diff --git a/.gitignore b/.gitignore
index b421d7e..a5fbcc8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,13 @@
 *.o
 *.a
 rxgrep
+binary_scan
+utf8_scripts
+ascii_logparse
+redos_atomic
+empty_match_rule
+large_file_search
+bench_vs_posix
 tests/generated_tests.c
 /.claude/
 *.dSYM/
diff --git a/Makefile b/Makefile
index 84b13a1..676cfe1 100644
--- a/Makefile
+++ b/Makefile
@@ -13,7 +13,7 @@ PREFIX   ?= /usr/local
 
 AR       ?= ar
 
-.PHONY: all lib example test check clean install fuzz-smoke
+.PHONY: all lib example examples test check clean install fuzz-smoke
 
 all: lib example
 
@@ -32,6 +32,36 @@ example: rxgrep
 rxgrep: examples/rxgrep.c libregexx.a regexx.h
 	$(CC) $(CFLAGS) -I. -o $@ examples/rxgrep.c libregexx.a $(LDLIBS)
 
+# ---- feature examples ------------------------------------------------------
+# Each program under examples/ (besides rxgrep) isolates one distinct,
+# less-obvious feature (a data mode, an empty-match rule, a ReDoS
+# mitigation, mmap-backed large file input) rather than being a general
+# purpose tool; see examples/README.md for what each one demonstrates.
+EXAMPLE_BINS = binary_scan utf8_scripts ascii_logparse redos_atomic empty_match_rule large_file_search bench_vs_posix
+
+examples: rxgrep $(EXAMPLE_BINS)
+
+binary_scan: examples/binary_scan.c libregexx.a regexx.h
+	$(CC) $(CFLAGS) -I. -o $@ examples/binary_scan.c libregexx.a $(LDLIBS)
+
+utf8_scripts: examples/utf8_scripts.c libregexx.a regexx.h
+	$(CC) $(CFLAGS) -I. -o $@ examples/utf8_scripts.c libregexx.a $(LDLIBS)
+
+ascii_logparse: examples/ascii_logparse.c libregexx.a regexx.h
+	$(CC) $(CFLAGS) -I. -o $@ examples/ascii_logparse.c libregexx.a $(LDLIBS)
+
+redos_atomic: examples/redos_atomic.c libregexx.a regexx.h
+	$(CC) $(CFLAGS) -I. -o $@ examples/redos_atomic.c libregexx.a $(LDLIBS)
+
+empty_match_rule: examples/empty_match_rule.c libregexx.a regexx.h
+	$(CC) $(CFLAGS) -I. -o $@ examples/empty_match_rule.c libregexx.a $(LDLIBS)
+
+large_file_search: examples/large_file_search.c libregexx.a regexx.h
+	$(CC) $(CFLAGS) -I. -o $@ examples/large_file_search.c libregexx.a $(LDLIBS)
+
+bench_vs_posix: examples/bench_vs_posix.c libregexx.a regexx.h
+	$(CC) $(CFLAGS) -I. -o $@ examples/bench_vs_posix.c libregexx.a $(LDLIBS)
+
 # ---- tests -----------------------------------------------------------------
 # tests/generated_tests.c is generated from tests/cases.py using
 # CPython's own `re` module as ground truth (concept.md Section 11).
@@ -54,4 +84,4 @@ install: libregexx.a regexx.h
 	install -m644 regexx.h $(DESTDIR)$(PREFIX)/include/
 
 clean:
-	rm -f regexx.o libregexx.a rxgrep tests/generated_tests.c
+	rm -f regexx.o libregexx.a rxgrep tests/generated_tests.c $(EXAMPLE_BINS)
diff --git a/README.md b/README.md
index 1aec56d..0b6d37e 100644
--- a/README.md
+++ b/README.md
@@ -367,6 +367,36 @@ API:
 
 Run `./rxgrep --help` for the full option list.
 
+`examples/` has six further programs, each isolating one distinct feature
+(a data mode, the undocumented CPython empty-match rule, atomic-group ReDoS
+mitigation, `mmap`-backed large file input) rather than being a general
+purpose tool; `make examples` builds all of them, and
+[`examples/README.md`](examples/README.md) lists what each one demonstrates.
+
+## Benchmarks
+
+`examples/bench_vs_posix.c` measures this library directly against the C
+standard library's own `<regex.h>` (POSIX `regcomp`/`regexec`, glibc's
+DFA-backed implementation), on six scenarios at multi-megabyte or
+multi-hundred-thousand-line scale, using only ERE pattern syntax that
+regexx also accepts (no `\d`/`\w`/`\s`, no POSIX bracket classes), so both
+engines run the identical pattern text against the identical subject. Reported without adjustment in either direction: on this
+machine, glibc's engine is roughly 2x to 35x faster across the five
+scenarios both engines can run, which is the expected outcome of a
+roughly 2000-line backtracking interpreter built for Python `re`
+compatibility competing against a DFA-backed engine with decades of
+production optimization behind it and a much smaller feature set (no named
+groups, no lazy quantifiers, no lookaround, no atomic groups, and no way to
+search past an embedded `NUL` byte at all). The sharpest case is the
+textbook ReDoS shape `(a+)+b`: measured at roughly 3x slower than glibc in
+its plain form (a real cost, not a hang, since memoization keeps it
+quadratic rather than exponential, "Implementation status" above), and, in
+the same measurement, effectively free once rewritten with an atomic group,
+a fix POSIX ERE cannot even express. Every scenario's match count is
+cross-checked between the two engines and reported as agreeing or
+differing, an independent correctness check beyond the CPython-derived test
+suite below.
+
 ## Testing
 
 `tests/cases.py` lists pattern/subject/operation triples, both hand-written
diff --git a/USAGE.md b/USAGE.md
index ada1b3e..901f312 100644
--- a/USAGE.md
+++ b/USAGE.md
@@ -719,3 +719,20 @@ Reading its source alongside this document is a reasonable next step once
 the examples above are familiar: it shows every function here used together
 in one program, including the parts this document simplified away for
 clarity (option parsing, line splitting, output formatting).
+
+`examples/` also has six smaller, single-purpose programs, each isolating
+one distinct feature this section-by-section walkthrough only touches
+briefly: `binary_scan.c` (raw byte-range classes including embedded `NUL`),
+`utf8_scripts.c` (`\w` across non-Latin scripts, code point versus byte
+offsets), `ascii_logparse.c` (named groups against structured log text),
+`redos_atomic.c` (atomic groups/possessive quantifiers timed directly
+against the unprotected form of a catastrophic-backtracking pattern),
+`empty_match_rule.c` (the undocumented CPython empty-match retry rule,
+verified against a real interpreter), `large_file_search.c` (`mmap`-backed
+file input at 100MB, with elapsed time and peak memory printed), and
+`bench_vs_posix.c` (a direct, honestly-reported timing comparison against
+the C standard library's own `<regex.h>` on six scenarios, including the
+one adversarial pattern shape where the gap is largest and how an atomic
+group closes it). See [`examples/README.md`](examples/README.md) for the
+complete list with what each one demonstrates; `make examples` builds all
+of them.
diff --git a/examples/README.md b/examples/README.md
new file mode 100644
index 0000000..1bd6962
--- /dev/null
+++ b/examples/README.md
@@ -0,0 +1,32 @@
+# Examples
+
+Each program here is self-contained (`main`, no shared helper code) and
+isolates one distinct feature rather than being a general purpose tool; the
+one exception is `rxgrep.c`, a small grep-like program that ties several of
+the same features together into something actually usable from a shell.
+[`../USAGE.md`](../USAGE.md) walks through the same API surface function by
+function, with smaller inline snippets; these programs are complete,
+runnable, and closer to what real code doing this specific thing looks
+like.
+
+Build all of them with `make examples` from the repository root (or
+`make all` / `make example` for just `rxgrep`, the default). Each is also a
+single `cc -I. file.c libregexx.a -o file` invocation away from being built
+directly, no build system required.
+
+| Program | Demonstrates |
+|---|---|
+| [`rxgrep.c`](rxgrep.c) | A complete grep-like CLI: all three data modes via `-m`, `Pattern_search`/`finditer` for line and per-match output, `Pattern_subn` for `--sub`, reading from a real file or a pipe. Run `./rxgrep --help`. |
+| [`binary_scan.c`](binary_scan.c) | `BINARY` mode: a byte-range character class (`[\x00-\xff]`) matching raw bytes 0-255, including an embedded `NUL` and an embedded `0x0A`, neither of which is a terminator or a line break in this mode the way it would be to a C string function or a line-oriented reader. This is the one thing `ASCII`/`UTF8` mode cannot do, since both introduce either a restricted classification or a decoding step. |
+| [`utf8_scripts.c`](utf8_scripts.c) | `UTF8` mode: `\w` recognizing letters across Latin, Greek, Cyrillic, and CJK text (not only ASCII), and the resulting difference between `Match_span` (code point units) and `Match_span_byte` (byte units) once a match spans characters that are more than one byte wide. |
+| [`ascii_logparse.c`](ascii_logparse.c) | `ASCII` mode doing what it is ordinarily used for: parsing structured, line-oriented text with named groups (`(?P<name>...)`) and reading fields back out by name via `Match_group`/`Pattern_groupindex_lookup`, not by a numeric position the caller has to remember. |
+| [`redos_atomic.c`](redos_atomic.c) | Atomic groups (`(?>...)`) and possessive quantifiers (`a++`) as a real, pattern-author-controlled defense against catastrophic backtracking, timed directly against the plain, unprotected form of the textbook `(a+)+b` shape on a non-matching adversarial input. |
+| [`empty_match_rule.c`](empty_match_rule.c) | `Pattern_finditer`/`Pattern_split` reproducing a real CPython interpreter's undocumented empty-match retry rule exactly (`\d*?` against `"123abc456"` yields 16 matches, not 9), found by probing a real interpreter directly rather than by reading its documentation. |
+| [`large_file_search.c`](large_file_search.c) | `Input_from_file`'s `mmap`-backed reading on a generated 100MB file, with the elapsed time and peak resident memory printed directly so they can be checked against the measured figures in `../README.md` "Memory footprint" rather than taken on faith. |
+| [`bench_vs_posix.c`](bench_vs_posix.c) | A direct, timed comparison against the C standard library's own `<regex.h>` (POSIX `regcomp`/`regexec`) on six scenarios at multi-megabyte/multi-hundred-thousand-line scale, using only pattern syntax valid in both engines. Reported honestly: glibc's DFA-backed engine wins most scenarios by a wide margin, and the one adversarial pattern shape (`(a+)+b`) where this library's backtracking cost is most visible is shown both in its plain form and fixed with an atomic group, the latter having no POSIX ERE equivalent to compare against at all. |
+
+Every program below was compiled and actually run while writing it; the
+claims in its top-of-file comment (what a real CPython interpreter does,
+what timing difference an atomic group makes, and so on) are checked
+against that program's own printed output, not written by hand and left
+unverified.
diff --git a/examples/ascii_logparse.c b/examples/ascii_logparse.c
new file mode 100644
index 0000000..50300c5
--- /dev/null
+++ b/examples/ascii_logparse.c
@@ -0,0 +1,71 @@
+/* ascii_logparse - demonstrates ASCII mode doing what it is actually for:
+ * parsing structured, line-oriented text with named groups, then reading
+ * fields back out by name rather than by remembering a numeric position.
+ * This is the ordinary, common case the other examples in this directory
+ * deliberately are not (they each isolate one less-common feature
+ * instead); it is included so the directory has one example that looks
+ * like typical real-world usage: log filtering and field extraction.
+ */
+#include "regexx.h"
+#include <stdio.h>
+#include <string.h>
+
+static const char *LOG =
+    "2024-01-15 10:23:45 INFO  [auth] user 'alice' logged in from 10.0.0.5\n"
+    "2024-01-15 10:24:02 ERROR [db] connection refused to 10.0.0.9:5432\n"
+    "2024-01-15 10:24:03 WARN  [auth] repeated login failure for user 'bob'\n"
+    "2024-01-15 10:25:11 ERROR [auth] user 'bob' locked out after 5 failures\n"
+    "2024-01-15 10:26:00 INFO  [db] connection pool resized to 32\n";
+
+int main(void) {
+    const char *pattern =
+        "(?P<date>\\d{4}-\\d{2}-\\d{2}) (?P<time>\\d{2}:\\d{2}:\\d{2}) "
+        "(?P<level>\\w+)\\s+\\[(?P<component>\\w+)\\] (?P<message>.+)";
+    PatternError err; memset(&err, 0, sizeof err);
+    Pattern *pat = re_compile(pattern, strlen(pattern), ASCII, &err);
+    if (!pat) {
+        fprintf(stderr, "compile error: %s\n", err.msg);
+        PatternError_free(&err);
+        return 1;
+    }
+
+    printf("-- every ERROR line, fields read back by name --\n");
+    size_t linelen = strlen(LOG);
+    size_t start = 0;
+    int error_count = 0;
+    for (size_t pos = 0; pos <= linelen; pos++) {
+        if (pos == linelen || LOG[pos] == '\n') {
+            size_t len = pos - start;
+            if (len > 0) {
+                Input *line = Input_from_buffer((const uint8_t *)(LOG + start), len);
+                Match m; memset(&m, 0, sizeof m);
+                if (Pattern_fullmatch(pat, line, 0, -1, &m) == 1) {
+                    const char *level; size_t levellen;
+                    Match_group(&m, "level", 0, &level, &levellen);
+                    if (levellen == 5 && strncmp(level, "ERROR", 5) == 0) {
+                        const char *time, *component, *message;
+                        size_t timelen, componentlen, messagelen;
+                        Match_group(&m, "time", 0, &time, &timelen);
+                        Match_group(&m, "component", 0, &component, &componentlen);
+                        Match_group(&m, "message", 0, &message, &messagelen);
+                        printf("[%.*s] %.*s: %.*s\n",
+                               (int)timelen, time,
+                               (int)componentlen, component,
+                               (int)messagelen, message);
+                        error_count++;
+                    }
+                    Match_free(&m);
+                }
+                Input_free(line);
+            }
+            start = pos + 1;
+        }
+    }
+    printf("\n%d error line(s) found (Pattern_groupindex_lookup(\"message\") = %d,\n"
+           "used internally by name lookup so this program never hardcodes a\n"
+           "capturing group's numeric position)\n",
+           error_count, Pattern_groupindex_lookup(pat, "message"));
+
+    Pattern_free(pat);
+    return 0;
+}
diff --git a/examples/bench_vs_posix.c b/examples/bench_vs_posix.c
new file mode 100644
index 0000000..6a2cce6
--- /dev/null
+++ b/examples/bench_vs_posix.c
@@ -0,0 +1,446 @@
+/* bench_vs_posix - a direct, measured comparison between this library and
+ * the C standard library's own regex engine (POSIX <regex.h>,
+ * regcomp/regexec, glibc's implementation on the platform this is built
+ * on). Every other example in this directory demonstrates a feature; this
+ * one instead demonstrates a limitation, honestly, at scale: regexx is a
+ * roughly 2000-line single-file backtracking interpreter (concept.md
+ * Section 7.3) built for Python `re` compatibility and convenience,
+ * competing against a DFA-backed engine that has been the default regex
+ * implementation on every Linux system for decades. Nothing here is
+ * rigged to make either engine look better; every pattern used is valid
+ * POSIX ERE syntax AND valid regexx syntax (no \d/\w/\s, no POSIX bracket
+ * classes, no lazy quantifiers), so both engines run the identical
+ * pattern text, and every scenario reports both engines' actual timing,
+ * including the ones where POSIX wins by a wide margin.
+ *
+ * Six scenarios, each at multi-megabyte or multi-hundred-thousand-line
+ * scale:
+ *   A. A literal needle near the end of a large non-matching haystack
+ *      (tests raw linear-scan throughput).
+ *   B. Extracting every number from a large text (tests iterated-match
+ *      throughput, not just a single search).
+ *   C. `a*b` against a large non-matching run of 'a' characters (the
+ *      pattern shape README.md documents this library's precomputed
+ *      skip-ahead tables were built specifically to fix).
+ *   D. `(a+)+b` against a non-matching run of 'a' characters (the textbook
+ *      ReDoS shape): the plain form, and, for regexx only, since POSIX ERE
+ *      has no equivalent syntax at all, the atomic-group form that avoids
+ *      it (examples/redos_atomic.c covers this one feature in isolation).
+ *   E. Case-insensitive alternation over a large text with many matches.
+ *   F. Anchored, per-line matching over several hundred thousand lines
+ *      (the shape examples/ascii_logparse.c and rxgrep.c's line mode
+ *      both use for real).
+ *
+ * A POSIX regex operates on a NUL-terminated C string with no notion of
+ * "here is how many bytes, keep going past an embedded NUL if there are
+ * any"; regexx's BINARY mode (examples/binary_scan.c) exists specifically
+ * because POSIX <regex.h> cannot do that at all, at any speed, which is a
+ * capability difference this file does not attempt to benchmark, since
+ * there is no POSIX baseline to measure against for it.
+ */
+#define _POSIX_C_SOURCE 199309L
+#include "regexx.h"
+#include <regex.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <time.h>
+
+/* Iterated matching against POSIX <regex.h> is done with REG_STARTEND
+ * (a widely available GNU/BSD extension to POSIX regexec, unconditionally
+ * declared by glibc's regex.h with no feature-test macro needed, unlike
+ * the rest of that header's GNU-only surface) rather than by advancing a
+ * `const char *` pointer and calling plain regexec() repeatedly. The
+ * pointer-advancing approach was tried first and measured to be quadratic
+ * in practice: without REG_STARTEND, regexec() has no way to know where
+ * the searchable string ends except by scanning for a NUL byte, so every
+ * call after the first rescans however much of the buffer remains,
+ * turning "run this pattern m times over an n-byte buffer" into O(n*m)
+ * instead of O(n). REG_STARTEND instead takes explicit [rm_so, rm_eo)
+ * byte offsets into the original, fixed buffer pointer, so no rescan
+ * happens and no NUL terminator is consulted at all (this is also,
+ * incidentally, the mechanism a POSIX-based program would use to search a
+ * buffer containing embedded NUL bytes, though this file does not
+ * otherwise exercise that). Deliberately not built with _GNU_SOURCE: that
+ * macro additionally exposes glibc's older re_search/re_match API, whose
+ * declarations collide with this project's own re_search/re_match
+ * (regexx.h, Python-exact naming, concept.md Section 9), so this file
+ * only enables what REG_STARTEND itself needs. */
+
+static double now_seconds(void) {
+    struct timespec ts;
+    clock_gettime(CLOCK_MONOTONIC, &ts);
+    return (double)ts.tv_sec + (double)ts.tv_nsec / 1e9;
+}
+
+typedef struct {
+    const char *label;
+    double regexx_time;
+    double posix_time;
+    int have_posix;      /* 0 for the one regexx-only row (atomic group) */
+    long regexx_count;   /* matches found, or 0/1 for a single search */
+    long posix_count;
+    const char *unit;    /* what regexx_time/posix_time are measuring, for the table */
+} Result;
+
+#define MAX_RESULTS 16
+static Result results[MAX_RESULTS];
+static int nresults = 0;
+
+static Result *add_result(const char *label, const char *unit) {
+    Result *r = &results[nresults++];
+    memset(r, 0, sizeof *r);
+    r->label = label;
+    r->unit = unit;
+    r->have_posix = 1;
+    return r;
+}
+
+/* ---- Scenario A: literal needle near the end of a large haystack ---- */
+static void scenario_a(void) {
+    size_t n = 40u * 1024 * 1024;
+    char *buf = malloc(n + 1);
+    memset(buf, 'x', n);
+    const char *needle = "needle_in_a_haystack_42";
+    size_t nl = strlen(needle);
+    memcpy(buf + n - nl - 100, needle, nl); /* near, not at, the very end */
+    buf[n] = '\0';
+
+    Result *r = add_result("A: literal search, 40MB haystack", "search");
+
+    PatternError err; memset(&err, 0, sizeof err);
+    Pattern *pat = re_compile(needle, nl, ASCII, &err);
+    Input *in = Input_from_buffer((const uint8_t *)buf, n);
+    Match m; memset(&m, 0, sizeof m);
+    double t0 = now_seconds();
+    int rc = Pattern_search(pat, in, 0, -1, &m);
+    r->regexx_time = now_seconds() - t0;
+    r->regexx_count = (rc == 1);
+    if (rc == 1) Match_free(&m);
+    Input_free(in);
+    Pattern_free(pat);
+
+    regex_t re;
+    regcomp(&re, needle, REG_EXTENDED | REG_NOSUB);
+    regmatch_t pm;
+    t0 = now_seconds();
+    int prc = regexec(&re, buf, 0, &pm, 0);
+    r->posix_time = now_seconds() - t0;
+    r->posix_count = (prc == 0);
+    regfree(&re);
+
+    free(buf);
+}
+
+/* ---- Scenario B: extract every number from a large text ---- */
+static void print_count_cb(void *ctx, const Match *m) {
+    (void)m;
+    long *n = ctx;
+    (*n)++;
+}
+static void scenario_b(void) {
+    size_t target = 20u * 1024 * 1024;
+    size_t cap = target + 4096;
+    char *buf = malloc(cap);
+    size_t len = 0;
+    unsigned long seed = 1; /* unsigned: wraps well-defined on overflow, unlike signed long */
+    while (len < target) {
+        seed = seed * 1103515245u + 12345u;
+        int v = (int)((seed >> 16) & 0xFFFF);
+        len += (size_t)snprintf(buf + len, cap - len, "id%d val%d code%d ", v, v * 3, v % 97);
+    }
+    buf[len] = '\0';
+
+    Result *r = add_result("B: extract all numbers, 20MB text", "matches");
+    const char *pattern = "[0-9]+";
+
+    PatternError err; memset(&err, 0, sizeof err);
+    Pattern *pat = re_compile(pattern, strlen(pattern), ASCII, &err);
+    Input *in = Input_from_buffer((const uint8_t *)buf, len);
+    long count = 0;
+    double t0 = now_seconds();
+    Pattern_finditer(pat, in, 0, -1, print_count_cb, &count);
+    r->regexx_time = now_seconds() - t0;
+    r->regexx_count = count;
+    Input_free(in);
+    Pattern_free(pat);
+
+    regex_t re;
+    regcomp(&re, pattern, REG_EXTENDED);
+    long pcount = 0;
+    size_t start = 0;
+    regmatch_t pm;
+    t0 = now_seconds();
+    while (start <= len) {
+        pm.rm_so = (regoff_t)start;
+        pm.rm_eo = (regoff_t)len;
+        if (regexec(&re, buf, 1, &pm, REG_STARTEND | (start == 0 ? 0 : REG_NOTBOL)) != 0) break;
+        pcount++;
+        size_t mso = (size_t)pm.rm_so, meo = (size_t)pm.rm_eo;
+        start = (meo > mso) ? meo : meo + 1;
+    }
+    r->posix_time = now_seconds() - t0;
+    r->posix_count = pcount;
+    regfree(&re);
+
+    free(buf);
+}
+
+/* ---- Scenario C: a*b, non-matching, over a large run of 'a' ---- */
+static void scenario_c(void) {
+    size_t n = 20u * 1024 * 1024;
+    char *buf = malloc(n + 1);
+    memset(buf, 'a', n);
+    buf[n] = '\0';
+
+    Result *r = add_result("C: a*b non-match, 20MB of 'a'", "search");
+    const char *pattern = "a*b";
+
+    PatternError err; memset(&err, 0, sizeof err);
+    Pattern *pat = re_compile(pattern, strlen(pattern), ASCII, &err);
+    Input *in = Input_from_buffer((const uint8_t *)buf, n);
+    Match m; memset(&m, 0, sizeof m);
+    double t0 = now_seconds();
+    int rc = Pattern_search(pat, in, 0, -1, &m);
+    r->regexx_time = now_seconds() - t0;
+    r->regexx_count = (rc == 1);
+    if (rc == 1) Match_free(&m);
+    Input_free(in);
+    Pattern_free(pat);
+
+    regex_t re;
+    regcomp(&re, pattern, REG_EXTENDED | REG_NOSUB);
+    regmatch_t pm;
+    t0 = now_seconds();
+    int prc = regexec(&re, buf, 0, &pm, 0);
+    r->posix_time = now_seconds() - t0;
+    r->posix_count = (prc == 0);
+    regfree(&re);
+
+    free(buf);
+}
+
+/* ---- Scenario D: (a+)+b, the textbook ReDoS shape, non-matching ---- */
+static void scenario_d(void) {
+    size_t n = 22000;
+    char *buf = malloc(n + 1);
+    memset(buf, 'a', n);
+    buf[n] = '\0';
+
+    Result *r = add_result("D1: (a+)+b non-match, plain, 22000 'a'", "search");
+    const char *pattern = "(a+)+b";
+
+    PatternError err; memset(&err, 0, sizeof err);
+    Pattern *pat = re_compile(pattern, strlen(pattern), ASCII, &err);
+    Input *in = Input_from_buffer((const uint8_t *)buf, n);
+    Match m; memset(&m, 0, sizeof m);
+    double t0 = now_seconds();
+    int rc = Pattern_search(pat, in, 0, -1, &m);
+    r->regexx_time = now_seconds() - t0;
+    r->regexx_count = (rc == 1);
+    if (rc == 1) Match_free(&m);
+    Input_free(in);
+    Pattern_free(pat);
+
+    regex_t re;
+    regcomp(&re, pattern, REG_EXTENDED | REG_NOSUB);
+    regmatch_t pm;
+    t0 = now_seconds();
+    int prc = regexec(&re, buf, 0, &pm, 0);
+    r->posix_time = now_seconds() - t0;
+    r->posix_count = (prc == 0);
+    regfree(&re);
+
+    /* Second row: the atomic-group rewrite. POSIX ERE has no atomic
+     * group or possessive quantifier syntax at all (not "slower", simply
+     * inexpressible), so this row has no POSIX column. */
+    Result *r2 = add_result("D2: (?>a+)+b non-match, atomic, same input", "search");
+    r2->have_posix = 0;
+    const char *pattern2 = "(?>a+)+b";
+    PatternError err2; memset(&err2, 0, sizeof err2);
+    Pattern *pat2 = re_compile(pattern2, strlen(pattern2), ASCII, &err2);
+    Input *in2 = Input_from_buffer((const uint8_t *)buf, n);
+    Match m2; memset(&m2, 0, sizeof m2);
+    t0 = now_seconds();
+    int rc2 = Pattern_search(pat2, in2, 0, -1, &m2);
+    r2->regexx_time = now_seconds() - t0;
+    r2->regexx_count = (rc2 == 1);
+    if (rc2 == 1) Match_free(&m2);
+    Input_free(in2);
+    Pattern_free(pat2);
+
+    free(buf);
+}
+
+/* ---- Scenario E: case-insensitive alternation, many matches ---- */
+static void scenario_e(void) {
+    const char *animals[] = { "Cat", "DOG", "bird", "FiSh", "snake" };
+    size_t target = 12u * 1024 * 1024;
+    size_t cap = target + 4096;
+    char *buf = malloc(cap);
+    size_t len = 0;
+    int i = 0;
+    while (len < target) {
+        len += (size_t)snprintf(buf + len, cap - len, "%s and some filler text here. ", animals[i % 5]);
+        i++;
+    }
+    buf[len] = '\0';
+
+    Result *r = add_result("E: case-insensitive alternation, 12MB", "matches");
+    const char *pattern = "(cat|dog|bird|fish|snake)";
+
+    PatternError err; memset(&err, 0, sizeof err);
+    Pattern *pat = re_compile(pattern, strlen(pattern), ASCII | IGNORECASE, &err);
+    Input *in = Input_from_buffer((const uint8_t *)buf, len);
+    long count = 0;
+    double t0 = now_seconds();
+    Pattern_finditer(pat, in, 0, -1, print_count_cb, &count);
+    r->regexx_time = now_seconds() - t0;
+    r->regexx_count = count;
+    Input_free(in);
+    Pattern_free(pat);
+
+    regex_t re;
+    regcomp(&re, pattern, REG_EXTENDED | REG_ICASE);
+    long pcount = 0;
+    size_t start = 0;
+    regmatch_t pm;
+    t0 = now_seconds();
+    while (start <= len) {
+        pm.rm_so = (regoff_t)start;
+        pm.rm_eo = (regoff_t)len;
+        if (regexec(&re, buf, 1, &pm, REG_STARTEND | (start == 0 ? 0 : REG_NOTBOL)) != 0) break;
+        pcount++;
+        size_t mso = (size_t)pm.rm_so, meo = (size_t)pm.rm_eo;
+        start = (meo > mso) ? meo : meo + 1;
+    }
+    r->posix_time = now_seconds() - t0;
+    r->posix_count = pcount;
+    regfree(&re);
+
+    free(buf);
+}
+
+/* ---- Scenario F: anchored per-line matching, many lines ---- */
+static void scenario_f(void) {
+    long nlines = 400000;
+    size_t cap = (size_t)nlines * 64;
+    char *buf = malloc(cap);
+    size_t len = 0;
+    for (long i = 0; i < nlines; i++) {
+        const char *level = (i % 10 == 0) ? "ERROR" : (i % 3 == 0) ? "WARN" : "INFO";
+        len += (size_t)snprintf(buf + len, cap - len, "%s message number %ld here\n", level, i);
+    }
+    buf[len] = '\0';
+
+    Result *r = add_result("F: '^ERROR', 400000 lines", "matches");
+    const char *pattern = "^ERROR";
+
+    PatternError err; memset(&err, 0, sizeof err);
+    Pattern *pat = re_compile(pattern, strlen(pattern), ASCII, &err);
+    long rcount = 0;
+    double t0 = now_seconds();
+    {
+        size_t start = 0;
+        for (size_t pos = 0; pos <= len; pos++) {
+            if (pos == len || buf[pos] == '\n') {
+                size_t linelen = pos - start;
+                Input *lin = Input_from_buffer((const uint8_t *)(buf + start), linelen);
+                Match m; memset(&m, 0, sizeof m);
+                if (Pattern_search(pat, lin, 0, -1, &m) == 1) { rcount++; Match_free(&m); }
+                Input_free(lin);
+                start = pos + 1;
+            }
+        }
+    }
+    r->regexx_time = now_seconds() - t0;
+    r->regexx_count = rcount;
+    Pattern_free(pat);
+
+    regex_t re;
+    regcomp(&re, pattern, REG_EXTENDED | REG_NOSUB);
+    long pcount = 0;
+    t0 = now_seconds();
+    {
+        char *line = malloc(256);
+        size_t start = 0;
+        for (size_t pos = 0; pos <= len; pos++) {
+            if (pos == len || buf[pos] == '\n') {
+                size_t linelen = pos - start;
+                if (linelen < 256) {
+                    memcpy(line, buf + start, linelen);
+                    line[linelen] = '\0';
+                    regmatch_t pm;
+                    if (regexec(&re, line, 0, &pm, 0) == 0) pcount++;
+                }
+                start = pos + 1;
+            }
+        }
+        free(line);
+    }
+    r->posix_time = now_seconds() - t0;
+    r->posix_count = pcount;
+    regfree(&re);
+
+    free(buf);
+}
+
+static void bar(double frac, char *out, int width) {
+    int filled = (int)(frac * width);
+    if (filled > width) filled = width;
+    if (filled < 0) filled = 0;
+    for (int i = 0; i < width; i++) out[i] = (i < filled) ? '#' : '.';
+    out[width] = '\0';
+}
+
+int main(void) {
+    printf("regexx vs POSIX <regex.h>: measured, not estimated.\n");
+    printf("Every pattern below is valid syntax for both engines; both run\n");
+    printf("against the identical subject text. Times are wall-clock seconds\n");
+    printf("(CLOCK_MONOTONIC), one run each, on whatever machine this runs on.\n\n");
+
+    scenario_a();
+    scenario_b();
+    scenario_c();
+    scenario_d();
+    scenario_e();
+    scenario_f();
+
+    printf("%-42s %12s %12s %10s %8s\n", "scenario", "regexx", "POSIX", "ratio", "match?");
+    for (int i = 0; i < nresults; i++) {
+        Result *r = &results[i];
+        char barbuf[41];
+        if (r->have_posix) {
+            double ratio = r->posix_time > 0 ? r->regexx_time / r->posix_time : 0;
+            printf("%-42s %10.4fs %10.4fs %9.1fx %8s\n",
+                   r->label, r->regexx_time, r->posix_time, ratio,
+                   (r->regexx_count == r->posix_count) ? "agree" : "DIFFER");
+            bar(r->regexx_time / (r->regexx_time + r->posix_time), barbuf, 40);
+            printf("    regexx [%s] POSIX [", barbuf);
+            bar(r->posix_time / (r->regexx_time + r->posix_time), barbuf, 40);
+            printf("%s]\n", barbuf);
+        } else {
+            printf("%-42s %10.4fs %12s %9s %8s\n",
+                   r->label, r->regexx_time, "n/a", "n/a", "n/a");
+            printf("    (no POSIX ERE equivalent syntax exists for an atomic group)\n");
+        }
+    }
+
+    printf("\nWhat this measures and does not measure: regexx is a backtracking\n"
+           "interpreter built for Python `re` semantics and the three data modes\n"
+           "(concept.md Section 7.3); glibc's <regex.h> is a mature, DFA-backed\n"
+           "engine with decades of optimization behind it and a much smaller\n"
+           "feature set (no named groups, no lazy quantifiers, no lookaround, no\n"
+           "atomic groups, and, structurally, no way to search past an embedded\n"
+           "NUL byte at all, docs/API.md Section 1.3 vs examples/binary_scan.c).\n"
+           "Scenario D is the sharpest illustration of the trade-off this library\n"
+           "makes: memoized backtracking (README.md \"Implementation status\")\n"
+           "keeps a Python-compatible engine off exponential time, not off\n"
+           "quadratic time, for a pattern shape a DFA-backed engine with no\n"
+           "backreference support handles without either problem; the correct\n"
+           "response to that specific gap is the atomic group in row D2, the same\n"
+           "fix a Python `re` user would reach for, not a claim that this engine\n"
+           "matches a DFA's asymptotic behavior in general, which it does not.\n");
+
+    return 0;
+}
diff --git a/examples/binary_scan.c b/examples/binary_scan.c
new file mode 100644
index 0000000..fb649fb
--- /dev/null
+++ b/examples/binary_scan.c
@@ -0,0 +1,64 @@
+/* binary_scan - demonstrates BINARY mode: matching against raw bytes with
+ * no decoding step at all, where every value 0-255 is an ordinary input
+ * character, including 0x00 (NUL) and 0x0A (the byte '\n' means in text).
+ * This is the one thing ASCII and UTF8 mode structurally cannot do: ASCII
+ * mode still treats the subject as bytes but restricts \d/\w/\s to the
+ * ASCII subset, and UTF8 mode decodes the subject before matching at all,
+ * so an arbitrary byte class spanning 0x00-0xFF describes decoded code
+ * points there, not raw bytes on the wire.
+ *
+ * The scenario: a small binary record format concatenated in one buffer,
+ * each record a 2-byte magic number followed by 4 raw payload bytes that
+ * may be anything, including bytes a C string function would treat as a
+ * terminator or a line break. A pattern built from re.escape'd magic bytes
+ * and a [\x00-\xff]{4} class extracts every record correctly regardless.
+ */
+#include "regexx.h"
+#include <stdio.h>
+#include <string.h>
+
+typedef struct { int n; } Ctx;
+
+static void print_record(void *ctx, const Match *m_const) {
+    Ctx *c = ctx;
+    Match *m = (Match *)m_const;
+    const char *g; size_t glen;
+    Match_group(m, NULL, 0, &g, &glen);
+    printf("record %d: magic=%02x%02x payload=", c->n, (unsigned char)g[0], (unsigned char)g[1]);
+    for (size_t i = 2; i < glen; i++) printf("%02x ", (unsigned char)g[i]);
+    printf("\n");
+    c->n++;
+}
+
+int main(void) {
+    /* Three records, back to back, with no separator: a real length-value
+     * binary format would carry its own framing; this example only needs
+     * a fixed-size payload to keep the pattern simple. Payload bytes
+     * deliberately include 0x00 and 0x0a, the two values that would break
+     * a NUL-terminated-string or line-oriented approach to scanning this
+     * same buffer. */
+    uint8_t data[] = {
+        0xca, 0xfe, 0x01, 0x00, 0x00, 0x00,   /* record 0: payload has an embedded NUL */
+        0xca, 0xfe, 0x0a, 0x0a, 0xff, 0x7f,   /* record 1: payload has embedded 0x0a bytes */
+        0xca, 0xfe, 0xde, 0xad, 0xbe, 0xef,   /* record 2: ordinary payload */
+    };
+
+    const char *pattern = "\\xca\\xfe[\\x00-\\xff]{4}";
+    PatternError err; memset(&err, 0, sizeof err);
+    Pattern *pat = re_compile(pattern, strlen(pattern), BINARY, &err);
+    if (!pat) {
+        fprintf(stderr, "compile error: %s\n", err.msg);
+        PatternError_free(&err);
+        return 1;
+    }
+
+    Input *in = Input_from_buffer(data, sizeof data);
+    Ctx ctx = { 0 };
+    int n = Pattern_finditer(pat, in, 0, -1, print_record, &ctx);
+    printf("total records found: %d (buffer is %zu bytes with %d embedded NUL, %d embedded 0x0a)\n",
+           n, sizeof data, 1, 2);
+
+    Input_free(in);
+    Pattern_free(pat);
+    return 0;
+}
diff --git a/examples/empty_match_rule.c b/examples/empty_match_rule.c
new file mode 100644
index 0000000..83b2895
--- /dev/null
+++ b/examples/empty_match_rule.c
@@ -0,0 +1,100 @@
+/* empty_match_rule - demonstrates a correctness feature rather than a
+ * performance one: Pattern_finditer/Pattern_split reproduce CPython's own
+ * undocumented empty-match behavior exactly, not the simpler "skip forward
+ * one position after an empty match" rule a first implementation attempt
+ * would reach for.
+ *
+ * A real CPython interpreter, if the match found at a given start position
+ * is empty, additionally searches for and reports a second, non-empty
+ * match at that same start position before moving on, rather than only
+ * reporting the empty one. This was found by directly probing a real
+ * Python interpreter (docs/API.md Section 3.5-3.6, README.md "Testing"),
+ * not by reading CPython's documentation, which does not describe this
+ * rule; an earlier revision of this library's Pattern_finditer/split did
+ * not implement it and was corrected once the discrepancy against real
+ * CPython output was found by the combinatorial test suite.
+ *
+ * The canonical example: \d*? (a lazy, possibly-empty run of digits)
+ * against "123abc456" finds 16 matches with a real CPython interpreter,
+ * not 9 (which is what "one match per start position, non-overlapping"
+ * alone would produce for a 9-character subject).
+ */
+#include "regexx.h"
+#include <stdio.h>
+#include <string.h>
+
+typedef struct { int n; } Ctx;
+
+static void print_match(void *ctx, const Match *m_const) {
+    Ctx *c = ctx;
+    Match *m = (Match *)m_const;
+    const char *g; size_t glen;
+    Match_group(m, NULL, 0, &g, &glen);
+    int64_t s, e;
+    Match_span(m, 0, &s, &e);
+    printf("  match %2d: span=[%lld,%lld) text='%.*s'\n",
+           c->n, (long long)s, (long long)e, (int)glen, g);
+    c->n++;
+}
+
+static void print_split_elem(void *ctx, const Match *m_const) {
+    Ctx *c = ctx;
+    Match *m = (Match *)m_const;
+    const char *g; size_t glen;
+    int r = Match_group(m, NULL, 0, &g, &glen);
+    if (r == 1) printf("  elem %2d: '%.*s'\n", c->n, (int)glen, g);
+    else printf("  elem %2d: (None)\n", c->n);
+    c->n++;
+}
+
+int main(void) {
+    const char *pattern = "\\d*?";
+    const char *subject = "123abc456";
+
+    PatternError err; memset(&err, 0, sizeof err);
+    Pattern *pat = re_compile(pattern, strlen(pattern), ASCII, &err);
+    if (!pat) {
+        fprintf(stderr, "compile error: %s\n", err.msg);
+        PatternError_free(&err);
+        return 1;
+    }
+    Input *in = Input_from_buffer((const uint8_t *)subject, strlen(subject));
+
+    printf("Pattern_finditer(\"%s\", \"%s\"):\n", pattern, subject);
+    Ctx ctx = { 0 };
+    int n = Pattern_finditer(pat, in, 0, -1, print_match, &ctx);
+    printf("total: %d matches (a real CPython interpreter reports 16 for\n"
+           "this exact pattern/subject pair, not 9; this build matches it)\n\n", n);
+
+    printf("Pattern_split(\"\\\\s*,\\\\s*\", \"a, b,c\") for contrast (an ordinary,\n"
+           "always-nonempty separator, no empty-match retry needed): \n");
+    {
+        const char *sp = "\\s*,\\s*";
+        PatternError err2; memset(&err2, 0, sizeof err2);
+        Pattern *pat2 = re_compile(sp, strlen(sp), ASCII, &err2);
+        const char *subj2 = "a, b,c";
+        Input *in2 = Input_from_buffer((const uint8_t *)subj2, strlen(subj2));
+        Ctx ctx2 = { 0 };
+        Pattern_split(pat2, in2, 0, print_split_elem, &ctx2);
+        Input_free(in2);
+        Pattern_free(pat2);
+    }
+
+    printf("\nPattern_split(\"x*\", \"-abc-\") (a pattern that CAN match empty,\n"
+           "showing the same retry rule apply during split):\n");
+    {
+        const char *sp = "x*";
+        PatternError err3; memset(&err3, 0, sizeof err3);
+        Pattern *pat3 = re_compile(sp, strlen(sp), ASCII, &err3);
+        const char *subj3 = "-abc-";
+        Input *in3 = Input_from_buffer((const uint8_t *)subj3, strlen(subj3));
+        Ctx ctx3 = { 0 };
+        Pattern_split(pat3, in3, 0, print_split_elem, &ctx3);
+        Input_free(in3);
+        Pattern_free(pat3);
+    }
+
+    Input_free(in);
+    Pattern_free(pat);
+    return 0;
+}
diff --git a/examples/large_file_search.c b/examples/large_file_search.c
new file mode 100644
index 0000000..331bb8c
--- /dev/null
+++ b/examples/large_file_search.c
@@ -0,0 +1,100 @@
+/* large_file_search - demonstrates Input_from_file's mmap-backed reading
+ * (README.md "Memory footprint") on a file large enough that the
+ * difference between mapping it and copying it into a fresh malloc'd
+ * buffer is not theoretical. The example generates its own input (so the
+ * program is self-contained and does not depend on a file existing on the
+ * machine it runs on), searches it for a pattern that does not occur
+ * anywhere (the worst case for a search: every position is tried, since
+ * none of them succeeds early), and reports both the elapsed time and,
+ * where /proc is available, the process's peak resident memory, so the
+ * two numbers can be compared directly against the measured figures in
+ * README.md rather than taken on faith.
+ */
+#define _POSIX_C_SOURCE 199309L
+#include "regexx.h"
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <time.h>
+
+static double now_seconds(void) {
+    struct timespec ts;
+    clock_gettime(CLOCK_MONOTONIC, &ts);
+    return (double)ts.tv_sec + (double)ts.tv_nsec / 1e9;
+}
+
+static void print_peak_rss(void) {
+    FILE *f = fopen("/proc/self/status", "r");
+    if (!f) { printf("(peak RSS: /proc not available on this platform)\n"); return; }
+    char line[256];
+    while (fgets(line, sizeof line, f)) {
+        if (strncmp(line, "VmHWM:", 6) == 0) {
+            printf("peak RSS: %s", line + 6);
+            break;
+        }
+    }
+    fclose(f);
+}
+
+int main(void) {
+    const char *path = "/tmp/regexx_large_file_search_example.dat";
+    size_t size = 100u * 1024 * 1024; /* 100MB: large enough to be a real
+                                        * measurement, small enough to run
+                                        * in a few seconds on ordinary
+                                        * hardware. */
+
+    printf("Generating a %zu MB file of non-matching text at %s ...\n", size / (1024 * 1024), path);
+    {
+        FILE *f = fopen(path, "wb");
+        if (!f) { perror("fopen"); return 1; }
+        /* Repeating, harmless filler text: never contains the digit
+         * sequence the search pattern below looks for. */
+        static const char chunk[] =
+            "the quick brown fox jumps over the lazy dog. ";
+        size_t chunklen = sizeof(chunk) - 1;
+        size_t written = 0;
+        while (written < size) {
+            size_t n = fwrite(chunk, 1, chunklen, f);
+            if (n == 0) break;
+            written += n;
+        }
+        fclose(f);
+    }
+
+    const char *pattern = "\\d{10,}"; /* ten or more consecutive digits: not present */
+    PatternError err; memset(&err, 0, sizeof err);
+    Pattern *pat = re_compile(pattern, strlen(pattern), ASCII, &err);
+    if (!pat) {
+        fprintf(stderr, "compile error: %s\n", err.msg);
+        PatternError_free(&err);
+        remove(path);
+        return 1;
+    }
+
+    Input *in = Input_from_file(path, &err);
+    if (!in) {
+        fprintf(stderr, "cannot read file: %s\n", err.msg);
+        PatternError_free(&err);
+        Pattern_free(pat);
+        remove(path);
+        return 1;
+    }
+
+    printf("Searching (Input_from_file mmaps this file rather than copying it,\n"
+           "so this process's own heap never holds a private copy of the 100MB\n"
+           "file content itself; it still allocates the search tables README.md\n"
+           "\"Memory footprint\" measures, roughly 8.4x the input length)...\n");
+    Match m; memset(&m, 0, sizeof m);
+    double t0 = now_seconds();
+    int rc = Pattern_search(pat, in, 0, -1, &m);
+    double t1 = now_seconds();
+    printf("result: rc=%d (0 = no match, as expected) in %.3fs\n", rc, t1 - t0);
+    print_peak_rss();
+
+    if (rc == 1) Match_free(&m);
+    Input_free(in);
+    Pattern_free(pat);
+    remove(path);
+    printf("(temporary file removed)\n");
+    return 0;
+}
diff --git a/examples/redos_atomic.c b/examples/redos_atomic.c
new file mode 100644
index 0000000..530b299
--- /dev/null
+++ b/examples/redos_atomic.c
@@ -0,0 +1,78 @@
+/* redos_atomic - demonstrates the one performance feature that is a
+ * genuine, user-facing correctness lever rather than an internal
+ * implementation detail: atomic groups (?>...) as a defense against
+ * catastrophic backtracking (ReDoS), on the textbook (a+)+b shape.
+ *
+ * README.md "Implementation status" explains why this shape is not fixed
+ * by this build's memoization alone: (a+)+b has no backreference, so it
+ * is memoized and therefore no longer exponential, but the inner a+'s
+ * repeat is followed by the group's closing save, not by a simple atom,
+ * so the precomputed skip-ahead table that makes a*b linear does not
+ * apply to it either, leaving it empirically quadratic. Wrapping the
+ * inner repetition in an atomic group removes the ambiguity a+ was
+ * causing (once a+ has consumed as many a's as it can, an atomic group
+ * forbids ever giving any of them back to try a shorter run instead),
+ * which is a real, structural difference the pattern author controls,
+ * not a performance tweak this library makes automatically.
+ *
+ * This program compiles both forms of the same pattern and times a search
+ * against an adversarial subject (a long run of 'a' characters with no
+ * trailing 'b', the one input that forces the most backtracking) at a
+ * size chosen to make the quadratic form's cost visible in a few seconds
+ * without making it so large the program is unpleasant to run.
+ */
+#define _POSIX_C_SOURCE 199309L
+#include "regexx.h"
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <time.h>
+
+static double now_seconds(void) {
+    struct timespec ts;
+    clock_gettime(CLOCK_MONOTONIC, &ts);
+    return (double)ts.tv_sec + (double)ts.tv_nsec / 1e9;
+}
+
+static void run_case(const char *label, const char *pattern, const char *subject, size_t subjlen) {
+    PatternError err; memset(&err, 0, sizeof err);
+    Pattern *pat = re_compile(pattern, strlen(pattern), ASCII, &err);
+    if (!pat) {
+        fprintf(stderr, "compile error for %s: %s\n", pattern, err.msg);
+        PatternError_free(&err);
+        return;
+    }
+    Input *in = Input_from_buffer((const uint8_t *)subject, subjlen);
+    Match m; memset(&m, 0, sizeof m);
+    double t0 = now_seconds();
+    int rc = Pattern_search(pat, in, 0, -1, &m);
+    double t1 = now_seconds();
+    printf("%-28s pattern=%-14s n=%-8zu rc=%-2d time=%.4fs\n",
+           label, pattern, subjlen, rc, t1 - t0);
+    if (rc == 1) Match_free(&m);
+    Input_free(in);
+    Pattern_free(pat);
+}
+
+int main(void) {
+    size_t n = 20000;
+    char *subject = malloc(n + 1);
+    memset(subject, 'a', n);
+    subject[n] = '\0'; /* no trailing 'b' anywhere: the worst case for both patterns */
+
+    printf("Searching %zu characters of 'a' with no trailing 'b' (never matches):\n\n", n);
+    run_case("plain nested quantifier", "(a+)+b", subject, n);
+    run_case("atomic inner group",      "(?>a+)+b", subject, n);
+    run_case("possessive inner quant.", "(a++)+b", subject, n);
+
+    printf("\nAll three patterns are equivalent in what they can match (none of\n"
+           "them ever matches this subject). The atomic and possessive forms\n"
+           "finish close to instantly regardless of n because they never explore\n"
+           "more than one way of splitting the run of 'a' characters; the plain\n"
+           "form's cost grows with n because memoization alone (README.md\n"
+           "\"Implementation status\") makes this shape quadratic, not linear,\n"
+           "and not exponential only because it lacks a backreference.\n");
+
+    free(subject);
+    return 0;
+}
diff --git a/examples/utf8_scripts.c b/examples/utf8_scripts.c
new file mode 100644
index 0000000..dd1e3ba
--- /dev/null
+++ b/examples/utf8_scripts.c
@@ -0,0 +1,67 @@
+/* utf8_scripts - demonstrates UTF8 mode: the subject is decoded into
+ * Unicode code points before matching (not just treated as opaque bytes,
+ * the way ASCII/BINARY mode do), so \w and IGNORECASE work correctly
+ * across scripts, not only ASCII letters, and match positions come in two
+ * different units depending on which accessor is used.
+ *
+ * The subject deliberately mixes Latin (with a combining-free accented
+ * letter), Greek, Cyrillic, and a CJK ideograph, each of which encodes to
+ * a different number of UTF-8 bytes per code point (1, 2, 2, and 3
+ * respectively), to make the code-point/byte distinction concrete rather
+ * than something that happens to not matter for the specific example
+ * chosen.
+ */
+#include "regexx.h"
+#include <stdio.h>
+#include <string.h>
+
+typedef struct { int n; } Ctx;
+
+static void print_word(void *ctx, const Match *m_const) {
+    Ctx *c = ctx;
+    Match *m = (Match *)m_const;
+    const char *g; size_t glen;
+    Match_group(m, NULL, 0, &g, &glen);
+    int64_t cs, ce, bs, be;
+    Match_span(m, 0, &cs, &ce);
+    Match_span_byte(m, 0, &bs, &be);
+    printf("word %d: '%.*s'  codepoints=[%lld,%lld) (len %lld)  bytes=[%lld,%lld) (len %lld)\n",
+           c->n, (int)glen, g,
+           (long long)cs, (long long)ce, (long long)(ce - cs),
+           (long long)bs, (long long)be, (long long)(be - bs));
+    c->n++;
+}
+
+int main(void) {
+    /* "café" (Latin, e-acute is 2 bytes) + "  " + "Ελλάδα" (Greek) + "  "
+     * + "Россия" (Cyrillic) + "  " + "日本" (CJK, 3 bytes per character). */
+    const char *subject =
+        "caf\xc3\xa9  "
+        "\xce\x95\xce\xbb\xce\xbb\xce\xac\xce\xb4\xce\xb1  "
+        "\xd0\xa0\xd0\xbe\xd1\x81\xd1\x81\xd0\xb8\xd1\x8f  "
+        "\xe6\x97\xa5\xe6\x9c\xac";
+
+    const char *pattern = "\\w+";
+    PatternError err; memset(&err, 0, sizeof err);
+    Pattern *pat = re_compile(pattern, strlen(pattern), UTF8, &err);
+    if (!pat) {
+        fprintf(stderr, "compile error: %s\n", err.msg);
+        PatternError_free(&err);
+        return 1;
+    }
+
+    Input *in = Input_from_buffer((const uint8_t *)subject, strlen(subject));
+    printf("subject is %zu bytes\n\n", strlen(subject));
+    Ctx ctx = { 0 };
+    int n = Pattern_finditer(pat, in, 0, -1, print_word, &ctx);
+    printf("\ntotal words: %d\n", n);
+    printf("\\w under UTF8 mode consults the platform's Unicode tables (glibc\n"
+           "wctype.h under the C.utf8 locale, docs/API.md Section 2), so it\n"
+           "recognizes Greek, Cyrillic, and CJK letters, not only ASCII ones;\n"
+           "the byte length of each word differs from its codepoint length\n"
+           "exactly where the script needs more than one byte per character.\n");
+
+    Input_free(in);
+    Pattern_free(pat);
+    return 0;
+}