docs(P1): README web UI quickstart + lexicon firewall v0.6 section

---ci---
project: oy
phase: 1
milestone: v0.6
status: execute
---/ci---

README.md

@@ -25,10 +25,14 @@ Loaf → Batch → Cake → Bakery → Granary → Mill → Harvest → Earth.**
 
 ## Status
 
-**v0.3 (Bearers & Documentation) — in progress.** The codebase is a skeleton +
-tests layer (Go types + keeper stubs + invariant tests, zero external Go deps)
-matching the v0.1/v0.2 pre-MVP pattern. See `.ciagent/oy/ROADMAP.md` for the
-phase plan and `.ciagent/oy/PROJECT.md` for governance.
+**v0.6 (Nomad Web UI) — in progress.** v0.5 shipped the Bearers Runtime
+(simtest-grade keeper handlers for 8 x/ modules). v0.6 adds the project's
+first UI: a Go `html/template` + HTMX prototype Web UI in `web/` where a
+visitor can sign up to be a Nomad (create a Reach + open a Stash) and
+exercise basic functionality around Reach, Stash, Window, Standing, and
+Bloom. All data is generated test fixtures — no real chain. See
+`.ciagent/oy/ROADMAP.md` for the phase plan and `.ciagent/oy/PROJECT.md`
+for governance.
 
 ## Build & test
 
@@ -40,6 +44,29 @@ go build ./...
 go test ./...
 ```
 
+## Web UI
+
+The Nomad Web UI (v0.6) is a Go `html/template` server with HTMX progressive
+enhancement, served by a mock HTTP server in `web/` that instantiates the
+real `x/*/types` structs from in-memory fixtures. No node, no build step,
+no real chain. To run it:
+
+```sh
+go run ./web
+# opens on http://localhost:8080 (PORT env var overridable)
+```
+
+Five screens, all reachable from the home nav:
+
+- `/reach` — create a Reach (sign up to be a Nomad) + Reach list/detail
+- `/stash/{holderID}` — Stash dashboard (Grain balance + Bread scale + 90-day maturity)
+- `/window` — Window authorization (open/lifecycle/audit log)
+- `/standing/{reachID}` — Standing + Freeholder signals progress
+- `/bloom/{stashID}` — Bloom accrual view
+
+HTMX is a single vendored JS file (`web/static/htmx.min.js`), NOT a Go
+dependency — `go.mod` stays unchanged (G-006).
+
 ## Docs
 
 The docs site is [MkDocs Material](https://squidfunk.github.io/mkdocs-material/)
@@ -58,17 +85,19 @@ deferred to v0.4 (D-046); v0.3 ships the source.
 ## Lexicon firewall
 
 OpenYield bans 10 financial terms as standalone words (REQ-012) across all Go
-source (`x/**/*.go`) and all docs (`README.md` + `docs/**/*.md`). The banned
-terms are the words you would expect a legacy financial institution to use;
-this README and the docs describe them only by their **safe replacements**, so
-the firewall itself never trips. The firewall is enforced in code by two
-sibling Go tests:
+source (`x/**/*.go`), all docs (`README.md` + `docs/**/*.md`), and all web UI
+files (`web/**/*.{html,js,go}`). The banned terms are the words you would
+expect a legacy financial institution to use; this README and the docs describe
+them only by their **safe replacements**, so the firewall itself never trips.
+The firewall is enforced in code by three sibling Go tests:
 
 - `lexicon_meta_test.go` (v0.2) — scans `x/**/*.go`.
 - `lexicon_meta_docs/lexicon_meta_docs_test.go` (v0.3) — scans `README.md` +
   `docs/**/*.md`.
+- `lexicon_meta_web/lexicon_meta_web_test.go` (v0.6) — scans
+  `web/templates/**` + `web/static/**` + `web/**/*.go`.
 
-Both use `lexicon.FindBannedTerm` (word-boundary, case-insensitive), so
+All three use `lexicon.FindBannedTerm` (word-boundary, case-insensitive), so
 "OpenYield" is safe (word-boundary does not match the banned term inside an
 identifier) but the standalone banned term is not — docs say **"real
 production"** / **"real return"**, and a Holder's identity is **Holder** /