diff --git a/Makefile b/Makefile
index 31d6bb62..b3117918 100644
--- a/Makefile
+++ b/Makefile
@@ -39,7 +39,7 @@ W6L_SRC	= cmd/w6l/main.c cmd/w6l/obj.c cmd/w6l/sym.c cmd/w6l/pass.c cmd/w6l/out.
 W6L_OBJ	= $(W6L_SRC:cmd/w6l/%.c=$(OBJ)/w6l/%.o)
 
 RT_S	= rt/start.s rt/syscall.s rt/alloc.s rt/streq.s rt/abort.s
-RT_WW	= rt/ensure.ww
+RT_WW	= rt/ensure.ww rt/malloc.ww
 RT_OBJ	= $(RT_S:rt/%.s=$(OBJ)/rt/%.o) $(RT_WW:rt/%.ww=$(OBJ)/rt/%.o)
 
 # Cstage: one-time C bootstrap (see BOOTSTRAP.md). Built by `cc`.
diff --git a/rt/alloc.s b/rt/alloc.s
index ad0dc01f..4673bace 100644
--- a/rt/alloc.s
+++ b/rt/alloc.s
@@ -1,18 +1,18 @@
-// rt/alloc.s — page allocator via the mmap syscall.
+// rt/alloc.s — raw page primitive via the mmap syscall.
 //
-// rt_malloc(n: u64) returns a *void aligned at a page boundary, sized
-// to the next page multiple. Pair with rt_free(p, n).
+// rt_segmalloc(n: u64) returns a *void aligned at a page boundary, sized
+// to the next page multiple. It is the primitive under rt/malloc.ww's
+// bump allocator (renamed from rt_malloc, task #8) — callers use the
+// bump rt_malloc, not this directly.
 //
 // We pin to PROT_READ|PROT_WRITE and MAP_PRIVATE|MAP_ANONYMOUS so
 // callers never have to plumb file descriptors through.
 //
-// On mmap failure the raw syscall returns -errno (negative). Task #30
-// graduated the `alloc` builtin to a fallible `(*T | nomem)` /
-// `([]T | nomem)` signature whose cgen branches on a null return, so
-// the failure path here returns 0 instead of a poisoned pointer. The
-// builtin's caller is expected to `!`/`?` the result.
+// On mmap failure the raw syscall returns -errno (negative); we map
+// that to 0 so the bump allocator's null-check (and the alloc builtin's
+// `!`/`?` lowering, task #30) sees a clean nil.
 
-TEXT rt_malloc,$0
+TEXT rt_segmalloc,$0
 	MOVQ	DI, SI		// arg 1: length = caller's n
 	MOVQ	$0, DI		// arg 0: addr = NULL (kernel chooses)
 	MOVQ	$3, DX		// arg 2: prot = R|W
@@ -22,13 +22,15 @@ TEXT rt_malloc,$0
 	MOVQ	$9, AX		// syscall: mmap
 	SYSCALL
 	CMPQ	$0, AX
-	JGE	rt_malloc_ok
+	JGE	rt_segmalloc_ok
 	XORQ	AX, AX
-rt_malloc_ok:
+rt_segmalloc_ok:
 	RET
 
+// rt_free is a no-op: ww is a no-free runtime. rt/malloc.ww bumps over
+// shared 2MiB chunks, so a mid-chunk pointer cannot be unmapped without
+// corrupting its neighbours; all memory is reclaimed at process exit.
+// Kept as a symbol because os.free re-exports it (lib/os/os.ww) for the
+// public API — callers' frees become harmless leaks. (task #8)
 TEXT rt_free,$0
-	// DI already holds ptr, SI already holds length
-	MOVQ	$11, AX		// syscall: munmap
-	SYSCALL
 	RET
diff --git a/rt/ensure.ww b/rt/ensure.ww
index ef19140b..f8fa8def 100644
--- a/rt/ensure.ww
+++ b/rt/ensure.ww
@@ -20,7 +20,6 @@
 // bare symbol name so the linker resolves it.
 
 @symbol("rt_malloc") fn malloc(n: u64) *void;
-@symbol("rt_free")  fn free(p: *void, n: u64) void;
 
 // Mirrors ww's []T header layout: 24 bytes with 8-byte slots.
 // ww's source uses i32 for len/cap but the compiler stores them in
@@ -46,9 +45,8 @@ export fn rt_ensure(s: *slice, membsz: u64) void = {
 		np[i] = s.ptr[i];
 		i += 1u64;
 	};
-	if (s.cap > 0i64) {
-		free(s.ptr: *void, (s.cap: u64) * membsz);
-	};
+	// No free: the bump allocator (rt/malloc.ww) can't reclaim a
+	// mid-chunk region; the old buffer leaks until process exit. (#8)
 	s.ptr = np;
 	s.cap = nc;
 };
diff --git a/rt/malloc.ww b/rt/malloc.ww
new file mode 100644
index 00000000..770b525a
--- /dev/null
+++ b/rt/malloc.ww
@@ -0,0 +1,44 @@
+// rt/malloc.ww — bump allocator over 2MiB chunks. Archived into
+// libwwrt.a, compiled standalone (no `module`) with bare symbols, like
+// rt/ensure.ww.
+//
+// WHY bump, replacing the page-per-call mmap (rt_segmalloc, ex-rt_malloc):
+// the old rt_malloc page-rounded every request, so a 32-72B node cost a
+// whole 4KiB page. w6a/w6c emit ~4 such nodes per .s line; a 145K-line
+// assembly burned ~625K pages (~2.5GB) vs C w6a's 24MB. Packing nodes
+// into shared chunks collapses that to the live set. (task #8)
+//
+// Mirrors Hare rt::malloc's chunk-bump (ref/hare/rt/malloc.ha:52-66,
+// CHUNKSZ :24, ALIGN :14), minus the bin/freelist machinery — that
+// exists only to support free, which ww does not have.
+//
+// Zero-init is preserved: every byte handed out is fresh from
+// MAP_ANONYMOUS (kernel-zeroed) and never reused, so alloc(T{})'s
+// zero-fill still holds. Lazy first chunk falls out of cur=rem=0.
+
+def CHUNKSZ: u64 = 2097152u64;	// 1<<21, ref/hare/rt/malloc.ha:24
+def ALIGN:   u64 = 16u64;	// ref/hare/rt/malloc.ha:14
+
+@symbol("rt_segmalloc") fn segmalloc(n: u64) *void;
+
+let cur: u64 = 0u64;
+let rem: u64 = 0u64;
+
+@symbol("rt_malloc") export fn rt_malloc(n: u64) *void = {
+	let need: u64 = (n + (ALIGN - 1u64)) & ~(ALIGN - 1u64);
+	// Oversized requests bypass the chunk so one huge alloc can't
+	// strand most of a chunk (ref/hare/rt/malloc.ha:38).
+	if (need > CHUNKSZ) { return segmalloc(need); };
+	if (rem < need) {
+		let c: *void = segmalloc(CHUNKSZ);
+		// mmap failure: keep the nomem null contract that the
+		// alloc-builtin `!`/`?` lowering checks.
+		if (c == nil) { return nil; };
+		cur = c: u64;
+		rem = CHUNKSZ;
+	};
+	let p: u64 = cur;
+	cur += need;
+	rem -= need;
+	return p: *void;
+};