ea49739c

merge: integrate gui text selection sprint

a73x 2026-09-06 13:45

Commit message

merge: integrate gui text selection sprint

CLAUDE.md

Old		New
@@ -63,6 +63,16 @@ and their diagnostics live in `build.zig`; `test/bans.sh` tests enforcement.
63	- Agent forwarding is opt-in. Clipboard reads through OSC 52 are refused.	63	- Agent forwarding is opt-in. Clipboard reads through OSC 52 are refused.
64		64
65	Read the detailed contracts for the area being changed:	65	Read the detailed contracts for the area being changed:
		66	\| Folder \| Row — its child files \|
		67	\|---\|---\|
		68	\| `src/engine/` \| `term`(`term.zig`) — `protocol` `replica` `grid` · `engine`(`engine.zig`) — `delta` — the daemon's ghostty-vt; no client row imports it outside a test \|
		69	\| `src/server/` \| `daemon`(`server.zig`) — `server_agent` `server_sessions` `cmd` `shellint` `quic_server` `upgrade` `server_test_*` · `pty` \|
		70	\| `src/client/` \| `client` — `client_core` `hosts` `handoff` `layout` `keymap` `askpass` `selection` `session_pump` `buffered_wire` `open_wait` `resolver` `discovery` · `webhub` · `wasm_core` `client_core_wasm_check` (wasm roots the build wires outside the table) \|
		71	\| `src/gui/` \| `native_core`(`native_core.zig`) — `workspace` `runtime` `picker` `persistence` `interaction` `font_options` `config` `theme` · `native`(`native.zig`) — `font` `atlas` `quads` `gl` `frame` `bench` \|
		72	\| `src/tui/` \| `wall`(`wallview.zig`) — `interact` `paint` `predict` `wall_host` `wall_picker` `wall_pump` `wall_layout` `wall_test_*` \|
		73	\| `src/cli/` \| `mux`(dispatch) — `main`(daemon) `mux_main`(client) `webhub_main`(hub) · `muxg`(native viewer) · `agent`(`muxa.zig`) · `cliflags`(`flags.zig`) \|
		74	\| `src/os/` \| `server_os`(`server_os.zig`) — `server_os_linux` `server_os_macos` · `client_os`(`client_os.zig`) — `client_os_linux` `client_os_macos` · `spawn` — the platform layer, one row per side so the client never links a fork or a pty; imports nothing of ours (spec 2026-09-03) \|
		75	\| `src/` \| `xdg` `sockpath` `dial` `link` `serve` `proxy` `quic` `testtmp` — what both sides link; `dial` is the client side of a daemon socket and `link` the live connection under it whatever reached it (fd, handoff stdio, QUIC), `serve` the right to bind a socket path and the duty to unlink it, `term` and nothing else under them \|
66		76
67	- [Terminal and agent contracts](docs/terminal-contracts.md).	77	- [Terminal and agent contracts](docs/terminal-contracts.md).
68	- [Daemon, transport and upgrade contracts](docs/daemon-contracts.md).	78	- [Daemon, transport and upgrade contracts](docs/daemon-contracts.md).

README.md

Old		New
@@ -79,6 +79,15 @@ sessions survive. Glyphs refresh automatically when display scale changes,
79	retaining the selected family. Installed Nerd Font Mono icons use that face;	79	retaining the selected family. Installed Nerd Font Mono icons use that face;
80	font fallback and cross-cell programming ligatures are not implemented.	80	font fallback and cross-cell programming ligatures are not implemented.
81		81
		82	In the native GUI, a left drag selects and copies text unless the application
		83	has requested mouse reporting. Applications such as tmux then receive ordinary
		84	clicks and drags; hold Shift when starting a drag to select locally instead.
		85	That choice remains fixed until release, even if Shift changes or the pointer
		86	crosses another pane. Ctrl+Shift+C copies the current local selection.
		87	Application OSC 52 writes update the desktop clipboard (`c`) or primary
		88	selection (`p`/`s`); clipboard queries remain refused. GUI paste is not yet
		89	implemented.
		90
82	Choose a Ghostty theme file by name in `$XDG_CONFIG_HOME/mux/themes/` (or	91	Choose a Ghostty theme file by name in `$XDG_CONFIG_HOME/mux/themes/` (or
83	`~/.config/mux/themes/`), or by absolute path:	92	`~/.config/mux/themes/`), or by absolute path:
84		93

RETRO.md

+| Issue | Current gap and evidence |
+| --- | --- |
+| `8b16e26b` mouse/wheel/selection | Visible-text drag selection and desktop copy are now delivered on the text-selection branch (demo acceptance pending). Wheel/history navigation, application mouse forwarding, extended selection gestures and GUI paste remain. See the text-selection delivery entry below; the user selected this slice before wheel scrolling. |
+| `f3cf5785` SSH askpass | No native prompt UI for passphrases or first-use host-key confirmation. TUI owns the askpass listener/prompt flow; shared askpass support exists. Earlier SSH failure classification did not implement prompts. |
+| `50ca9ba5` agent forwarding | No GUI `-A` policy or agent relay. Picker targets disable forwarding; functional relay handling remains in the TUI pump. |
+| `fb4a0ee4` prediction | No native local typing prediction overlay. The predictor remains TUI-local; sharing must preserve the authoritative replica. |
+webpage/video requirements. Implementation has not started. Ligatures remain
+deferred. Retain the appearance worktree's live review pages and preserve main's
+staged user retro file when fast-forwarding.
+## Wheel sprint opening — ownership and duplication cleanup, 2026-09-06
+The user asked to review duplication, hexagonal architecture opportunities and
+refactoring, then clarified that font validation should belong to fonts rather
+than either input adapter. `font_options.zig` now owns the shared point-size
+rule. CLI/config callers retain their diagnostics; installed-face/monospace
+validation stays in `font.zig`. The first proposal shared the helper from config;
+that removed repetition but assigned the rule to the wrong owner. Removed a
+redundant empty-family check already enforced by the text parser.
+Font settings, config and theme source now belong to the window-free native core.
+The native renderer consumes core theme values and preserves its existing public
+aliases. Luna implemented the bounded change; Terra reviewed ownership, error
+mapping and module/test reachability. Closing review removed a stale comment
+and retained the upper-limit rationale with its new policy owner. No extra
+transport or filesystem abstraction was introduced for a single caller.
+Independent dependency probes hid GUI package metadata: all 29 native core tests
+passed, and the matching full GUI build failed on missing SDL3 as expected.
+Native build/units, full native integration and full CI passed.
+Evidence is in `dist/wheel-opening-cleanup/` in the new worktree. The first native
+integration launch overlapped the check stage's temporary source-ban mutation;
+it failed before building and passed after that stage finished. Both logs are
+retained. The native workflow now explicitly serializes other builds against
+that stage. Existing approved appearance recordings remain the visual baseline;
+this opening refactor adds no visible feature or performance claim.
+Carry forward into wheel implementation: semantic wheel intent crosses the
+runtime/pump boundary; the pump consumes available mode frames before deciding
+history versus application input. Do not sample mutable pump modes in the GUI
+and queue pre-encoded bytes. Keep history/live snapshot ownership and reply
+correlation explicit, share actual semantic helpers instead of copying the TUI
+interaction core, and inject real SDL wheel events in the retained test adapter.
+These are implementation constraints, not completed wheel behavior.
+## Text selection opening cleanup — 2026-09-06
+The user selected text selection as the next sprint using the updated skill.
+Wheel behavior remains unimplemented; its plan is deferred. The reuse map in
+`docs/superpowers/plans/2026-09-06-native-text-selection.md` identifies existing
+drag state, daemon extraction and shared request correlation before feature edits.
+Moved the pure TUI selection module and all its tests to `client.selection`;
+both frontends can consume one gesture model. Deleted the old TUI source path
+and updated existing callers without changing wall behavior. Luna implemented;
+Terra independently found no opening-cleanup defect. The first focused client
+test attempt was sandbox-blocked on local sockets; the required escalated
+`make check` covers those tests. Logs are in `dist/text-selection/`.
+Feature work owns the remaining snapshot/request freshness checks and SDL
+clipboard adapter. Review identified a send-time race in addition to UI
+cancellation: the pump must compare the displayed sequence when sending and
+receiving. The existing protocol does not carry a server sequence precondition;
+observed output changes can be rejected, but atomic copying of a historical
+frame is not promised. A protocol-level version guard is retained for the next
+selection-consistency change if that stronger guarantee is required.
+## Native text selection delivery — 2026-09-06
+Implemented visible text drag selection and desktop copy on release. The user
+selected this before wheel scrolling; wheel remains deferred and unimplemented.
+The shared selection model was moved once in opening commit `b0a68b1`; both
+frontends consume it. Daemon extraction and the existing wire remain the owners
+of Unicode, soft wraps, trimming and wide-cell copy semantics.
+The reuse map guided implementation. Closing cleanup replaced repeated source
+version fields/rules with `SelectionVersion`, centralized pump invalidation,
+removed redundant held-range storage and the painter's duplicate span type.
+Queued request tickets cancel work before transmission; one owned result and a
+bounded deadline cross into the SDL clipboard adapter. Core rules remain free
+of window/font libraries. No new runtime dependency or protocol message was
+introduced. Root completed shared pump cleanup/tests after Luna's initial
+integration; Terra independently reviewed the final production diff.
+Review and real checks caught coordinate/history overflow, cross-pane subtraction,
+mouse capture remaining after release, lost divider release coordinates, stale
+press-version replacement, mode/reconnect invalidation, timeout locking,
+allocation-failure ownership and empty-copy behavior. All actionable production
+findings were resolved. Initial focused test claims covered existing tests only;
+closing work added explicit transport and GUI high-history cases before delivery.
+Full CI, client/native units/build, native integration, core-without-GUI metadata,
+real NVIDIA Wayland pointer/clipboard checks and both selection-specific and
+retained DPI gates passed. Separate NVIDIA stress passed with frame p99 19,267 us
+and sampled input upper bound 65.3 ms; historical frame-budget misses remain
+unexplained. Logs and earlier failed fixture attempts remain in
+`dist/text-selection/`. No macOS or performance improvement is inferred.
+The 24.4-second continuous recording uses real Wayland pointer motion and reads
+clipboard contents with a separate client. SDL injection alone lacked a valid
+Wayland input serial; the retained pointer adapter now makes that boundary
+explicit. Clipboard publication is asynchronous, so the independent reader waits
+for offers to arrive. An early recorder failure skipped cleanup; the recorder
+now guarantees fixture teardown and root stopped only that failed fixture's
+owned processes. Private page: https://charizard.folk-amberjack.ts.net/text-selection/ .
+Demo approval remains pending; automated success is not user acceptance.
+Carry-forward actions and ownership:
+- Next selection-consistency sprint: the existing wire has no source-version
+  precondition at the daemon. Observed changes cancel copying, but an atomic
+  historical-frame copy would require coordinated wire/frontend work.
+- Next mouse-parity sprint: implement wheel/history, then assess edge autoscroll,
+  word/line/rectangular selection and GUI paste as separately scoped behavior.
+  Application mouse forwarding remains open under issue `8b16e26b`.
+- Next renderer follow-up: investigate earlier NVIDIA budget misses and offscreen
+  growth artifacts. Current passes do not settle their cause.
+- Next recording/tooling change: consider promoting the retained C virtual-pointer
+  helper and recorder assets; the Python input adapter is now shared by tests and
+  this demo, while source/protocol/binary provenance remains with the artifacts.
+- Next frame/test-protocol change: assess broader extraction of passive hooks;
+  this slice added one read-only clipboard observation, not a second input path.
+The final private page passed HTTP range, desktop/mobile layout, playback and
+seeking checks; all three appearance pages still return success. The final
+retained recorder also passed after explicitly focusing the owned window before
+its first pane click. Offscreen selection was rechecked after the Wayland driver
+addition. Browser and compositor fixtures are stopped; only the allowlisted
+loopback page server (PID 3384909, port 18774) remains. The main checkout's staged
+`RETRO.pre-native-merge.md` remains byte-for-byte unchanged.
+### Acceptance teardown and application scrolling follow-up
+The user requested teardown after demo acceptance. Removed the three accepted
+appearance routes and stopped their verified page-server processes; retained
+their recordings and page sources. Only the text-selection route remains pending
+review, and its page still responds successfully. The maintained sprint skill
+and native guide now require this cleanup on acceptance, including verification
+and preservation of unrelated services. Evidence:
+`dist/text-selection/accepted-demo-teardown.json`.
+A focused probe ran real Vim and less in isolated daemon PTYs with the native
+offscreen GUI. In both apps, keyboard scrolling clears the GUI highlight while
+preserving text already copied on release. Scrolling during a held drag cancels
+it without overwriting the clipboard. Framebuffer and clipboard observations
+passed; all probe processes were closed. This does not add wheel scrolling or
+application mouse forwarding. Evidence and the rerunnable probe remain under
+`dist/text-selection/app-scroll*` and `check-app-selection.py`.
+### Hands-on copy shortcut — 2026-09-06
+The hands-on review found Ctrl+Shift+C reached the PTY as Ctrl+C. The SDL adapter
+now recognises the copy chord and the controller consumes it before terminal
+input, even with no selected range. Copy on release and explicit copying share
+one versioned request queue. Highlight and stale-attachment rules remain in the
+controller; extraction and clipboard writing keep their existing owners. The
+small cleanup removed an unnecessary forwarding helper. No new module,
+dependency or wire message was introduced.
+Luna implemented and Terra reviewed. Root caught a modifier-mask mistake that
+required both left and right modifiers simultaneously; the final adapter tests
+cover all four physical Ctrl/Shift combinations and Alt/GUI/Mode exclusions.
+The real-PTY regression independently records SIGINT: shortcut copy during a
+held drag, after release and without a selection leaves the process alone;
+ordinary Ctrl+C still interrupts it. Root also corrected test ordering races by
+waiting for actual highlighted pixels before releasing output or injecting the
+shortcut after Wayland pointer input. Earlier failures remain in the logs.
+Full CI, native integration, native/core units, full offscreen and independent
+Wayland clipboard/scale checks passed. The user confirmed copying works in the restarted review GUI. The new
+.4-second continuous recording demonstrates copying before mouse release and
+independent `wl-paste` output. Its pointer events come through Wayland; the copy
+chord uses SDL event injection. Original footage is retained separately.
+The initial hands-on launch used default colors because the user's mux config
+does not exist; prior demonstrations used isolated configs. Relaunched with the
+recording's explicit appearance flags. Next hands-on launch: reuse the recorded
+appearance arguments in `dist/text-selection/hands-on-gui.json`, and distinguish
+demo config from persistent user config when describing the launch.
+The user reached for paste but agreed it can remain deferred. They clarified
+their mouse-selection example was Claude Code, whose fullscreen mode requests
+mouse reporting and displays its own copy toast. Alternate-screen state alone
+does not confer mouse ownership. The TUI's `Core.forward` branches on `appMouse()`;
+the GUI currently owns drags locally. `session_pump.onFrame` also skips validated
+application `clipboard_set` effects. The next mouse/clipboard parity slice must
+assess both application mouse forwarding and application clipboard requests,
+alongside GUI paste and copy feedback. See the upstream explanation at
+https://code.claude.com/docs/en/fullscreen#keep-native-text-selection .
+Confirmation of copying is hands-on feedback,
+not acceptance of the whole sprint or authorization to end daemon sessions.
+The user confirmed Shift+drag belongs to the overall mouse feature. It is now
+required acceptance for the application mouse/clipboard slice: force native
+selection despite application mouse reporting, retain gesture ownership through
+release and modifier changes, and prevent reports or text leaking across panes.
+The wheel plan records the remaining order: wheel/history first, application
+mouse/clipboard next. The latter slice's planner owns carrying these criteria
+into implementation, tests and the demo; GUI paste remains deferred.
+## Native wheel scrolling — 2026-09-06
+Implemented the authorized next GUI/TUI parity slice: wheel over shell history,
+mode-aware alternate-screen arrows, negotiated application wheel reports and
+selection/copy from displayed history. Three panes on two daemons retain separate
+scroll positions and fractional remainders. Wheel does not change keyboard focus;
+menus, headers, dividers and command mode consume it. Application click/drag,
+application clipboard writes and the required Shift+drag override remain next.
+The controller owns geometry and gesture policy; the runtime checks attachment
+identity; the shared pump owns terminal modes, wire ordering and history memory.
+History uses the existing request/row decoder and a separate display grid, never
+a second replica. One outstanding fetch remains as a cancelled tombstone until
+drained, including across same-wire resync. New connections reset it; timeout
+reconnects. Grid and displayed origin are captured together. Output refreshes
+history while retaining its distance from live, and stale text cannot be copied.
+Luna implemented the GUI input seam and pure wheel encoder; root integrated the
+pump/runtime and real-boundary tests. Terra reviewed correctness and ownership.
+Closing cleanup removed a duplicate receive loop and hand-written UTF-8 encoding;
+standard key/Unicode encoding stays with its existing owner. No dependency or wire
+message was added, and frozen TUI behavior is unchanged. Production growth is
+concentrated in bounded history lifetime and semantic routing; no generic adapter
+framework or separate module was needed.
+Review and checks caught SDL wheel-coordinate fields, unrelated-selection
+cancellation, same-origin stale replies, history/live origin confusion, QUIC
+mailbox batching and a deleted pane stealing another pane's fractional remainder.
+Focused tests cover wire ordering, resync, resize, timeouts and legacy coordinate
+limits. Full CI and native integration passed on the final source. Real NVIDIA
+Wayland wheel/clipboard checks pass at 200%, 100%, 150% and 200%; the retained DPI
+resize gate also passed. Core tests run without GUI package metadata.
+A test application initially read a partially rewritten mode-control file and
+crashed; atomic replacement fixed the fixture. Earlier failed logs are retained.
+Draft test snippets were not treated as validation: root replaced incorrect
+fixture assumptions with tests exercising the production wire and mailbox.
+Next test author: verify fixture preconditions and assert the named behavior;
+a timeout test must exercise expiration, not merely compare the current clock.
+The local webpage and continuous actual-GUI recording show history scrolling,
+copying a history row through an independent clipboard reader and scrolling real
+less without changing keyboard focus. Desktop/mobile playback and seeking passed.
+Evidence is retained in `dist/wheel-scrolling/`; source is
+`docs/demos/native-wheel-scrolling.html`. User acceptance is pending.
+The user clarified delivery preferences: demos remain required; serve them on
+localhost by default. Publishing is optional only when explicitly requested,
+without routine prompts. The maintained skill and native workflow now say this
+and no longer embed a specific publishing provider or standing-publish step.
+The attempted remote publication was rejected by automatic approval review; no
+new remote route was created. The local page is the handoff. Preserve earlier
+services awaiting review and stop this page's owned server once accepted.
+Open work and ownership:
+- Renderer follow-up: investigate draw/swap timing at 60 Hz on NVIDIA. Initial
+  current build frame p99 was 20.199 ms, previous-release comparison 21.449 ms,
+  and current comparison 22.244 ms against the 20 ms limit. All input-response
+  samples passed the separate 250 ms bound; the current comparison's largest
+  observed upper bound was 98.4 ms with 5 ms polling. These are mixed historical
+  builds under the same conditions, not a speedup or no-regression claim. Keep
+  the failed logs and the pre-existing offscreen-growth issue open.
+- Next shared-client scheduling change: a continuously readable stream can defer
+  wheel input and following FIFO messages until ready mode frames are drained;
+  continuous output may postpone a safely selectable history refresh. A finite
+  protocol ordering boundary is the trigger if this is encountered; do not drop
+  input or silently copy stale rows.
+- Next application mouse/clipboard slice: Shift+drag must force native selection
+  through release and modifier changes; ordinary application gestures use pane
+  coordinates. Handle validated application clipboard writes. GUI paste remains
+  separately deferred.
+- Next portability run: repeat real desktop clipboard, wheel and DPI checks on
+  macOS. Linux success is not macOS coverage.
+Final-source timing passed at frame p99 18.745 ms and sampled input upper bound
+.3 ms. The earlier misses remain evidence for renderer follow-up, not discarded
+attempts or a performance-improvement claim. The final recording is 27 seconds.
+The localhost page is http://127.0.0.1:18776/wheel-scrolling/ ; publishing is no
+longer a pending action under the clarified workflow. Owned recording/browser
+and compositor fixtures are stopped after validation; the local review server
+remains pending acceptance.
+### Wheel selection feedback — 2026-09-06
+Hands-on feedback corrected the initial cancellation policy: a completed
+highlight must follow selected text through viewport scrolling, including
+scrolling away and back. The pump already distinguishes absolute source rows
+from the viewport origin. Removed the three viewport-only invalidations and
+made input invalidation explicit in the mailbox; no new production state,
+modules or dependencies were needed (four fewer production lines).
+Luna implemented the pump change; Terra independently reviewed freshness and
+input/resize/reconnect guards. Root corrected the regression fixture's history
+setup and verified actual pixels and independent Wayland clipboard reads.
+Held selection keeps its original anchor, with pointer motion/release resolving
+the endpoint in the current viewport. This intentionally permits extending a
+selection through scrolled history.
+The user requested hands-on review instead of a new demo recording for this
+feedback fix. The existing recording is retained and labelled as preceding this
+change. Demo acceptance remains pending.
+Lesson for the next mouse slice: distinguish source validity from viewport
+position; reuse the existing absolute selection coordinates. Keep the required
+Shift+drag override in that slice's acceptance criteria.
+Validation: client/native unit tests and the full native integration gate pass.
+Real NVIDIA Wayland wheel/selection checks pass all ten checkpoints at the
+retained scale transitions; the separate ten-checkpoint copy suite also passes,
+including stale output, delayed replies, resize and detach. Logs are retained as
+`dist/wheel-scrolling/selection-preserve-*.log`. The first unit attempt exposed
+an incomplete test setup after returning live; restoring history fixed the
+fixture, and the final run passed. The isolated test compositor was stopped.
+This bounded feedback fix makes no new performance or macOS claim.
+Repository `make check` passed inside the full `make ci` attempt. That attempt
+stopped in the existing terminal-client `agent-nested` exit wait (10 seconds),
+after the preceding e2e groups passed. The targeted `10_agent` rerun passed all
+six scenarios without source changes. Retain the failure rather than claiming
+a fully green CI run; the later e2e groups did not run in this attempt. Next
+trigger for the agent-test owner: investigate if this exit-wait timeout recurs.
+The remaining agent and throughput gates passed in the follow-up run.
+### Active-output selection feedback — 2026-09-06
+The user isolated a misleading fullscreen symptom: Claude's counter paused in
+the smaller window, and selection failed as soon as it resumed. Root reproduced
+this with a real tmux counter and real Wayland pointer/clipboard. Geometry
+inspection found no fullscreen-specific hit defect.
+The user's Ghostty reference led to a simpler policy: keep the live selected
+range through redraws and copy current text, even after that text is overwritten.
+Terra verified the pinned Ghostty selection/page ownership and reviewed the
+client validity predicate. Root implemented the pump-only change; the new source
+provenance flag preserves strict cached-history freshness after returning live.
+No per-cell tracking, duplicate extraction, new module, daemon change or wire
+extension was needed. Existing epoch, dimensions, modes, input, attachment and
+history-watermark guards remain. This supersedes prior retro statements that
+any selected-pane output must cancel copying.
+Acceptance now includes a counter that demonstrably advances during held and
+released selection/copy, real tmux, windowed/fullscreen Wayland, and copying the
+current text after an overwrite. Evidence is `dist/wheel-scrolling/active-selection-*`.
+The first counter run reproduces the bug. A later full-fixture run exposed shell
+job-completion text overwriting the next specimen; the fixture now waits for its
+writer before repainting. User requested hands-on review, with no new recording.
+Follow-up owner/trigger: the next history-identity slice must define scrolling,
+reflow and capped-history eviction identity before promising Ghostty's tracked
+pin behavior across the remote protocol. No atomic source snapshot is claimed.
+Validation: client/native units and full native integration pass. Actual NVIDIA
+Wayland selection passes eleven checkpoints through real tmux, and wheel/history
+passes all ten checkpoints including scale transitions. Final focused review has
+no remaining finding. The owned isolated compositor is stopped; existing demo
+servers awaiting acceptance are preserved. No new recording, macOS verification
+or performance claim is made for this behavioral fix.
+The final full `make ci` run passed, including all e2e, agent and throughput
+gates. The prior nested-agent timeout did not recur. Hands-on acceptance is
+still pending; source commit and tests do not imply user approval.
+### Follow-up: moving text and tmux selection ownership
+The user's two-client trial found two remaining gaps. First, retaining a range
+through redraws does not track the same line through terminal scrolling; the
+highlight must move with that line and subsequent copy must still name it.
+Second, foot's apparent tmux-owned drag can be visible in muxg because tmux paints
+it, whereas muxg's current local drag is not sent to tmux. Local desktop copy,
+tmux's paste buffer and shared selection rendering are distinct outcomes.
+Added explicit acceptance scenarios to the text-selection plan: row-following
+belongs to the selection-identity slice; normal application drag, shared tmux
+selection, independent buffer/clipboard checks and required Shift+drag override
+belong to the application mouse slice. Neither gap is claimed fixed by the
+redraw-preservation commit. User acceptance of the overall feature is pending.
+### Application mouse and clipboard writes — 2026-09-06
+The Ghostty/foot comparison identified separate owners: a normal drag belongs
+to an application that requests mouse reporting; Shift at press chooses native
+selection for the complete gesture. Alternate screen alone does not decide.
+The new controller captures the originating attachment and mode token; the pump
+owns reports, original-format cancellation and stale-event rejection. The shared
+wheel encoder now supplies all pointer formats. Application clipboard writes
+reuse ClientCore validation and bounded decoding, with one shared text predicate
+and SDL writer. No daemon, wire, dependency or new module was needed. The functional change
+adds 291 production Zig lines beyond the opening refactor (excluding embedded
+unit tests and build wiring): 134 for pump lifecycle/delivery, 88 for pane input
+policy, 48 for SDL adaptation/hooks, and 21 for clipboard decoding/validation.
+The growth buys the missing behavior while retaining existing owners.
+Luna implemented the opening encoder and initial controller/decoding/tests;
+Terra independently reviewed the boundaries and built acceptance fixtures; root
+integrated and independently validated them. Review and compilation caught
+incorrect expected bytes, runtime enum/character typing, double-counted pixel
+origins, partial-cell bounds, button ownership and outside-coordinate handling.
+The opening cleanup commit preceded the complete formatter gate because a
+concurrent GUI edit entered that check. Next sprint coordinator action: freeze
+all touched source until the opening check exits, then commit; never infer a
+successful gate from completed unit output. The later integrated check passed.
+Real NVIDIA Wayland checks verify direct application reports and both clipboard
+targets with independent wl-paste reads. A separate foot/muxg two-client tmux
+fixture verifies ordinary selection and the shared tmux paste buffer in both
+directions, plus Shift-local copying without changing tmux state. An attempted
+raw-program-inside-tmux cancellation check assumed the inner application's
+mouse-off would disable the outer terminal's reporting. That assumption is
+false; removed that redundant path and kept direct mode-cancellation and shared
+tmux selection as separate oracles. Failure logs remain with the final evidence
+under `dist/application-mouse/`.
+The user requested a hands-on binary without a new recording. No review server
+or publication was created; previous pending demos remain untouched. Hands-on
+acceptance is still pending. Final delivery gate results and fixture teardown
+are recorded below.
+Retained debt and next owners/triggers:
+- Selection-identity slice: track the same text through terminal scrolling,
+  reflow and history eviction. This sprint fixes tmux-owned selection sharing;
+  it does not give native local selection terminal line identity.
+- Input owner: GUI paste and composition remain separate. Additional physical
+  mouse buttons during a held gesture are ignored; add chorded gestures only
+  when needed, preserving each original attachment and cancellation contract.
+- Platform owner: Linux/Wayland evidence does not establish macOS. Native primary
+  selection uses the available SDL adapter; numbered and secondary OSC52 targets
+  remain unsupported, and clipboard reads remain refused.
+- Transport owner: the existing wheel wait behind a continuously readable stream
+  remains a separate liveness follow-up; no scheduler rewrite was added here.
+Final validation: full CI passed all 117 e2e scenarios, agent and throughput;
+final required check and ReleaseSafe native-core/native units passed. Full native
+integration passed, followed by separate final NVIDIA Wayland direct mouse,
+shared foot/tmux, ten wheel/scale and eleven selection checkpoints. The owned
+compositor PID 49292 was stopped and verified; test rigs cleaned up their own
+processes. Previous pending demos and the user's staged main-worktree file remain
+untouched.
+The native raw-output frame gate remains red: initial p99 20.597 ms against a
+ms budget. A controlled comparison reproduced it on the prior wheel release
+(23.134 ms) and new release (21.374 ms). All had ongoing output, successful
+reopen and input-to-painted upper bounds below 61 ms. Presentation dominated;
+this does not establish a stable performance pass or an improvement. Keep
+`stress.log`, `stress-baseline.log`, `stress-comparison.log` and their JSON
+artifacts. Renderer owner follow-up: resolve the existing NVIDIA presentation
+budget variability using this same isolated fixture; do not widen the budget
+or rerun until green. The new mouse feature is handed off for functional review
+with this limitation explicit.
+Application-mouse demo follow-up: user explicitly requested recording and
+publication after the hands-on handoff. Created the maintained review page and
+a 32.4-second continuous actual GUI recording, with input automation disclosed.
+Independent page review caught primary-selection coverage described as part of
+the video; corrected it to separate automated coverage. Both clients in the
+recording are muxg panes; foot remains separate acceptance evidence. Published
+only `/application-mouse` on the existing private host, preserving the older
+route. HTTPS page and byte ranges verified; recording fixtures stopped. Server
+PID 99795 remains pending acceptance, with exact ownership and targeted teardown
+in `dist/application-mouse/server.json` and the sprint plan.
+Application mouse/clipboard product sign-off — 2026-09-06: the user accepted
+the published demo and explicitly signed off the product slice. This is recorded
+demo review, not an assertion of additional hands-on testing. Removed only its
+`/application-mouse` sharing route, verified ownership and stopped server PID
+, and confirmed port 18777 closed. The existing text-selection route was
+preserved. Recording, page and test evidence remain; cleanup is recorded in
+`dist/application-mouse/accepted-demo-teardown.json`. The existing rendering
+budget issue and selection-identity/paste follow-ups remain open. No next sprint
+was started by this sign-off.
+### Selection follows terminal output — 2026-09-06
+Completed native selections now follow their original terminal occurrence
+through primary history and vertical scroll regions. Ctrl+Shift+C resolves the
+tracked endpoints; a held copy uses its current range and release registers the
+final range. One selection request/reply now covers extract/start/copy/clear for
+native, TUI and browser callers. Daemon and clients must be rebuilt together;
+compatibility was explicitly excluded.
+The daemon owns Ghostty pins and text extraction, the pump owns correlation and
+attachment lifetime, and the GUI receives position and grid together. Opening
+inspection needed no separate cleanup. Closing cleanup removed the parallel
+protocol and unused state. Independent Terra review approved these boundaries;
+Luna handled bounded implementation/fixtures, and root integrated, reviewed and
+tested actual behavior. Ghostty owns ordinary page movement and eviction. Its
+partial-region row-copy/rotation paths need explicit external-pin movement;
+REP now reuses the normal print hook rather than cancelling ordinary redraws.
+Review fixed an extraction lifetime bug, pin-allocation cleanup, alternate-screen
+allocator reuse, and partial-region endpoint movement. Assertions that a pin
+still existed hid wrong coordinates: retained selections now assert both moved
+coordinates and extracted distinct text. Validate library behavior against the
+pinned implementation and compiler, not assumptions about APIs or privacy.
+Re-copy acceptance first replaces the clipboard with a sentinel; unchanged
+clipboard text alone proves nothing. Fixture header clicks clear selection, so
+neighbour output uses the owned PTY directly. Wait for visible Wayland motion
+before a separate FIFO key injection; neither channel orders the other.
+Final CI passed all 117 e2e scenarios, 10 agent checks and throughput. Native
+units/integration and actual NVIDIA Wayland selection, wheel, scale, foot/tmux
+and live tmux counter checks passed. A prior CI run compiled while source was
+changing; coordinator action: hold the freeze through the entire CI command,
+including later agent/throughput builds, not only its check stage. Early failure
+logs are retained alongside the successful final runs.
+The raw-output frame gate still misses its existing 20 ms budget: 20.716 ms p99.
+Output and reopen progressed; sampled input-to-painted upper bounds were at most
+.4 ms including polling. Do not claim a performance pass or rerun until green.
+The 25-second actual GUI demo and review page remain on localhost, pending user
+product acceptance. The owned compositor and fixture apps are stopped; stop only
+server PID 257482 after verifying ownership on acceptance. Preserve unrelated
+demos. Full evidence and teardown are in the selection-follow sprint plan.
+Next owners/triggers:
+- Renderer owner: resolve the retained NVIDIA presentation budget variability
+  using the same isolated raw-output fixture; retain the budget and baseline.
+- Selection owner, when continuing this feature: held-drag movement, reflow,
+  character edits, rectangular margins and ranges crossing scroll-region
+  boundaries need explicit policies. They currently cancel conservatively;
+  preserve existing clipboard contents and add coordinate-plus-text oracles.
+- GUI input owner: paste and composition remain separate slices; ligatures are
+  still deferred. Platform owner: Linux evidence does not establish macOS.
+- Coordinator, on acceptance: record product review separately from architecture
+  and tests, verify/stop this demo server, and only then begin an authorized slice.
+Selection-follow product sign-off — 2026-09-06: the user approved after reporting
+that drag selection remains highlighted when scrolling the wheel and discussing
+the held-drag limitation. Clarified viewport movement versus terminal output
+moving the underlying rows. Recorded that specific hands-on observation and
+approval without treating it as manual coverage of every test. Verified ownership
+and stopped localhost demo server PID 257482; port 18778 is closed. Its compositor
+and app fixtures had already stopped. Retained the page, 25-second recording and
+check evidence, preserved unrelated services, and left the known NVIDIA frame
+budget debt open. No next sprint was started.

build.zig

Old		New
@@ -288,8 +288,9 @@ const mod_table = [_]ModSpec{
288	// through. It sits beside webhub for the same reason — both are fronts	288	// through. It sits beside webhub for the same reason — both are fronts
289	// on client's Transport and `client.hosts`' grammar; neither imports the	289	// on client's Transport and `client.hosts`' grammar; neither imports the
290	// other; both resolve a spelling through `client.Target.fromSpec`.	290	// other; both resolve a spelling through `client.Target.fromSpec`.
291	// The interaction loop, the painter, the selector and the prediction	291	// The interaction loop, painter and prediction overlay are CHILD FILES of
292	// overlay are CHILD FILES of this root rather than modules of their own,	292	// this root rather than modules of their own. Selection policy is a public
		293	// child of the client root so the native and terminal adapters share it,
293	// so nothing outside src/tui/ can name one: a second module claiming any	294	// so nothing outside src/tui/ can name one: a second module claiming any
294	// of those files is a file-in-multiple-modules compile error. `term` is	295	// of those files is a file-in-multiple-modules compile error. `term` is
295	// the children's as much as the root's: `term.replica` is the keyboard	296	// the children's as much as the root's: `term.replica` is the keyboard
@@ -1195,8 +1196,28 @@ pub fn build(b: *std.Build) void {
1195	native_theme_config.addArtifactArg(mux_exe);	1196	native_theme_config.addArtifactArg(mux_exe);
1196	native_theme_config.addArtifactArg(muxg_exe);	1197	native_theme_config.addArtifactArg(muxg_exe);
1197	native_theme_config.step.dependOn(&native_fonts.step);	1198	native_theme_config.step.dependOn(&native_fonts.step);
		1199	const native_selection = b.addSystemCommand(&.{ "python3", "-B", "test/native_selection.py" });
		1200	native_selection.addArtifactArg(mux_exe);
		1201	native_selection.addArtifactArg(muxg_exe);
		1202	native_selection.step.dependOn(&native_theme_config.step);
		1203	const native_selection_follow = b.addSystemCommand(&.{ "python3", "-B", "test/native_selection_follow.py" });
		1204	native_selection_follow.addArtifactArg(mux_exe);
		1205	native_selection_follow.addArtifactArg(muxg_exe);
		1206	native_selection_follow.step.dependOn(&native_selection.step);
		1207	const native_wheel = b.addSystemCommand(&.{ "python3", "-B", "test/native_wheel.py" });
		1208	native_wheel.addArtifactArg(mux_exe);
		1209	native_wheel.addArtifactArg(muxg_exe);
		1210	native_wheel.step.dependOn(&native_selection_follow.step);
1198	const native_e2e_step = b.step("native-e2e", "Run the native client's end-to-end leg (opt-in)");	1211	const native_e2e_step = b.step("native-e2e", "Run the native client's end-to-end leg (opt-in)");
1199	native_e2e_step.dependOn(&native_theme_config.step);	1212	const native_mouse = b.addSystemCommand(&.{ "python3", "-B", "test/native_mouse.py" });
		1213	native_mouse.addArtifactArg(mux_exe);
		1214	native_mouse.addArtifactArg(muxg_exe);
		1215	native_mouse.step.dependOn(&native_wheel.step);
		1216	const native_tmux_mouse = b.addSystemCommand(&.{ "python3", "-B", "test/native_tmux_mouse.py" });
		1217	native_tmux_mouse.addArtifactArg(mux_exe);
		1218	native_tmux_mouse.addArtifactArg(muxg_exe);
		1219	native_tmux_mouse.step.dependOn(&native_mouse.step);
		1220	native_e2e_step.dependOn(&native_tmux_mouse.step);
1200		1221
1201	// Both paths come from this build graph: a ReleaseSafe GUI beside a stale	1222	// Both paths come from this build graph: a ReleaseSafe GUI beside a stale
1202	// Debug daemon gives misleading latency numbers under raw terminal output.	1223	// Debug daemon gives misleading latency numbers under raw terminal output.

docs/component-ownership.md

Old		New
@@ -10,7 +10,7 @@ affected owner.
10	\| Area \| Owns \| Focused gate \|	10	\| Area \| Owns \| Focused gate \|
11	\| --- \| --- \| --- \|	11	\| --- \| --- \| --- \|
12	\| Daemon \| Authoritative terminal state and session lifecycle in `src/server/`, daemon engine files `src/engine/engine.zig` and `delta.zig`, and `src/os/server_os*` \| `make daemon-test` \|	12	\| Daemon \| Authoritative terminal state and session lifecycle in `src/server/`, daemon engine files `src/engine/engine.zig` and `delta.zig`, and `src/os/server_os*` \| `make daemon-test` \|
13	\| Native GUI \| `src/gui/native_core.zig` and its window free children (`workspace.zig`, `runtime.zig`, `picker.zig`, `persistence.zig`, `interaction.zig`), plus `src/gui/native.zig`, `frame.zig`, `bench.zig`, `atlas.zig`, `font.zig`, `quads.zig`, `gl.zig`, and `src/cli/muxg.zig` \| `make native-core-test` for policy; `make native` builds `muxg` and runs `native-test` \|	13	\| Native GUI \| `src/gui/native_core.zig` and its window free children (`workspace.zig`, `runtime.zig`, `picker.zig`, `persistence.zig`, `interaction.zig`, `font_options.zig`, `config.zig`, `theme.zig`), plus `src/gui/native.zig`, `frame.zig`, `bench.zig`, `atlas.zig`, `font.zig`, `quads.zig`, `gl.zig`, and `src/cli/muxg.zig` \| `make native-core-test` for policy; `make native` builds `muxg` and runs `native-test` \|
14	\| Shared wire/client \| The `term` component (`src/engine/term.zig`, `protocol.zig`, `grid.zig`, `replica.zig`), reusable `src/client/` services, and `src/dial.zig`, `src/link.zig`, `src/quic.zig` \| `make client-test`; use `make check` before handoff \|	14	\| Shared wire/client \| The `term` component (`src/engine/term.zig`, `protocol.zig`, `grid.zig`, `replica.zig`), reusable `src/client/` services, and `src/dial.zig`, `src/link.zig`, `src/quic.zig` \| `make client-test`; use `make check` before handoff \|
15		15
16	The daemon is the backend; terminal UI (`src/tui/`, `src/cli/mux_main.zig`),	16	The daemon is the backend; terminal UI (`src/tui/`, `src/cli/mux_main.zig`),
@@ -29,7 +29,12 @@ dependencies it compiles.
29		29
30	The native GUI is split into two build components. `native_core` owns pane	30	The native GUI is split into two build components. `native_core` owns pane
31	identity, attachment lifetime, persistence, picker state, native workspace	31	identity, attachment lifetime, persistence, picker state, native workspace
32	layout, and GUI interaction policy. It imports only `client` and `term`.	32	layout, GUI interaction policy, font settings, configuration parsing, and theme
		33	values/merging.
		34	It imports only `client` and `term`. Appearance policy tests therefore run without
		35	window or font libraries; the native root retains aliases for its callers.
		36	`font_options.zig` owns point-size policy. CLI/config parsers delegate to it;
		37	`font.zig` owns installed-face validation and rasterization through font libraries.
33	`native` owns the window and painter; `frame.zig` is the only GUI file that	38	`native` owns the window and painter; `frame.zig` is the only GUI file that
34	spells the window library. The native root reaches core through	39	spells the window library. The native root reaches core through
35	`@import("native_core")`, so core files have	40	`@import("native_core")`, so core files have

docs/demos/native-application-mouse.html

@@ @@ -0,0 +1,43 @@ @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Application mouse &amp; clipboard</title>
+  <style>
+    :root { color-scheme: dark; --bg:#101318; --panel:#181d25; --ink:#edf2f7; --muted:#aab5c2; --accent:#7dd3fc; --line:#303947; }
+    * { box-sizing:border-box; } body { margin:0; background:var(--bg); color:var(--ink); font:16px/1.55 system-ui,sans-serif; }
+    main { max-width:1000px; margin:auto; padding:3rem 1.25rem 5rem; } h1 { margin:0 0 .5rem; font-size:clamp(2rem,5vw,3.5rem); line-height:1.05; } h2 { margin-top:2rem; font-size:1.25rem; color:var(--accent); } p { color:var(--muted); } .lede { font-size:1.15rem; max-width:70ch; }
+    .card { margin-top:2rem; padding:1rem; background:var(--panel); border:1px solid var(--line); border-radius:12px; } video { display:block; width:100%; max-height:70vh; background:#080a0d; border-radius:8px; } a { color:var(--accent); } ul { color:var(--muted); padding-left:1.25rem; } li+li { margin-top:.4rem; } code { color:var(--ink); }
+    .status { display:inline-block; padding:.2rem .55rem; border:1px solid #a87927; border-radius:999px; color:#ffd580; font-size:.85rem; }
+  </style>
+</head>
+<body>
+<main>
+  <span class="status">Product signed off · 6 September 2026</span>
+  <h1>Application mouse &amp; clipboard</h1>
+  <p class="lede">Native mux panes now forward application mouse gestures and desktop clipboard writes while keeping Shift-drag local for text selection.</p>
+  <section class="card">
+    <video src="demo.mp4" poster="preview.png" controls playsinline preload="metadata"></video>
+    <p><a href="demo.mp4" download>Download the recording</a> · 32.4 seconds · 1100 × 700 · no audio</p>
+  </section>
+  <h2>What the recording shows</h2>
+  <ul>
+    <li>Normal drag forwarding in both directions to applications and tmux, across two mux sessions attached to the same tmux server.</li>
+    <li>Shift held at press keeps the gesture local through release.</li>
+    <li>An application OSC 52 write reaches the desktop clipboard, read independently with <code>wl-paste</code>.</li>
+    <li>Two separate mux daemon sessions attached to the same tmux server, checked with independent <code>wl-paste</code> and <code>tmux show-buffer</code> observations.</li>
+  </ul>
+  <h2>Evidence</h2>
+  <p>Source <code>03138bb</code>; no daemon update. Separate automated checks verify desktop and primary-selection writes (<code>c</code>, <code>p</code>/<code>s</code>). CI, 117 e2e cases, agent and throughput checks, native unit/e2e checks, and real NVIDIA Wayland validation passed. The existing 20 ms stress budget measured 20.6/21.4 ms; the previous wheel run measured 23.1 ms, so this page makes no stress improvement claim.</p>
+  <h2>Input disclosure</h2>
+  <p>Ordinary drags use genuine Wayland pointer input. The Shift modifier and pointer sequence use the ordinary SDL test hook with visible Wayland cursor motion. Fixture shell commands are entered through SDL keys.</p>
+  <h2>Limits</h2>
+  <ul>
+    <li>Local selection following text through scrolling and reflow remains open. Paste, IME, and ligatures remain separate work.</li>
+    <li>macOS behavior is unverified.</li>
+    <li>Recording metadata: continuous capture, no cuts, no audio, 5 fps, NVIDIA at 200% scale.</li>
+  </ul>
+</main>
+</body>
+</html>

docs/demos/native-selection-follow.html

@@ @@ -0,0 +1,46 @@ @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Selection follow through terminal output</title>
+  <style>
+    :root { color-scheme:dark; --bg:#101318; --panel:#181d25; --ink:#edf2f7; --muted:#aab5c2; --accent:#7dd3fc; --line:#303947; }
+    * { box-sizing:border-box; } body { margin:0; background:var(--bg); color:var(--ink); font:16px/1.55 system-ui,sans-serif; }
+    main { max-width:1000px; margin:auto; padding:3rem 1.25rem 5rem; } h1 { margin:0 0 .5rem; font-size:clamp(2rem,5vw,3.5rem); line-height:1.05; } h2 { margin-top:2rem; font-size:1.25rem; color:var(--accent); } p { color:var(--muted); } .lede { font-size:1.15rem; max-width:70ch; }
+    .card { margin-top:2rem; padding:1rem; background:var(--panel); border:1px solid var(--line); border-radius:12px; } video { display:block; width:100%; max-height:70vh; background:#080a0d; border-radius:8px; } a { color:var(--accent); } ul { color:var(--muted); padding-left:1.25rem; } li+li { margin-top:.4rem; } code { color:var(--ink); }
+    .status { display:inline-block; padding:.2rem .55rem; border:1px solid #a87927; border-radius:999px; color:#ffd580; font-size:.85rem; }
+  </style>
+</head>
+<body>
+<main>
+  <span class="status">Product approved · 6 September 2026</span>
+  <h1>Selection follows terminal output</h1>
+  <p class="lede">A completed selection keeps naming the same terminal occurrence when new output scrolls it upward. The recording uses a duplicate marker and its distinct successor so a stale coordinate or the other duplicate cannot pass the check.</p>
+  <section class="card">
+    <video src="demo.mp4" poster="preview.png" controls playsinline preload="metadata"></video>
+    <p><a href="demo.mp4" download>Download the recording</a> · 25 seconds · 960 × 600 · Linux NVIDIA Wayland · no audio</p>
+  </section>
+  <h2>What the recording shows</h2>
+  <ul>
+    <li>A notes pane sits on the left, the source pane has a nonzero origin on the right, and a third live pane remains active.</li>
+    <li>An ordinary Wayland pointer drag selects <code>SOURCE-DUPLICATE</code> and its <code>SOURCE-AFTER-006</code> successor while another duplicate appears elsewhere.</li>
+    <li>Three source rows arrive at one-second intervals. The selected occurrence moves with the terminal output, and its original framebuffer position clears.</li>
+    <li>An idle pane writes a clipboard sentinel through OSC 52. Notes reads that sentinel with independent <code>wl-paste</code>; Ctrl+Shift+C in the source pane then restores the followed selection, read back visibly in notes.</li>
+  </ul>
+  <h2>Controls and input</h2>
+  <p>Ordinary drag selects locally when the application has not requested mouse reporting. Hold Shift at press to select locally inside a mouse-reporting application. Ctrl+Shift+C asks the daemon to copy the completed tracked selection. The video uses genuine Wayland pointer input with a visible cursor; fixture output is emitted through fixture-owned PTYs.</p>
+  <h2>Validation</h2>
+  <p>Native unit and integration gates passed. Real NVIDIA Wayland checks passed for selection, scrolling, scale transitions, shared foot/tmux mouse behavior, and live tmux counters in windowed and fullscreen modes. Web ABI: 798 passed, 0 failed. Full CI passed: 117 end-to-end scenarios, 10 agent checks and throughput. Architectural review has no open blocker; product acceptance was given on 6 September 2026.</p>
+  <p>Rebuild both the daemon and client: they share the new selection protocol, with one request/reply path and no compatibility fallback.</p>
+  <h2>Limits and known debt</h2>
+  <ul>
+    <li>Completed selections follow output. Moving the viewport with the wheel preserves the selection. New terminal output moving the underlying rows during a held drag still cancels it; copying during a held drag remains supported. Resize/reflow, screen/mode changes and reset clear selection. Character insertion/deletion, rectangular margins and a range crossing a partially scrolled region also clear it. Paste, IME and ligatures are deferred.</li>
+    <li>The alternate screen and mouse-reporting scenario belongs to separate automation and is not claimed by this video.</li>
+    <li>Evidence is Linux-only. macOS behavior remains unverified.</li>
+    <li>The NVIDIA raw-output frame gate remains red: p99 20.7 ms against 20 ms. Output continued and reopen succeeded; sampled input-to-painted time stayed at or below 60.4 ms (including 5 ms polling). Prior-sprint measurements also missed this budget; no performance improvement is claimed.</li>
+    <li>Recording metadata: continuous capture, no cuts, no audio, 5 fps at 200% scale. The recording is a continuous 25-second capture.</li>
+  </ul>
+</main>
+</body>
+</html>

docs/demos/native-text-selection.html

@@ @@ -0,0 +1,34 @@ @@
+<!doctype html>
+<html lang="en">
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>mux · Text selection</title>
+<style>
+:root{color-scheme:dark;font-family:system-ui,sans-serif;background:#17191d;color:#e8e9ed}
+*{box-sizing:border-box}body{max-width:960px;margin:auto;padding:36px 22px 64px;line-height:1.65}
+h1{font-size:clamp(2rem,6vw,3.8rem);line-height:1.1;margin:12px 0 20px;letter-spacing:-.04em}h2{font-size:1.25rem;margin-top:32px}
+a{color:#99ded6}p{max-width:75ch}.eyebrow{font-size:.8rem;letter-spacing:.13em;text-transform:uppercase;color:#a1b5b3}
+video{width:100%;display:block;background:#101114;border-radius:10px;margin:22px 0 8px;border:1px solid #393f46}
+.cards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:28px 0}.card{padding:18px;border:1px solid #393f46;border-radius:10px}.card strong{display:block}.muted{color:#adb5bf}code{font-size:.9em;background:#272c32;padding:2px 5px;border-radius:4px}li{margin:8px 0}.status{color:#aadbd0}
+@media(max-width:650px){.cards{grid-template-columns:1fr}body{padding-top:24px}}
+</style>
+<p class="eyebrow">mux native · GUI / TUI parity</p>
+<h1>Select text.<br>Copy on release.</h1>
+<p>Drag across visible terminal text and copy it to the desktop clipboard. The GUI uses the existing shared gesture model; the daemon extracts the text, preserving Unicode and the difference between wrapped lines and real newlines.</p>
+<p class="status">Implemented · Automated checks passed · Demo acceptance pending</p>
+<video controls playsinline preload="metadata" poster="preview.png"><source src="demo.mp4" type="video/mp4">Your browser can <a href="demo.mp4">download the recording</a>.</video>
+<p class="muted">26.4 seconds, continuous recording · NVIDIA RTX 3080 · Wayland at 200% scale · <a href="demo.mp4">Open video</a></p>
+<div class="cards"><div class="card"><strong>One gesture model</strong>The terminal UI and native GUI share click, drag, direction and pane-confinement rules.</div><div class="card"><strong>Correct text ownership</strong>Copy requests use existing daemon extraction, including soft wraps and wide glyphs.</div><div class="card"><strong>Explicit cancellation</strong>Selection is cleared when observed output or geometry changes invalidate its coordinates.</div></div>
+<h2>What to try</h2>
+<ul><li>Drag across terminal text in either direction. Release to copy; the highlight remains until cleared. Ctrl+Shift+C also copies the current selection.</li><li>Select in another pane. A press focuses that pane, and the selection stays with its starting session.</li><li>A simple click clears the highlight without replacing the clipboard. Resizing, leaving the window or typing also clears selection. Ctrl+Shift+C with no selection does nothing; plain Ctrl+C still reaches the terminal.</li></ul>
+<p>The recording copies during a held drag with Ctrl+Shift+C, then reads the desktop clipboard using <code>wl-paste --no-newline</code> in another pane. Pointer input comes through Wayland; the recorded shortcut uses SDL event injection. GUI paste is a later slice.</p>
+<h2>Validation</h2>
+<p id="validation">Full CI, native units and integration passed. Real Wayland pointer tests verify desktop clipboard text, delayed replies, cancellation, timeouts and surviving shells. Held selection and fresh copying pass at 100%, 150% and 200%; the retained DPI/resize gate also passed. Core policy tests run without GUI package metadata.</p>
+<p>The copy shortcut is checked against a real foreground PTY process: Ctrl+Shift+C copies without SIGINT, including with no selection; plain Ctrl+C still delivers SIGINT. Adapter tests cover both sides of Ctrl and Shift.</p>
+<p>Separately measured NVIDIA responsiveness before the shortcut follow-up: frame p99 <strong>19.267 ms</strong> (20 ms limit); sampled input-to-painted upper bound <strong>65.3 ms</strong> (250 ms limit, up to 5 ms polling overhead). Earlier unexplained frame-budget misses remain a renderer follow-up; this pass is not a speedup claim.</p>
+<h2>Scope and limits</h2>
+<p>This slice selects visible text. Wheel scrolling, edge autoscroll, word and line selection, rectangular selection, GUI paste and application mouse forwarding remain pending. Ligatures are deferred.</p>
+<p>Verified with real Vim and less in the offscreen GUI: keyboard scrolling clears the GUI highlight but keeps text already copied. Scrolling before mouse release cancels that drag. Vim's own visual selection is separate.</p>
+<p>Observed changes in the selected pane cancel copying. Copying a frozen historical screen while fresh output arrives would need a later protocol change. These checks cover Linux; macOS validation remains open.</p>
+<p class="muted">Passing automated checks is separate from your demo approval. Feedback requested: selection feel, highlight readability and copy-on-release behavior.</p>
+</html>

docs/demos/native-wheel-scrolling.html

@@ @@ -0,0 +1,39 @@ @@
+<!doctype html>
+<html lang="en">
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>mux · Wheel scrolling</title>
+<style>
+:root{color-scheme:dark;font-family:system-ui,sans-serif;background:#17191d;color:#e8e9ed}
+*{box-sizing:border-box}body{max-width:960px;margin:auto;padding:36px 22px 64px;line-height:1.65}
+h1{font-size:clamp(2rem,6vw,3.8rem);line-height:1.1;margin:12px 0 20px;letter-spacing:-.04em}h2{font-size:1.25rem;margin-top:32px}
+a{color:#99ded6}p{max-width:75ch}.eyebrow{font-size:.8rem;letter-spacing:.13em;text-transform:uppercase;color:#a1b5b3}
+video{width:100%;display:block;background:#101114;border-radius:10px;margin:22px 0 8px;border:1px solid #393f46}
+.cards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:28px 0}.card{padding:18px;border:1px solid #393f46;border-radius:10px}.card strong{display:block}.muted{color:#adb5bf}code{font-size:.9em;background:#272c32;padding:2px 5px;border-radius:4px}li{margin:8px 0}.status{color:#aadbd0}
+@media(max-width:650px){.cards{grid-template-columns:1fr}body{padding-top:24px}}
+</style>
+<p class="eyebrow">mux native · GUI / TUI parity</p>
+<h1>Scroll the pane<br>under your pointer.</h1>
+<p>Use the wheel to browse shell history, scroll alternate-screen applications such as less, and send wheel reports to applications that request mouse input. Each pane keeps its own scroll position and fractional movement. Keyboard focus stays where you left it.</p>
+<p class="status">Implemented · Final checks passed · Demo acceptance pending</p>
+<video controls playsinline preload="metadata" poster="preview.png"><source src="demo.mp4" type="video/mp4">Your browser can <a href="demo.mp4">download the recording</a>.</video>
+<p class="muted">27-second continuous recording · NVIDIA RTX 3080 · Wayland at 200% scale · <a href="demo.mp4">Open video</a></p>
+<div class="cards"><div class="card"><strong>Shell history</strong>Three rows per notch. Scroll down to live output, or type to return immediately.</div><div class="card"><strong>Application input</strong>Alternate-screen arrows honor cursor-key mode; mouse-aware apps receive the encoding they request.</div><div class="card"><strong>History selection</strong>Drag to copy the displayed history rows. The highlight follows its text when you scroll, including away and back.</div></div>
+<h2>What the recording shows</h2>
+<p class="muted">The recording below predates the selection-preservation fix. The highlight also now survives live counter updates and redraws. These fixes are ready for hands-on review; no replacement recording was requested.</p>
+<p>Three panes on two daemons. Scroll an unfocused shell pane, select a history row, read its text with a separate desktop clipboard client, return to live output, then scroll a real less process. Pointer motion, selection and wheel events go through the Wayland compositor. Setup commands use the ordinary SDL keyboard event path.</p>
+<h2>Controls</h2>
+<ul><li>Wheel over terminal content to scroll that pane without moving keyboard focus.</li><li>At a shell prompt, wheel up browses history and wheel down returns toward live output. Typing into that pane returns it to live.</li><li>Drag across displayed text and release to copy; Ctrl+Shift+C also copies the current selection.</li><li>Menus, headers, dividers and command mode consume wheel events. Horizontal wheel behavior remains outside this slice.</li></ul>
+<h2>Validation</h2>
+<p id="validation">Full CI, native integration, focused client/native tests and real offscreen/Wayland acceptance passed. Core policy tests also run without GUI library metadata.</p>
+<p>Independent PTY readers check exact arrow sequences and X10, UTF-8, SGR, URXVT and SGR-pixel wheel reports. Pixel reports and real PTY sizes pass at 200%, 100%, 150% and 200%. Clipboard checks use a separate Wayland client. Deterministic wire tests cover delayed replies, same-origin cancellation, resize, resync, timeout and mode frames queued before wheel input.</p>
+<h2>Hardware timing and earlier misses</h2>
+<p>The final separate raw-output stress run passed: frame p99 <strong>18.745 ms</strong> against the 20 ms limit, and sampled input-to-painted response at most <strong>65.3 ms</strong> against 250 ms (5 ms polling). Earlier runs missed the frame limit. The old release also failed under the same isolated NVIDIA Wayland conditions at 60 Hz and 200% scale. These observations do not establish that wheel scrolling improves or worsens rendering performance; the final pass does not explain the earlier misses.</p>
+<ul><li>Initial wheel build: frame p99 20.199 ms.</li><li>Previous release comparison: frame p99 21.449 ms.</li><li>Wheel build comparison: frame p99 22.244 ms.</li></ul>
+<p>Most of the measured frame time was in draw/swap. Recordings and other GUI test fixtures were stopped during measurements. All failed logs and independent input-to-painted samples are retained with the sprint evidence. The renderer follow-up still owns the earlier unexplained timing misses and offscreen-growth artifacts.</p>
+<h2>Design and limits</h2>
+<p>The daemon still owns terminal parsing and history extraction. The native client reuses the existing protocol and keeps a separate history grid for display. One outstanding fetch is retained until its reply arrives; cancelled replies cannot replace a newer view. History refreshes as output arrives, keeping the same distance from live. While a refresh is pending, stale text cannot be copied.</p>
+<p>Continuous output can delay a safe history refresh or a wheel waiting behind pending mode frames. The wire has no source-version precondition, so an atomic historical-frame copy during concurrent output is not promised. Tests cover Linux; macOS validation remains open.</p>
+<p>Application click/drag forwarding and application clipboard requests are next. <strong>Shift+drag to force native selection is required for that slice.</strong> GUI paste, edge autoscroll, word/line/rectangular selection and ligatures remain deferred.</p>
+<p class="muted">Passing checks is separate from demo approval. Feedback requested: scrolling speed, pane targeting and history selection. After acceptance, this demo's owned server will be stopped; its page and recording will be retained.</p>
+</html>

docs/native-sprint-workflow.md

Old		New
@@ -10,6 +10,8 @@ the [delivery plan](superpowers/plans/2026-09-05-native-tiling.md) breaks it int
10	packages. Keep one sprint active, ending in a working demo and explicit acceptance.	10	packages. Keep one sprint active, ending in a working demo and explicit acceptance.
11		11
12	1. Review and scope. Read the previous sprint's actions in [RETRO.md](../RETRO.md).	12	1. Review and scope. Read the previous sprint's actions in [RETRO.md](../RETRO.md).
		13	Produce the reuse and ownership map required by the shared skill, using the
		14	[component briefs](component-ownership.md) and actual code/callers as evidence.
13	Define the smallest useful deliverable, its acceptance scenarios, and what	15	Define the smallest useful deliverable, its acceptance scenarios, and what
14	belongs to later sprints. Use existing agreements for material scope and	16	belongs to later sprints. Use existing agreements for material scope and
15	destructive-action semantics; clarify only unresolved points before	17	destructive-action semantics; clarify only unresolved points before
@@ -43,10 +45,11 @@ packages. Keep one sprint active, ending in a working demo and explicit acceptan
43	4. Build a functional slice. Establish the smallest model/interface contract,	45	4. Build a functional slice. Establish the smallest model/interface contract,
44	then connect actual input, rendering, and daemon behavior. Keep changes small	46	then connect actual input, rendering, and daemon behavior. Keep changes small
45	enough to review. Avoid expanding into later sprint features.	47	enough to review. Avoid expanding into later sprint features.
46	5. Resolve concrete review findings. The reviewer supplies a failing scenario,	48	5. Resolve concrete review findings. Apply the shared skill's correctness and
47	consequence, and expected result directly to the implementer. The implementer	49	structural review criteria. The reviewer supplies a scenario or structural
48	returns a fix and evidence, or a reason the finding does not apply. Root	50	finding, consequence, and expected result directly to the implementer. The
49	adjudicates disagreement against requirements and observed behavior. Agreement	51	implementer returns a fix and evidence, or a reason the finding does not apply.
		52	Root adjudicates disagreement against requirements and observed behavior. Agreement
50	is not a substitute for independent validation.	53	is not a substitute for independent validation.
51	6. Validate through real boundaries. Drive ordinary SDL events into an isolated	54	6. Validate through real boundaries. Drive ordinary SDL events into an isolated
52	GUI using `test/native_tiling.py`'s Rig. Compare actual framebuffer pixels and	55	GUI using `test/native_tiling.py`'s Rig. Compare actual framebuffer pixels and
@@ -108,7 +111,10 @@ packages. Keep one sprint active, ending in a working demo and explicit acceptan
108	make native-stress # Linux raw-output responsiveness	111	make native-stress # Linux raw-output responsiveness
109	```	112	```
110		113
111	`make ci` excludes native tests. Use the pinned compiler.	114	`make ci` excludes native tests. Use the pinned compiler. Do not overlap
		115	other builds in the same checkout with its `make check` stage: `test/bans.sh`
		116	temporarily plants invalid source files to verify the source rules. Wait for
		117	that stage to finish before starting native builds or integration tests.
112		118
113	The focused `make native-core-test` gate compiles workspace, runtime, picker,	119	The focused `make native-core-test` gate compiles workspace, runtime, picker,
114	persistence and interaction without window/font libraries. `native-test`	120	persistence and interaction without window/font libraries. `native-test`
@@ -120,7 +126,7 @@ packages. Keep one sprint active, ending in a working demo and explicit acceptan
120	A sandbox denial is not a product failure: run required local socket/PTY checks with the appropriate	126	A sandbox denial is not a product failure: run required local socket/PTY checks with the appropriate
121	authorized permissions. Rerun affected gates after meaningful changes; do not	127	authorized permissions. Rerun affected gates after meaningful changes; do not
122	repeatedly run broad suites without a new reason.	128	repeatedly run broad suites without a new reason.
123	9. Record and share the actual demo. Use Rig with `MUXG_VIDEODRIVER=wayland`	129	9. Record and serve the local demo. Use Rig with `MUXG_VIDEODRIVER=wayland`
124	and the current compositor environment. Create fixtures, focus the owned GUI,	130	and the current compositor environment. Create fixtures, focus the owned GUI,
125	and drive the same user controls being delivered. Capture the actual compositor	131	and drive the same user controls being delivered. Capture the actual compositor
126	window continuously; on Sway, find its rectangle by PID with `swaymsg -t get_tree`	132	window continuously; on Sway, find its rectangle by PID with `swaymsg -t get_tree`
@@ -143,15 +149,11 @@ packages. Keep one sprint active, ending in a working demo and explicit acceptan
143		149
144	Keep the page usable on desktop and mobile. Retain its source beside the	150	Keep the page usable on desktop and mobile. Retain its source beside the
145	sprint records and its video outside temporary fixture directories. Verify	151	sprint records and its video outside temporary fixture directories. Verify
146	page loading, video metadata and seeking before sharing. Use the established	152	page loading, video metadata and seeking. Serve the page and its assets on
147	private sharing route within the user's authorized scope; preserve existing	153	localhost by default, using a loopback HTTP server with byte-range support.
148	pages and services. Give the user the webpage URL in the final handoff, with	154	Give the user the local webpage URL, with the direct video link on the page.
149	the direct video link available from the page.	155	Publishing is optional and happens only when explicitly requested; do not
150		156	ask about publishing during routine sprint delivery. Preserve unrelated services.
151	The user has authorised sharing mux sprint review pages and their demo assets
152	privately on their own Tailscale so they can review from all their devices.
153	Treat that as standing authorization for this handoff; use the existing
154	private Serve host and preserve unrelated routes and services.
155		157
156	Build both demo binaries together in an isolated release prefix:	158	Build both demo binaries together in an isolated release prefix:
157		159
@@ -176,18 +178,9 @@ packages. Keep one sprint active, ending in a working demo and explicit acceptan
176	path. Cursor-warp commands can move the visible cursor without delivering	178	path. Cursor-warp commands can move the visible cursor without delivering
177	held-button motion. Verify actual divider movement and release, then check PTYs.	179	held-button motion. Verify actual divider movement and release, then check PTYs.
178		180
179	For a user on the same tailnet, serve only the demo page/video through a loopback	181	Verify playback and HTTP range responses. Retain the recording outside
180	HTTP server with byte-range support, then use Tailscale Serve:	182	temporary fixture directories and record the server's teardown command.
181		183
182	```sh
183	tailscale serve status
184	tailscale serve --bg http://127.0.0.1:18765
185	```
186
187	Check existing routes before changing them; preserve unrelated services. Use
188	the private HTTPS URL printed by Serve. Verify playback/HTTP range responses,
189	retain the recording outside temporary fixture directories, and record the
190	server's teardown command. Funnel and audio are unnecessary for this workflow.
191	10. Close honestly. Inspect the final diff, commit validated work, and provide	184	10. Close honestly. Inspect the final diff, commit validated work, and provide
192	the review webpage with the demo, controls, test results, and material limits.	185	the review webpage with the demo, controls, test results, and material limits.
193	User demo acceptance is	186	User demo acceptance is
@@ -195,8 +188,8 @@ packages. Keep one sprint active, ending in a working demo and explicit acceptan
195	or a hands-on trial, and capture any requested ergonomic adjustments separately.	188	or a hands-on trial, and capture any requested ergonomic adjustments separately.
196	Update the spec/plan status and RETRO.md with resolved findings and checkable	189	Update the spec/plan status and RETRO.md with resolved findings and checkable
197	next-sprint actions. Mark acceptance only when given; a recorded-demo approval	190	next-sprint actions. Mark acceptance only when given; a recorded-demo approval
198	does not imply hands-on feedback. Then begin the next authorized sprint with	191	does not imply hands-on feedback. On acceptance, stop that demo's owned
199	step 1.	192	server and remaining GUI, recorder or compositor fixtures; remove any sharing
200		193	route created at the user's request. Recheck process ownership and verify
201	Sprint 2 established the recorded Sway/private Serve demo route. Sprint 3 adds the	194	teardown. Preserve unrelated services and retain the page, recording and
202	opening cleanup pass by user request; keep the closing cleanup as well.	195	validation evidence. Then begin the next authorized sprint with step 1.

docs/skills/sprint-delivery/SKILL.md

Old		New
@@ -41,28 +41,66 @@ commit IDs, or temporary service URLs in this skill.
41		41
42	## Run a bounded sprint	42	## Run a bounded sprint
43		43
44	1. Scope and acceptance. Choose the smallest functional deliverable within	44	Planner, implementer and reviewer are responsibilities with required outputs.
45	the user's authorized plan. Define observable acceptance scenarios and carry	45	Assign them to people or agents using the pairing and fallback below; no separate
46	forward applicable retrospective actions. Clarify material unknowns early;	46	persona or additional agent is required for each step. Prefer less maintained
47	continue independent work while waiting. Existing authorization still applies.	47	code, clear ownership and small interfaces. Each new abstraction must earn its
		48	place by removing duplication or simplifying dependencies.
		49
		50	1. Plan from existing code. Choose the smallest functional deliverable within
		51	the user's authorized plan. Before proposing new code, search relevant modules
		52	and callers, verify what their APIs actually do, and identify reusable behavior,
		53	duplicated rules and refactors that would simplify the slice. Record a short
		54	reuse and ownership map in the plan:
		55
		56	\| Behavior or rule \| Existing implementation and callers \| Intended owner \| Reuse, refactor or add; what can be deleted \|
		57	\| --- \| --- \| --- \| --- \|
		58
		59	Cite actual file/symbol evidence. If nothing suitable exists, record where you
		60	searched. Explain why an existing owner cannot take any proposed new module's
		61	responsibility. Keep domain rules with their owner; input, rendering, storage
		62	and transport adapters should use those rules. Assess whether separating policy
		63	from external dependencies would help this slice; use the smallest justified
		64	boundary. Define observable acceptance scenarios and carry forward applicable
		65	retrospective actions. Clarify material unknowns early and continue independent
		66	work while waiting. Existing authorization still applies.
48	2. Opening cleanup. Inspect the touched code for small refactors that help	67	2. Opening cleanup. Inspect the touched code for small refactors that help
49	the slice. Review, validate, and commit these separately within existing	68	the slice. Review, validate, and commit these separately within existing
50	authorization. If the code is ready, say so; there is no cleanup quota.	69	authorization. If the code is ready, say so; there is no cleanup quota.
51	3. Delegate implementation and review. Use the pairing below. Deliver through	70	3. Delegate implementation and review. Use the pairing below. Deliver through
52	actual user interactions and system boundaries, then integrate the result.	71	actual user interactions and system boundaries. The implementer follows the
53	4. Closing cleanup. Explicitly review duplication, obsolete paths, temporary	72	ownership map, reuses existing behavior and removes superseded paths. Report
54	scaffolding, and unnecessary state. Refactor what the slice exposed. Record	73	discoveries that change the plan and update the map before extending scope.
55	retained debt with its location, consequence, and next owner or trigger.	74	4. Review correctness and structure. The reviewer checks behavior and failure
		75	paths, duplicated rules, misplaced responsibilities, unnecessary state,
		76	excessive dependencies, obsolete code and opportunities to delete code. Supply
		77	concrete evidence and resolve findings through the exchange below. Review net
		78	production-code and dependency changes; explain growth and its benefit rather
		79	than treating line count as a quota. Complete closing cleanup and integrate the
		80	result. Record retained debt with its location, consequence, and next owner or
		81	trigger. "Architecture reviewed" alone is not evidence: identify the rule,
		82	owner, dependency or removable path and its disposition.
56	5. Validate and demonstrate. Run required repository gates and meaningful	83	5. Validate and demonstrate. Run required repository gates and meaningful
57	checks for the change. Independently verify real behavior beyond agent	84	checks for the change. Independently verify real behavior beyond agent
58	agreement. Freeze source before final checks; rerun affected checks after	85	agreement. Prove claimed architectural boundaries with an appropriate check,
59	meaningful changes. Demonstrate the working result, including relevant failure	86	such as policy tests running without the external library or service that its
60	paths. A recording must show the actual application, not a slideshow.	87	adapter uses; moving files alone does not establish isolation. Freeze source
		88	before final checks; rerun affected checks after meaningful changes. Demonstrate
		89	the working result, including relevant failure paths. A recording must show
		90	the actual application, not a slideshow. Serve the review page and assets on
		91	localhost by default. Publish only when the user explicitly requests it;
		92	do not prompt for optional publishing during routine delivery.
61	6. Close and hand off. Commit validated work within existing authorization.	93	6. Close and hand off. Commit validated work within existing authorization.
62	Update the spec/plan status and `RETRO.md`: results, lessons, retained debt,	94	Update the spec/plan and ownership map to match the delivered code. Record
63	and checkable next-sprint actions. Record demo acceptance only when given;	95	results, removed duplication/paths, justified retained debt, lessons, and
64	test success does not imply user acceptance. Begin the next sprint only when	96	checkable next-sprint actions in `RETRO.md`; give each open item an owner or
65	authorized, preserving any acceptance requirement in the agreed plan.	97	concrete trigger. Record demo acceptance only when given; test success does not
		98	imply user acceptance. Once accepted, tear down that demo's sharing route and
		99	owned servers/fixtures without asking again, unless the user requests continued
		100	availability. Verify teardown and record it; retain the page source, recording
		101	and validation evidence. Preserve unrelated services and demos awaiting review.
		102	Begin the next sprint only when authorized, preserving
		103	any acceptance requirement in the agreed plan.
66		104
67	## Model and effort routing	105	## Model and effort routing
68		106
@@ -103,9 +141,9 @@ above; it is not required for every slice.
103	constraints, acceptance checks, and its partner's name. They should read only	141	constraints, acceptance checks, and its partner's name. They should read only
104	necessary code. The main session coordinates, integrates, and independently	142	necessary code. The main session coordinates, integrates, and independently
105	validates; assign each implementation or investigation one owner.	143	validates; assign each implementation or investigation one owner.
106	- The reviewer sends concrete findings directly to the implementer: trigger,	144	- The reviewer sends concrete findings directly to the implementer: trigger or
107	consequence, and expected behavior. The implementer returns a fix and evidence	145	structural evidence, consequence, and expected result. The implementer returns
108	or a reason the finding does not apply. Continue focused exchanges until	146	a fix and evidence or a reason the finding does not apply. Continue focused exchanges until
109	findings are resolved; root adjudicates persistent disagreement against the	147	findings are resolved; root adjudicates persistent disagreement against the
110	spec and observations. Re-review changed parts and unresolved findings rather	148	spec and observations. Re-review changed parts and unresolved findings rather
111	than repeating a broad review each round.	149	than repeating a broad review each round.
@@ -124,5 +162,4 @@ separately from frame timing, and state polling overhead or other material limit
124		162
125	Keep platform-specific gates and demo mechanics in project documentation. In mux,	163	Keep platform-specific gates and demo mechanics in project documentation. In mux,
126	the documented native gates complement `make ci`; the raw-output gate builds both	164	the documented native gates complement `make ci`; the raw-output gate builds both
127	the daemon and GUI in release mode. Preserve existing services when sharing a	165	the daemon and GUI in release mode. Preserve existing services when serving a demo.
128	demo, and use only the sharing scope the user authorized.

docs/superpowers/plans/2026-09-06-native-application-mouse.md

@@ @@ -0,0 +1,150 @@ @@
+# Native application mouse and clipboard writes
+Status: product signed off on 2026-09-06 after review of the published demo.
+CI and functional gates pass; the existing frame-time budget miss remains an
+open follow-up. No additional hands-on testing is claimed.
+Goal: normal mouse gestures reach applications requesting mouse reporting,
+including tmux, while Shift+drag remains a native selection. Application OSC 52
+writes reach the desktop clipboard through the existing daemon protocol.
+The initial handoff was a hands-on binary; the user subsequently requested and
+accepted a published recording.
+## Reuse and ownership map
+| Behavior | Existing implementation | Owner | Change |
+| --- | --- | --- | --- |
+| Mouse wire formats | client/keymap.zig encodeWheel | shared client | Extract encodeMouse; retain wheel wrapper, delete duplicate encoding need |
+| Negotiated modes, ordered transport | session_pump.zig routeWheel, ClientCore.terminal_modes | pump | Stamp gestures with connection/mode identity; encode at transport boundary |
+| Pane hit testing and attachment lifetime | interaction.Controller, runtime.Runtime | native core | Latch gesture source and owner; clamp app coordinates to original pane |
+| Local selection/extraction | client.selection.Drag, pump selection request | existing owners | Reuse unchanged for Shift override |
+| Clipboard validation | client_core.validClipboard, term_event | shared client | Add bounded text decoding; retain TUI validation contract |
+| Platform clipboard | frame.zig SDL_SetClipboardText | SDL adapter | One writer for local selection and decoded app effects; p/s use primary |
+No new module, VT parser, daemon change, or wire format is needed. The GUI owns
+pane geometry and gesture choice; the pump owns negotiated protocol and wire
+lifetime. A press uses the latest received modes under the pump mutex. Pending
+presses whose mode/connection identity changed before transmission are discarded;
+an already transmitted press is released in its original format on cancellation.
+Mouse ownership remains fixed through modifier changes and crossing another pane.
+## Acceptance
+- Mouse off: existing local drag/copy remains. Alternate screen alone does not
+  grant applications mouse ownership.
+- Modes 9/1000/1002/1003: press-only / press-release / held motion / hover;
+  negotiated X10, UTF8, SGR, URXVT and SGR pixels retain coordinate/modifier rules.
+- Shift at press forces local selection for the entire gesture, with no app
+  press, motion or release. Changing Shift mid-gesture does not switch owner.
+- Nonzero pane origin, high DPI, edge crossing and release all use original pane
+  coordinates. Modals/dividers retain priority; source replacement receives no
+  stale gesture. Focus loss, geometry or mode changes cancel held app buttons.
+- Two clients attached to one tmux: ordinary drag in either client enters tmux
+  selection, visible in both. Inspect tmux buffer independently; Shift+drag in
+  muxg affects only the desktop selection, not tmux's buffer.
+- Valid OSC52 c writes desktop clipboard; p/s write primary. Invalid base64,
+  NUL, invalid UTF8, empty/oversized and unsupported targets preserve clipboard.
+  OSC52 reads remain refused. Inspect clipboard independently of GUI state.
+## Validation and follow-ups
+Use pinned Ghostty source and installed foot as behavioral references; no
+Ghostty executable is installed. Keep exact protocol tests and actual PTY/GUI
+checks, then repository CI and native gates. Preserve unrelated running demos.
+Selection following text through terminal scroll/reflow/eviction remains the
+next identity slice. GUI paste, IME, ligatures and OSC52 reads are outside this
+slice. Existing continuous-output wheel scheduling debt remains separately
+tracked; this change must not introduce unbounded input deferral.
+## Implementation and review evidence
+Opening commit `93a94c8` extracts the encoder and updates its wheel caller.
+The first check found a Zig runtime character type error and incorrect fixture
+expectations; those were corrected. The subsequent opening check was interrupted
+by concurrent interaction formatting edits, so it is not recorded as green.
+The integrated required check subsequently passed inside CI. Keep opening work
+frozen through the complete check before committing in future sprints.
+The controller now retains a source attachment and pump token for an application
+gesture; a local-held flag prevents a Shift gesture from turning into hover
+reports when its highlight is invalidated. The pump owns cancellation generation,
+last transmitted button and negotiated format. SDL supplies input and clipboard
+IO. `mouseFormat` serves wheel and pointer encoding; `validClipboardText` is the
+single text safety predicate for decoded app writes and local clipboard copies.
+There are no new modules, dependencies, daemon changes or protocol fields.
+Independent review corrected double-counted pixel origins, partial terminal
+cells at pane edges, wrong-button release, attachment replacement, and local
+outside-coordinate handling. Actual Wayland checks pass exact press/motion/
+release bytes, middle/right routing, mode-change cancellation, Shift ownership,
+cross-pane clamping, and desktop/primary targets. The two-client foot/tmux check
+passes shared selection and buffer changes in both directions, and local Shift
+selection leaves tmux untouched. Evidence is under `dist/application-mouse/`.
+Only one physical button gesture is captured at a time; additional button
+presses are ignored until release. Chorded multi-button application input can be
+a later input-owner extension when required. Numbered/secondary OSC52 targets
+have no native platform adapter and are ignored. Clipboard writes from attached
+panes are delivered regardless of focus, consistent with session-scoped effects;
+focus never changes the originating selection request or its attachment.
+The default offscreen native gate skips the foot test explicitly. Real Wayland
+and NVIDIA evidence is separate; none of these checks establishes macOS behavior.
+## Final validation and handoff
+- Full `make ci`: PASS, including required check, all 117 e2e scenarios, agent
+  and throughput. `ci.log` retains the complete output.
+- Final `make check` after closing cleanup: PASS (`check-final.log`).
+- ReleaseSafe native-core/native unit tests: PASS (`native-units-final.log`).
+- Full `make native-e2e`: PASS (`native-e2e.log`); its offscreen foot skip is
+  explicit, rather than reported as real-client evidence.
+- Final ReleaseSafe NVIDIA Wayland: direct mouse/clipboard, shared foot/tmux,
+  ten wheel/scale and eleven selection checkpoints PASS
+  (`final-wayland-{mouse,tmux_mouse,wheel,selection}.log`).
+- `make native-stress`: frame budget FAIL. Initial p99 20.597 ms exceeded the
+ms limit. A controlled comparison also failed on the previous wheel
+  release (23.134 ms) and this release (21.374 ms); presentation dominated.
+  Input-to-painted observations stayed below 61 ms, including polling overhead,
+  while output continued and reopen/lifecycle checks succeeded. Retain all three
+  logs; no stable frame-budget pass or performance improvement is claimed.
+The retained rendering-budget issue belongs to the renderer owner, with the
+same isolated NVIDIA raw-output fixture as its next acceptance check. It is not
+silently waived by this feature's passing functional tests.
+Release binaries are in `dist/native-mouse-release/bin/`. Launch `muxg` there
+with the usual connection arguments; no remote daemon update is required.
+The owned compositor PID 49292 was stopped and verified (`cleanup.json`);
+all test rigs closed their sessions/daemons. Existing pending demos remain.
+This initial handoff preceded the recording and sign-off documented below.
+## Requested recording and publication
+The user subsequently requested a demo and publication. A 32.4-second continuous
+recording now demonstrates two mux sessions attached to one tmux server: shared
+normal dragging in both directions, Shift-local copying, independent tmux buffer
+and desktop clipboard reads, and an application OSC52 desktop write. Primary
+selection remains separate automated coverage, not a claim about the recording.
+The actual NVIDIA Wayland GUI was captured at 1100×700, 5 fps, without audio or
+restart cuts. Ordinary drags use real Wayland pointer events; Shift and its
+pointer sequence use the ordinary SDL hook with visible cursor motion. The
+page discloses this. A mistyped base64 fixture in the first attempt produced the
+wrong expected word; the corrected complete recording is the published asset.
+Review page source: `docs/demos/native-application-mouse.html`. Retained assets:
+`dist/application-mouse/demo/`. Private publication (explicitly requested):
+https://charizard.folk-amberjack.ts.net/application-mouse/ . HTTPS page and video
+byte-range seeking were verified (200/206). Review server PID 99795 listened on
+.0.0.1:18777. `dist/application-mouse/server.json` records ownership and route.
+Recording compositor PID 95465 and fixture processes were stopped after capture.
+On 2026-09-06 the user gave product sign-off: "yep looks good to me. Product sign off".
+Removed only `/application-mouse`, verified and stopped its server PID 99795,
+and confirmed port 18777 no longer accepts connections. The existing
+text-selection route was preserved. The recording, page and validation evidence
+remain retained; `dist/application-mouse/accepted-demo-teardown.json` records the
+verified cleanup. This closes the application mouse/clipboard slice; selection
+identity, paste/IME and the frame-time budget remain separate follow-ups.

docs/superpowers/plans/2026-09-06-native-selection-follow.md

@@ @@ -0,0 +1,134 @@ @@
+# Native selection follows output
+Status: implemented, functionally validated and architecturally reviewed.
+Product accepted on 2026-09-06; existing NVIDIA frame-time debt remains open.
+Goal: a completed local selection follows the same terminal text as output
+scrolls. This includes Shift+drag in an application using mouse reporting.
+The existing desktop clipboard stays unchanged until another copy; copying
+again resolves the tracked text, rather than its former screen position.
+## Scope and ownership
+| Behavior | Reuse | Owner |
+| --- | --- | --- |
+| Terminal identity | Pinned Ghostty Selection.track and PageList pins | Engine wrapper, one owned selection per attached server client |
+| Text extraction | Engine.extractSelection and existing formatter | Engine |
+| Correlation and compatibility | Framed protocol, server client slots | Shared protocol and server |
+| Position and clipboard delivery | Session pump mutex, request tickets and attachment lifetime | Shared client |
+| Drag and highlight | Existing selection.Drag and pane-relative hit testing | Native interaction |
+No second terminal parser, text matching, or global Ghostty Screen.selection.
+Opening inspection found no independent cleanup needed; the engine adapter
+belongs to the feature. Source stays frozen throughout validation before commit.
+The existing selection request/reply now carries a gesture ID, copy request ID,
+terminal sequence and authoritative source token. Registering against a stale
+source is refused. Source tokens must advance even when identical rows produce
+no visual delta. Positions are delivered after the matching terminal frame;
+the renderer hides an unmatched position until its corresponding state arrives.
+Copy uses the daemon's tracked endpoints. The user explicitly excluded backward
+compatibility: clients require the updated daemon. One action field selects
+extract/start/copy/clear; TUI and browser extraction use the same exchange.
+There is no parallel legacy request or capability fallback.
+The released range becomes the durable selection. Ctrl+Shift+C during a held
+drag still copies the current range; later copies and release register their
+current endpoints. Output moving during a held drag
+retains conservative cancellation; tracking an unfinished gesture is a later
+slice. Resize/reflow, screen replacement, disconnection and discarded endpoints
+invalidate selection and preserve the clipboard. GUI paste and ligatures remain
+outside this slice. A remote daemon needs rebuilding alongside the client.
+Character insertion/deletion and rectangular margins retire local selection;
+a linear range crossing a partially scrolled region also retires rather than
+claiming to represent unchanged text.
+## Acceptance
+- Select a line in a pane with nonzero origin; append output until it moves up.
+  Its highlight follows it, and copying again returns the intended text.
+- Exercise primary history and alternate-screen vertical scrolling, including
+  repeated identical rows and a scroll region. Position follows engine identity.
+- Shift-local selection sends no application mouse gesture and follows output.
+- Two client selections remain independent; another pane's output has no effect.
+- Discarded endpoints, resize, screen switch and reconnect clear the highlight
+  without replacing the clipboard. Late requests cannot select unrelated text.
+- Retain existing viewport-wheel selection, soft-wrap extraction and app mouse
+  behavior. Verify real GUI pixels and clipboard, plus engine/wire boundaries.
+## Delivery
+Use the repository sprint gates and a localhost review page with an actual GUI
+recording. Publishing is optional when requested. Product acceptance remains
+separate from tests and architectural review. Carry forward the existing NVIDIA
+frame-time budget miss; retain evidence rather than rerunning until green.
+## Integrated architecture and review
+The engine adapter owns one pair of Ghostty tracked pins per attached client.
+Ghostty owns page growth, history eviction, Unicode width and wrapping. Partial
+vertical operations that copy/rotate row contents need explicit endpoint moves;
+the adapter uses parsed actions and rebinds the existing pins after those moves.
+REP delegates each repeated character to the existing print hook using Ghostty's
+previous character. No client parses VT and no duplicate terminal state exists.
+The server owns tracker teardown, source validation and copy extraction. The
+pump owns queued/sent correlation, attachment cancellation and matching position
+metadata to the displayed snapshot or history chunk. The renderer receives grid,
+origin and position together. During a sequence gap it hides unmatched geometry
+without destroying the gesture. Clipboard delivery remains separate from
+unsolicited position updates.
+Closing cleanup consolidated selection into one action-based wire exchange and
+removed unused follow-state bookkeeping. Direct TUI/browser extraction reuses
+the same codecs and formatter. Review resolved extraction lifetime, tracked-pin
+allocation cleanup, alternate-screen allocator reuse, discarded-row tracking,
+partial-region movement and held-copy regressions. The independent Terra review
+has no remaining architectural blocker; final gate results remain separate.
+## Final evidence and handoff
+- `dist/selection-follow/ci-final.log`: full CI passed, including check,
+e2e scenarios / 38 convergence points, 10 agent checks and throughput.
+- `native-final-rerun.log`: ReleaseSafe native-core/native tests and the full
+  native integration chain passed. Its offscreen tmux skip is supplemented by
+  the separate actual Wayland fixture below.
+- `wayland-final.log`: selection, follow-selection, wheel and real
+%/100%/150%/200% scale checks passed with the matched release binaries.
+- `wayland-tmux-final.log`: three shared foot/tmux mouse checkpoints passed.
+  A later counter assertion exposed ordering between real Wayland motion and
+  the FIFO key hook; the fixture now observes the extended highlight first.
+  `wayland-tmux-counter-final.log` passes held/released copying through tmux in
+  both windowed and fullscreen modes with that independent pixel observation.
+- `stress-final.log` and retained `stress-result.json`: raw output continued
+  for 30.1 seconds (120.5 MB read), reopen succeeded, and 186 sampled input-to-
+  painted observations stayed at or below 60.4 ms including 5 ms polling.
+  The frame gate remains **red**: p99 20.576/20.716 ms against 20 ms. This is the
+  previously recorded NVIDIA presentation debt, not a performance pass.
+- Earlier failing logs remain. They include an existing PTY exit timing flake,
+  actual implementation failures fixed before delivery, fixture mistakes, and
+  a CI agent compile caught during a source change. Final CI is a separate,
+  successful frozen-source run. No red result was overwritten as a pass.
+Matched demo binaries were built with `make install
+INSTDIR=dist/native-follow-release BINDIR=dist/native-follow-bin`; daemon and
+GUI both use ReleaseSafe. The maintained page is
+[the selection-follow review page](../../demos/native-selection-follow.html).
+Its 25-second, 960×600 H.264 recording is continuous at 5 fps, no audio, on
+NVIDIA Wayland at 200% scale. It shows a real pointer drag, three appended rows,
+neighbour output and independently read clipboard replacement/recopy.
+Video decoding, page loading and HTTP byte ranges were verified.
+Product sign-off — 2026-09-06: the user approved after confirming that wheel
+scrolling the viewport preserves the highlight. The held-drag limitation concerns
+terminal output moving the underlying coordinate source, not merely looking at
+other existing rows. This records the reported hands-on wheel behavior and
+explicit approval, not hands-on verification of every automated scenario.
+The former localhost review URL on port 18778 is retired. No publication was
+created. Verified server PID 257482 named this worktree's
+`dist/selection-follow/serve-page.py`, stopped it, and verified port 18778 closed.
+`dist/selection-follow/accepted-demo-teardown.json` records the cleanup.
+Recording and test rigs had already closed; owned compositor PID 141229 had
+already been stopped. Page, recording and validation evidence remain; unrelated
+services were preserved. No next sprint was started by this approval.

docs/superpowers/plans/2026-09-06-native-text-selection.md

@@ @@ -0,0 +1,294 @@ @@
+# Native parity — text selection
+Status: implemented, independently reviewed and validated; actual GUI demo
+recorded. User demo acceptance is pending. User selected text selection as the next
+sprint on 2026-09-06; wheel scrolling remains unimplemented and deferred.
+Worktree branch: `gui-text-selection` (existing worktree directory retained).
+## Goal and trial behavior
+Drag across visible terminal text, see the selected cells, and copy the daemon's
+text to the desktop clipboard on release or with Ctrl+Shift+C. Reuse the TUI's single-click versus
+drag semantics and daemon extraction. A plain click continues to focus a pane.
+The selection belongs to its starting pane; crossing another pane must never
+select or copy that pane's text. A new press clears the previous highlight.
+This slice covers visible text, copy on release and the copy shortcut. Wheel/history navigation,
+edge autoscroll, double/triple click, rectangular selection, clipboard paste,
+application mouse forwarding and ligatures remain separate work. The existing
+GUI does not forward application mouse clicks; this slice preserves that scope.
+## Reuse and ownership map
+| Behavior or rule | Existing implementation and callers | Intended owner | Reuse, refactor or add; what can be deleted |
+| --- | --- | --- | --- |
+| Click/drag distinction, direction, pane confinement, inclusive row spans | `src/tui/select.zig`: `Drag`, `Range.span`; `interact.zig` and `wallview.zig` callers | Shared `client.selection` | Move the pure module and its tests to `src/client/selection.zig`; delete the TUI source and update imports. No second drag state machine. |
+| Text extraction, soft wraps, hard newlines, UTF-8/graphemes and wide cells | `Engine.extractSelection`, `Server.onSelectionReq`, protocol `SelectionReq`/`SelectionReply` | Daemon engine and existing wire | Reuse unchanged. Never reconstruct copied text from native grid cells. |
+| Request ID correlation and reply validation | `ClientCore.beginSelection`/`receiveSelectionReply`; TUI `Core.requestSelection`/`selectionCopy` | Shared client core and session pump | Reuse core matching. Add bounded mailbox request/result ownership to `session_pump`; release borrowed frame text before the frame is freed by copying or transferring into owned storage. Do not import TUI `Core`. |
+| Pane identity, lifetime and frozen displayed grid | `runtime.Live.capture`, `Runtime.accepts`, `workspace.Attachment` | Native runtime | Expose selection-relevant snapshot metadata alongside the grid through the existing boundary; associate requests with attachment and displayed coordinates. Avoid new unlocked reads of pump internals. |
+| Pointer hit testing, modal routing and cancellation | `interaction.Controller.pointerDown`/`pointerMove`, `focusLost`, `updateGeometry` | Window-free native controller | Use shared drag state with native geometry; add release/copy intent and cancellation. Keep divider drag distinct from text drag. |
+| Logical-to-physical input, mouse capture, clipboard IO | `frame.Events`, `physicalPoint`, `physicalSignedAxis`, existing pointer hooks | SDL frame adapter | Extend ordinary mouse routing and use SDL clipboard writing. SDL remains confined to frame. Test hooks observe actual clipboard state and inject existing SDL events. |
+| Selection highlight | `quads.rowInstances`, existing themed cell colors | Native painter | Consume a supplied row span; select complete wide glyph cells and retain readable colors. Never mutate the authoritative grid for highlighting. |
+| Copy shortcut from hands-on feedback | `frame.interactionKey`, `Controller.keyDown`, selection request in `pointerUp`, `Runtime.requestSelection` | SDL maps the chord; native controller owns copy intent | Extract the existing request action for both release and shortcut. Consume Ctrl+Shift+C even without selection; preserve plain Ctrl+C. No second text cache or clipboard implementation. |
+The existing pure selection module already supplies the needed domain rule; a
+new selection framework is unnecessary. Moving it to the shared client owner
+allows both frontends to consume it without importing either window or terminal
+UI libraries. The TUI's OSC 52 size cap is an adapter limit and must not become
+the desktop clipboard's cap; the existing wire's 1 MiB bound still applies.
+## Observable acceptance
+- Three panes across two real daemons, including off-origin panes: forward and
+  reverse drags highlight and copy only the starting pane. Headers, dividers,
+  blank padding and modal dialogs cannot start a terminal selection.
+- A press/release in one cell changes focus without changing clipboard text.
+  Copy on release uses exact daemon text for soft wraps, hard newlines, trailing
+  spaces, non-ASCII text and wide-cell continuations. A selected wide glyph is
+  visibly complete. Other panes retain their text, PTYs and input behavior.
+- Ctrl+Shift+C copies the current fresh range without clearing the highlight or
+  sending Ctrl+C to the application. With no selection it leaves the clipboard
+  and application untouched. Plain Ctrl+C still interrupts an actual foreground
+  PTY process. Repeat/release and modal routing retain their existing ownership.
+- A new selection, cancellation, resize/DPI transition, focus loss, attachment
+  replacement/reconnect or detach cannot allow a delayed reply to overwrite the
+  clipboard. Empty/invalid/unavailable/refused/oversized results leave its prior
+  contents intact; errors that need action get a bounded notice.
+- Live redraws retain the selected range, including when selected text is
+  overwritten; copying extracts its current text, following Ghostty. Geometry,
+  screen/connection changes and history-watermark changes still invalidate it.
+  Cached-history selections retain exact source freshness.
+- The painter highlights without changing replica cells. Core policy tests run
+  without GUI libraries. Real clipboard reads and actual framebuffer samples
+  are the independent integration oracles.
+- Real NVIDIA Wayland drag/release at 200%, retained scale transitions, and
+  separate raw-output responsiveness gates. Linux evidence does not imply Mac
+  acceptance.
+## Delivery and retained actions
+Luna owns opening shared-selection extraction and feature implementation;
+Terra independently reviews correctness and structure. Root owns planning,
+integration oracles, final gates, demonstration, documentation and commits.
+Opening cleanup is reviewed, checked and committed before feature edits.
+Follow `docs/native-sprint-workflow.md`, serializing builds against the source
+ban probes in `make check`. Retain logs for full CI, native core/build/units,
+native integration, NVIDIA scale and stress. Review production growth and remove
+superseded paths before freezing source. Existing NVIDIA frame-time misses and
+offscreen growth artifacts remain unresolved renderer follow-ups.
+Assess the existing passive frame hooks as they are touched; add only observation
+needed for clipboard evidence. Any broader hook extraction requires a concrete
+benefit rather than an arbitrary file split. Reuse the existing Rig and recorder
+assets with isolated XDG state and compositor addresses.
+Deliver a localhost review page with achievements, actual GUI recording,
+controls, checks and limitations. Preserve demos awaiting review; tear down accepted
+demo routes and owned processes while retaining their artifacts. Record demo approval
+only after the user gives it.
+## Delivered structure and closing review
+`client.selection` is the single gesture model, consumed by both frontends.
+`Drag.buttonHeld()` distinguishes capture lifetime from a retained highlight;
+the native painter consumes the shared `Span` directly. `SelectionVersion` in
+`session_pump` carries sequence, history, session epoch and a revision for
+connection, geometry and mode changes. The runtime captures that version under
+the same lock as the independent displayed grid. The controller retains the
+press version and attachment; it never refreshes an old drag into a new frame.
+The pump owns queued-request tickets, cancellation, the deadline and at most one
+owned result. It validates the version before sending, while decoding a reply
+and when transferring the result. Its single invalidation path clears semantic
+correlation and owned text, including requests cancelled before mailbox service.
+The SDL adapter writes clipboard text and reports failures; it preserves the
+previous clipboard for empty or unrepresentable NUL-containing replies.
+Review resolved history-coordinate overflow, neighbour-history subtraction,
+held mouse capture, release-position resize regression, stale press versions,
+mode/connection invalidation, unlocked timeout access, allocation-failure
+ownership, logical-only geometry changes and empty-copy behavior. Root completed
+the pump ownership cleanup and focused tests after the first integration pass;
+Terra independently reviewed the final version. No new library or wire message
+was added. Production growth connects the existing policy and wire to native
+input, rendering and clipboard adapters; test code supplies independent failure
+and ownership evidence.
+The existing protocol has no source-sequence precondition at the daemon.
+Observed client-side changes cancel selection conservatively; copying an atomic
+historical frame is not claimed. A wire-level version precondition belongs to
+any future sprint that strengthens this contract, across all frontend callers.
+## Validation and demo evidence
+Final source passed full `make ci`, client/native units and native build,
+`make native-e2e`, and native core tests with GUI package metadata hidden.
+Real offscreen and NVIDIA Wayland selection fixtures cover three panes on two
+daemons, daemon-extracted Unicode/wraps, actual framebuffer highlights,
+clipboard reads, other-pane/selected-pane output, delayed requests, blank copies,
+timeouts and detach without ending the shell. Wayland tests additionally use
+real virtual-pointer input and held selection across 100/150/200% transitions.
+The retained `native_scale.py` gate also passed. No Mac evidence is claimed.
+`make native-stress` passed separately from recording and other GUI fixtures:
+frame p99 19,267 us (20,000 limit), sampled input-to-painted upper bound 65.3 ms
+(250 limit; up to 5 ms polling overhead). Earlier unexplained NVIDIA misses stay
+open; this is one acceptance run, not a speedup claim.
+Logs, fixture paths, paired release build evidence, helper source/protocol,
+verified agent models/cumulative counters and recording scripts are retained in
+`dist/text-selection/`. The maintained `test/wayland_pointer.py` adapts the
+retained helper's line protocol; it requires one isolated headless Sway output.
+Set `MUXG_TEST_POINTER` to the absolute `dist/text-selection/pointer` binary when
+running `test/native_selection.py` on Wayland, and optionally set
+`MUXG_TEST_SCALE_OUTPUT=HEADLESS-1` for its held-selection scale scenarios.
+The helper sources, generated Wayland protocol and binary live with these
+artifacts; compile `pointer.c` and `pointer-protocol.c` with wayland-client if
+rebuilding the fixture. SDL-injected events remain the offscreen input path.
+The first Wayland test exposed a harness limitation: injected SDL mouse events
+cannot provide the input serial needed for compositor clipboard ownership.
+The final Wayland gate uses real pointer events and waits for clipboard offers
+to reach a separate `wl-paste` client. Initial failed logs are retained. The
+first demo's cleanup was interrupted by the recorder's minimum-length check;
+root stopped only its three owned GUI/daemon processes and fixed unconditional
+fixture cleanup before the successful recording.
+Review page source: `docs/demos/native-text-selection.html`. The 24.4-second
+continuous NVIDIA 200% recording shows real drags and independent `wl-paste`
+output, with no cuts or audio. Private handoff route:
+https://charizard.folk-amberjack.ts.net/text-selection/ . The accepted appearance
+routes were subsequently removed; their artifacts remain.
+Route-specific teardown: `tailscale serve --https=443 --set-path /text-selection off`,
+then stop only the page server identified by `dist/text-selection/server.json`.
+Private page verification passed HTTPS/byte ranges, desktop/mobile layout,
+playback and seeking; all three earlier appearance pages remain reachable.
+Only the allowlisted page server remains (PID 3384909, port 18774); owned
+browser/compositor fixtures are stopped. The final offscreen path was rechecked
+after sharing the Wayland pointer adapter. The retained recording script now
+explicitly focuses its owned window before its first pane click.
+## Hands-on copy-shortcut feedback
+The user found Ctrl+Shift+C was forwarded as terminal Ctrl+C. The SDL adapter now
+maps that chord to copy intent, and the native controller consumes it before
+terminal input. Both mouse release and keyboard copy share the existing request
+queue, ID and freshness handling; clipboard writing and daemon extraction are
+unchanged. No new module, dependency or protocol was needed. Pure modifiers keep
+the selection; plain Ctrl+C still goes to the PTY. Existing modal/prefix handling
+retains precedence. Luna implemented, Terra reviewed, root added the real-PTY
+oracle and removed a redundant forwarding helper.
+The regression uses a real foreground Python process recording SIGINT to a file.
+It verifies copying during a held drag, retaining the released highlight, copying
+with no selection, and ordinary Ctrl+C delivery. Adapter tests cover left/right
+modifier combinations and excluded Alt/GUI/Mode modifiers. Fixture output and
+keyboard events wait for actual highlighted pixels where compositor input and
+the passive hook arrive on separate connections. Early race failures are retained
+beside final results in `dist/text-selection/copy-*`.
+Full CI and native integration passed after the shortcut change, alongside
+native/core units and offscreen/Wayland selection checks. The review GUI was
+restarted with the same explicit appearance flags; the user confirmed copying.
+Updated footage is 26.4 seconds and includes copy before release (SDL-injected
+shortcut, real Wayland pointer, independent desktop clipboard read). Previous
+performance measurements predate this keyboard follow-up.
+The user's application-selection example was Claude Code, not Neovim. Follow-up
+parity must distinguish alternate-screen mode from requested mouse reporting:
+TUI `Core.forward` already uses `TermModes.appMouse()`. Native application mouse
+forwarding and application clipboard effects are both missing; the pump currently
+skips `clipboard_set`. GUI paste stays deferred by the user's clarification.
+## Required follow-up: application mouse and clipboard behavior
+Shift+drag is part of the overall mouse feature, as confirmed by the user; it is
+required when adding application mouse forwarding, not an optional later polish.
+Wheel scrolling is implemented. The active follow-up is
+[application mouse and clipboard writes](2026-09-06-native-application-mouse.md).
+The following application mouse/clipboard slice must demonstrate:
+- Normal click/drag reaches applications that request mouse reporting, using
+  coordinates relative to the starting pane. Alternate-screen mode alone does
+  not decide mouse ownership.
+- Shift+drag forces mux's native selection and copy even when the application
+  requests mouse reporting. No part of that drag reaches the application.
+- A gesture keeps its chosen owner through motion and release, including modifier
+  changes and crossing another pane; cancellation cannot leave an application
+  with a stuck button or copy text from a different pane.
+- Attach foot and muxg to the same tmux session with mouse reporting enabled.
+  Normal drag in either client must enter tmux's selection/copy path and render
+  its selection in both clients; verify tmux's paste buffer independently.
+  Shift+drag in muxg remains a local highlight and desktop copy, with no tmux
+  mouse reports or paste-buffer mutation. Verify desktop clipboard separately
+  from tmux's buffer; a visible shared highlight alone does not prove copying.
+- Application-issued clipboard writes reach the desktop through the existing
+  validated clipboard-effect path. Verify actual PTY mouse reports and an
+  independent clipboard reader, plus a real application's selection/copy flow.
+Owner: the planner and implementer of the application mouse/clipboard slice under
+parity issue `8b16e26b`. Include the Shift override in that slice's demo and tests
+before declaring application mouse parity complete. GUI paste remains deferred.
+### Active-output feedback
+A Claude counter running inside tmux made selection unusable. The apparent
+fullscreen dependency was actually the counter pausing in the smaller window.
+A real tmux counter reproduced the cancellation, with ordinary redraws advancing
+the replica sequence during a held drag.
+Following the user's Ghostty reference, live selection now retains its range
+through redraws and copies current daemon text. `SelectionVersion.history`
+records whether the selection originated in a cached history view; those
+selections still require the exact source sequence, including after returning
+live. This supersedes the initial policy of cancelling on every output frame.
+The pump remains the sole validity owner at poll, release, send, reply and take.
+No renderer, mouse-coordinate, daemon or protocol changes are needed.
+Ghostty reference (our pinned revision):
+[tracked selections](https://github.com/ghostty-org/ghostty/blob/853183e911b70ff7b61057f52fc7b47ea4934238/src/terminal/Selection.zig)
+and [screen-owned selection](https://github.com/ghostty-org/ghostty/blob/853183e911b70ff7b61057f52fc7b47ea4934238/src/terminal/Screen.zig).
+Its page pins belong to the daemon's terminal engine; the client has flattened
+rows. Existing daemon extraction already uses Ghostty. We follow the redraw
+behavior without adding another terminal or per-cell watcher to the client.
+The current protocol cannot pin an atomic source snapshot for a remote copy,
+or identify scrollback eviction when the history count remains at its cap.
+Preserving selection across history eviction/reflow still needs an explicit
+source-identity design; it is not claimed by this fix. Hands-on review replaces
+a new recording at the user's request.
+Validation: full `make ci`, client/native units, full native integration and
+actual NVIDIA Wayland selection/wheel checks passed. The counter runs inside
+real tmux for the Wayland selection check; eleven selection and ten wheel
+checkpoints pass. Evidence: `dist/wheel-scrolling/active-selection-*.log`.
+### Outstanding feedback: selection must follow moving text
+The user expects a selected line and its highlight to move together when output
+scrolls that line upward. Commit `7897f7d` only preserves a live coordinate range
+through redraws; it does not track row identity through scrolling inside an
+application. Wheel movement of the client's viewport is already handled, but
+terminal scroll-region movement, insert/delete lines, reflow and capped-history
+eviction require a distinct identity/transform solution. This gap remains open.
+Acceptance: select a unique line, let genuine terminal output scroll it upward,
+and verify its highlight follows that same line. Text already copied must remain
+unchanged; copying again must still address the originally selected line. Cover
+normal screen/history and alternate-screen scroll regions, plus offscreen return,
+without guessing identity by matching strings (duplicate lines are valid).
+Owner: the next selection-tracking slice, using Ghostty's existing engine-owned
+pins/scroll semantics and an explicit client/daemon contract where required.
+The user's foot/tmux comparison also exposes the already planned application
+mouse gap: normal muxg drag is currently local, so tmux cannot render that
+selection to other clients. This does not imply that local clipboard extraction
+failed. Cross-client visibility, tmux paste buffers, and the desktop clipboard
+must be tested as separate outcomes in the application mouse slice above.

docs/superpowers/plans/2026-09-06-native-wheel-scrolling.md

@@ @@ -1,7 +1,12 @@ @@
+# Native parity — wheel scrolling
+Status: implemented and independently reviewed; CI and functional checks passed.
+Final NVIDIA timing check passed; earlier timing misses remain documented.
+User acceptance is pending.
+Authorized by the user's next-sprint continuation on 2026-09-06.
+Opening architecture cleanup and visible-text selection are
+implemented and validated; whole text-selection demo acceptance remains pending.
+Continue in the existing parity worktree on branch `gui-text-selection`.
+This is the first functional slice of git-collab issue `8b16e26b`.
+## Sprint goal
+terminal mouse reports when an application requests them. Match existing TUI
+behavior while keeping each pane independent.
+## Order within the overall mouse feature
+After visible-text selection, this wheel slice is the next planned sprint item.
+Application click/drag forwarding and application clipboard writes follow it.
+That slice includes Shift+drag as the required native-selection override; see
+the [application mouse acceptance criteria](2026-09-06-native-text-selection.md#required-follow-up-application-mouse-and-clipboard-behavior).
+Wheel delivery alone does not complete the overall mouse feature. Preserve native
+selection and copy throughout these slices; GUI paste remains deferred.
+## Observable acceptance
+- Three panes on two daemons, including off-origin and unfocused panes. Wheel
@@ @@ -33,12 +47,36 @@ behavior while keeping each pane independent. @@
+- Demonstrate real NVIDIA Wayland wheel input at 200% and across the retained
+  scale transitions; verify other panes, focus, PTY sizes and shell identities.
+Visible-text selection and clipboard copy are delivered by the separate
+text-selection sprint; wheel work must preserve them. Clipboard paste, general
+app click/drag forwarding, ligatures, font fallback and terminal-wall retirement
+remain outside this wheel slice. Horizontal wheel
+behavior is outside this initial vertical scrolling slice.
+## Opening architecture findings and ownership
+### Reuse and ownership map
+| Behavior or rule | Existing implementation and callers | Intended owner | Reuse, refactor or add; what can be deleted |
+| --- | --- | --- | --- |
+| SDL coordinates and event injection | `frame.physicalPoint`, ordinary pointer events and `parseHook` | SDL adapter | Extend with wheel events; no separate test-only scrolling path |
+| Pane targeting, modal exclusion, selection cancellation | `interaction.Controller` pointer handlers and shared `client.selection.Drag` | Window-free controller | Reuse content hit testing and attachment checks; per-pane fractional remainder |
+| History positioning and row decoding | `Replica.scrollStart`, protocol scrollback request/chunk codecs; TUI and wasm consumers | Shared client pump | Reuse existing wire and grid rows; add bounded request/result ownership without a second replica |
+| Displayed view and selection coordinates | `runtime.Live.capture`, `SelectionVersion`, controller selection range | Pump/runtime snapshot boundary | Keep live replica independent; snapshot carries the displayed history origin and freshness |
+| Alternate-screen arrow encoding | `keymap.encode`, TUI `sendAltScroll` | Shared client input policy | Reuse key encoding; keep frozen TUI behavior unchanged |
+| Application wheel ownership and encoding | `TermModes.appMouse`, `mouse_modes`; TUI forwards existing terminal bytes | Pump and pure client encoder | Decide using admitted mode frames; SDL supplies semantic intent, so a terminal byte parser is unnecessary |
+| Real input and independent acceptance | `SelectionRig`, `LifecycleRig`, `wayland_pointer.Pointer` | Retained integration fixtures | Extend established plural-pane fixtures and virtual pointer axis input |
+The earlier font-settings cleanup already supplies the useful opening refactor;
+the current inspection found no additional cleanup needed before this feature.
+Application mouse encodings are checked against the
+[xterm mouse protocol](https://invisible-island.net/xterm/ctlseqs/ctlseqs.html#h2-Mouse-Tracking).
+Selection stays attached to its source text when the viewport moves, including
+scrolling offscreen and back or returning through live view. A held drag keeps
+its original text anchor and extends using the current pane coordinates. Live redraws preserve the selected range; geometry, screen/connection and
+history-watermark changes still invalidate it. Cached history keeps exact
+source freshness. These are part of wheel acceptance, not later polish.
+`frame.zig` owns SDL events and logical-to-framebuffer conversion through
+`physicalPoint`. `interaction.Controller` owns pane hit-testing and modal policy;
+keep these decisions window-free so native-core tests can cover them.
+isolated NVIDIA stress. Build both binaries in ReleaseSafe. Preserve earlier
+NVIDIA timing failures and the offscreen-growth limitation; neither is waived.
+Finish with a localhost review webpage containing achievements, an actual GUI
+video, controls, evidence and limits. Record user demo approval separately from
+checks. Publish only if explicitly requested; preserve unrelated services.
+## Architecture review before implementation
+The user asked explicitly for duplication, hexagonal architecture opportunities
+and refactoring. Review decisions:
+- Give font settings one owner in `font_options.zig`; both CLI and config
+  parsing call its point-size policy. Entry adapters retain their diagnostic
+  mapping, and the font backend retains installed-face validation. Sharing a
+  helper from `config.zig` alone would remove duplication but put domain policy
+  in an input adapter.
+- Move font settings and config/theme source ownership to `native_core`, with public aliases in
+  `native`. The renderer consumes theme values; window/font libraries are not
+  needed to test config parsing, precedence and theme derivation.
+- Preserve the existing SDL → controller → runtime → session-pump boundary.
+  Add semantic wheel intent at the transport mailbox and interpret it using
+  the pump-owned terminal modes, after consuming available frames. Reading modes
+  in the GUI and queueing pre-encoded input could race an incoming mode change.
+  Verify the ordering with real mode frames and independently observed PTY bytes.
+- Keep live/history snapshots behind the pump/runtime boundary. Wheel work should
+  narrow snapshot access rather than introduce new GUI reads of pump internals;
+  request correlation and view ownership belong in its implementation contract.
+- Do not copy the TUI interaction core or mouse byte parser into the GUI. Reuse
+  protocol/replica behavior and share only pure semantic encoding when an actual
+  second caller needs it. The frozen wall keeps its behavior.
+- Extend the existing test input adapter with a real SDL wheel event. A separate
+  test-only scroll path would leave actual event routing untested. Broader hook
+  extraction is a later package unless this slice exposes a concrete need.
+Config and theme line readers look similar but intentionally differ: unknown
+config keys are fatal, unknown theme keys warn, missing config is allowed, and a
+missing selected theme is fatal. Their shared color/palette parsing is already
+centralized. A generic parser framework or filesystem interface is not justified
+by the current callers; retain the existing pure parse/merge functions and small
+file-loading adapters.
+### Opening cleanup evidence
+`font_options.zig` now owns the point-size parser and validity rule. Config and
+CLI adapters preserve their existing errors; installed-face checks remain with
+the font backend. The native core owns font settings, config and theme, and the
+native rendering module retains public aliases. Removed the redundant empty
+family check after the text parser had already rejected empty values.
+Independent review found no behavior/API issue; it caught and removed a stale
+point-size comment left above palette parsing. The module split is checked by
+actual dependency probes: with `PKG_CONFIG_LIBDIR` set to an empty directory and
+`PKG_CONFIG_PATH` empty, `native-core-test` passed all 29 tests, while the full
+native build failed on missing SDL3 metadata as expected. This is a build
+boundary check, not merely a directory rename.
+Logs are in `dist/wheel-opening-cleanup/`. Native build, native unit/core tests
+and formatting passed. Full CI (check, terminal integration, agent, throughput)
+and final native integration passed with no gate changes. The first native integration launch overlapped CI's temporary
+source-ban probe and stopped before compiling; the retry started after the
+probe was removed. The original failed log is retained, and the workflow now
+calls out this build-serialization requirement.
+This refactor preserves appearance behavior and uses the approved appearance
+recordings as its visual baseline; no new visible feature or performance claim
+is made. The following functional wheel delivery supplies its own real-input
+recording and local review page.
+## Wheel implementation and closing review
+`frame` translates SDL wheel coordinates and modifiers into controller input.
+The controller excludes non-content regions and modes, retains fractional
+notches by pane attachment, and passes semantic intent through `Runtime.wheel`.
+The pump drains available mode frames before interpreting queued wheel input.
+Existing keyboard/resize work before a deferred wheel can run between bounded
+receive batches; the wheel and following messages retain FIFO order.
+Shell scrolling uses the existing scrollback request and grid decoder. The pump
+owns one optional history grid and one outstanding request; its cancelled
+request remains a tombstone until the reply is drained. New transport attachment
+clears that tombstone, but same-wire resync retains it. A two-second timeout
+reconnects rather than risking correlation with a later reply. View origin and
+grid are captured under the same lock; all selection hit/paint coordinates use
+that origin. The live replica remains untouched by history decoding.
+The selected distance from live stays constant as output arrives. Output or mode
+changes invalidate copying and schedule a new history fetch. The previous view
+can remain painted while a reply is pending, but cannot be copied as if current.
+This handles ring pruning even when the wire's history-row count remains flat.
+Returning to live, resizing, reconnecting and replacing an attachment invalidate
+the old view. As before, the wire does not provide an atomic source-version
+precondition at the daemon.
+Pure wheel encoding lives in `keymap`, reusing its arrow encoder and Zig's UTF-8
+encoder. SGR pixels, SGR cells, URXVT, UTF-8 and legacy X10 are supported with
+pane-relative coordinates. No runtime dependency, protocol message or terminal
+wall feature was added. Closing cleanup removed the hand-written UTF-8 helper
+and the old duplicated receive-loop body. Independent review checked ownership,
+request cancellation, pending input-buffer transfer, coordinate bounds and
+same-wire resync. The existing QUIC batching regression caught a receive-loop
+change that delayed mailbox work; the final implementation preserves its
+-frame batches and passes that regression.
+A continuously readable stream can delay a wheel waiting for its pending mode
+frames and the input ordered after that wheel. A continuously changing history
+can likewise postpone a safe selectable refresh. The next shared-client
+scheduling change owns investigating a finite protocol ordering boundary if
+this is encountered; dropping input or guessing a newer mode is not the fix.
+### Delivery evidence
+Final CI, client/native tests, full native integration, real Wayland wheel and
+clipboard acceptance, and desktop/mobile local video playback/seek checks passed.
+The final isolated NVIDIA run passed with frame p99 18.745 ms and sampled
+input-to-painted upper bound 65.3 ms (5 ms polling). Earlier current/baseline
+runs missed the frame gate; retained evidence does not establish the cause.
+The continuous recording is 27 seconds with real Wayland pointer/wheel input,
+three panes on two daemons, a separate clipboard reader and real less.
+Local review page: http://127.0.0.1:18776/wheel-scrolling/ . The loopback server
+is recorded in `dist/wheel-scrolling/server.json`; stop it after acceptance.
+No remote publication is required or pending. Publishing is opt-in at the user's
+request. Sources, recording and all validation logs remain in the worktree.
+### Hands-on feedback: keep the highlight while scrolling
+The user expects a completed selection to remain attached to its source text,
+including scrolling it offscreen and back. `Pump` now preserves selection
+freshness through local viewport requests, history replies and return-to-live.
+Input explicitly invalidates selection at the mailbox boundary; terminal output,
+modes, geometry and attachment changes retain their existing guards. Existing
+absolute selection rows and `Live.view_origin` already provide correct painting
+and hit testing, so no new production state or abstraction is needed.
+A held drag retains its original anchor; subsequent motion or release resolves
+its endpoint against the current viewport. The real Wayland regression covers
+both a release on the moved source row and extending across newly visible rows.
+The user requested hands-on review instead of a new demo recording for this fix.
+Client/native units, the full native integration suite and real NVIDIA Wayland
+wheel/copy regressions passed. The repository check gate passed; full CI stopped
+on an existing nested-agent exit timeout, which passed on targeted rerun without
+changes. Full-run CI success is therefore not claimed for this feedback commit.
+Evidence: `dist/wheel-scrolling/selection-preserve-*.log`; details in `RETRO.md`.
+Active-output follow-up: live selection now survives counter/redraw frames,
+following Ghostty; a cached-history origin remains strict even after returning
+live. See the text-selection plan's active-output entry for semantics and limits.

src/cli/muxg.zig

Old		New
@@ -13,9 +13,7 @@ const hosts = client.hosts;
13	const PointSize = struct {	13	const PointSize = struct {
14	value: f64,	14	value: f64,
15	pub fn parseCLI(text: []const u8) !PointSize {	15	pub fn parseCLI(text: []const u8) !PointSize {
16	const value = std.fmt.parseFloat(f64, text) catch return error.Invalid;	16	return .{ .value = native.font_options.parsePointSize(text) catch return error.Invalid };
17	if (!std.math.isFinite(value) or value < 1 or value > 192) return error.Invalid;
18	return .{ .value = value };
19	}	17	}
20	};	18	};
21	const Color = struct {	19	const Color = struct {

src/client/client.zig

Old		New
@@ -33,6 +33,7 @@ pub const layoutfile = @import("layoutfile.zig");
33	pub const keymap = @import("keymap.zig");	33	pub const keymap = @import("keymap.zig");
34	pub const askpass = @import("askpass.zig");	34	pub const askpass = @import("askpass.zig");
35	pub const core = @import("client_core.zig");	35	pub const core = @import("client_core.zig");
		36	pub const selection = @import("selection.zig");
36	pub const discovery = @import("discovery.zig");	37	pub const discovery = @import("discovery.zig");
37	pub const resolver = @import("resolver.zig");	38	pub const resolver = @import("resolver.zig");
38	const open_wait = @import("open_wait.zig");	39	const open_wait = @import("open_wait.zig");

src/client/client_core.zig

Old		New
@@ -1,9 +1,9 @@
1	//! What a client does with a daemon frame besides paint it: the terminal	1	//! What a client does with a daemon frame besides paint it: the terminal
2	//! modes a session set, a clipboard write, a bell, the answer to a selection	2	//! modes a session set, a clipboard write, a bell, the answer to a selection
3	//! request. One decoder with no transport and no terminal under it, so the	3	//! request. One decoder with no transport and no terminal under it, so the
4	//! CLI client and the browser core read the same frame the same way, and	4	//! CLI client and the browser core read the same frame the same way. Receive
5	//! `pending_selection_id` is the whole of its state. Every result BORROWS	5	//! results borrow the payload; the optional clipboard text adapter explicitly
6	//! the payload; nothing here allocates.	6	//! allocates an owned decoded copy.
7	const std = @import("std");	7	const std = @import("std");
8	const proto = @import("term").protocol;	8	const proto = @import("term").protocol;
9		9
@@ -12,6 +12,26 @@ pub const ClipboardSet = struct {
12	target: u8,	12	target: u8,
13	base64: []const u8,	13	base64: []const u8,
14	};	14	};
		15	pub const ClipboardText = struct { primary: bool, text: []u8 };
		16
		17	/// Text clipboard adapters must not silently truncate NUL or invalid UTF-8.
		18	pub fn validClipboardText(text: []const u8) bool {
		19	return text.len != 0 and std.unicode.utf8ValidateSlice(text) and std.mem.indexOfScalar(u8, text, 0) == null;
		20	}
		21
		22	/// Decode a supported clipboard target into owned, validated text. Targets
		23	/// addressed to numbered buffers or the secondary selection are ignored.
		24	pub fn decodeClipboard(alloc: std.mem.Allocator, target: u8, base64: []const u8) !?ClipboardText {
		25	if (target != 'c' and target != 'p' and target != 's') return null;
		26	if (!validClipboard(target, base64)) return error.InvalidClipboard;
		27	const size = std.base64.standard.Decoder.calcSizeForSlice(base64) catch return error.InvalidClipboard;
		28	if (size == 0) return error.InvalidClipboard;
		29	const text = try alloc.alloc(u8, size);
		30	errdefer alloc.free(text);
		31	std.base64.standard.Decoder.decode(text, base64) catch return error.InvalidClipboard;
		32	if (!validClipboardText(text)) return error.InvalidClipboard;
		33	return .{ .primary = target == 'p' or target == 's', .text = text };
		34	}
15		35
16	pub const State = union(enum) {	36	pub const State = union(enum) {
17	terminal_modes: proto.TermModes,	37	terminal_modes: proto.TermModes,
@@ -165,6 +185,21 @@ test "client core accepts clipboard and bell events" {
165	}	185	}
166	}	186	}
167		187
		188	test "decodeClipboard decodes supported targets and rejects unsafe text" {
		189	const a = std.testing.allocator;
		190	const decoded = (try decodeClipboard(a, 'c', "aMOp")) orelse return error.ExpectedClipboard;
		191	defer a.free(decoded.text);
		192	try std.testing.expect(!decoded.primary);
		193	try std.testing.expectEqualStrings("hé", decoded.text);
		194	const primary = (try decodeClipboard(a, 's', "aGk=")) orelse return error.ExpectedClipboard;
		195	defer a.free(primary.text);
		196	try std.testing.expect(primary.primary);
		197	try std.testing.expect((try decodeClipboard(a, 'q', "aGk=")) == null);
		198	try std.testing.expectError(error.InvalidClipboard, decodeClipboard(a, 'c', "aGk"));
		199	try std.testing.expectError(error.InvalidClipboard, decodeClipboard(a, 'c', "AA=="));
		200	try std.testing.expectError(error.InvalidClipboard, decodeClipboard(a, 'c', "//8="));
		201	}
		202
168	test "client core accepts every clipboard target boundary" {	203	test "client core accepts every clipboard target boundary" {
169	var core = ClientCore{};	204	var core = ClientCore{};
170	const targets = [_]u8{ 'c', 'p', 'q', 's', '0', '1', '2', '3', '4', '5', '6', '7' };	205	const targets = [_]u8{ 'c', 'p', 'q', 's', '0', '1', '2', '3', '4', '5', '6', '7' };
@@ -277,12 +312,13 @@ test "client core begins selection with exact request bytes" {
277	};	312	};
278		313
279	const encoded = core.beginSelection(req);	314	const encoded = core.beginSelection(req);
280	try std.testing.expectEqualSlices(u8, &.{	315	const expected = [_]u8{
281	0x12, 0x34, 0x56, 0x78,	316	0x12, 0x34, 0x56, 0x78,
282	0x11, 0x22, 0x33, 0x44,	317	0x11, 0x22, 0x33, 0x44,
283	0x55, 0x66, 0x77, 0x88,	318	0x55, 0x66, 0x77, 0x88,
284	0x99, 0xaa, 0xbb, 0xcc,	319	0x99, 0xaa, 0xbb, 0xcc,
285	}, &encoded);	320	} ++ ([_]u8{0} ** 21);
		321	try std.testing.expectEqualSlices(u8, &expected, &encoded);
286	try std.testing.expectEqualDeep(req, try proto.decodeSelectionReq(&encoded));	322	try std.testing.expectEqualDeep(req, try proto.decodeSelectionReq(&encoded));
287	try std.testing.expectEqual(@as(?u32, req.id), core.pending_selection_id);	323	try std.testing.expectEqual(@as(?u32, req.id), core.pending_selection_id);
288	}	324	}
@@ -294,8 +330,15 @@ test "client core ignores stale selection reply then accepts matching reply once
294	.anchor = .{ .row = 1, .col = 2 },	330	.anchor = .{ .row = 1, .col = 2 },
295	.active = .{ .row = 3, .col = 4 },	331	.active = .{ .row = 3, .col = 4 },
296	});	332	});
297	const stale = [_]u8{ 21, 0, 0, 0, 0, 0, 0, 0, 0, 'n', 'o' };	333	var stale = [_]u8{0} ** (proto.selection_reply_prefix_len + 2);
298	const matching = [_]u8{ 22, 0, 0, 0, 0, 8, 0, 0, 0, 'o', 'k' };	334	std.mem.writeInt(u32, stale[0..4], 21, .little);
		335	stale[proto.selection_reply_prefix_len..][0] = 'n';
		336	stale[proto.selection_reply_prefix_len..][1] = 'o';
		337	var matching = [_]u8{0} ** (proto.selection_reply_prefix_len + 2);
		338	std.mem.writeInt(u32, matching[0..4], 22, .little);
		339	std.mem.writeInt(u32, matching[5..9], 8, .little);
		340	matching[proto.selection_reply_prefix_len..][0] = 'o';
		341	matching[proto.selection_reply_prefix_len..][1] = 'k';
299		342
300	try expectIgnored(core.receive(.selection_reply, &stale));	343	try expectIgnored(core.receive(.selection_reply, &stale));
301	try std.testing.expectEqual(@as(?u32, 22), core.pending_selection_id);	344	try std.testing.expectEqual(@as(?u32, 22), core.pending_selection_id);
@@ -317,9 +360,15 @@ test "client core latest selection begin replaces the older pending id" {
317	.active = .{ .row = 4, .col = 5 },	360	.active = .{ .row = 4, .col = 5 },
318	});	361	});
319		362
320	try expectIgnored(core.receive(.selection_reply, &.{ 7, 0, 0, 0, 0, 0, 0, 0, 0, 'x' }));	363	var stale = [_]u8{0} ** (proto.selection_reply_prefix_len + 1);
		364	std.mem.writeInt(u32, stale[0..4], 7, .little);
		365	stale[proto.selection_reply_prefix_len] = 'x';
		366	try expectIgnored(core.receive(.selection_reply, &stale));
321	try std.testing.expectEqual(@as(?u32, 8), core.pending_selection_id);	367	try std.testing.expectEqual(@as(?u32, 8), core.pending_selection_id);
322	try expectSelection(core.receive(.selection_reply, &.{ 8, 0, 0, 0, 0, 0, 0, 0, 0, 'y' }), 8, .ok, 0, "y");	368	var matching = [_]u8{0} ** (proto.selection_reply_prefix_len + 1);
		369	std.mem.writeInt(u32, matching[0..4], 8, .little);
		370	matching[proto.selection_reply_prefix_len] = 'y';
		371	try expectSelection(core.receive(.selection_reply, &matching), 8, .ok, 0, "y");
323	}	372	}
324		373
325	test "client core malformed matching selection reply preserves pending request" {	374	test "client core malformed matching selection reply preserves pending request" {
@@ -330,9 +379,15 @@ test "client core malformed matching selection reply preserves pending request"
330	.active = .{ .row = 0, .col = 0 },	379	.active = .{ .row = 0, .col = 0 },
331	});	380	});
332		381
333	try expectIgnored(core.receive(.selection_reply, &.{ 9, 0, 0, 0, 1, 0, 0, 0, 0, 'x' }));	382	var malformed = [_]u8{0} ** (proto.selection_reply_prefix_len + 1);
		383	std.mem.writeInt(u32, malformed[0..4], 9, .little);
		384	malformed[4] = @intFromEnum(proto.SelectionStatus.invalid);
		385	malformed[proto.selection_reply_prefix_len] = 'x';
		386	try expectIgnored(core.receive(.selection_reply, &malformed));
334	try std.testing.expectEqual(@as(?u32, 9), core.pending_selection_id);	387	try std.testing.expectEqual(@as(?u32, 9), core.pending_selection_id);
335	try expectSelection(core.receive(.selection_reply, &.{ 9, 0, 0, 0, 0, 0, 0, 0, 0 }), 9, .ok, 0, "");	388	var matching = [_]u8{0} ** proto.selection_reply_prefix_len;
		389	std.mem.writeInt(u32, matching[0..4], 9, .little);
		390	try expectSelection(core.receive(.selection_reply, &matching), 9, .ok, 0, "");
336	}	391	}
337		392
338	test "client core delivers every matching non-ok selection status with empty text" {	393	test "client core delivers every matching non-ok selection status with empty text" {
@@ -345,8 +400,9 @@ test "client core delivers every matching non-ok selection status with empty tex
345	.anchor = .{ .row = 0, .col = 0 },	400	.anchor = .{ .row = 0, .col = 0 },
346	.active = .{ .row = 0, .col = 0 },	401	.active = .{ .row = 0, .col = 0 },
347	});	402	});
348	var payload = [_]u8{ 0, 0, 0, 0, @intFromEnum(status), 0, 0, 0, 0 };	403	var payload = [_]u8{0} ** proto.selection_reply_prefix_len;
349	std.mem.writeInt(u32, payload[0..4], id, .little);	404	std.mem.writeInt(u32, payload[0..4], id, .little);
		405	payload[4] = @intFromEnum(status);
350		406
351	try expectSelection(core.receive(.selection_reply, &payload), id, status, 0, "");	407	try expectSelection(core.receive(.selection_reply, &payload), id, status, 0, "");
352	try std.testing.expectEqual(@as(?u32, null), core.pending_selection_id);	408	try std.testing.expectEqual(@as(?u32, null), core.pending_selection_id);
@@ -360,7 +416,11 @@ test "client core selection reply text borrows the frame payload" {
360	.anchor = .{ .row = 0, .col = 0 },	416	.anchor = .{ .row = 0, .col = 0 },
361	.active = .{ .row = 0, .col = 0 },	417	.active = .{ .row = 0, .col = 0 },
362	});	418	});
363	var payload = [_]u8{ 1, 0, 0, 0, 0, 4, 0, 0, 0, 'h', 'i' };	419	var payload = [_]u8{0} ** (proto.selection_reply_prefix_len + 2);
		420	std.mem.writeInt(u32, payload[0..4], 1, .little);
		421	std.mem.writeInt(u32, payload[5..9], 4, .little);
		422	payload[proto.selection_reply_prefix_len..][0] = 'h';
		423	payload[proto.selection_reply_prefix_len..][1] = 'i';
364		424
365	const result = core.receive(.selection_reply, &payload);	425	const result = core.receive(.selection_reply, &payload);
366	payload[proto.selection_reply_prefix_len] = 'H';	426	payload[proto.selection_reply_prefix_len] = 'H';

src/client/keymap.zig

@@ @@ -76,6 +76,72 @@ pub const Event = struct { @@
+/// the widest today is the 7-byte modified tilde CSI; the slack is
+/// headroom for forms not in the table yet.
+pub const max_seq_len = 16;
+pub const MouseFormat = enum { x10, utf8, sgr, urxvt, sgr_pixels };
+pub const mouse_max_seq_len = 64;
+/// Encode one semantic mouse event. Coordinates are one-based on the wire.
+pub fn encodeMouse(format: MouseFormat, button_base: u8, release: bool, cell_x: u16, cell_y: u16, pixel_x: u32, pixel_y: u32, mods: Mods, buf: []u8) []const u8 {
+    std.debug.assert(buf.len >= mouse_max_seq_len);
+    const base: u16 = if (release and format != .sgr and format != .sgr_pixels) 3 else button_base;
+    const button: u16 = base + @as(u16, @intFromBool(mods.shift)) * 4 + @as(u16, @intFromBool(mods.alt)) * 8 + @as(u16, @intFromBool(mods.ctrl)) * 16;
+    const x: u32 = if (format == .sgr_pixels) pixel_x else cell_x;
+    const y: u32 = if (format == .sgr_pixels) pixel_y else cell_y;
+    const bx = x +| 1;
+    const by = y +| 1;
+    switch (format) {
+        .sgr, .sgr_pixels => return std.fmt.bufPrint(buf, "\x1b[<{d};{d};{d}{c}", .{ button, bx, by, @as(u8, if (release) 'm' else 'M') }) catch unreachable,
+        .urxvt => return std.fmt.bufPrint(buf, "\x1b[{d};{d};{d}M", .{ button + 32, bx, by }) catch unreachable,
+        .x10 => {
+            if (bx > 223 or by > 223) return buf[0..0];
+            buf[0] = 0x1b;
+            buf[1] = '[';
+            buf[2] = 'M';
+            buf[3] = @intCast(button + 32);
+            buf[4] = @intCast(bx + 32);
+            buf[5] = @intCast(by + 32);
+            return buf[0..6];
+        },
+        .utf8 => {
+            if (bx > 2015 or by > 2015) return buf[0..0];
+            buf[0] = 0x1b;
+            buf[1] = '[';
+            buf[2] = 'M';
+            var n: usize = 3;
+            for ([_]u21{ button + 32, @intCast(bx + 32), @intCast(by + 32) }) |cp| {
+                n += std.unicode.utf8Encode(cp, buf[n..]) catch unreachable;
+            }
+            return buf[0..n];
+        },
+    }
+}
+pub fn encodeWheel(format: MouseFormat, up: bool, cell_x: u16, cell_y: u16, pixel_x: u32, pixel_y: u32, mods: Mods, buf: []u8) []const u8 {
+    return encodeMouse(format, if (up) 64 else 65, false, cell_x, cell_y, pixel_x, pixel_y, mods, buf);
+}
+pub fn encodeWheelArrow(up: bool, cursor_keys: bool, buf: []u8) []const u8 {
+    const bytes = encode(.{ .key = if (up) .up else .down }, buf);
+    if (cursor_keys) buf[1] = 'O';
+    return bytes;
+}
+test "wheel encodes negotiated SGR and legacy forms" {
+    var buf: [mouse_max_seq_len]u8 = undefined;
+    try std.testing.expectEqualStrings("\x1b[<64;4;6M", encodeWheel(.sgr, true, 3, 5, 0, 0, .{}, &buf));
+    try std.testing.expectEqualStrings("\x1b[97;4;6M", encodeWheel(.urxvt, false, 3, 5, 0, 0, .{}, &buf));
+    try std.testing.expectEqualStrings("\x1bOA", encodeWheelArrow(true, true, &buf));
+    try std.testing.expectEqualStrings("\x1b[B", encodeWheelArrow(false, false, &buf));
+    try std.testing.expectEqualSlices(u8, &.{ 27, '[', 'M', 96, 255, 255 }, encodeWheel(.x10, true, 222, 222, 0, 0, .{}, &buf));
+    try std.testing.expectEqual(@as(usize, 0), encodeWheel(.x10, true, 223, 0, 0, 0, .{}, &buf).len);
+    try std.testing.expectEqualStrings("\x1b[<64;225;226M", encodeWheel(.sgr_pixels, true, 0, 0, 224, 225, .{}, &buf));
+    try std.testing.expectEqualSlices(u8, &.{ 27, '[', 'M', 96, 0xdf, 0xbf, 0xdf, 0xbf }, encodeWheel(.utf8, true, 2014, 2014, 0, 0, .{}, &buf));
+    try std.testing.expectEqual(@as(usize, 0), encodeWheel(.utf8, true, 2015, 0, 0, 0, .{}, &buf).len);
+    try std.testing.expectEqualStrings("\x1b[<93;1;1M", encodeWheel(.sgr, false, 0, 0, 0, 0, .{ .shift = true, .alt = true, .ctrl = true }, &buf));
+    try std.testing.expectEqualStrings("\x1b[<1;4;6m", encodeMouse(.sgr, 1, true, 3, 5, 0, 0, .{}, &buf));
+    try std.testing.expectEqualSlices(u8, &.{ 27, '[', 'M', 51, 33, 33 }, encodeMouse(.x10, 0, true, 0, 0, 0, 0, .{ .ctrl = true }, &buf));
+    try std.testing.expectEqualStrings("\x1b[35;4;6M", encodeMouse(.urxvt, 2, true, 3, 5, 0, 0, .{}, &buf));
+    try std.testing.expectEqualStrings("\x1b[<64;4;6M", encodeWheel(.sgr, true, 3, 5, 0, 0, .{}, &buf));
+}
+/// Encode one event into `buf` (at least max_seq_len bytes), returning the
+/// slice written. An event this table has no bytes for — a bare modifier,

src/client/selection.zig

@@ @@ -0,0 +1,367 @@ @@
+//! The drag behind text selection, as pure state: press, motion, release, and
+//! the span of columns highlighted on one line of one session.
+//!
+//! No tty, no transport, no engine, no allocation beyond its own struct — a
+//! driver resolves a mouse report into `Hit` and this owns what a SEQUENCE of
+//! those means, which is what lets two drivers in different layers share one
+//! meaning. Resolving a terminal row to a session line stays with the layout.
+//!
+//! Rows are ABSOLUTE, counted from the oldest row the daemon retains: a drag
+//! held while the session scrolls must keep naming the lines it started over,
+//! and a terminal row renames itself the moment output moves the window.
+const std = @import("std");
+/// One place in one session, as a driver has resolved a report.
+pub const Hit = struct {
+    tile: usize,
+    /// Absolute row: counted from the oldest row the daemon still retains.
+    row: u32,
+    /// Grid column, zero-based. Terminal column is the same number —
+    /// every painter emits from column 1 with no x-offset.
+    col: u16,
+};
+/// A zero-based terminal cell, which is not a `Hit`: it is where the POINTER
+/// is, not what is under it. The two part company when the session scrolls, and
+/// telling a click from a drag is the pointer's question.
+pub const Cell = struct { row: u16, col: u16 };
+/// Inclusive columns, the same convention `engine.extractSelection` and
+/// ghostty's `Selection` use at the other end of the wire.
+pub const Span = struct { from: u16, to: u16 };
+/// A completed selection, normalized: `from` is at or before `to` in
+/// reading order, whichever way the hand moved.
+pub const Range = struct {
+    from: Hit,
+    to: Hit,
+    /// On `Range` rather than `Drag` because two get compared: a drag that moved
+    /// repaints the rows whose span CHANGED. `cols` is the GRID's width, and the
+    /// clamp is not decoration — a grid narrower than its terminal has columns a
+    /// pointer can reach with no cell behind them.
+    pub fn span(self: Range, tile: usize, row: u32, cols: u16) ?Span {
+        if (self.from.tile != tile) return null;
+        if (row < self.from.row or row > self.to.row) return null;
+        const from = if (row == self.from.row) self.from.col else 0;
+        const to = @min(if (row == self.to.row) self.to.col else cols -| 1, cols -| 1);
+        // A selection whose whole width fell off the grid's right edge
+        // highlights nothing on this row, rather than one clamped cell at
+        // the edge that nobody pointed at.
+        if (from > to) return null;
+        return .{ .from = from, .to = to };
+    }
+};
+/// What a button coming up meant.
+pub const Release = union(enum) {
+    /// Nothing was down, or the press landed on nothing selectable.
+    nothing,
+    /// Press and release in one cell. Not a selection — tmux's
+    /// `MouseDown1Pane`, which a driver answers by moving its own
+    /// selection to the thing clicked.
+    click: Hit,
+    /// A drag that ended. The highlight STANDS after this: it is what a
+    /// copy is taken from, and what the next press or `clear` drops.
+    selection: Range,
+};
+/// One button's worth of drag. Four states, because a press is not yet a
+/// selection and a release is not the end of one: `.down` may still turn out to
+/// be a click, and `.held` is a finished selection still on screen.
+pub const Drag = struct {
+    const Phase = enum { idle, down, dragging, held };
+    phase: Phase = .idle,
+    /// The cell the press was on, which is what a later motion is
+    /// compared against to tell a drag from a tremor.
+    at: Cell = .{ .row = 0, .col = 0 },
+    anchor: Hit = .{ .tile = 0, .row = 0, .col = 0 },
+    active: Hit = .{ .tile = 0, .row = 0, .col = 0 },
+    /// Whatever was held is dropped however the press turns out: a new
+    /// press is a new selection, and a press on nothing (a label bar) is
+    /// the user putting the old one away.
+    pub fn press(self: *Drag, cell: Cell, hit: ?Hit) void {
+        const h = hit orelse {
+            self.* = .{};
+            return;
+        };
+        self.* = .{ .phase = .down, .at = cell, .anchor = h, .active = h };
+    }
+    /// Cell, not pixel: `?1002h` reports a CELL change, and a hand trembling
+    /// inside one cell still points at one line. Once it IS a drag it stays one.
+    /// Confined to its starting tile, or it would ask the wrong session.
+    pub fn motion(self: *Drag, cell: Cell, hit: ?Hit) void {
+        switch (self.phase) {
+            .idle, .held => return,
+            .down => {
+                if (cell.row == self.at.row and cell.col == self.at.col) return;
+                self.phase = .dragging;
+            },
+            .dragging => {},
+        }
+        const h = hit orelse return;
+        if (h.tile != self.anchor.tile) return;
+        self.active = h;
+    }
+    /// The button came up. See `Release` for what the three answers mean.
+    pub fn release(self: *Drag) Release {
+        switch (self.phase) {
+            .idle, .held => return .nothing,
+            .down => {
+                const hit = self.anchor;
+                self.* = .{};
+                return .{ .click = hit };
+            },
+            .dragging => {
+                self.phase = .held;
+                return .{ .selection = self.rangeLocked() };
+            },
+        }
+    }
+    /// Coordinates stopped meaning what they meant.
+    pub fn clear(self: *Drag) void {
+        self.* = .{};
+    }
+    /// A press that has not moved yet counts; `range`, by contrast,
+    /// answers only about what is on screen.
+    pub fn on(self: *const Drag) ?usize {
+        return if (self.phase == .idle) null else self.anchor.tile;
+    }
+    /// Whether the pointer button remains down and motion should be captured.
+    pub fn buttonHeld(self: *const Drag) bool {
+        return self.phase == .down or self.phase == .dragging;
+    }
+    /// The selection as an ordered pair, or null while there is none.
+    pub fn range(self: *const Drag) ?Range {
+        return switch (self.phase) {
+            .idle, .down => null,
+            .dragging, .held => self.rangeLocked(),
+        };
+    }
+    fn rangeLocked(self: *const Drag) Range {
+        const a = self.anchor;
+        const b = self.active;
+        const forward = b.row > a.row or (b.row == a.row and b.col >= a.col);
+        return if (forward) .{ .from = a, .to = b } else .{ .from = b, .to = a };
+    }
+    /// `Range.span` for the live selection, or null while there is none.
+    pub fn span(self: *const Drag, tile: usize, row: u32, cols: u16) ?Span {
+        const r = self.range() orelse return null;
+        return r.span(tile, row, cols);
+    }
+};
+test "select: a press alone is a click, and highlights nothing on its way" {
+    var d: Drag = .{};
+    const hit: Hit = .{ .tile = 1, .row = 40, .col = 7 };
+    d.press(.{ .row = 12, .col = 7 }, hit);
+    // Nothing is highlighted while the button is merely down: a press that
+    // turns out to be a click must never flicker an inversion on its way.
+    try std.testing.expect(d.span(1, 40, 80) == null);
+    try std.testing.expect(d.range() == null);
+    const r = d.release();
+    try std.testing.expectEqual(@as(usize, 1), r.click.tile);
+    try std.testing.expectEqual(@as(u32, 40), r.click.row);
+    try std.testing.expectEqual(@as(u16, 7), r.click.col);
+    // ...and the click leaves nothing behind to paint.
+    try std.testing.expect(d.range() == null);
+}
+test "select: absolute history rows do not narrow the pointer cell" {
+    var d: Drag = .{};
+    const origin: Hit = .{ .tile = 7, .row = 70_000, .col = 3 };
+    d.press(.{ .row = 2, .col = 3 }, origin);
+    try std.testing.expect(d.buttonHeld());
+    d.motion(.{ .row = 3, .col = 3 }, .{ .tile = 7, .row = 70_001, .col = 3 });
+    const release = d.release();
+    try std.testing.expectEqual(@as(u32, 70_001), release.selection.to.row);
+    try std.testing.expect(!d.buttonHeld());
+    try std.testing.expectEqual(@as(u16, 3), (d.range() orelse unreachable).from.col);
+}
+test "select: a drag names its tile from the press, before it is a selection" {
+    var d: Drag = .{};
+    try std.testing.expect(d.on() == null);
+    d.press(.{ .row = 2, .col = 1 }, .{ .tile = 3, .row = 5, .col = 1 });
+    // Pressed, not yet dragged: nothing to paint, and still a tile whose
+    // coordinates a caller may have to drop.
+    try std.testing.expect(d.range() == null);
+    try std.testing.expectEqual(@as(usize, 3), d.on().?);
+    d.motion(.{ .row = 4, .col = 1 }, .{ .tile = 3, .row = 7, .col = 1 });
+    try std.testing.expectEqual(@as(usize, 3), d.on().?);
+    _ = d.release();
+    // Still held after the button came up, which is what a highlight is.
+    try std.testing.expectEqual(@as(usize, 3), d.on().?);
+    d.clear();
+    try std.testing.expect(d.on() == null);
+}
+test "select: a press on nothing selectable is nothing at all" {
+    var d: Drag = .{};
+    d.press(.{ .row = 0, .col = 3 }, null);
+    d.motion(.{ .row = 4, .col = 9 }, .{ .tile = 0, .row = 5, .col = 9 });
+    try std.testing.expect(d.range() == null);
+    try std.testing.expect(d.release() == .nothing);
+}
+test "select: either drag direction yields the same ordered pair" {
+    const top: Hit = .{ .tile = 0, .row = 100, .col = 4 };
+    const bot: Hit = .{ .tile = 0, .row = 103, .col = 12 };
+    var down: Drag = .{};
+    down.press(.{ .row = 2, .col = 4 }, top);
+    down.motion(.{ .row = 5, .col = 12 }, bot);
+    const a = down.release().selection;
+    var up: Drag = .{};
+    up.press(.{ .row = 5, .col = 12 }, bot);
+    up.motion(.{ .row = 2, .col = 4 }, top);
+    const b = up.release().selection;
+    try std.testing.expectEqual(a.from, b.from);
+    try std.testing.expectEqual(a.to, b.to);
+    try std.testing.expectEqual(@as(u32, 100), a.from.row);
+    try std.testing.expectEqual(@as(u16, 4), a.from.col);
+    try std.testing.expectEqual(@as(u32, 103), a.to.row);
+    try std.testing.expectEqual(@as(u16, 12), a.to.col);
+}
+test "select: a one-row drag reads left to right whichever way the hand moved" {
+    var d: Drag = .{};
+    d.press(.{ .row = 3, .col = 9 }, .{ .tile = 0, .row = 50, .col = 9 });
+    d.motion(.{ .row = 3, .col = 2 }, .{ .tile = 0, .row = 50, .col = 2 });
+    const s = d.span(0, 50, 80).?;
+    try std.testing.expectEqual(@as(u16, 2), s.from);
+    try std.testing.expectEqual(@as(u16, 9), s.to);
+    // One row, so neither neighbour is in it.
+    try std.testing.expect(d.span(0, 49, 80) == null);
+    try std.testing.expect(d.span(0, 51, 80) == null);
+}
+test "select: the ends are clipped at the anchors, and the middle is the full width" {
+    var d: Drag = .{};
+    d.press(.{ .row = 1, .col = 30 }, .{ .tile = 2, .row = 7, .col = 30 });
+    d.motion(.{ .row = 4, .col = 6 }, .{ .tile = 2, .row = 10, .col = 6 });
+    const first = d.span(2, 7, 80).?;
+    try std.testing.expectEqual(@as(u16, 30), first.from);
+    try std.testing.expectEqual(@as(u16, 79), first.to);
+    const middle = d.span(2, 8, 80).?;
+    try std.testing.expectEqual(@as(u16, 0), middle.from);
+    try std.testing.expectEqual(@as(u16, 79), middle.to);
+    const last = d.span(2, 10, 80).?;
+    try std.testing.expectEqual(@as(u16, 0), last.from);
+    try std.testing.expectEqual(@as(u16, 6), last.to);
+    // Outside the range on both sides.
+    try std.testing.expect(d.span(2, 6, 80) == null);
+    try std.testing.expect(d.span(2, 11, 80) == null);
+}
+test "select: the highlight is one tile's, and the drag cannot leave it" {
+    var d: Drag = .{};
+    d.press(.{ .row = 2, .col = 1 }, .{ .tile = 0, .row = 5, .col = 1 });
+    // A drag onto the neighbouring stripe: it IS a drag, and the active
+    // end stays on the last line of the tile it started in.
+    d.motion(.{ .row = 9, .col = 40 }, .{ .tile = 1, .row = 200, .col = 40 });
+    const s = d.span(0, 5, 80).?;
+    try std.testing.expectEqual(@as(u16, 1), s.from);
+    try std.testing.expectEqual(@as(u16, 1), s.to);
+    // Neither the row it strayed onto nor the tile it strayed into.
+    try std.testing.expect(d.span(1, 200, 80) == null);
+    try std.testing.expect(d.span(0, 200, 80) == null);
+    // The same rows, asked for as somebody else's tile, are not the answer.
+    try std.testing.expect(d.span(1, 5, 80) == null);
+}
+test "select: a pointer that never leaves the press cell has not dragged" {
+    var d: Drag = .{};
+    d.press(.{ .row = 6, .col = 20 }, .{ .tile = 0, .row = 6, .col = 20 });
+    // `?1002h` reports on a cell change, but a terminal repeating the cell
+    // must not turn a click into an empty selection.
+    d.motion(.{ .row = 6, .col = 20 }, .{ .tile = 0, .row = 6, .col = 20 });
+    try std.testing.expect(d.range() == null);
+    try std.testing.expect(d.release() == .click);
+}
+test "select: a drag that comes back to where it started is still a drag" {
+    var d: Drag = .{};
+    const home: Hit = .{ .tile = 0, .row = 6, .col = 20 };
+    d.press(.{ .row = 6, .col = 20 }, home);
+    d.motion(.{ .row = 6, .col = 25 }, .{ .tile = 0, .row = 6, .col = 25 });
+    d.motion(.{ .row = 6, .col = 20 }, home);
+    try std.testing.expect(d.release() == .selection);
+    // One cell selected, and it is still on screen after the button is up.
+    const s = d.span(0, 6, 80).?;
+    try std.testing.expectEqual(@as(u16, 20), s.from);
+    try std.testing.expectEqual(@as(u16, 20), s.to);
+}
+test "select: the highlight outlives the release, and dies on clear" {
+    var d: Drag = .{};
+    d.press(.{ .row = 0, .col = 0 }, .{ .tile = 0, .row = 3, .col = 0 });
+    d.motion(.{ .row = 1, .col = 5 }, .{ .tile = 0, .row = 4, .col = 5 });
+    _ = d.release();
+    try std.testing.expect(d.span(0, 3, 80) != null);
+    // A motion after the button is up is somebody else's pointer moving
+    // over a selection that is finished.
+    d.motion(.{ .row = 8, .col = 8 }, .{ .tile = 0, .row = 11, .col = 8 });
+    try std.testing.expectEqual(@as(u32, 4), d.range().?.to.row);
+    try std.testing.expect(d.release() == .nothing);
+    d.clear();
+    try std.testing.expect(d.range() == null);
+    try std.testing.expect(d.span(0, 3, 80) == null);
+}
+test "select: a new press drops the selection the last one left" {
+    var d: Drag = .{};
+    d.press(.{ .row = 0, .col = 0 }, .{ .tile = 0, .row = 3, .col = 0 });
+    d.motion(.{ .row = 1, .col = 5 }, .{ .tile = 0, .row = 4, .col = 5 });
+    _ = d.release();
+    d.press(.{ .row = 7, .col = 2 }, .{ .tile = 0, .row = 10, .col = 2 });
+    try std.testing.expect(d.span(0, 3, 80) == null);
+    try std.testing.expect(d.range() == null);
+    // ...and a press on nothing drops it just as thoroughly.
+    d.motion(.{ .row = 7, .col = 6 }, .{ .tile = 0, .row = 10, .col = 6 });
+    try std.testing.expect(d.range() != null);
+    d.press(.{ .row = 0, .col = 0 }, null);
+    try std.testing.expect(d.range() == null);
+}
+test "select: a motion with no button down selects nothing" {
+    var d: Drag = .{};
+    d.motion(.{ .row = 4, .col = 4 }, .{ .tile = 0, .row = 4, .col = 4 });
+    try std.testing.expect(d.range() == null);
+    try std.testing.expect(d.release() == .nothing);
+}
+test "select: a span past the grid's right edge is clipped, not painted at the edge" {
+    // The tty is wider than the grid — latest-wins leaves that shape
+    // routinely — so a pointer can reach columns with no cell behind them.
+    var d: Drag = .{};
+    d.press(.{ .row = 0, .col = 90 }, .{ .tile = 0, .row = 2, .col = 90 });
+    d.motion(.{ .row = 1, .col = 95 }, .{ .tile = 0, .row = 3, .col = 95 });
+    // The first row's anchor is off the grid entirely: nothing to invert,
+    // and NOT one cell at column 39.
+    try std.testing.expect(d.span(0, 2, 40) == null);
+    // The last row runs from the left edge to the grid's own right edge.
+    const last = d.span(0, 3, 40).?;
+    try std.testing.expectEqual(@as(u16, 0), last.from);
+    try std.testing.expectEqual(@as(u16, 39), last.to);
+}
+// Forces semantic analysis of every pub decl under `zig build test`, so an
+// unreferenced decl must at least compile (the silent-module-loss hazard,
+// decisions.md). Pub decls only: std.meta.declarations sees nothing private.
+test {
+    std.testing.refAllDeclsRecursive(@This());
+}

src/client/session_pump.zig

@@ @@ -8,7 +8,68 @@ const term = @import("term"); @@
+const proto = term.protocol;
+const Wire = @import("buffered_wire.zig").Wire;
+/// Identity of the displayed terminal state, copied with its grid under mu.
+/// Live selection keeps its range through redraws and copies current text.
+/// History views retain exact source freshness because their cells are cached.
+/// Revision invalidates coordinates across reconnects, resizes and mode frames.
+pub const SelectionVersion = struct { seq: u64, source: u64 = 0, history_rows: u32, epoch: u64, revision: u64, history: bool = false };
+pub const SelectionRequest = struct {
+    id: u32,
+    gesture: u32 = 0,
+    anchor: proto.SelectionPoint,
+    active: proto.SelectionPoint,
+    version: SelectionVersion,
+    ticket: u64 = 0, // stamped by say; cancellation also invalidates queued work
+};
+pub const Say = union(enum) {
+    input: []const u8,
+    wheel: Wheel,
+    mouse: Mouse,
+    resize: proto.Size,
+    selection: SelectionRequest,
+    end: struct { request: u64, force: bool = false },
+    detach,
+    quit,
+};
+pub const Wheel = struct {
+    notches: i32,
+    col: u16,
+    row: u16,
+    pixel_x: u32,
+    pixel_y: u32,
+    mods: client.keymap.Mods = .{},
+};
+/// A GUI gesture belongs to the modes and wire admitted at its press.
+pub const MouseToken = struct { generation: u64, modes: proto.TermModes };
+pub const Mouse = struct {
+    token: MouseToken,
+    kind: enum { press, motion, release },
+    button: u8 = 0,
+    col: u16,
+    row: u16,
+    pixel_x: u32,
+    pixel_y: u32,
+    mods: client.keymap.Mods = .{},
+};
+fn mouseFormat(modes: proto.TermModes) client.keymap.MouseFormat {
+    return if (modes.mouse_sgr_pixels) .sgr_pixels else if (modes.mouse_sgr) .sgr else if (modes.mouse_urxvt) .urxvt else if (modes.mouse_utf8) .utf8 else .x10;
+}
+const HistoryRequest = struct {
+    start: u32,
+    size: proto.Size,
+    revision: u64,
+    until: i64,
+};
+pub const SelectionResult = struct { id: u32, gesture: u32 = 0, status: proto.SelectionStatus, text: []u8, version: SelectionVersion };
+pub const FollowPosition = struct {
+    id: u32,
+    seq: u64,
+    source: u64,
+    history_rows: u32,
+    status: proto.SelectionStatus,
+    anchor: proto.SelectionPoint,
+    active: proto.SelectionPoint,
+};
+pub const Phase = enum { dialing, attached, reconnecting, exited, refused, taken, failed, dial_failed };
+pub const EndPhase = enum { idle, pending, accepted, refused, unknown };
+pub const EndState = struct {
@@ @@ -44,6 +105,7 @@ pub const Options = struct { @@
+    retry_initial: bool = false,
+    open_timeout_ms: u32 = 15000,
+    end_timeout_ms: u32 = 2000,
+    selection_timeout_ms: u32 = 2000,
+    wake: ?*const fn (?*anyopaque) void = null,
+    wake_ctx: ?*anyopaque = null,
+};
@@ @@ -66,6 +128,30 @@ pub const Pump = struct { @@
+    thread: ?std.Thread = null,
+    admitted: bool = false,
+    end_until: i64 = 0, // guarded by mu with status.ending
+    selection_pending: ?SelectionRequest = null,
+    selection_pending_copy: bool = false,
+    selection_revision: u64 = 0, // mu: connection, geometry and terminal modes
+    selection_ticket: u64 = 0, // mu: queued and sent request cancellation
+    selection_until: i64 = 0,
+    selection_result: ?SelectionResult = null,
+    selection_gesture: u32 = 0,
+    selection_clear: ?u32 = null,
+    follow_position: ?FollowPosition = null,
+    follow_source: u64 = 0,
+    follow_seq: u64 = 0,
+    history_waiting_metadata: bool = false,
+    scroll_rows: u32 = 0, // mu: requested distance from live output
+    history: ?*term.grid.Grid = null,
+    history_start: u32 = 0,
+    history_version: SelectionVersion = .{ .seq = 0, .history_rows = 0, .epoch = 0, .revision = 0 },
+    history_revision: u64 = 0,
+    history_dirty: bool = false,
+    // A cancelled request stays here until its reply is drained. The wire has
+    // no request ID, so replacing it could accept an old same-origin reply.
+    history_pending: ?HistoryRequest = null,
+    mouse_generation: u64 = 0, // mu: wire, geometry and mode cancellation
+    mouse_active: ?Mouse = null, // transport thread only, last transmitted report
+    clipboard: [2]?[]u8 = .{ null, null }, // mu: latest write per desktop target
+    pub fn start(alloc: std.mem.Allocator, opts: Options) !*Pump {
+        if (opts.session.len != 0 and !proto.validSessionName(opts.session)) return error.InvalidSession;
@@ @@ -89,6 +175,17 @@ pub const Pump = struct { @@
+        defer self.mailbox_mu.unlock();
+        if (self.closing.load(.acquire)) return;
+        switch (msg) {
+            .selection => |req| {
+                self.mu.lock();
+                defer self.mu.unlock();
+                self.cancelPendingSelectionLocked();
+                var owned = req;
+                if (owned.gesture == 0) owned.gesture = owned.id;
+                owned.ticket = self.selection_ticket;
+                try self.mailbox.append(self.alloc, .{ .selection = owned });
+                self.selection_pending = owned;
+                self.selection_until = std.time.milliTimestamp() + self.opts.selection_timeout_ms;
+            },
+            .end => |req| {
+                self.mu.lock();
+                defer self.mu.unlock();
@@ @@ -125,6 +222,9 @@ pub const Pump = struct { @@
+        self.say(.quit) catch unreachable;
+        if (self.thread) |thread| thread.join();
+        for (self.mailbox.items) |msg| if (msg == .input) self.alloc.free(msg.input);
+        if (self.selection_result) |result| self.alloc.free(result.text);
+        if (self.history) |g| g.deinit();
+        for (self.clipboard) |text| if (text) |t| self.alloc.free(t);
+        self.mailbox.deinit(self.alloc);
+        closePipe(self.wake_pipe);
+        closePipe(self.cancel_pipe);
@@ @@ -132,6 +232,209 @@ pub const Pump = struct { @@
+        self.alloc.destroy(self);
+    pub fn mouseToken(self: *Pump) ?MouseToken {
+        self.mu.lock();
+        defer self.mu.unlock();
+        if (!self.admitted or self.status.phase != .attached or self.closing.load(.acquire)) return null;
+        return .{ .generation = self.mouse_generation, .modes = self.core.terminal_modes };
+    }
+    pub fn mouseFresh(self: *Pump, token: MouseToken) bool {
+        const current = self.mouseToken() orelse return false;
+        return current.generation == token.generation;
+    }
+    /// Cancellation cannot allocate or wait for a GUI-thread transport write.
+    pub fn cancelMouse(self: *Pump, token: MouseToken) void {
+        self.mu.lock();
+        if (self.mouse_generation == token.generation) self.mouse_generation +%= 1;
+        self.mu.unlock();
+        ring(self.wake_pipe[1], 1);
+    }
+    pub fn takeClipboard(self: *Pump, primary: bool) ?[]u8 {
+        self.mu.lock();
+        defer self.mu.unlock();
+        const index: usize = @intFromBool(primary);
+        const text = self.clipboard[index];
+        self.clipboard[index] = null;
+        return text;
+    }
+    fn clearClipboardLocked(self: *Pump) void {
+        for (&self.clipboard) |*text| {
+            if (text.*) |t| self.alloc.free(t);
+            text.* = null;
+        }
+    }
+    /// Caller holds mu while copying both this version and the displayed grid.
+    pub fn selectionVersionLocked(self: *const Pump) SelectionVersion {
+        if (self.history != null) return self.history_version;
+        return .{ .seq = self.replica.last_seq, .source = if (self.follow_seq == self.replica.last_seq) self.follow_source else 0, .history_rows = self.replica.history_rows, .epoch = self.replica.session_epoch, .revision = self.selection_revision };
+    }
+    pub fn viewGridLocked(self: *const Pump) *const term.grid.Grid {
+        return self.history orelse self.grid;
+    }
+    pub fn viewOriginLocked(self: *const Pump) u32 {
+        return if (self.history != null) self.history_start else self.replica.history_rows;
+    }
+    pub fn followPositionLocked(self: *const Pump) ?FollowPosition {
+        const position = self.follow_position orelse return null;
+        if (position.id != self.selection_gesture or position.status != .ok or position.seq != self.replica.last_seq) return null;
+        if (self.history != null and (self.history_version.seq != position.seq or
+            self.history_version.source != position.source)) return null;
+        return position;
+    }
+    fn selectionFreshLocked(self: *const Pump, version: SelectionVersion) bool {
+        return self.selectionAliveLocked(version) and
+            version.history_rows == self.replica.history_rows and
+            version.source != 0 and version.source == self.follow_source and
+            (!version.history or version.seq == self.replica.last_seq);
+    }
+    fn selectionAliveLocked(self: *const Pump, version: SelectionVersion) bool {
+        return !self.closing.load(.acquire) and self.status.phase == .attached and
+            self.replica.state_since_attach and version.epoch == self.replica.session_epoch and
+            version.revision == self.selection_revision;
+    }
+    fn returnLiveLocked(self: *Pump) void {
+        if (self.scroll_rows == 0 and self.history == null and !self.history_dirty) return;
+        self.scroll_rows = 0;
+        self.history_dirty = false;
+        self.history_revision +%= 1;
+        if (self.history) |g| g.deinit();
+        self.history = null;
+        self.history_waiting_metadata = false;
+    }
+    fn requestHistory(self: *Pump, wire: *Wire) !void {
+        self.mu.lock();
+        const pending = self.history_pending;
+        if (pending) |p| {
+            self.mu.unlock();
+            // Reconnect rather than reusing an uncorrelated stream after timeout.
+            if (std.time.milliTimestamp() >= p.until) return error.ConnectionTimedOut;
+            return;
+        }
+        if (!self.history_dirty or self.scroll_rows == 0 or !self.admitted) {
+            self.mu.unlock();
+            return;
+        }
+        const req: HistoryRequest = .{ .start = self.replica.scrollStart(self.scroll_rows), .size = .{ .cols = self.opts.cols, .rows = self.opts.rows }, .revision = self.history_revision, .until = std.time.milliTimestamp() + 2000 };
+        self.history_pending = req;
+        self.history_dirty = false;
+        self.mu.unlock();
+        const bytes = proto.encodeScrollbackReq(req.start, req.size.rows);
+        try wire.send(.fetch_scrollback, &bytes);
+    }
+    fn historyReplyLocked(self: *Pump, payload: []const u8) !Action {
+        const req = self.history_pending orelse return .skip;
+        self.history_pending = null;
+        if (req.revision != self.history_revision or self.scroll_rows == 0) return .skip;
+        if (payload.len < 6) return error.BadPayload;
+        const origin = std.mem.readInt(u32, payload[0..4], .little);
+        const count = std.mem.readInt(u16, payload[4..6], .little);
+        if (count > req.size.rows or origin > self.replica.history_rows) return error.BadPayload;
+        const view = try term.grid.Grid.init(self.alloc, req.size.cols, req.size.rows);
+        errdefer view.deinit();
+        var bytes = payload[6..];
+        for (view.lines[0..count]) |*row| bytes = try term.grid.decodeRow(self.alloc, row, bytes, req.size.cols);
+        if (bytes.len != 0) return error.BadPayload;
+        view.cursor = .{ .x = req.size.cols, .y = req.size.rows };
+        if (self.history) |old| old.deinit();
+        self.history = view;
+        self.history_start = origin;
+        self.history_version = .{ .seq = self.replica.last_seq, .history_rows = self.replica.history_rows, .epoch = self.replica.session_epoch, .revision = self.selection_revision, .history = true };
+        self.history_waiting_metadata = true;
+        return .changed;
+    }
+    pub fn selectionFresh(self: *Pump, version: SelectionVersion) bool {
+        self.mu.lock();
+        defer self.mu.unlock();
+        return self.selectionFreshLocked(version);
+    }
+    pub fn selectionAlive(self: *Pump, gesture: u32, version: SelectionVersion) bool {
+        self.mu.lock();
+        defer self.mu.unlock();
+        if (!self.selectionAliveLocked(version)) return false;
+        if (self.selection_pending) |pending| {
+            if ((if (pending.gesture == 0) pending.id else pending.gesture) == gesture) return true;
+        }
+        if (self.selection_result) |result| if (result.gesture == gesture) return true;
+        if (self.follow_position) |position| {
+            if (self.selection_gesture == gesture and position.id == gesture and position.status == .ok) return true;
+        }
+        return false;
+    }
+    /// Validate again under the same lock that transfers ownership. A newer
+    /// frame after reply decoding must not leave an old copy ready for the UI.
+    pub fn takeSelection(self: *Pump) ?SelectionResult {
+        self.mu.lock();
+        defer self.mu.unlock();
+        const result = self.selection_result orelse return null;
+        self.selection_result = null;
+        if (!self.selectionAliveLocked(result.version)) {
+            self.alloc.free(result.text);
+            return null;
+        }
+        return result;
+    }
+    fn invalidateSelectionLocked(self: *Pump) void {
+        if (self.selection_gesture != 0) self.selection_clear = self.selection_gesture;
+        self.selection_gesture = 0;
+        self.follow_position = null;
+        self.cancelPendingSelectionLocked();
+    }
+    fn cancelPendingSelectionLocked(self: *Pump) void {
+        self.selection_ticket +%= 1;
+        self.selection_pending = null;
+        self.selection_pending_copy = false;
+        self.selection_until = 0;
+        self.core.pending_selection_id = null;
+        if (self.selection_result) |result| self.alloc.free(result.text);
+        self.selection_result = null;
+    }
+    pub fn cancelSelection(self: *Pump) void {
+        self.mu.lock();
+        self.invalidateSelectionLocked();
+        self.mu.unlock();
+        ring(self.wake_pipe[1], 1);
+    }
+    fn flushSelectionClear(self: *Pump, wire: *Wire) !void {
+        self.mu.lock();
+        const gesture = self.selection_clear;
+        self.selection_clear = null;
+        self.mu.unlock();
+        if (gesture) |id| {
+            const clear = proto.encodeSelectionReq(.{
+                .action = .clear,
+                .id = 0,
+                .gesture = id,
+                .epoch = 0,
+                .source = 0,
+                .anchor = .{ .row = 0, .col = 0 },
+                .active = .{ .row = 0, .col = 0 },
+            });
+            try wire.send(.selection_req, &clear);
+        }
+    }
+    fn beginSelectionLocked(self: *Pump, req: SelectionRequest) ?[proto.selection_req_len]u8 {
+        const gesture = if (req.gesture == 0) req.id else req.gesture;
+        const action: @FieldType(proto.SelectionReq, "action") =
+            if (self.selection_gesture == gesture) .copy else .start;
+        if (req.ticket != self.selection_ticket or
+            (if (action == .copy) !self.selectionAliveLocked(req.version) else !self.selectionFreshLocked(req.version))) return null;
+        self.selection_gesture = gesture;
+        if (action == .start) self.follow_position = null;
+        self.selection_pending = req;
+        self.selection_pending_copy = action == .copy;
+        self.selection_until = std.time.milliTimestamp() + self.opts.selection_timeout_ms;
+        return proto.encodeSelectionReq(.{
+            .action = action,
+            .id = req.id,
+            .gesture = gesture,
+            .epoch = req.version.epoch,
+            .source = req.version.source,
+            .anchor = req.anchor,
+            .active = req.active,
+        });
+    }
+    fn wake(self: *Pump) void {
+        if (self.opts.wake) |f| f(self.opts.wake_ctx);
@@ @@ -144,6 +447,12 @@ pub const Pump = struct { @@
+    fn setState(self: *Pump, phase: Phase, code: u8, reason: []const u8) void {
+        if (phase != .attached) {
+            self.mouse_generation +%= 1;
+            self.clearClipboardLocked();
+            self.invalidateSelectionLocked();
+            self.returnLiveLocked();
+        }
+        self.status.phase = phase;
+        self.status.exit_code = code;
+        self.status.reason_len = @min(reason.len, self.status.reason.len);
@@ @@ -171,6 +480,7 @@ pub const Pump = struct { @@
+        while (!self.closing.load(.acquire)) {
+            var dial: client.handoff.Dial = .{};
+            self.expireEnd();
+            self.expireSelection();
+            var tr = client.Transport.openUntil(self.alloc, self.opts.target, null, self.cancel_pipe[0], &dial, std.time.milliTimestamp() + self.opts.open_timeout_ms) catch |err| {
+                if (self.closing.load(.acquire)) return;
+                var buf: [1024]u8 = undefined;
@@ @@ -205,58 +515,280 @@ pub const Pump = struct { @@
+    fn attach(self: *Pump, wire: *Wire, fresh: bool) !void {
+        if (fresh) try self.releaseMouse(wire) else self.mouse_active = null;
+        self.mu.lock();
+        self.mouse_generation +%= 1;
+        self.clearClipboardLocked();
+        self.invalidateSelectionLocked();
+        self.selection_revision +%= 1;
+        self.follow_position = null;
+        self.follow_source = 0;
+        self.follow_seq = 0;
+        self.history_waiting_metadata = false;
+        self.selection_gesture = 0;
+        self.selection_clear = null;
+        self.returnLiveLocked();
+        if (!fresh) self.history_pending = null;
+        const args = self.replica.attachArgs();
+        self.replica.state_since_attach = false;
+        self.admitted = false;
+        self.mu.unlock();
+        var buf: [proto.attach_max_len]u8 = undefined;
+        try wire.send(.attach, proto.encodeAttachNamed(&buf, if (self.opts.existing_only) 0 else self.opts.cols, if (self.opts.existing_only) 0 else self.opts.rows, if (fresh) 0 else args.have_seq, if (fresh) 0 else args.have_epoch, proto.wireName(self.opts.session)));
+    fn mail(self: *Pump, wire: *Wire, allow_wheel: bool) !void {
+        drain(self.wake_pipe[0]);
+        self.mailbox_mu.lock();
+        var messages = self.mailbox;
+        self.mailbox = .empty;
+        self.mailbox_mu.unlock();
+        var consumed = messages.items.len;
+        defer {
+            for (messages.items[0..consumed]) |msg| if (msg == .input) self.alloc.free(msg.input);
+            messages.deinit(self.alloc);
+        try self.flushSelectionClear(wire);
+        for (messages.items, 0..) |msg, i| {
+            if (msg == .wheel and !allow_wheel) {
+                // Keep the wheel and following input ordered, while allowing
+                // earlier resize/key/end work between bounded receive batches.
+                self.mailbox_mu.lock();
+                defer self.mailbox_mu.unlock();
+                try self.mailbox.insertSlice(self.alloc, 0, messages.items[i..]);
+                consumed = i;
+                ring(self.wake_pipe[1], 1);
+                break;
+            }
+            switch (msg) {
+                .end => |req| {
+                    self.expireEnd();
+                    self.mu.lock();
+                    const pending = self.status.ending.request == req.request and self.status.ending.phase == .pending;
+                    self.mu.unlock();
+                    if (!pending) continue;
+                    self.mu.lock();
+                    const admitted = self.admitted;
+                    self.mu.unlock();
+                    if (!admitted) {
+                        self.finishPendingEnd("Attachment changed before End; retry to check the session");
+                        continue;
+                    }
+                    var buf: [proto.end_req_max_len]u8 = undefined;
+                    try wire.send(.end_req, proto.encodeEndReq(&buf, req.force, self.opts.session));
+                },
+                .input => |bytes| {
+                    self.mu.lock();
+                    const scrolled = self.scroll_rows != 0;
+                    self.selection_revision +%= 1;
+                    self.invalidateSelectionLocked();
+                    self.returnLiveLocked();
+                    self.mu.unlock();
+                    if (scrolled) self.wake();
+                    try wire.send(.input, bytes);
+                },
+                .wheel => |wheel| try self.routeWheel(wire, wheel),
+                .mouse => |mouse| try self.routeMouse(wire, mouse),
+                .selection => |req| {
+                    self.mu.lock();
+                    const payload = self.beginSelectionLocked(req);
+                    self.mu.unlock();
+                    if (payload) |bytes| try wire.send(.selection_req, &bytes);
+                },
+                .resize => |size| {
+                    try self.releaseMouse(wire);
+                    self.mu.lock();
+                    self.mouse_generation +%= 1;
+                    self.invalidateSelectionLocked();
+                    self.selection_revision +%= 1;
+                    self.returnLiveLocked();
+                    self.mu.unlock();
+                    self.opts.cols = size.cols;
+                    self.opts.rows = size.rows;
+                    self.mu.lock();
+                    const admitted = self.admitted;
+                    self.mu.unlock();
+                    if (!self.opts.existing_only or admitted) {
+                        const buf = proto.encodeSize(size.cols, size.rows);
+                        try wire.send(.resize, &buf);
+                    }
+                },
+                .quit, .detach => unreachable,
+            }
+        }
+        // Input/resize can retire a tracker while this batch is being sent.
+        // Flush after the batch as well so a quiet connection still receives
+        // the bounded clear request.
+        try self.flushSelectionClear(wire);
+    }
+    fn writeMouse(wire: *Wire, event: Mouse) !bool {
+        const modes = event.token.modes;
+        if (event.kind == .release and modes.mouse_x10 and !modes.mouse_normal and !modes.mouse_button and !modes.mouse_any) return false;
+        var seq: [client.keymap.mouse_max_seq_len]u8 = undefined;
+        const bytes = client.keymap.encodeMouse(mouseFormat(modes), event.button + @as(u8, if (event.kind == .motion) 32 else 0), event.kind == .release, event.col, event.row, event.pixel_x, event.pixel_y, event.mods, &seq);
+        if (bytes.len == 0) return false;
+        try wire.send(.input, bytes);
+        return true;
+    }
+    fn releaseMouse(self: *Pump, wire: *Wire) !void {
+        var event = self.mouse_active orelse return;
+        self.mouse_active = null;
+        event.kind = .release;
+        _ = try writeMouse(wire, event);
+    }
+    fn reconcileMouse(self: *Pump, wire: *Wire) !void {
+        if (self.mouse_active) |active| {
+            if (!self.mouseFresh(active.token) or self.closing.load(.acquire)) try self.releaseMouse(wire);
+        }
+    }
+    fn routeMouse(self: *Pump, wire: *Wire, event: Mouse) !void {
+        try self.reconcileMouse(wire);
+        if (!self.mouseFresh(event.token) or !event.token.modes.appMouse() or event.button > 3) return;
+        switch (event.kind) {
+            .press => {
+                if (event.button == 3) return;
+                try self.releaseMouse(wire);
+                self.mu.lock();
+                self.returnLiveLocked();
+                self.invalidateSelectionLocked();
+                self.selection_revision +%= 1;
+                self.mu.unlock();
+                if (try writeMouse(wire, event)) self.mouse_active = event;
+                self.wake();
+            },
+            .motion => {
+                const modes = event.token.modes;
+                if (self.mouse_active) |active| {
+                    if (active.button != event.button or (!modes.mouse_any and !modes.mouse_button)) return;
+                    const same = if (modes.mouse_sgr_pixels) active.pixel_x == event.pixel_x and active.pixel_y == event.pixel_y else active.col == event.col and active.row == event.row;
+                    if (same) return;
+                    if (try writeMouse(wire, event)) self.mouse_active = event;
+                } else if (event.button == 3 and modes.mouse_any) {
+                    _ = try writeMouse(wire, event);
+            },
+            .release => {
+                const active = self.mouse_active orelse return;
+                if (event.button != active.button) return;
+                // If a legacy release is outside its encoding range, release
+                // at the last representable point instead of leaving it held.
+                if (!try writeMouse(wire, event)) try self.releaseMouse(wire);
+                self.mouse_active = null;
+            },
+        }
+    }
+    fn routeWheel(self: *Pump, wire: *Wire, wheel: Wheel) !void {
+        self.mu.lock();
+        if (!self.admitted or self.status.phase != .attached or wheel.notches == 0) {
+            self.mu.unlock();
+            return;
+        }
+        const modes = self.core.terminal_modes;
+        const arrows = modes.alt_screen and self.scroll_rows == 0;
+        if (!modes.appMouse() and !arrows) {
+            const rows: u32 = @intCast(@min(@as(u64, @abs(wheel.notches)) * 3, std.math.maxInt(u32)));
+            const next = if (wheel.notches > 0) @min(self.scroll_rows +| rows, self.replica.history_rows) else self.scroll_rows -| rows;
+            if (next != self.scroll_rows) {
+                if (next == 0) self.returnLiveLocked() else {
+                    self.scroll_rows = next;
+                    self.history_revision +%= 1;
+                    self.history_dirty = true;
+                }
+            }
+            self.mu.unlock();
+            self.wake();
+            return;
+        }
+        self.returnLiveLocked();
+        self.invalidateSelectionLocked();
+        self.selection_revision +%= 1;
+        self.mu.unlock();
+        self.wake();
+        var seq: [client.keymap.mouse_max_seq_len]u8 = undefined;
+        const bytes = if (modes.appMouse()) client.keymap.encodeWheel(
+            mouseFormat(modes),
+            wheel.notches > 0,
+            wheel.col,
+            wheel.row,
+            wheel.pixel_x,
+            wheel.pixel_y,
+            wheel.mods,
+            &seq,
+        ) else client.keymap.encodeWheelArrow(wheel.notches > 0, modes.cursor_keys, &seq);
+        if (bytes.len == 0) return;
+        // Bound a single mailbox event even if an input adapter supplies an
+        // extreme delta. Ordinary wheels are one or a few notches per event.
+        var left: u32 = @as(u32, @intCast(@min(@abs(wheel.notches), 1024))) * @as(u32, if (modes.appMouse()) 1 else 3);
+        var batch: [1024]u8 = undefined;
+        while (left != 0) {
+            const n = @min(left, batch.len / bytes.len);
+            for (0..n) |i| @memcpy(batch[i * bytes.len ..][0..bytes.len], bytes);
+            try wire.send(.input, batch[0 .. n * bytes.len]);
+            left -= @intCast(n);
+        }
+    }
+    /// Drain ready stream bytes before interpreting semantic mouse intent.
+    /// A partial header is progress, not proof that the next mode frame is absent.
+    const ReadState = enum { idle, busy, closed, ended };
+    fn receiveReady(self: *Pump, wire: *Wire) !ReadState {
+        var changed = false;
+        defer if (changed) self.wake();
+        var frames: usize = 0;
+        for (0..256) |_| {
+            var fd = [_]std.posix.pollfd{.{ .fd = wire.tr.pollFd(), .events = std.posix.POLL.IN, .revents = 0 }};
+            _ = try std.posix.poll(&fd, 0);
+            if (fd[0].revents == 0 and wire.tr.link != .quic) return .idle;
+            const before = wire.input.items.len;
+            switch (try wire.read()) {
+                .closed => return .closed,
+                .incomplete => if (wire.input.items.len == before) return .idle,
+                .frame => |frame| {
+                    defer frame.deinit(self.alloc);
+                    const action = try self.onFrame(frame.type, frame.payload);
+                    var admitted_now = false;
+                    self.mu.lock();
+                    if (!self.admitted and (frame.type == .snapshot or frame.type == .delta) and action == .changed) {
+                        self.admitted = true;
+                        admitted_now = true;
+                    }
+                    self.mu.unlock();
+                    if (admitted_now and self.opts.existing_only) {
+                        const size = proto.encodeSize(self.opts.cols, self.opts.rows);
+                        try wire.send(.resize, &size);
+                    }
+                    changed = changed or action != .skip;
+                    switch (action) {
+                        .resync => try self.attach(wire, true),
+                        .end => return .ended,
+                        else => {},
+                    }
+                    frames += 1;
+                    if (frames == 64) return .busy;
+                },
+            }
+        }
+        return .busy;
+    fn connected(self: *Pump, wire: *Wire) !bool {
+        try self.attach(wire, false);
+        while (true) {
+            self.expireEnd();
+            self.expireSelection();
+            wire.tr.service();
+            var busy = false;
+            if (!self.closing.load(.acquire)) switch (try self.receiveReady(wire)) {
+                .closed => return false,
+                .ended => return true,
+                .busy => busy = true,
+                .idle => {},
+            };
+            try self.reconcileMouse(wire);
+            try self.mail(wire, !busy);
+            try self.requestHistory(wire);
+            if (self.closing.load(.acquire)) {
+                try wire.send(.detach, "");
+                // A responsive peer receives detach; a stalled peer cannot
@@ @@ -276,41 +808,10 @@ pub const Pump = struct { @@
+                .{ .fd = wire.tr.errFd() orelse -1, .events = std.posix.POLL.IN, .revents = 0 },
+                .{ .fd = if (wire.tr.link != .quic and wire.pending()) wire.writeFd() else -1, .events = std.posix.POLL.OUT, .revents = 0 },
+            };
+            _ = try std.posix.poll(&fds, self.endWaitMs(wire.tr.timeoutMs(if (busy) 0 else 1000)));
+            wire.tr.service();
+            if (fds[2].revents != 0) wire.tr.drainErr();
+            if (fds[3].revents != 0) try wire.flush();
@@ @@ -318,7 +819,9 @@ pub const Pump = struct { @@
+    fn onFrame(self: *Pump, kind: proto.MsgType, payload: []const u8) !Action {
+        self.mu.lock();
+        defer self.mu.unlock();
+        if (kind != .selection_reply) self.history_waiting_metadata = false;
+        switch (kind) {
+            .scrollback_chunk => return self.historyReplyLocked(payload),
+            .end_reply => {
+                if (self.status.ending.phase != .pending) return .skip;
+                if (proto.parseEndReply(payload)) |reply| {
@@ @@ -328,11 +831,31 @@ pub const Pump = struct { @@
+            },
+            .snapshot, .delta => {
+                const begin = std.time.nanoTimestamp();
+                const old_epoch = self.replica.session_epoch;
+                const old_cols = self.grid.cols;
+                const old_rows = self.grid.rows;
+                const applied = self.replica.apply(kind, payload) catch |err| switch (err) {
+                    error.BadPayload => return .skip,
+                    else => return err,
+                };
+                self.last_apply_us = @intCast(@min(std.math.maxInt(u32), @max(0, @divTrunc(std.time.nanoTimestamp() - begin, 1000))));
+                // Output and scrollback growth preserve a tracked source. Only
+                // a resync, session epoch, or geometry change invalidates its
+                // coordinates; the follow-state reply remaps ordinary output.
+                if (applied == .resync or self.replica.session_epoch != old_epoch or
+                    self.grid.cols != old_cols or self.grid.rows != old_rows)
+                {
+                    self.selection_revision +%= 1;
+                    self.invalidateSelectionLocked();
+                }
+                if (self.replica.session_epoch != old_epoch or self.grid.cols != old_cols or self.grid.rows != old_rows) self.mouse_generation +%= 1;
+                if (self.replica.session_epoch != old_epoch) self.returnLiveLocked();
+                if (self.scroll_rows != 0) {
+                    self.scroll_rows = @min(self.scroll_rows, self.replica.history_rows);
+                    self.history_revision +%= 1;
+                    self.history_dirty = self.scroll_rows != 0;
+                    if (self.scroll_rows == 0) self.returnLiveLocked();
+                }
+                if (applied == .resync) return .resync;
+                if (kind == .snapshot) self.snapshot_ready = true;
+                self.setState(.attached, 0, "");
@@ @@ -347,12 +870,84 @@ pub const Pump = struct { @@
+                self.setState(.taken, 0, "session taken over");
+                return .end;
+            },
+            .selection_reply => {
+                const reply = proto.decodeSelectionReply(payload) catch return .skip;
+                if (reply.seq == self.replica.last_seq) {
+                    self.follow_seq = reply.seq;
+                    self.follow_source = reply.source;
+                    // The server emits this position metadata immediately after
+                    // a history chunk. Bind that chunk to the source that was
+                    // actually rendered; never borrow a later live source.
+                    if (self.history != null and self.history_waiting_metadata and reply.id == 0) {
+                        self.history_version.source = reply.source;
+                        self.history_version.seq = reply.seq;
+                        self.history_version.history_rows = reply.history_rows;
+                        self.history_waiting_metadata = false;
+                    }
+                    if (reply.gesture != 0) {
+                        const matches = self.selection_gesture == reply.gesture;
+                        if (matches) self.follow_position = .{
+                            .id = reply.gesture,
+                            .seq = reply.seq,
+                            .source = reply.source,
+                            .history_rows = reply.history_rows,
+                            .status = if (reply.status == .too_large) .ok else reply.status,
+                            .anchor = reply.anchor,
+                            .active = reply.active,
+                        };
+                    } else if (self.selection_gesture != 0) {
+                        // A zero-gesture state is the daemon's explicit
+                        // tracker retirement (metadata before a gesture has
+                        // no tracker to retire).
+                        self.follow_position = null;
+                    }
+                }
+                const pending = self.selection_pending orelse return .changed;
+                const gesture = if (pending.gesture == 0) pending.id else pending.gesture;
+                if (reply.id != pending.id or reply.gesture != gesture) return .changed;
+                const pending_alive = if (self.selection_pending_copy)
+                    self.selectionAliveLocked(pending.version)
+                else
+                    self.selectionFreshLocked(pending.version);
+                if (!pending_alive or reply.seq != self.replica.last_seq or
+                    (!self.selection_pending_copy and pending.version.source != reply.source))
+                {
+                    self.selection_pending = null;
+                    return .changed;
+                }
+                const text = try self.alloc.dupe(u8, reply.text);
+                self.selection_pending = null;
+                if (self.selection_result) |old| self.alloc.free(old.text);
+                self.selection_result = .{ .id = reply.id, .gesture = gesture, .status = reply.status, .text = text, .version = pending.version };
+                return .changed;
+            },
+            else => switch (self.core.receive(kind, payload)) {
+                .effect => |effect| switch (effect) {
+                    .bell => self.status.bell = true,
+                    .clipboard_set => |clip| {
+                        const decoded = client.core.decodeClipboard(self.alloc, clip.target, clip.base64) catch |err| switch (err) {
+                            error.InvalidClipboard => return .skip,
+                            else => return err,
+                        } orelse return .skip;
+                        if (!self.admitted or self.status.phase != .attached) {
+                            self.alloc.free(decoded.text);
+                            return .skip;
+                        }
+                        const index: usize = @intFromBool(decoded.primary);
+                        if (self.clipboard[index]) |old| self.alloc.free(old);
+                        self.clipboard[index] = decoded.text;
+                    },
+                },
+                .state => {
+                    self.mouse_generation +%= 1;
+                    self.invalidateSelectionLocked();
+                    self.selection_revision +%= 1;
+                    if (self.scroll_rows != 0) {
+                        self.history_revision +%= 1;
+                        self.history_dirty = true;
+                    }
+                    return .changed;
+                },
+                else => return .skip,
+            },
@@ @@ -371,11 +966,27 @@ pub const Pump = struct { @@
+        self.mu.unlock();
+        if (expired) self.wake();
+    fn expireSelection(self: *Pump) void {
+        self.mu.lock();
+        const expired = self.selection_pending != null and std.time.milliTimestamp() >= self.selection_until;
+        if (expired) {
+            const pending = self.selection_pending.?;
+            self.invalidateSelectionLocked();
+            self.selection_result = .{ .id = pending.id, .gesture = if (pending.gesture == 0) pending.id else pending.gesture, .status = .unavailable, .text = &.{}, .version = pending.version };
+        }
+        self.mu.unlock();
+        if (expired) self.wake();
+    }
+    fn endWaitMs(self: *Pump, cap: i32) i32 {
+        self.mu.lock();
+        defer self.mu.unlock();
+        const now = std.time.milliTimestamp();
+        var wait: i64 = cap;
+        if (self.status.ending.phase == .pending) wait = @min(wait, @max(0, self.end_until - now));
+        if (self.selection_pending != null) wait = @min(wait, @max(0, self.selection_until - now));
+        if (self.history_pending) |req| wait = @min(wait, @max(0, req.until - now));
+        return @intCast(wait);
+    fn finishPendingEnd(self: *Pump, reason: []const u8) void {
+        self.mu.lock();
+    defer a.free(runs);
+    try std.testing.expectEqual(@as(usize, 2), runs.len);
+// Exercise the production mailbox admission and frame decoder synchronously;
+// these tests own actual pipes/grid memory but need no transport peer or GUI.
+fn selectionTestPump() !*Pump {
+    const a = std.testing.allocator;
+    const g = try term.grid.Grid.init(a, 11, 3);
+    errdefer g.deinit();
+    const wp = try std.posix.pipe2(.{ .NONBLOCK = true, .CLOEXEC = true });
+    errdefer closePipe(wp);
+    const cp = try std.posix.pipe2(.{ .NONBLOCK = true, .CLOEXEC = true });
+    errdefer closePipe(cp);
+    const p = try a.create(Pump);
+    p.* = .{ .alloc = a, .opts = .{ .target = .{ .sock = "unused" }, .cols = 11, .rows = 3 }, .grid = g, .replica = .init(a, g), .wake_pipe = wp, .cancel_pipe = cp };
+    _ = try p.onFrame(.snapshot, &testSnapshot());
+    // The unified native path requires a nonzero follow source. Tests model
+    // the metadata frame that the daemon sends after the initial snapshot.
+    p.follow_seq = p.replica.last_seq;
+    p.follow_source = 1;
+    return p;
+}
+fn selectionTestQueue(p: *Pump, id: u32) !SelectionRequest {
+    p.mu.lock();
+    const version = p.selectionVersionLocked();
+    p.mu.unlock();
+    try p.say(.{ .selection = .{ .id = id, .anchor = .{ .row = 0, .col = 0 }, .active = .{ .row = 1, .col = 3 }, .version = version } });
+    return p.mailbox.items[p.mailbox.items.len - 1].selection;
+}
+fn selectionTestBegin(p: *Pump, req: SelectionRequest) ?[proto.selection_req_len]u8 {
+    p.mu.lock();
+    defer p.mu.unlock();
+    return p.beginSelectionLocked(req);
+}
+fn selectionTestReply(p: *Pump, id: u32, text: []const u8) !void {
+    var payload: std.ArrayList(u8) = .empty;
+    defer payload.deinit(std.testing.allocator);
+    p.mu.lock();
+    const history_rows = p.replica.history_rows;
+    const gesture = if (p.selection_pending) |pending| if (pending.gesture == 0) pending.id else pending.gesture else id;
+    p.mu.unlock();
+    try proto.encodeSelectionReply(&payload, std.testing.allocator, .{ .id = id, .gesture = gesture, .seq = p.replica.last_seq, .source = p.follow_source, .history_rows = history_rows, .status = .ok, .text = text });
+    _ = try p.onFrame(.selection_reply, payload.items);
+    @memset(payload.items, 0xaa); // The published result must own its text.
+}
+fn selectionTestFollowMetadata(p: *Pump, source: u64) !void {
+    var payload: std.ArrayList(u8) = .empty;
+    defer payload.deinit(std.testing.allocator);
+    try proto.encodeSelectionReply(&payload, std.testing.allocator, .{
+        .id = 0,
+        .gesture = 0,
+        .seq = p.replica.last_seq,
+        .source = source,
+        .history_rows = p.replica.history_rows,
+        .status = .ok,
+        .text = "",
+    });
+    _ = try p.onFrame(.selection_reply, payload.items);
+}
+test "follow selection sends a source-bound start then a gesture-bound copy" {
+    const p = try selectionTestPump();
+    defer p.stop();
+    p.admitted = true;
+    p.follow_seq = p.replica.last_seq;
+    p.follow_source = 91;
+    const version = p.selectionVersionLocked();
+    const first: SelectionRequest = .{
+        .id = 7,
+        .gesture = 42,
+        .anchor = .{ .row = 0, .col = 0 },
+        .active = .{ .row = 1, .col = 3 },
+        .version = version,
+        .ticket = p.selection_ticket,
+    };
+    const start = p.beginSelectionLocked(first).?;
+    const start_req = try proto.decodeSelectionReq(&start);
+    try std.testing.expectEqual(.start, start_req.action);
+    try std.testing.expectEqual(@as(u32, 7), start_req.id);
+    try std.testing.expectEqual(@as(u32, 42), start_req.gesture);
+    try std.testing.expectEqual(@as(u64, 91), start_req.source);
+    const second = SelectionRequest{ .id = 8, .gesture = 42, .anchor = first.anchor, .active = first.active, .version = version, .ticket = p.selection_ticket };
+    const copy = p.beginSelectionLocked(second).?;
+    const copy_req = try proto.decodeSelectionReq(&copy);
+    try std.testing.expectEqual(.copy, copy_req.action);
+    try std.testing.expectEqual(@as(u32, 8), copy_req.id);
+    try std.testing.expectEqual(@as(u32, 42), copy_req.gesture);
+}
+test "selection cancels queued work but retains live requests through redraw" {
+    const p = try selectionTestPump();
+    defer p.stop();
+    const cancelled = try selectionTestQueue(p, 1);
+    p.cancelSelection();
+    try std.testing.expect(selectionTestBegin(p, cancelled) == null);
+    const before_redraw = try selectionTestQueue(p, 2);
+    var newer = testSnapshot();
+    std.mem.writeInt(u64, newer[0..8], 38, .little);
+    _ = try p.onFrame(.snapshot, &newer);
+    p.follow_seq = p.replica.last_seq;
+    p.follow_source = 1;
+    try std.testing.expect(selectionTestBegin(p, before_redraw) != null);
+    const current = try selectionTestQueue(p, 3);
+    const bytes = selectionTestBegin(p, current).?;
+    const wire = try proto.decodeSelectionReq(&bytes);
+    try std.testing.expectEqual(@as(u32, 3), wire.id);
+    try std.testing.expectEqualDeep(current.active, wire.active);
+}
+test "selection results own UTF-8, newest request wins, and redraw preserves a decoded result" {
+    const p = try selectionTestPump();
+    defer p.stop();
+    _ = selectionTestBegin(p, try selectionTestQueue(p, 1)).?;
+    _ = selectionTestBegin(p, try selectionTestQueue(p, 2)).?;
+    try selectionTestReply(p, 1, "old");
+    try std.testing.expect(p.takeSelection() == null);
+    const text = try std.testing.allocator.alloc(u8, 70 * 1024);
+    defer std.testing.allocator.free(text);
+    @memset(text, 'x'); // Native copy does not inherit the OSC 52 base64 cap.
+    try selectionTestReply(p, 2, text);
+    const copied = p.takeSelection().?;
+    defer std.testing.allocator.free(copied.text);
+    try std.testing.expectEqualStrings(text, copied.text);
+    _ = selectionTestBegin(p, try selectionTestQueue(p, 3)).?;
+    try selectionTestReply(p, 3, "café");
+    var redraw = testSnapshot();
+    std.mem.writeInt(u64, redraw[0..8], 38, .little);
+    _ = try p.onFrame(.snapshot, &redraw);
+    const retained = p.takeSelection().?;
+    defer std.testing.allocator.free(retained.text);
+    try std.testing.expectEqualStrings("café", retained.text);
+}
+test "live selection survives pending redraw; history and geometry remain guarded" {
+    const p = try selectionTestPump();
+    defer p.stop();
+    const req = try selectionTestQueue(p, 1);
+    _ = selectionTestBegin(p, req).?;
+    var newer = testSnapshot();
+    std.mem.writeInt(u64, newer[0..8], 38, .little);
+    _ = try p.onFrame(.snapshot, &newer);
+    p.follow_seq = p.replica.last_seq;
+    p.follow_source = 1;
+    try std.testing.expect(p.selectionFresh(req.version));
+    try selectionTestReply(p, 1, "current text");
+    const result = p.takeSelection().?;
+    defer std.testing.allocator.free(result.text);
+    try std.testing.expectEqualStrings("current text", result.text);
+    try std.testing.expectEqualDeep(req.version, result.version);
+    const before_history = try selectionTestQueue(p, 2);
+    proto.writeSnapshotPrefix(newer[0..proto.snapshot_prefix_len], .{ .seq = 39, .history_rows = 1, .cols = 11, .rows = 3, .epoch = 93 });
+    _ = try p.onFrame(.snapshot, &newer);
+    try std.testing.expect(!p.selectionFresh(before_history.version));
+    try std.testing.expect(selectionTestBegin(p, before_history) == null);
+    const before_resize = try selectionTestQueue(p, 3);
+    // Empty fixture rows also decode at 12 cols.
+    proto.writeSnapshotPrefix(newer[0..proto.snapshot_prefix_len], .{ .seq = 40, .history_rows = 1, .cols = 12, .rows = 3, .epoch = 93 });
+    _ = try p.onFrame(.snapshot, &newer);
+    try std.testing.expect(!p.selectionFresh(before_resize.version));
+    try std.testing.expect(selectionTestBegin(p, before_resize) == null);
+}
+test "selection mode changes, cancellation and timeout discard later replies" {
+    const p = try selectionTestPump();
+    defer p.stop();
+    const req = try selectionTestQueue(p, 1);
+    _ = selectionTestBegin(p, req).?;
+    _ = try p.onFrame(.term_modes, &proto.encodeTermModes(.{ .bracketed_paste = false, .alt_screen = true }));
+    try std.testing.expect(!p.selectionFresh(req.version));
+    try selectionTestReply(p, 1, "wrong screen");
+    try std.testing.expect(p.takeSelection() == null);
+    _ = selectionTestBegin(p, try selectionTestQueue(p, 2)).?;
+    p.cancelSelection();
+    try selectionTestReply(p, 2, "cleared");
+    try std.testing.expect(p.takeSelection() == null);
+    _ = selectionTestBegin(p, try selectionTestQueue(p, 3)).?;
+    p.mu.lock();
+    p.selection_until = 0;
+    p.mu.unlock();
+    p.expireSelection();
+    const expired = p.takeSelection().?;
+    defer std.testing.allocator.free(expired.text);
+    try std.testing.expectEqual(proto.SelectionStatus.unavailable, expired.status);
+    try selectionTestReply(p, 3, "too late");
+    try std.testing.expect(p.takeSelection() == null);
+    try std.testing.expect(p.core.pending_selection_id == null);
+}
+test "wheel history tombstones, refresh, resize and timeout preserve the live replica" {
+    const p = try selectionTestPump();
+    defer p.stop();
+    p.replica.history_rows = 20;
+    p.admitted = true;
+    const incoming = try std.posix.pipe2(.{ .NONBLOCK = true, .CLOEXEC = true });
+    defer closePipe(incoming);
+    const outgoing = try std.posix.pipe2(.{ .NONBLOCK = true, .CLOEXEC = true });
+    defer closePipe(outgoing);
+    var tr: client.Transport = .{ .link = .{ .pipe = .{ .child = std.process.Child.init(&.{"unused"}, std.testing.allocator), .r = incoming[0], .w = outgoing[1] } } };
+    var wire = try Wire.init(std.testing.allocator, &tr);
+    defer wire.deinit();
+    const up: Wheel = .{ .notches = 1, .col = 2, .row = 1, .pixel_x = 22, .pixel_y = 18 };
+    const source_version = p.selectionVersionLocked();
+    try p.routeWheel(&wire, up);
+    try std.testing.expect(p.selectionFresh(source_version));
+    try p.requestHistory(&wire);
+    const first = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer first.deinit(std.testing.allocator);
+    try std.testing.expectEqual(proto.MsgType.fetch_scrollback, first.type);
+    try std.testing.expectEqualDeep(proto.ScrollbackReq{ .start = 17, .count = 3 }, try proto.decodeScrollbackReq(first.payload));
+    const revision = p.history_pending.?.revision;
+    try p.say(.{ .input = "live" });
+    try p.mail(&wire, true);
+    const typed = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer typed.deinit(std.testing.allocator);
+    try std.testing.expectEqualStrings("live", typed.payload);
+    try std.testing.expect(!p.selectionFresh(source_version));
+    try std.testing.expect(p.history_pending != null); // Keep the cancelled on-wire request.
+    const after_input = p.selectionVersionLocked();
+    try p.routeWheel(&wire, up);
+    try p.requestHistory(&wire);
+    try std.testing.expectEqual(revision, p.history_pending.?.revision);
+    const chunk = [_]u8{ 17, 0, 0, 0, 1, 0, 0, 0 }; // one valid blank CellRow
+    try std.testing.expectEqual(Pump.Action.skip, try p.onFrame(.scrollback_chunk, &chunk));
+    try std.testing.expect(p.history == null);
+    try p.requestHistory(&wire);
+    const fresh = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer fresh.deinit(std.testing.allocator);
+    try std.testing.expect(p.history_pending.?.revision != revision);
+    try std.testing.expectEqual(Pump.Action.changed, try p.onFrame(.scrollback_chunk, &chunk));
+    try selectionTestFollowMetadata(p, 1);
+    try std.testing.expectEqual(@as(u32, 17), p.viewOriginLocked());
+    try std.testing.expect(p.viewGridLocked() != p.grid);
+    try std.testing.expectEqual(@as(u16, 3), p.viewGridLocked().cursor.y);
+    try std.testing.expect(p.selectionFresh(after_input));
+    const history_version = p.selectionVersionLocked();
+    _ = selectionTestBegin(p, try selectionTestQueue(p, 41)).?;
+    p.mu.lock();
+    p.returnLiveLocked();
+    p.mu.unlock();
+    try selectionTestReply(p, 41, "kept through viewport");
+    const kept = p.takeSelection().?;
+    defer std.testing.allocator.free(kept.text);
+    try std.testing.expectEqualStrings("kept through viewport", kept.text);
+    try std.testing.expectEqualDeep(history_version, kept.version);
+    try p.routeWheel(&wire, up);
+    try p.requestHistory(&wire);
+    const restored = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer restored.deinit(std.testing.allocator);
+    _ = try p.onFrame(.scrollback_chunk, &chunk);
+    try selectionTestFollowMetadata(p, 1);
+    try std.testing.expect(p.selectionFresh(history_version));
+    const history_request = try selectionTestQueue(p, 42);
+    try std.testing.expect(history_request.version.history);
+    _ = selectionTestBegin(p, history_request).?;
+    p.mu.lock();
+    p.returnLiveLocked();
+    p.mu.unlock();
+    var live_redraw = testSnapshot();
+    proto.writeSnapshotPrefix(live_redraw[0..proto.snapshot_prefix_len], .{ .seq = 38, .history_rows = 20, .cols = 11, .rows = 3, .epoch = 93 });
+    _ = try p.onFrame(.snapshot, &live_redraw);
+    try std.testing.expect(!p.selectionFresh(history_request.version));
+    try selectionTestReply(p, 42, "stale history");
+    try std.testing.expect(p.takeSelection() == null);
+    try p.routeWheel(&wire, up);
+    try p.requestHistory(&wire);
+    const after_live = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer after_live.deinit(std.testing.allocator);
+    _ = try p.onFrame(.scrollback_chunk, &chunk);
+    try selectionTestFollowMetadata(p, 1);
+    var newer = testSnapshot();
+    proto.writeSnapshotPrefix(newer[0..proto.snapshot_prefix_len], .{ .seq = 39, .history_rows = 20, .cols = 11, .rows = 3, .epoch = 93 });
+    _ = try p.onFrame(.snapshot, &newer);
+    try std.testing.expect(p.history_dirty);
+    try std.testing.expect(!p.selectionFresh(p.selectionVersionLocked()));
+    try p.requestHistory(&wire);
+    const refresh = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer refresh.deinit(std.testing.allocator);
+    _ = try p.onFrame(.scrollback_chunk, &chunk);
+    try selectionTestFollowMetadata(p, 1);
+    try std.testing.expect(p.selectionFresh(p.selectionVersionLocked()));
+    _ = try p.onFrame(.term_modes, &proto.encodeTermModes(.{ .bracketed_paste = false, .cursor_keys = true }));
+    try std.testing.expect(p.history != null and p.history_dirty);
+    try p.mail(&wire, true);
+    const cleared = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer cleared.deinit(std.testing.allocator);
+    try std.testing.expectEqual(proto.MsgType.selection_req, cleared.type);
+    try p.requestHistory(&wire);
+    const before_resize = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer before_resize.deinit(std.testing.allocator);
+    try p.say(.{ .resize = .{ .cols = 12, .rows = 4 } });
+    try p.mail(&wire, true);
+    const resized = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer resized.deinit(std.testing.allocator);
+    try std.testing.expectEqual(proto.MsgType.resize, resized.type);
+    try std.testing.expect(p.history_pending != null and p.history == null);
+    _ = try p.onFrame(.scrollback_chunk, &chunk);
+    try std.testing.expect(p.history == null);
+    try std.testing.expectEqual(@as(u64, 39), p.replica.last_seq);
+    p.scroll_rows = 3;
+    p.history_pending = .{ .start = 17, .size = .{ .cols = 11, .rows = 3 }, .revision = p.history_revision, .until = 0 };
+    try std.testing.expectError(error.ConnectionTimedOut, p.requestHistory(&wire));
+    try std.testing.expectError(error.BadPayload, p.onFrame(.scrollback_chunk, &.{ 17, 0, 0, 0, 4, 0 }));
+    try std.testing.expectEqual(@as(u64, 39), p.replica.last_seq);
+    p.history_pending = .{ .start = 17, .size = .{ .cols = 11, .rows = 3 }, .revision = p.history_revision, .until = 0 };
+    try p.attach(&wire, true);
+    try std.testing.expect(p.history_pending != null);
+    try std.testing.expectEqual(Pump.Action.skip, try p.onFrame(.scrollback_chunk, &chunk));
+    p.history_pending = .{ .start = 17, .size = .{ .cols = 11, .rows = 3 }, .revision = p.history_revision, .until = 0 };
+    try p.attach(&wire, false);
+    try std.testing.expect(p.history == null and p.history_pending == null and p.scroll_rows == 0);
+}
+test "selection tracker survives source movement while history source stays paired" {
+    const p = try selectionTestPump();
+    defer p.stop();
+    p.admitted = true;
+    const start = try selectionTestQueue(p, 7);
+    try std.testing.expect(p.selectionAlive(7, start.version));
+    _ = selectionTestBegin(p, start).?;
+    var position: std.ArrayList(u8) = .empty;
+    defer position.deinit(std.testing.allocator);
+    try proto.encodeSelectionReply(&position, std.testing.allocator, .{
+        .id = 0,
+        .gesture = 7,
+        .seq = p.replica.last_seq,
+        .source = 1,
+        .history_rows = p.replica.history_rows,
+        .status = .ok,
+        .anchor = .{ .row = 0, .col = 0 },
+        .active = .{ .row = 0, .col = 1 },
+        .text = "",
+    });
+    _ = try p.onFrame(.selection_reply, position.items);
+    var redraw = testSnapshot();
+    std.mem.writeInt(u64, redraw[0..8], p.replica.last_seq + 1, .little);
+    _ = try p.onFrame(.snapshot, &redraw);
+    try std.testing.expect(p.followPositionLocked() == null);
+    try std.testing.expect(p.selectionAlive(7, start.version));
+    position.clearRetainingCapacity();
+    try proto.encodeSelectionReply(&position, std.testing.allocator, .{
+        .id = 0,
+        .gesture = 7,
+        .seq = p.replica.last_seq,
+        .source = 2,
+        .history_rows = p.replica.history_rows,
+        .status = .ok,
+        .anchor = .{ .row = 0, .col = 0 },
+        .active = .{ .row = 0, .col = 1 },
+        .text = "",
+    });
+    _ = try p.onFrame(.selection_reply, position.items);
+    try std.testing.expect(p.followPositionLocked() != null);
+    const copy = SelectionRequest{ .id = 8, .gesture = 7, .anchor = start.anchor, .active = start.active, .version = start.version, .ticket = p.selection_ticket };
+    try std.testing.expect(selectionTestBegin(p, copy) != null);
+    try selectionTestReply(p, 8, "moved source");
+    const result = p.takeSelection().?;
+    defer std.testing.allocator.free(result.text);
+    try std.testing.expectEqualStrings("moved source", result.text);
+    const stale_start = SelectionRequest{ .id = 9, .gesture = 9, .anchor = start.anchor, .active = start.active, .version = start.version, .ticket = p.selection_ticket };
+    try std.testing.expect(selectionTestBegin(p, stale_start) == null);
+    const h = try selectionTestPump();
+    defer h.stop();
+    h.admitted = true;
+    h.replica.history_rows = 20;
+    h.scroll_rows = 1;
+    h.history_pending = .{ .start = 17, .size = .{ .cols = 11, .rows = 3 }, .revision = h.history_revision, .until = std.math.maxInt(i64) };
+    const chunk = [_]u8{ 17, 0, 0, 0, 1, 0, 0, 0 };
+    try std.testing.expectEqual(Pump.Action.changed, try h.onFrame(.scrollback_chunk, &chunk));
+    try std.testing.expectEqual(@as(u64, 0), h.history_version.source);
+    try selectionTestFollowMetadata(h, 3);
+    try std.testing.expectEqual(@as(u64, 3), h.history_version.source);
+    var history_redraw = testSnapshot();
+    std.mem.writeInt(u64, history_redraw[0..8], h.replica.last_seq + 1, .little);
+    _ = try h.onFrame(.snapshot, &history_redraw);
+    try selectionTestFollowMetadata(h, 4);
+    try std.testing.expectEqual(@as(u64, 3), h.history_version.source);
+}
+test "ready terminal mode frames precede queued wheel input through the actual wire" {
+    const p = try selectionTestPump();
+    defer p.stop();
+    p.admitted = true;
+    const incoming = try std.posix.pipe2(.{ .NONBLOCK = true, .CLOEXEC = true });
+    defer closePipe(incoming);
+    const outgoing = try std.posix.pipe2(.{ .NONBLOCK = true, .CLOEXEC = true });
+    defer closePipe(outgoing);
+    var tr: client.Transport = .{ .link = .{ .pipe = .{ .child = std.process.Child.init(&.{"unused"}, std.testing.allocator), .r = incoming[0], .w = outgoing[1] } } };
+    var wire = try Wire.init(std.testing.allocator, &tr);
+    defer wire.deinit();
+    const up: Wheel = .{ .notches = 1, .col = 4, .row = 3, .pixel_x = 422, .pixel_y = 318 };
+    try p.say(.{ .wheel = up });
+    // More complete frames than one drain budget. Callers must defer the
+    // mailbox until the final mode frame has been admitted in FIFO order.
+    for (0..150) |_| try proto.writeFrame(incoming[1], .term_modes, &proto.encodeTermModes(.{ .bracketed_paste = false }));
+    try proto.writeFrame(incoming[1], .term_modes, &proto.encodeTermModes(.{ .bracketed_paste = false, .alt_screen = true, .cursor_keys = true }));
+    try std.testing.expectEqual(Pump.ReadState.busy, try p.receiveReady(&wire));
+    try p.mail(&wire, false);
+    try std.testing.expectEqual(@as(usize, 1), p.mailbox.items.len);
+    try std.testing.expectEqual(Pump.ReadState.busy, try p.receiveReady(&wire));
+    try std.testing.expectEqual(Pump.ReadState.idle, try p.receiveReady(&wire));
+    try p.mail(&wire, true);
+    const arrows = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer arrows.deinit(std.testing.allocator);
+    try std.testing.expectEqualStrings("\x1bOA\x1bOA\x1bOA", arrows.payload);
+    try proto.writeFrame(incoming[1], .term_modes, &proto.encodeTermModes(.{ .bracketed_paste = false, .mouse_normal = true, .mouse_sgr_pixels = true }));
+    try std.testing.expectEqual(Pump.ReadState.idle, try p.receiveReady(&wire));
+    try p.say(.{ .wheel = up });
+    try p.mail(&wire, true);
+    const pixels = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer pixels.deinit(std.testing.allocator);
+    try std.testing.expectEqualStrings("\x1b[<64;423;319M", pixels.payload);
+}
+test "mouse press motion release uses negotiated SGR coordinates" {
+    const p = try selectionTestPump();
+    defer p.stop();
+    p.admitted = true;
+    p.status.phase = .attached;
+    _ = try p.onFrame(.term_modes, &proto.encodeTermModes(.{ .bracketed_paste = false, .mouse_button = true, .mouse_sgr = true }));
+    const incoming = try std.posix.pipe2(.{ .NONBLOCK = true, .CLOEXEC = true });
+    defer closePipe(incoming);
+    const outgoing = try std.posix.pipe2(.{ .NONBLOCK = true, .CLOEXEC = true });
+    defer closePipe(outgoing);
+    var tr: client.Transport = .{ .link = .{ .pipe = .{ .child = std.process.Child.init(&.{"unused"}, std.testing.allocator), .r = incoming[0], .w = outgoing[1] } } };
+    var wire = try Wire.init(std.testing.allocator, &tr);
+    defer wire.deinit();
+    const token = p.mouseToken().?;
+    try p.say(.{ .mouse = .{ .token = token, .kind = .press, .button = 0, .col = 2, .row = 3, .pixel_x = 20, .pixel_y = 30 } });
+    try p.mail(&wire, true);
+    var frame = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer frame.deinit(std.testing.allocator);
+    try std.testing.expectEqualStrings("\x1b[<0;3;4M", frame.payload);
+    try p.say(.{ .mouse = .{ .token = token, .kind = .motion, .button = 0, .col = 4, .row = 5, .pixel_x = 40, .pixel_y = 50 } });
+    try p.mail(&wire, true);
+    var motion = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer motion.deinit(std.testing.allocator);
+    try std.testing.expectEqualStrings("\x1b[<32;5;6M", motion.payload);
+    try p.say(.{ .mouse = .{ .token = token, .kind = .release, .button = 0, .col = 4, .row = 5, .pixel_x = 40, .pixel_y = 50 } });
+    try p.mail(&wire, true);
+    var release = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer release.deinit(std.testing.allocator);
+    try std.testing.expectEqualStrings("\x1b[<0;5;6m", release.payload);
+    // Normal tracking ignores held motion, then a format change cancels in
+    // the format of the transmitted press, exactly once.
+    _ = try p.onFrame(.term_modes, &proto.encodeTermModes(.{ .bracketed_paste = false, .mouse_normal = true, .mouse_sgr = true }));
+    var event: Mouse = .{ .token = p.mouseToken().?, .kind = .press, .col = 2, .row = 3, .pixel_x = 20, .pixel_y = 30 };
+    try p.routeMouse(&wire, event);
+    const normal = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer normal.deinit(std.testing.allocator);
+    event.kind = .motion;
+    event.col = 5;
+    try p.routeMouse(&wire, event);
+    var probe: [1]u8 = undefined;
+    try std.testing.expectError(error.WouldBlock, std.posix.read(outgoing[0], &probe));
+    _ = try p.onFrame(.term_modes, &proto.encodeTermModes(.{ .bracketed_paste = false, .mouse_any = true }));
+    try p.reconcileMouse(&wire);
+    const cancelled = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer cancelled.deinit(std.testing.allocator);
+    try std.testing.expectEqualStrings("\x1b[<0;3;4m", cancelled.payload);
+    event.kind = .release;
+    try p.routeMouse(&wire, event);
+    try p.reconcileMouse(&wire);
+    try std.testing.expectError(error.WouldBlock, std.posix.read(outgoing[0], &probe));
+    // A cancelled queued press never starts a replacement gesture.
+    event.token = p.mouseToken().?;
+    event.kind = .press;
+    try p.say(.{ .mouse = event });
+    p.cancelMouse(event.token);
+    try p.mail(&wire, true);
+    try std.testing.expectError(error.WouldBlock, std.posix.read(outgoing[0], &probe));
+    event.token = p.mouseToken().?;
+    event.kind = .motion;
+    event.button = 3;
+    try p.routeMouse(&wire, event);
+    const hover = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer hover.deinit(std.testing.allocator);
+    try std.testing.expectEqualSlices(u8, &.{ 27, '[', 'M', 67, 38, 36 }, hover.payload);
+    _ = try p.onFrame(.term_modes, &proto.encodeTermModes(.{ .bracketed_paste = false, .mouse_x10 = true }));
+    event.token = p.mouseToken().?;
+    event.kind = .press;
+    event.button = 0;
+    try p.routeMouse(&wire, event);
+    const x10 = (try proto.readFrame(std.testing.allocator, outgoing[0])).?;
+    defer x10.deinit(std.testing.allocator);
+    try std.testing.expectEqualSlices(u8, &.{ 27, '[', 'M', 32, 38, 36 }, x10.payload);
+    event.kind = .release;
+    try p.routeMouse(&wire, event);
+    try std.testing.expectError(error.WouldBlock, std.posix.read(outgoing[0], &probe));
+}
+test "clipboard targets are retained separately and cleared on state change" {
+    const p = try selectionTestPump();
+    defer p.stop();
+    p.admitted = true;
+    p.status.phase = .attached;
+    _ = try p.onFrame(.term_event, "\x00cYQ==");
+    _ = try p.onFrame(.term_event, "\x00pYg==");
+    _ = try p.onFrame(.term_event, "\x00cYw==");
+    _ = try p.onFrame(.term_event, "\x00cAA=="); // NUL must preserve c.
+    const ctext = p.takeClipboard(false).?;
+    defer std.testing.allocator.free(ctext);
+    const ptext = p.takeClipboard(true).?;
+    defer std.testing.allocator.free(ptext);
+    try std.testing.expectEqualStrings("c", ctext);
+    try std.testing.expectEqualStrings("b", ptext);
+    _ = try p.onFrame(.term_event, "\x00cYQ==");
+    _ = try p.onFrame(.term_event, "\x00sYg==");
+    p.mu.lock();
+    p.setState(.reconnecting, 0, "reconnecting");
+    p.mu.unlock();
+    try std.testing.expect(p.takeClipboard(false) == null);
+    try std.testing.expect(p.takeClipboard(true) == null);
+}

src/engine/engine.zig

@@ @@ -38,10 +38,59 @@ pub const MuxHandler = struct { @@
+        comptime action: StreamAction.Tag,
+        value: StreamAction.Value(action),
+    ) void {
+        const eng = self.engineOf();
+        if (comptime action == .print_repeat) {
+            // Ghostty implements REP as repeated print calls. Route each
+            // through the same tracking hook, retaining its character state
+            // and width/wrap implementation instead of predicting the moves.
+            if (eng.term.previous_char) |c| for (0..@max(value, 1)) |_| self.vt(.print, .{ .cp = c });
+            return;
+        }
+        const active_before = eng.term.screens.active_key;
+        const print_x = if (comptime action == .print) eng.term.screens.active.cursor.x else 0;
+        const print_y = if (comptime action == .print) eng.term.screens.active.cursor.y else 0;
+        const print_at_scroll_bottom = if (comptime action == .print) print_y == eng.term.scrolling_region.bottom and
+            print_x >= eng.term.scrolling_region.left and print_x <= eng.term.scrolling_region.right else false;
+        // The source token guards a client coordinate pair while it crosses
+        // the wire to become tracked pins.  It is deliberately narrower than
+        // "received bytes": a counter repaint elsewhere must not make a
+        // completed drag refuse to register.  These are the stream actions
+        // which can remap a coordinate to another cell identity.  Test the
+        // terminal state before forwarding because index/reverse-index and a
+        // pending wrap decide whether this invocation actually scrolls.
+        const source_before = self.movesCoordinateIdentity(action);
+        if (source_before) eng.selection_source +%= 1;
+        // A narrow character at the right margin only arms pending wrap, but
+        // a wide character can wrap and discard the top row immediately. Mark
+        // the possible victims before Ghostty remaps their pins, then retire
+        // them only when the cursor proves that this print really wrapped.
+        if (comptime action == .print) eng.markPossiblePrintDiscard();
+        eng.prepareTrackedMutation(action, value);
+        // Ghostty's full reset frees the alternate Screen. Its allocator may
+        // reuse the exact address on the next alternate entry, so pointer
+        // equality alone cannot make a stale tracked pin safe to deinit.
+        if (comptime action == .full_reset)
+            eng.alternate_generation +%= 1;
+        if (comptime action == .semantic_prompt) self.onSemanticPrompt(value);
+        if (comptime action == .clipboard_contents) self.onClipboard(value);
+        if (comptime action == .bell) self.onBell();
+        self.inner.vt(action, value);
+        if (comptime action == .print) {
+            const cursor = eng.term.screens.active.cursor;
+            // A narrow glyph at the last column merely arms pending wrap; it
+            // does not yet remap a coordinate. Actual wrapping moves left or
+            // to another row, including a wide glyph that cannot fit.
+            const wrapped = cursor.x < print_x or cursor.y != print_y;
+            if (!source_before and wrapped)
+                eng.selection_source +%= 1;
+            if (wrapped and print_at_scroll_bottom) eng.commitTrackedMutation() else eng.clearTrackedMutation();
+        } else eng.commitTrackedMutation();
+        if (comptime action == .full_reset)
+            eng.screen_epoch +%= 1;
+        if (eng.term.screens.active_key != active_before) {
+            eng.screen_epoch +%= 1;
+            eng.selection_source +%= 1;
+        }
+        // After the stock handler, so the mode is on when the first report goes
+        // out. A bare vt answers DECRQM 2048 as recognised but never speaks the
+        // report, and an app that turns it on then ignores SIGWINCH and waits.
@@ @@ -56,6 +105,36 @@ pub const MuxHandler = struct { @@
+        return @alignCast(@fieldParentPtr("stream", stream_ptr));
+    fn movesCoordinateIdentity(self: *MuxHandler, comptime action: StreamAction.Tag) bool {
+        const term = &self.engineOf().term;
+        const cursor = term.screens.active.cursor;
+        const in_horizontal_region = cursor.x >= term.scrolling_region.left and
+            cursor.x <= term.scrolling_region.right;
+        return switch (action) {
+            // These either shift cells/lines directly, or can move retained
+            // rows into or out of scrollback.  A no-op is conservatively a
+            // new source, which only rejects a racing registration.
+            .insert_lines,
+            .delete_lines,
+            .insert_blanks,
+            .delete_chars,
+            .scroll_up,
+            .scroll_down,
+            .erase_display_complete,
+            .erase_display_scrollback,
+            .erase_display_scroll_complete,
+            .full_reset,
+            => true,
+            // A pending wrap necessarily invokes printWrap. For an otherwise
+            // ordinary print, `vt` compares pre/post cursor coordinates.
+            .print => term.modes.get(.insert) or cursor.pending_wrap,
+            .linefeed, .index, .next_line => in_horizontal_region and cursor.y == term.scrolling_region.bottom,
+            .reverse_index => in_horizontal_region and cursor.y == term.scrolling_region.top,
+            else => false,
+        };
+    }
+    fn onSemanticPrompt(
+        self: *MuxHandler,
+        value: StreamAction.Value(.semantic_prompt),
@@ @@ -137,6 +216,19 @@ pub const Engine = struct { @@
+    side_events: std.ArrayList(SideEvent),
+    /// Copied from Options: the interception path reads it per event.
+    clipboard_max: usize,
+    /// Full primary scrollback preserves pins only while the screen retains
+    /// scrolled-off rows. With no scrollback, that same scroll discards them.
+    scrollback_enabled: bool,
+    /// Monotonic coordinate-identity token. Clients use this to identify the
+    /// exact source state at which a tracked selection was installed.
+    selection_source: u64,
+    /// Changes when screen identity or geometry is reset, switched, or resized.
+    /// Ordinary output leaves this stable so tracked pins can follow it.
+    screen_epoch: u64,
+    /// Lifetime of Ghostty's lazily allocated alternate Screen. Full reset
+    /// destroys it; a new alternate may reuse its address.
+    alternate_generation: u64,
+    tracked_head: ?*TrackedSelection = null,
+    pub const MarkEvent = struct {
+        pub const Kind = enum(u8) { prompt_start, command_start, command_end };
@@ @@ -198,6 +290,96 @@ pub const Engine = struct { @@
+    };
+    /// A selection whose endpoints are pinned in one active Ghostty screen.
+    /// The daemon keeps this per client, rather than using Screen.selection,
+    /// so independent clients cannot overwrite one another's selection.
+    const SelectionPoints = struct { anchor: proto.SelectionPoint, active: proto.SelectionPoint };
+    pub const TrackedSelection = struct {
+        engine: *Engine,
+        screen: *vt.Screen,
+        screen_key: vt.ScreenSet.Key,
+        screen_epoch: u64,
+        alternate_generation: u64,
+        cols: u16,
+        rows: u16,
+        selection: vt.Selection,
+        prev: ?*TrackedSelection = null,
+        next: ?*TrackedSelection = null,
+        valid: bool = true,
+        discard_candidate: bool = false,
+        remap: ?SelectionPoints = null,
+        rotate_rows: u16 = 0,
+        pub fn deinit(self: *TrackedSelection) void {
+            self.unlink();
+            // A full reset may destroy the alternate Screen and its pins.
+            // Its allocator can then recreate it at this exact address; the
+            // explicit generation prevents an ABA untrack in that new Screen.
+            if (self.screen_key == .alternate and
+                self.engine.alternate_generation != self.alternate_generation)
+                return self.engine.alloc.destroy(self);
+            const current = self.engine.term.screens.all.get(self.screen_key) orelse {
+                self.engine.alloc.destroy(self);
+                return;
+            };
+            if (current == self.screen) self.selection.deinit(self.screen);
+            self.engine.alloc.destroy(self);
+        }
+        fn unlink(self: *TrackedSelection) void {
+            if (self.prev) |prev| prev.next = self.next else if (self.engine.tracked_head == self) self.engine.tracked_head = self.next;
+            if (self.next) |next| next.prev = self.prev;
+            self.prev = null;
+            self.next = null;
+        }
+        /// Current screen-space endpoints. A garbage pin, screen switch, or
+        /// geometry change retires the durable selection.
+        pub fn points(self: *const TrackedSelection) ?SelectionPoints {
+            if (!self.valid or self.engine.term.screens.active_key != self.screen_key or
+                self.engine.screen_epoch != self.screen_epoch or
+                self.engine.term.cols != self.cols or self.engine.term.rows != self.rows)
+                return null;
+            const anchor_pin = self.selection.start();
+            const active_pin = self.selection.end();
+            if (anchor_pin.garbage or active_pin.garbage) return null;
+            const anchor = self.screen.pages.pointFromPin(.screen, anchor_pin) orelse return null;
+            const active = self.screen.pages.pointFromPin(.screen, active_pin) orelse return null;
+            const anchor_coord = switch (anchor) {
+                .screen => |coord| coord,
+                else => return null,
+            };
+            const active_coord = switch (active) {
+                .screen => |coord| coord,
+                else => return null,
+            };
+            return .{
+                .anchor = .{ .row = anchor_coord.y, .col = @intCast(anchor_coord.x) },
+                .active = .{ .row = active_coord.y, .col = @intCast(active_coord.x) },
+            };
+        }
+        /// Extract from the endpoints' current positions. Null means the
+        /// tracked pins no longer name the original active screen geometry.
+        pub fn extract(
+            self: *const TrackedSelection,
+            alloc: std.mem.Allocator,
+            max_bytes: usize,
+        ) !?SelectionExtract {
+            const p = self.points() orelse return null;
+            return try self.engine.extractSelection(
+                alloc,
+                p.anchor.row,
+                p.anchor.col,
+                p.active.row,
+                p.active.col,
+                max_bytes,
+            );
+        }
+    };
+    /// Heap-allocates: stream.handler holds a pointer to `term`, so an
+    /// Engine must never move after init.
+    pub fn init(alloc: std.mem.Allocator, opts: Options) !*Engine {
@@ @@ -216,6 +398,11 @@ pub const Engine = struct { @@
+            .mark_events = .empty,
+            .side_events = .empty,
+            .clipboard_max = opts.clipboard_max,
+            .scrollback_enabled = opts.max_scrollback != 0,
+            .selection_source = 1,
+            .screen_epoch = 1,
+            .alternate_generation = 1,
+            .tracked_head = null,
+        };
+        errdefer self.term.deinit(alloc);
@@ @@ -230,6 +417,7 @@ pub const Engine = struct { @@
+    pub fn deinit(self: *Engine) void {
+        while (self.tracked_head) |tracked| tracked.deinit();
+        self.pty_out.deinit(self.alloc);
+        self.clearSideEvents();
+        self.side_events.deinit(self.alloc);
@@ @@ -243,6 +431,141 @@ pub const Engine = struct { @@
+        self.stream.nextSlice(bytes);
+    fn prepareTrackedMutation(self: *Engine, comptime action: StreamAction.Tag, value: StreamAction.Value(action)) void {
+        if (self.tracked_head == null) return;
+        const t = &self.term;
+        const c = t.screens.active.cursor;
+        const in_region = c.x >= t.scrolling_region.left and c.x <= t.scrolling_region.right;
+        switch (action) {
+            .print => if (t.modes.get(.insert)) self.invalidateActive(),
+            .scroll_up => self.prepareScrollUp(value),
+            .scroll_down => self.shiftSelectionRows(t.scrolling_region.top, t.scrolling_region.bottom, value, .down),
+            .index, .linefeed, .next_line => if (in_region and c.y == t.scrolling_region.bottom) self.prepareScrollUp(1),
+            .reverse_index => if (in_region and c.y == t.scrolling_region.top) self.shiftSelectionRows(t.scrolling_region.top, t.scrolling_region.bottom, 1, .down),
+            .insert_lines, .delete_lines => if (in_region and c.y >= t.scrolling_region.top and c.y <= t.scrolling_region.bottom) {
+                self.shiftSelectionRows(c.y, t.scrolling_region.bottom, value, if (action == .insert_lines) .down else .up);
+            },
+            // Horizontal edits need a different range policy from vertical moves.
+            .insert_blanks, .delete_chars => self.invalidateActive(),
+            .erase_display_complete, .erase_display_scrollback, .erase_display_scroll_complete, .full_reset => self.invalidateActive(),
+            else => {},
+        }
+    }
+    fn prepareScrollUp(self: *Engine, count: usize) void {
+        const t = &self.term;
+        if (count == 0) return;
+        if (t.scrolling_region.top == 0 and t.scrolling_region.left == 0 and t.scrolling_region.right == t.cols - 1) {
+            // Ghostty moves retained history itself. A partial bottom also
+            // rotates the untouched rows below it; those external pins need
+            // the same displacement after Ghostty has grown/pruned pages.
+            const n: u16 = @intCast(@min(count, t.scrolling_region.bottom + 1));
+            const origin = self.historyRows();
+            const bottom = origin + t.scrolling_region.bottom;
+            var it = self.tracked_head;
+            while (it) |tracked| : (it = tracked.next) if (tracked.points()) |points| {
+                const first = @min(points.anchor.row, points.active.row);
+                const last = @max(points.anchor.row, points.active.row);
+                if (first <= bottom and last > bottom) tracked.discard_candidate = true;
+                if (first > bottom) tracked.rotate_rows = n;
+                if (!self.scrollback_enabled or t.screens.active_key == .alternate)
+                    tracked.discard_candidate = tracked.discard_candidate or first < n;
+            };
+            return;
+        }
+        self.shiftSelectionRows(t.scrolling_region.top, t.scrolling_region.bottom, count, .up);
+    }
+    const ShiftDirection = enum { up, down };
+    fn shiftSelectionRows(self: *Engine, first: u16, last: u16, count: usize, direction: ShiftDirection) void {
+        if (count == 0 or self.tracked_head == null) return;
+        const t = &self.term;
+        // A rectangular margin can split a linear selection. Retire it until
+        // that separate selection policy is supported.
+        if (t.scrolling_region.left != 0 or t.scrolling_region.right != t.cols - 1) return self.invalidateActive();
+        const origin = self.historyRows();
+        const top = origin + first;
+        const bottom = origin + last;
+        const n: u32 = @intCast(@min(count, last - first + 1));
+        var it = self.tracked_head;
+        while (it) |tracked| : (it = tracked.next) if (tracked.points()) |points| {
+            const start = @min(points.anchor.row, points.active.row);
+            const end = @max(points.anchor.row, points.active.row);
+            if (start <= bottom and end >= top and (start < top or end > bottom)) {
+                tracked.discard_candidate = true;
+                continue;
+            }
+            var moved = points;
+            for ([_]*proto.SelectionPoint{ &moved.anchor, &moved.active }) |point| {
+                if (point.row < top or point.row > bottom) continue;
+                switch (direction) {
+                    .up => if (point.row < top + n) {
+                        tracked.discard_candidate = true;
+                    } else {
+                        point.row -= n;
+                    },
+                    .down => if (point.row + n > bottom) {
+                        tracked.discard_candidate = true;
+                    } else {
+                        point.row += n;
+                    },
+                }
+            }
+            tracked.remap = moved;
+        };
+    }
+    fn markPossiblePrintDiscard(self: *Engine) void {
+        if (self.tracked_head == null) return;
+        const t = &self.term;
+        const c = t.screens.active.cursor;
+        if (c.y == t.scrolling_region.bottom and c.x >= t.scrolling_region.left and c.x <= t.scrolling_region.right and
+            (c.x == t.scrolling_region.right or c.pending_wrap)) self.prepareScrollUp(1);
+    }
+    fn commitTrackedMutation(self: *Engine) void {
+        var it = self.tracked_head;
+        while (it) |tracked| : (it = tracked.next) {
+            if (tracked.discard_candidate) tracked.valid = false;
+            if (tracked.rotate_rows != 0) {
+                if (tracked.points()) |points| {
+                    var moved = points;
+                    moved.anchor.row += tracked.rotate_rows;
+                    moved.active.row += tracked.rotate_rows;
+                    tracked.remap = moved;
+                } else tracked.valid = false;
+            }
+            if (tracked.valid) if (tracked.remap) |points| {
+                // IL/DL copy row contents without remapping arbitrary pins.
+                // Rebind after the action, also covering index's fast path
+                // without duplicating Ghostty's choice of row-copy algorithm.
+                const a = tracked.screen.pages.pin(.{ .screen = .{ .x = points.anchor.col, .y = points.anchor.row } });
+                const b = tracked.screen.pages.pin(.{ .screen = .{ .x = points.active.col, .y = points.active.row } });
+                if (a != null and b != null) {
+                    tracked.selection.startPtr().* = a.?;
+                    tracked.selection.endPtr().* = b.?;
+                } else tracked.valid = false;
+            };
+            tracked.discard_candidate = false;
+            tracked.remap = null;
+            tracked.rotate_rows = 0;
+        }
+    }
+    fn clearTrackedMutation(self: *Engine) void {
+        var it = self.tracked_head;
+        while (it) |tracked| : (it = tracked.next) {
+            tracked.discard_candidate = false;
+            tracked.remap = null;
+            tracked.rotate_rows = 0;
+        }
+    }
+    fn invalidateActive(self: *Engine) void {
+        var it = self.tracked_head;
+        while (it) |tracked| : (it = tracked.next) {
+            if (tracked.screen == self.term.screens.active) tracked.valid = false;
+        }
+    }
+    pub fn selectionSource(self: *const Engine) u64 {
+        return self.selection_source;
+    }
+    pub fn ptyOutput(self: *const Engine) []const u8 {
+        return self.pty_out.items;
@@ @@ -593,6 +916,46 @@ pub const Engine = struct { @@
+        g.cursor = .{ .x = cur.x, .y = cur.y };
+    /// Pin a selection to the currently active screen. The returned owner
+    /// must be deinitialized by the caller, even when the terminal later
+    /// makes either endpoint unavailable.
+    pub fn trackSelection(
+        self: *Engine,
+        anchor: proto.SelectionPoint,
+        active: proto.SelectionPoint,
+    ) !?*TrackedSelection {
+        if (anchor.col >= self.term.cols or active.col >= self.term.cols)
+            return null;
+        const screen = self.term.screens.active;
+        const start = screen.pages.pin(.{ .screen = .{
+            .x = anchor.col,
+            .y = anchor.row,
+        } }) orelse return null;
+        const end = screen.pages.pin(.{ .screen = .{
+            .x = active.col,
+            .y = active.row,
+        } }) orelse return null;
+        const selection = vt.Selection.init(start, end, false);
+        const pinned = try selection.track(screen);
+        errdefer pinned.deinit(screen);
+        const tracked = try self.alloc.create(TrackedSelection);
+        tracked.* = .{
+            .engine = self,
+            .screen = screen,
+            .screen_key = self.term.screens.active_key,
+            .screen_epoch = self.screen_epoch,
+            .alternate_generation = self.alternate_generation,
+            .cols = @intCast(self.term.cols),
+            .rows = @intCast(self.term.rows),
+            .selection = pinned,
+        };
+        tracked.next = self.tracked_head;
+        if (self.tracked_head) |head| head.prev = tracked;
+        self.tracked_head = tracked;
+        return tracked;
+    }
+    /// Screen-space rows, zero being the oldest retained. Formatting writes
+    /// into a fixed-size allocation: hostile coordinates cannot blow it up.
+    pub fn extractSelection(
@@ @@ -675,11 +1038,16 @@ pub const Engine = struct { @@
+    /// Full reset (RIS). Also DISCARDS queued side_events: drain them first.
+    pub fn reset(self: *Engine) void {
+        self.selection_source +%= 1;
+        self.screen_epoch +%= 1;
+        self.alternate_generation +%= 1;
+        self.term.fullReset();
+        self.clearSideEvents();
+    pub fn resize(self: *Engine, cols: u16, rows: u16) !void {
+        self.selection_source +%= 1;
+        self.screen_epoch +%= 1;
+        try self.term.resize(self.alloc, @intCast(cols), @intCast(rows));
+        if (self.term.modes.get(.in_band_size_reports)) self.reportSize();
+    try std.testing.expectEqual(@as(?[]u8, null), unavailable.text);
+test "Engine: tracked selection follows output and preserves duplicate row identity" {
+    const alloc = std.testing.allocator;
+    var e = try Engine.init(alloc, .{ .cols = 16, .rows = 3, .max_scrollback = 16 });
+    defer e.deinit();
+    e.feed("DUPLICATE\r\nsame\r\nDUPLICATE\r\nother");
+    var tracked = (try e.trackSelection(.{ .row = 0, .col = 0 }, .{ .row = 0, .col = 8 })).?;
+    defer tracked.deinit();
+    var other = (try e.trackSelection(.{ .row = 2, .col = 0 }, .{ .row = 2, .col = 8 })).?;
+    defer other.deinit();
+    try std.testing.expect(tracked.points().?.anchor.row != other.points().?.anchor.row);
+    var first = (try tracked.extract(alloc, 64)).?;
+    defer first.deinit(alloc);
+    try std.testing.expectEqualStrings("DUPLICATE", first.text.?);
+    // More output advances the viewport and creates another identical row;
+    // tracked pins keep naming the first row rather than matching by text.
+    e.feed("\r\nnew-1\r\nnew-2\r\nnew-3");
+    var after_output = (try tracked.extract(alloc, 64)).?;
+    defer after_output.deinit(alloc);
+    try std.testing.expectEqualStrings("DUPLICATE", after_output.text.?);
+    try std.testing.expect(after_output.history_rows > first.history_rows);
+    var other_after = (try other.extract(alloc, 64)).?;
+    defer other_after.deinit(alloc);
+    try std.testing.expectEqualStrings("DUPLICATE", other_after.text.?);
+}
+test "Engine: selection source advances only for coordinate remapping actions" {
+    const alloc = std.testing.allocator;
+    var e = try Engine.init(alloc, .{ .cols = 4, .rows = 3 });
+    defer e.deinit();
+    const initial = e.selectionSource();
+    // Side effects and ordinary redraws leave coordinates meaningful. This is
+    // the live-counter case: a completed drag elsewhere must still register.
+    e.feed("\x07x\rY\n");
+    try std.testing.expectEqual(initial, e.selectionSource());
+    // Insert mode shifts the remainder of the row even away from its edge.
+    e.feed("\x1b[4hZ\x1b[4l");
+    const inserted = e.selectionSource();
+    try std.testing.expect(inserted != initial);
+    // Full-row repainting reaches the last column but only arms pending-wrap;
+    // it must not reject a drag elsewhere, such as a live counter redraw.
+    e.feed("\x1b[1;1H1234");
+    try std.testing.expectEqual(inserted, e.selectionSource());
+    // A wide glyph at the right margin cannot fit, so Ghostty immediately
+    // wraps and remaps coordinates. The post-print cursor proves that path.
+    e.feed("\x1b[1;4H漢");
+    const wrapped = e.selectionSource();
+    try std.testing.expect(wrapped != inserted);
+    // Index at the bottom scrolls; the same LF away from the bottom above did
+    // not. ED 3 clears scrollback and changes absolute row identities.
+    e.feed("\x1b[3;1H\n");
+    const scrolled = e.selectionSource();
+    try std.testing.expect(scrolled != wrapped);
+    e.feed("\x1b[3J");
+    try std.testing.expect(e.selectionSource() != scrolled);
+}
+test "Engine: tracked selection rejects active screen and geometry changes" {
+    const alloc = std.testing.allocator;
+    var e = try Engine.init(alloc, .{ .cols = 8, .rows = 3 });
+    defer e.deinit();
+    e.feed("tracked");
+    var tracked = (try e.trackSelection(.{ .row = 0, .col = 0 }, .{ .row = 0, .col = 6 })).?;
+    defer tracked.deinit();
+    try std.testing.expect(tracked.points() != null);
+    // Switching away and back in one feed still retires the source identity;
+    // comparing only the final active screen key would miss this.
+    e.feed("\x1b[?1049halt\x1b[?1049l");
+    try std.testing.expect(tracked.points() == null);
+    // Ordinary alternate leave retains its Screen and pins, but switching
+    // away/re-entering still retires this selection's presentation epoch.
+    e.feed("\x1b[?1049h");
+    var alt_tracked = (try e.trackSelection(.{ .row = 0, .col = 0 }, .{ .row = 0, .col = 3 })).?;
+    defer alt_tracked.deinit();
+    e.feed("\x1b[?1049l\x1b[?1049h");
+    try std.testing.expect(alt_tracked.points() == null);
+    e.feed("\x1b[?1049l");
+    var resized = (try e.trackSelection(.{ .row = 0, .col = 0 }, .{ .row = 0, .col = 6 })).?;
+    defer resized.deinit();
+    try e.resize(9, 3);
+    try std.testing.expect(resized.points() == null);
+    try e.resize(8, 3);
+    try std.testing.expect(resized.points() == null);
+    var reset = (try e.trackSelection(.{ .row = 0, .col = 0 }, .{ .row = 0, .col = 6 })).?;
+    defer reset.deinit();
+    e.reset();
+    try std.testing.expect(reset.points() == null);
+}
+test "Engine: alternate tracked pin deinit rejects a reset ABA lifetime" {
+    const alloc = std.testing.allocator;
+    var e = try Engine.init(alloc, .{ .cols = 8, .rows = 3 });
+    defer e.deinit();
+    e.feed("\x1b[?1049halt");
+    var tracked = (try e.trackSelection(.{ .row = 0, .col = 0 }, .{ .row = 0, .col = 2 })).?;
+    const lifetime = tracked.alternate_generation;
+    e.reset();
+    try std.testing.expect(e.alternate_generation != lifetime);
+    // This must be a no-op even if Ghostty's next alternate allocation takes
+    // the former address. The generation, not allocator behavior, is proof.
+    tracked.deinit();
+    e.feed("\x1b[?1049hnew-alt");
+}
+test "Engine: bounded scroll retires discarded endpoints but keeps shifted rows" {
+    const alloc = std.testing.allocator;
+    var e = try Engine.init(alloc, .{ .cols = 8, .rows = 4 });
+    defer e.deinit();
+    e.feed("\x1b[?1049hA\r\nB\r\nC\r\nD");
+    const discarded = (try e.trackSelection(.{ .row = 0, .col = 0 }, .{ .row = 0, .col = 0 })).?;
+    defer discarded.deinit();
+    const kept = (try e.trackSelection(.{ .row = 2, .col = 0 }, .{ .row = 2, .col = 0 })).?;
+    defer kept.deinit();
+    // Alt screen never receives scrollback: CSI S discards its top row.
+    e.feed("\x1b[1S");
+    try std.testing.expect(discarded.points() == null);
+    try std.testing.expectEqual(@as(u32, 1), kept.points().?.anchor.row);
+}
+test "Engine: print wrapping and REP retire an alternate discarded row" {
+    const alloc = std.testing.allocator;
+    var e = try Engine.init(alloc, .{ .cols = 4, .rows = 3 });
+    defer e.deinit();
+    e.feed("\x1b[?1049hA\r\nB\r\nC");
+    const wide_discarded = (try e.trackSelection(.{ .row = 0, .col = 0 }, .{ .row = 0, .col = 0 })).?;
+    defer wide_discarded.deinit();
+    // A wide glyph at the final cell wraps immediately; it does not first set
+    // pending_wrap, so the candidate must be remembered before Ghostty scrolls.
+    e.feed("\x1b[3;4H漢");
+    try std.testing.expect(wide_discarded.points() == null);
+    e.reset();
+    e.feed("\x1b[?1049hA\r\nB\r\nC");
+    const repeated_discarded = (try e.trackSelection(.{ .row = 0, .col = 0 }, .{ .row = 0, .col = 0 })).?;
+    defer repeated_discarded.deinit();
+    // REP at the margin prints twice: the second character consumes pending
+    // wrap and scrolls the alternate screen.
+    e.feed("\x1b[3;4H\x1b[2b");
+    try std.testing.expect(repeated_discarded.points() == null);
+}
+test "Engine: a non-bottom wrap retains primary history selection" {
+    const alloc = std.testing.allocator;
+    var e = try Engine.init(alloc, .{ .cols = 4, .rows = 4, .max_scrollback = 16 });
+    defer e.deinit();
+    e.feed("zero\r\none\r\ntwo\r\nthree\r\nfour\r\nfive");
+    const history = e.historyRows();
+    try std.testing.expect(history > 0);
+    const tracked = (try e.trackSelection(.{ .row = 0, .col = 0 }, .{ .row = 0, .col = 0 })).?;
+    defer tracked.deinit();
+    // This is an actual wide-character wrap, but it lands on the next row
+    // above the bottom of the full scrolling region and cannot discard text.
+    e.feed("\x1b[2;4H漢");
+    try std.testing.expect(tracked.points() != null);
+}
+test "Engine: full primary scroll without scrollback retires its top row" {
+    const alloc = std.testing.allocator;
+    var e = try Engine.init(alloc, .{ .cols = 8, .rows = 3, .max_scrollback = 0 });
+    defer e.deinit();
+    e.feed("top\r\nmid\r\nbottom");
+    const tracked = (try e.trackSelection(.{ .row = 0, .col = 0 }, .{ .row = 0, .col = 2 })).?;
+    defer tracked.deinit();
+    e.feed("\x1b[3;1H\n");
+    try std.testing.expect(tracked.points() == null);
+}
+test "Engine: partial primary discard compares absolute rows with history" {
+    const alloc = std.testing.allocator;
+    var e = try Engine.init(alloc, .{ .cols = 8, .rows = 4, .max_scrollback = 16 });
+    defer e.deinit();
+    e.feed("zero\r\none\r\ntwo\r\nthree\r\nfour\r\nfive");
+    const history = e.historyRows();
+    try std.testing.expect(history > 0);
+    const discarded = (try e.trackSelection(.{ .row = history + 1, .col = 0 }, .{ .row = history + 1, .col = 0 })).?;
+    defer discarded.deinit();
+    const kept = (try e.trackSelection(.{ .row = history + 2, .col = 0 }, .{ .row = history + 2, .col = 0 })).?;
+    defer kept.deinit();
+    e.feed("\x1b[2;4r\x1b[1S");
+    try std.testing.expect(discarded.points() == null);
+    try std.testing.expectEqual(history + 1, kept.points().?.anchor.row);
+    const text = (try kept.extract(alloc, 100)).?;
+    defer text.deinit(alloc);
+    try std.testing.expectEqualStrings("f", text.text.?);
+}
+test "Engine: retained region selection follows IL DL index and reverse scrolling" {
+    const alloc = std.testing.allocator;
+    const cases = .{
+        .{ "\x1b[2S", @as(u32, 1) },
+        .{ "\x1b[1T", @as(u32, 4) },
+        .{ "\x1b[3;1H\x1b[1L", @as(u32, 4) },
+        .{ "\x1b[2;1H\x1b[1M", @as(u32, 2) },
+        .{ "\x1b[6;1H\n", @as(u32, 2) },
+        .{ "\x1b[44m\x1b[6;1H\n", @as(u32, 2) },
+        .{ "\x1b[2;1H\x1bM", @as(u32, 4) },
+        .{ "\x1b[6;8H漢", @as(u32, 2) },
+    };
+    inline for (cases) |case| {
+        var e = try Engine.init(alloc, .{ .cols = 8, .rows = 6 });
+        defer e.deinit();
+        e.feed("\x1b[?1049hA\r\nB\r\nC\r\nD\r\nE\r\nF\x1b[2;6r");
+        const kept = (try e.trackSelection(.{ .row = 3, .col = 0 }, .{ .row = 3, .col = 0 })).?;
+        defer kept.deinit();
+        e.feed(case[0]);
+        try std.testing.expectEqual(case[1], kept.points().?.anchor.row);
+        const text = (try kept.extract(alloc, 100)).?;
+        defer text.deinit(alloc);
+        try std.testing.expectEqualStrings("D", text.text.?);
+    }
+}
+test "Engine: REP uses the normal print tracking path" {
+    const alloc = std.testing.allocator;
+    var e = try Engine.init(alloc, .{ .cols = 8, .rows = 4 });
+    defer e.deinit();
+    e.feed("\x1b[?1049hA\r\nB\r\nC\r\nD");
+    const kept = (try e.trackSelection(.{ .row = 2, .col = 0 }, .{ .row = 2, .col = 0 })).?;
+    defer kept.deinit();
+    const source = e.selectionSource();
+    e.feed("\x1b[1;2Hx\x1b[3b");
+    try std.testing.expectEqual(source, e.selectionSource());
+    try std.testing.expectEqual(@as(u32, 2), kept.points().?.anchor.row);
+    e.feed("\x1b[4;8H\x1b[2b");
+    try std.testing.expectEqual(@as(u32, 1), kept.points().?.anchor.row);
+    const text = (try kept.extract(alloc, 100)).?;
+    defer text.deinit(alloc);
+    try std.testing.expectEqualStrings("C", text.text.?);
+}
+test "Engine: split region ranges and insert-mode prints retire selection" {
+    const alloc = std.testing.allocator;
+    var e = try Engine.init(alloc, .{ .cols = 8, .rows = 6 });
+    defer e.deinit();
+    e.feed("\x1b[?1049hA\r\nB\r\nC\r\nD\r\nE\r\nF");
+    const crossing = (try e.trackSelection(.{ .row = 0, .col = 0 }, .{ .row = 4, .col = 0 })).?;
+    defer crossing.deinit();
+    e.feed("\x1b[2;4r\x1b[1S");
+    try std.testing.expect(crossing.points() == null);
+    e.feed("\x1b[r\x1b[1;1Hhello");
+    const inserted = (try e.trackSelection(.{ .row = 0, .col = 1 }, .{ .row = 0, .col = 3 })).?;
+    defer inserted.deinit();
+    e.feed("\x1b[1;1H\x1b[4hZ");
+    try std.testing.expect(inserted.points() == null);
+}
+test "Engine: top-zero partial-bottom scrolling preserves selected occurrence" {
+    const alloc = std.testing.allocator;
+    inline for (.{ "\x1b[1S", "\x1b[4;1H\n" }) |action| {
+        inline for (.{ true, false }) |alternate| {
+            var e = try Engine.init(alloc, .{ .cols = 8, .rows = 6 });
+            defer e.deinit();
+            if (alternate) e.feed("\x1b[?1049h");
+            e.feed("A\r\nB\r\nC\r\nD\r\nE\r\nF\x1b[1;4r");
+            const kept = (try e.trackSelection(.{ .row = 2, .col = 0 }, .{ .row = 2, .col = 0 })).?;
+            defer kept.deinit();
+            const below = (try e.trackSelection(.{ .row = 4, .col = 0 }, .{ .row = 5, .col = 0 })).?;
+            defer below.deinit();
+            const crossing = (try e.trackSelection(.{ .row = 2, .col = 0 }, .{ .row = 4, .col = 0 })).?;
+            defer crossing.deinit();
+            e.feed(action);
+            try std.testing.expect(crossing.points() == null);
+            try std.testing.expectEqual(e.historyRows() + 4, below.points().?.anchor.row);
+            const outside_text = (try below.extract(alloc, 100)).?;
+            defer outside_text.deinit(alloc);
+            try std.testing.expectEqualStrings("E\nF", outside_text.text.?);
+            try std.testing.expectEqual(e.historyRows() + 1, kept.points().?.anchor.row);
+            const text = (try kept.extract(alloc, 100)).?;
+            defer text.deinit(alloc);
+            try std.testing.expectEqualStrings("C", text.text.?);
+        }
+    }
+}
+test "Engine: history eviction makes tracked pins unavailable" {
+    const alloc = std.testing.allocator;
+    var e = try Engine.init(alloc, .{ .cols = 80, .rows = 3, .max_scrollback = 3 });
+    defer e.deinit();
+    e.feed("old\r\none\r\ntwo\r\nthree\r\nfour");
+    const oldest = (try e.trackSelection(.{ .row = 0, .col = 0 }, .{ .row = 0, .col = 2 })).?;
+    defer oldest.deinit();
+    // Scrollback is page-backed. Drive past several pages rather than
+    // assuming max_scrollback is a line count.
+    for (0..1600) |_| e.feed("discard\r\n");
+    try std.testing.expect(oldest.points() == null);
+}
+test "ghostty-vt boots headless and text lands in the grid" {
+    const alloc = std.testing.allocator;
+    var e = try Engine.init(alloc, .{ .cols = 80, .rows = 24 });

src/engine/protocol.zig

Old		New
@@ -377,111 +377,106 @@ pub const SelectionPoint = struct {
377	col: u16,	377	col: u16,
378	};	378	};
379		379
		380	/// One selection contract for direct extraction and per-client tracking.
		381	/// Start guards the coordinate source; copy and clear name an owned gesture.
380	pub const SelectionReq = struct {	382	pub const SelectionReq = struct {
		383	action: enum(u8) { extract, start, copy, clear } = .extract,
381	id: u32,	384	id: u32,
		385	gesture: u32 = 0,
		386	epoch: u64 = 0,
		387	source: u64 = 0,
382	anchor: SelectionPoint,	388	anchor: SelectionPoint,
383	active: SelectionPoint,	389	active: SelectionPoint,
384	};	390	};
385
386	pub const selection_text_max: usize = 1024 * 1024;	391	pub const selection_text_max: usize = 1024 * 1024;
387	pub const selection_req_len: usize = 16;	392	pub const selection_req_len: usize = 37;
388	pub const selection_reply_prefix_len: usize = 9;	393	pub const selection_reply_prefix_len: usize = 41;
389		394
390	pub fn encodeSelectionReq(req: SelectionReq) [selection_req_len]u8 {	395	fn writeSelectionPoint(out: *[6]u8, point: SelectionPoint) void {
391	var buf: [selection_req_len]u8 = undefined;	396	std.mem.writeInt(u32, out[0..4], point.row, .little);
392	std.mem.writeInt(u32, buf[0..4], req.id, .little);	397	std.mem.writeInt(u16, out[4..6], point.col, .little);
393	std.mem.writeInt(u32, buf[4..8], req.anchor.row, .little);
394	std.mem.writeInt(u16, buf[8..10], req.anchor.col, .little);
395	std.mem.writeInt(u32, buf[10..14], req.active.row, .little);
396	std.mem.writeInt(u16, buf[14..16], req.active.col, .little);
397	return buf;
398	}	398	}
399		399	fn readSelectionPoint(bytes: *const [6]u8) SelectionPoint {
400	pub fn decodeSelectionReq(payload: []const u8) !SelectionReq {	400	return .{ .row = std.mem.readInt(u32, bytes[0..4], .little), .col = std.mem.readInt(u16, bytes[4..6], .little) };
401	if (payload.len != selection_req_len) return error.BadPayload;	401	}
402	return .{	402	pub fn encodeSelectionReq(req: SelectionReq) [selection_req_len]u8 {
403	.id = std.mem.readInt(u32, payload[0..4], .little),	403	var out: [selection_req_len]u8 = undefined;
404	.anchor = .{	404	std.mem.writeInt(u32, out[0..4], req.id, .little);
405	.row = std.mem.readInt(u32, payload[4..8], .little),	405	writeSelectionPoint(out[4..10], req.anchor);
406	.col = std.mem.readInt(u16, payload[8..10], .little),	406	writeSelectionPoint(out[10..16], req.active);
407	},	407	out[16] = @intFromEnum(req.action);
408	.active = .{	408	std.mem.writeInt(u32, out[17..21], req.gesture, .little);
409	.row = std.mem.readInt(u32, payload[10..14], .little),	409	std.mem.writeInt(u64, out[21..29], req.epoch, .little);
410	.col = std.mem.readInt(u16, payload[14..16], .little),	410	std.mem.writeInt(u64, out[29..37], req.source, .little);
411	},	411	return out;
		412	}
		413	pub fn decodeSelectionReq(bytes: []const u8) !SelectionReq {
		414	if (bytes.len != selection_req_len) return error.BadPayload;
		415	const req: SelectionReq = .{
		416	.id = std.mem.readInt(u32, bytes[0..4], .little),
		417	.anchor = readSelectionPoint(bytes[4..10]),
		418	.active = readSelectionPoint(bytes[10..16]),
		419	.action = try enumFromByte(@FieldType(SelectionReq, "action"), bytes[16]),
		420	.gesture = std.mem.readInt(u32, bytes[17..21], .little),
		421	.epoch = std.mem.readInt(u64, bytes[21..29], .little),
		422	.source = std.mem.readInt(u64, bytes[29..37], .little),
412	};	423	};
		424	const valid = switch (req.action) {
		425	.extract => req.id != 0 and req.gesture == 0,
		426	.start, .copy => req.id != 0 and req.gesture != 0,
		427	.clear => req.id == 0 and req.gesture != 0,
		428	};
		429	if (!valid) return error.BadPayload;
		430	return req;
413	}	431	}
414		432	pub const SelectionStatus = enum(u8) { ok = 0, invalid = 1, too_large = 2, unavailable = 3 };
415	pub const SelectionStatus = enum(u8) {
416	ok = 0,
417	invalid = 1,
418	too_large = 2,
419	unavailable = 3,
420	};
421
422	pub const SelectionReply = struct {	433	pub const SelectionReply = struct {
423	id: u32,	434	id: u32 = 0, // zero is a position update, never a clipboard write
424	status: SelectionStatus,	435	gesture: u32 = 0,
425	/// Retained history rows on the screen the text was extracted from. Absolute	436	seq: u64 = 0,
426	/// rows count from the OLDEST RETAINED row, so an eviction shifts every one	437	source: u64 = 0,
427	/// of them under a request in flight and the reply is `.ok`, valid UTF-8,
428	/// and the wrong text.
429	///
430	/// A watermark rather than a lease on purpose: the daemon holds no
431	/// per-client selection state, so the requester compares and decides.
432	/// Ordinary output RAISES it without moving row zero; only eviction lowers it.
433	history_rows: u32,	438	history_rows: u32,
434	/// Borrowed from the frame payload and valid only as long as that	439	status: SelectionStatus = .unavailable,
435	/// payload remains alive and unchanged.	440	anchor: SelectionPoint = .{ .row = 0, .col = 0 },
436	text: []const u8,	441	active: SelectionPoint = .{ .row = 0, .col = 0 },
		442	/// Borrows the frame payload. Only successful copy/extract replies carry text.
		443	text: []const u8 = &.{},
437	};	444	};
438		445	fn checkSelectionText(reply: SelectionReply) !void {
439	/// One rule for both ends of a selection_reply: `.ok` carries valid UTF-8	446	if (reply.status != .ok or reply.id == 0) {
440	/// within the cap, every refusal carries nothing at all. A writer that	447	if (reply.text.len != 0) return error.BadPayload;
441	/// checked less than the reader would mint a frame it could not read back.	448	} else if (reply.text.len > selection_text_max or !std.unicode.utf8ValidateSlice(reply.text)) return error.BadPayload;
442	fn checkSelectionText(status: SelectionStatus, text_value: []const u8) !void {	449	}
443	switch (status) {	450	/// Validate before appending so malformed replies leave the caller's buffer intact.
444	.ok => {	451	pub fn encodeSelectionReply(out: *std.ArrayList(u8), alloc: std.mem.Allocator, reply: SelectionReply) !void {
445	if (text_value.len > selection_text_max or !std.unicode.utf8ValidateSlice(text_value))	452	try checkSelectionText(reply);
446	return error.BadPayload;
447	},
448	.invalid, .too_large, .unavailable => {
449	if (text_value.len != 0) return error.BadPayload;
450	},
451	}
452	}
453
454	/// Validation completes before the first append, so `error.BadPayload`
455	/// leaves a reused `out` unchanged.
456	pub fn encodeSelectionReply(
457	out: *std.ArrayList(u8),
458	alloc: std.mem.Allocator,
459	id: u32,
460	status: SelectionStatus,
461	history_rows: u32,
462	text_value: []const u8,
463	) !void {
464	try checkSelectionText(status, text_value);
465
466	var prefix: [selection_reply_prefix_len]u8 = undefined;	453	var prefix: [selection_reply_prefix_len]u8 = undefined;
467	std.mem.writeInt(u32, prefix[0..4], id, .little);	454	std.mem.writeInt(u32, prefix[0..4], reply.id, .little);
468	prefix[4] = @intFromEnum(status);	455	prefix[4] = @intFromEnum(reply.status);
469	std.mem.writeInt(u32, prefix[5..9], history_rows, .little);	456	std.mem.writeInt(u32, prefix[5..9], reply.history_rows, .little);
		457	std.mem.writeInt(u32, prefix[9..13], reply.gesture, .little);
		458	std.mem.writeInt(u64, prefix[13..21], reply.seq, .little);
		459	std.mem.writeInt(u64, prefix[21..29], reply.source, .little);
		460	writeSelectionPoint(prefix[29..35], reply.anchor);
		461	writeSelectionPoint(prefix[35..41], reply.active);
470	try out.appendSlice(alloc, &prefix);	462	try out.appendSlice(alloc, &prefix);
471	try out.appendSlice(alloc, text_value);	463	try out.appendSlice(alloc, reply.text);
472	}	464	}
473		465	pub fn decodeSelectionReply(bytes: []const u8) !SelectionReply {
474	pub fn decodeSelectionReply(payload: []const u8) !SelectionReply {	466	if (bytes.len < selection_reply_prefix_len) return error.BadPayload;
475	if (payload.len < selection_reply_prefix_len) return error.BadPayload;	467	const reply: SelectionReply = .{
476	const status = try enumFromByte(SelectionStatus, payload[4]);	468	.id = std.mem.readInt(u32, bytes[0..4], .little),
477	const text_value = payload[selection_reply_prefix_len..];	469	.status = try enumFromByte(SelectionStatus, bytes[4]),
478	try checkSelectionText(status, text_value);	470	.history_rows = std.mem.readInt(u32, bytes[5..9], .little),
479	return .{	471	.gesture = std.mem.readInt(u32, bytes[9..13], .little),
480	.id = std.mem.readInt(u32, payload[0..4], .little),	472	.seq = std.mem.readInt(u64, bytes[13..21], .little),
481	.status = status,	473	.source = std.mem.readInt(u64, bytes[21..29], .little),
482	.history_rows = std.mem.readInt(u32, payload[5..9], .little),	474	.anchor = readSelectionPoint(bytes[29..35]),
483	.text = text_value,	475	.active = readSelectionPoint(bytes[35..41]),
		476	.text = bytes[selection_reply_prefix_len..],
484	};	477	};
		478	try checkSelectionText(reply);
		479	return reply;
485	}	480	}
486		481
487	/// Where the command-boundary signal came from, weakest-last. `marks` is the	482	/// Where the command-boundary signal came from, weakest-last. `marks` is the
@@ -2672,7 +2667,8 @@ test "selection request has a fixed little-endian wire layout" {
2672	0x14, 0x13, 0x12, 0x11,	2667	0x14, 0x13, 0x12, 0x11,
2673	0x22, 0x21, 0x34, 0x33,	2668	0x22, 0x21, 0x34, 0x33,
2674	0x32, 0x31, 0x42, 0x41,	2669	0x32, 0x31, 0x42, 0x41,
2675	}, &bytes);	2670	}, bytes[0..16]);
		2671	try std.testing.expectEqualSlices(u8, &(@as([21]u8, @splat(0))), bytes[16..]);
2676	try std.testing.expectEqualDeep(req, try decodeSelectionReq(&bytes));	2672	try std.testing.expectEqualDeep(req, try decodeSelectionReq(&bytes));
2677	try std.testing.expectError(error.BadPayload, decodeSelectionReq(bytes[0..15]));	2673	try std.testing.expectError(error.BadPayload, decodeSelectionReq(bytes[0..15]));
2678	var long: [selection_req_len + 1]u8 = .{0} ** (selection_req_len + 1);	2674	var long: [selection_req_len + 1]u8 = .{0} ** (selection_req_len + 1);
@@ -2685,11 +2681,11 @@ test "selection reply validates status and text shape" {
2685	var payload: std.ArrayList(u8) = .empty;	2681	var payload: std.ArrayList(u8) = .empty;
2686	defer payload.deinit(alloc);	2682	defer payload.deinit(alloc);
2687		2683
2688	try encodeSelectionReply(&payload, alloc, 7, .ok, 0x11223344, "hello");	2684	try encodeSelectionReply(&payload, alloc, .{ .id = 7, .status = .ok, .history_rows = 0x11223344, .text = "hello" });
2689	try std.testing.expectEqualSlices(	2685	try std.testing.expectEqualSlices(
2690	u8,	2686	u8,
2691	&.{ 7, 0, 0, 0, 0, 0x44, 0x33, 0x22, 0x11, 'h', 'e', 'l', 'l', 'o' },	2687	&.{ 7, 0, 0, 0, 0, 0x44, 0x33, 0x22, 0x11 },
2692	payload.items,	2688	payload.items[0..9],
2693	);	2689	);
2694	const ok = try decodeSelectionReply(payload.items);	2690	const ok = try decodeSelectionReply(payload.items);
2695	try std.testing.expectEqual(@as(u32, 7), ok.id);	2691	try std.testing.expectEqual(@as(u32, 7), ok.id);
@@ -2698,27 +2694,60 @@ test "selection reply validates status and text shape" {
2698	try std.testing.expectEqualStrings("hello", ok.text);	2694	try std.testing.expectEqualStrings("hello", ok.text);
2699		2695
2700	payload.clearRetainingCapacity();	2696	payload.clearRetainingCapacity();
2701	try encodeSelectionReply(&payload, alloc, 9, .invalid, 5, "");	2697	try encodeSelectionReply(&payload, alloc, .{ .id = 9, .status = .invalid, .history_rows = 5, .text = "" });
2702	try std.testing.expectEqualSlices(u8, &.{ 9, 0, 0, 0, 1, 5, 0, 0, 0 }, payload.items);	2698	try std.testing.expectEqualSlices(u8, &.{ 9, 0, 0, 0, 1, 5, 0, 0, 0 }, payload.items[0..9]);
2703	const invalid = try decodeSelectionReply(payload.items);	2699	const invalid = try decodeSelectionReply(payload.items);
2704	try std.testing.expectEqual(@as(u32, 9), invalid.id);	2700	try std.testing.expectEqual(@as(u32, 9), invalid.id);
2705	try std.testing.expectEqual(SelectionStatus.invalid, invalid.status);	2701	try std.testing.expectEqual(SelectionStatus.invalid, invalid.status);
2706	try std.testing.expectEqual(@as(u32, 5), invalid.history_rows);	2702	try std.testing.expectEqual(@as(u32, 5), invalid.history_rows);
2707	try std.testing.expectEqual(@as(usize, 0), invalid.text.len);	2703	try std.testing.expectEqual(@as(usize, 0), invalid.text.len);
2708		2704
		2705	payload.items[4] = 0xff;
		2706	try std.testing.expectError(error.BadPayload, decodeSelectionReply(payload.items));
		2707	payload.items[4] = @intFromEnum(SelectionStatus.invalid);
		2708	try payload.append(alloc, 'x');
		2709	try std.testing.expectError(error.BadPayload, decodeSelectionReply(payload.items));
		2710	payload.items[4] = @intFromEnum(SelectionStatus.ok);
		2711	payload.items[selection_reply_prefix_len] = 0xff;
		2712	try std.testing.expectError(error.BadPayload, decodeSelectionReply(payload.items));
		2713
2709	try std.testing.expectError(error.BadPayload, decodeSelectionReply(&.{ 1, 0, 0, 0, 0xff, 0, 0, 0, 0 }));	2714	try std.testing.expectError(error.BadPayload, decodeSelectionReply(&.{ 1, 0, 0, 0, 0xff, 0, 0, 0, 0 }));
2710	try std.testing.expectError(error.BadPayload, decodeSelectionReply(&.{ 1, 0, 0, 0, 1, 0, 0, 0, 0, 'x' }));	2715	try std.testing.expectError(error.BadPayload, decodeSelectionReply(&.{ 1, 0, 0, 0, 1, 0, 0, 0, 0, 'x' }));
2711	try std.testing.expectError(error.BadPayload, decodeSelectionReply(&.{ 1, 0, 0, 0, 0, 0, 0, 0, 0, 0xff }));	2716	try std.testing.expectError(error.BadPayload, decodeSelectionReply(&.{ 1, 0, 0, 0, 0, 0, 0, 0, 0, 0xff }));
2712		2717
2713	// The watermark is part of the prefix, so a reply carrying only the	2718	// The watermark is part of the prefix, so a reply carrying only the
2714	// pre-watermark five bytes is short, not a legacy reply to interpret.	2719	// pre-watermark five bytes is short, not a legacy reply to interpret.
2715	const prefix = [_]u8{ 1, 0, 0, 0, 0, 0, 0, 0, 0 };	2720	const prefix: [selection_reply_prefix_len]u8 = @splat(0);
2716	for (0..selection_reply_prefix_len) \|len\| {	2721	for (0..selection_reply_prefix_len) \|len\| {
2717	try std.testing.expectError(error.BadPayload, decodeSelectionReply(prefix[0..len]));	2722	try std.testing.expectError(error.BadPayload, decodeSelectionReply(prefix[0..len]));
2718	}	2723	}
2719	}	2724	}
2720		2725
2721	test "selection status discriminants have exact nine-byte golden replies" {	2726	test "selection tracking has one request and reply codec with guarded action shapes" {
		2727	var req: SelectionReq = .{ .action = .start, .id = 7, .gesture = 9, .epoch = 11, .source = 13, .anchor = .{ .row = 70000, .col = 3 }, .active = .{ .row = 70001, .col = 4 } };
		2728	const bytes = encodeSelectionReq(req);
		2729	try std.testing.expectEqualDeep(req, try decodeSelectionReq(&bytes));
		2730	try std.testing.expectEqualSlices(u8, &.{ 1, 9, 0, 0, 0, 11, 0, 0, 0, 0, 0, 0, 0, 13, 0, 0, 0, 0, 0, 0, 0 }, bytes[16..]);
		2731	req.id = 0;
		2732	try std.testing.expectError(error.BadPayload, decodeSelectionReq(&encodeSelectionReq(req)));
		2733	req.action = .clear;
		2734	try std.testing.expectEqualDeep(req, try decodeSelectionReq(&encodeSelectionReq(req)));
		2735	req.gesture = 0;
		2736	try std.testing.expectError(error.BadPayload, decodeSelectionReq(&encodeSelectionReq(req)));
		2737	var bad = bytes;
		2738	bad[16] = 0xff;
		2739	try std.testing.expectError(error.BadPayload, decodeSelectionReq(&bad));
		2740
		2741	const reply: SelectionReply = .{ .gesture = 9, .seq = 15, .source = 13, .history_rows = 69999, .status = .ok, .anchor = req.anchor, .active = req.active };
		2742	var out: std.ArrayList(u8) = .empty;
		2743	defer out.deinit(std.testing.allocator);
		2744	try encodeSelectionReply(&out, std.testing.allocator, reply);
		2745	try std.testing.expectEqualDeep(reply, try decodeSelectionReply(out.items));
		2746	try out.append(std.testing.allocator, 'x');
		2747	try std.testing.expectError(error.BadPayload, decodeSelectionReply(out.items));
		2748	}
		2749
		2750	test "selection status discriminants retain exact scalar prefixes" {
2722	const alloc = std.testing.allocator;	2751	const alloc = std.testing.allocator;
2723	const cases = [_]struct { status: SelectionStatus, wire: u8 }{	2752	const cases = [_]struct { status: SelectionStatus, wire: u8 }{
2724	.{ .status = .ok, .wire = 0 },	2753	.{ .status = .ok, .wire = 0 },
@@ -2729,11 +2758,11 @@ test "selection status discriminants have exact nine-byte golden replies" {
2729	for (cases) \|case\| {	2758	for (cases) \|case\| {
2730	var payload: std.ArrayList(u8) = .empty;	2759	var payload: std.ArrayList(u8) = .empty;
2731	defer payload.deinit(alloc);	2760	defer payload.deinit(alloc);
2732	try encodeSelectionReply(&payload, alloc, 0x01020304, case.status, 0x0a0b0c0d, "");	2761	try encodeSelectionReply(&payload, alloc, .{ .id = 0x01020304, .status = case.status, .history_rows = 0x0a0b0c0d, .text = "" });
2733	try std.testing.expectEqualSlices(	2762	try std.testing.expectEqualSlices(
2734	u8,	2763	u8,
2735	&.{ 0x04, 0x03, 0x02, 0x01, case.wire, 0x0d, 0x0c, 0x0b, 0x0a },	2764	&.{ 0x04, 0x03, 0x02, 0x01, case.wire, 0x0d, 0x0c, 0x0b, 0x0a },
2736	payload.items,	2765	payload.items[0..9],
2737	);	2766	);
2738	const reply = try decodeSelectionReply(payload.items);	2767	const reply = try decodeSelectionReply(payload.items);
2739	try std.testing.expectEqual(@as(u32, 0x01020304), reply.id);	2768	try std.testing.expectEqual(@as(u32, 0x01020304), reply.id);
@@ -2751,7 +2780,7 @@ test "selection text accepts the exact cap and rejects one byte more" {
2751		2780
2752	var payload: std.ArrayList(u8) = .empty;	2781	var payload: std.ArrayList(u8) = .empty;
2753	defer payload.deinit(alloc);	2782	defer payload.deinit(alloc);
2754	try encodeSelectionReply(&payload, alloc, 1, .ok, 0, at_cap);	2783	try encodeSelectionReply(&payload, alloc, .{ .id = 1, .status = .ok, .history_rows = 0, .text = at_cap });
2755	try std.testing.expectEqual(selection_reply_prefix_len + selection_text_max, payload.items.len);	2784	try std.testing.expectEqual(selection_reply_prefix_len + selection_text_max, payload.items.len);
2756	const decoded = try decodeSelectionReply(payload.items);	2785	const decoded = try decodeSelectionReply(payload.items);
2757	try std.testing.expectEqual(selection_text_max, decoded.text.len);	2786	try std.testing.expectEqual(selection_text_max, decoded.text.len);
@@ -2759,7 +2788,7 @@ test "selection text accepts the exact cap and rejects one byte more" {
2759	const over_cap = try alloc.alloc(u8, selection_text_max + 1);	2788	const over_cap = try alloc.alloc(u8, selection_text_max + 1);
2760	defer alloc.free(over_cap);	2789	defer alloc.free(over_cap);
2761	@memset(over_cap, 'x');	2790	@memset(over_cap, 'x');
2762	try std.testing.expectError(error.BadPayload, encodeSelectionReply(&payload, alloc, 1, .ok, 0, over_cap));	2791	try std.testing.expectError(error.BadPayload, encodeSelectionReply(&payload, alloc, .{ .id = 1, .status = .ok, .history_rows = 0, .text = over_cap }));
2763		2792
2764	var oversized_payload = try alloc.alloc(u8, selection_reply_prefix_len + selection_text_max + 1);	2793	var oversized_payload = try alloc.alloc(u8, selection_reply_prefix_len + selection_text_max + 1);
2765	defer alloc.free(oversized_payload);	2794	defer alloc.free(oversized_payload);
@@ -2776,20 +2805,20 @@ test "selection reply validation errors do not modify a reused output buffer" {
2776	defer payload.deinit(alloc);	2805	defer payload.deinit(alloc);
2777	try payload.appendSlice(alloc, "sentinel");	2806	try payload.appendSlice(alloc, "sentinel");
2778		2807
2779	try std.testing.expectError(error.BadPayload, encodeSelectionReply(&payload, alloc, 1, .invalid, 0, "x"));	2808	try std.testing.expectError(error.BadPayload, encodeSelectionReply(&payload, alloc, .{ .id = 1, .status = .invalid, .history_rows = 0, .text = "x" }));
2780	try std.testing.expectEqualStrings("sentinel", payload.items);	2809	try std.testing.expectEqualStrings("sentinel", payload.items);
2781	try std.testing.expectError(error.BadPayload, encodeSelectionReply(&payload, alloc, 1, .ok, 0, &.{0xff}));	2810	try std.testing.expectError(error.BadPayload, encodeSelectionReply(&payload, alloc, .{ .id = 1, .status = .ok, .history_rows = 0, .text = &.{0xff} }));
2782	try std.testing.expectEqualStrings("sentinel", payload.items);	2811	try std.testing.expectEqualStrings("sentinel", payload.items);
2783		2812
2784	const over_cap = try alloc.alloc(u8, selection_text_max + 1);	2813	const over_cap = try alloc.alloc(u8, selection_text_max + 1);
2785	defer alloc.free(over_cap);	2814	defer alloc.free(over_cap);
2786	@memset(over_cap, 'x');	2815	@memset(over_cap, 'x');
2787	try std.testing.expectError(error.BadPayload, encodeSelectionReply(&payload, alloc, 1, .ok, 0, over_cap));	2816	try std.testing.expectError(error.BadPayload, encodeSelectionReply(&payload, alloc, .{ .id = 1, .status = .ok, .history_rows = 0, .text = over_cap }));
2788	try std.testing.expectEqualStrings("sentinel", payload.items);	2817	try std.testing.expectEqualStrings("sentinel", payload.items);
2789	}	2818	}
2790		2819
2791	test "decoded selection text borrows the payload" {	2820	test "decoded selection text borrows the payload" {
2792	var payload = [_]u8{ 7, 0, 0, 0, 0, 3, 0, 0, 0, 'o', 'n', 'e' };	2821	var payload = [_]u8{ 7, 0, 0, 0, 0, 3, 0, 0, 0 } ++ [_]u8{0} ** 32 ++ [_]u8{ 'o', 'n', 'e' };
2793	const reply = try decodeSelectionReply(&payload);	2822	const reply = try decodeSelectionReply(&payload);
2794	try std.testing.expectEqualStrings("one", reply.text);	2823	try std.testing.expectEqualStrings("one", reply.text);
2795	payload[selection_reply_prefix_len] = 'O';	2824	payload[selection_reply_prefix_len] = 'O';
@@ -2799,8 +2828,8 @@ test "decoded selection text borrows the payload" {
2799	test "selection message values and fixed lengths are pinned" {	2828	test "selection message values and fixed lengths are pinned" {
2800	try std.testing.expectEqual(@as(u8, 0x0b), @intFromEnum(MsgType.selection_req));	2829	try std.testing.expectEqual(@as(u8, 0x0b), @intFromEnum(MsgType.selection_req));
2801	try std.testing.expectEqual(@as(u8, 0x90), @intFromEnum(MsgType.selection_reply));	2830	try std.testing.expectEqual(@as(u8, 0x90), @intFromEnum(MsgType.selection_reply));
2802	try std.testing.expectEqual(@as(usize, 16), selection_req_len);	2831	try std.testing.expectEqual(@as(usize, 37), selection_req_len);
2803	try std.testing.expectEqual(@as(usize, 9), selection_reply_prefix_len);	2832	try std.testing.expectEqual(@as(usize, 41), selection_reply_prefix_len);
2804	try std.testing.expectEqual(@as(usize, 1024 * 1024), selection_text_max);	2833	try std.testing.expectEqual(@as(usize, 1024 * 1024), selection_text_max);
2805	}	2834	}
2806		2835

src/gui/config.zig

Old		New
@@ -1,5 +1,6 @@
1	//! Small, explicit native appearance and font configuration parser.	1	//! Small, explicit native appearance and font configuration parser.
2	const std = @import("std");	2	const std = @import("std");
		3	const font_options = @import("font_options.zig");
3		4
4	pub const Settings = struct {	5	pub const Settings = struct {
5	family: ?[:0]const u8 = null,	6	family: ?[:0]const u8 = null,
@@ -32,8 +33,6 @@ pub fn parsePalette(text: []const u8) Error!PalettePair {
32	return .{ .index = index, .color = parseColor(std.mem.trim(u8, text[eq + 1 ..], " \t")) catch return error.InvalidPalette };	33	return .{ .index = index, .color = parseColor(std.mem.trim(u8, text[eq + 1 ..], " \t")) catch return error.InvalidPalette };
33	}	34	}
34		35
35	// 192pt is the largest accepted size: at Linux's 96 DPI it is 256px at 100%.
36
37	fn valueText(raw: []const u8, alloc: std.mem.Allocator) Error![:0]const u8 {	36	fn valueText(raw: []const u8, alloc: std.mem.Allocator) Error![:0]const u8 {
38	var value = raw;	37	var value = raw;
39	if (value.len >= 2 and value[0] == '"' and value[value.len - 1] == '"') value = value[1 .. value.len - 1];	38	if (value.len >= 2 and value[0] == '"' and value[value.len - 1] == '"') value = value[1 .. value.len - 1];
@@ -70,20 +69,11 @@ pub fn parse(alloc: std.mem.Allocator, bytes: []const u8, line_out: ?*usize) Err
70	return error.InvalidSyntax;	69	return error.InvalidSyntax;
71	}	70	}
72	out.family = try valueText(value, alloc);	71	out.family = try valueText(value, alloc);
73	if (out.family.?.len == 0) {
74	return error.MissingFamily;
75	}
76	} else if (std.mem.eql(u8, key, "font-size")) {	72	} else if (std.mem.eql(u8, key, "font-size")) {
77	if (out.size_points != null) {	73	if (out.size_points != null) {
78	return error.InvalidSyntax;	74	return error.InvalidSyntax;
79	}	75	}
80	const points = std.fmt.parseFloat(f64, value) catch {	76	out.size_points = font_options.parsePointSize(value) catch return error.InvalidValue;
81	return error.InvalidValue;
82	};
83	if (!std.math.isFinite(points) or points < 1 or points > 192) {
84	return error.InvalidValue;
85	}
86	out.size_points = points;
87	} else if (std.mem.eql(u8, key, "theme")) {	77	} else if (std.mem.eql(u8, key, "theme")) {
88	if (out.theme != null) return error.InvalidSyntax;	78	if (out.theme != null) return error.InvalidSyntax;
89	out.theme = valueText(value, alloc) catch \|err\| return if (err == error.MissingFamily) error.InvalidThemeName else err;	79	out.theme = valueText(value, alloc) catch \|err\| return if (err == error.MissingFamily) error.InvalidThemeName else err;

src/gui/font_options.zig

@@ @@ -0,0 +1,19 @@ @@
+//! Shared font option validation for config files and native CLI flags.
+const std = @import("std");
+pub const Error = error{InvalidValue};
+/// Ghostty-style point size: finite, inclusive range 1–192 points.
+/// The upper limit is 256 pixels at Linux's 96 DPI and 100% display scale.
+pub fn parsePointSize(text: []const u8) Error!f64 {
+    const value = std.fmt.parseFloat(f64, text) catch return error.InvalidValue;
+    if (!std.math.isFinite(value) or value < 1 or value > 192) return error.InvalidValue;
+    return value;
+}
+test "point size validation is shared and bounded" {
+    try std.testing.expectEqual(@as(f64, 12.5), try parsePointSize("12.5"));
+    try std.testing.expectError(error.InvalidValue, parsePointSize("nan"));
+    try std.testing.expectError(error.InvalidValue, parsePointSize("0"));
+    try std.testing.expectError(error.InvalidValue, parsePointSize("193"));
+}

src/gui/frame.zig

Old		New
@@ -12,7 +12,7 @@ const interaction = native_core.interaction;
12	const font = @import("font.zig");	12	const font = @import("font.zig");
13	const atlas = @import("atlas.zig");	13	const atlas = @import("atlas.zig");
14	const quads = @import("quads.zig");	14	const quads = @import("quads.zig");
15	const theme_mod = @import("theme.zig");	15	const theme_mod = native_core.theme;
16	const gl = @import("gl.zig");	16	const gl = @import("gl.zig");
17	const bench = @import("bench.zig");	17	const bench = @import("bench.zig");
18		18
@@ -87,17 +87,31 @@ pub const Hook = union(enum) {
87	text: []const u8,	87	text: []const u8,
88	key: struct { code: u32, mods: u16 = 0 },	88	key: struct { code: u32, mods: u16 = 0 },
89	click: struct { x: f32, y: f32 },	89	click: struct { x: f32, y: f32 },
90	pointer: struct { kind: enum { down, motion, up }, x: f32, y: f32 },	90	pointer: struct { kind: enum { down, motion, up }, x: f32, y: f32, button: u8 = 0, mods: ?u8 = null },
		91	wheel: struct { x: f32, y: f32, delta: f32, flipped: bool = false },
91	state: []const u8,	92	state: []const u8,
92	resize: struct { w: u32, h: u32 },	93	resize: struct { w: u32, h: u32 },
93	capture: []const u8,	94	capture: []const u8,
94	capture_last: []const u8,	95	capture_last: []const u8,
		96	clipboard: []const u8,
		97	primary: []const u8,
95	quit,	98	quit,
96	};	99	};
97		100
98	pub fn parseHook(line: []const u8) ?Hook {	101	pub fn parseHook(line: []const u8) ?Hook {
99	if (std.mem.eql(u8, line, "quit")) return .quit;	102	if (std.mem.eql(u8, line, "quit")) return .quit;
100	if (std.mem.startsWith(u8, line, "state:")) return .{ .state = line[6..] };	103	if (std.mem.startsWith(u8, line, "state:")) return .{ .state = line[6..] };
		104	if (std.mem.startsWith(u8, line, "mouse:")) {
		105	var it = std.mem.splitScalar(u8, line[6..], ',');
		106	const name = it.next() orelse return null;
		107	const kind: @FieldType(@FieldType(Hook, "pointer"), "kind") = if (std.mem.eql(u8, name, "down")) .down else if (std.mem.eql(u8, name, "move")) .motion else if (std.mem.eql(u8, name, "up")) .up else return null;
		108	const x = std.fmt.parseFloat(f32, it.next() orelse return null) catch return null;
		109	const y = std.fmt.parseFloat(f32, it.next() orelse return null) catch return null;
		110	const button = std.fmt.parseInt(u8, it.next() orelse return null, 10) catch return null;
		111	const mods = std.fmt.parseInt(u8, it.next() orelse return null, 10) catch return null;
		112	if (button > 2 or mods > 7 or it.next() != null) return null;
		113	return .{ .pointer = .{ .kind = kind, .x = x, .y = y, .button = button, .mods = mods } };
		114	}
101	inline for (.{ .{ "mousedown:", .down }, .{ "mousemove:", .motion }, .{ "mouseup:", .up } }) \|entry\| {	115	inline for (.{ .{ "mousedown:", .down }, .{ "mousemove:", .motion }, .{ "mouseup:", .up } }) \|entry\| {
102	if (std.mem.startsWith(u8, line, entry[0])) {	116	if (std.mem.startsWith(u8, line, entry[0])) {
103	const comma = std.mem.indexOfScalar(u8, line, ',') orelse return null;	117	const comma = std.mem.indexOfScalar(u8, line, ',') orelse return null;
@@ -105,6 +119,16 @@ pub fn parseHook(line: []const u8) ?Hook {
105	}	119	}
106	}	120	}
107	if (std.mem.startsWith(u8, line, "capture-last:")) return .{ .capture_last = line[13..] };	121	if (std.mem.startsWith(u8, line, "capture-last:")) return .{ .capture_last = line[13..] };
		122	if (std.mem.startsWith(u8, line, "primary:")) return .{ .primary = line[8..] };
		123	if (std.mem.startsWith(u8, line, "clipboard:")) return .{ .clipboard = line[10..] };
		124	if (std.mem.startsWith(u8, line, "wheel:")) {
		125	var it = std.mem.splitScalar(u8, line[6..], ',');
		126	const x = std.fmt.parseFloat(f32, it.next() orelse return null) catch return null;
		127	const y = std.fmt.parseFloat(f32, it.next() orelse return null) catch return null;
		128	const delta = std.fmt.parseFloat(f32, it.next() orelse return null) catch return null;
		129	const flipped = if (it.next()) \|v\| std.mem.eql(u8, v, "flipped") else false;
		130	return .{ .wheel = .{ .x = x, .y = y, .delta = delta, .flipped = flipped } };
		131	}
108	if (std.mem.startsWith(u8, line, "click:")) {	132	if (std.mem.startsWith(u8, line, "click:")) {
109	const comma = std.mem.indexOfScalar(u8, line, ',') orelse return null;	133	const comma = std.mem.indexOfScalar(u8, line, ',') orelse return null;
110	return .{ .click = .{ .x = std.fmt.parseFloat(f32, line[6..comma]) catch return null, .y = std.fmt.parseFloat(f32, line[comma + 1 ..]) catch return null } };	134	return .{ .click = .{ .x = std.fmt.parseFloat(f32, line[6..comma]) catch return null, .y = std.fmt.parseFloat(f32, line[comma + 1 ..]) catch return null } };
@@ -114,6 +138,8 @@ pub fn parseHook(line: []const u8) ?Hook {
114	if (std.mem.startsWith(u8, line, "key:")) {	138	if (std.mem.startsWith(u8, line, "key:")) {
115	const name = line["key:".len..];	139	const name = line["key:".len..];
116	if (std.mem.eql(u8, name, "prefix")) return .{ .key = .{ .code = c.SDLK_BACKSLASH, .mods = c.SDL_KMOD_CTRL } };	140	if (std.mem.eql(u8, name, "prefix")) return .{ .key = .{ .code = c.SDLK_BACKSLASH, .mods = c.SDL_KMOD_CTRL } };
		141	if (std.mem.eql(u8, name, "copy")) return .{ .key = .{ .code = c.SDLK_C, .mods = c.SDL_KMOD_CTRL \| c.SDL_KMOD_SHIFT } };
		142	if (std.mem.eql(u8, name, "interrupt")) return .{ .key = .{ .code = c.SDLK_C, .mods = c.SDL_KMOD_CTRL } };
117	if (name.len == 1 and std.mem.indexOfScalar(u8, "hjklvbrdxp", name[0]) != null) return .{ .key = .{ .code = name[0] } };	143	if (name.len == 1 and std.mem.indexOfScalar(u8, "hjklvbrdxp", name[0]) != null) return .{ .key = .{ .code = name[0] } };
118	inline for (.{ .{ "enter", c.SDLK_RETURN }, .{ "tab", c.SDLK_TAB }, .{ "escape", c.SDLK_ESCAPE }, .{ "backspace", c.SDLK_BACKSPACE }, .{ "up", c.SDLK_UP }, .{ "down", c.SDLK_DOWN }, .{ "left", c.SDLK_LEFT }, .{ "right", c.SDLK_RIGHT } }) \|pair\| {	144	inline for (.{ .{ "enter", c.SDLK_RETURN }, .{ "tab", c.SDLK_TAB }, .{ "escape", c.SDLK_ESCAPE }, .{ "backspace", c.SDLK_BACKSPACE }, .{ "up", c.SDLK_UP }, .{ "down", c.SDLK_DOWN }, .{ "left", c.SDLK_LEFT }, .{ "right", c.SDLK_RIGHT } }) \|pair\| {
119	if (std.mem.eql(u8, name, pair[0])) return .{ .key = .{ .code = pair[1] } };	145	if (std.mem.eql(u8, name, pair[0])) return .{ .key = .{ .code = pair[1] } };
@@ -249,6 +275,15 @@ const HookReader = struct {
249	ev.button.type = c.SDL_EVENT_MOUSE_BUTTON_UP;	275	ev.button.type = c.SDL_EVENT_MOUSE_BUTTON_UP;
250	},	276	},
251	.pointer => \|at\| {	277	.pointer => \|at\| {
		278	if (at.mods) \|mods\| {
		279	// Queue modifier state with the ordinary SDL event, so
		280	// multiple FIFO gestures retain their own event ordering.
		281	ev.user.type = c.SDL_EVENT_USER;
		282	ev.user.code = 0x4d4f4453;
		283	ev.user.data1 = @ptrFromInt(@as(usize, mods));
		284	if (!c.SDL_PushEvent(&ev)) return error.EventInjectionFailed;
		285	ev = std.mem.zeroes(c.SDL_Event);
		286	}
252	if (at.kind == .motion) {	287	if (at.kind == .motion) {
253	ev.motion.type = c.SDL_EVENT_MOUSE_MOTION;	288	ev.motion.type = c.SDL_EVENT_MOUSE_MOTION;
254	ev.motion.state = c.SDL_BUTTON_LMASK;	289	ev.motion.state = c.SDL_BUTTON_LMASK;
@@ -256,11 +291,25 @@ const HookReader = struct {
256	ev.motion.y = at.y;	291	ev.motion.y = at.y;
257	} else {	292	} else {
258	ev.button.type = if (at.kind == .down) c.SDL_EVENT_MOUSE_BUTTON_DOWN else c.SDL_EVENT_MOUSE_BUTTON_UP;	293	ev.button.type = if (at.kind == .down) c.SDL_EVENT_MOUSE_BUTTON_DOWN else c.SDL_EVENT_MOUSE_BUTTON_UP;
259	ev.button.button = c.SDL_BUTTON_LEFT;	294	ev.button.button = switch (at.button) {
		295	1 => c.SDL_BUTTON_MIDDLE,
		296	2 => c.SDL_BUTTON_RIGHT,
		297	else => c.SDL_BUTTON_LEFT,
		298	};
260	ev.button.x = at.x;	299	ev.button.x = at.x;
261	ev.button.y = at.y;	300	ev.button.y = at.y;
262	}	301	}
263	},	302	},
		303	.wheel => \|at\| {
		304	ev.wheel.type = c.SDL_EVENT_MOUSE_WHEEL;
		305	ev.wheel.mouse_x = at.x;
		306	ev.wheel.mouse_y = at.y;
		307	ev.wheel.x = 0;
		308	ev.wheel.y = at.delta;
		309	ev.wheel.integer_x = 0;
		310	ev.wheel.integer_y = 0;
		311	ev.wheel.direction = if (at.flipped) c.SDL_MOUSEWHEEL_FLIPPED else c.SDL_MOUSEWHEEL_NORMAL;
		312	},
264	.state => \|path\| {	313	.state => \|path\| {
265	const copy = try self.alloc.dupe(u8, path);	314	const copy = try self.alloc.dupe(u8, path);
266	if (self.state) \|old\| self.alloc.free(old);	315	if (self.state) \|old\| self.alloc.free(old);
@@ -284,6 +333,14 @@ const HookReader = struct {
284	self.capture_last = copy;	333	self.capture_last = copy;
285	return;	334	return;
286	},	335	},
		336	.clipboard, .primary => \|path\| {
		337	const text = (if (hook == .primary) c.SDL_GetPrimarySelectionText() else c.SDL_GetClipboardText()) orelse return error.ClipboardReadFailed;
		338	defer c.SDL_free(@ptrCast(text));
		339	const file = try std.fs.cwd().createFile(path, .{ .truncate = true });
		340	defer file.close();
		341	try file.writeAll(std.mem.span(text));
		342	return;
		343	},
287	.quit => ev.type = c.SDL_EVENT_QUIT,	344	.quit => ev.type = c.SDL_EVENT_QUIT,
288	}	345	}
289	if (!c.SDL_PushEvent(&ev)) {	346	if (!c.SDL_PushEvent(&ev)) {
@@ -319,7 +376,7 @@ const Events = struct {
319	self.syncCapture();	376	self.syncCapture();
320	}	377	}
321	fn syncCapture(self: *Events) void {	378	fn syncCapture(self: *Events) void {
322	const capturing = self.ui.drag != null;	379	const capturing = self.ui.hasPointerCapture();
323	if (self.captured != capturing) {	380	if (self.captured != capturing) {
324	_ = c.SDL_CaptureMouse(capturing);	381	_ = c.SDL_CaptureMouse(capturing);
325	self.captured = capturing;	382	self.captured = capturing;
@@ -328,7 +385,7 @@ const Events = struct {
328	/// Commit events sample the actual drawable even if its resize notice	385	/// Commit events sample the actual drawable even if its resize notice
329	/// is still behind this event in SDL's bounded queue.	386	/// is still behind this event in SDL's bounded queue.
330	fn dispatch(self: *Events, ev: c.SDL_Event) !bool {	387	fn dispatch(self: *Events, ev: c.SDL_Event) !bool {
331	if ((ev.type == c.SDL_EVENT_KEY_DOWN and (self.ui.resize_mode or ev.key.key == c.SDLK_RETURN or ev.key.key == c.SDLK_KP_ENTER)) or ev.type == c.SDL_EVENT_MOUSE_BUTTON_DOWN or (self.ui.drag != null and (ev.type == c.SDL_EVENT_MOUSE_MOTION or ev.type == c.SDL_EVENT_MOUSE_BUTTON_UP))) {	388	if ((ev.type == c.SDL_EVENT_KEY_DOWN and (self.ui.resize_mode or ev.key.key == c.SDLK_RETURN or ev.key.key == c.SDLK_KP_ENTER)) or ev.type == c.SDL_EVENT_MOUSE_BUTTON_DOWN or ev.type == c.SDL_EVENT_MOUSE_WHEEL or ((self.ui.hasPointerCapture()) and (ev.type == c.SDL_EVENT_MOUSE_MOTION or ev.type == c.SDL_EVENT_MOUSE_BUTTON_UP))) {
332	self.geometry_dirty = true;	389	self.geometry_dirty = true;
333	try self.refreshGeometry();	390	try self.refreshGeometry();
334	}	391	}
@@ -346,27 +403,48 @@ const Events = struct {
346	c.SDL_EVENT_KEY_DOWN => try self.ui.keyDown(interactionKey(ev.key)),	403	c.SDL_EVENT_KEY_DOWN => try self.ui.keyDown(interactionKey(ev.key)),
347	c.SDL_EVENT_KEY_UP => self.ui.keyUp(ev.key.key),	404	c.SDL_EVENT_KEY_UP => self.ui.keyUp(ev.key.key),
348	c.SDL_EVENT_WINDOW_FOCUS_LOST => self.ui.focusLost(),	405	c.SDL_EVENT_WINDOW_FOCUS_LOST => self.ui.focusLost(),
349	c.SDL_EVENT_MOUSE_BUTTON_DOWN => if (ev.button.button == c.SDL_BUTTON_LEFT) {	406	c.SDL_EVENT_USER => if (ev.user.code == 0x4d4f4453) {
		407	const mods = @intFromPtr(ev.user.data1);
		408	c.SDL_SetModState(@as(c.SDL_Keymod, if (mods & 1 != 0) c.SDL_KMOD_SHIFT else 0) \| @as(c.SDL_Keymod, if (mods & 2 != 0) c.SDL_KMOD_ALT else 0) \| @as(c.SDL_Keymod, if (mods & 4 != 0) c.SDL_KMOD_CTRL else 0));
		409	},
		410	c.SDL_EVENT_MOUSE_BUTTON_DOWN => {
		411	const button = mouseButton(ev.button.button) orelse return true;
350	var w: c_int = 0;	412	var w: c_int = 0;
351	var h: c_int = 0;	413	var h: c_int = 0;
352	if (c.SDL_GetWindowSize(self.win, &w, &h)) {	414	if (c.SDL_GetWindowSize(self.win, &w, &h)) {
353	const at = physicalPoint(ev.button.x, ev.button.y, w, h, self.ui.fb_w, self.ui.fb_h);	415	const at = physicalPoint(ev.button.x, ev.button.y, w, h, self.ui.fb_w, self.ui.fb_h);
354	try self.ui.pointerDown(at.x, at.y, grabPixels(w, self.ui.fb_w), grabPixels(h, self.ui.fb_h));	416	try self.ui.mouseDown(at.x, at.y, grabPixels(w, self.ui.fb_w), grabPixels(h, self.ui.fb_h), button, mouseMods());
		417	}
		418	},
		419	c.SDL_EVENT_MOUSE_WHEEL => {
		420	var w: c_int = 0;
		421	var h: c_int = 0;
		422	if (c.SDL_GetWindowSize(self.win, &w, &h)) {
		423	const at = physicalPoint(ev.wheel.mouse_x, ev.wheel.mouse_y, w, h, self.ui.fb_w, self.ui.fb_h);
		424	try self.ui.wheel(at.x, at.y, ev.wheel.y, ev.wheel.direction == c.SDL_MOUSEWHEEL_FLIPPED, mouseMods());
355	}	425	}
356	},	426	},
357	c.SDL_EVENT_MOUSE_MOTION, c.SDL_EVENT_MOUSE_BUTTON_UP => {	427	c.SDL_EVENT_MOUSE_MOTION, c.SDL_EVENT_MOUSE_BUTTON_UP => {
358	if (ev.type == c.SDL_EVENT_MOUSE_BUTTON_UP and ev.button.button != c.SDL_BUTTON_LEFT) return true;	428	const motion = ev.type == c.SDL_EVENT_MOUSE_MOTION;
359	if (self.ui.drag != null) {	429	const button = if (motion) 0 else mouseButton(ev.button.button) orelse return true;
360	var w: c_int = 0;	430	var w: c_int = 0;
361	var h: c_int = 0;	431	var h: c_int = 0;
362	if (c.SDL_GetWindowSize(self.win, &w, &h)) {	432	if (c.SDL_GetWindowSize(self.win, &w, &h)) {
363	const motion = ev.type == c.SDL_EVENT_MOUSE_MOTION;	433	const x = physicalSignedAxis(if (motion) ev.motion.x else ev.button.x, w, self.ui.fb_w);
364	const x = physicalSignedAxis(if (motion) ev.motion.x else ev.button.x, w, self.ui.fb_w);	434	const y = physicalSignedAxis(if (motion) ev.motion.y else ev.button.y, h, self.ui.fb_h);
365	const y = physicalSignedAxis(if (motion) ev.motion.y else ev.button.y, h, self.ui.fb_h);	435	if (x != null and y != null) {
366	if (x != null and y != null) try self.ui.pointerMove(x.?, y.?);	436	if (motion) try self.ui.mouseMove(x.?, y.?, mouseMods()) else {
		437	if (button == 0 and self.ui.drag != null) try self.ui.pointerMove(x.?, y.?);
		438	try self.ui.mouseUp(@intCast(@max(x.?, 0)), @intCast(@max(y.?, 0)), button, mouseMods());
		439	}
		440	} else if (self.ui.app_drag != null) {
		441	self.ui.cancelMouse();
		442	} else if (motion) {
		443	try self.ui.pointerMove(-1, -1);
		444	} else if (button == 0) {
		445	try self.ui.mouseUp(0, 0, button, mouseMods());
367	}	446	}
368	}	447	}
369	if (ev.type == c.SDL_EVENT_MOUSE_BUTTON_UP) self.ui.cancelDrag();
370	},	448	},
371	c.SDL_EVENT_WINDOW_PIXEL_SIZE_CHANGED, c.SDL_EVENT_WINDOW_RESIZED, c.SDL_EVENT_WINDOW_DISPLAY_SCALE_CHANGED => self.geometry_dirty = true,	449	c.SDL_EVENT_WINDOW_PIXEL_SIZE_CHANGED, c.SDL_EVENT_WINDOW_RESIZED, c.SDL_EVENT_WINDOW_DISPLAY_SCALE_CHANGED => self.geometry_dirty = true,
372	c.SDL_EVENT_WINDOW_EXPOSED => self.ui.dirty = true,	450	c.SDL_EVENT_WINDOW_EXPOSED => self.ui.dirty = true,
@@ -384,7 +462,10 @@ const Events = struct {
384	var logical_w: c_int = 0;	462	var logical_w: c_int = 0;
385	var logical_h: c_int = 0;	463	var logical_h: c_int = 0;
386	if (!c.SDL_GetWindowSize(self.win, &logical_w, &logical_h)) return error.WindowSizeFailed;	464	if (!c.SDL_GetWindowSize(self.win, &logical_w, &logical_h)) return error.WindowSizeFailed;
387	if (logical_w != self.logical_w or logical_h != self.logical_h) self.ui.cancelDrag();	465	if (logical_w != self.logical_w or logical_h != self.logical_h) {
		466	self.ui.cancelDrag();
		467	self.ui.clearSelection();
		468	}
388	self.logical_w = logical_w;	469	self.logical_w = logical_w;
389	self.logical_h = logical_h;	470	self.logical_h = logical_h;
390	try self.updateGeometry(w, h, c.SDL_GetWindowDisplayScale(self.win));	471	try self.updateGeometry(w, h, c.SDL_GetWindowDisplayScale(self.win));
@@ -418,6 +499,7 @@ fn grabPixels(logical: c_int, pixels: c_int) u32 {
418	fn interactionKey(ev: c.SDL_KeyboardEvent) interaction.KeyDown {	499	fn interactionKey(ev: c.SDL_KeyboardEvent) interaction.KeyDown {
419	const translated = if (ev.scancode != c.SDL_SCANCODE_UNKNOWN) c.SDL_GetKeyFromScancode(ev.scancode, ev.mod, false) else ev.key;	500	const translated = if (ev.scancode != c.SDL_SCANCODE_UNKNOWN) c.SDL_GetKeyFromScancode(ev.scancode, ev.mod, false) else ev.key;
420	const prefix = ev.key == c.SDLK_BACKSLASH and ev.mod & c.SDL_KMOD_CTRL != 0 and ev.mod & (c.SDL_KMOD_ALT \| c.SDL_KMOD_GUI \| c.SDL_KMOD_MODE) == 0;	501	const prefix = ev.key == c.SDLK_BACKSLASH and ev.mod & c.SDL_KMOD_CTRL != 0 and ev.mod & (c.SDL_KMOD_ALT \| c.SDL_KMOD_GUI \| c.SDL_KMOD_MODE) == 0;
		502	const copy = ev.key == c.SDLK_C and ev.mod & c.SDL_KMOD_CTRL != 0 and ev.mod & c.SDL_KMOD_SHIFT != 0 and ev.mod & (c.SDL_KMOD_ALT \| c.SDL_KMOD_GUI \| c.SDL_KMOD_MODE) == 0;
421	return .{	503	return .{
422	.code = ev.key,	504	.code = ev.key,
423	.kind = switch (ev.key) {	505	.kind = switch (ev.key) {
@@ -444,6 +526,7 @@ fn interactionKey(ev: c.SDL_KeyboardEvent) interaction.KeyDown {
444	.prefix = prefix,	526	.prefix = prefix,
445	.modified = ev.mod & (c.SDL_KMOD_CTRL \| c.SDL_KMOD_ALT \| c.SDL_KMOD_GUI) != 0,	527	.modified = ev.mod & (c.SDL_KMOD_CTRL \| c.SDL_KMOD_ALT \| c.SDL_KMOD_GUI) != 0,
446	.repeat = ev.repeat,	528	.repeat = ev.repeat,
		529	.copy = copy,
447	.terminal = keyEvent(if (prefix) ev.key else translated, ev.mod),	530	.terminal = keyEvent(if (prefix) ev.key else translated, ev.mod),
448	};	531	};
449	}	532	}
@@ -555,7 +638,19 @@ pub fn run(alloc: std.mem.Allocator, opts: Options) !u8 {
555	try events.refreshGeometry();	638	try events.refreshGeometry();
556	if (usr1_seen.swap(false, .acq_rel)) report(&ring);	639	if (usr1_seen.swap(false, .acq_rel)) report(&ring);
557	const now = std.time.milliTimestamp();	640	const now = std.time.milliTimestamp();
558	events.ui.dirty = rt.poll(now) or events.ui.dirty;	641	events.ui.dirty = events.ui.poll(now) or events.ui.dirty;
		642	// Every effect is drained from its source attachment; focus does not
		643	// redirect another pane's write into a selection request.
		644	for (events.ui.rt.lives) \|slot\| if (slot) \|live\| {
		645	inline for (.{ false, true }) \|primary\| if (live.pump.takeClipboard(primary)) \|text\| {
		646	defer alloc.free(text);
		647	try setClipboard(&events.ui, text, primary);
		648	};
		649	};
		650	if (events.ui.takeSelectionText()) \|text\| {
		651	defer alloc.free(text);
		652	try setClipboard(&events.ui, text, false);
		653	}
559	try events.ui.pollEnd();	654	try events.ui.pollEnd();
560	events.syncCapture();	655	events.syncCapture();
561	if (events.ui.picker) \|picker\| if (picker.job) \|job\| if (job.done.load(.acquire)) {	656	if (events.ui.picker) \|picker\| if (picker.job) \|job\| if (job.done.load(.acquire)) {
@@ -627,7 +722,10 @@ pub fn run(alloc: std.mem.Allocator, opts: Options) !u8 {
627	ctx.y0 = @floatFromInt(p.content.y);	722	ctx.y0 = @floatFromInt(p.content.y);
628	const bg_start = lists.backgrounds.items.len;	723	const bg_start = lists.backgrounds.items.len;
629	const fg_start = lists.foregrounds.items.len;	724	const fg_start = lists.foregrounds.items.len;
630	for (0..grid.rows) \|y\| visible_blink = (try quads.rowInstances(&lists, alloc, grid.row(@intCast(y)), grid.cols, 0, @intCast(y), ctx)) or visible_blink;	725	for (0..grid.rows) \|y\| {
		726	ctx.selection = if (events.ui.selectedSpan(p.id, live.view_origin + @as(u32, @intCast(y)), grid.cols)) \|s\| .{ .from = s.from, .to = s.to } else null;
		727	visible_blink = (try quads.rowInstances(&lists, alloc, grid.row(@intCast(y)), grid.cols, 0, @intCast(y), ctx)) or visible_blink;
		728	}
631	if (rt.workspace.tab().focus == p.id and grid.cursor.x < grid.cols and grid.cursor.y < grid.rows) try lists.foregrounds.append(alloc, quads.cursorInstance(grid.cursor.x, grid.cursor.y, ctx));	729	if (rt.workspace.tab().focus == p.id and grid.cursor.x < grid.cols and grid.cursor.y < grid.rows) try lists.foregrounds.append(alloc, quads.cursorInstance(grid.cursor.x, grid.cursor.y, ctx));
632	clipPane(&lists, bg_start, fg_start, model.Rect.intersect(p.content, p.visible));	730	clipPane(&lists, bg_start, fg_start, model.Rect.intersect(p.content, p.visible));
633	ctx.x0 = @floatFromInt(p.header.x);	731	ctx.x0 = @floatFromInt(p.header.x);
@@ -860,6 +958,26 @@ test "pending End header stays with its origin and rejects stale generations" {
860	events.ui.pending_end = null;	958	events.ui.pending_end = null;
861	}	959	}
862		960
		961	fn mouseButton(button: u8) ?u8 {
		962	return switch (button) {
		963	c.SDL_BUTTON_LEFT => 0,
		964	c.SDL_BUTTON_MIDDLE => 1,
		965	c.SDL_BUTTON_RIGHT => 2,
		966	else => null,
		967	};
		968	}
		969	fn mouseMods() keymap.Mods {
		970	const mods = c.SDL_GetModState();
		971	return .{ .shift = mods & c.SDL_KMOD_SHIFT != 0, .ctrl = mods & c.SDL_KMOD_CTRL != 0, .alt = mods & c.SDL_KMOD_ALT != 0 };
		972	}
		973	fn setClipboard(ui: *interaction.Controller, text: []const u8, primary: bool) !void {
		974	if (!client.core.validClipboardText(text)) return;
		975	const z = try ui.rt.alloc.dupeZ(u8, text);
		976	defer ui.rt.alloc.free(z);
		977	const ok = if (primary) c.SDL_SetPrimarySelectionText(z.ptr) else c.SDL_SetClipboardText(z.ptr);
		978	if (!ok) ui.setNotice("Clipboard update failed");
		979	}
		980
863	const Header = struct {	981	const Header = struct {
864	bytes: [512]u8 = undefined,	982	bytes: [512]u8 = undefined,
865	cells: [512]term.grid.Cell = undefined,	983	cells: [512]term.grid.Cell = undefined,
@@ -1224,6 +1342,28 @@ test "command key text is consumed and subsequent ordinary text is not suppresse
1224	try std.testing.expectEqualSlices(u8, &.{0x1c}, keymap.encode(keyEvent(c.SDLK_BACKSLASH, event.key.mod).?, &bytes));	1342	try std.testing.expectEqualSlices(u8, &.{0x1c}, keymap.encode(keyEvent(c.SDLK_BACKSLASH, event.key.mod).?, &bytes));
1225	}	1343	}
1226		1344
		1345	test "copy chord is exact while plain interrupt remains terminal input" {
		1346	var copy_event = std.mem.zeroes(c.SDL_KeyboardEvent);
		1347	copy_event.key = c.SDLK_C;
		1348	copy_event.mod = c.SDL_KMOD_CTRL \| c.SDL_KMOD_SHIFT;
		1349	const copy = interactionKey(copy_event);
		1350	try std.testing.expect(copy.copy);
		1351	var interrupt_event = copy_event;
		1352	interrupt_event.mod = c.SDL_KMOD_CTRL;
		1353	const interrupt = interactionKey(interrupt_event);
		1354	try std.testing.expect(!interrupt.copy);
		1355	try std.testing.expect(interrupt.terminal != null);
		1356	for ([_]u16{ c.SDL_KMOD_LCTRL \| c.SDL_KMOD_LSHIFT, c.SDL_KMOD_RCTRL \| c.SDL_KMOD_RSHIFT, c.SDL_KMOD_LCTRL \| c.SDL_KMOD_RSHIFT, c.SDL_KMOD_RCTRL \| c.SDL_KMOD_LSHIFT }) \|mods\| {
		1357	copy_event.mod = mods;
		1358	try std.testing.expect(interactionKey(copy_event).copy);
		1359	}
		1360	for ([_]u16{ c.SDL_KMOD_ALT, c.SDL_KMOD_GUI, c.SDL_KMOD_MODE, c.SDL_KMOD_RALT }) \|extra\| {
		1361	var excluded = copy_event;
		1362	excluded.mod \|= extra;
		1363	try std.testing.expect(!interactionKey(excluded).copy);
		1364	}
		1365	}
		1366
1227	test "later pane atlas growth precedes earlier pane UV generation" {	1367	test "later pane atlas growth precedes earlier pane UV generation" {
1228	const a = std.testing.allocator;	1368	const a = std.testing.allocator;
1229	var face = try font.Face.open(16);	1369	var face = try font.Face.open(16);

src/gui/interaction.zig

@@ @@ -19,9 +19,21 @@ pub const KeyDown = struct { @@
+    prefix: bool = false,
+    modified: bool = false,
+    repeat: bool = false,
+    copy: bool = false,
+    terminal: ?keymap.Event = null,
+};
+pub const PendingEnd = struct { key: model.Attachment, request: u64 };
+pub const Wheel = struct {
+    fraction: f32 = 0,
+    /// Convert native wheel lines into whole terminal notches, retaining input.
+    pub fn notches(self: *Wheel, delta: f32, flipped: bool) i32 {
+        if (!std.math.isFinite(delta)) return 0;
+        self.fraction += std.math.clamp(if (flipped) -delta else delta, -1024, 1024);
+        const whole = @trunc(self.fraction);
+        self.fraction -= whole;
+        return @intFromFloat(whole);
+    }
+};
+pub const Recovery = struct {
+    kind: enum { recovery, force_end },
@@ @@ -80,6 +92,14 @@ pub const Controller = struct { @@
+    resize_mode: bool = false,
+    modal_held: std.AutoHashMapUnmanaged(u32, void) = .empty,
+    drag: ?struct { id: model.DividerId, tab: model.TabId, offset: i64, changed: bool = false } = null,
+    selection_drag: client.selection.Drag = .{},
+    app_drag: ?struct { key: model.Attachment, token: client.session_pump.MouseToken, button: u8 } = null,
+    local_held: bool = false,
+    wheel_remainder: [model.max_panes]struct { key: ?model.Attachment = null, wheel: Wheel = .{} } = @splat(.{}),
+    selection_key: ?model.Attachment = null,
+    selection_request: u32 = 0,
+    selection_gesture: u32 = 0,
+    selection_version: client.session_pump.SelectionVersion = .{ .seq = 0, .history_rows = 0, .epoch = 0, .revision = 0 },
+    consumed_key: ?u32 = null,
+    notice: []const u8 = "",
@@ @@ -88,11 +108,97 @@ pub const Controller = struct { @@
+    pub fn deinit(self: *Controller) void {
+        if (self.pending_end != null) std.debug.print("muxg: End was still pending; its remote outcome is unknown\n", .{});
+        self.cancelDrag();
+        self.clearSelection();
+        self.modal_held.deinit(self.rt.alloc);
+        if (self.picker) |picker| picker.deinit();
+    pub fn hasPointerCapture(self: *const Controller) bool {
+        return self.drag != null or self.selection_drag.buttonHeld() or self.app_drag != null or self.local_held;
+    }
+    pub fn cancelMouse(self: *Controller) void {
+        if (self.app_drag) |app| {
+            if (self.rt.accepts(app.key)) self.rt.get(app.key.pane).?.pump.cancelMouse(app.token);
+            self.app_drag = null;
+        }
+        self.local_held = false;
+    }
+    pub fn clearSelection(self: *Controller) void {
+        if (self.selection_key) |key| if (self.rt.get(key.pane)) |live| live.pump.cancelSelection();
+        self.selection_drag.clear();
+        self.selection_key = null;
+        self.selection_gesture = 0;
+        self.dirty = true;
+    }
+    fn hit(self: *Controller, x: u32, y: u32) ?client.selection.Hit {
+        if (self.metrics.cell_w == 0 or self.metrics.cell_h == 0) return null;
+        const id = self.layout.hit(x, y) orelse return null;
+        const p = self.layout.get(id) orelse return null;
+        if (x < p.content.x or y < p.content.y or x >= p.content.x + p.content.w or y >= p.content.y + p.content.h) return null;
+        const live = self.rt.get(id) orelse return null;
+        const local_row: u32 = (y - p.content.y) / self.metrics.cell_h;
+        const col: u16 = @intCast(@min(@as(u32, std.math.maxInt(u16)), (x - p.content.x) / self.metrics.cell_w));
+        if (local_row >= live.snapshot.rows or col >= live.snapshot.cols) return null;
+        const actual_col = if (live.snapshot.row(@intCast(local_row)).cells[col].wide == .spacer_tail and col > 0) col - 1 else col;
+        return .{ .tile = @intCast(id), .row = live.view_origin + local_row, .col = actual_col };
+    }
+    fn cellFor(self: *Controller, x: u32, y: u32) client.selection.Cell {
+        const h = self.hit(x, y) orelse return self.selection_drag.at;
+        const p = self.layout.get(@intCast(h.tile)) orelse return self.selection_drag.at;
+        return .{ .row = @intCast((y -| p.content.y) / self.metrics.cell_h), .col = @intCast(@min(@as(u32, std.math.maxInt(u16)), (x -| p.content.x) / self.metrics.cell_w)) };
+    }
+    pub fn selectedSpan(self: *const Controller, tile: usize, row: u32, cols: u16) ?client.selection.Span {
+        if (self.selection_key) |key| if (@as(usize, @intCast(key.pane)) == tile and self.rt.accepts(key)) {
+            if (self.selection_gesture != 0 and !self.selection_drag.buttonHeld()) {
+                const position = self.rt.get(key.pane).?.snapshot_follow orelse return null;
+                if (position.id != self.selection_gesture or position.status != .ok) return null;
+                const range: client.selection.Range = .{
+                    .from = .{ .tile = tile, .row = position.anchor.row, .col = position.anchor.col },
+                    .to = .{ .tile = tile, .row = position.active.row, .col = position.active.col },
+                };
+                return range.span(tile, row, cols);
+            }
+            return (self.selection_drag.range() orelse return null).span(tile, row, cols);
+        };
+        return null;
+    }
+    pub fn poll(self: *Controller, now: i64) bool {
+        const changed = self.rt.poll(now);
+        if (self.app_drag) |app| {
+            if (!self.rt.accepts(app.key) or !self.rt.get(app.key.pane).?.pump.mouseFresh(app.token)) self.cancelMouse();
+        }
+        if (self.selection_key) |key| {
+            const live = self.rt.get(key.pane) orelse {
+                self.clearSelection();
+                return true;
+            };
+            const fresh = if (self.selection_drag.buttonHeld())
+                live.pump.selectionFresh(self.selection_version)
+            else if (self.selection_gesture != 0)
+                live.pump.selectionAlive(self.selection_gesture, self.selection_version)
+            else
+                live.pump.selectionFresh(self.selection_version);
+            if (!self.rt.accepts(key) or !fresh) {
+                self.clearSelection();
+                return true;
+            }
+        }
+        return changed;
+    }
+    pub fn takeSelectionText(self: *Controller) ?[]u8 {
+        const key = self.selection_key orelse return null;
+        const live = self.rt.get(key.pane) orelse return null;
+        if (!self.rt.accepts(key)) return null;
+        const result = live.pump.takeSelection() orelse return null;
+        if (result.id != self.selection_request or result.gesture != self.selection_gesture or result.status != .ok) {
+            self.rt.alloc.free(result.text);
+            if (result.status != .ok) self.setNotice(if (result.status == .too_large) "Selection too large" else "Selection unavailable");
+            return null;
+        }
+        return result.text;
+    }
+    pub fn command(self: *Controller, key: Key) !void {
+        self.cancelDrag();
+        self.clearSelection();
+        self.command_mode = false;
+        self.notice = "";
+        const ws = &self.rt.workspace;
@@ @@ -136,6 +242,7 @@ pub const Controller = struct { @@
+    pub fn openPicker(self: *Controller, mode: picker_mod.Picker.Mode) !void {
+        self.cancelDrag();
+        self.clearSelection();
+        self.recovery = null;
+        self.notice = "";
+        const picker = try picker_mod.Picker.initMode(self.rt.alloc, self.rt, &self.next_request, self.key_path, @intCast(@max(self.fb_w, 0)), @intCast(@max(self.fb_h, 0)), self.metrics, self.wake_ctx, self.wake, mode);
@@ @@ -248,6 +355,7 @@ pub const Controller = struct { @@
+    pub fn pointerDown(self: *Controller, x: u32, y: u32, grab_x: u32, grab_y: u32) !void {
+        self.cancelDrag();
+        self.clearSelection();
+        if (self.recovery) |menu| {
+            const view = menu.view(@intCast(@max(self.fb_w, 0)), @intCast(@max(self.fb_h, 0)), self.metrics);
+            for (0..menu.count()) |i| if (view.rowRect(i).contains(x, y)) {
@@ @@ -266,11 +374,147 @@ pub const Controller = struct { @@
+            if (self.layout.hit(x, y)) |id| {
+                self.intent_dirty = self.intent_dirty or self.rt.workspace.tab().focus != id;
+                _ = self.rt.workspace.focus(id);
+                const point = self.hit(x, y);
+                self.selection_drag.press(.{ .row = if (point) |h| @intCast(h.row - self.rt.get(id).?.view_origin) else 0, .col = if (point) |h| h.col else 0 }, point);
+                if (point) |h| {
+                    const live = self.rt.get(h.tile).?;
+                    self.selection_key = live.key;
+                    self.selection_version = live.snapshot_version;
+                }
+            } else if (self.layout.len == 0) try self.openPicker(.insert);
+        self.dirty = true;
+    pub fn mouseDown(self: *Controller, x: u32, y: u32, grab_x: u32, grab_y: u32, button: u8, mods: keymap.Mods) !void {
+        if (self.hasPointerCapture() or button > 2 or self.command_mode) return;
+        if (self.picker != null or self.recovery != null or self.resize_mode or self.layout.hitDivider(x, y, grab_x, grab_y) != null) {
+            if (button == 0) try self.pointerDown(x, y, grab_x, grab_y);
+            return;
+        }
+        if (self.layout.hit(x, y)) |id| {
+            const p = self.layout.get(id).?;
+            if (p.content.contains(x, y)) if (self.rt.get(id)) |live| {
+                if (!mods.shift) if (live.pump.mouseToken()) |token| if (token.modes.appMouse()) {
+                    const event = self.mouseAt(live.key, token, .press, button, x, y, mods) orelse return;
+                    try live.pump.say(.{ .mouse = event });
+                    self.clearSelection();
+                    self.intent_dirty = self.intent_dirty or self.rt.workspace.tab().focus != id;
+                    _ = self.rt.workspace.focus(id);
+                    self.app_drag = .{ .key = live.key, .token = token, .button = button };
+                    self.dirty = true;
+                    return;
+                };
+            };
+        }
+        if (button != 0) return;
+        try self.pointerDown(x, y, grab_x, grab_y);
+        self.local_held = self.selection_drag.buttonHeld();
+    }
+    fn mouseAt(self: *Controller, key: model.Attachment, token: client.session_pump.MouseToken, kind: anytype, button: u8, x: u32, y: u32, mods: keymap.Mods) ?client.session_pump.Mouse {
+        const p = self.layout.get(key.pane) orelse return null;
+        if (self.metrics.cell_w == 0 or self.metrics.cell_h == 0 or p.cols == 0 or p.rows == 0 or p.content.w == 0 or p.content.h == 0) return null;
+        const px = std.math.clamp(x, p.content.x, p.content.x +| p.content.w -| 1);
+        const py = std.math.clamp(y, p.content.y, p.content.y +| p.content.h -| 1);
+        return .{ .token = token, .kind = kind, .button = button, .col = @intCast(@min(@as(u32, p.cols - 1), (px - p.content.x) / self.metrics.cell_w)), .row = @intCast(@min(@as(u32, p.rows - 1), (py - p.content.y) / self.metrics.cell_h)), .pixel_x = px - p.content.x, .pixel_y = py - p.content.y, .mods = mods };
+    }
+    pub fn mouseMove(self: *Controller, x: i64, y: i64, mods: keymap.Mods) !void {
+        if (self.app_drag) |app| {
+            if (!self.rt.accepts(app.key)) return self.cancelMouse();
+            const live = self.rt.get(app.key.pane) orelse return self.cancelMouse();
+            if (!live.pump.mouseFresh(app.token)) return self.cancelMouse();
+            const event = self.mouseAt(app.key, app.token, .motion, app.button, @intCast(@max(x, 0)), @intCast(@max(y, 0)), mods) orelse return;
+            try live.pump.say(.{ .mouse = event });
+            return;
+        }
+        if (self.local_held or self.drag != null or self.selection_drag.buttonHeld()) return self.pointerMove(x, y);
+        if (x < 0 or y < 0 or mods.shift or self.picker != null or self.recovery != null or self.resize_mode or self.command_mode) return;
+        const id = self.layout.hit(@intCast(x), @intCast(y)) orelse return;
+        if (self.layout.hitDivider(@intCast(x), @intCast(y), 0, 0) != null) return;
+        const p = self.layout.get(id) orelse return;
+        if (!p.content.contains(@intCast(x), @intCast(y))) return;
+        const live = self.rt.get(id) orelse return;
+        const token = live.pump.mouseToken() orelse return;
+        if (!token.modes.mouse_any) return;
+        if (self.mouseAt(live.key, token, .motion, 3, @intCast(x), @intCast(y), mods)) |event| try live.pump.say(.{ .mouse = event });
+    }
+    pub fn mouseUp(self: *Controller, x: u32, y: u32, button: u8, mods: keymap.Mods) !void {
+        if (self.app_drag) |app| {
+            if (button != app.button) return;
+            if (!self.rt.accepts(app.key)) return self.cancelMouse();
+            const live = self.rt.get(app.key.pane) orelse return self.cancelMouse();
+            if (live.pump.mouseFresh(app.token)) {
+                if (self.mouseAt(app.key, app.token, .release, app.button, x, y, mods)) |event| try live.pump.say(.{ .mouse = event });
+            }
+            self.app_drag = null;
+            return;
+        }
+        if ((self.local_held or self.drag != null or self.selection_drag.buttonHeld()) and button == 0) {
+            self.local_held = false;
+            return self.pointerUp(x, y);
+        }
+    }
+    pub fn pointerUp(self: *Controller, x: u32, y: u32) !void {
+        if (self.drag != null) {
+            self.cancelDrag();
+            return;
+        }
+        const id = self.selection_key orelse return;
+        const live = self.rt.get(id.pane) orelse return self.clearSelection();
+        if (!live.pump.selectionFresh(self.selection_version)) return self.clearSelection();
+        const point = self.hit(x, y);
+        const cell = self.cellFor(x, y);
+        self.selection_drag.motion(cell, point);
+        switch (self.selection_drag.release()) {
+            .click => {},
+            .selection => |range| {
+                // A release always starts a new daemon tracker, even when a
+                // copy was requested while the button was held.
+                self.selection_gesture = 0;
+                try self.queueSelection(live, range);
+            },
+            .nothing => self.clearSelection(),
+        }
+        self.dirty = true;
+    }
+    fn queueSelection(self: *Controller, live: *runtime.Live, range: client.selection.Range) !void {
+        self.selection_request +%= 1;
+        if (self.selection_request == 0) self.selection_request = 1;
+        if (self.selection_gesture == 0) self.selection_gesture = self.selection_request;
+        try self.rt.requestSelection(live.key, self.selection_request, self.selection_gesture, range, self.selection_version);
+    }
+    pub fn copySelection(self: *Controller) !void {
+        const key = self.selection_key orelse return;
+        if (!self.rt.accepts(key)) return self.clearSelection();
+        const live = self.rt.get(key.pane) orelse return;
+        const range = self.selection_drag.range() orelse return;
+        const held = self.selection_drag.buttonHeld();
+        const valid = if (held)
+            live.pump.selectionFresh(self.selection_version)
+        else
+            live.pump.selectionAlive(self.selection_gesture, self.selection_version);
+        if (!valid) return self.clearSelection();
+        if (held) self.selection_gesture = 0;
+        try self.queueSelection(live, range);
+    }
+    pub fn pointerMove(self: *Controller, x: i64, y: i64) !void {
+        if (self.drag == null and self.selection_drag.on() != null) {
+            if (x < 0 or y < 0) {
+                self.selection_drag.motion(self.selection_drag.at, null);
+                self.dirty = true;
+                return;
+            }
+            const px: u32 = @intCast(@max(x, 0));
+            const py: u32 = @intCast(@max(y, 0));
+            const point = self.hit(px, py);
+            self.selection_drag.motion(self.cellFor(px, py), point);
+            self.dirty = true;
+            return;
+        }
+        const drag = self.drag orelse return;
+        if (drag.tab != self.rt.workspace.active_tab_id) return self.cancelDrag();
+        const d = self.layout.divider(drag.id) orelse return self.cancelDrag();
@@ @@ -280,12 +524,45 @@ pub const Controller = struct { @@
+            try self.relayout();
+    /// Semantic wheel entry point. Transport routing is deliberately deferred
+    /// until the pump has sampled the pane's current terminal modes.
+    pub fn wheel(self: *Controller, x: u32, y: u32, delta: f32, flipped: bool, mods: keymap.Mods) !void {
+        if (self.picker != null or self.recovery != null or self.resize_mode or self.command_mode or self.drag != null) return;
+        const id = self.layout.hit(x, y) orelse return;
+        const placement = self.layout.get(id) orelse return;
+        if (!placement.content.contains(x, y) or placement.cols == 0 or placement.rows == 0 or self.metrics.cell_w == 0 or self.metrics.cell_h == 0) return;
+        const live = self.rt.get(id) orelse return;
+        const slot = found: {
+            for (&self.wheel_remainder) |*candidate| {
+                if (candidate.key != null and candidate.key.?.pane == live.key.pane) break :found candidate;
+            }
+            for (&self.wheel_remainder) |*candidate| {
+                if (candidate.key == null or self.rt.get(candidate.key.?.pane) == null) break :found candidate;
+            }
+            return;
+        };
+        if (slot.key == null or !std.meta.eql(slot.key.?, live.key)) {
+            slot.* = .{ .key = live.key, .wheel = .{} };
+        }
+        const notches = slot.wheel.notches(delta, flipped);
+        if (notches == 0) return;
+        try self.rt.wheel(live.key, .{
+            .notches = notches,
+            .col = @intCast(@min((x - placement.content.x) / self.metrics.cell_w, placement.cols - 1)),
+            .row = @intCast(@min((y - placement.content.y) / self.metrics.cell_h, placement.rows - 1)),
+            .pixel_x = x - placement.content.x,
+            .pixel_y = y - placement.content.y,
+            .mods = mods,
+        });
+    }
+    pub fn cancelDrag(self: *Controller) void {
+        self.cancelMouse();
+        if (self.drag == null) return;
+        self.intent_dirty = self.intent_dirty or self.drag.?.changed;
+        self.drag = null;
+    pub fn sendKey(self: *Controller, key: keymap.Event) !void {
+        self.clearSelection();
+        var buf: [keymap.max_seq_len]u8 = undefined;
+        const bytes = keymap.encode(key, &buf);
+        if (bytes.len != 0) try self.rt.input(bytes);
@@ @@ -300,7 +577,10 @@ pub const Controller = struct { @@
+            if (self.picker) |picker| {
+                try picker.text(text);
+                self.dirty = true;
+            } else if (!self.command_mode and !self.resize_mode and self.recovery == null) {
+                self.clearSelection();
+                try self.rt.input(text);
+            }
+        self.suppress_text = false;
@@ @@ -315,11 +595,15 @@ pub const Controller = struct { @@
+        self.resize_mode = false;
+        self.modal_held.clearRetainingCapacity();
+        self.cancelDrag();
+        self.clearSelection();
+        self.consumed_key = null;
+        self.dirty = true;
+    pub fn updateGeometry(self: *Controller, w: i32, h: i32, metrics: model.Metrics) !void {
+        if (w != self.fb_w or h != self.fb_h or !std.meta.eql(metrics, self.metrics)) {
+            self.cancelDrag();
+            self.clearSelection();
+        }
+        self.fb_w = w;
+        self.fb_h = h;
+        self.metrics = metrics;
@@ @@ -343,6 +627,12 @@ pub const Controller = struct { @@
+            self.suppress_text = true;
+            return;
+        if (input.copy and !input.prefix and self.picker == null and self.recovery == null and !self.resize_mode and !self.command_mode) {
+            self.consumed_key = key;
+            self.suppress_text = true;
+            try self.copySelection();
+            return;
+        }
+        if (self.recovery) |*menu| {
+            try self.modal_held.put(self.rt.alloc, key, {});
+            self.suppress_text = true;
+    try std.testing.expectEqual(@as(u64, 1), ui.pending_end.?.request);
+    ui.pending_end = null;
+test "wheel retains fractional deltas and emits whole notches" {
+    var wheel: Wheel = .{};
+    try std.testing.expectEqual(@as(i32, 0), wheel.notches(0.4, false));
+    try std.testing.expectEqual(@as(i32, 1), wheel.notches(0.6, false));
+    try std.testing.expectEqual(@as(i32, -1), wheel.notches(1, true));
+}
+test "selection hit keeps absolute history and pane-local pointer cells" {
+    var rt = runtime.Runtime.init(std.testing.allocator, .{});
+    defer rt.deinit();
+    const metrics: model.Metrics = .{ .cell_w = 8, .cell_h = 16 };
+    const first = try rt.add(.{ .via = "cat" }, "history-a", 800, 600, metrics);
+    const second = try rt.add(.{ .via = "cat" }, "history-b", 800, 600, metrics);
+    var ui: Controller = .{ .rt = &rt, .metrics = metrics, .fb_w = 800, .fb_h = 600 };
+    defer ui.deinit();
+    ui.layout = rt.workspace.layout(800, 600, metrics);
+    for (ui.layout.items()) |placement| {
+        const live = rt.get(placement.id).?;
+        try live.snapshot.resize(22, 9);
+        live.view_origin = if (placement.id == first) 70_000 else 3;
+    }
+    const a = ui.layout.get(first).?;
+    const b = ui.layout.get(second).?;
+    const ha = ui.hit(a.content.x + 4, a.content.y + 16).?;
+    const hb = ui.hit(b.content.x + 4, b.content.y + 16).?;
+    try std.testing.expectEqual(@as(u32, 70_001), ha.row);
+    try std.testing.expectEqual(@as(u32, 4), hb.row);
+    try std.testing.expectEqual(@as(u16, 1), ui.cellFor(a.content.x + 4, a.content.y + 16).row);
+    try std.testing.expectEqual(@as(u16, 1), ui.cellFor(b.content.x + 4, b.content.y + 16).row);
+    try ui.pointerDown(a.content.x + 4, a.content.y + 16, 0, 0);
+    try ui.pointerMove(b.content.x + 4, b.content.y + 32);
+    try std.testing.expect(ui.selection_drag.buttonHeld());
+    try std.testing.expectEqual(@as(u32, 70_001), ui.selection_drag.range().?.to.row);
+    try ui.pointerMove(a.content.x + 12, a.content.y + 32);
+    try std.testing.expectEqual(@as(u32, 70_002), ui.selection_drag.range().?.to.row);
+    ui.focusLost();
+    try std.testing.expect(!ui.selection_drag.buttonHeld());
+    try std.testing.expect(ui.selection_drag.range() == null);
+}
+test "held selection copies restart the gesture and release starts another" {
+    var rt = runtime.Runtime.init(std.testing.allocator, .{});
+    defer rt.deinit();
+    const metrics: model.Metrics = .{ .cell_w = 8, .cell_h = 16 };
+    const id = try rt.add(.{ .via = "cat" }, "copy-gesture", 800, 600, metrics);
+    var ui: Controller = .{ .rt = &rt, .metrics = metrics, .fb_w = 800, .fb_h = 600 };
+    defer ui.deinit();
+    ui.layout = rt.workspace.layout(800, 600, metrics);
+    const live = rt.get(id).?;
+    live.pump.mu.lock();
+    try live.snapshot.resize(22, 9);
+    live.pump.status.phase = .attached;
+    live.pump.admitted = true;
+    live.pump.replica.state_since_attach = true;
+    live.pump.follow_seq = live.pump.replica.last_seq;
+    live.pump.follow_source = 1;
+    const source_version = live.pump.selectionVersionLocked();
+    live.pump.mu.unlock();
+    const p = ui.layout.get(id).?.content;
+    try ui.pointerDown(p.x + 4, p.y + 8, 0, 0);
+    ui.selection_version = source_version;
+    try ui.pointerMove(p.x + 20, p.y + 8);
+    const first_range = ui.selection_drag.range().?;
+    try std.testing.expectEqual(@as(u16, 2), first_range.to.col);
+    try ui.copySelection();
+    const first = ui.selection_gesture;
+    try std.testing.expect(first != 0);
+    try ui.pointerMove(p.x + 28, p.y + 8);
+    const extended_range = ui.selection_drag.range().?;
+    try std.testing.expectEqual(@as(u16, 3), extended_range.to.col);
+    try std.testing.expect(extended_range.to.col != first_range.to.col);
+    try ui.copySelection();
+    try std.testing.expect(ui.selection_gesture != first);
+    const second = ui.selection_gesture;
+    try ui.pointerUp(p.x + 36, p.y + 8);
+    try std.testing.expect(ui.selection_gesture != second);
+    try std.testing.expectEqual(@as(u16, 4), ui.selection_drag.range().?.to.col);
+}
+test "wheel reuses an existing pane remainder before a vacant earlier slot" {
+    var rt = runtime.Runtime.init(std.testing.allocator, .{});
+    defer rt.deinit();
+    const metrics: model.Metrics = .{ .cell_w = 8, .cell_h = 16 };
+    const id = try rt.add(.{ .via = "cat" }, "fraction", 800, 600, metrics);
+    var ui: Controller = .{ .rt = &rt, .metrics = metrics, .fb_w = 800, .fb_h = 600 };
+    defer ui.deinit();
+    ui.layout = rt.workspace.layout(800, 600, metrics);
+    const live = rt.get(id).?;
+    ui.wheel_remainder[0] = .{ .key = .{ .pane = id + 1, .generation = 1 }, .wheel = .{ .fraction = 0.75 } };
+    ui.wheel_remainder[1] = .{ .key = live.key, .wheel = .{ .fraction = 0.5 } };
+    const rect = ui.layout.get(id).?.content;
+    try ui.wheel(rect.x + 4, rect.y + 8, 0.5, false, .{});
+    try std.testing.expectEqual(@as(f32, 0), ui.wheel_remainder[1].wheel.fraction);
+    try std.testing.expectEqual(@as(f32, 0.75), ui.wheel_remainder[0].wheel.fraction);
+    ui.wheel_remainder[1].key.?.generation +%= 1;
+    try ui.wheel(rect.x + 4, rect.y + 8, 0.5, false, .{});
+    try std.testing.expectEqual(@as(f32, 0.5), ui.wheel_remainder[1].wheel.fraction);
+}

src/gui/native.zig

Old		New
@@ -16,9 +16,10 @@ pub const frame = @import("frame.zig");
16	pub const bench = @import("bench.zig");	16	pub const bench = @import("bench.zig");
17	pub const atlas = @import("atlas.zig");	17	pub const atlas = @import("atlas.zig");
18	pub const font = @import("font.zig");	18	pub const font = @import("font.zig");
19	pub const config = @import("config.zig");	19	pub const config = core.config;
20	pub const quads = @import("quads.zig");	20	pub const quads = @import("quads.zig");
21	pub const theme = @import("theme.zig");	21	pub const theme = core.theme;
		22	pub const font_options = core.font_options;
22	pub const gl = @import("gl.zig");	23	pub const gl = @import("gl.zig");
23		24
24	// Compatibility aliases for callers that previously reached these through	25	// Compatibility aliases for callers that previously reached these through
@@ -41,8 +42,6 @@ test {
41	_ = bench;	42	_ = bench;
42	_ = atlas;	43	_ = atlas;
43	_ = font;	44	_ = font;
44	_ = config;
45	_ = quads;	45	_ = quads;
46	_ = theme;
47	_ = gl;	46	_ = gl;
48	}	47	}

src/gui/native_core.zig

Old		New
@@ -1,6 +1,7 @@
1	//! Window-free native GUI model, transport runtime, picker, persistence, and	1	//! Window-free native GUI model, transport runtime, appearance/font policy,
2	//! interaction policy. The native window and painter consume this component;	2	//! picker, persistence, and interaction policy. The native window and painter
3	//! keeping it as its own module lets its tests run without window libraries.	3	//! consume this component; keeping it as its own module lets its tests run
		4	//! without window libraries.
4	const client = @import("client");	5	const client = @import("client");
5	const term = @import("term");	6	const term = @import("term");
6		7
@@ -9,6 +10,9 @@ pub const runtime = @import("runtime.zig");
9	pub const picker = @import("picker.zig");	10	pub const picker = @import("picker.zig");
10	pub const persistence = @import("persistence.zig");	11	pub const persistence = @import("persistence.zig");
11	pub const interaction = @import("interaction.zig");	12	pub const interaction = @import("interaction.zig");
		13	pub const config = @import("config.zig");
		14	pub const theme = @import("theme.zig");
		15	pub const font_options = @import("font_options.zig");
12		16
13	test {	17	test {
14	_ = client;	18	_ = client;
@@ -18,4 +22,7 @@ test {
18	_ = picker;	22	_ = picker;
19	_ = persistence;	23	_ = persistence;
20	_ = interaction;	24	_ = interaction;
		25	_ = config;
		26	_ = theme;
		27	_ = font_options;
21	}	28	}

src/gui/quads.zig

Old		New
@@ -1,10 +1,11 @@
1	//! Grid cells to ordered background and foreground instance streams.	1	//! Grid cells to ordered background and foreground instance streams.
2	const std = @import("std");	2	const std = @import("std");
		3	const client = @import("client");
3	const term = @import("term");	4	const term = @import("term");
4	const grid = term.grid;	5	const grid = term.grid;
5	const proto = term.protocol;	6	const proto = term.protocol;
6	const atlas = @import("atlas.zig");	7	const atlas = @import("atlas.zig");
7	const theme_mod = @import("theme.zig");	8	const theme_mod = @import("native_core").theme;
8	pub const Instance = extern struct {	9	pub const Instance = extern struct {
9	x: f32,	10	x: f32,
10	y: f32,	11	y: f32,
@@ -33,7 +34,7 @@ pub const Lists = struct {
33	try out.appendSlice(a, s.foregrounds.items);	34	try out.appendSlice(a, s.foregrounds.items);
34	}	35	}
35	};	36	};
36	pub const Ctx = struct { cell_w: u16, cell_h: u16, ascent: u16, x0: f32 = 0, y0: f32 = 0, atlas_w: f32, atlas_h: f32, glyphs: Glyphs, blink_visible: bool = true, theme: *const theme_mod.Theme = &theme_mod.legacy, fg: ?u32 = null, bg: ?u32 = null };	37	pub const Ctx = struct { cell_w: u16, cell_h: u16, ascent: u16, x0: f32 = 0, y0: f32 = 0, atlas_w: f32, atlas_h: f32, glyphs: Glyphs, blink_visible: bool = true, theme: *const theme_mod.Theme = &theme_mod.legacy, fg: ?u32 = null, bg: ?u32 = null, selection: ?client.selection.Span = null };
37	pub fn rgbaOf(c: u32, d: u32, appearance: *const theme_mod.Theme) u32 {	38	pub fn rgbaOf(c: u32, d: u32, appearance: *const theme_mod.Theme) u32 {
38	return switch (c >> 24) {	39	return switch (c >> 24) {
39	1 => appearance.palette[@intCast(c & 0xff)],	40	1 => appearance.palette[@intCast(c & 0xff)],
@@ -84,9 +85,10 @@ pub fn rowInstances(out: Lists, a: std.mem.Allocator, row: const grid.Row, col
84	for (row.cells[0..n], 0..) \|cell, x\| {	85	for (row.cells[0..n], 0..) \|cell, x\| {
85	if (cell.wide == .spacer_tail) continue;	86	if (cell.wide == .spacer_tail) continue;
86	const span_cols: usize = @min(if (cell.wide == .wide) @as(usize, 2) else 1, n - x);	87	const span_cols: usize = @min(if (cell.wide == .wide) @as(usize, 2) else 1, n - x);
		88	const selected = if (ctx.selection) \|s\| x <= s.to and x + span_cols - 1 >= s.from else false;
87	const inv = cell.style.flags & (1 << 4) != 0;	89	const inv = cell.style.flags & (1 << 4) != 0;
88	const bg = if (inv) rgbaOf(cell.style.fg, ctx.fg orelse ctx.theme.terminal_fg, ctx.theme) else rgbaOf(cell.style.bg, ctx.bg orelse ctx.theme.terminal_bg, ctx.theme);	90	const bg = if (selected) ctx.theme.chrome_focus_bg else if (inv) rgbaOf(cell.style.fg, ctx.fg orelse ctx.theme.terminal_fg, ctx.theme) else rgbaOf(cell.style.bg, ctx.bg orelse ctx.theme.terminal_bg, ctx.theme);
89	if (inv or cell.style.bg != proto.color_none) try out.backgrounds.append(a, solid(ctx.x0 + @as(f32, @floatFromInt(col_off + x)) * cw, top, cw * @as(f32, @floatFromInt(span_cols)), ch, bg));	91	if (selected or inv or cell.style.bg != proto.color_none) try out.backgrounds.append(a, solid(ctx.x0 + @as(f32, @floatFromInt(col_off + x)) * cw, top, cw * @as(f32, @floatFromInt(span_cols)), ch, bg));
90	}	92	}
91	for (row.cells[0..n], 0..) \|cell, x\| {	93	for (row.cells[0..n], 0..) \|cell, x\| {
92	if (cell.wide == .spacer_tail) continue;	94	if (cell.wide == .spacer_tail) continue;
@@ -100,6 +102,8 @@ pub fn rowInstances(out: Lists, a: std.mem.Allocator, row: const grid.Row, col
100	const left = ctx.x0 + @as(f32, @floatFromInt(col_off + x)) * cw;	102	const left = ctx.x0 + @as(f32, @floatFromInt(col_off + x)) * cw;
101	const span_cols: usize = @min(if (cell.wide == .wide) @as(usize, 2) else 1, n - x);	103	const span_cols: usize = @min(if (cell.wide == .wide) @as(usize, 2) else 1, n - x);
102	const span = cw * @as(f32, @floatFromInt(span_cols));	104	const span = cw * @as(f32, @floatFromInt(span_cols));
		105	const selected = if (ctx.selection) \|s\| x <= s.to and x + span_cols - 1 >= s.from else false;
		106	if (selected) fg = ctx.theme.chrome_focus_fg;
103	if (cell.text_len > 0) {	107	if (cell.text_len > 0) {
104	const run = try ctx.glyphs.resolve(ctx.glyphs.ctx, row.textOf(cell), variantOf(flags));	108	const run = try ctx.glyphs.resolve(ctx.glyphs.ctx, row.textOf(cell), variantOf(flags));
105	var pen_x: i32 = 0;	109	var pen_x: i32 = 0;
@@ -251,6 +255,24 @@ test "glyphs and a clipped wide edge stay inside the authoritative span" {
251	try std.testing.expect(glyph.u1 < @as(f32, 22) / ctx.atlas_w);	255	try std.testing.expect(glyph.u1 < @as(f32, 22) / ctx.atlas_w);
252	}	256	}
253		257
		258	test "selection highlight covers wide cells without changing grid styles" {
		259	var cells = [_]grid.Cell{
		260	.{ .wide = .wide, .text_len = 1, .style = .{ .fg = proto.colorRgb(1, 2, 3), .bg = proto.colorRgb(4, 5, 6) } },
		261	.{ .wide = .spacer_tail },
		262	};
		263	var row: grid.Row = .{ .cells = &cells, .text = .{ .items = @constCast("界"), .capacity = 3 } };
		264	var lists: Lists = .{};
		265	defer lists.deinit(std.testing.allocator);
		266	var ctx = testCtx(true);
		267	ctx.selection = .{ .from = 1, .to = 1 };
		268	_ = try rowInstances(&lists, std.testing.allocator, &row, 2, 0, 0, ctx);
		269	// Selecting the continuation still paints the owning wide cell as one
		270	// complete two-column rectangle, while the source style remains intact.
		271	try std.testing.expectEqual(@as(f32, 16), lists.backgrounds.items[0].w);
		272	try std.testing.expectEqual(theme_mod.legacy.chrome_focus_bg, lists.backgrounds.items[0].rgba);
		273	try std.testing.expectEqual(proto.colorRgb(1, 2, 3), cells[0].style.fg);
		274	}
		275
254	/// Clip only the newly emitted range, adjusting glyph UVs proportionally.	276	/// Clip only the newly emitted range, adjusting glyph UVs proportionally.
255	/// Removed instances are compacted without changing background/foreground order.	277	/// Removed instances are compacted without changing background/foreground order.
256	pub fn clip(list: *std.ArrayListUnmanaged(Instance), start: usize, x: f32, y: f32, w: f32, h: f32) void {	278	pub fn clip(list: *std.ArrayListUnmanaged(Instance), start: usize, x: f32, y: f32, w: f32, h: f32) void {

src/gui/runtime.zig

Old		New
@@ -11,7 +11,10 @@ pub const Live = struct {
11	pump: *Pump,	11	pump: *Pump,
12	snapshot: *term.grid.Grid,	12	snapshot: *term.grid.Grid,
13	snapshot_seq: u64 = 0,	13	snapshot_seq: u64 = 0,
		14	snapshot_version: client.session_pump.SelectionVersion = .{ .seq = 0, .history_rows = 0, .epoch = 0, .revision = 0 },
		15	snapshot_follow: ?client.session_pump.FollowPosition = null,
14	painted_seq: u64 = 0,	16	painted_seq: u64 = 0,
		17	view_origin: u32 = 0,
15	status: client.session_pump.State = .{},	18	status: client.session_pump.State = .{},
16	size: term.protocol.Size,	19	size: term.protocol.Size,
17	notify: Notify,	20	notify: Notify,
@@ -45,9 +48,12 @@ pub const Live = struct {
45	defer self.pump.mu.unlock();	48	defer self.pump.mu.unlock();
46	if (self.preserve_snapshot and !self.pump.snapshot_ready) return 0;	49	if (self.preserve_snapshot and !self.pump.snapshot_ready) return 0;
47	self.preserve_snapshot = false;	50	self.preserve_snapshot = false;
48	const src = self.pump.grid;	51	const src = self.pump.viewGridLocked();
49	try copyGrid(self.snapshot, src, @min(cols, src.cols), @min(rows, src.rows));	52	try copyGrid(self.snapshot, src, @min(cols, src.cols), @min(rows, src.rows));
50	self.snapshot_seq = self.pump.replica.last_seq;	53	self.snapshot_seq = self.pump.replica.last_seq;
		54	self.snapshot_version = self.pump.selectionVersionLocked();
		55	self.snapshot_follow = self.pump.followPositionLocked();
		56	self.view_origin = self.pump.viewOriginLocked();
51	return self.pump.last_apply_us;	57	return self.pump.last_apply_us;
52	}	58	}
53	};	59	};
@@ -129,6 +135,8 @@ pub const Runtime = struct {
129	if (keep_snapshot) {	135	if (keep_snapshot) {
130	try copyGrid(live.snapshot, old.snapshot, old.snapshot.cols, old.snapshot.rows);	136	try copyGrid(live.snapshot, old.snapshot, old.snapshot.cols, old.snapshot.rows);
131	live.snapshot_seq = old.snapshot_seq;	137	live.snapshot_seq = old.snapshot_seq;
		138	live.snapshot_version = old.snapshot_version;
		139	live.view_origin = old.view_origin;
132	live.preserve_snapshot = true;	140	live.preserve_snapshot = true;
133	}	141	}
134	for (&self.lives) \|slot\| if (slot. == old) {	142	for (&self.lives) \|slot\| if (slot. == old) {
@@ -170,6 +178,18 @@ pub const Runtime = struct {
170	else => {},	178	else => {},
171	}	179	}
172	}	180	}
		181
		182	pub fn wheel(self: *Runtime, key: model.Attachment, event: client.session_pump.Wheel) !void {
		183	const live = self.get(key.pane) orelse return;
		184	if (!self.accepts(key) or live.status.phase != .attached) return;
		185	try live.pump.say(.{ .wheel = event });
		186	}
		187
		188	pub fn requestSelection(self: *Runtime, key: model.Attachment, id: u32, gesture: u32, range: client.selection.Range, version: client.session_pump.SelectionVersion) !void {
		189	const live = self.get(key.pane) orelse return error.MissingPane;
		190	if (!self.accepts(key)) return error.StaleAttachment;
		191	try live.pump.say(.{ .selection = .{ .id = id, .gesture = gesture, .anchor = .{ .row = range.from.row, .col = range.from.col }, .active = .{ .row = range.to.row, .col = range.to.col }, .version = version } });
		192	}
173	pub fn poll(self: *Runtime, now: i64) bool {	193	pub fn poll(self: *Runtime, now: i64) bool {
174	var changed = false;	194	var changed = false;
175	for (self.lives) \|p\| if (p) \|live\| {	195	for (self.lives) \|p\| if (p) \|live\| {

src/server/server.zig

Old		New
@@ -266,6 +266,12 @@ const ClientSlot = struct {
266	/// This client volunteered an SSH agent (`.agent_offer`). Opt-in and	266	/// This client volunteered an SSH agent (`.agent_offer`). Opt-in and
267	/// per-connection: a redial is a new slot and must offer again.	267	/// per-connection: a redial is a new slot and must offer again.
268	agent_offer: bool = false,	268	agent_offer: bool = false,
		269	selection: ?struct { id: u32, tracked: *Engine.TrackedSelection } = null,
		270
		271	fn clearSelection(self: *ClientSlot) void {
		272	if (self.selection) \|*selection\| selection.tracked.deinit();
		273	self.selection = null;
		274	}
269	};	275	};
270		276
271	/// One client's outstanding await: the request as asked, plus the two pieces	277	/// One client's outstanding await: the request as asked, plus the two pieces
@@ -1083,6 +1089,7 @@ pub const Server = struct {
1083	fn teardownClient(self: *Server, i: usize, close_sink: bool) void {	1089	fn teardownClient(self: *Server, i: usize, close_sink: bool) void {
1084	self.agents.closeOfClient(self, i);	1090	self.agents.closeOfClient(self, i);
1085	if (self.clients[i]) \|*slot\| {	1091	if (self.clients[i]) \|*slot\| {
		1092	slot.clearSelection();
1086	slot.pending.deinit(self.alloc);	1093	slot.pending.deinit(self.alloc);
1087	slot.inbound.deinit(self.alloc);	1094	slot.inbound.deinit(self.alloc);
1088	if (close_sink) slot.sink.close();	1095	if (close_sink) slot.sink.close();
@@ -1118,26 +1125,22 @@ pub const Server = struct {
1118	return self.clients[i] != null;	1125	return self.clients[i] != null;
1119	}	1126	}
1120		1127
1121	/// The lane is TOTAL: a decodable request leaves with exactly one answer,	1128	pub fn queueSelectionReply(self: *Server, i: usize, reply: proto.SelectionReply) void {
1122	/// so the fallback reserves capacity first.	1129	var bytes: std.ArrayList(u8) = .empty;
1123	pub fn queueSelectionReply(	1130	defer bytes.deinit(self.alloc);
1124	self: *Server,	1131	// Reserve the refusal before formatting a potentially large reply.
1125	i: usize,	1132	bytes.ensureTotalCapacity(self.alloc, proto.selection_reply_prefix_len) catch {
1126	id: u32,	1133	self.dropClient(i);
1127	status: proto.SelectionStatus,
1128	history_rows: u32,
1129	value: []const u8,
1130	) void {
1131	var payload: std.ArrayList(u8) = .empty;
1132	defer payload.deinit(self.alloc);
1133	payload.ensureTotalCapacity(self.alloc, proto.selection_reply_prefix_len) catch return;
1134	proto.encodeSelectionReply(&payload, self.alloc, id, status, history_rows, value) catch {
1135	payload.clearRetainingCapacity();
1136	proto.encodeSelectionReply(&payload, self.alloc, id, .unavailable, 0, "") catch return;
1137	_ = self.queueFrame(i, .selection_reply, payload.items);
1138	return;	1134	return;
1139	};	1135	};
1140	_ = self.queueFrame(i, .selection_reply, payload.items);	1136	proto.encodeSelectionReply(&bytes, self.alloc, reply) catch {
		1137	bytes.clearRetainingCapacity();
		1138	var refusal = reply;
		1139	refusal.status = .unavailable;
		1140	refusal.text = &.{};
		1141	proto.encodeSelectionReply(&bytes, self.alloc, refusal) catch unreachable;
		1142	};
		1143	_ = self.queueFrame(i, .selection_reply, bytes.items);
1141	}	1144	}
1142		1145
1143	/// Wait up to `budget_ms` for clients to accept what they are owed. Only	1146	/// Wait up to `budget_ms` for clients to accept what they are owed. Only
@@ -1651,7 +1654,7 @@ pub const Server = struct {
1651	.resize => self.onResize(i, frame),	1654	.resize => self.onResize(i, frame),
1652	.input => self.onInput(i, frame),	1655	.input => self.onInput(i, frame),
1653	.fetch_scrollback => self.onFetchScrollback(i, frame),	1656	.fetch_scrollback => self.onFetchScrollback(i, frame),
1654	.selection_req => self.onSelectionReq(i, frame),	1657	.selection_req => self.onSelectionReq(i, frame.payload),
1655	.detach => self.dropClient(i),	1658	.detach => self.dropClient(i),
1656	.status_req => self.onStatusReq(i, frame),	1659	.status_req => self.onStatusReq(i, frame),
1657	.await_req => self.onAwaitReq(i, frame),	1660	.await_req => self.onAwaitReq(i, frame),
@@ -1814,6 +1817,7 @@ pub const Server = struct {
1814	return;	1817	return;
1815	};	1818	};
1816	if (self.clients[i]) \|*c\| {	1819	if (self.clients[i]) \|*c\| {
		1820	c.clearSelection();
1817	// Seq series are per-session, so an await's `since_seq` from the	1821	// Seq series are per-session, so an await's `since_seq` from the
1818	// old one would answer instantly or never, arbitrarily. Only on a	1822	// old one would answer instantly or never, arbitrarily. Only on a
1819	// real change: a reconnect re-resolving the same name keeps its await.	1823	// real change: a reconnect re-resolving the same name keeps its await.
@@ -1876,47 +1880,79 @@ pub const Server = struct {
1876	@memcpy(payload[0..6], &proto.encodeScrollbackReq(got.first, got.count));	1880	@memcpy(payload[0..6], &proto.encodeScrollbackReq(got.first, got.count));
1877	@memcpy(payload[6..], got.bytes);	1881	@memcpy(payload[6..], got.bytes);
1878	_ = self.queueFrame(i, .scrollback_chunk, payload);	1882	_ = self.queueFrame(i, .scrollback_chunk, payload);
		1883	self.sendSelectionState(si, i);
1879	}	1884	}
1880		1885
1881	fn onSelectionReq(self: *Server, i: usize, frame: proto.Frame) void {	1886	fn onSelectionReq(self: *Server, i: usize, payload: []const u8) void {
1882	// Selection is a client-local observation, not input: it claims no	1887	const req = proto.decodeSelectionReq(payload) catch return;
1883	// size and repaints nobody. Decoded BEFORE the session lookup, because
1884	// a malformed payload carries no id to correlate and only silence is
1885	// honest — while a well-formed one from a session-less slot deserves
1886	// its answer rather than the client's whole timeout.
1887	const req = proto.decodeSelectionReq(frame.payload) catch return;
1888	const si = self.clients[i].?.session orelse {	1888	const si = self.clients[i].?.session orelse {
1889	self.queueSelectionReply(i, req.id, selectionReplyStatus(null), 0, "");	1889	self.queueSelectionReply(i, .{ .id = req.id, .gesture = req.gesture, .history_rows = 0 });
1890	return;	1890	return;
1891	};	1891	};
1892	var result = self.ses(si).eng.extractSelection(	1892	const s = self.ses(si);
1893	self.alloc,	1893	if (req.action == .clear) {
1894	req.anchor.row,	1894	if (self.clients[i].?.selection) \|selection\| {
1895	req.anchor.col,	1895	if (selection.id == req.gesture) self.clients[i].?.clearSelection();
1896	req.active.row,	1896	}
1897	req.active.col,
1898	proto.selection_text_max,
1899	) catch {
1900	// No extraction happened, so there is no screen whose
1901	// history this could honestly quote. Zero is the
1902	// watermark that claims nothing, and a non-ok status is
1903	// never compared against one anyway.
1904	self.queueSelectionReply(i, req.id, selectionReplyStatus(null), 0, "");
1905	return;	1897	return;
1906	};	1898	}
1907	defer result.deinit(self.alloc);	1899	var state = self.selectionState(si, i);
1908	// Status and text are one invariant, not two independent	1900	state.id = req.id;
1909	// fields. In particular, an impossible `.ok` without the	1901	state.gesture = req.gesture;
1910	// owned text must not become a successful empty selection.	1902	if (req.action == .start) {
1911	const base = result.history_rows;	1903	const tracked = if (req.gesture != 0 and req.epoch == s.epoch and req.source == s.eng.selectionSource())
1912	switch (result.status) {	1904	s.eng.trackSelection(req.anchor, req.active) catch null
1913	.ok => if (result.text) \|value\|
1914	self.queueSelectionReply(i, req.id, selectionReplyStatus(.ok), base, value)
1915	else	1905	else
1916	self.queueSelectionReply(i, req.id, selectionReplyStatus(null), base, ""),	1906	null;
1917	.invalid => self.queueSelectionReply(i, req.id, selectionReplyStatus(.invalid), base, ""),	1907	if (tracked) \|selection\| {
1918	.too_large => self.queueSelectionReply(i, req.id, selectionReplyStatus(.too_large), base, ""),	1908	self.clients[i].?.clearSelection();
		1909	self.clients[i].?.selection = .{ .id = req.gesture, .tracked = selection };
		1910	state = self.selectionState(si, i);
		1911	state.id = req.id;
		1912	} else {
		1913	state.status = .unavailable;
		1914	self.queueSelectionReply(i, state);
		1915	return;
		1916	}
		1917	}
		1918	const result: ?Engine.SelectionExtract = if (req.action == .extract)
		1919	s.eng.extractSelection(self.alloc, req.anchor.row, req.anchor.col, req.active.row, req.active.col, proto.selection_text_max) catch null
		1920	else if (self.clients[i].?.selection) \|*selection\|
		1921	if (selection.id == req.gesture and req.epoch == s.epoch)
		1922	selection.tracked.extract(self.alloc, proto.selection_text_max) catch null
		1923	else
		1924	null
		1925	else
		1926	null;
		1927	defer if (result) \|value\| value.deinit(self.alloc);
		1928	if (result) \|value\| {
		1929	state.status = selectionReplyStatus(value.status);
		1930	state.text = value.text orelse &.{};
		1931	} else state.status = .unavailable;
		1932	self.queueSelectionReply(i, state);
		1933	}
		1934
		1935	fn selectionState(self: *Server, si: usize, i: usize) proto.SelectionReply {
		1936	const s = self.ses(si);
		1937	var state: proto.SelectionReply = .{
		1938	.seq = s.tracker.seq,
		1939	.source = s.eng.selectionSource(),
		1940	.history_rows = s.eng.historyRows(),
		1941	};
		1942	if (self.clients[i].?.selection) \|*selection\| {
		1943	state.gesture = selection.id;
		1944	if (selection.tracked.points()) \|points\| {
		1945	state.status = .ok;
		1946	state.anchor = points.anchor;
		1947	state.active = points.active;
		1948	} else self.clients[i].?.clearSelection();
1919	}	1949	}
		1950	return state;
		1951	}
		1952
		1953	fn sendSelectionState(self: *Server, si: usize, i: usize) void {
		1954	if (!self.inSession(i, si)) return;
		1955	self.queueSelectionReply(i, self.selectionState(si, i));
1920	}	1956	}
1921		1957
1922	fn onStatusReq(self: *Server, i: usize, frame: proto.Frame) void {	1958	fn onStatusReq(self: *Server, i: usize, frame: proto.Frame) void {
@@ -2369,6 +2405,7 @@ pub const Server = struct {
2369	for (0..max_clients) \|i\| {	2405	for (0..max_clients) \|i\| {
2370	if (if (to) \|only\| i != only else !self.inSession(i, si)) continue;	2406	if (if (to) \|only\| i != only else !self.inSession(i, si)) continue;
2371	if (!self.queueFrame(i, t, payload)) continue;	2407	if (!self.queueFrame(i, t, payload)) continue;
		2408	self.sendSelectionState(si, i);
2372	sent = true;	2409	sent = true;
2373	if (t == .delta) {	2410	if (t == .delta) {
2374	self.stats.deltas += 1;	2411	self.stats.deltas += 1;
@@ -2408,7 +2445,7 @@ pub const Server = struct {
2408	}	2445	}
2409	const upd = s.tracker.update(self.alloc, s.eng) catch return;	2446	const upd = s.tracker.update(self.alloc, s.eng) catch return;
2410	switch (upd) {	2447	switch (upd) {
2411	.none => {},	2448	.none => for (0..max_clients) \|i\| self.sendSelectionState(si, i),
2412	.discontinuity => self.resyncSnapshot(si),	2449	.discontinuity => self.resyncSnapshot(si),
2413	.advanced => {	2450	.advanced => {
2414	// Losing the payload would strand the clients a seq behind	2451	// Losing the payload would strand the clients a seq behind
@@ -2662,6 +2699,9 @@ pub const Server = struct {
2662	/// unlike sendResync: every attached client was told the mode on attach	2699	/// unlike sendResync: every attached client was told the mode on attach
2663	/// and at each change; a resync that skips it breaks that, silently.	2700	/// and at each change; a resync that skips it breaks that, silently.
2664	pub fn resyncSnapshot(self: *Server, si: usize) void {	2701	pub fn resyncSnapshot(self: *Server, si: usize) void {
		2702	for (0..max_clients) \|i\| {
		2703	if (self.inSession(i, si)) self.clients[i].?.clearSelection();
		2704	}
2665	if (!self.rebuildTracker(si)) return;	2705	if (!self.rebuildTracker(si)) return;
2666	if (!self.hasClientsIn(si)) return;	2706	if (!self.hasClientsIn(si)) return;
2667	const payload = self.buildSnapshotPayload(si) catch return;	2707	const payload = self.buildSnapshotPayload(si) catch return;

src/server/server_test_attach.zig

Old		New
@@ -610,6 +610,7 @@ test "Server: scrollback fetch is per-client and independent" {
610	if (frame.type != .selection_reply) return;	610	if (frame.type != .selection_reply) return;
611	const self: *@This() = @ptrCast(@alignCast(ctx.?));	611	const self: *@This() = @ptrCast(@alignCast(ctx.?));
612	const reply = try proto.decodeSelectionReply(frame.payload);	612	const reply = try proto.decodeSelectionReply(frame.payload);
		613	if (reply.id == 0) return;
613	switch (self.n) {	614	switch (self.n) {
614	0 => {	615	0 => {
615	try std.testing.expectEqual(@as(u32, 77), reply.id);	616	try std.testing.expectEqual(@as(u32, 77), reply.id);
@@ -656,7 +657,7 @@ test "Server: scrollback fetch is per-client and independent" {
656	fn on(_: ?*anyopaque, frame: proto.Frame) anyerror!void {	657	fn on(_: ?*anyopaque, frame: proto.Frame) anyerror!void {
657	// A fifth reply to four requests would mean the malformed frame	658	// A fifth reply to four requests would mean the malformed frame
658	// generated one of its own.	659	// generated one of its own.
659	if (frame.type == .selection_reply) return error.LateSelectionReply;	660	if (frame.type == .selection_reply and (try proto.decodeSelectionReply(frame.payload)).id != 0) return error.LateSelectionReply;
660	}	661	}
661	};	662	};
662	var status_reply: ?proto.StatusReply = null;	663	var status_reply: ?proto.StatusReply = null;

src/server/server_test_clipboard.zig

@@ @@ -12,6 +12,7 @@ const awaitFrame = h.awaitFrame; @@
+const awaitGridText = h.awaitGridText;
+const connectedPair = h.connectedPair;
+const writeDyingGapShell = h.writeDyingGapShell;
+const SelectionAction = @FieldType(proto.SelectionReq, "action");
+/// Returns the parts of the reply that outlive the frame's payload — which
+/// is the whole reason this is not `awaitFrame` spelled at each call site:
@@ @@ -21,10 +22,223 @@ fn awaitSelectionReply( @@
+    srv: *Server,
+    peer: std.posix.fd_t,
+) !?struct { id: u32, status: proto.SelectionStatus, text_len: usize } {
+    // Every grid update also carries an id-zero source/position state. A
+    // direct extraction is correlated by its nonzero id, as ClientCore is.
+    for (0..16) |_| {
+        const frame = (try awaitFrame(alloc, srv, peer, .selection_reply, 400)) orelse return null;
+        defer frame.deinit(alloc);
+        const reply = try proto.decodeSelectionReply(frame.payload);
+        if (reply.id == 0) continue;
+        return .{ .id = reply.id, .status = reply.status, .text_len = reply.text.len };
+    }
+    return null;
+}
+const TrackedReply = struct {
+    id: u32,
+    gesture: u32,
+    seq: u64,
+    source: u64,
+    status: proto.SelectionStatus,
+    anchor: proto.SelectionPoint,
+    active: proto.SelectionPoint,
+    text: [128]u8 = undefined,
+    text_len: usize = 0,
+    fn textValue(self: *const TrackedReply) []const u8 {
+        return self.text[0..self.text_len];
+    }
+};
+/// Position updates have id zero; a copy/start reply carries its request id.
+/// Skip the other client-local updates so tests never depend on send order.
+fn awaitTracked(
+    alloc: std.mem.Allocator,
+    srv: *Server,
+    peer: std.posix.fd_t,
+    gesture: u32,
+    id: u32,
+) !?TrackedReply {
+    for (0..16) |_| {
+        const frame = (try awaitFrame(alloc, srv, peer, .selection_reply, 400)) orelse return null;
+        defer frame.deinit(alloc);
+        const reply = try proto.decodeSelectionReply(frame.payload);
+        if (reply.gesture != gesture or reply.id != id) continue;
+        if (reply.text.len > 128) return error.TrackedTextTooLong;
+        var result: TrackedReply = .{
+            .id = reply.id,
+            .gesture = reply.gesture,
+            .seq = reply.seq,
+            .source = reply.source,
+            .status = reply.status,
+            .anchor = reply.anchor,
+            .active = reply.active,
+        };
+        @memcpy(result.text[0..reply.text.len], reply.text);
+        result.text_len = reply.text.len;
+        return result;
+    }
+    return null;
+}
+fn writeTracked(
+    peer: std.posix.fd_t,
+    action: SelectionAction,
+    id: u32,
+    gesture: u32,
+    epoch: u64,
+    source: u64,
+    anchor: proto.SelectionPoint,
+    active: proto.SelectionPoint,
+) !void {
+    const bytes = proto.encodeSelectionReq(.{
+        .action = action,
+        .id = id,
+        .gesture = gesture,
+        .epoch = epoch,
+        .source = source,
+        .anchor = anchor,
+        .active = active,
+    });
+    try proto.writeFrame(peer, .selection_req, &bytes);
+}
+fn attachTracked(alloc: std.mem.Allocator, td: *h.TestDaemon) !std.net.Stream {
+    const c = try dial.dialAttach(td.sock_path, 16, 9);
+    errdefer c.close();
+    (try awaitFrame(alloc, &td.srv, c.handle, .snapshot, 400) orelse return error.NoTrackedSnapshot).deinit(alloc);
+    const state_frame = (try awaitFrame(alloc, &td.srv, c.handle, .selection_reply, 400)) orelse return error.NoTrackedSource;
+    defer state_frame.deinit(alloc);
+    const state = try proto.decodeSelectionReply(state_frame.payload);
+    if (state.id != 0 or state.gesture != 0) return error.BadTrackedSource;
+    return c;
+}
+test "Server: tracked selection rejects a stale exact source even when the grid did not change" {
+    const alloc = std.testing.allocator;
+    var td = try h.TestDaemon.init(alloc, "follow-stale", .{ .shell = "/bin/cat" });
+    defer td.deinit();
+    const c = try attachTracked(alloc, &td);
+    defer c.close();
+    const session = td.srv.sessions.table[0].?;
+    const source = session.eng.selectionSource();
+    // Scroll a blank screen: row identities move but the rendered grid is
+    // unchanged. The source guard must still reject a delayed coordinate.
+    session.eng.feed("\x1b[1S");
+    td.srv.sendUpdate(0);
+    try writeTracked(c.handle, .start, 1, 41, session.epoch, source, .{ .row = 0, .col = 0 }, .{ .row = 0, .col = 0 });
+    const reply = (try awaitTracked(alloc, &td.srv, c.handle, 41, 1)) orelse return error.NoStaleTrackedReply;
+    try std.testing.expectEqual(proto.SelectionStatus.unavailable, reply.status);
+    try std.testing.expectEqual(@as(usize, 0), reply.text_len);
+}
+test "Server: a stale start does not retire the client's existing tracked gesture" {
+    const alloc = std.testing.allocator;
+    var td = try h.TestDaemon.init(alloc, "tracked-stale-replace", .{ .shell = "/bin/cat", .cols = 16, .rows = 9 });
+    defer td.deinit();
+    const c = try attachTracked(alloc, &td);
+    defer c.close();
+    const session = td.srv.sessions.table[0].?;
+    session.eng.feed("KEEP");
+    td.srv.sendUpdate(0);
+    const source = session.eng.selectionSource();
+    try writeTracked(c.handle, .start, 1, 71, session.epoch, source, .{ .row = 0, .col = 0 }, .{ .row = 0, .col = 3 });
+    _ = (try awaitTracked(alloc, &td.srv, c.handle, 71, 1)) orelse return error.NoInitialTrackedStart;
+    // This changes the coordinate source after gesture 71 is owned. A late
+    // gesture 72 must be refused without clearing the still-live pins.
+    session.eng.feed("\x1b[1S");
+    td.srv.sendUpdate(0);
+    try writeTracked(c.handle, .start, 2, 72, session.epoch, source, .{ .row = 0, .col = 0 }, .{ .row = 0, .col = 0 });
+    const stale = (try awaitTracked(alloc, &td.srv, c.handle, 72, 2)) orelse return error.NoStaleReplacementReply;
+    try std.testing.expectEqual(proto.SelectionStatus.unavailable, stale.status);
+    try writeTracked(c.handle, .copy, 3, 71, session.epoch, session.eng.selectionSource(), .{ .row = 0, .col = 0 }, .{ .row = 0, .col = 0 });
+    const kept = (try awaitTracked(alloc, &td.srv, c.handle, 71, 3)) orelse return error.NoKeptTrackedCopy;
+    try std.testing.expectEqual(proto.SelectionStatus.ok, kept.status);
+    try std.testing.expectEqualStrings("KEEP", kept.textValue());
+}
+test "Server: tracked selection tracks duplicate occurrences per client and clear ids cannot cross" {
+    const alloc = std.testing.allocator;
+    var td = try h.TestDaemon.init(alloc, "follow-clients", .{ .shell = "/bin/cat", .cols = 16, .rows = 9 });
+    defer td.deinit();
+    const a = try attachTracked(alloc, &td);
+    defer a.close();
+    const b = try attachTracked(alloc, &td);
+    defer b.close();
+    const session = td.srv.sessions.table[0].?;
+    session.eng.feed("DUPLICATE\r\nBEFORE\r\nDUPLICATE\r\nAFTER");
+    td.srv.sendUpdate(0);
+    const epoch = session.epoch;
+    const source = session.eng.selectionSource();
+    try writeTracked(a.handle, .start, 1, 101, epoch, source, .{ .row = 0, .col = 0 }, .{ .row = 0, .col = 8 });
+    try writeTracked(b.handle, .start, 1, 202, epoch, source, .{ .row = 2, .col = 0 }, .{ .row = 2, .col = 8 });
+    const started_a = (try awaitTracked(alloc, &td.srv, a.handle, 101, 1)) orelse return error.NoTrackedA;
+    const started_b = (try awaitTracked(alloc, &td.srv, b.handle, 202, 1)) orelse return error.NoTrackedB;
+    try std.testing.expectEqualStrings("DUPLICATE", started_a.textValue());
+    try std.testing.expectEqualStrings("DUPLICATE", started_b.textValue());
+    try std.testing.expect(started_a.anchor.row != started_b.anchor.row);
+    // Start at the bottom and append enough to shift both matching strings;
+    // no text comparison can identify which one each client intended.
+    session.eng.feed("\r\nTAIL-1\r\nTAIL-2\r\nTAIL-3\r\nTAIL-4\r\nTAIL-5\r\nTAIL-6");
+    td.srv.sendUpdate(0);
+    const moved_a = (try awaitTracked(alloc, &td.srv, a.handle, 101, 0)) orelse return error.NoMovedTrackedA;
+    const moved_b = (try awaitTracked(alloc, &td.srv, b.handle, 202, 0)) orelse return error.NoMovedTrackedB;
+    try std.testing.expect(moved_a.anchor.row != moved_b.anchor.row);
+    // A foreign clear cannot destroy A's pins. Its following copy must still
+    // name A's original duplicate, not B's or a current coordinate.
+    try writeTracked(a.handle, .clear, 0, 999, epoch, source, .{ .row = 0, .col = 0 }, .{ .row = 0, .col = 0 });
+    try writeTracked(a.handle, .copy, 2, 101, epoch, source, .{ .row = 0, .col = 0 }, .{ .row = 0, .col = 0 });
+    const copied_a = (try awaitTracked(alloc, &td.srv, a.handle, 101, 2)) orelse return error.NoTrackedCopy;
+    try std.testing.expectEqual(proto.SelectionStatus.ok, copied_a.status);
+    try std.testing.expectEqualStrings("DUPLICATE", copied_a.textValue());
+}
+test "Server: tracked selection is retired by resync, resize and detach" {
+    const alloc = std.testing.allocator;
+    var td = try h.TestDaemon.init(alloc, "follow-retire", .{ .shell = "/bin/cat", .cols = 16, .rows = 9 });
+    defer td.deinit();
+    var c = try attachTracked(alloc, &td);
+    var c_open = true;
+    defer if (c_open) c.close();
+    const session = td.srv.sessions.table[0].?;
+    session.eng.feed("tracked");
+    td.srv.sendUpdate(0);
+    try writeTracked(c.handle, .start, 1, 77, session.epoch, session.eng.selectionSource(), .{ .row = 0, .col = 0 }, .{ .row = 0, .col = 6 });
+    _ = (try awaitTracked(alloc, &td.srv, c.handle, 77, 1)) orelse return error.NoTrackedFollow;
+    td.srv.resyncSnapshot(0);
+    const resynced = (try awaitTracked(alloc, &td.srv, c.handle, 0, 0)) orelse return error.NoResyncFollow;
+    try std.testing.expectEqual(proto.SelectionStatus.unavailable, resynced.status);
+    // Re-arm before a real client resize; its snapshot and following state
+    // must likewise retire the pins rather than projecting them through reflow.
+    try writeTracked(c.handle, .start, 2, 78, session.epoch, session.eng.selectionSource(), .{ .row = 0, .col = 0 }, .{ .row = 0, .col = 6 });
+    _ = (try awaitTracked(alloc, &td.srv, c.handle, 78, 2)) orelse return error.NoResizeFollowStart;
+    const size = proto.encodeSize(17, 9);
+    try proto.writeFrame(c.handle, .resize, &size);
+    const resized = (try awaitTracked(alloc, &td.srv, c.handle, 0, 0)) orelse return error.NoResizeFollow;
+    try std.testing.expectEqual(proto.SelectionStatus.unavailable, resized.status);
+    // Socket closure takes the sole teardown path. The testing allocator at
+    // TestDaemon.deinit then proves its tracked pins were unregistered.
+    c.close();
+    c_open = false;
+    var detached = false;
+    for (0..80) |_| {
+        try td.srv.pumpOnce(5);
+        if (!td.srv.hasClientsIn(0)) {
+            detached = true;
+            break;
+        }
+    }
+    try std.testing.expect(detached);
+test "Server: a session-less slot still answers a well-formed selection request" {
+    });
+    const real = td.srv.alloc;
+    td.srv.alloc = failing.allocator();
+    td.srv.queueSelectionReply(0, .{ .id = 99, .status = .ok, .history_rows = 7, .text = text });
+    td.srv.alloc = real;
+    try std.testing.expect(failing.has_induced_failure);

src/server/server_test_deliver.zig

Old		New
@@ -61,8 +61,8 @@ test "Server: a stalled client does not block delivery to others" {
61	try std.testing.expect(td.srv.clients[1] != null);	61	try std.testing.expect(td.srv.clients[1] != null);
62	try std.testing.expectEqual(@as(usize, 0), td.srv.clients[1].?.pending.items.len);	62	try std.testing.expectEqual(@as(usize, 0), td.srv.clients[1].?.pending.items.len);
63		63
64	// ...and what it received is whole parseable frames, one snapshot per	64	// ...and what it received is whole parseable snapshot/state pairs, one
65	// round, not a stream truncated or interleaved by A's backpressure.	65	// per round, not a stream truncated or interleaved by A's backpressure.
66	var frames: usize = 0;	66	var frames: usize = 0;
67	while (frames < rounds) : (frames += 1) {	67	while (frames < rounds) : (frames += 1) {
68	const f = (try proto.readFrame(alloc, b.peer)) orelse break;	68	const f = (try proto.readFrame(alloc, b.peer)) orelse break;
@@ -70,6 +70,12 @@ test "Server: a stalled client does not block delivery to others" {
70	try std.testing.expectEqual(proto.MsgType.snapshot, f.type);	70	try std.testing.expectEqual(proto.MsgType.snapshot, f.type);
71	const p = try proto.readSnapshotPrefix(f.payload);	71	const p = try proto.readSnapshotPrefix(f.payload);
72	try std.testing.expectEqual(@as(u16, 80), p.cols);	72	try std.testing.expectEqual(@as(u16, 80), p.cols);
		73	const state = (try proto.readFrame(alloc, b.peer)) orelse return error.NoSnapshotSource;
		74	defer state.deinit(alloc);
		75	try std.testing.expectEqual(proto.MsgType.selection_reply, state.type);
		76	const reply = try proto.decodeSelectionReply(state.payload);
		77	try std.testing.expectEqual(@as(u32, 0), reply.id);
		78	try std.testing.expectEqual(@as(u32, 0), reply.gesture);
73	}	79	}
74	try std.testing.expectEqual(rounds, frames);	80	try std.testing.expectEqual(rounds, frames);
75	}	81	}

src/server/server_test_harness.zig

Old		New
@@ -525,7 +525,12 @@ pub const ReplicaFeed = struct {
525	pub fn on(ctx: ?*anyopaque, frame: proto.Frame) anyerror!void {	525	pub fn on(ctx: ?*anyopaque, frame: proto.Frame) anyerror!void {
526	const self: *@This() = @ptrCast(@alignCast(ctx.?));	526	const self: *@This() = @ptrCast(@alignCast(ctx.?));
527	for (self.w.reject) \|bad\| {	527	for (self.w.reject) \|bad\| {
528	if (frame.type == bad) return error.RejectedFrameArrived;	528	if (frame.type == bad) {
		529	// Unsolicited position metadata accompanies every grid. Only
		530	// a correlated copy reply would leak another client's read.
		531	if (bad == .selection_reply and (try proto.decodeSelectionReply(frame.payload)).id == 0) continue;
		532	return error.RejectedFrameArrived;
		533	}
529	}	534	}
530	// applyFrame ignores everything that is not state, so the stream's	535	// applyFrame ignores everything that is not state, so the stream's
531	// replies and marks pass through untouched.	536	// replies and marks pass through untouched.

src/tui/interact.zig

src/tui/paint.zig

Old		New
@@ -18,8 +18,8 @@ pub const sync_end = "\x1b[?25h\x1b[?2026l";
18	/// Inclusive grid columns of one row, painted inverted.	18	/// Inclusive grid columns of one row, painted inverted.
19	pub const Span = struct { from: u16, to: u16 };	19	pub const Span = struct { from: u16, to: u16 };
20		20
21	/// A callback, not a shape: `select.zig` is a sibling child file of the same	21	/// A callback, not a shape: `client.selection` owns selection state, while
22	/// module root, and neither file imports the other.	22	/// this file adapts its spans into painted output.
23	pub const Highlight = struct {	23	pub const Highlight = struct {
24	ctx: ?*anyopaque = null,	24	ctx: ?*anyopaque = null,
25	span: ?const fn (?anyopaque, row: u16, cols: u16) ?Span = null,	25	span: ?const fn (?anyopaque, row: u16, cols: u16) ?Span = null,

src/tui/select.zig

Old		New
@@ -1,350 +0,0 @@
1	//! The drag behind text selection, as pure state: press, motion, release, and
2	//! the span of columns highlighted on one line of one session.
3	//!
4	//! No tty, no transport, no engine, no allocation beyond its own struct — a
5	//! driver resolves a mouse report into `Hit` and this owns what a SEQUENCE of
6	//! those means, which is what lets two drivers in different layers share one
7	//! meaning. Resolving a terminal row to a session line stays with the layout.
8	//!
9	//! Rows are ABSOLUTE, counted from the oldest row the daemon retains: a drag
10	//! held while the session scrolls must keep naming the lines it started over,
11	//! and a terminal row renames itself the moment output moves the window.
12	const std = @import("std");
13
14	/// One place in one session, as a driver has resolved a report.
15	pub const Hit = struct {
16	tile: usize,
17	/// Absolute row: counted from the oldest row the daemon still retains.
18	row: u32,
19	/// Grid column, zero-based. Terminal column is the same number —
20	/// every painter emits from column 1 with no x-offset.
21	col: u16,
22	};
23
24	/// A zero-based terminal cell, which is not a `Hit`: it is where the POINTER
25	/// is, not what is under it. The two part company when the session scrolls, and
26	/// telling a click from a drag is the pointer's question.
27	pub const Cell = struct { row: u16, col: u16 };
28
29	/// Inclusive columns, the same convention `engine.extractSelection` and
30	/// ghostty's `Selection` use at the other end of the wire.
31	pub const Span = struct { from: u16, to: u16 };
32
33	/// A completed selection, normalized: `from` is at or before `to` in
34	/// reading order, whichever way the hand moved.
35	pub const Range = struct {
36	from: Hit,
37	to: Hit,
38
39	/// On `Range` rather than `Drag` because two get compared: a drag that moved
40	/// repaints the rows whose span CHANGED. `cols` is the GRID's width, and the
41	/// clamp is not decoration — a grid narrower than its terminal has columns a
42	/// pointer can reach with no cell behind them.
43	pub fn span(self: Range, tile: usize, row: u32, cols: u16) ?Span {
44	if (self.from.tile != tile) return null;
45	if (row < self.from.row or row > self.to.row) return null;
46	const from = if (row == self.from.row) self.from.col else 0;
47	const to = @min(if (row == self.to.row) self.to.col else cols -\| 1, cols -\| 1);
48	// A selection whose whole width fell off the grid's right edge
49	// highlights nothing on this row, rather than one clamped cell at
50	// the edge that nobody pointed at.
51	if (from > to) return null;
52	return .{ .from = from, .to = to };
53	}
54	};
55
56	/// What a button coming up meant.
57	pub const Release = union(enum) {
58	/// Nothing was down, or the press landed on nothing selectable.
59	nothing,
60	/// Press and release in one cell. Not a selection — tmux's
61	/// `MouseDown1Pane`, which a driver answers by moving its own
62	/// selection to the thing clicked.
63	click: Hit,
64	/// A drag that ended. The highlight STANDS after this: it is what a
65	/// copy is taken from, and what the next press or `clear` drops.
66	selection: Range,
67	};
68
69	/// One button's worth of drag. Four states, because a press is not yet a
70	/// selection and a release is not the end of one: `.down` may still turn out to
71	/// be a click, and `.held` is a finished selection still on screen.
72	pub const Drag = struct {
73	const Phase = enum { idle, down, dragging, held };
74
75	phase: Phase = .idle,
76	/// The cell the press was on, which is what a later motion is
77	/// compared against to tell a drag from a tremor.
78	at: Cell = .{ .row = 0, .col = 0 },
79	anchor: Hit = .{ .tile = 0, .row = 0, .col = 0 },
80	active: Hit = .{ .tile = 0, .row = 0, .col = 0 },
81
82	/// Whatever was held is dropped however the press turns out: a new
83	/// press is a new selection, and a press on nothing (a label bar) is
84	/// the user putting the old one away.
85	pub fn press(self: *Drag, cell: Cell, hit: ?Hit) void {
86	const h = hit orelse {
87	self.* = .{};
88	return;
89	};
90	self.* = .{ .phase = .down, .at = cell, .anchor = h, .active = h };
91	}
92
93	/// Cell, not pixel: `?1002h` reports a CELL change, and a hand trembling
94	/// inside one cell still points at one line. Once it IS a drag it stays one.
95	/// Confined to its starting tile, or it would ask the wrong session.
96	pub fn motion(self: *Drag, cell: Cell, hit: ?Hit) void {
97	switch (self.phase) {
98	.idle, .held => return,
99	.down => {
100	if (cell.row == self.at.row and cell.col == self.at.col) return;
101	self.phase = .dragging;
102	},
103	.dragging => {},
104	}
105	const h = hit orelse return;
106	if (h.tile != self.anchor.tile) return;
107	self.active = h;
108	}
109
110	/// The button came up. See `Release` for what the three answers mean.
111	pub fn release(self: *Drag) Release {
112	switch (self.phase) {
113	.idle, .held => return .nothing,
114	.down => {
115	const hit = self.anchor;
116	self.* = .{};
117	return .{ .click = hit };
118	},
119	.dragging => {
120	self.phase = .held;
121	return .{ .selection = self.rangeLocked() };
122	},
123	}
124	}
125
126	/// Coordinates stopped meaning what they meant.
127	pub fn clear(self: *Drag) void {
128	self.* = .{};
129	}
130
131	/// A press that has not moved yet counts; `range`, by contrast,
132	/// answers only about what is on screen.
133	pub fn on(self: *const Drag) ?usize {
134	return if (self.phase == .idle) null else self.anchor.tile;
135	}
136
137	/// The selection as an ordered pair, or null while there is none.
138	pub fn range(self: *const Drag) ?Range {
139	return switch (self.phase) {
140	.idle, .down => null,
141	.dragging, .held => self.rangeLocked(),
142	};
143	}
144
145	fn rangeLocked(self: *const Drag) Range {
146	const a = self.anchor;
147	const b = self.active;
148	const forward = b.row > a.row or (b.row == a.row and b.col >= a.col);
149	return if (forward) .{ .from = a, .to = b } else .{ .from = b, .to = a };
150	}
151
152	/// `Range.span` for the live selection, or null while there is none.
153	pub fn span(self: *const Drag, tile: usize, row: u32, cols: u16) ?Span {
154	const r = self.range() orelse return null;
155	return r.span(tile, row, cols);
156	}
157	};
158
159	test "select: a press alone is a click, and highlights nothing on its way" {
160	var d: Drag = .{};
161	const hit: Hit = .{ .tile = 1, .row = 40, .col = 7 };
162	d.press(.{ .row = 12, .col = 7 }, hit);
163	// Nothing is highlighted while the button is merely down: a press that
164	// turns out to be a click must never flicker an inversion on its way.
165	try std.testing.expect(d.span(1, 40, 80) == null);
166	try std.testing.expect(d.range() == null);
167	const r = d.release();
168	try std.testing.expectEqual(@as(usize, 1), r.click.tile);
169	try std.testing.expectEqual(@as(u32, 40), r.click.row);
170	try std.testing.expectEqual(@as(u16, 7), r.click.col);
171	// ...and the click leaves nothing behind to paint.
172	try std.testing.expect(d.range() == null);
173	}
174
175	test "select: a drag names its tile from the press, before it is a selection" {
176	var d: Drag = .{};
177	try std.testing.expect(d.on() == null);
178	d.press(.{ .row = 2, .col = 1 }, .{ .tile = 3, .row = 5, .col = 1 });
179	// Pressed, not yet dragged: nothing to paint, and still a tile whose
180	// coordinates a caller may have to drop.
181	try std.testing.expect(d.range() == null);
182	try std.testing.expectEqual(@as(usize, 3), d.on().?);
183	d.motion(.{ .row = 4, .col = 1 }, .{ .tile = 3, .row = 7, .col = 1 });
184	try std.testing.expectEqual(@as(usize, 3), d.on().?);
185	_ = d.release();
186	// Still held after the button came up, which is what a highlight is.
187	try std.testing.expectEqual(@as(usize, 3), d.on().?);
188	d.clear();
189	try std.testing.expect(d.on() == null);
190	}
191
192	test "select: a press on nothing selectable is nothing at all" {
193	var d: Drag = .{};
194	d.press(.{ .row = 0, .col = 3 }, null);
195	d.motion(.{ .row = 4, .col = 9 }, .{ .tile = 0, .row = 5, .col = 9 });
196	try std.testing.expect(d.range() == null);
197	try std.testing.expect(d.release() == .nothing);
198	}
199
200	test "select: either drag direction yields the same ordered pair" {
201	const top: Hit = .{ .tile = 0, .row = 100, .col = 4 };
202	const bot: Hit = .{ .tile = 0, .row = 103, .col = 12 };
203
204	var down: Drag = .{};
205	down.press(.{ .row = 2, .col = 4 }, top);
206	down.motion(.{ .row = 5, .col = 12 }, bot);
207	const a = down.release().selection;
208
209	var up: Drag = .{};
210	up.press(.{ .row = 5, .col = 12 }, bot);
211	up.motion(.{ .row = 2, .col = 4 }, top);
212	const b = up.release().selection;
213
214	try std.testing.expectEqual(a.from, b.from);
215	try std.testing.expectEqual(a.to, b.to);
216	try std.testing.expectEqual(@as(u32, 100), a.from.row);
217	try std.testing.expectEqual(@as(u16, 4), a.from.col);
218	try std.testing.expectEqual(@as(u32, 103), a.to.row);
219	try std.testing.expectEqual(@as(u16, 12), a.to.col);
220	}
221
222	test "select: a one-row drag reads left to right whichever way the hand moved" {
223	var d: Drag = .{};
224	d.press(.{ .row = 3, .col = 9 }, .{ .tile = 0, .row = 50, .col = 9 });
225	d.motion(.{ .row = 3, .col = 2 }, .{ .tile = 0, .row = 50, .col = 2 });
226	const s = d.span(0, 50, 80).?;
227	try std.testing.expectEqual(@as(u16, 2), s.from);
228	try std.testing.expectEqual(@as(u16, 9), s.to);
229	// One row, so neither neighbour is in it.
230	try std.testing.expect(d.span(0, 49, 80) == null);
231	try std.testing.expect(d.span(0, 51, 80) == null);
232	}
233
234	test "select: the ends are clipped at the anchors, and the middle is the full width" {
235	var d: Drag = .{};
236	d.press(.{ .row = 1, .col = 30 }, .{ .tile = 2, .row = 7, .col = 30 });
237	d.motion(.{ .row = 4, .col = 6 }, .{ .tile = 2, .row = 10, .col = 6 });
238
239	const first = d.span(2, 7, 80).?;
240	try std.testing.expectEqual(@as(u16, 30), first.from);
241	try std.testing.expectEqual(@as(u16, 79), first.to);
242	const middle = d.span(2, 8, 80).?;
243	try std.testing.expectEqual(@as(u16, 0), middle.from);
244	try std.testing.expectEqual(@as(u16, 79), middle.to);
245	const last = d.span(2, 10, 80).?;
246	try std.testing.expectEqual(@as(u16, 0), last.from);
247	try std.testing.expectEqual(@as(u16, 6), last.to);
248	// Outside the range on both sides.
249	try std.testing.expect(d.span(2, 6, 80) == null);
250	try std.testing.expect(d.span(2, 11, 80) == null);
251	}
252
253	test "select: the highlight is one tile's, and the drag cannot leave it" {
254	var d: Drag = .{};
255	d.press(.{ .row = 2, .col = 1 }, .{ .tile = 0, .row = 5, .col = 1 });
256	// A drag onto the neighbouring stripe: it IS a drag, and the active
257	// end stays on the last line of the tile it started in.
258	d.motion(.{ .row = 9, .col = 40 }, .{ .tile = 1, .row = 200, .col = 40 });
259	const s = d.span(0, 5, 80).?;
260	try std.testing.expectEqual(@as(u16, 1), s.from);
261	try std.testing.expectEqual(@as(u16, 1), s.to);
262	// Neither the row it strayed onto nor the tile it strayed into.
263	try std.testing.expect(d.span(1, 200, 80) == null);
264	try std.testing.expect(d.span(0, 200, 80) == null);
265	// The same rows, asked for as somebody else's tile, are not the answer.
266	try std.testing.expect(d.span(1, 5, 80) == null);
267	}
268
269	test "select: a pointer that never leaves the press cell has not dragged" {
270	var d: Drag = .{};
271	d.press(.{ .row = 6, .col = 20 }, .{ .tile = 0, .row = 6, .col = 20 });
272	// `?1002h` reports on a cell change, but a terminal repeating the cell
273	// must not turn a click into an empty selection.
274	d.motion(.{ .row = 6, .col = 20 }, .{ .tile = 0, .row = 6, .col = 20 });
275	try std.testing.expect(d.range() == null);
276	try std.testing.expect(d.release() == .click);
277	}
278
279	test "select: a drag that comes back to where it started is still a drag" {
280	var d: Drag = .{};
281	const home: Hit = .{ .tile = 0, .row = 6, .col = 20 };
282	d.press(.{ .row = 6, .col = 20 }, home);
283	d.motion(.{ .row = 6, .col = 25 }, .{ .tile = 0, .row = 6, .col = 25 });
284	d.motion(.{ .row = 6, .col = 20 }, home);
285	try std.testing.expect(d.release() == .selection);
286	// One cell selected, and it is still on screen after the button is up.
287	const s = d.span(0, 6, 80).?;
288	try std.testing.expectEqual(@as(u16, 20), s.from);
289	try std.testing.expectEqual(@as(u16, 20), s.to);
290	}
291
292	test "select: the highlight outlives the release, and dies on clear" {
293	var d: Drag = .{};
294	d.press(.{ .row = 0, .col = 0 }, .{ .tile = 0, .row = 3, .col = 0 });
295	d.motion(.{ .row = 1, .col = 5 }, .{ .tile = 0, .row = 4, .col = 5 });
296	_ = d.release();
297	try std.testing.expect(d.span(0, 3, 80) != null);
298	// A motion after the button is up is somebody else's pointer moving
299	// over a selection that is finished.
300	d.motion(.{ .row = 8, .col = 8 }, .{ .tile = 0, .row = 11, .col = 8 });
301	try std.testing.expectEqual(@as(u32, 4), d.range().?.to.row);
302	try std.testing.expect(d.release() == .nothing);
303	d.clear();
304	try std.testing.expect(d.range() == null);
305	try std.testing.expect(d.span(0, 3, 80) == null);
306	}
307
308	test "select: a new press drops the selection the last one left" {
309	var d: Drag = .{};
310	d.press(.{ .row = 0, .col = 0 }, .{ .tile = 0, .row = 3, .col = 0 });
311	d.motion(.{ .row = 1, .col = 5 }, .{ .tile = 0, .row = 4, .col = 5 });
312	_ = d.release();
313	d.press(.{ .row = 7, .col = 2 }, .{ .tile = 0, .row = 10, .col = 2 });
314	try std.testing.expect(d.span(0, 3, 80) == null);
315	try std.testing.expect(d.range() == null);
316	// ...and a press on nothing drops it just as thoroughly.
317	d.motion(.{ .row = 7, .col = 6 }, .{ .tile = 0, .row = 10, .col = 6 });
318	try std.testing.expect(d.range() != null);
319	d.press(.{ .row = 0, .col = 0 }, null);
320	try std.testing.expect(d.range() == null);
321	}
322
323	test "select: a motion with no button down selects nothing" {
324	var d: Drag = .{};
325	d.motion(.{ .row = 4, .col = 4 }, .{ .tile = 0, .row = 4, .col = 4 });
326	try std.testing.expect(d.range() == null);
327	try std.testing.expect(d.release() == .nothing);
328	}
329
330	test "select: a span past the grid's right edge is clipped, not painted at the edge" {
331	// The tty is wider than the grid — latest-wins leaves that shape
332	// routinely — so a pointer can reach columns with no cell behind them.
333	var d: Drag = .{};
334	d.press(.{ .row = 0, .col = 90 }, .{ .tile = 0, .row = 2, .col = 90 });
335	d.motion(.{ .row = 1, .col = 95 }, .{ .tile = 0, .row = 3, .col = 95 });
336	// The first row's anchor is off the grid entirely: nothing to invert,
337	// and NOT one cell at column 39.
338	try std.testing.expect(d.span(0, 2, 40) == null);
339	// The last row runs from the left edge to the grid's own right edge.
340	const last = d.span(0, 3, 40).?;
341	try std.testing.expectEqual(@as(u16, 0), last.from);
342	try std.testing.expectEqual(@as(u16, 39), last.to);
343	}
344
345	// Forces semantic analysis of every pub decl under `zig build test`, so an
346	// unreferenced decl must at least compile (the silent-module-loss hazard,
347	// decisions.md). Pub decls only: std.meta.declarations sees nothing private.
348	test {
349	std.testing.refAllDeclsRecursive(@This());
350	}

src/tui/wall_test_harness.zig

Old		New
@@ -281,6 +281,7 @@ pub fn replyBytes(
281	std.mem.writeInt(u32, buf[0..4], id, .little);	281	std.mem.writeInt(u32, buf[0..4], id, .little);
282	buf[4] = @intFromEnum(status);	282	buf[4] = @intFromEnum(status);
283	std.mem.writeInt(u32, buf[5..9], history_rows, .little);	283	std.mem.writeInt(u32, buf[5..9], history_rows, .little);
		284	@memset(buf[9..proto.selection_reply_prefix_len], 0);
284	@memcpy(buf[proto.selection_reply_prefix_len..][0..text.len], text);	285	@memcpy(buf[proto.selection_reply_prefix_len..][0..text.len], text);
285	return buf[0 .. proto.selection_reply_prefix_len + text.len];	286	return buf[0 .. proto.selection_reply_prefix_len + text.len];
286	}	287	}

src/tui/wallview.zig

Old		New
@@ -12,6 +12,7 @@ const spawn = @import("spawn");
12	const proxy = @import("proxy");	12	const proxy = @import("proxy");
13	const grid_mod = @import("term").grid;	13	const grid_mod = @import("term").grid;
14	const paint = @import("paint.zig");	14	const paint = @import("paint.zig");
		15	const select = client.selection;
15	// Counters ride out through `Shared` because a detached pump never reaches	16	// Counters ride out through `Shared` because a detached pump never reaches
16	// a `Core.deinit`.	17	// a `Core.deinit`.
17	// The chord table and the prediction hooks a focused tile shares with the	18	// The chord table and the prediction hooks a focused tile shares with the
@@ -2641,7 +2642,6 @@ pub fn run(alloc: std.mem.Allocator, host_specs: []const HostSpec, entry: Entry)
2641	test {	2642	test {
2642	_ = @import("interact.zig");	2643	_ = @import("interact.zig");
2643	_ = @import("paint.zig");	2644	_ = @import("paint.zig");
2644	_ = @import("select.zig");
2645	_ = @import("predict.zig");	2645	_ = @import("predict.zig");
2646	_ = @import("wall_test_harness.zig");	2646	_ = @import("wall_test_harness.zig");
2647	_ = @import("wall_test_host.zig");	2647	_ = @import("wall_test_host.zig");

test/native_mouse.py

@@ @@ -0,0 +1,208 @@ @@
+#!/usr/bin/env python3
+"""Application mouse reports and OSC 52 through native SDL input and real PTYs.
+The FIFO's generic `mouse:KIND,X,Y,BUTTON,MODS` form is deliberately used
+here: it reaches the same SDL dispatch path as a user event, while the
+fixture can pin all button and modifier combinations without a compositor.
+"""
+import os
+import shlex
+import subprocess
+import sys
+import time
+sys.dont_write_bytecode = True
+from native_lifecycle import start_persistent
+from native_resize import by_id
+from native_selection import SelectionRig
+from native_tiling import eventually, require
+SHIFT = 1
+class MouseRig(SelectionRig):
+    def mouse(self, kind, point, button=0, mods=0):
+        """Inject a normalized SDL mouse event through the generic hook."""
+        x, y = point.split(',')
+        self.send(f'mouse:{kind},{x},{y},{button},{mods}')
+    def mouse_cell(self, state, pane, col, row, kind, button=0, mods=0):
+        self.mouse(kind, self.cell_point(state, pane, col, row), button, mods)
+    def desktop(self):
+        return self.clipboard()
+    def primary(self):
+        value = self.artifact('primary', '.txt').read_text()
+        if self.env['SDL_VIDEO_DRIVER'] == 'wayland':
+            external = subprocess.run(['wl-paste', '--primary', '--no-newline'], env=self.env,
+                                      capture_output=True, timeout=3)
+            if external.returncode or external.stdout.decode() != value:
+                return None
+        return value
+    def wait_desktop(self, text):
+        eventually(lambda: self.desktop() == text, 'desktop clipboard did not become ' + repr(text))
+    def wait_primary(self, text):
+        eventually(lambda: self.primary() == text, 'primary selection did not become ' + repr(text))
+def reader_program(rig, tag):
+    """A raw foreground terminal app with independent input and output oracles."""
+    source = rig.root / ('mouse-reader-' + tag + '.py')
+    received = rig.root / ('mouse-received-' + tag + '.bin')
+    control = rig.root / ('mouse-control-' + tag)
+    source.write_text(
+        'import os, select, sys, termios, tty, time\n'
+        'from pathlib import Path\n'
+        f'received=Path({str(received)!r}); control=Path({str(control)!r})\n'
+        'fd=sys.stdin.fileno(); old=termios.tcgetattr(fd); tty.setraw(fd)\n'
+        'try:\n'
+        ' sys.stdout.write("\\033[?25l\\033[2J\\033[HAPP-MOUSE-READY\\033[2;1Halpha café omega\\033[?1002h\\033[?1006h"); sys.stdout.flush()\n'
+        ' seen=0\n'
+        ' while True:\n'
+        '  if control.exists():\n'
+        '   commands=control.read_text()[seen:]; seen += len(commands)\n'
+        '   for command in commands.splitlines():\n'
+        '    if command == "off":\n'
+        '     sys.stdout.write("\\033[?1002l\\033[4;1HMODE-OFF"); sys.stdout.flush(); continue\n'
+        '    if command == "on":\n'
+        '     sys.stdout.write("\\033[?1002h\\033[4;1HMODE-ON "); sys.stdout.flush(); continue\n'
+        '    target={"c":"c","p":"p","s":"s","bad":"c","q":"q"}.get(command)\n'
+        '    if target:\n'
+        '     value={"c":"DESKTOP-C","p":"PRIMARY-P","s":"PRIMARY-S","bad":"\\x00","q":"IGNORED-Q"}[command]\n'
+        '     import base64\n'
+        '     sys.stdout.write("\\033]52;"+target+";"+base64.b64encode(value.encode()).decode()+"\\a"); sys.stdout.flush()\n'
+        '  ready, _, _ = select.select([fd], [], [], .02)\n'
+        '  if ready:\n'
+        '   data=os.read(fd, 4096)\n'
+        '   if not data: break\n'
+        '   with received.open("ab") as out: out.write(data)\n'
+        'finally:\n'
+        ' termios.tcsetattr(fd, termios.TCSADRAIN, old)\n')
+    return source, received, control
+def start_reader(rig, pane, tag):
+    source, received, control = reader_program(rig, tag)
+    rig.focus(pane)  # A real Wayland pointer serial precedes any OSC 52 write.
+    rig.shell('python3 ' + shlex.quote(str(source)))
+    rig.wait_state(lambda s: 'APP-MOUSE-READY' in by_id(s)[pane]['painted_text'])
+    return received, control
+def bytes_after(path, offset, expected, message):
+    eventually(lambda: path.exists() and path.stat().st_size >= offset + len(expected), message)
+    actual = path.read_bytes()[offset:]
+    require(actual == expected, f'{message}: got {actual!r}, expected {expected!r}')
+def application_drag(rig, pane, other):
+    received, control = start_reader(rig, pane, 'direct')
+    state = rig.state()
+    # 1002 + 1006: left press, held motion, then SGR release. The cells
+    # are one-based on the wire and relative to the selected source pane.
+    rig.mouse_cell(state, pane, 0, 1, 'down')
+    rig.mouse_cell(state, pane, 4, 1, 'move')
+    rig.mouse_cell(state, pane, 4, 1, 'up')
+    expected = b'\033[<0;1;2M\033[<32;5;2M\033[<0;5;2m'
+    bytes_after(received, 0, expected, 'application press/drag/release did not reach its PTY')
+    # Middle/right belong to the application too. Adding Shift after
+    # press changes report modifiers without turning this into local copy.
+    for button in (1, 2):
+        offset = received.stat().st_size
+        rig.mouse_cell(state, pane, 0, 1, 'down', button=button)
+        rig.mouse_cell(state, pane, 4, 1, 'move', button=button, mods=SHIFT)
+        rig.mouse_cell(state, pane, 4, 1, 'up', button=button, mods=SHIFT)
+        expected = (f'\033[<{button};1;2M\033[<{button + 36};5;2M'
+                    f'\033[<{button + 4};5;2m').encode()
+        bytes_after(received, offset, expected, 'application modified button drag did not reach its PTY')
+    # A terminal mode change cancels a held app gesture but sends one
+    # release in the original SGR format, so the application cannot keep
+    # its button state stuck. Subsequent pointer events stay local until
+    # the application enables reporting again.
+    offset = received.stat().st_size
+    rig.mouse_cell(state, pane, 0, 1, 'down')
+    bytes_after(received, offset, b'\033[<0;1;2M', 'application press before mode change missing')
+    with control.open('a') as out:
+        out.write('off\n')
+    rig.wait_state(lambda s: 'MODE-OFF' in by_id(s)[pane]['painted_text'])
+    eventually(lambda: received.read_bytes()[offset:] == b'\033[<0;1;2M\033[<0;1;2m',
+               'mode change did not release the held application button')
+    rig.mouse_cell(state, pane, 4, 1, 'up')
+    time.sleep(.08)
+    require(received.read_bytes()[offset:] == b'\033[<0;1;2M\033[<0;1;2m',
+            'stale release after mode cancellation reached the application')
+    with control.open('a') as out:
+        out.write('on\n')
+    rig.wait_state(lambda s: 'MODE-ON' in by_id(s)[pane]['painted_text'])
+    # Shift latches a local selection even while the application has mouse
+    # reporting. It must not append any input to the terminal application.
+    offset = received.stat().st_size
+    rig.mouse_cell(state, pane, 0, 1, 'down', mods=SHIFT)
+    rig.mouse_cell(state, pane, 4, 1, 'move')
+    rig.mouse_cell(state, pane, 4, 1, 'up')
+    rig.wait_desktop('alpha')
+    time.sleep(.12)
+    require(received.stat().st_size == offset, 'Shift local drag leaked application mouse bytes')
+    # Capture stays with the original pane. A move over another tile must
+    # report the source pane's clamped edge, never a neighbour coordinate.
+    state = rig.state()
+    source = by_id(state)[pane]
+    other_content = by_id(state)[other]['content']
+    endpoint = rig.cell_point(state, other, 4, 1)
+    end_x = other_content['x'] + 4.5 * state['cell_w']
+    end_y = other_content['y'] + 1.5 * state['cell_h']
+    offset = received.stat().st_size
+    rig.mouse_cell(state, pane, 0, 1, 'down')
+    rig.mouse('move', endpoint)
+    rig.mouse('up', endpoint)
+    edge_x = max(0, min(source['cols'] - 1, int((end_x - source['content']['x']) / state['cell_w']))) + 1
+    edge_y = max(0, min(source['rows'] - 1, int((end_y - source['content']['y']) / state['cell_h']))) + 1
+    expected = (f'\033[<0;1;2M\033[<32;{edge_x};{edge_y}M\033[<0;{edge_x};{edge_y}m').encode()
+    bytes_after(received, offset, expected, 'cross-pane capture changed application source or missed release')
+    # OSC 52 C owns desktop clipboard; P and S update primary only. An
+    # unsafe decoded NUL and an unsupported target leave prior ownership.
+    for command, primary in (('c', None), ('p', 'PRIMARY-P'), ('s', 'PRIMARY-S')):
+        with control.open('a') as out:
+            out.write(command + '\n')
+        if command == 'c':
+            rig.wait_desktop('DESKTOP-C')
+        else:
+            rig.wait_primary(primary)
+            require(rig.desktop() == 'DESKTOP-C', f'OSC 52 {command} overwrote desktop clipboard')
+    with control.open('a') as out:
+        out.write('bad\nq\n')
+    time.sleep(.15)
+    require(rig.desktop() == 'DESKTOP-C' and rig.primary() == 'PRIMARY-S',
+            'invalid or unsupported OSC 52 write changed clipboard ownership')
+    rig.ok('application mouse bytes, Shift local drag, source capture, and OSC 52 targets')
+def main():
+    require(len(sys.argv) == 3, 'usage: native_mouse.py MUX MUXG')
+    rig = MouseRig(*sys.argv[1:])
+    try:
+        refs = start_persistent(rig)
+        panes = list(refs)
+        application_drag(rig, panes[1], panes[2])
+        rig.kernel_sizes()
+        rig.assert_cli_untouched()
+        rig.quit()
+        print('Native mouse acceptance passed; artifacts:', rig.root, flush=True)
+    except BaseException:
+        rig.failure_artifacts()
+        raise
+    finally:
+        rig.close()
+if __name__ == '__main__':
+    main()

test/native_selection.py

@@ @@ -0,0 +1,448 @@ @@
+#!/usr/bin/env python3
+"""Real drag events, daemon extraction, framebuffer and desktop clipboard oracles."""
+import os
+import shlex
+import signal
+import subprocess
+import sys
+import time
+sys.dont_write_bytecode = True
+from native_lifecycle import LifecycleRig, start_persistent
+from native_resize import by_id
+from native_theme import pixel
+from native_tiling import eventually, require
+class SelectionRig(LifecycleRig):
+    pointer = None
+    def send(self, *lines):
+        if self.env['SDL_VIDEO_DRIVER'] != 'wayland':
+            return super().send(*lines)
+        from wayland_pointer import Pointer
+        for line in lines:
+            kind, _, coords = line.partition(':')
+            if kind in ('mousedown', 'mousemove', 'mouseup', 'click'):
+                if self.pointer is None:
+                    binary = os.environ.get('MUXG_TEST_POINTER')
+                    require(binary, 'Wayland clipboard acceptance requires MUXG_TEST_POINTER')
+                    self.pointer = Pointer(binary, self.env, self.gui.pid)
+                    subprocess.run(['swaymsg', f'[pid={self.gui.pid}] focus'], env=self.env,
+                                   capture_output=True, check=True, timeout=3)
+                    self.pointer.move(*map(float, coords.split(',')))
+                    self.state()  # Deliver initial window focus before testing a pane click.
+                self.pointer.event(kind, *map(float, coords.split(',')))
+            else:
+                super().send(line)
+    def close(self):
+        try:
+            if self.pointer is not None:
+                self.pointer.close()
+                self.pointer = None
+        finally:
+            super().close()
+    def clipboard(self):
+        value = self.artifact('clipboard', '.txt').read_text()
+        if self.env['SDL_VIDEO_DRIVER'] == 'wayland':
+            # A separate client asks the compositor, not the application hook.
+            external = subprocess.run(['wl-paste', '--no-newline'], env=self.env,
+                                      capture_output=True, timeout=3)
+            self.clipboard_observed = {'sdl': value, 'desktop': external.stdout.decode(),
+                                       'error': external.stderr.decode()}
+            # SDL publishes asynchronously to the compositor. Poll for both
+            # clients to agree instead of treating offer propagation as failure.
+            if external.returncode or external.stdout.decode() != value:
+                return None
+        return value
+    def cell_point(self, state, pane_id, col, row):
+        content = by_id(state)[pane_id]['content']
+        return self.point(state, content['x'] + (col + .5) * state['cell_w'],
+                          content['y'] + (row + .5) * state['cell_h'])
+    def select(self, pane_id, start, finish, release=True):
+        state = self.state()
+        a, b = (self.cell_point(state, pane_id, *cell) for cell in (start, finish))
+        self.send('mousedown:' + a, 'mousemove:' + b)
+        if release:
+            self.send('mouseup:' + b)
+        return state
+    def copied(self, text):
+        try:
+            eventually(lambda: self.clipboard() == text, 'clipboard did not become ' + repr(text))
+        except AssertionError as error:
+            raise AssertionError(f'{error}; observed {getattr(self, "clipboard_observed", None)}') from error
+    def unchanged(self, text):
+        # Observe over several event-loop turns so a queued reply has a chance
+        # to arrive; a single immediate equality would miss a late overwrite.
+        until = time.monotonic() + .35
+        while time.monotonic() < until:
+            require(self.clipboard() == text, 'cancelled selection changed clipboard')
+            time.sleep(.025)
+def specimen(rig, pane_id, tag):
+    rig.focus(pane_id)
+    pane = by_id(rig.state())[pane_id]
+    require(pane['cols'] >= 22 and pane['rows'] >= 9, 'selection specimen needs 22x9 cells')
+    wrap = 'W' * pane['cols'] + 'RAP'
+    marker = 'READY-' + tag + '-' + str(rig.serial)
+    output = ('\033[0m\033[2J\033[H' + tag + '\033[2;1Halpha café 界 omega'
+              '\033[3;1Hhard one\r\nhard two   '
+              '\033[5;1H' + wrap + '\033[8;1H' + marker + '\033[9;1H')
+    escaped = output.replace('\033', '\\033').replace('\r', '\\r').replace('\n', '\\n')
+    rig.shell("export PS1=''; printf '%b' " + shlex.quote(escaped))
+    rig.wait_state(lambda s: marker in by_id(s)[pane_id]['painted_text'])
+    return wrap
+def cell_background(rig, state, pane_id, col, row):
+    rect = by_id(state)[pane_id]['content']
+    # Cell corner avoids glyph ink and samples actual completed painted state.
+    return pixel(rig.last_pixels(), rect['x'] + col * state['cell_w'] + 1,
+                 rect['y'] + row * state['cell_h'] + 1)
+def arm_output(rig, pane_id, label, row=7):
+    """Shell-owned output released by a file, with no input during the drag."""
+    trigger = rig.root / label
+    rig.focus(pane_id)
+    rig.shell('(while ! test -e ' + shlex.quote(str(trigger)) +
+              "; do sleep .02; done; printf '\\033[" + str(row) + ";1H" + label + "') &")
+    return trigger
+def copy_shortcut(rig, pane):
+    """Observe copy and SIGINT independently in a real foreground PTY process."""
+    rig.focus(pane)
+    interrupted, stop = (rig.root / name for name in ('copy-sigint', 'copy-stop'))
+    program = rig.root / 'copy-foreground.py'
+    program.write_text(
+        'import signal, time\nfrom pathlib import Path\n'
+        f'interrupted = Path({str(interrupted)!r})\nstop = Path({str(stop)!r})\n'
+        'def on_interrupt(signum, frame):\n'
+        '    with interrupted.open("a") as out: out.write("INT\\n")\n'
+        'signal.signal(signal.SIGINT, on_interrupt)\n'
+        'print("\\033[0m\\033[2J\\033[HCOPY-READY\\033[2;1Halpha café omega\\033[4;1H", end="", flush=True)\n'
+        'while not stop.exists(): time.sleep(.02)\n')
+    rig.shell('python3 ' + shlex.quote(str(program)))
+    state = rig.wait_state(lambda s: by_id(s)[pane]['painted_text'].startswith('COPY-READY'))
+    background = cell_background(rig, state, pane, 1, 1)
+    try:
+        rig.select(pane, (6, 1), (9, 1))
+        rig.copied('café')
+        # Copy before release proves the shortcut invoked the copy path itself.
+        rig.select(pane, (0, 1), (4, 1), release=False)
+        eventually(lambda: cell_background(rig, state, pane, 1, 1) != background,
+                   'held selection was not painted before copy shortcut')
+        rig.key('copy')
+        rig.copied('alpha')
+        eventually(lambda: cell_background(rig, state, pane, 1, 1) != background,
+                   'copy shortcut cleared held selection')
+        rig.send('mouseup:' + rig.cell_point(state, pane, 4, 1))
+        rig.key('copy')
+        rig.unchanged('alpha')
+        require(not interrupted.exists(), 'copy shortcut sent SIGINT to foreground process')
+        eventually(lambda: cell_background(rig, state, pane, 1, 1) != background,
+                   'copy shortcut cleared released selection')
+        rig.focus(pane)  # Header press clears the range.
+        eventually(lambda: cell_background(rig, state, pane, 1, 1) == background,
+                   'header press did not clear selection before copy shortcut')
+        rig.key('copy')
+        rig.unchanged('alpha')
+        require(not interrupted.exists(), 'copy without selection sent SIGINT')
+        rig.key('interrupt')
+        eventually(lambda: interrupted.exists() and interrupted.read_text() == 'INT\n',
+                   'ordinary Ctrl+C did not interrupt the foreground PTY process')
+        rig.unchanged('alpha')
+        rig.ok('Ctrl+Shift+C copies and retains selection without SIGINT; plain Ctrl+C still interrupts')
+    finally:
+        stop.touch()
+    specimen(rig, pane, 'PANE-' + str(pane))
+def scale_selection(rig, pane):
+    output = os.environ.get('MUXG_TEST_SCALE_OUTPUT')
+    if not output:
+        return
+    require(rig.pointer is not None, 'scale acceptance requires real Wayland input')
+    original = next(o['scale'] for o in rig.pointer.query('get_outputs') if o['name'] == output)
+    def scale(value):
+        response = subprocess.run(['swaymsg', '-r', 'output', output, 'scale', str(value)],
+                                  env=rig.env, capture_output=True, text=True, check=True, timeout=3)
+        require('"success": true' in response.stdout, 'compositor refused fixture scale')
+        return rig.wait_state(lambda s: abs(s['width'] / s['logical_width'] - value) < .01)
+    try:
+        for value in (1, 1.5, 2):
+            specimen(rig, pane, 'SCALE-' + str(value))
+            rig.select(pane, (0, 1), (4, 1))
+            rig.copied('alpha')
+            rig.select(pane, (6, 1), (9, 1), release=False)
+            state = scale(value)
+            rig.send('mouseup:' + rig.cell_point(state, pane, 9, 1))
+            rig.unchanged('alpha')
+            specimen(rig, pane, 'SCALED-' + str(value))
+            rig.select(pane, (6, 1), (9, 1))
+            rig.copied('café')
+            rig.kernel_sizes()
+    finally:
+        scale(original)
+    rig.ok('real held drags cancel at 100/150/200% transitions; new drags copy and PTYs agree')
+def active_output(rig, pane):
+    """A real PTY keeps repainting while selection and clipboard are observed."""
+    rig.focus(pane)
+    stop = rig.root / 'counter-stop'
+    program = rig.root / 'selection-counter.py'
+    program.write_text(
+        'import os, time\nfrom pathlib import Path\n'
+        f'stop=Path({str(stop)!r})\n'
+        'os.write(1,b"\\033[?25l\\033[2J\\033[HCOUNTER-READY")\n'
+        'n=0\n'
+        'while not stop.exists():\n'
+        ' os.write(1,("\\033[2;1Halpha café omega\\033[2;21HCOUNT-%08d" % n).encode())\n'
+        ' n+=1; time.sleep(.025)\n'
+        'print("\\r\\nCOUNTER-DONE",flush=True)\n')
+    tmux_socket = rig.root / 'counter-tmux.sock'
+    nested = os.environ.get('MUXG_TEST_TMUX') == '1'
+    command = 'python3 ' + shlex.quote(str(program))
+    if nested:
+        command = ('tmux -S ' + shlex.quote(str(tmux_socket)) +
+                   ' -f /dev/null new-session -s counter ' + shlex.quote(command))
+    rig.shell(command)
+    def count(state):
+        text = by_id(state)[pane]['painted_text']
+        return int(text.split('COUNT-', 1)[1][:8]) if 'COUNT-' in text else -1
+    rig.wait_state(lambda state: count(state) >= 0)
+    wayland = rig.env['SDL_VIDEO_DRIVER'] == 'wayland'
+    windowed = rig.state()
+    original_size = (windowed['logical_width'], windowed['logical_height'])
+    try:
+        for fullscreen in ((False, True) if wayland else (False,)):
+            if wayland:
+                subprocess.run(['swaymsg', f'[pid={rig.gui.pid}] fullscreen ' +
+                                ('enable' if fullscreen else 'disable')],
+                               env=rig.env, capture_output=True, check=True, timeout=3)
+                rig.wait_state(lambda state: ((state['logical_width'], state['logical_height']) !=
+                                              original_size) == fullscreen)
+            # Let resize output settle while proving the application still runs.
+            initial = count(rig.state())
+            state = rig.wait_state(lambda state: count(state) >= initial + 8)
+            background = cell_background(rig, state, pane, 1, 1)
+            rig.select(pane, (0, 1), (4, 1), release=False)
+            initial = count(rig.state())
+            rig.wait_state(lambda state: count(state) >= initial + 12)
+            eventually(lambda: cell_background(rig, state, pane, 1, 1) != background,
+                       'active counter cleared the held selection')
+            rig.key('copy')
+            rig.copied('alpha')
+            # A second copy during the same held gesture must use the newly
+            # extended range. Release then registers its final, shorter range.
+            rig.send('mousemove:' + rig.cell_point(state, pane, 6, 1))
+            # Wayland motion and the FIFO keyboard hook arrive independently.
+            # Observe the extended highlight before asking the other channel to copy.
+            eventually(lambda: cell_background(rig, rig.state(), pane, 6, 1) != background,
+                       'held drag did not visibly extend before copying')
+            rig.key('copy')
+            rig.copied('alpha c')
+            rig.send('mouseup:' + rig.cell_point(state, pane, 4, 1))
+            rig.copied('alpha')
+            initial = count(rig.state())
+            rig.wait_state(lambda state: count(state) >= initial + 12)
+            eventually(lambda: cell_background(rig, state, pane, 1, 1) != background,
+                       'active counter cleared the released highlight')
+            rig.key('copy')
+            rig.copied('alpha')
+        rig.ok('live PTY counter keeps advancing during held/released selection and copy' +
+               (' through tmux' if nested else '') +
+               (' in windowed and fullscreen Wayland' if wayland else ''))
+    finally:
+        stop.touch()
+        if nested:
+            subprocess.run(['tmux', '-S', str(tmux_socket), 'kill-server'],
+                           env=rig.env, capture_output=True, timeout=3)
+        if wayland:
+            subprocess.run(['swaymsg', f'[pid={rig.gui.pid}] fullscreen disable'],
+                           env=rig.env, capture_output=True, timeout=3)
+    if wayland:
+        rig.wait_state(lambda state: (state['logical_width'], state['logical_height']) == original_size)
+    if nested:
+        rig.wait_state(lambda state: count(state) < 0)
+    else:
+        rig.wait_state(lambda state: 'COUNTER-DONE' in by_id(state)[pane]['painted_text'])
+def exercise(rig):
+    refs = start_persistent(rig)
+    rig.drag('stacked', dy=rig.state()['cell_h'] * 3)
+    panes = list(refs)
+    active_output(rig, panes[1])
+    wraps = {pane: specimen(rig, pane, 'PANE-' + str(pane)) for pane in panes}
+    target, neighbour = panes[1], panes[2]
+    copy_shortcut(rig, target)
+    rig.focus(panes[0])
+    state = rig.state()
+    before = {p: cell_background(rig, state, p, 1, 1) for p in panes}
+    rig.select(target, (0, 1), (4, 1), release=False)
+    eventually(lambda: cell_background(rig, state, target, 1, 1) != before[target],
+               'drag did not visibly highlight the off-origin pane')
+    for p in (panes[0], neighbour):
+        require(cell_background(rig, state, p, 1, 1) == before[p], 'highlight leaked into neighbour')
+    require(rig.state()['focus'] == target, 'press did not focus selected pane')
+    rig.send('mouseup:' + rig.cell_point(state, target, 4, 1))
+    rig.copied('alpha')
+    rig.ok('off-origin held drag paints only its pane and release copies daemon text')
+    for pane in panes:
+        rig.select(pane, (4, 1), (0, 1))
+        rig.copied('alpha')
+        rig.select(pane, (6, 1), (10, 1))
+        rig.copied('café')
+        # Endpoint on the wide glyph continuation must include the whole glyph.
+        rig.select(pane, (10, 1), (12, 1))
+        rig.copied(' 界')
+        rig.select(pane, (0, 2), (10, 3))
+        rig.copied('hard one\nhard two')
+        rig.select(pane, (0, 4), (2, 5))
+        rig.copied(wraps[pane])
+    rig.ok('both directions, Unicode, wide continuation, trimming, hard newline and soft wrap')
+    baseline = wraps[panes[-1]]
+    state = rig.state()
+    same = rig.cell_point(state, target, 0, 1)
+    rig.send('mousedown:' + same, 'mousemove:' + same, 'mouseup:' + same)
+    rig.unchanged(baseline)
+    rig.focus(neighbour)  # Header press is deliberately not terminal text.
+    rig.unchanged(baseline)
+    rig.chord('enter')
+    rig.picker('hosts')
+    rig.select(target, (0, 1), (4, 1))
+    rig.unchanged(baseline)
+    rig.key('escape')
+    rig.key('escape')
+    rig.ok('same-cell tremor, header press and modal pointer input preserve clipboard')
+    # Start in one pane, enter its neighbour, then release back over the origin.
+    # The neighbour must not supply either the endpoint or copied text.
+    state = rig.select(target, (0, 1), (4, 1), release=False)
+    rig.send('mousemove:' + rig.cell_point(state, neighbour, 16, 1),
+             'mouseup:' + rig.cell_point(state, target, 4, 1))
+    rig.copied('alpha')
+    rig.ok('cross-pane motion keeps the original session selection')
+    trigger = arm_output(rig, neighbour, 'NEIGHBOUR-OUTPUT')
+    specimen(rig, neighbour, 'PANE-' + str(neighbour))
+    background = cell_background(rig, rig.state(), target, 7, 1)
+    state = rig.select(target, (6, 1), (9, 1), release=False)
+    eventually(lambda: cell_background(rig, state, target, 7, 1) != background,
+               'selection was not painted before neighbouring output')
+    trigger.touch()
+    rig.wait_state(lambda s: 'NEIGHBOUR-OUTPUT' in by_id(s)[neighbour]['painted_text'])
+    rig.send('mouseup:' + rig.cell_point(state, target, 9, 1))
+    rig.copied('café')
+    trigger = arm_output(rig, target, 'SELECTED-OUTPUT', row=2)
+    specimen(rig, target, 'PANE-' + str(target))
+    background = cell_background(rig, rig.state(), target, 1, 1)
+    state = rig.select(target, (0, 1), (4, 1), release=False)
+    eventually(lambda: cell_background(rig, state, target, 1, 1) != background,
+               'selection was not painted before selected-pane output')
+    trigger.touch()
+    rig.wait_state(lambda s: 'SELECTED-OUTPUT' in by_id(s)[target]['painted_text'])
+    rig.send('mouseup:' + rig.cell_point(state, target, 4, 1))
+    rig.copied('SELEC')
+    rig.ok('redraw preserves selection; overwriting selected text copies the current range')
+    rig.shell('wait')  # Reap the fixture writer before painting the next specimen.
+    specimen(rig, target, 'PANE-' + str(target))
+    rig.select(target, (0, 1), (4, 1))
+    rig.copied('alpha')
+    # Pause only this fixture's real daemon. The queued selection is still
+    # decoded/extracted by that daemon when resumed, not by a protocol mock.
+    sock = refs[target][0]
+    daemon = next(proc for path, proc in rig.daemons if path == sock)
+    daemon.send_signal(signal.SIGSTOP)
+    try:
+        rig.select(target, (6, 1), (9, 1))
+        rig.state()  # Event queue barrier, no repaint or data repair.
+        rig.focus(neighbour)
+    finally:
+        daemon.send_signal(signal.SIGCONT)
+    rig.unchanged('alpha')
+    rig.ok('a delayed real-daemon reply cannot copy after a new press clears selection')
+    # Resize while a reply is waiting; then validate the real PTY sizes.
+    daemon.send_signal(signal.SIGSTOP)
+    try:
+        rig.select(target, (6, 1), (9, 1))
+        rig.state()
+        rig.drag('beside', dx=rig.state()['cell_w'] * -2)
+        rig.state()  # Process the resize events before allowing the reply.
+    finally:
+        daemon.send_signal(signal.SIGCONT)
+    rig.unchanged('alpha')
+    rig.kernel_sizes()
+    rig.ok('geometry change cancels pending copy and all PTYs match the resized panes')
+    specimen(rig, target, 'PANE-' + str(target))
+    state = rig.state()
+    blank = cell_background(rig, state, target, 16, 8)
+    rig.select(target, (15, 8), (18, 8), release=False)
+    eventually(lambda: cell_background(rig, state, target, 16, 8) != blank,
+               'empty-copy fixture did not select its in-bounds blank cells')
+    rig.send('mouseup:' + rig.cell_point(state, target, 18, 8))
+    rig.state()
+    rig.unchanged('alpha')
+    daemon.send_signal(signal.SIGSTOP)
+    try:
+        rig.select(target, (6, 1), (9, 1))
+        rig.wait_state(lambda s: 'Selection unavailable' in s['notice'])
+    finally:
+        daemon.send_signal(signal.SIGCONT)
+    rig.unchanged('alpha')
+    rig.ok('empty copy and a real unanswered request preserve clipboard; timeout is visible')
+    scale_selection(rig, target)
+    specimen(rig, target, 'DETACH')
+    rig.select(target, (0, 1), (4, 1))
+    rig.copied('alpha')
+    daemon.send_signal(signal.SIGSTOP)
+    try:
+        rig.select(target, (6, 1), (9, 1))
+        rig.state()
+        rig.chord('d')
+        rig.wait_state(lambda s: target not in by_id(s))
+    finally:
+        daemon.send_signal(signal.SIGCONT)
+    rig.unchanged('alpha')
+    require(rig.status(*refs[target])['cols'] > 0, 'detach ended the selected shell')
+    rig.ok('detach cancels copying with a stalled daemon and leaves its shell alive')
+    rig.assert_cli_untouched()
+    return refs
+def main():
+    require(len(sys.argv) == 3, 'usage: native_selection.py MUX MUXG')
+    rig = SelectionRig(*sys.argv[1:])
+    try:
+        exercise(rig)
+        rig.quit()
+        print('Native selection acceptance passed; artifacts:', rig.root, flush=True)
+    except BaseException:
+        rig.failure_artifacts()
+        raise
+    finally:
+        for _, proc in rig.daemons:
+            if proc.poll() is None:
+                proc.send_signal(signal.SIGCONT)
+        rig.close()
+if __name__ == '__main__':
+    main()

test/native_selection_follow.py

@@ @@ -0,0 +1,239 @@ @@
+#!/usr/bin/env python3
+"""Real-PTY acceptance for completed local selections that follow terminal edits.
+The source panes deliberately contain duplicate text.  The surrounding numbered
+rows and framebuffer location make a copied duplicate insufficient evidence:
+the selected *occurrence* must move with the terminal's own tracked pins.
+"""
+import shlex
+import os
+import sys
+import time
+sys.dont_write_bytecode = True
+from native_lifecycle import start_persistent
+from native_resize import by_id
+from native_selection import SelectionRig, cell_background
+from native_tiling import eventually, require
+SHIFT = 1
+def pty_output(rig, pane, data):
+    """Write fixture-owned terminal output without changing GUI focus."""
+    fd = os.open(rig.tty_paths[pane], os.O_WRONLY | os.O_NOCTTY)
+    try:
+        os.write(fd, data)
+    finally:
+        os.close(fd)
+def row_of(state, pane, prefix):
+    for row, line in enumerate(by_id(state)[pane]['painted_text'].splitlines()):
+        if line.startswith(prefix):
+            return row
+    return None
+def mouse_cell(rig, state, pane, col, row, kind, mods=0):
+    point = rig.cell_point(state, pane, col, row)
+    x, y = point.split(',')
+    rig.send(f'mouse:{kind},{x},{y},0,{mods}')
+def local_shift_select(rig, pane, start, finish):
+    """Use the ordinary SDL mouse hook: an app may be reporting mouse input."""
+    state = rig.state()
+    mouse_cell(rig, state, pane, *start, 'down', SHIFT)
+    mouse_cell(rig, state, pane, *finish, 'move', SHIFT)
+    mouse_cell(rig, state, pane, *finish, 'up', SHIFT)
+    return state
+def shell_follow_program(rig, pane):
+    trigger = rig.root / 'shell-follow-go'
+    source = rig.root / 'shell-follow.py'
+    rows = by_id(rig.state())[pane]['rows']
+    require(rows >= 9, 'shell follow fixture needs nine terminal rows')
+    source.write_text(
+        'import os, time\nfrom pathlib import Path\n'
+        f'trigger=Path({str(trigger)!r})\n'
+        f'rows={rows}\n'
+        'body=["SHELL-%03d" % n for n in range(rows)]\n'
+        'body[rows-8]="SHELL-DUPLICATE"; body[rows-7]="SHELL-BEFORE-003"\n'
+        'body[rows-5]="SHELL-DUPLICATE"; body[rows-4]="SHELL-AFTER-006"; body[-1]="SHELL-READY"\n'
+        'os.write(1, ("\\033[0m\\033[2J\\033[H"+"\\r\\n".join(body)).encode())\n'
+        'while not trigger.exists(): time.sleep(.01)\n'
+        'for n in range(3):\n'
+        ' os.write(1, ("\\r\\nSHELL-TAIL-%03d" % n).encode()); time.sleep(.03)\n'
+        'while True: time.sleep(60)\n')
+    rig.focus(pane)
+    rig.shell('python3 ' + shlex.quote(str(source)))
+    state = rig.wait_state(lambda s: row_of(s, pane, 'SHELL-READY') is not None)
+    return trigger, state
+def shell_primary_scroll(rig, target, neighbour):
+    trigger, state = shell_follow_program(rig, target)
+    after = row_of(state, target, 'SHELL-AFTER-006')
+    start = None if after is None else after - 1
+    require(start is not None and start + 1 < by_id(state)[target]['rows'],
+            'shell fixture did not leave a two-row selection in the viewport')
+    background = cell_background(rig, state, target, 2, start)
+    # Select a duplicate plus its distinct successor. Matching the word alone
+    # would let a stale range select a different identical line.
+    local_shift_select(rig, target, (0, start), (16, start + 1))
+    rig.copied('SHELL-DUPLICATE\nSHELL-AFTER-006')
+    eventually(lambda: cell_background(rig, rig.state(), target, 2, start) != background,
+               'completed shell selection was not visibly painted')
+    # Unselected output must not move or invalidate this pane's occurrence.
+    pty_output(rig, neighbour, b'\033[0mNEIGHBOUR-OUTPUT\r\n')
+    rig.wait_state(lambda s: 'NEIGHBOUR-OUTPUT' in by_id(s)[neighbour]['painted_text'])
+    rig.key('copy')
+    rig.copied('SHELL-DUPLICATE\nSHELL-AFTER-006')
+    trigger.touch()
+    moved = rig.wait_state(lambda s: row_of(s, target, 'SHELL-TAIL-002') is not None)
+    after = row_of(moved, target, 'SHELL-AFTER-006')
+    new_row = None if after is None else after - 1
+    require(new_row == start - 3,
+            f'shell occurrence moved to row {new_row}, expected {start - 3}')
+    eventually(lambda: cell_background(rig, rig.state(), target, 2, new_row) != background,
+               'shell highlight did not follow its selected occurrence upward')
+    require(cell_background(rig, rig.state(), target, 2, start) == background,
+            'shell highlight remained at the old viewport row')
+    pty_output(rig, neighbour, b'\033]52;c;Q09QWS1TRU5USU5FTA==\a')
+    rig.copied('COPY-SENTINEL')
+    rig.key('copy')
+    rig.copied('SHELL-DUPLICATE\nSHELL-AFTER-006')
+    rig.ok('completed local selection follows primary-screen append through duplicate rows; neighbouring output is independent')
+    # Return the target pane to its shell before the alternate-screen fixture
+    # starts; otherwise its launch command would be consumed by the old app.
+    rig.key('interrupt')
+    time.sleep(.12)
+def alt_reporter(rig, pane):
+    control = rig.root / 'alt-follow-control'
+    received = rig.root / 'alt-follow-received.bin'
+    source = rig.root / 'alt-follow.py'
+    rows = by_id(rig.state())[pane]['rows']
+    require(rows >= 9, 'alt follow fixture needs nine terminal rows')
+    source.write_text(
+        'import os, select, sys, termios, tty, time\nfrom pathlib import Path\n'
+        f'control=Path({str(control)!r}); received=Path({str(received)!r})\n'
+        'fd=0; old=termios.tcgetattr(fd); tty.setraw(fd); seen=0\n'
+        f'rows={rows}\n'
+        'body=["ALT-%03d" % n for n in range(rows)]\n'
+        'body[rows-8]="ALT-DUPLICATE"; body[rows-7]="ALT-BEFORE-003"\n'
+        'body[rows-5]="ALT-DUPLICATE"; body[rows-4]="ALT-AFTER-006"; body[-1]="ALT-READY"\n'
+        'try:\n'
+        ' os.write(1, ("\\033[?1049h\\033[?25l\\033[2J\\033[H"+"\\r\\n".join(body)+"\\033[?1002h\\033[?1006h").encode())\n'
+        ' while True:\n'
+        '  if control.exists():\n'
+        '   data=control.read_text()[seen:]; seen += len(data)\n'
+        '   for command in data.splitlines():\n'
+        '    if command == "scroll": os.write(1, ("\\033[2;%dr\\033[2S\\033[r" % rows).encode())\n'
+        '    if command == "reset": os.write(1, b"\\033c")\n'
+        '  if select.select([fd], [], [], .02)[0]:\n'
+        '   with received.open("ab") as out: out.write(os.read(fd, 4096))\n'
+        'finally: termios.tcsetattr(fd, termios.TCSADRAIN, old)\n')
+    rig.focus(pane)
+    rig.shell('python3 ' + shlex.quote(str(source)))
+    state = rig.wait_state(lambda s: row_of(s, pane, 'ALT-READY') is not None)
+    return control, received, state
+def alt_region_scroll(rig, target, neighbour):
+    control, received, state = alt_reporter(rig, target)
+    after = row_of(state, target, 'ALT-AFTER-006')
+    start = None if after is None else after - 1
+    require(start is not None and start + 1 < by_id(state)[target]['rows'], 'alt fixture rows missing')
+    background = cell_background(rig, state, target, 2, start)
+    before_bytes = received.stat().st_size if received.exists() else 0
+    local_shift_select(rig, target, (0, start), (14, start + 1))
+    rig.copied('ALT-DUPLICATE\nALT-AFTER-006')
+    time.sleep(.12)
+    require((received.stat().st_size if received.exists() else 0) == before_bytes,
+            'Shift local selection leaked mouse reports into the reporting app')
+    with control.open('a') as out:
+        out.write('scroll\n')
+    moved = rig.wait_state(lambda s: row_of(s, target, 'ALT-AFTER-006') == start - 1)
+    after = row_of(moved, target, 'ALT-AFTER-006')
+    new_row = None if after is None else after - 1
+    eventually(lambda: cell_background(rig, rig.state(), target, 2, new_row) != background,
+               'alt-screen region scroll did not move the highlight')
+    require(cell_background(rig, rig.state(), target, 2, start) == background,
+            'alt-screen region scroll left highlight at its old row')
+    # Ctrl+Shift+C must ask the daemon for the tracked occurrence after the
+    # scroll, rather than reusing the old client coordinates.
+    pty_output(rig, neighbour, b'\033]52;c;Q09QWS1TRU5USU5FTA==\a')
+    rig.copied('COPY-SENTINEL')
+    rig.key('copy')
+    rig.copied('ALT-DUPLICATE\nALT-AFTER-006')
+    rig.ok('Shift selection in a mouse-reporting alt screen follows vertical-region scrolling and Ctrl+Shift+C copies it')
+    return control
+def invalidation(rig, target, control, neighbour):
+    stable = rig.clipboard()
+    require(stable == 'ALT-DUPLICATE\nALT-AFTER-006', 'missing selection-copy baseline')
+    # A real pane geometry change makes terminal screen coordinates ambiguous.
+    state = rig.state()
+    rig.drag('beside', dx=-2 * state['cell_w'])
+    state = rig.wait_state(lambda s: row_of(s, target, 'ALT-AFTER-006') is not None)
+    rig.unchanged(stable)
+    pty_output(rig, neighbour, b'\033]52;c;Q09QWS1TRU5USU5FTA==\a')
+    rig.copied('COPY-SENTINEL')
+    rig.key('copy')
+    rig.unchanged('COPY-SENTINEL')
+    after = row_of(state, target, 'ALT-AFTER-006')
+    start = None if after is None else after - 1
+    require(start is not None and start + 1 < by_id(state)[target]['rows'],
+            'resized alt fixture lost its selection markers')
+    background = cell_background(rig, state, target, 2, start)
+    local_shift_select(rig, target, (0, start), (14, start + 1))
+    rig.copied(stable)
+    eventually(lambda: cell_background(rig, rig.state(), target, 2, start) != background,
+               'selection could not be recreated after resize')
+    # RIS resets the terminal's pages and makes Ghostty's tracked pins garbage.
+    with control.open('a') as out:
+        out.write('reset\n')
+    rig.wait_state(lambda s: row_of(s, target, 'ALT-DUPLICATE') is None)
+    rig.unchanged(stable)
+    pty_output(rig, neighbour, b'\033]52;c;Q09QWS1TRU5USU5FTA==\a')
+    rig.copied('COPY-SENTINEL')
+    rig.key('copy')
+    rig.unchanged('COPY-SENTINEL')
+    rig.ok('resize and terminal reset invalidate a followed selection without changing the desktop clipboard')
+def exercise(rig):
+    refs = start_persistent(rig)
+    rig.drag('stacked', dy=rig.state()['cell_h'] * 3)
+    panes = list(refs)
+    target, neighbour = panes[1], panes[2]
+    shell_primary_scroll(rig, target, neighbour)
+    control = alt_region_scroll(rig, target, neighbour)
+    invalidation(rig, target, control, neighbour)
+    rig.assert_cli_untouched()
+def main():
+    require(len(sys.argv) == 3, 'usage: native_selection_follow.py MUX MUXG')
+    rig = SelectionRig(*sys.argv[1:])
+    try:
+        exercise(rig)
+        rig.quit()
+        print('Native selection-follow acceptance passed; artifacts:', rig.root, flush=True)
+    except BaseException:
+        rig.failure_artifacts()
+        raise
+    finally:
+        rig.close()
+if __name__ == '__main__':
+    main()

test/native_tmux_mouse.py

@@ @@ -0,0 +1,180 @@ @@
+#!/usr/bin/env python3
+"""Wayland-only mouse selection shared by muxg and a real foot tmux client."""
+import os
+import shlex
+import shutil
+import subprocess
+import sys
+import time
+sys.dont_write_bytecode = True
+from native_resize import by_id
+from native_selection import SelectionRig, cell_background
+from native_tiling import eventually, require
+from wayland_pointer import Pointer
+def tmux(rig, socket, *args, check=True):
+    return subprocess.run(['tmux', '-S', str(socket), *args], env=rig.env,
+                          capture_output=True, text=True, timeout=3, check=check)
+def find_pid(tree, pid):
+    if tree.get('pid') == pid:
+        return tree
+    for node in tree.get('nodes', []) + tree.get('floating_nodes', []):
+        found = find_pid(node, pid)
+        if found:
+            return found
+    return None
+def foot_point(pointer, pid, cols, rows, col, row):
+    node = find_pid(pointer.query('get_tree'), pid)
+    require(node is not None, 'foot window is not mapped')
+    rect = node['rect']
+    # The fixture removes Sway decorations and foot padding, so the terminal
+    # grid starts at the client origin. Keep well away from either edge.
+    return ((col + .5) * rect['width'] / cols,
+            (row + .5) * rect['height'] / rows)
+def pane_mode(rig, socket, target):
+    return tmux(rig, socket, 'display-message', '-p', '-t', target,
+                '#{pane_in_mode}').stdout.strip()
+def buffer(rig, socket):
+    return tmux(rig, socket, 'show-buffer', check=False).stdout
+def leave_copy_mode(rig, socket, target):
+    tmux(rig, socket, 'send-keys', '-t', target, '-X', 'cancel', check=False)
+    eventually(lambda: pane_mode(rig, socket, target) == '0', 'tmux did not leave copy mode')
+def write_tmux_config(root):
+    config = root / 'tmux.conf'
+    config.write_text(
+        'set -g mouse on\n'
+        'set -g status off\n'
+        'set -g set-clipboard on\n'
+        'set -g mode-keys vi\n'
+        'bind -T copy-mode MouseDragEnd1Pane send -X copy-selection-no-clear\n'
+        'bind -T copy-mode-vi MouseDragEnd1Pane send -X copy-selection-no-clear\n')
+    return config
+def run(mux, muxg):
+    if os.environ.get('MUXG_VIDEODRIVER') != 'wayland':
+        print('Native tmux mouse skipped: requires MUXG_VIDEODRIVER=wayland', flush=True)
+        return
+    require(shutil.which('foot') and shutil.which('tmux'), 'native tmux mouse requires foot and tmux')
+    pointer_binary = os.environ.get('MUXG_TEST_POINTER')
+    require(pointer_binary, 'native tmux mouse requires MUXG_TEST_POINTER')
+    rig = SelectionRig(mux, muxg)
+    foot = None
+    foot_pointer = None
+    socket = rig.root / 'shared.tmux.sock'
+    target = 'shared:0.0'
+    try:
+        sock, _ = rig.daemon('tmux')
+        state = rig.launch_gui(['--sock', sock, '--session', 'tmux'], 'gui')
+        pane = state['panes'][0]['id']
+        config = write_tmux_config(rig.root)
+        paint = ('printf "\\033[2J\\033[HROW-000 alpha alpha\\nROW-001 bravo bravo\\n'
+                 'ROW-002 charlie charlie\\n"; exec sh')
+        command = ('exec tmux -S ' + shlex.quote(str(socket)) + ' -f ' + shlex.quote(str(config)) +
+                   ' new-session -A -s shared ' + shlex.quote(paint))
+        rig.shell(command)
+        state = rig.wait_state(lambda s: 'ROW-002 charlie charlie' in by_id(s)[pane]['painted_text'])
+        eventually(lambda: 'ROW-001 bravo bravo' in tmux(rig, socket, 'capture-pane', '-p', '-e', '-t', target).stdout,
+                   'tmux pane never painted the specimen')
+        # This is a second real terminal client of the exact same tmux server.
+        foot_config = rig.root / 'foot.ini'
+        foot_config.write_text('[main]\npad=0x0\nfont=monospace:size=12\n')
+        foot = rig.spawn(['foot', '-c', str(foot_config), '-a', 'muxg-tmux-mouse',
+                          '-T', 'muxg-tmux-mouse', '-w', '960x600',
+                          'tmux', '-S', str(socket), 'attach', '-t', 'shared'], 'foot')
+        foot_pointer = Pointer(pointer_binary, rig.env, foot.pid)
+        def foot_ready():
+            node = find_pid(foot_pointer.query('get_tree'), foot.pid)
+            clients = tmux(rig, socket, 'list-clients', '-F', '#{client_tty}').stdout.splitlines()
+            return node is not None and len(clients) >= 2
+        eventually(foot_ready, 'foot did not attach as a second tmux client', seconds=10)
+        subprocess.run(['swaymsg', f'[pid={foot.pid}] floating enable, border none'], env=rig.env,
+                       capture_output=True, check=True, timeout=3)
+        # A normal muxg drag reaches tmux's mouse binding. Its copy-mode
+        # selection remains visible in muxg and becomes the actual tmux buffer.
+        subprocess.run(['swaymsg', f'[pid={rig.gui.pid}] focus'], env=rig.env, capture_output=True, check=True)
+        state = rig.state()
+        before = cell_background(rig, state, pane, 10, 0)
+        rig.select(pane, (8, 0), (12, 0))
+        eventually(lambda: pane_mode(rig, socket, target) == '1', 'muxg drag did not enter tmux copy mode')
+        eventually(lambda: 'alpha' in buffer(rig, socket), 'muxg drag did not populate tmux buffer')
+        eventually(lambda: cell_background(rig, state, pane, 10, 0) != before,
+                   'tmux selection was not visibly painted by muxg')
+        rig.ok('ordinary muxg drag enters tmux copy mode, paints selection and copies its buffer')
+        leave_copy_mode(rig, socket, target)
+        state = rig.state()
+        before = cell_background(rig, state, pane, 10, 1)
+        subprocess.run(['swaymsg', f'[pid={foot.pid}] focus'], env=rig.env, capture_output=True, check=True)
+        clients = tmux(rig, socket, 'list-clients', '-F', '#{client_termname} #{client_width} #{client_height}').stdout.splitlines()
+        cols, rows = next(tuple(map(int, line.split()[1:])) for line in clients if line.startswith('foot '))
+        a = foot_point(foot_pointer, foot.pid, cols, rows, 8, 1)
+        b = foot_point(foot_pointer, foot.pid, cols, rows, 12, 1)
+        foot_pointer.event('mousedown', *a)
+        foot_pointer.event('mousemove', *b)
+        foot_pointer.event('mouseup', *b)
+        eventually(lambda: pane_mode(rig, socket, target) == '1', 'foot drag did not enter tmux copy mode')
+        eventually(lambda: 'bravo' in buffer(rig, socket), 'foot drag did not populate shared tmux buffer')
+        eventually(lambda: cell_background(rig, state, pane, 10, 1) != before,
+                   'foot tmux selection did not repaint muxg')
+        rig.ok('ordinary foot drag shares tmux selection state and muxg repaint')
+        leave_copy_mode(rig, socket, target)
+        prior = buffer(rig, socket)
+        subprocess.run(['swaymsg', f'[pid={rig.gui.pid}] focus'], env=rig.env, capture_output=True, check=True)
+        state = rig.state()
+        before = cell_background(rig, state, pane, 10, 0)
+        a = rig.cell_point(state, pane, 8, 0)
+        b = rig.cell_point(state, pane, 12, 0)
+        rig.send('mouse:down,' + a + ',0,1', 'mouse:move,' + b + ',0,0',
+                 'mouse:up,' + b + ',0,0')
+        eventually(lambda: cell_background(rig, state, pane, 10, 0) != before,
+                   'Shift muxg drag did not paint its local selection')
+        rig.copied('alpha')
+        time.sleep(.15)
+        require(pane_mode(rig, socket, target) == '0' and buffer(rig, socket) == prior,
+                'Shift muxg drag changed tmux selection or buffer')
+        rig.ok('Shift muxg drag remains local and leaves shared tmux buffer unchanged')
+        rig.quit()
+        print('Native tmux mouse acceptance passed; artifacts:', rig.root, flush=True)
+    except BaseException:
+        rig.failure_artifacts()
+        raise
+    finally:
+        if foot_pointer is not None:
+            foot_pointer.close()
+        if foot is not None and foot.poll() is None:
+            foot.terminate()
+            try:
+                foot.wait(timeout=3)
+            except subprocess.TimeoutExpired:
+                foot.kill()
+                foot.wait(timeout=3)
+        tmux(rig, socket, 'kill-server', check=False)
+        rig.close()
+def main():
+    require(len(sys.argv) == 3, 'usage: native_tmux_mouse.py MUX MUXG')
+    run(*sys.argv[1:])
+if __name__ == '__main__':
+    main()

test/native_wheel.py

@@ @@ -0,0 +1,316 @@ @@
+#!/usr/bin/env python3
+"""Wheel input through real SDL/Wayland, history pixels and independent PTY bytes."""
+import os
+from pathlib import Path
+import shlex
+import subprocess
+import sys
+import time
+sys.dont_write_bytecode = True
+from native_lifecycle import start_persistent
+from native_resize import by_id, one_divider
+from native_selection import SelectionRig, cell_background
+from native_tiling import eventually, require
+class WheelRig(SelectionRig):
+    def wheel_at(self, point, delta, flipped=False, native=True):
+        if self.env['SDL_VIDEO_DRIVER'] == 'wayland' and native and not flipped and int(delta) == delta:
+            # Initialize the established compositor input adapter without a click.
+            self.send('mousemove:' + point)
+            self.pointer.wheel(*map(float, point.split(',')), int(delta))
+        else:
+            self.send(f'wheel:{point},{delta}' + (',flipped' if flipped else ''))
+    def wheel(self, pane, delta, col=4, row=3, **kwargs):
+        state = self.state()
+        self.wheel_at(self.cell_point(state, pane, col, row), delta, **kwargs)
+def painted(rig, pane):
+    return by_id(rig.state())[pane]['painted_text']
+def history(rig, pane):
+    rig.focus(pane)
+    # Known numbered rows span many screens; full markers occur only in output.
+    program = rig.root / f'history-{pane}.py'
+    program.write_text('import sys\n'
+                       'sys.stdout.write("\\033[?25l\\033[2J\\033[H")\n'
+                       'for n in range(300): print(f"HISTORY-{n:04d} alpha café")\n'
+                       'print("WHEEL-" + "LIVE", flush=True)\n')
+    rig.shell("export PS1=''; python3 " + shlex.quote(str(program)))
+    rig.wait_state(lambda s: 'WHEEL-LIVE' in by_id(s)[pane]['painted_text'])
+    return painted(rig, pane)
+def first_number(text):
+    first = text.splitlines()[0]
+    require(first.startswith('HISTORY-'), 'expected a numbered history row, got ' + repr(first))
+    return int(first[8:12])
+def shell_history(rig, panes):
+    live = {pane: history(rig, pane) for pane in panes}
+    target, other, focused = panes[1], panes[0], panes[2]
+    rig.focus(focused)
+    baseline = first_number(live[target])
+    rig.wheel(target, 1)
+    state = rig.wait_state(lambda s: first_number(by_id(s)[target]['painted_text']) == baseline - 3)
+    require(state['focus'] == focused, 'wheel moved keyboard focus')
+    for pane in (other, focused):
+        require(by_id(state)[pane]['painted_text'] == live[pane], 'wheel changed another pane')
+    # Inspect completed framebuffer pixels as well as the passive text snapshot.
+    before_pixels = rig.last_pixels()[2]
+    rig.wheel(target, 1)
+    rig.wait_state(lambda s: first_number(by_id(s)[target]['painted_text']) == baseline - 6)
+    eventually(lambda: rig.last_pixels()[2] != before_pixels, 'history text did not change framebuffer')
+    rig.ok('off-origin unfocused pane scrolls three rows per notch without changing neighbours or focus')
+    state = rig.state()
+    background = cell_background(rig, state, other, 1, 0)
+    selected = by_id(state)[other]['painted_text'].splitlines()[0][:12]
+    rig.select(other, (0, 0), (11, 0))
+    rig.copied(selected)
+    eventually(lambda: cell_background(rig, state, other, 1, 0) != background,
+               'selection did not paint before scrolling a neighbour')
+    rig.wheel(target, 1)
+    rig.wait_state(lambda s: first_number(by_id(s)[target]['painted_text']) == baseline - 9)
+    require(cell_background(rig, state, other, 1, 0) != background,
+            'scrolling another pane cleared the selection')
+    rig.unchanged(selected)
+    rig.ok('scrolling a neighbouring pane preserves selected text and its highlight')
+    rig.wheel(target, -1000)
+    rig.wait_state(lambda s: by_id(s)[target]['painted_text'] == live[target])
+    rig.wheel(target, .5, native=False)
+    rig.wheel(other, .5, native=False)
+    require(painted(rig, target) == live[target] and painted(rig, other) == live[other],
+            'fractional notches leaked between panes')
+    rig.wheel(target, .5, native=False)
+    rig.wait_state(lambda s: first_number(by_id(s)[target]['painted_text']) == baseline - 3)
+    require(painted(rig, other) == live[other], 'target consumed another pane remainder')
+    rig.wheel(other, -.5, native=False)  # cancel its remainder
+    rig.wheel(target, 1, flipped=True)
+    rig.wait_state(lambda s: by_id(s)[target]['painted_text'] == live[target])
+    rig.ok('fractional wheel events accumulate per pane and flipped direction returns to live')
+    rig.wheel(target, 1000)
+    oldest = rig.wait_state(lambda s: 'HISTORY-0000' in by_id(s)[target]['painted_text'])
+    oldest_text = by_id(oldest)[target]['painted_text']
+    rig.wheel(target, 1000)
+    require(painted(rig, target) == oldest_text, 'wheel moved beyond oldest history')
+    rig.wheel(target, -1000)
+    rig.wait_state(lambda s: by_id(s)[target]['painted_text'] == live[target])
+    rig.wheel(target, 4)
+    state = rig.wait_state(lambda s: first_number(by_id(s)[target]['painted_text']) == baseline - 12)
+    first = by_id(state)[target]['painted_text'].splitlines()[0]
+    background = cell_background(rig, state, target, 1, 0)
+    rig.select(target, (0, 0), (11, 0))
+    rig.copied(first[:12])
+    eventually(lambda: cell_background(rig, state, target, 1, 0) != background,
+               'history selection did not paint')
+    rig.wheel(target, 1)
+    rig.wait_state(lambda s: first_number(by_id(s)[target]['painted_text']) == baseline - 15)
+    eventually(lambda: cell_background(rig, state, target, 1, 3) != background and
+               cell_background(rig, state, target, 1, 0) == background,
+               'highlight did not follow its text three rows down')
+    rig.wheel(target, 1000)
+    rig.wait_state(lambda s: 'HISTORY-0000' in by_id(s)[target]['painted_text'])
+    eventually(lambda: all(cell_background(rig, state, target, 1, row) == background
+                          for row in range(by_id(state)[target]['rows'])),
+               'offscreen selection left a highlight in the viewport')
+    rig.wheel(target, -1000)
+    rig.wait_state(lambda s: by_id(s)[target]['painted_text'] == live[target])
+    rig.wheel(target, 4)
+    rig.wait_state(lambda s: first_number(by_id(s)[target]['painted_text']) == baseline - 12)
+    eventually(lambda: cell_background(rig, state, target, 1, 0) != background,
+               'highlight did not return with selected history text')
+    rig.key('copy')
+    rig.unchanged(first[:12])
+    rig.ok('released history highlight follows text, survives offscreen/live round trips and remains copyable')
+    # Keep the original anchor while a held drag moves through history. Release
+    # at its new screen row to copy the same source row, then repeat with an
+    # explicit motion to extend the selection across the newly visible rows.
+    held = by_id(rig.state())[target]['painted_text'].splitlines()[1]
+    rig.select(target, (0, 1), (11, 1), release=False)
+    rig.wheel(target, 1, col=11, row=1)
+    rig.wait_state(lambda s: first_number(by_id(s)[target]['painted_text']) == baseline - 15)
+    rig.send('mouseup:' + rig.cell_point(state, target, 11, 4))
+    rig.copied(held[:12])
+    rig.select(target, (0, 0), (11, 0), release=False)
+    rig.wheel(target, 1, col=11, row=0)
+    moved = rig.wait_state(lambda s: first_number(by_id(s)[target]['painted_text']) == baseline - 18)
+    lines = by_id(moved)[target]['painted_text'].splitlines()
+    rig.send('mousemove:' + rig.cell_point(moved, target, 11, 4))
+    rig.key('copy')
+    rig.copied(lines[3] + '\n' + lines[4][:12])
+    rig.send('mouseup:' + rig.cell_point(moved, target, 11, 4))
+    rig.copied(lines[3] + '\n' + lines[4][:12])
+    rig.ok('held drag retains its text anchor and extends using the scrolled pane coordinates')
+    rig.wheel(target, -1000)
+    rig.wait_state(lambda s: by_id(s)[target]['painted_text'] == live[target])
+    rig.select(target, (0, 0), (11, 0))
+    rig.copied(live[target].splitlines()[0][:12])
+    rig.wheel(target, 1)
+    rig.wait_state(lambda s: first_number(by_id(s)[target]['painted_text']) == baseline - 3)
+    eventually(lambda: cell_background(rig, state, target, 1, 3) != background,
+               'live selection disappeared on entering history')
+    rig.wheel(target, -1)
+    rig.wait_state(lambda s: by_id(s)[target]['painted_text'] == live[target])
+    eventually(lambda: cell_background(rig, state, target, 1, 0) != background,
+               'live selection disappeared on returning from history')
+    rig.shell("printf 'RETURN-%s\\n' LIVE")
+    rig.wait_state(lambda s: 'RETURN-LIVE' in by_id(s)[target]['painted_text'])
+    eventually(lambda: cell_background(rig, state, target, 1, 0) == background,
+               'input failed to clear the selection')
+    rig.ok('live selection survives history navigation; typing returns live and clears it')
+def raw_reader(rig, pane):
+    """A real foreground PTY application changes modes and records all received bytes."""
+    rig.focus(pane)
+    control, received, stopped = (rig.root / f'{name}-{pane}' for name in ('mode', 'received', 'stop'))
+    program = rig.root / f'raw-reader-{pane}.py'
+    program.write_text(
+        'import os, select, termios, tty\nfrom pathlib import Path\n'
+        f'control=Path({str(control)!r}); received=Path({str(received)!r}); stop=Path({str(stopped)!r})\n'
+        'old=termios.tcgetattr(0); tty.setraw(0); previous=None\n'
+        'reset="\\033[?9l\\033[?1000l\\033[?1002l\\033[?1003l\\033[?1005l\\033[?1006l\\033[?1015l\\033[?1016l\\033[?1l\\033[?1049l"\n'
+        'try:\n'
+        ' with received.open("wb", buffering=0) as output:\n'
+        '  while not stop.exists():\n'
+        '   current=control.read_text() if control.exists() else "ready|"\n'
+        '   if current != previous:\n'
+        '    tag, modes=current.split("|", 1)\n'
+        '    os.write(1, (reset+modes+"\\033[2J\\033[HMODE-"+tag+"\\r\\n").encode()); previous=current\n'
+        '   if select.select([0], [], [], .02)[0]: output.write(os.read(0, 4096))\n'
+        'finally:\n'
+        ' os.write(1, reset.encode()); termios.tcsetattr(0, termios.TCSANOW, old)\n')
+    rig.shell('python3 ' + shlex.quote(str(program)))
+    rig.wait_state(lambda s: by_id(s)[pane]['painted_text'].startswith('MODE-ready'))
+    return control, received, stopped
+def application_wheel(rig, panes):
+    pane, focus = panes[1], panes[2]
+    control, received, stopped = raw_reader(rig, pane)
+    def set_mode(value):
+        pending = control.with_suffix('.next')
+        pending.write_text(value)
+        pending.replace(control)
+    rig.focus(focus)
+    offset = 0
+    try:
+        cases = [('arrows', '\033[?1049h', b'\033[A' * 3, b'\033[B' * 3),
+                 ('app-arrows', '\033[?1049h\033[?1h', b'\033OA' * 3, b'\033OB' * 3),
+                 ('sgr', '\033[?1000h\033[?1006h', b'\033[<64;5;4M', b'\033[<65;5;4M'),
+                 ('legacy', '\033[?1000h', b'\033[M`%$', b'\033[Ma%$'),
+                 ('utf8', '\033[?1000h\033[?1005h', b'\033[M`%$', b'\033[Ma%$'),
+                 ('urxvt', '\033[?1000h\033[?1015h', b'\033[96;5;4M', b'\033[97;5;4M')]
+        for label, modes, up, down in cases:
+            set_mode(label + '|' + modes)
+            rig.wait_state(lambda s: by_id(s)[pane]['painted_text'].startswith('MODE-' + label))
+            rig.wheel(pane, 1)
+            rig.wheel(pane, -1)
+            expected = up + down
+            eventually(lambda: received.stat().st_size >= offset + len(expected), label + ' PTY bytes missing')
+            time.sleep(.08)
+            actual = received.read_bytes()[offset:]
+            require(actual == expected, f'{label} PTY received {actual!r}, expected {expected!r}')
+            offset += len(expected)
+            require(rig.state()['focus'] == focus, 'application wheel changed keyboard focus')
+        rig.ok('independent PTY bytes prove alternate arrows, cursor-key mode and negotiated cell mouse formats')
+        set_mode('pixels|\033[?1000h\033[?1016h')
+        rig.wait_state(lambda s: by_id(s)[pane]['painted_text'].startswith('MODE-pixels'))
+        scale_output = os.environ.get('MUXG_TEST_SCALE_OUTPUT')
+        original = None
+        scales = (None,)
+        if scale_output:
+            original = next(o['scale'] for o in rig.pointer.query('get_outputs') if o['name'] == scale_output)
+            scales = (2, 1, 1.5, 2)
+        try:
+            for scale in scales:
+                if scale is not None:
+                    subprocess.run(['swaymsg', 'output', scale_output, 'scale', str(scale)],
+                                   env=rig.env, capture_output=True, check=True, timeout=3)
+                    rig.wait_state(lambda s: abs(s['width'] / s['logical_width'] - scale) < .01)
+                    rig.kernel_sizes()
+                state = rig.state()
+                point = rig.cell_point(state, pane, 4, 3)
+                x, y = map(float, point.split(','))
+                if rig.env['SDL_VIDEO_DRIVER'] == 'wayland':
+                    x, y = int(x), int(y)  # virtual pointer uses logical integer coordinates
+                content = by_id(state)[pane]['content']
+                px = int(x * state['width'] / state['logical_width']) - content['x'] + 1
+                py = int(y * state['height'] / state['logical_height']) - content['y'] + 1
+                rig.wheel_at(point, 1)
+                expected = f'\033[<64;{px};{py}M'.encode()
+                eventually(lambda: received.stat().st_size >= offset + len(expected), 'pixel report missing')
+                require(received.read_bytes()[offset:] == expected, 'pixel report not relative to pane at current DPI')
+                offset += len(expected)
+        finally:
+            if original is not None:
+                subprocess.run(['swaymsg', 'output', scale_output, 'scale', str(original)],
+                               env=rig.env, capture_output=True, check=True, timeout=3)
+        rig.ok('SGR pixel coordinates are pane-relative, including configured Wayland scale transitions')
+        rig.key('prefix')
+        rig.wheel(pane, 1)
+        time.sleep(.1)
+        require(received.stat().st_size == offset, 'command prefix leaked wheel input')
+        rig.key('escape')
+        rig.chord('enter')
+        rig.picker()
+        rig.wheel(pane, 1)
+        time.sleep(.1)
+        require(received.stat().st_size == offset, 'picker leaked wheel input')
+        rig.key('escape')
+        rig.wait_state(lambda s: not s.get('picker'))
+        rig.chord('p')
+        rig.wait_state(lambda s: s.get('recovery'))
+        rig.wheel(pane, 1)
+        time.sleep(.1)
+        require(received.stat().st_size == offset, 'recovery menu leaked wheel input')
+        rig.key('escape')
+        state = rig.wait_state(lambda s: not s.get('recovery'))
+        header = by_id(state)[pane]['header']
+        rig.wheel_at(rig.point(state, header['x'] + header['w']/2, header['y'] + header['h']/2), 1)
+        rect = one_divider(state, 'beside')['rect']
+        point = rig.point(state, rect['x'] + rect['w']/2, rect['y'] + rect['h']/4)
+        rig.wheel_at(point, 1)
+        rig.send('mousedown:' + point)
+        rig.wheel(pane, 1)
+        rig.send('mouseup:' + point)
+        time.sleep(.1)
+        require(received.stat().st_size == offset, 'header/divider/resize leaked wheel input')
+        rig.ok('picker, recovery, headers, dividers and held resize intercept wheel events')
+    finally:
+        stopped.touch()
+def main():
+    rig = WheelRig(*sys.argv[1:3])
+    try:
+        refs = start_persistent(rig)
+        panes = list(refs)
+        shell_history(rig, panes)
+        application_wheel(rig, panes)
+        rig.kernel_sizes()
+        rig.assert_cli_untouched()
+        rig.quit()
+        rig.ok('three real PTYs retain geometry, persistent identities and terminal layout state')
+        print('Wheel artifacts:', rig.root)
+    except Exception:
+        rig.failure_artifacts()
+        raise
+    finally:
+        rig.close()
+if __name__ == '__main__':
+    main()

test/wayland_pointer.py

@@ @@ -0,0 +1,69 @@ @@
+"""Drive the retained virtual-pointer helper on an isolated Sway output.
+MUXG_TEST_POINTER names the helper binary (line protocol: move x y w h,
+button 0/1, wheel NOTCHES; each command returns ok). A real input serial is required for
+Wayland clipboard ownership; SDL-injected events cannot establish it.
+"""
+import json
+import select
+import subprocess
+class Pointer:
+    def __init__(self, binary, env, pid):
+        self.env, self.pid = env, pid
+        self.proc = subprocess.Popen([binary], env=env, stdin=subprocess.PIPE,
+                                     stdout=subprocess.PIPE, text=True)
+    def command(self, line):
+        self.proc.stdin.write(line + '\n')
+        self.proc.stdin.flush()
+        if not select.select([self.proc.stdout], [], [], 3)[0]:
+            raise RuntimeError('virtual pointer command timed out')
+        if self.proc.stdout.readline().strip() != 'ok':
+            raise RuntimeError('virtual pointer command failed')
+    def query(self, kind):
+        return json.loads(subprocess.check_output(['swaymsg', '-r', '-t', kind],
+                                                 env=self.env, timeout=3))
+    def move(self, x, y):
+        def find(node):
+            if node.get('pid') == self.pid:
+                return node
+            for child in node.get('nodes', []) + node.get('floating_nodes', []):
+                found = find(child)
+                if found:
+                    return found
+        node = find(self.query('get_tree'))
+        if node is None:
+            raise RuntimeError('owned native window is not mapped')
+        outputs = self.query('get_outputs')
+        if len(outputs) != 1 or not outputs[0]['name'].startswith('HEADLESS-'):
+            raise RuntimeError('pointer fixture requires one isolated headless output')
+        rect, screen = node['rect'], outputs[0]['rect']
+        self.command(f"move {int(rect['x'] + x - screen['x'])} "
+                     f"{int(rect['y'] + y - screen['y'])} {screen['width']} {screen['height']}")
+    def event(self, kind, x, y):
+        self.move(x, y)
+        if kind in ('mousedown', 'click'):
+            self.command('button 1')
+        if kind in ('mouseup', 'click'):
+            self.command('button 0')
+    def wheel(self, x, y, notches):
+        self.move(x, y)
+        self.command(f'wheel {notches}')
+    def close(self):
+        self.proc.stdin.close()
+        try:
+            if self.proc.wait(timeout=3):
+                raise RuntimeError('virtual pointer failed on shutdown')
+        except subprocess.TimeoutExpired:
+            self.proc.kill()
+            self.proc.wait(timeout=3)
+            raise
+        finally:
+            self.proc.stdout.close()

web/mux.js

Old		New
@@ -1158,7 +1158,7 @@ class Tile {
1158	const n = this.core.mux_selection_request(	1158	const n = this.core.mux_selection_request(
1159	this.nextSelectionId, a.row, a.col, b.row, b.col,	1159	this.nextSelectionId, a.row, a.col, b.row, b.col,
1160	);	1160	);
1161	if (n === 16) {	1161	if (n > 0) {
1162	const selection = this.selection;	1162	const selection = this.selection;
1163	// Establish reply authority before send: a host is allowed to deliver	1163	// Establish reply authority before send: a host is allowed to deliver
1164	// a matching semantic reply synchronously from its send hook.	1164	// a matching semantic reply synchronously from its send hook.

web/verify.js

Old		New
@@ -894,7 +894,7 @@ async function verifySelectionShell(shell, html) {
894	const makeTile = () => {	894	const makeTile = () => {
895	const selected = new h.Tile(4, 'selection fixture', h.document.createElement('div'), '');	895	const selected = new h.Tile(4, 'selection fixture', h.document.createElement('div'), '');
896	const memory = { buffer: new ArrayBuffer(1024) };	896	const memory = { buffer: new ArrayBuffer(1024) };
897	let requestResult = 16;	897	let requestResult = 37;
898	let scrollFeedResult = 0;	898	let scrollFeedResult = 0;
899	let result = { id: 0, status: 3, historyRows: 30, ptr: 96, len: 0 };	899	let result = { id: 0, status: 3, historyRows: 30, ptr: 96, len: 0 };
900	const requestCalls = [];	900	const requestCalls = [];
@@ -913,7 +913,7 @@ async function verifySelectionShell(shell, html) {
913	mux_input_cap: () => 1024,	913	mux_input_cap: () => 1024,
914	mux_input_ptr: () => 0,	914	mux_input_ptr: () => 0,
915	mux_output_ptr: () => 256,	915	mux_output_ptr: () => 256,
916	mux_output_len: () => requestResult === 16 ? 16 : 0,	916	mux_output_len: () => requestResult === 37 ? 37 : 0,
917	mux_scroll_start: (pages, rows) => 30 - pages * rows,	917	mux_scroll_start: (pages, rows) => 30 - pages * rows,
918	mux_scroll_feed: () => scrollFeedResult,	918	mux_scroll_feed: () => scrollFeedResult,
919	mux_init: () => 0,	919	mux_init: () => 0,
@@ -927,14 +927,14 @@ async function verifySelectionShell(shell, html) {
927	mux_selection_len: () => result.len,	927	mux_selection_len: () => result.len,
928	mux_selection_request: (id, ar, ac, br, bc) => {	928	mux_selection_request: (id, ar, ac, br, bc) => {
929	requestCalls.push([id >>> 0, ar, ac, br, bc]);	929	requestCalls.push([id >>> 0, ar, ac, br, bc]);
930	if (requestResult !== 16) return requestResult;	930	if (requestResult !== 37) return requestResult;
931	const view = new DataView(memory.buffer, 256, 16);	931	const view = new DataView(memory.buffer, 256, 37);
932	view.setUint32(0, id, true);	932	view.setUint32(0, id, true);
933	view.setUint32(4, ar, true);	933	view.setUint32(4, ar, true);
934	view.setUint16(8, ac, true);	934	view.setUint16(8, ac, true);
935	view.setUint32(10, br, true);	935	view.setUint32(10, br, true);
936	view.setUint16(14, bc, true);	936	view.setUint16(14, bc, true);
937	return 16;	937	return 37;
938	},	938	},
939	};	939	};
940	selected.zoomed = true;	940	selected.zoomed = true;
@@ -1258,9 +1258,9 @@ async function verifySelectionShell(shell, html) {
1258	JSON.stringify([[1, 31, 2, 33, 5]]),	1258	JSON.stringify([[1, 31, 2, 33, 5]]),
1259	);	1259	);
1260	check(	1260	check(
1261	'drag release sends the exact 16-byte request',	1261	'drag release sends the exact 37-byte request',
1262	Buffer.from(forward.sent[0]?.payload ?? []).toString('hex'),	1262	Buffer.from(forward.sent[0]?.payload ?? []).toString('hex'),
1263	'010000001f0000000200210000000500',	1263	'010000001f0000000200210000000500000000000000000000000000000000000000000000',
1264	);	1264	);
1265		1265
1266	const reverse = makeTile();	1266	const reverse = makeTile();
@@ -3139,11 +3139,11 @@ async function main() {
3139		3139
3140	const selectionReply = (id, status, text = '', historyRows = 0) => {	3140	const selectionReply = (id, status, text = '', historyRows = 0) => {
3141	const body = Buffer.from(text, 'utf8');	3141	const body = Buffer.from(text, 'utf8');
3142	const reply = Buffer.alloc(9 + body.length);	3142	const reply = Buffer.alloc(41 + body.length);
3143	reply.writeUInt32LE(id, 0);	3143	reply.writeUInt32LE(id, 0);
3144	reply[4] = status;	3144	reply[4] = status;
3145	reply.writeUInt32LE(historyRows, 5);	3145	reply.writeUInt32LE(historyRows, 5);
3146	body.copy(reply, 9);	3146	body.copy(reply, 41);
3147	return reply;	3147	return reply;
3148	};	3148	};
3149	const selectionText = () => Buffer.from(mem().subarray(	3149	const selectionText = () => Buffer.from(mem().subarray(
@@ -3151,12 +3151,12 @@ async function main() {
3151	e.mux_selection_ptr() + e.mux_selection_len(),	3151	e.mux_selection_ptr() + e.mux_selection_len(),
3152	));	3152	));
3153	const firstSelectionId = 0x78563412;	3153	const firstSelectionId = 0x78563412;
3154	check('selection request len', e.mux_selection_request(firstSelectionId, 0x44332211, 0x6655, 0xaa998877, 0xccbb), 16);	3154	check('selection request len', e.mux_selection_request(firstSelectionId, 0x44332211, 0x6655, 0xaa998877, 0xccbb), 37);
3155	check('selection request output len', e.mux_output_len(), 16);	3155	check('selection request output len', e.mux_output_len(), 37);
3156	check(	3156	check(
3157	'selection request golden bytes',	3157	'selection request golden bytes',
3158	outBytes().toString('hex'),	3158	outBytes().toString('hex'),
3159	'12345678112233445566778899aabbcc',	3159	'12345678112233445566778899aabbcc000000000000000000000000000000000000000000',
3160	);	3160	);
3161	check('selection invalid anchor col', e.mux_selection_request(30, 1, 65536, 2, 3), -3);	3161	check('selection invalid anchor col', e.mux_selection_request(30, 1, 65536, 2, 3), -3);
3162	check('selection invalid anchor col clears output', e.mux_output_len(), 0);	3162	check('selection invalid anchor col clears output', e.mux_output_len(), 0);
@@ -3169,13 +3169,13 @@ async function main() {
3169	);	3169	);
3170		3170
3171	const supersededSelectionId = 0x01020304;	3171	const supersededSelectionId = 0x01020304;
3172	check('selection superseded request', e.mux_selection_request(supersededSelectionId, 5, 6, 7, 8), 16);	3172	check('selection superseded request', e.mux_selection_request(supersededSelectionId, 5, 6, 7, 8), 37);
3173	const latestSelectionId = 0x10203040;	3173	const latestSelectionId = 0x10203040;
3174	check('selection latest request replaces pending', e.mux_selection_request(latestSelectionId, 9, 10, 11, 12), 16);	3174	check('selection latest request replaces pending', e.mux_selection_request(latestSelectionId, 9, 10, 11, 12), 37);
3175	check(	3175	check(
3176	'selection request survives enlarged input staging capacity',	3176	'selection request survives enlarged input staging capacity',
3177	outBytes().toString('hex'),	3177	outBytes().toString('hex'),
3178	'40302010090000000a000b0000000c00',	3178	'40302010090000000a000b0000000c00000000000000000000000000000000000000000000',
3179	);	3179	);
3180	check(	3180	check(
3181	'selection stale reply ignored',	3181	'selection stale reply ignored',
@@ -3206,7 +3206,7 @@ async function main() {
3206	check('selection repeated reply clears getter', e.mux_selection_len(), 0);	3206	check('selection repeated reply clears getter', e.mux_selection_len(), 0);
3207		3207
3208	const highSelectionId = 0xfedcba98;	3208	const highSelectionId = 0xfedcba98;
3209	check('high-bit selection request', e.mux_selection_request(highSelectionId, 0, 0, 0, 0), 16);	3209	check('high-bit selection request', e.mux_selection_request(highSelectionId, 0, 0, 0, 0), 37);
3210	check(	3210	check(
3211	'high-bit selection reply action',	3211	'high-bit selection reply action',
3212	e.mux_client_frame(0x90, stage(selectionReply(highSelectionId, 0, 'high'))),	3212	e.mux_client_frame(0x90, stage(selectionReply(highSelectionId, 0, 'high'))),
@@ -3218,7 +3218,7 @@ async function main() {
3218		3218
3219	for (const [name, status] of [['invalid', 1], ['too large', 2], ['unavailable', 3]]) {	3219	for (const [name, status] of [['invalid', 1], ['too large', 2], ['unavailable', 3]]) {
3220	const id = 100 + status;	3220	const id = 100 + status;
3221	check(`selection ${name} request`, e.mux_selection_request(id, 0, 0, 0, 0), 16);	3221	check(`selection ${name} request`, e.mux_selection_request(id, 0, 0, 0, 0), 37);
3222	check(	3222	check(
3223	`selection ${name} action`,	3223	`selection ${name} action`,
3224	e.mux_client_frame(0x90, stage(selectionReply(id, status))),	3224	e.mux_client_frame(0x90, stage(selectionReply(id, status))),
@@ -3230,7 +3230,7 @@ async function main() {
3230	}	3230	}
3231		3231
3232	const populateSelection = (id) => {	3232	const populateSelection = (id) => {
3233	check(`selection ${id} request`, e.mux_selection_request(id, 0, 0, 0, 0), 16);	3233	check(`selection ${id} request`, e.mux_selection_request(id, 0, 0, 0, 0), 37);
3234	check(	3234	check(
3235	`selection ${id} reply`,	3235	`selection ${id} reply`,
3236	e.mux_client_frame(0x90, stage(selectionReply(id, 0, 'x'))),	3236	e.mux_client_frame(0x90, stage(selectionReply(id, 0, 'x'))),
@@ -3251,7 +3251,7 @@ async function main() {
3251	check('wide type after selection', e.mux_client_frame(0x100, 0), clientAction.ignored);	3251	check('wide type after selection', e.mux_client_frame(0x100, 0), clientAction.ignored);
3252	check('wide type clears selection getter', e.mux_selection_len(), 0);	3252	check('wide type clears selection getter', e.mux_selection_len(), 0);
3253	populateSelection(205);	3253	populateSelection(205);
3254	check('valid new request after selection', e.mux_selection_request(206, 1, 2, 3, 4), 16);	3254	check('valid new request after selection', e.mux_selection_request(206, 1, 2, 3, 4), 37);
3255	check('valid new request clears selection getter', e.mux_selection_len(), 0);	3255	check('valid new request clears selection getter', e.mux_selection_len(), 0);
3256		3256
3257	populateSelection(207);	3257	populateSelection(207);
@@ -3281,7 +3281,7 @@ async function main() {
3281	check('invalid selection request clears exposed id', e.mux_selection_id(), 0);	3281	check('invalid selection request clears exposed id', e.mux_selection_id(), 0);
3282	check('invalid selection request clears exposed status', e.mux_selection_status(), 3);	3282	check('invalid selection request clears exposed status', e.mux_selection_status(), 3);
3283	check('invalid selection request clears exposed len', e.mux_selection_len(), 0);	3283	check('invalid selection request clears exposed len', e.mux_selection_len(), 0);
3284	check('pending selection request before invalid request', e.mux_selection_request(213, 1, 2, 3, 4), 16);	3284	check('pending selection request before invalid request', e.mux_selection_request(213, 1, 2, 3, 4), 37);
3285	check('invalid selection request preserves pending correlation', e.mux_selection_request(214, 1, 2, 3, 65536), -3);	3285	check('invalid selection request preserves pending correlation', e.mux_selection_request(214, 1, 2, 3, 65536), -3);
3286	check(	3286	check(
3287	'matching reply after invalid request is accepted',	3287	'matching reply after invalid request is accepted',
@@ -3456,7 +3456,7 @@ async function main() {
3456	// The staging cap is pinned to the largest selection reply: its nine-byte	3456	// The staging cap is pinned to the largest selection reply: its nine-byte
3457	// correlation/status/history prefix plus the protocol's one-MiB text	3457	// correlation/status/history prefix plus the protocol's one-MiB text
3458	// maximum.	3458	// maximum.
3459	check('input cap', e.mux_input_cap(), 1024 * 1024 + 9);	3459	check('input cap', e.mux_input_cap(), 1024 * 1024 + 41);
3460		3460
3461	// --- the shell's ACTUAL call list, read out of mux.js ---	3461	// --- the shell's ACTUAL call list, read out of mux.js ---
3462	// Everything above pins exports this file happens to name. This pins	3462	// Everything above pins exports this file happens to name. This pins
@@ -3711,7 +3711,7 @@ async function main() {
3711	check('clipboard before lifecycle reset', e.mux_client_frame(0x8f, stage(clipboard)), clientAction.clipboard);	3711	check('clipboard before lifecycle reset', e.mux_client_frame(0x8f, stage(clipboard)), clientAction.clipboard);
3712	check('clipboard populated before lifecycle reset', e.mux_clipboard_len(), 4);	3712	check('clipboard populated before lifecycle reset', e.mux_clipboard_len(), 4);
3713	check('modes populated before lifecycle reset', e.mux_bracketed_paste(), 1);	3713	check('modes populated before lifecycle reset', e.mux_bracketed_paste(), 1);
3714	check('selection before lifecycle reset request', e.mux_selection_request(301, 0, 0, 0, 0), 16);	3714	check('selection before lifecycle reset request', e.mux_selection_request(301, 0, 0, 0, 0), 37);
3715	check('selection before lifecycle reset reply', e.mux_client_frame(0x90, stage(selectionReply(301, 0, 'reset'))), clientAction.selection);	3715	check('selection before lifecycle reset reply', e.mux_client_frame(0x90, stage(selectionReply(301, 0, 'reset'))), clientAction.selection);
3716	check('selection populated before lifecycle reset', e.mux_selection_len(), 5);	3716	check('selection populated before lifecycle reset', e.mux_selection_len(), 5);
3717	e.mux_deinit();	3717	e.mux_deinit();

Old		New
@@ -23,13 +23,14 @@ const client_os = @import("client_os");
23	// `paint`, which a container-level `paint` would collide with.	23	// `paint`, which a container-level `paint` would collide with.
24	const paint_mod = @import("paint.zig");	24	const paint_mod = @import("paint.zig");
25	const askpass = @import("client").askpass;	25	const askpass = @import("client").askpass;
26	const select = @import("select.zig");	26	const select = @import("client").selection;
27	// The command prefix byte. Owned by keymap because the dialler in client.zig	27	// The command prefix byte. Owned by keymap because the dialler in client.zig
28	// watches for it with no session and no terminal in the picture.	28	// watches for it with no session and no terminal in the picture.
29	const detach_key = @import("client").keymap.detach_key;	29	const detach_key = @import("client").keymap.detach_key;
30		30
31	/// What `select` answers, in the shape `paint` asks for. The two are siblings	31	/// What `select` answers, in the shape `paint` asks for. Selection policy lives
32	/// that may not import one another, so somebody above both joins them.	32	/// in `client.selection`; this adapter converts its absolute rows to the wall's
		33	/// grid rows before painting.
33	///	34	///
34	/// It CONVERTS as well as adapts: `select` speaks absolute rows and a painter	35	/// It CONVERTS as well as adapts: `select` speaks absolute rows and a painter
35	/// speaks grid rows, so the history count of the frame being painted turns one	36	/// speaks grid rows, so the history count of the frame being painted turns one
@@ -4576,6 +4577,7 @@ fn replyBytes(
4576	std.mem.writeInt(u32, buf[0..4], id, .little);	4577	std.mem.writeInt(u32, buf[0..4], id, .little);
4577	buf[4] = @intFromEnum(status);	4578	buf[4] = @intFromEnum(status);
4578	std.mem.writeInt(u32, buf[5..9], history_rows, .little);	4579	std.mem.writeInt(u32, buf[5..9], history_rows, .little);
		4580	@memset(buf[9..proto.selection_reply_prefix_len], 0);
4579	@memcpy(buf[proto.selection_reply_prefix_len..][0..text.len], text);	4581	@memcpy(buf[proto.selection_reply_prefix_len..][0..text.len], text);
4580	return buf[0 .. proto.selection_reply_prefix_len + text.len];	4582	return buf[0 .. proto.selection_reply_prefix_len + text.len];
4581	}	4583	}