5e74a908

refactor: every wall test sits beside the code it names

a73x 2026-08-28 20:56

Commit message

refactor: every wall test sits beside the code it names

All 115 tests, same names, split by subject into wall_test_host,
wall_test_picker, wall_test_pump, wall_test_layout and wall_test_wall,
with the benches and stand-in transports they share in
wall_test_harness. wallview.zig reaches them the way server.zig reaches
its own.

docscheck.budget

Old		New
@@ -52,3 +52,9 @@ wall_host.zig 0
52	wall_picker.zig 0	52	wall_picker.zig 0
53	wall_pump.zig 0	53	wall_pump.zig 0
54	wall_layout.zig 1596	54	wall_layout.zig 1596
		55	wall_test_harness.zig 0
		56	wall_test_host.zig 0
		57	wall_test_picker.zig 0
		58	wall_test_pump.zig 0
		59	wall_test_layout.zig 0
		60	wall_test_wall.zig 0

src/tui/wall_test_harness.zig

@@ @@ -0,0 +1,254 @@ @@
+//! Fixtures the wall's test files share: benches that stand a wall up
+//! without a terminal, and the transports and screens they read back.
+const std = @import("std");
+const proto = @import("protocol");
+const client = @import("client");
+const Engine = @import("engine").Engine;
+const layout = @import("layout");
+const wall_host = @import("wall_host.zig");
+const wall_picker = @import("wall_picker.zig");
+const wall_pump = @import("wall_pump.zig");
+const wv = @import("wallview.zig");
+const EndReason = wv.EndReason;
+const Host = wall_host.Host;
+const Shared = wv.Shared;
+const Tile = wv.Tile;
+/// Three tiles: two sessions on host 0 and a same-named one on host 1, so a
+/// diff that aliased by NAME alone would be caught.
+pub fn diffFixture(shared: *Shared) [3]Tile {
+    const t0: client.Target = .{ .sock = "/tmp/h0.sock" };
+    const t1: client.Target = .{ .sock = "/tmp/h1.sock" };
+    const rect: layout.Rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 };
+    return .{
+        .{
+            .r = .{ .target = t0, .label = "--sock /tmp/h0.sock#a", .session = "a" },
+            .rect = rect,
+            .shared = shared,
+            .idx = 0,
+            .wake_r = -1,
+            .wake_w = -1,
+            .host = 0,
+        },
+        .{
+            .r = .{ .target = t0, .label = "--sock /tmp/h0.sock#b", .session = "b" },
+            .rect = rect,
+            .shared = shared,
+            .idx = 1,
+            .wake_r = -1,
+            .wake_w = -1,
+            .host = 0,
+        },
+        .{
+            .r = .{ .target = t1, .label = "--sock /tmp/h1.sock#a", .session = "a" },
+            .rect = rect,
+            .shared = shared,
+            .idx = 2,
+            .wake_r = -1,
+            .wake_w = -1,
+            .host = 1,
+        },
+    };
+}
+/// The keyboard-thread fixture: `running` stopped, so a pump a diff spawns
+/// returns at its first check rather than dialling a socket no test is
+/// listening on.
+pub fn stoppedWall(alloc: std.mem.Allocator, shared: *Shared) void {
+    shared.* = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    shared.running.store(false, .release);
+}
+/// Detached pumps hold `*Tile` into the test's own frame; nothing may return
+/// while one is still running. The wake pipes go here too: the WALL never
+/// closes one (see `ring`), and a test binary would run out of fds.
+pub fn endPumps(tiles: []Tile) void {
+    for (tiles) |*t| {
+        while (t.alive.load(.acquire)) std.Thread.sleep(std.time.ns_per_ms);
+    }
+    for (tiles) |*t| {
+        if (t.wake_r >= 0) std.posix.close(t.wake_r);
+        if (t.wake_w >= 0) std.posix.close(t.wake_w);
+        t.wake_r = -1;
+        t.wake_w = -1;
+    }
+}
+pub fn testHost(shared: *Shared, spelling: []const u8, sock: []const u8) Host {
+    return .{
+        .spec = .{ .spelling = spelling, .target = .{ .sock = sock }, .poll_target = .{ .sock = sock } },
+        .shared = shared,
+    };
+}
+pub fn setList(h: *Host, list: []const u8) void {
+    @memcpy(h.list[0..list.len], list);
+    h.list_len = list.len;
+    h.reachable.store(true, .release);
+}
+// A picker painted into a pipe, drained. Non-blocking on both ends so a
+// frame that outgrew the pipe FAILS here rather than parking the suite.
+pub fn pickerFrame(shared: *Shared, r: std.posix.fd_t, host_table: []Host, sel: usize, out: []u8) []const u8 {
+    wall_picker.paintPicker(shared, host_table, sel, null);
+    const n = std.posix.read(r, out) catch 0;
+    return out[0..n];
+}
+pub fn claimBench(shared: *Shared, idx: usize) Tile {
+    return .{
+        .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "0" },
+        .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+        .shared = shared,
+        .idx = idx,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+}
+/// A wall of `n` tiles with none forgotten.
+fn allPresent(comptime n: usize) [n]bool {
+    return [_]bool{true} ** n;
+}
+/// Only the fields `endAction` reads: a whole Tile describes the pump, not
+/// the rule.
+pub fn endBench(
+    tiles: []Tile,
+    shared: *Shared,
+    ended: usize,
+    reason: EndReason,
+    code: u8,
+    born_from: ?usize,
+) void {
+    for (tiles, 0..) |*t, i| {
+        t.* = .{
+            .r = .{ .target = .{ .sock = "/s" }, .label = "t", .session = "" },
+            .rect = .{ .top = 0, .left = 0, .rows = 2, .cols = 80 },
+            .shared = shared,
+            .idx = i,
+        };
+    }
+    tiles[ended].end.store(@intFromEnum(reason), .release);
+    tiles[ended].code.store(code, .release);
+    tiles[ended].born_from = born_from;
+}
+// A pump, reduced to the one thing this test judges: it takes passes, and
+// remembers the content size the pass told it to send.
+pub const ResizeWitness = struct {
+    t: *Tile,
+    stop: std.atomic.Value(bool) = std.atomic.Value(bool).init(false),
+    sent: std.atomic.Value(u32) = std.atomic.Value(u32).init(0),
+    passes: std.atomic.Value(u64) = std.atomic.Value(u64).init(0),
+    pub fn run(w: *ResizeWitness) void {
+        while (!w.stop.load(.acquire)) {
+            const p = wall_pump.takePass(w.t);
+            if (p.resize) w.sent.store(pack(p.cols, p.rows -| p.label_rows), .release);
+            _ = w.passes.fetchAdd(1, .release);
+        }
+    }
+    pub fn pack(cols: u16, rows: u16) u32 {
+        return (@as(u32, cols) << 16) | @as(u32, rows);
+    }
+};
+// The terminal, as an oracle. The wall's bytes are replayed into an engine
+// and the GRID is judged: a bar painted at a row the terminal no longer has
+// looks fine in the bytes — the terminal clamps the CUP onto its last row —
+// and lands on top of somebody else's content in the grid.
+pub const WallScreen = struct {
+    eng: *Engine,
+    r: std.posix.fd_t,
+    w: std.posix.fd_t,
+    pub fn init(alloc: std.mem.Allocator, cols: u16, rows: u16) !WallScreen {
+        const p = try std.posix.pipe2(.{ .NONBLOCK = true });
+        return .{
+            .eng = try Engine.init(alloc, .{ .cols = cols, .rows = rows }),
+            .r = p[0],
+            .w = p[1],
+        };
+    }
+    pub fn deinit(self: *WallScreen) void {
+        self.eng.deinit();
+        std.posix.close(self.r);
+        std.posix.close(self.w);
+    }
+    pub fn drain(self: *WallScreen) void {
+        var buf: [4096]u8 = undefined;
+        while (std.posix.read(self.r, &buf)) |n| {
+            if (n == 0) break;
+            self.eng.feed(buf[0..n]);
+        } else |_| {}
+    }
+    pub fn line(text: []const u8, n: u16) ?[]const u8 {
+        var it = std.mem.splitScalar(u8, text, '\n');
+        var i: u16 = 0;
+        while (it.next()) |l| : (i += 1) if (i == n) return l;
+        return null;
+    }
+};
+pub fn noticeBench(shared: *Shared, tiles: []Tile) void {
+    for (tiles, 0..) |*t, i| {
+        t.* = Tile{
+            .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+            .shared = shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+    }
+}
+// A transport that swallows every frame: a Core's selection request goes
+// nowhere, which is what lets a copy test stand up without a daemon.
+pub const SwallowTransport = struct {
+    pub fn writeFrame(_: *SwallowTransport, _: proto.MsgType, _: []const u8) !void {}
+};
+// One selection_reply payload — id, status, watermark, text — in the wire
+// form encodeSelectionReply writes, laid out in a caller buffer so a test
+// does not allocate the prefix separately.
+pub fn replyBytes(
+    buf: []u8,
+    id: u32,
+    status: proto.SelectionStatus,
+    history_rows: u32,
+    text: []const u8,
+) []const u8 {
+    std.mem.writeInt(u32, buf[0..4], id, .little);
+    buf[4] = @intFromEnum(status);
+    std.mem.writeInt(u32, buf[5..9], history_rows, .little);
+    @memcpy(buf[proto.selection_reply_prefix_len..][0..text.len], text);
+    return buf[0 .. proto.selection_reply_prefix_len + text.len];
+}
+/// Whether the other end of a non-blocking pipe has been closed: EOF says
+/// yes, EAGAIN says the writer is still holding it.
+pub fn peerClosed(fd: std.posix.fd_t) bool {
+    var b: [1]u8 = undefined;
+    const n = std.posix.read(fd, &b) catch return false;
+    return n == 0;
+}
+/// Everything waiting on a non-blocking pipe. Non-blocking so a half that
+/// stopped writing fails the assertion rather than parking the test on a
+/// read that will never return.
+pub fn readAvail(fd: std.posix.fd_t, buf: []u8) []const u8 {
+    var n: usize = 0;
+    while (std.posix.read(fd, buf[n..])) |got| {
+        if (got == 0) break;
+        n += got;
+    } else |_| {}
+    return buf[0..n];
+}

src/tui/wall_test_host.zig

@@ @@ -0,0 +1,633 @@ @@
+//! The hosts file, the host table and the poller (wall_host.zig).
+const std = @import("std");
+const proto = @import("protocol");
+const wall = @import("wall");
+const hosts = @import("hosts");
+const TmpDir = @import("testtmp").TmpDir;
+const fixture = @import("wall_test_harness.zig");
+const wall_host = @import("wall_host.zig");
+const wv = @import("wallview.zig");
+const AddHost = wall_host.AddHost;
+const BirthNames = wall_host.BirthNames;
+const Host = wall_host.Host;
+const HostSpec = wall_host.HostSpec;
+const Shared = wv.Shared;
+const Tile = wv.Tile;
+const TileIdxs = wall_host.TileIdxs;
+test "planHostDiff: names the daemon has and the wall does not are births, tiles it dropped vanish, and another host's same name is untouched" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var tiles = fixture.diffFixture(&shared);
+    var present = [_]bool{ true, true, true };
+    var births = BirthNames{};
+    var vanish = TileIdxs{};
+    // The birth is immediate; the vanish waits for a second list to agree
+    // (see the grace test below), so this list is asked twice.
+    wall_host.planHostDiff(&tiles, &present, 3, 0, "a\nc\n", null, &births, &vanish);
+    try std.testing.expectEqual(@as(usize, 1), births.len);
+    try std.testing.expectEqualStrings("c", births.get(0));
+    births.len = 0;
+    wall_host.planHostDiff(&tiles, &present, 3, 0, "a\nc\n", null, &births, &vanish);
+    try std.testing.expectEqual(@as(usize, 1), vanish.len);
+    try std.testing.expectEqual(@as(usize, 1), vanish.get(0));
+    // Host 1's "a" survives host 0's list saying nothing about it.
+    births.len = 0;
+    vanish.len = 0;
+    wall_host.planHostDiff(&tiles, &present, 3, 1, "a\n", null, &births, &vanish);
+    try std.testing.expectEqual(@as(usize, 0), births.len + vanish.len);
+    // An empty list vanishes everything the host had, once every tile has
+    // spent the grace.
+    wall_host.planHostDiff(&tiles, &present, 3, 0, "", null, &births, &vanish);
+    vanish.len = 0;
+    wall_host.planHostDiff(&tiles, &present, 3, 0, "", null, &births, &vanish);
+    try std.testing.expectEqual(@as(usize, 2), vanish.len);
+    try std.testing.expectEqual(@as(usize, 0), births.len);
+}
+test "planHostDiff: a live pump's tile is not vanished by ONE list that lacks it" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var tiles = fixture.diffFixture(&shared);
+    var present = [_]bool{ true, true, true };
+    var births = BirthNames{};
+    var vanish = TileIdxs{};
+    // A poll can overtake a session's exit: the daemon has already dropped
+    // the name while the pump has not yet read its `exit_status`. Vanishing
+    // on that list loses the exit code — on a wall of one, `endedTile` skips
+    // a tile that is no longer present and mux never leaves.
+    wall_host.planHostDiff(&tiles, &present, 3, 0, "a\n", null, &births, &vanish);
+    try std.testing.expectEqual(@as(usize, 0), vanish.len);
+    try std.testing.expect(tiles[1].missed_once);
+    // A list that names it again forgives it: a tile does not accumulate
+    // misses across the seconds it is legitimately live.
+    wall_host.planHostDiff(&tiles, &present, 3, 0, "a\nb\n", null, &births, &vanish);
+    try std.testing.expectEqual(@as(usize, 0), vanish.len);
+    try std.testing.expect(!tiles[1].missed_once);
+    // Two consecutive lists without it, and it goes.
+    wall_host.planHostDiff(&tiles, &present, 3, 0, "a\n", null, &births, &vanish);
+    wall_host.planHostDiff(&tiles, &present, 3, 0, "a\n", null, &births, &vanish);
+    try std.testing.expectEqual(@as(usize, 1), vanish.len);
+    try std.testing.expectEqual(@as(usize, 1), vanish.get(0));
+    // A pump that has ENDED has no exit code left to lose, so its tile
+    // needs no grace at all.
+    tiles[0].alive.store(false, .release);
+    vanish.len = 0;
+    const only0 = [_]bool{ true, false, false };
+    wall_host.planHostDiff(&tiles, &only0, 3, 0, "", null, &births, &vanish);
+    try std.testing.expectEqual(@as(usize, 1), vanish.len);
+    try std.testing.expectEqual(@as(usize, 0), vanish.get(0));
+}
+test "planHostDiff: a vanished tile is not present, so the next list does not vanish it twice" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var tiles = fixture.diffFixture(&shared);
+    var present = [_]bool{ true, false, true };
+    var births = BirthNames{};
+    var vanish = TileIdxs{};
+    wall_host.planHostDiff(&tiles, &present, 3, 0, "a\n", null, &births, &vanish);
+    try std.testing.expectEqual(@as(usize, 0), vanish.len);
+    // ...and the name is not reborn either: the tile is gone, but the
+    // daemon no longer lists it, so there is nothing to bring back.
+    try std.testing.expectEqual(@as(usize, 0), births.len);
+}
+test "planHostDiff: the session this shell is inside is never born as a tile" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var tiles = fixture.diffFixture(&shared);
+    var present = [_]bool{ true, true, true };
+    var births = BirthNames{};
+    var vanish = TileIdxs{};
+    // The daemon has "a", "b" and "self"; "self" is the shell mux runs in,
+    // so a tile of it would paint into the grid it is reading.
+    wall_host.planHostDiff(&tiles, &present, 3, 0, "a\nb\nself\n", "self", &births, &vanish);
+    try std.testing.expectEqual(@as(usize, 0), births.len);
+    try std.testing.expectEqual(@as(usize, 0), vanish.len);
+}
+test "planHostDiff: a name the wire grammar refuses never becomes a tile, however the peer spells it" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var tiles = fixture.diffFixture(&shared);
+    var present = [_]bool{ true, true, true };
+    var births = BirthNames{};
+    var vanish = TileIdxs{};
+    // A whole reply may be `sessions_text_max`, so ONE "name" in it can be
+    // 1056 bytes; `encodeAttachNamed` memcpys the birth's name into a
+    // 32-byte tail behind nothing but an assert. Peer bytes are filtered
+    // where they become a tile, not asserted about at the wire.
+    const over_long = "x" ** (proto.session_name_max + 1);
+    const list = "a\n" ++ over_long ++ "\nhas space\n\x1b[2J\nc\n";
+    wall_host.planHostDiff(&tiles, &present, 3, 0, list, null, &births, &vanish);
+    try std.testing.expectEqual(@as(usize, 1), births.len);
+    try std.testing.expectEqualStrings("c", births.get(0));
+}
+test "applyReadyLists: a host added after the wall opened gets its sessions, and reaches past nothing" {
+    var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer arena.deinit();
+    const alloc = arena.allocator();
+    var shared: Shared = undefined;
+    fixture.stoppedWall(alloc, &shared);
+    var tiles: [8]Tile = undefined;
+    var present = [_]bool{false} ** 8;
+    var live: usize = 0;
+    defer fixture.endPumps(tiles[0..live]);
+    // TWO hosts open the wall and a THIRD arrives from the picker. A fixture
+    // whose table never grows cannot see a per-host flag sized at the count
+    // the wall opened with — which is the whole of this.
+    var table = [_]Host{
+        fixture.testHost(&shared, "box", "/tmp/box.sock"),
+        fixture.testHost(&shared, "vm", "/tmp/vm.sock"),
+        fixture.testHost(&shared, "--sock /tmp/added.sock", "/tmp/added.sock"),
+    };
+    fixture.setList(&table[2], "late\n");
+    table[2].list_ready.store(true, .release);
+    _ = wall_host.applyReadyLists(alloc, &tiles, &present, &live, &shared, table[0..3]);
+    // The added host's session is a tile, and only the host that reported is
+    // marked: the two that opened the wall are still owed a first list.
+    try std.testing.expect(table[2].applied);
+    try std.testing.expect(!table[0].applied);
+    try std.testing.expect(!table[1].applied);
+    try std.testing.expectEqual(@as(usize, 1), live);
+    try std.testing.expectEqualStrings("late", tiles[0].r.session);
+}
+test "recordHost: a file it cannot write comes BACK — the wall may be on the alternate screen" {
+    const alloc = std.testing.allocator;
+    var tmp = try TmpDir.make();
+    defer tmp.cleanup();
+    var bad_buf: [256]u8 = undefined;
+    var ok_buf: [256]u8 = undefined;
+    var blocker_buf: [256]u8 = undefined;
+    // A path whose parent is a FILE. `saveBytes` makes missing directories,
+    // so an absent one is not a failure — this is. The caller has to say so
+    // out loud, and WHERE it may say it depends on which caller it is:
+    // stderr before the screen is taken, a notice after.
+    const blocker = try std.fmt.bufPrint(&blocker_buf, "{s}/notadir", .{tmp.path()});
+    try wall.saveBytes(blocker, "x");
+    const bad = try std.fmt.bufPrint(&bad_buf, "{s}/notadir/hosts", .{tmp.path()});
+    const ok = try std.fmt.bufPrint(&ok_buf, "{s}/hosts", .{tmp.path()});
+    try std.testing.expect(wall_host.recordHost(alloc, .{ .sock = "/a" }, "--sock /a", bad) != null);
+    try std.testing.expect(wall_host.recordHost(alloc, .{ .sock = "/a" }, "--sock /a", ok) == null);
+    // `--via` has no form in the host grammar, and writing nothing down for
+    // it is not a failure to report.
+    try std.testing.expect(wall_host.recordHost(alloc, .{ .via = "ssh h muxd proxy" }, "x", bad) == null);
+}
+test "applyHostList: a host with no live session gets no tile — the wall shows sessions only" {
+    var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer arena.deinit();
+    const alloc = arena.allocator();
+    var shared: Shared = undefined;
+    fixture.stoppedWall(alloc, &shared);
+    var tiles: [4]Tile = undefined;
+    var present = [_]bool{false} ** 4;
+    var live: usize = 0;
+    defer fixture.endPumps(tiles[0..live]);
+    // The two ways a host has nothing to show, side by side: one that never
+    // answered and one that answered with an empty list.
+    var table = [_]Host{
+        fixture.testHost(&shared, "down", "/tmp/nobody.sock"),
+        fixture.testHost(&shared, "empty", "/tmp/empty.sock"),
+    };
+    table[0].reachable.store(false, .release);
+    fixture.setList(&table[1], "");
+    // Twice, because a placeholder that is born once is still a placeholder.
+    for (0..2) |_| {
+        wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
+        wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 1);
+    }
+    try std.testing.expectEqual(@as(usize, 0), live);
+    try std.testing.expectEqual(@as(usize, 0), wv.presentCount(present[0..]));
+    // A session on the empty host, and the wall has exactly the one tile.
+    fixture.setList(&table[1], "a\n");
+    wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 1);
+    try std.testing.expectEqual(@as(usize, 1), wv.presentCount(present[0..live]));
+    try std.testing.expectEqualStrings("a", tiles[0].r.session);
+    try std.testing.expectEqual(@as(?usize, 1), tiles[0].host);
+}
+test "applyHostList: a live tile survives one list that lost its session, and goes on the next" {
+    var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer arena.deinit();
+    const alloc = arena.allocator();
+    var shared: Shared = undefined;
+    fixture.stoppedWall(alloc, &shared);
+    var tiles: [4]Tile = undefined;
+    var present = [_]bool{false} ** 4;
+    var live: usize = 0;
+    defer fixture.endPumps(tiles[0..live]);
+    // Two sessions, because the tile that keeps its name is what shows the
+    // grace is per tile and not a wall-wide pause.
+    var table = [_]Host{fixture.testHost(&shared, "box", "/tmp/box.sock")};
+    fixture.setList(&table[0], "a\nb\n");
+    wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
+    try std.testing.expectEqual(@as(usize, 2), live);
+    // The wall's pumps are stopped in this fixture, so the liveness the rule
+    // turns on is stated rather than raced for.
+    tiles[0].alive.store(true, .release);
+    tiles[1].alive.store(true, .release);
+    fixture.setList(&table[0], "a\n");
+    wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
+    // Still there: this list may have overtaken an `exit_status` the pump
+    // has not read yet, and that code is the run's own on a wall of one.
+    try std.testing.expect(present[1]);
+    try std.testing.expect(present[0]);
+    wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
+    try std.testing.expect(!present[1]);
+    try std.testing.expect(present[0]);
+}
+test "applyHostList: two sessions on an empty wall are two tiles, the first focused" {
+    var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer arena.deinit();
+    const alloc = arena.allocator();
+    var shared: Shared = undefined;
+    fixture.stoppedWall(alloc, &shared);
+    var tiles: [4]Tile = undefined;
+    var present = [_]bool{false} ** 4;
+    var live: usize = 0;
+    defer fixture.endPumps(tiles[0..live]);
+    var table = [_]Host{fixture.testHost(&shared, "box", "/tmp/box.sock")};
+    fixture.setList(&table[0], "a\nb\n");
+    wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
+    // The first birth has no leaf to sit beside — an empty tree takes it as
+    // its root, and the second inserts against it.
+    try std.testing.expectEqual(@as(usize, 2), live);
+    try std.testing.expectEqual(@as(usize, 2), shared.tree.count());
+    try std.testing.expectEqualStrings("a", tiles[0].r.session);
+    try std.testing.expectEqualStrings("b", tiles[1].r.session);
+    try std.testing.expectEqual(@as(usize, 0), shared.sel);
+    try std.testing.expect(tiles[0].claim_pending.load(.acquire));
+}
+test "applyHostList: one list's tiles are laid out in the order the daemon reported them" {
+    var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer arena.deinit();
+    const alloc = arena.allocator();
+    var shared: Shared = undefined;
+    fixture.stoppedWall(alloc, &shared);
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    var tiles: [4]Tile = undefined;
+    var present = [_]bool{false} ** 4;
+    var live: usize = 0;
+    defer fixture.endPumps(tiles[0..live]);
+    var table = [_]Host{fixture.testHost(&shared, "box", "/tmp/box.sock")};
+    // THREE, because two cannot fail: the first birth roots the tree and the
+    // second lands after it whatever it anchored on. The third is the one
+    // that has a choice, and anchoring it back at the focus puts it BETWEEN
+    // its two siblings.
+    fixture.setList(&table[0], "a\nb\nc\n");
+    wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
+    try std.testing.expectEqual(@as(usize, 3), live);
+    // Down the screen in the daemon's own order. The tile ARRAY is in that
+    // order by construction; what this reads is the flatten, which is where
+    // an anchor that did not move shows up.
+    const flat = shared.last_flat orelse return error.NoFlat;
+    const top_a = (flat.rectOf(0) orelse return error.NoRect).top;
+    const top_b = (flat.rectOf(1) orelse return error.NoRect).top;
+    const top_c = (flat.rectOf(2) orelse return error.NoRect).top;
+    try std.testing.expectEqualStrings("a", tiles[0].r.session);
+    try std.testing.expectEqualStrings("b", tiles[1].r.session);
+    try std.testing.expectEqualStrings("c", tiles[2].r.session);
+    try std.testing.expect(top_a < top_b);
+    try std.testing.expect(top_b < top_c);
+}
+test "applyHostList: sessions past the wall's capacity are counted in the notice, not dropped in silence" {
+    var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer arena.deinit();
+    const alloc = arena.allocator();
+    var shared: Shared = undefined;
+    fixture.stoppedWall(alloc, &shared);
+    var tiles: [wv.max_tiles]Tile = undefined;
+    var present = [_]bool{true} ** wv.max_tiles;
+    var live: usize = wv.max_tiles;
+    var names: [wv.max_tiles][2]u8 = undefined;
+    var text: std.ArrayList(u8) = .empty;
+    for (&tiles, 0..) |*t, i| {
+        const name = std.fmt.bufPrint(&names[i], "{d}", .{i}) catch unreachable;
+        t.* = .{
+            .r = .{ .target = .{ .sock = "/tmp/box.sock" }, .label = "box", .session = name },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+            .host = 0,
+            .alive = std.atomic.Value(bool).init(false),
+        };
+        try text.appendSlice(alloc, name);
+        try text.append(alloc, '\n');
+    }
+    // Two more than the wall can hold.
+    try text.appendSlice(alloc, "x\ny\n");
+    var table = [_]Host{fixture.testHost(&shared, "box", "/tmp/box.sock")};
+    fixture.setList(&table[0], text.items);
+    wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
+    try std.testing.expectEqual(@as(usize, wv.max_tiles), live);
+    var buf: [96]u8 = undefined;
+    try std.testing.expectEqualStrings("[+2 not shown]", wv.takeNotice(&shared, &buf));
+}
+test "applyHostList: a wall too thin for a second pane takes what fits and retains nothing for the rest" {
+    // The TESTING allocator, not an arena: what this pins is that a birth
+    // the wall refuses leaves no allocation behind, and only leak detection
+    // can say so. The tile that DID fit owns its copies, so the test frees
+    // exactly those two.
+    const alloc = std.testing.allocator;
+    var shared: Shared = undefined;
+    fixture.stoppedWall(alloc, &shared);
+    // Four rows: one pane fits (`min_session_rows`), two never can — each
+    // would owe a label bar on top of that floor.
+    shared.size = .{ .cols = 80, .rows = 4 };
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    var tiles: [4]Tile = undefined;
+    var present = [_]bool{false} ** 4;
+    var live: usize = 0;
+    defer fixture.endPumps(tiles[0..live]);
+    defer for (tiles[0..live]) |*t| {
+        alloc.free(t.r.session);
+        alloc.free(t.r.label);
+    };
+    var table = [_]Host{fixture.testHost(&shared, "box", "/tmp/box.sock")};
+    fixture.setList(&table[0], "a\nb\n");
+    wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
+    try std.testing.expectEqual(@as(usize, 1), live);
+    try std.testing.expectEqualStrings("a", tiles[0].r.session);
+    var buf: [96]u8 = undefined;
+    try std.testing.expectEqualStrings("[+1 not shown]", wv.takeNotice(&shared, &buf));
+}
+test "applyHostList: when a host's last session goes the wall empties, and nothing stands in for the host" {
+    var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer arena.deinit();
+    const alloc = arena.allocator();
+    var shared: Shared = undefined;
+    fixture.stoppedWall(alloc, &shared);
+    var tiles: [4]Tile = undefined;
+    var present = [_]bool{false} ** 4;
+    var live: usize = 1;
+    defer fixture.endPumps(tiles[0..live]);
+    tiles[0] = .{
+        .r = .{ .target = .{ .sock = "/tmp/box.sock" }, .label = "--sock /tmp/box.sock#a", .session = "a" },
+        .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+        .host = 0,
+        .alive = std.atomic.Value(bool).init(false),
+    };
+    present[0] = true;
+    try shared.tree.addFirst(0);
+    var table = [_]Host{fixture.testHost(&shared, "box", "/tmp/box.sock")};
+    // The daemon has nothing left: a restart, or another client ended it.
+    fixture.setList(&table[0], "");
+    wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
+    // The host is up with nothing on it, which the wall says by showing
+    // nothing: no placeholder tile takes the gone session's place.
+    try std.testing.expect(!present[0]);
+    try std.testing.expectEqual(@as(usize, 0), wv.presentCount(present[0..]));
+}
+test "planHostDiff: a creating tile whose attach has not landed yet is not vanished by the list that raced it" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var tiles = fixture.diffFixture(&shared);
+    // `Ctrl-\ c` picked "b" off the daemon's free list and the tile is
+    // dialling; `pokeHost` asks for the list at exactly this moment, and
+    // the daemon answers before the attach that makes "b" lands.
+    tiles[1].creates = true;
+    var present = [_]bool{ true, true, true };
+    var births = BirthNames{};
+    var vanish = TileIdxs{};
+    wall_host.planHostDiff(&tiles, &present, 3, 0, "a\n", null, &births, &vanish);
+    try std.testing.expectEqual(@as(usize, 0), vanish.len);
+    // ...and once its session exists, the same list does drop it — after
+    // the one list of grace a live pump gets: a session the daemon HAD and
+    // no longer lists is gone.
+    tiles[1].ever_up.store(true, .release);
+    wall_host.planHostDiff(&tiles, &present, 3, 0, "a\n", null, &births, &vanish);
+    wall_host.planHostDiff(&tiles, &present, 3, 0, "a\n", null, &births, &vanish);
+    try std.testing.expectEqual(@as(usize, 1), vanish.len);
+    try std.testing.expectEqual(@as(usize, 1), vanish.get(0));
+}
+test "hostsOverCapacity: a hosts file past the wall's room is counted out loud, not cut in silence" {
+    var buf: [64]u8 = undefined;
+    // Exactly full is not over: the boundary is where a silent cut starts.
+    try std.testing.expectEqual(@as(?[]const u8, null), wall_host.hostsOverCapacity(&buf, wv.max_tiles));
+    try std.testing.expectEqual(@as(?[]const u8, null), wall_host.hostsOverCapacity(&buf, 0));
+    try std.testing.expectEqualStrings(
+        "[+1 host in the file not shown]",
+        wall_host.hostsOverCapacity(&buf, wv.max_tiles + 1) orelse "",
+    );
+    try std.testing.expectEqualStrings(
+        "[+9 hosts in the file not shown]",
+        wall_host.hostsOverCapacity(&buf, wv.max_tiles + 9) orelse "",
+    );
+}
+test "addHost: a forgotten host's slot comes back, so a and x cannot fill the table between them" {
+    const alloc = std.testing.allocator;
+    var tmp = try TmpDir.make();
+    defer tmp.cleanup();
+    var path_buf: [256]u8 = undefined;
+    const path = try std.fmt.bufPrint(&path_buf, "{s}/hosts", .{tmp.path()});
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    defer shared.tree.deinit();
+    // A FULL table is the only one that can see a forgotten slot refused:
+    // `hosts_live` only ever grew, so 32 adds spent the wall for good even
+    // with two rows left in the picker.
+    var table: [2]Host = undefined;
+    table[0] = .{ .spec = .{ .spelling = "--sock /a", .target = .{ .sock = "/a" }, .poll_target = .{ .sock = "/a" } }, .shared = &shared };
+    table[1] = .{ .spec = .{ .spelling = "--sock /b", .target = .{ .sock = "/b" }, .poll_target = .{ .sock = "/b" } }, .shared = &shared };
+    var n: usize = 2;
+    var buf: [96]u8 = undefined;
+    try std.testing.expect(wall_host.addHost(alloc, &shared, &table, &n, "--sock /c", null, 30_000, path) == .refused);
+    try std.testing.expectEqualStrings("[no room on the wall for another host]", wv.takeNotice(&shared, &buf));
+    // `x` asks the poller to leave; until it has, the slot is still its own.
+    // A spec overwritten under a live poller is a thread dialling a target
+    // that has been replaced.
+    table[0].forgotten.store(true, .release);
+    try std.testing.expect(wall_host.addHost(alloc, &shared, &table, &n, "--sock /c", null, 30_000, path) == .refused);
+    try std.testing.expectEqualStrings("[no room on the wall for another host]", wv.takeNotice(&shared, &buf));
+    // The poller's last act, and the slot is the wall's again.
+    table[0].poller_done.store(true, .release);
+    const at = switch (wall_host.addHost(alloc, &shared, &table, &n, "--sock /c", null, 30_000, path)) {
+        .added => |i| i,
+        else => return error.HostWasNotAdded,
+    };
+    // `run`'s allocator is an ARENA that never returns, so a reused slot's
+    // old spec is deliberately not freed there; a test outlives its own.
+    defer alloc.free(table[at].spec.spelling);
+    try std.testing.expectEqual(@as(usize, 0), at);
+    try std.testing.expectEqual(@as(usize, 2), n);
+    try std.testing.expectEqualStrings("/c", table[0].spec.target.sock);
+    try std.testing.expect(!table[0].forgotten.load(.acquire));
+    try std.testing.expect(!table[0].poller_done.load(.acquire));
+}
+test "addHost: the prompt adds a DAEMON — a flag, a session and a host already listed are all refused" {
+    const alloc = std.testing.allocator;
+    var tmp = try TmpDir.make();
+    defer tmp.cleanup();
+    var path_buf: [256]u8 = undefined;
+    const path = try std.fmt.bufPrint(&path_buf, "{s}/hosts", .{tmp.path()});
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    defer shared.tree.deinit();
+    // Two hosts on the wall before the prompt is ever opened: a table that
+    // only ever held one cannot see an append landing on the wrong row.
+    var table: [4]Host = undefined;
+    table[0] = .{ .spec = .{ .spelling = "--sock /a", .target = .{ .sock = "/a" }, .poll_target = .{ .sock = "/a" } }, .shared = &shared };
+    table[1] = .{ .spec = .{ .spelling = "--sock /b", .target = .{ .sock = "/b" }, .poll_target = .{ .sock = "/b" } }, .shared = &shared };
+    var n: usize = 2;
+    var buf: [96]u8 = undefined;
+    // The typo `mux hosts add -A host` dies at, typed at the prompt
+    // instead: a host named `-A` is nobody's intent at either mouth.
+    try std.testing.expect(wall_host.addHost(alloc, &shared, &table, &n, "-A nosuchhost.invalid", null, 30_000, path) == .refused);
+    try std.testing.expectEqual(@as(usize, 2), n);
+    try std.testing.expectEqualStrings("[bad host: FlagLikeTarget]", wv.takeNotice(&shared, &buf));
+    // `#` is the old wall grammar's session split. The prompt names a
+    // daemon now, and the refusal says which half was one too many.
+    try std.testing.expect(wall_host.addHost(alloc, &shared, &table, &n, "--sock /c#work", null, 30_000, path) == .refused);
+    try std.testing.expectEqual(@as(usize, 2), n);
+    try std.testing.expect(std.mem.indexOf(u8, wv.takeNotice(&shared, &buf), "daemons") != null);
+    // A real one: it lands in the table AND in the file, because the wall
+    // the user is looking at and the wall they get back are the same wall.
+    const at = switch (wall_host.addHost(alloc, &shared, &table, &n, "--sock /c", null, 30_000, path)) {
+        .added => |i| i,
+        else => return error.HostWasNotAdded,
+    };
+    // `run`'s allocator never returns, so the table's copy is deliberately
+    // never freed there; a test outlives its allocator's bookkeeping.
+    defer alloc.free(table[at].spec.spelling);
+    try std.testing.expectEqual(@as(usize, 2), at);
+    try std.testing.expectEqual(@as(usize, 3), n);
+    try std.testing.expectEqualStrings("/c", table[2].spec.target.sock);
+    var h = try hosts.load(alloc, path);
+    defer h.deinit(alloc);
+    try std.testing.expect(h.has("--sock /c"));
+    // Twice is once: the poller is already asking that daemon for its
+    // sessions, and a second one would tile every one of them again. It
+    // says so and names the row, because an unchanged popup and an unmoved
+    // selection is the prompt answering a real host with nothing at all.
+    try std.testing.expectEqual(
+        AddHost{ .listed = 2 },
+        wall_host.addHost(alloc, &shared, &table, &n, "--sock /c", null, 30_000, path),
+    );
+    try std.testing.expectEqual(@as(usize, 3), n);
+    try std.testing.expectEqualStrings("[that host is already on the wall]", wv.takeNotice(&shared, &buf));
+    // Full is said out loud, not swallowed.
+    n = table.len;
+    try std.testing.expect(wall_host.addHost(alloc, &shared, &table, &n, "--sock /d", null, 30_000, path) == .refused);
+    try std.testing.expectEqualStrings("[no room on the wall for another host]", wv.takeNotice(&shared, &buf));
+}
+test "resolveHost refuses a sun_path-overflowing sock path" {
+    const alloc = std.testing.allocator;
+    // Refused at usage altitude, not at a connect that fails with a
+    // truncated sun_path nobody typed.
+    const long = "--sock /" ++ "x" ** 200;
+    try std.testing.expectError(error.SockPathTooLong, wall_host.resolveHost(alloc, long, null, 30_000));
+}
+test "resolveHost: an ssh host is polled by a recipe that cannot prompt and cannot narrate" {
+    var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer arena.deinit();
+    const alloc = arena.allocator();
+    // Two spellings, because the poll target is built per host and a shared
+    // one would point every stripe at the first host's ssh line.
+    for ([_][]const u8{ "box", "user@gate" }) |spelling| {
+        const spec = try wall_host.resolveHost(alloc, spelling, null, 30_000);
+        try std.testing.expect(std.mem.indexOf(u8, spec.poll_target.hand.ssh_cmd, "BatchMode=yes") != null);
+        try std.testing.expectEqualStrings(spelling, spec.poll_target.hand.host);
+        // The attach the user sees must still be able to ask for a password.
+        try std.testing.expect(std.mem.indexOf(u8, spec.target.hand.ssh_cmd, "BatchMode") == null);
+        // Neither door narrates a fallback: both are dialled under a wall
+        // that owns the alternate screen.
+        try std.testing.expect(!spec.target.hand.asked);
+        try std.testing.expect(!spec.poll_target.hand.asked);
+    }
+    // A transport that cannot prompt has one target, not a copy of one.
+    const s = try wall_host.resolveHost(alloc, "--sock /tmp/a.sock", null, 30_000);
+    try std.testing.expectEqualStrings(s.target.sock, s.poll_target.sock);
+}
+test "pollDelayMs: a poll that cost an ssh login is asked ten times less often" {
+    // The whole point of the number: a pipe-answered poll spawned `ssh`,
+    // read the announce and killed it — a remote auth log line per cycle.
+    try std.testing.expectEqual(@as(u64, 10_000), wall_host.pollDelayMs(.pipe));
+    try std.testing.expectEqual(@as(u64, 1_000), wall_host.pollDelayMs(.fd));
+    try std.testing.expectEqual(@as(u64, 1_000), wall_host.pollDelayMs(.quic));
+}
+test "otherHosts: the dialled host is not tiled twice, and the rest follow in file order" {
+    const alloc = std.testing.allocator;
+    var tmp = try TmpDir.make();
+    defer tmp.cleanup();
+    var buf: [256]u8 = undefined;
+    const path = try std.fmt.bufPrint(&buf, "{s}/hosts", .{tmp.path()});
+    // Off-origin: the host the user dialled is the file's SECOND line, so a
+    // skip that only ever worked on line 0 is caught here.
+    try wall.saveBytes(path, "--sock /a\n--sock /b\n");
+    var arena_state = std.heap.ArenaAllocator.init(alloc);
+    defer arena_state.deinit();
+    const arena = arena_state.allocator();
+    var specs: std.ArrayList(HostSpec) = .empty;
+    try specs.append(arena, .{ .spelling = "--sock /b", .target = .{ .sock = "/b" }, .poll_target = .{ .sock = "/b" } });
+    wall_host.otherHosts(arena, &specs, "--sock /b", path, null, 0);
+    try std.testing.expectEqual(@as(usize, 2), specs.items.len);
+    try std.testing.expectEqualStrings("--sock /b", specs.items[0].spelling);
+    try std.testing.expectEqualStrings("--sock /a", specs.items[1].spelling);
+    // A file the grammar refuses costs the user the WALL, never the session
+    // they asked for: the entry host stands alone and the attach goes on.
+    try wall.saveBytes(path, "--sock /a\nbox#old\n");
+    var one: std.ArrayList(HostSpec) = .empty;
+    try one.append(arena, .{ .spelling = "--sock /b", .target = .{ .sock = "/b" }, .poll_target = .{ .sock = "/b" } });
+    wall_host.otherHosts(arena, &one, "--sock /b", path, null, 0);
+    try std.testing.expectEqual(@as(usize, 1), one.items.len);
+}

src/tui/wall_test_layout.zig

@@ @@ -0,0 +1,916 @@ @@
+//! The pane tree, the rects it cuts and the layout sidecar (wall_layout.zig).
+const std = @import("std");
+const proto = @import("protocol");
+const wall = @import("wall");
+const layout = @import("layout");
+const TmpDir = @import("testtmp").TmpDir;
+const fixture = @import("wall_test_harness.zig");
+const wall_host = @import("wall_host.zig");
+const wall_layout = @import("wall_layout.zig");
+const wv = @import("wallview.zig");
+const ResizeWitness = fixture.ResizeWitness;
+const Resolved = wall_host.Resolved;
+const Shared = wv.Shared;
+const Tile = wv.Tile;
+const WallScreen = fixture.WallScreen;
+test "the tree's stacked cut splits rows with the remainder at the top" {
+    const alloc = std.testing.allocator;
+    var tree = layout.Tree.init(alloc);
+    defer tree.deinit();
+    try tree.addFirst(0);
+    try tree.insert(0, 1);
+    try tree.insert(1, 2);
+    var f = try tree.flatten(alloc, 25, 80, wall_layout.wallFloors(3), null);
+    defer f.deinit(alloc);
+    try std.testing.expectEqual(layout.Rect{ .top = 0, .left = 0, .rows = 9, .cols = 80 }, f.rectOf(0).?);
+    try std.testing.expectEqual(layout.Rect{ .top = 9, .left = 0, .rows = 8, .cols = 80 }, f.rectOf(1).?);
+    try std.testing.expectEqual(layout.Rect{ .top = 17, .left = 0, .rows = 8, .cols = 80 }, f.rectOf(2).?);
+}
+test "the tree refuses a wall that cannot show a content row" {
+    const alloc = std.testing.allocator;
+    var tree = layout.Tree.init(alloc);
+    defer tree.deinit();
+    // 12 tiles over 23 rows: 1 row each — a label with no content.
+    try tree.addFirst(0);
+    for (1..12) |i| try tree.insert(@intCast(i - 1), @intCast(i));
+    try std.testing.expectError(error.TooSmall, tree.flatten(alloc, 23, 80, wall_layout.wallFloors(12), null));
+}
+test "the tree refuses a multi-tile cut too thin for the daemon's row floor" {
+    const alloc = std.testing.allocator;
+    var tree = layout.Tree.init(alloc);
+    defer tree.deinit();
+    try tree.addFirst(0);
+    try tree.insert(0, 1);
+    // Two tiles on five rows: each rect is two rows, and under a label
+    // bar that is one content row — below `min_session_rows`, so the
+    // daemon refuses the resize and the tile freezes on a stale grid.
+    try std.testing.expectError(error.TooSmall, tree.flatten(alloc, 5, 80, wall_layout.wallFloors(2), null));
+    try std.testing.expectError(error.TooSmall, tree.flatten(alloc, 4, 80, wall_layout.wallFloors(2), null));
+    // Six rows is the first cut that fits: three a rect, two of them
+    // content under the bar — exactly the daemon's row floor.
+    var f = try tree.flatten(alloc, 6, 80, wall_layout.wallFloors(2), null);
+    defer f.deinit(alloc);
+    try std.testing.expectEqual(@as(u16, 3), f.rectOf(0).?.rows);
+    try std.testing.expectEqual(@as(u16, 3), f.rectOf(1).?.rows);
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 6 }, .is_tty = false };
+    shared.label_rows = 1; // two tiles draw a bar
+    var t0 = Tile{
+        .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+        .rect = f.rectOf(0).?,
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    var t1 = Tile{
+        .r = .{ .target = .{ .sock = "/tmp/y" }, .label = "y", .session = "" },
+        .rect = f.rectOf(1).?,
+        .shared = &shared,
+        .idx = 1,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    try std.testing.expectEqual(proto.min_session_rows, t0.viewRows());
+    try std.testing.expectEqual(proto.min_session_rows, t1.viewRows());
+    // A one-tile wall draws no bar, so its floor is the daemon's alone.
+    var one = layout.Tree.init(alloc);
+    defer one.deinit();
+    try one.addFirst(0);
+    var of = try one.flatten(alloc, 2, 80, wall_layout.wallFloors(1), null);
+    defer of.deinit(alloc);
+    try std.testing.expectEqual(@as(u16, 2), of.rectOf(0).?.rows);
+}
+test "viewRows: a one-tile wall keeps every row, a multi-tile wall loses the label bar" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    // A one-tile wall: no label bar, the tile claims every row.
+    shared.label_rows = 0;
+    var t0 = Tile{
+        .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+        .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    try std.testing.expectEqual(@as(u16, 24), t0.viewRows());
+    // A two-tile wall: each tile loses one row to the label bar.
+    shared.label_rows = 1;
+    var t1 = Tile{
+        .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+        .rect = .{ .top = 0, .left = 0, .rows = 12, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    var t2 = Tile{
+        .r = .{ .target = .{ .sock = "/tmp/y" }, .label = "y", .session = "" },
+        .rect = .{ .top = 12, .left = 0, .rows = 12, .cols = 80 },
+        .shared = &shared,
+        .idx = 1,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    try std.testing.expectEqual(@as(u16, 11), t1.viewRows());
+    try std.testing.expectEqual(@as(u16, 11), t2.viewRows());
+}
+test "relayout sets resize_pending on every live tile" {
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    try shared.tree.addFirst(0);
+    try shared.tree.insert(0, 1);
+    const tiles = try alloc.alloc(Tile, 2);
+    defer alloc.free(tiles);
+    const present = try alloc.alloc(bool, 2);
+    defer alloc.free(present);
+    present[0] = true;
+    present[1] = true;
+    for (tiles, 0..) |*t, i| {
+        t.* = Tile{
+            .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+    }
+    wall_layout.relayout(alloc, tiles, present, &shared, 0);
+    // Two tiles: a label bar appears.
+    try std.testing.expectEqual(@as(u8, 1), shared.label_rows);
+    // Every tile is doorbelled: its pump sends the new rect.
+    try std.testing.expect(tiles[0].resize_pending);
+    try std.testing.expect(tiles[1].resize_pending);
+}
+test "a relayout landing mid-pass is still sent" {
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    try shared.tree.addFirst(0);
+    try shared.tree.insert(0, 1);
+    const tiles = try alloc.alloc(Tile, 2);
+    defer alloc.free(tiles);
+    const present = [_]bool{ true, true };
+    for (tiles, 0..) |*t, i| {
+        t.* = Tile{
+            .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+    }
+    var w = ResizeWitness{ .t = &tiles[0] };
+    const th = try std.Thread.spawn(.{}, ResizeWitness.run, .{&w});
+    defer {
+        w.stop.store(true, .release);
+        th.join();
+    }
+    // The dimension this fixture varies is TIME: the wall is re-cut while a
+    // pump is mid-pass, over and over, so a relayout is free to land at any
+    // point inside one. Both heights clear `wallFloors(2)`, so every cut
+    // really does move the rect.
+    const heights = [_]u16{ 24, 22, 24, 23 };
+    var i: usize = 0;
+    while (i < 400) : (i += 1) {
+        shared.paint_mu.lock();
+        shared.size = .{ .cols = 80, .rows = heights[i % heights.len] };
+        shared.paint_mu.unlock();
+        wall_layout.relayout(alloc, tiles, &present, &shared, 0);
+        // Quiesce: the pump owes nothing, and the pass that took the last
+        // doorbell has finished. Only then is "what the daemon holds" a
+        // settled question.
+        while (true) {
+            shared.paint_mu.lock();
+            const owed = tiles[0].resize_pending;
+            shared.paint_mu.unlock();
+            if (!owed) break;
+        }
+        const n = w.passes.load(.acquire);
+        while (w.passes.load(.acquire) < n + 1) {}
+        shared.paint_mu.lock();
+        const want = ResizeWitness.pack(tiles[0].rect.cols, tiles[0].rect.rows -| shared.label_rows);
+        shared.paint_mu.unlock();
+        // The claim: a quiet wall and a quiet pump agree on the grid. A
+        // doorbell consumed apart from the rect it describes breaks this —
+        // the pump sent the rect it snapshotted BEFORE the re-cut, cleared
+        // the flag, and nothing re-sends.
+        try std.testing.expectEqual(want, w.sent.load(.acquire));
+    }
+}
+test "a terminal too small for the cut falls back to the focused pane, and grows back" {
+    const alloc = std.testing.allocator;
+    const n = 7;
+    var screen = try WallScreen.init(alloc, 80, 24);
+    defer screen.deinit();
+    var shared = Shared{ .out_fd = screen.w, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    try shared.tree.addFirst(0);
+    var k: u8 = 1;
+    while (k < n) : (k += 1) try shared.tree.insert(k - 1, k);
+    const tiles = try alloc.alloc(Tile, n);
+    defer alloc.free(tiles);
+    const present = try alloc.alloc(bool, n);
+    defer alloc.free(present);
+    var labels: [n][2]u8 = undefined;
+    for (tiles, 0..) |*t, i| {
+        present[i] = true;
+        labels[i] = .{ 't', '0' + @as(u8, @intCast(i)) };
+        t.* = Tile{
+            .r = .{ .target = .{ .sock = "/tmp/x" }, .label = &labels[i], .session = "" },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+    }
+    // One tile whose pump has ended: the keyboard is the only thread left
+    // that can paint its bar, so it is the tile that proves a HIDDEN pane
+    // gets no bar either.
+    tiles[n - 1].alive.store(false, .release);
+    // The dimension this fixture varies is the terminal's height — the one
+    // the wall is cut against. 24 rows hold seven panes under their bars;
+    // 20 do not, and `flatten` says so; and the wall has to come back.
+    for ([_]u16{ 24, 20, 24 }) |rows| {
+        try screen.eng.resize(80, rows);
+        shared.paint_mu.lock();
+        shared.size = .{ .cols = 80, .rows = rows };
+        shared.paint_mu.unlock();
+        wall_layout.relayout(alloc, tiles, present, &shared, 0);
+        // What the pumps do with the generation bump: repaint their bars.
+        for (tiles, present) |*t, p| if (p) wv.paintLabel(t, .up);
+        screen.drain();
+        const dump = try screen.eng.dumpPlain(alloc);
+        defer alloc.free(dump);
+        // No tile ever claims a row the terminal does not have. A SIGWINCH
+        // is not an operation and cannot be refused: doing nothing leaves
+        // every rect pointing past the bottom of the screen.
+        for (tiles, present) |*t, p| {
+            if (!p) continue;
+            try std.testing.expect(t.rect.top + t.rect.rows <= rows);
+            try std.testing.expect(t.rect.left + t.rect.cols <= 80);
+        }
+        if (rows == 20) {
+            // The degrade: the focused pane whole, every other pane at 0x0
+            // — a rect that paints nothing and claims no size — and the
+            // tree untouched underneath.
+            try std.testing.expectEqual(@as(u16, 0), shared.label_rows);
+            try std.testing.expectEqual(@as(u16, 20), tiles[0].rect.rows);
+            try std.testing.expectEqual(@as(u16, 80), tiles[0].rect.cols);
+            try std.testing.expectEqual(@as(u16, 0), tiles[0].rect.top);
+            for (tiles[1..]) |*t| try std.testing.expectEqual(@as(u16, 0), t.rect.rows);
+            // One pane, so no bars: every row of the grid the wall itself
+            // wrote is blank, hidden tiles included.
+            var it = std.mem.splitScalar(u8, dump, '\n');
+            while (it.next()) |l|
+                try std.testing.expectEqual(@as(usize, 0), std.mem.trim(u8, l, " ").len);
+        } else {
+            try std.testing.expectEqual(@as(u16, 1), shared.label_rows);
+            // Seven bars, each on the first row of the pane it names.
+            for (tiles) |*t| {
+                const l = WallScreen.line(dump, t.rect.top) orelse return error.NoSuchRow;
+                try std.testing.expect(std.mem.indexOf(u8, l, t.r.label) != null);
+            }
+        }
+    }
+}
+test "fullscreen gives the focused tile the whole terminal and hides the rest" {
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    try shared.tree.addFirst(0);
+    try shared.tree.insert(0, 1);
+    const tiles = try alloc.alloc(Tile, 2);
+    defer alloc.free(tiles);
+    const present = [_]bool{ true, true };
+    for (tiles, 0..) |*t, i| {
+        t.* = Tile{
+            .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+    }
+    shared.fullscreen = true;
+    wall_layout.relayout(alloc, tiles, &present, &shared, 0);
+    // No label bar: the fullscreened pane is a one-tile wall.
+    try std.testing.expectEqual(@as(u8, 0), shared.label_rows);
+    // Tile 0 gets the whole terminal; tile 1 gets nothing.
+    try std.testing.expectEqual(@as(u16, 24), tiles[0].rect.rows);
+    try std.testing.expectEqual(@as(u16, 80), tiles[0].rect.cols);
+    try std.testing.expectEqual(@as(u16, 0), tiles[1].rect.rows);
+    try std.testing.expectEqual(@as(u16, 0), tiles[1].rect.cols);
+    // The base flat is kept for neighbor.
+    try std.testing.expect(shared.base_flat != null);
+}
+test "toggle off fullscreen restores the real rects" {
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    try shared.tree.addFirst(0);
+    try shared.tree.insert(0, 1);
+    const tiles = try alloc.alloc(Tile, 2);
+    defer alloc.free(tiles);
+    const present = [_]bool{ true, true };
+    for (tiles, 0..) |*t, i| {
+        t.* = Tile{
+            .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+    }
+    shared.fullscreen = true;
+    wall_layout.relayout(alloc, tiles, &present, &shared, 0);
+    shared.fullscreen = false;
+    wall_layout.relayout(alloc, tiles, &present, &shared, 0);
+    // Two tiles again: label bar back, both have real rects (stacked:
+    // full width, half height each).
+    try std.testing.expectEqual(@as(u8, 1), shared.label_rows);
+    try std.testing.expectEqual(@as(u16, 80), tiles[0].rect.cols);
+    try std.testing.expectEqual(@as(u16, 80), tiles[1].rect.cols);
+    try std.testing.expect(tiles[0].rect.rows < 24);
+    try std.testing.expect(tiles[1].rect.rows > 0);
+}
+test "focus_dir while fullscreened follows the focus" {
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    try shared.tree.addFirst(0);
+    try shared.tree.insert(0, 1);
+    const tiles = try alloc.alloc(Tile, 2);
+    defer alloc.free(tiles);
+    const present = [_]bool{ true, true };
+    for (tiles, 0..) |*t, i| {
+        t.* = Tile{
+            .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+    }
+    shared.fullscreen = true;
+    wall_layout.relayout(alloc, tiles, &present, &shared, 0);
+    // Move focus to tile 1 while fullscreened.
+    wv.focusAnswer(alloc, tiles, &present, &shared, false, 1);
+    // The full rect followed: tile 1 now owns the terminal.
+    try std.testing.expectEqual(@as(u16, 24), tiles[1].rect.rows);
+    try std.testing.expectEqual(@as(u16, 80), tiles[1].rect.cols);
+    try std.testing.expectEqual(@as(u16, 0), tiles[0].rect.rows);
+    try std.testing.expectEqual(@as(usize, 1), shared.sel);
+}
+test "resize: l grows the focused pane, h shrinks it" {
+    // Spec: h shrinks width, l grows width. layout.resize always makes
+    // the focus GAIN cells, so shrink = grow a neighbor at focus's
+    // expense. Two beside panes at 80x24 (floors {3,2}): equal split is
+    // 39/40 (rail takes 1). l moves the rail right; h moves it left.
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    try shared.tree.addFirst(0);
+    try shared.tree.splitRight(0, 1);
+    const tiles = try alloc.alloc(Tile, 2);
+    defer alloc.free(tiles);
+    const present = [_]bool{ true, true };
+    for (tiles, 0..) |*t, i| {
+        t.* = Tile{
+            .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+    }
+    wall_layout.relayout(alloc, tiles, &present, &shared, 0);
+    const before = tiles[0].rect.cols;
+    // l (grow width): focus 0 gains from its right sibling.
+    try std.testing.expect(wall_layout.doResize(alloc, tiles, &present, &shared, 0, .right));
+    try std.testing.expect(tiles[0].rect.cols > before);
+    // h (shrink width): the right neighbor gains a cell back from focus.
+    try std.testing.expect(wall_layout.doResize(alloc, tiles, &present, &shared, 0, .left));
+    try std.testing.expectEqual(before, tiles[0].rect.cols);
+}
+test "resize: j grows height, k shrinks height" {
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    try shared.tree.addFirst(0);
+    try shared.tree.splitBelow(0, 1);
+    const tiles = try alloc.alloc(Tile, 2);
+    defer alloc.free(tiles);
+    const present = [_]bool{ true, true };
+    for (tiles, 0..) |*t, i| {
+        t.* = Tile{
+            .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+    }
+    wall_layout.relayout(alloc, tiles, &present, &shared, 0);
+    const before = tiles[0].rect.rows;
+    try std.testing.expect(wall_layout.doResize(alloc, tiles, &present, &shared, 0, .down));
+    try std.testing.expect(tiles[0].rect.rows > before);
+    try std.testing.expect(wall_layout.doResize(alloc, tiles, &present, &shared, 0, .up));
+    try std.testing.expectEqual(before, tiles[0].rect.rows);
+}
+test "resize refuses while fullscreened" {
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    try shared.tree.addFirst(0);
+    try shared.tree.splitRight(0, 1);
+    const tiles = try alloc.alloc(Tile, 2);
+    defer alloc.free(tiles);
+    const present = [_]bool{ true, true };
+    for (tiles, 0..) |*t, i| {
+        t.* = Tile{
+            .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+    }
+    shared.fullscreen = true;
+    wall_layout.relayout(alloc, tiles, &present, &shared, 0);
+    try std.testing.expect(!wall_layout.doResize(alloc, tiles, &present, &shared, 0, .right));
+}
+test "a pump's answer that grew the wall re-cuts it; a mere focus move does not" {
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    defer if (shared.last_flat) |*f| f.deinit(shared.flat_alloc);
+    defer if (shared.base_flat) |*f| f.deinit(shared.flat_alloc);
+    const tiles = try alloc.alloc(Tile, 2);
+    defer alloc.free(tiles);
+    const present = try alloc.alloc(bool, 2);
+    defer alloc.free(present);
+    present[0] = true;
+    present[1] = true;
+    for (tiles, 0..) |*t, i| {
+        t.* = Tile{
+            .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+    }
+    // Growth: without the re-cut the new tile sits on placeholder geometry
+    // and the old tile still owns the whole terminal — the screen keeps
+    // showing tile 0 while the keyboard types into tile 1's rows.
+    wv.focusAnswer(alloc, tiles, present, &shared, true, 1);
+    try std.testing.expectEqual(@as(u8, 1), shared.label_rows);
+    try std.testing.expect(tiles[0].resize_pending);
+    try std.testing.expect(tiles[1].resize_pending);
+    try std.testing.expectEqual(@as(usize, 1), shared.sel);
+    try std.testing.expect(tiles[1].claim_pending.load(.acquire));
+    tiles[0].resize_pending = false;
+    tiles[1].resize_pending = false;
+    // No growth: a full clear here would flash the wall for a focus move.
+    wv.focusAnswer(alloc, tiles, present, &shared, false, 0);
+    try std.testing.expect(!tiles[0].resize_pending);
+    try std.testing.expect(!tiles[1].resize_pending);
+    try std.testing.expectEqual(@as(usize, 0), shared.sel);
+    try std.testing.expect(tiles[0].claim_pending.load(.acquire));
+}
+test "a one-tile wall draws no label bar and paints row 1" {
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    try shared.tree.addFirst(0);
+    const tiles = try alloc.alloc(Tile, 1);
+    defer alloc.free(tiles);
+    const present = try alloc.alloc(bool, 1);
+    defer alloc.free(present);
+    present[0] = true;
+    tiles[0] = Tile{
+        .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+        .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    wall_layout.relayout(alloc, tiles, present, &shared, 0);
+    // One tile: no label bar, every row is content.
+    try std.testing.expectEqual(@as(u8, 0), shared.label_rows);
+    try std.testing.expectEqual(@as(u16, 24), tiles[0].viewRows());
+}
+test "a relayout drops every tile's highlight, because the stripes move under it" {
+    // The drag is per-tile now, on each pump's Core, so relayout cannot
+    // reach it directly. It bumps repaint_gen instead, and every pump
+    // clears its own core.drag when it sees the generation move under it —
+    // a relayout re-cut the rect a held drag's anchor was resolved against.
+    // The generation is the whole mechanism, so it is what this pins.
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    try shared.tree.addFirst(0);
+    try shared.tree.insert(0, 1);
+    const tiles = try alloc.alloc(Tile, 2);
+    defer alloc.free(tiles);
+    const present = try alloc.alloc(bool, 2);
+    defer alloc.free(present);
+    present[0] = true;
+    present[1] = true;
+    for (tiles, 0..) |*t, i| {
+        t.* = Tile{
+            .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+    }
+    const before = shared.repaint_gen.load(.acquire);
+    wall_layout.relayout(alloc, tiles, present, &shared, 0);
+    // One bump, every tile's pump clears its drag on it: the stripes moved,
+    // so a held drag's anchor names a rect that is somewhere else now.
+    try std.testing.expect(shared.repaint_gen.load(.acquire) > before);
+}
+test "saveLayoutTo writes the sidecar for the present tiles, spellings verbatim" {
+    // A wall saves its tree on the way out: the leaf spellings are the
+    // tiles' labels verbatim, so a reload restores the same view.
+    const alloc = std.testing.allocator;
+    var tmp = try TmpDir.make();
+    defer tmp.cleanup();
+    const path = try std.fmt.allocPrint(alloc, "{s}/layout", .{tmp.path()});
+    defer alloc.free(path);
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    try shared.tree.addFirst(0);
+    try shared.tree.splitRight(0, 1);
+    const tiles = try alloc.alloc(Tile, 2);
+    defer alloc.free(tiles);
+    for (tiles, 0..) |*t, i| {
+        t.* = Tile{
+            .r = .{
+                .target = .{ .sock = "/tmp/x" },
+                .label = switch (i) {
+=> "--sock /tmp/x#a",
+                    else => "--sock /tmp/x#b",
+                },
+                .session = "",
+            },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+    }
+    const present = [_]bool{ true, true };
+    wall_layout.saveLayoutTo(alloc, path, tiles, &present, &shared);
+    const got = wall.loadLayout(alloc, path) orelse return error.TestUnexpectedResult;
+    defer alloc.free(got);
+    try std.testing.expect(std.mem.startsWith(u8, got, "mux-layout 1\nbeside 0\n"));
+    try std.testing.expect(std.mem.indexOf(u8, got, "--sock /tmp/x#b\n") != null);
+}
+test "saveLayoutTo handles a vanished middle tile without panicking" {
+    // Tiles are never compacted (pump threads hold pointers into the
+    // array), so a vanished middle tile leaves a hole: present = {t,f,t}
+    // and the tree holds leaves 0 and 2. serialize indexes spellings by
+    // leaf ID, so the array must be tile-indexed — a dense array would
+    // panic on spellings[2] with only two entries.
+    const alloc = std.testing.allocator;
+    var tmp = try TmpDir.make();
+    defer tmp.cleanup();
+    const path = try std.fmt.allocPrint(alloc, "{s}/layout", .{tmp.path()});
+    defer alloc.free(path);
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    try shared.tree.addFirst(0);
+    try shared.tree.splitRight(0, 1);
+    try shared.tree.splitRight(1, 2);
+    // Tile 1 vanished: remove leaf 1 from the tree.
+    shared.tree.remove(1);
+    const tiles = try alloc.alloc(Tile, 3);
+    defer alloc.free(tiles);
+    for (tiles, 0..) |*t, i| {
+        t.* = Tile{
+            .r = .{
+                .target = .{ .sock = "/tmp/x" },
+                .label = switch (i) {
+=> "--sock /tmp/x#a",
+=> "--sock /tmp/x#b",
+                    else => "--sock /tmp/x#c",
+                },
+                .session = "",
+            },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+    }
+    const present = [_]bool{ true, false, true };
+    wall_layout.saveLayoutTo(alloc, path, tiles, &present, &shared);
+    const got = wall.loadLayout(alloc, path) orelse return error.TestUnexpectedResult;
+    defer alloc.free(got);
+    // Tile 2's label is verbatim; the hole (tile 1) is never serialized.
+    try std.testing.expect(std.mem.indexOf(u8, got, "--sock /tmp/x#c\n") != null);
+    try std.testing.expect(std.mem.indexOf(u8, got, "--sock /tmp/x#b") == null);
+}
+test "restore: a saved beside pair comes back verbatim on a tall terminal" {
+    // Aspect at 40x30 would say stacked; the sidecar says beside and wins.
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 40, .rows = 30 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    const resolved = [_]Resolved{
+        .{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#a", .session = "a" },
+        .{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#b", .session = "b" },
+    };
+    const bytes = "mux-layout 1\nbeside 0\n leaf 40 --sock /tmp/x#a\n leaf 39 --sock /tmp/x#b\n";
+    var focus_out: ?u8 = null;
+    try std.testing.expect(wall_layout.restoreLayout(alloc, &resolved, &shared, bytes, &focus_out));
+    const tiles = try alloc.alloc(Tile, 2);
+    defer alloc.free(tiles);
+    const present = [_]bool{ true, true };
+    for (tiles, 0..) |*t, i| {
+        t.* = Tile{
+            .r = resolved[i],
+            .rect = .{ .top = 0, .left = 0, .rows = 30, .cols = 40 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+    }
+    wall_layout.relayout(alloc, tiles, &present, &shared, 0);
+    try std.testing.expectEqual(@as(u16, 0), tiles[1].rect.top);
+    try std.testing.expect(tiles[1].rect.left > 0);
+}
+test "restore: heals — unknown wall line inserted, lost leaf dropped" {
+    // Sidecar knows a, GONE and c side by side; the wall has a, c and NEW.
+    // Three saved leaves, not two: with two, dropping one collapses the
+    // container and every heal lands on the default cut, so the claim
+    // ("inserted BESIDE the match") could not be seen.
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    const resolved = [_]Resolved{
+        .{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#a", .session = "a" },
+        .{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#c", .session = "c" },
+        .{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#new", .session = "new" },
+    };
+    const bytes = "mux-layout 1\nbeside 0\n leaf 26 --sock /tmp/x#a\n" ++
+        " leaf 26 --sock /tmp/x#gone\n leaf 26 --sock /tmp/x#c\n";
+    var focus_out: ?u8 = null;
+    try std.testing.expect(wall_layout.restoreLayout(alloc, &resolved, &shared, bytes, &focus_out));
+    try std.testing.expectEqual(@as(usize, 3), shared.tree.count());
+    const flat = try shared.tree.flatten(alloc, 24, 80, wall_layout.wallFloors(3), null);
+    defer flat.deinit(alloc);
+    const a = flat.rectOf(0) orelse return error.TestUnexpectedResult;
+    const c = flat.rectOf(1) orelse return error.TestUnexpectedResult;
+    const new = flat.rectOf(2) orelse return error.TestUnexpectedResult;
+    // The saved axis survives the drop — a heal that rebuilt the default
+    // cut would stack these, giving them one left and three tops.
+    try std.testing.expectEqual(a.top, c.top);
+    try std.testing.expectEqual(a.top, new.top);
+    // NEW landed next to the match (a), not at either end by accident.
+    try std.testing.expect(a.left < new.left);
+    try std.testing.expect(new.left < c.left);
+}
+test "restore: zero matches or garbage degrade to false" {
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    const resolved = [_]Resolved{
+        .{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#a", .session = "a" },
+    };
+    var focus_out: ?u8 = null;
+    try std.testing.expect(!wall_layout.restoreLayout(alloc, &resolved, &shared, "not a sidecar", &focus_out));
+    const nomatch = "mux-layout 1\nleaf 0 --sock /nowhere#z\n";
+    try std.testing.expect(!wall_layout.restoreLayout(alloc, &resolved, &shared, nomatch, &focus_out));
+}
+test "restore: duplicate spellings pair positionally" {
+    // Wall shows one host twice: same spelling on both lines. Saved
+    // leaves 0 and 1 share it; leaf 0 takes wall 0, leaf 1 takes wall 1.
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    const resolved = [_]Resolved{
+        .{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#dup", .session = "dup" },
+        .{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#dup", .session = "dup" },
+    };
+    // Lopsided on purpose: with near-equal weights a mispairing produces
+    // near-equal rects and hides in the leaf count.
+    const bytes = "mux-layout 1\nbeside 0\n leaf 59 --sock /tmp/x#dup\n leaf 20 --sock /tmp/x#dup\n";
+    var focus_out: ?u8 = null;
+    try std.testing.expect(wall_layout.restoreLayout(alloc, &resolved, &shared, bytes, &focus_out));
+    try std.testing.expectEqual(@as(usize, 2), shared.tree.count());
+    // Pairing is the whole claim and it IS observable: saved leaf 0 owns
+    // the left, wide slot, so it must be wall tile 0. Paired the other
+    // way round the count is still 2 and the tiles have swapped screens.
+    const flat = try shared.tree.flatten(alloc, 24, 80, wall_layout.wallFloors(2), null);
+    defer flat.deinit(alloc);
+    const t0 = flat.rectOf(0) orelse return error.TestUnexpectedResult;
+    const t1 = flat.rectOf(1) orelse return error.TestUnexpectedResult;
+    try std.testing.expect(t0.left < t1.left);
+    try std.testing.expect(t0.cols > t1.cols);
+}
+test "restoreLayoutFrom: dense sidecar indices land on the real tile indices" {
+    // Tile 1 was forgotten, so the dense array is 0,2,3 and the two index
+    // spaces disagree. With no hole they coincide and the second remap is
+    // untestable by construction — which is how a tile could be handed the
+    // rect flattened for its neighbour and no test would say so.
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.tree = layout.Tree.init(alloc);
+    shared.flat_alloc = alloc;
+    defer shared.tree.deinit();
+    defer if (shared.last_flat) |*f| f.deinit(alloc);
+    defer if (shared.base_flat) |*f| f.deinit(alloc);
+    const labels = [_][]const u8{
+        "--sock /tmp/x#a",
+        "--sock /tmp/x#hole",
+        "--sock /tmp/x#c",
+        "--sock /tmp/x#d",
+    };
+    var tiles: [4]Tile = undefined;
+    for (&tiles, 0..) |*t, i| {
+        t.* = .{
+            .r = .{ .target = .{ .sock = "/tmp/x" }, .label = labels[i], .session = "" },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+    }
+    var present = [_]bool{ true, false, true, true };
+    // Three unequal weights over 80 columns less two rails: 40+20+18 = 78,
+    // so each tile's width names which saved leaf it was given.
+    const bytes = "mux-layout 1\nbeside 0\n leaf 40 --sock /tmp/x#a\n" ++
+        " leaf 20 --sock /tmp/x#c\n leaf 18 --sock /tmp/x#d\n";
+    var restored_focus: ?usize = null;
+    wall_layout.restoreLayoutFrom(alloc, &tiles, &present, 4, &shared, bytes, &restored_focus) orelse
+        return error.TestUnexpectedResult;
+    const flat = try shared.tree.flatten(alloc, 24, 80, wall_layout.wallFloors(3), null);
+    defer flat.deinit(alloc);
+    try std.testing.expectEqual(@as(?layout.Rect, null), flat.rectOf(1));
+    const a = flat.rectOf(0) orelse return error.TestUnexpectedResult;
+    const c = flat.rectOf(2) orelse return error.TestUnexpectedResult;
+    const d = flat.rectOf(3) orelse return error.TestUnexpectedResult;
+    try std.testing.expectEqual(@as(u16, 40), a.cols);
+    try std.testing.expectEqual(@as(u16, 20), c.cols);
+    try std.testing.expectEqual(@as(u16, 18), d.cols);
+    try std.testing.expect(a.left < c.left);
+    try std.testing.expect(c.left < d.left);
+}
+test "restore: focus_out maps the saved focus through the spelling match" {
+    // Saved leaf 1 matches wall tile 1 (b) → focus_out == 1. Saved leaf 1
+    // matches NO wall tile (gone) → focus_out stays null.
+    const alloc = std.testing.allocator;
+    // Matched: focus 1 → tile 1.
+    {
+        var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+        shared.tree = layout.Tree.init(alloc);
+        shared.flat_alloc = alloc;
+        defer shared.tree.deinit();
+        defer if (shared.last_flat) |*f| f.deinit(alloc);
+        defer if (shared.base_flat) |*f| f.deinit(alloc);
+        const resolved = [_]Resolved{
+            .{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#a", .session = "a" },
+            .{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#b", .session = "b" },
+        };
+        const bytes = "mux-layout 1\nbeside 0\n leaf 40 --sock /tmp/x#a\n leaf 39 --sock /tmp/x#b\nfocus 1\n";
+        var focus_out: ?u8 = null;
+        try std.testing.expect(wall_layout.restoreLayout(alloc, &resolved, &shared, bytes, &focus_out));
+        try std.testing.expectEqual(@as(?u8, 1), focus_out);
+    }
+    // Unmatched: saved leaf 1 (gone) has no wall tile → focus_out null.
+    {
+        var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+        shared.tree = layout.Tree.init(alloc);
+        shared.flat_alloc = alloc;
+        defer shared.tree.deinit();
+        defer if (shared.last_flat) |*f| f.deinit(alloc);
+        defer if (shared.base_flat) |*f| f.deinit(alloc);
+        const resolved = [_]Resolved{
+            .{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#a", .session = "a" },
+            .{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#new", .session = "new" },
+        };
+        const bytes = "mux-layout 1\nbeside 0\n leaf 40 --sock /tmp/x#a\n leaf 39 --sock /tmp/x#gone\nfocus 1\n";
+        var focus_out: ?u8 = null;
+        try std.testing.expect(wall_layout.restoreLayout(alloc, &resolved, &shared, bytes, &focus_out));
+        try std.testing.expectEqual(@as(?u8, null), focus_out);
+    }
+}

src/tui/wall_test_picker.zig

@@ @@ -0,0 +1,526 @@ @@
+//! The host picker popup (wall_picker.zig).
+const std = @import("std");
+const proto = @import("protocol");
+const client = @import("client");
+const interact = @import("interact");
+const fixture = @import("wall_test_harness.zig");
+const wall_host = @import("wall_host.zig");
+const wall_picker = @import("wall_picker.zig");
+const wv = @import("wallview.zig");
+const Host = wall_host.Host;
+const PickerAuto = wall_picker.PickerAuto;
+const PickerBody = wall_picker.PickerBody;
+const Shared = wv.Shared;
+const Tile = wv.Tile;
+const WallScreen = fixture.WallScreen;
+test "paintPicker: the box is centred on the terminal, not pinned to the origin" {
+    const pipe = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(pipe[0]);
+    defer std.posix.close(pipe[1]);
+    // Off-origin is the BASELINE here: a fixture on a terminal the box
+    // happens to fill is blind to every centring arithmetic mistake.
+    var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 100, .rows = 40 }, .is_tty = true };
+    var table = [_]Host{
+        fixture.testHost(&shared, "a", "/tmp/a.sock"),
+        fixture.testHost(&shared, "b", "/tmp/b.sock"),
+        fixture.testHost(&shared, "c", "/tmp/c.sock"),
+    };
+    for (&table) |*h| {
+        fixture.setList(h, "");
+        h.applied = true;
+    }
+    var buf: [8192]u8 = undefined;
+    const frame = fixture.pickerFrame(&shared, pipe[0], &table, 0, &buf);
+    // Five rows (header + three hosts + footer) on forty: top = (40-5)/2.
+    // The box is the terminal's width here, so left is 0 and the columns
+    // are 1-based CUP.
+    try std.testing.expect(std.mem.indexOf(u8, frame, "\x1b[18;1H") != null);
+    try std.testing.expect(std.mem.indexOf(u8, frame, "\x1b[19;1H") != null);
+    try std.testing.expect(std.mem.indexOf(u8, frame, "\x1b[22;1H") != null);
+    // ...and nothing above or below the box.
+    try std.testing.expect(std.mem.indexOf(u8, frame, "\x1b[17;1H") == null);
+    try std.testing.expect(std.mem.indexOf(u8, frame, "\x1b[23;1H") == null);
+    // The cursor goes with the popup: a caret blinking in a tile says the
+    // keys are going there.
+    try std.testing.expect(std.mem.startsWith(u8, frame, "\x1b[?25l"));
+}
+test "paintPicker: a box wider than its cap is centred in the columns" {
+    const pipe = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(pipe[0]);
+    defer std.posix.close(pipe[1]);
+    // Wider than `picker_row_max`, so the box is capped and the leftover
+    // columns are split: (200 - 128) / 2.
+    var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 200, .rows = 10 }, .is_tty = true };
+    var table = [_]Host{fixture.testHost(&shared, "a", "/tmp/a.sock")};
+    fixture.setList(&table[0], "");
+    table[0].applied = true;
+    var buf: [8192]u8 = undefined;
+    const frame = fixture.pickerFrame(&shared, pipe[0], &table, 0, &buf);
+    try std.testing.expect(std.mem.indexOf(u8, frame, "\x1b[4;37H") != null);
+}
+test "paintPicker: a terminal too small for a box still says which popup has the keys" {
+    const pipe = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(pipe[0]);
+    defer std.posix.close(pipe[1]);
+    var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 20, .rows = 3 }, .is_tty = true };
+    var table = [_]Host{
+        fixture.testHost(&shared, "a", "/tmp/a.sock"),
+        fixture.testHost(&shared, "b", "/tmp/b.sock"),
+    };
+    for (&table) |*h| {
+        fixture.setList(h, "");
+        h.applied = true;
+    }
+    var buf: [8192]u8 = undefined;
+    const frame = fixture.pickerFrame(&shared, pipe[0], &table, 0, &buf);
+    try std.testing.expect(std.mem.indexOf(u8, frame, "hosts") != null);
+    // Under the minimum the header is the WHOLE popup: no rows, no legend.
+    // A box that does not fit is worse than a line saying which one it is.
+    try std.testing.expect(std.mem.indexOf(u8, frame, "Enter/c new session") == null);
+    try std.testing.expect(std.mem.indexOf(u8, frame, " 1  a") == null);
+}
+test "paintPicker: the window scrolls so the selected row is always on screen" {
+    const pipe = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(pipe[0]);
+    defer std.posix.close(pipe[1]);
+    // Six rows for the box: header, footer, and four hosts of the eight.
+    var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 60, .rows = 6 }, .is_tty = true };
+    const names = [_][]const u8{ "h0", "h1", "h2", "h3", "h4", "h5", "h6", "h7" };
+    var table: [8]Host = undefined;
+    for (&table, names) |*h, name| {
+        h.* = fixture.testHost(&shared, name, "/tmp/x.sock");
+        fixture.setList(h, "");
+        h.applied = true;
+    }
+    var buf: [8192]u8 = undefined;
+    const top = fixture.pickerFrame(&shared, pipe[0], &table, 0, &buf);
+    try std.testing.expect(std.mem.indexOf(u8, top, " 1> h0") != null);
+    try std.testing.expect(std.mem.indexOf(u8, top, "h7") == null);
+    // The last row: the window has to follow the selection, or `j` walks
+    // off the bottom of a box that never moves.
+    var buf2: [8192]u8 = undefined;
+    const bottom = fixture.pickerFrame(&shared, pipe[0], &table, 7, &buf2);
+    try std.testing.expect(std.mem.indexOf(u8, bottom, " 8> h7") != null);
+    try std.testing.expect(std.mem.indexOf(u8, bottom, "h0") == null);
+}
+test "paintPicker: a frame the stamp refuses to write does not eat the notice with it" {
+    const pipe = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(pipe[0]);
+    defer std.posix.close(pipe[1]);
+    var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 100, .rows = 40 }, .is_tty = true };
+    var table = [_]Host{fixture.testHost(&shared, "--sock /tmp/a.sock", "/tmp/a.sock")};
+    fixture.setList(&table[0], "");
+    table[0].applied = true;
+    wall_picker.paintPicker(&shared, &table, 0, null);
+    // A notice whose footer is byte-for-byte the legend already on the
+    // screen: the stamp refuses the write, and taking the notice ahead of
+    // that check is a sentence consumed by a frame nobody was sent.
+    wv.setNotice(&shared, " Enter/c new session   x forget   a add   Esc");
+    wall_picker.paintPicker(&shared, &table, 0, null);
+    var buf: [96]u8 = undefined;
+    try std.testing.expectEqualStrings(
+        " Enter/c new session   x forget   a add   Esc",
+        wv.takeNotice(&shared, &buf),
+    );
+}
+test "paintPicker: replayed into an engine, the popup covers its box and NOT one cell more" {
+    const alloc = std.testing.allocator;
+    const cols: u16 = 160;
+    const rows: u16 = 20;
+    var screen = try WallScreen.init(alloc, cols, rows);
+    defer screen.deinit();
+    // Off-origin in BOTH axes: `picker_row_max` caps the width at 128, so
+    // left = (160-128)/2, and three hosts make a five-row box at
+    // top = (20-5)/2. A grep over the frame's CUP sequences cannot see a
+    // paint that reaches a cell by another route — a different CUP form, a
+    // wider pad — so this one judges the GRID.
+    const w: u16 = @intCast(wall_picker.picker_row_max);
+    const left: u16 = (cols - w) / 2;
+    const height: u16 = 5;
+    const top: u16 = (rows - height) / 2;
+    // A background every untouched cell can be recognised by.
+    var bg: [cols]u8 = undefined;
+    @memset(&bg, '.');
+    var r: u16 = 0;
+    while (r < rows) : (r += 1) {
+        var cup: [16]u8 = undefined;
+        screen.eng.feed(std.fmt.bufPrint(&cup, "\x1b[{d};1H", .{r + 1}) catch unreachable);
+        screen.eng.feed(&bg);
+    }
+    screen.eng.feed("\x1b[H");
+    var shared = Shared{ .out_fd = screen.w, .size = .{ .cols = cols, .rows = rows }, .is_tty = true };
+    var table = [_]Host{
+        fixture.testHost(&shared, "--sock /tmp/a.sock", "/tmp/a.sock"),
+        fixture.testHost(&shared, "--sock /tmp/b.sock", "/tmp/b.sock"),
+        fixture.testHost(&shared, "--sock /tmp/c.sock", "/tmp/c.sock"),
+    };
+    for (&table) |*h| {
+        fixture.setList(h, "");
+        h.applied = true;
+    }
+    wall_picker.paintPicker(&shared, &table, 1, null);
+    screen.drain();
+    const dump = try screen.eng.dumpPlain(alloc);
+    defer alloc.free(dump);
+    var i: u16 = 0;
+    while (i < rows) : (i += 1) {
+        const l = WallScreen.line(dump, i) orelse return error.NoSuchRow;
+        try std.testing.expectEqual(@as(usize, cols), l.len);
+        if (i >= top and i < top + height) {
+            // The rails and every tile beside the box are outside it.
+            try std.testing.expectEqualStrings(bg[0..left], l[0..left]);
+            try std.testing.expectEqualStrings(bg[0..left], l[left + w ..]);
+            try std.testing.expect(!std.mem.eql(u8, bg[0..w], l[left..][0..w]));
+        } else {
+            try std.testing.expectEqualStrings(&bg, l);
+        }
+    }
+    // The selected row is the one the popup says it is, in the grid.
+    const sel_row = WallScreen.line(dump, top + 2) orelse return error.NoSuchRow;
+    try std.testing.expect(std.mem.indexOf(u8, sel_row, " 2> ") != null);
+}
+test "paintPicker: an unchanged frame is not written again" {
+    const pipe = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(pipe[0]);
+    defer std.posix.close(pipe[1]);
+    var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 60, .rows = 20 }, .is_tty = true };
+    var table = [_]Host{
+        fixture.testHost(&shared, "a", "/tmp/a.sock"),
+        fixture.testHost(&shared, "b", "/tmp/b.sock"),
+    };
+    for (&table) |*h| {
+        fixture.setList(h, "");
+        h.applied = true;
+    }
+    var buf: [8192]u8 = undefined;
+    try std.testing.expect(fixture.pickerFrame(&shared, pipe[0], &table, 0, &buf).len > 0);
+    // The pollers repaint this box once a second PER HOST. Rewriting an
+    // identical screen at that rate is a terminal that never goes quiet,
+    // which is also every `settle` in the e2e suite.
+    try std.testing.expectEqual(@as(usize, 0), fixture.pickerFrame(&shared, pipe[0], &table, 0, &buf).len);
+    // A moved selection is a different frame, and is written.
+    try std.testing.expect(fixture.pickerFrame(&shared, pipe[0], &table, 1, &buf).len > 0);
+    // ...and a cleared stamp is what a relayout leaves behind, so the box
+    // goes back onto a screen that was wiped under it.
+    shared.picker_stamp = 0;
+    try std.testing.expect(fixture.pickerFrame(&shared, pipe[0], &table, 1, &buf).len > 0);
+}
+test "PickerAuto: an empty wall opens the picker once, and a tile takes it back" {
+    var a: PickerAuto = .{};
+    // Empty and nothing open: the wall opens it itself, because a blank
+    // screen is no place to act from.
+    try std.testing.expectEqual(PickerAuto.Step.open, a.step(true, true, false, false));
+    // ...ONCE. The Esc that closed it has to leave the one-line text
+    // standing rather than being reopened over.
+    try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, true, false, false));
+    // A tile arrived: the wall has something to show and gets the screen.
+    try std.testing.expectEqual(PickerAuto.Step.close, a.step(true, false, true, false));
+    // ...and only once; the popup is already gone.
+    try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, false, false, false));
+}
+test "PickerAuto: a spelling in progress keeps the popup a tile would have closed" {
+    var a: PickerAuto = .{};
+    try std.testing.expectEqual(PickerAuto.Step.open, a.step(true, true, false, false));
+    // `prompting` layers OVER `picking`: closing on `picking` alone would
+    // take the editor off the screen and leave it eating every key, and its
+    // Enter would reach the main switch's dead `.add_tile` arm — no line,
+    // no notice, and no host added.
+    try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, false, true, true));
+    // The moment the line is submitted or cancelled, the close is owed again.
+    try std.testing.expectEqual(PickerAuto.Step.close, a.step(true, false, true, false));
+}
+test "PickerAuto: a picker the user opened is not closed by an arriving tile" {
+    var a: PickerAuto = .{};
+    try std.testing.expectEqual(PickerAuto.Step.open, a.step(true, true, false, false));
+    // Esc, and the user opens it again by hand. Without `taken` the flag
+    // outlives the close and the next birth force-closes a popup they are
+    // choosing from.
+    a.taken();
+    try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, false, true, false));
+}
+test "PickerAuto: the Esc that closes the wall's own popup is not undone by the wall" {
+    var a: PickerAuto = .{};
+    try std.testing.expectEqual(PickerAuto.Step.open, a.step(true, true, false, false));
+    // The close runs `taken` on EVERY exit, the wall's popup included, and
+    // the wall is still empty afterwards. One flag for both facts reopened
+    // the box over the one-line text the Esc had just asked for — and on
+    // that wall `Ctrl-\ d` never reached the keyboard again.
+    a.taken();
+    try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, true, false, false));
+    try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, true, false, false));
+    // A tile arrives and leaves again: THAT emptiness earns its own open.
+    try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, false, false, false));
+    try std.testing.expectEqual(PickerAuto.Step.open, a.step(true, true, false, false));
+}
+test "PickerAuto: one Esc leaves a user's picker that outlived the wall's last tile" {
+    var a: PickerAuto = .{};
+    // The user opens the popup on a wall that still has tiles, and the last
+    // of them ends underneath it. The emptiness the wall then sees is one
+    // whose popup is already up, so it is spent without ever opening.
+    try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, false, true, false));
+    try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, true, true, false));
+    a.taken();
+    // The one Esc that closed it is the whole of this: unspent, the wall
+    // answers it by opening the box straight back over the empty line.
+    try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, true, false, false));
+}
+test "PickerAuto: a wall still dialling spends nothing, so its first known emptiness still opens" {
+    var a: PickerAuto = .{};
+    // `is_tty` carries `restore_tried`: the user can open the picker by hand
+    // while the hosts are still answering, and a wall not yet KNOWN to be
+    // empty must not spend the open it has not made.
+    try std.testing.expectEqual(PickerAuto.Step.leave, a.step(false, true, true, false));
+    a.taken();
+    try std.testing.expectEqual(PickerAuto.Step.open, a.step(true, true, false, false));
+}
+test "PickerAuto: a wall still dialling, and a wall with no terminal, open nothing" {
+    var a: PickerAuto = .{};
+    // The caller folds `restore_tried` into this argument: a wall that has
+    // not heard from its hosts yet is not KNOWN to be empty, and a popup
+    // flashed over tiles that are about to arrive is one nobody asked for.
+    try std.testing.expectEqual(PickerAuto.Step.leave, a.step(false, true, false, false));
+    // A piped mux has no screen to put a popup on.
+    var b: PickerAuto = .{};
+    try std.testing.expectEqual(PickerAuto.Step.leave, b.step(false, true, false, false));
+}
+test "pickerRow: a table with a 10 in it pads every number, so no spelling shifts a column" {
+    var nine_buf: [96]u8 = undefined;
+    var ten_buf: [96]u8 = undefined;
+    const nine = wall_picker.pickerRow(&nine_buf, 9, true, "--sock /a", "1 session", false, 40);
+    const ten = wall_picker.pickerRow(&ten_buf, 10, true, "--sock /a", "1 session", false, 40);
+    try std.testing.expectEqual(
+        std.mem.indexOf(u8, nine, "--sock").?,
+        std.mem.indexOf(u8, ten, "--sock").?,
+    );
+    // A table that never reaches 10 spends no column on a digit it has not
+    // got: the marker is already two wide for the same reason.
+    var narrow_buf: [96]u8 = undefined;
+    const narrow = wall_picker.pickerRow(&narrow_buf, 9, false, "--sock /a", "1 session", false, 40);
+    try std.testing.expectEqualStrings(" 9  --sock", narrow[0..10]);
+}
+test "pickerRows: every host says what its poller last answered" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    // Four hosts, one per state the column can report. A fixture of one
+    // reachable host is blind to three of them.
+    var table = [_]Host{
+        fixture.testHost(&shared, "--sock /tmp/a.sock", "/tmp/a.sock"),
+        fixture.testHost(&shared, "box", "/tmp/b.sock"),
+        fixture.testHost(&shared, "quic://gate:4433", "/tmp/c.sock"),
+        fixture.testHost(&shared, "slow", "/tmp/d.sock"),
+    };
+    fixture.setList(&table[0], "0\nwork\ndev\n");
+    table[0].applied = true;
+    fixture.setList(&table[1], "");
+    table[1].reachable.store(false, .release);
+    table[1].applied = true;
+    fixture.setList(&table[2], "");
+    table[2].applied = true;
+    // Never answered: `applied` is what a first list sets, so a host that
+    // has not reported once is `connecting` and not `no sessions` — the
+    // two send the user to opposite places.
+    var body: PickerBody = .{};
+    wall_picker.pickerRows(&body, &table, 2, 48);
+    try std.testing.expectEqual(@as(usize, 4), body.n);
+    try std.testing.expectEqualStrings(" 1  --sock /tmp/a.sock               3 sessions ", body.row(0));
+    try std.testing.expectEqualStrings(" 2  box                             unreachable ", body.row(1));
+    // The selected row wears the same marker a focused tile's bar does.
+    try std.testing.expectEqualStrings(" 3> quic://gate:4433                no sessions ", body.row(2));
+    try std.testing.expectEqualStrings(" 4  slow                             connecting ", body.row(3));
+}
+test "pickerRows: one session is not 1 sessions" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    var table = [_]Host{fixture.testHost(&shared, "box", "/tmp/b.sock")};
+    fixture.setList(&table[0], "0\n");
+    table[0].applied = true;
+    var body: PickerBody = .{};
+    wall_picker.pickerRows(&body, &table, 0, 32);
+    try std.testing.expectEqualStrings(" 1> box               1 session ", body.row(0));
+}
+test "pickerRows: a spelling wider than the box keeps its tail" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    var table = [_]Host{fixture.testHost(
+        &shared,
+        "--sock /run/user/1000/mux/very/long/path/to/muxd.sock",
+        "/tmp/b.sock",
+    )};
+    fixture.setList(&table[0], "0\n");
+    table[0].applied = true;
+    var body: PickerBody = .{};
+    wall_picker.pickerRows(&body, &table, 0, 32);
+    // Cut from the LEFT: the head of a socket path is what every host on
+    // one machine has in common, and the tail is what tells them apart.
+    try std.testing.expectEqualStrings(" 1> path/to/muxd.sock 1 session ", body.row(0));
+}
+test "pickBirth: Enter on an emptied popup births nothing, not a session on a host just forgotten" {
+    var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer arena.deinit();
+    const alloc = arena.allocator();
+    var shared: Shared = undefined;
+    fixture.stoppedWall(alloc, &shared);
+    var tiles: [4]Tile = undefined;
+    var present = [_]bool{false} ** 4;
+    var live: usize = 0;
+    defer fixture.endPumps(tiles[0..live]);
+    // TWO hosts, both forgotten: the wall the last `x` empties is the wall
+    // whose popup has no row left to move the selection to, so `sel` still
+    // indexes a slot — a one-host fixture proves nothing about the index.
+    var table = [_]Host{
+        fixture.testHost(&shared, "a", "/tmp/a.sock"),
+        fixture.testHost(&shared, "b", "/tmp/b.sock"),
+    };
+    for (&table) |*h| {
+        fixture.setList(h, "");
+        h.applied = true;
+        h.forgotten.store(true, .release);
+    }
+    const at = wall_picker.pickBirth(alloc, &tiles, &present, &live, &shared, &table, 1);
+    if (at != null) return error.BornOnAForgottenHost;
+    if (live != 0) return error.AForgottenHostTookASlot;
+    var buf: [96]u8 = undefined;
+    try std.testing.expectEqualStrings(
+        "[no hosts to start a session on - a adds one]",
+        wv.takeNotice(&shared, &buf),
+    );
+}
+test "pickBirth: Enter is an ask — the tile it births may start a daemon, the row it came from may not" {
+    var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer arena.deinit();
+    const alloc = arena.allocator();
+    var shared: Shared = undefined;
+    fixture.stoppedWall(alloc, &shared);
+    var tiles: [4]Tile = undefined;
+    var present = [_]bool{false} ** 4;
+    var live: usize = 0;
+    defer fixture.endPumps(tiles[0..live]);
+    // TWO hosts, and the birth on the second: a one-host fixture cannot
+    // see a birth that reaches for the wrong row.
+    var table = [_]Host{
+        .{
+            .spec = try wall_host.resolveHost(alloc, "alpha", null, client.quic_idle_ms_default),
+            .shared = &shared,
+        },
+        .{
+            .spec = try wall_host.resolveHost(alloc, "beta", null, client.quic_idle_ms_default),
+            .shared = &shared,
+        },
+    };
+    for (&table) |*h| {
+        fixture.setList(h, "");
+        h.applied = true;
+    }
+    const at = wall_picker.pickBirth(alloc, &tiles, &present, &live, &shared, &table, 1) orelse
+        return error.EnterBornNothing;
+    // The row Enter lands on is often exactly the one the poller calls
+    // unreachable, and starting that machine's daemon is what choosing it
+    // means. Nothing else on the wall may: the spec below it is what the
+    // poller re-dials every second.
+    try std.testing.expect(tiles[at].r.target.hand.asked);
+    try std.testing.expect(!table[1].spec.target.hand.asked);
+    try std.testing.expect(!table[1].spec.poll_target.hand.asked);
+}
+test "pickerRows: a forgotten host is off the list, and the numbers close up" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    var table = [_]Host{
+        fixture.testHost(&shared, "a", "/tmp/a.sock"),
+        fixture.testHost(&shared, "b", "/tmp/b.sock"),
+        fixture.testHost(&shared, "c", "/tmp/c.sock"),
+    };
+    for (&table) |*h| {
+        fixture.setList(h, "");
+        h.applied = true;
+    }
+    // The slot STAYS — a poller thread holds the pointer and `Tile.host`
+    // indexes it — so only the list closes up.
+    table[1].forgotten.store(true, .release);
+    var body: PickerBody = .{};
+    wall_picker.pickerRows(&body, &table, 2, 32);
+    try std.testing.expectEqual(@as(usize, 2), body.n);
+    try std.testing.expectEqualStrings(" 1  a               no sessions ", body.row(0));
+    try std.testing.expectEqualStrings(" 2> c               no sessions ", body.row(1));
+}
+test "pickerRepaint: a screen cleared under the spelling editor still owes a paint, carrying the half-typed line" {
+    var f = interact.PrefixFilter{};
+    var buf: [interact.PrefixFilter.prompt_max + 4]u8 = undefined;
+    // Nothing is owed while the popup is not up, whatever else happened.
+    try std.testing.expect(!wall_picker.pickerRepaint(&buf, &f, true).due);
+    f.picking = true;
+    const closed = wall_picker.pickerRepaint(&buf, &f, false);
+    try std.testing.expect(!closed.due);
+    try std.testing.expectEqual(@as(?[]const u8, null), closed.line);
+    // The editor is open and a poll on some OTHER host births or vanishes a
+    // tile: `relayout` clears the whole screen and zeroes the stamp, which
+    // is the trigger. Skipping the paint here leaves the user typing into an
+    // editor that is not on the screen, and every key still goes to it.
+    f.prompting = true;
+    var typed = [_]u8{ 'b', 'o', 'x' };
+    for (&typed) |*c| _ = f.feed(c[0..1]);
+    const repair = wall_picker.pickerRepaint(&buf, &f, true);
+    try std.testing.expect(repair.due);
+    try std.testing.expectEqualStrings(": box_", repair.line orelse "");
+}
+test "hostState: the row counts the sessions the wall could show, not the runs in the reply" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var h = Host{
+        .spec = .{ .spelling = "--sock /a", .target = .{ .sock = "/a" }, .poll_target = .{ .sock = "/a" } },
+        .shared = &shared,
+    };
+    var buf: [32]u8 = undefined;
+    // Never polled, so nothing is known: `no sessions` here would send the
+    // user to birth on a machine that is not answering.
+    try std.testing.expectEqualStrings("connecting", wall_picker.hostState(&buf, &h));
+    h.applied = true;
+    const listed = "a\nb\nc\n";
+    @memcpy(h.list[0..listed.len], listed);
+    h.list_len = listed.len;
+    try std.testing.expectEqualStrings("3 sessions", wall_picker.hostState(&buf, &h));
+    // A row saying `4 sessions` beside three tiles is the row lying about
+    // the wall: `planHostDiff` births through `validSessionName`, so the
+    // count reads the reply through the same filter.
+    const with_junk = "a\nb\n" ++ ("x" ** (proto.session_name_max + 1)) ++ "\nc\n";
+    @memcpy(h.list[0..with_junk.len], with_junk);
+    h.list_len = with_junk.len;
+    try std.testing.expectEqualStrings("3 sessions", wall_picker.hostState(&buf, &h));
+    h.reachable.store(false, .release);
+    try std.testing.expectEqualStrings("unreachable", wall_picker.hostState(&buf, &h));
+}

src/tui/wall_test_pump.zig

@@ @@ -0,0 +1,530 @@ @@
+//! One tile's pump thread (wall_pump.zig).
+const std = @import("std");
+const proto = @import("protocol");
+const client = @import("client");
+const interact = @import("interact");
+const TmpDir = @import("testtmp").TmpDir;
+const fixture = @import("wall_test_harness.zig");
+const wall_pump = @import("wall_pump.zig");
+const wv = @import("wallview.zig");
+const AgentLocal = wall_pump.AgentLocal;
+const ClaimStep = wall_pump.ClaimStep;
+const Shared = wv.Shared;
+const SwallowTransport = fixture.SwallowTransport;
+const Tile = wv.Tile;
+test "claimAllowed: a stale arm does not claim even when the sink would now admit it" {
+    const alloc = std.testing.allocator;
+    const pipe = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(pipe[0]);
+    defer std.posix.close(pipe[1]);
+    var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    // The focus has moved to tile 1; tile 2 is still holding the arm it was
+    // given before the popup went up.
+    shared.sel = 1;
+    var t = fixture.claimBench(&shared, 2);
+    t.claim_pending.store(true, .release);
+    var core = try interact.Core.initSized(alloc, -1, pipe[1], .{ .cols = 80, .rows = 24 });
+    defer core.deinit();
+    core.is_tty = true;
+    // The whole of this test: the picker has CLOSED, so the default sink
+    // admits every paint and `claimTerminal` would SUCCEED. Judging the
+    // claim's refusal cannot see that — there is no refusal left to judge —
+    // so the focus test has to run first, and `claimFocus` is the one door
+    // in this file that puts the two in that order.
+    const rect: proto.Size = .{ .cols = 80, .rows = 24 };
+    _ = t.claim_pending.swap(false, .acq_rel);
+    try std.testing.expectEqual(ClaimStep.dropped, wall_pump.claimFocus(&t, &core, rect));
+    // Nothing claimed, and nothing on the terminal: `session_claim` is the
+    // mouse modes, and a second tile setting them is what leaves one
+    // session's modes on the screen with nothing left to take them off.
+    try std.testing.expectEqual(interact.Claim.none, core.claim);
+    var buf: [256]u8 = undefined;
+    try std.testing.expectEqual(@as(usize, 0), std.posix.read(pipe[0], &buf) catch 0);
+    // The control: the same call on the tile that DOES hold the focus takes
+    // it, so the guard is a focus test and not a blanket refusal.
+    shared.sel = 2;
+    try std.testing.expectEqual(ClaimStep.done, wall_pump.claimFocus(&t, &core, rect));
+    try std.testing.expectEqual(interact.Claim.session, core.claim);
+    try std.testing.expect((std.posix.read(pipe[0], &buf) catch 0) > 0);
+}
+test "afterClaim: a claim the picker refused is armed again for this tile" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    // Off-origin: tile 2 of a wall, not tile 0, so an index compared
+    // against a hard-coded 0 would pass here and nowhere else.
+    shared.sel = 2;
+    var t = fixture.claimBench(&shared, 2);
+    try std.testing.expectEqual(ClaimStep.rearmed, wall_pump.afterClaim(&t, false, false, true));
+    try std.testing.expect(t.claim_pending.load(.acquire));
+}
+test "afterClaim: an arm does not outlive the focus that earned it" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    var t = fixture.claimBench(&shared, 2);
+    // The keyboard moved the focus while the popup was up — a poller's tile
+    // arriving, or the birth the Enter made. A re-arm that survived it
+    // fires after the close: two tiles' modes on one terminal, the cursor
+    // resting on the loser, and the release already consumed so nothing
+    // takes either off.
+    shared.sel = 1;
+    try std.testing.expectEqual(ClaimStep.dropped, wall_pump.afterClaim(&t, false, false, true));
+    try std.testing.expect(!t.claim_pending.load(.acquire));
+}
+test "afterClaim: only the SINK's refusal is worth another pass" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    shared.sel = 2;
+    var t = fixture.claimBench(&shared, 2);
+    // A claim that landed owes nothing.
+    try std.testing.expectEqual(ClaimStep.done, wall_pump.afterClaim(&t, true, true, true));
+    // A Core that ALREADY holds it answers false too, and re-arming that
+    // would re-take the focus notice on every pass, forever.
+    try std.testing.expectEqual(ClaimStep.done, wall_pump.afterClaim(&t, false, true, true));
+    // No terminal, nothing to hold: a piped `mux` is one tile and no claim.
+    try std.testing.expectEqual(ClaimStep.done, wall_pump.afterClaim(&t, false, false, false));
+    // None of the three armed anything.
+    try std.testing.expect(!t.claim_pending.load(.acquire));
+}
+test "tilePaintBegin: no tile paints while the picker owns the screen" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    var t = Tile{
+        .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "0" },
+        .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    // The gate the whole popup rests on, and the gate that makes a focus
+    // CLAIM fail under it (`Core.claimTerminal` writes through the same
+    // sink) — which is why the pump re-arms `claim_pending` instead of
+    // treating a false return as "already claimed".
+    try std.testing.expect(wall_pump.tilePaintBegin(&t));
+    wall_pump.tilePaintEnd(&t);
+    shared.picker_open.store(true, .release);
+    try std.testing.expect(!wall_pump.tilePaintBegin(&t));
+    // Refused WITHOUT holding the lock: a begin that returned false and
+    // kept `paint_mu` would wedge the keyboard on its next paint.
+    try std.testing.expect(shared.paint_mu.tryLock());
+    shared.paint_mu.unlock();
+}
+test "endRefusal: a refusal is said in this client's words, never in the peer's bytes" {
+    try std.testing.expectEqualStrings(
+        "[no such session on that daemon]",
+        wall_pump.endRefusal(proto.end_reason.no_session),
+    );
+    try std.testing.expectEqualStrings(
+        "[the daemon could not read the end request]",
+        wall_pump.endRefusal(proto.end_reason.bad_frame),
+    );
+    // Anything the daemon does not say: an OSC title set, a CSI, or 260
+    // bytes of nothing. All three used to reach the terminal verbatim.
+    try std.testing.expectEqualStrings(
+        "[the daemon refused to end this session]",
+        wall_pump.endRefusal("\x1b]0;pwned\x07"),
+    );
+    try std.testing.expectEqualStrings(
+        "[the daemon refused to end this session]",
+        wall_pump.endRefusal("\x1b[2J"),
+    );
+    try std.testing.expectEqualStrings("[the daemon refused to end this session]", wall_pump.endRefusal(""));
+}
+test "a copy too big for OSC 52 is said out loud rather than dropped" {
+    // The notice path is the whole claim. A reply that rounds to ok on the
+    // wire but outruns OSC 52 is neither trimmed nor dropped: a half-copied
+    // selection is worse than none, because the user finds out when they
+    // paste it. The drag is per-tile now, on the Core the pump owns, so the
+    // copy goes through that Core — no claim is taken, the copy reads the
+    // drag and not the terminal's modes.
+    const alloc = std.testing.allocator;
+    const p = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(p[0]);
+    defer std.posix.close(p[1]);
+    var shared = Shared{ .out_fd = p[1], .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    var t = Tile{
+        .r = .{ .target = .{ .sock = "/s" }, .label = "a", .session = "a" },
+        .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    var core = try interact.Core.initSized(alloc, -1, p[1], shared.size);
+    defer core.deinit();
+    core.rep.history_rows = 0;
+    core.drag.press(.{ .row = 3, .col = 4 }, .{ .tile = 0, .row = 0, .col = 4 });
+    core.drag.motion(.{ .row = 5, .col = 9 }, .{ .tile = 0, .row = 2, .col = 9 });
+    _ = core.drag.release();
+    try std.testing.expect(core.drag.range() != null);
+    var tr: SwallowTransport = .{};
+    const held = core.drag.range() orelse return error.NoDrag;
+    try core.requestSelection(&tr, held);
+    // Base64 of this length overruns clipboard_base64_max: the daemon sends
+    // it as ok, and OSC 52 cannot carry it.
+    const fits = proto.clipboard_base64_max / 4 * 3;
+    const big = try alloc.alloc(u8, fits + 1);
+    defer alloc.free(big);
+    @memset(big, 'x');
+    const rbuf = try alloc.alloc(u8, proto.selection_reply_prefix_len + big.len);
+    defer alloc.free(rbuf);
+    const payload = fixture.replyBytes(rbuf, core.sel_id, .ok, 0, big);
+    wall_pump.copySelection(&t, alloc, &core, payload);
+    var buf: [8192]u8 = undefined;
+    const said = fixture.readAvail(p[0], &buf);
+    try std.testing.expect(std.mem.indexOf(u8, said, "too large") != null);
+    // Refused, not trimmed: a half-copied selection is worse than none,
+    // because the user finds out when they paste it.
+    try std.testing.expect(std.mem.indexOf(u8, said, "\x1b]52;") == null);
+}
+test "a reconnect drops the highlight over its own tile, and only its own" {
+    // Core.reattached clears that Core's drag — a resync renames the
+    // absolute row space, so a highlight kept across one would invert rows
+    // nobody selected. The drag is per-tile, so one tile's reconnect says
+    // nothing about another's selection: the neighbour's highlight stays.
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var tiles: [2]Tile = undefined;
+    tiles[0] = Tile{
+        .r = .{ .target = .{ .sock = "/s" }, .label = "a", .session = "a" },
+        .rect = .{ .top = 0, .left = 0, .rows = 12, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    tiles[1] = Tile{
+        .r = .{ .target = .{ .sock = "/s" }, .label = "b", .session = "b" },
+        .rect = .{ .top = 12, .left = 0, .rows = 12, .cols = 80 },
+        .shared = &shared,
+        .idx = 1,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    // Each tile's pump owns its own Core, and each Core its own drag. A
+    // drag over tile 0 and one over tile 1, anchored in their own tiles.
+    var core0 = try interact.Core.initSized(alloc, -1, -1, shared.size);
+    defer core0.deinit();
+    var core1 = try interact.Core.initSized(alloc, -1, -1, shared.size);
+    defer core1.deinit();
+    core0.drag.press(.{ .row = 3, .col = 4 }, .{ .tile = 0, .row = 0, .col = 4 });
+    core0.drag.motion(.{ .row = 5, .col = 9 }, .{ .tile = 0, .row = 2, .col = 9 });
+    core1.drag.press(.{ .row = 3, .col = 4 }, .{ .tile = 1, .row = 0, .col = 4 });
+    core1.drag.motion(.{ .row = 5, .col = 9 }, .{ .tile = 1, .row = 2, .col = 9 });
+    try std.testing.expectEqual(@as(?usize, 0), core0.drag.on());
+    try std.testing.expectEqual(@as(?usize, 1), core1.drag.on());
+    // Tile 0 reconnects: its row space is about to be renamed, so its
+    // highlight comes off. Tile 1's never went away.
+    core0.reattached();
+    try std.testing.expect(core0.drag.range() == null);
+    try std.testing.expect(core0.drag.on() == null);
+    try std.testing.expect(core1.drag.range() != null);
+    try std.testing.expectEqual(@as(?usize, 1), core1.drag.on());
+}
+test "agent channels: slots fill in order, a full table refuses, and a close is announced" {
+    // The pump's table at the size its refusal path needs. The e2e proves
+    // one channel end to end and will never fill eight of them.
+    var locals: [3]?AgentLocal = @splat(null);
+    // Real fds, not stand-ins: a channel here is the write end of a pipe, so
+    // "the table closed it" is answered by the READER seeing EOF rather than
+    // by trusting the table's own bookkeeping. Non-blocking, so a channel
+    // that was NOT closed reports EAGAIN and fails the assertion instead of
+    // parking the suite on a read that never returns.
+    var peers: [4]std.posix.fd_t = undefined;
+    var chans: [4]std.posix.fd_t = undefined;
+    for (0..4) |i| {
+        const p = try std.posix.pipe2(.{ .NONBLOCK = true });
+        peers[i] = p[0];
+        chans[i] = p[1];
+    }
+    defer for (peers) |fd| std.posix.close(fd);
+    for (0..3) |i| try std.testing.expectEqual(
+        @as(?usize, i),
+        wall_pump.storeLocal(&locals, @intCast(10 + i), chans[i]),
+    );
+    // The full table the pump answers with `agent_close`. The fourth fd stays
+    // this test's to close: a refused store never took ownership of it.
+    try std.testing.expectEqual(@as(?usize, null), wall_pump.storeLocal(&locals, 99, chans[3]));
+    std.posix.close(chans[3]);
+    try std.testing.expectEqual(@as(?usize, 1), wall_pump.findLocal(&locals, 11));
+    try std.testing.expectEqual(@as(?usize, null), wall_pump.findLocal(&locals, 99));
+    // A pipe for the link, which is what a `.fd` transport writes to. The
+    // frame that comes back out of it is the daemon's only notice that this
+    // end hung up on the channel.
+    const link = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(link[0]);
+    defer std.posix.close(link[1]);
+    var transport: client.Transport = .{ .conn = .{ .r = link[0], .w = link[1] }, .link = .fd };
+    wall_pump.closeLocal(&locals, 1, &transport);
+    try std.testing.expectEqual(@as(?AgentLocal, null), locals[1]);
+    try std.testing.expect(fixture.peerClosed(peers[1]));
+    const frame = (try proto.readFrame(std.testing.allocator, link[0])) orelse
+        return error.NoAgentCloseOnLocalClose;
+    defer frame.deinit(std.testing.allocator);
+    try std.testing.expectEqual(proto.MsgType.agent_close, frame.type);
+    try std.testing.expectEqual(@as(u32, 11), try proto.decodeAgentId(frame.payload));
+    // The redial's sweep: every channel still open goes, and nothing is said
+    // — the connection that owned them is the one that just died.
+    wall_pump.dropLocals(&locals);
+    for (locals) |c| try std.testing.expectEqual(@as(?AgentLocal, null), c);
+    try std.testing.expect(fixture.peerClosed(peers[0]));
+    try std.testing.expect(fixture.peerClosed(peers[2]));
+}
+test "agent channels: an oversize frame hangs the channel up, a full one lands" {
+    var locals: [2]?AgentLocal = @splat(null);
+    const chan = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(chan[0]);
+    _ = wall_pump.storeLocal(&locals, 5, chan[1]);
+    const link = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(link[0]);
+    defer std.posix.close(link[1]);
+    var transport: client.Transport = .{ .conn = .{ .r = link[0], .w = link[1] }, .link = .fd };
+    // The ordinary case first, so the refusal below is a refusal and not a
+    // delivery path that never worked.
+    var small: [proto.agent_id_len + 2]u8 = undefined;
+    small[0..proto.agent_id_len].* = proto.encodeAgentId(5);
+    @memcpy(small[proto.agent_id_len..], "hi");
+    try std.testing.expect(wall_pump.deliverAgentData(&locals, &small, &transport));
+    var got: [8]u8 = undefined;
+    try std.testing.expectEqual(@as(usize, 2), try std.posix.read(chan[0], &got));
+    try std.testing.expectEqualSlices(u8, "hi", got[0..2]);
+    // One byte past the cap. The daemon never sends this; a peer that is not
+    // the daemon we shipped can, and `writeAllFd` would block on it.
+    const over = try std.testing.allocator.alloc(u8, proto.agent_id_len + proto.agent_data_max + 1);
+    defer std.testing.allocator.free(over);
+    @memset(over, 'x');
+    over[0..proto.agent_id_len].* = proto.encodeAgentId(5);
+    try std.testing.expect(wall_pump.deliverAgentData(&locals, over, &transport));
+    try std.testing.expectEqual(@as(?AgentLocal, null), locals[0]);
+    try std.testing.expect(fixture.peerClosed(chan[0]));
+    // And the daemon is told, because it is holding the far socket open for
+    // an answer this end will never write.
+    // A payload too short to name a channel: false, and the pump abandons the
+    // batch on it rather than skipping one frame, because a stream that has
+    // lost frame alignment is not one to keep reading.
+    try std.testing.expect(!wall_pump.deliverAgentData(&locals, "ab", &transport));
+    const frame = (try proto.readFrame(std.testing.allocator, link[0])) orelse
+        return error.NoAgentCloseOnOversize;
+    defer frame.deinit(std.testing.allocator);
+    try std.testing.expectEqual(proto.MsgType.agent_close, frame.type);
+    try std.testing.expectEqual(@as(u32, 5), try proto.decodeAgentId(frame.payload));
+}
+test "agent forwarding is per tile: no -A offers nothing and opens nothing" {
+    // A REAL agent socket on this machine, listening. Without one, a tile
+    // that never asked for forwarding and a tile that did both refuse — for
+    // different reasons — and the consent gate could be deleted under a
+    // green suite.
+    var tmp = try TmpDir.make();
+    defer tmp.cleanup();
+    var buf: [128]u8 = undefined;
+    const sock = try std.fmt.bufPrintZ(&buf, "{s}/agent.sock", .{tmp.path()});
+    const addr = try std.net.Address.initUnix(sock);
+    var listener = try addr.listen(.{});
+    defer listener.deinit();
+    var locals: [2]?AgentLocal = @splat(null);
+    defer wall_pump.dropLocals(&locals);
+    // The gate, both ways round, against the same reachable agent.
+    try std.testing.expect(!wall_pump.openAgentChan(&locals, 1, false, sock));
+    try std.testing.expectEqual(@as(?usize, null), wall_pump.findLocal(&locals, 1));
+    try std.testing.expect(wall_pump.openAgentChan(&locals, 1, true, sock));
+    try std.testing.expect(wall_pump.findLocal(&locals, 1) != null);
+    // And the daemon does not get told about an agent the tile never
+    // offered — the offer is what the daemon routes on, so a stray one
+    // makes this client the answerer for a session it never armed.
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var t = Tile{
+        .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "", .agent = false },
+        .rect = .{ .top = 0, .left = 0, .rows = 4, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    const link = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(link[0]);
+    defer std.posix.close(link[1]);
+    var transport: client.Transport = .{ .conn = .{ .r = link[0], .w = link[1] }, .link = .fd };
+    try wall_pump.sendAttach(&t, &transport, 0, 0);
+    const first = (try proto.readFrame(std.testing.allocator, link[0])) orelse
+        return error.NoAttach;
+    defer first.deinit(std.testing.allocator);
+    try std.testing.expectEqual(proto.MsgType.attach, first.type);
+    // Nothing else on the pipe at all: an empty non-blocking read is the
+    // only proof that no offer followed, since a frame reader would just
+    // block waiting for one.
+    var spare: [1]u8 = undefined;
+    try std.testing.expectError(error.WouldBlock, std.posix.read(link[0], &spare));
+    // The positive control on the same pipe: with `-A` the offer follows the
+    // attach, so the silence above is the gate and not an unwritten frame.
+    t.r.agent = true;
+    try wall_pump.sendAttach(&t, &transport, 0, 0);
+    const attach = (try proto.readFrame(std.testing.allocator, link[0])).?;
+    defer attach.deinit(std.testing.allocator);
+    const offer = (try proto.readFrame(std.testing.allocator, link[0])) orelse
+        return error.NoAgentOffer;
+    defer offer.deinit(std.testing.allocator);
+    try std.testing.expectEqual(proto.MsgType.agent_offer, offer.type);
+}
+test "a view tile's attach makes no size claim; a tile the user asked for does" {
+    // The daemon reads attach-or-create off the attach's size claim: 0x0
+    // joins, a real size creates. So a view tile (creates = false) must
+    // put 0x0 on the wire and leave its rect to the resize doorbell, while
+    // a tile the user asked for (creates = true) claims its rect in the
+    // attach itself.
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    // A one-tile wall: no label bar, so viewRows is the whole stripe.
+    shared.label_rows = 0;
+    var t = Tile{
+        .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "", .agent = false },
+        .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    const link = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(link[0]);
+    defer std.posix.close(link[1]);
+    var transport: client.Transport = .{ .conn = .{ .r = link[0], .w = link[1] }, .link = .fd };
+    // A view tile: 0x0 on the wire, and the rect owed to the doorbell.
+    t.creates = false;
+    t.resize_pending = false;
+    try wall_pump.sendAttach(&t, &transport, 0, 0);
+    const view = (try proto.readFrame(std.testing.allocator, link[0])) orelse
+        return error.NoAttach;
+    defer view.deinit(std.testing.allocator);
+    try std.testing.expectEqual(proto.MsgType.attach, view.type);
+    const view_req = try proto.decodeAttach(view.payload);
+    try std.testing.expectEqual(@as(u16, 0), view_req.cols);
+    try std.testing.expectEqual(@as(u16, 0), view_req.rows);
+    try std.testing.expect(t.resize_pending);
+    // The same tile, now one the user asked for: the rect is in the attach,
+    // and no doorbell is owed.
+    t.creates = true;
+    t.resize_pending = false;
+    try wall_pump.sendAttach(&t, &transport, 0, 0);
+    const entry = (try proto.readFrame(std.testing.allocator, link[0])) orelse
+        return error.NoAttach;
+    defer entry.deinit(std.testing.allocator);
+    try std.testing.expectEqual(proto.MsgType.attach, entry.type);
+    const entry_req = try proto.decodeAttach(entry.payload);
+    try std.testing.expectEqual(@as(u16, 80), entry_req.cols);
+    try std.testing.expectEqual(@as(u16, 24), entry_req.rows);
+    try std.testing.expect(!t.resize_pending);
+}
+test "a newborn tile's first claim is its real stripe, not the placeholder" {
+    // A chord-born tile (creates = true) puts its rect on the attach frame,
+    // and the daemon refuses creates under min_session_rows. A 2-row
+    // stripe under a label bar is 1 content row — below the floor — so a
+    // placeholder stripe silently freezes the session on a stale grid.
+    // The tile's stripe must be what relayout would give it BEFORE the
+    // pump's first sendAttach.
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.label_rows = 1; // two tiles draw a bar
+    // Real stripe for the second tile of a 2-tile wall on 24 rows.
+    var t = Tile{
+        .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "", .agent = false },
+        .rect = .{ .top = 12, .left = 0, .rows = 12, .cols = 80 },
+        .shared = &shared,
+        .idx = 1,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    t.creates = true;
+    const link = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(link[0]);
+    defer std.posix.close(link[1]);
+    var transport: client.Transport = .{ .conn = .{ .r = link[0], .w = link[1] }, .link = .fd };
+    try wall_pump.sendAttach(&t, &transport, 0, 0);
+    const fr = (try proto.readFrame(std.testing.allocator, link[0])) orelse
+        return error.NoAttach;
+    defer fr.deinit(std.testing.allocator);
+    const req = try proto.decodeAttach(fr.payload);
+    // The real stripe's viewRows is 11 (12 - 1 bar), never the 1 a
+    // placeholder rows=2 stripe would put on the wire.
+    try std.testing.expectEqual(@as(u16, 80), req.cols);
+    try std.testing.expectEqual(@as(u16, 11), req.rows);
+    try std.testing.expect(req.rows >= proto.min_session_rows);
+}
+test "the cursor sleeps in the focused tile, whoever painted last" {
+    // Every painter ends by showing the cursor where its own stripe sits, so
+    // without an owner the visible cursor lands on whichever pump painted
+    // last. The fix: a focused paint records its screen cursor in Shared, and
+    // an unfocused paint's last act is to put the cursor back there. A
+    // focused tile with no core (the unit-test fixture) records nothing and
+    // restores nothing — the core is what knows the cursor.
+    const p = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(p[0]);
+    defer std.posix.close(p[1]);
+    var shared = Shared{ .out_fd = p[1], .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    var tiles: [2]Tile = undefined;
+    tiles[0] = Tile{
+        .r = .{ .target = .{ .sock = "/s" }, .label = "a", .session = "a" },
+        .rect = .{ .top = 0, .left = 0, .rows = 12, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    tiles[1] = Tile{
+        .r = .{ .target = .{ .sock = "/s" }, .label = "b", .session = "b" },
+        .rect = .{ .top = 12, .left = 0, .rows = 12, .cols = 80 },
+        .shared = &shared,
+        .idx = 1,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    shared.sel = 0;
+    shared.cursor = .{ .x = 3, .y = 5 };
+    var buf: [512]u8 = undefined;
+    // An UNFOCUSED paint (tile 1, core null) ends by restoring the shared
+    // cursor: hide, CUP to the focused tile's stored position, then show
+    // again so the cursor rests visible in the focused tile until its own
+    // next paint — without the trailing show the cursor stays hidden.
+    _ = wall_pump.tilePaintBegin(&tiles[1]);
+    wall_pump.tilePaintEnd(&tiles[1]);
+    try std.testing.expectEqualStrings("\x1b[?25l\x1b[6;4H\x1b[?25h", fixture.readAvail(p[0], &buf));
+    // A FOCUSED paint (tile 0, core null) records nothing and restores
+    // nothing: no core means the shared cursor is left untouched, and the
+    // pipe receives no new bytes.
+    _ = wall_pump.tilePaintBegin(&tiles[0]);
+    wall_pump.tilePaintEnd(&tiles[0]);
+    try std.testing.expectEqual(@as(usize, 0), fixture.readAvail(p[0], &buf).len);
+}

src/tui/wall_test_wall.zig

@@ @@ -0,0 +1,1156 @@ @@
+//! The wall itself: tiles, focus, births, endings and label bars.
+const std = @import("std");
+const proto = @import("protocol");
+const client = @import("client");
+const interact = @import("interact");
+const fixture = @import("wall_test_harness.zig");
+const wall_host = @import("wall_host.zig");
+const wall_layout = @import("wall_layout.zig");
+const wall_pump = @import("wall_pump.zig");
+const wv = @import("wallview.zig");
+const EndAction = wv.EndAction;
+const EndKey = wv.EndKey;
+const EndReason = wv.EndReason;
+const Resolved = wall_host.Resolved;
+const Shared = wv.Shared;
+const State = wv.State;
+const Tile = wv.Tile;
+test "birthTile: a chord-born tile creates and offers no agent" {
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    defer shared.tree.deinit();
+    try shared.tree.addFirst(0);
+    var tiles: [2]Tile = undefined;
+    tiles[0] = .{
+        .r = .{ .target = .{ .sock = "/tmp/a" }, .label = "--sock /tmp/a", .session = "" },
+        .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    var present = [_]bool{ true, false };
+    var live: usize = 1;
+    const r: Resolved = .{ .target = .{ .sock = "/tmp/b" }, .label = "--sock /tmp/b#b", .session = "b" };
+    const at = wv.birthTile(alloc, &tiles, &present, &live, &shared, .{
+        .r = r,
+        .from = 0,
+        .place = .beside_focus,
+        .creates = true,
+        .born_from = 0,
+    }) orelse return error.TestUnexpectedResult;
+    defer std.posix.close(tiles[at].wake_r);
+    defer std.posix.close(tiles[at].wake_w);
+    try std.testing.expectEqual(@as(usize, 1), at);
+    try std.testing.expect(tiles[at].creates);
+    try std.testing.expect(!tiles[at].r.agent);
+    try std.testing.expectEqual(@as(?usize, 0), tiles[at].born_from);
+    try std.testing.expect(present[1]);
+    try std.testing.expectEqual(@as(usize, 2), live);
+    // Two tiles draw a bar, and the bar is set at birth so viewRows is
+    // right from the first attach.
+    try std.testing.expectEqual(@as(u16, 1), shared.label_rows);
+}
+test "the empty wall advertises the key the picker really answers to" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    const hint = wv.emptyWallHint(&shared);
+    // The sentence names a chord; this is what stops it outliving the
+    // binding. `Ctrl-\ s` in the text, `\x1c s` through the filter.
+    try std.testing.expect(std.mem.indexOf(u8, hint, "Ctrl-\\ s") != null);
+    var f: interact.PrefixFilter = .{};
+    var keys = "\x1cs".*;
+    try std.testing.expectEqual(interact.PrefixFilter.Action.pick_open, f.feed(&keys).action);
+}
+test "emptyWallHint: a chord an empty wall refuses is said there, and said once" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    const way_out = "Ctrl-\\ s to pick a host - Ctrl-\\ d to leave";
+    try std.testing.expectEqualStrings(way_out, wv.emptyWallHint(&shared));
+    wv.setNotice(&shared, "[no session to birth beside - Ctrl-\\ s picks a host]");
+    shared.paint_mu.lock();
+    defer shared.paint_mu.unlock();
+    // An empty wall has no pump, and a notice is painted by the pump that
+    // claims the terminal — so this line is the only place it can be said.
+    try std.testing.expectEqualStrings(
+        "[no session to birth beside - Ctrl-\\ s picks a host]",
+        wv.emptyWallHint(&shared),
+    );
+    // Once: every relayout repaints the empty line, and a sentence that
+    // outlived the keystroke that earned it would never leave the screen.
+    try std.testing.expectEqualStrings(way_out, wv.emptyWallHint(&shared));
+}
+test "awaitDetach: a pump that has already returned is not waited on" {
+    var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer arena.deinit();
+    var shared: Shared = undefined;
+    fixture.stoppedWall(arena.allocator(), &shared);
+    var t: Tile = .{
+        .r = .{ .target = .{ .sock = "/tmp/a" }, .label = "--sock /tmp/a", .session = "0" },
+        .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+        .alive = std.atomic.Value(bool).init(false),
+    };
+    // The pump is the only thread that sets `detach_ack`, and this one has
+    // returned: the wait can only ever run out its 400ms bound.
+    const began = std.time.milliTimestamp();
+    wv.awaitDetach(&t, &shared);
+    try std.testing.expect(std.time.milliTimestamp() - began < 100);
+}
+test "setNoticeIdle: a standing condition waits — a refusal the user just earned is not overwritten" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var buf: [96]u8 = undefined;
+    // The poll re-derives `[+N not shown]` every second per host, and the
+    // slot is one: the earned sentence has to survive to a paint.
+    wv.setNotice(&shared, "[bad host: FlagLikeTarget]");
+    wv.setNoticeIdle(&shared, "[+2 not shown]");
+    try std.testing.expectEqualStrings("[bad host: FlagLikeTarget]", wv.takeNotice(&shared, &buf));
+    // Read, and the standing condition takes the slot it was waiting for.
+    wv.setNoticeIdle(&shared, "[+2 not shown]");
+    try std.testing.expectEqualStrings("[+2 not shown]", wv.takeNotice(&shared, &buf));
+}
+test "endKey: x on a tile that never came up closes the TILE — there is no session to end" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var t = Tile{
+        .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "0" },
+        .rect = .{ .top = 0, .left = 0, .rows = 4, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    t.alive.store(true, .release);
+    // Parked on its first dial: alive, so the old rule stored an ask that
+    // `dial` never reads — no effect and no sentence, and the session ended
+    // under the user if the box ever came back.
+    t.state = .connecting;
+    try std.testing.expectEqual(EndKey.drop, wv.endKey(&t, 0));
+    // Once it has been up, the DAEMON owns the ending, reconnect or not.
+    t.ever_up.store(true, .release);
+    t.state = .reconnecting;
+    try std.testing.expectEqual(EndKey{ .ask = .end }, wv.endKey(&t, 0));
+    t.state = .up;
+    try std.testing.expectEqual(EndKey{ .ask = .end }, wv.endKey(&t, 0));
+    // The armed second press forces; the client never decides that itself.
+    t.end_armed_until.store(1000, .release);
+    try std.testing.expectEqual(EndKey{ .ask = .end_force }, wv.endKey(&t, 999));
+    try std.testing.expectEqual(EndKey{ .ask = .end }, wv.endKey(&t, 1000));
+    // A pump that has ended has nothing to ask over.
+    t.alive.store(false, .release);
+    try std.testing.expectEqual(EndKey.none, wv.endKey(&t, 0));
+}
+test "x on a tile whose daemon refused arms a second press, and the window closes after 3 s" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    defer shared.tree.deinit();
+    var t: Tile = .{
+        .r = .{ .target = .{ .sock = "/tmp/a" }, .label = "--sock /tmp/a", .session = "work" },
+        .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    // A first `x` is never a force: the daemon is the one that knows who
+    // else is attached, so the client asks before it insists.
+    try std.testing.expectEqual(client.SwitchIntent.end, wv.intentForEnd(&t, 1000));
+    wv.onEndReply(&t, .{ .accepted = false, .others = 2, .reason = "others attached" }, 1000);
+    try std.testing.expectEqual(@as(i64, 1000 + wv.end_arm_ms), t.end_armed_until.load(.acquire));
+    try std.testing.expectEqual(client.SwitchIntent.end_force, wv.intentForEnd(&t, 2500));
+    // The window SHUTS. Without this an `x` typed minutes later, on a
+    // session that has picked up watchers since, kills them without asking.
+    try std.testing.expectEqual(client.SwitchIntent.end, wv.intentForEnd(&t, 4001));
+    // An accepted end disarms rather than leaving the window standing: the
+    // reply for the tile that is going must not force the next one.
+    t.end_armed_until.store(9000, .release);
+    wv.onEndReply(&t, .{ .accepted = true, .others = 0, .reason = "" }, 5000);
+    try std.testing.expectEqual(@as(i64, 0), t.end_armed_until.load(.acquire));
+}
+test "n/p walk the wall's tiles: a hole is stepped over, and a wall of one has nowhere to go" {
+    // Three slots with the middle one vanished, because the walk `n` used
+    // to do was one daemon's session ring and the wall is every host's
+    // sessions — a fixture of two adjacent tiles cannot see the hole.
+    const three = [_]bool{ true, false, true };
+    try std.testing.expectEqual(@as(?usize, 2), wv.walkTiles(&three, 0, true));
+    try std.testing.expectEqual(@as(?usize, 0), wv.walkTiles(&three, 2, true));
+    try std.testing.expectEqual(@as(?usize, 2), wv.walkTiles(&three, 0, false));
+    try std.testing.expectEqual(@as(?usize, 0), wv.walkTiles(&three, 2, false));
+    // One tile is its own neighbour, which is not a move: a focus that
+    // "moves" to itself releases the terminal and re-claims it for nothing.
+    const one = [_]bool{ false, true, false };
+    try std.testing.expectEqual(@as(?usize, null), wv.walkTiles(&one, 1, true));
+    try std.testing.expectEqual(@as(?usize, null), wv.walkTiles(&one, 1, false));
+    const none = [_]bool{ false, false };
+    try std.testing.expectEqual(@as(?usize, null), wv.walkTiles(&none, 0, true));
+}
+test "birthTile: no room is null and the tree is left as it was" {
+    const alloc = std.testing.allocator;
+    // Four rows cannot hold two stacked tiles under a bar: `wallFloors`
+    // asks min_session_rows + 1 of each. The leaf count pins the undo —
+    // a birth that refused and kept its insert would leave the tree one
+    // leaf wider than the wall.
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 4 }, .is_tty = false };
+    defer shared.tree.deinit();
+    try shared.tree.addFirst(0);
+    var tiles: [2]Tile = undefined;
+    tiles[0] = .{
+        .r = .{ .target = .{ .sock = "/tmp/a" }, .label = "--sock /tmp/a", .session = "" },
+        .rect = .{ .top = 0, .left = 0, .rows = 4, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    var present = [_]bool{ true, false };
+    var live: usize = 1;
+    const r: Resolved = .{ .target = .{ .sock = "/tmp/b" }, .label = "--sock /tmp/b#b", .session = "b" };
+    try std.testing.expectEqual(@as(?usize, null), wv.birthTile(alloc, &tiles, &present, &live, &shared, .{
+        .r = r,
+        .from = 0,
+        .place = .beside_focus,
+        .creates = true,
+        .born_from = 0,
+    }));
+    try std.testing.expectEqual(@as(usize, 1), live);
+    try std.testing.expect(!present[1]);
+    try std.testing.expectEqual(@as(usize, 1), shared.tree.count());
+}
+test "birthTile: a beside wall admits more panes than rows/3" {
+    const alloc = std.testing.allocator;
+    // Nine panes side by side on 24x200: every one keeps all 24 rows and
+    // 8 rails plus 9 columns of 21 fit inside 200. A rows/n admission test
+    // refuses this at the 9th (24/9 = 2), capping ANY terminal at rows/3
+    // panes however wide it is. The tree owns the answer.
+    const n = 9;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 200, .rows = 24 }, .is_tty = false };
+    defer shared.tree.deinit();
+    try shared.tree.addFirst(0);
+    var tiles: [n]Tile = undefined;
+    var present = [_]bool{false} ** n;
+    var live: usize = 0;
+    var i: u8 = 0;
+    while (i < n - 1) : (i += 1) {
+        if (i > 0) {
+            try shared.tree.insert(i - 1, i);
+            // `insert` wraps a bare root leaf in `.stacked`; a wide
+            // terminal's wall is cut the other way (`rootOrient`).
+            if (i == 1) shared.tree.setRootOrient(.beside);
+        }
+        tiles[i] = .{
+            .r = .{ .target = .{ .sock = "/tmp/a" }, .label = "--sock /tmp/a", .session = "" },
+            .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 21 },
+            .shared = &shared,
+            .idx = i,
+            .wake_r = -1,
+            .wake_w = -1,
+        };
+        present[i] = true;
+        live += 1;
+    }
+    const r: Resolved = .{ .target = .{ .sock = "/tmp/b" }, .label = "--sock /tmp/b#b", .session = "b" };
+    const at = wv.birthTile(alloc, &tiles, &present, &live, &shared, .{
+        .r = r,
+        .from = n - 2,
+        .place = .beside_focus,
+        .creates = true,
+        .born_from = n - 2,
+        // Borrowed, so the tile gets copies of its own: these are literals,
+        // and `Birth.borrowed = false` promises the slot's next reuse two
+        // slices it may free.
+        .borrowed = true,
+    }) orelse return error.TestUnexpectedResult;
+    defer std.posix.close(tiles[at].wake_r);
+    defer std.posix.close(tiles[at].wake_w);
+    defer alloc.free(tiles[at].r.session);
+    defer alloc.free(tiles[at].r.label);
+    try std.testing.expectEqual(@as(usize, n), shared.tree.count());
+    // Admitted AND habitable: every pane keeps the full height and clears
+    // the column floor, which is what makes the refusal wrong.
+    const flat = try shared.tree.flatten(alloc, 24, 200, wall_layout.wallFloors(n), null);
+    defer flat.deinit(alloc);
+    try std.testing.expectEqual(@as(usize, n), flat.placed.len);
+    for (flat.placed) |p| {
+        try std.testing.expectEqual(@as(u16, 24), p.rect.rows);
+        try std.testing.expect(p.rect.cols >= proto.min_session_cols);
+    }
+}
+test "birthTile: a vanished digit is taken back, and not before its pump returned" {
+    const alloc = std.testing.allocator;
+    // Five slots on a wall wide enough for all of them: the claim is which
+    // digit a birth lands on, so no refusal may decide it instead.
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 200, .rows = 24 }, .is_tty = false };
+    defer shared.tree.deinit();
+    try shared.tree.addFirst(0);
+    var tiles: [5]Tile = undefined;
+    var present = [_]bool{ true, false, false, false, false };
+    var live: usize = 1;
+    const target: client.Target = .{ .sock = "/tmp/a" };
+    tiles[0] = .{
+        .r = .{ .target = target, .label = "--sock /tmp/a#0", .session = "0" },
+        .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 200 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    // Every other tile is born the way a host's poll births one, so the
+    // copies a reuse has to free are the real owned ones.
+    defer for (tiles[1..], present[1..]) |*t, p| {
+        if (!p) continue;
+        alloc.free(t.r.session);
+        alloc.free(t.r.label);
+        std.posix.close(t.wake_r);
+        std.posix.close(t.wake_w);
+    };
+    const born = struct {
+        fn at(a: std.mem.Allocator, ts: []Tile, ps: []bool, lv: *usize, sh: *Shared, tg: client.Target, name: []const u8, host: ?usize) ?usize {
+            return wv.birthTile(a, ts, ps, lv, sh, .{
+                .r = .{ .target = tg, .label = "", .session = name },
+                .from = 0,
+                .place = .beside_focus,
+                .creates = true,
+                .born_from = 0,
+                .host = host,
+                .borrowed = true,
+            });
+        }
+    }.at;
+    try std.testing.expectEqual(@as(?usize, 1), born(alloc, &tiles, &present, &live, &shared, target, "1", 3));
+    try std.testing.expectEqual(@as(?usize, 2), born(alloc, &tiles, &present, &live, &shared, target, "2", 3));
+    // The middle tile leaves, carrying a full set of dirt: every one of
+    // these is a field whose stale value would be a lie about the NEXT
+    // tile in the slot — a session that was never up, a list that never
+    // missed it, an `x` nobody pressed, a host that does not own it.
+    tiles[1].ever_up.store(true, .release);
+    tiles[1].missed_once = true;
+    tiles[1].end_armed_until.store(9000, .release);
+    const doorbell = tiles[1].wake_r;
+    wv.vanishTile(&tiles, &present, &shared, 1, null);
+    // Its pump has not returned, so the digit is not free yet: the birth
+    // appends rather than hand a live thread's `*Tile` to a new tile.
+    try std.testing.expectEqual(@as(?usize, 3), born(alloc, &tiles, &present, &live, &shared, target, "3", 3));
+    tiles[1].pump_done.store(true, .release);
+    try std.testing.expectEqual(@as(?usize, 1), born(alloc, &tiles, &present, &live, &shared, target, "1", null));
+    // Reuse, not growth: the wall is four tiles wide, not five.
+    try std.testing.expectEqual(@as(usize, 4), live);
+    try std.testing.expectEqual(@as(usize, 1), tiles[1].idx);
+    try std.testing.expect(!tiles[1].ever_up.load(.acquire));
+    try std.testing.expect(!tiles[1].missed_once);
+    try std.testing.expectEqual(@as(i64, 0), tiles[1].end_armed_until.load(.acquire));
+    try std.testing.expectEqual(@as(?usize, null), tiles[1].host);
+    try std.testing.expect(!tiles[1].pump_done.load(.acquire));
+    // The doorbell is the slot's, not the tile's: a fresh pipe per reuse
+    // would leak the fd pair the old one is never closed on.
+    try std.testing.expectEqual(doorbell, tiles[1].wake_r);
+}
+test "birthTile: the digit's next tile frees the copies an unborrowed birth handed over" {
+    const alloc = std.testing.allocator;
+    // `Birth.borrowed = false` hands the tile two slices outright, and the
+    // birth that takes its digit back is what frees them. The testing
+    // allocator is the whole oracle: a slice it never handed out aborts the
+    // free, and one nobody frees is reported leaked — which is what a
+    // caller passing a literal and a reuse that kept the old copies each
+    // look like.
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 200, .rows = 24 }, .is_tty = false };
+    defer shared.tree.deinit();
+    try shared.tree.addFirst(0);
+    var tiles: [3]Tile = undefined;
+    var present = [_]bool{ true, false, false };
+    var live: usize = 1;
+    const target: client.Target = .{ .sock = "/tmp/a" };
+    tiles[0] = .{
+        .r = .{ .target = target, .label = "--sock /tmp/a#0", .session = "0" },
+        .rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 200 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    // The chord's road, verbatim: the caller allocates, `birthTile` takes
+    // the slices as they are.
+    const handed = struct {
+        fn birth(
+            a: std.mem.Allocator,
+            ts: []Tile,
+            ps: []bool,
+            lv: *usize,
+            sh: *Shared,
+            tg: client.Target,
+            name: []const u8,
+        ) ?usize {
+            const session = a.dupe(u8, name) catch return null;
+            const label = wv.tileLabel(a, tg, session) catch {
+                a.free(session);
+                return null;
+            };
+            return wv.birthTile(a, ts, ps, lv, sh, .{
+                .r = .{ .target = tg, .label = label, .session = session },
+                .from = 0,
+                .place = .beside_focus,
+                .creates = true,
+                .born_from = 0,
+            });
+        }
+    }.birth;
+    const first = handed(alloc, &tiles, &present, &live, &shared, target, "1") orelse
+        return error.TestUnexpectedResult;
+    try std.testing.expectEqual(@as(usize, 1), first);
+    defer if (present[1]) {
+        alloc.free(tiles[1].r.session);
+        alloc.free(tiles[1].r.label);
+        std.posix.close(tiles[1].wake_r);
+        std.posix.close(tiles[1].wake_w);
+    };
+    wv.vanishTile(&tiles, &present, &shared, 1, null);
+    tiles[1].pump_done.store(true, .release);
+    // The same digit, so the free under test is one this birth really did.
+    try std.testing.expectEqual(
+        @as(?usize, 1),
+        handed(alloc, &tiles, &present, &live, &shared, target, "2"),
+    );
+}
+test "labelText: the state word survives truncation at every width" {
+    var buf: [256]u8 = undefined;
+    // A label longer than any bar, so truncation is what is under test and
+    // not the label's own length.
+    const long = "x" ** 400;
+    // The markers are the ones a bar actually carries: three bytes with the
+    // chord digit, four for tiles 10 and up. Every one of them comes out of
+    // the label's cut, so the marker width is part of what this pins — a
+    // two-byte marker exercises no bar that ships.
+    // Narrow: the label is cut, the bar fits the terminal, the state stays.
+    const narrow = wv.labelText(&buf, 30, "1> ", long, "up");
+    if (!std.mem.endsWith(u8, narrow, " [up]")) return error.OneDigitNarrowBarLostTheStateWord;
+    if (narrow.len > 30) return error.OneDigitNarrowBarOverranTheTerminal;
+    // The same width with the widest marker: the two extra bytes come off
+    // the label, never off the state.
+    const narrow2 = wv.labelText(&buf, 30, "12  ", long, "up");
+    if (!std.mem.endsWith(u8, narrow2, " [up]")) return error.TwoDigitNarrowBarLostTheStateWord;
+    if (narrow2.len > 30) return error.TwoDigitNarrowBarOverranTheTerminal;
+    // Wide: `cols` alone would have asked for more than `buf` holds, and the
+    // failed bufPrint used to hand back the buffer's undefined bytes — with
+    // the state word among what was lost.
+    const wide = wv.labelText(&buf, 300, "12> ", long, "reconnecting");
+    if (!std.mem.endsWith(u8, wide, " [reconnecting]")) return error.TwoDigitWideBarLostTheStateWord;
+    if (wide.len > buf.len) return error.TwoDigitWideBarOverranItsBuffer;
+    // Wider than `buf` with the longest status word a bar can carry: the
+    // bound that matters is `buf`'s, and it is not `cols`'.
+    const widest = wv.labelText(&buf, 400, "12  ", long, State.reconnecting.word());
+    if (!std.mem.endsWith(u8, widest, " [reconnecting]")) return error.TwoDigitWidestBarLostTheStateWord;
+    if (widest.len > buf.len) return error.TwoDigitWidestBarOverranItsBuffer;
+}
+test "showsSelf: the wall never tiles the session the walling shell is standing in" {
+    const sock = "/run/user/1000/muxd.sock";
+    const target: client.Target = .{ .sock = sock };
+    // The case: `mux --session 1` typed in session 0's shell. Session 0 is
+    // on the host's own list, and tiling it would paint that session's
+    // stripe into the grid it is reading.
+    try std.testing.expect(wv.showsSelf(target, "0", sock, "0"));
+    // The empty name is the wire's spelling of the default, and the daemon
+    // plants the resolved one.
+    try std.testing.expect(wv.showsSelf(target, "", sock, "0"));
+    try std.testing.expect(wv.showsSelf(target, "work", sock, "work"));
+    // Every other session of the same daemon is exactly what the wall is
+    // for — it must not drop those.
+    try std.testing.expect(!wv.showsSelf(target, "1", sock, "0"));
+    try std.testing.expect(!wv.showsSelf(target, "", sock, "1"));
+    // A different daemon's socket is a different session whatever it is
+    // called.
+    try std.testing.expect(!wv.showsSelf(target, "0", "/run/user/1000/other.sock", "0"));
+    // Not a unix socket: a quic:// or --via target cannot be the daemon
+    // whose shell planted these.
+    try std.testing.expect(!wv.showsSelf(.{ .via = "ssh host muxd proxy" }, "0", sock, "0"));
+    // Unset, and the emptied spelling of unset that the self-attach
+    // refusal names as the way to override it.
+    try std.testing.expect(!wv.showsSelf(target, "0", null, "0"));
+    try std.testing.expect(!wv.showsSelf(target, "0", sock, null));
+    try std.testing.expect(!wv.showsSelf(target, "0", "", "0"));
+    try std.testing.expect(!wv.showsSelf(target, "0", sock, ""));
+}
+test "sendKeys: a chunk that does not fit is dropped whole, and says so" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var t = Tile{
+        .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+        .rect = .{ .top = 0, .left = 0, .rows = 4, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        // -1 both ends: `ring` writes to the doorbell and ignores the
+        // failure, which is exactly what it promises to do.
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    const head = "abc";
+    wv.sendKeys(&t, head);
+    try std.testing.expectEqual(@as(usize, 3), t.in_len);
+    try std.testing.expect(!t.in_dropped.load(.acquire));
+    // One byte more than the room left. The old code copied what fit.
+    const too_big = [_]u8{'z'} ** (wv.mailbox_max - 2);
+    wv.sendKeys(&t, &too_big);
+    try std.testing.expectEqual(@as(usize, 3), t.in_len);
+    try std.testing.expect(t.in_dropped.load(.acquire));
+    // ...and the mailbox still holds exactly what was typed before it, so
+    // the next chunk cannot splice onto a half-delivered one.
+    wv.sendKeys(&t, "def");
+    var out: [wv.mailbox_max]u8 = undefined;
+    try std.testing.expectEqualStrings("abcdef", wall_pump.takeKeys(&t, &out));
+    // Exactly filling it is not overflow — the bound is `>`, not `>=`.
+    const exact = [_]u8{'q'} ** wv.mailbox_max;
+    t.in_dropped.store(false, .release);
+    wv.sendKeys(&t, &exact);
+    try std.testing.expectEqual(@as(usize, wv.mailbox_max), t.in_len);
+    try std.testing.expect(!t.in_dropped.load(.acquire));
+}
+test "labelText: a dropped chunk is narrated beside the state that caused it" {
+    // The bar's own format, asserted through the same truncation path the
+    // states go through, because "reconnecting, input dropped" is now the
+    // longest thing a bar can say and `buf`'s bound is what it tests.
+    var buf: [256]u8 = undefined;
+    const long = "x" ** 400;
+    const said = wv.labelText(&buf, 300, "> ", long, "reconnecting, input dropped");
+    try std.testing.expect(std.mem.endsWith(u8, said, " [reconnecting, input dropped]"));
+    try std.testing.expect(said.len <= buf.len);
+}
+test "noticeText: the banner says what the exit line says, whichever sentence it is" {
+    var buf: [128]u8 = undefined;
+    // Both sentences a vanish can carry. A notice that names a cause the
+    // stderr line contradicts is worse than either alone.
+    try std.testing.expectEqualStrings(
+        "[cannot create a new session (daemon full?)]",
+        wv.noticeText(&buf, "mux: cannot create a new session (daemon full?)"),
+    );
+    try std.testing.expectEqualStrings(
+        "[cannot create a new session (daemon unreachable)]",
+        wv.noticeText(&buf, "mux: cannot create a new session (daemon unreachable)"),
+    );
+    // A sentence that never wore the prefix keeps all of its words.
+    try std.testing.expectEqualStrings("[detached]", wv.noticeText(&buf, "detached"));
+}
+test "endAction: on a terminal the last tile's exit leaves an empty wall, not an exit" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    var tiles: [3]Tile = undefined;
+    const one = [_]bool{ true, false, false };
+    // `x` ends a session, never the program: the wall stays up with the
+    // picker over it, and the machines are still there to birth on. There
+    // is no tile left to hand the focus to, which is what `back` says.
+    fixture.endBench(&tiles, &shared, 0, .exited, 7, null);
+    try std.testing.expectEqual(
+        EndAction{ .vanish = .{ .back = null, .msg = null } },
+        wv.endAction(&tiles, &one, 3, 0, true, true),
+    );
+    // The piped half is unchanged and load-bearing: a wall of one with no
+    // keyboard is what a script runs, and it exits with the shell's code.
+    fixture.endBench(&tiles, &shared, 0, .exited, 7, null);
+    try std.testing.expectEqual(
+        EndAction{ .finish = .{ .code = 7, .msg = null } },
+        wv.endAction(&tiles, &one, 3, 0, true, false),
+    );
+}
+test "endAction: a birth the picker made into a standing wall is refused ON it, not out of mux" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    var tiles: [3]Tile = undefined;
+    const one = [_]bool{ true, false, false };
+    // The headline path: the wall's last session ends, the picker opens
+    // itself, Enter lands on a daemon that is full. There was no anchor to
+    // hand the focus back to, so `born_from` is null — and the ENTRY tile
+    // carries null for the opposite reason, which is why the flag exists.
+    fixture.endBench(&tiles, &shared, 0, .refused, 0, null);
+    tiles[0].keeps_wall = true;
+    try std.testing.expectEqual(
+        EndAction{ .vanish = .{ .back = null, .msg = "mux: cannot create a new session (daemon full?)" } },
+        wv.endAction(&tiles, &one, 3, 0, true, true),
+    );
+    // A box that never answered: the picker advertises `unreachable` rows
+    // as a place to press Enter, so this is a designed path, not a fault.
+    fixture.endBench(&tiles, &shared, 0, .lost, 0, null);
+    tiles[0].keeps_wall = true;
+    try std.testing.expectEqual(
+        EndAction{ .vanish = .{ .back = null, .msg = "mux: cannot create a new session (daemon unreachable)" } },
+        wv.endAction(&tiles, &one, 3, 0, true, true),
+    );
+    // Nothing refused anything here, and the wall still stands.
+    fixture.endBench(&tiles, &shared, 0, .no_thread, 0, null);
+    tiles[0].keeps_wall = true;
+    try std.testing.expectEqual(
+        EndAction{ .vanish = .{ .back = null, .msg = "mux: could not start a thread for this session" } },
+        wv.endAction(&tiles, &one, 3, 0, true, true),
+    );
+    // The entry tile of `mux TARGET` is the wall, and its refusal is mux's:
+    // a script reads the code.
+    fixture.endBench(&tiles, &shared, 0, .refused, 0, null);
+    try std.testing.expectEqual(
+        EndAction{ .finish = .{ .code = 1, .msg = "mux: attach refused or no state received (session full?)" } },
+        wv.endAction(&tiles, &one, 3, 0, true, true),
+    );
+    // ...and a piped `mux` has no wall to leave standing, flag or no flag.
+    fixture.endBench(&tiles, &shared, 0, .refused, 0, null);
+    tiles[0].keeps_wall = true;
+    try std.testing.expectEqual(
+        EndAction{ .finish = .{ .code = 1, .msg = "mux: attach refused or no state received (session full?)" } },
+        wv.endAction(&tiles, &one, 3, 0, true, false),
+    );
+}
+test "endAction: the only tile's ending is mux's, and so is any ending nobody can leave" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var tiles: [3]Tile = undefined;
+    const one = [_]bool{ true, false, false };
+    const two = [_]bool{ true, true, false };
+    // One tile, shell exited: the code is mux's, which is what keeps `mux`
+    // something you can put in a script.
+    fixture.endBench(&tiles, &shared, 0, .exited, 7, null);
+    try std.testing.expectEqual(
+        EndAction{ .finish = .{ .code = 7, .msg = null } },
+        wv.endAction(&tiles, &one, 3, 0, true, false),
+    );
+    // Two tiles: the exit vanishes — a dead stripe for a cleanly exited
+    // shell is noise — and the wall re-cuts onto the survivor.
+    fixture.endBench(&tiles, &shared, 0, .exited, 7, null);
+    try std.testing.expectEqual(
+        EndAction{ .vanish = .{ .back = 1, .msg = null } },
+        wv.endAction(&tiles, &two, 3, 0, true, false),
+    );
+    // ...but not once stdin has closed. A piped `mux` with no keyboard
+    // waits in poll forever with the code in hand — reproduced at RC=124
+    // before this argument existed, which is the whole reason the rule is
+    // stated in one pure function and not at the read that happens to
+    // notice EOF.
+    fixture.endBench(&tiles, &shared, 0, .exited, 7, null);
+    try std.testing.expectEqual(
+        EndAction{ .finish = .{ .code = 7, .msg = null } },
+        wv.endAction(&tiles, &two, 3, 0, false, false),
+    );
+    // A tile the user already forgot is not company: `present`, never the
+    // wall's length, is what "somewhere to go" counts.
+    const one_left = [_]bool{ true, false, false };
+    fixture.endBench(&tiles, &shared, 0, .exited, 3, null);
+    try std.testing.expectEqual(
+        EndAction{ .finish = .{ .code = 3, .msg = null } },
+        wv.endAction(&tiles, &one_left, 3, 0, true, false),
+    );
+}
+test "endAction: a refusal a chord earned goes back where the chord was typed" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var tiles: [3]Tile = undefined;
+    const two = [_]bool{ true, true, false };
+    // The plain client's `.refused` recovery: the daemon would not create
+    // the session, and the chord-born tile leaves with no trace — the
+    // sentence is the record a script reads, the survivor the screen.
+    fixture.endBench(&tiles, &shared, 1, .refused, 1, 0);
+    try std.testing.expectEqual(
+        EndAction{ .vanish = .{ .back = 0, .msg = "mux: cannot create a new session (daemon full?)" } },
+        wv.endAction(&tiles, &two, 3, 1, true, false),
+    );
+    // It outranks the closed stdin, because vanishing lands on a live
+    // SESSION rather than on nothing: whatever ends that one ends the run.
+    fixture.endBench(&tiles, &shared, 1, .refused, 1, 0);
+    try std.testing.expectEqual(
+        EndAction{ .vanish = .{ .back = 0, .msg = "mux: cannot create a new session (daemon full?)" } },
+        wv.endAction(&tiles, &two, 3, 1, false, false),
+    );
+    // A daemon that never answered is not a daemon that answered and said
+    // no. `x` on the last LOCAL session ends the local daemon, so a wall
+    // whose own machine has gone is exactly how this arrives — and "full?"
+    // would send the user hunting for sessions that are not there.
+    fixture.endBench(&tiles, &shared, 1, .lost, 1, 0);
+    try std.testing.expectEqual(
+        EndAction{ .vanish = .{ .back = 0, .msg = "mux: cannot create a new session (daemon unreachable)" } },
+        wv.endAction(&tiles, &two, 3, 1, true, false),
+    );
+    // ...but a chord-born tile that HAD its session and lost the link later
+    // is not a failed creation at all: it keeps its rect and narrates, like
+    // any other lost tile.
+    fixture.endBench(&tiles, &shared, 1, .lost, 1, 0);
+    tiles[1].ever_up.store(true, .release);
+    try std.testing.expectEqual(
+        EndAction{ .refocus = 0 },
+        wv.endAction(&tiles, &two, 3, 1, true, false),
+    );
+    // A refusal with nowhere to fall back to is an ending like any other,
+    // and says the thing the plain client said.
+    fixture.endBench(&tiles, &shared, 0, .refused, 1, null);
+    const one = [_]bool{ true, false, false };
+    const out = wv.endAction(&tiles, &one, 3, 0, true, false);
+    try std.testing.expectEqual(@as(u8, 1), out.finish.code);
+    try std.testing.expectEqualStrings(
+        "mux: attach refused or no state received (session full?)",
+        out.finish.msg.?,
+    );
+    // ...and so is one whose fall-back tile the user forgot meanwhile.
+    fixture.endBench(&tiles, &shared, 1, .refused, 1, 0);
+    const gone_back = [_]bool{ false, true, false };
+    try std.testing.expectEqual(
+        @as(u8, 1),
+        wv.endAction(&tiles, &gone_back, 3, 1, true, false).finish.code,
+    );
+}
+test "endAction: an exited session's tile vanishes; a lost one narrates" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var tiles: [3]Tile = undefined;
+    const two = [_]bool{ true, true, false };
+    // A clean exit is noise once it is over: the tile leaves, the wall
+    // re-cuts, and nothing is said.
+    fixture.endBench(&tiles, &shared, 0, .exited, 7, null);
+    try std.testing.expectEqual(
+        EndAction{ .vanish = .{ .back = 1, .msg = null } },
+        wv.endAction(&tiles, &two, 3, 0, true, false),
+    );
+    // A lost link can heal: the tile keeps its rect and its bar, and the
+    // focus steps to the next present tile rather than the tile leaving.
+    fixture.endBench(&tiles, &shared, 0, .lost, 1, null);
+    try std.testing.expectEqual(
+        EndAction{ .refocus = 1 },
+        wv.endAction(&tiles, &two, 3, 0, true, false),
+    );
+    // The last present tile exiting is still mux's own ending, with the
+    // shell's code — `mux` in a script is the thing that ran the shell.
+    fixture.endBench(&tiles, &shared, 0, .exited, 3, null);
+    const one = [_]bool{ true, false, false };
+    try std.testing.expectEqual(
+        EndAction{ .finish = .{ .code = 3, .msg = null } },
+        wv.endAction(&tiles, &one, 3, 0, true, false),
+    );
+}
+test "endAction: a vanishing tile hands focus to a live neighbour, not a corpse" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var tiles: [3]Tile = undefined;
+    const two = [_]bool{ true, true, false };
+    // Tile 0 (focused) has just exited — its pump is dead. Tile 1 is
+    // present but dead (pump ended, narrating a lost link). With no live
+    // neighbour, the back-target falls back to the dead tile (the wall
+    // still shows it), but with a live third tile, focus lands there.
+    fixture.endBench(&tiles, &shared, 0, .exited, 7, null);
+    tiles[0].alive.store(false, .release);
+    tiles[1].alive.store(false, .release);
+    tiles[1].end.store(@intFromEnum(EndReason.lost), .release);
+    tiles[1].end_seen = true;
+    // Two tiles, both dead: fallback to the present-only step.
+    const out_dead = wv.endAction(&tiles, &two, 3, 0, true, false);
+    try std.testing.expect(out_dead == .vanish);
+    try std.testing.expectEqual(@as(usize, 1), out_dead.vanish.back);
+    // Three tiles: 0 dead ending, 1 dead narrating, 2 alive. Focus must
+    // land on tile 2, the live neighbour — never the dead tile 1.
+    const three = [_]bool{ true, true, true };
+    fixture.endBench(&tiles, &shared, 0, .exited, 7, null);
+    tiles[0].alive.store(false, .release);
+    tiles[1].alive.store(false, .release);
+    tiles[1].end.store(@intFromEnum(EndReason.lost), .release);
+    tiles[1].end_seen = true;
+    const out_live = wv.endAction(&tiles, &three, 3, 0, true, false);
+    try std.testing.expect(out_live == .vanish);
+    try std.testing.expectEqual(@as(usize, 2), out_live.vanish.back);
+}
+test "closeNotice: a sentence the popup left behind is given a tile to land on" {
+    const alloc = std.testing.allocator;
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    const tiles = try alloc.alloc(Tile, 2);
+    defer alloc.free(tiles);
+    fixture.noticeBench(&shared, tiles);
+    const present = [_]bool{ true, true };
+    // Focus on tile 1, and the forgotten host owned NEITHER tile: the focus
+    // does not move on its own here, which is the whole of the finding.
+    shared.sel = 1;
+    wv.setNotice(&shared, "[hosts file not updated: read-only file system]");
+    wv.closeNotice(tiles, &present, &shared);
+    // Armed, not merely rung: a pump paints the notice on a CLAIM, and a
+    // doorbell alone gives it nothing to claim for.
+    if (!tiles[1].claim_pending.load(.acquire)) return error.NoticeHasNoClaimToRideOn;
+    // Still there for the pump to take on that claim, whole: a keyboard
+    // that consumed it here would paint nothing and lose the sentence.
+    var buf: [96]u8 = undefined;
+    try std.testing.expectEqualStrings(
+        "[hosts file not updated: read-only file system]",
+        wv.takeNotice(&shared, &buf),
+    );
+    // The control: with nothing to say, the close is the bare retry it was,
+    // and no tile is handed a claim it did not earn.
+    fixture.noticeBench(&shared, tiles);
+    wv.closeNotice(tiles, &present, &shared);
+    try std.testing.expect(!tiles[1].claim_pending.load(.acquire));
+}
+test "bare keys reach the focused tile; the prefix does not" {
+    var f: interact.PrefixFilter = .{};
+    // Bare keys are forwarded to the focused tile.
+    var keys: [3]u8 = .{ 'a', 'b', 'c' };
+    const a = f.feed(&keys);
+    try std.testing.expectEqualStrings("abc", a.forward);
+    try std.testing.expectEqual(interact.PrefixFilter.Action.none, a.action);
+    // A chord consumes its key and produces no forward bytes.
+    var chord: [2]u8 = .{ 0x1c, 'n' };
+    const b = f.feed(&chord);
+    try std.testing.expectEqual(@as(usize, 0), b.forward.len);
+    try std.testing.expectEqual(interact.PrefixFilter.Action.next_session, b.action);
+}
+test "focus follows a click: rectHit picks the tile under a row and column" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    shared.label_rows = 1;
+    var tiles: [2]Tile = undefined;
+    tiles[0] = Tile{
+        .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+        .rect = .{ .top = 0, .left = 0, .rows = 12, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    tiles[1] = Tile{
+        .r = .{ .target = .{ .sock = "/tmp/y" }, .label = "y", .session = "" },
+        .rect = .{ .top = 12, .left = 0, .rows = 12, .cols = 80 },
+        .shared = &shared,
+        .idx = 1,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    const present = [_]bool{ true, true };
+    // A click in row 3 hits tile 0.
+    try std.testing.expectEqual(@as(?usize, 0), wv.rectHit(&tiles, &present, &shared, 3, 0));
+    // A click in row 15 hits tile 1.
+    try std.testing.expectEqual(@as(?usize, 1), wv.rectHit(&tiles, &present, &shared, 15, 0));
+    // A beside pair: same rows, different columns. A click in the left
+    // half hits tile 0, the right half hits tile 1, and a rail column
+    // between them hits neither.
+    tiles[0].rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 39 };
+    tiles[1].rect = .{ .top = 0, .left = 41, .rows = 24, .cols = 39 };
+    try std.testing.expectEqual(@as(?usize, 0), wv.rectHit(&tiles, &present, &shared, 5, 10));
+    try std.testing.expectEqual(@as(?usize, 1), wv.rectHit(&tiles, &present, &shared, 5, 50));
+    try std.testing.expectEqual(@as(?usize, null), wv.rectHit(&tiles, &present, &shared, 5, 40));
+}
+test "setFocus writes the outgoing tile's release before the store that lets the next pump claim" {
+    // The keyboard thread's half of the terminal handover, and the order is
+    // load-bearing: two pumps are two threads, and A's release and B's claim
+    // race if the release is not on the wire first. The outgoing pump writes
+    // nothing (already_written), so if this stops emitting, nothing does —
+    // and the wall reports clicks into whatever shell the user lands in.
+    // is_tty is true because this leg is about what a focus move WRITES, and
+    // the gate that suppresses those writes on a pipe is exactly what it
+    // must not be testing.
+    const p = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(p[0]);
+    defer std.posix.close(p[1]);
+    var shared = Shared{ .out_fd = p[1], .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    var tiles: [2]Tile = undefined;
+    tiles[0] = Tile{
+        .r = .{ .target = .{ .sock = "/s" }, .label = "a", .session = "a" },
+        .rect = .{ .top = 0, .left = 0, .rows = 12, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    tiles[1] = Tile{
+        .r = .{ .target = .{ .sock = "/s" }, .label = "b", .session = "b" },
+        .rect = .{ .top = 12, .left = 0, .rows = 12, .cols = 80 },
+        .shared = &shared,
+        .idx = 1,
+        .wake_r = -1,
+        // The claim doorbell lands on the SAME pipe as the release: the
+        // write order on one fd is the only order a test can read, and the
+        // release must come first.
+        .wake_w = p[1],
+    };
+    shared.sel = 0;
+    var buf: [512]u8 = undefined;
+    // A move to the SAME tile has no outgoing session to take off, so it
+    // writes no release — a release here would unset modes the user's own
+    // terminal may have arrived with.
+    wv.setFocus(&tiles, &shared, 0);
+    try std.testing.expect(std.mem.indexOf(u8, fixture.readAvail(p[0], &buf), interact.session_release) == null);
+    // A -> B: the release is written under paint_mu, before sel is stored
+    // and before B is doorbelled to claim. On the one pipe both share that
+    // shows up as the release preceding the claim's wake byte.
+    wv.setFocus(&tiles, &shared, 1);
+    const out = fixture.readAvail(p[0], &buf);
+    const rel = std.mem.indexOf(u8, out, interact.session_release) orelse
+        return error.NoReleaseOnFocusMove;
+    const bell = std.mem.indexOfScalar(u8, out, 0) orelse
+        return error.NoClaimDoorbell;
+    try std.testing.expect(rel < bell);
+    // The outgoing pump is told to release, the incoming one to claim.
+    try std.testing.expect(tiles[0].release_pending.load(.acquire));
+    try std.testing.expect(tiles[1].claim_pending.load(.acquire));
+    try std.testing.expectEqual(@as(usize, 1), shared.sel);
+}
+test "a focus move drops what the wall's input filters are holding" {
+    // The input-filter state that mattered — the drag — moved off the
+    // wall's keyboard loop and onto each tile's Core. setFocus drops it the
+    // same way relayout does: a repaint_gen bump every pump clears its
+    // core.drag on. The wall-level prefix is deliberately KEPT, because a
+    // chord is a wall command now and not a tile's; what stopped existing on
+    // a focus move is the screen the drag was drawn on, not a half-typed
+    // chord about it.
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    var tiles: [2]Tile = undefined;
+    tiles[0] = Tile{
+        .r = .{ .target = .{ .sock = "/s" }, .label = "a", .session = "a" },
+        .rect = .{ .top = 0, .left = 0, .rows = 12, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    tiles[1] = Tile{
+        .r = .{ .target = .{ .sock = "/s" }, .label = "b", .session = "b" },
+        .rect = .{ .top = 12, .left = 0, .rows = 12, .cols = 80 },
+        .shared = &shared,
+        .idx = 1,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    shared.sel = 0;
+    const before = shared.repaint_gen.load(.acquire);
+    wv.setFocus(&tiles, &shared, 1);
+    try std.testing.expect(shared.repaint_gen.load(.acquire) > before);
+}
+test "setFocus: the marker moves between two tiles with no pump to move it" {
+    // A refused attach and an exited session both leave a tile
+    // whose pump has ended: repaint_gen and the doorbell reach nobody, so
+    // the bar keeps whatever marker it was born with. Two of them and
+    // Ctrl-\ 1 / Ctrl-\ 2 change nothing on screen; one of them beside a
+    // live tile shows two `>`. The keyboard is the only thread left that
+    // can paint these, which is what this pins.
+    const p = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(p[0]);
+    defer std.posix.close(p[1]);
+    var shared = Shared{ .out_fd = p[1], .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    shared.label_rows = 1; // two tiles draw a bar
+    var tiles: [3]Tile = undefined;
+    tiles[0] = Tile{
+        .r = .{ .target = .{ .sock = "/s" }, .label = "one", .session = "a" },
+        .rect = .{ .top = 0, .left = 0, .rows = 12, .cols = 80 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+        .state = .refused,
+        .alive = std.atomic.Value(bool).init(false),
+    };
+    tiles[1] = Tile{
+        .r = .{ .target = .{ .sock = "/s" }, .label = "two", .session = "b" },
+        .rect = .{ .top = 12, .left = 0, .rows = 12, .cols = 80 },
+        .shared = &shared,
+        .idx = 1,
+        .wake_r = -1,
+        .wake_w = -1,
+        .state = .refused,
+        .alive = std.atomic.Value(bool).init(false),
+    };
+    // Forgotten, not merely dead: `x` clears `present` and sets `gone`
+    // together, and a bar painted into a rect the layout no longer owns
+    // writes over a neighbour.
+    tiles[2] = Tile{
+        .r = .{ .target = .{ .sock = "/s" }, .label = "ghost", .session = "c" },
+        .rect = .{ .top = 0, .left = 0, .rows = 12, .cols = 80 },
+        .shared = &shared,
+        .idx = 2,
+        .wake_r = -1,
+        .wake_w = -1,
+        .state = .exited,
+        .alive = std.atomic.Value(bool).init(false),
+        .gone = std.atomic.Value(bool).init(true),
+    };
+    shared.sel = 0;
+    wv.setFocus(&tiles, &shared, 1);
+    var buf: [2048]u8 = undefined;
+    const out = fixture.readAvail(p[0], &buf);
+    // The bar is one contiguous write (`paintLabelLocked`), so the cursor
+    // move and the marker are adjacent bytes: matching them together is
+    // what says the marker landed in THIS tile's bar and not a neighbour's.
+    if (std.mem.indexOf(u8, out, "\x1b[13;1H\x1b[7m 2> two") == null)
+        return error.DeadTileNeverGainsTheMarker;
+    if (std.mem.indexOf(u8, out, "\x1b[1;1H\x1b[7m 1  one") == null)
+        return error.DeadTileNeverDropsTheMarker;
+    if (std.mem.indexOf(u8, out, "ghost") != null)
+        return error.ForgottenTilePaintedItsBar;
+}
+test "the bar's digit is the tile's chord: idx + 1, and a two-digit tile still says where it is" {
+    // Ctrl-\ 1-9 focuses by POSITION (tiles[idx - 1]) while the bar named the
+    // session (#0, #2...): two series that stop lining up the moment a tile is
+    // forgotten or a session dies. The digit on the bar is the chord's, so the
+    // two cannot diverge.
+    const p = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(p[0]);
+    defer std.posix.close(p[1]);
+    var shared = Shared{ .out_fd = p[1], .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    shared.label_rows = 1;
+    shared.sel = 0;
+    var tiles: [3]Tile = undefined;
+    const labels = [_][]const u8{ "one", "two", "twelve" };
+    // idx 11 with no tiles 3..10: the digit is the tile's own idx, never a
+    // count of what is on screen. Past 9 the chord cannot reach it, but the
+    // number still says where it sits — the chord's reach is the chord's
+    // limit, not the bar's.
+    const idxs = [_]usize{ 0, 1, 11 };
+    for (&tiles, labels, idxs, 0..) |*t, label, idx, row| {
+        t.* = Tile{
+            .r = .{ .target = .{ .sock = "/s" }, .label = label, .session = "a" },
+            .rect = .{ .top = @intCast(row * 8), .left = 0, .rows = 8, .cols = 80 },
+            .shared = &shared,
+            .idx = idx,
+            .wake_r = -1,
+            .wake_w = -1,
+            .state = .up,
+            .alive = std.atomic.Value(bool).init(false),
+        };
+        wv.paintLabelLocked(t);
+    }
+    var buf: [2048]u8 = undefined;
+    const out = fixture.readAvail(p[0], &buf);
+    // Cursor move and marker together, as in the setFocus pin: that is what
+    // says the digit landed in THIS tile's bar and not a neighbour's.
+    if (std.mem.indexOf(u8, out, "\x1b[1;1H\x1b[7m 1> one") == null)
+        return error.FocusedBarLostItsChordDigit;
+    if (std.mem.indexOf(u8, out, "\x1b[9;1H\x1b[7m 2  two") == null)
+        return error.UnfocusedBarLostItsChordDigit;
+    if (std.mem.indexOf(u8, out, "\x1b[17;1H\x1b[7m 12  twelve") == null)
+        return error.TwoDigitTileLostItsNumber;
+}
+test "a vanished tile is stepped over" {
+    // A tile's end and a poll that no longer lists its session both refocus
+    // through stepPresent, and a click's rectHit and the Ctrl-\ l and 1-9
+    // chords check the same present array a vanish clears. Tiles are never
+    // compacted — pumps hold pointers into the array — so a vanished tile is
+    // a hole focus steps over, not a gap it fills. gone and present clear
+    // together in `vanishTile`, so stepping on present is stepping past
+    // gone.
+    const mid = [_]bool{ true, false, true };
+    try std.testing.expectEqual(@as(?usize, 2), wv.stepPresent(&mid, 0, true));
+    try std.testing.expectEqual(@as(?usize, 0), wv.stepPresent(&mid, 2, true));
+    try std.testing.expectEqual(@as(?usize, 0), wv.stepPresent(&mid, 2, false));
+    try std.testing.expectEqual(@as(?usize, 2), wv.stepPresent(&mid, 0, false));
+    // Standing on the hole (the moment after x, before the selection has
+    // moved) still steps to a real tile.
+    try std.testing.expectEqual(@as(?usize, 2), wv.stepPresent(&mid, 1, true));
+    try std.testing.expectEqual(@as(?usize, 0), wv.stepPresent(&mid, 1, false));
+    // The last tile gone: nothing is a selection any more, and every
+    // motion says so rather than picking a tile that is gone.
+    const none = [_]bool{ false, false };
+    try std.testing.expectEqual(@as(?usize, null), wv.stepPresent(&none, 0, true));
+    try std.testing.expectEqual(@as(?usize, null), wv.stepPresent(&none, 0, false));
+    // One survivor is its own answer, exactly as a one-tile wall is.
+    const one = [_]bool{ false, true, false };
+    try std.testing.expectEqual(@as(?usize, 1), wv.stepPresent(&one, 1, true));
+    try std.testing.expectEqual(@as(?usize, 1), wv.stepPresent(&one, 0, false));
+}
+test "tileBanner: a prompt wider than its pane shows the tail inside the pane" {
+    // A tile that painted a whole long spelling would run across the rail
+    // into its neighbour, so the banner is bounded by the tile's rect and
+    // not by the terminal. The tail is what is kept: the cursor end of the
+    // line the user is still typing.
+    const pipe = try std.posix.pipe();
+    defer std.posix.close(pipe[0]);
+    var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
+    shared.label_rows = 1;
+    var t = Tile{
+        .r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
+        .rect = .{ .top = 2, .left = 5, .rows = 5, .cols = 10 },
+        .shared = &shared,
+        .idx = 0,
+        .wake_r = -1,
+        .wake_w = -1,
+    };
+    const text = ": --sock /tmp/very/long/paths_";
+    try std.testing.expectEqual(@as(usize, 30), text.len);
+    wv.tileBanner(&t, text);
+    std.posix.close(pipe[1]);
+    var out: [256]u8 = undefined;
+    const n = try std.posix.read(pipe[0], &out);
+    const got = out[0..n];
+    // The tile's own corner: rect.top + label_rows + 1, rect.left + 1.
+    try std.testing.expect(std.mem.indexOf(u8, got, "\x1b[4;6H") != null);
+    const from = std.mem.indexOf(u8, got, "\x1b[7m").? + 4;
+    const to = std.mem.indexOf(u8, got, "\x1b[0m").?;
+    try std.testing.expectEqualStrings(text[text.len - 10 ..], got[from..to]);
+}

src/tui/wallview.zig

Old		New
@@ -40,15 +40,9 @@ const wall_host = @import("wall_host.zig");
40	const wall_layout = @import("wall_layout.zig");	40	const wall_layout = @import("wall_layout.zig");
41	const wall_picker = @import("wall_picker.zig");	41	const wall_picker = @import("wall_picker.zig");
42	const wall_pump = @import("wall_pump.zig");	42	const wall_pump = @import("wall_pump.zig");
43	const AddHost = wall_host.AddHost;
44	const AgentLocal = wall_pump.AgentLocal;
45	const BirthNames = wall_host.BirthNames;
46	const ClaimStep = wall_pump.ClaimStep;
47	const Host = wall_host.Host;	43	const Host = wall_host.Host;
48	const PickerAuto = wall_picker.PickerAuto;	44	const PickerAuto = wall_picker.PickerAuto;
49	const PickerBody = wall_picker.PickerBody;
50	const Resolved = wall_host.Resolved;	45	const Resolved = wall_host.Resolved;
51	const TileIdxs = wall_host.TileIdxs;
52		46
53	// `wallview` is this module's face: mux_main reaches these through	47	// `wallview` is this module's face: mux_main reaches these through
54	// the root, wherever inside the module they now live.	48	// the root, wherever inside the module they now live.
@@ -398,7 +392,7 @@ pub const Tile = struct {
398	/// the column is what separates them; a click on a rail column hits no	392	/// the column is what separates them; a click on a rail column hits no
399	/// tile and focus stays put. Under `paint_mu` because `Tile.rect` is	393	/// tile and focus stays put. Under `paint_mu` because `Tile.rect` is
400	/// written under it.	394	/// written under it.
401	fn rectHit(tiles: []Tile, present: []const bool, shared: *Shared, row: u16, col: u16) ?usize {	395	pub fn rectHit(tiles: []Tile, present: []const bool, shared: *Shared, row: u16, col: u16) ?usize {
402	shared.paint_mu.lock();	396	shared.paint_mu.lock();
403	defer shared.paint_mu.unlock();	397	defer shared.paint_mu.unlock();
404	for (tiles, present) \|*t, p\| {	398	for (tiles, present) \|*t, p\| {
@@ -432,10 +426,10 @@ pub fn stepPresent(present: []const bool, sel: usize, forward: bool) ?usize {
432	/// How long a refusal leaves the second `x` armed. Long enough to read the	426	/// How long a refusal leaves the second `x` armed. Long enough to read the
433	/// count and decide, short enough that the decision is about the session on	427	/// count and decide, short enough that the decision is about the session on
434	/// the screen and not one the user has since walked away from.	428	/// the screen and not one the user has since walked away from.
435	const end_arm_ms: i64 = 3000;	429	pub const end_arm_ms: i64 = 3000;
436		430
437	/// What `Ctrl-\ x` has to act on.	431	/// What `Ctrl-\ x` has to act on.
438	const EndKey = union(enum) {	432	pub const EndKey = union(enum) {
439	/// The daemon owns the two-step; the pump carries this.	433	/// The daemon owns the two-step; the pump carries this.
440	ask: client.SwitchIntent,	434	ask: client.SwitchIntent,
441	/// No session yet: the TILE goes, locally.	435	/// No session yet: the TILE goes, locally.
@@ -445,7 +439,7 @@ const EndKey = union(enum) {
445	};	439	};
446		440
447	/// Whether `Ctrl-\ x` has anything to ask, and what.	441	/// Whether `Ctrl-\ x` has anything to ask, and what.
448	fn endKey(t: *Tile, now: i64) EndKey {	442	pub fn endKey(t: *Tile, now: i64) EndKey {
449	// A pump that has ended is the only thread that would ever swap `ask`	443	// A pump that has ended is the only thread that would ever swap `ask`
450	// out again, so an ask stored on one goes nowhere for the wall's life.	444	// out again, so an ask stored on one goes nowhere for the wall's life.
451	if (!t.alive.load(.acquire)) return .none;	445	if (!t.alive.load(.acquire)) return .none;
@@ -459,7 +453,7 @@ fn endKey(t: *Tile, now: i64) EndKey {
459	}	453	}
460		454
461	/// Which `x` this is.	455	/// Which `x` this is.
462	fn intentForEnd(t: *const Tile, now: i64) client.SwitchIntent {	456	pub fn intentForEnd(t: *const Tile, now: i64) client.SwitchIntent {
463	// The client never DECIDES to force: the daemon is the only side that	457	// The client never DECIDES to force: the daemon is the only side that
464	// knows who else is attached, so this only remembers being told to ask	458	// knows who else is attached, so this only remembers being told to ask
465	// twice.	459	// twice.
@@ -472,7 +466,7 @@ pub fn onEndReply(t: *Tile, r: proto.EndReply, now: i64) void {
472	}	466	}
473		467
474	/// `n`/`p`: the next TILE, or null when there is nowhere to go.	468	/// `n`/`p`: the next TILE, or null when there is nowhere to go.
475	fn walkTiles(present: []const bool, sel: usize, forward: bool) ?usize {	469	pub fn walkTiles(present: []const bool, sel: usize, forward: bool) ?usize {
476	// Over `present`, which is what the eyes are looking at: the wall is	470	// Over `present`, which is what the eyes are looking at: the wall is
477	// every host's sessions, and the daemon's session ring was only ever	471	// every host's sessions, and the daemon's session ring was only ever
478	// the local host's slice of it.	472	// the local host's slice of it.
@@ -533,7 +527,7 @@ pub fn labelText(
533	/// shared state, and this is also what writes the bytes out. Only called	527	/// shared state, and this is also what writes the bytes out. Only called
534	/// when `label_rows` is nonzero: a one-tile wall owns every row and has no	528	/// when `label_rows` is nonzero: a one-tile wall owns every row and has no
535	/// bar to draw.	529	/// bar to draw.
536	fn paintLabelLocked(t: *Tile) void {	530	pub fn paintLabelLocked(t: *Tile) void {
537	if (t.shared.picker_open.load(.acquire)) return;	531	if (t.shared.picker_open.load(.acquire)) return;
538	// ASCII, not an arrow glyph: this bar is byte-truncated, greppable in	532	// ASCII, not an arrow glyph: this bar is byte-truncated, greppable in
539	// a capture, and must not depend on a font. The unfocused marker is	533	// a capture, and must not depend on a font. The unfocused marker is
@@ -682,7 +676,7 @@ pub fn takeNotice(shared: *Shared, out: []u8) []const u8 {
682	///	676	///
683	/// A chunk that does not fit is dropped WHOLE: copying what fits splices two	677	/// A chunk that does not fit is dropped WHOLE: copying what fits splices two
684	/// reads into a command nobody typed; blocking wedges the wall.	678	/// reads into a command nobody typed; blocking wedges the wall.
685	fn sendKeys(t: *Tile, keys: []const u8) void {	679	pub fn sendKeys(t: *Tile, keys: []const u8) void {
686	{	680	{
687	t.in_mu.lock();	681	t.in_mu.lock();
688	defer t.in_mu.unlock();	682	defer t.in_mu.unlock();
@@ -745,7 +739,7 @@ pub fn setFocus(tiles: []Tile, shared: *Shared, next: usize) void {
745		739
746	/// Re-cut before the move: `setFocus` releases the outgoing session	740	/// Re-cut before the move: `setFocus` releases the outgoing session
747	/// and needs the true previous focus.	741	/// and needs the true previous focus.
748	fn focusAnswer(	742	pub fn focusAnswer(
749	alloc: std.mem.Allocator,	743	alloc: std.mem.Allocator,
750	tiles: []Tile,	744	tiles: []Tile,
751	present: []const bool,	745	present: []const bool,
@@ -761,7 +755,7 @@ fn focusAnswer(
761		755
762	/// TAKEN, not read: an empty wall has no pump to paint a notice as a	756	/// TAKEN, not read: an empty wall has no pump to paint a notice as a
763	/// banner, and every relayout would repaint a sentence left on this line.	757	/// banner, and every relayout would repaint a sentence left on this line.
764	fn emptyWallHint(shared: *Shared) []const u8 {	758	pub fn emptyWallHint(shared: *Shared) []const u8 {
765	if (shared.notice_len == 0) return "Ctrl-\\ s to pick a host - Ctrl-\\ d to leave";	759	if (shared.notice_len == 0) return "Ctrl-\\ s to pick a host - Ctrl-\\ d to leave";
766	const said = shared.notice[0..shared.notice_len];	760	const said = shared.notice[0..shared.notice_len];
767	shared.notice_len = 0;	761	shared.notice_len = 0;
@@ -1142,7 +1136,7 @@ fn showRefusal(tiles: []Tile, shared: *Shared, z: usize) void {
1142	/// What the closing picker owes the wall it hands back: the retry for a	1136	/// What the closing picker owes the wall it hands back: the retry for a
1143	/// claim the popup refused, and — when the popup left a sentence behind —	1137	/// claim the popup refused, and — when the popup left a sentence behind —
1144	/// the focus move that is the only thing which makes a pump take it.	1138	/// the focus move that is the only thing which makes a pump take it.
1145	fn closeNotice(tiles: []Tile, present: []const bool, shared: *Shared) void {	1139	pub fn closeNotice(tiles: []Tile, present: []const bool, shared: *Shared) void {
1146	const z = shared.sel;	1140	const z = shared.sel;
1147	if (z >= tiles.len or !present[z]) return;	1141	if (z >= tiles.len or !present[z]) return;
1148	shared.paint_mu.lock();	1142	shared.paint_mu.lock();
@@ -1191,7 +1185,7 @@ pub fn tileLabel(alloc: std.mem.Allocator, target: client.Target, name: []const
1191	/// What a pump's ending means for the wall. Only the last present tile	1185	/// What a pump's ending means for the wall. Only the last present tile
1192	/// ending can end the program: a tile that goes quiet while others remain	1186	/// ending can end the program: a tile that goes quiet while others remain
1193	/// narrates itself and the wall goes on, which is what the dead-tile paint is for.	1187	/// narrates itself and the wall goes on, which is what the dead-tile paint is for.
1194	const EndAction = union(enum) {	1188	pub const EndAction = union(enum) {
1195	/// The wall has other tiles: the focus moves to the next present one.	1189	/// The wall has other tiles: the focus moves to the next present one.
1196	/// Its label already says what became of the ended tile.	1190	/// Its label already says what became of the ended tile.
1197	refocus: usize,	1191	refocus: usize,
@@ -1205,14 +1199,14 @@ const EndAction = union(enum) {
1205		1199
1206	/// One sentence in both places it is said: on stderr as `mux: ...`, and in	1200	/// One sentence in both places it is said: on stderr as `mux: ...`, and in
1207	/// the brackets a banner wears.	1201	/// the brackets a banner wears.
1208	fn noticeText(buf: *[128]u8, msg: []const u8) []const u8 {	1202	pub fn noticeText(buf: *[128]u8, msg: []const u8) []const u8 {
1209	const prefix = "mux: ";	1203	const prefix = "mux: ";
1210	const bare = if (std.mem.startsWith(u8, msg, prefix)) msg[prefix.len..] else msg;	1204	const bare = if (std.mem.startsWith(u8, msg, prefix)) msg[prefix.len..] else msg;
1211	return std.fmt.bufPrint(buf, "[{s}]", .{bare}) catch bare;	1205	return std.fmt.bufPrint(buf, "[{s}]", .{bare}) catch bare;
1212	}	1206	}
1213		1207
1214	/// Closed `stdin` ends mux: a wall nobody types at is nowhere to leave a user.	1208	/// Closed `stdin` ends mux: a wall nobody types at is nowhere to leave a user.
1215	fn endAction(	1209	pub fn endAction(
1216	tiles: []Tile,	1210	tiles: []Tile,
1217	present: []const bool,	1211	present: []const bool,
1218	live: usize,	1212	live: usize,
@@ -1346,7 +1340,7 @@ fn awaitingSession(t: *Tile) ?State {
1346	/// `mux` typed straight after a `Ctrl-\ d` would otherwise race its own	1340	/// `mux` typed straight after a `Ctrl-\ d` would otherwise race its own
1347	/// corpse for the session. Bounded so a wedged pump cannot hold the terminal	1341	/// corpse for the session. Bounded so a wedged pump cannot hold the terminal
1348	/// hostage; the process exit closes the socket either way.	1342	/// hostage; the process exit closes the socket either way.
1349	fn awaitDetach(t: Tile, shared: Shared) void {	1343	pub fn awaitDetach(t: Tile, shared: Shared) void {
1350	// The pump is the only thread that sets `detach_ack`, so one that has	1344	// The pump is the only thread that sets `detach_ack`, so one that has
1351	// already returned can only run the wait out: 400ms of a wall that has	1345	// already returned can only run the wait out: 400ms of a wall that has
1352	// said goodbye.	1346	// said goodbye.
@@ -2244,3925 +2238,13 @@ pub fn run(alloc: std.mem.Allocator, host_specs: []const HostSpec, entry: Entry)
2244	std.posix.exit(exit_code);	2238	std.posix.exit(exit_code);
2245	}	2239	}
2246		2240
2247	test "the tree's stacked cut splits rows with the remainder at the top" {	2241	// Reaching a file is what registers its tests; build.zig gates
2248	const alloc = std.testing.allocator;	2242	// the list.
2249	var tree = layout.Tree.init(alloc);	2243	test {
2250	defer tree.deinit();	2244	_ = @import("wall_test_harness.zig");
2251	try tree.addFirst(0);	2245	_ = @import("wall_test_host.zig");
2252	try tree.insert(0, 1);	2246	_ = @import("wall_test_layout.zig");
2253	try tree.insert(1, 2);	2247	_ = @import("wall_test_picker.zig");
2254	var f = try tree.flatten(alloc, 25, 80, wall_layout.wallFloors(3), null);	2248	_ = @import("wall_test_pump.zig");
2255	defer f.deinit(alloc);	2249	_ = @import("wall_test_wall.zig");
2256	try std.testing.expectEqual(layout.Rect{ .top = 0, .left = 0, .rows = 9, .cols = 80 }, f.rectOf(0).?);
2257	try std.testing.expectEqual(layout.Rect{ .top = 9, .left = 0, .rows = 8, .cols = 80 }, f.rectOf(1).?);
2258	try std.testing.expectEqual(layout.Rect{ .top = 17, .left = 0, .rows = 8, .cols = 80 }, f.rectOf(2).?);
2259	}
2260
2261	test "the tree refuses a wall that cannot show a content row" {
2262	const alloc = std.testing.allocator;
2263	var tree = layout.Tree.init(alloc);
2264	defer tree.deinit();
2265	// 12 tiles over 23 rows: 1 row each — a label with no content.
2266	try tree.addFirst(0);
2267	for (1..12) \|i\| try tree.insert(@intCast(i - 1), @intCast(i));
2268	try std.testing.expectError(error.TooSmall, tree.flatten(alloc, 23, 80, wall_layout.wallFloors(12), null));
2269	}
2270
2271	test "the tree refuses a multi-tile cut too thin for the daemon's row floor" {
2272	const alloc = std.testing.allocator;
2273	var tree = layout.Tree.init(alloc);
2274	defer tree.deinit();
2275	try tree.addFirst(0);
2276	try tree.insert(0, 1);
2277	// Two tiles on five rows: each rect is two rows, and under a label
2278	// bar that is one content row — below `min_session_rows`, so the
2279	// daemon refuses the resize and the tile freezes on a stale grid.
2280	try std.testing.expectError(error.TooSmall, tree.flatten(alloc, 5, 80, wall_layout.wallFloors(2), null));
2281	try std.testing.expectError(error.TooSmall, tree.flatten(alloc, 4, 80, wall_layout.wallFloors(2), null));
2282	// Six rows is the first cut that fits: three a rect, two of them
2283	// content under the bar — exactly the daemon's row floor.
2284	var f = try tree.flatten(alloc, 6, 80, wall_layout.wallFloors(2), null);
2285	defer f.deinit(alloc);
2286	try std.testing.expectEqual(@as(u16, 3), f.rectOf(0).?.rows);
2287	try std.testing.expectEqual(@as(u16, 3), f.rectOf(1).?.rows);
2288	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 6 }, .is_tty = false };
2289	shared.label_rows = 1; // two tiles draw a bar
2290	var t0 = Tile{
2291	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
2292	.rect = f.rectOf(0).?,
2293	.shared = &shared,
2294	.idx = 0,
2295	.wake_r = -1,
2296	.wake_w = -1,
2297	};
2298	var t1 = Tile{
2299	.r = .{ .target = .{ .sock = "/tmp/y" }, .label = "y", .session = "" },
2300	.rect = f.rectOf(1).?,
2301	.shared = &shared,
2302	.idx = 1,
2303	.wake_r = -1,
2304	.wake_w = -1,
2305	};
2306	try std.testing.expectEqual(proto.min_session_rows, t0.viewRows());
2307	try std.testing.expectEqual(proto.min_session_rows, t1.viewRows());
2308	// A one-tile wall draws no bar, so its floor is the daemon's alone.
2309	var one = layout.Tree.init(alloc);
2310	defer one.deinit();
2311	try one.addFirst(0);
2312	var of = try one.flatten(alloc, 2, 80, wall_layout.wallFloors(1), null);
2313	defer of.deinit(alloc);
2314	try std.testing.expectEqual(@as(u16, 2), of.rectOf(0).?.rows);
2315	}
2316
2317	test "birthTile: a chord-born tile creates and offers no agent" {
2318	const alloc = std.testing.allocator;
2319	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
2320	defer shared.tree.deinit();
2321	try shared.tree.addFirst(0);
2322	var tiles: [2]Tile = undefined;
2323	tiles[0] = .{
2324	.r = .{ .target = .{ .sock = "/tmp/a" }, .label = "--sock /tmp/a", .session = "" },
2325	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
2326	.shared = &shared,
2327	.idx = 0,
2328	.wake_r = -1,
2329	.wake_w = -1,
2330	};
2331	var present = [_]bool{ true, false };
2332	var live: usize = 1;
2333	const r: Resolved = .{ .target = .{ .sock = "/tmp/b" }, .label = "--sock /tmp/b#b", .session = "b" };
2334	const at = birthTile(alloc, &tiles, &present, &live, &shared, .{
2335	.r = r,
2336	.from = 0,
2337	.place = .beside_focus,
2338	.creates = true,
2339	.born_from = 0,
2340	}) orelse return error.TestUnexpectedResult;
2341	defer std.posix.close(tiles[at].wake_r);
2342	defer std.posix.close(tiles[at].wake_w);
2343	try std.testing.expectEqual(@as(usize, 1), at);
2344	try std.testing.expect(tiles[at].creates);
2345	try std.testing.expect(!tiles[at].r.agent);
2346	try std.testing.expectEqual(@as(?usize, 0), tiles[at].born_from);
2347	try std.testing.expect(present[1]);
2348	try std.testing.expectEqual(@as(usize, 2), live);
2349	// Two tiles draw a bar, and the bar is set at birth so viewRows is
2350	// right from the first attach.
2351	try std.testing.expectEqual(@as(u16, 1), shared.label_rows);
2352	}
2353
2354	/// Three tiles: two sessions on host 0 and a same-named one on host 1, so a
2355	/// diff that aliased by NAME alone would be caught.
2356	fn diffFixture(shared: *Shared) [3]Tile {
2357	const t0: client.Target = .{ .sock = "/tmp/h0.sock" };
2358	const t1: client.Target = .{ .sock = "/tmp/h1.sock" };
2359	const rect: layout.Rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 };
2360	return .{
2361	.{
2362	.r = .{ .target = t0, .label = "--sock /tmp/h0.sock#a", .session = "a" },
2363	.rect = rect,
2364	.shared = shared,
2365	.idx = 0,
2366	.wake_r = -1,
2367	.wake_w = -1,
2368	.host = 0,
2369	},
2370	.{
2371	.r = .{ .target = t0, .label = "--sock /tmp/h0.sock#b", .session = "b" },
2372	.rect = rect,
2373	.shared = shared,
2374	.idx = 1,
2375	.wake_r = -1,
2376	.wake_w = -1,
2377	.host = 0,
2378	},
2379	.{
2380	.r = .{ .target = t1, .label = "--sock /tmp/h1.sock#a", .session = "a" },
2381	.rect = rect,
2382	.shared = shared,
2383	.idx = 2,
2384	.wake_r = -1,
2385	.wake_w = -1,
2386	.host = 1,
2387	},
2388	};
2389	}
2390
2391	test "planHostDiff: names the daemon has and the wall does not are births, tiles it dropped vanish, and another host's same name is untouched" {
2392	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
2393	var tiles = diffFixture(&shared);
2394	var present = [_]bool{ true, true, true };
2395
2396	var births = BirthNames{};
2397	var vanish = TileIdxs{};
2398	// The birth is immediate; the vanish waits for a second list to agree
2399	// (see the grace test below), so this list is asked twice.
2400	wall_host.planHostDiff(&tiles, &present, 3, 0, "a\nc\n", null, &births, &vanish);
2401	try std.testing.expectEqual(@as(usize, 1), births.len);
2402	try std.testing.expectEqualStrings("c", births.get(0));
2403	births.len = 0;
2404	wall_host.planHostDiff(&tiles, &present, 3, 0, "a\nc\n", null, &births, &vanish);
2405	try std.testing.expectEqual(@as(usize, 1), vanish.len);
2406	try std.testing.expectEqual(@as(usize, 1), vanish.get(0));
2407
2408	// Host 1's "a" survives host 0's list saying nothing about it.
2409	births.len = 0;
2410	vanish.len = 0;
2411	wall_host.planHostDiff(&tiles, &present, 3, 1, "a\n", null, &births, &vanish);
2412	try std.testing.expectEqual(@as(usize, 0), births.len + vanish.len);
2413
2414	// An empty list vanishes everything the host had, once every tile has
2415	// spent the grace.
2416	wall_host.planHostDiff(&tiles, &present, 3, 0, "", null, &births, &vanish);
2417	vanish.len = 0;
2418	wall_host.planHostDiff(&tiles, &present, 3, 0, "", null, &births, &vanish);
2419	try std.testing.expectEqual(@as(usize, 2), vanish.len);
2420	try std.testing.expectEqual(@as(usize, 0), births.len);
2421	}
2422
2423	test "planHostDiff: a live pump's tile is not vanished by ONE list that lacks it" {
2424	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
2425	var tiles = diffFixture(&shared);
2426	var present = [_]bool{ true, true, true };
2427
2428	var births = BirthNames{};
2429	var vanish = TileIdxs{};
2430	// A poll can overtake a session's exit: the daemon has already dropped
2431	// the name while the pump has not yet read its `exit_status`. Vanishing
2432	// on that list loses the exit code — on a wall of one, `endedTile` skips
2433	// a tile that is no longer present and mux never leaves.
2434	wall_host.planHostDiff(&tiles, &present, 3, 0, "a\n", null, &births, &vanish);
2435	try std.testing.expectEqual(@as(usize, 0), vanish.len);
2436	try std.testing.expect(tiles[1].missed_once);
2437
2438	// A list that names it again forgives it: a tile does not accumulate
2439	// misses across the seconds it is legitimately live.
2440	wall_host.planHostDiff(&tiles, &present, 3, 0, "a\nb\n", null, &births, &vanish);
2441	try std.testing.expectEqual(@as(usize, 0), vanish.len);
2442	try std.testing.expect(!tiles[1].missed_once);
2443
2444	// Two consecutive lists without it, and it goes.
2445	wall_host.planHostDiff(&tiles, &present, 3, 0, "a\n", null, &births, &vanish);
2446	wall_host.planHostDiff(&tiles, &present, 3, 0, "a\n", null, &births, &vanish);
2447	try std.testing.expectEqual(@as(usize, 1), vanish.len);
2448	try std.testing.expectEqual(@as(usize, 1), vanish.get(0));
2449
2450	// A pump that has ENDED has no exit code left to lose, so its tile
2451	// needs no grace at all.
2452	tiles[0].alive.store(false, .release);
2453	vanish.len = 0;
2454	const only0 = [_]bool{ true, false, false };
2455	wall_host.planHostDiff(&tiles, &only0, 3, 0, "", null, &births, &vanish);
2456	try std.testing.expectEqual(@as(usize, 1), vanish.len);
2457	try std.testing.expectEqual(@as(usize, 0), vanish.get(0));
2458	}
2459
2460	test "planHostDiff: a vanished tile is not present, so the next list does not vanish it twice" {
2461	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
2462	var tiles = diffFixture(&shared);
2463	var present = [_]bool{ true, false, true };
2464
2465	var births = BirthNames{};
2466	var vanish = TileIdxs{};
2467	wall_host.planHostDiff(&tiles, &present, 3, 0, "a\n", null, &births, &vanish);
2468	try std.testing.expectEqual(@as(usize, 0), vanish.len);
2469	// ...and the name is not reborn either: the tile is gone, but the
2470	// daemon no longer lists it, so there is nothing to bring back.
2471	try std.testing.expectEqual(@as(usize, 0), births.len);
2472	}
2473
2474	test "planHostDiff: the session this shell is inside is never born as a tile" {
2475	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
2476	var tiles = diffFixture(&shared);
2477	var present = [_]bool{ true, true, true };
2478
2479	var births = BirthNames{};
2480	var vanish = TileIdxs{};
2481	// The daemon has "a", "b" and "self"; "self" is the shell mux runs in,
2482	// so a tile of it would paint into the grid it is reading.
2483	wall_host.planHostDiff(&tiles, &present, 3, 0, "a\nb\nself\n", "self", &births, &vanish);
2484	try std.testing.expectEqual(@as(usize, 0), births.len);
2485	try std.testing.expectEqual(@as(usize, 0), vanish.len);
2486	}
2487
2488	test "planHostDiff: a name the wire grammar refuses never becomes a tile, however the peer spells it" {
2489	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
2490	var tiles = diffFixture(&shared);
2491	var present = [_]bool{ true, true, true };
2492
2493	var births = BirthNames{};
2494	var vanish = TileIdxs{};
2495	// A whole reply may be `sessions_text_max`, so ONE "name" in it can be
2496	// 1056 bytes; `encodeAttachNamed` memcpys the birth's name into a
2497	// 32-byte tail behind nothing but an assert. Peer bytes are filtered
2498	// where they become a tile, not asserted about at the wire.
2499	const over_long = "x" ** (proto.session_name_max + 1);
2500	const list = "a\n" ++ over_long ++ "\nhas space\n\x1b[2J\nc\n";
2501	wall_host.planHostDiff(&tiles, &present, 3, 0, list, null, &births, &vanish);
2502	try std.testing.expectEqual(@as(usize, 1), births.len);
2503	try std.testing.expectEqualStrings("c", births.get(0));
2504	}
2505
2506	/// The keyboard-thread fixture: `running` stopped, so a pump a diff spawns
2507	/// returns at its first check rather than dialling a socket no test is
2508	/// listening on.
2509	fn stoppedWall(alloc: std.mem.Allocator, shared: *Shared) void {
2510	shared.* = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
2511	shared.tree = layout.Tree.init(alloc);
2512	shared.flat_alloc = alloc;
2513	shared.running.store(false, .release);
2514	}
2515
2516	/// Detached pumps hold `*Tile` into the test's own frame; nothing may return
2517	/// while one is still running. The wake pipes go here too: the WALL never
2518	/// closes one (see `ring`), and a test binary would run out of fds.
2519	fn endPumps(tiles: []Tile) void {
2520	for (tiles) \|*t\| {
2521	while (t.alive.load(.acquire)) std.Thread.sleep(std.time.ns_per_ms);
2522	}
2523	for (tiles) \|*t\| {
2524	if (t.wake_r >= 0) std.posix.close(t.wake_r);
2525	if (t.wake_w >= 0) std.posix.close(t.wake_w);
2526	t.wake_r = -1;
2527	t.wake_w = -1;
2528	}
2529	}
2530
2531	fn testHost(shared: *Shared, spelling: []const u8, sock: []const u8) Host {
2532	return .{
2533	.spec = .{ .spelling = spelling, .target = .{ .sock = sock }, .poll_target = .{ .sock = sock } },
2534	.shared = shared,
2535	};
2536	}
2537
2538	fn setList(h: *Host, list: []const u8) void {
2539	@memcpy(h.list[0..list.len], list);
2540	h.list_len = list.len;
2541	h.reachable.store(true, .release);
2542	}
2543
2544	test "applyReadyLists: a host added after the wall opened gets its sessions, and reaches past nothing" {
2545	var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
2546	defer arena.deinit();
2547	const alloc = arena.allocator();
2548	var shared: Shared = undefined;
2549	stoppedWall(alloc, &shared);
2550	var tiles: [8]Tile = undefined;
2551	var present = [_]bool{false} ** 8;
2552	var live: usize = 0;
2553	defer endPumps(tiles[0..live]);
2554	// TWO hosts open the wall and a THIRD arrives from the picker. A fixture
2555	// whose table never grows cannot see a per-host flag sized at the count
2556	// the wall opened with — which is the whole of this.
2557	var table = [_]Host{
2558	testHost(&shared, "box", "/tmp/box.sock"),
2559	testHost(&shared, "vm", "/tmp/vm.sock"),
2560	testHost(&shared, "--sock /tmp/added.sock", "/tmp/added.sock"),
2561	};
2562	setList(&table[2], "late\n");
2563	table[2].list_ready.store(true, .release);
2564
2565	_ = wall_host.applyReadyLists(alloc, &tiles, &present, &live, &shared, table[0..3]);
2566
2567	// The added host's session is a tile, and only the host that reported is
2568	// marked: the two that opened the wall are still owed a first list.
2569	try std.testing.expect(table[2].applied);
2570	try std.testing.expect(!table[0].applied);
2571	try std.testing.expect(!table[1].applied);
2572	try std.testing.expectEqual(@as(usize, 1), live);
2573	try std.testing.expectEqualStrings("late", tiles[0].r.session);
2574	}
2575
2576	// A picker painted into a pipe, drained. Non-blocking on both ends so a
2577	// frame that outgrew the pipe FAILS here rather than parking the suite.
2578	fn pickerFrame(shared: *Shared, r: std.posix.fd_t, host_table: []Host, sel: usize, out: []u8) []const u8 {
2579	wall_picker.paintPicker(shared, host_table, sel, null);
2580	const n = std.posix.read(r, out) catch 0;
2581	return out[0..n];
2582	}
2583
2584	test "paintPicker: the box is centred on the terminal, not pinned to the origin" {
2585	const pipe = try std.posix.pipe2(.{ .NONBLOCK = true });
2586	defer std.posix.close(pipe[0]);
2587	defer std.posix.close(pipe[1]);
2588	// Off-origin is the BASELINE here: a fixture on a terminal the box
2589	// happens to fill is blind to every centring arithmetic mistake.
2590	var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 100, .rows = 40 }, .is_tty = true };
2591	var table = [_]Host{
2592	testHost(&shared, "a", "/tmp/a.sock"),
2593	testHost(&shared, "b", "/tmp/b.sock"),
2594	testHost(&shared, "c", "/tmp/c.sock"),
2595	};
2596	for (&table) \|*h\| {
2597	setList(h, "");
2598	h.applied = true;
2599	}
2600	var buf: [8192]u8 = undefined;
2601	const frame = pickerFrame(&shared, pipe[0], &table, 0, &buf);
2602	// Five rows (header + three hosts + footer) on forty: top = (40-5)/2.
2603	// The box is the terminal's width here, so left is 0 and the columns
2604	// are 1-based CUP.
2605	try std.testing.expect(std.mem.indexOf(u8, frame, "\x1b[18;1H") != null);
2606	try std.testing.expect(std.mem.indexOf(u8, frame, "\x1b[19;1H") != null);
2607	try std.testing.expect(std.mem.indexOf(u8, frame, "\x1b[22;1H") != null);
2608	// ...and nothing above or below the box.
2609	try std.testing.expect(std.mem.indexOf(u8, frame, "\x1b[17;1H") == null);
2610	try std.testing.expect(std.mem.indexOf(u8, frame, "\x1b[23;1H") == null);
2611	// The cursor goes with the popup: a caret blinking in a tile says the
2612	// keys are going there.
2613	try std.testing.expect(std.mem.startsWith(u8, frame, "\x1b[?25l"));
2614	}
2615
2616	test "paintPicker: a box wider than its cap is centred in the columns" {
2617	const pipe = try std.posix.pipe2(.{ .NONBLOCK = true });
2618	defer std.posix.close(pipe[0]);
2619	defer std.posix.close(pipe[1]);
2620	// Wider than `picker_row_max`, so the box is capped and the leftover
2621	// columns are split: (200 - 128) / 2.
2622	var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 200, .rows = 10 }, .is_tty = true };
2623	var table = [_]Host{testHost(&shared, "a", "/tmp/a.sock")};
2624	setList(&table[0], "");
2625	table[0].applied = true;
2626	var buf: [8192]u8 = undefined;
2627	const frame = pickerFrame(&shared, pipe[0], &table, 0, &buf);
2628	try std.testing.expect(std.mem.indexOf(u8, frame, "\x1b[4;37H") != null);
2629	}
2630
2631	test "paintPicker: a terminal too small for a box still says which popup has the keys" {
2632	const pipe = try std.posix.pipe2(.{ .NONBLOCK = true });
2633	defer std.posix.close(pipe[0]);
2634	defer std.posix.close(pipe[1]);
2635	var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 20, .rows = 3 }, .is_tty = true };
2636	var table = [_]Host{
2637	testHost(&shared, "a", "/tmp/a.sock"),
2638	testHost(&shared, "b", "/tmp/b.sock"),
2639	};
2640	for (&table) \|*h\| {
2641	setList(h, "");
2642	h.applied = true;
2643	}
2644	var buf: [8192]u8 = undefined;
2645	const frame = pickerFrame(&shared, pipe[0], &table, 0, &buf);
2646	try std.testing.expect(std.mem.indexOf(u8, frame, "hosts") != null);
2647	// Under the minimum the header is the WHOLE popup: no rows, no legend.
2648	// A box that does not fit is worse than a line saying which one it is.
2649	try std.testing.expect(std.mem.indexOf(u8, frame, "Enter/c new session") == null);
2650	try std.testing.expect(std.mem.indexOf(u8, frame, " 1 a") == null);
2651	}
2652
2653	test "paintPicker: the window scrolls so the selected row is always on screen" {
2654	const pipe = try std.posix.pipe2(.{ .NONBLOCK = true });
2655	defer std.posix.close(pipe[0]);
2656	defer std.posix.close(pipe[1]);
2657	// Six rows for the box: header, footer, and four hosts of the eight.
2658	var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 60, .rows = 6 }, .is_tty = true };
2659	const names = [_][]const u8{ "h0", "h1", "h2", "h3", "h4", "h5", "h6", "h7" };
2660	var table: [8]Host = undefined;
2661	for (&table, names) \|*h, name\| {
2662	h.* = testHost(&shared, name, "/tmp/x.sock");
2663	setList(h, "");
2664	h.applied = true;
2665	}
2666	var buf: [8192]u8 = undefined;
2667	const top = pickerFrame(&shared, pipe[0], &table, 0, &buf);
2668	try std.testing.expect(std.mem.indexOf(u8, top, " 1> h0") != null);
2669	try std.testing.expect(std.mem.indexOf(u8, top, "h7") == null);
2670	// The last row: the window has to follow the selection, or `j` walks
2671	// off the bottom of a box that never moves.
2672	var buf2: [8192]u8 = undefined;
2673	const bottom = pickerFrame(&shared, pipe[0], &table, 7, &buf2);
2674	try std.testing.expect(std.mem.indexOf(u8, bottom, " 8> h7") != null);
2675	try std.testing.expect(std.mem.indexOf(u8, bottom, "h0") == null);
2676	}
2677
2678	test "paintPicker: a frame the stamp refuses to write does not eat the notice with it" {
2679	const pipe = try std.posix.pipe2(.{ .NONBLOCK = true });
2680	defer std.posix.close(pipe[0]);
2681	defer std.posix.close(pipe[1]);
2682	var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 100, .rows = 40 }, .is_tty = true };
2683	var table = [_]Host{testHost(&shared, "--sock /tmp/a.sock", "/tmp/a.sock")};
2684	setList(&table[0], "");
2685	table[0].applied = true;
2686	wall_picker.paintPicker(&shared, &table, 0, null);
2687
2688	// A notice whose footer is byte-for-byte the legend already on the
2689	// screen: the stamp refuses the write, and taking the notice ahead of
2690	// that check is a sentence consumed by a frame nobody was sent.
2691	setNotice(&shared, " Enter/c new session x forget a add Esc");
2692	wall_picker.paintPicker(&shared, &table, 0, null);
2693	var buf: [96]u8 = undefined;
2694	try std.testing.expectEqualStrings(
2695	" Enter/c new session x forget a add Esc",
2696	takeNotice(&shared, &buf),
2697	);
2698	}
2699
2700	test "paintPicker: replayed into an engine, the popup covers its box and NOT one cell more" {
2701	const alloc = std.testing.allocator;
2702	const cols: u16 = 160;
2703	const rows: u16 = 20;
2704	var screen = try WallScreen.init(alloc, cols, rows);
2705	defer screen.deinit();
2706	// Off-origin in BOTH axes: `picker_row_max` caps the width at 128, so
2707	// left = (160-128)/2, and three hosts make a five-row box at
2708	// top = (20-5)/2. A grep over the frame's CUP sequences cannot see a
2709	// paint that reaches a cell by another route — a different CUP form, a
2710	// wider pad — so this one judges the GRID.
2711	const w: u16 = @intCast(wall_picker.picker_row_max);
2712	const left: u16 = (cols - w) / 2;
2713	const height: u16 = 5;
2714	const top: u16 = (rows - height) / 2;
2715
2716	// A background every untouched cell can be recognised by.
2717	var bg: [cols]u8 = undefined;
2718	@memset(&bg, '.');
2719	var r: u16 = 0;
2720	while (r < rows) : (r += 1) {
2721	var cup: [16]u8 = undefined;
2722	screen.eng.feed(std.fmt.bufPrint(&cup, "\x1b[{d};1H", .{r + 1}) catch unreachable);
2723	screen.eng.feed(&bg);
2724	}
2725	screen.eng.feed("\x1b[H");
2726
2727	var shared = Shared{ .out_fd = screen.w, .size = .{ .cols = cols, .rows = rows }, .is_tty = true };
2728	var table = [_]Host{
2729	testHost(&shared, "--sock /tmp/a.sock", "/tmp/a.sock"),
2730	testHost(&shared, "--sock /tmp/b.sock", "/tmp/b.sock"),
2731	testHost(&shared, "--sock /tmp/c.sock", "/tmp/c.sock"),
2732	};
2733	for (&table) \|*h\| {
2734	setList(h, "");
2735	h.applied = true;
2736	}
2737	wall_picker.paintPicker(&shared, &table, 1, null);
2738	screen.drain();
2739	const dump = try screen.eng.dumpPlain(alloc);
2740	defer alloc.free(dump);
2741
2742	var i: u16 = 0;
2743	while (i < rows) : (i += 1) {
2744	const l = WallScreen.line(dump, i) orelse return error.NoSuchRow;
2745	try std.testing.expectEqual(@as(usize, cols), l.len);
2746	if (i >= top and i < top + height) {
2747	// The rails and every tile beside the box are outside it.
2748	try std.testing.expectEqualStrings(bg[0..left], l[0..left]);
2749	try std.testing.expectEqualStrings(bg[0..left], l[left + w ..]);
2750	try std.testing.expect(!std.mem.eql(u8, bg[0..w], l[left..][0..w]));
2751	} else {
2752	try std.testing.expectEqualStrings(&bg, l);
2753	}
2754	}
2755	// The selected row is the one the popup says it is, in the grid.
2756	const sel_row = WallScreen.line(dump, top + 2) orelse return error.NoSuchRow;
2757	try std.testing.expect(std.mem.indexOf(u8, sel_row, " 2> ") != null);
2758	}
2759
2760	test "paintPicker: an unchanged frame is not written again" {
2761	const pipe = try std.posix.pipe2(.{ .NONBLOCK = true });
2762	defer std.posix.close(pipe[0]);
2763	defer std.posix.close(pipe[1]);
2764	var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 60, .rows = 20 }, .is_tty = true };
2765	var table = [_]Host{
2766	testHost(&shared, "a", "/tmp/a.sock"),
2767	testHost(&shared, "b", "/tmp/b.sock"),
2768	};
2769	for (&table) \|*h\| {
2770	setList(h, "");
2771	h.applied = true;
2772	}
2773	var buf: [8192]u8 = undefined;
2774	try std.testing.expect(pickerFrame(&shared, pipe[0], &table, 0, &buf).len > 0);
2775	// The pollers repaint this box once a second PER HOST. Rewriting an
2776	// identical screen at that rate is a terminal that never goes quiet,
2777	// which is also every `settle` in the e2e suite.
2778	try std.testing.expectEqual(@as(usize, 0), pickerFrame(&shared, pipe[0], &table, 0, &buf).len);
2779	// A moved selection is a different frame, and is written.
2780	try std.testing.expect(pickerFrame(&shared, pipe[0], &table, 1, &buf).len > 0);
2781	// ...and a cleared stamp is what a relayout leaves behind, so the box
2782	// goes back onto a screen that was wiped under it.
2783	shared.picker_stamp = 0;
2784	try std.testing.expect(pickerFrame(&shared, pipe[0], &table, 1, &buf).len > 0);
2785	}
2786
2787	test "PickerAuto: an empty wall opens the picker once, and a tile takes it back" {
2788	var a: PickerAuto = .{};
2789	// Empty and nothing open: the wall opens it itself, because a blank
2790	// screen is no place to act from.
2791	try std.testing.expectEqual(PickerAuto.Step.open, a.step(true, true, false, false));
2792	// ...ONCE. The Esc that closed it has to leave the one-line text
2793	// standing rather than being reopened over.
2794	try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, true, false, false));
2795	// A tile arrived: the wall has something to show and gets the screen.
2796	try std.testing.expectEqual(PickerAuto.Step.close, a.step(true, false, true, false));
2797	// ...and only once; the popup is already gone.
2798	try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, false, false, false));
2799	}
2800
2801	test "PickerAuto: a spelling in progress keeps the popup a tile would have closed" {
2802	var a: PickerAuto = .{};
2803	try std.testing.expectEqual(PickerAuto.Step.open, a.step(true, true, false, false));
2804	// `prompting` layers OVER `picking`: closing on `picking` alone would
2805	// take the editor off the screen and leave it eating every key, and its
2806	// Enter would reach the main switch's dead `.add_tile` arm — no line,
2807	// no notice, and no host added.
2808	try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, false, true, true));
2809	// The moment the line is submitted or cancelled, the close is owed again.
2810	try std.testing.expectEqual(PickerAuto.Step.close, a.step(true, false, true, false));
2811	}
2812
2813	test "PickerAuto: a picker the user opened is not closed by an arriving tile" {
2814	var a: PickerAuto = .{};
2815	try std.testing.expectEqual(PickerAuto.Step.open, a.step(true, true, false, false));
2816	// Esc, and the user opens it again by hand. Without `taken` the flag
2817	// outlives the close and the next birth force-closes a popup they are
2818	// choosing from.
2819	a.taken();
2820	try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, false, true, false));
2821	}
2822
2823	test "PickerAuto: the Esc that closes the wall's own popup is not undone by the wall" {
2824	var a: PickerAuto = .{};
2825	try std.testing.expectEqual(PickerAuto.Step.open, a.step(true, true, false, false));
2826	// The close runs `taken` on EVERY exit, the wall's popup included, and
2827	// the wall is still empty afterwards. One flag for both facts reopened
2828	// the box over the one-line text the Esc had just asked for — and on
2829	// that wall `Ctrl-\ d` never reached the keyboard again.
2830	a.taken();
2831	try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, true, false, false));
2832	try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, true, false, false));
2833	// A tile arrives and leaves again: THAT emptiness earns its own open.
2834	try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, false, false, false));
2835	try std.testing.expectEqual(PickerAuto.Step.open, a.step(true, true, false, false));
2836	}
2837
2838	test "PickerAuto: one Esc leaves a user's picker that outlived the wall's last tile" {
2839	var a: PickerAuto = .{};
2840	// The user opens the popup on a wall that still has tiles, and the last
2841	// of them ends underneath it. The emptiness the wall then sees is one
2842	// whose popup is already up, so it is spent without ever opening.
2843	try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, false, true, false));
2844	try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, true, true, false));
2845	a.taken();
2846	// The one Esc that closed it is the whole of this: unspent, the wall
2847	// answers it by opening the box straight back over the empty line.
2848	try std.testing.expectEqual(PickerAuto.Step.leave, a.step(true, true, false, false));
2849	}
2850
2851	test "PickerAuto: a wall still dialling spends nothing, so its first known emptiness still opens" {
2852	var a: PickerAuto = .{};
2853	// `is_tty` carries `restore_tried`: the user can open the picker by hand
2854	// while the hosts are still answering, and a wall not yet KNOWN to be
2855	// empty must not spend the open it has not made.
2856	try std.testing.expectEqual(PickerAuto.Step.leave, a.step(false, true, true, false));
2857	a.taken();
2858	try std.testing.expectEqual(PickerAuto.Step.open, a.step(true, true, false, false));
2859	}
2860
2861	test "PickerAuto: a wall still dialling, and a wall with no terminal, open nothing" {
2862	var a: PickerAuto = .{};
2863	// The caller folds `restore_tried` into this argument: a wall that has
2864	// not heard from its hosts yet is not KNOWN to be empty, and a popup
2865	// flashed over tiles that are about to arrive is one nobody asked for.
2866	try std.testing.expectEqual(PickerAuto.Step.leave, a.step(false, true, false, false));
2867	// A piped mux has no screen to put a popup on.
2868	var b: PickerAuto = .{};
2869	try std.testing.expectEqual(PickerAuto.Step.leave, b.step(false, true, false, false));
2870	}
2871
2872	fn claimBench(shared: *Shared, idx: usize) Tile {
2873	return .{
2874	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "0" },
2875	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
2876	.shared = shared,
2877	.idx = idx,
2878	.wake_r = -1,
2879	.wake_w = -1,
2880	};
2881	}
2882
2883	test "claimAllowed: a stale arm does not claim even when the sink would now admit it" {
2884	const alloc = std.testing.allocator;
2885	const pipe = try std.posix.pipe2(.{ .NONBLOCK = true });
2886	defer std.posix.close(pipe[0]);
2887	defer std.posix.close(pipe[1]);
2888	var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
2889	// The focus has moved to tile 1; tile 2 is still holding the arm it was
2890	// given before the popup went up.
2891	shared.sel = 1;
2892	var t = claimBench(&shared, 2);
2893	t.claim_pending.store(true, .release);
2894	var core = try interact.Core.initSized(alloc, -1, pipe[1], .{ .cols = 80, .rows = 24 });
2895	defer core.deinit();
2896	core.is_tty = true;
2897
2898	// The whole of this test: the picker has CLOSED, so the default sink
2899	// admits every paint and `claimTerminal` would SUCCEED. Judging the
2900	// claim's refusal cannot see that — there is no refusal left to judge —
2901	// so the focus test has to run first, and `claimFocus` is the one door
2902	// in this file that puts the two in that order.
2903	const rect: proto.Size = .{ .cols = 80, .rows = 24 };
2904	_ = t.claim_pending.swap(false, .acq_rel);
2905	try std.testing.expectEqual(ClaimStep.dropped, wall_pump.claimFocus(&t, &core, rect));
2906
2907	// Nothing claimed, and nothing on the terminal: `session_claim` is the
2908	// mouse modes, and a second tile setting them is what leaves one
2909	// session's modes on the screen with nothing left to take them off.
2910	try std.testing.expectEqual(interact.Claim.none, core.claim);
2911	var buf: [256]u8 = undefined;
2912	try std.testing.expectEqual(@as(usize, 0), std.posix.read(pipe[0], &buf) catch 0);
2913
2914	// The control: the same call on the tile that DOES hold the focus takes
2915	// it, so the guard is a focus test and not a blanket refusal.
2916	shared.sel = 2;
2917	try std.testing.expectEqual(ClaimStep.done, wall_pump.claimFocus(&t, &core, rect));
2918	try std.testing.expectEqual(interact.Claim.session, core.claim);
2919	try std.testing.expect((std.posix.read(pipe[0], &buf) catch 0) > 0);
2920	}
2921
2922	test "afterClaim: a claim the picker refused is armed again for this tile" {
2923	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
2924	// Off-origin: tile 2 of a wall, not tile 0, so an index compared
2925	// against a hard-coded 0 would pass here and nowhere else.
2926	shared.sel = 2;
2927	var t = claimBench(&shared, 2);
2928	try std.testing.expectEqual(ClaimStep.rearmed, wall_pump.afterClaim(&t, false, false, true));
2929	try std.testing.expect(t.claim_pending.load(.acquire));
2930	}
2931
2932	test "afterClaim: an arm does not outlive the focus that earned it" {
2933	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
2934	var t = claimBench(&shared, 2);
2935	// The keyboard moved the focus while the popup was up — a poller's tile
2936	// arriving, or the birth the Enter made. A re-arm that survived it
2937	// fires after the close: two tiles' modes on one terminal, the cursor
2938	// resting on the loser, and the release already consumed so nothing
2939	// takes either off.
2940	shared.sel = 1;
2941	try std.testing.expectEqual(ClaimStep.dropped, wall_pump.afterClaim(&t, false, false, true));
2942	try std.testing.expect(!t.claim_pending.load(.acquire));
2943	}
2944
2945	test "afterClaim: only the SINK's refusal is worth another pass" {
2946	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
2947	shared.sel = 2;
2948	var t = claimBench(&shared, 2);
2949	// A claim that landed owes nothing.
2950	try std.testing.expectEqual(ClaimStep.done, wall_pump.afterClaim(&t, true, true, true));
2951	// A Core that ALREADY holds it answers false too, and re-arming that
2952	// would re-take the focus notice on every pass, forever.
2953	try std.testing.expectEqual(ClaimStep.done, wall_pump.afterClaim(&t, false, true, true));
2954	// No terminal, nothing to hold: a piped `mux` is one tile and no claim.
2955	try std.testing.expectEqual(ClaimStep.done, wall_pump.afterClaim(&t, false, false, false));
2956	// None of the three armed anything.
2957	try std.testing.expect(!t.claim_pending.load(.acquire));
2958	}
2959
2960	test "tilePaintBegin: no tile paints while the picker owns the screen" {
2961	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
2962	var t = Tile{
2963	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "0" },
2964	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
2965	.shared = &shared,
2966	.idx = 0,
2967	.wake_r = -1,
2968	.wake_w = -1,
2969	};
2970	// The gate the whole popup rests on, and the gate that makes a focus
2971	// CLAIM fail under it (`Core.claimTerminal` writes through the same
2972	// sink) — which is why the pump re-arms `claim_pending` instead of
2973	// treating a false return as "already claimed".
2974	try std.testing.expect(wall_pump.tilePaintBegin(&t));
2975	wall_pump.tilePaintEnd(&t);
2976	shared.picker_open.store(true, .release);
2977	try std.testing.expect(!wall_pump.tilePaintBegin(&t));
2978	// Refused WITHOUT holding the lock: a begin that returned false and
2979	// kept `paint_mu` would wedge the keyboard on its next paint.
2980	try std.testing.expect(shared.paint_mu.tryLock());
2981	shared.paint_mu.unlock();
2982	}
2983
2984	test "pickerRow: a table with a 10 in it pads every number, so no spelling shifts a column" {
2985	var nine_buf: [96]u8 = undefined;
2986	var ten_buf: [96]u8 = undefined;
2987	const nine = wall_picker.pickerRow(&nine_buf, 9, true, "--sock /a", "1 session", false, 40);
2988	const ten = wall_picker.pickerRow(&ten_buf, 10, true, "--sock /a", "1 session", false, 40);
2989	try std.testing.expectEqual(
2990	std.mem.indexOf(u8, nine, "--sock").?,
2991	std.mem.indexOf(u8, ten, "--sock").?,
2992	);
2993
2994	// A table that never reaches 10 spends no column on a digit it has not
2995	// got: the marker is already two wide for the same reason.
2996	var narrow_buf: [96]u8 = undefined;
2997	const narrow = wall_picker.pickerRow(&narrow_buf, 9, false, "--sock /a", "1 session", false, 40);
2998	try std.testing.expectEqualStrings(" 9 --sock", narrow[0..10]);
2999	}
3000
3001	test "pickerRows: every host says what its poller last answered" {
3002	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
3003	// Four hosts, one per state the column can report. A fixture of one
3004	// reachable host is blind to three of them.
3005	var table = [_]Host{
3006	testHost(&shared, "--sock /tmp/a.sock", "/tmp/a.sock"),
3007	testHost(&shared, "box", "/tmp/b.sock"),
3008	testHost(&shared, "quic://gate:4433", "/tmp/c.sock"),
3009	testHost(&shared, "slow", "/tmp/d.sock"),
3010	};
3011	setList(&table[0], "0\nwork\ndev\n");
3012	table[0].applied = true;
3013	setList(&table[1], "");
3014	table[1].reachable.store(false, .release);
3015	table[1].applied = true;
3016	setList(&table[2], "");
3017	table[2].applied = true;
3018	// Never answered: `applied` is what a first list sets, so a host that
3019	// has not reported once is `connecting` and not `no sessions` — the
3020	// two send the user to opposite places.
3021
3022	var body: PickerBody = .{};
3023	wall_picker.pickerRows(&body, &table, 2, 48);
3024
3025	try std.testing.expectEqual(@as(usize, 4), body.n);
3026	try std.testing.expectEqualStrings(" 1 --sock /tmp/a.sock 3 sessions ", body.row(0));
3027	try std.testing.expectEqualStrings(" 2 box unreachable ", body.row(1));
3028	// The selected row wears the same marker a focused tile's bar does.
3029	try std.testing.expectEqualStrings(" 3> quic://gate:4433 no sessions ", body.row(2));
3030	try std.testing.expectEqualStrings(" 4 slow connecting ", body.row(3));
3031	}
3032
3033	test "pickerRows: one session is not 1 sessions" {
3034	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
3035	var table = [_]Host{testHost(&shared, "box", "/tmp/b.sock")};
3036	setList(&table[0], "0\n");
3037	table[0].applied = true;
3038	var body: PickerBody = .{};
3039	wall_picker.pickerRows(&body, &table, 0, 32);
3040	try std.testing.expectEqualStrings(" 1> box 1 session ", body.row(0));
3041	}
3042
3043	test "pickerRows: a spelling wider than the box keeps its tail" {
3044	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
3045	var table = [_]Host{testHost(
3046	&shared,
3047	"--sock /run/user/1000/mux/very/long/path/to/muxd.sock",
3048	"/tmp/b.sock",
3049	)};
3050	setList(&table[0], "0\n");
3051	table[0].applied = true;
3052	var body: PickerBody = .{};
3053	wall_picker.pickerRows(&body, &table, 0, 32);
3054	// Cut from the LEFT: the head of a socket path is what every host on
3055	// one machine has in common, and the tail is what tells them apart.
3056	try std.testing.expectEqualStrings(" 1> path/to/muxd.sock 1 session ", body.row(0));
3057	}
3058
3059	test "pickBirth: Enter on an emptied popup births nothing, not a session on a host just forgotten" {
3060	var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
3061	defer arena.deinit();
3062	const alloc = arena.allocator();
3063	var shared: Shared = undefined;
3064	stoppedWall(alloc, &shared);
3065	var tiles: [4]Tile = undefined;
3066	var present = [_]bool{false} ** 4;
3067	var live: usize = 0;
3068	defer endPumps(tiles[0..live]);
3069	// TWO hosts, both forgotten: the wall the last `x` empties is the wall
3070	// whose popup has no row left to move the selection to, so `sel` still
3071	// indexes a slot — a one-host fixture proves nothing about the index.
3072	var table = [_]Host{
3073	testHost(&shared, "a", "/tmp/a.sock"),
3074	testHost(&shared, "b", "/tmp/b.sock"),
3075	};
3076	for (&table) \|*h\| {
3077	setList(h, "");
3078	h.applied = true;
3079	h.forgotten.store(true, .release);
3080	}
3081
3082	const at = wall_picker.pickBirth(alloc, &tiles, &present, &live, &shared, &table, 1);
3083
3084	if (at != null) return error.BornOnAForgottenHost;
3085	if (live != 0) return error.AForgottenHostTookASlot;
3086	var buf: [96]u8 = undefined;
3087	try std.testing.expectEqualStrings(
3088	"[no hosts to start a session on - a adds one]",
3089	takeNotice(&shared, &buf),
3090	);
3091	}
3092
3093	test "pickBirth: Enter is an ask — the tile it births may start a daemon, the row it came from may not" {
3094	var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
3095	defer arena.deinit();
3096	const alloc = arena.allocator();
3097	var shared: Shared = undefined;
3098	stoppedWall(alloc, &shared);
3099	var tiles: [4]Tile = undefined;
3100	var present = [_]bool{false} ** 4;
3101	var live: usize = 0;
3102	defer endPumps(tiles[0..live]);
3103	// TWO hosts, and the birth on the second: a one-host fixture cannot
3104	// see a birth that reaches for the wrong row.
3105	var table = [_]Host{
3106	.{
3107	.spec = try resolveHost(alloc, "alpha", null, client.quic_idle_ms_default),
3108	.shared = &shared,
3109	},
3110	.{
3111	.spec = try resolveHost(alloc, "beta", null, client.quic_idle_ms_default),
3112	.shared = &shared,
3113	},
3114	};
3115	for (&table) \|*h\| {
3116	setList(h, "");
3117	h.applied = true;
3118	}
3119
3120	const at = wall_picker.pickBirth(alloc, &tiles, &present, &live, &shared, &table, 1) orelse
3121	return error.EnterBornNothing;
3122
3123	// The row Enter lands on is often exactly the one the poller calls
3124	// unreachable, and starting that machine's daemon is what choosing it
3125	// means. Nothing else on the wall may: the spec below it is what the
3126	// poller re-dials every second.
3127	try std.testing.expect(tiles[at].r.target.hand.asked);
3128	try std.testing.expect(!table[1].spec.target.hand.asked);
3129	try std.testing.expect(!table[1].spec.poll_target.hand.asked);
3130	}
3131
3132	test "pickerRows: a forgotten host is off the list, and the numbers close up" {
3133	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
3134	var table = [_]Host{
3135	testHost(&shared, "a", "/tmp/a.sock"),
3136	testHost(&shared, "b", "/tmp/b.sock"),
3137	testHost(&shared, "c", "/tmp/c.sock"),
3138	};
3139	for (&table) \|*h\| {
3140	setList(h, "");
3141	h.applied = true;
3142	}
3143	// The slot STAYS — a poller thread holds the pointer and `Tile.host`
3144	// indexes it — so only the list closes up.
3145	table[1].forgotten.store(true, .release);
3146	var body: PickerBody = .{};
3147	wall_picker.pickerRows(&body, &table, 2, 32);
3148	try std.testing.expectEqual(@as(usize, 2), body.n);
3149	try std.testing.expectEqualStrings(" 1 a no sessions ", body.row(0));
3150	try std.testing.expectEqualStrings(" 2> c no sessions ", body.row(1));
3151	}
3152
3153	test "the empty wall advertises the key the picker really answers to" {
3154	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
3155	const hint = emptyWallHint(&shared);
3156	// The sentence names a chord; this is what stops it outliving the
3157	// binding. `Ctrl-\ s` in the text, `\x1c s` through the filter.
3158	try std.testing.expect(std.mem.indexOf(u8, hint, "Ctrl-\\ s") != null);
3159	var f: interact.PrefixFilter = .{};
3160	var keys = "\x1cs".*;
3161	try std.testing.expectEqual(interact.PrefixFilter.Action.pick_open, f.feed(&keys).action);
3162	}
3163
3164	test "emptyWallHint: a chord an empty wall refuses is said there, and said once" {
3165	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
3166	const way_out = "Ctrl-\\ s to pick a host - Ctrl-\\ d to leave";
3167	try std.testing.expectEqualStrings(way_out, emptyWallHint(&shared));
3168
3169	setNotice(&shared, "[no session to birth beside - Ctrl-\\ s picks a host]");
3170	shared.paint_mu.lock();
3171	defer shared.paint_mu.unlock();
3172	// An empty wall has no pump, and a notice is painted by the pump that
3173	// claims the terminal — so this line is the only place it can be said.
3174	try std.testing.expectEqualStrings(
3175	"[no session to birth beside - Ctrl-\\ s picks a host]",
3176	emptyWallHint(&shared),
3177	);
3178	// Once: every relayout repaints the empty line, and a sentence that
3179	// outlived the keystroke that earned it would never leave the screen.
3180	try std.testing.expectEqualStrings(way_out, emptyWallHint(&shared));
3181	}
3182
3183	test "awaitDetach: a pump that has already returned is not waited on" {
3184	var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
3185	defer arena.deinit();
3186	var shared: Shared = undefined;
3187	stoppedWall(arena.allocator(), &shared);
3188	var t: Tile = .{
3189	.r = .{ .target = .{ .sock = "/tmp/a" }, .label = "--sock /tmp/a", .session = "0" },
3190	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
3191	.shared = &shared,
3192	.idx = 0,
3193	.wake_r = -1,
3194	.wake_w = -1,
3195	.alive = std.atomic.Value(bool).init(false),
3196	};
3197	// The pump is the only thread that sets `detach_ack`, and this one has
3198	// returned: the wait can only ever run out its 400ms bound.
3199	const began = std.time.milliTimestamp();
3200	awaitDetach(&t, &shared);
3201	try std.testing.expect(std.time.milliTimestamp() - began < 100);
3202	}
3203
3204	test "recordHost: a file it cannot write comes BACK — the wall may be on the alternate screen" {
3205	const alloc = std.testing.allocator;
3206	var tmp = try TmpDir.make();
3207	defer tmp.cleanup();
3208	var bad_buf: [256]u8 = undefined;
3209	var ok_buf: [256]u8 = undefined;
3210	var blocker_buf: [256]u8 = undefined;
3211	// A path whose parent is a FILE. `saveBytes` makes missing directories,
3212	// so an absent one is not a failure — this is. The caller has to say so
3213	// out loud, and WHERE it may say it depends on which caller it is:
3214	// stderr before the screen is taken, a notice after.
3215	const blocker = try std.fmt.bufPrint(&blocker_buf, "{s}/notadir", .{tmp.path()});
3216	try wall.saveBytes(blocker, "x");
3217	const bad = try std.fmt.bufPrint(&bad_buf, "{s}/notadir/hosts", .{tmp.path()});
3218	const ok = try std.fmt.bufPrint(&ok_buf, "{s}/hosts", .{tmp.path()});
3219	try std.testing.expect(wall_host.recordHost(alloc, .{ .sock = "/a" }, "--sock /a", bad) != null);
3220	try std.testing.expect(wall_host.recordHost(alloc, .{ .sock = "/a" }, "--sock /a", ok) == null);
3221	// `--via` has no form in the host grammar, and writing nothing down for
3222	// it is not a failure to report.
3223	try std.testing.expect(wall_host.recordHost(alloc, .{ .via = "ssh h muxd proxy" }, "x", bad) == null);
3224	}
3225
3226	test "applyHostList: a host with no live session gets no tile — the wall shows sessions only" {
3227	var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
3228	defer arena.deinit();
3229	const alloc = arena.allocator();
3230	var shared: Shared = undefined;
3231	stoppedWall(alloc, &shared);
3232	var tiles: [4]Tile = undefined;
3233	var present = [_]bool{false} ** 4;
3234	var live: usize = 0;
3235	defer endPumps(tiles[0..live]);
3236	// The two ways a host has nothing to show, side by side: one that never
3237	// answered and one that answered with an empty list.
3238	var table = [_]Host{
3239	testHost(&shared, "down", "/tmp/nobody.sock"),
3240	testHost(&shared, "empty", "/tmp/empty.sock"),
3241	};
3242	table[0].reachable.store(false, .release);
3243	setList(&table[1], "");
3244
3245	// Twice, because a placeholder that is born once is still a placeholder.
3246	for (0..2) \|_\| {
3247	wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
3248	wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 1);
3249	}
3250
3251	try std.testing.expectEqual(@as(usize, 0), live);
3252	try std.testing.expectEqual(@as(usize, 0), presentCount(present[0..]));
3253
3254	// A session on the empty host, and the wall has exactly the one tile.
3255	setList(&table[1], "a\n");
3256	wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 1);
3257
3258	try std.testing.expectEqual(@as(usize, 1), presentCount(present[0..live]));
3259	try std.testing.expectEqualStrings("a", tiles[0].r.session);
3260	try std.testing.expectEqual(@as(?usize, 1), tiles[0].host);
3261	}
3262
3263	test "applyHostList: a live tile survives one list that lost its session, and goes on the next" {
3264	var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
3265	defer arena.deinit();
3266	const alloc = arena.allocator();
3267	var shared: Shared = undefined;
3268	stoppedWall(alloc, &shared);
3269	var tiles: [4]Tile = undefined;
3270	var present = [_]bool{false} ** 4;
3271	var live: usize = 0;
3272	defer endPumps(tiles[0..live]);
3273	// Two sessions, because the tile that keeps its name is what shows the
3274	// grace is per tile and not a wall-wide pause.
3275	var table = [_]Host{testHost(&shared, "box", "/tmp/box.sock")};
3276	setList(&table[0], "a\nb\n");
3277	wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
3278	try std.testing.expectEqual(@as(usize, 2), live);
3279
3280	// The wall's pumps are stopped in this fixture, so the liveness the rule
3281	// turns on is stated rather than raced for.
3282	tiles[0].alive.store(true, .release);
3283	tiles[1].alive.store(true, .release);
3284	setList(&table[0], "a\n");
3285	wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
3286	// Still there: this list may have overtaken an `exit_status` the pump
3287	// has not read yet, and that code is the run's own on a wall of one.
3288	try std.testing.expect(present[1]);
3289	try std.testing.expect(present[0]);
3290
3291	wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
3292	try std.testing.expect(!present[1]);
3293	try std.testing.expect(present[0]);
3294	}
3295
3296	test "applyHostList: two sessions on an empty wall are two tiles, the first focused" {
3297	var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
3298	defer arena.deinit();
3299	const alloc = arena.allocator();
3300	var shared: Shared = undefined;
3301	stoppedWall(alloc, &shared);
3302	var tiles: [4]Tile = undefined;
3303	var present = [_]bool{false} ** 4;
3304	var live: usize = 0;
3305	defer endPumps(tiles[0..live]);
3306	var table = [_]Host{testHost(&shared, "box", "/tmp/box.sock")};
3307	setList(&table[0], "a\nb\n");
3308
3309	wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
3310
3311	// The first birth has no leaf to sit beside — an empty tree takes it as
3312	// its root, and the second inserts against it.
3313	try std.testing.expectEqual(@as(usize, 2), live);
3314	try std.testing.expectEqual(@as(usize, 2), shared.tree.count());
3315	try std.testing.expectEqualStrings("a", tiles[0].r.session);
3316	try std.testing.expectEqualStrings("b", tiles[1].r.session);
3317	try std.testing.expectEqual(@as(usize, 0), shared.sel);
3318	try std.testing.expect(tiles[0].claim_pending.load(.acquire));
3319	}
3320
3321	test "applyHostList: one list's tiles are laid out in the order the daemon reported them" {
3322	var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
3323	defer arena.deinit();
3324	const alloc = arena.allocator();
3325	var shared: Shared = undefined;
3326	stoppedWall(alloc, &shared);
3327	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
3328	var tiles: [4]Tile = undefined;
3329	var present = [_]bool{false} ** 4;
3330	var live: usize = 0;
3331	defer endPumps(tiles[0..live]);
3332	var table = [_]Host{testHost(&shared, "box", "/tmp/box.sock")};
3333	// THREE, because two cannot fail: the first birth roots the tree and the
3334	// second lands after it whatever it anchored on. The third is the one
3335	// that has a choice, and anchoring it back at the focus puts it BETWEEN
3336	// its two siblings.
3337	setList(&table[0], "a\nb\nc\n");
3338
3339	wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
3340
3341	try std.testing.expectEqual(@as(usize, 3), live);
3342	// Down the screen in the daemon's own order. The tile ARRAY is in that
3343	// order by construction; what this reads is the flatten, which is where
3344	// an anchor that did not move shows up.
3345	const flat = shared.last_flat orelse return error.NoFlat;
3346	const top_a = (flat.rectOf(0) orelse return error.NoRect).top;
3347	const top_b = (flat.rectOf(1) orelse return error.NoRect).top;
3348	const top_c = (flat.rectOf(2) orelse return error.NoRect).top;
3349	try std.testing.expectEqualStrings("a", tiles[0].r.session);
3350	try std.testing.expectEqualStrings("b", tiles[1].r.session);
3351	try std.testing.expectEqualStrings("c", tiles[2].r.session);
3352	try std.testing.expect(top_a < top_b);
3353	try std.testing.expect(top_b < top_c);
3354	}
3355
3356	test "applyHostList: sessions past the wall's capacity are counted in the notice, not dropped in silence" {
3357	var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
3358	defer arena.deinit();
3359	const alloc = arena.allocator();
3360	var shared: Shared = undefined;
3361	stoppedWall(alloc, &shared);
3362	var tiles: [max_tiles]Tile = undefined;
3363	var present = [_]bool{true} ** max_tiles;
3364	var live: usize = max_tiles;
3365	var names: [max_tiles][2]u8 = undefined;
3366	var text: std.ArrayList(u8) = .empty;
3367	for (&tiles, 0..) \|*t, i\| {
3368	const name = std.fmt.bufPrint(&names[i], "{d}", .{i}) catch unreachable;
3369	t.* = .{
3370	.r = .{ .target = .{ .sock = "/tmp/box.sock" }, .label = "box", .session = name },
3371	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
3372	.shared = &shared,
3373	.idx = i,
3374	.wake_r = -1,
3375	.wake_w = -1,
3376	.host = 0,
3377	.alive = std.atomic.Value(bool).init(false),
3378	};
3379	try text.appendSlice(alloc, name);
3380	try text.append(alloc, '\n');
3381	}
3382	// Two more than the wall can hold.
3383	try text.appendSlice(alloc, "x\ny\n");
3384	var table = [_]Host{testHost(&shared, "box", "/tmp/box.sock")};
3385	setList(&table[0], text.items);
3386
3387	wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
3388
3389	try std.testing.expectEqual(@as(usize, max_tiles), live);
3390	var buf: [96]u8 = undefined;
3391	try std.testing.expectEqualStrings("[+2 not shown]", takeNotice(&shared, &buf));
3392	}
3393
3394	test "applyHostList: a wall too thin for a second pane takes what fits and retains nothing for the rest" {
3395	// The TESTING allocator, not an arena: what this pins is that a birth
3396	// the wall refuses leaves no allocation behind, and only leak detection
3397	// can say so. The tile that DID fit owns its copies, so the test frees
3398	// exactly those two.
3399	const alloc = std.testing.allocator;
3400	var shared: Shared = undefined;
3401	stoppedWall(alloc, &shared);
3402	// Four rows: one pane fits (`min_session_rows`), two never can — each
3403	// would owe a label bar on top of that floor.
3404	shared.size = .{ .cols = 80, .rows = 4 };
3405	defer shared.tree.deinit();
3406	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
3407	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
3408	var tiles: [4]Tile = undefined;
3409	var present = [_]bool{false} ** 4;
3410	var live: usize = 0;
3411	defer endPumps(tiles[0..live]);
3412	defer for (tiles[0..live]) \|*t\| {
3413	alloc.free(t.r.session);
3414	alloc.free(t.r.label);
3415	};
3416	var table = [_]Host{testHost(&shared, "box", "/tmp/box.sock")};
3417	setList(&table[0], "a\nb\n");
3418
3419	wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
3420
3421	try std.testing.expectEqual(@as(usize, 1), live);
3422	try std.testing.expectEqualStrings("a", tiles[0].r.session);
3423	var buf: [96]u8 = undefined;
3424	try std.testing.expectEqualStrings("[+1 not shown]", takeNotice(&shared, &buf));
3425	}
3426
3427	test "applyHostList: when a host's last session goes the wall empties, and nothing stands in for the host" {
3428	var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
3429	defer arena.deinit();
3430	const alloc = arena.allocator();
3431	var shared: Shared = undefined;
3432	stoppedWall(alloc, &shared);
3433	var tiles: [4]Tile = undefined;
3434	var present = [_]bool{false} ** 4;
3435	var live: usize = 1;
3436	defer endPumps(tiles[0..live]);
3437	tiles[0] = .{
3438	.r = .{ .target = .{ .sock = "/tmp/box.sock" }, .label = "--sock /tmp/box.sock#a", .session = "a" },
3439	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
3440	.shared = &shared,
3441	.idx = 0,
3442	.wake_r = -1,
3443	.wake_w = -1,
3444	.host = 0,
3445	.alive = std.atomic.Value(bool).init(false),
3446	};
3447	present[0] = true;
3448	try shared.tree.addFirst(0);
3449	var table = [_]Host{testHost(&shared, "box", "/tmp/box.sock")};
3450	// The daemon has nothing left: a restart, or another client ended it.
3451	setList(&table[0], "");
3452
3453	wall_host.applyHostList(alloc, &tiles, &present, &live, &shared, &table, 0);
3454
3455	// The host is up with nothing on it, which the wall says by showing
3456	// nothing: no placeholder tile takes the gone session's place.
3457	try std.testing.expect(!present[0]);
3458	try std.testing.expectEqual(@as(usize, 0), presentCount(present[0..]));
3459	}
3460
3461	test "planHostDiff: a creating tile whose attach has not landed yet is not vanished by the list that raced it" {
3462	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
3463	var tiles = diffFixture(&shared);
3464	// `Ctrl-\ c` picked "b" off the daemon's free list and the tile is
3465	// dialling; `pokeHost` asks for the list at exactly this moment, and
3466	// the daemon answers before the attach that makes "b" lands.
3467	tiles[1].creates = true;
3468	var present = [_]bool{ true, true, true };
3469
3470	var births = BirthNames{};
3471	var vanish = TileIdxs{};
3472	wall_host.planHostDiff(&tiles, &present, 3, 0, "a\n", null, &births, &vanish);
3473	try std.testing.expectEqual(@as(usize, 0), vanish.len);
3474
3475	// ...and once its session exists, the same list does drop it — after
3476	// the one list of grace a live pump gets: a session the daemon HAD and
3477	// no longer lists is gone.
3478	tiles[1].ever_up.store(true, .release);
3479	wall_host.planHostDiff(&tiles, &present, 3, 0, "a\n", null, &births, &vanish);
3480	wall_host.planHostDiff(&tiles, &present, 3, 0, "a\n", null, &births, &vanish);
3481	try std.testing.expectEqual(@as(usize, 1), vanish.len);
3482	try std.testing.expectEqual(@as(usize, 1), vanish.get(0));
3483	}
3484
3485	test "setNoticeIdle: a standing condition waits — a refusal the user just earned is not overwritten" {
3486	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
3487	var buf: [96]u8 = undefined;
3488
3489	// The poll re-derives `[+N not shown]` every second per host, and the
3490	// slot is one: the earned sentence has to survive to a paint.
3491	setNotice(&shared, "[bad host: FlagLikeTarget]");
3492	setNoticeIdle(&shared, "[+2 not shown]");
3493	try std.testing.expectEqualStrings("[bad host: FlagLikeTarget]", takeNotice(&shared, &buf));
3494
3495	// Read, and the standing condition takes the slot it was waiting for.
3496	setNoticeIdle(&shared, "[+2 not shown]");
3497	try std.testing.expectEqualStrings("[+2 not shown]", takeNotice(&shared, &buf));
3498	}
3499
3500	test "hostsOverCapacity: a hosts file past the wall's room is counted out loud, not cut in silence" {
3501	var buf: [64]u8 = undefined;
3502	// Exactly full is not over: the boundary is where a silent cut starts.
3503	try std.testing.expectEqual(@as(?[]const u8, null), wall_host.hostsOverCapacity(&buf, max_tiles));
3504	try std.testing.expectEqual(@as(?[]const u8, null), wall_host.hostsOverCapacity(&buf, 0));
3505	try std.testing.expectEqualStrings(
3506	"[+1 host in the file not shown]",
3507	wall_host.hostsOverCapacity(&buf, max_tiles + 1) orelse "",
3508	);
3509	try std.testing.expectEqualStrings(
3510	"[+9 hosts in the file not shown]",
3511	wall_host.hostsOverCapacity(&buf, max_tiles + 9) orelse "",
3512	);
3513	}
3514
3515	test "endKey: x on a tile that never came up closes the TILE — there is no session to end" {
3516	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
3517	var t = Tile{
3518	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "0" },
3519	.rect = .{ .top = 0, .left = 0, .rows = 4, .cols = 80 },
3520	.shared = &shared,
3521	.idx = 0,
3522	.wake_r = -1,
3523	.wake_w = -1,
3524	};
3525	t.alive.store(true, .release);
3526
3527	// Parked on its first dial: alive, so the old rule stored an ask that
3528	// `dial` never reads — no effect and no sentence, and the session ended
3529	// under the user if the box ever came back.
3530	t.state = .connecting;
3531	try std.testing.expectEqual(EndKey.drop, endKey(&t, 0));
3532
3533	// Once it has been up, the DAEMON owns the ending, reconnect or not.
3534	t.ever_up.store(true, .release);
3535	t.state = .reconnecting;
3536	try std.testing.expectEqual(EndKey{ .ask = .end }, endKey(&t, 0));
3537	t.state = .up;
3538	try std.testing.expectEqual(EndKey{ .ask = .end }, endKey(&t, 0));
3539
3540	// The armed second press forces; the client never decides that itself.
3541	t.end_armed_until.store(1000, .release);
3542	try std.testing.expectEqual(EndKey{ .ask = .end_force }, endKey(&t, 999));
3543	try std.testing.expectEqual(EndKey{ .ask = .end }, endKey(&t, 1000));
3544
3545	// A pump that has ended has nothing to ask over.
3546	t.alive.store(false, .release);
3547	try std.testing.expectEqual(EndKey.none, endKey(&t, 0));
3548	}
3549
3550	test "endRefusal: a refusal is said in this client's words, never in the peer's bytes" {
3551	try std.testing.expectEqualStrings(
3552	"[no such session on that daemon]",
3553	wall_pump.endRefusal(proto.end_reason.no_session),
3554	);
3555	try std.testing.expectEqualStrings(
3556	"[the daemon could not read the end request]",
3557	wall_pump.endRefusal(proto.end_reason.bad_frame),
3558	);
3559	// Anything the daemon does not say: an OSC title set, a CSI, or 260
3560	// bytes of nothing. All three used to reach the terminal verbatim.
3561	try std.testing.expectEqualStrings(
3562	"[the daemon refused to end this session]",
3563	wall_pump.endRefusal("\x1b]0;pwned\x07"),
3564	);
3565	try std.testing.expectEqualStrings(
3566	"[the daemon refused to end this session]",
3567	wall_pump.endRefusal("\x1b[2J"),
3568	);
3569	try std.testing.expectEqualStrings("[the daemon refused to end this session]", wall_pump.endRefusal(""));
3570	}
3571
3572	test "pickerRepaint: a screen cleared under the spelling editor still owes a paint, carrying the half-typed line" {
3573	var f = interact.PrefixFilter{};
3574	var buf: [interact.PrefixFilter.prompt_max + 4]u8 = undefined;
3575
3576	// Nothing is owed while the popup is not up, whatever else happened.
3577	try std.testing.expect(!wall_picker.pickerRepaint(&buf, &f, true).due);
3578
3579	f.picking = true;
3580	const closed = wall_picker.pickerRepaint(&buf, &f, false);
3581	try std.testing.expect(!closed.due);
3582	try std.testing.expectEqual(@as(?[]const u8, null), closed.line);
3583
3584	// The editor is open and a poll on some OTHER host births or vanishes a
3585	// tile: `relayout` clears the whole screen and zeroes the stamp, which
3586	// is the trigger. Skipping the paint here leaves the user typing into an
3587	// editor that is not on the screen, and every key still goes to it.
3588	f.prompting = true;
3589	var typed = [_]u8{ 'b', 'o', 'x' };
3590	for (&typed) \|*c\| _ = f.feed(c[0..1]);
3591	const repair = wall_picker.pickerRepaint(&buf, &f, true);
3592	try std.testing.expect(repair.due);
3593	try std.testing.expectEqualStrings(": box_", repair.line orelse "");
3594	}
3595
3596	test "hostState: the row counts the sessions the wall could show, not the runs in the reply" {
3597	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
3598	var h = Host{
3599	.spec = .{ .spelling = "--sock /a", .target = .{ .sock = "/a" }, .poll_target = .{ .sock = "/a" } },
3600	.shared = &shared,
3601	};
3602	var buf: [32]u8 = undefined;
3603
3604	// Never polled, so nothing is known: `no sessions` here would send the
3605	// user to birth on a machine that is not answering.
3606	try std.testing.expectEqualStrings("connecting", wall_picker.hostState(&buf, &h));
3607
3608	h.applied = true;
3609	const listed = "a\nb\nc\n";
3610	@memcpy(h.list[0..listed.len], listed);
3611	h.list_len = listed.len;
3612	try std.testing.expectEqualStrings("3 sessions", wall_picker.hostState(&buf, &h));
3613
3614	// A row saying `4 sessions` beside three tiles is the row lying about
3615	// the wall: `planHostDiff` births through `validSessionName`, so the
3616	// count reads the reply through the same filter.
3617	const with_junk = "a\nb\n" ++ ("x" ** (proto.session_name_max + 1)) ++ "\nc\n";
3618	@memcpy(h.list[0..with_junk.len], with_junk);
3619	h.list_len = with_junk.len;
3620	try std.testing.expectEqualStrings("3 sessions", wall_picker.hostState(&buf, &h));
3621
3622	h.reachable.store(false, .release);
3623	try std.testing.expectEqualStrings("unreachable", wall_picker.hostState(&buf, &h));
3624	}
3625
3626	test "addHost: a forgotten host's slot comes back, so a and x cannot fill the table between them" {
3627	const alloc = std.testing.allocator;
3628	var tmp = try TmpDir.make();
3629	defer tmp.cleanup();
3630	var path_buf: [256]u8 = undefined;
3631	const path = try std.fmt.bufPrint(&path_buf, "{s}/hosts", .{tmp.path()});
3632	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
3633	defer shared.tree.deinit();
3634
3635	// A FULL table is the only one that can see a forgotten slot refused:
3636	// `hosts_live` only ever grew, so 32 adds spent the wall for good even
3637	// with two rows left in the picker.
3638	var table: [2]Host = undefined;
3639	table[0] = .{ .spec = .{ .spelling = "--sock /a", .target = .{ .sock = "/a" }, .poll_target = .{ .sock = "/a" } }, .shared = &shared };
3640	table[1] = .{ .spec = .{ .spelling = "--sock /b", .target = .{ .sock = "/b" }, .poll_target = .{ .sock = "/b" } }, .shared = &shared };
3641	var n: usize = 2;
3642	var buf: [96]u8 = undefined;
3643	try std.testing.expect(wall_host.addHost(alloc, &shared, &table, &n, "--sock /c", null, 30_000, path) == .refused);
3644	try std.testing.expectEqualStrings("[no room on the wall for another host]", takeNotice(&shared, &buf));
3645
3646	// `x` asks the poller to leave; until it has, the slot is still its own.
3647	// A spec overwritten under a live poller is a thread dialling a target
3648	// that has been replaced.
3649	table[0].forgotten.store(true, .release);
3650	try std.testing.expect(wall_host.addHost(alloc, &shared, &table, &n, "--sock /c", null, 30_000, path) == .refused);
3651	try std.testing.expectEqualStrings("[no room on the wall for another host]", takeNotice(&shared, &buf));
3652
3653	// The poller's last act, and the slot is the wall's again.
3654	table[0].poller_done.store(true, .release);
3655	const at = switch (wall_host.addHost(alloc, &shared, &table, &n, "--sock /c", null, 30_000, path)) {
3656	.added => \|i\| i,
3657	else => return error.HostWasNotAdded,
3658	};
3659	// `run`'s allocator is an ARENA that never returns, so a reused slot's
3660	// old spec is deliberately not freed there; a test outlives its own.
3661	defer alloc.free(table[at].spec.spelling);
3662	try std.testing.expectEqual(@as(usize, 0), at);
3663	try std.testing.expectEqual(@as(usize, 2), n);
3664	try std.testing.expectEqualStrings("/c", table[0].spec.target.sock);
3665	try std.testing.expect(!table[0].forgotten.load(.acquire));
3666	try std.testing.expect(!table[0].poller_done.load(.acquire));
3667	}
3668
3669	test "addHost: the prompt adds a DAEMON — a flag, a session and a host already listed are all refused" {
3670	const alloc = std.testing.allocator;
3671	var tmp = try TmpDir.make();
3672	defer tmp.cleanup();
3673	var path_buf: [256]u8 = undefined;
3674	const path = try std.fmt.bufPrint(&path_buf, "{s}/hosts", .{tmp.path()});
3675	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
3676	defer shared.tree.deinit();
3677	// Two hosts on the wall before the prompt is ever opened: a table that
3678	// only ever held one cannot see an append landing on the wrong row.
3679	var table: [4]Host = undefined;
3680	table[0] = .{ .spec = .{ .spelling = "--sock /a", .target = .{ .sock = "/a" }, .poll_target = .{ .sock = "/a" } }, .shared = &shared };
3681	table[1] = .{ .spec = .{ .spelling = "--sock /b", .target = .{ .sock = "/b" }, .poll_target = .{ .sock = "/b" } }, .shared = &shared };
3682	var n: usize = 2;
3683	var buf: [96]u8 = undefined;
3684
3685	// The typo `mux hosts add -A host` dies at, typed at the prompt
3686	// instead: a host named `-A` is nobody's intent at either mouth.
3687	try std.testing.expect(wall_host.addHost(alloc, &shared, &table, &n, "-A nosuchhost.invalid", null, 30_000, path) == .refused);
3688	try std.testing.expectEqual(@as(usize, 2), n);
3689	try std.testing.expectEqualStrings("[bad host: FlagLikeTarget]", takeNotice(&shared, &buf));
3690
3691	// `#` is the old wall grammar's session split. The prompt names a
3692	// daemon now, and the refusal says which half was one too many.
3693	try std.testing.expect(wall_host.addHost(alloc, &shared, &table, &n, "--sock /c#work", null, 30_000, path) == .refused);
3694	try std.testing.expectEqual(@as(usize, 2), n);
3695	try std.testing.expect(std.mem.indexOf(u8, takeNotice(&shared, &buf), "daemons") != null);
3696
3697	// A real one: it lands in the table AND in the file, because the wall
3698	// the user is looking at and the wall they get back are the same wall.
3699	const at = switch (wall_host.addHost(alloc, &shared, &table, &n, "--sock /c", null, 30_000, path)) {
3700	.added => \|i\| i,
3701	else => return error.HostWasNotAdded,
3702	};
3703	// `run`'s allocator never returns, so the table's copy is deliberately
3704	// never freed there; a test outlives its allocator's bookkeeping.
3705	defer alloc.free(table[at].spec.spelling);
3706	try std.testing.expectEqual(@as(usize, 2), at);
3707	try std.testing.expectEqual(@as(usize, 3), n);
3708	try std.testing.expectEqualStrings("/c", table[2].spec.target.sock);
3709	var h = try hosts.load(alloc, path);
3710	defer h.deinit(alloc);
3711	try std.testing.expect(h.has("--sock /c"));
3712
3713	// Twice is once: the poller is already asking that daemon for its
3714	// sessions, and a second one would tile every one of them again. It
3715	// says so and names the row, because an unchanged popup and an unmoved
3716	// selection is the prompt answering a real host with nothing at all.
3717	try std.testing.expectEqual(
3718	AddHost{ .listed = 2 },
3719	wall_host.addHost(alloc, &shared, &table, &n, "--sock /c", null, 30_000, path),
3720	);
3721	try std.testing.expectEqual(@as(usize, 3), n);
3722	try std.testing.expectEqualStrings("[that host is already on the wall]", takeNotice(&shared, &buf));
3723
3724	// Full is said out loud, not swallowed.
3725	n = table.len;
3726	try std.testing.expect(wall_host.addHost(alloc, &shared, &table, &n, "--sock /d", null, 30_000, path) == .refused);
3727	try std.testing.expectEqualStrings("[no room on the wall for another host]", takeNotice(&shared, &buf));
3728	}
3729
3730	test "x on a tile whose daemon refused arms a second press, and the window closes after 3 s" {
3731	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
3732	defer shared.tree.deinit();
3733	var t: Tile = .{
3734	.r = .{ .target = .{ .sock = "/tmp/a" }, .label = "--sock /tmp/a", .session = "work" },
3735	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
3736	.shared = &shared,
3737	.idx = 0,
3738	.wake_r = -1,
3739	.wake_w = -1,
3740	};
3741	// A first `x` is never a force: the daemon is the one that knows who
3742	// else is attached, so the client asks before it insists.
3743	try std.testing.expectEqual(client.SwitchIntent.end, intentForEnd(&t, 1000));
3744	onEndReply(&t, .{ .accepted = false, .others = 2, .reason = "others attached" }, 1000);
3745	try std.testing.expectEqual(@as(i64, 1000 + end_arm_ms), t.end_armed_until.load(.acquire));
3746	try std.testing.expectEqual(client.SwitchIntent.end_force, intentForEnd(&t, 2500));
3747
3748	// The window SHUTS. Without this an `x` typed minutes later, on a
3749	// session that has picked up watchers since, kills them without asking.
3750	try std.testing.expectEqual(client.SwitchIntent.end, intentForEnd(&t, 4001));
3751
3752	// An accepted end disarms rather than leaving the window standing: the
3753	// reply for the tile that is going must not force the next one.
3754	t.end_armed_until.store(9000, .release);
3755	onEndReply(&t, .{ .accepted = true, .others = 0, .reason = "" }, 5000);
3756	try std.testing.expectEqual(@as(i64, 0), t.end_armed_until.load(.acquire));
3757	}
3758
3759	test "n/p walk the wall's tiles: a hole is stepped over, and a wall of one has nowhere to go" {
3760	// Three slots with the middle one vanished, because the walk `n` used
3761	// to do was one daemon's session ring and the wall is every host's
3762	// sessions — a fixture of two adjacent tiles cannot see the hole.
3763	const three = [_]bool{ true, false, true };
3764	try std.testing.expectEqual(@as(?usize, 2), walkTiles(&three, 0, true));
3765	try std.testing.expectEqual(@as(?usize, 0), walkTiles(&three, 2, true));
3766	try std.testing.expectEqual(@as(?usize, 2), walkTiles(&three, 0, false));
3767	try std.testing.expectEqual(@as(?usize, 0), walkTiles(&three, 2, false));
3768
3769	// One tile is its own neighbour, which is not a move: a focus that
3770	// "moves" to itself releases the terminal and re-claims it for nothing.
3771	const one = [_]bool{ false, true, false };
3772	try std.testing.expectEqual(@as(?usize, null), walkTiles(&one, 1, true));
3773	try std.testing.expectEqual(@as(?usize, null), walkTiles(&one, 1, false));
3774
3775	const none = [_]bool{ false, false };
3776	try std.testing.expectEqual(@as(?usize, null), walkTiles(&none, 0, true));
3777	}
3778
3779	test "birthTile: no room is null and the tree is left as it was" {
3780	const alloc = std.testing.allocator;
3781	// Four rows cannot hold two stacked tiles under a bar: `wallFloors`
3782	// asks min_session_rows + 1 of each. The leaf count pins the undo —
3783	// a birth that refused and kept its insert would leave the tree one
3784	// leaf wider than the wall.
3785	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 4 }, .is_tty = false };
3786	defer shared.tree.deinit();
3787	try shared.tree.addFirst(0);
3788	var tiles: [2]Tile = undefined;
3789	tiles[0] = .{
3790	.r = .{ .target = .{ .sock = "/tmp/a" }, .label = "--sock /tmp/a", .session = "" },
3791	.rect = .{ .top = 0, .left = 0, .rows = 4, .cols = 80 },
3792	.shared = &shared,
3793	.idx = 0,
3794	.wake_r = -1,
3795	.wake_w = -1,
3796	};
3797	var present = [_]bool{ true, false };
3798	var live: usize = 1;
3799	const r: Resolved = .{ .target = .{ .sock = "/tmp/b" }, .label = "--sock /tmp/b#b", .session = "b" };
3800	try std.testing.expectEqual(@as(?usize, null), birthTile(alloc, &tiles, &present, &live, &shared, .{
3801	.r = r,
3802	.from = 0,
3803	.place = .beside_focus,
3804	.creates = true,
3805	.born_from = 0,
3806	}));
3807	try std.testing.expectEqual(@as(usize, 1), live);
3808	try std.testing.expect(!present[1]);
3809	try std.testing.expectEqual(@as(usize, 1), shared.tree.count());
3810	}
3811
3812	test "birthTile: a beside wall admits more panes than rows/3" {
3813	const alloc = std.testing.allocator;
3814	// Nine panes side by side on 24x200: every one keeps all 24 rows and
3815	// 8 rails plus 9 columns of 21 fit inside 200. A rows/n admission test
3816	// refuses this at the 9th (24/9 = 2), capping ANY terminal at rows/3
3817	// panes however wide it is. The tree owns the answer.
3818	const n = 9;
3819	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 200, .rows = 24 }, .is_tty = false };
3820	defer shared.tree.deinit();
3821	try shared.tree.addFirst(0);
3822	var tiles: [n]Tile = undefined;
3823	var present = [_]bool{false} ** n;
3824	var live: usize = 0;
3825	var i: u8 = 0;
3826	while (i < n - 1) : (i += 1) {
3827	if (i > 0) {
3828	try shared.tree.insert(i - 1, i);
3829	// `insert` wraps a bare root leaf in `.stacked`; a wide
3830	// terminal's wall is cut the other way (`rootOrient`).
3831	if (i == 1) shared.tree.setRootOrient(.beside);
3832	}
3833	tiles[i] = .{
3834	.r = .{ .target = .{ .sock = "/tmp/a" }, .label = "--sock /tmp/a", .session = "" },
3835	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 21 },
3836	.shared = &shared,
3837	.idx = i,
3838	.wake_r = -1,
3839	.wake_w = -1,
3840	};
3841	present[i] = true;
3842	live += 1;
3843	}
3844	const r: Resolved = .{ .target = .{ .sock = "/tmp/b" }, .label = "--sock /tmp/b#b", .session = "b" };
3845	const at = birthTile(alloc, &tiles, &present, &live, &shared, .{
3846	.r = r,
3847	.from = n - 2,
3848	.place = .beside_focus,
3849	.creates = true,
3850	.born_from = n - 2,
3851	// Borrowed, so the tile gets copies of its own: these are literals,
3852	// and `Birth.borrowed = false` promises the slot's next reuse two
3853	// slices it may free.
3854	.borrowed = true,
3855	}) orelse return error.TestUnexpectedResult;
3856	defer std.posix.close(tiles[at].wake_r);
3857	defer std.posix.close(tiles[at].wake_w);
3858	defer alloc.free(tiles[at].r.session);
3859	defer alloc.free(tiles[at].r.label);
3860	try std.testing.expectEqual(@as(usize, n), shared.tree.count());
3861	// Admitted AND habitable: every pane keeps the full height and clears
3862	// the column floor, which is what makes the refusal wrong.
3863	const flat = try shared.tree.flatten(alloc, 24, 200, wall_layout.wallFloors(n), null);
3864	defer flat.deinit(alloc);
3865	try std.testing.expectEqual(@as(usize, n), flat.placed.len);
3866	for (flat.placed) \|p\| {
3867	try std.testing.expectEqual(@as(u16, 24), p.rect.rows);
3868	try std.testing.expect(p.rect.cols >= proto.min_session_cols);
3869	}
3870	}
3871
3872	test "birthTile: a vanished digit is taken back, and not before its pump returned" {
3873	const alloc = std.testing.allocator;
3874	// Five slots on a wall wide enough for all of them: the claim is which
3875	// digit a birth lands on, so no refusal may decide it instead.
3876	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 200, .rows = 24 }, .is_tty = false };
3877	defer shared.tree.deinit();
3878	try shared.tree.addFirst(0);
3879	var tiles: [5]Tile = undefined;
3880	var present = [_]bool{ true, false, false, false, false };
3881	var live: usize = 1;
3882	const target: client.Target = .{ .sock = "/tmp/a" };
3883	tiles[0] = .{
3884	.r = .{ .target = target, .label = "--sock /tmp/a#0", .session = "0" },
3885	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 200 },
3886	.shared = &shared,
3887	.idx = 0,
3888	.wake_r = -1,
3889	.wake_w = -1,
3890	};
3891	// Every other tile is born the way a host's poll births one, so the
3892	// copies a reuse has to free are the real owned ones.
3893	defer for (tiles[1..], present[1..]) \|*t, p\| {
3894	if (!p) continue;
3895	alloc.free(t.r.session);
3896	alloc.free(t.r.label);
3897	std.posix.close(t.wake_r);
3898	std.posix.close(t.wake_w);
3899	};
3900	const born = struct {
3901	fn at(a: std.mem.Allocator, ts: []Tile, ps: []bool, lv: usize, sh: Shared, tg: client.Target, name: []const u8, host: ?usize) ?usize {
3902	return birthTile(a, ts, ps, lv, sh, .{
3903	.r = .{ .target = tg, .label = "", .session = name },
3904	.from = 0,
3905	.place = .beside_focus,
3906	.creates = true,
3907	.born_from = 0,
3908	.host = host,
3909	.borrowed = true,
3910	});
3911	}
3912	}.at;
3913
3914	try std.testing.expectEqual(@as(?usize, 1), born(alloc, &tiles, &present, &live, &shared, target, "1", 3));
3915	try std.testing.expectEqual(@as(?usize, 2), born(alloc, &tiles, &present, &live, &shared, target, "2", 3));
3916
3917	// The middle tile leaves, carrying a full set of dirt: every one of
3918	// these is a field whose stale value would be a lie about the NEXT
3919	// tile in the slot — a session that was never up, a list that never
3920	// missed it, an `x` nobody pressed, a host that does not own it.
3921	tiles[1].ever_up.store(true, .release);
3922	tiles[1].missed_once = true;
3923	tiles[1].end_armed_until.store(9000, .release);
3924	const doorbell = tiles[1].wake_r;
3925	vanishTile(&tiles, &present, &shared, 1, null);
3926
3927	// Its pump has not returned, so the digit is not free yet: the birth
3928	// appends rather than hand a live thread's `*Tile` to a new tile.
3929	try std.testing.expectEqual(@as(?usize, 3), born(alloc, &tiles, &present, &live, &shared, target, "3", 3));
3930
3931	tiles[1].pump_done.store(true, .release);
3932	try std.testing.expectEqual(@as(?usize, 1), born(alloc, &tiles, &present, &live, &shared, target, "1", null));
3933	// Reuse, not growth: the wall is four tiles wide, not five.
3934	try std.testing.expectEqual(@as(usize, 4), live);
3935	try std.testing.expectEqual(@as(usize, 1), tiles[1].idx);
3936	try std.testing.expect(!tiles[1].ever_up.load(.acquire));
3937	try std.testing.expect(!tiles[1].missed_once);
3938	try std.testing.expectEqual(@as(i64, 0), tiles[1].end_armed_until.load(.acquire));
3939	try std.testing.expectEqual(@as(?usize, null), tiles[1].host);
3940	try std.testing.expect(!tiles[1].pump_done.load(.acquire));
3941	// The doorbell is the slot's, not the tile's: a fresh pipe per reuse
3942	// would leak the fd pair the old one is never closed on.
3943	try std.testing.expectEqual(doorbell, tiles[1].wake_r);
3944	}
3945
3946	test "birthTile: the digit's next tile frees the copies an unborrowed birth handed over" {
3947	const alloc = std.testing.allocator;
3948	// `Birth.borrowed = false` hands the tile two slices outright, and the
3949	// birth that takes its digit back is what frees them. The testing
3950	// allocator is the whole oracle: a slice it never handed out aborts the
3951	// free, and one nobody frees is reported leaked — which is what a
3952	// caller passing a literal and a reuse that kept the old copies each
3953	// look like.
3954	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 200, .rows = 24 }, .is_tty = false };
3955	defer shared.tree.deinit();
3956	try shared.tree.addFirst(0);
3957	var tiles: [3]Tile = undefined;
3958	var present = [_]bool{ true, false, false };
3959	var live: usize = 1;
3960	const target: client.Target = .{ .sock = "/tmp/a" };
3961	tiles[0] = .{
3962	.r = .{ .target = target, .label = "--sock /tmp/a#0", .session = "0" },
3963	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 200 },
3964	.shared = &shared,
3965	.idx = 0,
3966	.wake_r = -1,
3967	.wake_w = -1,
3968	};
3969	// The chord's road, verbatim: the caller allocates, `birthTile` takes
3970	// the slices as they are.
3971	const handed = struct {
3972	fn birth(
3973	a: std.mem.Allocator,
3974	ts: []Tile,
3975	ps: []bool,
3976	lv: *usize,
3977	sh: *Shared,
3978	tg: client.Target,
3979	name: []const u8,
3980	) ?usize {
3981	const session = a.dupe(u8, name) catch return null;
3982	const label = tileLabel(a, tg, session) catch {
3983	a.free(session);
3984	return null;
3985	};
3986	return birthTile(a, ts, ps, lv, sh, .{
3987	.r = .{ .target = tg, .label = label, .session = session },
3988	.from = 0,
3989	.place = .beside_focus,
3990	.creates = true,
3991	.born_from = 0,
3992	});
3993	}
3994	}.birth;
3995
3996	const first = handed(alloc, &tiles, &present, &live, &shared, target, "1") orelse
3997	return error.TestUnexpectedResult;
3998	try std.testing.expectEqual(@as(usize, 1), first);
3999	defer if (present[1]) {
4000	alloc.free(tiles[1].r.session);
4001	alloc.free(tiles[1].r.label);
4002	std.posix.close(tiles[1].wake_r);
4003	std.posix.close(tiles[1].wake_w);
4004	};
4005
4006	vanishTile(&tiles, &present, &shared, 1, null);
4007	tiles[1].pump_done.store(true, .release);
4008	// The same digit, so the free under test is one this birth really did.
4009	try std.testing.expectEqual(
4010	@as(?usize, 1),
4011	handed(alloc, &tiles, &present, &live, &shared, target, "2"),
4012	);
4013	}
4014
4015	test "labelText: the state word survives truncation at every width" {
4016	var buf: [256]u8 = undefined;
4017	// A label longer than any bar, so truncation is what is under test and
4018	// not the label's own length.
4019	const long = "x" ** 400;
4020
4021	// The markers are the ones a bar actually carries: three bytes with the
4022	// chord digit, four for tiles 10 and up. Every one of them comes out of
4023	// the label's cut, so the marker width is part of what this pins — a
4024	// two-byte marker exercises no bar that ships.
4025
4026	// Narrow: the label is cut, the bar fits the terminal, the state stays.
4027	const narrow = labelText(&buf, 30, "1> ", long, "up");
4028	if (!std.mem.endsWith(u8, narrow, " [up]")) return error.OneDigitNarrowBarLostTheStateWord;
4029	if (narrow.len > 30) return error.OneDigitNarrowBarOverranTheTerminal;
4030
4031	// The same width with the widest marker: the two extra bytes come off
4032	// the label, never off the state.
4033	const narrow2 = labelText(&buf, 30, "12 ", long, "up");
4034	if (!std.mem.endsWith(u8, narrow2, " [up]")) return error.TwoDigitNarrowBarLostTheStateWord;
4035	if (narrow2.len > 30) return error.TwoDigitNarrowBarOverranTheTerminal;
4036
4037	// Wide: `cols` alone would have asked for more than `buf` holds, and the
4038	// failed bufPrint used to hand back the buffer's undefined bytes — with
4039	// the state word among what was lost.
4040	const wide = labelText(&buf, 300, "12> ", long, "reconnecting");
4041	if (!std.mem.endsWith(u8, wide, " [reconnecting]")) return error.TwoDigitWideBarLostTheStateWord;
4042	if (wide.len > buf.len) return error.TwoDigitWideBarOverranItsBuffer;
4043
4044	// Wider than `buf` with the longest status word a bar can carry: the
4045	// bound that matters is `buf`'s, and it is not `cols`'.
4046	const widest = labelText(&buf, 400, "12 ", long, State.reconnecting.word());
4047	if (!std.mem.endsWith(u8, widest, " [reconnecting]")) return error.TwoDigitWidestBarLostTheStateWord;
4048	if (widest.len > buf.len) return error.TwoDigitWidestBarOverranItsBuffer;
4049	}
4050
4051	/// A wall of `n` tiles with none forgotten.
4052	fn allPresent(comptime n: usize) [n]bool {
4053	return [_]bool{true} ** n;
4054	}
4055
4056	test "showsSelf: the wall never tiles the session the walling shell is standing in" {
4057	const sock = "/run/user/1000/muxd.sock";
4058	const target: client.Target = .{ .sock = sock };
4059
4060	// The case: `mux --session 1` typed in session 0's shell. Session 0 is
4061	// on the host's own list, and tiling it would paint that session's
4062	// stripe into the grid it is reading.
4063	try std.testing.expect(showsSelf(target, "0", sock, "0"));
4064	// The empty name is the wire's spelling of the default, and the daemon
4065	// plants the resolved one.
4066	try std.testing.expect(showsSelf(target, "", sock, "0"));
4067	try std.testing.expect(showsSelf(target, "work", sock, "work"));
4068
4069	// Every other session of the same daemon is exactly what the wall is
4070	// for — it must not drop those.
4071	try std.testing.expect(!showsSelf(target, "1", sock, "0"));
4072	try std.testing.expect(!showsSelf(target, "", sock, "1"));
4073	// A different daemon's socket is a different session whatever it is
4074	// called.
4075	try std.testing.expect(!showsSelf(target, "0", "/run/user/1000/other.sock", "0"));
4076	// Not a unix socket: a quic:// or --via target cannot be the daemon
4077	// whose shell planted these.
4078	try std.testing.expect(!showsSelf(.{ .via = "ssh host muxd proxy" }, "0", sock, "0"));
4079
4080	// Unset, and the emptied spelling of unset that the self-attach
4081	// refusal names as the way to override it.
4082	try std.testing.expect(!showsSelf(target, "0", null, "0"));
4083	try std.testing.expect(!showsSelf(target, "0", sock, null));
4084	try std.testing.expect(!showsSelf(target, "0", "", "0"));
4085	try std.testing.expect(!showsSelf(target, "0", sock, ""));
4086	}
4087
4088	/// Only the fields `endAction` reads: a whole Tile describes the pump, not
4089	/// the rule.
4090	fn endBench(
4091	tiles: []Tile,
4092	shared: *Shared,
4093	ended: usize,
4094	reason: EndReason,
4095	code: u8,
4096	born_from: ?usize,
4097	) void {
4098	for (tiles, 0..) \|*t, i\| {
4099	t.* = .{
4100	.r = .{ .target = .{ .sock = "/s" }, .label = "t", .session = "" },
4101	.rect = .{ .top = 0, .left = 0, .rows = 2, .cols = 80 },
4102	.shared = shared,
4103	.idx = i,
4104	};
4105	}
4106	tiles[ended].end.store(@intFromEnum(reason), .release);
4107	tiles[ended].code.store(code, .release);
4108	tiles[ended].born_from = born_from;
4109	}
4110
4111	test "sendKeys: a chunk that does not fit is dropped whole, and says so" {
4112	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
4113	var t = Tile{
4114	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
4115	.rect = .{ .top = 0, .left = 0, .rows = 4, .cols = 80 },
4116	.shared = &shared,
4117	.idx = 0,
4118	// -1 both ends: `ring` writes to the doorbell and ignores the
4119	// failure, which is exactly what it promises to do.
4120	.wake_r = -1,
4121	.wake_w = -1,
4122	};
4123
4124	const head = "abc";
4125	sendKeys(&t, head);
4126	try std.testing.expectEqual(@as(usize, 3), t.in_len);
4127	try std.testing.expect(!t.in_dropped.load(.acquire));
4128
4129	// One byte more than the room left. The old code copied what fit.
4130	const too_big = [_]u8{'z'} ** (mailbox_max - 2);
4131	sendKeys(&t, &too_big);
4132	try std.testing.expectEqual(@as(usize, 3), t.in_len);
4133	try std.testing.expect(t.in_dropped.load(.acquire));
4134
4135	// ...and the mailbox still holds exactly what was typed before it, so
4136	// the next chunk cannot splice onto a half-delivered one.
4137	sendKeys(&t, "def");
4138	var out: [mailbox_max]u8 = undefined;
4139	try std.testing.expectEqualStrings("abcdef", wall_pump.takeKeys(&t, &out));
4140
4141	// Exactly filling it is not overflow — the bound is `>`, not `>=`.
4142	const exact = [_]u8{'q'} ** mailbox_max;
4143	t.in_dropped.store(false, .release);
4144	sendKeys(&t, &exact);
4145	try std.testing.expectEqual(@as(usize, mailbox_max), t.in_len);
4146	try std.testing.expect(!t.in_dropped.load(.acquire));
4147	}
4148
4149	test "labelText: a dropped chunk is narrated beside the state that caused it" {
4150	// The bar's own format, asserted through the same truncation path the
4151	// states go through, because "reconnecting, input dropped" is now the
4152	// longest thing a bar can say and `buf`'s bound is what it tests.
4153	var buf: [256]u8 = undefined;
4154	const long = "x" ** 400;
4155	const said = labelText(&buf, 300, "> ", long, "reconnecting, input dropped");
4156	try std.testing.expect(std.mem.endsWith(u8, said, " [reconnecting, input dropped]"));
4157	try std.testing.expect(said.len <= buf.len);
4158	}
4159
4160	test "noticeText: the banner says what the exit line says, whichever sentence it is" {
4161	var buf: [128]u8 = undefined;
4162	// Both sentences a vanish can carry. A notice that names a cause the
4163	// stderr line contradicts is worse than either alone.
4164	try std.testing.expectEqualStrings(
4165	"[cannot create a new session (daemon full?)]",
4166	noticeText(&buf, "mux: cannot create a new session (daemon full?)"),
4167	);
4168	try std.testing.expectEqualStrings(
4169	"[cannot create a new session (daemon unreachable)]",
4170	noticeText(&buf, "mux: cannot create a new session (daemon unreachable)"),
4171	);
4172	// A sentence that never wore the prefix keeps all of its words.
4173	try std.testing.expectEqualStrings("[detached]", noticeText(&buf, "detached"));
4174	}
4175
4176	test "resolveHost refuses a sun_path-overflowing sock path" {
4177	const alloc = std.testing.allocator;
4178	// Refused at usage altitude, not at a connect that fails with a
4179	// truncated sun_path nobody typed.
4180	const long = "--sock /" ++ "x" ** 200;
4181	try std.testing.expectError(error.SockPathTooLong, resolveHost(alloc, long, null, 30_000));
4182	}
4183
4184	test "resolveHost: an ssh host is polled by a recipe that cannot prompt and cannot narrate" {
4185	var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
4186	defer arena.deinit();
4187	const alloc = arena.allocator();
4188
4189	// Two spellings, because the poll target is built per host and a shared
4190	// one would point every stripe at the first host's ssh line.
4191	for ([_][]const u8{ "box", "user@gate" }) \|spelling\| {
4192	const spec = try resolveHost(alloc, spelling, null, 30_000);
4193	try std.testing.expect(std.mem.indexOf(u8, spec.poll_target.hand.ssh_cmd, "BatchMode=yes") != null);
4194	try std.testing.expectEqualStrings(spelling, spec.poll_target.hand.host);
4195	// The attach the user sees must still be able to ask for a password.
4196	try std.testing.expect(std.mem.indexOf(u8, spec.target.hand.ssh_cmd, "BatchMode") == null);
4197	// Neither door narrates a fallback: both are dialled under a wall
4198	// that owns the alternate screen.
4199	try std.testing.expect(!spec.target.hand.asked);
4200	try std.testing.expect(!spec.poll_target.hand.asked);
4201	}
4202
4203	// A transport that cannot prompt has one target, not a copy of one.
4204	const s = try resolveHost(alloc, "--sock /tmp/a.sock", null, 30_000);
4205	try std.testing.expectEqualStrings(s.target.sock, s.poll_target.sock);
4206	}
4207
4208	test "pollDelayMs: a poll that cost an ssh login is asked ten times less often" {
4209	// The whole point of the number: a pipe-answered poll spawned `ssh`,
4210	// read the announce and killed it — a remote auth log line per cycle.
4211	try std.testing.expectEqual(@as(u64, 10_000), wall_host.pollDelayMs(.pipe));
4212	try std.testing.expectEqual(@as(u64, 1_000), wall_host.pollDelayMs(.fd));
4213	try std.testing.expectEqual(@as(u64, 1_000), wall_host.pollDelayMs(.quic));
4214	}
4215
4216	test "endAction: on a terminal the last tile's exit leaves an empty wall, not an exit" {
4217	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
4218	var tiles: [3]Tile = undefined;
4219	const one = [_]bool{ true, false, false };
4220
4221	// `x` ends a session, never the program: the wall stays up with the
4222	// picker over it, and the machines are still there to birth on. There
4223	// is no tile left to hand the focus to, which is what `back` says.
4224	endBench(&tiles, &shared, 0, .exited, 7, null);
4225	try std.testing.expectEqual(
4226	EndAction{ .vanish = .{ .back = null, .msg = null } },
4227	endAction(&tiles, &one, 3, 0, true, true),
4228	);
4229
4230	// The piped half is unchanged and load-bearing: a wall of one with no
4231	// keyboard is what a script runs, and it exits with the shell's code.
4232	endBench(&tiles, &shared, 0, .exited, 7, null);
4233	try std.testing.expectEqual(
4234	EndAction{ .finish = .{ .code = 7, .msg = null } },
4235	endAction(&tiles, &one, 3, 0, true, false),
4236	);
4237	}
4238
4239	test "endAction: a birth the picker made into a standing wall is refused ON it, not out of mux" {
4240	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
4241	var tiles: [3]Tile = undefined;
4242	const one = [_]bool{ true, false, false };
4243
4244	// The headline path: the wall's last session ends, the picker opens
4245	// itself, Enter lands on a daemon that is full. There was no anchor to
4246	// hand the focus back to, so `born_from` is null — and the ENTRY tile
4247	// carries null for the opposite reason, which is why the flag exists.
4248	endBench(&tiles, &shared, 0, .refused, 0, null);
4249	tiles[0].keeps_wall = true;
4250	try std.testing.expectEqual(
4251	EndAction{ .vanish = .{ .back = null, .msg = "mux: cannot create a new session (daemon full?)" } },
4252	endAction(&tiles, &one, 3, 0, true, true),
4253	);
4254
4255	// A box that never answered: the picker advertises `unreachable` rows
4256	// as a place to press Enter, so this is a designed path, not a fault.
4257	endBench(&tiles, &shared, 0, .lost, 0, null);
4258	tiles[0].keeps_wall = true;
4259	try std.testing.expectEqual(
4260	EndAction{ .vanish = .{ .back = null, .msg = "mux: cannot create a new session (daemon unreachable)" } },
4261	endAction(&tiles, &one, 3, 0, true, true),
4262	);
4263
4264	// Nothing refused anything here, and the wall still stands.
4265	endBench(&tiles, &shared, 0, .no_thread, 0, null);
4266	tiles[0].keeps_wall = true;
4267	try std.testing.expectEqual(
4268	EndAction{ .vanish = .{ .back = null, .msg = "mux: could not start a thread for this session" } },
4269	endAction(&tiles, &one, 3, 0, true, true),
4270	);
4271
4272	// The entry tile of `mux TARGET` is the wall, and its refusal is mux's:
4273	// a script reads the code.
4274	endBench(&tiles, &shared, 0, .refused, 0, null);
4275	try std.testing.expectEqual(
4276	EndAction{ .finish = .{ .code = 1, .msg = "mux: attach refused or no state received (session full?)" } },
4277	endAction(&tiles, &one, 3, 0, true, true),
4278	);
4279
4280	// ...and a piped `mux` has no wall to leave standing, flag or no flag.
4281	endBench(&tiles, &shared, 0, .refused, 0, null);
4282	tiles[0].keeps_wall = true;
4283	try std.testing.expectEqual(
4284	EndAction{ .finish = .{ .code = 1, .msg = "mux: attach refused or no state received (session full?)" } },
4285	endAction(&tiles, &one, 3, 0, true, false),
4286	);
4287	}
4288
4289	test "endAction: the only tile's ending is mux's, and so is any ending nobody can leave" {
4290	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
4291	var tiles: [3]Tile = undefined;
4292	const one = [_]bool{ true, false, false };
4293	const two = [_]bool{ true, true, false };
4294
4295	// One tile, shell exited: the code is mux's, which is what keeps `mux`
4296	// something you can put in a script.
4297	endBench(&tiles, &shared, 0, .exited, 7, null);
4298	try std.testing.expectEqual(
4299	EndAction{ .finish = .{ .code = 7, .msg = null } },
4300	endAction(&tiles, &one, 3, 0, true, false),
4301	);
4302
4303	// Two tiles: the exit vanishes — a dead stripe for a cleanly exited
4304	// shell is noise — and the wall re-cuts onto the survivor.
4305	endBench(&tiles, &shared, 0, .exited, 7, null);
4306	try std.testing.expectEqual(
4307	EndAction{ .vanish = .{ .back = 1, .msg = null } },
4308	endAction(&tiles, &two, 3, 0, true, false),
4309	);
4310
4311	// ...but not once stdin has closed. A piped `mux` with no keyboard
4312	// waits in poll forever with the code in hand — reproduced at RC=124
4313	// before this argument existed, which is the whole reason the rule is
4314	// stated in one pure function and not at the read that happens to
4315	// notice EOF.
4316	endBench(&tiles, &shared, 0, .exited, 7, null);
4317	try std.testing.expectEqual(
4318	EndAction{ .finish = .{ .code = 7, .msg = null } },
4319	endAction(&tiles, &two, 3, 0, false, false),
4320	);
4321
4322	// A tile the user already forgot is not company: `present`, never the
4323	// wall's length, is what "somewhere to go" counts.
4324	const one_left = [_]bool{ true, false, false };
4325	endBench(&tiles, &shared, 0, .exited, 3, null);
4326	try std.testing.expectEqual(
4327	EndAction{ .finish = .{ .code = 3, .msg = null } },
4328	endAction(&tiles, &one_left, 3, 0, true, false),
4329	);
4330	}
4331
4332	test "endAction: a refusal a chord earned goes back where the chord was typed" {
4333	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
4334	var tiles: [3]Tile = undefined;
4335	const two = [_]bool{ true, true, false };
4336
4337	// The plain client's `.refused` recovery: the daemon would not create
4338	// the session, and the chord-born tile leaves with no trace — the
4339	// sentence is the record a script reads, the survivor the screen.
4340	endBench(&tiles, &shared, 1, .refused, 1, 0);
4341	try std.testing.expectEqual(
4342	EndAction{ .vanish = .{ .back = 0, .msg = "mux: cannot create a new session (daemon full?)" } },
4343	endAction(&tiles, &two, 3, 1, true, false),
4344	);
4345
4346	// It outranks the closed stdin, because vanishing lands on a live
4347	// SESSION rather than on nothing: whatever ends that one ends the run.
4348	endBench(&tiles, &shared, 1, .refused, 1, 0);
4349	try std.testing.expectEqual(
4350	EndAction{ .vanish = .{ .back = 0, .msg = "mux: cannot create a new session (daemon full?)" } },
4351	endAction(&tiles, &two, 3, 1, false, false),
4352	);
4353
4354	// A daemon that never answered is not a daemon that answered and said
4355	// no. `x` on the last LOCAL session ends the local daemon, so a wall
4356	// whose own machine has gone is exactly how this arrives — and "full?"
4357	// would send the user hunting for sessions that are not there.
4358	endBench(&tiles, &shared, 1, .lost, 1, 0);
4359	try std.testing.expectEqual(
4360	EndAction{ .vanish = .{ .back = 0, .msg = "mux: cannot create a new session (daemon unreachable)" } },
4361	endAction(&tiles, &two, 3, 1, true, false),
4362	);
4363
4364	// ...but a chord-born tile that HAD its session and lost the link later
4365	// is not a failed creation at all: it keeps its rect and narrates, like
4366	// any other lost tile.
4367	endBench(&tiles, &shared, 1, .lost, 1, 0);
4368	tiles[1].ever_up.store(true, .release);
4369	try std.testing.expectEqual(
4370	EndAction{ .refocus = 0 },
4371	endAction(&tiles, &two, 3, 1, true, false),
4372	);
4373
4374	// A refusal with nowhere to fall back to is an ending like any other,
4375	// and says the thing the plain client said.
4376	endBench(&tiles, &shared, 0, .refused, 1, null);
4377	const one = [_]bool{ true, false, false };
4378	const out = endAction(&tiles, &one, 3, 0, true, false);
4379	try std.testing.expectEqual(@as(u8, 1), out.finish.code);
4380	try std.testing.expectEqualStrings(
4381	"mux: attach refused or no state received (session full?)",
4382	out.finish.msg.?,
4383	);
4384
4385	// ...and so is one whose fall-back tile the user forgot meanwhile.
4386	endBench(&tiles, &shared, 1, .refused, 1, 0);
4387	const gone_back = [_]bool{ false, true, false };
4388	try std.testing.expectEqual(
4389	@as(u8, 1),
4390	endAction(&tiles, &gone_back, 3, 1, true, false).finish.code,
4391	);
4392	}
4393
4394	test "endAction: an exited session's tile vanishes; a lost one narrates" {
4395	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
4396	var tiles: [3]Tile = undefined;
4397	const two = [_]bool{ true, true, false };
4398
4399	// A clean exit is noise once it is over: the tile leaves, the wall
4400	// re-cuts, and nothing is said.
4401	endBench(&tiles, &shared, 0, .exited, 7, null);
4402	try std.testing.expectEqual(
4403	EndAction{ .vanish = .{ .back = 1, .msg = null } },
4404	endAction(&tiles, &two, 3, 0, true, false),
4405	);
4406
4407	// A lost link can heal: the tile keeps its rect and its bar, and the
4408	// focus steps to the next present tile rather than the tile leaving.
4409	endBench(&tiles, &shared, 0, .lost, 1, null);
4410	try std.testing.expectEqual(
4411	EndAction{ .refocus = 1 },
4412	endAction(&tiles, &two, 3, 0, true, false),
4413	);
4414
4415	// The last present tile exiting is still mux's own ending, with the
4416	// shell's code — `mux` in a script is the thing that ran the shell.
4417	endBench(&tiles, &shared, 0, .exited, 3, null);
4418	const one = [_]bool{ true, false, false };
4419	try std.testing.expectEqual(
4420	EndAction{ .finish = .{ .code = 3, .msg = null } },
4421	endAction(&tiles, &one, 3, 0, true, false),
4422	);
4423	}
4424
4425	test "endAction: a vanishing tile hands focus to a live neighbour, not a corpse" {
4426	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
4427	var tiles: [3]Tile = undefined;
4428	const two = [_]bool{ true, true, false };
4429
4430	// Tile 0 (focused) has just exited — its pump is dead. Tile 1 is
4431	// present but dead (pump ended, narrating a lost link). With no live
4432	// neighbour, the back-target falls back to the dead tile (the wall
4433	// still shows it), but with a live third tile, focus lands there.
4434	endBench(&tiles, &shared, 0, .exited, 7, null);
4435	tiles[0].alive.store(false, .release);
4436	tiles[1].alive.store(false, .release);
4437	tiles[1].end.store(@intFromEnum(EndReason.lost), .release);
4438	tiles[1].end_seen = true;
4439	// Two tiles, both dead: fallback to the present-only step.
4440	const out_dead = endAction(&tiles, &two, 3, 0, true, false);
4441	try std.testing.expect(out_dead == .vanish);
4442	try std.testing.expectEqual(@as(usize, 1), out_dead.vanish.back);
4443
4444	// Three tiles: 0 dead ending, 1 dead narrating, 2 alive. Focus must
4445	// land on tile 2, the live neighbour — never the dead tile 1.
4446	const three = [_]bool{ true, true, true };
4447	endBench(&tiles, &shared, 0, .exited, 7, null);
4448	tiles[0].alive.store(false, .release);
4449	tiles[1].alive.store(false, .release);
4450	tiles[1].end.store(@intFromEnum(EndReason.lost), .release);
4451	tiles[1].end_seen = true;
4452	const out_live = endAction(&tiles, &three, 3, 0, true, false);
4453	try std.testing.expect(out_live == .vanish);
4454	try std.testing.expectEqual(@as(usize, 2), out_live.vanish.back);
4455	}
4456
4457	test "viewRows: a one-tile wall keeps every row, a multi-tile wall loses the label bar" {
4458	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
4459	// A one-tile wall: no label bar, the tile claims every row.
4460	shared.label_rows = 0;
4461	var t0 = Tile{
4462	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
4463	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
4464	.shared = &shared,
4465	.idx = 0,
4466	.wake_r = -1,
4467	.wake_w = -1,
4468	};
4469	try std.testing.expectEqual(@as(u16, 24), t0.viewRows());
4470
4471	// A two-tile wall: each tile loses one row to the label bar.
4472	shared.label_rows = 1;
4473	var t1 = Tile{
4474	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
4475	.rect = .{ .top = 0, .left = 0, .rows = 12, .cols = 80 },
4476	.shared = &shared,
4477	.idx = 0,
4478	.wake_r = -1,
4479	.wake_w = -1,
4480	};
4481	var t2 = Tile{
4482	.r = .{ .target = .{ .sock = "/tmp/y" }, .label = "y", .session = "" },
4483	.rect = .{ .top = 12, .left = 0, .rows = 12, .cols = 80 },
4484	.shared = &shared,
4485	.idx = 1,
4486	.wake_r = -1,
4487	.wake_w = -1,
4488	};
4489	try std.testing.expectEqual(@as(u16, 11), t1.viewRows());
4490	try std.testing.expectEqual(@as(u16, 11), t2.viewRows());
4491	}
4492
4493	test "relayout sets resize_pending on every live tile" {
4494	const alloc = std.testing.allocator;
4495	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
4496	shared.tree = layout.Tree.init(alloc);
4497	shared.flat_alloc = alloc;
4498	defer shared.tree.deinit();
4499	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
4500	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
4501	try shared.tree.addFirst(0);
4502	try shared.tree.insert(0, 1);
4503	const tiles = try alloc.alloc(Tile, 2);
4504	defer alloc.free(tiles);
4505	const present = try alloc.alloc(bool, 2);
4506	defer alloc.free(present);
4507	present[0] = true;
4508	present[1] = true;
4509	for (tiles, 0..) \|*t, i\| {
4510	t.* = Tile{
4511	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
4512	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
4513	.shared = &shared,
4514	.idx = i,
4515	.wake_r = -1,
4516	.wake_w = -1,
4517	};
4518	}
4519	wall_layout.relayout(alloc, tiles, present, &shared, 0);
4520	// Two tiles: a label bar appears.
4521	try std.testing.expectEqual(@as(u8, 1), shared.label_rows);
4522	// Every tile is doorbelled: its pump sends the new rect.
4523	try std.testing.expect(tiles[0].resize_pending);
4524	try std.testing.expect(tiles[1].resize_pending);
4525	}
4526
4527	// A pump, reduced to the one thing this test judges: it takes passes, and
4528	// remembers the content size the pass told it to send.
4529	const ResizeWitness = struct {
4530	t: *Tile,
4531	stop: std.atomic.Value(bool) = std.atomic.Value(bool).init(false),
4532	sent: std.atomic.Value(u32) = std.atomic.Value(u32).init(0),
4533	passes: std.atomic.Value(u64) = std.atomic.Value(u64).init(0),
4534
4535	fn run(w: *ResizeWitness) void {
4536	while (!w.stop.load(.acquire)) {
4537	const p = wall_pump.takePass(w.t);
4538	if (p.resize) w.sent.store(pack(p.cols, p.rows -\| p.label_rows), .release);
4539	_ = w.passes.fetchAdd(1, .release);
4540	}
4541	}
4542
4543	fn pack(cols: u16, rows: u16) u32 {
4544	return (@as(u32, cols) << 16) \| @as(u32, rows);
4545	}
4546	};
4547
4548	test "a relayout landing mid-pass is still sent" {
4549	const alloc = std.testing.allocator;
4550	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
4551	shared.tree = layout.Tree.init(alloc);
4552	shared.flat_alloc = alloc;
4553	defer shared.tree.deinit();
4554	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
4555	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
4556	try shared.tree.addFirst(0);
4557	try shared.tree.insert(0, 1);
4558	const tiles = try alloc.alloc(Tile, 2);
4559	defer alloc.free(tiles);
4560	const present = [_]bool{ true, true };
4561	for (tiles, 0..) \|*t, i\| {
4562	t.* = Tile{
4563	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
4564	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
4565	.shared = &shared,
4566	.idx = i,
4567	.wake_r = -1,
4568	.wake_w = -1,
4569	};
4570	}
4571
4572	var w = ResizeWitness{ .t = &tiles[0] };
4573	const th = try std.Thread.spawn(.{}, ResizeWitness.run, .{&w});
4574	defer {
4575	w.stop.store(true, .release);
4576	th.join();
4577	}
4578	// The dimension this fixture varies is TIME: the wall is re-cut while a
4579	// pump is mid-pass, over and over, so a relayout is free to land at any
4580	// point inside one. Both heights clear `wallFloors(2)`, so every cut
4581	// really does move the rect.
4582	const heights = [_]u16{ 24, 22, 24, 23 };
4583	var i: usize = 0;
4584	while (i < 400) : (i += 1) {
4585	shared.paint_mu.lock();
4586	shared.size = .{ .cols = 80, .rows = heights[i % heights.len] };
4587	shared.paint_mu.unlock();
4588	wall_layout.relayout(alloc, tiles, &present, &shared, 0);
4589
4590	// Quiesce: the pump owes nothing, and the pass that took the last
4591	// doorbell has finished. Only then is "what the daemon holds" a
4592	// settled question.
4593	while (true) {
4594	shared.paint_mu.lock();
4595	const owed = tiles[0].resize_pending;
4596	shared.paint_mu.unlock();
4597	if (!owed) break;
4598	}
4599	const n = w.passes.load(.acquire);
4600	while (w.passes.load(.acquire) < n + 1) {}
4601
4602	shared.paint_mu.lock();
4603	const want = ResizeWitness.pack(tiles[0].rect.cols, tiles[0].rect.rows -\| shared.label_rows);
4604	shared.paint_mu.unlock();
4605	// The claim: a quiet wall and a quiet pump agree on the grid. A
4606	// doorbell consumed apart from the rect it describes breaks this —
4607	// the pump sent the rect it snapshotted BEFORE the re-cut, cleared
4608	// the flag, and nothing re-sends.
4609	try std.testing.expectEqual(want, w.sent.load(.acquire));
4610	}
4611	}
4612
4613	// The terminal, as an oracle. The wall's bytes are replayed into an engine
4614	// and the GRID is judged: a bar painted at a row the terminal no longer has
4615	// looks fine in the bytes — the terminal clamps the CUP onto its last row —
4616	// and lands on top of somebody else's content in the grid.
4617	const WallScreen = struct {
4618	eng: *Engine,
4619	r: std.posix.fd_t,
4620	w: std.posix.fd_t,
4621
4622	fn init(alloc: std.mem.Allocator, cols: u16, rows: u16) !WallScreen {
4623	const p = try std.posix.pipe2(.{ .NONBLOCK = true });
4624	return .{
4625	.eng = try Engine.init(alloc, .{ .cols = cols, .rows = rows }),
4626	.r = p[0],
4627	.w = p[1],
4628	};
4629	}
4630
4631	fn deinit(self: *WallScreen) void {
4632	self.eng.deinit();
4633	std.posix.close(self.r);
4634	std.posix.close(self.w);
4635	}
4636
4637	fn drain(self: *WallScreen) void {
4638	var buf: [4096]u8 = undefined;
4639	while (std.posix.read(self.r, &buf)) \|n\| {
4640	if (n == 0) break;
4641	self.eng.feed(buf[0..n]);
4642	} else \|_\| {}
4643	}
4644
4645	fn line(text: []const u8, n: u16) ?[]const u8 {
4646	var it = std.mem.splitScalar(u8, text, '\n');
4647	var i: u16 = 0;
4648	while (it.next()) \|l\| : (i += 1) if (i == n) return l;
4649	return null;
4650	}
4651	};
4652
4653	test "a terminal too small for the cut falls back to the focused pane, and grows back" {
4654	const alloc = std.testing.allocator;
4655	const n = 7;
4656	var screen = try WallScreen.init(alloc, 80, 24);
4657	defer screen.deinit();
4658	var shared = Shared{ .out_fd = screen.w, .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
4659	shared.tree = layout.Tree.init(alloc);
4660	shared.flat_alloc = alloc;
4661	defer shared.tree.deinit();
4662	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
4663	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
4664	try shared.tree.addFirst(0);
4665	var k: u8 = 1;
4666	while (k < n) : (k += 1) try shared.tree.insert(k - 1, k);
4667	const tiles = try alloc.alloc(Tile, n);
4668	defer alloc.free(tiles);
4669	const present = try alloc.alloc(bool, n);
4670	defer alloc.free(present);
4671	var labels: [n][2]u8 = undefined;
4672	for (tiles, 0..) \|*t, i\| {
4673	present[i] = true;
4674	labels[i] = .{ 't', '0' + @as(u8, @intCast(i)) };
4675	t.* = Tile{
4676	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = &labels[i], .session = "" },
4677	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
4678	.shared = &shared,
4679	.idx = i,
4680	.wake_r = -1,
4681	.wake_w = -1,
4682	};
4683	}
4684	// One tile whose pump has ended: the keyboard is the only thread left
4685	// that can paint its bar, so it is the tile that proves a HIDDEN pane
4686	// gets no bar either.
4687	tiles[n - 1].alive.store(false, .release);
4688
4689	// The dimension this fixture varies is the terminal's height — the one
4690	// the wall is cut against. 24 rows hold seven panes under their bars;
4691	// 20 do not, and `flatten` says so; and the wall has to come back.
4692	for ([_]u16{ 24, 20, 24 }) \|rows\| {
4693	try screen.eng.resize(80, rows);
4694	shared.paint_mu.lock();
4695	shared.size = .{ .cols = 80, .rows = rows };
4696	shared.paint_mu.unlock();
4697	wall_layout.relayout(alloc, tiles, present, &shared, 0);
4698	// What the pumps do with the generation bump: repaint their bars.
4699	for (tiles, present) \|*t, p\| if (p) paintLabel(t, .up);
4700	screen.drain();
4701	const dump = try screen.eng.dumpPlain(alloc);
4702	defer alloc.free(dump);
4703
4704	// No tile ever claims a row the terminal does not have. A SIGWINCH
4705	// is not an operation and cannot be refused: doing nothing leaves
4706	// every rect pointing past the bottom of the screen.
4707	for (tiles, present) \|*t, p\| {
4708	if (!p) continue;
4709	try std.testing.expect(t.rect.top + t.rect.rows <= rows);
4710	try std.testing.expect(t.rect.left + t.rect.cols <= 80);
4711	}
4712	if (rows == 20) {
4713	// The degrade: the focused pane whole, every other pane at 0x0
4714	// — a rect that paints nothing and claims no size — and the
4715	// tree untouched underneath.
4716	try std.testing.expectEqual(@as(u16, 0), shared.label_rows);
4717	try std.testing.expectEqual(@as(u16, 20), tiles[0].rect.rows);
4718	try std.testing.expectEqual(@as(u16, 80), tiles[0].rect.cols);
4719	try std.testing.expectEqual(@as(u16, 0), tiles[0].rect.top);
4720	for (tiles[1..]) \|*t\| try std.testing.expectEqual(@as(u16, 0), t.rect.rows);
4721	// One pane, so no bars: every row of the grid the wall itself
4722	// wrote is blank, hidden tiles included.
4723	var it = std.mem.splitScalar(u8, dump, '\n');
4724	while (it.next()) \|l\|
4725	try std.testing.expectEqual(@as(usize, 0), std.mem.trim(u8, l, " ").len);
4726	} else {
4727	try std.testing.expectEqual(@as(u16, 1), shared.label_rows);
4728	// Seven bars, each on the first row of the pane it names.
4729	for (tiles) \|*t\| {
4730	const l = WallScreen.line(dump, t.rect.top) orelse return error.NoSuchRow;
4731	try std.testing.expect(std.mem.indexOf(u8, l, t.r.label) != null);
4732	}
4733	}
4734	}
4735	}
4736
4737	test "fullscreen gives the focused tile the whole terminal and hides the rest" {
4738	const alloc = std.testing.allocator;
4739	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
4740	shared.tree = layout.Tree.init(alloc);
4741	shared.flat_alloc = alloc;
4742	defer shared.tree.deinit();
4743	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
4744	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
4745	try shared.tree.addFirst(0);
4746	try shared.tree.insert(0, 1);
4747	const tiles = try alloc.alloc(Tile, 2);
4748	defer alloc.free(tiles);
4749	const present = [_]bool{ true, true };
4750	for (tiles, 0..) \|*t, i\| {
4751	t.* = Tile{
4752	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
4753	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
4754	.shared = &shared,
4755	.idx = i,
4756	.wake_r = -1,
4757	.wake_w = -1,
4758	};
4759	}
4760	shared.fullscreen = true;
4761	wall_layout.relayout(alloc, tiles, &present, &shared, 0);
4762	// No label bar: the fullscreened pane is a one-tile wall.
4763	try std.testing.expectEqual(@as(u8, 0), shared.label_rows);
4764	// Tile 0 gets the whole terminal; tile 1 gets nothing.
4765	try std.testing.expectEqual(@as(u16, 24), tiles[0].rect.rows);
4766	try std.testing.expectEqual(@as(u16, 80), tiles[0].rect.cols);
4767	try std.testing.expectEqual(@as(u16, 0), tiles[1].rect.rows);
4768	try std.testing.expectEqual(@as(u16, 0), tiles[1].rect.cols);
4769	// The base flat is kept for neighbor.
4770	try std.testing.expect(shared.base_flat != null);
4771	}
4772
4773	test "toggle off fullscreen restores the real rects" {
4774	const alloc = std.testing.allocator;
4775	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
4776	shared.tree = layout.Tree.init(alloc);
4777	shared.flat_alloc = alloc;
4778	defer shared.tree.deinit();
4779	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
4780	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
4781	try shared.tree.addFirst(0);
4782	try shared.tree.insert(0, 1);
4783	const tiles = try alloc.alloc(Tile, 2);
4784	defer alloc.free(tiles);
4785	const present = [_]bool{ true, true };
4786	for (tiles, 0..) \|*t, i\| {
4787	t.* = Tile{
4788	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
4789	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
4790	.shared = &shared,
4791	.idx = i,
4792	.wake_r = -1,
4793	.wake_w = -1,
4794	};
4795	}
4796	shared.fullscreen = true;
4797	wall_layout.relayout(alloc, tiles, &present, &shared, 0);
4798	shared.fullscreen = false;
4799	wall_layout.relayout(alloc, tiles, &present, &shared, 0);
4800	// Two tiles again: label bar back, both have real rects (stacked:
4801	// full width, half height each).
4802	try std.testing.expectEqual(@as(u8, 1), shared.label_rows);
4803	try std.testing.expectEqual(@as(u16, 80), tiles[0].rect.cols);
4804	try std.testing.expectEqual(@as(u16, 80), tiles[1].rect.cols);
4805	try std.testing.expect(tiles[0].rect.rows < 24);
4806	try std.testing.expect(tiles[1].rect.rows > 0);
4807	}
4808
4809	test "focus_dir while fullscreened follows the focus" {
4810	const alloc = std.testing.allocator;
4811	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
4812	shared.tree = layout.Tree.init(alloc);
4813	shared.flat_alloc = alloc;
4814	defer shared.tree.deinit();
4815	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
4816	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
4817	try shared.tree.addFirst(0);
4818	try shared.tree.insert(0, 1);
4819	const tiles = try alloc.alloc(Tile, 2);
4820	defer alloc.free(tiles);
4821	const present = [_]bool{ true, true };
4822	for (tiles, 0..) \|*t, i\| {
4823	t.* = Tile{
4824	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
4825	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
4826	.shared = &shared,
4827	.idx = i,
4828	.wake_r = -1,
4829	.wake_w = -1,
4830	};
4831	}
4832	shared.fullscreen = true;
4833	wall_layout.relayout(alloc, tiles, &present, &shared, 0);
4834	// Move focus to tile 1 while fullscreened.
4835	focusAnswer(alloc, tiles, &present, &shared, false, 1);
4836	// The full rect followed: tile 1 now owns the terminal.
4837	try std.testing.expectEqual(@as(u16, 24), tiles[1].rect.rows);
4838	try std.testing.expectEqual(@as(u16, 80), tiles[1].rect.cols);
4839	try std.testing.expectEqual(@as(u16, 0), tiles[0].rect.rows);
4840	try std.testing.expectEqual(@as(usize, 1), shared.sel);
4841	}
4842
4843	test "resize: l grows the focused pane, h shrinks it" {
4844	// Spec: h shrinks width, l grows width. layout.resize always makes
4845	// the focus GAIN cells, so shrink = grow a neighbor at focus's
4846	// expense. Two beside panes at 80x24 (floors {3,2}): equal split is
4847	// 39/40 (rail takes 1). l moves the rail right; h moves it left.
4848	const alloc = std.testing.allocator;
4849	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
4850	shared.tree = layout.Tree.init(alloc);
4851	shared.flat_alloc = alloc;
4852	defer shared.tree.deinit();
4853	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
4854	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
4855	try shared.tree.addFirst(0);
4856	try shared.tree.splitRight(0, 1);
4857	const tiles = try alloc.alloc(Tile, 2);
4858	defer alloc.free(tiles);
4859	const present = [_]bool{ true, true };
4860	for (tiles, 0..) \|*t, i\| {
4861	t.* = Tile{
4862	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
4863	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
4864	.shared = &shared,
4865	.idx = i,
4866	.wake_r = -1,
4867	.wake_w = -1,
4868	};
4869	}
4870	wall_layout.relayout(alloc, tiles, &present, &shared, 0);
4871	const before = tiles[0].rect.cols;
4872	// l (grow width): focus 0 gains from its right sibling.
4873	try std.testing.expect(wall_layout.doResize(alloc, tiles, &present, &shared, 0, .right));
4874	try std.testing.expect(tiles[0].rect.cols > before);
4875	// h (shrink width): the right neighbor gains a cell back from focus.
4876	try std.testing.expect(wall_layout.doResize(alloc, tiles, &present, &shared, 0, .left));
4877	try std.testing.expectEqual(before, tiles[0].rect.cols);
4878	}
4879
4880	test "resize: j grows height, k shrinks height" {
4881	const alloc = std.testing.allocator;
4882	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
4883	shared.tree = layout.Tree.init(alloc);
4884	shared.flat_alloc = alloc;
4885	defer shared.tree.deinit();
4886	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
4887	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
4888	try shared.tree.addFirst(0);
4889	try shared.tree.splitBelow(0, 1);
4890	const tiles = try alloc.alloc(Tile, 2);
4891	defer alloc.free(tiles);
4892	const present = [_]bool{ true, true };
4893	for (tiles, 0..) \|*t, i\| {
4894	t.* = Tile{
4895	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
4896	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
4897	.shared = &shared,
4898	.idx = i,
4899	.wake_r = -1,
4900	.wake_w = -1,
4901	};
4902	}
4903	wall_layout.relayout(alloc, tiles, &present, &shared, 0);
4904	const before = tiles[0].rect.rows;
4905	try std.testing.expect(wall_layout.doResize(alloc, tiles, &present, &shared, 0, .down));
4906	try std.testing.expect(tiles[0].rect.rows > before);
4907	try std.testing.expect(wall_layout.doResize(alloc, tiles, &present, &shared, 0, .up));
4908	try std.testing.expectEqual(before, tiles[0].rect.rows);
4909	}
4910
4911	test "resize refuses while fullscreened" {
4912	const alloc = std.testing.allocator;
4913	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
4914	shared.tree = layout.Tree.init(alloc);
4915	shared.flat_alloc = alloc;
4916	defer shared.tree.deinit();
4917	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
4918	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
4919	try shared.tree.addFirst(0);
4920	try shared.tree.splitRight(0, 1);
4921	const tiles = try alloc.alloc(Tile, 2);
4922	defer alloc.free(tiles);
4923	const present = [_]bool{ true, true };
4924	for (tiles, 0..) \|*t, i\| {
4925	t.* = Tile{
4926	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
4927	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
4928	.shared = &shared,
4929	.idx = i,
4930	.wake_r = -1,
4931	.wake_w = -1,
4932	};
4933	}
4934	shared.fullscreen = true;
4935	wall_layout.relayout(alloc, tiles, &present, &shared, 0);
4936	try std.testing.expect(!wall_layout.doResize(alloc, tiles, &present, &shared, 0, .right));
4937	}
4938
4939	fn noticeBench(shared: *Shared, tiles: []Tile) void {
4940	for (tiles, 0..) \|*t, i\| {
4941	t.* = Tile{
4942	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
4943	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
4944	.shared = shared,
4945	.idx = i,
4946	.wake_r = -1,
4947	.wake_w = -1,
4948	};
4949	}
4950	}
4951
4952	test "closeNotice: a sentence the popup left behind is given a tile to land on" {
4953	const alloc = std.testing.allocator;
4954	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
4955	const tiles = try alloc.alloc(Tile, 2);
4956	defer alloc.free(tiles);
4957	noticeBench(&shared, tiles);
4958	const present = [_]bool{ true, true };
4959	// Focus on tile 1, and the forgotten host owned NEITHER tile: the focus
4960	// does not move on its own here, which is the whole of the finding.
4961	shared.sel = 1;
4962	setNotice(&shared, "[hosts file not updated: read-only file system]");
4963
4964	closeNotice(tiles, &present, &shared);
4965
4966	// Armed, not merely rung: a pump paints the notice on a CLAIM, and a
4967	// doorbell alone gives it nothing to claim for.
4968	if (!tiles[1].claim_pending.load(.acquire)) return error.NoticeHasNoClaimToRideOn;
4969	// Still there for the pump to take on that claim, whole: a keyboard
4970	// that consumed it here would paint nothing and lose the sentence.
4971	var buf: [96]u8 = undefined;
4972	try std.testing.expectEqualStrings(
4973	"[hosts file not updated: read-only file system]",
4974	takeNotice(&shared, &buf),
4975	);
4976
4977	// The control: with nothing to say, the close is the bare retry it was,
4978	// and no tile is handed a claim it did not earn.
4979	noticeBench(&shared, tiles);
4980	closeNotice(tiles, &present, &shared);
4981	try std.testing.expect(!tiles[1].claim_pending.load(.acquire));
4982	}
4983
4984	test "a pump's answer that grew the wall re-cuts it; a mere focus move does not" {
4985	const alloc = std.testing.allocator;
4986	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
4987	defer if (shared.last_flat) \|*f\| f.deinit(shared.flat_alloc);
4988	defer if (shared.base_flat) \|*f\| f.deinit(shared.flat_alloc);
4989	const tiles = try alloc.alloc(Tile, 2);
4990	defer alloc.free(tiles);
4991	const present = try alloc.alloc(bool, 2);
4992	defer alloc.free(present);
4993	present[0] = true;
4994	present[1] = true;
4995	for (tiles, 0..) \|*t, i\| {
4996	t.* = Tile{
4997	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
4998	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
4999	.shared = &shared,
5000	.idx = i,
5001	.wake_r = -1,
5002	.wake_w = -1,
5003	};
5004	}
5005	// Growth: without the re-cut the new tile sits on placeholder geometry
5006	// and the old tile still owns the whole terminal — the screen keeps
5007	// showing tile 0 while the keyboard types into tile 1's rows.
5008	focusAnswer(alloc, tiles, present, &shared, true, 1);
5009	try std.testing.expectEqual(@as(u8, 1), shared.label_rows);
5010	try std.testing.expect(tiles[0].resize_pending);
5011	try std.testing.expect(tiles[1].resize_pending);
5012	try std.testing.expectEqual(@as(usize, 1), shared.sel);
5013	try std.testing.expect(tiles[1].claim_pending.load(.acquire));
5014	tiles[0].resize_pending = false;
5015	tiles[1].resize_pending = false;
5016	// No growth: a full clear here would flash the wall for a focus move.
5017	focusAnswer(alloc, tiles, present, &shared, false, 0);
5018	try std.testing.expect(!tiles[0].resize_pending);
5019	try std.testing.expect(!tiles[1].resize_pending);
5020	try std.testing.expectEqual(@as(usize, 0), shared.sel);
5021	try std.testing.expect(tiles[0].claim_pending.load(.acquire));
5022	}
5023
5024	test "a one-tile wall draws no label bar and paints row 1" {
5025	const alloc = std.testing.allocator;
5026	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
5027	shared.tree = layout.Tree.init(alloc);
5028	shared.flat_alloc = alloc;
5029	defer shared.tree.deinit();
5030	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
5031	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
5032	try shared.tree.addFirst(0);
5033	const tiles = try alloc.alloc(Tile, 1);
5034	defer alloc.free(tiles);
5035	const present = try alloc.alloc(bool, 1);
5036	defer alloc.free(present);
5037	present[0] = true;
5038	tiles[0] = Tile{
5039	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
5040	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
5041	.shared = &shared,
5042	.idx = 0,
5043	.wake_r = -1,
5044	.wake_w = -1,
5045	};
5046	wall_layout.relayout(alloc, tiles, present, &shared, 0);
5047	// One tile: no label bar, every row is content.
5048	try std.testing.expectEqual(@as(u8, 0), shared.label_rows);
5049	try std.testing.expectEqual(@as(u16, 24), tiles[0].viewRows());
5050	}
5051
5052	test "bare keys reach the focused tile; the prefix does not" {
5053	var f: interact.PrefixFilter = .{};
5054	// Bare keys are forwarded to the focused tile.
5055	var keys: [3]u8 = .{ 'a', 'b', 'c' };
5056	const a = f.feed(&keys);
5057	try std.testing.expectEqualStrings("abc", a.forward);
5058	try std.testing.expectEqual(interact.PrefixFilter.Action.none, a.action);
5059	// A chord consumes its key and produces no forward bytes.
5060	var chord: [2]u8 = .{ 0x1c, 'n' };
5061	const b = f.feed(&chord);
5062	try std.testing.expectEqual(@as(usize, 0), b.forward.len);
5063	try std.testing.expectEqual(interact.PrefixFilter.Action.next_session, b.action);
5064	}
5065
5066	test "focus follows a click: rectHit picks the tile under a row and column" {
5067	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
5068	shared.label_rows = 1;
5069	var tiles: [2]Tile = undefined;
5070	tiles[0] = Tile{
5071	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
5072	.rect = .{ .top = 0, .left = 0, .rows = 12, .cols = 80 },
5073	.shared = &shared,
5074	.idx = 0,
5075	.wake_r = -1,
5076	.wake_w = -1,
5077	};
5078	tiles[1] = Tile{
5079	.r = .{ .target = .{ .sock = "/tmp/y" }, .label = "y", .session = "" },
5080	.rect = .{ .top = 12, .left = 0, .rows = 12, .cols = 80 },
5081	.shared = &shared,
5082	.idx = 1,
5083	.wake_r = -1,
5084	.wake_w = -1,
5085	};
5086	const present = [_]bool{ true, true };
5087	// A click in row 3 hits tile 0.
5088	try std.testing.expectEqual(@as(?usize, 0), rectHit(&tiles, &present, &shared, 3, 0));
5089	// A click in row 15 hits tile 1.
5090	try std.testing.expectEqual(@as(?usize, 1), rectHit(&tiles, &present, &shared, 15, 0));
5091
5092	// A beside pair: same rows, different columns. A click in the left
5093	// half hits tile 0, the right half hits tile 1, and a rail column
5094	// between them hits neither.
5095	tiles[0].rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 39 };
5096	tiles[1].rect = .{ .top = 0, .left = 41, .rows = 24, .cols = 39 };
5097	try std.testing.expectEqual(@as(?usize, 0), rectHit(&tiles, &present, &shared, 5, 10));
5098	try std.testing.expectEqual(@as(?usize, 1), rectHit(&tiles, &present, &shared, 5, 50));
5099	try std.testing.expectEqual(@as(?usize, null), rectHit(&tiles, &present, &shared, 5, 40));
5100	}
5101
5102	// A transport that swallows every frame: a Core's selection request goes
5103	// nowhere, which is what lets a copy test stand up without a daemon.
5104	const SwallowTransport = struct {
5105	pub fn writeFrame(_: *SwallowTransport, _: proto.MsgType, _: []const u8) !void {}
5106	};
5107
5108	// One selection_reply payload — id, status, watermark, text — in the wire
5109	// form encodeSelectionReply writes, laid out in a caller buffer so a test
5110	// does not allocate the prefix separately.
5111	fn replyBytes(
5112	buf: []u8,
5113	id: u32,
5114	status: proto.SelectionStatus,
5115	history_rows: u32,
5116	text: []const u8,
5117	) []const u8 {
5118	std.mem.writeInt(u32, buf[0..4], id, .little);
5119	buf[4] = @intFromEnum(status);
5120	std.mem.writeInt(u32, buf[5..9], history_rows, .little);
5121	@memcpy(buf[proto.selection_reply_prefix_len..][0..text.len], text);
5122	return buf[0 .. proto.selection_reply_prefix_len + text.len];
5123	}
5124
5125	test "a copy too big for OSC 52 is said out loud rather than dropped" {
5126	// The notice path is the whole claim. A reply that rounds to ok on the
5127	// wire but outruns OSC 52 is neither trimmed nor dropped: a half-copied
5128	// selection is worse than none, because the user finds out when they
5129	// paste it. The drag is per-tile now, on the Core the pump owns, so the
5130	// copy goes through that Core — no claim is taken, the copy reads the
5131	// drag and not the terminal's modes.
5132	const alloc = std.testing.allocator;
5133	const p = try std.posix.pipe2(.{ .NONBLOCK = true });
5134	defer std.posix.close(p[0]);
5135	defer std.posix.close(p[1]);
5136	var shared = Shared{ .out_fd = p[1], .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
5137	var t = Tile{
5138	.r = .{ .target = .{ .sock = "/s" }, .label = "a", .session = "a" },
5139	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
5140	.shared = &shared,
5141	.idx = 0,
5142	.wake_r = -1,
5143	.wake_w = -1,
5144	};
5145	var core = try interact.Core.initSized(alloc, -1, p[1], shared.size);
5146	defer core.deinit();
5147	core.rep.history_rows = 0;
5148	core.drag.press(.{ .row = 3, .col = 4 }, .{ .tile = 0, .row = 0, .col = 4 });
5149	core.drag.motion(.{ .row = 5, .col = 9 }, .{ .tile = 0, .row = 2, .col = 9 });
5150	_ = core.drag.release();
5151	try std.testing.expect(core.drag.range() != null);
5152	var tr: SwallowTransport = .{};
5153	const held = core.drag.range() orelse return error.NoDrag;
5154	try core.requestSelection(&tr, held);
5155
5156	// Base64 of this length overruns clipboard_base64_max: the daemon sends
5157	// it as ok, and OSC 52 cannot carry it.
5158	const fits = proto.clipboard_base64_max / 4 * 3;
5159	const big = try alloc.alloc(u8, fits + 1);
5160	defer alloc.free(big);
5161	@memset(big, 'x');
5162	const rbuf = try alloc.alloc(u8, proto.selection_reply_prefix_len + big.len);
5163	defer alloc.free(rbuf);
5164	const payload = replyBytes(rbuf, core.sel_id, .ok, 0, big);
5165
5166	wall_pump.copySelection(&t, alloc, &core, payload);
5167	var buf: [8192]u8 = undefined;
5168	const said = readAvail(p[0], &buf);
5169	try std.testing.expect(std.mem.indexOf(u8, said, "too large") != null);
5170	// Refused, not trimmed: a half-copied selection is worse than none,
5171	// because the user finds out when they paste it.
5172	try std.testing.expect(std.mem.indexOf(u8, said, "\x1b]52;") == null);
5173	}
5174
5175	test "setFocus writes the outgoing tile's release before the store that lets the next pump claim" {
5176	// The keyboard thread's half of the terminal handover, and the order is
5177	// load-bearing: two pumps are two threads, and A's release and B's claim
5178	// race if the release is not on the wire first. The outgoing pump writes
5179	// nothing (already_written), so if this stops emitting, nothing does —
5180	// and the wall reports clicks into whatever shell the user lands in.
5181	// is_tty is true because this leg is about what a focus move WRITES, and
5182	// the gate that suppresses those writes on a pipe is exactly what it
5183	// must not be testing.
5184	const p = try std.posix.pipe2(.{ .NONBLOCK = true });
5185	defer std.posix.close(p[0]);
5186	defer std.posix.close(p[1]);
5187	var shared = Shared{ .out_fd = p[1], .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
5188	var tiles: [2]Tile = undefined;
5189	tiles[0] = Tile{
5190	.r = .{ .target = .{ .sock = "/s" }, .label = "a", .session = "a" },
5191	.rect = .{ .top = 0, .left = 0, .rows = 12, .cols = 80 },
5192	.shared = &shared,
5193	.idx = 0,
5194	.wake_r = -1,
5195	.wake_w = -1,
5196	};
5197	tiles[1] = Tile{
5198	.r = .{ .target = .{ .sock = "/s" }, .label = "b", .session = "b" },
5199	.rect = .{ .top = 12, .left = 0, .rows = 12, .cols = 80 },
5200	.shared = &shared,
5201	.idx = 1,
5202	.wake_r = -1,
5203	// The claim doorbell lands on the SAME pipe as the release: the
5204	// write order on one fd is the only order a test can read, and the
5205	// release must come first.
5206	.wake_w = p[1],
5207	};
5208	shared.sel = 0;
5209	var buf: [512]u8 = undefined;
5210
5211	// A move to the SAME tile has no outgoing session to take off, so it
5212	// writes no release — a release here would unset modes the user's own
5213	// terminal may have arrived with.
5214	setFocus(&tiles, &shared, 0);
5215	try std.testing.expect(std.mem.indexOf(u8, readAvail(p[0], &buf), interact.session_release) == null);
5216
5217	// A -> B: the release is written under paint_mu, before sel is stored
5218	// and before B is doorbelled to claim. On the one pipe both share that
5219	// shows up as the release preceding the claim's wake byte.
5220	setFocus(&tiles, &shared, 1);
5221	const out = readAvail(p[0], &buf);
5222	const rel = std.mem.indexOf(u8, out, interact.session_release) orelse
5223	return error.NoReleaseOnFocusMove;
5224	const bell = std.mem.indexOfScalar(u8, out, 0) orelse
5225	return error.NoClaimDoorbell;
5226	try std.testing.expect(rel < bell);
5227	// The outgoing pump is told to release, the incoming one to claim.
5228	try std.testing.expect(tiles[0].release_pending.load(.acquire));
5229	try std.testing.expect(tiles[1].claim_pending.load(.acquire));
5230	try std.testing.expectEqual(@as(usize, 1), shared.sel);
5231	}
5232
5233	test "a relayout drops every tile's highlight, because the stripes move under it" {
5234	// The drag is per-tile now, on each pump's Core, so relayout cannot
5235	// reach it directly. It bumps repaint_gen instead, and every pump
5236	// clears its own core.drag when it sees the generation move under it —
5237	// a relayout re-cut the rect a held drag's anchor was resolved against.
5238	// The generation is the whole mechanism, so it is what this pins.
5239	const alloc = std.testing.allocator;
5240	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
5241	shared.tree = layout.Tree.init(alloc);
5242	shared.flat_alloc = alloc;
5243	defer shared.tree.deinit();
5244	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
5245	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
5246	try shared.tree.addFirst(0);
5247	try shared.tree.insert(0, 1);
5248	const tiles = try alloc.alloc(Tile, 2);
5249	defer alloc.free(tiles);
5250	const present = try alloc.alloc(bool, 2);
5251	defer alloc.free(present);
5252	present[0] = true;
5253	present[1] = true;
5254	for (tiles, 0..) \|*t, i\| {
5255	t.* = Tile{
5256	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
5257	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
5258	.shared = &shared,
5259	.idx = i,
5260	.wake_r = -1,
5261	.wake_w = -1,
5262	};
5263	}
5264	const before = shared.repaint_gen.load(.acquire);
5265	wall_layout.relayout(alloc, tiles, present, &shared, 0);
5266	// One bump, every tile's pump clears its drag on it: the stripes moved,
5267	// so a held drag's anchor names a rect that is somewhere else now.
5268	try std.testing.expect(shared.repaint_gen.load(.acquire) > before);
5269	}
5270
5271	test "a reconnect drops the highlight over its own tile, and only its own" {
5272	// Core.reattached clears that Core's drag — a resync renames the
5273	// absolute row space, so a highlight kept across one would invert rows
5274	// nobody selected. The drag is per-tile, so one tile's reconnect says
5275	// nothing about another's selection: the neighbour's highlight stays.
5276	const alloc = std.testing.allocator;
5277	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
5278	var tiles: [2]Tile = undefined;
5279	tiles[0] = Tile{
5280	.r = .{ .target = .{ .sock = "/s" }, .label = "a", .session = "a" },
5281	.rect = .{ .top = 0, .left = 0, .rows = 12, .cols = 80 },
5282	.shared = &shared,
5283	.idx = 0,
5284	.wake_r = -1,
5285	.wake_w = -1,
5286	};
5287	tiles[1] = Tile{
5288	.r = .{ .target = .{ .sock = "/s" }, .label = "b", .session = "b" },
5289	.rect = .{ .top = 12, .left = 0, .rows = 12, .cols = 80 },
5290	.shared = &shared,
5291	.idx = 1,
5292	.wake_r = -1,
5293	.wake_w = -1,
5294	};
5295	// Each tile's pump owns its own Core, and each Core its own drag. A
5296	// drag over tile 0 and one over tile 1, anchored in their own tiles.
5297	var core0 = try interact.Core.initSized(alloc, -1, -1, shared.size);
5298	defer core0.deinit();
5299	var core1 = try interact.Core.initSized(alloc, -1, -1, shared.size);
5300	defer core1.deinit();
5301	core0.drag.press(.{ .row = 3, .col = 4 }, .{ .tile = 0, .row = 0, .col = 4 });
5302	core0.drag.motion(.{ .row = 5, .col = 9 }, .{ .tile = 0, .row = 2, .col = 9 });
5303	core1.drag.press(.{ .row = 3, .col = 4 }, .{ .tile = 1, .row = 0, .col = 4 });
5304	core1.drag.motion(.{ .row = 5, .col = 9 }, .{ .tile = 1, .row = 2, .col = 9 });
5305	try std.testing.expectEqual(@as(?usize, 0), core0.drag.on());
5306	try std.testing.expectEqual(@as(?usize, 1), core1.drag.on());
5307
5308	// Tile 0 reconnects: its row space is about to be renamed, so its
5309	// highlight comes off. Tile 1's never went away.
5310	core0.reattached();
5311	try std.testing.expect(core0.drag.range() == null);
5312	try std.testing.expect(core0.drag.on() == null);
5313	try std.testing.expect(core1.drag.range() != null);
5314	try std.testing.expectEqual(@as(?usize, 1), core1.drag.on());
5315	}
5316
5317	test "a focus move drops what the wall's input filters are holding" {
5318	// The input-filter state that mattered — the drag — moved off the
5319	// wall's keyboard loop and onto each tile's Core. setFocus drops it the
5320	// same way relayout does: a repaint_gen bump every pump clears its
5321	// core.drag on. The wall-level prefix is deliberately KEPT, because a
5322	// chord is a wall command now and not a tile's; what stopped existing on
5323	// a focus move is the screen the drag was drawn on, not a half-typed
5324	// chord about it.
5325	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
5326	var tiles: [2]Tile = undefined;
5327	tiles[0] = Tile{
5328	.r = .{ .target = .{ .sock = "/s" }, .label = "a", .session = "a" },
5329	.rect = .{ .top = 0, .left = 0, .rows = 12, .cols = 80 },
5330	.shared = &shared,
5331	.idx = 0,
5332	.wake_r = -1,
5333	.wake_w = -1,
5334	};
5335	tiles[1] = Tile{
5336	.r = .{ .target = .{ .sock = "/s" }, .label = "b", .session = "b" },
5337	.rect = .{ .top = 12, .left = 0, .rows = 12, .cols = 80 },
5338	.shared = &shared,
5339	.idx = 1,
5340	.wake_r = -1,
5341	.wake_w = -1,
5342	};
5343	shared.sel = 0;
5344	const before = shared.repaint_gen.load(.acquire);
5345	setFocus(&tiles, &shared, 1);
5346	try std.testing.expect(shared.repaint_gen.load(.acquire) > before);
5347	}
5348
5349	test "setFocus: the marker moves between two tiles with no pump to move it" {
5350	// A refused attach and an exited session both leave a tile
5351	// whose pump has ended: repaint_gen and the doorbell reach nobody, so
5352	// the bar keeps whatever marker it was born with. Two of them and
5353	// Ctrl-\ 1 / Ctrl-\ 2 change nothing on screen; one of them beside a
5354	// live tile shows two `>`. The keyboard is the only thread left that
5355	// can paint these, which is what this pins.
5356	const p = try std.posix.pipe2(.{ .NONBLOCK = true });
5357	defer std.posix.close(p[0]);
5358	defer std.posix.close(p[1]);
5359	var shared = Shared{ .out_fd = p[1], .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
5360	shared.label_rows = 1; // two tiles draw a bar
5361	var tiles: [3]Tile = undefined;
5362	tiles[0] = Tile{
5363	.r = .{ .target = .{ .sock = "/s" }, .label = "one", .session = "a" },
5364	.rect = .{ .top = 0, .left = 0, .rows = 12, .cols = 80 },
5365	.shared = &shared,
5366	.idx = 0,
5367	.wake_r = -1,
5368	.wake_w = -1,
5369	.state = .refused,
5370	.alive = std.atomic.Value(bool).init(false),
5371	};
5372	tiles[1] = Tile{
5373	.r = .{ .target = .{ .sock = "/s" }, .label = "two", .session = "b" },
5374	.rect = .{ .top = 12, .left = 0, .rows = 12, .cols = 80 },
5375	.shared = &shared,
5376	.idx = 1,
5377	.wake_r = -1,
5378	.wake_w = -1,
5379	.state = .refused,
5380	.alive = std.atomic.Value(bool).init(false),
5381	};
5382	// Forgotten, not merely dead: `x` clears `present` and sets `gone`
5383	// together, and a bar painted into a rect the layout no longer owns
5384	// writes over a neighbour.
5385	tiles[2] = Tile{
5386	.r = .{ .target = .{ .sock = "/s" }, .label = "ghost", .session = "c" },
5387	.rect = .{ .top = 0, .left = 0, .rows = 12, .cols = 80 },
5388	.shared = &shared,
5389	.idx = 2,
5390	.wake_r = -1,
5391	.wake_w = -1,
5392	.state = .exited,
5393	.alive = std.atomic.Value(bool).init(false),
5394	.gone = std.atomic.Value(bool).init(true),
5395	};
5396	shared.sel = 0;
5397
5398	setFocus(&tiles, &shared, 1);
5399
5400	var buf: [2048]u8 = undefined;
5401	const out = readAvail(p[0], &buf);
5402	// The bar is one contiguous write (`paintLabelLocked`), so the cursor
5403	// move and the marker are adjacent bytes: matching them together is
5404	// what says the marker landed in THIS tile's bar and not a neighbour's.
5405	if (std.mem.indexOf(u8, out, "\x1b[13;1H\x1b[7m 2> two") == null)
5406	return error.DeadTileNeverGainsTheMarker;
5407	if (std.mem.indexOf(u8, out, "\x1b[1;1H\x1b[7m 1 one") == null)
5408	return error.DeadTileNeverDropsTheMarker;
5409	if (std.mem.indexOf(u8, out, "ghost") != null)
5410	return error.ForgottenTilePaintedItsBar;
5411	}
5412
5413	test "the bar's digit is the tile's chord: idx + 1, and a two-digit tile still says where it is" {
5414	// Ctrl-\ 1-9 focuses by POSITION (tiles[idx - 1]) while the bar named the
5415	// session (#0, #2...): two series that stop lining up the moment a tile is
5416	// forgotten or a session dies. The digit on the bar is the chord's, so the
5417	// two cannot diverge.
5418	const p = try std.posix.pipe2(.{ .NONBLOCK = true });
5419	defer std.posix.close(p[0]);
5420	defer std.posix.close(p[1]);
5421	var shared = Shared{ .out_fd = p[1], .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
5422	shared.label_rows = 1;
5423	shared.sel = 0;
5424	var tiles: [3]Tile = undefined;
5425	const labels = [_][]const u8{ "one", "two", "twelve" };
5426	// idx 11 with no tiles 3..10: the digit is the tile's own idx, never a
5427	// count of what is on screen. Past 9 the chord cannot reach it, but the
5428	// number still says where it sits — the chord's reach is the chord's
5429	// limit, not the bar's.
5430	const idxs = [_]usize{ 0, 1, 11 };
5431	for (&tiles, labels, idxs, 0..) \|*t, label, idx, row\| {
5432	t.* = Tile{
5433	.r = .{ .target = .{ .sock = "/s" }, .label = label, .session = "a" },
5434	.rect = .{ .top = @intCast(row * 8), .left = 0, .rows = 8, .cols = 80 },
5435	.shared = &shared,
5436	.idx = idx,
5437	.wake_r = -1,
5438	.wake_w = -1,
5439	.state = .up,
5440	.alive = std.atomic.Value(bool).init(false),
5441	};
5442	paintLabelLocked(t);
5443	}
5444
5445	var buf: [2048]u8 = undefined;
5446	const out = readAvail(p[0], &buf);
5447	// Cursor move and marker together, as in the setFocus pin: that is what
5448	// says the digit landed in THIS tile's bar and not a neighbour's.
5449	if (std.mem.indexOf(u8, out, "\x1b[1;1H\x1b[7m 1> one") == null)
5450	return error.FocusedBarLostItsChordDigit;
5451	if (std.mem.indexOf(u8, out, "\x1b[9;1H\x1b[7m 2 two") == null)
5452	return error.UnfocusedBarLostItsChordDigit;
5453	if (std.mem.indexOf(u8, out, "\x1b[17;1H\x1b[7m 12 twelve") == null)
5454	return error.TwoDigitTileLostItsNumber;
5455	}
5456
5457	test "a vanished tile is stepped over" {
5458	// A tile's end and a poll that no longer lists its session both refocus
5459	// through stepPresent, and a click's rectHit and the Ctrl-\ l and 1-9
5460	// chords check the same present array a vanish clears. Tiles are never
5461	// compacted — pumps hold pointers into the array — so a vanished tile is
5462	// a hole focus steps over, not a gap it fills. gone and present clear
5463	// together in `vanishTile`, so stepping on present is stepping past
5464	// gone.
5465	const mid = [_]bool{ true, false, true };
5466	try std.testing.expectEqual(@as(?usize, 2), stepPresent(&mid, 0, true));
5467	try std.testing.expectEqual(@as(?usize, 0), stepPresent(&mid, 2, true));
5468	try std.testing.expectEqual(@as(?usize, 0), stepPresent(&mid, 2, false));
5469	try std.testing.expectEqual(@as(?usize, 2), stepPresent(&mid, 0, false));
5470	// Standing on the hole (the moment after x, before the selection has
5471	// moved) still steps to a real tile.
5472	try std.testing.expectEqual(@as(?usize, 2), stepPresent(&mid, 1, true));
5473	try std.testing.expectEqual(@as(?usize, 0), stepPresent(&mid, 1, false));
5474
5475	// The last tile gone: nothing is a selection any more, and every
5476	// motion says so rather than picking a tile that is gone.
5477	const none = [_]bool{ false, false };
5478	try std.testing.expectEqual(@as(?usize, null), stepPresent(&none, 0, true));
5479	try std.testing.expectEqual(@as(?usize, null), stepPresent(&none, 0, false));
5480
5481	// One survivor is its own answer, exactly as a one-tile wall is.
5482	const one = [_]bool{ false, true, false };
5483	try std.testing.expectEqual(@as(?usize, 1), stepPresent(&one, 1, true));
5484	try std.testing.expectEqual(@as(?usize, 1), stepPresent(&one, 0, false));
5485	}
5486
5487	test "agent channels: slots fill in order, a full table refuses, and a close is announced" {
5488	// The pump's table at the size its refusal path needs. The e2e proves
5489	// one channel end to end and will never fill eight of them.
5490	var locals: [3]?AgentLocal = @splat(null);
5491
5492	// Real fds, not stand-ins: a channel here is the write end of a pipe, so
5493	// "the table closed it" is answered by the READER seeing EOF rather than
5494	// by trusting the table's own bookkeeping. Non-blocking, so a channel
5495	// that was NOT closed reports EAGAIN and fails the assertion instead of
5496	// parking the suite on a read that never returns.
5497	var peers: [4]std.posix.fd_t = undefined;
5498	var chans: [4]std.posix.fd_t = undefined;
5499	for (0..4) \|i\| {
5500	const p = try std.posix.pipe2(.{ .NONBLOCK = true });
5501	peers[i] = p[0];
5502	chans[i] = p[1];
5503	}
5504	defer for (peers) \|fd\| std.posix.close(fd);
5505
5506	for (0..3) \|i\| try std.testing.expectEqual(
5507	@as(?usize, i),
5508	wall_pump.storeLocal(&locals, @intCast(10 + i), chans[i]),
5509	);
5510	// The full table the pump answers with `agent_close`. The fourth fd stays
5511	// this test's to close: a refused store never took ownership of it.
5512	try std.testing.expectEqual(@as(?usize, null), wall_pump.storeLocal(&locals, 99, chans[3]));
5513	std.posix.close(chans[3]);
5514
5515	try std.testing.expectEqual(@as(?usize, 1), wall_pump.findLocal(&locals, 11));
5516	try std.testing.expectEqual(@as(?usize, null), wall_pump.findLocal(&locals, 99));
5517
5518	// A pipe for the link, which is what a `.fd` transport writes to. The
5519	// frame that comes back out of it is the daemon's only notice that this
5520	// end hung up on the channel.
5521	const link = try std.posix.pipe2(.{ .NONBLOCK = true });
5522	defer std.posix.close(link[0]);
5523	defer std.posix.close(link[1]);
5524	var transport: client.Transport = .{ .conn = .{ .r = link[0], .w = link[1] }, .link = .fd };
5525
5526	wall_pump.closeLocal(&locals, 1, &transport);
5527	try std.testing.expectEqual(@as(?AgentLocal, null), locals[1]);
5528	try std.testing.expect(peerClosed(peers[1]));
5529
5530	const frame = (try proto.readFrame(std.testing.allocator, link[0])) orelse
5531	return error.NoAgentCloseOnLocalClose;
5532	defer frame.deinit(std.testing.allocator);
5533	try std.testing.expectEqual(proto.MsgType.agent_close, frame.type);
5534	try std.testing.expectEqual(@as(u32, 11), try proto.decodeAgentId(frame.payload));
5535
5536	// The redial's sweep: every channel still open goes, and nothing is said
5537	// — the connection that owned them is the one that just died.
5538	wall_pump.dropLocals(&locals);
5539	for (locals) \|c\| try std.testing.expectEqual(@as(?AgentLocal, null), c);
5540	try std.testing.expect(peerClosed(peers[0]));
5541	try std.testing.expect(peerClosed(peers[2]));
5542	}
5543
5544	/// Whether the other end of a non-blocking pipe has been closed: EOF says
5545	/// yes, EAGAIN says the writer is still holding it.
5546	fn peerClosed(fd: std.posix.fd_t) bool {
5547	var b: [1]u8 = undefined;
5548	const n = std.posix.read(fd, &b) catch return false;
5549	return n == 0;
5550	}
5551
5552	/// Everything waiting on a non-blocking pipe. Non-blocking so a half that
5553	/// stopped writing fails the assertion rather than parking the test on a
5554	/// read that will never return.
5555	fn readAvail(fd: std.posix.fd_t, buf: []u8) []const u8 {
5556	var n: usize = 0;
5557	while (std.posix.read(fd, buf[n..])) \|got\| {
5558	if (got == 0) break;
5559	n += got;
5560	} else \|_\| {}
5561	return buf[0..n];
5562	}
5563
5564	test "agent channels: an oversize frame hangs the channel up, a full one lands" {
5565	var locals: [2]?AgentLocal = @splat(null);
5566	const chan = try std.posix.pipe2(.{ .NONBLOCK = true });
5567	defer std.posix.close(chan[0]);
5568	_ = wall_pump.storeLocal(&locals, 5, chan[1]);
5569
5570	const link = try std.posix.pipe2(.{ .NONBLOCK = true });
5571	defer std.posix.close(link[0]);
5572	defer std.posix.close(link[1]);
5573	var transport: client.Transport = .{ .conn = .{ .r = link[0], .w = link[1] }, .link = .fd };
5574
5575	// The ordinary case first, so the refusal below is a refusal and not a
5576	// delivery path that never worked.
5577	var small: [proto.agent_id_len + 2]u8 = undefined;
5578	small[0..proto.agent_id_len].* = proto.encodeAgentId(5);
5579	@memcpy(small[proto.agent_id_len..], "hi");
5580	try std.testing.expect(wall_pump.deliverAgentData(&locals, &small, &transport));
5581	var got: [8]u8 = undefined;
5582	try std.testing.expectEqual(@as(usize, 2), try std.posix.read(chan[0], &got));
5583	try std.testing.expectEqualSlices(u8, "hi", got[0..2]);
5584
5585	// One byte past the cap. The daemon never sends this; a peer that is not
5586	// the daemon we shipped can, and `writeAllFd` would block on it.
5587	const over = try std.testing.allocator.alloc(u8, proto.agent_id_len + proto.agent_data_max + 1);
5588	defer std.testing.allocator.free(over);
5589	@memset(over, 'x');
5590	over[0..proto.agent_id_len].* = proto.encodeAgentId(5);
5591	try std.testing.expect(wall_pump.deliverAgentData(&locals, over, &transport));
5592	try std.testing.expectEqual(@as(?AgentLocal, null), locals[0]);
5593	try std.testing.expect(peerClosed(chan[0]));
5594
5595	// And the daemon is told, because it is holding the far socket open for
5596	// an answer this end will never write.
5597	// A payload too short to name a channel: false, and the pump abandons the
5598	// batch on it rather than skipping one frame, because a stream that has
5599	// lost frame alignment is not one to keep reading.
5600	try std.testing.expect(!wall_pump.deliverAgentData(&locals, "ab", &transport));
5601
5602	const frame = (try proto.readFrame(std.testing.allocator, link[0])) orelse
5603	return error.NoAgentCloseOnOversize;
5604	defer frame.deinit(std.testing.allocator);
5605	try std.testing.expectEqual(proto.MsgType.agent_close, frame.type);
5606	try std.testing.expectEqual(@as(u32, 5), try proto.decodeAgentId(frame.payload));
5607	}
5608
5609	test "agent forwarding is per tile: no -A offers nothing and opens nothing" {
5610	// A REAL agent socket on this machine, listening. Without one, a tile
5611	// that never asked for forwarding and a tile that did both refuse — for
5612	// different reasons — and the consent gate could be deleted under a
5613	// green suite.
5614	var tmp = try TmpDir.make();
5615	defer tmp.cleanup();
5616	var buf: [128]u8 = undefined;
5617	const sock = try std.fmt.bufPrintZ(&buf, "{s}/agent.sock", .{tmp.path()});
5618	const addr = try std.net.Address.initUnix(sock);
5619	var listener = try addr.listen(.{});
5620	defer listener.deinit();
5621
5622	var locals: [2]?AgentLocal = @splat(null);
5623	defer wall_pump.dropLocals(&locals);
5624
5625	// The gate, both ways round, against the same reachable agent.
5626	try std.testing.expect(!wall_pump.openAgentChan(&locals, 1, false, sock));
5627	try std.testing.expectEqual(@as(?usize, null), wall_pump.findLocal(&locals, 1));
5628	try std.testing.expect(wall_pump.openAgentChan(&locals, 1, true, sock));
5629	try std.testing.expect(wall_pump.findLocal(&locals, 1) != null);
5630
5631	// And the daemon does not get told about an agent the tile never
5632	// offered — the offer is what the daemon routes on, so a stray one
5633	// makes this client the answerer for a session it never armed.
5634	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
5635	var t = Tile{
5636	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "", .agent = false },
5637	.rect = .{ .top = 0, .left = 0, .rows = 4, .cols = 80 },
5638	.shared = &shared,
5639	.idx = 0,
5640	.wake_r = -1,
5641	.wake_w = -1,
5642	};
5643	const link = try std.posix.pipe2(.{ .NONBLOCK = true });
5644	defer std.posix.close(link[0]);
5645	defer std.posix.close(link[1]);
5646	var transport: client.Transport = .{ .conn = .{ .r = link[0], .w = link[1] }, .link = .fd };
5647
5648	try wall_pump.sendAttach(&t, &transport, 0, 0);
5649	const first = (try proto.readFrame(std.testing.allocator, link[0])) orelse
5650	return error.NoAttach;
5651	defer first.deinit(std.testing.allocator);
5652	try std.testing.expectEqual(proto.MsgType.attach, first.type);
5653	// Nothing else on the pipe at all: an empty non-blocking read is the
5654	// only proof that no offer followed, since a frame reader would just
5655	// block waiting for one.
5656	var spare: [1]u8 = undefined;
5657	try std.testing.expectError(error.WouldBlock, std.posix.read(link[0], &spare));
5658
5659	// The positive control on the same pipe: with `-A` the offer follows the
5660	// attach, so the silence above is the gate and not an unwritten frame.
5661	t.r.agent = true;
5662	try wall_pump.sendAttach(&t, &transport, 0, 0);
5663	const attach = (try proto.readFrame(std.testing.allocator, link[0])).?;
5664	defer attach.deinit(std.testing.allocator);
5665	const offer = (try proto.readFrame(std.testing.allocator, link[0])) orelse
5666	return error.NoAgentOffer;
5667	defer offer.deinit(std.testing.allocator);
5668	try std.testing.expectEqual(proto.MsgType.agent_offer, offer.type);
5669	}
5670
5671	test "a view tile's attach makes no size claim; a tile the user asked for does" {
5672	// The daemon reads attach-or-create off the attach's size claim: 0x0
5673	// joins, a real size creates. So a view tile (creates = false) must
5674	// put 0x0 on the wire and leave its rect to the resize doorbell, while
5675	// a tile the user asked for (creates = true) claims its rect in the
5676	// attach itself.
5677	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
5678	// A one-tile wall: no label bar, so viewRows is the whole stripe.
5679	shared.label_rows = 0;
5680	var t = Tile{
5681	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "", .agent = false },
5682	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
5683	.shared = &shared,
5684	.idx = 0,
5685	.wake_r = -1,
5686	.wake_w = -1,
5687	};
5688	const link = try std.posix.pipe2(.{ .NONBLOCK = true });
5689	defer std.posix.close(link[0]);
5690	defer std.posix.close(link[1]);
5691	var transport: client.Transport = .{ .conn = .{ .r = link[0], .w = link[1] }, .link = .fd };
5692
5693	// A view tile: 0x0 on the wire, and the rect owed to the doorbell.
5694	t.creates = false;
5695	t.resize_pending = false;
5696	try wall_pump.sendAttach(&t, &transport, 0, 0);
5697	const view = (try proto.readFrame(std.testing.allocator, link[0])) orelse
5698	return error.NoAttach;
5699	defer view.deinit(std.testing.allocator);
5700	try std.testing.expectEqual(proto.MsgType.attach, view.type);
5701	const view_req = try proto.decodeAttach(view.payload);
5702	try std.testing.expectEqual(@as(u16, 0), view_req.cols);
5703	try std.testing.expectEqual(@as(u16, 0), view_req.rows);
5704	try std.testing.expect(t.resize_pending);
5705
5706	// The same tile, now one the user asked for: the rect is in the attach,
5707	// and no doorbell is owed.
5708	t.creates = true;
5709	t.resize_pending = false;
5710	try wall_pump.sendAttach(&t, &transport, 0, 0);
5711	const entry = (try proto.readFrame(std.testing.allocator, link[0])) orelse
5712	return error.NoAttach;
5713	defer entry.deinit(std.testing.allocator);
5714	try std.testing.expectEqual(proto.MsgType.attach, entry.type);
5715	const entry_req = try proto.decodeAttach(entry.payload);
5716	try std.testing.expectEqual(@as(u16, 80), entry_req.cols);
5717	try std.testing.expectEqual(@as(u16, 24), entry_req.rows);
5718	try std.testing.expect(!t.resize_pending);
5719	}
5720
5721	test "a newborn tile's first claim is its real stripe, not the placeholder" {
5722	// A chord-born tile (creates = true) puts its rect on the attach frame,
5723	// and the daemon refuses creates under min_session_rows. A 2-row
5724	// stripe under a label bar is 1 content row — below the floor — so a
5725	// placeholder stripe silently freezes the session on a stale grid.
5726	// The tile's stripe must be what relayout would give it BEFORE the
5727	// pump's first sendAttach.
5728	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
5729	shared.label_rows = 1; // two tiles draw a bar
5730	// Real stripe for the second tile of a 2-tile wall on 24 rows.
5731	var t = Tile{
5732	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "", .agent = false },
5733	.rect = .{ .top = 12, .left = 0, .rows = 12, .cols = 80 },
5734	.shared = &shared,
5735	.idx = 1,
5736	.wake_r = -1,
5737	.wake_w = -1,
5738	};
5739	t.creates = true;
5740	const link = try std.posix.pipe2(.{ .NONBLOCK = true });
5741	defer std.posix.close(link[0]);
5742	defer std.posix.close(link[1]);
5743	var transport: client.Transport = .{ .conn = .{ .r = link[0], .w = link[1] }, .link = .fd };
5744	try wall_pump.sendAttach(&t, &transport, 0, 0);
5745	const fr = (try proto.readFrame(std.testing.allocator, link[0])) orelse
5746	return error.NoAttach;
5747	defer fr.deinit(std.testing.allocator);
5748	const req = try proto.decodeAttach(fr.payload);
5749	// The real stripe's viewRows is 11 (12 - 1 bar), never the 1 a
5750	// placeholder rows=2 stripe would put on the wire.
5751	try std.testing.expectEqual(@as(u16, 80), req.cols);
5752	try std.testing.expectEqual(@as(u16, 11), req.rows);
5753	try std.testing.expect(req.rows >= proto.min_session_rows);
5754	}
5755
5756	test "the cursor sleeps in the focused tile, whoever painted last" {
5757	// Every painter ends by showing the cursor where its own stripe sits, so
5758	// without an owner the visible cursor lands on whichever pump painted
5759	// last. The fix: a focused paint records its screen cursor in Shared, and
5760	// an unfocused paint's last act is to put the cursor back there. A
5761	// focused tile with no core (the unit-test fixture) records nothing and
5762	// restores nothing — the core is what knows the cursor.
5763	const p = try std.posix.pipe2(.{ .NONBLOCK = true });
5764	defer std.posix.close(p[0]);
5765	defer std.posix.close(p[1]);
5766	var shared = Shared{ .out_fd = p[1], .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
5767	var tiles: [2]Tile = undefined;
5768	tiles[0] = Tile{
5769	.r = .{ .target = .{ .sock = "/s" }, .label = "a", .session = "a" },
5770	.rect = .{ .top = 0, .left = 0, .rows = 12, .cols = 80 },
5771	.shared = &shared,
5772	.idx = 0,
5773	.wake_r = -1,
5774	.wake_w = -1,
5775	};
5776	tiles[1] = Tile{
5777	.r = .{ .target = .{ .sock = "/s" }, .label = "b", .session = "b" },
5778	.rect = .{ .top = 12, .left = 0, .rows = 12, .cols = 80 },
5779	.shared = &shared,
5780	.idx = 1,
5781	.wake_r = -1,
5782	.wake_w = -1,
5783	};
5784	shared.sel = 0;
5785	shared.cursor = .{ .x = 3, .y = 5 };
5786	var buf: [512]u8 = undefined;
5787
5788	// An UNFOCUSED paint (tile 1, core null) ends by restoring the shared
5789	// cursor: hide, CUP to the focused tile's stored position, then show
5790	// again so the cursor rests visible in the focused tile until its own
5791	// next paint — without the trailing show the cursor stays hidden.
5792	_ = wall_pump.tilePaintBegin(&tiles[1]);
5793	wall_pump.tilePaintEnd(&tiles[1]);
5794	try std.testing.expectEqualStrings("\x1b[?25l\x1b[6;4H\x1b[?25h", readAvail(p[0], &buf));
5795
5796	// A FOCUSED paint (tile 0, core null) records nothing and restores
5797	// nothing: no core means the shared cursor is left untouched, and the
5798	// pipe receives no new bytes.
5799	_ = wall_pump.tilePaintBegin(&tiles[0]);
5800	wall_pump.tilePaintEnd(&tiles[0]);
5801	try std.testing.expectEqual(@as(usize, 0), readAvail(p[0], &buf).len);
5802	}
5803
5804	test "saveLayoutTo writes the sidecar for the present tiles, spellings verbatim" {
5805	// A wall saves its tree on the way out: the leaf spellings are the
5806	// tiles' labels verbatim, so a reload restores the same view.
5807	const alloc = std.testing.allocator;
5808	var tmp = try TmpDir.make();
5809	defer tmp.cleanup();
5810	const path = try std.fmt.allocPrint(alloc, "{s}/layout", .{tmp.path()});
5811	defer alloc.free(path);
5812	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
5813	shared.tree = layout.Tree.init(alloc);
5814	shared.flat_alloc = alloc;
5815	defer shared.tree.deinit();
5816	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
5817	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
5818	try shared.tree.addFirst(0);
5819	try shared.tree.splitRight(0, 1);
5820	const tiles = try alloc.alloc(Tile, 2);
5821	defer alloc.free(tiles);
5822	for (tiles, 0..) \|*t, i\| {
5823	t.* = Tile{
5824	.r = .{
5825	.target = .{ .sock = "/tmp/x" },
5826	.label = switch (i) {
5827	0 => "--sock /tmp/x#a",
5828	else => "--sock /tmp/x#b",
5829	},
5830	.session = "",
5831	},
5832	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
5833	.shared = &shared,
5834	.idx = i,
5835	.wake_r = -1,
5836	.wake_w = -1,
5837	};
5838	}
5839	const present = [_]bool{ true, true };
5840	wall_layout.saveLayoutTo(alloc, path, tiles, &present, &shared);
5841	const got = wall.loadLayout(alloc, path) orelse return error.TestUnexpectedResult;
5842	defer alloc.free(got);
5843	try std.testing.expect(std.mem.startsWith(u8, got, "mux-layout 1\nbeside 0\n"));
5844	try std.testing.expect(std.mem.indexOf(u8, got, "--sock /tmp/x#b\n") != null);
5845	}
5846
5847	test "saveLayoutTo handles a vanished middle tile without panicking" {
5848	// Tiles are never compacted (pump threads hold pointers into the
5849	// array), so a vanished middle tile leaves a hole: present = {t,f,t}
5850	// and the tree holds leaves 0 and 2. serialize indexes spellings by
5851	// leaf ID, so the array must be tile-indexed — a dense array would
5852	// panic on spellings[2] with only two entries.
5853	const alloc = std.testing.allocator;
5854	var tmp = try TmpDir.make();
5855	defer tmp.cleanup();
5856	const path = try std.fmt.allocPrint(alloc, "{s}/layout", .{tmp.path()});
5857	defer alloc.free(path);
5858	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
5859	shared.tree = layout.Tree.init(alloc);
5860	shared.flat_alloc = alloc;
5861	defer shared.tree.deinit();
5862	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
5863	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
5864	try shared.tree.addFirst(0);
5865	try shared.tree.splitRight(0, 1);
5866	try shared.tree.splitRight(1, 2);
5867	// Tile 1 vanished: remove leaf 1 from the tree.
5868	shared.tree.remove(1);
5869	const tiles = try alloc.alloc(Tile, 3);
5870	defer alloc.free(tiles);
5871	for (tiles, 0..) \|*t, i\| {
5872	t.* = Tile{
5873	.r = .{
5874	.target = .{ .sock = "/tmp/x" },
5875	.label = switch (i) {
5876	0 => "--sock /tmp/x#a",
5877	1 => "--sock /tmp/x#b",
5878	else => "--sock /tmp/x#c",
5879	},
5880	.session = "",
5881	},
5882	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
5883	.shared = &shared,
5884	.idx = i,
5885	.wake_r = -1,
5886	.wake_w = -1,
5887	};
5888	}
5889	const present = [_]bool{ true, false, true };
5890	wall_layout.saveLayoutTo(alloc, path, tiles, &present, &shared);
5891	const got = wall.loadLayout(alloc, path) orelse return error.TestUnexpectedResult;
5892	defer alloc.free(got);
5893	// Tile 2's label is verbatim; the hole (tile 1) is never serialized.
5894	try std.testing.expect(std.mem.indexOf(u8, got, "--sock /tmp/x#c\n") != null);
5895	try std.testing.expect(std.mem.indexOf(u8, got, "--sock /tmp/x#b") == null);
5896	}
5897
5898	test "restore: a saved beside pair comes back verbatim on a tall terminal" {
5899	// Aspect at 40x30 would say stacked; the sidecar says beside and wins.
5900	const alloc = std.testing.allocator;
5901	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 40, .rows = 30 }, .is_tty = false };
5902	shared.tree = layout.Tree.init(alloc);
5903	shared.flat_alloc = alloc;
5904	defer shared.tree.deinit();
5905	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
5906	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
5907	const resolved = [_]Resolved{
5908	.{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#a", .session = "a" },
5909	.{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#b", .session = "b" },
5910	};
5911	const bytes = "mux-layout 1\nbeside 0\n leaf 40 --sock /tmp/x#a\n leaf 39 --sock /tmp/x#b\n";
5912	var focus_out: ?u8 = null;
5913	try std.testing.expect(wall_layout.restoreLayout(alloc, &resolved, &shared, bytes, &focus_out));
5914	const tiles = try alloc.alloc(Tile, 2);
5915	defer alloc.free(tiles);
5916	const present = [_]bool{ true, true };
5917	for (tiles, 0..) \|*t, i\| {
5918	t.* = Tile{
5919	.r = resolved[i],
5920	.rect = .{ .top = 0, .left = 0, .rows = 30, .cols = 40 },
5921	.shared = &shared,
5922	.idx = i,
5923	.wake_r = -1,
5924	.wake_w = -1,
5925	};
5926	}
5927	wall_layout.relayout(alloc, tiles, &present, &shared, 0);
5928	try std.testing.expectEqual(@as(u16, 0), tiles[1].rect.top);
5929	try std.testing.expect(tiles[1].rect.left > 0);
5930	}
5931
5932	test "restore: heals — unknown wall line inserted, lost leaf dropped" {
5933	// Sidecar knows a, GONE and c side by side; the wall has a, c and NEW.
5934	// Three saved leaves, not two: with two, dropping one collapses the
5935	// container and every heal lands on the default cut, so the claim
5936	// ("inserted BESIDE the match") could not be seen.
5937	const alloc = std.testing.allocator;
5938	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
5939	shared.tree = layout.Tree.init(alloc);
5940	shared.flat_alloc = alloc;
5941	defer shared.tree.deinit();
5942	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
5943	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
5944	const resolved = [_]Resolved{
5945	.{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#a", .session = "a" },
5946	.{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#c", .session = "c" },
5947	.{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#new", .session = "new" },
5948	};
5949	const bytes = "mux-layout 1\nbeside 0\n leaf 26 --sock /tmp/x#a\n" ++
5950	" leaf 26 --sock /tmp/x#gone\n leaf 26 --sock /tmp/x#c\n";
5951	var focus_out: ?u8 = null;
5952	try std.testing.expect(wall_layout.restoreLayout(alloc, &resolved, &shared, bytes, &focus_out));
5953	try std.testing.expectEqual(@as(usize, 3), shared.tree.count());
5954	const flat = try shared.tree.flatten(alloc, 24, 80, wall_layout.wallFloors(3), null);
5955	defer flat.deinit(alloc);
5956	const a = flat.rectOf(0) orelse return error.TestUnexpectedResult;
5957	const c = flat.rectOf(1) orelse return error.TestUnexpectedResult;
5958	const new = flat.rectOf(2) orelse return error.TestUnexpectedResult;
5959	// The saved axis survives the drop — a heal that rebuilt the default
5960	// cut would stack these, giving them one left and three tops.
5961	try std.testing.expectEqual(a.top, c.top);
5962	try std.testing.expectEqual(a.top, new.top);
5963	// NEW landed next to the match (a), not at either end by accident.
5964	try std.testing.expect(a.left < new.left);
5965	try std.testing.expect(new.left < c.left);
5966	}
5967
5968	test "restore: zero matches or garbage degrade to false" {
5969	const alloc = std.testing.allocator;
5970	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
5971	shared.tree = layout.Tree.init(alloc);
5972	shared.flat_alloc = alloc;
5973	defer shared.tree.deinit();
5974	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
5975	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
5976	const resolved = [_]Resolved{
5977	.{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#a", .session = "a" },
5978	};
5979	var focus_out: ?u8 = null;
5980	try std.testing.expect(!wall_layout.restoreLayout(alloc, &resolved, &shared, "not a sidecar", &focus_out));
5981	const nomatch = "mux-layout 1\nleaf 0 --sock /nowhere#z\n";
5982	try std.testing.expect(!wall_layout.restoreLayout(alloc, &resolved, &shared, nomatch, &focus_out));
5983	}
5984
5985	test "restore: duplicate spellings pair positionally" {
5986	// Wall shows one host twice: same spelling on both lines. Saved
5987	// leaves 0 and 1 share it; leaf 0 takes wall 0, leaf 1 takes wall 1.
5988	const alloc = std.testing.allocator;
5989	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
5990	shared.tree = layout.Tree.init(alloc);
5991	shared.flat_alloc = alloc;
5992	defer shared.tree.deinit();
5993	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
5994	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
5995	const resolved = [_]Resolved{
5996	.{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#dup", .session = "dup" },
5997	.{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#dup", .session = "dup" },
5998	};
5999	// Lopsided on purpose: with near-equal weights a mispairing produces
6000	// near-equal rects and hides in the leaf count.
6001	const bytes = "mux-layout 1\nbeside 0\n leaf 59 --sock /tmp/x#dup\n leaf 20 --sock /tmp/x#dup\n";
6002	var focus_out: ?u8 = null;
6003	try std.testing.expect(wall_layout.restoreLayout(alloc, &resolved, &shared, bytes, &focus_out));
6004	try std.testing.expectEqual(@as(usize, 2), shared.tree.count());
6005	// Pairing is the whole claim and it IS observable: saved leaf 0 owns
6006	// the left, wide slot, so it must be wall tile 0. Paired the other
6007	// way round the count is still 2 and the tiles have swapped screens.
6008	const flat = try shared.tree.flatten(alloc, 24, 80, wall_layout.wallFloors(2), null);
6009	defer flat.deinit(alloc);
6010	const t0 = flat.rectOf(0) orelse return error.TestUnexpectedResult;
6011	const t1 = flat.rectOf(1) orelse return error.TestUnexpectedResult;
6012	try std.testing.expect(t0.left < t1.left);
6013	try std.testing.expect(t0.cols > t1.cols);
6014	}
6015
6016	test "restoreLayoutFrom: dense sidecar indices land on the real tile indices" {
6017	// Tile 1 was forgotten, so the dense array is 0,2,3 and the two index
6018	// spaces disagree. With no hole they coincide and the second remap is
6019	// untestable by construction — which is how a tile could be handed the
6020	// rect flattened for its neighbour and no test would say so.
6021	const alloc = std.testing.allocator;
6022	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
6023	shared.tree = layout.Tree.init(alloc);
6024	shared.flat_alloc = alloc;
6025	defer shared.tree.deinit();
6026	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
6027	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
6028	const labels = [_][]const u8{
6029	"--sock /tmp/x#a",
6030	"--sock /tmp/x#hole",
6031	"--sock /tmp/x#c",
6032	"--sock /tmp/x#d",
6033	};
6034	var tiles: [4]Tile = undefined;
6035	for (&tiles, 0..) \|*t, i\| {
6036	t.* = .{
6037	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = labels[i], .session = "" },
6038	.rect = .{ .top = 0, .left = 0, .rows = 24, .cols = 80 },
6039	.shared = &shared,
6040	.idx = i,
6041	.wake_r = -1,
6042	.wake_w = -1,
6043	};
6044	}
6045	var present = [_]bool{ true, false, true, true };
6046	// Three unequal weights over 80 columns less two rails: 40+20+18 = 78,
6047	// so each tile's width names which saved leaf it was given.
6048	const bytes = "mux-layout 1\nbeside 0\n leaf 40 --sock /tmp/x#a\n" ++
6049	" leaf 20 --sock /tmp/x#c\n leaf 18 --sock /tmp/x#d\n";
6050	var restored_focus: ?usize = null;
6051	wall_layout.restoreLayoutFrom(alloc, &tiles, &present, 4, &shared, bytes, &restored_focus) orelse
6052	return error.TestUnexpectedResult;
6053	const flat = try shared.tree.flatten(alloc, 24, 80, wall_layout.wallFloors(3), null);
6054	defer flat.deinit(alloc);
6055	try std.testing.expectEqual(@as(?layout.Rect, null), flat.rectOf(1));
6056	const a = flat.rectOf(0) orelse return error.TestUnexpectedResult;
6057	const c = flat.rectOf(2) orelse return error.TestUnexpectedResult;
6058	const d = flat.rectOf(3) orelse return error.TestUnexpectedResult;
6059	try std.testing.expectEqual(@as(u16, 40), a.cols);
6060	try std.testing.expectEqual(@as(u16, 20), c.cols);
6061	try std.testing.expectEqual(@as(u16, 18), d.cols);
6062	try std.testing.expect(a.left < c.left);
6063	try std.testing.expect(c.left < d.left);
6064	}
6065
6066	test "restore: focus_out maps the saved focus through the spelling match" {
6067	// Saved leaf 1 matches wall tile 1 (b) → focus_out == 1. Saved leaf 1
6068	// matches NO wall tile (gone) → focus_out stays null.
6069	const alloc = std.testing.allocator;
6070
6071	// Matched: focus 1 → tile 1.
6072	{
6073	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
6074	shared.tree = layout.Tree.init(alloc);
6075	shared.flat_alloc = alloc;
6076	defer shared.tree.deinit();
6077	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
6078	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
6079	const resolved = [_]Resolved{
6080	.{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#a", .session = "a" },
6081	.{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#b", .session = "b" },
6082	};
6083	const bytes = "mux-layout 1\nbeside 0\n leaf 40 --sock /tmp/x#a\n leaf 39 --sock /tmp/x#b\nfocus 1\n";
6084	var focus_out: ?u8 = null;
6085	try std.testing.expect(wall_layout.restoreLayout(alloc, &resolved, &shared, bytes, &focus_out));
6086	try std.testing.expectEqual(@as(?u8, 1), focus_out);
6087	}
6088
6089	// Unmatched: saved leaf 1 (gone) has no wall tile → focus_out null.
6090	{
6091	var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
6092	shared.tree = layout.Tree.init(alloc);
6093	shared.flat_alloc = alloc;
6094	defer shared.tree.deinit();
6095	defer if (shared.last_flat) \|*f\| f.deinit(alloc);
6096	defer if (shared.base_flat) \|*f\| f.deinit(alloc);
6097	const resolved = [_]Resolved{
6098	.{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#a", .session = "a" },
6099	.{ .target = .{ .sock = "/tmp/x" }, .label = "--sock /tmp/x#new", .session = "new" },
6100	};
6101	const bytes = "mux-layout 1\nbeside 0\n leaf 40 --sock /tmp/x#a\n leaf 39 --sock /tmp/x#gone\nfocus 1\n";
6102	var focus_out: ?u8 = null;
6103	try std.testing.expect(wall_layout.restoreLayout(alloc, &resolved, &shared, bytes, &focus_out));
6104	try std.testing.expectEqual(@as(?u8, null), focus_out);
6105	}
6106	}
6107
6108	test "tileBanner: a prompt wider than its pane shows the tail inside the pane" {
6109	// A tile that painted a whole long spelling would run across the rail
6110	// into its neighbour, so the banner is bounded by the tile's rect and
6111	// not by the terminal. The tail is what is kept: the cursor end of the
6112	// line the user is still typing.
6113	const pipe = try std.posix.pipe();
6114	defer std.posix.close(pipe[0]);
6115	var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 80, .rows = 24 }, .is_tty = true };
6116	shared.label_rows = 1;
6117	var t = Tile{
6118	.r = .{ .target = .{ .sock = "/tmp/x" }, .label = "x", .session = "" },
6119	.rect = .{ .top = 2, .left = 5, .rows = 5, .cols = 10 },
6120	.shared = &shared,
6121	.idx = 0,
6122	.wake_r = -1,
6123	.wake_w = -1,
6124	};
6125	const text = ": --sock /tmp/very/long/paths_";
6126	try std.testing.expectEqual(@as(usize, 30), text.len);
6127	tileBanner(&t, text);
6128	std.posix.close(pipe[1]);
6129
6130	var out: [256]u8 = undefined;
6131	const n = try std.posix.read(pipe[0], &out);
6132	const got = out[0..n];
6133	// The tile's own corner: rect.top + label_rows + 1, rect.left + 1.
6134	try std.testing.expect(std.mem.indexOf(u8, got, "\x1b[4;6H") != null);
6135	const from = std.mem.indexOf(u8, got, "\x1b[7m").? + 4;
6136	const to = std.mem.indexOf(u8, got, "\x1b[0m").?;
6137	try std.testing.expectEqualStrings(text[text.len - 10 ..], got[from..to]);
6138	}
6139
6140	test "otherHosts: the dialled host is not tiled twice, and the rest follow in file order" {
6141	const alloc = std.testing.allocator;
6142	var tmp = try TmpDir.make();
6143	defer tmp.cleanup();
6144	var buf: [256]u8 = undefined;
6145	const path = try std.fmt.bufPrint(&buf, "{s}/hosts", .{tmp.path()});
6146	// Off-origin: the host the user dialled is the file's SECOND line, so a
6147	// skip that only ever worked on line 0 is caught here.
6148	try wall.saveBytes(path, "--sock /a\n--sock /b\n");
6149
6150	var arena_state = std.heap.ArenaAllocator.init(alloc);
6151	defer arena_state.deinit();
6152	const arena = arena_state.allocator();
6153	var specs: std.ArrayList(HostSpec) = .empty;
6154	try specs.append(arena, .{ .spelling = "--sock /b", .target = .{ .sock = "/b" }, .poll_target = .{ .sock = "/b" } });
6155	wall_host.otherHosts(arena, &specs, "--sock /b", path, null, 0);
6156
6157	try std.testing.expectEqual(@as(usize, 2), specs.items.len);
6158	try std.testing.expectEqualStrings("--sock /b", specs.items[0].spelling);
6159	try std.testing.expectEqualStrings("--sock /a", specs.items[1].spelling);
6160
6161	// A file the grammar refuses costs the user the WALL, never the session
6162	// they asked for: the entry host stands alone and the attach goes on.
6163	try wall.saveBytes(path, "--sock /a\nbox#old\n");
6164	var one: std.ArrayList(HostSpec) = .empty;
6165	try one.append(arena, .{ .spelling = "--sock /b", .target = .{ .sock = "/b" }, .poll_target = .{ .sock = "/b" } });
6166	wall_host.otherHosts(arena, &one, "--sock /b", path, null, 0);
6167	try std.testing.expectEqual(@as(usize, 1), one.items.len);
6168	}	2250	}