I've been looking at the URL Rewriting documentation, and writing some test libraries. I've also looked at Jamie's Francotoile work, and I'm learning from that, and deciding to do some things slightly differently from the way his site works. Things learned today:

• If you deploy in Tomcat using a WAR file, don't ever delete the WAR file; Tomcat deletes the app irrecoverably. Nothing valuable lost, but it could have been.
• Nothing outside of WEB-INF is actually required. The JNLP continues to function as long as it's configured in controller-config.xml (in WEB-INF).
• The approach of putting the application logic inside a collection called site is a good one; relative links in output to e.g. CSS files in subcollections "just work", but they're served as application/xml or whatever rather than text/css, so I think it's more productive to have a configuration in controller-config.xml which calls an XQuery for ANY path ending in .css; that way the correct response headers can be sent, and CSS files are accessible from anywhere in the site structure, without worrying about relative paths.
• For permissions, "update" doesn't really appear to mean "update" in the case of XQL files; to enable a guest to browse to an XQL file and see its output, it needs to have world "update". However, as long as world doesn't have update on the folder containing the XQL file, it's safe from modification by guest. This means you really can't be mixing data and logic.