray(res.body.length - 16).subarray(0, 4)], [0x26, 0x06, 0x47, 0x00]);
+});
+
+test("a third-level name nobody holds is NXDOMAIN, never parked", async () => {
+  // Parking is for names that are for sale; a sub-name never is. Not held
+  // exactly, not held by wildcard — NXDOMAIN, where a two-label miss would
+  // have been sent to the parking page.
+  const handle = createDohHandler({
+    tldSet: new Set(["hacker"]),
+    parkingAddress: "203.0.113.9",
+    fetchImpl: okJson({ name_registered: false, target: null }),
+  });
+  const res = await handle({ method: "POST", body: query("foo.chovy.hacker", TYPE_AAAA) });
+  assert.equal(rcode(res.body), 3, "NXDOMAIN");
+  assert.equal(answers(res.body), 0);
+});
diff --git a/test/help.test.mjs b/test/help.test.mjs
index 7530313..6722392 100644
--- a/test/help.test.mjs
+++ b/test/help.test.mjs
@@ -20,7 +20,7 @@ import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 
 import {
-  CORE_CLI_COMMANDS, MCP_VERBS, SKILL_VERBS, UPGRADE_TARGETS, DNS_VERBS,
+  CORE_CLI_COMMANDS, MCP_VERBS, SKILL_VERBS, TRADE_VERBS, UPGRADE_TARGETS, DNS_VERBS,
 } from "../src/cli-schema.mjs";
 import {
   WIDTH, findCommand, findPitCommand, helpModel, pitHelpModel, renderCommand, renderOverview,
@@ -219,7 +219,7 @@ test("every dispatched command has a schema entry with a description", async ()
 });
 
 test("every sub-verb has a description", () => {
-  for (const [label, table] of [["mcp", MCP_VERBS], ["skill", SKILL_VERBS], ["upgrade", UPGRADE_TARGETS], ["dns", DNS_VERBS]]) {
+  for (const [label, table] of [["mcp", MCP_VERBS], ["skill", SKILL_VERBS], ["trade", TRADE_VERBS], ["upgrade", UPGRADE_TARGETS], ["dns", DNS_VERBS]]) {
     for (const verb of table) {
       assert.ok(verb.description?.length, `${label} ${verb.name} has no description`);
     }
diff --git a/test/socials.test.mjs b/test/socials.test.mjs
new file mode 100644
index 0000000..99b8a51
--- /dev/null
+++ b/test/socials.test.mjs
@@ -0,0 +1,49 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { postSocial, resolveSocial, socialPostUrl, socialRoster } from "../src/socials.mjs";
+
+test("social roster includes Bluesky and Nostr with aliases", () => {
+  assert.deepEqual(socialRoster().map((social) => social.name), ["bluesky", "nostr"]);
+  assert.equal(resolveSocial("bsky")?.name, "bluesky");
+  assert.equal(resolveSocial("NOSTR")?.name, "nostr");
+  assert.equal(resolveSocial("twitter"), null);
+});
+
+test("Bluesky posts use the official compose intent", () => {
+  const url = new URL(socialPostUrl("bluesky", "hello & goodbye"));
+  assert.equal(url.origin + url.pathname, "https://bsky.app/intent/compose");
+  assert.equal(url.searchParams.get("text"), "hello & goodbye");
+});
+
+test("Nostr drafts stay in the URL fragment and honor a self-hosted app", () => {
+  const url = new URL(socialPostUrl("nostr", "draft #1", {
+    env: { MOSHCODE_API: "https://mosh.example/" },
+  }));
+  assert.equal(url.origin + url.pathname, "https://mosh.example/socials/nostr");
+  assert.equal(url.search, "");
+  assert.equal(new URLSearchParams(url.hash.slice(1)).get("text"), "draft #1");
+});
+
+test("postSocial opens a prepared composer when a browser is available", () => {
+  let opened = "";
+  const result = postSocial(["bsky", "two", "words"], {
+    canOpen: () => true,
+    open: (url) => { opened = url; return true; },
+  });
+
+  assert.equal(result.ok, true);
+  assert.equal(result.social, "bluesky");
+  assert.equal(result.message, "two words");
+  assert.equal(result.opened, true);
+  assert.equal(opened, result.url);
+});
+
+test("postSocial reports missing messages and unknown networks without opening", () => {
+  let opens = 0;
+  const options = { canOpen: () => true, open: () => { opens++; return true; } };
+  assert.match(postSocial([], options).error, /usage: \/post/);
+  assert.match(postSocial(["nostr"], options).error, /usage: \/post/);
+  assert.match(postSocial(["twitter", "hello"], options).error, /unknown social/);
+  assert.equal(opens, 0);
+});
diff --git a/test/templates.test.mjs b/test/templates.test.mjs
index 169ec42..865d5a9 100644
--- a/test/templates.test.mjs
+++ b/test/templates.test.mjs
@@ -46,7 +46,7 @@ test("template list --json prints the stable template metadata", async () => {
 
   assert.equal(code, 0);
   assert.ok(Array.isArray(templates));
-  assert.deepEqual(templates.map((template) => template.name), ["bun-caddy-sqlite", "caddy-static"]);
+  assert.deepEqual(templates.map((template) => template.name), ["bun-caddy-sqlite", "caddy-proxy", "caddy-static"]);
   for (const template of templates) {
     assert.deepEqual(Object.keys(template), ["name", "description"]);
     assert.equal(typeof template.description, "string");
@@ -499,7 +499,7 @@ test("every bundled systemd unit is installable", async () => {
 test("the Caddyfiles keep the scheme that stops Caddy chasing a certificate", async () => {
   // Dropping `http://` makes Caddy try to provision a cert for an ending no CA
   // will issue for, and the site never comes up. Easy to "tidy away" later.
-  for (const template of ["bun-caddy-sqlite", "caddy-static"]) {
+  for (const template of ["bun-caddy-sqlite", "caddy-proxy", "caddy-static"]) {
     const caddyfile = await fs.readFile(path.join(BUNDLED_DIR, template, "Caddyfile"), "utf8");
     assert.match(caddyfile, /^http:\/\/\{\$MOSHPIT_NAME/m, template);
   }
diff --git a/test/tools.test.mjs b/test/tools.test.mjs
index df37fa4..e73bedc 100644
--- a/test/tools.test.mjs
+++ b/test/tools.test.mjs
@@ -107,6 +107,47 @@ test("cloud CLIs resolve and are listed as workflow tools", () => {
   assert.deepEqual(resolveTool("GH"), ["gh", TOOLS.gh]);
 });
 
+test("Alpaca is a workflow tool installed from its official Go command", () => {
+  assert.deepEqual(resolveTool("ALPACA"), ["alpaca", TOOLS.alpaca]);
+  assert.deepEqual(TOOLS.alpaca.install, {
+    cmd: "go",
+    args: ["install", "github.com/alpacahq/cli/cmd/alpaca@latest"],
+  });
+  assert.deepEqual(TOOLS.alpaca.binDirs, [path.join(homedir(), "go", "bin")]);
+  assert.match(toolList(), /alpaca/);
+});
+
+test("install alpaca delegates to the official Go package", async () => {
+  const root = tempDir("moshcode-install-alpaca-");
+  const nativeBin = path.join(root, "bin");
+  const capture = path.join(root, "go-args.json");
+  mkdirSync(nativeBin);
+  writeExecutable(nativeBin, "go", `
+import fs from "node:fs";
+fs.writeFileSync(process.env.GO_CAPTURE, JSON.stringify(process.argv.slice(2)));
+`);
+
+  const result = await run(["install", "alpaca"], {
+    binDir: nativeBin,
+    env: { GO_CAPTURE: capture },
+  });
+
+  assert.equal(result.status, 0, result.stderr);
+  assert.deepEqual(JSON.parse(readFileSync(capture, "utf8")), [
+    "install", "github.com/alpacahq/cli/cmd/alpaca@latest",
+  ]);
+});
+
+test("install alpaca explains a missing Go prerequisite", async () => {
+  const emptyPath = tempDir("moshcode-install-alpaca-no-go-");
+  const result = await run(["install", "alpaca"], { env: { PATH: emptyPath } });
+
+  assert.equal(result.status, 1);
+  assert.match(result.stderr, /install failed/);
+  assert.match(result.stderr, /Go is required to install Alpaca/);
+  assert.match(result.stderr, /moshcode install alpaca/);
+});
+
 test("railway installs from the official npm package", () => {
   // Railway's shell installer needs bash process substitution, which does not
   // survive `sh -c`, so the npm package is the portable path.
diff --git a/test/trade.test.mjs b/test/trade.test.mjs
new file mode 100644
index 0000000..e111b43
--- /dev/null
+++ b/test/trade.test.mjs
@@ -0,0 +1,112 @@
+import assert from "node:assert/strict";
+import { chmodSync, existsSync, mkdtempSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+import { tradeArgs, tradeUsage } from "../src/trade.mjs";
+
+const BIN = fileURLToPath(new URL("../bin/moshcode.mjs", import.meta.url));
+
+test("trade translates market lookup shortcuts to Alpaca argv", () => {
+  assert.deepEqual(tradeArgs(["ticker", "aapl"]), {
+    args: ["asset", "get", "--symbol-or-asset-id", "AAPL"],
+  });
+  assert.deepEqual(tradeArgs(["quote", "msft", "--feed", "iex"]), {
+    args: ["data", "latest-quote", "--symbol", "MSFT", "--feed", "iex"],
+  });
+  assert.deepEqual(tradeArgs(["analysis", "nvda"]), {
+    args: ["data", "snapshot", "--symbol", "NVDA"],
+  });
+});
+
+test("buy and sell preview by default and submit only when explicit", () => {
+  assert.deepEqual(tradeArgs(["buy", "aapl", "2"]), {
+    args: ["order", "submit", "--symbol", "AAPL", "--side", "buy", "--qty", "2", "--type", "market", "--dry-run"],
+    preview: true,
+  });
+  assert.deepEqual(tradeArgs(["sell", "tsla", "0.5", "--type", "limit", "--limit-price", "300", "--submit"]), {
+    args: ["order", "submit", "--symbol", "TSLA", "--side", "sell", "--qty", "0.5", "--type", "limit", "--limit-price", "300"],
+    preview: false,
+  });
+  assert.equal(tradeArgs(["buy", "AAPL", "zero"]).error, "trade buy quantity must be a positive number");
+});
+
+test("buy and sell accept native qty/notional forms without allowing both", () => {
+  assert.deepEqual(tradeArgs(["buy", "aapl", "--notional", "100"]), {
+    args: ["order", "submit", "--symbol", "AAPL", "--side", "buy", "--type", "market", "--notional", "100", "--dry-run"],
+    preview: true,
+  });
+  assert.deepEqual(tradeArgs(["sell", "aapl", "--qty=0.25", "--submit"]), {
+    args: ["order", "submit", "--symbol", "AAPL", "--side", "sell", "--type", "market", "--qty=0.25"],
+    preview: false,
+  });
+  assert.match(tradeArgs(["buy", "AAPL"]).error, /quantity or --notional/);
+  assert.match(tradeArgs(["buy", "AAPL", "1", "--notional", "100"]).error, /accepts one of/);
+  assert.match(tradeArgs(["buy", "AAPL", "--notional", "0"]).error, /notional amount must be a positive/);
+  assert.match(tradeArgs(["buy", "AAPL", "--notional"]).error, /requires a positive number/);
+});
+
+test("portfolio, watchlist, account, login, and raw shortcuts preserve native args", () => {
+  assert.deepEqual(tradeArgs(["watch"]), { args: ["watchlist", "list"] });
+  assert.deepEqual(tradeArgs(["watch", "add", "--watchlist-id", "w", "--symbol", "AAPL"]), {
+    args: ["watchlist", "add", "--watchlist-id", "w", "--symbol", "AAPL"],
+  });
+  assert.deepEqual(tradeArgs(["positions"]), { args: ["position", "list"] });
+  assert.deepEqual(tradeArgs(["orders", "cancel-all"]), { args: ["order", "cancel-all"] });
+  assert.deepEqual(tradeArgs(["account"]), { args: ["account", "get"] });
+  assert.deepEqual(tradeArgs(["login", "--api-key"]), { args: ["profile", "login", "--api-key"] });
+  assert.deepEqual(tradeArgs(["raw", "data", "news", "--symbol", "AAPL"]), {
+    args: ["data", "news", "--symbol", "AAPL"],
+  });
+  assert.equal(tradeArgs([]).usage, true);
+  assert.match(tradeUsage(), /--submit/);
+});
+
+test("moshcode trade invokes Alpaca with translated argv and preserves output", () => {
+  const binDir = mkdtempSync(path.join(tmpdir(), "moshcode-trade-"));
+  const alpaca = path.join(binDir, "alpaca");
+  writeFileSync(alpaca, "#!/bin/sh\nprintf '%s\\n' \"$@\"\n");
+  chmodSync(alpaca, 0o755);
+
+  const result = spawnSync(process.execPath, [BIN, "trade", "buy", "AAPL", "3"], {
+    encoding: "utf8",
+    env: { ...process.env, PATH: `${binDir}${path.delimiter}${process.env.PATH || ""}` },
+  });
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(result.stderr, "");
+  assert.deepEqual(result.stdout.trim().split("\n"), [
+    "order", "submit", "--symbol", "AAPL", "--side", "buy", "--qty", "3", "--type", "market", "--dry-run",
+  ]);
+});
+
+const REAL_ALPACA = path.join(homedir(), "go", "bin", process.platform === "win32" ? "alpaca.exe" : "alpaca");
+
+test("installed Alpaca accepts the facade's real lookup and order argv", {
+  skip: !existsSync(REAL_ALPACA) && "Alpaca CLI is not installed in the default Go bin directory",
+}, () => {
+  const env = {
+    ...process.env,
+    // Non-secret placeholders satisfy Alpaca's local auth gate. Every order
+    // keeps the facade-injected --dry-run, so this test performs no API call.
+    ALPACA_API_KEY: "PK_MOSHCODE_TEST",
+    ALPACA_SECRET_KEY: "MOSHCODE_TEST_ONLY",
+  };
+  const run = (...args) => spawnSync(process.execPath, [BIN, "trade", ...args], { encoding: "utf8", env });
+
+  for (const args of [["ticker", "AAPL", "--schema"], ["quote", "AAPL", "--schema"]]) {
+    const result = run(...args);
+    assert.equal(result.status, 0, `${args.join(" ")}: ${result.stderr || result.stdout}`);
+  }
+
+  for (const args of [["buy", "AAPL", "1"], ["buy", "AAPL", "--notional", "100"]]) {
+    const result = run(...args);
+    assert.equal(result.status, 0, `${args.join(" ")}: ${result.stderr || result.stdout}`);
+    const body = JSON.parse(result.stdout);
+    assert.equal(body.symbol, "AAPL");
+    assert.equal(body.side, "buy");
+    assert.equal(body.type, "market");
+  }
+});
diff --git a/test/uninstall.test.mjs b/test/uninstall.test.mjs
index e7eb4da..5f1405a 100644
--- a/test/uninstall.test.mjs
+++ b/test/uninstall.test.mjs
@@ -59,6 +59,13 @@ test("the places a per-user installer legitimately writes are allowed", () => {
   }
 });
 
+test("a Go-installed Alpaca binary can be removed from the default GOPATH", () => {
+  const entry = { bin: "alpaca", install: { cmd: "go", args: ["install", "github.com/alpacahq/cli/cmd/alpaca@latest"] } };
+  const plan = uninstallPlan(entry, { binPath: `${HOME}/go/bin/alpaca`, home: HOME });
+  assert.equal(plan.kind, "binary");
+  assert.deepEqual(plan.steps, [{ kind: "remove", path: `${HOME}/go/bin/alpaca` }]);
+});
+
 test("a tool that is not there says so rather than failing", () => {
   const plan = uninstallPlan(scriptEntry, { binPath: null, home: HOME });
   assert.equal(plan.kind, "absent");
diff --git a/test/upgrade-install-missing.test.mjs b/test/upgrade-install-missing.test.mjs
index f83f7c1..3ae1e5c 100644
--- a/test/upgrade-install-missing.test.mjs
+++ b/test/upgrade-install-missing.test.mjs
@@ -37,9 +37,22 @@ function withPath(names, fn) {
     chmodSync(file, 0o755);
   }
   const before = process.env.PATH;
+  const entries = [...Object.values(ENGINES), ...Object.values(TOOLS)];
+  const beforeBinDirs = entries.map((entry) => [entry, entry.binDirs]);
   process.env.PATH = dir;
+  // PATH is only half the lookup contract: tools installed into a known
+  // user-local directory (Turso, Alpaca) deliberately remain discoverable in
+  // an already-running shell. Blank those explicit directories too so a real
+  // local install cannot leak into this fake-machine test.
+  for (const entry of entries) entry.binDirs = [];
   try { return fn(); }
-  finally { process.env.PATH = before; }
+  finally {
+    process.env.PATH = before;
+    for (const [entry, binDirs] of beforeBinDirs) {
+      if (binDirs === undefined) delete entry.binDirs;
+      else entry.binDirs = binDirs;
+    }
+  }
 }
 
 const specOf = (target) => withPath([], () => planUpgrade([target]).items[0]);
diff --git a/test/upgrade.test.mjs b/test/upgrade.test.mjs
index 483f3f1..6af20dd 100644
--- a/test/upgrade.test.mjs
+++ b/test/upgrade.test.mjs
@@ -6,6 +6,7 @@ import test from "node:test";
 
 import { ENGINES, upgradeSpec } from "../src/engines.mjs";
 import { planUpgrade, runUpgrade, selfSpec } from "../src/upgrade.mjs";
+import { TOOLS } from "../src/tools.mjs";
 
 // Same trick as withFakeTools, for the cases that turn on a target being
 // installed: only an installed target is asked to update itself, so the
@@ -31,13 +32,21 @@ function withFakeTools(fn) {
     chmodSync(file, 0o755);
   }
   const before = process.env.PATH;
+  const beforeBinDirs = Object.values(TOOLS).map((tool) => [tool, tool.binDirs]);
   // REPLACE the PATH rather than prepending to it: "which tools are installed"
   // is the thing under test, so any real CLI on the developer's machine (gh,
   // doctl, tailscale…) would otherwise leak into the plan and make the
   // assertions depend on the host.
   process.env.PATH = dir;
+  for (const tool of Object.values(TOOLS)) tool.binDirs = [];
   try { return fn(); }
-  finally { process.env.PATH = before; }
+  finally {
+    process.env.PATH = before;
+    for (const [tool, binDirs] of beforeBinDirs) {
+      if (binDirs === undefined) delete tool.binDirs;
+      else tool.binDirs = binDirs;
+    }
+  }
 }
 
 test("upgrade tools selects installed workflow tools without self or engines", () => {