From 13da805b35923dcc3d670b2974be5350c389956a Mon Sep 17 00:00:00 2001
From: "fizzy-linux[bot]" <346940526+fizzy-linux[bot]@users.noreply.github.com>
Date: Mon, 26 Oct 2026 16:46:22 -0500
Subject: [PATCH 1/4] build: fixture tests for the build API in check-examples

A fixture app builds two staticModule plugin packages (both kinds of executable, and native-only), the web and package steps, and the duplicate-plugin and taken-web-step errors against this tree.

Agent-Team: linux
Worker: claude
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 scripts/check-examples.sh                     | 62 ++++++++++++++++++-
 scripts/fixtures/build-api/app/build.zig      | 50 +++++++++++++++
 scripts/fixtures/build-api/app/build.zig.zon  | 16 +++++
 scripts/fixtures/build-api/plugin/build.zig   | 22 +++++++
 .../fixtures/build-api/plugin/build.zig.zon   | 14 +++++
 scripts/fixtures/build-api/plugin/lib.zig     |  1 +
 scripts/fixtures/build-api/plugin/plugin.zig  | 45 ++++++++++++++
 .../build-api/plugin/plugin.zig.zon.tmpl      |  7 +++
 8 files changed, 214 insertions(+), 3 deletions(-)
 create mode 100644 scripts/fixtures/build-api/app/build.zig
 create mode 100644 scripts/fixtures/build-api/app/build.zig.zon
 create mode 100644 scripts/fixtures/build-api/plugin/build.zig
 create mode 100644 scripts/fixtures/build-api/plugin/build.zig.zon
 create mode 100644 scripts/fixtures/build-api/plugin/lib.zig
 create mode 100644 scripts/fixtures/build-api/plugin/plugin.zig
 create mode 100644 scripts/fixtures/build-api/plugin/plugin.zig.zon.tmpl

diff --git a/scripts/check-examples.sh b/scripts/check-examples.sh
index 7295127e6..368b1902b 100755
--- a/scripts/check-examples.sh
+++ b/scripts/check-examples.sh
@@ -17,6 +17,8 @@
 #                                        # uses checkouts of your own (example-app/ and
 #                                        # example-plugin/ in that directory), as they are on
 #                                        # disk, copied so they are left untouched
+#   EXAMPLES_BUILDS="" scripts/check-examples.sh
+#                                        # builds none of their apps: the build API fixture alone
 #
 # CI: the examples job of .github/workflows/ci.yml.
 set -euo pipefail
@@ -104,7 +106,7 @@ build_one() {
 }
 export -f build_args build_one
 
-builds="plugin minimal studio endless studio-zon replay dvui dvui-sdl3"
+builds="${EXAMPLES_BUILDS-plugin minimal studio endless studio-zon replay dvui dvui-sdl3}"
 
 # Each build is one compile of an app that mostly keeps one core busy, so they run side by side,
 # EXAMPLES_JOBS at once (3: CI's runner has 4 cores and 16 GB). First each configuration is
@@ -116,5 +118,59 @@ for b in $builds; do
   for a in "${args[@]:1}"; do [[ $a == -* ]] && opts+=("$a"); done
   (cd "$work/${args[0]}" && zig build -l ${opts[@]+"${opts[@]}"} > /dev/null)
 done
-echo "== example-plugin and example-app, against this tree"
-printf '%s\n' $builds | xargs -P "${EXAMPLES_JOBS:-3}" -n 1 bash -c 'build_one "$1"' _
+if [[ -n $builds ]]; then
+  echo "== example-plugin and example-app, against this tree"
+  printf '%s\n' $builds | xargs -P "${EXAMPLES_JOBS:-3}" -n 1 bash -c 'build_one "$1"' _
+fi
+
+# The build API an app and a plugin package call (`fizzy.framework`, `staticModule`, `addApp`,
+# `addWebSteps`, `addPackageSteps`; design/build-api.md), on a fixture app of its own: two plugin
+# packages, one for both kinds of executable and one `.native` only, which fails to compile if it
+# reaches the wasm.
+fixtures="scripts/fixtures/build-api"
+for id in fixture_both fixture_native; do
+  mkdir -p "$work/$id"
+  cp "$fixtures"/plugin/{build.zig,build.zig.zon,plugin.zig,lib.zig} "$work/$id/"
+  sed "s/@ID@/$id/g" "$fixtures/plugin/plugin.zig.zon.tmpl" > "$work/$id/plugin.zig.zon"
+  (cd "$work/$id" && zig fetch --save=fizzy "$sdk_tarball" >/dev/null)
+done
+mkdir -p "$work/fixture-app"
+cp "$fixtures"/app/{build.zig,build.zig.zon} "$work/fixture-app/"
+(cd "$work/fixture-app" && zig fetch --save=fizzy "$work/fizzy.tar.gz" >/dev/null \
+  && zig build -l > /dev/null)
+
+echo "== build API fixture app"
+fixture_fail=0
+# step <label> <ok|fail|any> <expected text in the output> <zig build arguments…>
+step() {
+  local label=$1 want=$2 text=$3 got=0
+  shift 3
+  (cd "$work/fixture-app" && zig build "$@") > "$work/log-fixture.txt" 2>&1 || got=$?
+  if { [[ $want == ok && $got -eq 0 ]] || [[ $want == fail && $got -ne 0 ]] || [[ $want == any ]]; } \
+    && { [[ -z $text ]] || grep -q -- "$text" "$work/log-fixture.txt"; }; then
+    echo "ok    $label"
+  else
+    echo "FAIL  $label (wanted $want, exit $got, output containing '$text')"
+    tail -n 30 "$work/log-fixture.txt" | cut -c1-300 | sed "s/^/      /"
+    fixture_fail=1
+  fi
+}
+step "native executable, both plugins linked" ok "" --prefix "$work/out/fixture"
+# The step list holds what the API adds: `web`, and `package`, `desktop` and `packageall`.
+step "web, package and packageall steps added" ok "packageall" -l
+for name in web package desktop; do
+  grep -q "^  $name " "$work/log-fixture.txt" || { echo "FAIL  step '$name' missing"; fixture_fail=1; }
+done
+step "web build leaves the native-only plugin out" ok "" web --prefix "$work/out/fixture-web"
+[[ -f "$work/out/fixture-web/web/index.html" ]] \
+  || { echo "FAIL  addWebSteps installed no web/index.html"; fixture_fail=1; }
+# `package` runs vpk, which needs dotnet; `--verbose` prints its command line, `vpk-args` on it.
+# Whether vpk then packs the fixture is not the question, so the status is not read.
+if command -v dotnet > /dev/null; then
+  step "vpk-args reach vpk pack" any "--fixture-vpk-arg" package --verbose --prefix "$work/out/fixture-pkg"
+else
+  echo "skip  vpk-args reach vpk pack (no dotnet)"
+fi
+step "a plugin listed twice is an error" fail "listed twice" -Dfixture-fail=twice
+step "an app's own web step is an error" fail "already has a \`web\` step" -Dfixture-fail=web-taken
+[[ $fixture_fail -eq 0 ]]
diff --git a/scripts/fixtures/build-api/app/build.zig b/scripts/fixtures/build-api/app/build.zig
new file mode 100644
index 000000000..736fc2c34
--- /dev/null
+++ b/scripts/fixtures/build-api/app/build.zig
@@ -0,0 +1,50 @@
+//! An application over fizzy's build API, for `scripts/check-examples.sh`: two plugin packages
+//! built with `fizzy.framework` (one for both kinds of executable, one native-only), the web and
+//! package steps, and the failures the API promises.
+//!
+//! `-Dfixture-fail=<case>` builds a list the API refuses: `twice` lists a plugin twice,
+//! `web-taken` has a `web` step already.
+const std = @import("std");
+const fizzy = @import("fizzy");
+const both = @import("fixture_both");
+const native = @import("fixture_native");
+
+pub fn build(b: *std.Build) !void {
+    const target = b.standardTargetOptions(.{});
+    const optimize = b.standardOptimizeOption(.{});
+    const fail = b.option([]const u8, "fixture-fail", "A case the API must refuse") orelse "";
+
+    // Files that go beside the executable in the pack input, and an argument for `vpk pack`.
+    const helpers = b.addWriteFiles();
+    _ = helpers.add("fixture-helper.txt", "beside the executable\n");
+
+    const fizzy_dep = b.dependency("fizzy", .{
+        .target = target,
+        .optimize = optimize,
+        .@"defer-app" = true,
+        .@"app-name" = @as([]const u8, "fixtureapp"),
+        .@"package-dirs" = &[_]std.Build.LazyPath{helpers.getDirectory()},
+        .@"vpk-args" = &[_][]const u8{ "--fixture-vpk-arg", "1" },
+    });
+    const both_dep = b.dependency("fixture_both", .{});
+    const native_dep = b.dependency("fixture_native", .{});
+
+    const list = [_]fizzy.BundledPlugin{
+        fizzy.plugins.workbench,
+        fizzy.plugins.text,
+        .{ .name = "fixture_both", .targets = &.{
+            .{ .target = .native, .module = both.staticModule(both_dep.builder, fizzy.framework(fizzy_dep, .native)) },
+            .{ .target = .web, .module = both.staticModule(both_dep.builder, fizzy.framework(fizzy_dep, .web)) },
+        } },
+        .{ .name = "fixture_native", .targets = &.{
+            .{ .target = .native, .module = native.staticModule(native_dep.builder, fizzy.framework(fizzy_dep, .native)) },
+        } },
+    };
+    const twice = list ++ [_]fizzy.BundledPlugin{list[2]};
+    const app = try fizzy.addApp(fizzy_dep, if (std.mem.eql(u8, fail, "twice")) &twice else &list);
+    b.installArtifact(app.exe);
+
+    if (std.mem.eql(u8, fail, "web-taken")) _ = b.step("web", "taken before the API's");
+    try fizzy.addWebSteps(b, fizzy_dep);
+    try fizzy.addPackageSteps(b, fizzy_dep);
+}
diff --git a/scripts/fixtures/build-api/app/build.zig.zon b/scripts/fixtures/build-api/app/build.zig.zon
new file mode 100644
index 000000000..eb5bf2540
--- /dev/null
+++ b/scripts/fixtures/build-api/app/build.zig.zon
@@ -0,0 +1,16 @@
+.{
+    .name = .fixture_app,
+    .version = "0.0.1",
+    .fingerprint = 0x915c21d842947814,
+    .minimum_zig_version = "0.17.0",
+    .paths = .{ "build.zig", "build.zig.zon" },
+    .dependencies = .{
+        // Replaced by `zig fetch --save=fizzy` with this tree.
+        .fizzy = .{
+            .url = "git+https://github.com/fizzyedit/fizzy#d99a7509032aea580d2db7a2eae5100bdb9b6afd",
+            .hash = "fizzy-0.2.0-c46aVltCpgC5UG61y5Nm4TH_52KKUl5xQHTS7SayqK3W",
+        },
+        .fixture_both = .{ .path = "../fixture_both" },
+        .fixture_native = .{ .path = "../fixture_native" },
+    },
+}
diff --git a/scripts/fixtures/build-api/plugin/build.zig b/scripts/fixtures/build-api/plugin/build.zig
new file mode 100644
index 000000000..9828be18a
--- /dev/null
+++ b/scripts/fixtures/build-api/plugin/build.zig
@@ -0,0 +1,22 @@
+//! A plugin package the way `fizzy.plugin.staticModule` documents it: the module is built against
+//! the framework the application's executables link, with a dependency of its own added.
+const std = @import("std");
+const fizzy = @import("fizzy");
+
+// anytype: the Framework of fizzy's build, a build-time duck type (pinned SDKs have their own type)
+pub fn staticModule(b: *std.Build, framework: anytype) *std.Build.Module {
+    const m = fizzy.plugin.staticModule(b, framework, .{});
+    m.addImport("fixture_lib", b.createModule(.{
+        .root_source_file = b.path("lib.zig"),
+        .target = framework.target,
+        .optimize = framework.optimize,
+    }));
+    return m;
+}
+
+pub fn build(b: *std.Build) void {
+    const target = b.standardTargetOptions(.{});
+    const optimize = b.standardOptimizeOption(.{});
+    const plugin = fizzy.plugin.create(b, .{ .target = target, .optimize = optimize });
+    fizzy.plugin.install(b, plugin.lib, .{});
+}
diff --git a/scripts/fixtures/build-api/plugin/build.zig.zon b/scripts/fixtures/build-api/plugin/build.zig.zon
new file mode 100644
index 000000000..6656e8abd
--- /dev/null
+++ b/scripts/fixtures/build-api/plugin/build.zig.zon
@@ -0,0 +1,14 @@
+.{
+    .name = .fixture_plugin,
+    .version = "0.0.1",
+    .minimum_zig_version = "0.17.0",
+    .fingerprint = 0x9b70afac3d2d8bc6,
+    .paths = .{ "build.zig", "build.zig.zon", "plugin.zig", "plugin.zig.zon", "lib.zig" },
+    .dependencies = .{
+        // Replaced by `zig fetch --save=fizzy` with this tree's packed SDK.
+        .fizzy = .{
+            .url = "https://github.com/fizzyedit/fizzy/releases/download/sdk-v0.2.30/fizzy-sdk-v0.2.30.tar.gz",
+            .hash = "fizzy-0.2.30-SGBwY1QnJwDznUMVnSLATxXgH2e8_Vz7eMwLj9UQ0sVU",
+        },
+    },
+}
diff --git a/scripts/fixtures/build-api/plugin/lib.zig b/scripts/fixtures/build-api/plugin/lib.zig
new file mode 100644
index 000000000..2e5803bd5
--- /dev/null
+++ b/scripts/fixtures/build-api/plugin/lib.zig
@@ -0,0 +1 @@
+pub const answer = 42;
diff --git a/scripts/fixtures/build-api/plugin/plugin.zig b/scripts/fixtures/build-api/plugin/plugin.zig
new file mode 100644
index 000000000..bce0cc8fd
--- /dev/null
+++ b/scripts/fixtures/build-api/plugin/plugin.zig
@@ -0,0 +1,45 @@
+//! The build-API fixture plugin: one surface, built by `staticModule` for each kind of
+//! executable. `scripts/check-examples.sh` links it into `app/`.
+const std = @import("std");
+const builtin = @import("builtin");
+const sdk = @import("fizzy_sdk");
+const dvui = @import("dvui");
+
+pub const plugin_options = @import("fizzy_plugin_options");
+pub const plugin_id = plugin_options.id;
+
+// The native-only fixture is the same file under another id: a web build that links it
+// fails here, which is how the check sees a `.native` entry kept out of the wasm.
+comptime {
+    if (std.mem.eql(u8, plugin_options.id, "fixture_native") and
+        builtin.cpu.arch == .wasm32)
+    {
+        @compileError("a native-only plugin was linked into the web build");
+    }
+}
+
+var plugin: sdk.Plugin = .{
+    .state = undefined,
+    .vtable = &vtable,
+    .id = plugin_id,
+    .display_name = plugin_options.name,
+};
+
+const vtable: sdk.Plugin.VTable = .{};
+
+pub fn register(host: *sdk.Host) !void {
+    try host.registerPlugin(&plugin);
+    try host.registerSurface(.{
+        .id = plugin_id ++ ".surface",
+        .owner = &plugin,
+        .icon = .{ .tvg = dvui.entypo.emoji_happy },
+        .title = plugin_options.name,
+        .keywords = sdk.keywords.ide.sidebar,
+        .draw = draw,
+    });
+}
+
+fn draw(_: ?*anyopaque) !dvui.App.Result {
+    dvui.label(@src(), "{s}", .{plugin_id}, .{});
+    return .ok;
+}
diff --git a/scripts/fixtures/build-api/plugin/plugin.zig.zon.tmpl b/scripts/fixtures/build-api/plugin/plugin.zig.zon.tmpl
new file mode 100644
index 000000000..95c87698d
--- /dev/null
+++ b/scripts/fixtures/build-api/plugin/plugin.zig.zon.tmpl
@@ -0,0 +1,7 @@
+.{
+    .id = "@ID@",
+    .name = "@ID@",
+    .version = "0.0.1",
+    .min_sdk_version = "0.2.30",
+    .description = "A build-API fixture.",
+}

From 054b487ee30d80163a17e7f62d6e8e6b4c4a9552 Mon Sep 17 00:00:00 2001
From: "fizzy-linux[bot]" <346940526+fizzy-linux[bot]@users.noreply.github.com>
Date: Mon, 26 Oct 2026 19:00:03 -0500
Subject: [PATCH 2/4] build: fixture asserts package-dirs and a C dependency

The fixture app now reads fixture-helper.txt from the pack input, and the
plugin package links a C source it calls at register, so a lost
package-dirs staging or a lost dependency fails check-examples.

Agent-Team: linux
Worker: claude
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 scripts/check-examples.sh                       | 14 +++++++++++---
 scripts/fixtures/build-api/plugin/build.zig     |  6 ++++--
 scripts/fixtures/build-api/plugin/build.zig.zon |  2 +-
 scripts/fixtures/build-api/plugin/lib.c         |  4 ++++
 scripts/fixtures/build-api/plugin/lib.zig       |  4 +++-
 scripts/fixtures/build-api/plugin/plugin.zig    |  3 +++
 6 files changed, 26 insertions(+), 7 deletions(-)
 create mode 100644 scripts/fixtures/build-api/plugin/lib.c

diff --git a/scripts/check-examples.sh b/scripts/check-examples.sh
index 368b1902b..10ba4cf30 100755
--- a/scripts/check-examples.sh
+++ b/scripts/check-examples.sh
@@ -130,7 +130,7 @@ fi
 fixtures="scripts/fixtures/build-api"
 for id in fixture_both fixture_native; do
   mkdir -p "$work/$id"
-  cp "$fixtures"/plugin/{build.zig,build.zig.zon,plugin.zig,lib.zig} "$work/$id/"
+  cp "$fixtures"/plugin/{build.zig,build.zig.zon,plugin.zig,lib.zig,lib.c} "$work/$id/"
   sed "s/@ID@/$id/g" "$fixtures/plugin/plugin.zig.zon.tmpl" > "$work/$id/plugin.zig.zon"
   (cd "$work/$id" && zig fetch --save=fizzy "$sdk_tarball" >/dev/null)
 done
@@ -165,11 +165,19 @@ step "web build leaves the native-only plugin out" ok "" web --prefix "$work/out
 [[ -f "$work/out/fixture-web/web/index.html" ]] \
   || { echo "FAIL  addWebSteps installed no web/index.html"; fixture_fail=1; }
 # `package` runs vpk, which needs dotnet; `--verbose` prints its command line, `vpk-args` on it.
-# Whether vpk then packs the fixture is not the question, so the status is not read.
+# Whether vpk then packs the fixture is not the question, so the status is not read; the files of
+# `package-dirs` are staged into the pack input before vpk runs, and that is read from disk.
 if command -v dotnet > /dev/null; then
   step "vpk-args reach vpk pack" any "--fixture-vpk-arg" package --verbose --prefix "$work/out/fixture-pkg"
+  staged=$(ls "$work"/out/fixture-pkg/*/.pack-input/fixture-helper.txt 2>/dev/null || true)
+  if [[ -n $staged && $(cat "$staged") == "beside the executable" ]]; then
+    echo "ok    package-dirs staged into the pack input"
+  else
+    echo "FAIL  package-dirs file missing from the pack input"
+    fixture_fail=1
+  fi
 else
-  echo "skip  vpk-args reach vpk pack (no dotnet)"
+  echo "skip  vpk-args reach vpk pack, package-dirs staged (no dotnet)"
 fi
 step "a plugin listed twice is an error" fail "listed twice" -Dfixture-fail=twice
 step "an app's own web step is an error" fail "already has a \`web\` step" -Dfixture-fail=web-taken
diff --git a/scripts/fixtures/build-api/plugin/build.zig b/scripts/fixtures/build-api/plugin/build.zig
index 9828be18a..62b27d0b3 100644
--- a/scripts/fixtures/build-api/plugin/build.zig
+++ b/scripts/fixtures/build-api/plugin/build.zig
@@ -6,11 +6,13 @@ const fizzy = @import("fizzy");
 // anytype: the Framework of fizzy's build, a build-time duck type (pinned SDKs have their own type)
 pub fn staticModule(b: *std.Build, framework: anytype) *std.Build.Module {
     const m = fizzy.plugin.staticModule(b, framework, .{});
-    m.addImport("fixture_lib", b.createModule(.{
+    const lib = b.createModule(.{
         .root_source_file = b.path("lib.zig"),
         .target = framework.target,
         .optimize = framework.optimize,
-    }));
+    });
+    lib.addCSourceFile(.{ .file = b.path("lib.c") });
+    m.addImport("fixture_lib", lib);
     return m;
 }
 
diff --git a/scripts/fixtures/build-api/plugin/build.zig.zon b/scripts/fixtures/build-api/plugin/build.zig.zon
index 6656e8abd..2644c0d58 100644
--- a/scripts/fixtures/build-api/plugin/build.zig.zon
+++ b/scripts/fixtures/build-api/plugin/build.zig.zon
@@ -3,7 +3,7 @@
     .version = "0.0.1",
     .minimum_zig_version = "0.17.0",
     .fingerprint = 0x9b70afac3d2d8bc6,
-    .paths = .{ "build.zig", "build.zig.zon", "plugin.zig", "plugin.zig.zon", "lib.zig" },
+    .paths = .{ "build.zig", "build.zig.zon", "plugin.zig", "plugin.zig.zon", "lib.zig", "lib.c" },
     .dependencies = .{
         // Replaced by `zig fetch --save=fizzy` with this tree's packed SDK.
         .fizzy = .{
diff --git a/scripts/fixtures/build-api/plugin/lib.c b/scripts/fixtures/build-api/plugin/lib.c
new file mode 100644
index 000000000..87c510882
--- /dev/null
+++ b/scripts/fixtures/build-api/plugin/lib.c
@@ -0,0 +1,4 @@
+// Weak: both fixture packages link this file into one executable.
+__attribute__((weak)) int fixture_answer(void) {
+    return 42;
+}
diff --git a/scripts/fixtures/build-api/plugin/lib.zig b/scripts/fixtures/build-api/plugin/lib.zig
index 2e5803bd5..0b9956a00 100644
--- a/scripts/fixtures/build-api/plugin/lib.zig
+++ b/scripts/fixtures/build-api/plugin/lib.zig
@@ -1 +1,3 @@
-pub const answer = 42;
+//! The fixture plugin's dependency of its own: Zig declaring a function that `lib.c` defines, so
+//! a lost import or a lost C source fails the plugin's compile or link.
+pub extern fn fixture_answer() c_int;
diff --git a/scripts/fixtures/build-api/plugin/plugin.zig b/scripts/fixtures/build-api/plugin/plugin.zig
index bce0cc8fd..1e1687ab2 100644
--- a/scripts/fixtures/build-api/plugin/plugin.zig
+++ b/scripts/fixtures/build-api/plugin/plugin.zig
@@ -4,6 +4,7 @@ const std = @import("std");
 const builtin = @import("builtin");
 const sdk = @import("fizzy_sdk");
 const dvui = @import("dvui");
+const fixture_lib = @import("fixture_lib");
 
 pub const plugin_options = @import("fizzy_plugin_options");
 pub const plugin_id = plugin_options.id;
@@ -28,6 +29,8 @@ var plugin: sdk.Plugin = .{
 const vtable: sdk.Plugin.VTable = .{};
 
 pub fn register(host: *sdk.Host) !void {
+    // Calls into the C source of the package's own dependency: it must have reached the link.
+    if (fixture_lib.fixture_answer() != 42) return error.FixtureDependency;
     try host.registerPlugin(&plugin);
     try host.registerSurface(.{
         .id = plugin_id ++ ".surface",

From 781ae567859dfd837e53fe1ba48a86301645b2f7 Mon Sep 17 00:00:00 2001
From: "fizzy-linux[bot]" <346940526+fizzy-linux[bot]@users.noreply.github.com>
Date: Mon, 26 Oct 2026 21:12:02 -0500
Subject: [PATCH 3/4] build: api-fixture-tests (codex)

Agent-Team: linux

Worker: codex
---
 scripts/check-examples.sh                    | 49 ++++++++++----------
 scripts/fixtures/build-api/plugin/plugin.zig |  1 +
 2 files changed, 26 insertions(+), 24 deletions(-)

diff --git a/scripts/check-examples.sh b/scripts/check-examples.sh
index 10ba4cf30..85dfed391 100755
--- a/scripts/check-examples.sh
+++ b/scripts/check-examples.sh
@@ -47,29 +47,32 @@ pack "$root" | gzip > "$work/fizzy.tar.gz"
 bash scripts/pack-sdk.sh "$work/sdk" >/dev/null
 sdk_tarball="$(ls "$work"/sdk/fizzy-sdk-v*.tar.gz)"
 
-for repo in example-app example-plugin; do
-  if [[ -n "${EXAMPLES_DIR:-}" ]]; then
-    mkdir -p "$work/$repo"
-    pack "$EXAMPLES_DIR/$repo" | tar -x -C "$work/$repo"
-  else
-    git clone --quiet --depth 1 "https://github.com/fizzyedit/$repo" "$work/$repo"
-  fi
-done
-
-(cd "$work/example-plugin" && zig fetch --save=fizzy "$sdk_tarball" >/dev/null)
-# example-app bundles example-plugin (`hello`), pinned by URL: the copy here, on this tree's SDK.
-pack "$work/example-plugin" | gzip > "$work/example-plugin.tar.gz"
-(
-  cd "$work/example-app"
-  zig fetch --save=hello "$work/example-plugin.tar.gz" >/dev/null
-  zig fetch --save=fizzy "$work/fizzy.tar.gz" >/dev/null
-  # Its replay app depends on the plugin SDK alone: this tree's, packed as a release would be.
-  zig fetch --save=fizzy_sdk "$sdk_tarball" >/dev/null
-  # So do the plugins it carries, each pinning a released SDK of its own.
-  for plugin in plugins/*/; do
-    (cd "$plugin" && zig fetch --save=fizzy "$sdk_tarball" >/dev/null)
+builds="${EXAMPLES_BUILDS-plugin minimal studio endless studio-zon replay dvui dvui-sdl3}"
+if [[ -n $builds ]]; then
+  for repo in example-app example-plugin; do
+    if [[ -n "${EXAMPLES_DIR:-}" ]]; then
+      mkdir -p "$work/$repo"
+      pack "$EXAMPLES_DIR/$repo" | tar -x -C "$work/$repo"
+    else
+      git clone --quiet --depth 1 "https://github.com/fizzyedit/$repo" "$work/$repo"
+    fi
   done
-)
+
+  (cd "$work/example-plugin" && zig fetch --save=fizzy "$sdk_tarball" >/dev/null)
+  # example-app bundles example-plugin (`hello`), pinned by URL: the copy here, on this tree's SDK.
+  pack "$work/example-plugin" | gzip > "$work/example-plugin.tar.gz"
+  (
+    cd "$work/example-app"
+    zig fetch --save=hello "$work/example-plugin.tar.gz" >/dev/null
+    zig fetch --save=fizzy "$work/fizzy.tar.gz" >/dev/null
+    # Its replay app depends on the plugin SDK alone: this tree's, packed as a release would be.
+    zig fetch --save=fizzy_sdk "$sdk_tarball" >/dev/null
+    # So do the plugins it carries, each pinning a released SDK of its own.
+    for plugin in plugins/*/; do
+      (cd "$plugin" && zig fetch --save=fizzy "$sdk_tarball" >/dev/null)
+    done
+  )
+fi
 
 # The plugin build installs the plugin: into a profile of its own, not this machine's fizzy.
 export FIZZY_PROFILE="$work/profile"
@@ -106,8 +109,6 @@ build_one() {
 }
 export -f build_args build_one
 
-builds="${EXAMPLES_BUILDS-plugin minimal studio endless studio-zon replay dvui dvui-sdl3}"
-
 # Each build is one compile of an app that mostly keeps one core busy, so they run side by side,
 # EXAMPLES_JOBS at once (3: CI's runner has 4 cores and 16 GB). First each configuration is
 # configured alone (`-l` lists its steps), which fetches the lazy dependencies it asks for, so
diff --git a/scripts/fixtures/build-api/plugin/plugin.zig b/scripts/fixtures/build-api/plugin/plugin.zig
index 1e1687ab2..3e578d97f 100644
--- a/scripts/fixtures/build-api/plugin/plugin.zig
+++ b/scripts/fixtures/build-api/plugin/plugin.zig
@@ -19,6 +19,7 @@ comptime {
     }
 }
 
+// The host writes plugin lifecycle state on the main UI thread.
 var plugin: sdk.Plugin = .{
     .state = undefined,
     .vtable = &vtable,

From 1a10373005da9bf7650edd2a8116fec672d6951e Mon Sep 17 00:00:00 2001
From: "fizzy-linux[bot]" <346940526+fizzy-linux[bot]@users.noreply.github.com>
Date: Tue, 27 Oct 2026 00:17:21 -0500
Subject: [PATCH 4/4] build: api-fixture-tests (codex)

Agent-Team: linux

Worker: codex
---
 .github/workflows/ci.yml                      |  35 ++-
 .github/workflows/hello-numbers.yml           |  13 +-
 CONTRIBUTING.md                               |   4 +-
 app/App.zig                                   |   4 +-
 app/Recents.zig                               |   4 +-
 app/Tracks.zig                                |  63 ++++-
 app/automation/overlay.zig                    |  54 +++-
 app/control/Server.zig                        |  73 +++--
 app/layout/Picker.zig                         |   2 +-
 app/layout/Region.zig                         |  27 +-
 app/layout/SplitTree.zig                      |  28 +-
 app/layout/State.zig                          |   2 +-
 app/layout/ViewDrag.zig                       |  19 +-
 app/store/PluginLoader.zig                    |  44 ++-
 app/store/PluginStore.zig                     |   2 +-
 app/update/bounded_join.zig                   |  51 ++++
 app/update/update_notify.zig                  |  29 +-
 backend/src/glass/BlurBackdrop.zig            |   8 +-
 backend/src/glass/LiquidField.zig             |  12 +
 build.zig                                     |  14 +-
 build/app.zig                                 |   2 +
 build/plugins.zig                             |   4 +-
 build/sdk.zig                                 |   7 -
 core/FileTable.zig                            |   5 +-
 core/LocalFs.zig                              |  17 +-
 core/dialogs.zig                              |   8 +-
 core/form_factor.zig                          |  26 +-
 docs/AGENT_WORK.md                            |  11 +
 docs/DEPENDENCIES.md                          |   3 +
 docs/HELLO_NUMBERS.md                         |  23 +-
 scripts/agent-finish                          |  11 +-
 scripts/check-examples.sh                     |  20 ++
 scripts/compare-hello.sh                      |   5 -
 scripts/hello-numbers.py                      |  21 +-
 scripts/hello-numbers.sh                      |   4 -
 scripts/test-agent-work.sh                    |  12 +
 scripts/test-hello-numbers.py                 |   4 +-
 scripts/test-web-text-input.sh                |  13 +
 src/Entry.zig                                 |   7 +-
 src/backend/layout_file.zig                   |   3 +
 src/editor/Editor.zig                         |  17 +-
 src/editor/PluginReloads.zig                  |   9 +-
 src/editor/explorer/settings.zig              | 100 ++-----
 tests/demos.zig                               |  14 +-
 tests/fixtures/app-only/build.zig             |  18 ++
 tests/fixtures/app-only/build.zig.zon         |  14 +
 tests/fixtures/app-only/plugin.zig            |   1 +
 tests/integration.zig                         | 161 ++++++++---
 web/fizzy.js                                  |  21 +-
 ...s-correction-replaces-the-typed-word.patch | 266 ++++++++++++++++++
 web/tests/text-input.test.js                  | 107 +++++++
 51 files changed, 1106 insertions(+), 316 deletions(-)
 create mode 100644 app/update/bounded_join.zig
 delete mode 100755 scripts/compare-hello.sh
 delete mode 100755 scripts/hello-numbers.sh
 create mode 100755 scripts/test-web-text-input.sh
 create mode 100644 tests/fixtures/app-only/build.zig
 create mode 100644 tests/fixtures/app-only/build.zig.zon
 create mode 100644 tests/fixtures/app-only/plugin.zig
 create mode 100644 web/patches/dvui/0010-web-a-keyboard-s-correction-replaces-the-typed-word.patch
 create mode 100644 web/tests/text-input.test.js

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c19f2b3ed..7c68fcf3f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,10 +15,29 @@ name: CI
 # three cold. Now the merge that changes a dependency saves the new caches, a cache GitHub
 # evicted after a quiet week comes back on the next merge, and every merge is tested on all
 # three platforms. Nothing waits on a main run, and a cache hit makes the extra jobs short.
+#
+# A draft pull request runs only `changes`: its author ran the gates on their own machine, and a
+# draft decides nothing, so the matrix would only repeat that. The matrix runs once per push to a
+# ready pull request, and `ready_for_review` starts it for the push the draft already holds.
+# `changes` reports code=false and sdl=false for a draft, the builds skip, and `ci-ok` passes on
+# skipped jobs; `gh pr ready` is therefore what makes the required check mean something, and
+# `main`'s ruleset still requires it. Pushes to main and the merge queue are unchanged.
+#
+# A green `ci-ok` on a draft means "nothing was built", and that is safe only because a draft
+# cannot be merged and the merge queue reruns the whole matrix on the `merge_group` ref. Turning
+# a ready PR back into a draft is not a trigger, so its last full result stays on it; push or
+# mark it ready again for a fresh one.
+#
+# The Zig compiler is restored from the Actions cache by every job: setup-zig keeps the verified
+# tarball under the key `setup-zig-tarball-<tarball name>` (the version is pinned by ZIG_VERSION;
+# a job's log shows `Cache hit for: setup-zig-tarball-zig-x86_64-linux-0.17.0`),
+# independent of the `use-cache: false` the jobs set for the Zig *package* cache, which has the
+# per-job key `zig-<ZIG_VERSION>-<job>-<os>-<arch>-<hash of every build.zig.zon>`.
 on:
   push:
     branches: [main]
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
   merge_group:
   workflow_dispatch:
 
@@ -59,8 +78,14 @@ jobs:
           EVENT: ${{ github.event_name }}
           PUSH_BEFORE: ${{ github.event.before }}
           QUEUE_BASE: ${{ github.event.merge_group.base_sha }}
+          DRAFT: ${{ github.event.pull_request.draft }}
         run: |
           set -euo pipefail
+          if [ "$DRAFT" = true ]; then
+            echo "::notice::draft pull request: nothing was built; the full CI runs at gh pr ready"
+            printf 'code=false\nsdl=false\n' >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           case "$EVENT" in
             pull_request) base=HEAD^1 ;;
             merge_group) base=$QUEUE_BASE ;;
@@ -112,6 +137,8 @@ jobs:
         run: sh scripts/test-zb.sh
       - name: scripts/check-kickoff
         run: python3 scripts/test-check-kickoff.py
+      - name: scripts/hello-numbers (harness, no windows)
+        run: python3 scripts/test-hello-numbers.py
       - name: scripts/agent-prepare, agent-finish
         run: bash scripts/test-agent-work.sh
       - name: superfans (fan-dedupe, fan-route, fan-lint on seeded input)
@@ -135,7 +162,8 @@ jobs:
           - { os: windows-latest, name: Windows }
           - { os: macos-14, name: macOS }
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 30
+    # macOS runs 26 to 30 minutes on a healthy day; a slow run should not be a failed one.
+    timeout-minutes: ${{ matrix.name == 'macOS' && 45 || 30 }}
     steps:
       - uses: actions/checkout@v4
       # The Zig cache's key, worked out once, here, before anything is unpacked. The fetch below
@@ -237,6 +265,11 @@ jobs:
       - name: Compile web (wasm) build with a custom layout
         if: matrix.name != 'Windows'
         shell: bash
+        # The script builds through scripts/zb, which waits for the load average to fall under the
+        # performance cores. A runner's load is the previous step's compilers (16 against 3 on
+        # macOS), so zb idled 10 minutes there. Nothing else shares a CI runner: skip the wait.
+        env:
+          FIZZY_BUILD_SKIP: "1"
         run: bash scripts/ci-retry.sh scripts/check-web-layout.sh
 
       # The tapes fizzyed.it serves beside the app: a script or `docs/demos/` tape that no longer
diff --git a/.github/workflows/hello-numbers.yml b/.github/workflows/hello-numbers.yml
index eb70b8f1b..8b8eae45e 100644
--- a/.github/workflows/hello-numbers.yml
+++ b/.github/workflows/hello-numbers.yml
@@ -3,6 +3,13 @@ name: Hello numbers
 on:
   push:
     branches: [main]
+  pull_request:
+    paths:
+      - .github/workflows/hello-numbers.yml
+      - scripts/hello-numbers.py
+      - scripts/test-hello-numbers.py
+      - docs/HELLO_NUMBERS.md
+      - src/Entry.zig
   workflow_dispatch:
 
 permissions:
@@ -47,8 +54,6 @@ jobs:
           echo "LIBGL_ALWAYS_SOFTWARE=1" >> "$GITHUB_ENV"
           echo "SDL_VIDEO_DRIVER=x11" >> "$GITHUB_ENV"
           echo "VK_DRIVER_FILES=$(ls /usr/share/vulkan/icd.d/lvp_icd*.json | head -n 1)" >> "$GITHUB_ENV"
-      - name: Test the measurement harness without windows
-        run: python3 scripts/test-hello-numbers.py
       - name: Measure both release modes
         run: |
           set -euo pipefail
@@ -58,9 +63,9 @@ jobs:
             --example-revision "$(git -C ../example-app rev-parse HEAD)"
             --plugin-revision "$(git -C ../example-plugin rev-parse HEAD)")
           if [[ "$RUNNER_OS" == Linux ]]; then
-            xvfb-run -a -s "-screen 0 1280x1024x24" scripts/hello-numbers.sh "${args[@]}"
+            xvfb-run -a -s "-screen 0 1280x1024x24" python3 scripts/hello-numbers.py "${args[@]}"
           else
-            scripts/hello-numbers.sh "${args[@]}"
+            python3 scripts/hello-numbers.py "${args[@]}"
           fi
       - uses: actions/upload-artifact@v4
         if: always()
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 5c86a1ea6..f730f7ff8 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -42,10 +42,10 @@ The open PR list is the board of who is working on what.
    touches the same files or the same plan step, coordinate on it (comment, or stack on top of
    it) instead of starting a parallel version.
 2. **Open a draft PR on your first push** (`gh pr create --draft --body-file <file>`), with the
-   template filled in as far as you know it. A draft runs CI, so claim early.
+   template filled in as far as you know it. A draft runs only the light `changes` job (the full matrix starts at `gh pr ready`), so claim early.
 3. **Take it to ready yourself; don't hand back a draft.** When the change is done and the gates
    pass, review your own diff (in Claude Code, the `code-review` skill at `high` on the PR), fix
-   what holds up, push, and wait for CI to go green. Then `gh pr ready`, and end the session
+   what holds up, push, then `gh pr ready`, which starts the full CI, and wait for it to go green. End the session
    with one question: merge it? Say what was reviewed and what was left, so the answer can be
    yes without opening the PR.
 4. **Merging is the maintainer's.** On a yes, merge with `gh pr merge --squash`. Never push to
diff --git a/app/App.zig b/app/App.zig
index 34201bb52..5565f6a8d 100644
--- a/app/App.zig
+++ b/app/App.zig
@@ -1013,7 +1013,7 @@ pub fn recordCaseClash(app: *App, id: []const u8, other: []const u8, path: ?[]co
     const why = app.arena.allocator().print("id '{s}' differs only in case from the plugin '{s}'", .{ id, other }) catch "id differs only in case from another plugin";
     std.log.warn("plugin '{s}': {s}; not loaded", .{ id, why });
     // The web's loader has no build on disk to read a version from.
-    const probe = if (comptime builtin.target.cpu.arch == .wasm32) null else if (path) |p| PluginLoader.probeVersionInfo(p) else null;
+    const probe = if (comptime builtin.target.cpu.arch == .wasm32) null else if (path) |p| PluginLoader.probeVersionInfo(app.gpa, p) else null;
     app.clearFailedUserPlugin(id);
     app.recordPluginFailure(id, why, null, if (probe) |info| info.plugin_version else null, if (path) |p| .of(p) else .{});
 }
@@ -1328,7 +1328,7 @@ pub fn reconcilePluginSettings(app: *App) void {
 /// (loaded / disabled / failed) rather than vanishing from the UI.
 pub fn recordLoadFailure(app: *App, id: []const u8, path: []const u8, err: PluginLoader.LoadError) void {
     const reason = App.pluginLoadFailureReason(err);
-    const probe = PluginLoader.probeVersionInfo(path);
+    const probe = PluginLoader.probeVersionInfo(app.gpa, path);
     const detail: ?[]const u8 = if (probe) |info|
         App.formatPluginProbeDetail(app.gpa, info) catch null
     else
diff --git a/app/Recents.zig b/app/Recents.zig
index 25268309d..e1e67a65a 100644
--- a/app/Recents.zig
+++ b/app/Recents.zig
@@ -247,7 +247,7 @@ test "a recents.zon from before times reads in order, every time unknown" {
     var dirs = try TestDirs.init(gpa);
     defer dirs.deinit(gpa);
 
-    const old = try gpa.print(".{{ .last_open_folder = \"\", .folders = .{{ \"{s}\", \"{s}\" }}, .commands = .{{}} }}", .{ dirs.a, dirs.b });
+    const old = try gpa.print(".{{ .last_open_folder = \"\", .folders = .{{ \"{f}\", \"{f}\" }}, .commands = .{{}} }}", .{ std.zig.fmtString(dirs.a), std.zig.fmtString(dirs.b) });
     defer gpa.free(old);
     try core.fs.write(dvui.io, dirs.zon, old);
 
@@ -285,7 +285,7 @@ test "a time stays with its folder when a row before it is gone from disk" {
     var dirs = try TestDirs.init(gpa);
     defer dirs.deinit(gpa);
 
-    const zon = try gpa.print(".{{ .folders = .{{ \"{s}/gone\", \"{s}\" }}, .folders_opened = .{{ 100, 200 }} }}", .{ dirs.a, dirs.b });
+    const zon = try gpa.print(".{{ .folders = .{{ \"{f}/gone\", \"{f}\" }}, .folders_opened = .{{ 100, 200 }} }}", .{ std.zig.fmtString(dirs.a), std.zig.fmtString(dirs.b) });
     defer gpa.free(zon);
     try core.fs.write(dvui.io, dirs.zon, zon);
 
diff --git a/app/Tracks.zig b/app/Tracks.zig
index c07deca3c..997dfe5f9 100644
--- a/app/Tracks.zig
+++ b/app/Tracks.zig
@@ -548,8 +548,7 @@ fn keepLater(self: *Tracks, t: *Track) bool {
     return true;
 }
 
-/// Write what `keepLater` left, here: for a read of a kept file (`pickUp`) or the app quitting,
-/// neither of which can wait for the checkpoint.
+/// Write what `keepLater` left, here: for the app quitting, which cannot wait for the checkpoint.
 fn flushPending(self: *Tracks) void {
     if (comptime !can_keep) return;
     // The checkpoint's thread may hold older copies of the same files.
@@ -625,9 +624,18 @@ fn pickUp(self: *Tracks, t: *Track) bool {
     if (!keepable(path)) return false;
     const file = self.keptFile(self.gpa, path) orelse return false;
     defer self.gpa.free(file);
-    self.flushPending();
-    const bytes = std.Io.Dir.cwd().readFileAlloc(dvui.io, file, self.gpa, .unlimited) catch return false;
-    defer self.gpa.free(bytes);
+    // A closed document's track still waiting for the checkpoint's thread is read where it is, not
+    // written first: a reopen never packs or writes on the frame. The last is the newest.
+    var waiting: ?[]const u8 = null;
+    for (self.pending.items) |k| {
+        if (std.mem.eql(u8, k.file, file)) waiting = k.bytes;
+    }
+    // One the thread already took is on its way to the file: wait it out, which is rare, so the
+    // read finds the newest history and not an absent or older file.
+    if (waiting == null) while (self.writing.load(.acquire) != 0) std.Thread.yield() catch {};
+    const read_bytes = if (waiting) |_| null else std.Io.Dir.cwd().readFileAlloc(dvui.io, file, self.gpa, .unlimited) catch return false;
+    defer if (read_bytes) |b| self.gpa.free(b);
+    const bytes = waiting orelse read_bytes.?;
     const prof = core.profile.begin("fizzy", "tracks.pickUp");
     defer prof.end();
     var kept = track_file.read(self.gpa, bytes) catch return false;
@@ -1389,10 +1397,14 @@ const KeptStand = struct {
         return true;
     }
 
+    // lint-allow(anyerror): the vtable's signature
+    fn restoreHistory(_: *anyopaque, _: sdk.DocHandle, _: sdk.Plugin.RestoredHistory) anyerror!void {}
+
     const vtable: sdk.Plugin.VTable = v: {
         var v = Stand.vtable;
         v.documentPath = documentPath;
         v.isDirty = isDirty;
+        v.restoreHistory = restoreHistory;
         break :v v;
     };
     var plugin: sdk.Plugin = .{ .state = &Stand.state, .vtable = &vtable, .id = "kept", .display_name = "Kept", .step_format = 1 };
@@ -1464,7 +1476,46 @@ test "a closed document's track waits unpacked for the checkpoint's thread" {
     try testing.expect(size < Stand.bytes.len / 2);
 }
 
-test "a read of a kept file writes the closed documents' tracks first" {
+test "reopening a document reads its closed track from memory and writes nothing" {
+    var tmp = testing.tmpDir(.{});
+    defer tmp.cleanup();
+    var t = try KeptStand.tracks(&tmp);
+    defer t.deinitAll();
+    t.closed(1);
+    try testing.expectEqual(@as(usize, 1), t.pending.items.len);
+    t.opened(.{ .ptr = &Stand.state, .owner = &KeptStand.plugin, .id = 1 });
+    t.tick();
+    // The track came back, and the frame neither wrote nor dropped the copy waiting for the thread.
+    try testing.expectEqual(@as(usize, 1), t.open.get(1).?.steps.items.len);
+    try testing.expectEqual(@as(usize, 1), t.pending.items.len);
+    try testing.expectEqual(@as(?u64, null), try KeptStand.keptFileSize(&t, &tmp));
+}
+
+test "reopening a document while the checkpoint's thread writes its track keeps the history" {
+    const Writer = struct {
+        fn run(t: *Tracks, k: KeptFile) void {
+            dvui.io.sleep(.fromMilliseconds(50), .awake) catch {};
+            _ = writeKept(testing.allocator, k, "checkpoint");
+            t.doneWriting();
+        }
+    };
+    var tmp = testing.tmpDir(.{});
+    defer tmp.cleanup();
+    var t = try KeptStand.tracks(&tmp);
+    defer t.deinitAll();
+    t.closed(1);
+    const taken = t.takeChanged(false);
+    defer testing.allocator.free(taken);
+    defer taken[0].deinit(testing.allocator);
+    const thread = try std.Thread.spawn(.{}, Writer.run, .{ &t, taken[0] });
+    defer thread.join();
+    // Taken, and not yet renamed into place: a reopen now must not start a fresh track.
+    t.opened(.{ .ptr = &Stand.state, .owner = &KeptStand.plugin, .id = 1 });
+    t.tick();
+    try testing.expectEqual(@as(usize, 1), t.open.get(1).?.steps.items.len);
+}
+
+test "the app quitting writes the closed documents' tracks" {
     var tmp = testing.tmpDir(.{});
     defer tmp.cleanup();
     var t = try KeptStand.tracks(&tmp);
diff --git a/app/automation/overlay.zig b/app/automation/overlay.zig
index 3c1c31779..5cdaab483 100644
--- a/app/automation/overlay.zig
+++ b/app/automation/overlay.zig
@@ -1145,14 +1145,21 @@ fn drawSeeking(player: *Player, win: dvui.Rect) void {
     done.fill(.all(r.h / 2), .{ .color = .{ .color = theme().color(.highlight, .fill) }, .fade = 1 });
 }
 
-test "a caption's card is made of the material tooltips and menus wear" {
+test "a caption's card is made of the material tooltips, menus and popovers wear" {
     const fns = struct {
         var blur: f32 = 0;
+        var glass_ready = false;
         var tooltip: ?f32 = null;
         var caption: ?f32 = null;
+        var popover: ?f32 = null;
+        var tooltip_field: ?bool = null;
+        var caption_field: ?bool = null;
+        var popover_field: ?bool = null;
         var menu: ?core.widgets.BlurBackdrop.Pane = null;
         var dialog: ?core.widgets.FloatingWindowWidget.Frost = null;
+        var popover_rect: dvui.Rect = .{};
         fn frame() !dvui.App.Result {
+            core.widgets.LiquidField.readyInTest(glass_ready);
             core.dialogs.publishStyle(.{ .blur = blur, .opacity = 0.5 });
             menu = core.widgets.menuFrost();
             dialog = core.dialogs.dialogFrost();
@@ -1161,6 +1168,7 @@ test "a caption's card is made of the material tooltips and menus wear" {
                 defer box.deinit();
                 core.dialogs.tooltipSurface(box.data());
                 tooltip = radiusOf(box.data().id);
+                tooltip_field = fieldOf(box.data().id);
                 dvui.labelNoFmt(@src(), "tooltip", .{}, .{});
             }
             {
@@ -1168,33 +1176,65 @@ test "a caption's card is made of the material tooltips and menus wear" {
                 defer box.deinit();
                 glass(box.data(), .{ .x = 0.5, .y = 0.5 }, .{});
                 caption = radiusOf(box.data().id);
+                caption_field = fieldOf(box.data().id);
                 dvui.labelNoFmt(@src(), "caption", .{}, .{});
             }
+            {
+                var p = core.widgets.Popover.init(@src(), .{ .rect = &popover_rect, .anchor = .{ .x = 20, .y = 20 } });
+                defer p.deinit();
+                popover = radiusOf(p.win.data().id);
+                popover_field = fieldOf(p.win.data().id);
+                dvui.labelNoFmt(@src(), "popover", .{}, .{});
+            }
             return .ok;
         }
         fn radiusOf(id: dvui.Id) ?f32 {
             const f = dvui.dataGetPtr(null, id, "_frost", core.widgets.BlurBackdrop) orelse return null;
             return f.radius_px;
         }
+        /// Whether the pane queued under `id` is the glass program's (a field) rather than the
+        /// rounded rect's; null when none was queued.
+        fn fieldOf(id: dvui.Id) ?bool {
+            const job = dvui.dataGetPtr(null, id, "_frost_job", core.widgets.BlurBackdrop.FrostJob) orelse return null;
+            if (job.rect.w <= 0) return null;
+            return job.field != null;
+        }
         /// A window of its own each, so no frost is left over from the other's frame.
-        fn drawnAt(b: f32) !void {
+        fn drawnAt(b: f32, ready: bool) !void {
             var t = try dvui.testing.init(.{ .window_size = .{ .w = 400, .h = 300 } });
             defer t.deinit();
             blur = b;
-            _ = try dvui.testing.step(frame);
+            glass_ready = ready;
+            popover_rect = .{};
+            // Frames, for the popover to open out of nothing.
+            for (0..4) |_| _ = try dvui.testing.step(frame);
         }
     };
-    // Blur on: both are the dialog frost, at the style's radius.
-    try fns.drawnAt(20);
+    // Blur on: all three are the dialog frost, at the style's radius.
+    try fns.drawnAt(20, false);
     try std.testing.expectEqual(@as(?f32, 20), fns.tooltip);
     try std.testing.expectEqual(fns.tooltip, fns.caption);
+    // A popover wears the same frost (its window forms the radius its own way).
+    try std.testing.expect(fns.popover != null);
     // The menus ask for the same frost from the same place.
     try std.testing.expectEqual(fns.dialog.?.radius, fns.menu.?.radius);
     try std.testing.expectEqual(fns.dialog.?.mix, fns.menu.?.mix);
     try std.testing.expectEqual(fns.dialog.?.tint, fns.menu.?.tint);
-    // Blur off (and no glass program in the testing backend): a plain fill for both, no frost.
-    try fns.drawnAt(0);
+    // Blur off and no glass program: a plain fill for all, no frost.
+    try fns.drawnAt(0, false);
     try std.testing.expectEqual(@as(?f32, null), fns.tooltip);
     try std.testing.expectEqual(@as(?f32, null), fns.caption);
+    try std.testing.expectEqual(@as(?f32, null), fns.popover);
     try std.testing.expect(fns.menu == null);
+    // The glass program ready (blur on or off): every one is the rounded rect's frost the dialog
+    // style asks for. A caption that took its own Liquid Glass path (as it did before) queues
+    // the program's field here while the rest do not.
+    for ([_]f32{ 20, 0 }) |b| {
+        try fns.drawnAt(b, true);
+        try std.testing.expect(fns.menu != null);
+        try std.testing.expectEqual(@as(?bool, false), fns.tooltip_field);
+        try std.testing.expectEqual(@as(?bool, false), fns.caption_field);
+        try std.testing.expectEqual(@as(?bool, false), fns.popover_field);
+    }
+    try std.testing.expect(fns.menu.?.clear);
 }
diff --git a/app/control/Server.zig b/app/control/Server.zig
index f7ebc76b8..f0bb42c21 100644
--- a/app/control/Server.zig
+++ b/app/control/Server.zig
@@ -684,18 +684,25 @@ fn noWake() void {}
 const Watchdog = struct {
     const limit_ms = 60_000;
 
+    gpa: std.mem.Allocator,
     io: Io,
     name: []const u8,
     done: Io.Event = .unset,
-    thread: ?std.Thread = null,
+    thread: std.Thread = undefined,
 
-    fn arm(self: *Watchdog) !void {
+    /// Starts a watch on the test `name` (`@src().fn_name`); the test ends it with `stop`.
+    fn start(gpa: std.mem.Allocator, io: Io, name: []const u8) !*Watchdog {
+        const self = try gpa.create(Watchdog);
+        errdefer gpa.destroy(self);
+        self.* = .{ .io = io, .name = name, .gpa = gpa };
         self.thread = try std.Thread.spawn(.{}, watch, .{self});
+        return self;
     }
 
-    fn disarm(self: *Watchdog) void {
+    fn stop(self: *Watchdog) void {
         self.done.set(self.io);
-        if (self.thread) |t| t.join();
+        self.thread.join();
+        self.gpa.destroy(self);
     }
 
     fn watch(self: *Watchdog) void {
@@ -704,7 +711,8 @@ const Watchdog = struct {
                 std.debug.print("\nfizzy-control-server-tests: {s} still running after {d} s: a client or the server is blocked; aborting\n", .{ self.name, limit_ms / 1000 });
                 std.process.abort();
             },
-            else => {},
+            // Nothing cancels this thread; a cancellation would mean the test is already ending.
+            error.Canceled => {},
         };
     }
 };
@@ -754,9 +762,8 @@ test "a request reaches the UI thread and its answer goes back" {
     if (!Io.net.has_unix_sockets) return error.SkipZigTest;
     const gpa = std.testing.allocator;
     const io = std.testing.io;
-    var dog: Watchdog = .{ .io = io, .name = @src().fn_name };
-    try dog.arm();
-    defer dog.disarm();
+    const dog = try Watchdog.start(gpa, io, @src().fn_name);
+    defer dog.stop();
     var tmp = std.testing.tmpDir(.{});
     defer tmp.cleanup();
     // In a folder of its own that `start` makes, as the app's is (`control/control.sock`).
@@ -831,9 +838,8 @@ test "a request still queued at quit is answered: the server is stopping" {
     if (!Io.net.has_unix_sockets) return error.SkipZigTest;
     const gpa = std.testing.allocator;
     const io = std.testing.io;
-    var dog: Watchdog = .{ .io = io, .name = @src().fn_name };
-    try dog.arm();
-    defer dog.disarm();
+    const dog = try Watchdog.start(gpa, io, @src().fn_name);
+    defer dog.stop();
     var tmp = std.testing.tmpDir(.{});
     defer tmp.cleanup();
     const path = try testSocket(gpa, &tmp);
@@ -864,9 +870,8 @@ test "what cannot be served is refused before its body, and never reaches the ap
     if (!Io.net.has_unix_sockets) return error.SkipZigTest;
     const gpa = std.testing.allocator;
     const io = std.testing.io;
-    var dog: Watchdog = .{ .io = io, .name = @src().fn_name };
-    try dog.arm();
-    defer dog.disarm();
+    const dog = try Watchdog.start(gpa, io, @src().fn_name);
+    defer dog.stop();
     var tmp = std.testing.tmpDir(.{});
     defer tmp.cleanup();
     const path = try testSocket(gpa, &tmp);
@@ -930,9 +935,8 @@ test "a server that took over the path keeps it when the old one stops" {
     if (!Io.net.has_unix_sockets) return error.SkipZigTest;
     const gpa = std.testing.allocator;
     const io = std.testing.io;
-    var dog: Watchdog = .{ .io = io, .name = @src().fn_name };
-    try dog.arm();
-    defer dog.disarm();
+    const dog = try Watchdog.start(gpa, io, @src().fn_name);
+    defer dog.stop();
     var tmp = std.testing.tmpDir(.{});
     defer tmp.cleanup();
     const path = try testSocket(gpa, &tmp);
@@ -967,9 +971,8 @@ test "a stream gets the events it asked for, once each, until the server stops"
     if (!Io.net.has_unix_sockets) return error.SkipZigTest;
     const gpa = std.testing.allocator;
     const io = std.testing.io;
-    var dog: Watchdog = .{ .io = io, .name = @src().fn_name };
-    try dog.arm();
-    defer dog.disarm();
+    const dog = try Watchdog.start(gpa, io, @src().fn_name);
+    defer dog.stop();
     var tmp = std.testing.tmpDir(.{});
     defer tmp.cleanup();
     const path = try testSocket(gpa, &tmp);
@@ -1069,9 +1072,8 @@ test "a client that stops reading neither holds up the quit nor buffers without
     if (!Io.net.has_unix_sockets) return error.SkipZigTest;
     const gpa = std.testing.allocator;
     const io = std.testing.io;
-    var dog: Watchdog = .{ .io = io, .name = @src().fn_name };
-    try dog.arm();
-    defer dog.disarm();
+    const dog = try Watchdog.start(gpa, io, @src().fn_name);
+    defer dog.stop();
     var tmp = std.testing.tmpDir(.{});
     defer tmp.cleanup();
     const path = try testSocket(gpa, &tmp);
@@ -1114,9 +1116,8 @@ test "a stopped server ends a stream whose client stopped reading" {
     if (!Io.net.has_unix_sockets) return error.SkipZigTest;
     const gpa = std.testing.allocator;
     const io = std.testing.io;
-    var dog: Watchdog = .{ .io = io, .name = @src().fn_name };
-    try dog.arm();
-    defer dog.disarm();
+    const dog = try Watchdog.start(gpa, io, @src().fn_name);
+    defer dog.stop();
     var tmp = std.testing.tmpDir(.{});
     defer tmp.cleanup();
     const path = try testSocket(gpa, &tmp);
@@ -1146,9 +1147,8 @@ test "an event published as the stream is answered is not lost" {
     if (!Io.net.has_unix_sockets) return error.SkipZigTest;
     const gpa = std.testing.allocator;
     const io = std.testing.io;
-    var dog: Watchdog = .{ .io = io, .name = @src().fn_name };
-    try dog.arm();
-    defer dog.disarm();
+    const dog = try Watchdog.start(gpa, io, @src().fn_name);
+    defer dog.stop();
     var tmp = std.testing.tmpDir(.{});
     defer tmp.cleanup();
     const path = try testSocket(gpa, &tmp);
@@ -1180,9 +1180,8 @@ test "a stopped server ends a keep-alive connection waiting for its next request
     if (!Io.net.has_unix_sockets) return error.SkipZigTest;
     const gpa = std.testing.allocator;
     const io = std.testing.io;
-    var dog: Watchdog = .{ .io = io, .name = @src().fn_name };
-    try dog.arm();
-    defer dog.disarm();
+    const dog = try Watchdog.start(gpa, io, @src().fn_name);
+    defer dog.stop();
     var tmp = std.testing.tmpDir(.{});
     defer tmp.cleanup();
     const path = try testSocket(gpa, &tmp);
@@ -1289,9 +1288,8 @@ test "an upgraded connection carries bytes both ways until the app closes it" {
     if (!Io.net.has_unix_sockets) return error.SkipZigTest;
     const gpa = std.testing.allocator;
     const io = std.testing.io;
-    var dog: Watchdog = .{ .io = io, .name = @src().fn_name };
-    try dog.arm();
-    defer dog.disarm();
+    const dog = try Watchdog.start(gpa, io, @src().fn_name);
+    defer dog.stop();
     var tmp = std.testing.tmpDir(.{});
     defer tmp.cleanup();
     const path = try testSocket(gpa, &tmp);
@@ -1337,9 +1335,8 @@ test "a client that leaves an upgraded connection finishes its link" {
     if (!Io.net.has_unix_sockets) return error.SkipZigTest;
     const gpa = std.testing.allocator;
     const io = std.testing.io;
-    var dog: Watchdog = .{ .io = io, .name = @src().fn_name };
-    try dog.arm();
-    defer dog.disarm();
+    const dog = try Watchdog.start(gpa, io, @src().fn_name);
+    defer dog.stop();
     var tmp = std.testing.tmpDir(.{});
     defer tmp.cleanup();
     const path = try testSocket(gpa, &tmp);
diff --git a/app/layout/Picker.zig b/app/layout/Picker.zig
index 57f1c179e..88e8d90b1 100644
--- a/app/layout/Picker.zig
+++ b/app/layout/Picker.zig
@@ -753,7 +753,7 @@ fn drawLifted(self: *Picker, f: *Layout) void {
             .release => if (me.button.pointer()) {
                 e.handled = true;
                 ViewDrag.apply(f, ViewDrag.loose_source, me.p);
-                d.discard();
+                d.discard(f.gpa);
                 self.lifted = false;
                 dvui.captureMouse(null, e.num);
                 dvui.dragEnd();
diff --git a/app/layout/Region.zig b/app/layout/Region.zig
index 3f17d5c57..bbe5bf638 100644
--- a/app/layout/Region.zig
+++ b/app/layout/Region.zig
@@ -931,7 +931,7 @@ fn cornerButton(self: *Layout, opts: InitOptions, keywords: []const []const u8,
                 ViewDrag.apply(self, opts.name, me.p);
                 dragged = true;
             }
-            self.state.view_drag.discard();
+            self.state.view_drag.discard(self.gpa);
             dvui.dataRemove(null, box.data().id, "_chooser_press");
             dvui.captureMouse(null, e.num);
             dvui.dragEnd();
@@ -1453,13 +1453,19 @@ fn orientBranch(self: *Layout, saved: SplitTree.Branch, id: dvui.Id) SplitTree.B
         const room = alongSize(saved.dir, dims);
         if (seen == null or seen.? != extent) {
             dvui.dataSet(null, id, "_seen", extent);
-            if (room > 0) dvui.dataSet(null, id, "_share", std.math.clamp(extent / room, 0, 1));
+            // The first sight of a half that was saved keeps its saved share: its extent is
+            // along the axis it was left on, which this box may not have.
+            if (seen == null and saved.share != null) {
+                setShare(self, saved.created, id, saved.share.?);
+            } else if (room > 0) {
+                setShare(self, saved.created, id, std.math.clamp(extent / room, 0, 1));
+            }
         }
     } else if (chosen) |extent| {
         // Dragged since the branch set it: the drag is the new share.
         const set = dvui.dataGet(null, id, "_set", f32) orelse extent;
         const room = alongSize(drawn.dir, dims);
-        if (set != extent and room > 0) dvui.dataSet(null, id, "_share", std.math.clamp(extent / room, 0, 1));
+        if (set != extent and room > 0) setShare(self, saved.created, id, std.math.clamp(extent / room, 0, 1));
     }
     const share = dvui.dataGet(null, id, "_share", f32) orelse return drawn;
 
@@ -1503,6 +1509,13 @@ fn orientBranch(self: *Layout, saved: SplitTree.Branch, id: dvui.Id) SplitTree.B
     return drawn;
 }
 
+/// The share an adaptive split's new half has now: drawn through the turn (`_share`), and saved
+/// with the split.
+fn setShare(self: *Layout, created: []const u8, id: dvui.Id, share: f32) void {
+    dvui.dataSet(null, id, "_share", share);
+    if (self.state.splits.setShare(created, share)) self.extents_changed = true;
+}
+
 fn alongSize(dir: dvui.enums.Direction, size: dvui.Size) f32 {
     return switch (dir) {
         .horizontal => size.w,
@@ -1701,10 +1714,14 @@ fn drawTreeNode(
                     dvui.dataSet(null, id, "_size", default);
                 }
                 const chosen = dvui.dataGet(null, id, "_size", f32) orelse default;
-                const shown = Split.eased(id, chosen);
+                // Folds and writes like a leaf (`orientBranch`): the half of an outer turn
+                // slides shut, and while it is drawn turned its extent is not the person's.
+                const folding = dvui.dataGet(null, id, "_fold", bool) orelse false;
+                const turned = dvui.dataGet(null, id, "_turned", bool) orelse false;
+                const shown = Split.eased(id, if (folding) 0 else chosen);
                 dvui.dataSet(null, id, "_size", chosen);
                 // Forgotten, its nodes are freed with it: nothing more of it to draw this frame.
-                if (persistExtent(self, .{ .name = b.origin, .forget_when_empty = true }, id, chosen, shown)) return;
+                if (!turned and persistExtent(self, .{ .name = b.origin, .forget_when_empty = true }, id, chosen, shown)) return;
                 box_opts.min_size_content = switch (parent_dir) {
                     .horizontal => .{ .w = shown },
                     .vertical => .{ .h = shown },
diff --git a/app/layout/SplitTree.zig b/app/layout/SplitTree.zig
index 7f517eeb8..bcb8b86f6 100644
--- a/app/layout/SplitTree.zig
+++ b/app/layout/SplitTree.zig
@@ -54,6 +54,10 @@ pub const Branch = struct {
     /// Fizzy made this split, not the person: it runs the way its space's shape asks and turns
     /// with it (`turn`). `dir` and `side` are how it runs now.
     adaptive: bool = false,
+    /// An adaptive split's new half as a share of its box along the axis, 0 to 1. Saved because
+    /// the half's pixel extent is along the axis it was last chosen on, which a box of another
+    /// shape (a restart in portrait) no longer has. Null until the person has sized it.
+    share: ?f32 = null,
     a: *Node,
     b: *Node,
 };
@@ -208,6 +212,7 @@ pub const Forest = struct {
         parent: []const u8,
         side: Side,
         adaptive: bool = false,
+        share: ?f32 = null,
     };
 
     /// The split that minted `created` is fizzy's own (`Branch.adaptive`). False when no split did.
@@ -217,6 +222,27 @@ pub const Forest = struct {
         return false;
     }
 
+    /// Record the share of the adaptive split that minted `created`. True when it changed.
+    pub fn setShare(self: *Forest, created: []const u8, share: f32) bool {
+        var it = self.roots.valueIterator();
+        while (it.next()) |n| if (shareIn(n.*, created, share)) |changed| return changed;
+        return false;
+    }
+
+    fn shareIn(node: *Node, created: []const u8, share: f32) ?bool {
+        switch (node.kind) {
+            .leaf => return null,
+            .branch => |*b| {
+                if (std.mem.eql(u8, b.created, created)) {
+                    if (b.share == share) return false;
+                    b.share = share;
+                    return true;
+                }
+                return shareIn(b.a, created, share) orelse shareIn(b.b, created, share);
+            },
+        }
+    }
+
     fn markIn(node: *Node, created: []const u8) bool {
         switch (node.kind) {
             .leaf => return false,
@@ -244,7 +270,7 @@ pub const Forest = struct {
         switch (node.kind) {
             .leaf => {},
             .branch => |b| {
-                out.append(gpa, .{ .name = b.created, .parent = b.origin, .side = b.side, .adaptive = b.adaptive }) catch {};
+                out.append(gpa, .{ .name = b.created, .parent = b.origin, .side = b.side, .adaptive = b.adaptive, .share = b.share }) catch {};
                 collectFrom(b.a, gpa, out);
                 collectFrom(b.b, gpa, out);
             },
diff --git a/app/layout/State.zig b/app/layout/State.zig
index 96da8e6dc..46aa109cf 100644
--- a/app/layout/State.zig
+++ b/app/layout/State.zig
@@ -860,7 +860,7 @@ pub fn clearArrangement(self: *State, gpa: std.mem.Allocator) void {
     self.splits.deinit(gpa);
     self.splits = .{};
     self.slide_open = "";
-    self.view_drag.discard();
+    self.view_drag.discard(gpa);
     self.discardSwaps();
     self.center_transition.discard();
     self.center_prev_id = null;
diff --git a/app/layout/ViewDrag.zig b/app/layout/ViewDrag.zig
index 61500fea1..ce83ef85d 100644
--- a/app/layout/ViewDrag.zig
+++ b/app/layout/ViewDrag.zig
@@ -58,7 +58,8 @@ texture_rect: dvui.Rect.Physical = .{},
 photo_box: dvui.Rect = .{ .x = 0, .y = 0, .w = 1, .h = 1 },
 /// Its pixels, premultiplied RGBA rows of `photo_size`, kept where the app shows the picture under
 /// the OS's glass (`core.dialogs.carry_windows`) — handed over once, as an image (`photo_gen` new
-/// with each picture) — and freed with the drag (`discard`). Null elsewhere.
+/// with each picture) — and freed with the drag (`discard`), both given the one allocator the layout
+/// owns it with. Null elsewhere.
 photo_pixels: ?[]dvui.Color.PMA = null,
 photo_size: [2]u32 = .{ 0, 0 },
 photo_gen: u32 = 0,
@@ -482,11 +483,11 @@ fn takes(d: *const ViewDrag, o: Offer) bool {
     return false;
 }
 
-pub fn discard(self: *ViewDrag) void {
+pub fn discard(self: *ViewDrag, gpa: std.mem.Allocator) void {
     // Destroyed with a frame, and only in one: discarded at teardown (quitting mid-drag) there is
     // no window, and the GPU goes with the process.
     if (self.texture) |tex| if (dvui.current_window != null) dvui.Texture.destroyLater(tex);
-    self.forgetPixels();
+    self.forgetPixels(gpa);
     // The drops still showing outlive the drag: they run back together where they were drawn
     // (`drawOverlay`), whatever the drop has just done to their places.
     const finishing = self.last_pending;
@@ -496,10 +497,10 @@ pub fn discard(self: *ViewDrag) void {
     self.last_pending_count = finishing_count;
 }
 
-pub fn takePicture(self: *ViewDrag, pic: *dvui.Picture) void {
+pub fn takePicture(self: *ViewDrag, gpa: std.mem.Allocator, pic: *dvui.Picture) void {
     pic.stop();
     self.photo_box = .{ .x = 0, .y = 0, .w = 1, .h = 1 };
-    self.forgetPixels();
+    self.forgetPixels(gpa);
     if (dvui.Texture.readTarget(dvui.currentWindow().arena(), pic.texture)) |px| {
         const w = pic.texture.width;
         const h = pic.texture.height;
@@ -507,7 +508,7 @@ pub fn takePicture(self: *ViewDrag, pic: *dvui.Picture) void {
         // What the drop shows of it, closer where it is too wide to read shrunk into the drop.
         self.photo_box = focusBox(dvui.currentWindow().arena(), px, w, h, self.photo_box, 2 * drop_r * dvui.currentWindow().natural_scale * std.math.sqrt1_2);
         if (core.dialogs.carry_windows and px.len >= @as(usize, w) * h) {
-            if (std.heap.page_allocator.dupe(dvui.Color.PMA, px[0 .. @as(usize, w) * h])) |kept| {
+            if (gpa.dupe(dvui.Color.PMA, px[0 .. @as(usize, w) * h])) |kept| {
                 self.photo_pixels = kept;
                 self.photo_size = .{ w, h };
                 self.photo_gen +%= 1;
@@ -521,8 +522,8 @@ pub fn takePicture(self: *ViewDrag, pic: *dvui.Picture) void {
     self.texture_rect = pic.r;
 }
 
-fn forgetPixels(self: *ViewDrag) void {
-    if (self.photo_pixels) |px| std.heap.page_allocator.free(px);
+fn forgetPixels(self: *ViewDrag, gpa: std.mem.Allocator) void {
+    if (self.photo_pixels) |px| gpa.free(px);
     self.photo_pixels = null;
 }
 
@@ -678,7 +679,7 @@ pub fn shotWanted(l: *Layout, is_source: bool) Shot {
 pub fn keepShot(l: *Layout, shot: Shot, pic: *dvui.Picture) void {
     const d = &l.state.view_drag;
     if (shot.card) {
-        d.takePicture(pic);
+        d.takePicture(l.gpa, pic);
         if (d.texture) |tex| {
             // Over what the frame already has under the place, as its draw would have gone: the
             // capture is clear where the place draws nothing — the window's base shows there — and
diff --git a/app/store/PluginLoader.zig b/app/store/PluginLoader.zig
index 09add5938..3361358be 100644
--- a/app/store/PluginLoader.zig
+++ b/app/store/PluginLoader.zig
@@ -179,13 +179,13 @@ fn lockOpenedPaths() void {
 /// once per plugin (~480ms for three plugins); loading the stable installed file in place pays
 /// it once, on the launch right after an install.
 ///
-/// Entries (and their duped keys) are intentionally kept for the process lifetime — the set is
+/// Entries (and their duped keys) are kept until the app quits (`deinitOpenedPaths`) — the set is
 /// bounded by the number of distinct plugin paths, and its whole purpose is to outlive
 /// individual load attempts.
-fn markPathOpened(path: []const u8) bool {
-    // Its own allocator, not a caller's: the set outlives every individual load attempt (and
-    // the probe helpers that also mark paths have no allocator to hand in).
-    const gpa = std.heap.page_allocator;
+///
+/// `gpa` owns the set's keys for that lifetime, so it is the application's long-lived allocator,
+/// never an arena or a per-call one.
+fn markPathOpened(gpa: std.mem.Allocator, path: []const u8) bool {
     lockOpenedPaths();
     defer opened_paths_lock.unlock();
     if (opened_paths.contains(path)) return true;
@@ -197,6 +197,17 @@ fn markPathOpened(path: []const u8) bool {
     return false;
 }
 
+/// Frees the opened-path set. At shutdown, with the allocator every caller of `markPathOpened`
+/// passed.
+pub fn deinitOpenedPaths(gpa: std.mem.Allocator) void {
+    lockOpenedPaths();
+    defer opened_paths_lock.unlock();
+    var keys = opened_paths.keyIterator();
+    while (keys.next()) |key| gpa.free(key.*);
+    opened_paths.deinit(gpa);
+    opened_paths = .empty;
+}
+
 /// `{dirname(path)}/.load-tmp` — where fresh-copy load attempts land, beside the plugin itself.
 fn loadTempDir(allocator: std.mem.Allocator, path: []const u8) ![]const u8 {
     const dir = std.fs.path.dirname(path) orelse ".";
@@ -376,7 +387,7 @@ pub fn open(allocator: std.mem.Allocator, path: []const u8, expected_id: []const
     //     re-uses across launches (so this costs nothing on a normal launch).
     //   * re-open of a path this process already opened → a unique throwaway copy, the only
     //     case where the loader's stale-image behavior is actually in play.
-    const reopen = markPathOpened(path);
+    const reopen = markPathOpened(allocator, path);
     const src_stat: ?std.Io.File.Stat = std.Io.Dir.cwd().statFile(dvui.io, path, .{}) catch null;
     const load_path: []const u8 = if (reopen)
         copyToFreshLoadPath(allocator, path) catch return error.DylibOpenFailed
@@ -524,10 +535,11 @@ fn allowAbiWarn() bool {
 /// Best-effort read of a plugin's user-facing display name straight from the dylib, **without
 /// registering it**. Prefers the embedded `plugin.zig.zon` (`fizzy_plugin_manifest_zon`); falls
 /// back to the `fizzy_plugin_name` export. Caller owns the returned slice.
+/// `allocator` also keeps the opened-path set (`markPathOpened`), so it is the long-lived one.
 pub fn probeName(allocator: std.mem.Allocator, path: []const u8) ?[]u8 {
     // Counts as an open for stale-image purposes: after this, a load of the same path must go
     // through `copyToFreshLoadPath` even if it is the first *load*.
-    _ = markPathOpened(path);
+    _ = markPathOpened(allocator, path);
     var lib = DynLib.open(path) catch return null;
     defer lib.close();
     if (lib.lookup(dylib_api.GetManifestZonFn, dylib_api.symbol_manifest_zon)) |get_zon| {
@@ -566,7 +578,7 @@ pub const ProbedManifest = struct {
 /// dylib or its manifest couldn't be read at all, which callers can distinguish from a
 /// successfully-read manifest whose fields happen to be empty.
 pub fn probeManifestInfo(allocator: std.mem.Allocator, path: []const u8) ?ProbedManifest {
-    _ = markPathOpened(path); // see `probeName`
+    _ = markPathOpened(allocator, path); // see `probeName`
     var lib = DynLib.open(path) catch return null;
     defer lib.close();
     const get_zon = lib.lookup(dylib_api.GetManifestZonFn, dylib_api.symbol_manifest_zon) orelse return null;
@@ -609,18 +621,18 @@ fn dupeTags(allocator: std.mem.Allocator, tags: []const []const u8) ![][]u8 {
 
 /// Best-effort read of version exports from a dylib (for failure diagnostics).
 /// Prefers semver from the embedded manifest zon when present.
-pub fn probeVersionInfo(path: []const u8) ?PluginVersionInfo {
-    _ = markPathOpened(path); // see `probeName`
+pub fn probeVersionInfo(gpa: std.mem.Allocator, path: []const u8) ?PluginVersionInfo {
+    _ = markPathOpened(gpa, path); // see `probeName`
     var lib = DynLib.open(path) catch return null;
     defer lib.close();
     var plugin_version = readVersionTriplet(lookupVersionFn(&lib, dylib_api.symbol_plugin_version));
     if (lib.lookup(dylib_api.GetManifestZonFn, dylib_api.symbol_manifest_zon)) |get_zon| {
         const zon = std.mem.span(get_zon());
         if (zon.len > 0) {
-            // A short-lived Manifest, in an arena over the page allocator.
-            var arena: std.heap.ArenaAllocator = .init(std.heap.page_allocator);
+            // A short-lived Manifest, in an arena over `gpa`.
+            var arena: std.heap.ArenaAllocator = .init(gpa);
             defer arena.deinit();
-            if (sdk.Manifest.parse(std.heap.page_allocator, arena.allocator(), zon)) |parsed| {
+            if (sdk.Manifest.parse(gpa, arena.allocator(), zon)) |parsed| {
                 if (std.SemanticVersion.parse(parsed.version)) |sv| {
                     plugin_version = .{ .major = @intCast(sv.major), .minor = @intCast(sv.minor), .patch = @intCast(sv.patch) };
                 } else |_| {}
@@ -635,8 +647,12 @@ pub fn probeVersionInfo(path: []const u8) ?PluginVersionInfo {
 }
 
 test "builtin plugin path joins exe_dir/plugins/<name>/<name>.<ext>" {
-    const path = try builtinPluginPath(std.testing.allocator, "/app", "pixi");
+    const joined = try builtinPluginPath(std.testing.allocator, "/app", "pixi");
+    defer std.testing.allocator.free(joined);
+    // `join` keeps `exe_dir` as given and separates the rest with the native separator.
+    const path = try std.testing.allocator.dupe(u8, joined);
     defer std.testing.allocator.free(path);
+    std.mem.replaceScalar(u8, path, std.fs.path.sep, '/');
     switch (builtin.target.os.tag) {
         .windows => try std.testing.expectEqualStrings("/app/plugins/pixi/pixi.dll", path),
         .macos => try std.testing.expectEqualStrings("/app/plugins/pixi/pixi.dylib", path),
diff --git a/app/store/PluginStore.zig b/app/store/PluginStore.zig
index 25c4a1583..593e2f959 100644
--- a/app/store/PluginStore.zig
+++ b/app/store/PluginStore.zig
@@ -424,7 +424,7 @@ fn probeOnDiskInfo() void {
             }
         }
         if (!have_version) {
-            if (PluginLoader.probeVersionInfo(path)) |info| {
+            if (PluginLoader.probeVersionInfo(a, path)) |info| {
                 rememberVersion(id, info.plugin_version);
             }
         }
diff --git a/app/update/bounded_join.zig b/app/update/bounded_join.zig
new file mode 100644
index 000000000..eeb91e5df
--- /dev/null
+++ b/app/update/bounded_join.zig
@@ -0,0 +1,51 @@
+//! Waiting for a thread at shutdown for only so long. std-only, so its test needs no window.
+
+const std = @import("std");
+
+/// Waits until `done` is set, up to `bound_ms`, then joins `thread`; past the bound, detaches it
+/// instead and returns false. The caller owns what the thread still touches: it must outlive
+/// the process or the thread must touch nothing torn down meanwhile.
+pub fn joinWithin(io: std.Io, thread: std.Thread, done: *const std.atomic.Value(bool), bound_ms: u32) bool {
+    var waited_ms: u32 = 0;
+    while (!done.load(.acquire)) : (waited_ms += poll_ms) {
+        if (waited_ms >= bound_ms) {
+            thread.detach();
+            return false;
+        }
+        io.sleep(.fromMilliseconds(poll_ms), .awake) catch {};
+    }
+    thread.join();
+    return true;
+}
+
+const poll_ms = 5;
+
+test "a stalled thread is detached once the bound passes" {
+    const Stall = struct {
+        var release: std.atomic.Value(bool) = .init(false);
+        var done: std.atomic.Value(bool) = .init(false);
+        fn run(io: std.Io) void {
+            while (!release.load(.acquire)) io.sleep(.fromMilliseconds(1), .awake) catch {};
+            done.store(true, .release);
+        }
+    };
+    const io = std.testing.io;
+    const thread = try std.Thread.spawn(.{}, Stall.run, .{io});
+    const start = std.Io.Clock.awake.now(io);
+    try std.testing.expect(!joinWithin(io, thread, &Stall.done, 50));
+    const elapsed = start.durationTo(std.Io.Clock.awake.now(io));
+    try std.testing.expect(elapsed.toMilliseconds() < 1000);
+    Stall.release.store(true, .release);
+    while (!Stall.done.load(.acquire)) io.sleep(.fromMilliseconds(1), .awake) catch {};
+}
+
+test "a finished thread is joined" {
+    const Quick = struct {
+        var done: std.atomic.Value(bool) = .init(false);
+        fn run() void {
+            done.store(true, .release);
+        }
+    };
+    const thread = try std.Thread.spawn(.{}, Quick.run, .{});
+    try std.testing.expect(joinWithin(std.testing.io, thread, &Quick.done, 1000));
+}
diff --git a/app/update/update_notify.zig b/app/update/update_notify.zig
index cf359d425..ec1fe1656 100644
--- a/app/update/update_notify.zig
+++ b/app/update/update_notify.zig
@@ -9,6 +9,7 @@ const core = @import("core");
 const auto_update = @import("auto_update.zig");
 const update_install = @import("update_install.zig");
 const move_offer = @import("move_offer.zig");
+const bounded_join = @import("bounded_join.zig");
 const restart = @import("../restart.zig");
 
 const Phase = enum(u8) {
@@ -94,16 +95,36 @@ fn startCheck() void {
         return;
     }
 
-    const thread = std.Thread.spawn(.{}, worker, .{io}) catch {
+    // The worker may outlive `deinit` (see there), so it cannot borrow the app's allocator.
+    check_thread = std.Thread.spawn(.{}, worker, .{ io, std.heap.page_allocator }) catch {
         phase.store(@backingInt(Phase.done_no), .release);
         return;
     };
-    thread.detach();
 }
 
-fn worker(io: std.Io) void {
+/// The launch check's thread, joined by `deinit`. Written on the GUI thread only. Builds without
+/// an updater (the web has no threads) never name `std.Thread`.
+var check_thread: if (auto_update.impl) ?std.Thread else void = if (auto_update.impl) null else {};
+
+/// Set by the check's thread as its last act.
+var check_done: std.atomic.Value(bool) = .init(false);
+
+/// How long quit waits on a check still in flight: Velopack's request blocks in C and cannot be
+/// cancelled, so past this the thread is detached and the process exit ends it.
+const quit_wait_ms = 250;
+
+/// Waits for the launch check, up to `quit_wait_ms`. The check's thread runs on its own allocator,
+/// so the one given to `setAllocator` may be torn down after this returns.
+pub fn deinit(io: std.Io) void {
+    if (comptime !auto_update.impl) return;
+    if (check_thread) |thread| _ = bounded_join.joinWithin(io, thread, &check_done, quit_wait_ms);
+    check_thread = null;
+}
+
+fn worker(io: std.Io, gpa: std.mem.Allocator) void {
+    defer check_done.store(true, .release);
     var ver_buf: [128]u8 = undefined;
-    const summary = auto_update.checkRemoteVersionSummary(io, std.heap.page_allocator, &ver_buf) catch {
+    const summary = auto_update.checkRemoteVersionSummary(io, gpa, &ver_buf) catch {
         phase.store(@backingInt(Phase.done_no), .release);
         return;
     };
diff --git a/backend/src/glass/BlurBackdrop.zig b/backend/src/glass/BlurBackdrop.zig
index 595ce6e9e..dd0da4114 100644
--- a/backend/src/glass/BlurBackdrop.zig
+++ b/backend/src/glass/BlurBackdrop.zig
@@ -1201,10 +1201,10 @@ test "marks past the span's room widen its last rect" {
     try std.testing.expectEqual(@as(u8, 8), span.len);
     try std.testing.expect(span.hits(.{ .x = 905, .y = 0, .w = 2, .h = 2 }));
 }
-
-/// What `frostPane` hands to the replay. Lives in the data store under the owner's id, so the
-/// pointer is good until the frame ends.
-const FrostJob = struct {
+/// What `frostPane` hands to the replay. Lives in the data store under the owner's id (`_frost_job`),
+/// so the pointer is good until the frame ends. `pub` for the tests that check which glass a
+/// surface asked for: `field` set is the program's, null the rounded rect's.
+pub const FrostJob = struct {
     backdrop: *BlurBackdrop = undefined,
     corners: dvui.CornerRect = .{},
     scale: f32 = 1,
diff --git a/backend/src/glass/LiquidField.zig b/backend/src/glass/LiquidField.zig
index 145c4fd41..42b0790b4 100644
--- a/backend/src/glass/LiquidField.zig
+++ b/backend/src/glass/LiquidField.zig
@@ -26,6 +26,7 @@
 //! Layers do not join each other: a dialog over a drop is two layers, the dialog's capture taken
 //! with the drop already on the frame.
 const std = @import("std");
+const builtin = @import("builtin");
 const dvui = @import("dvui");
 const programs = @import("programs.zig");
 const liquid_glass = @import("liquid_glass.zig");
@@ -371,8 +372,19 @@ fn applyLook(self: *const LiquidField, u: *Uniforms, l: glass_look.InApp) void {
     if (self.edge != null) u.shapes[max_shapes - 1][2][0] *= l.frost;
 }
 
+/// Test seam: the testing backend has no glass program, so `ready` is false there and every
+/// branch that turns on it goes unexercised. This makes `ready` answer `on` for the current
+/// window (the flag lives in its data, so each test window starts unset). Draws nothing.
+pub fn readyInTest(on: bool) void {
+    if (!builtin.is_test) @compileError("LiquidField.readyInTest is for tests");
+    dvui.dataSet(null, enabled_id, "_ready_in_test", on);
+}
+
 /// Whether `draw` would draw now: programs here, switched on, compiled.
 pub fn ready() bool {
+    if (builtin.is_test) {
+        if (dvui.dataGet(null, enabled_id, "_ready_in_test", bool)) |on| return on;
+    }
     if (!enabled()) return false;
     const h = programs.hooks() orelse return false;
     return program.ready(h) != null;
diff --git a/build.zig b/build.zig
index 60b6ac9fc..27fa52d9c 100644
--- a/build.zig
+++ b/build.zig
@@ -230,7 +230,9 @@ pub fn framework(fizzy_dep: *std.Build.Dependency, platform: Platform) Framework
 /// ```
 ///
 /// `linked` is everything the app links, in registration order (the order of the sidebar's
-/// views): fizzy's own (`fizzy.plugins`) and the app's. For an app's, `name` is the plugin's id
+/// views): fizzy's own (`fizzy.plugins`) and the app's, and nothing else is added. Until
+/// fizzyedit/plans#16 makes it optional the list must include `fizzy.plugins.workbench`; one
+/// without it, the empty list too, fails the build. For an app's, `name` is the plugin's id
 /// (its root's `plugin_id`) and `module` its static module, which the plugin package exports and
 /// which fizzy wires to `dvui`, `core`, `fizzy_sdk` and `icons`.
 pub fn buildApp(fizzy_dep: *std.Build.Dependency, linked: []const BundledPlugin) !void {
@@ -274,7 +276,7 @@ pub const App = struct {
 pub fn addApp(fizzy_dep: *std.Build.Dependency, linked: []const BundledPlugin) !App {
     const d = deferred orelse @panic("fizzy.addApp: pass `.@\"defer-app\" = true` to b.dependency(\"fizzy\", …) first");
     var opts = d.base;
-    opts.app_plugins = try withFizzys(fizzy_dep.builder, linked);
+    opts.app_plugins = linked;
     const built = try @import("build/app.zig").construct(
         fizzy_dep.builder,
         d.target,
@@ -294,14 +296,6 @@ pub fn addApp(fizzy_dep: *std.Build.Dependency, linked: []const BundledPlugin) !
     };
 }
 
-/// Until fizzyedit/example-app lists fizzy's plugins itself (its CI and fizzy's build each other's
-/// main): a list naming none of fizzy's gets all of them ahead of its own, as before. Goes in
-/// fizzyedit/plans#13 step 2.
-fn withFizzys(b: *std.Build, linked: []const BundledPlugin) ![]const BundledPlugin {
-    for (linked) |p| if (p.isFizzys()) return linked;
-    return std.mem.concat(b.allocator, BundledPlugin, &.{ &plugins.all, linked });
-}
-
 /// `zig build package` (and its alias `desktop`) and `zig build packageall` for an app built with
 /// `buildApp`, as steps of the app's own build `b`: a dependency's steps are not the command
 /// line's. `package` packages the app for the target the app gave fizzy, into the app's
diff --git a/build/app.zig b/build/app.zig
index 82552bb8a..34cf3b592 100644
--- a/build/app.zig
+++ b/build/app.zig
@@ -1076,6 +1076,8 @@ fn addTests(
         // /Applications, and what happens to the copy it leaves. std-only (see
         // install_location.zig); `macos_bundle.zig` asks the system and acts on it.
         .{ "fizzy-install-location-tests", "app/update/install_location.zig" },
+        // Quit's bounded wait on the launch update check's thread. std-only (see bounded_join.zig).
+        .{ "fizzy-bounded-join-tests", "app/update/bounded_join.zig" },
         // The command palette's recently used commands: order, re-use, the cap. std-only
         // (see RecentCommands.zig); `Recents` holds it and stores it in recents.zon.
         .{ "fizzy-recent-commands-tests", "app/RecentCommands.zig" },
diff --git a/build/plugins.zig b/build/plugins.zig
index 2d6c6d219..1a2e5cdb0 100644
--- a/build/plugins.zig
+++ b/build/plugins.zig
@@ -75,11 +75,11 @@ pub const Linked = struct {
 
 /// Make the modules for `plugins`: fizzy's own built for this executable, an application's
 /// re-homed onto it. workbench must be listed, because the editor still holds its state
-/// (fizzyedit/plans#13).
+/// (fizzyedit/plans#16).
 pub fn link(b: *std.Build, w: Wiring, plugins: []const BundledPlugin) Linked {
     if (!linksFizzys(plugins, "workbench")) std.debug.panic(
         "fizzy: the plugin list must include `fizzy.plugins.workbench`; the editor " ++
-            "still holds its state (fizzyedit/plans#13)",
+            "still holds its state (fizzyedit/plans#16)",
         .{},
     );
 
diff --git a/build/sdk.zig b/build/sdk.zig
index 40e333e70..e40bdee49 100644
--- a/build/sdk.zig
+++ b/build/sdk.zig
@@ -177,13 +177,6 @@ pub const BundledPlugin = struct {
         module: ?*std.Build.Module = null,
     };
 
-    /// One of fizzy's own: no module for any executable.
-    pub fn isFizzys(self: BundledPlugin) bool {
-        if (self.module != null) return false;
-        for (self.targets orelse &.{}) |t| if (t.module != null) return false;
-        return true;
-    }
-
     /// The entry as `platform`'s executables link it, or null if they do not.
     pub fn forPlatform(self: BundledPlugin, platform: Platform) ?BundledPlugin {
         const targets = self.targets orelse return self;
diff --git a/core/FileTable.zig b/core/FileTable.zig
index 41a39ce8c..01a58d2c3 100644
--- a/core/FileTable.zig
+++ b/core/FileTable.zig
@@ -25,8 +25,9 @@
 //! path, or whichever mount claims the path's prefix (`gdrive://<account>`). A cloud plugin
 //! registers a mount through `Host.mount`; nothing here knows what is behind it. The one thing
 //! a mount changes is *when* an answer arrives: `vfs.Fs` completes asynchronously, so a miss on
-//! a cloud directory returns null this frame and the listing appears (with `env.refresh`) when
-//! the response lands. The local mount answers inside the same call, exactly as before.
+//! a directory returns null this frame and the listing appears (with `env.refresh`) when the
+//! response lands. The local mount's listings run on the `Io` pool too: a small folder is waited
+//! for briefly and answered in the same call, a large one is pending like a cloud one.
 const std = @import("std");
 const fuzzy = @import("fuzzy.zig");
 const vfs = @import("vfs/vfs.zig");
diff --git a/core/LocalFs.zig b/core/LocalFs.zig
index 4d459431b..9d1d5e9c8 100644
--- a/core/LocalFs.zig
+++ b/core/LocalFs.zig
@@ -1,18 +1,21 @@
 //! The local disk as a `vfs.Fs`, so `FileTable` has exactly one read path whether a directory
 //! lives on this machine or on a cloud mount.
 //!
-//! Paths are the OS's own absolute paths — the local mount has no prefix to strip. Every op
-//! but a read runs to completion inside its start call (the disk is synchronous here, as it
-//! always was) and the result is parked until `pump`, which is the `vfs.Fs` contract.
-//! `FileTable` pumps the mount it just asked right away, so a local listing still comes back
-//! in the same call that requested it and nothing above notices a difference.
+//! Paths are the OS's own absolute paths — the local mount has no prefix to strip. A read and a
+//! listing run on the `Io`'s pool, so their start call returns a job before the disk has been
+//! touched and the result is delivered by `pump`, which is the `vfs.Fs` contract; a caller must
+//! treat a listing as pending (`FileTable.listDir` returns null) until a later `pump` lands it, and
+//! rely on `wake` rather than assume the same call completes; `FileTable` only waits a moment
+//! (`inline_wait_ns`) so a small folder still answers at once. The other ops run to completion
+//! inside their start call and park the result until `pump`.
 //!
 //! A read and a listing are the ops worth overlapping: a cold index of a large vault is hundreds
 //! of thousands of small files, each ~120 µs of waiting when nothing else is in flight, and one
 //! folder of that many notes is seconds of directory reads that a frame must not wait for.
 //! `readFile` and `listDir` go through `io.concurrent`, which the host's threaded `Io` runs on its
 //! pool and a single-threaded `Io` (tests, or a saturated pool) runs inline — one implementation,
-//! and the caller that issues a window of them and pumps gets the overlap where it exists.
+//! and the caller that issues a window of them and pumps gets the overlap where it exists. Only
+//! on the inline path has the result landed by the time the start call returns.
 const std = @import("std");
 const builtin = @import("builtin");
 const vfs = @import("vfs/vfs.zig");
@@ -27,7 +30,7 @@ const no_disk = builtin.target.cpu.arch == .wasm32;
 gpa: std.mem.Allocator,
 io: std.Io,
 ready: vfs.http.Completions(Completion),
-/// Reads in flight on `io.async`, by job id. Guarded by `lock`; the futures themselves are
+/// Reads in flight on `io.concurrent`, by job id. Guarded by `lock`; the futures themselves are
 /// awaited from `pump` only once their task has set `done`.
 reads: std.AutoArrayHashMapUnmanaged(u64, *ReadJob) = .empty,
 /// Listings in flight on `io.concurrent`, by job id; guarded by `lock` like `reads`.
diff --git a/core/dialogs.zig b/core/dialogs.zig
index 84350b479..5baf5ea77 100644
--- a/core/dialogs.zig
+++ b/core/dialogs.zig
@@ -899,8 +899,7 @@ pub fn closeFloatingDialogAnchored() void {
     dvui.dataSet(null, sub.id, "_close_rect", close_rect);
 }
 
-// lint-allow(anyerror): this is `dvui.Dialog.DisplayFn`, dvui's own type, which a dialog window must match.
-pub fn dialogWindow(id: dvui.Id) anyerror!void {
+pub fn dialogWindow(id: dvui.Id) !void {
     // Shown after dvui has stopped capturing the frame: in one an agent is taking a snapshot of,
     // the dialog captures itself (`replay.Snapshot.scopeBegin`).
     const scoped = Snapshot.scopeBegin();
@@ -1944,3 +1943,8 @@ test "a dialog's failure is one of Error, and only an allocation failure keeps i
     try std.testing.expectEqualStrings("failed", why);
     try std.testing.expectEqual(@as(Error, error.OutOfMemory), failed("test", error.OutOfMemory));
 }
+
+test "the dialog window handles callback errors without propagating them" {
+    const display: *const fn (dvui.Id) error{}!void = dialogWindow;
+    _ = display;
+}
diff --git a/core/form_factor.zig b/core/form_factor.zig
index 33958528a..f21235431 100644
--- a/core/form_factor.zig
+++ b/core/form_factor.zig
@@ -53,19 +53,19 @@ pub fn effective(detected: FormFactor, mode: LayoutMode, override: ?FormFactor)
 }
 
 test "effective covers every detected form, mode and override" {
-    const overrides = [_]?FormFactor{ null, .desktop, .tablet, .mobile };
-    for (std.enums.values(FormFactor)) |detected| {
-        for (std.enums.values(LayoutMode)) |mode| {
-            for (overrides) |override| {
-                const want: FormFactor = if (override) |o| o else switch (mode) {
-                    .auto => detected,
-                    .mobile => .mobile,
-                    .desktop => .desktop,
-                };
-                try std.testing.expectEqual(want, effective(detected, mode, override));
-            }
-        }
-    }
+    const D = FormFactor.desktop;
+    const T = FormFactor.tablet;
+    const M = FormFactor.mobile;
+    // detected, mode, override, expected
+    const cases = [_]struct { FormFactor, LayoutMode, ?FormFactor, FormFactor }{
+        .{ D, .auto, null, D },    .{ T, .auto, null, T },    .{ M, .auto, null, M },
+        .{ D, .mobile, null, M },  .{ T, .mobile, null, M },  .{ M, .mobile, null, M },
+        .{ D, .desktop, null, D }, .{ T, .desktop, null, D }, .{ M, .desktop, null, D },
+        .{ D, .auto, T, T },       .{ M, .auto, D, D },       .{ T, .auto, M, M },
+        .{ D, .mobile, D, D },     .{ M, .mobile, T, T },     .{ T, .mobile, M, M },
+        .{ D, .desktop, M, M },    .{ M, .desktop, T, T },    .{ T, .desktop, D, D },
+    };
+    for (cases) |c| try std.testing.expectEqual(c[3], effective(c[0], c[1], c[2]));
 }
 
 test "a mode forces mobile or desktop on any device, and auto keeps a tablet a tablet" {
diff --git a/docs/AGENT_WORK.md b/docs/AGENT_WORK.md
index 12048502c..50453fea1 100644
--- a/docs/AGENT_WORK.md
+++ b/docs/AGENT_WORK.md
@@ -146,6 +146,16 @@ Both helpers exit non-zero and print a one-line reason on failure. A failed prep
 its workspace for inspection; a failed finish can leave a published branch if GitHub refused
 PR creation. Fix the reported problem and retry finish. Neither helper merges or marks ready.
 
+## Where verification happens
+
+Three places, in order: the worker's **local gates** (step 3), which decide whether the PR is
+worth pushing; **cross-review** by a different worker; and **CI at ready**. A draft PR runs only
+the light `changes` job (`ci.yml`), so pushing to a draft costs almost nothing and proves nothing;
+`gh pr ready` starts the full matrix, and `ci-ok` is the required check on that run. A reviewer
+waits for finished checks, so a draft is reviewed from its diff and the gate output in its body,
+and a cross-reviewer may give a verdict on a draft without CI. The merge question waits for the
+full CI at ready.
+
 ## Review
 
 The stages and markers above are the review. Reviewer and author both answer the four questions
@@ -153,6 +163,7 @@ in [`REVIEW.md`](REVIEW.md). A worker working an issue leaves its PR draft and n
 marking it ready (once the gates pass and CI is green), the merge and the `pm:approve` yes are the
 maintainer's. `CONTRIBUTING.md`'s "take it to ready yourself" is for a person's own session, not
 for a worker on this contract.
+A draft's CI is only the light `changes` job, so the full CI runs at ready and must be green before the merge question.
 
 ## Which worker suits which work
 
diff --git a/docs/DEPENDENCIES.md b/docs/DEPENDENCIES.md
index 17942b919..7836bba99 100644
--- a/docs/DEPENDENCIES.md
+++ b/docs/DEPENDENCIES.md
@@ -219,6 +219,9 @@ the patch changes it too, and nothing dvui's own web backend uses is taken away
 - `0007` **Precise render targets** (`dvui.Backend.support_precise_targets`), with `web.zig`'s.
 - `0008` **`wasm_renderStream`**, a flush's draws in one call: what `WebBackend.flushBatch` sends.
 - `0009` **Custom fragment programs in the draw stream** (`core.gfx.programs`).
+- `0010` **A keyboard's correction replaces the typed word** (`TextInput`): the hidden input holds the
+  word before the caret, and a replacement or recomposition becomes backspaces and the new text.
+  Test: `scripts/test-web-text-input.sh` (needs node, or jsc on macOS).
 
 The patches are the commits of a dvui checkout's branch, from the pinned commit. To change one,
 or to carry them to a new dvui pin: rebase the branch (`git rebase <new pin>`), fix what
diff --git a/docs/HELLO_NUMBERS.md b/docs/HELLO_NUMBERS.md
index 1184a5847..911f6ca04 100644
--- a/docs/HELLO_NUMBERS.md
+++ b/docs/HELLO_NUMBERS.md
@@ -1,9 +1,10 @@
 # Minimal app measurements
 
-[`hello-numbers.yml`](../.github/workflows/hello-numbers.yml) runs on every push to main and on manual
-dispatch, never on pull requests (two release builds and a package on two OSes is too much load
-for each one). `python3 scripts/test-hello-numbers.py` and the `--sizes-only` mode are the checks
-a pull request runs itself. Each macOS/Linux artifact contains
+[`hello-numbers.yml`](../.github/workflows/hello-numbers.yml) runs on every push to main, on manual
+dispatch, and on a pull request that touches the harness (its script, tests, workflow, this doc or
+`src/Entry.zig`'s marker); other pull requests skip it, since two release builds and a package on
+two OSes is too much load for each one. CI's `python3 scripts/test-hello-numbers.py` step and the
+`--sizes-only` mode are the checks every pull request runs itself. Each macOS/Linux artifact contains
 `hello-numbers.jsonl`: one complete JSON object for each ReleaseFast/ReleaseSmall run.
 Download both artifacts from the [workflow runs](https://github.com/fizzyedit/fizzy/actions/workflows/hello-numbers.yml).
 A failed measurement fails the job; a partial artifact may contain only the first mode.
@@ -21,7 +22,7 @@ Scratch sources and build outputs are deleted even on failure.
 On a machine where opening a window is acceptable (not a window-free worker session):
 
 ```sh
-scripts/hello-numbers.sh --output "$PWD/hello-numbers.jsonl" \
+python3 scripts/hello-numbers.py --output "$PWD/hello-numbers.jsonl" \
   --revision '<fizzy commit; add dirty if edited>' fizzy \
   --example ../example-app --example-revision '<example-app commit>' \
   --plugin ../example-plugin --plugin-revision '<example-plugin commit>'
@@ -37,7 +38,7 @@ runner image, compiler version, all three source revisions and executable SHA-25
 | --- | --- |
 | `binary_bytes` | Installed `minimalapp`, after host `strip` (and ad-hoc signing on macOS). Excludes resources and plugin libraries. Packaging may link a separate executable with Velopack support. |
 | `installer_bytes` | Unsigned macOS `.pkg` or Linux `.AppImage` from the `package` output; includes packaged resources/libraries. A missing or ambiguous installer fails. |
-| `first_frame_ms` | `core.profile`'s `main` to `first frame` phase at the end of the first `AppFrame`. Excludes loader work before Zig main; GPU submission, display presentation and window reveal may follow. |
+| `first_frame_ms` | Process spawn to the 10 ms poll that saw the stderr marker `reportFirstFrame` prints at the end of the first `AppFrame`, the clock the peers use. Includes loader work before Zig main; GPU submission, display presentation and window reveal may follow. `first_frame_after_main_ms` is `core.profile`'s `main` to `first frame` phase, the app's own clock. |
 | `idle_rss_bytes` | Sum of `ps` RSS (KiB x 1024) for the process and descendants, sampled 30 seconds after spawn. Shared pages may be counted more than once. |
 | `wasm_gzip_bytes` | Installed `web.wasm`, gzip with mtime zero, default compression level 9. Excludes JS, fonts and runtime plugin downloads. |
 
@@ -50,7 +51,7 @@ terminated after the sample; a missing first-frame marker or an early exit fails
 
 ## Electron and Tauri comparison (manual only)
 
-`scripts/compare-hello.sh` measures already-built stock hello-world applications on the **same
+`python3 scripts/hello-numbers.py compare` measures already-built stock hello-world applications on the **same
 machine**, outside CI. Keep framework templates at their defaults, use production packaging,
 and record template/source revision and exact framework version. Do not use a development
 server or attach developer tools. Supply the executable inside the packaged app and its actual
@@ -64,7 +65,9 @@ For Electron, relay an IPC message from the renderer to `console.log` in the mai
 for Tauri, invoke a Rust command that uses `println!`. A webview console message alone does
 not reach the harness. Keep this instrumentation in the recorded source revision. Startup is
 measured externally from spawn to observing stdout (10 ms polling), so it includes loader/IPC
-work and is **not directly equivalent** to Fizzy's internal main-to-first-frame clock.
+work. Fizzy's `first_frame_ms` is measured the same way (spawn to the poll that saw its stderr
+marker), so the two compare; its own main-to-first-frame clock is kept beside it as
+`first_frame_after_main_ms`.
 
 Configure each application to put all user data under the `HELLO_PROFILE` environment variable
 before creating its window (Electron: `app.setPath('userData', ...)`; Tauri: configure the
@@ -73,10 +76,10 @@ The harness includes descendant RSS so Electron's renderer and GPU helpers count
 use OS webview services outside its process tree; disclose that limitation with the results.
 
 ```sh
-scripts/compare-hello.sh --output "$PWD/peers.jsonl" --revision '<instrumented source commit>' \
+python3 scripts/hello-numbers.py --output "$PWD/peers.jsonl" --revision '<instrumented source commit>' \
   compare --app electron --framework-version '<version>' \
   --binary '/path/to/Hello.app/Contents/MacOS/Hello' --installer '/path/to/Hello.dmg'
-scripts/compare-hello.sh --output "$PWD/peers.jsonl" --revision '<instrumented source commit>' \
+python3 scripts/hello-numbers.py --output "$PWD/peers.jsonl" --revision '<instrumented source commit>' \
   compare --app tauri --framework-version '<version>' \
   --binary '/path/to/hello' --installer '/path/to/hello.AppImage'
 ```
diff --git a/scripts/agent-finish b/scripts/agent-finish
index 244957631..8b0a10d8d 100755
--- a/scripts/agent-finish
+++ b/scripts/agent-finish
@@ -67,7 +67,7 @@ reason='could not write the pull request summary'
 if [[ -f $summary_file ]]; then
     cat "$summary_file" >"$tmp/summary"
 elif grep -qxF "$marker" <<<"$pr_body"; then
-    awk -v m="$marker" '$0 == m { exit } NR == 1 && /^Part of / { next } !started && /^$/ { next } { started = 1; print }' <<<"$pr_body" >"$tmp/summary"
+    awk -v m="$marker" '$0 == m { exit } !started && (/^Part of / || /^Rework: / || /^$/) { next } { started = 1; print }' <<<"$pr_body" >"$tmp/summary"
 elif $claim; then
     printf "$headings\n" '' '' '' 'Draft: work in progress' >"$tmp/summary"
 else
@@ -118,8 +118,15 @@ else
     done
     gates_label="$gates_passed of $gates_total passed"
 fi
+# A rework run on an existing PR keeps the PR's own work issue: its running: lock and
+# close-merged find the PR by that line.
+part_of=$(grep -m1 -E '^Part of fizzyedit/work#[1-9][0-9]*$' <<<"$pr_body" || true)
 {
-    printf 'Part of fizzyedit/work#%s\n\n' "$issue"
+    if [[ -n $part_of && $part_of != "Part of fizzyedit/work#$issue" ]]; then
+        printf '%s\nRework: work#%s\n\n' "$part_of" "$issue"
+    else
+        printf 'Part of fizzyedit/work#%s\n\n' "$issue"
+    fi
     sed -e :a -e '/^\n*$/{$d;N;ba' -e '}' "$tmp/summary"
     printf '\n\n%s\n\n<details><summary>Changes (%s)</summary>\n\n```text\n' "$marker" "$changes"
     head -n 100 "$tmp/stat"
diff --git a/scripts/check-examples.sh b/scripts/check-examples.sh
index 85dfed391..f866248e8 100755
--- a/scripts/check-examples.sh
+++ b/scripts/check-examples.sh
@@ -7,6 +7,9 @@
 # dependency does. A path dependency (or `zig build --fork`) would see the whole checkout and
 # miss a file left out of `.paths`.
 #
+# tests/fixtures/app-only is an app listing only a plugin of its own, which must fail to build
+# naming `fizzy.plugins.workbench` (the list is the list, and workbench is required for now).
+#
 # example-app gets the whole repo (its shapes, and its dvui app on either backend), and for its
 # replay app the plugin SDK; example-plugin gets the plugin SDK. The SDK is packed as a release
 # would be (`scripts/pack-sdk.sh`).
@@ -124,6 +127,23 @@ if [[ -n $builds ]]; then
   printf '%s\n' $builds | xargs -P "${EXAMPLES_JOBS:-3}" -n 1 bash -c 'build_one "$1"' _
 fi
 
+# An app's list is exact: one naming none of fizzy's, workbench included, fails while build.zig
+# configures, which compiles nothing. The build must fail and say which plugin is missing.
+echo "== app-only fixture, expected to fail naming fizzy.plugins.workbench"
+mkdir -p "$work/app-only"
+pack "$root/tests/fixtures/app-only" | tar -x -C "$work/app-only"
+(cd "$work/app-only" && zig fetch --save=fizzy "$work/fizzy.tar.gz" >/dev/null)
+if (cd "$work/app-only" && zig build --prefix "$work/out/app-only") > "$work/log-app-only.txt" 2>&1; then
+  echo "FAIL  app-only: built, but an app without fizzy.plugins.workbench must not"
+  exit 1
+fi
+if ! grep -q 'fizzy\.plugins\.workbench' "$work/log-app-only.txt"; then
+  echo "FAIL  app-only: failed without naming fizzy.plugins.workbench"
+  sed 's/^/      /' "$work/log-app-only.txt"
+  exit 1
+fi
+echo "ok    app-only (failed as expected)"
+
 # The build API an app and a plugin package call (`fizzy.framework`, `staticModule`, `addApp`,
 # `addWebSteps`, `addPackageSteps`; design/build-api.md), on a fixture app of its own: two plugin
 # packages, one for both kinds of executable and one `.native` only, which fails to compile if it
diff --git a/scripts/compare-hello.sh b/scripts/compare-hello.sh
deleted file mode 100755
index 85ec85dfa..000000000
--- a/scripts/compare-hello.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-# Measure a stock Electron/Tauri hello app; opt-in, never called by CI.
-# See docs/HELLO_NUMBERS.md for the first-frame marker and fresh-profile contract.
-set -euo pipefail
-exec python3 "$(dirname "$0")/hello-numbers.py" "$@"
diff --git a/scripts/hello-numbers.py b/scripts/hello-numbers.py
index bab580983..a02cb6555 100755
--- a/scripts/hello-numbers.py
+++ b/scripts/hello-numbers.py
@@ -103,25 +103,28 @@ def measure(command, log, env, peer=False, idle_seconds=30):
                                    env=env, start_new_session=True)
         try:
             first_frame_ms = None
+            after_main_ms = None
             while time.monotonic() - started < idle_seconds:
                 if process.poll() is not None:
                     raise RuntimeError(f'app exited ({process.returncode}): {log.read_text()}')
                 if first_frame_ms is None:
                     content = log.read_text()
-                    if peer:
-                        if 'HELLO_FIRST_FRAME' in content:
-                            first_frame_ms = (time.monotonic() - started) * 1000
-                    else:
-                        match = FIRST_FRAME.search(content)
+                    # One clock for every app: spawn to the poll that saw the marker.
+                    match = None if peer else FIRST_FRAME.search(content)
+                    if match or (peer and 'HELLO_FIRST_FRAME' in content):
+                        first_frame_ms = (time.monotonic() - started) * 1000
                         if match:
-                            first_frame_ms = float(match[1])
+                            after_main_ms = float(match[1])
                 time.sleep(min(0.01, max(0, idle_seconds - (time.monotonic() - started))))
             sample_at = time.monotonic() - started
             if first_frame_ms is None:
                 raise RuntimeError(f'first-frame marker missing: {log.read_text()}')
             rss = rss_bytes(process.pid)
-            return {'first_frame_ms': first_frame_ms, 'idle_rss_bytes': rss,
-                    'rss_sample_after_s': sample_at, 'rss_scope': 'process_tree'}
+            result = {'first_frame_ms': first_frame_ms, 'idle_rss_bytes': rss,
+                      'rss_sample_after_s': sample_at, 'rss_scope': 'process_tree'}
+            if after_main_ms is not None:
+                result['first_frame_after_main_ms'] = after_main_ms
+            return result
         finally:
             # A peer may spawn helpers; tear down the entire private process group.
             for sig in (signal.SIGTERM, signal.SIGKILL):
@@ -189,7 +192,7 @@ def benchmark(args):
                            'binary_bytes': binary.stat().st_size, 'installer_bytes': installer.stat().st_size,
                            'installer_format': installer.suffix, 'wasm_gzip_bytes': len(gzip.compress(wasm.read_bytes(), compresslevel=9, mtime=0)),
                            'binary_sha256': hashlib.sha256(binary.read_bytes()).hexdigest(),
-                           'first_frame_source': 'core.profile main -> first frame'})
+                           'first_frame_source': 'process spawn -> stderr startup marker (10 ms polling)'})
             env = dict(os.environ, FIZZY_PROFILE=str(work / f'profile-{mode}'), FIZZY_QUIET='1',
                        FIZZY_STARTUP_REPORT='1')
             if not args.sizes_only:
diff --git a/scripts/hello-numbers.sh b/scripts/hello-numbers.sh
deleted file mode 100755
index 24718eac2..000000000
--- a/scripts/hello-numbers.sh
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/usr/bin/env bash
-# Build and measure example-app minimal. See docs/HELLO_NUMBERS.md for the protocol.
-set -euo pipefail
-exec python3 "$(dirname "$0")/hello-numbers.py" "$@"
diff --git a/scripts/test-agent-work.sh b/scripts/test-agent-work.sh
index ecfc6d019..e95eff8f2 100755
--- a/scripts/test-agent-work.sh
+++ b/scripts/test-agent-work.sh
@@ -36,6 +36,7 @@ cat >"$tmp/bin/gh" <<'FAKE'
 set -e
 printf '%s\n' "$*" >>"$AGENT_TEST_DIR/calls"
 if [[ $1 == pr && $2 == list && ${AGENT_TEST_EXISTING:-} == 1 ]]; then echo 12; fi
+if [[ $1 == pr && $2 == view && -n ${AGENT_TEST_BODY:-} ]]; then printf '%s\n' "$AGENT_TEST_BODY"; fi
 if [[ $1 == pr && ( $2 == create || $2 == edit ) ]]; then
     while [[ $# -gt 0 ]]; do
         if [[ $1 == --body-file ]]; then cp "$2" "$AGENT_TEST_DIR/body"; break; fi
@@ -134,6 +135,17 @@ AGENT_TEST_GIT=1 "$finish" --claim 42 >"$tmp/output"
 ! grep -q 'allow-empty' "$tmp/calls" || fail 'empty commit despite commits ahead'
 AGENT_TEST_EXISTING=1 "$finish" 42 >"$tmp/output"
 grep -q 'pr edit 12 --body-file' "$tmp/calls" || fail 'existing PR refresh'
+# A rework run keeps the PR's own work issue; a fresh PR takes the issue being worked.
+AGENT_TEST_EXISTING=1 AGENT_TEST_BODY=$'Part of fizzyedit/work#7\n\n## Goal\n\nold' "$finish" 99 >"$tmp/output"
+[[ $(head -n 1 "$tmp/body") == 'Part of fizzyedit/work#7' ]] || fail 'rework replaced Part of line'
+grep -qx 'Rework: work#99' "$tmp/body" || fail 'rework line missing'
+! grep -q 'Part of fizzyedit/work#99' "$tmp/body" || fail 'rework issue became Part of'
+AGENT_TEST_EXISTING=1 AGENT_TEST_BODY=$'Part of fizzyedit/work#7\nRework: work#5\n\nsummary\n\n<!-- agent-finish: generated below -->' "$finish" 99 >"$tmp/output"
+[[ $(grep -c '^Rework:' "$tmp/body") == 1 ]] || fail 'old rework line carried into summary'
+AGENT_TEST_EXISTING=1 AGENT_TEST_BODY=$'Part of fizzyedit/work#42\n\nx' "$finish" 42 >"$tmp/output"
+! grep -q '^Rework:' "$tmp/body" || fail 'rework line on a same-issue run'
+AGENT_TEST_EXISTING=1 "$finish" 42 >"$tmp/output"
+grep -q '^Part of fizzyedit/work#42$' "$tmp/body" || fail 'fresh PR issue line'
 cat >"$tmp/bin/uname" <<'FAKE'
 #!/usr/bin/env bash
 echo Linux
diff --git a/scripts/test-hello-numbers.py b/scripts/test-hello-numbers.py
index 99635b637..91a484959 100644
--- a/scripts/test-hello-numbers.py
+++ b/scripts/test-hello-numbers.py
@@ -39,7 +39,9 @@ def test_first_frame_and_rss(self, _rss):
             command = [sys.executable, '-u', '-c',
                        'import time; print("info: startup: first frame 12.375 ms after main"); time.sleep(10)']
             record = hello.measure(command, Path(temporary) / 'log', os.environ, idle_seconds=2)
-            self.assertEqual(record['first_frame_ms'], 12.375)
+            self.assertEqual(record['first_frame_after_main_ms'], 12.375)
+            # Spawn to observation, the clock the peers use, so it is never below the app's own.
+            self.assertGreater(record['first_frame_ms'], 0)
             self.assertGreater(record['idle_rss_bytes'], 0)
             self.assertGreaterEqual(record['rss_sample_after_s'], 2)
             output = Path(temporary) / 'numbers.jsonl'
diff --git a/scripts/test-web-text-input.sh b/scripts/test-web-text-input.sh
new file mode 100755
index 000000000..632417c10
--- /dev/null
+++ b/scripts/test-web-text-input.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+# The hidden input's tests (web/tests/text-input.test.js) against the web.js the web build
+# writes: `zig build web` first. Needs node, or jsc on macOS.
+set -eu
+cd "$(dirname "$0")/.."
+js=zig-out/web/web.js
+[ -f "$js" ] || { echo "test-web-text-input: no $js; run zig build web" >&2; exit 1; }
+if command -v node >/dev/null; then
+    exec node web/tests/text-input.test.js "$PWD/$js"
+fi
+jsc=/System/Library/Frameworks/JavaScriptCore.framework/Versions/Current/Helpers/jsc
+[ -x "$jsc" ] || { echo "test-web-text-input: needs node (or macOS's jsc)" >&2; exit 1; }
+exec "$jsc" -m web/tests/text-input.test.js -- "$PWD/$js"
diff --git a/src/Entry.zig b/src/Entry.zig
index 08ecdf247..2df3ebd29 100644
--- a/src/Entry.zig
+++ b/src/Entry.zig
@@ -438,7 +438,10 @@ fn reportFirstFrame() void {
     const raw = std.c.getenv("FIZZY_STARTUP_REPORT") orelse return;
     if (std.mem.eql(u8, std.mem.span(raw), "0")) return;
     const ph = fizzy.core.profile.phases() orelse return;
-    std.debug.print("startup: first frame {d:.3} ms after main\n", .{ph.ms(ph.len - 1)});
+    var buf: [64]u8 = undefined;
+    var err = std.Io.File.stderr().writer(dvui.io, &buf);
+    err.interface.print("startup: first frame {d:.3} ms after main\n", .{ph.ms(ph.len - 1)}) catch return;
+    err.interface.flush() catch return;
 }
 
 /// Where the window's reveal is (`revealOnceDrawn`): drawing its first frame, then seen.
@@ -487,6 +490,8 @@ pub fn AppDeinit(_: *dvui.Window) void {
     // `editor.deinit` runs each plugin's `deinit` first (pixi's persists its `.fizproject` and
     // frees its own state + packer while `editor.app.host`/folder are still live).
     fizzy.editor().deinit() catch unreachable;
+    // A check still in flight is given a moment, then left to the process exit.
+    update_notify.deinit(dvui.io);
     // Tear down the singleton listener after the editor so any callback
     // currently in flight finishes before we free state it touches.
     singleton.deinit();
diff --git a/src/backend/layout_file.zig b/src/backend/layout_file.zig
index 130a34747..5ac1e9dc9 100644
--- a/src/backend/layout_file.zig
+++ b/src/backend/layout_file.zig
@@ -44,6 +44,9 @@ pub const SavedRegion = struct {
     /// That split is fizzy's own, not the person's (`Branch.adaptive`): it follows its space's
     /// shape and turns with it. Absent is the person's, as every split of an older file is.
     adaptive: ?bool = null,
+    /// An adaptive split's new half as a share of its box (`Branch.share`), kept so a restart in
+    /// a box of another shape comes back to the same proportion. Absent: not sized yet.
+    share: ?f32 = null,
     /// What a fizzy before tabs-when-many wrote: whether the place showed one view or several.
     /// Read only to migrate (`loadRegions`), never written: a place now shows tabs exactly when
     /// it holds more than one view.
diff --git a/src/editor/Editor.zig b/src/editor/Editor.zig
index 1ec8baeeb..2c99793ad 100644
--- a/src/editor/Editor.zig
+++ b/src/editor/Editor.zig
@@ -494,8 +494,6 @@ pub fn init(
         }
     }
 
-    // Save-queue worker is owned by the pixel-art plugin (`initPlugin` in `postInit`).
-
     { // Setup themes
         var fizzy_dark = dvui.themeGet();
         fizzy_dark.embedded_fonts = embedded_fonts;
@@ -843,7 +841,7 @@ pub fn loadUserPlugins(editor: *Editor, config_folder: []const u8) void {
                 dvui.log.info("user plugin '{s}': already loaded as a built-in; skipped", .{plugin_id});
             } else {
                 dvui.log.err("user plugin '{s}': id already registered by a built-in; skipped", .{plugin_id});
-                const probe = PluginLoader.probeVersionInfo(path);
+                const probe = PluginLoader.probeVersionInfo(editor.app.gpa, path);
                 editor.app.recordPluginFailure(plugin_id, "id already registered by a built-in plugin", null, if (probe) |info| info.plugin_version else null, .of(path));
             }
             editor.app.gpa.free(path);
@@ -937,8 +935,8 @@ fn unloadPluginLibs(editor: *Editor) void {
 
 // ---- runtime plugin lifecycle (store: install / enable / disable / update) ---------
 //
-// Only dylib-loaded *user* plugins are managed here. Bundled built-ins (pixi/workbench/
-// code) ship in the app and are never unloaded, even though they also appear in
+// Only dylib-loaded *user* plugins are managed here. Bundled built-ins (workbench,
+// text, …) ship in the app and are never unloaded, even though they also appear in
 // `loaded_plugin_libs` when loaded from their bundled dylibs.
 
 /// True when `id` names one of the bundled built-ins (ships in the app, must never be
@@ -5186,6 +5184,7 @@ pub fn collectSavedRegions(editor: *Editor, gpa: std.mem.Allocator) []fizzy.back
             gop.value_ptr.parent = l.parent;
             gop.value_ptr.from = @tagName(l.side);
             gop.value_ptr.adaptive = if (l.adaptive) true else null;
+            gop.value_ptr.share = l.share;
         }
     }
     {
@@ -5285,7 +5284,10 @@ fn loadRuntimeSplits(state: *Layout.State, gpa: std.mem.Allocator, saved: []cons
         const parent = r.parent orelse continue;
         const side = Layout.State.SplitTree.parseSide(r.from orelse continue) orelse continue;
         const made = state.splits.split(gpa, intern.go, parent, side, r.extent orelse 0, r.name);
-        if (made != null and (r.adaptive orelse false)) _ = state.splits.markAdaptive(r.name);
+        if (made != null and (r.adaptive orelse false)) {
+            _ = state.splits.markAdaptive(r.name);
+            if (r.share) |share| _ = state.splits.setShare(r.name, share);
+        }
     }
 }
 
@@ -7302,7 +7304,7 @@ pub fn deinit(editor: *Editor) !void {
     // Owned outright rather than cached by dvui, so it has to be released explicitly.
     editor.app.layout.center_transition.discard();
     editor.app.layout.center_prev_id = null;
-    editor.app.layout.view_drag.discard();
+    editor.app.layout.view_drag.discard(editor.app.gpa);
     editor.app.layout.deinitSwaps(editor.app.gpa);
     editor.app.layout.regions.deinit(editor.app.gpa);
     editor.preview_docs.deinit(editor.app.gpa);
@@ -7342,6 +7344,7 @@ pub fn deinit(editor: *Editor) !void {
     editor.checkpoint.deinit(editor);
     // Rebuilds still opening: their threads joined, what they opened dropped unregistered.
     editor.plugin_reloads.deinit(editor.app.gpa);
+    if (comptime builtin.target.cpu.arch != .wasm32) PluginLoader.deinitOpenedPaths(editor.app.gpa);
     if (editor.session) |*kept| kept.deinit();
     // Before the plugin `deinit` loop below: `tick` fans out into plugin vtables, and this
     // joins the thread that feeds it.
diff --git a/src/editor/PluginReloads.zig b/src/editor/PluginReloads.zig
index 70cd48583..45da551be 100644
--- a/src/editor/PluginReloads.zig
+++ b/src/editor/PluginReloads.zig
@@ -69,18 +69,19 @@ pub fn start(self: *PluginReloads, editor: *Editor, id: []const u8) void {
         .started_ns = std.Io.Clock.boot.now(dvui.io).nanoseconds,
     };
     self.jobs.append(gpa, job) catch return freeJob(gpa, job);
-    job.thread = std.Thread.spawn(.{}, work, .{job}) catch |err| {
+    job.thread = std.Thread.spawn(.{}, work, .{ job, gpa }) catch |err| {
         dvui.log.warn("plugin watcher: could not start reloading '{s}': {t}", .{ id, err });
         _ = self.jobs.pop();
         return freeJob(gpa, job);
     };
 }
 
-fn work(job: *Job) void {
+fn work(job: *Job, gpa: std.mem.Allocator) void {
     var name_buf: [64]u8 = undefined;
     const timed = fizzy.core.profile.span(std.mem.print(&name_buf, "plugin open {s}", .{job.id}) catch "plugin open");
-    // The worker's own allocator: `open` only needs a scratch path from it.
-    job.opened = PluginLoader.open(std.heap.smp_allocator, job.path, job.id);
+    // The app's allocator, not a worker's own: `open` also keeps the opened-path set's keys in it
+    // (`PluginLoader.deinitOpenedPaths` frees them with the app's).
+    job.opened = PluginLoader.open(gpa, job.path, job.id);
     timed.end();
     job.opened_ns = std.Io.Clock.boot.now(dvui.io).nanoseconds;
     job.done.store(true, .release);
diff --git a/src/editor/explorer/settings.zig b/src/editor/explorer/settings.zig
index 325025ca4..65dd8cb44 100644
--- a/src/editor/explorer/settings.zig
+++ b/src/editor/explorer/settings.zig
@@ -636,19 +636,8 @@ fn drawHoldMenuDuration() void {
 }
 
 fn drawInputScheme() void {
-    var dropdown: core.widgets.DropdownWidget = undefined;
-    dropdown.init(@src(), .{}, .{
-        .expand = .horizontal,
-        .corners = dvui.CornerRect.all(1000),
-    });
-    defer dropdown.deinit();
-
-    var hbox = dvui.box(@src(), .{ .dir = .horizontal }, .{
-        .expand = .vertical,
-        .gravity_x = 1.0,
-    });
-
-    const label_text: []const u8 = switch (fizzy.editor().app.settings.input_scheme) {
+    const scheme = &fizzy.editor().app.settings.input_scheme;
+    const label_text: []const u8 = switch (scheme.*) {
         .auto => switch (dvui.mouseType()) {
             .unknown => "Auto",
             .mouse, .trackpad => |hint| dvui.currentWindow().arena().print("Auto ({s})", .{@tagName(hint)}) catch "Auto",
@@ -656,62 +645,12 @@ fn drawInputScheme() void {
         .mouse => "Mouse",
         .trackpad => "Trackpad",
     };
-    dvui.label(@src(), "{s}", .{label_text}, .{ .margin = .all(0), .padding = .all(0) });
-    core.icon.icon(@src(), "dropdown_triangle", dvui.entypo.triangle_down, .{}, .{ .gravity_y = 0.5 });
-
-    hbox.deinit();
-
-    if (dropdown.dropped()) {
-        inline for (.{
-            .{ "Auto", Editor.Settings.InputScheme.auto },
-            .{ "Mouse", Editor.Settings.InputScheme.mouse },
-            .{ "Trackpad", Editor.Settings.InputScheme.trackpad },
-        }) |choice| {
-            if (dropdown.addChoiceLabel(choice[0])) {
-                fizzy.editor().app.settings.input_scheme = choice[1];
-                fizzy.editor().markSettingsDirty();
-                dvui.refresh(null, @src(), null);
-            }
-        }
-    }
+    drawEnumDropdown(scheme, label_text, &.{ "Auto", "Mouse", "Trackpad" });
 }
 
 fn drawLayoutMode() void {
-    var dropdown: core.widgets.DropdownWidget = undefined;
-    dropdown.init(@src(), .{}, .{
-        .expand = .horizontal,
-        .corners = dvui.CornerRect.all(1000),
-    });
-    defer dropdown.deinit();
-
-    var hbox = dvui.box(@src(), .{ .dir = .horizontal }, .{
-        .expand = .vertical,
-        .gravity_x = 1.0,
-    });
-
-    const label_text: []const u8 = switch (fizzy.editor().app.settings.layout_mode) {
-        .auto => "Auto",
-        .mobile => "Mobile",
-        .desktop => "Desktop",
-    };
-    dvui.label(@src(), "{s}", .{label_text}, .{ .margin = .all(0), .padding = .all(0) });
-    core.icon.icon(@src(), "dropdown_triangle", dvui.entypo.triangle_down, .{}, .{ .gravity_y = 0.5 });
-
-    hbox.deinit();
-
-    if (dropdown.dropped()) {
-        inline for (.{
-            .{ "Auto", Editor.Settings.LayoutMode.auto },
-            .{ "Mobile", Editor.Settings.LayoutMode.mobile },
-            .{ "Desktop", Editor.Settings.LayoutMode.desktop },
-        }) |choice| {
-            if (dropdown.addChoiceLabel(choice[0])) {
-                fizzy.editor().app.settings.layout_mode = choice[1];
-                fizzy.editor().markSettingsDirty();
-                dvui.refresh(null, @src(), null);
-            }
-        }
-    }
+    const mode = &fizzy.editor().app.settings.layout_mode;
+    drawEnumDropdown(mode, null, &.{ "Auto", "Mobile", "Desktop" });
 }
 
 // ---- Plugins ----------------------------------------------------------------------------
@@ -720,6 +659,18 @@ fn drawLayoutMode() void {
 /// the plugin's own card in the Plugins tab (`PluginStore`), not a row here — there is one of
 /// those per installed plugin, and the tree is fizzy's own settings.
 fn drawPluginUpdateMode() void {
+    const mode = &fizzy.editor().app.settings.plugin_update_mode;
+    drawEnumDropdown(mode, null, &.{ "Prompt", "Silent" });
+}
+
+/// A dropdown over every value of enum `E`: `choices` are the menu's labels in the enum's
+/// declaration order, and the closed button shows the current one unless `label_text` says
+/// otherwise. A pick marks the settings dirty.
+// anytype: a pointer to any settings enum; `E` is read off its type
+fn drawEnumDropdown(value: anytype, label_text: ?[]const u8, comptime choices: []const []const u8) void {
+    const E = @typeInfo(@TypeOf(value)).pointer.child;
+    comptime std.debug.assert(choices.len == std.enums.values(E).len);
+
     var dropdown: core.widgets.DropdownWidget = undefined;
     dropdown.init(@src(), .{}, .{
         .expand = .horizontal,
@@ -731,23 +682,14 @@ fn drawPluginUpdateMode() void {
         .expand = .vertical,
         .gravity_x = 1.0,
     });
-
-    const label_text: []const u8 = switch (fizzy.editor().app.settings.plugin_update_mode) {
-        .prompt => "Prompt",
-        .silent => "Silent",
-    };
-    dvui.label(@src(), "{s}", .{label_text}, .{ .margin = .all(0), .padding = .all(0) });
+    dvui.label(@src(), "{s}", .{label_text orelse choices[@backingInt(value.*)]}, .{ .margin = .all(0), .padding = .all(0) });
     core.icon.icon(@src(), "dropdown_triangle", dvui.entypo.triangle_down, .{}, .{ .gravity_y = 0.5 });
-
     hbox.deinit();
 
     if (dropdown.dropped()) {
-        inline for (.{
-            .{ "Prompt", Editor.Settings.PluginUpdateMode.prompt },
-            .{ "Silent", Editor.Settings.PluginUpdateMode.silent },
-        }) |choice| {
-            if (dropdown.addChoiceLabel(choice[0])) {
-                fizzy.editor().app.settings.plugin_update_mode = choice[1];
+        inline for (choices, std.enums.values(E)) |choice_label, choice| {
+            if (dropdown.addChoiceLabel(choice_label)) {
+                value.* = choice;
                 fizzy.editor().markSettingsDirty();
                 dvui.refresh(null, @src(), null);
             }
diff --git a/tests/demos.zig b/tests/demos.zig
index cbf5ad6a2..492694863 100644
--- a/tests/demos.zig
+++ b/tests/demos.zig
@@ -395,23 +395,27 @@ test "demo: every bundled demo plays to the end through fizzy's stage, a seek la
         defer gpa.free(panes_zon);
         try std.Io.Dir.cwd().writeFile(dvui.io, .{ .sub_path = panes_zon, .data = ".{ .persons = true }" });
 
-        // The explorer shut, so the person's pane has the room for the tour's drop to split it
-        // (`core.placement`): with it open the drop is left out of the tour.
-        app.editor.explorer.close(app.editor);
-        try dvui.testing.settle(headlessFrame);
+        // The explorer left open: the person's pane has no room for the tour's drop to split it
+        // (`core.placement`), so the drop is left out and the tab is brought forward instead.
+        // (The integration test plays the tour with it shut, for the split.)
+        try std.testing.expect(!app.editor.explorer.closed);
         try app.editor.demo.play("tour");
         var held = true;
         var split = false;
+        var forward = false;
         frames = 0;
         while (p.state != .ended and frames < 5_000) : (frames += 1) {
             _ = try dvui.testing.step(headlessFrame);
             if (frames == 30) _ = try app.editor.openFilePath(later, wb.currentGroupingID());
             if (frames > 5 and p.state == .playing) held = held and wb.panes_held;
             split = split or wb.workspaces.count() > panes_before.groupings.len;
+            forward = forward or std.mem.endsWith(u8, activePath(app.editor), "src/main.zig");
         }
         try std.testing.expectEqual(automation.Player.State.ended, p.state);
+        try std.testing.expectEqual(@as(u32, 0), p.timeouts);
         try std.testing.expect(held);
-        try std.testing.expect(split);
+        try std.testing.expect(!split);
+        try std.testing.expect(forward);
         p.unload();
         try dvui.testing.settle(headlessFrame);
 
diff --git a/tests/fixtures/app-only/build.zig b/tests/fixtures/app-only/build.zig
new file mode 100644
index 000000000..bf4eca20a
--- /dev/null
+++ b/tests/fixtures/app-only/build.zig
@@ -0,0 +1,18 @@
+//! An app that lists only a plugin of its own. `buildApp` links exactly the list it is given, and
+//! until fizzyedit/plans#16 makes workbench optional the build must fail naming
+//! `fizzy.plugins.workbench`; `scripts/check-examples.sh` expects that. When plans#16 lands this
+//! flips to expecting success, which is where "names none of fizzy's links none" becomes true.
+const std = @import("std");
+const fizzy = @import("fizzy");
+
+pub fn build(b: *std.Build) !void {
+    const fizzy_dep = b.dependency("fizzy", .{
+        .target = b.standardTargetOptions(.{}),
+        .optimize = b.standardOptimizeOption(.{}),
+        .@"defer-app" = true,
+    });
+    try fizzy.buildApp(fizzy_dep, &.{.{
+        .name = "solo",
+        .module = b.createModule(.{ .root_source_file = b.path("plugin.zig") }),
+    }});
+}
diff --git a/tests/fixtures/app-only/build.zig.zon b/tests/fixtures/app-only/build.zig.zon
new file mode 100644
index 000000000..d9c3e6b83
--- /dev/null
+++ b/tests/fixtures/app-only/build.zig.zon
@@ -0,0 +1,14 @@
+.{
+    .name = .app_only,
+    .version = "0.0.0",
+    .fingerprint = 0xe5f716f041fcf114,
+    .minimum_zig_version = "0.17.0",
+    .dependencies = .{
+        // A placeholder: `scripts/check-examples.sh` swaps in the packed tree.
+        .fizzy = .{
+            .url = "https://github.com/fizzyedit/fizzy/archive/refs/heads/main.tar.gz",
+            .hash = "N-V-__8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+        },
+    },
+    .paths = .{ "build.zig", "build.zig.zon", "plugin.zig" },
+}
diff --git a/tests/fixtures/app-only/plugin.zig b/tests/fixtures/app-only/plugin.zig
new file mode 100644
index 000000000..86cb59e1d
--- /dev/null
+++ b/tests/fixtures/app-only/plugin.zig
@@ -0,0 +1 @@
+pub const plugin_id = "solo";
diff --git a/tests/integration.zig b/tests/integration.zig
index 9ae41d941..ff0d44a26 100644
--- a/tests/integration.zig
+++ b/tests/integration.zig
@@ -2853,7 +2853,7 @@ test "a hide_when_empty panel stays while its view is dragged onto main" {
     defer editor.app.layout.deinitQualified(editor.app.gpa);
     defer editor.app.layout.deinitAssignments(editor.app.gpa);
     defer editor.app.layout.deinitExtents(editor.app.gpa);
-    defer editor.app.layout.view_drag.discard();
+    defer editor.app.layout.view_drag.discard(editor.app.gpa);
 
     try editor.app.host.registerSurface(.{ .id = "test.main", .title = "Main", .keywords = fizzy.sdk.keywords.ide.main, .draw = EmptyPanelFrame.drawMain });
     try editor.app.host.registerSurface(.{ .id = "test.output", .title = "Output", .keywords = fizzy.sdk.keywords.ide.panel, .draw = EmptyPanelFrame.drawMain });
@@ -3836,6 +3836,78 @@ test "an adaptive split turns with the window, keeps its share and writes nothin
     try std.testing.expect(!editor.app.layout.dirty);
 }
 
+// The half of an adaptive split that is itself split is an outer branch, not a leaf: its turn
+// waits for it to slide shut, and while drawn turned its extent is not the person's to save.
+test "an adaptive split whose new half is split again turns and writes nothing" {
+    var case = try NestedSplitCase.init();
+    defer case.deinit();
+    const ctx = &case.ctx;
+    const editor = ctx.editor;
+    {
+        var layout = fizzy.Editor.Layout.init(&editor.app.host, &editor.app.layout, editor.app.gpa, dvui.currentWindow().arena());
+        layout.markAdaptive("Main/r1");
+    }
+    ctx.t.backend.size = .{ .w = 1180, .h = 820 };
+    ctx.t.backend.size_pixels = .{ .w = 1180, .h = 820 };
+    for (0..40) |_| _ = try dvui.testing.step(ColumnCardFrame.frame);
+    const left = try ColumnCardFrame.sizeOf(editor, "Main");
+    try std.testing.expect(left.w < left.h * 1.15);
+    const saved_extent = editor.app.layout.extent("Main/r1", 0);
+    editor.app.layout.dirty = false;
+
+    ctx.t.backend.size = .{ .w = 820, .h = 1180 };
+    ctx.t.backend.size_pixels = .{ .w = 820, .h = 1180 };
+    for (0..60) |_| _ = try dvui.testing.step(ColumnCardFrame.frame);
+    const top = try ColumnCardFrame.sizeOf(editor, "Main");
+    const column = try ColumnCardFrame.sizeOf(editor, "Main/r1");
+    try std.testing.expect(column.h > 40);
+    try std.testing.expectApproxEqAbs(top.w, column.w, 40);
+    try std.testing.expect(!editor.app.layout.dirty);
+    try std.testing.expectEqual(saved_extent, editor.app.layout.extent("Main/r1", 0));
+}
+
+// A half saved in landscape is a pixel extent along the width. Over a portrait box that number is
+// another share, so the share is saved beside it and the turn uses that one.
+test "an adaptive split saved beside comes back as the same share stacked" {
+    var ctx = try shim.init(std.testing.allocator);
+    defer ctx.deinit(std.testing.allocator);
+
+    const editor = ctx.editor;
+    editor.app.gpa = std.testing.allocator;
+    defer editor.app.layout.regions.deinit(editor.app.gpa);
+    defer editor.app.layout.regions_building.deinit(editor.app.gpa);
+    defer editor.app.layout.deinitExtents(editor.app.gpa);
+    defer editor.app.layout.deinitAssignments(editor.app.gpa);
+    defer editor.app.layout.deinitQualified(editor.app.gpa);
+
+    ColumnCardFrame.editor = editor;
+    defer ColumnCardFrame.editor = null;
+
+    // A restart in portrait: the layout as loaded (`loadRuntimeSplits`) has the landscape half,
+    // 590 across a 1180 box, and its share of a half.
+    ctx.t.backend.size = .{ .w = 820, .h = 1180 };
+    ctx.t.backend.size_pixels = .{ .w = 820, .h = 1180 };
+    try dvui.testing.settle(ColumnCardFrame.frame);
+    const state = &editor.app.layout;
+    const intern = struct {
+        var st: *fizzy.Editor.Layout.State = undefined;
+        fn go(a: std.mem.Allocator, name: []const u8) []const u8 {
+            return st.internName(a, name);
+        }
+    };
+    intern.st = state;
+    try std.testing.expect(state.splits.split(editor.app.gpa, intern.go, "Main", .right, 590, "Main/r1") != null);
+    try std.testing.expect(state.splits.markAdaptive("Main/r1"));
+    try std.testing.expect(state.splits.setShare("Main/r1", 0.5));
+    _ = state.setExtent(editor.app.gpa, "Main/r1", 590);
+
+    for (0..60) |_| _ = try dvui.testing.step(ColumnCardFrame.frame);
+    const top = try ColumnCardFrame.sizeOf(editor, "Main");
+    const bottom = try ColumnCardFrame.sizeOf(editor, "Main/r1");
+    // Not 590 over the 820 width, which is the share the pixels alone would say.
+    try std.testing.expectApproxEqAbs(0.5, bottom.h / (top.h + bottom.h), 0.03);
+}
+
 /// Main | (Main/r1 over Main/r1/b1) in fizzy's split forest, each holding one view. Main/r1 is two
 /// things at once: the half Main's split minted, and the half its own split kept.
 const NestedSplitCase = struct {
@@ -4149,10 +4221,10 @@ test "split: the trash is offered out of a place of several, not out of a lone d
     // Joined back, Center is the shape's one place again, showing one view.
     try case.place("Center", "Center", .remove);
     var layout = fizzy.Editor.Layout.init(&editor.app.host, &editor.app.layout, editor.app.gpa, dvui.currentWindow().arena());
-    defer editor.app.layout.view_drag.discard();
+    defer editor.app.layout.view_drag.discard(editor.app.gpa);
     VD.begin(&layout, "Center", .{ .w = 100, .h = 100 }, .{ .w = 100, .h = 100 });
     try std.testing.expect(!VD.removable(&layout));
-    editor.app.layout.view_drag.discard();
+    editor.app.layout.view_drag.discard(editor.app.gpa);
     // Holding several, the trash takes just the view carried.
     try editor.app.layout.assign(editor.app.gpa, "Center", &.{ "test.view", "test.other" });
     try dvui.testing.settle(EndlessFrame.frame);
@@ -4167,7 +4239,7 @@ test "drag: a strip whose place cannot take the view is not a chooser for it" {
     const editor = case.ctx.editor;
     const VD = fizzy.Editor.Layout.ViewDrag;
     var layout = fizzy.Editor.Layout.init(&editor.app.host, &editor.app.layout, editor.app.gpa, dvui.currentWindow().arena());
-    defer editor.app.layout.view_drag.discard();
+    defer editor.app.layout.view_drag.discard(editor.app.gpa);
     VD.begin(&layout, "Center", .{ .w = 100, .h = 100 }, .{ .w = 100, .h = 100 });
     const strip: dvui.Rect.Physical = .{ .x = 0, .y = 0, .w = 200, .h = 30 };
     // A strip of a place the drag mapped no target for (a document pane, say) is passed over...
@@ -4529,7 +4601,7 @@ test "dragging a tab off a Multiple place's strip starts the view drag with it"
     defer editor.app.layout.deinitExtents(editor.app.gpa);
     defer editor.app.layout.deinitAssignments(editor.app.gpa);
     defer editor.app.layout.deinitQualified(editor.app.gpa);
-    defer editor.app.layout.view_drag.discard();
+    defer editor.app.layout.view_drag.discard(editor.app.gpa);
     EndlessFrame.editor = editor;
     defer EndlessFrame.editor = null;
 
@@ -4559,7 +4631,7 @@ test "a tab carried off a Multiple place's strip and back along it goes in where
     defer editor.app.layout.deinitExtents(editor.app.gpa);
     defer editor.app.layout.deinitAssignments(editor.app.gpa);
     defer editor.app.layout.deinitQualified(editor.app.gpa);
-    defer editor.app.layout.view_drag.discard();
+    defer editor.app.layout.view_drag.discard(editor.app.gpa);
     EndlessFrame.editor = editor;
     defer EndlessFrame.editor = null;
 
@@ -4608,7 +4680,7 @@ test "a view let go over another place's chooser goes into its list where along
     defer editor.app.layout.deinitExtents(editor.app.gpa);
     defer editor.app.layout.deinitAssignments(editor.app.gpa);
     defer editor.app.layout.deinitQualified(editor.app.gpa);
-    defer editor.app.layout.view_drag.discard();
+    defer editor.app.layout.view_drag.discard(editor.app.gpa);
     EndlessFrame.editor = editor;
     defer EndlessFrame.editor = null;
 
@@ -4964,7 +5036,7 @@ test "a drop runs back together after the release, whatever happened to its plac
         var layout = fizzy.Editor.Layout.init(&editor.app.host, &editor.app.layout, editor.app.gpa, dvui.currentWindow().arena());
         fizzy.Editor.Layout.ViewDrag.begin(&layout, "Panel", panel_at, panel_at);
     }
-    defer editor.app.layout.view_drag.discard();
+    defer editor.app.layout.view_drag.discard(editor.app.gpa);
     _ = try dvui.currentWindow().addEventMouseMotion(.{ .pt = main_at.center() });
     try dvui.testing.settle(DropFinishFrame.frame);
     try std.testing.expect(DropZones.showing(DropFinishFrame.key));
@@ -4977,7 +5049,7 @@ test "a drop runs back together after the release, whatever happened to its plac
     }
 
     // Released, and the place it was over is now called something else.
-    editor.app.layout.view_drag.discard();
+    editor.app.layout.view_drag.discard(editor.app.gpa);
     editor.app.layout.registerRegion(editor.app.gpa, .{ .name = "Main/b0", .keywords = main_kw, .bounds = main_at });
     editor.app.layout.registerRegion(editor.app.gpa, .{ .name = "Panel", .keywords = panel_kw, .bounds = panel_at });
     editor.app.layout.publishRegions();
@@ -5020,7 +5092,7 @@ test "a drag aims at the places that were there when it began" {
     var layout = fizzy.Editor.Layout.init(&editor.app.host, &editor.app.layout, editor.app.gpa, dvui.currentWindow().arena());
     const ViewDrag = fizzy.Editor.Layout.ViewDrag;
     ViewDrag.begin(&layout, "Panel", panel_at, panel_at);
-    defer editor.app.layout.view_drag.discard();
+    defer editor.app.layout.view_drag.discard(editor.app.gpa);
 
     try std.testing.expectEqualStrings("Main", ViewDrag.targetAt(&layout, middle, "Panel") orelse
         return error.TestExpectedEqual);
@@ -5240,7 +5312,7 @@ test "drag: a document not open yet goes only to a document's slot, whose drop g
     defer editor.app.layout.regions_building.deinit(editor.app.gpa);
     defer editor.app.layout.deinitQualified(editor.app.gpa);
     defer editor.app.layout.deinitAssignments(editor.app.gpa);
-    defer editor.app.layout.view_drag.discard();
+    defer editor.app.layout.view_drag.discard(editor.app.gpa);
 
     const state = &editor.app.layout;
     const gpa = editor.app.gpa;
@@ -5317,7 +5389,7 @@ test "float: a document tab dropped on its own pane's middle floats in a view ho
     defer editor.app.layout.deinitExtents(editor.app.gpa);
     defer editor.app.layout.deinitQualified(editor.app.gpa);
     defer editor.app.layout.deinitAssignments(editor.app.gpa);
-    defer editor.app.layout.view_drag.discard();
+    defer editor.app.layout.view_drag.discard(editor.app.gpa);
 
     const state = &editor.app.layout;
     const gpa = editor.app.gpa;
@@ -5351,7 +5423,7 @@ test "float: a document tab dropped on its own pane's middle floats in a view ho
     DropProbe.last = null;
     VD.beginLoose(&layout, "text.doc:/project/a.md", .{ .x = 110, .y = 44, .w = 120, .h = 24 }, null);
     VD.place(&layout, VD.loose_source, "Pane 0", .swap);
-    state.view_drag.discard();
+    state.view_drag.discard(gpa);
     try std.testing.expect(DropProbe.last == null);
     try std.testing.expectEqualStrings("text.doc:/project/a.md", DocViews.housed[0..DocViews.housed_len]);
     try std.testing.expectEqual(@as(usize, 1), state.floats.items.items.len);
@@ -5368,7 +5440,7 @@ test "float: a document tab dropped on its own pane's middle floats in a view ho
     DocViews.lone = "test.workspace.1";
     VD.beginLoose(&layout, "text.doc:/project/b.md", .{ .x = 110, .y = 44, .w = 120, .h = 24 }, null);
     VD.place(&layout, VD.loose_source, "Pane 0", .swap);
-    state.view_drag.discard();
+    state.view_drag.discard(gpa);
     try std.testing.expectEqual(@as(usize, 2), state.floats.items.items.len);
     try std.testing.expectEqualStrings("Main", state.floats.items.items[1].home);
     try std.testing.expectEqualStrings("test.workspace.1", (state.assignment("Float 2") orelse return error.TestExpectedEqual)[0]);
@@ -5378,7 +5450,7 @@ test "float: a document tab dropped on its own pane's middle floats in a view ho
     regions.publish(state, gpa, true);
     VD.beginLoose(&layout, "text.doc:/project/b.md", .{ .x = 110, .y = 44, .w = 120, .h = 24 }, null);
     VD.place(&layout, VD.loose_source, "Pane 0", .swap);
-    state.view_drag.discard();
+    state.view_drag.discard(gpa);
     try std.testing.expectEqual(@as(usize, 2), state.floats.items.items.len);
     try std.testing.expect(DropProbe.last != null);
 
@@ -5432,7 +5504,7 @@ test "dragging a view over its own place shows that place's drop zones" {
     defer editor.app.layout.deinitExtents(editor.app.gpa);
     defer editor.app.layout.deinitAssignments(editor.app.gpa);
     defer editor.app.layout.deinitQualified(editor.app.gpa);
-    defer editor.app.layout.view_drag.discard();
+    defer editor.app.layout.view_drag.discard(editor.app.gpa);
     EndlessFrame.editor = editor;
     defer EndlessFrame.editor = null;
 
@@ -7534,7 +7606,7 @@ test "float: a drag aims at a float's place over it, at nothing over its header,
     var layout = fizzy.Editor.Layout.init(&editor.app.host, state, gpa, dvui.currentWindow().arena());
     const ViewDrag = fizzy.Editor.Layout.ViewDrag;
     ViewDrag.begin(&layout, "Panel", panel_at, panel_at);
-    defer state.view_drag.discard();
+    defer state.view_drag.discard(gpa);
 
     // Over the float: its place, though Main is under it too.
     try std.testing.expectEqualStrings("Float 1", ViewDrag.targetAt(&layout, .{ .x = 350, .y = 250 }, "Panel") orelse
@@ -7603,7 +7675,7 @@ test "float: a place a float lies over has its drop in the part left clear, wher
     var layout = fizzy.Editor.Layout.init(&editor.app.host, &editor.app.layout, gpa, dvui.currentWindow().arena());
     const ViewDrag = fizzy.Editor.Layout.ViewDrag;
     ViewDrag.begin(&layout, "Panel", FloatOverMain.panel_at, FloatOverMain.panel_at);
-    defer editor.app.layout.view_drag.discard();
+    defer editor.app.layout.view_drag.discard(editor.app.gpa);
 
     // Main's middle is under the float: its drop is in Main, clear of the float, all of it.
     const clear = ViewDrag.zoneBounds(&editor.app.layout, "Main") orelse return error.TestExpectedEqual;
@@ -7638,7 +7710,7 @@ test "float: a place a float lies all over has no drop" {
     var layout = fizzy.Editor.Layout.init(&editor.app.host, &editor.app.layout, gpa, dvui.currentWindow().arena());
     const ViewDrag = fizzy.Editor.Layout.ViewDrag;
     ViewDrag.begin(&layout, "Panel", FloatOverMain.panel_at, FloatOverMain.panel_at);
-    defer editor.app.layout.view_drag.discard();
+    defer editor.app.layout.view_drag.discard(editor.app.gpa);
 
     try std.testing.expect(ViewDrag.zoneBounds(&editor.app.layout, "Main/r1") == null);
     try std.testing.expect(ViewDrag.wheelOf(&editor.app.layout, "Main/r1") == null);
@@ -7656,7 +7728,7 @@ test "float: dragging a place's view onto its own middle floats it, over a seed
     defer editor.app.layout.deinitExtents(editor.app.gpa);
     defer editor.app.layout.deinitAssignments(editor.app.gpa);
     defer editor.app.layout.deinitQualified(editor.app.gpa);
-    defer editor.app.layout.view_drag.discard();
+    defer editor.app.layout.view_drag.discard(editor.app.gpa);
     EndlessFrame.editor = editor;
     defer EndlessFrame.editor = null;
 
@@ -7759,7 +7831,7 @@ test "float: the float a view is carried out of is a ghost while the view is aim
     // Lifted from its corner button, over the float: it is still itself.
     try pointTo(.{ .x = bounds.x + bounds.w - 16, .y = header.y + header.h + 16 }, ManyPanelFrame.frame, 1);
     ViewDrag.begin(&layout, "Float 1", bounds, bounds);
-    defer editor.app.layout.view_drag.discard();
+    defer editor.app.layout.view_drag.discard(editor.app.gpa);
     // Mapped with the others, marked as the one the view is carried out of.
     try std.testing.expectEqual(@as(usize, 1), editor.app.layout.view_drag.occluder_count);
     try std.testing.expect(editor.app.layout.view_drag.occluders[0].source);
@@ -7788,7 +7860,7 @@ test "float: the float a view is carried out of is a ghost while the view is aim
     // Off it again, and let go over nothing: back as it was.
     try pointTo(try offFloat(bounds), ManyPanelFrame.frame, ghost_frames);
     try std.testing.expectEqual(@as(f32, 1), asideOf(editor, 0));
-    editor.app.layout.view_drag.discard();
+    editor.app.layout.view_drag.discard(editor.app.gpa);
     try dvui.testing.settle(ManyPanelFrame.frame);
     try std.testing.expectEqual(@as(usize, 1), openFloats(editor));
     try std.testing.expectEqual(@as(f32, 0), asideOf(editor, 0));
@@ -7819,7 +7891,7 @@ test "float: the drops beneath a ghost sit clear of it, and it firms up as the v
     const ViewDrag = fizzy.Editor.Layout.ViewDrag;
     cw.mouse_pt = place.center();
     ViewDrag.begin(&layout, "Float 1", place, place);
-    defer state.view_drag.discard();
+    defer state.view_drag.discard(gpa);
 
     // Aimed off the float: a ghost, and beside it, what is beneath.
     const beside: dvui.Point.Physical = .{ .x = 650, .y = 200 };
@@ -7872,7 +7944,7 @@ test "float: a drop squeezed by the ghost stays whole under it, reached through
     const ViewDrag = fizzy.Editor.Layout.ViewDrag;
     cw.mouse_pt = place.center();
     ViewDrag.begin(&layout, "Float 1", place, place);
-    defer state.view_drag.discard();
+    defer state.view_drag.discard(gpa);
 
     const prev_time = cw.frame_time_ns;
     defer cw.frame_time_ns = prev_time;
@@ -7944,7 +8016,7 @@ test "float: a float of two is a ghost too, and comes back without the view that
     // Landed in Panel, which takes it beside what it shows: the float comes back, holding the
     // other.
     ViewDrag.place(&layout, "Float 1", "Panel", .swap);
-    editor.app.layout.view_drag.discard();
+    editor.app.layout.view_drag.discard(editor.app.gpa);
     try dvui.testing.settle(ManyPanelFrame.frame);
     try std.testing.expectEqual(@as(usize, 1), openFloats(editor));
     try std.testing.expectEqual(@as(f32, 0), floats.items.items[0].aside.at());
@@ -7967,7 +8039,7 @@ test "float: a ghost for its last view goes when the view lands, without flying
     try pointTo(try offFloat(bounds), ManyPanelFrame.frame, ghost_frames);
     // Released on Panel, as `apply` lands it, then the drag ends.
     ViewDrag.place(&layout, "Float 1", "Panel", .swap);
-    editor.app.layout.view_drag.discard();
+    editor.app.layout.view_drag.discard(editor.app.gpa);
     _ = try dvui.testing.step(ManyPanelFrame.frame);
     // Gone on the next frame: no glass reappearing to fly shut.
     try std.testing.expectEqual(@as(usize, 0), floats.items.items.len);
@@ -8013,7 +8085,7 @@ test "float: coming back without the view that landed elsewhere, it draws its vi
     ViewDrag.begin(&layout, "Float 1", bounds, bounds);
     try pointTo(try offFloat(bounds), ManyPanelFrame.frame, ghost_frames);
     ViewDrag.place(&layout, "Float 1", "Panel", .swap);
-    editor.app.layout.view_drag.discard();
+    editor.app.layout.view_drag.discard(editor.app.gpa);
 
     var faded = false;
     for (0..ghost_frames) |_| {
@@ -8053,7 +8125,7 @@ test "float: a drag's own layer is over every float" {
     // floating widget made in the app's own window would stay under.
     var layout = fizzy.Editor.Layout.init(&editor.app.host, &editor.app.layout, editor.app.gpa, dvui.currentWindow().arena());
     fizzy.Editor.Layout.ViewDrag.begin(&layout, "Main", main, main);
-    defer editor.app.layout.view_drag.discard();
+    defer editor.app.layout.view_drag.discard(editor.app.gpa);
     _ = try dvui.testing.step(OverlaidFrame.frame);
     _ = try dvui.testing.step(OverlaidFrame.frame);
     const float_id = editor.app.layout.floats.items.items[0].win_id;
@@ -8084,7 +8156,7 @@ test "float: a strip a float lies over is no chooser where the float is, and is
     var layout = fizzy.Editor.Layout.init(&editor.app.host, state, gpa, dvui.currentWindow().arena());
     const ViewDrag = fizzy.Editor.Layout.ViewDrag;
     ViewDrag.begin(&layout, "Panel", FloatOverMain.panel_at, FloatOverMain.panel_at);
-    defer state.view_drag.discard();
+    defer state.view_drag.discard(gpa);
 
     // A strip across Main, drawn in the app's own window, running under the float's body — a tab
     // strip of a pane the float lies over, as a plugin offers one (`Host.Region.offerChooser`).
@@ -8478,11 +8550,15 @@ test "workbench: the Files explorer frame does not grow with a 300k-note folder"
     defer gpa.free(editor.app.folder.?);
     explorer_scroll = .{ .horizontal = .none };
 
-    const last = try std.fmt.allocPrint(gpa, "{s}/note-{d:0>6}.md", .{ root, n - 1 });
+    const last_name = try std.fmt.allocPrint(gpa, "note-{d:0>6}.md", .{n - 1});
+    defer gpa.free(last_name);
+    const last = try std.fs.path.join(gpa, &.{ root, last_name });
     defer gpa.free(last);
     const last_tag = try std.fmt.allocPrint(gpa, "workbench.file:{s}", .{last});
     defer gpa.free(last_tag);
-    const hit_tag = try std.fmt.allocPrint(gpa, "workbench.file:{s}/note-123456.md", .{root});
+    const hit = try std.fs.path.join(gpa, &.{ root, "note-123456.md" });
+    defer gpa.free(hit);
+    const hit_tag = try std.fmt.allocPrint(gpa, "workbench.file:{s}", .{hit});
     defer gpa.free(hit_tag);
 
     // Loading the folder: no frame waits for the disk, and the row says so meanwhile.
@@ -9778,6 +9854,15 @@ test "live: a wait that never holds stops the tape and says where" {
 // Taking `--profile` out of argv is `app/profile.zig`'s own unit tests; these are the single-instance
 // layer's half: the profile made absolute like any other path, and never forwarded as one.
 
+/// `expected` written with `/`, against a path the OS spelled with its own separator.
+fn expectPosixPath(expected: []const u8, actual: []const u8) !void {
+    const gpa = std.testing.allocator;
+    const posix = try gpa.dupe(u8, actual);
+    defer gpa.free(posix);
+    std.mem.replaceScalar(u8, posix, std.fs.path.sep, '/');
+    try std.testing.expectEqualStrings(expected, posix);
+}
+
 test "profile: argv names one, made absolute and taken out of what is opened" {
     const si = @import("app").single_instance;
     const gpa = std.testing.allocator;
@@ -9785,16 +9870,16 @@ test "profile: argv names one, made absolute and taken out of what is opened" {
     const named = try si.resolveArgs(gpa, "/work", &.{ "fizzy", "--profile", "sandbox/./one", "notes.md", "-v" }, "/from/env");
     defer si.freeResolvedArgv(gpa, named.argv);
     defer gpa.free(named.profile.?);
-    try std.testing.expectEqualStrings("/work/sandbox/one", named.profile.?);
+    try expectPosixPath("/work/sandbox/one", named.profile.?);
     try std.testing.expectEqual(@as(usize, 3), named.argv.len);
-    try std.testing.expectEqualStrings("/work/notes.md", named.argv[1]);
+    try expectPosixPath("/work/notes.md", named.argv[1]);
     try std.testing.expectEqualStrings("-v", named.argv[2]);
 
     // The flag absent, the environment names it; neither, there is none.
     const from_env = try si.resolveArgs(gpa, "/work", &.{"fizzy"}, "/from/env");
     defer si.freeResolvedArgv(gpa, from_env.argv);
     defer gpa.free(from_env.profile.?);
-    try std.testing.expectEqualStrings("/from/env", from_env.profile.?);
+    try expectPosixPath("/from/env", from_env.profile.?);
 
     const none = try si.resolveArgs(gpa, "/work", &.{ "fizzy", "a.md" }, null);
     defer si.freeResolvedArgv(gpa, none.argv);
@@ -9807,7 +9892,7 @@ test "profile: argv names one, made absolute and taken out of what is opened" {
     defer gpa.free(quiet.profile.?);
     try std.testing.expect(quiet.quiet);
     try std.testing.expectEqual(@as(usize, 2), quiet.argv.len);
-    try std.testing.expectEqualStrings("/work/a.md", quiet.argv[1]);
+    try expectPosixPath("/work/a.md", quiet.argv[1]);
 
     // Taking the lock with a profile is native startup, not something a test process can do
     // twice; it is compiled here, so a mistake in it fails this build rather than only the app's.
@@ -9947,6 +10032,11 @@ test "headless: the whole editor comes up, opens a file, plays the tour and goes
     defer gpa.destroy(editor);
     fizzy.setInstances(entry, editor);
     editor.* = try fizzy.Editor.init(entry);
+    // A failing expect below returns early, and the watcher threads read the editor until
+    // `deinit` joins them: without this they outlive the `destroy` above and crash the run
+    // while it prints the failure.
+    var quit = false;
+    errdefer if (!quit) editor.deinit() catch {};
     workbench.runtime.setWorkbench(&editor.workbench);
     try editor.postInit();
     try dvui.testing.settle(headlessFrame);
@@ -12476,6 +12566,7 @@ test "headless: the whole editor comes up, opens a file, plays the tour and goes
     const harness_window = dvui.current_window;
     dvui.current_window = null;
     defer dvui.current_window = harness_window;
+    quit = true;
     try editor.deinit();
 }
 
diff --git a/web/fizzy.js b/web/fizzy.js
index 3a6e78b27..d562dc75a 100644
--- a/web/fizzy.js
+++ b/web/fizzy.js
@@ -7,7 +7,7 @@
 // Stamped by the build (`build/web.zig`): the hash of what it loads, and the storage name
 // (`-Dweb-storage`).
 
-import { Dvui } from "./web.js?cache-buster=TEMPLATE_HASH_WITH_PADDING__ITS_64_BYTES_LONG_THE_SAME_AS_SHA256";
+import { Dvui, TextInput } from "./web.js?cache-buster=TEMPLATE_HASH_WITH_PADDING__ITS_64_BYTES_LONG_THE_SAME_AS_SHA256";
 
 // The name this build files what it keeps in the browser under: its own files, the plugins it
 // remembers and their cached bytes. Every copy of the app served from one site shares the
@@ -974,6 +974,7 @@ export class Fizzy {
             canvas.style.cursor = m.name;
             break;
           case "textInput":
+            if ((textInputRect.length === 0) !== (m.rect.length === 0)) textInput.clear();
             textInputRect = m.rect;
             oskCheck();
             break;
@@ -1116,7 +1117,17 @@ export class Fizzy {
         axis(1, ev.deltaY, []);
       }, { passive: false });
 
+      // What the keyboard does to the word before the caret reaches the worker as typing.
+      const textInput = new TextInput(hidden, {
+        text: (text) => post({ type: "text", text }),
+        backspace: () => {
+          post({ type: "key", kind: 5, key: "Backspace", repeat: 0, mods: 0 });
+          post({ type: "key", kind: 6, key: "Backspace", repeat: 0, mods: 0 });
+        },
+      });
+      canvas.addEventListener("pointerdown", () => textInput.clear());
       const keydown = (ev) => {
+        textInput.keydown(ev);
         if (ev.key === "Tab") {
           if (ev.ctrlKey) return;
           ev.preventDefault();
@@ -1129,14 +1140,6 @@ export class Fizzy {
       hidden.addEventListener("keydown", keydown);
       canvas.addEventListener("keyup", keyup);
       hidden.addEventListener("keyup", keyup);
-      hidden.addEventListener("beforeinput", (ev) => {
-        ev.preventDefault();
-        if (ev.data && !ev.isComposing) post({ type: "text", text: ev.data });
-      });
-      hidden.addEventListener("compositionend", (ev) => {
-        if (ev.data) post({ type: "text", text: ev.data });
-        ev.target.value = "";
-      });
 
       const touches = [];
       const touchIndex = (id) => {
diff --git a/web/patches/dvui/0010-web-a-keyboard-s-correction-replaces-the-typed-word.patch b/web/patches/dvui/0010-web-a-keyboard-s-correction-replaces-the-typed-word.patch
new file mode 100644
index 000000000..4bc3e1fda
--- /dev/null
+++ b/web/patches/dvui/0010-web-a-keyboard-s-correction-replaces-the-typed-word.patch
@@ -0,0 +1,266 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fizzy macos worker <fizzy-macos@users.noreply.github.com>
+Date: Mon, 26 Oct 2026 12:00:00 -0400
+Subject: [PATCH] web: a keyboard's correction replaces the typed word
+
+A phone keyboard corrects the word before the caret, but the hidden input stayed empty and
+every beforeinput/compositionend was sent as new text, so "im" became "imI'm". TextInput keeps
+the word typed since the last space in the hidden input, caret at its end, and turns an
+insertReplacementText (its target range, or the selection the keyboard made, when a range is
+empty as it is for an input) or a composition that rewrote the word into backspaces and the
+new text. A pointer, a navigation key, a delete it cannot follow, a blur or another field
+clears the word.
+---
+ src/backends/web.js | 159 ++++++++++++++++
+ 1 file changed, 128 insertions(+), 31 deletions(-)
+
+diff --git a/src/backends/web.js b/src/backends/web.js
+index cecf29a..cc084e5 100644
+--- a/src/backends/web.js
++++ b/src/backends/web.js
+@@ -162,16 +162,138 @@ const StylusAction = Object.freeze({
+     /** motion only */
+     move: 1,
+     /** motion, then the left button pressed */
+     press: 2,
+     /** motion, then the left button released */
+     release: 3,
+ });
+ 
++/**
++ * Keeps the hidden input showing the word before the caret, and turns what a phone keyboard
++ * does to that word into the edits dvui's text widgets understand.
++ *
++ * The widgets draw their own text, so the input is empty and a keyboard has nothing to
++ * correct: autocorrect or a suggestion then arrives as plain new text ("im" becomes "imI'm").
++ * The input holds the word typed since the last space instead, the caret at its end, so a
++ * keyboard replaces it, and a replacement is sent as that many backspaces and then the new
++ * text. The word is only what this class has seen typed; a caret moved by a pointer or a key,
++ * or a delete it cannot follow, clears it.
++ */
++export class TextInput {
++    /** The word before the caret, as the hidden input shows it. */
++    word = "";
++    /** @type {boolean} */
++    composing = false;
++    /** A Backspace keydown not yet matched by its `deleteContentBackward`. */
++    backspaceKey = false;
++
++    /**
++     * @param {HTMLInputElement} hidden
++     * @param {{text: (text: string) => void, backspace: () => void}} sink Where the edits go.
++     */
++    constructor(hidden, sink) {
++        this.hidden = hidden;
++        this.sink = sink;
++        hidden.addEventListener("beforeinput", (ev) => this.beforeInput(ev));
++        hidden.addEventListener("compositionstart", () => { this.composing = true; });
++        hidden.addEventListener("compositionend", (ev) => this.compositionEnd(ev));
++        hidden.addEventListener("blur", () => this.clear());
++    }
++
++    /** Forget the word: the caret moved, or the field changed. */
++    clear() {
++        this.word = "";
++        if (!this.composing && this.hidden.value !== "") this.hidden.value = "";
++    }
++
++    /** Called for every keydown on the canvas or the hidden input. */
++    keydown(ev) {
++        if (this.composing || ["Shift", "Control", "Alt", "Meta", "CapsLock", "Unidentified", "Process", "Dead"].includes(ev.key)) return;
++        if (ev.key === "Backspace" && !ev.ctrlKey && !ev.altKey && !ev.metaKey) {
++            this.backspaceKey = true;
++            this.set(Array.from(this.word).slice(0, -1).join(""));
++        } else if (ev.key.length > 1 || ev.ctrlKey || ev.metaKey) {
++            this.clear();
++        }
++    }
++
++    set(word) {
++        this.word = word;
++        if (!this.composing && this.hidden.value !== word) this.hidden.value = word;
++    }
++
++    /** The word after `text` is typed at the caret. */
++    typed(text) {
++        this.set((this.word + text).split(/\s/).pop());
++    }
++
++    /** Replace [start, end) of the word with `text`: the deleted tail, then the text. */
++    replace(start, end, text) {
++        // The DOM counts UTF-16 code units, so slice the string by them; the keyboard erases code points.
++        start = Math.max(0, Math.min(start, this.word.length));
++        end = Math.max(start, Math.min(end, this.word.length));
++        // The caret is at the end of the word, so what follows `end` goes too and comes back.
++        const after = this.word.slice(end);
++        const kept = this.word.slice(0, start);
++        const deleted = Array.from(this.word.slice(start)).length;
++        for (let i = 0; i < deleted; i++) this.sink.backspace();
++        this.sink.text(text + after);
++        this.set(kept);
++        this.typed(text + after);
++    }
++
++    beforeInput(ev) {
++        ev.preventDefault();
++        if (ev.isComposing) return;
++        const type = ev.inputType;
++        if (type === "deleteContentBackward") {
++            // Soft keyboards usually send the Backspace key as well, which has popped the word.
++            if (this.backspaceKey) this.backspaceKey = false;
++            else this.set(Array.from(this.word).slice(0, -1).join(""));
++            return;
++        }
++        if (type && type.startsWith("delete")) {
++            this.clear();
++            return;
++        }
++        let text = ev.data;
++        if (text == null && type === "insertReplacementText" && ev.dataTransfer) text = ev.dataTransfer.getData("text/plain");
++        if (!text) return;
++        if (type === "insertReplacementText") {
++            // For an input the target ranges are empty; the keyboard selects what it replaces.
++            const ranges = ev.getTargetRanges ? ev.getTargetRanges() : [];
++            const start = ranges.length > 0 ? ranges[0].startOffset : this.hidden.selectionStart;
++            const end = ranges.length > 0 ? ranges[0].endOffset : this.hidden.selectionEnd;
++            if (start != null && end != null && start < end) {
++                this.replace(start, end, text);
++                return;
++            }
++        }
++        this.sink.text(text);
++        this.typed(text);
++    }
++
++    compositionEnd(ev) {
++        this.composing = false;
++        // The input now holds the word as the keyboard composed it. Whatever it shares with the
++        // word the widgets have is untouched; the rest of ours is deleted and theirs typed.
++        const had = Array.from(this.word);
++        let now = Array.from(this.hidden.value);
++        if (now.length === 0 && had.length === 0 && ev.data) now = Array.from(ev.data);
++        let same = 0;
++        while (same < had.length && same < now.length && had[same] === now[same]) same++;
++        for (let i = same; i < had.length; i++) this.sink.backspace();
++        const text = now.slice(same).join("");
++        if (text) this.sink.text(text);
++        this.word = "";
++        this.typed(now.join(""));
++    }
++}
++
+ export class Dvui {
+     /** @type {WebGL2RenderingContext | WebGLRenderingContext} */
+     gl;
+     /** @type {WebGLBuffer} */
+     indexBuffer;
+     /** @type {WebGLBuffer} */
+     vertexBuffer;
+     /** @type {WebGLProgram} */
+@@ -1164,21 +1286,24 @@ export class Dvui {
+                 }
+                 if (this.cur !== this.stock) this.useProgram(0, null, 0, 0);
+             },
+             wasm_cursor: (name_ptr, name_len) => {
+                 const cursor_name = this.stringFromPointer(name_ptr, name_len);
+                 this.gl.canvas.style.cursor = cursor_name;
+             },
+             wasm_text_input: (x, y, w, h) => {
++                const was = this.textInputRect;
+                 if (w > 0 && h > 0) {
+                     this.textInputRect = [x, y, w, h];
+                 } else {
+                     this.textInputRect = [];
+                 }
++                // Another field: the word typed in the last is not this one's.
++                if (was.length !== this.textInputRect.length) this.textInput?.clear();
+             },
+             wasm_open_url: (ptr, len, new_win) => {
+                 const url = this.stringFromPointer(ptr, len);
+ 
+                 if (new_win) {
+                     window.open(url);
+                 } else {
+                     window.location.href = url;
+@@ -1725,16 +1850,17 @@ export class Dvui {
+                     0,
+                 );
+             }
+             this.requestRender();
+         });
+ 
+         let keydown = (ev) => {
+             if (this.stopped) return;
++            this.textInput.keydown(ev);
+             if (ev.key == "Tab") {
+ 
+                 // In most browsers we don't even see a control-tab, the
+                 // browser uses it to switch tabs.  But Vivaldi sends it to us
+                 // first, so bail (before preventDefault) so that Vivaldi
+                 // switches tabs and we don't do anything.
+                 if (ev.ctrlKey) return;
+ 
+@@ -1771,49 +1897,32 @@ export class Dvui {
+                 (ev.metaKey << 3) + (ev.altKey << 2) + (ev.ctrlKey << 1) +
+                 (ev.shiftKey << 0),
+             );
+             this.requestRender();
+         };
+         this.gl.canvas.addEventListener("keyup", keyup.bind(this));
+         this.hidden_input.addEventListener("keyup", keyup.bind(this));
+ 
+-        this.hidden_input.addEventListener("beforeinput", (ev) => {
+-            if (this.stopped) return;
+-            ev.preventDefault();
+-            if (ev.data && !ev.isComposing) {
+-                const str = utf8encoder.encode(ev.data);
+-                const ptr = this.allocBuffer(this.instance.exports.arena_u8, str);
+-                this.instance.exports.add_event(
+-                    7,
+-                    ptr,
+-                    str.length,
+-                    0,
+-                    0,
+-                );
+-                this.requestRender();
+-            }
+-        });
+-        this.hidden_input.addEventListener("compositionend", (ev) => {
++        const addString = (kind, str) => {
+             if (this.stopped) return;
+-            if (ev.data) {
+-                const str = utf8encoder.encode(ev.data);
+-                const ptr = this.allocBuffer(this.instance.exports.arena_u8, str);
+-                this.instance.exports.add_event(
+-                    7,
+-                    ptr,
+-                    str.length,
+-                    0,
+-                    0,
+-                );
+-                this.requestRender();
+-            }
+-            // Reset value to empty after composition maybe put text there
+-            ev.target.value = "";
++            const bytes = utf8encoder.encode(str);
++            const ptr = this.allocBuffer(this.instance.exports.arena_u8, bytes);
++            this.instance.exports.add_event(kind, ptr, bytes.length, 0, 0);
++            this.requestRender();
++        };
++        this.textInput = new TextInput(this.hidden_input, {
++            text: (text) => addString(7, text),
++            backspace: () => {
++                addString(5, "Backspace");
++                addString(6, "Backspace");
++            },
+         });
++        this.gl.canvas.addEventListener("pointerdown", () => this.textInput.clear());
++
+         this.gl.canvas.addEventListener("touchstart", (ev) => {
+             if (this.stopped) return;
+             ev.preventDefault();
+             let rect = this.gl.canvas.getBoundingClientRect();
+             for (let i = 0; i < ev.changedTouches.length; i++) {
+                 let touch = ev.changedTouches[i];
+                 if (touch.touchType === "stylus") {
+                     this.stylusEvent(ev, touch, StylusAction.press);
diff --git a/web/tests/text-input.test.js b/web/tests/text-input.test.js
new file mode 100644
index 000000000..441da2a59
--- /dev/null
+++ b/web/tests/text-input.test.js
@@ -0,0 +1,107 @@
+// The hidden input's word and what a keyboard's correction does to the text. Run by
+// scripts/test-web-text-input.sh against the web.js the build writes (dvui's, patched):
+//   node text-input.test.js <path to the patched web.js>   (or jsc -m, as the script does)
+// A fake input stands in for the page's; the fake sink applies the edits like a text field.
+const path = globalThis.process ? process.argv[2] : globalThis.arguments[0];
+const print = globalThis.print ?? console.log;
+const exit = (code) => (globalThis.process ? process.exit(code) : quit());
+// web.js builds its codecs as it loads; jsc has none, and these tests never decode.
+globalThis.TextDecoder ??= class { decode() { return ""; } };
+globalThis.TextEncoder ??= class { encode() { return new Uint8Array(); } };
+const { TextInput } = await import(path);
+
+let failed = 0;
+function check(name, got, want) {
+  if (got === want) return;
+  failed++;
+  print(`FAIL ${name}: got ${JSON.stringify(got)}, want ${JSON.stringify(want)}`);
+}
+
+function fixture() {
+  const listeners = {};
+  const hidden = {
+    value: "", selectionStart: 0, selectionEnd: 0,
+    addEventListener(type, fn) { listeners[type] = fn; },
+  };
+  const field = { text: "" };
+  const input = new TextInput(hidden, {
+    text: (t) => { field.text += t; },
+    backspace: () => { field.text = Array.from(field.text).slice(0, -1).join(""); },
+  });
+  const fire = (type, ev) => listeners[type](ev);
+  const type = (data) => fire("beforeinput", { preventDefault() {}, inputType: "insertText", data, isComposing: false });
+  const select = (a, b) => { hidden.selectionStart = a; hidden.selectionEnd = b; };
+  return { hidden, field, input, fire, type, select };
+}
+
+const replacement = (data, ranges = []) => ({
+  preventDefault() {}, inputType: "insertReplacementText", data, isComposing: false, getTargetRanges: () => ranges,
+});
+
+{
+  const { hidden, field, type, fire, select } = fixture();
+  for (const c of "teh") type(c);
+  check("the word is mirrored", hidden.value, "teh");
+  select(0, 3);
+  fire("beforeinput", replacement("the", [{ startOffset: 0, endOffset: 3 }]));
+  check("target range replaced", field.text, "the");
+  check("mirror follows the replacement", hidden.value, "the");
+}
+{
+  const { field, type, fire, select } = fixture();
+  for (const c of "teh") type(c);
+  select(0, 3);
+  fire("beforeinput", replacement("the"));
+  check("selection stands in for empty target ranges", field.text, "the");
+}
+{
+  const { field, type, fire, select } = fixture();
+  for (const c of "a teh") type(c);
+  select(0, 3);
+  fire("beforeinput", replacement("the", [{ startOffset: 0, endOffset: 3 }]));
+  check("only the word after the space is replaced", field.text, "a the");
+}
+{
+  // The DOM's offsets are UTF-16 code units: the emoji spans [0, 2), "teh" is [2, 5).
+  const { field, type, fire, select } = fixture();
+  for (const c of ["\u{1F600}", "t", "e", "h"]) type(c);
+  select(2, 5);
+  fire("beforeinput", replacement("the", [{ startOffset: 2, endOffset: 5 }]));
+  check("offsets count UTF-16 units past an astral character", field.text, "\u{1F600}the");
+}
+{
+  const { hidden, field, type, fire } = fixture();
+  for (const c of "im") type(c);
+  fire("compositionstart", {});
+  hidden.value = "I'm";
+  fire("compositionend", { data: "I'm" });
+  check("a composition over the typed word", field.text, "I'm");
+}
+{
+  const { hidden, field, fire } = fixture();
+  fire("compositionstart", {});
+  hidden.value = "hello";
+  fire("compositionend", { data: "hello" });
+  check("a composition on a new word", field.text, "hello");
+}
+{
+  const { field, type, input } = fixture();
+  for (const c of "teh") type(c);
+  input.clear();
+  type(" ");
+  check("a cleared word is not replaced", field.text, "teh ");
+}
+{
+  const { hidden, field, type, input } = fixture();
+  for (const c of "tex") type(c);
+  input.keydown({ key: "Backspace" });
+  check("backspace pops the mirror", hidden.value, "te");
+  input.keydown({ key: "ArrowLeft" });
+  check("a navigation key clears it", hidden.value, "");
+  check("and leaves the field alone", field.text, "tex");
+}
+if (failed > 0) {
+  print(`text-input: ${failed} failed`);
+  exit(1);
+}
+print("text-input: ok");