Refactor panes and filesystem; replace FUSE with 9P

Consolidate pane, layout, memory and host code. Serve 9P by default over Unix sockets, with runtime mounts and optional TCP/QUIC transports. Remove FUSE and obsolete proof-of-concept examples.

Fix highlighting and terminal-history performance, expand differential and stress-test infrastructure, sort navigation results while preserving the next occurrence, add syntax-colored Braille minimaps, remove SPC-k, and document 9P interaction as a repository skill.

1 files changed, 0 insertions, 3782 deletions

diff --git a/src/acmefs.zig b/src/acmefs.zig
deleted file mode 100644
index dc2780fe..00000000
--- a/src/acmefs.zig
+++ /dev/null
@@ -1,3782 +0,0 @@
-//! ACME'S CONTROL FILESYSTEM, as a pure transaction over the core.
-//!
-//! plan9's acme serves `/mnt/acme`: a directory per window holding `addr`,
-//! `body`, `ctl`, `data`, `event`, `tag`..., and a program that opens those
-//! files IS an editor extension — no plugin API, no embedded interpreter, no
-//! rebuild. `pardes --fs` serves the same tree over Linux FUSE (src/fuse.zig),
-//! and this file is the whole of what the files MEAN. Read it beside acme's
-//! `fsys.c` (the tree) and `xfid.c` (the handlers).
-//!
-//! THE SHAPE, and why it is this shape. A filesystem is a request/response
-//! protocol driven by other processes, i.e. exactly the kind of concurrency
-//! the core does not have and must not grow. acme answers it with a thread per
-//! in-flight request (`xfidallocthread`, a `Channel` per `Xfid`, a `QLock` per
-//! window); pardes cannot and should not, so:
-//!
-//!   * This module is a PURE MAIN-THREAD TRANSACTION: `handle(p, req) Reply`.
-//!     No thread, no waiting, no callback, no allocation on the hot path. It
-//!     is freestanding-safe (no libc, no OS) and unit-testable with no FUSE
-//!     anywhere near it — the tests below post requests and read replies.
-//!   * Requests arrive as an ordinary `Event.fs_req` and answers leave as an
-//!     ordinary `Effect.fs_reply`, so the transport is the queue every other
-//!     host<->core message already uses. A backend with no threads at all
-//!     (the browser, a test) is not a special case: it either never sends a
-//!     request, or sends one from its own frame loop.
-//!   * BLOCKING — acme's `event` file, whose read waits for the user to do
-//!     something (acme parks the `Xfid` in `w->eventx` and a later `winevent`
-//!     sends it a message) — is `Status.again` here: "nothing consumed, ask me
-//!     again". The waiting lives in the host, which is where the kernel's
-//!     request already is. The core keeps no waiter list and no wakeups.
-//!
-//! DIVERGENCE FROM ACME, deliberate: acme counts RUNES, pardes counts BYTES
-//! (clamped to grapheme boundaries). Every offset in this filesystem — `addr`,
-//! `data`, the event records' q0/q1, `index`'s lengths — is a byte offset,
-//! because pardes is byte-addressed end to end (selections, look spots, LSP
-//! offsets) and a second coordinate system would mean an O(n) conversion at
-//! every boundary and a lossy `addr=dot`. acme pays that cost the other way
-//! round: it keeps the document as `Rune*` and converts on every utf read
-//! (`xfidutfread`, which carries a "BUG: stupid code: scan from beginning"
-//! comment for its cache miss). Identical for ASCII, which is what scripts
-//! compute with.
-const std = @import("std");
-const mvzr = @import("mvzr");
-const pardes = @import("pardes.zig");
-const config = @import("config.zig");
-const modal = @import("modal.zig");
-const file_pane = @import("file_pane.zig");
-const output_pane = @import("output_pane.zig");
-/// only for the scrollback read below: a terminal's `body` is a grid, and
-/// term_pane owns how a grid becomes bytes (and whether there is one at all).
-const term_pane = @import("term_pane.zig");
-/// only for `look.readFile`, which is what a `get` verb IS — the same
-/// synchronous path-backed read `file_pane.open` does, and the one place this
-/// module touches a disk.
-const look = @import("look.zig");
-const Pardes = pardes.Pardes;
-const Pane = pardes.Pane;
-const MAX_PANES = pardes.MAX_PANES;
-
-// ============================================================================
-// THE ABI — what a transport hands in and gets back.
-// ============================================================================
-
-/// The filesystem operations the core answers. Protocol-neutral on purpose:
-/// FUSE opcodes, 9P messages and a unit test all reduce to these.
-pub const Op = enum(u8) {
-    /// resolve `data` (a name) inside the directory `node`
-    lookup,
-    getattr,
-    /// only `truncate` is honoured; a filesystem of live editor state has no
-    /// mode, owner or timestamps to set
-    setattr,
-    open,
-    read,
-    write,
-    release,
-    readdir,
-    statfs,
-};
-
-pub const Status = enum(u8) {
-    ok,
-    /// NO DATA YET, nothing consumed: the transport must hold this request and
-    /// re-submit it unchanged on a later frame. The one blocking primitive,
-    /// and the reason the core needs no waiters (see the header).
-    again,
-    err,
-};
-
-/// One operation. `data` is BORROWED for the length of the single
-/// `update(.{ .fs_req = ... })` call that carries it — the same rule as
-/// `.pty_read`'s bytes — so this never goes through `postEvent`.
-pub const Req = struct {
-    /// opaque echo token; the transport's request id (FUSE `unique`)
-    tag: u64,
-    op: Op,
-    node: u64,
-    /// from `.open`, on read/write/release
-    handle: u32 = 0,
-    /// read/write: byte offset. readdir: how many entries to skip.
-    off: u64 = 0,
-    /// read/readdir: bytes wanted. Writes carry their length in `data`.
-    size: u32 = 0,
-    /// lookup: the name. write: the bytes.
-    data: []const u8 = &.{},
-    /// setattr: a size was set (only 0 means anything here)
-    truncate: bool = false,
-};
-
-pub const Reply = struct {
-    tag: u64,
-    status: Status = .ok,
-    /// positive errno when `status == .err`
-    errno: u16 = 0,
-    /// lookup/getattr/setattr answer this; `open` leaves it zeroed
-    attr: Attr = .{},
-    /// `open` answers this; every later read/write/release repeats it
-    handle: u32 = 0,
-    payload: Payload = .none,
-    /// write: how many of the offered bytes were taken. A short count is a
-    /// real answer (`data` refusing a partial grapheme), not an error.
-    written: u32 = 0,
-
-    pub const Attr = struct {
-        node: u64 = 0,
-        dir: bool = false,
-        size: u64 = 0,
-        /// permission bits only; the transport adds the format bits
-        mode: u16 = 0o600,
-    };
-
-    /// WHERE THE ANSWER'S BYTES ARE. Resolved by `pardes.fsPayload` inside the
-    /// effect drain — a borrow window identical to `.save_text`'s — so reading
-    /// a megabyte of body copies nothing.
-    pub const Payload = union(enum) {
-        none,
-        /// `State.out[0..len]`: formatted answers (ctl, addr, index, dirents,
-        /// event records). Valid until the next `handle` call.
-        staged: u32,
-        /// a slice of a live pane's text. `serial` rejects a reused slot
-        /// exactly like `.save_text` does.
-        region: struct { pane: u8, serial: u32, off: u32, len: u32 },
-    };
-
-    pub fn fail(tag: u64, e: u16) Reply {
-        return .{ .tag = tag, .status = .err, .errno = e };
-    }
-};
-
-/// The errno values this filesystem returns, standing in for acme's error
-/// strings (`fsys.c`/`xfid.c`: Eperm, Ebadctl, Ebadaddr, Ebadevent, Edel...).
-/// A filesystem has one channel for "no": the number.
-pub const E = struct {
-    pub const PERM: u16 = 1;
-    pub const NOENT: u16 = 2;
-    pub const IO: u16 = 5;
-    pub const NOMEM: u16 = 12;
-    pub const NOTDIR: u16 = 20;
-    pub const INVAL: u16 = 22;
-    pub const NFILE: u16 = 23;
-    /// the one FILE here with a fixed capacity: a pane's editable tag tail is
-    /// a bounded one-line buffer, so a write with no room left is full rather
-    /// than refused (`writeTag`)
-    pub const NOSPC: u16 = 28;
-    pub const NOSYS: u16 = 38;
-};
-
-// ============================================================================
-// THE TREE — nodes, names, and the packing that makes both cheap.
-// ============================================================================
-
-/// One file inside a pane's directory: acme's `dirtabw` minus the plan9
-/// compatibility stubs (`editout` needs acme's Edit language; `draw`,
-/// `consctl` and `label` are rio artefacts acme keeps for other programs'
-/// sake), plus the `pty/` directory and its three files — the one thing here
-/// with no prior art anywhere, because acme has no terminals and `ad` has no
-/// terminal surface at all.
-///
-/// A pty is a file interface wearing the wrong clothes: everything one wants
-/// to do to it is an `ioctl`, and no dialect of this protocol has one. So
-/// `TIOCSWINSZ` becomes `winsize 80 24`, `kill` becomes `sig INT`, spawn
-/// becomes `exec`, and `TIOCGWINSZ` becomes a read of `status`. Three files
-/// and no more: being first is a reason to keep it small.
-///
-/// THE FIELD IS FULL AFTER THIS. `Node.file` is a u4 — sixteen values — and
-/// these four take it to fifteen used. ONE VALUE (15) IS LEFT. The next file
-/// added to a pane's directory needs a wider field, which means `Node`'s
-/// packing changes and every node id in flight through a transport changes
-/// with it; that is a deliberate wall, not an oversight, and it is why `pty/`
-/// is a DIRECTORY holding three names rather than three more names beside
-/// `body` — a subdirectory costs one value for the directory itself and buys
-/// a namespace of its own, so `ctl` and `data` did not have to be renamed.
-pub const PaneFile = enum(u4) {
-    dir = 0,
-    addr,
-    body,
-    ctl,
-    data,
-    errors,
-    event,
-    tag,
-    xdata,
-    rdsel,
-    wrsel,
-    /// the `pty/` directory itself, present only on a terminal pane
-    pty,
-    /// `pty/ctl`: `winsize`, `sig`, `exec`. Spelled with the prefix because
-    /// the enum is flat — the tree is two levels and the tag namespace is one
-    /// — and `name()` below is what puts the short name back on the wire.
-    pty_ctl,
-    /// `pty/status`: the dimensions and who holds the tty
-    pty_status,
-    /// `pty/data`: the raw stream, both directions
-    pty_data,
-
-    /// Every name IS the variant's name, except the directory itself (`.` is
-    /// not an identifier) and the three inside `pty/`, whose names are already
-    /// taken by files beside `body` and so carry a prefix in the enum only.
-    pub fn name(f: PaneFile) []const u8 {
-        return switch (f) {
-            .dir => ".",
-            .pty_ctl => "ctl",
-            .pty_status => "status",
-            .pty_data => "data",
-            else => @tagName(f),
-        };
-    }
-
-    /// acme's dirtabw modes: 0400 read, 0200 write, 0600 both.
-    pub fn mode(f: PaneFile) u16 {
-        return switch (f) {
-            .dir, .pty => 0o500,
-            .errors, .wrsel, .pty_ctl => 0o200,
-            .rdsel, .pty_status => 0o400,
-            else => 0o600,
-        };
-    }
-
-    /// The two directories a pane has. Asked by `stat` and by every handler
-    /// that must refuse to treat a directory as a file.
-    pub fn isDir(f: PaneFile) bool {
-        return f == .dir or f == .pty;
-    }
-
-    /// Does this name exist ONLY on a terminal pane? A file pane has no pty,
-    /// so the whole subtree is absent there rather than present and refusing:
-    /// a script tests `-d $PARDES_FS/7/pty` to find out whether pane 7 is a
-    /// terminal, which is a question the tree could not answer before.
-    pub fn inPty(f: PaneFile) bool {
-        return switch (f) {
-            .pty, .pty_ctl, .pty_status, .pty_data => true,
-            else => false,
-        };
-    }
-};
-
-/// The files at the root, and the root itself. `new` is a directory whose
-/// every lookup CREATES a pane (acme(4): "Accessing any file in new creates a
-/// new window"), which is how a script opens one without a keystroke.
-pub const TopFile = enum(u4) {
-    root = 1,
-    index = 2,
-    cons = 3,
-    new = 4,
-
-    pub fn name(f: TopFile) []const u8 {
-        return if (f == .root) "." else @tagName(f);
-    }
-
-    pub fn mode(f: TopFile) u16 {
-        return switch (f) {
-            .root, .new => 0o500,
-            .index => 0o400,
-            .cons => 0o200,
-        };
-    }
-
-    pub fn dir(f: TopFile) bool {
-        return f == .root or f == .new;
-    }
-};
-
-/// A NODE ID, which is one integer to the kernel and two fields to us: the
-/// file within a pane's directory, and the pane's SERIAL — never reused, so a
-/// node id can never come to mean a different pane. acme does the same packing
-/// with `QID(w->id, f)` / `WIN(q)` / `FILE(q)` macros over an int; a packed
-/// struct is the same bits with the shifts and masks checked by the compiler,
-/// and `serial == 0` (no pane) is what keeps the top-level ids 1..5 out of the
-/// way with no separate range check.
-pub const Node = packed struct(u64) {
-    file: u4 = 0,
-    serial: u60 = 0,
-
-    pub fn of(serial: u32, file: PaneFile) u64 {
-        std.debug.assert(serial != 0);
-        return @bitCast(Node{ .file = @intFromEnum(file), .serial = serial });
-    }
-
-    /// What this id points at, or null when it names neither a top-level file
-    /// nor a possible pane file. Validity is decided HERE so no handler has to.
-    pub fn target(node: u64) ?Target {
-        const n: Node = @bitCast(node);
-        if (n.serial == 0) {
-            return .{ .top = std.enums.fromInt(TopFile, n.file) orelse return null };
-        }
-        return .{ .pane = .{
-            .serial = std.math.cast(u32, n.serial) orelse return null,
-            .file = std.enums.fromInt(PaneFile, n.file) orelse return null,
-        } };
-    }
-};
-
-/// What a node id points at.
-pub const Target = union(enum) {
-    top: TopFile,
-    pane: struct { serial: u32, file: PaneFile },
-};
-
-// ============================================================================
-// STATE — everything the filesystem remembers between requests.
-// ============================================================================
-
-/// What a formatted answer starts out able to hold before it grows: `index`
-/// over every pane, a directory listing, one event record. The buffer is kept
-/// between requests and cleared, not freed, so the steady state allocates
-/// nothing and nothing is capped by a number picked here.
-pub const out_reserve = 4 * 1024;
-
-/// Records a reader has not taken yet, per pane. Beyond this the oldest are
-/// dropped: an editor must not stall or grow without bound because a script
-/// stopped reading, and a reader that fell this far behind has already lost
-/// the thread — it can re-read `body` and resynchronise. (acme grows
-/// `w->events` with `realloc` and has no bound at all.)
-pub const queue_cap = 64 * 1024;
-
-/// A byte queue of formatted event records, each framed by its length so a
-/// record whose TEXT contains newlines still comes out whole.
-pub const Queue = struct {
-    buf: std.ArrayList(u8) = .empty,
-    /// How much of `buf` has been consumed. Popping moves this instead of
-    /// sliding the remainder down: a full queue holds thousands of ~20-byte
-    /// records, and a memmove per pop made draining one quadratic. The space
-    /// is reclaimed when the head passes half the buffer, so the amortised
-    /// cost of a pop is a pointer bump.
-    head: usize = 0,
-
-    pub fn deinit(q: *Queue, gpa: std.mem.Allocator) void {
-        q.buf.deinit(gpa);
-        q.head = 0;
-    }
-
-    pub fn push(q: *Queue, gpa: std.mem.Allocator, record: []const u8) void {
-        if (record.len > std.math.maxInt(u32)) return;
-        while (q.buf.items.len - q.head + record.len + 4 > queue_cap) {
-            if (q.peek() == null) return;
-            q.pop();
-        }
-        q.compact();
-        var head: [4]u8 = undefined;
-        std.mem.writeInt(u32, &head, @intCast(record.len), .little);
-        q.buf.appendSlice(gpa, &head) catch return;
-        q.buf.appendSlice(gpa, record) catch {
-            q.buf.shrinkRetainingCapacity(q.buf.items.len - 4);
-            return;
-        };
-    }
-
-    /// The oldest record, or null when empty. Does not consume.
-    pub fn peek(q: *const Queue) ?[]const u8 {
-        const rest = q.buf.items[@min(q.head, q.buf.items.len)..];
-        if (rest.len < 4) return null;
-        const len = std.mem.readInt(u32, rest[0..4], .little);
-        if (rest.len < 4 + len) return null;
-        return rest[4 .. 4 + len];
-    }
-
-    pub fn pop(q: *Queue) void {
-        const record = q.peek() orelse return;
-        q.head += 4 + record.len;
-        if (q.head == q.buf.items.len) {
-            q.buf.clearRetainingCapacity();
-            q.head = 0;
-        }
-    }
-
-    /// Consume `n` bytes off the FRONT of the oldest record, leaving whatever
-    /// is left of it as the new oldest record.
-    ///
-    /// A record-framed queue can do this at all only because the frame is a
-    /// length written IMMEDIATELY BEFORE its bytes: shortening the record
-    /// means writing the new length into the four bytes that now sit just
-    /// before what remains, and those four bytes are inside the region the old
-    /// length and the consumed bytes already occupied. Nothing live is
-    /// overwritten and nothing moves.
-    ///
-    /// Only a STREAM wants this. `event`'s records are atomic — half a record
-    /// is unparseable and desynchronises the reader for the rest of the
-    /// session — so `event` uses `pop` and refuses a short read. `pty/data`
-    /// carries raw pty bytes, which have no framing of their own: the records
-    /// there are only "what arrived in one `.output` event" and a reader may
-    /// split them anywhere, exactly as `read(2)` on the pty itself would.
-    pub fn popFront(q: *Queue, n: usize) void {
-        const record = q.peek() orelse return;
-        if (n >= record.len) return q.pop();
-        q.head += n;
-        std.mem.writeInt(u32, q.buf.items[q.head..][0..4], @intCast(record.len - n), .little);
-    }
-
-    fn compact(q: *Queue) void {
-        if (q.head == 0 or q.head * 2 < q.buf.items.len) return;
-        const rest = q.buf.items.len - q.head;
-        std.mem.copyForwards(u8, q.buf.items[0..rest], q.buf.items[q.head..]);
-        q.buf.shrinkRetainingCapacity(rest);
-        q.head = 0;
-    }
-
-    pub fn empty(q: *const Queue) bool {
-        return q.peek() == null;
-    }
-
-    /// Drop everything AND give the memory back. A queue whose last reader
-    /// left must not hold `queue_cap` of a program's output until its pane
-    /// dies; `clearRetainingCapacity` inside `pop` is the right thing between
-    /// reads and the wrong thing between readers.
-    pub fn clearAndFree(q: *Queue, gpa: std.mem.Allocator) void {
-        q.buf.clearAndFree(gpa);
-        q.head = 0;
-    }
-};
-
-/// Per-pane filesystem state, indexed by pane SLOT (not serial): it dies with
-/// the pane, and a reused slot must start clean.
-pub const PaneFs = struct {
-    /// acme's `w->addr`: where `data`/`xdata` read and write. Byte offsets.
-    addr: Range = .{},
-    /// `limit=addr`: the range regex searches are confined to, or none.
-    limit: ?Range = null,
-    /// how many opens of this pane's `event` file are live. Non-zero means the
-    /// pane is SCRIPT-DRIVEN: its Look and Exec are reported, not performed.
-    readers: u16 = 0,
-    events: Queue = .{},
-    /// `nomark`: writes stop pushing an undo point each, so a script's batch
-    /// of edits is one Undo (acme: `w->nomark`).
-    nomark: bool = false,
-    /// `noscroll`: a body write does not drag the view to the new text.
-    noscroll: bool = false,
-    /// The tag as it was at the end of the last update, so tag edits can be
-    /// reported without a hook in every tag mutation. Only kept while somebody
-    /// is listening.
-    tag_snap: std.ArrayList(u8) = .empty,
-    /// How many opens of this pane's `pty/data` file are live. THE GATE on the
-    /// raw queue below, and deliberately NOT `readers` above: a script reading
-    /// a terminal's output stream is not claiming the pane's buttons, so a pty
-    /// reader must not make the pane script-driven. Nobody reading means
-    /// `notePtyOutput` is one load and one branch and copies nothing.
-    pty_readers: u16 = 0,
-    /// Raw pty bytes on their way to the emulator, kept only while somebody is
-    /// reading them. The core does not buffer these anywhere else — they go
-    /// into the grid, and a grid cannot be un-rendered back into a byte
-    /// stream — so this is where `pty/data`'s read comes from. Same
-    /// drop-oldest cap as `events`, for the same reason: a script that stops
-    /// reading must not grow the editor.
-    pty_out: Queue = .{},
-
-    pub const Range = struct { q0: u32 = 0, q1: u32 = 0 };
-
-    fn deinit(pf: *PaneFs, gpa: std.mem.Allocator) void {
-        pf.events.deinit(gpa);
-        pf.pty_out.deinit(gpa);
-        pf.tag_snap.deinit(gpa);
-        pf.* = .{};
-    }
-};
-
-/// The core's filesystem state. Lives on `Pardes`; zero-initialised, so a core
-/// that never serves a filesystem pays one branch per frame and no memory
-/// beyond this struct.
-pub const State = struct {
-    /// Formatted answers, valid until the next `handle` call (Payload.staged).
-    /// Kept and cleared rather than freed: after the first few requests the
-    /// capacity is there and staging an answer allocates nothing.
-    out: std.ArrayList(u8) = .empty,
-    panes: [MAX_PANES]PaneFs = @splat(.{}),
-    /// How many `event` files are open anywhere. The one gate every recording
-    /// hook in the core is behind: nobody listening, nothing recorded, no diff
-    /// computed, no bytes copied.
-    listeners: u16 = 0,
-    /// Which input the core is handling, as acme's origin character: `K`
-    /// keyboard, `M` mouse, `E` a write to body/tag through this filesystem,
-    /// `F` an action through one of its other files. Set once per update.
-    origin: u8 = 'K',
-
-    pub fn deinit(st: *State, gpa: std.mem.Allocator) void {
-        for (&st.panes) |*pf| pf.deinit(gpa);
-        st.out.deinit(gpa);
-    }
-
-    /// Start a fresh answer. The previous one's bytes are dead the moment the
-    /// next request arrives, which is exactly the borrow window `fsPayload`
-    /// documents.
-    pub fn stage(st: *State, gpa: std.mem.Allocator) *std.ArrayList(u8) {
-        st.out.clearRetainingCapacity();
-        st.out.ensureTotalCapacity(gpa, out_reserve) catch {};
-        return &st.out;
-    }
-
-    /// A pane died: drop its filesystem state, and with it any listener count
-    /// it held, so a script killed with its pane cannot leave the editor
-    /// suppressing button actions forever.
-    pub fn forget(st: *State, gpa: std.mem.Allocator, id: usize) void {
-        if (id >= MAX_PANES) return;
-        st.listeners -= @min(st.listeners, st.panes[id].readers);
-        st.panes[id].deinit(gpa);
-    }
-
-    /// Is anybody reading this pane's events? The suppression rule and every
-    /// recording hook ask this.
-    pub fn scripted(st: *const State, id: usize) bool {
-        return id < MAX_PANES and st.panes[id].readers != 0;
-    }
-};
-
-// ============================================================================
-// EVENT RECORDS — what the core reports, in acme's wire format.
-// ============================================================================
-
-/// acme's record, byte for byte: origin char, type char, then four
-/// blank-separated decimals (q0, q1, flag, text length), a blank, the text,
-/// and a newline — `winevent`'s `"%c%d %d %d %d %.*S\n"` with the owner char
-/// pushed in front (`wind.c`). Text of 256 bytes or more is elided (the
-/// reader fetches it from `data`), which is also what bounds this buffer.
-pub const max_record_text = 256;
-
-/// The action characters. Lower case is the tag, upper case the body, which is
-/// how a reader tells them apart with no extra field.
-pub const Action = enum(u8) {
-    body_delete = 'D',
-    tag_delete = 'd',
-    body_insert = 'I',
-    tag_insert = 'i',
-    body_look = 'L',
-    tag_look = 'l',
-    body_exec = 'X',
-    tag_exec = 'x',
-
-    /// The enum IS the character, the way acme's `winevent` takes a `char` and
-    /// prints `%c` (`wind.c`) — so these three are expressions rather than the
-    /// three parallel switches that spelled the same alphabet out again.
-    pub fn char(a: Action) u8 {
-        return @intFromEnum(a);
-    }
-
-    pub fn fromChar(c: u8) ?Action {
-        return std.enums.fromInt(Action, c);
-    }
-
-    /// Lower case is the tag, upper case the body: acme's whole encoding of
-    /// WHICH TEXT a record is about, with no extra field.
-    pub fn onTag(a: Action) bool {
-        return @intFromEnum(a) >= 'a';
-    }
-};
-
-/// Flag bits, acme(4). Look and exec are different vocabularies at the same
-/// bit positions, so they get separate names rather than one enum.
-pub const flag_builtin: u32 = 1;
-pub const flag_expansion: u32 = 2;
-pub const flag_filename: u32 = 4;
-pub const flag_chorded: u32 = 8;
-
-/// Format one record into `buf` and return the bytes.
-pub fn formatRecord(
-    buf: []u8,
-    origin: u8,
-    action: Action,
-    q0: u32,
-    q1: u32,
-    flag: u32,
-    text: []const u8,
-) []const u8 {
-    const sent = if (text.len >= max_record_text) text[0..0] else text;
-    return std.fmt.bufPrint(buf, "{c}{c}{d} {d} {d} {d} {s}\n", .{
-        origin,
-        action.char(),
-        q0,
-        q1,
-        flag,
-        sent.len,
-        sent,
-    }) catch buf[0..0];
-}
-
-/// THE SPAN TWO VERSIONS OF A TEXT DIFFER IN: everything outside their common
-/// prefix and common suffix.
-///
-/// Chunked through `std.mem.eql`, which lowers to vectorised compares. That is
-/// not premature: this runs on EVERY edit of a scripted pane, over the whole
-/// buffer, and the byte-at-a-time loop it replaces cost 2.4x per keystroke on
-/// a 40 KB body (`zig build fs-bench`, the two `keystroke` rows).
-pub const Span = struct { at: u32, removed: u32, inserted: u32 };
-
-pub fn diffSpan(old: []const u8, new: []const u8) Span {
-    const both = @min(old.len, new.len);
-    const stride = 64;
-    var head: usize = 0;
-    while (head + stride <= both and
-        std.mem.eql(u8, old[head..][0..stride], new[head..][0..stride])) head += stride;
-    while (head < both and old[head] == new[head]) head += 1;
-    var tail: usize = 0;
-    const rest = both - head;
-    while (tail + stride <= rest and std.mem.eql(
-        u8,
-        old[old.len - tail - stride ..][0..stride],
-        new[new.len - tail - stride ..][0..stride],
-    )) tail += stride;
-    while (tail < rest and old[old.len - 1 - tail] == new[new.len - 1 - tail]) tail += 1;
-    return .{
-        .at = @intCast(head),
-        .removed = @intCast(old.len - tail - head),
-        .inserted = @intCast(new.len - tail - head),
-    };
-}
-
-/// Report a whole-text replacement the way acme reports an edit: the deletion
-/// first and then the insertion, because that is the order `textdelete` and
-/// `textinsert` would have run in. pardes replaces whole buffers, so the pair
-/// is recovered here — one implementation, one place that knows the order, and
-/// the only cost paid by an unscripted editor is the `scripted` check.
-pub fn noteReplace(p: *Pardes, id: usize, on_tag: bool, old: []const u8, new: []const u8) void {
-    if (!p.fs.scripted(id)) return;
-    const span = diffSpan(old, new);
-    if (span.removed == 0 and span.inserted == 0) return;
-    if (span.removed > 0) _ = noteAction(
-        p,
-        id,
-        if (on_tag) .tag_delete else .body_delete,
-        span.at,
-        span.at + span.removed,
-        0,
-        "",
-    );
-    if (span.inserted > 0) _ = noteAction(
-        p,
-        id,
-        if (on_tag) .tag_insert else .body_insert,
-        span.at,
-        span.at + span.inserted,
-        0,
-        new[span.at..][0..span.inserted],
-    );
-}
-
-/// Record a Look or an Exec, and say whether THE CORE MUST NOT PERFORM IT.
-///
-/// That inversion is acme's whole extension model: while a script holds a
-/// pane's `event` file open, buttons 2 and 3 in that pane belong to the script
-/// — the words in its tag are its commands, not pardes's. A script that dies
-/// closes the file and the pane goes back to being an editor.
-pub fn noteAction(
-    p: *Pardes,
-    id: usize,
-    action: Action,
-    q0: u32,
-    q1: u32,
-    flag: u32,
-    text: []const u8,
-) bool {
-    if (!p.fs.scripted(id)) return false;
-    var buf: [max_record_text + 64]u8 = undefined;
-    const record = formatRecord(&buf, p.fs.origin, action, q0, q1, flag, text);
-    p.fs.panes[id].events.push(p.gpa, record);
-    return true;
-}
-
-/// A PANE'S SHELL PRODUCED OUTPUT, raw, before the emulator ate it.
-///
-/// The one hook `pty/data`'s read needs, and the reason it has to be a hook at
-/// all: the core's only memory of a program's output is the emulator GRID,
-/// which is a rendering — the escape sequences are gone, the scrollback is
-/// reflowed, and no amount of reading it back gives a script the byte stream a
-/// pipe would have given it. So the bytes are copied here, where they arrive,
-/// or not at all.
-///
-/// GATED ON A READER COUNT, exactly as every recording hook in this file is
-/// gated on `scripted`: a pane nobody is reading pays one load and one branch
-/// and allocates nothing, which is what makes an editor that serves this
-/// filesystem cost the same as one that does not. `Queue` caps itself and
-/// drops the oldest, so a script that opens the file and then stops reading
-/// bounds the damage at `queue_cap` per pane.
-pub fn notePtyOutput(p: *Pardes, id: usize, bytes: []const u8) void {
-    if (id >= MAX_PANES or bytes.len == 0) return;
-    const pf = &p.fs.panes[id];
-    if (pf.pty_readers == 0) return;
-    // SPLIT, because a record larger than `queue_cap - 4` can never be
-    // admitted: `Queue.push`'s eviction loop pops until `peek()` is null —
-    // destroying every unread byte the script was still owed — and then drops
-    // the new record too, silently.
-    //
-    // That is not a theoretical size. Every host reads a pty master with a
-    // 64 KiB buffer (`pty_chunk` in detached/server.zig, `[0x10000]u8` in
-    // tty.zig, gui.zig and macos.zig) and a single read really does return
-    // 65536 on Linux — measured. So a pane running a build or a `cat` of
-    // anything large produces exactly the record that empties the queue,
-    // repeatedly, for as long as a script holds `pty/data` open.
-    //
-    // The `event` queue never met this because its records are a few dozen
-    // bytes; `pty/data` inherited the cap without inheriting that property.
-    // Half the cap per record, so a full queue is at least two records and the
-    // eviction loop always has something to evict.
-    var off: usize = 0;
-    while (off < bytes.len) {
-        const n = @min(bytes.len - off, queue_cap / 2);
-        pf.pty_out.push(p.gpa, bytes[off..][0..n]);
-        off += n;
-    }
-}
-
-// ============================================================================
-// THE TRANSACTION.
-// ============================================================================
-
-/// Answer one filesystem request against the live editor. The only entry
-/// point: `Event.fs_req` lands here and the `Reply` leaves as
-/// `Effect.fs_reply`.
-pub fn handle(p: *Pardes, req: Req) Reply {
-    const target = Node.target(req.node) orelse return Reply.fail(req.tag, E.NOENT);
-    // THE ORIGIN CHARACTER for everything this request goes on to cause —
-    // including the TAG DIFF the core takes at the end of the update, after
-    // this function has returned. acme sets `w->owner` in `winlock` and calls
-    // `winsettag` before `winunlock`, so the tag change a body write provokes
-    // (the dirty marker appearing) is attributed to that write and not to
-    // whatever touched the editor last. Set once, here, for the same reason.
-    //
-    // Nothing restores it: `Pardes.update` sets the origin afresh on every
-    // keystroke and every mouse event, which is what owns it the rest of the
-    // time. A read cannot cause a record, so only the mutating ops set it.
-    if (req.op == .write or req.op == .setattr) p.fs.origin = switch (target) {
-        // acme's `xfidwrite` opens with exactly this: `c = 'F'; if(qid==QWtag
-        // || qid==QWbody) c = 'E';` — `E` is "writes to the body or tag file",
-        // `F` is "actions through the window's other files" (acme(4)).
-        .pane => |t| @as(u8, if (t.file == .body or t.file == .tag) 'E' else 'F'),
-        .top => 'F',
-    };
-    return switch (req.op) {
-        .lookup => lookup(p, req, target),
-        .getattr => switch (attrOf(p, target)) {
-            .ok => |a| .{ .tag = req.tag, .attr = a },
-            .missing => Reply.fail(req.tag, E.NOENT),
-        },
-        .setattr => setattr(p, req, target),
-        .open => open(p, req, target),
-        .release => release(p, req),
-        .readdir => readdir(p, req, target),
-        .read => read(p, req, target),
-        .write => write(p, req, target),
-        // A synthetic filesystem has no blocks. Answering successfully with
-        // zeros keeps `df` and anything that stats the mount working.
-        .statfs => .{ .tag = req.tag },
-    };
-}
-
-const AttrResult = union(enum) { ok: Reply.Attr, missing };
-
-fn attrOf(p: *Pardes, target: Target) AttrResult {
-    switch (target) {
-        .top => |f| return .{ .ok = .{
-            .node = @intFromEnum(f),
-            .dir = f.dir(),
-            .mode = f.mode(),
-            .size = topSize(p, f),
-        } },
-        .pane => |t| {
-            const id = p.paneBySerial(t.serial) orelse return .missing;
-            // THE WHOLE OF "a non-terminal pane has no pty/". Decided here so
-            // no handler has to: `lookup` answers with the target's attributes
-            // and `getattr` asks the same question, so one check makes the
-            // subtree ENOENT on a file pane for every operation at once.
-            if (t.file.inPty() and !p.panes[id].?.isTerminal()) return .missing;
-            return .{ .ok = .{
-                .node = Node.of(t.serial, t.file),
-                .dir = t.file.isDir(),
-                .mode = t.file.mode(),
-                .size = paneFileSize(p, id, t.file),
-            } };
-        },
-    }
-}
-
-/// A size for `stat`. Exact where it is cheap and honest (`body`, `tag`), zero
-/// where the file is a stream whose length is not a property (`event`, `log`);
-/// FUSE serves these with direct IO, so a zero-length file still reads.
-fn topSize(p: *Pardes, f: TopFile) u64 {
-    return switch (f) {
-        .root, .new, .cons => 0,
-        .index => indexLen(p),
-    };
-}
-
-fn paneFileSize(p: *Pardes, id: usize, f: PaneFile) u64 {
-    const pane = p.panes[id] orelse return 0;
-    return switch (f) {
-        .body, .data, .xdata => bodyLen(p, pane),
-        .tag => tagLen(p, pane),
-        // `pty/status` is formatted per read like `ctl` is, and `pty/data` is
-        // a stream whose length is not a property of anything.
-        .dir, .addr, .ctl, .errors, .event, .rdsel, .wrsel => 0,
-        .pty, .pty_ctl, .pty_status, .pty_data => 0,
-    };
-}
-
-// ---------------------------------------------------------------------------
-// PER-FILE SEMANTICS. Everything above is the frame: the ABI, the tree, the
-// state, the records. Everything below is what acme's xfid.c does.
-// ---------------------------------------------------------------------------
-
-// ===========================================================================
-// THE TWO TEXTS A PANE HAS. Every handler below asks these, so "what is this
-// pane's body" has one answer here and not eleven answers scattered about.
-// ===========================================================================
-
-/// A pane's BODY, BORROWED. A file pane — which includes every output buffer
-/// — lends its content, and that is the whole reason a `body` read costs
-/// nothing (`Payload.region`). A terminal has no such buffer: its body is the
-/// emulator's scrollback, which has to be RENDERED before it is bytes, so it
-/// is not lendable and `readBody` produces one instead. Empty here therefore
-/// means "nothing to lend", which for a terminal is not "empty document".
-fn bodyOf(pane: *const Pane) []const u8 {
-    if (pane.file) |*f| return f.content;
-    return "";
-}
-
-/// ...and the writable side of the same question. Null is "this pane has no
-/// document", which is every terminal and the answer to every write that
-/// would need one.
-fn fileOf(pane: *Pane) ?*file_pane.State {
-    return if (pane.file) |*f| f else null;
-}
-
-/// The pane's TAG exactly as it is drawn: the live read-only prefix (the path,
-/// the dirty marker, the pane's builtin words, the alignment gap) then the
-/// editable tail.
-///
-/// Scratch-owned — and `Pardes.update` resets that arena before the transport
-/// ever reads a payload, so every tag answer is COPIED into `State.out`.
-/// `body` is the only text lent out, because it is the only one that is a
-/// buffer rather than a rendering.
-fn tagOf(p: *Pardes, pane: *Pane) []const u8 {
-    return p.tagText(p.scratch.allocator(), pane) catch "";
-}
-
-/// The directory a pane belongs to: acme's "the directory currently named in
-/// the tag", which is where this pane's `+Errors` goes.
-fn dirOf(pane: *Pane) []const u8 {
-    if (pane.file) |*f| return std.fs.path.dirname(f.path) orelse "/";
-    const cwd = pane.cwdSlice();
-    return if (cwd.len > 0) cwd else "/";
-}
-
-/// acme's `w->dirty`: the body differs from what is on disk. A terminal and an
-/// output buffer have nothing on disk, so they are never dirty — the same
-/// `saves` trait the tag's `*` marker already asks.
-fn dirtyOf(pane: *const Pane) bool {
-    const f = if (pane.file) |*x| x else return false;
-    if (!output_pane.fileTraits(f.output).saves) return false;
-    return f.revision != f.saved_revision;
-}
-
-/// A byte offset as a `Range` field. A pane holding four gigabytes of text is
-/// not something this editor does; saturating is honest where a silent wrap
-/// would hand a script an address pointing at the wrong end of the file.
-fn clip(n: usize) u32 {
-    return std.math.cast(u32, n) orelse std.math.maxInt(u32);
-}
-
-fn cellOf(row: i32, col: i32) modal.Cursor {
-    return .{ .row = @intCast(@max(0, row)), .col = @intCast(@max(0, col)) };
-}
-
-fn firstLine(s: []const u8) []const u8 {
-    return s[0 .. std.mem.indexOfScalar(u8, s, '\n') orelse s.len];
-}
-
-/// acme's DOT — the user's selection — as a byte range over the body.
-///
-/// pardes keeps the selection as two (row, col) cells with a HELIX block
-/// cursor, i.e. the head cell is INSIDE the range; acme's dot is gap to gap.
-/// This is the one place that conversion lives and `setDot` is its inverse, so
-/// `addr=dot` followed by `dot=addr` is the identity rather than a range that
-/// creeps by one grapheme each round trip.
-fn dotOf(pane: *Pane) PaneFs.Range {
-    const text = bodyOf(pane);
-    const head = modal.hxOff(text, cellOf(pane.cur_row, pane.cur_col));
-    if (!pane.vsel.active) return .{ .q0 = clip(head), .q1 = clip(head) };
-    const anchor = modal.hxOff(text, cellOf(pane.vsel.row, pane.vsel.col));
-    var hi = @max(head, anchor);
-    if (hi < text.len) hi = modal.nextGrapheme(text, hi);
-    return .{ .q0 = clip(@min(head, anchor)), .q1 = clip(hi) };
-}
-
-/// acme's `textsetselect`. The head lands ON the last grapheme of the range,
-/// never one past it, because that is where every pardes motion leaves it and
-/// a cursor sitting one cell right of its own selection is a selection the
-/// acme chords will not act on.
-fn setDot(pane: *Pane, r: PaneFs.Range) void {
-    const text = bodyOf(pane);
-    const q0 = @min(@as(usize, r.q0), text.len);
-    const q1 = @max(q0, @min(@as(usize, r.q1), text.len));
-    const a = modal.hxPos(text, q0);
-    pane.vsel = .{ .active = q1 > q0, .row = @intCast(a.row), .col = @intCast(a.col), .explicit = true };
-    const h = modal.hxPos(text, if (q1 > q0) modal.prevGrapheme(text, q1) else q0);
-    pane.cur_row = @intCast(h.row);
-    pane.cur_col = @intCast(h.col);
-    pane.cur_pinned = true;
-    pane.sticky_col = -1;
-    pane.msel.active = false;
-    pane.ensureCursorVisible();
-}
-
-/// acme's `textshow`: put a spot on screen. Suppressed by `noscroll`.
-fn showOffset(pane: *Pane, off: usize) void {
-    const text = bodyOf(pane);
-    const c = modal.hxPos(text, @min(off, text.len));
-    pane.cur_row = @intCast(c.row);
-    pane.cur_col = @intCast(c.col);
-    pane.cur_pinned = true;
-    pane.sticky_col = -1;
-    pane.ensureCursorVisible();
-}
-
-/// acme's `clampaddr`. Its `Range` is signed and it clamps both ends; ours is
-/// unsigned, so only the top can be wrong — and it can, the moment a pane's
-/// body shrinks under a stored address.
-fn clampAddr(pf: *PaneFs, len: usize) void {
-    const n = clip(len);
-    pf.addr.q0 = @min(pf.addr.q0, n);
-    pf.addr.q1 = @min(pf.addr.q1, n);
-    if (pf.limit) |*l| {
-        l.q0 = @min(l.q0, n);
-        l.q1 = @min(l.q1, n);
-    }
-}
-
-/// Move a range across an edit at `at` that replaced `removed` bytes with
-/// `inserted` — acme's `if(tq0 >= q0) tq0 += nr;`, applied to both ends, which
-/// is what keeps a script rewriting text under your cursor from dragging the
-/// cursor onto a different word.
-fn shiftBy(r: PaneFs.Range, at: u32, removed: u32, inserted: u32) PaneFs.Range {
-    return .{ .q0 = shiftOne(r.q0, at, removed, inserted), .q1 = shiftOne(r.q1, at, removed, inserted) };
-}
-
-fn shiftOne(v: u32, at: u32, removed: u32, inserted: u32) u32 {
-    if (v <= at) return v;
-    if (v <= at +| removed) return at +| inserted;
-    return v - removed +| inserted;
-}
-
-/// How many of these bytes end on a character boundary.
-///
-/// acme buffers a partial rune on the Fid (`fullrunewrite` plus `f->rpart`)
-/// and stitches it onto the next write. A SHORT COUNT is the POSIX spelling of
-/// the same promise — the writer's libc retries with the tail — and it needs
-/// no per-handle state at all. Never zero for a
-/// non-empty write: a writer handed 0 retries the same bytes forever.
-fn wholeUtf8(data: []const u8) usize {
-    var i = data.len;
-    var back: usize = 0;
-    while (i > 0 and back < 4) : (back += 1) {
-        i -= 1;
-        const c = data[i];
-        if (c < 0x80) return data.len; // an ASCII tail is always complete
-        if (c & 0xC0 == 0xC0) { // a lead byte: is its sequence all here?
-            const need = std.unicode.utf8ByteSequenceLength(c) catch return data.len;
-            if (i + need <= data.len or i == 0) return data.len;
-            return i;
-        }
-    }
-    // four trailing continuation bytes and no lead: not UTF-8 at all. acme's
-    // `cvttorunes` substitutes for bad bytes rather than refusing them, and so
-    // does storing them verbatim.
-    return data.len;
-}
-
-// ===========================================================================
-// LOOKUP — acme's `fsyswalk`, minus 9P's fid bookkeeping.
-// ===========================================================================
-
-/// A name inside a pane's directory. `.` and `..` are the kernel's business,
-/// never ours, the directory variant is not nameable, and the three inside
-/// `pty/` are not nameable HERE — their enum names carry a prefix precisely so
-/// that `stringToEnum` cannot hand `7/pty_ctl` back as a file beside `body`.
-/// `pty` itself resolves; whether it EXISTS is `attrOf`'s question.
-fn paneFileNamed(name: []const u8) ?PaneFile {
-    const f = std.meta.stringToEnum(PaneFile, name) orelse return null;
-    if (f == .dir) return null;
-    return if (f.inPty() and f != .pty) null else f;
-}
-
-/// ...and a name inside `pty/`, which is a separate namespace: `ctl` and
-/// `data` mean different files on the two sides of the slash, which is the
-/// whole reason `pty/` is a directory (see `PaneFile`).
-fn ptyFileNamed(name: []const u8) ?PaneFile {
-    if (std.mem.eql(u8, name, "ctl")) return .pty_ctl;
-    if (std.mem.eql(u8, name, "status")) return .pty_status;
-    if (std.mem.eql(u8, name, "data")) return .pty_data;
-    return null;
-}
-
-fn topFileNamed(name: []const u8) ?TopFile {
-    const f = std.meta.stringToEnum(TopFile, name) orelse return null;
-    return if (f == .root) null else f;
-}
-
-/// acme: "is it a numeric name? yes: it's a directory". A pane's directory is
-/// named by its SERIAL, which is never reused, so a stale path can go stale
-/// but can never come to mean a different pane.
-fn serialNamed(name: []const u8) ?u32 {
-    if (name.len == 0 or name.len > 10) return null;
-    for (name) |c| if (c < '0' or c > '9') return null;
-    return std.fmt.parseInt(u32, name, 10) catch null;
-}
-
-/// The smallest live serial greater than `after`, so a caller can walk every
-/// pane in ascending serial without sorting anything. O(panes) per step over
-/// at most sixteen slots, and no allocation — the alternative was a scratch
-/// array in a function that must not allocate.
-fn nextSerialAfter(p: *Pardes, after: u32) ?u32 {
-    var best: ?u32 = null;
-    for (p.panes) |slot| {
-        const pane = slot orelse continue;
-        if (pane.serial <= after) continue;
-        if (best == null or pane.serial < best.?) best = pane.serial;
-    }
-    return best;
-}
-
-/// Create a pane the way the `New` builtin does — an empty scratch below the
-/// active one, in its column — and answer its serial.
-///
-/// acme has `newwindowthread` sitting on a channel for exactly this, and its
-/// windows go wherever `rowadd` puts them. Going through `newScratchBelow`
-/// means a pane a script opened is in every respect a pane you opened: same
-/// tag, same builtins, same undo, same Del.
-fn newPane(p: *Pardes) ?u32 {
-    const slot = p.freeSlot() orelse return null;
-    p.newScratchBelow(p.active);
-    const pane = p.panes[slot] orelse return null;
-    return pane.serial;
-}
-
-fn lookup(p: *Pardes, req: Req, target: Target) Reply {
-    const name = req.data;
-    if (name.len == 0 or std.mem.indexOfScalar(u8, name, '/') != null) return Reply.fail(req.tag, E.NOENT);
-    const node: u64 = switch (target) {
-        .top => |f| switch (f) {
-            .root => root: {
-                if (topFileNamed(name)) |t| break :root @intFromEnum(t);
-                const serial = serialNamed(name) orelse return Reply.fail(req.tag, E.NOENT);
-                _ = p.paneBySerial(serial) orelse return Reply.fail(req.tag, E.NOENT);
-                break :root Node.of(serial, .dir);
-            },
-            .new => new: {
-                // acme(4): "Accessing any file in new creates a new window."
-                //
-                // acme creates it one component EARLIER — `fsyswalk` sends on
-                // `cnewwindow` the moment it walks the name `new` itself. That
-                // cannot work over FUSE: the kernel CACHES the dentry for
-                // `new`, so a lookup there would fire once per mount and never
-                // again. Creating at the CHILD keeps the promise the man page
-                // makes (`echo hi > $PARDES_FS/new/body` opens a pane holding
-                // `hi`) under a protocol that caches.
-                //
-                // The name is checked BEFORE the pane is made, so a stat of
-                // `new/nosuchfile` leaves no litter. acme's walk creates the
-                // window first and then fails the second component, which
-                // leaves an empty window behind for every typo.
-                const want = paneFileNamed(name) orelse return Reply.fail(req.tag, E.NOENT);
-                // `new/` makes a SCRATCH pane, which is a document and never a
-                // terminal, so `new/pty` names something that cannot exist.
-                // Refused before the pane is made, for the same reason every
-                // other bad name here is: a typo must leave no litter.
-                if (want.inPty()) return Reply.fail(req.tag, E.NOENT);
-                const serial = newPane(p) orelse return Reply.fail(req.tag, E.NFILE);
-                break :new Node.of(serial, want);
-            },
-            else => return Reply.fail(req.tag, E.NOTDIR),
-        },
-        .pane => |t| pane: {
-            _ = p.paneBySerial(t.serial) orelse return Reply.fail(req.tag, E.NOENT);
-            // Two directories, two namespaces. `attrOf` below is what decides
-            // whether the `pty` half exists on this pane at all.
-            const f = switch (t.file) {
-                .dir => paneFileNamed(name),
-                .pty => ptyFileNamed(name),
-                else => return Reply.fail(req.tag, E.NOTDIR),
-            } orelse return Reply.fail(req.tag, E.NOENT);
-            break :pane Node.of(t.serial, f);
-        },
-    };
-    // A lookup answers with the TARGET's attributes, which is exactly what a
-    // getattr of that node would say — one spelling, so the two can never
-    // disagree about a size or a mode.
-    return switch (attrOf(p, Node.target(node) orelse return Reply.fail(req.tag, E.NOENT))) {
-        .ok => |a| .{ .tag = req.tag, .attr = a },
-        .missing => Reply.fail(req.tag, E.NOENT),
-    };
-}
-
-// ===========================================================================
-// READDIR
-// ===========================================================================
-
-/// One directory entry in the transport-neutral staging format `src/fuse.zig`
-/// decodes: node id, kind, name length, name — packed, little-endian, no
-/// padding. A readdir answer is that record repeated.
-///
-/// `node` travels because it becomes the `d_ino` a `getdents64` reports, and a
-/// `d_ino` that disagrees with the later `st_ino` is a filesystem that lies to
-/// `find -inum`.
-fn stageDirent(out: *std.ArrayList(u8), gpa: std.mem.Allocator, node: u64, dir: bool, name: []const u8) void {
-    if (name.len == 0 or name.len > 255) return;
-    var head: [10]u8 = undefined;
-    std.mem.writeInt(u64, head[0..8], node, .little);
-    head[8] = @intFromBool(dir);
-    head[9] = @intCast(name.len);
-    out.appendSlice(gpa, &head) catch return;
-    out.appendSlice(gpa, name) catch return;
-}
-
-/// The pane files, for a pane directory. `pty/` is listed only on a terminal:
-/// a file pane's listing is byte for byte what it was before that directory
-/// existed, which is what keeps every existing script's `ls` unsurprised.
-fn stagePaneFiles(p: *Pardes, out: *std.ArrayList(u8), serial: u32, terminal: bool, skip: *u64) void {
-    inline for (comptime std.enums.values(PaneFile)) |f| {
-        // The directory itself is never an entry, and the three names inside
-        // `pty/` belong to THAT directory's listing rather than to this one —
-        // the enum is flat, the tree is not.
-        if (comptime f == .dir or (f.inPty() and f != .pty)) continue;
-        // `pty/` itself is present only on a terminal. A runtime `continue`
-        // cannot leave an `inline for` body, so the entry is conditional
-        // rather than the iteration.
-        const present = f != .pty or terminal;
-        if (present) {
-            if (skip.* > 0) skip.* -= 1 else stageDirent(out, p.gpa, Node.of(serial, f), f.isDir(), f.name());
-        }
-    }
-}
-
-/// ...and the three inside `pty/`, in declaration order like every other
-/// listing here, so a script that walks the tree twice can diff the walks.
-fn stagePtyFiles(p: *Pardes, out: *std.ArrayList(u8), serial: u32, skip: *u64) void {
-    inline for (comptime std.enums.values(PaneFile)) |f| {
-        if (comptime !f.inPty() or f == .pty) continue;
-        if (skip.* > 0) skip.* -= 1 else stageDirent(out, p.gpa, Node.of(serial, f), false, f.name());
-    }
-}
-
-fn readdir(p: *Pardes, req: Req, target: Target) Reply {
-    const out = p.fs.stage(p.gpa);
-    var skip = req.off;
-    switch (target) {
-        .top => |f| switch (f) {
-            .root => {
-                inline for (.{ TopFile.index, TopFile.cons, TopFile.new }) |t| {
-                    if (skip > 0) skip -= 1 else stageDirent(out, p.gpa, @intFromEnum(t), t.dir(), t.name());
-                }
-                // Ascending serial: serials are never reused, so this order is
-                // stable across a create and a delete — which is what a script
-                // that walks the tree twice and diffs the two walks needs.
-                // acme lists windows in SCREEN order (column by column), which
-                // changes when you drag a window and says nothing a script can
-                // rely on.
-                var last: u32 = 0;
-                while (nextSerialAfter(p, last)) |s| {
-                    last = s;
-                    if (skip > 0) {
-                        skip -= 1;
-                        continue;
-                    }
-                    var buf: [16]u8 = undefined;
-                    const name = std.fmt.bufPrint(&buf, "{d}", .{s}) catch continue;
-                    stageDirent(out, p.gpa, Node.of(s, .dir), true, name);
-                }
-            },
-            // `new/` ENUMERATES NOTHING, and that is a guarantee rather than a
-            // shrug: the names it could list are exactly the names whose LOOKUP
-            // creates a pane, and every tool that lists a directory then stats
-            // what it found — `ls -l`, `ls --color`, `find`, a shell completing
-            // `$PARDES_FS/new/` — would make one pane per name. acme never
-            // lists it either. Naming a file here is what creates one; see
-            // `lookup`.
-            .new => {},
-            else => return Reply.fail(req.tag, E.NOTDIR),
-        },
-        .pane => |t| {
-            const id = p.paneBySerial(t.serial) orelse return Reply.fail(req.tag, E.NOENT);
-            const terminal = p.panes[id].?.isTerminal();
-            switch (t.file) {
-                .dir => stagePaneFiles(p, out, t.serial, terminal, &skip),
-                // A node id naming `pty/` can only have come from a pane that
-                // was a terminal when it was resolved. It may not be one now
-                // (a pane can acquire a document), so answer what a lookup
-                // would answer today rather than trusting the id.
-                .pty => {
-                    if (!terminal) return Reply.fail(req.tag, E.NOENT);
-                    stagePtyFiles(p, out, t.serial, &skip);
-                },
-                else => return Reply.fail(req.tag, E.NOTDIR),
-            }
-        },
-    }
-    // Zero bytes is END OF DIRECTORY, never an error: the transport stops
-    // asking, and re-staging from scratch on every call is what makes a
-    // partially consumed answer safe to ask for again at a higher cookie.
-    return .{ .tag = req.tag, .payload = .{ .staged = @intCast(out.items.len) } };
-}
-
-// ===========================================================================
-// OPEN / RELEASE / SETATTR
-// ===========================================================================
-
-/// Open carries no per-open state, because there is none to carry: `addr` and
-/// `limit` belong to the pane (as they do in acme, where they are Window
-/// fields), and every read brings its own offset. What an open DOES do is
-/// arm the two things acme arms on open, and count the two kinds of reader.
-///
-/// So there is no fid table. acme needs one because 9P walks to a fid and
-/// every later message names only that fid; FUSE puts the nodeid on every
-/// request, RELEASE included, so the handle is decoration. It is answered
-/// non-zero only because the transport spells "no handle" as zero.
-fn open(p: *Pardes, req: Req, target: Target) Reply {
-    switch (target) {
-        .top => {},
-        .pane => |t| {
-            const id = p.paneBySerial(t.serial) orelse return Reply.fail(req.tag, E.NOENT);
-            const pf = &p.fs.panes[id];
-            // A file that is not there cannot be opened, so the reader count
-            // below cannot be armed on a pane with no pty. Same answer
-            // `lookup`, `read` and `write` give (`attrOf`).
-            if (t.file.inPty() and !p.panes[id].?.isTerminal()) return Reply.fail(req.tag, E.NOENT);
-            switch (t.file) {
-                // acme(4): "When the ctl file is first opened, regular
-                // expression context searches in addr addresses examine the
-                // whole file"; `limit=addr` narrows them again.
-                .ctl => pf.limit = null,
-                // acme resets both on the FIRST open (`w->nopen[QWaddr]++ ==
-                // 0`) and keeps a per-file open count to know. There is none
-                // here: `addr` is one piece of per-pane state that a second
-                // opener would be sharing anyway, so the honest reading of
-                // "first" is "whenever somebody opens it" — and a script's
-                // first act on `addr` is always to write one.
-                .addr => {
-                    pf.addr = .{};
-                    pf.limit = null;
-                },
-                // THE SUPPRESSION GATE. While this is non-zero the pane is
-                // script-driven: its Look and Exec are reported, not
-                // performed (`noteAction`). Counted per OPEN, not per pane, so
-                // two readers means the second one closing leaves the first
-                // still in charge.
-                .event => {
-                    pf.readers +|= 1;
-                    p.fs.listeners +|= 1;
-                },
-                // THE OTHER GATE, and deliberately a separate count: while
-                // this is non-zero the raw pty bytes are copied into
-                // `pty_out` as they arrive (`notePtyOutput`). It does NOT
-                // touch `listeners` — reading a terminal's output stream is
-                // not claiming the pane's buttons, and a script that did both
-                // would have opened `event` too.
-                .pty_data => pf.pty_readers +|= 1,
-                else => {},
-            }
-        },
-    }
-    return .{ .tag = req.tag, .handle = 1 };
-}
-
-fn release(p: *Pardes, req: Req) Reply {
-    const target = Node.target(req.node) orelse return .{ .tag = req.tag };
-    switch (target) {
-        .top => {},
-        .pane => |t| {
-            if (t.file != .event and t.file != .pty_data) return .{ .tag = req.tag };
-            // The pane may have DIED while this was open. `State.forget` has
-            // then already taken its whole reader count out of `listeners`
-            // (the core calls it from `deinitPane`), so a serial that no
-            // longer resolves must not be decremented a second time — that
-            // underflow is exactly what would leave the editor suppressing
-            // button actions forever with no script left to interpret them.
-            const id = p.paneBySerial(t.serial) orelse return .{ .tag = req.tag };
-            const pf = &p.fs.panes[id];
-            if (t.file == .pty_data) {
-                if (pf.pty_readers == 0) return .{ .tag = req.tag };
-                pf.pty_readers -= 1;
-                // The LAST pty reader leaving takes the queue's MEMORY with
-                // it, not merely its contents: `queue_cap` per pane held
-                // until the pane dies would be an editor that grew by being
-                // scripted once. And what is in it is stale anyway — the next
-                // reader wants the program's output from when IT opened the
-                // file, not a replay of somebody else's session.
-                if (pf.pty_readers == 0) pf.pty_out.clearAndFree(p.gpa);
-                return .{ .tag = req.tag };
-            }
-            if (pf.readers == 0) return .{ .tag = req.tag };
-            pf.readers -= 1;
-            p.fs.listeners -|= 1;
-            // The LAST reader leaving takes the tag snapshot with it. It is
-            // only ever compared against while somebody is listening, so
-            // keeping it would let the tag drift unobserved and then hand the
-            // NEXT reader a `d`/`i` pair for a change it never saw.
-            if (pf.readers == 0) pf.tag_snap.clearAndFree(p.gpa);
-        },
-    }
-    return .{ .tag = req.tag };
-}
-
-fn setattr(p: *Pardes, req: Req, target: Target) Reply {
-    // acme has NO equivalent: 9P has no truncate-on-open, so nothing in
-    // `xfid.c` answers a Twstat carrying a length. Linux does — `> body` is
-    // O_TRUNC — and refusing it would make the shell's most natural way to
-    // REPLACE a pane's text (rather than append to it) fail with EPERM on the
-    // redirect, before a single byte was written. So exactly one field is
-    // honoured, only the value zero means anything, and everything else a
-    // `stat` structure can carry (mode, owner, times) is silently accepted and
-    // ignored the way a filesystem of live editor state has to.
-    if (req.truncate) switch (target) {
-        .pane => |t| switch (t.file) {
-            .body, .data, .xdata => {
-                const id = p.paneBySerial(t.serial) orelse return Reply.fail(req.tag, E.NOENT);
-                const pane = p.panes[id].?;
-                if (fileOf(pane) != null) {
-                    _ = spliceBody(p, id, pane, 0, bodyOf(pane).len, "") orelse
-                        return Reply.fail(req.tag, E.NOMEM);
-                    p.fs.panes[id].addr = .{};
-                    setDot(pane, .{});
-                }
-            },
-            else => {},
-        },
-        else => {},
-    };
-    return switch (attrOf(p, target)) {
-        .ok => |a| .{ .tag = req.tag, .attr = a },
-        .missing => Reply.fail(req.tag, E.NOENT),
-    };
-}
-
-// ===========================================================================
-// READ
-// ===========================================================================
-
-/// Answer with a WINDOW onto what was just staged. `Payload.staged` is a
-/// LENGTH from the start of the buffer, so a read at an offset slides the
-/// bytes down rather than growing the payload union with a second field
-/// nothing else would ever use.
-fn staged(p: *Pardes, req: Req) Reply {
-    const out = &p.fs.out;
-    const off = @min(req.off, out.items.len);
-    const n = @min(out.items.len - off, req.size);
-    if (off > 0) std.mem.copyForwards(u8, out.items[0..n], out.items[off..][0..n]);
-    out.shrinkRetainingCapacity(n);
-    return .{ .tag = req.tag, .payload = .{ .staged = @intCast(n) } };
-}
-
-fn read(p: *Pardes, req: Req, target: Target) Reply {
-    switch (target) {
-        .top => |f| return switch (f) {
-            .index => readIndex(p, req),
-            // acme's dirtab: `cons` is 0200 and a directory is not read(2)able.
-            .cons, .root, .new => Reply.fail(req.tag, E.PERM),
-        },
-        .pane => |t| {
-            const id = p.paneBySerial(t.serial) orelse return Reply.fail(req.tag, E.NOENT);
-            const pane = p.panes[id].?;
-            const pf = &p.fs.panes[id];
-            // A `pty/` node whose pane is no longer a terminal reads as
-            // absent, not as empty: the same answer `lookup` gives today.
-            if (t.file.inPty() and !pane.isTerminal()) return Reply.fail(req.tag, E.NOENT);
-            return switch (t.file) {
-                .addr => readAddr(p, req, pf, pane),
-                .body => readBody(p, req, id, pane),
-                .ctl => readCtl(p, req, pane),
-                .data => readData(req, id, pane, pf, false),
-                .xdata => readData(req, id, pane, pf, true),
-                .tag => readTag(p, req, pane),
-                .event => readQueue(p, req, &pf.events),
-                .rdsel => readRdsel(req, id, pane),
-                .pty_status => readPtyStatus(p, req, id, pane),
-                .pty_data => readPtyData(p, req, pf),
-                .dir, .errors, .wrsel, .pty, .pty_ctl => Reply.fail(req.tag, E.PERM),
-            };
-        },
-    }
-}
-
-/// acme's `Ctlsize`: five `%11d ` fields = 60 bytes, before the tag.
-const ctl_fields = 5 * 12;
-
-/// acme's `winctlprint(w, buf, 0)` — the five numbers `index` and `ctl` share.
-///
-/// COST: acme reads the tag's length off `w->tag.file->nc` for free, because
-/// acme's tag IS a buffer. pardes's is COMPUTED every time it is asked for
-/// (path, dirty marker, builtins, and the alignment gap, which is measured
-/// against every other pane in the same layout column), so these five numbers
-/// cost one tag render — a couple of microseconds and a few bumps of the
-/// per-update scratch arena, which `Pardes.update` resets. That is the price
-/// of the second field being the number a `tag` read will actually hand back;
-/// a cheaper approximation that disagreed with `read tag` would be worse than
-/// slow, it would be wrong.
-fn stageCtlNumbers(p: *Pardes, out: *std.ArrayList(u8), pane: *Pane) void {
-    out.print(p.gpa, "{d:>11} {d:>11} {d:>11} {d:>11} {d:>11} ", .{
-        pane.serial,
-        tagOf(p, pane).len,
-        bodyOf(pane).len,
-        // acme's `isdir` marks a window holding a DIRECTORY LISTING. pardes
-        // never opens one — a Look at a directory spawns a shell there
-        // (look.zig) — so this is structurally zero, not unimplemented.
-        @as(u32, 0),
-        @intFromBool(dirtyOf(pane)),
-    }) catch {};
-}
-
-/// acme's `xfidindexread`: one line per pane, the five numbers then the tag up
-/// to its first newline. Seekable, so a script can pread the middle of it —
-/// "at character position 5×12 starts the name of the window" (acme(4)).
-fn readIndex(p: *Pardes, req: Req) Reply {
-    const out = p.fs.stage(p.gpa);
-    var last: u32 = 0;
-    while (nextSerialAfter(p, last)) |s| {
-        last = s;
-        const pane = p.panes[p.paneBySerial(s).?].?;
-        stageCtlNumbers(p, out, pane);
-        out.appendSlice(p.gpa, firstLine(tagOf(p, pane))) catch {};
-        out.append(p.gpa, '\n') catch {};
-    }
-    return staged(p, req);
-}
-
-/// acme: `sprint(buf, "%11d %11d ", w->addr.q0, w->addr.q1)`. acme's numbers
-/// are RUNE offsets; these are bytes (see the header). "Thus a regular
-/// expression may be evaluated by writing it to addr and reading it back."
-fn readAddr(p: *Pardes, req: Req, pf: *PaneFs, pane: *Pane) Reply {
-    clampAddr(pf, bodyOf(pane).len);
-    const out = p.fs.stage(p.gpa);
-    out.print(p.gpa, "{d:>11} {d:>11} ", .{ pf.addr.q0, pf.addr.q1 }) catch {};
-    return staged(p, req);
-}
-
-fn readBody(p: *Pardes, req: Req, id: usize, pane: *Pane) Reply {
-    if (pane.file != null) {
-        // ZERO COPY: `.region` is resolved by `fsPayload` during the effect
-        // drain, so reading a megabyte of body moves no bytes in here at all.
-        // This is the whole reason `Payload` is a union and not a slice.
-        const text = bodyOf(pane);
-        const off = @min(req.off, text.len);
-        const n = @min(text.len - off, req.size);
-        return .{ .tag = req.tag, .payload = .{ .region = .{
-            .pane = @intCast(id),
-            .serial = pane.serial,
-            .off = clip(off),
-            .len = clip(n),
-        } } };
-    }
-    // A TERMINAL has no such buffer. acme's body is always a `Text`; pardes's
-    // is a terminal emulator, and its "body" is the scrollback — which only
-    // becomes bytes when somebody renders the pages into lines. So it is
-    // produced, staged, and paid for per read. `win`'s transcript, read side.
-    const text = term_pane.screenTextAlloc(pane, p.gpa) catch
-        return Reply.fail(req.tag, E.NOMEM);
-    defer p.gpa.free(text);
-    const out = p.fs.stage(p.gpa);
-    out.appendSlice(p.gpa, text) catch return Reply.fail(req.tag, E.NOMEM);
-    return staged(p, req);
-}
-
-/// The face the shell was last asked to wear. acme owns its fonts and prints
-/// the real one; the core only knows what it REQUESTED — on a tty the font
-/// belongs to the terminal emulator and in the browser to the page — so it
-/// prints that, or `default`, which is the same word the Debug overlay shows
-/// for the same reason.
-fn fontName(p: *Pardes) []const u8 {
-    const name = p.settings.font.effective_name.get();
-    return if (name.len == 0) "default" else name;
-}
-
-/// plan9's `%q` (`quotestrfmt`): a string with nothing special in it prints
-/// bare, anything else is wrapped in single quotes with internal quotes
-/// doubled. Load-bearing rather than decoration — a script splits the ctl line
-/// into shell words, and a font name with a space in it is one word.
-fn stageQuoted(out: *std.ArrayList(u8), gpa: std.mem.Allocator, s: []const u8) void {
-    const plain = s.len > 0 and for (s) |c| {
-        if (c <= ' ' or c == '\'') break false;
-    } else true;
-    if (plain) {
-        out.appendSlice(gpa, s) catch {};
-        return;
-    }
-    out.append(gpa, '\'') catch {};
-    for (s) |c| {
-        if (c == '\'') out.append(gpa, '\'') catch {};
-        out.append(gpa, c) catch {};
-    }
-    out.append(gpa, '\'') catch {};
-}
-
-/// acme's `winctlprint(w, buf, 1)`: index's five numbers plus three more.
-fn readCtl(p: *Pardes, req: Req, pane: *Pane) Reply {
-    const out = p.fs.stage(p.gpa);
-    stageCtlNumbers(p, out, pane);
-    // acme prints `Dx(w->body.r)` — the body's width in PIXELS — and
-    // `w->body.maxtab`, a tab's width in pixels too. pardes is a CELL GRID:
-    // on a tty there is no pixel width to report at all, and on the two pixel
-    // shells the number a script actually wants is still how many characters
-    // fit. So both are CELLS. A script that would have divided by the font
-    // width to get columns gets columns without dividing.
-    out.print(p.gpa, "{d:>11} ", .{pane.cols}) catch {};
-    stageQuoted(out, p.gpa, fontName(p));
-    out.print(p.gpa, " {d:>11} ", .{config.tab_width}) catch {};
-    return staged(p, req);
-}
-
-fn readTag(p: *Pardes, req: Req, pane: *Pane) Reply {
-    const out = p.fs.stage(p.gpa);
-    out.appendSlice(p.gpa, tagOf(p, pane)) catch {};
-    return staged(p, req);
-}
-
-/// acme's `xfidruneread`: hand back whole characters from the START of `addr`
-/// and move `addr` to the null string just after them; `xdata` additionally
-/// stops at the END of `addr` (acme passes `w->addr.q1` where `data` passes
-/// `nc`). The file offset is ignored — `addr` is the position.
-///
-/// "Whole characters" is acme's partial-rune rule; here it is a GRAPHEME
-/// boundary, which is strictly stronger and is what every other offset in
-/// pardes already respects. A read too small for the next grapheme returns
-/// zero bytes rather than half of one — acme's `if(m == 0) break`.
-fn readData(req: Req, id: usize, pane: *Pane, pf: *PaneFs, stop_at_end: bool) Reply {
-    const text = bodyOf(pane);
-    clampAddr(pf, text.len);
-    const q0: usize = pf.addr.q0;
-    // acme carries a "BUG: what should happen if q1 > q0?" here and answers by
-    // reading nothing. An inverted address is a legal thing to have written
-    // (`address()` never normalises), so the empty read is the answer.
-    const hi: usize = if (stop_at_end) @max(q0, @as(usize, pf.addr.q1)) else text.len;
-    var end = @min(hi, q0 +| req.size);
-    end = @max(q0, modal.graphemeStart(text, end));
-    // `data` collapses the address onto the point it read up to; `xdata` moves
-    // only q0 and KEEPS q1, because q1 is the stop address the man page
-    // promises ("reads stop at the end address") and the next chunked read has
-    // to be able to continue from where this one stopped. acme spells the same
-    // difference at xfid.c:331-341: QWdata assigns both, QWxdata only q0.
-    pf.addr.q0 = clip(end);
-    if (!stop_at_end) pf.addr.q1 = clip(end);
-    if (pane.file == null) return .{ .tag = req.tag };
-    return .{ .tag = req.tag, .payload = .{ .region = .{
-        .pane = @intCast(id),
-        .serial = pane.serial,
-        .off = clip(q0),
-        .len = clip(end - q0),
-    } } };
-}
-
-/// acme copies the selection into a TEMP FILE at open, with a comment
-/// apologising for it, so a `|sort` cannot see the text change underneath.
-/// There is no such window here: the whole request is one main-thread
-/// transaction, nothing can run between the open and the read, and the bytes
-/// go out of the pane unmoved.
-fn readRdsel(req: Req, id: usize, pane: *Pane) Reply {
-    if (pane.file == null) return .{ .tag = req.tag };
-    const text = bodyOf(pane);
-    const d = dotOf(pane);
-    const lo = @min(@as(usize, d.q0), text.len);
-    const hi = @max(lo, @min(@as(usize, d.q1), text.len));
-    const off = @min(req.off, hi - lo);
-    const n = @min(hi - lo - off, req.size);
-    return .{ .tag = req.tag, .payload = .{ .region = .{
-        .pane = @intCast(id),
-        .serial = pane.serial,
-        .off = clip(lo + off),
-        .len = clip(n),
-    } } };
-}
-
-/// ONE RECORD PER READ, and `Status.again` when there is none.
-///
-/// This is the whole of what acme's blocking `event` read becomes. acme parks
-/// the `Xfid` in `w->eventx` and `winevent` sends it a message to wake it up;
-/// the waiting lives in a thread per in-flight request, and `xfidflush` exists
-/// to cancel one. Here nothing is consumed and nothing is remembered: the
-/// transport still holds the kernel's request and asks again. No waiter list,
-/// no wakeup, no flush bookkeeping, and no loop anywhere in the core.
-fn readQueue(p: *Pardes, req: Req, q: *Queue) Reply {
-    const record = q.peek() orelse return .{ .tag = req.tag, .status = .again };
-    // acme hands back as much of its event buffer as the count allows and
-    // keeps the rest, which can split a record down the middle; a reader is
-    // simply expected never to ask for less than one. Refusing is the honest
-    // version of that contract — half a record is unparseable and silently
-    // desynchronises the reader for the rest of the session.
-    if (req.size < record.len) return Reply.fail(req.tag, E.INVAL);
-    const out = p.fs.stage(p.gpa);
-    out.appendSlice(p.gpa, record) catch return Reply.fail(req.tag, E.NOMEM);
-    q.pop();
-    return .{ .tag = req.tag, .payload = .{ .staged = @intCast(out.items.len) } };
-}
-
-// ===========================================================================
-// `pty/` — the terminal a pane is, as three files. No prior art: acme has no
-// terminals and `ad` has no terminal surface at all, so nobody has made these
-// mistakes for us and nobody's scripts expect a particular spelling. Which is
-// the argument for three files and no fourth.
-// ===========================================================================
-
-/// `pty/status`: `%11d `-formatted, exactly like `ctl` and `index`, so a
-/// script splits it the same way and `read`s it at an offset.
-///
-/// THREE NUMBERS, and the choice of which three is the whole content of this
-/// function. The core knows the grid it asked for and it can ask the host who
-/// holds the tty; that is all it knows, and inventing a fourth field would be
-/// inventing the number behind it.
-///
-///   cols, rows   the grid, in cells. What `TIOCGWINSZ` would answer, and the
-///                same pair `winsize` sets — so a script can set a size and
-///                read back that it took.
-///   taken        1 while a PROGRAM holds the tty (vim, a pager, a build), 0
-///                at the shell's own prompt. `pull_tty_taken`, the probe the
-///                core already asks before it types a command line; a host
-///                that cannot tell says 0, which is how pardes behaved before
-///                the probe existed.
-///
-/// WHAT IS NOT HERE, and why not, because a missing field is a fact about the
-/// core rather than an omission:
-///
-///   exit status  NOT TRACKED ANYWHERE. A shell's death arrives as
-///                `Event.eof`, whose whole handler is `removePane` — the pane
-///                and its serial are gone, so by the time anybody could read
-///                a status file there is no directory to read it in. Reporting
-///                a zero here would be reporting a number the core does not
-///                have. Giving the pane an exit status means keeping the pane
-///                alive past its child, which is a change to what a terminal
-///                pane IS and does not belong in a status file's formatter.
-///   raw/cooked   the draft's `TCSETS` line. The core never sets a termios:
-///                the mode belongs to the program on the far side of the pty,
-///                which sets it for itself and never tells us. There is
-///                nothing to report and nothing to set.
-fn readPtyStatus(p: *Pardes, req: Req, id: usize, pane: *Pane) Reply {
-    const out = p.fs.stage(p.gpa);
-    out.print(p.gpa, "{d:>11} {d:>11} {d:>11} ", .{
-        pane.cols,
-        pane.rows,
-        @intFromBool(p.hostTtyTaken(id)),
-    }) catch {};
-    return staged(p, req);
-}
-
-/// `pty/data`, read side: THE RAW OUTPUT STREAM, as a stream.
-///
-/// FRAMING, which is the one decision here. `event` refuses a read smaller
-/// than one record because half a record is unparseable. Raw pty bytes have no
-/// records: what is in the queue is only "what arrived in one `.output`
-/// event", which is wherever the host's `read(2)` happened to land, so
-/// refusing a short read would be enforcing a boundary that means nothing —
-/// and a reader with a 1 KB buffer would deadlock against a 4 KB arrival
-/// forever. So this hands back as much as the count allows, spanning arrivals,
-/// and keeps the remainder (`Queue.popFront`). That is what `read(2)` on the
-/// pty itself would do.
-///
-/// The OFFSET is ignored, for the same reason `event`'s is: the queue is the
-/// position. And an empty queue is `Status.again` — nothing consumed, ask me
-/// again — which is the whole of how a blocking read works here.
-///
-/// A pane nobody has OPENED this file on has an empty queue by construction
-/// (`notePtyOutput` is gated on the count `open` keeps), so a read that beats
-/// the first byte of output and a read on a pane that never recorded any are
-/// the same cheap answer.
-fn readPtyData(p: *Pardes, req: Req, pf: *PaneFs) Reply {
-    if (pf.pty_out.empty()) return .{ .tag = req.tag, .status = .again };
-    const out = p.fs.stage(p.gpa);
-    while (out.items.len < req.size) {
-        const chunk = pf.pty_out.peek() orelse break;
-        const n = @min(chunk.len, req.size - out.items.len);
-        out.appendSlice(p.gpa, chunk[0..n]) catch break;
-        pf.pty_out.popFront(n);
-    }
-    return .{ .tag = req.tag, .payload = .{ .staged = @intCast(out.items.len) } };
-}
-
-// ===========================================================================
-// WRITE
-// ===========================================================================
-
-fn write(p: *Pardes, req: Req, target: Target) Reply {
-    switch (target) {
-        .top => |f| return switch (f) {
-            // acme(4): text written to `cons` appears in `dir/+Errors`, where
-            // `dir` is the directory the command ran in — acme knows which
-            // from the mount the writer inherited (`x->f->mntdir`, one per
-            // `win`). A FUSE mount is ONE directory for the whole editor, so
-            // the writing process is anonymous and the only defensible owner
-            // is the pane the user is in. A script that wants a specific
-            // pane's errors writes `<id>/errors`, which is unambiguous.
-            .cons => if (appendErrors(p, p.active, req.data)) |took|
-                .{ .tag = req.tag, .written = @intCast(took) }
-            else
-                Reply.fail(req.tag, E.IO),
-            else => Reply.fail(req.tag, E.PERM),
-        },
-        .pane => |t| {
-            const id = p.paneBySerial(t.serial) orelse return Reply.fail(req.tag, E.NOENT);
-            const pane = p.panes[id].?;
-            if (t.file.inPty() and !pane.isTerminal()) return Reply.fail(req.tag, E.NOENT);
-            return switch (t.file) {
-                .addr => writeAddr(p, req, id, pane),
-                .body => writeBody(p, req, id, pane),
-                .ctl => writeCtl(p, req, t.serial),
-                // acme's `data` and `xdata` differ only in what a READ stops
-                // at; the writes are the same code path there and here.
-                .data, .xdata => writeData(p, req, id, pane),
-                .tag => writeTag(p, req, pane),
-                .event => writeEvent(p, req, id),
-                .wrsel => writeWrsel(p, req, id, pane),
-                .errors => if (appendErrors(p, id, req.data)) |took|
-                    .{ .tag = req.tag, .written = @intCast(took) }
-                else
-                    Reply.fail(req.tag, E.IO),
-                .pty_ctl => writePtyCtl(p, req, id),
-                .pty_data => writePtyData(p, req, id),
-                .dir, .rdsel, .pty, .pty_status => Reply.fail(req.tag, E.PERM),
-            };
-        },
-    }
-}
-
-/// THE ONE BODY SPLICE every writing file goes through: replace `[q0, q1)`
-/// with `bytes`, via `file_pane.setContent` — which is where the core diffs
-/// out the insert/delete event records, so a script's edit is reported exactly
-/// once and in exactly the same shape as a keystroke's. One swap per write for
-/// the same reason: two swaps would be two `D`/`I` pairs for one write.
-///
-/// The origin character the records carry is `handle`'s, set once per request
-/// (acme's winlock owner), so nothing here has to know which file it is
-/// serving.
-fn spliceBody(p: *Pardes, id: usize, pane: *Pane, q0: usize, q1: usize, bytes: []const u8) ?usize {
-    const f = fileOf(pane) orelse return null;
-    const take = if (bytes.len == 0) 0 else wholeUtf8(bytes);
-    const lo = @min(q0, f.content.len);
-    const hi = @max(lo, @min(q1, f.content.len));
-    const new = p.gpa.alloc(u8, f.content.len - (hi - lo) + take) catch return null;
-    @memcpy(new[0..lo], f.content[0..lo]);
-    @memcpy(new[lo..][0..take], bytes[0..take]);
-    @memcpy(new[lo + take ..], f.content[hi..]);
-    // acme: `if(w->nomark == FALSE){ seq++; filemark(t->file); }` — `nomark`
-    // is how a script makes a batch of edits one Undo.
-    //
-    // COST, and the reason `nomark` matters more here than it does in acme:
-    // acme's `filemark` is a sequence number on a log-structured, disk-backed
-    // Buffer, so it is O(1). pardes's undo is a SNAPSHOT of the whole body
-    // (`file_pane.pushUndo` compares and then duplicates it), so a script that
-    // appends a line at a time to a megabyte body pays a megabyte per line and
-    // keeps 256 of them. That is exactly the same cost one KEYSTROKE pays on
-    // the same body — this is not a filesystem tax, it is the core's edit
-    // model — but a script can do it ten thousand times a second where a
-    // typist cannot. `nomark` is the documented remedy and the reason acme
-    // gave scripts the verb.
-    if (!p.fs.panes[id].nomark) file_pane.pushUndo(p, pane);
-    file_pane.setContent(p, f, new);
-    return take;
-}
-
-/// acme(4): "Text written to body is always appended; the file offset is
-/// ignored." So `req.off` is deliberately never read here.
-fn writeBody(p: *Pardes, req: Req, id: usize, pane: *Pane) Reply {
-    if (req.data.len == 0) return .{ .tag = req.tag, .written = 0 };
-    // A TERMINAL's body is not a document, it is a program's transcript — and
-    // the only way to put text into a transcript is to TYPE it. So a body
-    // write to a terminal pane is a pty write: `echo ls > $PARDES_FS/3/body`
-    // runs ls in pane 3's shell. That is `win`'s semantics in acme (the shell
-    // reads what you write to its window's body), reached through the effect
-    // the core already has instead of through a pipe.
-    //
-    // Nothing is RECORDED for it: the insert/delete diff lives in
-    // `file_pane.setContent`, and a terminal has no `file` to swap. The
-    // program's output comes back as ordinary `.output` bytes.
-    if (pane.file == null) {
-        const take = wholeUtf8(req.data);
-        p.emitWrite(id, req.data[0..take]);
-        return .{ .tag = req.tag, .written = @intCast(take) };
-    }
-    const at = bodyOf(pane).len;
-    const take = spliceBody(p, id, pane, at, at, req.data) orelse
-        return Reply.fail(req.tag, E.NOMEM);
-    if (!p.fs.panes[id].noscroll) showOffset(pane, at + take);
-    return .{ .tag = req.tag, .written = @intCast(take) };
-}
-
-/// acme's tag is one `Text` and a write appends to all of it. pardes's tag is
-/// PREFIX ++ TAIL: the prefix is chrome the core recomputes every frame (the
-/// path, the dirty marker, the builtin words, the alignment gap), so bytes
-/// appended to it would be gone by the next render. A tag write therefore
-/// appends to the TAIL — which is the part that is a buffer, and the part a
-/// script means when it writes ` Undo` into a tag.
-///
-/// The tail is a fixed one-line buffer (`Pane.tag_tail`), so a write that does
-/// not fit is short, and one with no room at all is ENOSPC rather than a zero
-/// count the writer would retry forever.
-fn writeTag(p: *Pardes, req: Req, pane: *Pane) Reply {
-    if (req.data.len == 0) return .{ .tag = req.tag, .written = 0 };
-    // the laid-out default tail becomes real bytes on first touch, exactly as
-    // it does when you click into the tag
-    p.seedTail(pane);
-    const room = pane.tag_tail.len - pane.tag_tail_len;
-    if (room == 0) return Reply.fail(req.tag, E.NOSPC);
-    const take = wholeUtf8(req.data[0..@min(req.data.len, room)]);
-    @memcpy(pane.tag_tail[pane.tag_tail_len..][0..take], req.data[0..take]);
-    pane.tag_tail_len += take;
-    pane.tag_init = true;
-    return .{ .tag = req.tag, .written = @intCast(take) };
-}
-
-/// acme(4): text written to `data` "replaces the characters addressed by the
-/// addr file and sets the address to the null string at the end of the written
-/// text". The file offset is ignored.
-fn writeData(p: *Pardes, req: Req, id: usize, pane: *Pane) Reply {
-    if (fileOf(pane) == null) return Reply.fail(req.tag, E.INVAL);
-    const pf = &p.fs.panes[id];
-    clampAddr(pf, bodyOf(pane).len);
-    const q0: usize = pf.addr.q0;
-    const q1: usize = @max(q0, @as(usize, pf.addr.q1));
-    const before = dotOf(pane);
-    // acme's winlock(w, 'F'): everything but body and tag is "an action
-    // through the window's other files".
-    const take = spliceBody(p, id, pane, q0, q1, req.data) orelse
-        return Reply.fail(req.tag, E.NOMEM);
-    setDot(pane, shiftBy(before, clip(q0), clip(q1 - q0), clip(take)));
-    pf.addr = .{ .q0 = clip(q0 + take), .q1 = clip(q0 + take) };
-    if (!pf.noscroll) showOffset(pane, q0 + take);
-    return .{ .tag = req.tag, .written = @intCast(take) };
-}
-
-/// acme's `wrsel` cuts the selection when the file is OPENED and inserts each
-/// write at a running point after it (`w->wrselrange`). Same result, no
-/// open-time mutation: each write REPLACES the selection, and because the
-/// selection is left collapsed just after the inserted text, a second write
-/// appends to the first exactly as `wrselrange` does. The only difference is
-/// what an open and close with NO write does — acme has already emptied the
-/// selection by then, this leaves the pane untouched. A filesystem that edits
-/// your document when you `stat` it is a filesystem you cannot explore.
-///
-/// acme also forces `nomark` for the file's lifetime so the whole stream is
-/// one Undo. That needs open-time state we do not keep; a script that wants it
-/// writes `nomark` to `ctl`, which is the same button with a name on it.
-fn writeWrsel(p: *Pardes, req: Req, id: usize, pane: *Pane) Reply {
-    if (fileOf(pane) == null) return Reply.fail(req.tag, E.INVAL);
-    const d = dotOf(pane);
-    const q0: usize = d.q0;
-    const q1: usize = @max(q0, @as(usize, d.q1));
-    const take = spliceBody(p, id, pane, q0, q1, req.data) orelse
-        return Reply.fail(req.tag, E.NOMEM);
-    setDot(pane, .{ .q0 = clip(q0 + take), .q1 = clip(q0 + take) });
-    return .{ .tag = req.tag, .written = @intCast(take) };
-}
-
-/// acme's `xfidwrite` QWaddr. Two failures, and acme has two error strings for
-/// them: `Ebadaddr` (the parser stopped before the end of the expression) and
-/// `Eaddr` (it parsed but did not evaluate — out of range, or no match). A
-/// filesystem has one channel for "no", so both are EINVAL.
-fn writeAddr(p: *Pardes, req: Req, id: usize, pane: *Pane) Reply {
-    const pf = &p.fs.panes[id];
-    const text = bodyOf(pane);
-    clampAddr(pf, text.len);
-    // acme's parser stops at a newline of its own accord (`\n` reaches the
-    // `default:` arm), which is what lets `echo '/foo/' > addr` work from a
-    // shell. Trimming says the same thing without threading it through every
-    // arm of the state machine.
-    const expr = std.mem.trimEnd(u8, req.data, "\n");
-    var a: Addr = .{ .text = text, .lim = pf.limit, .expr = expr };
-    const r = a.address(pf.addr) orelse return Reply.fail(req.tag, E.INVAL);
-    if (a.i < expr.len) return Reply.fail(req.tag, E.INVAL);
-    pf.addr = r;
-    return .{ .tag = req.tag, .written = @intCast(req.data.len) };
-}
-
-// ===========================================================================
-// THE ADDRESS LANGUAGE — acme's addr.c, byte-addressed.
-// ===========================================================================
-
-/// mvzr PANICS on a pattern that ends inside an escape: `parseCharSet` slices
-/// `in[i+1..]` and `valueFor` indexes `[0]` of it, so a trailing backslash is
-/// an out-of-bounds read rather than a compile failure (pardes.zig's
-/// `applySelRegex` carries the same warning about the prefix `[^\`). A live
-/// typist can only reach that by accident; a SCRIPT's regex is untrusted
-/// input, so it is screened here before the engine ever sees it.
-fn safePattern(pat: []const u8) bool {
-    var i: usize = 0;
-    while (i < pat.len) : (i += 1) {
-        if (pat[i] != '\\') continue;
-        if (i + 1 >= pat.len) return false;
-        i += 1;
-    }
-    return true;
-}
-
-/// THE ADDRESS PARSER, in acme's shape: one left-to-right pass with three
-/// pieces of state — a running range, a DIRECTION (`+`/`-`/none) and a SIZE
-/// (line or character) — recursing once per `,` or `;`.
-///
-/// What is gone is the C. acme reads the expression through a `getc` callback
-/// over a `Rune*` so one parser can serve both the filesystem and the Edit
-/// language; it reports failure through two out-parameters (`evalp` for "did
-/// not evaluate", `qp` for "stopped here") because it cannot return three
-/// things; and it grows the regex pattern with `runerealloc` one rune at a
-/// time. Here the expression is a slice, the cursor is a field, a pattern is a
-/// subslice of the expression, and "did not evaluate" is `null`.
-const Addr = struct {
-    text: []const u8,
-    /// `limit=addr`: regex context searches are confined to this. acme applies
-    /// it FORWARDS only, and so does this.
-    lim: ?PaneFs.Range,
-    expr: []const u8,
-    i: usize = 0,
-    /// One frame per `,` or `;`. acme recurses without a bound, which is fine
-    /// when the expression came from a person typing into a tag and is a
-    /// STACK OVERFLOW when it came from a script: `,,,,,...` a hundred
-    /// thousand deep is one write(2). A compound address deeper than this is
-    /// not an address anybody meant.
-    depth: u8 = 0,
-
-    const max_depth = 32;
-    const Size = enum { char, line };
-
-    /// acme's `address()`. `ar` is what `.` means — and `xfidwrite` passes
-    /// `w->addr`, NOT the user's selection, so `.` is the CURRENT ADDRESS and
-    /// `addr=dot` is the only door the selection comes in by. (acme(4)
-    /// describes the language as "the format understood by button 3", where
-    /// `.` is dot; the code is the authority and this follows the code.)
-    fn address(a: *Addr, ar_in: PaneFs.Range) ?PaneFs.Range {
-        const start = a.i;
-        var ar = ar_in;
-        var r = ar_in;
-        var dir: u8 = 0;
-        var size: Size = .line;
-        var c: u8 = 0;
-        while (a.i < a.expr.len) {
-            const prevc = c;
-            c = a.expr[a.i];
-            a.i += 1;
-            switch (c) {
-                ',', ';' => {
-                    // `;` differs from `,` in one way: it makes the RIGHT side
-                    // relative to the left one.
-                    if (c == ';') ar = r;
-                    if (prevc == 0) r.q0 = 0; // lhs defaults to 0
-                    if (a.i >= a.expr.len) {
-                        r.q1 = clip(a.text.len); // rhs defaults to $
-                    } else {
-                        if (a.depth >= max_depth) return null;
-                        a.depth += 1;
-                        const nr = a.address(ar) orelse return null;
-                        a.depth -= 1;
-                        r.q1 = nr.q1;
-                    }
-                    return r;
-                },
-                '+', '-' => {
-                    // a pending `+`/`-` with no count of its own means one
-                    // line, unless what follows is itself an operand
-                    if (prevc == '+' or prevc == '-') {
-                        const nc = if (a.i < a.expr.len) a.expr[a.i] else 0;
-                        if (nc != '#' and nc != '/' and nc != '?')
-                            r = a.number(r, 1, prevc, .line) orelse return null;
-                    }
-                    dir = c;
-                },
-                '.', '$' => {
-                    // both are only meaningful as the FIRST character of a
-                    // (sub)expression; anywhere else they end the parse
-                    if (a.i != start + 1) {
-                        a.i -= 1;
-                        return r;
-                    }
-                    r = if (c == '.') ar else .{ .q0 = clip(a.text.len), .q1 = clip(a.text.len) };
-                    dir = if (a.i < a.expr.len) '+' else 0;
-                },
-                '#', '0'...'9' => {
-                    var digit = c;
-                    if (c == '#') {
-                        if (a.i >= a.expr.len or a.expr[a.i] < '0' or a.expr[a.i] > '9') {
-                            a.i -= 1;
-                            return r;
-                        }
-                        digit = a.expr[a.i];
-                        a.i += 1;
-                        size = .char;
-                    }
-                    var n: u64 = digit - '0';
-                    while (a.i < a.expr.len) : (a.i += 1) {
-                        const d = a.expr[a.i];
-                        if (d < '0' or d > '9') break;
-                        n = @min(n * 10 + (d - '0'), std.math.maxInt(u32));
-                    }
-                    r = a.number(r, @intCast(n), dir, size) orelse return null;
-                    dir = 0;
-                    size = .line;
-                },
-                '/', '?' => {
-                    const back = c == '?';
-                    r = a.regexp(r, a.pattern(c), back) orelse return null;
-                    dir = 0;
-                    size = .line;
-                },
-                else => {
-                    a.i -= 1;
-                    return r;
-                },
-            }
-        }
-        // a trailing `+` or `-` with nothing after it: one line that way
-        if (dir != 0) r = a.number(r, 1, dir, .line) orelse return null;
-        return r;
-    }
-
-    /// The pattern between the delimiters, with the backslash of an escape
-    /// KEPT (it belongs to the regex engine, not to this parser).
-    ///
-    /// DIVERGENCE: acme closes both `/re/` and `?re?` on a `/` — its scanner
-    /// has no `case '?'` at all, so `?foo?` yields the pattern `foo?`, which
-    /// as a regex means `fo` plus an optional `o`. That is a bug you can only
-    /// find by reading addr.c. Here the OPENING delimiter closes.
-    fn pattern(a: *Addr, delim: u8) []const u8 {
-        const s = a.i;
-        while (a.i < a.expr.len) {
-            const c = a.expr[a.i];
-            if (c == '\n') break;
-            a.i += 1;
-            if (c == '\\') {
-                if (a.i < a.expr.len) a.i += 1;
-                continue;
-            }
-            if (c == delim) return a.expr[s .. a.i - 1];
-        }
-        return a.expr[s..a.i];
-    }
-
-    /// acme's `number()`, byte for byte — including its two oddities: a `-`
-    /// count from offset 0 wraps to the END of the file, and `:1-1` is legal
-    /// (it means `#0`) while `:1-2` is an error.
-    fn number(a: *Addr, r_in: PaneFs.Range, n: u32, dir: u8, size: Size) ?PaneFs.Range {
-        var r = r_in;
-        if (size == .char) {
-            var off: i64 = n;
-            if (dir == '+') {
-                off = @as(i64, r.q1) + n;
-            } else if (dir == '-') {
-                if (r.q0 == 0 and n > 0) r.q0 = clip(a.text.len);
-                off = @as(i64, r.q0) - n;
-            }
-            if (off < 0 or off > @as(i64, @intCast(a.text.len))) return null;
-            // BYTES, and a byte offset can land inside a grapheme where acme's
-            // rune offset never could. Clamped to the boundary at or before
-            // it, which is the rule every other offset in pardes follows.
-            const g = clip(modal.graphemeStart(a.text, @intCast(off)));
-            return .{ .q0 = g, .q1 = g };
-        }
-        var line: i64 = n;
-        var q0: usize = r.q0;
-        var q1: usize = r.q1;
-        switch (dir) {
-            '-' => {
-                if (q0 < a.text.len) while (q0 > 0 and a.text[q0 - 1] != '\n') {
-                    q0 -= 1;
-                };
-                q1 = q0;
-                while (line > 0 and q0 > 0) {
-                    if (a.text[q0 - 1] == '\n') {
-                        line -= 1;
-                        q1 = q0;
-                    }
-                    q0 -= 1;
-                }
-                if (line > 1) return null;
-                while (q0 > 0 and a.text[q0 - 1] != '\n') q0 -= 1;
-                return .{ .q0 = clip(q0), .q1 = clip(q1) };
-            },
-            '+' => {
-                if (q1 > 0) while (q1 < a.text.len and a.text[q1 - 1] != '\n') {
-                    q1 += 1;
-                };
-                q0 = q1;
-            },
-            else => {
-                q0 = 0;
-                q1 = 0;
-            },
-        }
-        while (line > 0 and q1 < a.text.len) {
-            const ch = a.text[q1];
-            q1 += 1;
-            if (ch == '\n' or q1 == a.text.len) {
-                line -= 1;
-                if (line > 0) q0 = q1;
-            }
-        }
-        if (line > 0) return null;
-        return .{ .q0 = clip(q0), .q1 = clip(q1) };
-    }
-
-    /// acme's `regexp()`. Forward runs from the END of the running range to
-    /// the limit (`limit=addr`, else the end of the file); backward runs from
-    /// its START back to the beginning.
-    ///
-    /// The engine is mvzr, the one `%s` and the selection previews already
-    /// use. Two of its properties come along and cannot be fixed here: `^` and
-    /// `$` assert against the SLICE being searched rather than against a line,
-    /// and `.` matches a newline like any other byte. Both are already waived
-    /// in pardes.zig; an address that needs a line anchor matches `\n`.
-    fn regexp(a: *Addr, r: PaneFs.Range, pat: []const u8, back: bool) ?PaneFs.Range {
-        // acme reuses the LAST compiled expression for an empty pattern
-        // (`rxnull`). There is no such global here — one more piece of hidden
-        // state for a script to guess wrong about — so `//` is not an address.
-        if (pat.len == 0 or !safePattern(pat)) return null;
-        const re = mvzr.compile(pat) orelse return null;
-        if (back) {
-            const hi = @min(@as(usize, r.q0), a.text.len);
-            var best: ?mvzr.Match = null;
-            var at: usize = 0;
-            while (at < hi) {
-                const m = re.matchPos(at, a.text[0..hi]) orelse break;
-                best = m;
-                at = if (m.end > m.start) m.end else m.end + 1;
-            }
-            const m = best orelse return null;
-            return .{ .q0 = clip(m.start), .q1 = clip(m.end) };
-        }
-        const hi = if (a.lim) |l| @min(@as(usize, l.q1), a.text.len) else a.text.len;
-        const from = @min(@as(usize, r.q1), hi);
-        const m = re.match(a.text[from..hi]) orelse return null;
-        return .{ .q0 = clip(from + m.start), .q1 = clip(from + m.end) };
-    }
-};
-
-// ===========================================================================
-// CTL VERBS — acme's xfidctlwrite.
-// ===========================================================================
-
-/// The verbs that mean something here. acme matches PREFIXES with `strncmp`
-/// and advances by the matched length, which is why its arms have to be
-/// ordered `delete` before `del`, `nomark` before `mark`, `noscroll` before
-/// `scroll` — get that ordering wrong and a verb is silently truncated into a
-/// different one. Splitting on the newline the man page already requires and
-/// matching WHOLE tokens makes that class of bug unrepresentable.
-const Verb = enum {
-    @"addr=dot",
-    clean,
-    cleartag,
-    del,
-    delete,
-    dirty,
-    @"dot=addr",
-    get,
-    @"limit=addr",
-    mark,
-    nomark,
-    noscroll,
-    put,
-    scroll,
-    show,
-};
-
-/// ...and the ones acme has that pardes REFUSES. Loudly, because a silently
-/// accepted no-op is the worse failure: the script believes it holds the lock.
-///
-///   menu / nomenu — acme maintains `Undo Redo Put` in the LEFT HALF of the
-///     tag and these switch that off. pardes's tag prefix is computed chrome
-///     (the path, the dirty marker, the pane's own builtins) with no halves
-///     and no writable menu region, so there is nothing to switch.
-///   dump / dumpdir — acme's dump file stores a COMMAND that recreates a
-///     window. pardes's dump (src/dump.zig) stores the window's TEXT, so a
-///     recreation command has nowhere to be kept and nothing to run it.
-///   font — the face belongs to the SHELL, not the core: on a tty it is the
-///     terminal emulator's and in the browser it is the page's. The `Font`
-///     builtin only ASKS; a ctl verb that looked like it set one would be a
-///     lie on three of the four platforms.
-///   lock / unlock — acme's exclusive-use lock is a `QLock` held against a 9P
-///     fid. There is no fid here and the core is single-threaded, so a lock
-///     would promise a mutual exclusion nothing can violate and nothing
-///     provides.
-const refused_verbs = [_][]const u8{ "dump", "dumpdir", "font", "lock", "menu", "nomenu", "unlock" };
-
-fn verbIs(line: []const u8, word: []const u8) bool {
-    if (!std.mem.startsWith(u8, line, word)) return false;
-    return line.len == word.len or line[word.len] == ' ';
-}
-
-/// acme's ctl write is NOT atomic: it applies verbs until one fails, then
-/// answers `Ebadctl` with a count of the bytes it got through, so
-/// `dirty\nbogus\n` leaves the window dirty and the write "fails". A short
-/// count on a Linux write is not read as "the rest failed" by anybody, so the
-/// only honest translation is all-or-nothing: validate every verb first, then
-/// apply. `ctlVerb` answers the same yes/no in both passes.
-fn writeCtl(p: *Pardes, req: Req, serial: u32) Reply {
-    for ([2]bool{ false, true }) |apply| {
-        // `del`'s guard is the one predicate that reads state EARLIER VERBS IN
-        // THE SAME WRITE change, so the validation pass has to model it or the
-        // two passes disagree: `clean\ndel` (acme's own idiom, and what
-        // examples/acmefs/life.py sends on the way out) would fail validation
-        // while `dirty\ndel` would pass it and then fail half-applied.
-        var dirty = if (p.paneBySerial(serial)) |id| dirtyOf(p.panes[id].?) else false;
-        var it = std.mem.splitScalar(u8, req.data, '\n');
-        while (it.next()) |raw| {
-            const line = std.mem.trim(u8, raw, " \t\r");
-            if (line.len == 0) continue;
-            // `del` and `delete` remove the pane, and the verbs after them in
-            // the same write have nothing left to act on.
-            const live = p.paneBySerial(serial) orelse if (apply) break else return Reply.fail(req.tag, E.NOENT);
-            if (!ctlVerb(p, live, line, apply, &dirty)) return Reply.fail(req.tag, E.INVAL);
-        }
-    }
-    return .{ .tag = req.tag, .written = @intCast(req.data.len) };
-}
-
-/// One verb. `apply` false is the validation pass and must change nothing but
-/// `dirty`, which both passes advance identically so that `del`'s guard sees
-/// the same answer in each.
-fn ctlVerb(p: *Pardes, id: usize, line: []const u8, apply: bool, dirty: *bool) bool {
-    const pane = p.panes[id] orelse return false;
-    const pf = &p.fs.panes[id];
-
-    // The one verb with an argument. acme rejects a name containing any
-    // character `<= ' '` and an empty one; so does this.
-    if (verbIs(line, "name")) {
-        if (line.len <= 5) return false;
-        const name = std.mem.trim(u8, line[5..], " \t");
-        if (name.len == 0) return false;
-        for (name) |c| if (c <= ' ') return false;
-        if (!apply) return true;
-        const f = fileOf(pane) orelse return true; // a terminal has no name to set
-        const copy = p.gpa.dupe(u8, name) catch return true;
-        p.gpa.free(f.path);
-        f.path = copy;
-        return true;
-    }
-    for (refused_verbs) |w| if (verbIs(line, w)) return false;
-
-    const v = std.meta.stringToEnum(Verb, line) orelse return false;
-    // acme: `del` is "delete, but check dirty", `delete` is "delete for sure".
-    // pardes's `Del` builtin is unconditional (the guard there is the `*` you
-    // can see in the tag), so `del` gets acme's guard here and `delete` does
-    // not — which is the whole difference between the two words.
-    if (v == .del and dirty.*) return false;
-    switch (v) {
-        .dirty => dirty.* = true,
-        .clean, .get, .put => dirty.* = false,
-        else => {},
-    }
-    if (!apply) return true;
-
-    switch (v) {
-        .@"addr=dot" => pf.addr = dotOf(pane),
-        .@"dot=addr" => {
-            clampAddr(pf, bodyOf(pane).len);
-            setDot(pane, pf.addr);
-        },
-        .@"limit=addr" => {
-            clampAddr(pf, bodyOf(pane).len);
-            pf.limit = pf.addr;
-        },
-        // acme marks the window clean by resetting the file's sequence number;
-        // pardes's equivalent is "the revision on screen IS the saved one".
-        .clean => if (fileOf(pane)) |f| {
-            f.saved_revision = f.revision;
-        },
-        .dirty => if (fileOf(pane)) |f| {
-            f.saved_revision = f.revision -% 1;
-        },
-        // acme: "wipe tag right of bar". pardes's bar is the boundary between
-        // the computed prefix and the editable tail, so this empties the tail
-        // — and leaves it SEEDED, or the next render would put the default
-        // builtins straight back.
-        .cleartag => {
-            pane.tag_tail_len = 0;
-            pane.tag_init = true;
-        },
-        .del, .delete => _ = p.executeBuiltinLine(id, "Del"),
-        .put => _ = p.executeBuiltinLine(id, "Save"),
-        // acme's `get`: "Equivalent to the Get interactive command with no
-        // arguments". pardes has no such builtin, so this is what Get would
-        // be — the same synchronous read `file_pane.open` does, through the
-        // same content swap, with an undo point in front of it so a script
-        // cannot discard your edits irrecoverably.
-        .get => if (fileOf(pane)) |f| {
-            if (output_pane.fileTraits(f.output).saves) {
-                if (look.readFile(p.gpa, f.path)) |bytes| {
-                    file_pane.pushUndo(p, pane);
-                    file_pane.setContent(p, f, bytes);
-                    f.saved_revision = f.revision;
-                } else |_| {}
-            }
-        },
-        // acme's `mark` both cancels `nomark` AND pushes a mark, so the edits
-        // made while nomark was on stay one Undo and the next one starts fresh.
-        .mark => {
-            pf.nomark = false;
-            file_pane.pushUndo(p, pane);
-        },
-        .nomark => pf.nomark = true,
-        .noscroll => pf.noscroll = true,
-        .scroll => pf.noscroll = false,
-        .show => showOffset(pane, dotOf(pane).q0),
-    }
-    return true;
-}
-
-// ===========================================================================
-// `pty/ctl` VERBS — the ioctls, as words.
-// ===========================================================================
-
-/// THE WHOLE GRAMMAR, one verb per line, blank lines ignored, each line
-/// trimmed and split on blanks:
-///
-///   winsize <cols> <rows>   two decimals, each 1..65535
-///   sig <NAME>              one of INT, TERM, HUP, QUIT, KILL
-///   exec                    no argument
-///
-/// An enum and an exhaustive switch for the same reason `Verb` above is one:
-/// adding a word is a compile error until it is handled, and matching WHOLE
-/// tokens makes acme's ordering bug (`del` shadowing `delete`) unrepresentable.
-const PtyVerb = enum { winsize, sig, exec };
-
-/// A `winsize` field.
-///
-/// ZERO IS REFUSED. `TIOCSWINSZ` reads a zero as "unknown", so `winsize 0 24`
-/// would not be a narrow terminal, it would be a terminal of no known width —
-/// which is what a program sees when nobody has set a size at all, and never
-/// something a script asked for on purpose.
-fn ptyDimension(word: []const u8) ?u16 {
-    if (word.len == 0 or word.len > 5) return null;
-    for (word) |c| if (c < '0' or c > '9') return null;
-    const n = std.fmt.parseInt(u16, word, 10) catch return null;
-    return if (n == 0) null else n;
-}
-
-/// `sig`'s argument: the five names, upper case, spelled the way `kill -INT`
-/// and `trap` spell them.
-///
-/// NOT A NUMBER, and not `SIGINT` either. A number would be one platform's
-/// number in a tree meant to be read from another machine, and the core has no
-/// signal numbers of its own (see `pardes.PtySignal`); the `SIG` prefix has
-/// been optional to `kill` since 1988 and carrying it here would mean
-/// accepting both spellings or refusing the shorter one people type.
-fn ptySignalNamed(word: []const u8) ?pardes.PtySignal {
-    if (std.mem.eql(u8, word, "INT")) return .int;
-    if (std.mem.eql(u8, word, "TERM")) return .term;
-    if (std.mem.eql(u8, word, "HUP")) return .hup;
-    if (std.mem.eql(u8, word, "QUIT")) return .quit;
-    if (std.mem.eql(u8, word, "KILL")) return .kill;
-    return null;
-}
-
-/// VALIDATE EVERY VERB, THEN APPLY — `writeCtl`'s shape, for `writeCtl`'s
-/// reason: acme applies verbs until one fails and answers with a byte count of
-/// how far it got, and nothing on Linux reads a short count on a `write(2)` as
-/// "the rest failed", so all-or-nothing is the only honest translation.
-///
-/// Simpler than `writeCtl` in exactly one way, and it is worth saying why the
-/// two passes need no shared bookkeeping here: no verb in this file can remove
-/// the pane or change what a later verb in the same write would decide. `ctl`
-/// has `del`, whose guard reads state `clean` sets, so its passes have to
-/// model each other; these three are independent, so the validation pass is a
-/// pure predicate.
-fn writePtyCtl(p: *Pardes, req: Req, id: usize) Reply {
-    for ([2]bool{ false, true }) |apply| {
-        var it = std.mem.splitScalar(u8, req.data, '\n');
-        while (it.next()) |raw| {
-            const line = std.mem.trim(u8, raw, " \t\r");
-            if (line.len == 0) continue;
-            if (!ptyVerb(p, id, line, apply)) return Reply.fail(req.tag, E.INVAL);
-        }
-    }
-    return .{ .tag = req.tag, .written = @intCast(req.data.len) };
-}
-
-/// One `pty/ctl` verb. `apply` false is the validation pass and must change
-/// nothing whatsoever — not even a queued effect, which is the only state
-/// these three touch.
-fn ptyVerb(p: *Pardes, id: usize, line: []const u8, apply: bool) bool {
-    const pane = p.panes[id] orelse return false;
-    var words = std.mem.tokenizeAny(u8, line, " \t");
-    // the line is non-empty and trimmed, so there is always a first token
-    const v = std.meta.stringToEnum(PtyVerb, words.next() orelse return false) orelse return false;
-    switch (v) {
-        // `TIOCSWINSZ`, and DELIBERATELY NOTHING ELSE — in particular not the
-        // core's own grid.
-        //
-        // A pane's grid size is not a free variable here: `Pardes.sync` derives
-        // `pane.cols`/`pane.rows` from the pane's RECTANGLE at the end of every
-        // update, so a script that wrote them would have them overwritten
-        // before its write returned — and `sync` would then emit a second
-        // `resize_pty` putting the pty back to the layout's size, so the verb
-        // would visibly undo itself. Telling only the pty leaves the script's
-        // size in force until the pane's rectangle actually changes, which for
-        // a layout nobody is dragging is for good.
-        //
-        // Which is also why a `winsize` write is not read back from `status`:
-        // `status` reports the grid the editor computed, the only size the core
-        // has. What a program was last TOLD is remembered by the pty, and the
-        // pty will not say.
-        .winsize => {
-            const cols = ptyDimension(words.next() orelse return false) orelse return false;
-            const rows = ptyDimension(words.next() orelse return false) orelse return false;
-            if (words.next() != null) return false;
-            if (!apply) return true;
-            p.emit(.{ .resize_pty = .{ .pane = @intCast(id), .cols = cols, .rows = rows } });
-        },
-        // The one genuinely new capability in the whole `pty/` directory:
-        // there is no `kill` anywhere in the host seam until this effect.
-        .sig => {
-            const which = ptySignalNamed(words.next() orelse return false) orelse return false;
-            if (words.next() != null) return false;
-            if (!apply) return true;
-            p.emit(.{ .signal_pty = .{ .pane = @intCast(id), .sig = which } });
-        },
-        // RESPAWN THIS PANE'S SHELL, and NO ARGUMENT — which is a limit of the
-        // effect and not a choice made here. `Effect.spawn` carries a pane and
-        // a cwd (pardes.zig) and has nowhere to put an argv; the host answers
-        // it by forking `core.shellBin()`, and the argv it builds is the
-        // prompt-integration rc files, not something a caller supplies. So
-        // `exec` respawns the configured shell in the pane's own directory,
-        // and `exec /bin/sh` is EINVAL — refused loudly rather than accepted
-        // and silently ignored, which is the failure a script cannot see.
-        //
-        // Giving it an argv means widening the effect and teaching four hosts
-        // to exec something the user did not configure, which is a change to
-        // what a terminal pane IS and wants its own argument.
-        //
-        // The host reaps the old child and forks a new one (every `push_spawn`
-        // opens by doing exactly that, because the core has no close effect).
-        // The GRID is not cleared: a terminal's body is a transcript, and the
-        // transcript of the shell that just died is the thing a script would
-        // want to read afterwards.
-        .exec => {
-            if (words.next() != null) return false;
-            if (!apply) return true;
-            p.emit(.{ .spawn = .{ .pane = @intCast(id), .cwd = .from(pane.cwdSlice()) } });
-        },
-    }
-    return true;
-}
-
-/// `pty/data`, write side: TYPE AT THE PROGRAM.
-///
-/// Identical to what a `body` write to a terminal already does (`writeBody`),
-/// and that is the point of the name rather than a duplication: `body` is a
-/// pty write because a transcript can only be written by typing, `pty/data` is
-/// a pty write because it IS the pty. A script that knows it is talking to a
-/// terminal says so; one that is generic over panes writes `body`.
-///
-/// The offset is ignored — a stream has no offsets — and the count is short at
-/// a character boundary exactly as every other write here is, so a caller
-/// whose buffer was split mid-sequence by the kernel's `max_write` retries the
-/// tail instead of having it dropped.
-fn writePtyData(p: *Pardes, req: Req, id: usize) Reply {
-    if (req.data.len == 0) return .{ .tag = req.tag, .written = 0 };
-    const take = wholeUtf8(req.data);
-    p.emitWrite(id, req.data[0..take]);
-    return .{ .tag = req.tag, .written = @intCast(take) };
-}
-
-// ===========================================================================
-// EVENT WRITE-BACK — acme's xfideventwrite.
-// ===========================================================================
-
-const EventRecord = struct { action: Action, q0: u32, q1: u32 };
-
-/// `{origin}{type}{q0} {q1}\n`, acme's `xfideventwrite` parse: two characters,
-/// two blank-separated decimals, a newline. Everything a full record carries
-/// after that — the flag, the count, the text — is omitted on the way back in,
-/// which is what acme(4) means by "with the flag, count, and text omitted".
-///
-/// acme walks this with `strtoul`, pointer arithmetic and `goto Rescue`; here
-/// the failure is `null` and the position stays in the struct, so the caller
-/// can tell "ran out cleanly" from "stopped on garbage" by looking at `i`.
-const EventReader = struct {
-    data: []const u8,
-    i: usize = 0,
-
-    fn next(er: *EventReader) ?EventRecord {
-        if (er.i >= er.data.len) return null;
-        var i = er.i;
-        if (i + 2 > er.data.len) return null;
-        // acme stores the first character as `w->owner` (with a
-        // `/* disgusting */` beside it) so later records inherit whatever the
-        // writer claimed. Read and dropped here — see `writeEvent`.
-        i += 1;
-        const action = Action.fromChar(er.data[i]) orelse return null;
-        i += 1;
-        const q0 = scanNumber(er.data, &i) orelse return null;
-        const q1 = scanNumber(er.data, &i) orelse return null;
-        while (i < er.data.len and er.data[i] == ' ') i += 1;
-        if (i >= er.data.len or er.data[i] != '\n') return null;
-        er.i = i + 1;
-        return .{ .action = action, .q0 = q0, .q1 = q1 };
-    }
-};
-
-fn scanNumber(data: []const u8, i: *usize) ?u32 {
-    while (i.* < data.len and data[i.*] == ' ') i.* += 1;
-    const s = i.*;
-    var n: u64 = 0;
-    while (i.* < data.len and data[i.*] >= '0' and data[i.*] <= '9') : (i.* += 1)
-        n = @min(n * 10 + (data[i.*] - '0'), std.math.maxInt(u32));
-    if (i.* == s) return null;
-    return @intCast(n);
-}
-
-/// Writing a record back PERFORMS the action it names, "exactly as it would
-/// have been if the event file had not been open" (acme(4)). This is the
-/// documented remote-control door and the point of the whole suppression rule:
-/// a script reads an `X` record, decides the text is not one of its own tag
-/// commands, and hands it back for pardes to run.
-///
-/// It is also, deliberately, arbitrary code execution — an `X` record is an
-/// Exec — which is why the mount is 0700 under the user's runtime directory.
-///
-/// NOTHING in the write applies unless all of it parses: acme validates each
-/// record just before executing it and leaves the earlier ones done, which
-/// makes a malformed batch half-applied and unrepeatable.
-fn writeEvent(p: *Pardes, req: Req, id: usize) Reply {
-    const pane0 = p.panes[id] orelse return Reply.fail(req.tag, E.NOENT);
-    const serial = pane0.serial;
-    {
-        const body = bodyOf(pane0);
-        const tag = tagOf(p, pane0);
-        var check: EventReader = .{ .data = req.data };
-        while (check.next()) |r| {
-            switch (r.action) {
-                // acme accepts only `xXlL` on the way back in. A `D` or an `I`
-                // is a REPORT, not a request; writing one back would mean
-                // "pretend the user typed this", which nothing implements and
-                // acme's switch rejects with `Ebadevent`.
-                .body_look, .tag_look, .body_exec, .tag_exec => {},
-                else => return Reply.fail(req.tag, E.INVAL),
-            }
-            // lower case is the tag, upper case the body — how a reader tells
-            // the two texts apart with no extra field
-            const n = if (r.action.onTag()) tag.len else body.len;
-            if (r.q0 > r.q1 or r.q1 > n) return Reply.fail(req.tag, E.INVAL);
-        }
-        if (check.i != req.data.len) return Reply.fail(req.tag, E.INVAL);
-    }
-    // acme(4): `F` is "actions through the window's other files", which is
-    // exactly what this is, and `handle` has already set it. acme takes the
-    // origin from the RECORD instead (`w->owner = *p++`, with a
-    // `/* disgusting */` beside it), so a writer can attribute its own action
-    // to the keyboard; the character is parsed here and dropped, because a
-    // record saying where it came from is worth nothing if the sender picks.
-    var run: EventReader = .{ .data = req.data };
-    while (run.next()) |r| {
-        // an earlier action in this same write may have deleted the pane
-        const now = p.paneBySerial(serial) orelse break;
-        const pane = p.panes[now].?;
-        const whole = if (r.action.onTag()) tagOf(p, pane) else bodyOf(pane);
-        const lo = @min(@as(usize, r.q0), whole.len);
-        const hi = @max(lo, @min(@as(usize, r.q1), whole.len));
-        // the action can replace the very text it is reading from
-        const text = p.scratch.allocator().dupe(u8, whole[lo..hi]) catch continue;
-        switch (r.action) {
-            .body_exec, .tag_exec => _ = p.execute(now, text),
-            .body_look, .tag_look => p.lookAt(now, text),
-            else => unreachable,
-        }
-    }
-    return .{ .tag = req.tag, .written = @intCast(req.data.len) };
-}
-
-// ===========================================================================
-// +Errors — acme's `errorwin`.
-// ===========================================================================
-
-/// acme(4): writing to `errors` "appends to the body of the dir/+Errors
-/// window, where dir is the directory currently named in the tag. The window
-/// is created if necessary, but not until text is actually written."
-///
-/// One buffer per DIRECTORY, not per pane — which is why a search for an
-/// existing one matches on the dirname and not on the writer. Answers HOW
-/// MANY BYTES WERE TAKEN, or null for failure.
-///
-/// The count matters because the append goes through `spliceBody`, which stops
-/// at a whole-character boundary: the kernel splits a large `write(2)` at
-/// `max_write` wherever it lands, so a multi-byte character straddling that
-/// boundary must be reported short and retried by the writer's libc, exactly
-/// as `body` and `data` do. Acknowledging the whole buffer would drop it.
-fn appendErrors(p: *Pardes, id: usize, text: []const u8) ?usize {
-    if (text.len == 0) return 0;
-    const pane = p.panes[id] orelse return null;
-    const dir = dirOf(pane);
-    for (p.panes, 0..) |slot, i| {
-        const q = slot orelse continue;
-        const qf = fileOf(q) orelse continue;
-        const o = qf.output orelse continue;
-        if (std.meta.activeTag(o.from) != .errors) continue;
-        if (!std.mem.eql(u8, std.fs.path.dirname(qf.path) orelse "", dir)) continue;
-        return spliceBody(p, i, q, qf.content.len, qf.content.len, text);
-    }
-    const free = p.freeSlot() orelse return null;
-    const content = p.gpa.dupe(u8, text) catch return null;
-    const np = output_pane.open(p, free, dir, .errors, "", content) catch {
-        p.gpa.free(content);
-        return null;
-    };
-    p.placeDoc(id, free, np);
-    return text.len;
-}
-
-// ===========================================================================
-// SIZES — what `stat` reports.
-// ===========================================================================
-
-/// The whole `index`, measured. acme's `xfidindexread` walks every window to
-/// size its buffer too; the tag of each is FORMATTED to be measured, into the
-/// per-update scratch arena that is reset anyway, so this is bump allocation
-/// rather than sixteen allocations a frame.
-fn indexLen(p: *Pardes) u64 {
-    var n: u64 = 0;
-    for (p.panes) |slot| {
-        const pane = slot orelse continue;
-        n += ctl_fields + firstLine(tagOf(p, pane)).len + 1;
-    }
-    return n;
-}
-
-/// A terminal's body has no length that is cheap AND honest — measuring it
-/// means rendering the whole scrollback — so it reports zero and is served
-/// with direct IO, exactly like `event` and `log`.
-fn bodyLen(p: *Pardes, pane: *Pane) u64 {
-    _ = p;
-    return bodyOf(pane).len;
-}
-
-fn tagLen(p: *Pardes, pane: *Pane) u64 {
-    return tagOf(p, pane).len;
-}
-
-// ===========================================================================
-// TESTS.
-//
-// The whole point of the split: every one of these drives `handle()` through
-// the ordinary event queue with NO FUSE, NO mount, NO thread and no /dev/fuse
-// anywhere. A filesystem whose semantics are a pure function of the core is a
-// filesystem you can unit-test at the speed of a function call, and one whose
-// blocking is a return value is one you can test without a scheduler.
-// ===========================================================================
-
-const testing = std.testing;
-
-/// What a transport sees: the reply, and the bytes `fsPayload` resolved for it
-/// inside the drain's borrow window. The two effects a filesystem operation
-/// can additionally cause are captured too, because for `put` and for a write
-/// to a terminal's body THE EFFECT IS THE ANSWER.
-const Answer = struct {
-    reply: Reply = .{ .tag = 0, .status = .err, .errno = E.IO },
-    bytes: []const u8 = "",
-    saved: bool = false,
-    pty_buf: [256]u8 = undefined,
-    pty_len: usize = 0,
-    /// `pty/ctl`'s three verbs are each ONE EFFECT and nothing else, so the
-    /// effect is the only thing a test can look at.
-    winsize: ?struct { cols: u16, rows: u16 } = null,
-    signal: ?pardes.PtySignal = null,
-    spawned: bool = false,
-
-    fn pty(a: *const Answer) []const u8 {
-        return a.pty_buf[0..a.pty_len];
-    }
-
-    fn errno(a: Answer) u16 {
-        return if (a.reply.status == .err) a.reply.errno else 0;
-    }
-};
-
-/// One request in, one answer out. Effects are DRAINED but not performed: a
-/// `put` must be observable as a `.save_file` without a test writing to the
-/// real filesystem.
-fn call(p: *Pardes, req: Req) Answer {
-    p.update(.{ .fs_req = req });
-    var ans: Answer = .{};
-    while (p.nextEffect()) |e| switch (e) {
-        .fs_reply => |r| {
-            ans.reply = r;
-            ans.bytes = p.fsPayload(r);
-        },
-        .save_file, .save_text => ans.saved = true,
-        .write => |w| {
-            const b = w.bytes.slice();
-            const n = @min(b.len, ans.pty_buf.len - ans.pty_len);
-            @memcpy(ans.pty_buf[ans.pty_len..][0..n], b[0..n]);
-            ans.pty_len += n;
-        },
-        .resize_pty => |r| ans.winsize = .{ .cols = r.cols, .rows = r.rows },
-        .signal_pty => |s| ans.signal = s.sig,
-        .spawn => ans.spawned = true,
-        else => {},
-    };
-    return ans;
-}
-
-fn rd(p: *Pardes, node: u64, off: u64, size: u32) Answer {
-    return call(p, .{ .tag = 1, .op = .read, .node = node, .off = off, .size = size });
-}
-
-fn wr(p: *Pardes, node: u64, data: []const u8) Answer {
-    return call(p, .{ .tag = 2, .op = .write, .node = node, .data = data });
-}
-
-fn rdir(p: *Pardes, node: u64, skip: u64) Answer {
-    return call(p, .{ .tag = 4, .op = .readdir, .node = node, .off = skip, .size = 4096 });
-}
-
-fn look_up(p: *Pardes, dir: u64, name: []const u8) Answer {
-    return call(p, .{ .tag = 3, .op = .lookup, .node = dir, .data = name });
-}
-
-/// A core with one FILE pane holding `text`, which is what most of acme's
-/// window files are about. Slot 0, and its serial is the directory name.
-fn withFile(gpa: std.mem.Allocator, text: []const u8) !*Pardes {
-    const p = try Pardes.init(gpa, .{ .tty_only = true, .cols = 80, .rows = 24 });
-    errdefer p.deinit();
-    while (p.nextEffect()) |_| {}
-    _ = try p.hxOpenFileContent(text);
-    while (p.nextEffect()) |_| {}
-    return p;
-}
-
-/// ...and a core whose slot 0 is a TERMINAL, which is what `pty/` is about.
-/// `tty_only` opens exactly one shell pane and nothing else, so there is no
-/// document anywhere and the geometry has already settled by the time the
-/// startup effects are drained — a later `.resize_pty` in a test is therefore
-/// one a verb caused.
-fn withTerm(gpa: std.mem.Allocator) !*Pardes {
-    const p = try Pardes.init(gpa, .{ .tty_only = true, .cols = 80, .rows = 24 });
-    errdefer p.deinit();
-    while (p.nextEffect()) |_| {}
-    std.debug.assert(p.panes[0].?.isTerminal());
-    return p;
-}
-
-fn serialOf(p: *Pardes) u32 {
-    return p.panes[0].?.serial;
-}
-
-const Dirent = struct { node: u64, dir: bool, name: []const u8 };
-
-/// Decode the readdir staging format `src/fuse.zig` agreed to.
-fn dirents(bytes: []const u8, out: []Dirent) []Dirent {
-    var n: usize = 0;
-    var i: usize = 0;
-    while (i + 10 <= bytes.len and n < out.len) {
-        const node = std.mem.readInt(u64, bytes[i..][0..8], .little);
-        const kind = bytes[i + 8];
-        const len = bytes[i + 9];
-        i += 10;
-        if (i + len > bytes.len) break;
-        out[n] = .{ .node = node, .dir = kind == 1, .name = bytes[i .. i + len] };
-        i += len;
-        n += 1;
-    }
-    return out[0..n];
-}
-
-fn nameAt(list: []const Dirent, want: []const u8) ?Dirent {
-    for (list) |d| if (std.mem.eql(u8, d.name, want)) return d;
-    return null;
-}
-
-test "readdir lists the root, a pane directory, and new/ without creating anything" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "hello\n");
-    defer p.deinit();
-    const serial = serialOf(p);
-    var buf: [32]Dirent = undefined;
-
-    const root = rdir(p, @intFromEnum(TopFile.root), 0);
-    try testing.expectEqual(Status.ok, root.reply.status);
-    const top = dirents(root.bytes, &buf);
-    try testing.expectEqual(@as(usize, 4), top.len);
-    try testing.expectEqualStrings("index", top[0].name);
-    try testing.expectEqualStrings("cons", top[1].name);
-    try testing.expectEqualStrings("new", top[2].name);
-    try testing.expect(top[2].dir and !top[0].dir);
-    var idbuf: [16]u8 = undefined;
-    try testing.expectEqualStrings(try std.fmt.bufPrint(&idbuf, "{d}", .{serial}), top[3].name);
-    try testing.expect(top[3].dir);
-    // the id a readdir reports is the id a getattr will report
-    try testing.expectEqual(Node.of(serial, .dir), top[3].node);
-
-    // `off` skips entries, and past the end is EOF, not an error
-    const rest = rdir(p, @intFromEnum(TopFile.root), 3);
-    try testing.expectEqual(@as(usize, 1), dirents(rest.bytes, &buf).len);
-    const eof = rdir(p, @intFromEnum(TopFile.root), 99);
-    try testing.expectEqual(Status.ok, eof.reply.status);
-    try testing.expectEqual(@as(usize, 0), eof.bytes.len);
-
-    const dir = rdir(p, Node.of(serial, .dir), 0);
-    const files = dirents(dir.bytes, &buf);
-    try testing.expectEqual(@as(usize, 10), files.len); // dirtabw minus "."
-    try testing.expect(nameAt(files, "addr") != null);
-    try testing.expect(nameAt(files, "xdata") != null);
-    try testing.expect(nameAt(files, ".") == null);
-    try testing.expectEqual(Node.of(serial, .body), nameAt(files, "body").?.node);
-
-    // acme(4) says accessing a file in `new` creates a window, so LISTING it
-    // must enumerate nothing at all: every name it could report is a name
-    // whose lookup creates a pane, and `ls -l` stats what a listing reported.
-    const before = p.next_serial;
-    const new = rdir(p, @intFromEnum(TopFile.new), 0);
-    try testing.expectEqual(Status.ok, new.reply.status);
-    try testing.expectEqual(@as(usize, 0), new.bytes.len);
-    try testing.expectEqual(before, p.next_serial);
-
-    // a file is not a directory
-    try testing.expectEqual(E.NOTDIR, rdir(p, Node.of(serial, .body), 0).errno());
-}
-
-test "lookup resolves top files, pane serials and pane files" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "hello\n");
-    defer p.deinit();
-    const serial = serialOf(p);
-    const root = @intFromEnum(TopFile.root);
-
-    try testing.expectEqual(@as(u64, @intFromEnum(TopFile.index)), look_up(p, root, "index").reply.attr.node);
-    try testing.expect(look_up(p, root, "new").reply.attr.dir);
-    try testing.expectEqual(E.NOENT, look_up(p, root, "nosuchthing").errno());
-
-    var idbuf: [16]u8 = undefined;
-    const dir = look_up(p, root, try std.fmt.bufPrint(&idbuf, "{d}", .{serial}));
-    try testing.expectEqual(Node.of(serial, .dir), dir.reply.attr.node);
-    try testing.expect(dir.reply.attr.dir);
-    // a serial that is not a live pane, and a serial that never existed
-    try testing.expectEqual(E.NOENT, look_up(p, root, "99999").errno());
-
-    const body = look_up(p, Node.of(serial, .dir), "body");
-    try testing.expectEqual(Node.of(serial, .body), body.reply.attr.node);
-    // a lookup answers exactly what a getattr of the same node would
-    const stat = call(p, .{ .tag = 4, .op = .getattr, .node = Node.of(serial, .body) });
-    try testing.expectEqual(body.reply.attr.size, stat.reply.attr.size);
-    try testing.expectEqual(@as(u64, "hello\n".len), stat.reply.attr.size);
-    try testing.expectEqual(E.NOENT, look_up(p, Node.of(serial, .dir), "editout").errno());
-    try testing.expectEqual(E.NOTDIR, look_up(p, Node.of(serial, .body), "x").errno());
-}
-
-test "a lookup inside new/ creates a pane and resolves that pane's file" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "first\n");
-    defer p.deinit();
-    const before = serialOf(p);
-
-    // a name that is not a pane file creates nothing
-    try testing.expectEqual(E.NOENT, look_up(p, @intFromEnum(TopFile.new), "bogus").errno());
-    try testing.expectEqual(before, p.next_serial);
-
-    const a = look_up(p, @intFromEnum(TopFile.new), "body");
-    try testing.expectEqual(Status.ok, a.reply.status);
-    const made: Node = @bitCast(a.reply.attr.node);
-    try testing.expect(made.serial != before);
-    try testing.expectEqual(@intFromEnum(PaneFile.body), made.file);
-
-    // ...and it is a real pane: `echo hi > new/body` leaves a pane holding hi
-    _ = wr(p, a.reply.attr.node, "hi");
-    const id = p.paneBySerial(@intCast(made.serial)).?;
-    try testing.expectEqualStrings("hi", p.panes[id].?.file.?.content);
-}
-
-test "index prints winctlprint's five fields then the tag" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "hello\nthere\n");
-    defer p.deinit();
-    const pane = p.panes[0].?;
-
-    const a = rd(p, @intFromEnum(TopFile.index), 0, 4096);
-    try testing.expectEqual(Status.ok, a.reply.status);
-    var got: [512]u8 = undefined;
-    @memcpy(got[0..a.bytes.len], a.bytes);
-    const line = got[0..a.bytes.len];
-
-    const tag = tagOf(p, pane);
-    var want: std.ArrayList(u8) = .empty;
-    defer want.deinit(gpa);
-    try want.print(gpa, "{d:>11} {d:>11} {d:>11} {d:>11} {d:>11} {s}\n", .{
-        pane.serial, tag.len, @as(usize, "hello\nthere\n".len), 0, 0, firstLine(tag),
-    });
-    try testing.expectEqualStrings(want.items, line);
-    // acme(4): "at character position 5x12 starts the name of the window"
-    try testing.expectEqual(@as(usize, 60), std.mem.indexOf(u8, line, firstLine(tag)).?);
-
-    // seekable: a script may pread the middle of it
-    const mid = rd(p, @intFromEnum(TopFile.index), 60, 5);
-    try testing.expectEqualStrings(firstLine(tag)[0..5], mid.bytes);
-
-    // ...and a dirty pane says so in the fifth field
-    pane.file.?.saved_revision = pane.file.?.revision -% 1;
-    const dirty = rd(p, @intFromEnum(TopFile.index), 48, 12);
-    try testing.expectEqualStrings("          1 ", dirty.bytes);
-}
-
-test "ctl read is index's five fields plus width in cells, font and tab width" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "x\n");
-    defer p.deinit();
-    const pane = p.panes[0].?;
-
-    const a = rd(p, Node.of(pane.serial, .ctl), 0, 4096);
-    try testing.expectEqual(Status.ok, a.reply.status);
-    var want: std.ArrayList(u8) = .empty;
-    defer want.deinit(gpa);
-    try want.print(gpa, "{d:>11} {d:>11} {d:>11} {d:>11} {d:>11} {d:>11} {s} {d:>11} ", .{
-        pane.serial, tagOf(p, pane).len, @as(usize, 2), 0, 0, pane.cols, "default", config.tab_width,
-    });
-    try testing.expectEqualStrings(want.items, a.bytes);
-
-    // plan9 %q: a name with a space in it becomes one shell word
-    var quoted: std.ArrayList(u8) = .empty;
-    defer quoted.deinit(gpa);
-    stageQuoted(&quoted, gpa, "DejaVu Sans Mono");
-    try testing.expectEqualStrings("'DejaVu Sans Mono'", quoted.items);
-    quoted.clearRetainingCapacity();
-    stageQuoted(&quoted, gpa, "it's");
-    try testing.expectEqualStrings("'it''s'", quoted.items);
-}
-
-test "body reads at any offset and writes append" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "one\ntwo\n");
-    defer p.deinit();
-    const serial = serialOf(p);
-    const body = Node.of(serial, .body);
-
-    try testing.expectEqualStrings("one\ntwo\n", rd(p, body, 0, 100).bytes);
-    try testing.expectEqualStrings("two\n", rd(p, body, 4, 100).bytes);
-    try testing.expectEqualStrings("wo", rd(p, body, 5, 2).bytes);
-    try testing.expectEqualStrings("", rd(p, body, 999, 2).bytes);
-    // zero copy: the answer points INTO the pane, it is not a staged copy
-    try testing.expect(rd(p, body, 0, 100).bytes.ptr == p.panes[0].?.file.?.content.ptr);
-
-    // acme(4): "Text written to body is always appended; the file offset is
-    // ignored" — so a write at offset 0 still lands at the end.
-    const w = call(p, .{ .tag = 5, .op = .write, .node = body, .off = 0, .data = "three\n" });
-    try testing.expectEqual(@as(u32, 6), w.reply.written);
-    try testing.expectEqualStrings("one\ntwo\nthree\n", p.panes[0].?.file.?.content);
-
-    // a write cut mid-character is SHORT, never split
-    const short = wr(p, body, "a\xC3");
-    try testing.expectEqual(@as(u32, 1), short.reply.written);
-    try testing.expectEqualStrings("one\ntwo\nthree\na", p.panes[0].?.file.?.content);
-}
-
-test "a body write to a terminal pane types at its shell" {
-    const gpa = testing.allocator;
-    const p = try Pardes.init(gpa, .{ .tty_only = true, .cols = 40, .rows = 10 });
-    defer p.deinit();
-    while (p.nextEffect()) |_| {}
-    const pane = p.panes[0].?;
-    try testing.expect(pane.isTerminal());
-
-    // `win`'s transcript semantics: the only way into a program's transcript
-    // is to type at it, so a body write becomes a pty write.
-    const a = wr(p, Node.of(pane.serial, .body), "ls -l\r");
-    try testing.expectEqual(@as(u32, 6), a.reply.written);
-    try testing.expectEqualStrings("ls -l\r", a.pty());
-
-    // and a body READ renders the scrollback rather than lending a buffer
-    const r = rd(p, Node.of(pane.serial, .body), 0, 64);
-    try testing.expectEqual(Status.ok, r.reply.status);
-}
-
-test "tag reads the whole tag and writes append to the editable tail" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "x\n");
-    defer p.deinit();
-    const pane = p.panes[0].?;
-    const node = Node.of(pane.serial, .tag);
-
-    const whole = rd(p, node, 0, 4096);
-    try testing.expect(std.mem.startsWith(u8, whole.bytes, "/hxcase.txt"));
-    try testing.expect(std.mem.indexOf(u8, whole.bytes, "Del") != null);
-
-    const before = rd(p, node, 0, 4096).bytes.len;
-    const w = wr(p, node, " Mine");
-    try testing.expectEqual(@as(u32, 5), w.reply.written);
-    try testing.expect(std.mem.endsWith(u8, pane.tag_tail[0..pane.tag_tail_len], " Mine"));
-    const after = rd(p, node, 0, 4096);
-    try testing.expectEqual(before + 5, after.bytes.len);
-    try testing.expect(std.mem.endsWith(u8, after.bytes, " Mine"));
-
-    // the tail is one bounded line; with no room left the file is FULL
-    pane.tag_tail_len = pane.tag_tail.len;
-    try testing.expectEqual(E.NOSPC, wr(p, node, "x").errno());
-}
-
-test "the address language, form by form" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "one\ntwo\nthree\n"); // 14 bytes, three lines
-    defer p.deinit();
-    const serial = serialOf(p);
-    const addr = Node.of(serial, .addr);
-
-    const Case = struct { expr: []const u8, q0: u32, q1: u32 };
-    for ([_]Case{
-        .{ .expr = "#0", .q0 = 0, .q1 = 0 },
-        .{ .expr = "#5", .q0 = 5, .q1 = 5 },
-        .{ .expr = "0", .q0 = 0, .q1 = 0 },
-        .{ .expr = "1", .q0 = 0, .q1 = 4 },
-        .{ .expr = "2", .q0 = 4, .q1 = 8 },
-        .{ .expr = "$", .q0 = 14, .q1 = 14 },
-        .{ .expr = ",", .q0 = 0, .q1 = 14 },
-        .{ .expr = "1,2", .q0 = 0, .q1 = 8 },
-        .{ .expr = "#1,#4", .q0 = 1, .q1 = 4 },
-        .{ .expr = "2+1", .q0 = 8, .q1 = 14 },
-        .{ .expr = "$-1", .q0 = 8, .q1 = 14 },
-        .{ .expr = "/two/", .q0 = 4, .q1 = 7 },
-        .{ .expr = "/t.o/", .q0 = 4, .q1 = 7 },
-        // a trailing newline is what a shell redirect leaves behind
-        .{ .expr = "1\n", .q0 = 0, .q1 = 4 },
-    }) |c| {
-        // every case starts from a known address, so `.` and `+`/`-` are
-        // measured against the same place each time
-        _ = wr(p, addr, "#0");
-        const w = wr(p, addr, c.expr);
-        try testing.expectEqual(Status.ok, w.reply.status);
-        const got = rd(p, addr, 0, 64);
-        var want: [32]u8 = undefined;
-        try testing.expectEqualStrings(
-            try std.fmt.bufPrint(&want, "{d:>11} {d:>11} ", .{ c.q0, c.q1 }),
-            got.bytes,
-        );
-    }
-
-    // `.` is the CURRENT ADDRESS (acme passes w->addr as `ar`), not the
-    // selection: set it, then ask for it back.
-    _ = wr(p, addr, "1");
-    _ = wr(p, addr, ".");
-    try testing.expectEqual(@as(u32, 0), p.fs.panes[0].addr.q0);
-    try testing.expectEqual(@as(u32, 4), p.fs.panes[0].addr.q1);
-
-    // `?re?` searches BACKWARD from the start of the running range and takes
-    // the LAST match before it — acme's `rxbexecute`.
-    _ = wr(p, addr, "$");
-    _ = wr(p, addr, "?o?");
-    try testing.expectEqual(@as(u32, 6), p.fs.panes[0].addr.q0); // the `o` in "two"
-    try testing.expectEqual(@as(u32, 7), p.fs.panes[0].addr.q1);
-
-    // limit=addr confines a forward search
-    _ = wr(p, addr, "1");
-    _ = wr(p, Node.of(serial, .ctl), "limit=addr\n");
-    _ = wr(p, addr, "#0");
-    try testing.expectEqual(E.INVAL, wr(p, addr, "/three/").errno());
-    _ = wr(p, Node.of(serial, .ctl), "clean\n"); // any ctl write; limit stays
-    // ...and opening ctl clears it again (acme(4))
-    _ = call(p, .{ .tag = 6, .op = .open, .node = Node.of(serial, .ctl) });
-    try testing.expect(p.fs.panes[0].limit == null);
-    _ = wr(p, addr, "#0");
-    try testing.expectEqual(Status.ok, wr(p, addr, "/three/").reply.status);
-
-    // refusals
-    for ([_][]const u8{ "zzz", "#", "//", "/nomatch/", "1 2", "99", "/a\\" }) |bad| {
-        _ = wr(p, addr, "#0");
-        try testing.expectEqual(E.INVAL, wr(p, addr, bad).errno());
-    }
-
-    // acme recurses once per `,` with no bound at all, which a script turns
-    // into a stack overflow with one write(2). Refused, not crashed.
-    const nested = "," ** 4096;
-    _ = wr(p, addr, "#0");
-    try testing.expectEqual(E.INVAL, wr(p, addr, nested).errno());
-}
-
-test "data and xdata read from addr, move it, and write through it" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "one\ntwo\n");
-    defer p.deinit();
-    const serial = serialOf(p);
-    const addr = Node.of(serial, .addr);
-    const data = Node.of(serial, .data);
-    const xdata = Node.of(serial, .xdata);
-
-    _ = wr(p, addr, "#0");
-    try testing.expectEqualStrings("one", rd(p, data, 0, 3).bytes);
-    // ...and the address is now the null string after what was returned
-    try testing.expectEqual(@as(u32, 3), p.fs.panes[0].addr.q0);
-    try testing.expectEqual(@as(u32, 3), p.fs.panes[0].addr.q1);
-
-    // xdata stops at the END of the address where data would run on
-    _ = wr(p, addr, "1");
-    try testing.expectEqualStrings("one\n", rd(p, xdata, 0, 100).bytes);
-    _ = wr(p, addr, "1");
-    try testing.expectEqualStrings("one\ntwo\n", rd(p, data, 0, 100).bytes);
-
-    // a write REPLACES the addressed text and leaves the address after it
-    _ = wr(p, addr, "1");
-    const w = wr(p, data, "ONE\n");
-    try testing.expectEqual(@as(u32, 4), w.reply.written);
-    try testing.expectEqualStrings("ONE\ntwo\n", p.panes[0].?.file.?.content);
-    try testing.expectEqual(@as(u32, 4), p.fs.panes[0].addr.q0);
-}
-
-test "data never splits a grapheme, in either direction" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "\u{00e9}x\n"); // é is two bytes
-    defer p.deinit();
-    const serial = serialOf(p);
-    _ = wr(p, Node.of(serial, .addr), "#0");
-    // one byte is not enough for the first character: acme's `if(m == 0) break`
-    try testing.expectEqualStrings("", rd(p, Node.of(serial, .data), 0, 1).bytes);
-    _ = wr(p, Node.of(serial, .addr), "#0");
-    try testing.expectEqualStrings("\u{00e9}", rd(p, Node.of(serial, .data), 0, 2).bytes);
-
-    // and a write ending mid-character is short rather than corrupting
-    _ = wr(p, Node.of(serial, .addr), "#0");
-    try testing.expectEqual(@as(u32, 1), wr(p, Node.of(serial, .data), "a\xC3").reply.written);
-}
-
-test "rdsel reads the selection and wrsel replaces it" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "one\ntwo\n");
-    defer p.deinit();
-    const serial = serialOf(p);
-    const ctl = Node.of(serial, .ctl);
-
-    _ = wr(p, Node.of(serial, .addr), "#0,#3");
-    try testing.expectEqual(Status.ok, wr(p, ctl, "dot=addr\n").reply.status);
-    try testing.expectEqualStrings("one", rd(p, Node.of(serial, .rdsel), 0, 100).bytes);
-
-    // ...and the round trip back out is the identity, not a range that creeps
-    _ = wr(p, ctl, "addr=dot\n");
-    try testing.expectEqual(@as(u32, 0), p.fs.panes[0].addr.q0);
-    try testing.expectEqual(@as(u32, 3), p.fs.panes[0].addr.q1);
-
-    try testing.expectEqual(Status.ok, wr(p, Node.of(serial, .wrsel), "ONE").reply.status);
-    try testing.expectEqualStrings("ONE\ntwo\n", p.panes[0].?.file.?.content);
-    // a second write appends after the first, acme's `wrselrange`
-    _ = wr(p, Node.of(serial, .wrsel), "!");
-    try testing.expectEqualStrings("ONE!\ntwo\n", p.panes[0].?.file.?.content);
-}
-
-test "every ctl verb, and every refusal" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "one\ntwo\n");
-    defer p.deinit();
-    const serial = serialOf(p);
-    const ctl = Node.of(serial, .ctl);
-    const pane = p.panes[0].?;
-    const pf = &p.fs.panes[0];
-
-    // several verbs in one write, which is what the man page promises
-    try testing.expectEqual(Status.ok, wr(p, ctl, "nomark\nnoscroll\ndirty\n").reply.status);
-    try testing.expect(pf.nomark and pf.noscroll and dirtyOf(pane));
-    try testing.expectEqual(Status.ok, wr(p, ctl, "mark\nscroll\nclean\n").reply.status);
-    try testing.expect(!pf.nomark and !pf.noscroll and !dirtyOf(pane));
-
-    _ = wr(p, ctl, "cleartag\n");
-    try testing.expectEqual(@as(usize, 0), pane.tag_tail_len);
-
-    _ = wr(p, Node.of(serial, .addr), "2");
-    _ = wr(p, ctl, "limit=addr\n");
-    try testing.expectEqual(@as(u32, 4), pf.limit.?.q0);
-    _ = wr(p, ctl, "dot=addr\nshow\n");
-    try testing.expectEqual(@as(i32, 1), pane.cur_row);
-
-    try testing.expectEqual(Status.ok, wr(p, ctl, "name /tmp/renamed.txt\n").reply.status);
-    try testing.expectEqualStrings("/tmp/renamed.txt", pane.file.?.path);
-    // acme rejects a name with any character <= ' ' in it
-    try testing.expectEqual(E.INVAL, wr(p, ctl, "name two words\n").errno());
-    try testing.expectEqual(E.INVAL, wr(p, ctl, "name\n").errno());
-    try testing.expectEqualStrings("/tmp/renamed.txt", pane.file.?.path);
-
-    // `put` is acme's Put, which is pardes's Save
-    try testing.expect(wr(p, ctl, "put\n").saved);
-
-    // REFUSED, each for a reason that is not "unimplemented" — see
-    // `refused_verbs`. Silently accepting these is the worse failure.
-    for ([_][]const u8{
-        "menu", "nomenu", "dump echo hi", "dumpdir /tmp", "font Go Mono", "lock", "unlock", "bogus", "DEL",
-    }) |bad| try testing.expectEqual(E.INVAL, wr(p, ctl, bad).errno());
-
-    // ATOMIC, which acme is not: an unknown verb aborts the WHOLE write.
-    try testing.expect(!dirtyOf(pane));
-    try testing.expectEqual(E.INVAL, wr(p, ctl, "dirty\nbogus\n").errno());
-    try testing.expect(!dirtyOf(pane));
-}
-
-test "ctl get reloads the pane from disk and del honours a dirty body" {
-    const gpa = testing.allocator;
-    var tmp = testing.tmpDir(.{});
-    defer tmp.cleanup();
-    try tmp.dir.writeFile(testing.io, .{ .sub_path = "note.txt", .data = "from disk\n" });
-    var path_buf: [256]u8 = undefined;
-    const path = try std.fmt.bufPrint(&path_buf, ".zig-cache/tmp/{s}/note.txt", .{tmp.sub_path});
-
-    const p = try withFile(gpa, "in memory\n");
-    defer p.deinit();
-    const serial = serialOf(p);
-    const ctl = Node.of(serial, .ctl);
-    const pane = p.panes[0].?;
-
-    var name: [std.fs.max_path_bytes + 8]u8 = undefined;
-    _ = wr(p, ctl, try std.fmt.bufPrint(&name, "name {s}\n", .{path}));
-    try testing.expectEqual(Status.ok, wr(p, ctl, "get\n").reply.status);
-    try testing.expectEqualStrings("from disk\n", pane.file.?.content);
-    // Get leaves the pane clean and the previous text one Undo away
-    try testing.expect(!dirtyOf(pane));
-    try testing.expect(pane.file.?.undo_len > 0);
-
-    // acme: `del` is "delete, but check dirty"; `delete` is "delete for sure"
-    _ = wr(p, ctl, "dirty\n");
-    try testing.expectEqual(E.INVAL, wr(p, ctl, "del\n").errno());
-    try testing.expect(p.paneBySerial(serial) != null);
-    // ...and a second pane so the last one closing does not quit the editor
-    _ = look_up(p, @intFromEnum(TopFile.new), "body");
-    try testing.expectEqual(Status.ok, wr(p, ctl, "delete\n").reply.status);
-    try testing.expect(p.paneBySerial(serial) == null);
-}
-
-test "errors and cons append to one +Errors buffer per directory" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "x\n");
-    defer p.deinit();
-    const serial = serialOf(p);
-
-    const live = for (p.panes) |slot| {
-        if (slot) |q| if (q.file) |f| if (f.output) |o| if (std.meta.activeTag(o.from) == .errors) break q;
-    } else null;
-    try testing.expect(live == null); // "not until text is actually written"
-
-    try testing.expectEqual(Status.ok, wr(p, Node.of(serial, .errors), "boom\n").reply.status);
-    _ = wr(p, @intFromEnum(TopFile.cons), "again\n");
-
-    var found: usize = 0;
-    for (p.panes) |slot| {
-        const q = slot orelse continue;
-        const f = q.file orelse continue;
-        const o = f.output orelse continue;
-        if (std.meta.activeTag(o.from) != .errors) continue;
-        found += 1;
-        try testing.expectEqualStrings("boom\nagain\n", f.content);
-        try testing.expectEqualStrings("/+Errors", f.path);
-    }
-    try testing.expectEqual(@as(usize, 1), found);
-}
-
-test "setattr truncation empties the body and answers fresh attributes" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "one\ntwo\n");
-    defer p.deinit();
-    const serial = serialOf(p);
-
-    const a = call(p, .{ .tag = 7, .op = .setattr, .node = Node.of(serial, .body), .truncate = true });
-    try testing.expectEqual(Status.ok, a.reply.status);
-    try testing.expectEqual(@as(u64, 0), a.reply.attr.size);
-    try testing.expectEqualStrings("", p.panes[0].?.file.?.content);
-
-    // `> body` then a write is the shell's way of REPLACING a pane's text
-    _ = wr(p, Node.of(serial, .body), "new text\n");
-    try testing.expectEqualStrings("new text\n", p.panes[0].?.file.?.content);
-
-    // a setattr that sets no size changes nothing
-    const noop = call(p, .{ .tag = 8, .op = .setattr, .node = Node.of(serial, .body) });
-    try testing.expectEqual(@as(u64, 9), noop.reply.attr.size);
-}
-
-test "event records are acme's bytes, one per read, and .again when empty" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "Msg fs-ran\n");
-    defer p.deinit();
-    const serial = serialOf(p);
-    const event = Node.of(serial, .event);
-
-    // nothing is recorded while nobody is listening
-    _ = noteAction(p, 0, .body_exec, 1, 4, flag_builtin, "sg ");
-    try testing.expect(p.fs.panes[0].events.empty());
-
-    const h = call(p, .{ .tag = 10, .op = .open, .node = event });
-    try testing.expect(h.reply.handle != 0);
-    try testing.expectEqual(@as(u16, 1), p.fs.listeners);
-
-    // an empty queue is `.again`: nothing consumed, ask me later. NEVER an
-    // error, and never a loop.
-    try testing.expectEqual(Status.again, rd(p, event, 0, 4096).reply.status);
-
-    p.fs.origin = 'M';
-    _ = noteAction(p, 0, .body_exec, 1, 4, flag_builtin, "ell");
-    _ = noteAction(p, 0, .body_delete, 0, 3, 0, "");
-    // `%c%c%d %d %d %d %s\n`, wind.c's winevent with the owner char in front
-    try testing.expectEqualStrings("MX1 4 1 3 ell\n", rd(p, event, 0, 4096).bytes);
-    try testing.expectEqualStrings("MD0 3 0 0 \n", rd(p, event, 0, 4096).bytes);
-    try testing.expectEqual(Status.again, rd(p, event, 0, 4096).reply.status);
-
-    // one record per read: a read too small to hold one is refused rather
-    // than answered with half a record the reader cannot resynchronise from
-    _ = noteAction(p, 0, .body_look, 0, 3, flag_filename, "one");
-    try testing.expectEqual(E.INVAL, rd(p, event, 0, 4).errno());
-    try testing.expectEqualStrings("ML0 3 4 3 one\n", rd(p, event, 0, 4096).bytes);
-
-    // text of 256 bytes or more is elided; the reader fetches it from `data`
-    const big = "z" ** max_record_text;
-    _ = noteAction(p, 0, .body_exec, 0, max_record_text, 0, big);
-    try testing.expectEqualStrings("MX0 256 0 0 \n", rd(p, event, 0, 4096).bytes);
-
-    _ = call(p, .{ .tag = 11, .op = .release, .node = event, .handle = h.reply.handle });
-    try testing.expectEqual(@as(u16, 0), p.fs.listeners);
-}
-
-/// Drain a queue into `store` and return the records. Reading is destructive
-/// and a `.staged` answer is only valid until the next request, so each record
-/// is copied out as it arrives.
-fn drainEvents(p: *Pardes, node: u64, store: []u8, out: [][]const u8) [][]const u8 {
-    var used: usize = 0;
-    var n: usize = 0;
-    while (n < out.len) {
-        const a = rd(p, node, 0, 4096);
-        if (a.reply.status != .ok) break;
-        @memcpy(store[used..][0..a.bytes.len], a.bytes);
-        out[n] = store[used..][0..a.bytes.len];
-        used += a.bytes.len;
-        n += 1;
-    }
-    return out[0..n];
-}
-
-test "a write through the filesystem is reported once, attributed to the file it came through" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "one\ntwo\n");
-    defer p.deinit();
-    const serial = serialOf(p);
-    const event = Node.of(serial, .event);
-    _ = call(p, .{ .tag = 40, .op = .open, .node = event });
-    var store: [4096]u8 = undefined;
-    var slots: [16][]const u8 = undefined;
-    _ = drainEvents(p, event, &store, &slots);
-
-    // A body write is acme's `E`: "writes to the body or tag file". ONE pair
-    // per write, because the diff lives in `file_pane.setContent` and a write
-    // is one content swap — that is the contract with the core's hook, and
-    // emitting records from the handler as well is what it forbids.
-    _ = wr(p, Node.of(serial, .body), "three\n");
-    const body_recs = drainEvents(p, event, &store, &slots);
-    try testing.expect(body_recs.len >= 1);
-    // ...and the record's TEXT here contains a newline of its own, which is
-    // exactly why `Queue` frames records by length instead of by line
-    try testing.expectEqualStrings("EI8 14 0 6 three\n\n", body_recs[0]);
-    // the write also made the pane dirty, so its TAG changed — and acme
-    // attributes that to the write too (`winsettag` runs inside the same
-    // `winlock(w, 'E')`), which is why the origin is set for the whole
-    // request and not just for the mutation.
-    for (body_recs[1..]) |r| {
-        try testing.expectEqual(@as(u8, 'E'), r[0]);
-        try testing.expect(Action.fromChar(r[1]).?.onTag());
-    }
-
-    // A `data` write is acme's `F`: "actions through the window's other
-    // files" — and a replacement is a delete then an insert, acme's order,
-    // with no text on the delete.
-    _ = wr(p, Node.of(serial, .addr), "1");
-    _ = wr(p, Node.of(serial, .data), "ONE\n");
-    const data_recs = drainEvents(p, event, &store, &slots);
-    try testing.expectEqual(@as(usize, 2), data_recs.len);
-    try testing.expectEqualStrings("FD0 3 0 0 \n", data_recs[0]);
-    try testing.expectEqualStrings("FI0 3 0 3 ONE\n", data_recs[1]);
-    try testing.expectEqual(Status.again, rd(p, event, 0, 4096).reply.status);
-}
-
-test "two event readers each count once, and the second closing leaves the first" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "x\n");
-    defer p.deinit();
-    const event = Node.of(serialOf(p), .event);
-
-    _ = call(p, .{ .tag = 12, .op = .open, .node = event });
-    _ = call(p, .{ .tag = 13, .op = .open, .node = event });
-    try testing.expectEqual(@as(u16, 2), p.fs.panes[0].readers);
-    try testing.expectEqual(@as(u16, 2), p.fs.listeners);
-
-    // A release names the NODE, not a handle: FUSE carries the nodeid on every
-    // request, so there is no fid table to look one up in, and one release
-    // answers for one open.
-    _ = call(p, .{ .tag = 14, .op = .release, .node = event });
-    try testing.expectEqual(@as(u16, 1), p.fs.panes[0].readers);
-    try testing.expect(p.fs.scripted(0)); // the pane is STILL script-driven
-
-    // a release with nothing left to release changes nothing and is not an
-    // error, and neither is one naming a node that never counted
-    _ = call(p, .{ .tag = 15, .op = .release, .node = Node.of(serialOf(p), .body) });
-    try testing.expectEqual(@as(u16, 1), p.fs.listeners);
-
-    _ = call(p, .{ .tag = 16, .op = .release, .node = event });
-    try testing.expectEqual(@as(u16, 0), p.fs.listeners);
-    try testing.expect(!p.fs.scripted(0));
-    _ = call(p, .{ .tag = 17, .op = .release, .node = event });
-    try testing.expectEqual(@as(u16, 0), p.fs.listeners);
-}
-
-test "a pane deleted while its event file is open leaves no suppression behind" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "x\n");
-    defer p.deinit();
-    const serial = serialOf(p);
-    const event = Node.of(serial, .event);
-    // a second pane, so deleting the first does not quit the editor
-    _ = look_up(p, @intFromEnum(TopFile.new), "body");
-
-    const a = call(p, .{ .tag = 18, .op = .open, .node = event });
-    const b = call(p, .{ .tag = 19, .op = .open, .node = event });
-    try testing.expectEqual(@as(u16, 2), p.fs.listeners);
-
-    _ = wr(p, Node.of(serial, .ctl), "delete\n");
-    try testing.expect(p.paneBySerial(serial) == null);
-    // the core's `State.forget` took BOTH readers out with the pane
-    try testing.expectEqual(@as(u16, 0), p.fs.listeners);
-
-    // ...and the two late releases must not underflow it back to 65535, which
-    // would suppress every button action in the editor forever
-    _ = call(p, .{ .tag = 20, .op = .release, .node = event, .handle = a.reply.handle });
-    _ = call(p, .{ .tag = 21, .op = .release, .node = event, .handle = b.reply.handle });
-    try testing.expectEqual(@as(u16, 0), p.fs.listeners);
-
-    // every operation on the dead pane is ENOENT — acme's Edel
-    try testing.expectEqual(E.NOENT, rd(p, event, 0, 64).errno());
-    try testing.expectEqual(E.NOENT, rd(p, Node.of(serial, .body), 0, 64).errno());
-    try testing.expectEqual(E.NOENT, wr(p, Node.of(serial, .ctl), "clean\n").errno());
-    try testing.expectEqual(E.NOENT, call(p, .{ .tag = 22, .op = .open, .node = event }).errno());
-}
-
-test "writing an event record back performs the action it names" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "Msg fs-ran\n");
-    defer p.deinit();
-    const serial = serialOf(p);
-    const event = Node.of(serial, .event);
-    const pane = p.panes[0].?;
-
-    // an `X` record over the body text `Msg fs-ran` is an Exec of it
-    const w = wr(p, event, "FX0 10\n");
-    try testing.expectEqual(Status.ok, w.reply.status);
-    try testing.expectEqualStrings("fs-ran", pane.msg[0..pane.msg_len]);
-
-    // several records in one write
-    pane.msg_len = 0;
-    try testing.expectEqual(Status.ok, wr(p, event, "FX0 10\nFX0 10\n").reply.status);
-    try testing.expectEqualStrings("fs-ran", pane.msg[0..pane.msg_len]);
-
-    // ...and nothing applies when any of it is malformed: acme's Ebadevent
-    pane.msg_len = 0;
-    for ([_][]const u8{
-        "FX0 10\nFQ0 1\n", // unknown type character
-        "FX0 999\n", // out of range
-        "FX0 10", // no newline
-        "FX5 1\n", // q0 > q1
-        "FD0 3\n", // a report, not a request
-        "F\n",
-    }) |bad| {
-        try testing.expectEqual(E.INVAL, wr(p, event, bad).errno());
-        try testing.expectEqual(@as(usize, 0), pane.msg_len);
-    }
-
-    // The action is attributed to the FILESYSTEM (`F`), never to whatever the
-    // writer put in the record's origin character — acme copies that byte
-    // into `w->owner` and lets a script claim its Exec came from the
-    // keyboard.
-    _ = call(p, .{ .tag = 23, .op = .open, .node = event });
-    p.fs.origin = 'K';
-    _ = wr(p, event, "KX0 10\n");
-    try testing.expectEqual(@as(u8, 'F'), p.fs.origin);
-}
-
-test "a pane that is not a terminal has no pty/ at all" {
-    const gpa = testing.allocator;
-    const p = try withFile(gpa, "hello\n");
-    defer p.deinit();
-    const serial = serialOf(p);
-    const dir = Node.of(serial, .dir);
-
-    // ABSENT, not present-and-refusing: `-d $PARDES_FS/<id>/pty` is how a
-    // script asks whether a pane is a terminal.
-    try testing.expectEqual(E.NOENT, look_up(p, dir, "pty").errno());
-    try testing.expectEqual(E.NOENT, call(p, .{
-        .tag = 1,
-        .op = .getattr,
-        .node = Node.of(serial, .pty),
-    }).errno());
-    try testing.expectEqual(E.NOENT, rd(p, Node.of(serial, .pty_status), 0, 256).errno());
-    try testing.expectEqual(E.NOENT, wr(p, Node.of(serial, .pty_ctl), "winsize 80 24\n").errno());
-    try testing.expectEqual(E.NOENT, rdir(p, Node.of(serial, .pty), 0).errno());
-    // ...and an OPEN too, so the reader count that gates the raw queue can
-    // never be armed on a pane that has no pty to produce bytes
-    try testing.expectEqual(E.NOENT, call(p, .{
-        .tag = 2,
-        .op = .open,
-        .node = Node.of(serial, .pty_data),
-    }).errno());
-    try testing.expectEqual(@as(u16, 0), p.fs.panes[0].pty_readers);
-
-    // ...and the listing is byte for byte the ten entries it always was
-    var buf: [32]Dirent = undefined;
-    const files = dirents(rdir(p, dir, 0).bytes, &buf);
-    try testing.expectEqual(@as(usize, 10), files.len);
-    try testing.expect(nameAt(files, "pty") == null);
-
-    // the enum's spelling is not a name in the tree: `pty_ctl` is how the flat
-    // enum spells `pty/ctl`, and neither directory answers to it
-    try testing.expectEqual(E.NOENT, look_up(p, dir, "pty_ctl").errno());
-    try testing.expectEqual(E.NOENT, look_up(p, dir, "status").errno());
-
-    // `new/` makes a scratch, which can never be a terminal, so naming a pty
-    // file there creates nothing at all
-    const before = p.next_serial;
-    try testing.expectEqual(E.NOENT, look_up(p, @intFromEnum(TopFile.new), "pty").errno());
-    try testing.expectEqual(before, p.next_serial);
-}
-
-test "a terminal pane's pty/ holds exactly ctl, status and data" {
-    const gpa = testing.allocator;
-    const p = try withTerm(gpa);
-    defer p.deinit();
-    const serial = serialOf(p);
-    const dir = Node.of(serial, .dir);
-
-    const pty = look_up(p, dir, "pty");
-    try testing.expectEqual(Node.of(serial, .pty), pty.reply.attr.node);
-    try testing.expect(pty.reply.attr.dir);
-    try testing.expectEqual(@as(u16, 0o500), pty.reply.attr.mode);
-
-    var buf: [32]Dirent = undefined;
-    const files = dirents(rdir(p, dir, 0).bytes, &buf);
-    try testing.expectEqual(@as(usize, 11), files.len); // the ten, plus pty
-    try testing.expect(nameAt(files, "pty").?.dir);
-
-    const inside = dirents(rdir(p, Node.of(serial, .pty), 0).bytes, &buf);
-    try testing.expectEqual(@as(usize, 3), inside.len);
-    try testing.expectEqualStrings("ctl", inside[0].name);
-    try testing.expectEqualStrings("status", inside[1].name);
-    try testing.expectEqualStrings("data", inside[2].name);
-    for (inside) |d| try testing.expect(!d.dir);
-    // the ids a listing reports are the ids a lookup resolves
-    try testing.expectEqual(Node.of(serial, .pty_data), inside[2].node);
-
-    // ...and the two namespaces do not leak into each other
-    const ctl = look_up(p, Node.of(serial, .pty), "ctl");
-    try testing.expectEqual(Node.of(serial, .pty_ctl), ctl.reply.attr.node);
-    try testing.expectEqual(@as(u16, 0o200), ctl.reply.attr.mode);
-    try testing.expectEqual(@as(u16, 0o400), look_up(p, Node.of(serial, .pty), "status").reply.attr.mode);
-    try testing.expectEqual(E.NOENT, look_up(p, Node.of(serial, .pty), "body").errno());
-    try testing.expectEqual(E.NOENT, look_up(p, Node.of(serial, .pty), "pty").errno());
-
-    // a file is not a directory, on either side of the slash
-    try testing.expectEqual(E.NOTDIR, look_up(p, Node.of(serial, .pty_ctl), "x").errno());
-    try testing.expectEqual(E.NOTDIR, rdir(p, Node.of(serial, .pty_ctl), 0).errno());
-    // and the directory itself is not read(2)able, nor is a write-only file
-    try testing.expectEqual(E.PERM, rd(p, Node.of(serial, .pty), 0, 16).errno());
-    try testing.expectEqual(E.PERM, rd(p, Node.of(serial, .pty_ctl), 0, 16).errno());
-    try testing.expectEqual(E.PERM, wr(p, Node.of(serial, .pty_status), "x").errno());
-}
-
-test "every pty/ctl verb, and every refusal" {
-    const gpa = testing.allocator;
-    const p = try withTerm(gpa);
-    defer p.deinit();
-    const ctl = Node.of(serialOf(p), .pty_ctl);
-
-    // winsize reaches the effect queue, and ONLY the pty: the grid belongs to
-    // the layout, so the pane's own cols/rows are untouched.
-    const pane = p.panes[0].?;
-    const cols = pane.cols;
-    const rows = pane.rows;
-    const ws = wr(p, ctl, "winsize 132 44\n");
-    try testing.expectEqual(@as(u32, "winsize 132 44\n".len), ws.reply.written);
-    try testing.expectEqual(@as(u16, 132), ws.winsize.?.cols);
-    try testing.expectEqual(@as(u16, 44), ws.winsize.?.rows);
-    try testing.expectEqual(cols, pane.cols);
-    try testing.expectEqual(rows, pane.rows);
-
-    // all five signal names, and no others
-    for ([_]struct { line: []const u8, want: pardes.PtySignal }{
-        .{ .line = "sig INT", .want = .int },
-        .{ .line = "sig TERM", .want = .term },
-        .{ .line = "sig HUP", .want = .hup },
-        .{ .line = "sig QUIT", .want = .quit },
-        .{ .line = "sig KILL", .want = .kill },
-    }) |c| {
-        const a = wr(p, ctl, c.line);
-        try testing.expectEqual(Status.ok, a.reply.status);
-        try testing.expectEqual(c.want, a.signal.?);
-    }
-
-    // exec respawns the shell: the same effect `newShell` emits
-    const ex = wr(p, ctl, "exec\n");
-    try testing.expectEqual(Status.ok, ex.reply.status);
-    try testing.expect(ex.spawned);
-
-    // several verbs in one write, no trailing newline needed
-    const both = wr(p, ctl, "winsize 100 30\nsig TERM");
-    try testing.expectEqual(@as(u16, 100), both.winsize.?.cols);
-    try testing.expectEqual(pardes.PtySignal.term, both.signal.?);
-
-    // ...and EVERY malformed line refuses the WHOLE batch, so the good verb
-    // beside it never reached the queue. Two passes, one applied.
-    for ([_][]const u8{
-        "winsize", // no arguments
-        "winsize 80", // one argument
-        "winsize 80 24 extra", // three
-        "winsize 0 24", // zero is "unknown", never a width
-        "winsize 80 0",
-        "winsize -1 24", // not a decimal
-        "winsize 999999 24", // wider than a u16
-        "sig", // no name
-        "sig INT TERM", // two
-        "sig SIGINT", // the prefix `kill` dropped in 1988
-        "sig int", // lower case
-        "sig 9", // a number is one platform's number
-        "sig USR1", // a real signal, deliberately not offered
-        "exec /bin/sh", // the effect carries no argv; refused, never ignored
-        "raw", // the draft's TCSETS line, which the core cannot answer
-        "cooked",
-        "winsize 80 24\nbogus", // a good verb beside a bad one
-        "bogus\nwinsize 80 24",
-        "name x", // a `ctl` verb; the two files share no vocabulary
-        "del",
-    }) |bad| {
-        const a = wr(p, ctl, bad);
-        try testing.expectEqual(E.INVAL, a.errno());
-        try testing.expect(a.winsize == null);
-        try testing.expect(a.signal == null);
-        try testing.expect(!a.spawned);
-    }
-
-    // blank lines and surrounding space are not verbs and not errors
-    const spaced = wr(p, ctl, "\n  winsize 90 20  \n\n");
-    try testing.expectEqual(Status.ok, spaced.reply.status);
-    try testing.expectEqual(@as(u16, 90), spaced.winsize.?.cols);
-    // an empty write is a write of nothing
-    try testing.expectEqual(Status.ok, wr(p, ctl, "").reply.status);
-}
-
-/// A host that answers `pull_tty_taken` and nothing else, so `pty/status`'s
-/// third field can be tested with no pty anywhere. The same shape
-/// `pardes.zig`'s own `FakeTtyQuery` has, spelled again here because that one
-/// is private to its own tests.
-const FakeTty = struct {
-    taken: bool,
-
-    const vtable: pardes.Host.VTable = .{ .pull_tty_taken = answer };
-
-    fn answer(ctx: ?*anyopaque, pane: u8) bool {
-        _ = pane;
-        const f: *FakeTty = @ptrCast(@alignCast(ctx.?));
-        return f.taken;
-    }
-};
-
-test "pty/status reports the grid and who holds the tty" {
-    const gpa = testing.allocator;
-    const p = try withTerm(gpa);
-    defer p.deinit();
-    const pane = p.panes[0].?;
-    const status = Node.of(pane.serial, .pty_status);
-
-    const a = rd(p, status, 0, 256);
-    try testing.expectEqual(Status.ok, a.reply.status);
-    var want: [64]u8 = undefined;
-    const whole = try std.fmt.bufPrint(&want, "{d:>11} {d:>11} {d:>11} ", .{ pane.cols, pane.rows, 0 });
-    try testing.expectEqualStrings(whole, a.bytes);
-    // three `%11d ` fields, like `ctl` and `index`, and seekable like both.
-    // The expectation is compared against `want` and not against `a.bytes`,
-    // which the NEXT request's staging invalidates — the borrow window this
-    // whole module is built on.
-    try testing.expectEqual(@as(usize, 3 * 12), a.bytes.len);
-    try testing.expectEqualStrings(whole[12..], rd(p, status, 12, 256).bytes);
-
-    // the third field is `pull_tty_taken`, the probe the core already has
-    var probe: FakeTty = .{ .taken = true };
-    p.host = .{ .ctx = &probe, .vtable = &FakeTty.vtable };
-    const held = rd(p, status, 0, 256);
-    try testing.expectEqualStrings(
-        try std.fmt.bufPrint(&want, "{d:>11} {d:>11} {d:>11} ", .{ pane.cols, pane.rows, 1 }),
-        held.bytes,
-    );
-}
-
-test "pty/data writes at the shell and reads the raw stream" {
-    const gpa = testing.allocator;
-    const p = try withTerm(gpa);
-    defer p.deinit();
-    const serial = serialOf(p);
-    const data = Node.of(serial, .pty_data);
-
-    // WRITE is a pty write, exactly as a body write to a terminal is, and the
-    // offset is ignored because a stream has none
-    const w = call(p, .{ .tag = 2, .op = .write, .node = data, .off = 999, .data = "ls -l\r" });
-    try testing.expectEqual(@as(u32, 6), w.reply.written);
-    try testing.expectEqualStrings("ls -l\r", w.pty());
-    // short at a character boundary, never split, never zero for real bytes
-    try testing.expectEqual(@as(u32, 1), wr(p, data, "a\xC3").reply.written);
-    try testing.expectEqual(@as(u32, 0), wr(p, data, "").reply.written);
-
-    // READ blocks — `.again`, nothing consumed — while there is nothing there
-    try testing.expectEqual(Status.again, rd(p, data, 0, 64).reply.status);
-
-    // THE READER COUNT IS THE GATE: output arriving at a pane nobody is
-    // reading is not recorded, so the queue stays empty and the pane pays
-    // nothing for a filesystem it is not using.
-    p.update(.{ .output = .{ .pane = 0, .bytes = "unwatched" } });
-    while (p.nextEffect()) |_| {}
-    try testing.expectEqual(@as(usize, 0), p.fs.panes[0].pty_out.buf.items.len);
-    try testing.expectEqual(Status.again, rd(p, data, 0, 64).reply.status);
-
-    _ = call(p, .{ .tag = 5, .op = .open, .node = data });
-    try testing.expectEqual(@as(u16, 1), p.fs.panes[0].pty_readers);
-    // ...and it is NOT the event-suppression gate: reading a terminal's output
-    // is not claiming the pane's buttons.
-    try testing.expectEqual(@as(u16, 0), p.fs.listeners);
-    try testing.expect(!p.fs.scripted(0));
-
-    p.update(.{ .output = .{ .pane = 0, .bytes = "hello" } });
-    while (p.nextEffect()) |_| {}
-    try testing.expectEqualStrings("hello", rd(p, data, 0, 64).bytes);
-    try testing.expectEqual(Status.again, rd(p, data, 0, 64).reply.status);
-
-    // UNFRAMED: a read smaller than one arrival is served and the remainder
-    // kept, because raw pty bytes have no records to split down the middle.
-    // `event` refuses exactly this read; that is the difference, on purpose.
-    p.update(.{ .output = .{ .pane = 0, .bytes = "abcdef" } });
-    while (p.nextEffect()) |_| {}
-    try testing.expectEqualStrings("ab", rd(p, data, 0, 2).bytes);
-    try testing.expectEqualStrings("cd", rd(p, data, 0, 2).bytes);
-    // ...and a read SPANS arrivals, which one read(2) on the pty would too
-    p.update(.{ .output = .{ .pane = 0, .bytes = "ghi" } });
-    while (p.nextEffect()) |_| {}
-    try testing.expectEqualStrings("efghi", rd(p, data, 0, 64).bytes);
-
-    // the LAST reader leaving gives the memory back and drops what is stale
-    p.update(.{ .output = .{ .pane = 0, .bytes = "orphan" } });
-    while (p.nextEffect()) |_| {}
-    _ = call(p, .{ .tag = 6, .op = .release, .node = data });
-    try testing.expectEqual(@as(u16, 0), p.fs.panes[0].pty_readers);
-    try testing.expectEqual(@as(usize, 0), p.fs.panes[0].pty_out.buf.capacity);
-    try testing.expectEqual(Status.again, rd(p, data, 0, 64).reply.status);
-
-    // two readers: the second closing leaves the first still recording
-    _ = call(p, .{ .tag = 7, .op = .open, .node = data });
-    _ = call(p, .{ .tag = 8, .op = .open, .node = data });
-    _ = call(p, .{ .tag = 9, .op = .release, .node = data });
-    try testing.expectEqual(@as(u16, 1), p.fs.panes[0].pty_readers);
-    p.update(.{ .output = .{ .pane = 0, .bytes = "still" } });
-    while (p.nextEffect()) |_| {}
-    try testing.expectEqualStrings("still", rd(p, data, 0, 64).bytes);
-}
-
-test "the pty queue drops the oldest at its cap" {
-    const gpa = testing.allocator;
-    const p = try withTerm(gpa);
-    defer p.deinit();
-    const data = Node.of(serialOf(p), .pty_data);
-    _ = call(p, .{ .tag = 5, .op = .open, .node = data });
-
-    // A script that opens the file and stops reading must BOUND the editor,
-    // not grow it. The oldest arrivals go; a reader that fell this far behind
-    // has lost the thread anyway and can re-read `body` to resynchronise.
-    const oldest: [4096]u8 = @splat('A');
-    const rest: [4096]u8 = @splat('B');
-    notePtyOutput(p, 0, &oldest);
-    for (0..queue_cap / rest.len + 4) |_| notePtyOutput(p, 0, &rest);
-    // LIVE bytes, not the buffer: `Queue` pops by moving `head` and reclaims
-    // the space lazily (`compact`), so the allocation trails the contents by
-    // design and the cap is a bound on what is still owed to a reader.
-    const q = &p.fs.panes[0].pty_out;
-    try testing.expect(q.buf.items.len - q.head <= queue_cap);
-
-    var seen: usize = 0;
-    while (true) {
-        const a = rd(p, data, 0, 1 << 16);
-        if (a.reply.status == .again) break;
-        try testing.expect(std.mem.indexOfScalar(u8, a.bytes, 'A') == null);
-        if (a.bytes.len == 0) break;
-        seen += a.bytes.len;
-    }
-    try testing.expect(seen > 0 and seen <= queue_cap);
-}