@@ -36,6 +36,7 @@ Deviations are noted per area below.
 | `lock.ts`      | `PathLock` — `RENAME` takes it, `READ`/`WRITE` run outside it                                                                                                 |
 | `subtree.ts`   | `remapSubtree()` — the rename rewrite; internal, deliberately not in the public `path.ts`                                                                     |
 | `ownership.ts` | who a new entry belongs to: `inode_init_owner()`'s set-gid rule, plus the `lchown`/`chmod` that applies it. Internal; used by the two NFS sessions' `#claim`  |
+| `http.ts`      | RFC 9110's `HTTP-date`, `Range` and `ETag` quoting — the one copy, shared by the two HTTP transports; `mountx/s3` re-exports every symbol under its own name  |
 | `auto.ts`      | `mountx/auto` — probe, then FUSE → 9P → NFS, each behind `await import()`                                                                                     |
 
 ### Drivers (`src/drivers/`)
@@ -122,6 +123,25 @@ is no RFC; everything is transcribed from Amazon's docs and named where it is us
 | `session.ts`   | one request in, one reply out, streaming **both ways**. Derived ETags, multipart staged under a reserved prefix                                                  |
 | `server.ts`    | loopback-only without credentials; ordered drain on `close()`                                                                                                    |
 
+## WebDAV (`src/webdav/`, exported as `mountx/webdav`)
+
+The other transport that is not a mount, and the one a kernel can mount anyway
+without root or native code (`davfs2`, `mount_webdav`, the Windows redirector).
+**RFC 4918 class 1** — every method but `LOCK`/`UNLOCK` — transcribed from the RFC,
+with RFC 9110 for the HTTP it rides on and RFC 4331 for the quota pair.
+
+| File           | What                                                                                                                                                         |
+| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `constants.ts` | the errno → HTTP status table, typed **total** over `ErrnoCode` (the same shape as `s3/constants.ts`'s), the protocol's literals, and the `propstat` phrases |
+| `protocol.ts`  | pure: target ↔ `href` (decoded and encoded **per segment**), `Depth`/`Overwrite`/`Destination`, the two request grammars, `multistatus` and `error`          |
+| `session.ts`   | method semantics over one driver. No handle table and no `PathLock` — HTTP carries no per-connection state, so a request resolves its own paths and is done  |
+| `server.ts`    | the socket, and the only file here that imports `node:http`. Loopback-only without credentials; HTTP Basic with them                                         |
+
+The deliberate gaps, each recorded at its own definition: no locking (so the `DAV`
+header says `1, 3`, never `1, 2, 3`), no dead properties (`PROPPATCH` answers `403
+cannot-modify-protected-property` — a driver has nowhere to keep one), and no
+conditional requests (they arrive with `If`, which exists to carry lock tokens).
+
 ## CLI (`src/cli/`, the `mountx` bin, `pnpm mountx` from source)
 
 A demo and a test bench, not a mount tool: it mounts this package's own `README.md`
@@ -197,10 +217,24 @@ The facts no single file's header can own.
   after a failure, and no probe when a transport is named. `p9ModuleRefusal` lives
   there rather than in `9p/probe.ts` because it is a judgement call the no-fallback
   rule forces, not a fact about the host.
-- **`mountx/s3` is outside `auto` on purpose** — `auto`'s contract is a mountpoint,
-  and the gateway never produces one.
+- **`mountx/s3` and `mountx/webdav` are outside `auto` on purpose** — `auto`'s
+  contract is a mountpoint, and neither serving transport produces one. WebDAV is
+  the one whose _client_ can produce one (`davfs2`, `mount_webdav`), which is a fact
+  about the host's tooling rather than something this package does.
+- **`src/webdav/protocol.ts` imports `src/s3/xml.ts`.** The second deliberate
+  cross-transport dependency, after 9P→`fuse/flags.ts`, and the same argument: a
+  bounded XML encoder and a copying, DOCTYPE-refusing parser are facts about XML, not
+  about S3, and a second hardened parser is a second thing to get wrong. What it
+  costs is namespaces — the parser reports local names — which `webdav/protocol.ts`
+  documents in full at its header. `xml.ts` pulls in only `s3/constants.ts`, so
+  `mountx/webdav` does not load a signature or a chunked decoder.
+- **`src/http.ts` is the HTTP the two HTTP transports share** — `formatHttpDate` /
+  `parseHttpDate`, `parseRange` and the `Content-Range`/`ETag` spellings, all
+  RFC 9110. It was `src/s3/protocol.ts`'s until WebDAV needed the same three;
+  `s3/protocol.ts` re-exports every symbol under its old name, so `mountx/s3`'s
+  surface never moved.
 - **Platforms.** FUSE is Linux; 9P is Linux and root-only; NFS is Linux (root) and
-  macOS (no root, behind a consent gate); S3 is anywhere. macOS gets NFS by necessity
+  macOS (no root, behind a consent gate); S3 and WebDAV are anywhere. macOS gets NFS by necessity
   — macFUSE is a third-party kext with its own dialect, so `src/fuse/` cannot serve
   it.
 - **`memory.ts` is the only driver with `mountx.mknod`**, which is what keeps the
 
@@ -48,17 +48,22 @@ no cast.
 
 **The errno table is transcribed once**, in `src/errors.ts`. The addon reports a raw
 positive `errno` and lets `src/fuse/native.ts` name it, rather than carrying a second
-copy of the table in another language where the two would drift.
+copy of the table in another language where the two would drift. The same argument
+covers a wire format two transports share: RFC 9110's `HTTP-date`, `Range` and `ETag`
+spellings live in `src/http.ts`, which `src/s3/protocol.ts` re-exports under its own
+names and `src/webdav/` imports directly — one transcription, two HTTP transports.
 
 ## Wire protocols
 
 **Wire constants are transcribed, never guessed or borrowed from host `node:fs`.**
 FUSE constants come from the kernel's `include/uapi/linux/fuse.h`; NFS constants come
 from RFC 1813/5531/4506 and, for v4.1, RFC 8881 with RFC 5662 for the XDR it does not
 spell out; 9P constants come from the kernel's `include/net/9p/9p.h` (both header
-sources pinned at tag v6.12) with diod's `protocol.md` as the prose reference; the
-`fusermount3` handshake and the Node-API declarations come from libfuse's and Node's
-own sources, both named where they are used.
+sources pinned at tag v6.12) with diod's `protocol.md` as the prose reference; WebDAV's methods,
+statuses, properties and precondition names come from RFC 4918, with RFC 4331 for the
+quota pair and RFC 9110 for the HTTP underneath; the `fusermount3` handshake and the
+Node-API declarations come from libfuse's and Node's own sources, both named where
+they are used.
 
 **The wire's `O_*` and a driver's `O_*` are different namespaces.**
 `fuse_open_in.flags` is the Linux kernel's; `FsDriver` is a subset of
@@ -77,7 +82,9 @@ NFSv4.1, since COMPOUND is the one procedure everything else travels inside.
 one, a thrown value becomes a negative errno on FUSE (unknown → `EIO`), a positive
 Linux errno in an `Rlerror` on 9P, an `nfsstat3` on NFSv3, a legal `nfsstat4` on
 NFSv4.1 (an escaped `XdrError` → `NFS4ERR_BADXDR`, anything else →
-`NFS4ERR_SERVERFAULT`) and one S3 XML error body on the gateway, and a dev-mode
+`NFS4ERR_SERVERFAULT`), one S3 XML error body on the gateway, and one HTTP status —
+mapped from the errno by `src/webdav/constants.ts`'s table, with a `DAV:` `<error>`
+document when there is a §16 condition to carry — on WebDAV, and a dev-mode
 assertion tracks it per request id. A retried `(session, slot, sequence)` on v4.1
 answers from the slot's reply cache and re-runs nothing.
 
 
@@ -37,8 +37,10 @@ area whose code it changes, not the area that motivated it.
 - **`mountx/auto` never falls back after a mount failure**, and never probes
   when a transport is named. The probe decides from host facts, once — a silent
   second attempt would hand back different semantics than the error nobody saw.
-- **The S3 gateway stays out of `mountx/auto`.** Auto's whole contract is a
-  mountpoint and that transport never produces one.
+- **The two HTTP transports stay out of `mountx/auto`.** Auto's whole contract
+  is a mountpoint, and neither `mountx/s3` nor `mountx/webdav` produces one —
+  even though a WebDAV _client_ (`davfs2`, `mount_webdav`) can, which is a fact
+  about the host's tooling rather than something this package does.
 - **NLM byte-range locking is out of scope**, hence NFS mounts use `nolock`.
 - **Per-call caller credentials are not going into `FsDriver`.** The shape would
   be a `mountx.*` extension carrying the caller's uid/gid/groups into each
@@ -239,6 +241,48 @@ area whose code it changes, not the area that motivated it.
   attribute's "deliberately absent, it is the OPEN step's call" note predates
   the OPEN step making that call.
 
+## WebDAV
+
+- **No `LOCK`/`UNLOCK`, so the share is class 1.** This is the one gap with a
+  visible cost rather than a theoretical one: macOS's `mount_webdav` mounts a
+  class-1 share **read-only**, and the Windows redirector has its own
+  objections, so the transport that exists to be the unprivileged mount path
+  cannot yet be an unprivileged _writable_ mount path on either. What it needs
+  is a lock table (tokens, timeouts, depth-0 and depth-infinity scope) plus the
+  `If` header, which is the other half — a request proves it holds a lock by
+  carrying the token there, and implementing `If` without locks would be
+  answering a question nothing can ask. `src/9p/locks.ts` is the nearest
+  precedent for the table, though the semantics are not the same: 9P's are POSIX
+  byte ranges owned by a client/proc pair, WebDAV's are whole-resource (or
+  whole-subtree) and owned by a token the server minted.
+- **Requested properties lose their namespace.** `src/s3/xml.ts`'s parser
+  reports an element's local name and drops its prefix, which is right for the
+  grammar and wrong for a property in a namespace other than `DAV:` — Finder's
+  and Office's `Win32*` properties come back as bare local names in `DAV:`,
+  inside the `404` propstat. Bounded to properties this server does not have,
+  and fixing it means teaching that parser to track `xmlns` bindings, which is a
+  change to a module the S3 gateway depends on.
+- **No conditional requests.** `If-Match`, `If-None-Match`, `If-Modified-Since`
+  and `If-Unmodified-Since` are ignored rather than half-honoured. `mountx/s3`
+  implements RFC 9110's four over the same derived ETag, so the codec is
+  written; what is deliberate is the _timing_ — doing these without `If` would
+  leave the one header WebDAV adds as the conspicuous hole, so they arrive with
+  the locking work above.
+- **`PROPPATCH` cannot store anything.** Every property is refused with `403
+cannot-modify-protected-property`, which is truthful for a server whose
+  properties are all live, and is also what makes a client that sets
+  `Win32LastModifiedTime` (Finder, Explorer) report a failure it did not expect.
+  The cheap half is `getlastmodified` → `driver.utimes()` for a driver
+  declaring `times`; the expensive half is dead properties, which need a store
+  the driver interface does not have — a sidecar file would show up in every
+  listing.
+- **The two HTTP servers duplicate their transport mechanics.**
+  `src/webdav/server.ts` and `src/s3/server.ts` track connections, drain on
+  `close()` and write a streaming reply the same way, deliberately not shared
+  yet: the bind refusal's wording, the fallback error reply and the
+  authentication are each transport's own. If a third HTTP-shaped transport
+  appears, this is the duplication to remove first.
+
 ## Platforms
 
 - **AppleDouble sidecars are undocumented in `docs/`.** macOS tags every new
@@ -256,6 +300,10 @@ area whose code it changes, not the area that motivated it.
   into `kNetFSAlternatePortKey` and then never reads it — it goes to port 111
   and fails `ECONNREFUSED`, fatal for a server with no portmapper. Worth it only
   if someone actually needs the volume to appear where Finder puts one.
-- **WebDAV and Windows support.** Not designed against; WebDAV is the
-  unprivileged, zero-native-code path for macOS/Windows. Windows also has no
-  `mount(8)`, so it stays out of the NFS transport's platform switch.
+- **Windows is still not designed against.** `mountx/webdav` is the
+  unprivileged, zero-native-code path that could reach it — the Windows
+  redirector mounts a WebDAV share with no kernel module and no root — but
+  nothing here has been run on Windows, and the redirector wants class-2
+  locking before it will write (see the WebDAV section). Windows also has no
+  `mount(8)`, so it stays out of the NFS transport's platform switch either
+  way.
@@ -98,6 +98,20 @@ test:9p:mount` / `pnpm test:root`) — 9P has no unprivileged route on any host,
   `oracle.test.ts` — a real `rclone`/`curl` against the gateway, gated on `command -v
 rclone`/`curl` and needing no root, so it runs as part of `pnpm test` and skips
   clean when either binary is absent.
+- `test/webdav/` — Tier 0/1, all of it socket-optional: `protocol.test.ts` (the two
+  request grammars, the `multistatus`/`error` documents, and the target↔`href`
+  mapping round-tripped — the security-relevant half, since a name is the only thing
+  that decides which resource a request reaches), `session.test.ts` (in-process
+  against the memory driver, no sockets: RFC 4918's per-method semantics, the `207`
+  partial-failure shapes for `DELETE` and `COPY`, Basic auth, and the one-reply
+  discipline), and `server.test.ts` (real sockets driven with `fetch` plus one raw
+  one: the bind gate, keep-alive, an unread body drained, a short body taking the
+  connection with it, and an abandoned download releasing its handle), plus
+  `oracle.test.ts` — a real `rclone` and `curl` against the server, gated on
+  `command -v` and needing no root, so it runs as part of `pnpm test` and skips
+  clean when either binary is absent. That is the file that catches a symmetric
+  misreading of RFC 4918, the same role rclone plays for the S3 gateway. **No
+  conformance column yet** — see Known gaps.
 - `test/auto.test.ts` — Tier 0 for `mountx/auto`: the preference order and the
   ruled-out reasons, answered for darwin and win32 from any host via the `platform`
   override. `test/auto-mount.test.ts` — Tier 2, whichever transport this host chose.
@@ -109,6 +123,14 @@ rclone`/`curl` and needing no root, so it runs as part of `pnpm test` and skips
 
 ## Known gaps
 
+- **No WebDAV conformance column.** `test/webdav/` pins the protocol thoroughly but
+  does not run the shared suite, because that needs an `FsDriver` built over the
+  WebDAV session the way `test/s3/client.ts` is over the S3 one — and a WebDAV client
+  can offer no `handles`, no `symlinks`, no `permissions` and no `truncate`, so most
+  of what the column would report is already known from the protocol. It is worth
+  writing anyway, for the same reason the S3 column was: the rows nobody predicted
+  are the point. Until then `pnpm matrix` has five columns, not six.
+
 - **No real-mount NFSv4.1 column.** Tier-2 `test/nfs/mount.test.ts` is v3-only; the
   dev host has no `mount.nfs` to write a v4.1 one against. The protocol is not
   unwitnessed, though: a VM guest supplies the missing client, and two of them have
 
@@ -1,9 +1,9 @@
 # mountx
 
 Mount a JavaScript filesystem: one driver interface (a subset of `node:fs/promises`),
-multiple transports — FUSE, 9P, NFS (v3 and v4.1) — plus an S3 gateway (`mountx/s3`)
-that serves the same driver to an S3 client instead of mounting it, deliberately
-outside `mountx/auto`.
+multiple transports — FUSE, 9P, NFS (v3 and v4.1) — plus two that serve the same
+driver over HTTP instead of mounting it, an S3 gateway (`mountx/s3`) and a WebDAV
+server (`mountx/webdav`), both deliberately outside `mountx/auto`.
 
 **Conventions:** pure JS/TS, zero runtime deps, pure-JS-first. Single package with
 subpath exports. Small conventional commits to `main`, `pnpm test` green before each
@@ -28,12 +28,14 @@ any rule below that looks removable.
 | `src/harness.ts` | `createLoopback(driver)` — what driver authors test against                                            |
 | `src/lock.ts`    | `PathLock`, taken by `RENAME` on every transport                                                       |
 | `src/subtree.ts` | `remapSubtree()` — the rename rewrite all three handle tables share (internal)                         |
+| `src/http.ts`    | RFC 9110's `HTTP-date`, `Range` and `ETag` quoting — shared by the two HTTP transports                 |
 | `src/auto.ts`    | `mountx/auto`: probe, then FUSE → 9P → NFS, each via `await import()`                                  |
 | `src/drivers/`   | `memory` (the only `mountx.mknod` implementation), `node-fs`, `unstorage`, `handle.ts`                 |
 | `src/fuse/`      | `mountx/fuse` — protocol 7.41, root and `fusermount3` mount paths, `exec.ts` (shared spawn/`Deadline`) |
 | `src/9p/`        | `mountx/9p` — 9P2000.L, `trans=unix` by default, one session per connection                            |
 | `src/nfs/`       | `mountx/nfs` — a version router over `v3/` (RFC 1813 + MOUNT) and `v4/` (NFSv4.1); Linux and macOS     |
 | `src/s3/`        | `mountx/s3` — SigV4 gateway over HTTP, path-style, one bucket per driver                               |
+| `src/webdav/`    | `mountx/webdav` — RFC 4918 class 1 over HTTP; no locking, and the `DAV` header says so                 |
 | `src/cli/`       | the `mountx` bin — a demo and test bench that mounts this package's README                             |
 | `native/`        | the Zig Node-API addon and its generated embed (`prebuilt.mjs`)                                        |
 | `test/`          | Tier 0/1/2 suites and the shared conformance suite — see `.agents/testing.md`                          |
 
@@ -73,6 +73,7 @@ npx mountx
 - [Troubleshooting](https://mountx.vercel.app/guide/troubleshooting) — the things that will bite you, and how to recover.
 - [Transports](https://mountx.vercel.app/transports) — FUSE, 9P and NFS, what each costs, and how to pin one.
 - [S3 Gateway](https://mountx.vercel.app/transports/s3) — serve a driver as an S3-compatible bucket for `rclone`, the AWS CLI or an SDK, no mount involved.
+- [WebDAV](https://mountx.vercel.app/transports/webdav) — serve a driver over RFC 4918 to `rclone`, `curl` or `davfs2`, no mount involved either.
 - [Reference](https://mountx.vercel.app/reference) — every entry point, option and type.
 
 ## Development
 
@@ -12,6 +12,7 @@ export default defineBuildConfig({
         "./src/nfs/index.ts",
         "./src/9p/index.ts",
         "./src/s3/index.ts",
+        "./src/webdav/index.ts",
         "./src/drivers/memory.ts",
         "./src/drivers/node-fs.ts",
         "./src/drivers/unstorage.ts",