From bf9d9dbf352e6486f721dc8f0458526ecd7dbd6e Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 09:20:34 +0000
Subject: [PATCH 01/29] mk: build the Linux-guest test image without first-boot
 setup

With NONOS_LINUX_GUESTS=1 the kernel was still built with the setup
profile. Under it the apps, the Linux personality among them, spawn only
once first-boot setup exits, and setup waits for keys. An unattended guest
boot therefore never started its guest: in 180 s after `[INIT] Capsules
spawned` the log had `[SETUP] keyboard held` and no `[APP-LINUX]` or
`[LINUX]` line.

That image now builds `microkernel-desktop-gui` with `nonos-stark-attest`,
the same capsule set without setup, so the apps spawn at boot. Every other
build of nonos-mk-desktop-gui-prod is unchanged.
---
 mk/20-build.mk | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/mk/20-build.mk b/mk/20-build.mk
index 893340e79..ae5e484be 100644
--- a/mk/20-build.mk
+++ b/mk/20-build.mk
@@ -1187,10 +1187,18 @@ DESKTOP_GUI_CAPSULE_ARTIFACTS := $(DESKTOP_BASE_CAPSULE_ARTIFACTS) \
 		$(DESKTOP_STD_TOOL_ARTIFACTS) \
 		$(ZK_POLICY_ROOT)
 
+# A Linux-guest test image boots unattended, and first-boot setup waits for
+# keys nobody presses. Under the setup profile the apps, the Linux personality
+# among them, spawn only once setup exits, so that image would never start its
+# guest. It builds the desktop profile without first-boot setup instead.
 nonos-mk-desktop-gui-prod: $(DESKTOP_GUI_CAPSULE_ARTIFACTS) \
 		nonos-mk-verify-desktop-gui-capsules \
 		nonos-mk-check-deps nonos-mk-ensure-signing-key
+ifeq ($(NONOS_LINUX_GUESTS),1)
+	$(call nonos_kernel_build,microkernel-desktop-gui + nonos-stark-attest (unattended guest test),microkernel-desktop-gui$(_boot_comma)nonos-stark-attest)
+else
 	$(call nonos_kernel_build,microkernel-setup-wizard + nonos-stark-attest,microkernel-setup-wizard$(_boot_comma)nonos-stark-attest)
+endif
 
 # nonos-mk-install-prod: the desktop profile with the NVMe driver capsule in
 # it. The desktop cut leaves NVMe out because a driver whose hardware is absent

From 5ab0a0912032e470b2448bdaa9a8fd04ba7a2a59 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 09:20:34 +0000
Subject: [PATCH 02/29] exit: keep a thread group's page tables until its last
 member is gone

Threads run on their leader's tables without owning an address space
entry, so release freed the tables when the leader was finalized, whatever
its threads were doing. A thread still in the process table can be on the
CPU under those tables, taking its own kill. When a Go guest exited, the
personality killed its threads and then its leader, and the timer drain
finalized the leader while a Go thread was running. The kernel then took a
page fault fetching the double fault gate, and the machine reset:
CR3 was the guest's, FS held the Go thread's TLS, and CR2 was the IDT's
entry for vector 8.

Release now hands the address space to another process in the table that
runs on the same tables, and rebinds that process's capability token to
the ASID it now owns. The last holder's release frees the tables.
---
 .../paging/manager/api/address_space.rs       | 12 +++++++
 src/memory/paging/manager/api/mod.rs          |  4 +--
 .../address_space/lifecycle/release.rs        | 33 +++++++++++++++++--
 3 files changed, 44 insertions(+), 5 deletions(-)

diff --git a/src/memory/paging/manager/api/address_space.rs b/src/memory/paging/manager/api/address_space.rs
index 7d0950a48..99be15ac6 100644
--- a/src/memory/paging/manager/api/address_space.rs
+++ b/src/memory/paging/manager/api/address_space.rs
@@ -38,6 +38,18 @@ pub fn lookup_asid_for_process(process_id: u32) -> Option<u32> {
     lock_responsive(&PAGING_MANAGER).lookup_asid_for_process(process_id)
 }
 
+/// Make `process_id` the owner of the tables `asid` names, so its release is
+/// the one that frees them. False when there is no such address space.
+pub fn hand_over_address_space(asid: u32, process_id: u32) -> bool {
+    match lock_responsive(&PAGING_MANAGER).address_spaces.get_mut(&asid) {
+        Some(space) => {
+            space.process_id = process_id;
+            true
+        }
+        None => false,
+    }
+}
+
 pub fn switch_to_process_address_space(process_id: u32) -> PagingResult<()> {
     let asid = lookup_asid_for_process(process_id)
         .ok_or(crate::memory::paging::error::PagingError::AddressSpaceNotFound)?;
diff --git a/src/memory/paging/manager/api/mod.rs b/src/memory/paging/manager/api/mod.rs
index 61b032185..7eea35570 100644
--- a/src/memory/paging/manager/api/mod.rs
+++ b/src/memory/paging/manager/api/mod.rs
@@ -27,8 +27,8 @@ mod stats;
 mod tlb_ops;
 
 pub use address_space::{
-    cleanup_address_space, create_address_space, get_process_cr3, lookup_asid_for_process,
-    switch_address_space, switch_to_process_address_space,
+    cleanup_address_space, create_address_space, get_process_cr3, hand_over_address_space,
+    lookup_asid_for_process, switch_address_space, switch_to_process_address_space,
 };
 pub use faults::handle_page_fault;
 pub use init::{init, is_initialized};
diff --git a/src/process/address_space/lifecycle/release.rs b/src/process/address_space/lifecycle/release.rs
index 2ae992d8e..20ad4e12b 100644
--- a/src/process/address_space/lifecycle/release.rs
+++ b/src/process/address_space/lifecycle/release.rs
@@ -29,9 +29,36 @@ pub fn release(pcb: &Arc<ProcessControlBlock>) {
     // table, so it freed whatever address space happened to be current; the
     // ASID-scoped teardown frees the leaf frames as well, so it is the only
     // path that touches the right tables.
-    if let Some(asid) = crate::memory::paging::manager::lookup_asid_for_process(pcb.pid) {
-        if crate::memory::paging::manager::cleanup_address_space(asid).is_err() {
-            crate::sys::serial::println(b"[EXIT] address_space_cleanup_failed");
+    let Some(asid) = crate::memory::paging::manager::lookup_asid_for_process(pcb.pid) else {
+        return;
+    };
+    /*
+     * A thread runs on its group's tables without owning them, and until it
+     * leaves the process table it can still be on a CPU under them, taking
+     * its own kill or parked on its kernel stack. Freed when the owner went
+     * first, they were reused under a running thread, and a threaded guest's
+     * exit triple faulted. They pass to a thread still in the table instead,
+     * and the last holder's release frees them.
+     */
+    if let Some(heir) = holder_after(pcb) {
+        if crate::memory::paging::manager::hand_over_address_space(asid, heir.pid) {
+            // Its token names the ASID it runs in, which it now owns.
+            let _ = crate::process::caps::rebind_address_space(&heir);
+            return;
         }
     }
+    if crate::memory::paging::manager::cleanup_address_space(asid).is_err() {
+        crate::sys::serial::println(b"[EXIT] address_space_cleanup_failed");
+    }
+}
+
+fn holder_after(pcb: &ProcessControlBlock) -> Option<Arc<ProcessControlBlock>> {
+    let tables = pcb.cr3.load(Ordering::Acquire);
+    if tables == 0 {
+        return None;
+    }
+    crate::process::core::PROCESS_TABLE
+        .get_all_processes()
+        .into_iter()
+        .find(|p| p.pid != pcb.pid && p.cr3.load(Ordering::Acquire) == tables)
 }

From 3fc1ac19d32d1a84e482287f2adefce1915920be Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 09:20:35 +0000
Subject: [PATCH 03/29] foreign: start a guest's clone child on its parent's
 registers

A Linux clone child resumes after its parent's `syscall` holding the
parent's registers, with rax zero and rsp the new stack. MkForeignThread
started the child on fresh registers instead, and both runtimes that start
threads here call through a register in the child: Go's `runtime.clone`
calls r12 and reads m and g from r13 and r9, and musl 1.2.4's `__clone`
calls r9. The first gohello boot started two threads, and they faulted at
`rip=0` and at a heap address on an NX page.

MkForeignThread takes a fifth argument, the guest thread parked in the
call that asked. Given, the new thread starts on a copy of that thread's
parked registers, with rax zero, the entry and stack given, and the
parent's FS base unless a TLS is named. The source thread must be
supervised by the caller and in the same thread group as the target, so no
guest receives another's register contents. Zero keeps the fresh start.

The personality passes the calling thread, and passes a TLS only when
CLONE_SETTLS is set; before, a clone without it installed the fifth
argument, whatever it held, as the child's FS base.
---
 abi/syscalls.toml                             |  2 +-
 src/process/foreign/thread.rs                 | 60 ++++++++++++++++++-
 src/syscall/microkernel/dispatch/process.rs   |  2 +-
 .../src/linux/call/spawn/clone.rs             | 15 +++--
 userland/libc/src/foreign.rs                  |  9 ++-
 5 files changed, 76 insertions(+), 12 deletions(-)

diff --git a/abi/syscalls.toml b/abi/syscalls.toml
index 210a70b84..798d02d5f 100644
--- a/abi/syscalls.toml
+++ b/abi/syscalls.toml
@@ -662,7 +662,7 @@ ret  = {type="i64"}
 [desc.MFTH]
 nr   = 0x4854464D
 caps = ["ForeignExec"]
-args = [{name="pid",type="u32",dir="in"},{name="entry",type="u64",dir="in"},{name="rsp",type="u64",dir="in"},{name="tls",type="u64",dir="in"}]
+args = [{name="pid",type="u32",dir="in"},{name="entry",type="u64",dir="in"},{name="rsp",type="u64",dir="in"},{name="tls",type="u64",dir="in"},{name="from",type="u32",dir="in"}]
 ret  = {type="i64"}
 
 [desc.MPTL]
diff --git a/src/process/foreign/thread.rs b/src/process/foreign/thread.rs
index fd3d230a7..f46ea39a5 100644
--- a/src/process/foreign/thread.rs
+++ b/src/process/foreign/thread.rs
@@ -17,12 +17,20 @@
 //! A second thread inside a guest.
 
 use super::peer_guard::{in_user_half, pid_arg};
+use crate::arch::context::SavedUser;
 use crate::process::core::{admit_thread, spawn_thread_parked};
-use crate::syscall::microkernel::errnos::{ERRNO_INVAL, ERRNO_NOMEM, ERRNO_PERM};
+use crate::syscall::microkernel::errnos::{ERRNO_INVAL, ERRNO_NOENT, ERRNO_NOMEM, ERRNO_PERM};
 
 /// `MkForeignThread`: a thread in `pid`, sharing its address space and
 /// supervised by the same caller.
-pub fn sys_foreign_thread(pid: u64, entry: u64, rsp: u64, tls: u64) -> i64 {
+///
+/// `from` is zero, or the thread of that guest parked in the call that asked
+/// for this one. Given, the new thread starts on a copy of its registers, as a
+/// Linux clone child does: zero in the return register, the stack and entry
+/// given here, and the parent's thread pointer unless `tls` names another. Go
+/// hands the child its function and its thread state in registers and calls
+/// through them, so a child started on fresh registers called address zero.
+pub fn sys_foreign_thread(pid: u64, entry: u64, rsp: u64, tls: u64, from: u64) -> i64 {
     let Some(caller) = crate::process::current_pid() else {
         return ERRNO_INVAL;
     };
@@ -44,12 +52,37 @@ pub fn sys_foreign_thread(pid: u64, entry: u64, rsp: u64, tls: u64) -> i64 {
     if tls != 0 && !in_user_half(tls, 1) {
         return ERRNO_INVAL;
     }
+    let parent = match from {
+        0 => None,
+        raw => match parked_parent(caller, pid, raw) {
+            Ok(p) => Some(p),
+            Err(e) => return e,
+        },
+    };
     let Ok(tid) = spawn_thread_parked(pid, entry, rsp) else {
         return ERRNO_NOMEM;
     };
+    let tls = match (tls, &parent) {
+        (0, Some((_, parent_tls))) => *parent_tls,
+        _ => tls,
+    };
     if tls != 0 {
         crate::process::with_process(tid, |pcb| pcb.set_tls_base(tls));
     }
+    if let Some((mut regs, _)) = parent {
+        regs.rax = 0;
+        regs.rip = entry;
+        regs.rsp = rsp;
+        /*
+         * A saved context is what the switch resumes when no first entry is
+         * pending, which is how a forked child starts; the fresh entry the
+         * spawn prepared would otherwise win and drop every register.
+         */
+        crate::process::with_process(tid, |pcb| {
+            pcb.pending_user_entry.lock().take();
+            *pcb.saved_user_context.lock() = Some(regs);
+        });
+    }
     if !super::registry::insert(tid, caller) {
         crate::process::exit::teardown(tid, ERRNO_NOMEM as i32, false);
         return ERRNO_NOMEM;
@@ -57,3 +90,26 @@ pub fn sys_foreign_thread(pid: u64, entry: u64, rsp: u64, tls: u64) -> i64 {
     admit_thread(tid);
     tid as i64
 }
+
+/*
+ * The registers and thread pointer of the thread that asked. It must be one
+ * this caller supervises, in the same thread group as `pid`: a copy across
+ * groups would hand one guest another's register contents. It must also be
+ * parked in a call, since only then are its registers held aside.
+ */
+fn parked_parent(caller: u32, pid: u32, raw: u64) -> Result<(SavedUser, u64), i64> {
+    let from = pid_arg(raw)?;
+    if super::registry::supervisor_of(from) != Some(caller) {
+        return Err(ERRNO_PERM);
+    }
+    let group = |p: u32| crate::process::with_process(p, |pcb| pcb.thread_group_id());
+    let (Some(want), Some(have)) = (group(pid), group(from)) else {
+        return Err(ERRNO_INVAL);
+    };
+    if want != have {
+        return Err(ERRNO_PERM);
+    }
+    let regs = super::trap_frame::parked_frame(from).ok_or(ERRNO_NOENT)?;
+    let parent_tls = crate::process::with_process(from, |pcb| pcb.get_tls_base()).unwrap_or(0);
+    Ok((regs, parent_tls))
+}
diff --git a/src/syscall/microkernel/dispatch/process.rs b/src/syscall/microkernel/dispatch/process.rs
index 18e11d28c..dddf6a4a9 100644
--- a/src/syscall/microkernel/dispatch/process.rs
+++ b/src/syscall/microkernel/dispatch/process.rs
@@ -95,7 +95,7 @@ pub(super) fn handle(nr: u64, a: Args) -> Option<i64> {
         SYS_PEER_MAP => sys_peer_map(a.a0, a.a1, a.a2, a.a3),
         SYS_PEER_COPY => sys_peer_copy(a.a0, a.a1, a.a2, a.a3, a.a4),
         SYS_PEER_PROTECT => sys_peer_protect(a.a0, a.a1, a.a2, a.a3),
-        SYS_FOREIGN_THREAD => sys_foreign_thread(a.a0, a.a1, a.a2, a.a3),
+        SYS_FOREIGN_THREAD => sys_foreign_thread(a.a0, a.a1, a.a2, a.a3, a.a4),
         SYS_PEER_TLS => sys_peer_tls(a.a0, a.a1),
         SYS_FOREIGN_FORK => sys_foreign_fork(a.a0),
         SYS_PEER_UNMAP => sys_peer_unmap(a.a0, a.a1, a.a2),
diff --git a/userland/capsule_linux/src/linux/call/spawn/clone.rs b/userland/capsule_linux/src/linux/call/spawn/clone.rs
index 3ecdb0cae..e9c8ddfa8 100644
--- a/userland/capsule_linux/src/linux/call/spawn/clone.rs
+++ b/userland/capsule_linux/src/linux/call/spawn/clone.rs
@@ -24,13 +24,18 @@ use crate::linux::serve::Answer;
 
 const CLONE_VM: u64 = 0x100;
 const CLONE_THREAD: u64 = 0x10000;
+const CLONE_SETTLS: u64 = 0x80000;
 
-/// musl's `__clone` resumes the child at the instruction after its own
-/// `syscall`, with rax zero and rsp pointing at the function and argument it
-/// pushed.
+/// A Linux clone child resumes at the instruction after its parent's
+/// `syscall`, on its parent's registers with rax zero and rsp the new stack.
+/// Both runtimes that start threads here call through a register in the
+/// child: musl's `__clone` pops the argument and calls r9, Go's calls r12.
 pub fn clone(guest: &mut Guest, frame: &ForeignFrame) -> Answer {
     let a = frame.args();
-    let (flags, stack, tls) = (a[0], a[1], a[4]);
+    let (flags, stack) = (a[0], a[1]);
+    // The fifth argument is a thread pointer only when the flag says so;
+    // without it the child keeps its parent's.
+    let tls = if flags & CLONE_SETTLS != 0 { a[4] } else { 0 };
     if flags & (CLONE_VM | CLONE_THREAD) != CLONE_VM | CLONE_THREAD {
         /*
          * A new process, not a thread. That is fork, and fork needs an
@@ -48,7 +53,7 @@ pub fn clone(guest: &mut Guest, frame: &ForeignFrame) -> Answer {
     if stack == 0 {
         return Answer::value(errno::fail(errno::EINVAL));
     }
-    let tid = mk_foreign_thread(guest.pid, frame.rip, stack, tls);
+    let tid = mk_foreign_thread(guest.pid, frame.rip, stack, tls, frame.pid);
     if tid < 0 {
         return Answer::value(errno::fail(errno::ENOMEM));
     }
diff --git a/userland/libc/src/foreign.rs b/userland/libc/src/foreign.rs
index f3217b39e..a50956d75 100644
--- a/userland/libc/src/foreign.rs
+++ b/userland/libc/src/foreign.rs
@@ -54,9 +54,12 @@ pub fn mk_foreign_exec(pid: u32, entry: u64, rsp: u64) -> i64 {
 }
 
 /// A thread in a guest, sharing its address space. `tls` is the FS base
-/// it wakes with, which a C runtime reads before anything else.
-pub fn mk_foreign_thread(pid: u32, entry: u64, rsp: u64, tls: u64) -> i64 {
-    call_raw(N_MK_FOREIGN_THREAD, [pid as u64, entry, rsp, tls, 0, 0])
+/// it wakes with, which a C runtime reads before anything else. `from` is
+/// the guest thread parked in the call that asked for it, whose registers the
+/// new thread starts on, as a Linux clone child does; zero starts it on fresh
+/// ones.
+pub fn mk_foreign_thread(pid: u32, entry: u64, rsp: u64, tls: u64, from: u32) -> i64 {
+    call_raw(N_MK_FOREIGN_THREAD, [pid as u64, entry, rsp, tls, from as u64, 0])
 }
 
 /// Block until a guest of this process makes a call the kernel refuses,

From 874f3ecfc204a8cc6775775ae47005b2032cdc98 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 09:42:16 +0000
Subject: [PATCH 04/29] kill: let a foreign supervisor end the guests it hosts

MkKill admitted a parent or a holder of ProcessControl. A guest thread's
parent is its group leader, not the supervisor, so when a Linux guest
exited, the personality's kill of each thread was refused with EPERM, and
the refusal was dropped. The threads outlived their process. Once the
personality had exited, their parked calls were abandoned and they ran Go
code with no one to answer them: a second goconc boot showed a guest
thread faulting at 0x1006 and then at address zero after `[LINUX] guest
exited`.

MkKill now also admits the caller the foreign registry names as the
target's supervisor. The personality prints a refused kill as
`[LINUX] kill refused: pid <n> outlives its process, errno <e>`, so a
thread that survives its process is named in the log.
---
 src/syscall/microkernel/kill.rs                       |  9 ++++++++-
 userland/capsule_linux/src/linux/serve/family_reap.rs | 10 +++++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/syscall/microkernel/kill.rs b/src/syscall/microkernel/kill.rs
index 5274cf1f2..8ab3ac8bc 100644
--- a/src/syscall/microkernel/kill.rs
+++ b/src/syscall/microkernel/kill.rs
@@ -32,6 +32,13 @@ pub fn sys_kill(pid: u64, sig: u64) -> i64 {
     // unrelated pid needs the ProcessControl capability, held only by the
     // process manager, so a compromised app cannot terminate other capsules.
     let is_parent = caller != 0 && get_parent_pid(target) == Some(caller);
+    /*
+     * A foreign supervisor ends the guests it hosts. A guest thread's parent
+     * is its group leader, not the supervisor, so without this a guest's
+     * exit left its threads running, and once the supervisor was gone they
+     * ran on with no one to answer their calls.
+     */
+    let supervises = caller != 0 && crate::process::foreign::supervisor_of(target) == Some(caller);
     let controls = caller != 0
         && with_process(caller, |pcb| {
             pcb.caps_bits.load(core::sync::atomic::Ordering::Relaxed)
@@ -39,7 +46,7 @@ pub fn sys_kill(pid: u64, sig: u64) -> i64 {
                 != 0
         })
         .unwrap_or(false);
-    if !is_parent && !controls {
+    if !is_parent && !supervises && !controls {
         return ERRNO_PERM;
     }
     if !pid_alive(target) {
diff --git a/userland/capsule_linux/src/linux/serve/family_reap.rs b/userland/capsule_linux/src/linux/serve/family_reap.rs
index 16b102a88..831a95f57 100644
--- a/userland/capsule_linux/src/linux/serve/family_reap.rs
+++ b/userland/capsule_linux/src/linux/serve/family_reap.rs
@@ -31,7 +31,15 @@ impl Family {
             let gone = self.guests.remove(i);
             let code = gone.exited.unwrap_or(0);
             for tid in gone.threads.iter().chain([gone.pid].iter()) {
-                let _ = mk_kill(*tid as u64, SIGKILL);
+                let rc = mk_kill(*tid as u64, SIGKILL);
+                if rc < 0 {
+                    // Refused, it runs on after its process ended.
+                    let line = alloc::format!(
+                        "[LINUX] kill refused: pid {tid} outlives its process, errno {}\n",
+                        -rc
+                    );
+                    let _ = nonos_libc::mk_debug(line.as_ptr(), line.len());
+                }
             }
             if gone.pid == self.root {
                 self.root_code = code;

From a06600d4cc17f8dcfbbad6500db2f42b7af69fcc Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 12:56:50 +0000
Subject: [PATCH 05/29] app_skeleton: let an app keep its window open when
 close is pressed

Pressing the close button now asks the app first, through close_requested.
An app holding unsaved work returns false and says so in its own window; the next press closes. The default closes as before, so no other app changes.
---
 userland/app_skeleton/src/app/behavior.rs     | 8 ++++++++
 userland/app_skeleton/src/runner/drain_ipc.rs | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/userland/app_skeleton/src/app/behavior.rs b/userland/app_skeleton/src/app/behavior.rs
index 32d84781c..f67e25b26 100644
--- a/userland/app_skeleton/src/app/behavior.rs
+++ b/userland/app_skeleton/src/app/behavior.rs
@@ -58,4 +58,12 @@ pub trait App {
     fn on_accessory_event(&mut self, _event: InputEvent) -> EventOutcome {
         EventOutcome::Idle
     }
+
+    /// Asked when the window's close button is pressed. An app holding work
+    /// the user would lose returns false, says so in its own window, and the
+    /// window stays open; pressing close again is the user's answer. Defaults
+    /// to closing.
+    fn close_requested(&mut self) -> bool {
+        true
+    }
 }
diff --git a/userland/app_skeleton/src/runner/drain_ipc.rs b/userland/app_skeleton/src/runner/drain_ipc.rs
index 9d13fbfee..234269ea6 100644
--- a/userland/app_skeleton/src/runner/drain_ipc.rs
+++ b/userland/app_skeleton/src/runner/drain_ipc.rs
@@ -77,6 +77,14 @@ pub(super) fn drain<A: App>(
         let event = decorations::normalize(event);
         click_focus::handle(event, wm_port, window_id, request_id);
         match decorations::handle(width, height, maximized, event) {
+            /*
+             * An app with work the user would lose keeps its window and says
+             * why; the next press on close is the answer.
+             */
+            Some(EventOutcome::Close) if !app.close_requested() => {
+                repaint = true;
+                continue;
+            }
             Some(EventOutcome::Close) => {
                 return DrainResult {
                     repaint,

From adb4a7968852b26c70328571bd9be862a199269d Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 12:56:51 +0000
Subject: [PATCH 06/29] text_editor: never overwrite a file with text that was
 not read from it

A failed open no longer renames the tab, so the next save cannot write the old text over the file that failed, and a failed open from the tree opens no tab. Opening puts the file in its own tab and never replaces text; a load resets undo, redo and selection. A new document is untitled instead of carrying /notes.txt unread, and saving it asks for a path. Save As asks before replacing another file, and a document takes a new name only once the write lands.

Undo and redo track a save point, so undoing back to the saved text is clean and undoing past it is not, even after old steps are dropped. Every close control and the window close button ask once before discarding unsaved text, and Esc no longer closes the window. editor_proofs compiles again, with save-point proofs: 34 pass.
---
 .../capsule_text_editor/src/editor/app.rs     | 12 +++-
 .../src/editor/ctrl_open.rs                   | 67 +++++++++++-------
 .../src/editor/ctrl_save.rs                   | 48 +++++++++----
 .../capsule_text_editor/src/editor/dismiss.rs | 30 ++++++++
 .../capsule_text_editor/src/editor/edit.rs    | 36 ++++------
 .../capsule_text_editor/src/editor/event.rs   |  3 +-
 .../src/editor/event_editor.rs                | 29 ++++----
 .../src/editor/goto_prompt.rs                 | 34 ++++++++++
 .../capsule_text_editor/src/editor/mod.rs     | 10 ++-
 .../src/editor/open_prompt.rs                 | 42 ++++++++++++
 .../src/editor/path_prompt.rs                 | 67 ++++++++++--------
 .../src/editor/quick_act.rs                   | 10 +--
 .../capsule_text_editor/src/editor/reflow.rs  |  7 ++
 .../src/editor/save_point.rs                  | 65 ++++++++++++++++++
 .../capsule_text_editor/src/editor/state.rs   |  5 +-
 .../src/editor/state_new.rs                   | 16 +++--
 .../src/editor/undo_push.rs                   | 61 +++++++++++++++++
 .../src/editor/ws_close.rs                    | 68 +++++++++++++++++++
 .../src/editor/ws_menubar.rs                  |  2 +-
 .../capsule_text_editor/src/editor/ws_open.rs | 52 +++++++-------
 .../src/editor/ws_pointer.rs                  |  2 +-
 userland/editor_proofs/Cargo.lock             |  2 +-
 userland/editor_proofs/src/lib.rs             | 15 ++++
 .../editor_proofs/src/save_history_tests.rs   | 56 +++++++++++++++
 userland/editor_proofs/src/save_tests.rs      | 62 +++++++++++++++++
 25 files changed, 650 insertions(+), 151 deletions(-)
 create mode 100644 userland/capsule_text_editor/src/editor/dismiss.rs
 create mode 100644 userland/capsule_text_editor/src/editor/goto_prompt.rs
 create mode 100644 userland/capsule_text_editor/src/editor/open_prompt.rs
 create mode 100644 userland/capsule_text_editor/src/editor/save_point.rs
 create mode 100644 userland/capsule_text_editor/src/editor/undo_push.rs
 create mode 100644 userland/capsule_text_editor/src/editor/ws_close.rs
 create mode 100644 userland/editor_proofs/src/save_history_tests.rs
 create mode 100644 userland/editor_proofs/src/save_tests.rs

diff --git a/userland/capsule_text_editor/src/editor/app.rs b/userland/capsule_text_editor/src/editor/app.rs
index f4373c393..509a49812 100644
--- a/userland/capsule_text_editor/src/editor/app.rs
+++ b/userland/capsule_text_editor/src/editor/app.rs
@@ -49,7 +49,10 @@ pub struct Editor {
     /// A close was asked for on a document with unsaved edits and refused
     /// once. Cleared by anything else, so the confirmation cannot be
     /// satisfied by a keystroke from a minute ago.
-    pub(super) close_armed: bool,
+    /// The tab whose unsaved text the next close request discards.
+    pub(super) close_armed: Option<usize>,
+    /// The window close button was pressed once with unsaved tabs open.
+    pub(super) quit_armed: bool,
     pub(super) owner_pid: u32,
     // Tab pixel spans from the last paint, used to hit-test tab-strip clicks.
     pub(super) tab_layout: Vec<TabSpan>,
@@ -82,7 +85,8 @@ impl Editor {
             mru: Vec::new(),
             sidebar_open: true,
             chord_ctrl_k: false,
-            close_armed: false,
+            close_armed: None,
+            quit_armed: false,
             owner_pid: 0,
             tab_layout: Vec::new(),
             last_w: 0,
@@ -124,4 +128,8 @@ impl App for Editor {
     fn paint(&mut self, fb: &mut PaintBuffer) {
         self.paint_shell(fb);
     }
+
+    fn close_requested(&mut self) -> bool {
+        self.confirm_quit()
+    }
 }
diff --git a/userland/capsule_text_editor/src/editor/ctrl_open.rs b/userland/capsule_text_editor/src/editor/ctrl_open.rs
index c10de3f48..9905b4163 100644
--- a/userland/capsule_text_editor/src/editor/ctrl_open.rs
+++ b/userland/capsule_text_editor/src/editor/ctrl_open.rs
@@ -14,39 +14,60 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-use nonos_app_skeleton::{clients::vfs, EventOutcome};
+//! Loading a file into a document.
+//!
+//! The path becomes the document's only once its bytes are in the buffer. A
+//! failed read leaves the document exactly as it was, name included, so the
+//! next save cannot write the old text over the file that failed to open.
+
+use nonos_app_skeleton::clients::vfs;
 
 use super::mode::mode_for_path;
 use super::resolve_owner_pid::resolve_owner_pid;
 use super::state::{State, CAPACITY};
 
-pub(super) fn ctrl_open(state: &mut State) -> EventOutcome {
+/// Read `path` into `state`. On failure `status` says why and nothing else in
+/// the document changes.
+pub(super) fn load(state: &mut State, path: &[u8]) -> bool {
+    if path.is_empty() || path.len() > state.path.len() {
+        state.status = b"no path given";
+        return false;
+    }
     if !resolve_owner_pid(state) {
-        state.status = b"open failed";
-        return EventOutcome::Repaint;
+        state.status = b"open failed: file service not reachable";
+        return false;
     }
-    let path = state.path[..state.path_len].to_vec();
-    if let Ok((size, _)) = vfs::stat(state.owner_pid, &path) {
+    if let Ok((size, _)) = vfs::stat(state.owner_pid, path) {
         if size > CAPACITY as u64 {
-            state.status = b"file too large";
-            return EventOutcome::Repaint;
+            state.status = b"open refused: file is larger than 256 KiB";
+            return false;
         }
     }
-    match vfs::read_file(state.owner_pid, &path, CAPACITY as u32) {
-        Ok(bytes) if core::str::from_utf8(&bytes).is_ok() && bytes.len() <= CAPACITY => {
-            state.buf[..bytes.len()].copy_from_slice(&bytes);
-            state.len = bytes.len();
-            state.dirty = false;
-            state.status = b"opened";
-            // Open at the top of the file with the caret ready to edit.
-            state.caret = 0;
-            state.scroll_line = 0;
-            let p = core::str::from_utf8(&state.path[..state.path_len]).unwrap_or("");
-            state.mode = mode_for_path(p);
-            state.reflow();
+    let bytes = match vfs::read_file(state.owner_pid, path, CAPACITY as u32) {
+        Ok(b) => b,
+        Err(_) => {
+            state.status = b"open failed: file could not be read";
+            return false;
         }
-        Ok(_) => state.status = b"file is not valid utf-8",
-        Err(_) => state.status = b"open failed",
+    };
+    if bytes.len() > CAPACITY {
+        state.status = b"open refused: file is larger than 256 KiB";
+        return false;
+    }
+    if core::str::from_utf8(&bytes).is_err() {
+        state.status = b"open refused: file is not valid UTF-8";
+        return false;
     }
-    EventOutcome::Repaint
+    state.buf[..bytes.len()].copy_from_slice(&bytes);
+    state.len = bytes.len();
+    state.path[..path.len()].copy_from_slice(path);
+    state.path_len = path.len();
+    state.reset_history();
+    state.status = b"opened";
+    state.caret = 0;
+    state.scroll_line = 0;
+    let p = core::str::from_utf8(path).unwrap_or("");
+    state.mode = mode_for_path(p);
+    state.reflow();
+    true
 }
diff --git a/userland/capsule_text_editor/src/editor/ctrl_save.rs b/userland/capsule_text_editor/src/editor/ctrl_save.rs
index d2418b185..6b6177368 100644
--- a/userland/capsule_text_editor/src/editor/ctrl_save.rs
+++ b/userland/capsule_text_editor/src/editor/ctrl_save.rs
@@ -14,25 +14,49 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+//! Writing a document to a file.
+//!
+//! The document takes the new name only when the write lands, so a Save As
+//! that fails leaves the document named after the file that holds its text.
+
 use nonos_app_skeleton::{clients::vfs, EventOutcome};
 
+use super::path_prompt;
 use super::resolve_owner_pid::resolve_owner_pid;
-use super::state::State;
+use super::state::{PromptOp, State};
 
 pub(super) fn ctrl_save(state: &mut State) -> EventOutcome {
-    if !resolve_owner_pid(state) {
-        state.status = b"save failed";
-        return EventOutcome::Repaint;
+    // An untitled document has nowhere to go yet, so Save means Save As.
+    if state.path_len == 0 {
+        return path_prompt::start(state, PromptOp::Save);
     }
     let path = state.path[..state.path_len].to_vec();
-    let ok = vfs::write_file(state.owner_pid, &path, &state.buf[..state.len]).is_ok();
-    if ok {
-        super::notify::notify_saved(state);
+    write_to(state, &path);
+    EventOutcome::Repaint
+}
+
+/// Whether a file is already at `path`, for asking before replacing it.
+pub(super) fn exists(state: &mut State, path: &[u8]) -> bool {
+    resolve_owner_pid(state) && vfs::stat(state.owner_pid, path).is_ok()
+}
+
+pub(super) fn write_to(state: &mut State, path: &[u8]) -> bool {
+    if path.is_empty() || path.len() > state.path.len() {
+        state.status = b"save failed: no path given";
+        return false;
     }
-    // Only a write that landed makes the document clean again.
-    if ok {
-        state.dirty = false;
+    if !resolve_owner_pid(state) {
+        state.status = b"save failed: file service not reachable";
+        return false;
     }
-    state.status = if ok { b"saved" } else { b"save failed" };
-    EventOutcome::Repaint
+    if vfs::write_file(state.owner_pid, path, &state.buf[..state.len]).is_err() {
+        state.status = b"save failed: file could not be written";
+        return false;
+    }
+    state.path[..path.len()].copy_from_slice(path);
+    state.path_len = path.len();
+    state.mark_saved();
+    super::notify::notify_saved(state);
+    state.status = b"saved";
+    true
 }
diff --git a/userland/capsule_text_editor/src/editor/dismiss.rs b/userland/capsule_text_editor/src/editor/dismiss.rs
new file mode 100644
index 000000000..359ab8332
--- /dev/null
+++ b/userland/capsule_text_editor/src/editor/dismiss.rs
@@ -0,0 +1,30 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Esc in the document: it dismisses a selection and nothing more. It used
+//! to close the window, one stray key away from losing a document.
+
+use nonos_app_skeleton::EventOutcome;
+
+use super::state::State;
+
+pub(super) fn dismiss(state: &mut State) -> EventOutcome {
+    if state.sel_anchor.take().is_some() {
+        EventOutcome::Repaint
+    } else {
+        EventOutcome::Idle
+    }
+}
diff --git a/userland/capsule_text_editor/src/editor/edit.rs b/userland/capsule_text_editor/src/editor/edit.rs
index 5b59d75cb..2c87d6793 100644
--- a/userland/capsule_text_editor/src/editor/edit.rs
+++ b/userland/capsule_text_editor/src/editor/edit.rs
@@ -24,13 +24,15 @@ use alloc::vec::Vec;
 use super::state::{State, CAPACITY};
 
 /// A reversible edit: at `at`, `inserted_len` bytes replaced `deleted`.
+/// `id` names the document state the edit leads to, so the save point can be
+/// compared against the top of the undo stack after any replay.
 pub struct EditOp {
     pub at: usize,
     pub deleted: Vec<u8>,
     pub inserted_len: usize,
+    pub id: u64,
 }
 
-const MAX_UNDO: usize = 400;
 
 impl State {
     /// Replace `buf[at..at+del]` with `ins`, recording an undo step and clearing
@@ -41,6 +43,7 @@ impl State {
         };
         self.push_undo(at, removed, ins.len());
         self.redo.clear();
+        self.refresh_dirty();
         true
     }
 
@@ -51,6 +54,7 @@ impl State {
         match self.apply_op(&op) {
             Some(reverse) => {
                 self.redo.push(reverse);
+                self.refresh_dirty();
                 true
             }
             None => {
@@ -67,6 +71,7 @@ impl State {
         match self.apply_op(&op) {
             Some(reverse) => {
                 self.undo.push(reverse);
+                self.refresh_dirty();
                 true
             }
             None => {
@@ -92,30 +97,15 @@ impl State {
         Some(removed)
     }
 
-    // Apply one op and return its inverse, for undo/redo replay.
+    /*
+     * Apply one op and return its inverse, for undo/redo replay. Undoing
+     * lands on the state the op below it names, and redoing lands on the
+     * state this op names, so the inverse carries the id of where it leads.
+     */
     fn apply_op(&mut self, op: &EditOp) -> Option<EditOp> {
         let removed = self.splice(op.at, op.inserted_len, &op.deleted)?;
         self.caret = op.at + op.deleted.len();
-        Some(EditOp { at: op.at, deleted: removed, inserted_len: op.deleted.len() })
-    }
-
-    // Push an undo step, coalescing a run of single-character typing so one
-    // Ctrl-Z removes a word rather than a letter.
-    fn push_undo(&mut self, at: usize, removed: Vec<u8>, inserted_len: usize) {
-        // The one place every mutation passes through, so the one place that
-        // needs to know the document has moved away from what is on disk.
-        self.dirty = true;
-        if removed.is_empty() && inserted_len == 1 {
-            if let Some(last) = self.undo.last_mut() {
-                if last.deleted.is_empty() && last.at + last.inserted_len == at {
-                    last.inserted_len += 1;
-                    return;
-                }
-            }
-        }
-        self.undo.push(EditOp { at, deleted: removed, inserted_len });
-        if self.undo.len() > MAX_UNDO {
-            self.undo.remove(0);
-        }
+        self.sel_anchor = None;
+        Some(EditOp { at: op.at, deleted: removed, inserted_len: op.deleted.len(), id: op.id })
     }
 }
diff --git a/userland/capsule_text_editor/src/editor/event.rs b/userland/capsule_text_editor/src/editor/event.rs
index 18c331a7d..cab8ba47c 100644
--- a/userland/capsule_text_editor/src/editor/event.rs
+++ b/userland/capsule_text_editor/src/editor/event.rs
@@ -97,7 +97,8 @@ pub fn on_event(state: &mut State, event: InputEvent) -> EventOutcome {
         }
     }
     let changed = match event.code {
-        KEY_ESC => return EventOutcome::Close,
+        // Esc dismisses; it never closes the window (see `dismiss`).
+        KEY_ESC => return super::dismiss::dismiss(state),
         // Backspace and Delete remove the selection as a unit when there is one.
         KEY_BACKSPACE => state.delete_sel() || state.backspace(),
         KEY_DELETE => state.delete_sel() || state.delete_forward(),
diff --git a/userland/capsule_text_editor/src/editor/event_editor.rs b/userland/capsule_text_editor/src/editor/event_editor.rs
index 5c2ac0b8e..66174d3ff 100644
--- a/userland/capsule_text_editor/src/editor/event_editor.rs
+++ b/userland/capsule_text_editor/src/editor/event_editor.rs
@@ -40,10 +40,11 @@ impl Editor {
 
         // Any keystroke that is not a second Ctrl+W disarms a pending close,
         // so a confirmation cannot be answered by an unrelated key later.
-        if event.is_key_down()
-            && !(event.flags & MOD_CTRL != 0 && matches!(event.code, 0x57 | 0x77))
-        {
-            self.close_armed = false;
+        if event.is_key_down() {
+            self.quit_armed = false;
+            if !(event.flags & MOD_CTRL != 0 && matches!(event.code, 0x57 | 0x77)) {
+                self.close_armed = None;
+            }
         }
 
         // The name entry owns the keyboard while it is open.
@@ -59,6 +60,12 @@ impl Editor {
         {
             return self.finish_quick_open();
         }
+        if event.is_key_down()
+            && event.code == KEY_ENTER
+            && self.doc_ref().prompt == Some(PromptOp::Open)
+        {
+            return self.finish_open_prompt();
+        }
 
         // Shell-level shortcuts, taken before the document sees them because
         // what they move belongs to the shell rather than to the text.
@@ -105,20 +112,10 @@ impl Editor {
             }
             if event.flags & MOD_SHIFT == 0 && matches!(event.code, 0x57 | 0x77) {
                 let at = self.active;
-                // A document with unsaved edits costs two presses. `close_tab`
-                // removes it outright and there is no undo across a close, so
-                // one slip next to Ctrl+S would be unrecoverable work. The
-                // arming is cleared by any other key below.
-                if self.docs[at].dirty && !self.close_armed {
-                    self.close_armed = true;
-                    self.docs[at].status = b"unsaved: Ctrl+W again to close, Ctrl+S to write";
-                    return EventOutcome::Repaint;
-                }
-                self.close_armed = false;
-                self.close_tab(at);
+                self.request_close(at);
                 return EventOutcome::Repaint;
             }
-            self.close_armed = false;
+            self.close_armed = None;
         }
 
         if event.kind == InputKind::Wheel {
diff --git a/userland/capsule_text_editor/src/editor/goto_prompt.rs b/userland/capsule_text_editor/src/editor/goto_prompt.rs
new file mode 100644
index 000000000..084bfcc33
--- /dev/null
+++ b/userland/capsule_text_editor/src/editor/goto_prompt.rs
@@ -0,0 +1,34 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Go to a line: move the caret to the line the prompt names.
+
+use nonos_app_skeleton::EventOutcome;
+
+use super::state::State;
+
+/// Move the caret to the line the prompt names, and scroll so it is visible.
+pub(super) fn goto(state: &mut State, len: usize) -> EventOutcome {
+    let Some(n) = super::goto_line::parse_line_number(&state.prompt_path[..len]) else {
+        state.status = b"not a line number";
+        return EventOutcome::Repaint;
+    };
+    state.caret = super::goto_line::offset_of_line(&state.buf[..state.len], n);
+    let rows = state.visible_rows;
+    super::follow_caret::follow_caret(state, rows);
+    state.status = b"jumped";
+    EventOutcome::Repaint
+}
diff --git a/userland/capsule_text_editor/src/editor/mod.rs b/userland/capsule_text_editor/src/editor/mod.rs
index 1cc7afe45..b8b9ea7d5 100644
--- a/userland/capsule_text_editor/src/editor/mod.rs
+++ b/userland/capsule_text_editor/src/editor/mod.rs
@@ -31,6 +31,7 @@ mod ctrl_open;
 mod ctrl_paste;
 mod ctrl_save;
 mod delete;
+mod dismiss;
 mod doc_pos;
 mod edit;
 mod event;
@@ -39,8 +40,7 @@ mod find;
 mod find_key;
 mod follow_caret;
 mod goto_line;
-mod quick_act;
-mod quick_open;
+mod goto_prompt;
 mod highlight;
 mod home;
 mod indent;
@@ -61,6 +61,7 @@ mod notify;
 mod on_ctrl;
 mod on_ctrl_nav;
 mod on_nav;
+mod open_prompt;
 mod pagebreak;
 mod pagebreak_mark;
 mod paint;
@@ -72,10 +73,13 @@ mod panel_press;
 mod panel_rows;
 mod path_prompt;
 mod position_at;
+mod quick_act;
+mod quick_open;
 mod reflow;
 mod replace;
 mod resolve_owner_pid;
 mod ribbon;
+mod save_point;
 mod sb_entry;
 mod sb_menu;
 mod screen;
@@ -97,11 +101,13 @@ mod table_rules;
 mod theme;
 mod toggle_comment;
 mod tree;
+mod undo_push;
 mod unsupported;
 mod visual_lines;
 mod widget;
 mod word_nav;
 mod wordcount;
+mod ws_close;
 mod ws_event;
 mod ws_info;
 mod ws_menu;
diff --git a/userland/capsule_text_editor/src/editor/open_prompt.rs b/userland/capsule_text_editor/src/editor/open_prompt.rs
new file mode 100644
index 000000000..8f12819a3
--- /dev/null
+++ b/userland/capsule_text_editor/src/editor/open_prompt.rs
@@ -0,0 +1,42 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Finishing the Open prompt: the typed path opens in its own tab.
+
+use super::app::Editor;
+use nonos_app_skeleton::EventOutcome;
+
+impl Editor {
+    /// Finish the Open prompt: the typed path opens in its own tab, so the
+    /// document the prompt was started from keeps its text and its name.
+    pub(super) fn finish_open_prompt(&mut self) -> EventOutcome {
+        let d = self.doc();
+        let typed = d.prompt_path[..d.prompt_len].to_vec();
+        d.prompt = None;
+        d.prompt_len = 0;
+        if typed.is_empty() {
+            d.status = b"no path given";
+            return EventOutcome::Repaint;
+        }
+        match core::str::from_utf8(&typed) {
+            Ok(path) => {
+                self.open_path(path);
+            }
+            Err(_) => self.doc().status = b"open refused: path is not valid UTF-8",
+        }
+        EventOutcome::Repaint
+    }
+}
diff --git a/userland/capsule_text_editor/src/editor/path_prompt.rs b/userland/capsule_text_editor/src/editor/path_prompt.rs
index 2e32c40d8..31b50efaa 100644
--- a/userland/capsule_text_editor/src/editor/path_prompt.rs
+++ b/userland/capsule_text_editor/src/editor/path_prompt.rs
@@ -17,12 +17,12 @@
 use nonos_app_skeleton::{EventOutcome, InputEvent, KEY_BACKSPACE, KEY_ENTER, KEY_ESC, MOD_CTRL};
 
 use super::ctrl_export::ctrl_export;
-use super::ctrl_open::ctrl_open;
-use super::ctrl_save::ctrl_save;
+use super::ctrl_save::{exists, write_to};
 use super::state::{PromptOp, State};
 
 pub(super) fn start(state: &mut State, op: PromptOp) -> EventOutcome {
     state.prompt = Some(op);
+    state.overwrite_armed = false;
     // Save As starts from the current path so a small edit is quick. Open
     // starts empty, because opening a different file meant backspacing the
     // whole of the old one first.
@@ -43,19 +43,6 @@ pub(super) fn start(state: &mut State, op: PromptOp) -> EventOutcome {
     EventOutcome::Repaint
 }
 
-/// Move the caret to the line the prompt names, and scroll so it is visible.
-fn goto(state: &mut State, len: usize) -> EventOutcome {
-    let Some(n) = super::goto_line::parse_line_number(&state.prompt_path[..len]) else {
-        state.status = b"not a line number";
-        return EventOutcome::Repaint;
-    };
-    state.caret = super::goto_line::offset_of_line(&state.buf[..state.len], n);
-    let rows = state.visible_rows;
-    super::follow_caret::follow_caret(state, rows);
-    state.status = b"jumped";
-    EventOutcome::Repaint
-}
-
 pub(super) fn on_key(state: &mut State, event: InputEvent) -> EventOutcome {
     let Some(op) = state.prompt else { return EventOutcome::Idle };
     match event.code {
@@ -69,6 +56,7 @@ pub(super) fn on_key(state: &mut State, event: InputEvent) -> EventOutcome {
             if state.prompt_len > 0 {
                 state.prompt_len -= 1;
             }
+            state.overwrite_armed = false;
         }
         KEY_ENTER => {
             state.prompt = None;
@@ -81,25 +69,43 @@ pub(super) fn on_key(state: &mut State, event: InputEvent) -> EventOutcome {
                 state.prompt_len = 0;
                 return ctrl_export(state, n);
             }
-            // Goto moves the caret and touches nothing else. It must return
-            // before the commit below, which would otherwise overwrite the
-            // document's path with a line number.
+            /*
+             * Goto moves the caret and touches nothing else, so a line number
+             * can never be taken for a path.
+             */
             if op == PromptOp::Goto {
                 let n = state.prompt_len;
                 state.prompt_len = 0;
-                return goto(state, n);
+                return super::goto_prompt::goto(state, n);
             }
-            // Commit point: the typed path becomes the document's only here.
-            state.path[..state.prompt_len].copy_from_slice(&state.prompt_path[..state.prompt_len]);
-            state.path_len = state.prompt_len;
-            state.prompt_len = 0;
-            return match op {
-                PromptOp::Open => ctrl_open(state),
-                PromptOp::Save => ctrl_save(state),
-                // Quick never reaches here: the shell takes its Enter, because
-                // resolving the name needs the tree.
-                PromptOp::Export | PromptOp::Goto | PromptOp::Quick => EventOutcome::Repaint,
-            };
+            let n = state.prompt_len;
+            let target = state.prompt_path[..n].to_vec();
+            match op {
+                PromptOp::Save => {
+                    let same = target[..] == state.path[..state.path_len];
+                    /*
+                     * Replacing another file is asked once: the prompt stays
+                     * open with the name, and Enter again is the answer.
+                     */
+                    if !same && !state.overwrite_armed && exists(state, &target) {
+                        state.prompt = Some(PromptOp::Save);
+                        state.overwrite_armed = true;
+                        state.status = b"a file with that name exists: Enter again replaces it";
+                        return EventOutcome::Repaint;
+                    }
+                    state.overwrite_armed = false;
+                    state.prompt_len = 0;
+                    write_to(state, &target);
+                }
+                /*
+                 * Open and Quick never reach here: the shell finishes them,
+                 * because only it can choose which tab the file goes into.
+                 */
+                PromptOp::Open | PromptOp::Quick | PromptOp::Export | PromptOp::Goto => {
+                    state.prompt_len = 0;
+                }
+            }
+            return EventOutcome::Repaint;
         }
         code => {
             if event.flags & MOD_CTRL == 0 {
@@ -107,6 +113,7 @@ pub(super) fn on_key(state: &mut State, event: InputEvent) -> EventOutcome {
                     if ch.is_ascii_graphic() && state.prompt_len < 255 {
                         state.prompt_path[state.prompt_len] = ch as u8;
                         state.prompt_len += 1;
+                        state.overwrite_armed = false;
                     }
                 }
             }
diff --git a/userland/capsule_text_editor/src/editor/quick_act.rs b/userland/capsule_text_editor/src/editor/quick_act.rs
index f9e5dc702..0465eec86 100644
--- a/userland/capsule_text_editor/src/editor/quick_act.rs
+++ b/userland/capsule_text_editor/src/editor/quick_act.rs
@@ -55,16 +55,10 @@ impl Editor {
         };
 
         let path = files[hit].clone();
-        let bytes = path.as_bytes();
         let d = self.doc();
         d.prompt = None;
         d.prompt_len = 0;
-        // The document's path is the commit point, exactly as the open prompt
-        // does it, so the file loads through the one path that already handles
-        // a read failing.
-        let n = bytes.len().min(d.path.len());
-        d.path[..n].copy_from_slice(&bytes[..n]);
-        d.path_len = n;
-        super::ctrl_open::ctrl_open(d)
+        self.open_path(&path);
+        EventOutcome::Repaint
     }
 }
diff --git a/userland/capsule_text_editor/src/editor/reflow.rs b/userland/capsule_text_editor/src/editor/reflow.rs
index 0d5599589..f3d4627a7 100644
--- a/userland/capsule_text_editor/src/editor/reflow.rs
+++ b/userland/capsule_text_editor/src/editor/reflow.rs
@@ -25,6 +25,13 @@ use super::state::State;
 use crate::doc::align::Align;
 use crate::doc::paginate::paginate;
 use crate::doc::text_bridge::doc_from_text;
+/*
+ * The machine measures with the real font; host proofs, which have no font
+ * service, measure with fixed advances so the same reflow runs on both.
+ */
+#[cfg(not(target_os = "none"))]
+use crate::doc::measure::FixedMeasurer as TtfMeasurer;
+#[cfg(target_os = "none")]
 use crate::doc::ttf_measure::TtfMeasurer;
 
 impl State {
diff --git a/userland/capsule_text_editor/src/editor/save_point.rs b/userland/capsule_text_editor/src/editor/save_point.rs
new file mode 100644
index 000000000..54997fa8c
--- /dev/null
+++ b/userland/capsule_text_editor/src/editor/save_point.rs
@@ -0,0 +1,65 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Whether the document matches what was last read or written.
+//!
+//! Each edit names the state it leads to, and the save point records the name
+//! of the state on disk. The document is clean exactly when the top of the undo
+//! stack names that state, so undoing back to the saved text is clean again and
+//! undoing past it is not.
+
+use super::state::State;
+
+/// Ids of document states: the next edit's, the one on disk, and the one
+/// history bottoms out at once old steps are dropped.
+#[derive(Default)]
+pub struct SavePoint {
+    pub next_op: u64,
+    pub on_disk: u64,
+    pub floor: u64,
+}
+
+impl State {
+    /// The state the buffer is in now: the top of the undo stack, or the floor
+    /// history bottoms out at.
+    pub(super) fn top_id(&self) -> u64 {
+        self.undo.last().map_or(self.saved.floor, |op| op.id)
+    }
+
+    pub(super) fn refresh_dirty(&mut self) {
+        self.dirty = self.top_id() != self.saved.on_disk;
+    }
+
+    /// The buffer now matches the file on disk.
+    pub(super) fn mark_saved(&mut self) {
+        self.saved.on_disk = self.top_id();
+        self.dirty = false;
+    }
+
+    /// A fresh load: the old history describes a different text, so replaying
+    /// it here would corrupt this one. Selection and search go with it.
+    pub(super) fn reset_history(&mut self) {
+        self.undo.clear();
+        self.redo.clear();
+        self.saved.floor = self.saved.next_op;
+        self.saved.on_disk = self.saved.next_op;
+        self.dirty = false;
+        self.sel_anchor = None;
+        self.selecting = false;
+        self.find_active = false;
+        self.replace_active = false;
+    }
+}
diff --git a/userland/capsule_text_editor/src/editor/state.rs b/userland/capsule_text_editor/src/editor/state.rs
index 07f36b76c..ff42ab87f 100644
--- a/userland/capsule_text_editor/src/editor/state.rs
+++ b/userland/capsule_text_editor/src/editor/state.rs
@@ -17,7 +17,6 @@
 // 256 KiB per document, heap-backed, enough for any real source file while
 // keeping a dozen open tabs cheap.
 pub const CAPACITY: usize = 256 * 1024;
-pub const PATH: &[u8] = b"/notes.txt";
 
 #[derive(Clone, Copy, PartialEq)]
 pub enum PromptOp {
@@ -66,6 +65,8 @@ pub struct State {
     // whatever had been half typed, and the next save wrote that instead.
     pub prompt_path: [u8; 256],
     pub prompt_len: usize,
+    /// Save As named an existing file and the next Enter replaces it.
+    pub overwrite_armed: bool,
     pub shell_port: u32,
     // Undo and redo stacks of reversible edits. Every mutation goes through
     // `apply_edit`, so both stay in sync with the buffer.
@@ -73,6 +74,8 @@ pub struct State {
     /// written. Tracked here rather than inferred from the undo depth, because
     /// undoing back to a coincidentally equal depth is not the same document.
     pub dirty: bool,
+    /// Which document state is on disk. See `save_point`.
+    pub saved: super::save_point::SavePoint,
     pub undo: alloc::vec::Vec<super::edit::EditOp>,
     pub redo: alloc::vec::Vec<super::edit::EditOp>,
     // Incremental find: the query being typed and whether the find bar is open.
diff --git a/userland/capsule_text_editor/src/editor/state_new.rs b/userland/capsule_text_editor/src/editor/state_new.rs
index b5b705bfe..75a5fdf2d 100644
--- a/userland/capsule_text_editor/src/editor/state_new.rs
+++ b/userland/capsule_text_editor/src/editor/state_new.rs
@@ -14,12 +14,16 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-use super::state::{State, PATH};
+use super::state::State;
 
 impl State {
     pub fn new() -> Self {
-        let mut path = [0u8; 256];
-        path[..PATH.len()].copy_from_slice(PATH);
+        /*
+         * A new document is untitled. It used to carry a default file name
+         * without reading that file, so the first save replaced whatever the
+         * file held with the new text.
+         */
+        let path = [0u8; 256];
         let mut s = State {
             owner_pid: 0,
             buf: alloc::vec![0; super::state::CAPACITY],
@@ -37,12 +41,14 @@ impl State {
             glyph_advance: super::layout::GLYPH_ADVANCE,
             status: b"Ctrl-O open  Ctrl-S save  Ctrl-E export  Ctrl-C copy  Ctrl-V paste",
             path,
-            path_len: PATH.len(),
+            path_len: 0,
             prompt: None,
             prompt_path: [0u8; 256],
             prompt_len: 0,
+            overwrite_armed: false,
             shell_port: 0,
             dirty: false,
+            saved: Default::default(),
             undo: alloc::vec::Vec::new(),
             redo: alloc::vec::Vec::new(),
             find_active: false,
@@ -60,7 +66,7 @@ impl State {
                 height: 980.0,
                 margin: 56.0,
             },
-            mode: super::mode::mode_for_path(core::str::from_utf8(PATH).unwrap_or("")),
+            mode: super::mode::mode_for_path(""),
         };
         s.reflow();
         s
diff --git a/userland/capsule_text_editor/src/editor/undo_push.rs b/userland/capsule_text_editor/src/editor/undo_push.rs
new file mode 100644
index 000000000..7196b558d
--- /dev/null
+++ b/userland/capsule_text_editor/src/editor/undo_push.rs
@@ -0,0 +1,61 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Recording an edit on the undo stack, merging a typing run into one
+//! step and dropping the oldest steps in batches.
+
+use super::edit::EditOp;
+use super::state::State;
+use alloc::vec::Vec;
+
+const MAX_UNDO: usize = 400;
+/// Oldest steps are dropped in batches, so a long session does not shift
+/// the whole stack on every keystroke once it is full.
+const UNDO_SLACK: usize = 64;
+
+impl State {
+    /*
+     * Push an undo step, coalescing a run of single-character typing so one
+     * Ctrl-Z removes a word rather than a letter.
+     */
+    pub(super) fn push_undo(&mut self, at: usize, removed: Vec<u8>, inserted_len: usize) {
+        self.saved.next_op = self.saved.next_op.wrapping_add(1).max(1);
+        let id = self.saved.next_op;
+        if removed.is_empty() && inserted_len == 1 {
+            if let Some(last) = self.undo.last_mut() {
+                /*
+                 * A merged step is a new document state, so it takes the new
+                 * id: a save made mid-word must not match the finished word.
+                 */
+                if last.deleted.is_empty() && last.at + last.inserted_len == at {
+                    last.inserted_len += 1;
+                    last.id = id;
+                    return;
+                }
+            }
+        }
+        self.undo.push(EditOp { at, deleted: removed, inserted_len, id });
+        if self.undo.len() > MAX_UNDO + UNDO_SLACK {
+            let cut = self.undo.len() - MAX_UNDO;
+            /*
+             * Undo can no longer reach below the dropped steps, so the state
+             * they led to becomes the bottom of history.
+             */
+            self.saved.floor = self.undo[cut - 1].id;
+            self.undo.drain(..cut);
+        }
+    }
+}
diff --git a/userland/capsule_text_editor/src/editor/ws_close.rs b/userland/capsule_text_editor/src/editor/ws_close.rs
new file mode 100644
index 000000000..1af35f552
--- /dev/null
+++ b/userland/capsule_text_editor/src/editor/ws_close.rs
@@ -0,0 +1,68 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Closing tabs, and the window, without losing unsaved text.
+
+use super::app::Editor;
+use super::state::State;
+
+impl Editor {
+    /// Close a tab the user asked to close. Unsaved text costs a second
+    /// request on the same tab, from any close control, because closing
+    /// cannot be undone. Returns whether the tab went.
+    pub(super) fn request_close(&mut self, idx: usize) -> bool {
+        let Some(d) = self.docs.get_mut(idx) else { return false };
+        if d.dirty && self.close_armed != Some(idx) {
+            self.close_armed = Some(idx);
+            d.status = b"unsaved changes: close again to discard them, Ctrl+S to save";
+            self.active = idx;
+            return false;
+        }
+        self.close_armed = None;
+        self.close_tab(idx);
+        true
+    }
+
+    fn close_tab(&mut self, idx: usize) {
+        if idx >= self.docs.len() {
+            return;
+        }
+        self.docs.remove(idx);
+        if self.docs.is_empty() {
+            self.docs.push(State::new());
+            self.active = 0;
+            return;
+        }
+        if self.active > idx || self.active >= self.docs.len() {
+            self.active = self.active.saturating_sub(1).min(self.docs.len() - 1);
+        }
+    }
+
+    /// The window close button: unsaved text anywhere costs a second press,
+    /// with the first unsaved tab brought to the front to say so.
+    pub(super) fn confirm_quit(&mut self) -> bool {
+        let unsaved = self.docs.iter().position(|d| d.dirty);
+        match unsaved {
+            Some(i) if !self.quit_armed => {
+                self.quit_armed = true;
+                self.active = i;
+                self.docs[i].status = b"unsaved changes: close the window again to discard them";
+                false
+            }
+            _ => true,
+        }
+    }
+}
diff --git a/userland/capsule_text_editor/src/editor/ws_menubar.rs b/userland/capsule_text_editor/src/editor/ws_menubar.rs
index b17883bce..28ccfb25f 100644
--- a/userland/capsule_text_editor/src/editor/ws_menubar.rs
+++ b/userland/capsule_text_editor/src/editor/ws_menubar.rs
@@ -53,7 +53,7 @@ impl Editor {
             MenuCmd::NewTab => self.new_tab(),
             MenuCmd::CloseTab => {
                 let idx = self.active;
-                self.close_tab(idx);
+                self.request_close(idx);
             }
             MenuCmd::ToggleSidebar => {
                 self.sidebar_open = !self.sidebar_open;
diff --git a/userland/capsule_text_editor/src/editor/ws_open.rs b/userland/capsule_text_editor/src/editor/ws_open.rs
index 52a7272a2..f6a0f5fd3 100644
--- a/userland/capsule_text_editor/src/editor/ws_open.rs
+++ b/userland/capsule_text_editor/src/editor/ws_open.rs
@@ -18,7 +18,7 @@
 //! file) and close tabs, always leaving at least one document open.
 
 use super::app::Editor;
-use super::ctrl_open::ctrl_open;
+use super::ctrl_open::load;
 use super::state::State;
 
 fn doc_path(d: &State) -> &str {
@@ -26,36 +26,38 @@ fn doc_path(d: &State) -> &str {
 }
 
 impl Editor {
-    pub(super) fn open_path(&mut self, path: &str) {
-        if path.len() > 255 {
-            return;
-        }
-        self.mru_note(path);
+    /// Open `path` in its own tab: the tab that already holds it, else the
+    /// front tab when it is an untouched blank, else a new tab. Nothing that
+    /// holds text is ever replaced, and a file that fails to load opens no tab.
+    pub(super) fn open_path(&mut self, path: &str) -> bool {
         if let Some(i) = self.docs.iter().position(|d| doc_path(d) == path) {
             self.active = i;
-            return;
+            return true;
+        }
+        let front = self.active.min(self.docs.len().saturating_sub(1));
+        let blank = self
+            .docs
+            .get(front)
+            .map(|d| d.len == 0 && !d.dirty && d.path_len == 0)
+            .unwrap_or(false);
+        if blank {
+            let ok = load(&mut self.docs[front], path.as_bytes());
+            if ok {
+                self.mru_note(path);
+            }
+            return ok;
         }
         let mut d = State::new();
-        d.path[..path.len()].copy_from_slice(path.as_bytes());
-        d.path_len = path.len();
         d.owner_pid = self.owner_pid;
-        ctrl_open(&mut d);
+        if !load(&mut d, path.as_bytes()) {
+            // The reason belongs where the user is looking.
+            let why = d.status;
+            self.doc().status = why;
+            return false;
+        }
+        self.mru_note(path);
         self.docs.push(d);
         self.active = self.docs.len() - 1;
-    }
-
-    pub(super) fn close_tab(&mut self, idx: usize) {
-        if idx >= self.docs.len() {
-            return;
-        }
-        self.docs.remove(idx);
-        if self.docs.is_empty() {
-            self.docs.push(State::new());
-            self.active = 0;
-            return;
-        }
-        if self.active > idx || self.active >= self.docs.len() {
-            self.active = self.active.saturating_sub(1).min(self.docs.len() - 1);
-        }
+        true
     }
 }
diff --git a/userland/capsule_text_editor/src/editor/ws_pointer.rs b/userland/capsule_text_editor/src/editor/ws_pointer.rs
index 34a41f9d7..a6e08d4e6 100644
--- a/userland/capsule_text_editor/src/editor/ws_pointer.rs
+++ b/userland/capsule_text_editor/src/editor/ws_pointer.rs
@@ -97,7 +97,7 @@ impl Editor {
                 self.toolbar_action(btn);
             } else if let Some((idx, close)) = tab_hit(&self.tab_layout, x) {
                 if close {
-                    self.close_tab(idx);
+                    self.request_close(idx);
                 } else {
                     self.active = idx;
                 }
diff --git a/userland/editor_proofs/Cargo.lock b/userland/editor_proofs/Cargo.lock
index 89111bba2..b17e92d58 100644
--- a/userland/editor_proofs/Cargo.lock
+++ b/userland/editor_proofs/Cargo.lock
@@ -4,4 +4,4 @@ version = 4
 
 [[package]]
 name = "editor_proofs"
-version = "0.1.0"
+version = "0.3.0"
diff --git a/userland/editor_proofs/src/lib.rs b/userland/editor_proofs/src/lib.rs
index f0f32271a..fdb3627de 100644
--- a/userland/editor_proofs/src/lib.rs
+++ b/userland/editor_proofs/src/lib.rs
@@ -22,6 +22,15 @@
 
 extern crate alloc;
 
+#[path = "../../capsule_text_editor/src/doc/mod.rs"]
+pub mod doc;
+#[path = "../../capsule_text_editor/src/editor/mode.rs"]
+pub mod mode;
+#[path = "../../capsule_text_editor/src/editor/reflow.rs"]
+pub mod reflow;
+#[path = "../../capsule_text_editor/src/editor/save_point.rs"]
+pub mod save_point;
+
 #[path = "../../capsule_text_editor/src/editor/autoclose.rs"]
 pub mod autoclose;
 #[path = "../../capsule_text_editor/src/editor/backspace.rs"]
@@ -70,6 +79,8 @@ pub mod state;
 pub mod state_new;
 #[path = "../../capsule_text_editor/src/editor/theme.rs"]
 pub mod theme;
+#[path = "../../capsule_text_editor/src/editor/undo_push.rs"]
+pub mod undo_push;
 #[path = "../../capsule_text_editor/src/editor/toggle_comment.rs"]
 pub mod toggle_comment;
 #[path = "../../capsule_text_editor/src/editor/visual_lines.rs"]
@@ -81,3 +92,7 @@ pub mod word_nav;
 mod edit_tests;
 #[cfg(test)]
 mod feature_tests;
+#[cfg(test)]
+mod save_history_tests;
+#[cfg(test)]
+mod save_tests;
diff --git a/userland/editor_proofs/src/save_history_tests.rs b/userland/editor_proofs/src/save_history_tests.rs
new file mode 100644
index 000000000..346dffa6d
--- /dev/null
+++ b/userland/editor_proofs/src/save_history_tests.rs
@@ -0,0 +1,56 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The save point across dropped history and a reload.
+
+use crate::edit_tests::doc;
+
+#[test]
+fn an_edit_after_undoing_past_the_save_never_matches_it_again() {
+    let mut s = doc("abc");
+    s.caret = 3;
+    assert!(s.insert(b"X"));
+    s.mark_saved();
+    assert!(s.undo());
+    // A different edit replaces the redo branch that held the saved text.
+    assert!(s.insert(b"Y"));
+    assert!(s.dirty);
+    assert!(s.undo());
+    assert!(s.dirty, "abc is not the saved abcX");
+}
+
+#[test]
+fn dropped_history_cannot_undo_to_a_false_clean() {
+    let mut s = doc("");
+    // Separate steps: a space after each letter breaks the typing run.
+    for _ in 0..600 {
+        assert!(s.apply_edit(s.len, 0, b"ab"));
+    }
+    while s.undo() {}
+    assert!(s.len > 0, "the oldest steps were dropped");
+    assert!(s.dirty, "the buffer is not the empty text that was loaded");
+}
+
+#[test]
+fn a_reload_forgets_the_old_history() {
+    let mut s = doc("abc");
+    s.caret = 3;
+    assert!(s.insert(b"d"));
+    s.reset_history();
+    assert!(!s.dirty);
+    assert!(!s.undo(), "undo must not replay edits made to another text");
+    assert!(s.sel_anchor.is_none());
+}
diff --git a/userland/editor_proofs/src/save_tests.rs b/userland/editor_proofs/src/save_tests.rs
new file mode 100644
index 000000000..d0348ec7e
--- /dev/null
+++ b/userland/editor_proofs/src/save_tests.rs
@@ -0,0 +1,62 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Proofs for the save point: the document is clean exactly when its text is
+//! the text last read or written, whatever undo and redo did in between.
+
+use crate::edit_tests::{doc, text};
+
+#[test]
+fn a_loaded_document_is_clean() {
+    let s = doc("abc");
+    assert!(!s.dirty);
+}
+
+#[test]
+fn undo_back_to_the_saved_text_is_clean() {
+    let mut s = doc("abc");
+    s.caret = 3;
+    assert!(s.insert(b"d"));
+    assert!(s.dirty);
+    assert!(s.undo());
+    assert_eq!(text(&s), "abc");
+    assert!(!s.dirty, "the text on disk is back");
+}
+
+#[test]
+fn undo_after_a_save_is_dirty() {
+    let mut s = doc("abc");
+    s.caret = 3;
+    assert!(s.insert(b"d"));
+    s.mark_saved();
+    assert!(!s.dirty);
+    assert!(s.undo());
+    assert!(s.dirty, "the buffer no longer matches the saved file");
+    assert!(s.redo());
+    assert!(!s.dirty, "redo returns to the saved text");
+}
+
+#[test]
+fn typing_on_after_a_mid_word_save_is_dirty() {
+    let mut s = doc("");
+    for b in b"ab" {
+        assert!(s.insert(&[*b]));
+    }
+    s.mark_saved();
+    // The next letter merges into the same undo step; it is still a change.
+    assert!(s.insert(b"c"));
+    assert!(s.dirty);
+}

From 7e51ab417b0ffb34233c3e3a280898f4af52c5ac Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 12:56:51 +0000
Subject: [PATCH 07/29] nonos_vt: an xterm-compatible terminal screen, parser
 and input encoder

A no_std crate the terminal will draw from. The parser is the DEC state machine: CSI with private markers, colon sub-parameters and intermediates, OSC, DCS, SOS/PM/APC swallowed, CAN/SUB/ESC aborting any sequence, UTF-8 split across reads. The screen defers the wrap at the last column, so a full-screen program can fill the bottom-right cell, and implements IL, DL, RI, SU, SD, ICH, DCH, ECH, REP, tab stops, origin and insert modes, DECSC/DECRC, the 47/1047/1048/1049 alternate screens, DEC line drawing, wide characters kept whole, and combining marks and ZWJ sequences in one cell. Resize re-wraps the normal screen and its history.

It answers DA1, DA2, DSR, DECRQM, XTVERSION, XTGETTCAP, DECRQSS, size reports and OSC colour queries, since editors wait for them. A program may not move or resize its window, and a clipboard read (OSC 52 ?) is refused and counted. Keys, mouse (X10 and SGR), focus and paste encode per mode; paste strips escape bytes so pasted text cannot end the bracket and run as commands. Every buffer output can grow has a ceiling in limits.

69 tests, including a seeded mutation fuzz that interleaves hostile output with resizes, copies and searches and checks the cursor and row widths after every step; it found a cursor left below the screen after a resize, fixed here.
---
 userland/nonos_vt/Cargo.lock                  |  7 ++
 userland/nonos_vt/Cargo.toml                  | 17 +++++
 userland/nonos_vt/src/cell/attr.rs            | 35 +++++++++
 userland/nonos_vt/src/cell/data.rs            | 69 +++++++++++++++++
 userland/nonos_vt/src/cell/mod.rs             | 26 +++++++
 userland/nonos_vt/src/cell/pen.rs             | 28 +++++++
 userland/nonos_vt/src/cell/underline.rs       | 40 ++++++++++
 userland/nonos_vt/src/charset.rs              | 71 ++++++++++++++++++
 userland/nonos_vt/src/color/mod.rs            | 27 +++++++
 userland/nonos_vt/src/color/name.rs           | 36 +++++++++
 userland/nonos_vt/src/color/palette.rs        | 63 ++++++++++++++++
 userland/nonos_vt/src/color/xterm.rs          | 38 ++++++++++
 userland/nonos_vt/src/input/keys.rs           | 73 ++++++++++++++++++
 userland/nonos_vt/src/input/keys_encode.rs    | 75 +++++++++++++++++++
 userland/nonos_vt/src/input/keys_seq.rs       | 44 +++++++++++
 userland/nonos_vt/src/input/mod.rs            | 31 ++++++++
 userland/nonos_vt/src/input/mouse.rs          | 60 +++++++++++++++
 userland/nonos_vt/src/input/mouse_encode.rs   | 73 ++++++++++++++++++
 userland/nonos_vt/src/input/paste.rs          | 49 ++++++++++++
 userland/nonos_vt/src/lib.rs                  | 47 ++++++++++++
 userland/nonos_vt/src/limits.rs               | 57 ++++++++++++++
 userland/nonos_vt/src/line/data.rs            | 69 +++++++++++++++++
 userland/nonos_vt/src/line/marks.rs           | 70 +++++++++++++++++
 userland/nonos_vt/src/line/mod.rs             | 30 ++++++++
 userland/nonos_vt/src/line/shift.rs           | 68 +++++++++++++++++
 userland/nonos_vt/src/line/trim.rs            | 35 +++++++++
 userland/nonos_vt/src/line/write.rs           | 70 +++++++++++++++++
 userland/nonos_vt/src/out.rs                  | 30 ++++++++
 userland/nonos_vt/src/params/collect.rs       | 72 ++++++++++++++++++
 userland/nonos_vt/src/params/mod.rs           | 25 +++++++
 userland/nonos_vt/src/params/read.rs          | 68 +++++++++++++++++
 userland/nonos_vt/src/parser/advance.rs       | 62 +++++++++++++++
 userland/nonos_vt/src/parser/csi_states.rs    | 57 ++++++++++++++
 userland/nonos_vt/src/parser/dcs_states.rs    | 50 +++++++++++++
 userland/nonos_vt/src/parser/escape.rs        | 66 ++++++++++++++++
 userland/nonos_vt/src/parser/ground.rs        | 53 +++++++++++++
 userland/nonos_vt/src/parser/handler.rs       | 34 +++++++++
 userland/nonos_vt/src/parser/machine.rs       | 66 ++++++++++++++++
 userland/nonos_vt/src/parser/mod.rs           | 32 ++++++++
 userland/nonos_vt/src/parser/seq.rs           | 61 +++++++++++++++
 userland/nonos_vt/src/parser/strings.rs       | 63 ++++++++++++++++
 userland/nonos_vt/src/term/abs.rs             | 57 ++++++++++++++
 userland/nonos_vt/src/term/alt.rs             | 59 +++++++++++++++
 userland/nonos_vt/src/term/answer/dcs.rs      | 58 ++++++++++++++
 userland/nonos_vt/src/term/answer/mod.rs      | 25 +++++++
 userland/nonos_vt/src/term/answer/reply.rs    | 44 +++++++++++
 userland/nonos_vt/src/term/answer/report.rs   | 64 ++++++++++++++++
 userland/nonos_vt/src/term/answer/tcap.rs     | 57 ++++++++++++++
 userland/nonos_vt/src/term/answer/winops.rs   | 42 +++++++++++
 userland/nonos_vt/src/term/control.rs         | 54 +++++++++++++
 userland/nonos_vt/src/term/csi.rs             | 72 ++++++++++++++++++
 userland/nonos_vt/src/term/csi_move.rs        | 67 +++++++++++++++++
 userland/nonos_vt/src/term/csi_place.rs       | 67 +++++++++++++++++
 userland/nonos_vt/src/term/cursor_style.rs    | 40 ++++++++++
 userland/nonos_vt/src/term/edit.rs            | 66 ++++++++++++++++
 userland/nonos_vt/src/term/erase.rs           | 73 ++++++++++++++++++
 userland/nonos_vt/src/term/esc.rs             | 66 ++++++++++++++++
 userland/nonos_vt/src/term/feed.rs            | 60 +++++++++++++++
 userland/nonos_vt/src/term/glyph.rs           | 72 ++++++++++++++++++
 userland/nonos_vt/src/term/handler.rs         | 47 ++++++++++++
 userland/nonos_vt/src/term/history.rs         | 49 ++++++++++++
 userland/nonos_vt/src/term/index.rs           | 53 +++++++++++++
 userland/nonos_vt/src/term/join.rs            | 49 ++++++++++++
 userland/nonos_vt/src/term/lines.rs           | 63 ++++++++++++++++
 userland/nonos_vt/src/term/logical.rs         | 44 +++++++++++
 userland/nonos_vt/src/term/mod.rs             | 73 ++++++++++++++++++
 userland/nonos_vt/src/term/mode_state.rs      | 55 ++++++++++++++
 userland/nonos_vt/src/term/modes.rs           | 73 ++++++++++++++++++
 userland/nonos_vt/src/term/modes_type.rs      | 74 ++++++++++++++++++
 userland/nonos_vt/src/term/mouse_mode.rs      | 31 ++++++++
 userland/nonos_vt/src/term/new.rs             | 71 ++++++++++++++++++
 userland/nonos_vt/src/term/osc/dispatch.rs    | 75 +++++++++++++++++++
 userland/nonos_vt/src/term/osc/links.rs       | 50 +++++++++++++
 userland/nonos_vt/src/term/osc/mod.rs         | 25 +++++++
 userland/nonos_vt/src/term/osc/osc_color.rs   | 53 +++++++++++++
 userland/nonos_vt/src/term/osc/osc_get.rs     | 52 +++++++++++++
 userland/nonos_vt/src/term/osc/osc_misc.rs    | 68 +++++++++++++++++
 userland/nonos_vt/src/term/osc/osc_palette.rs | 73 ++++++++++++++++++
 userland/nonos_vt/src/term/pick.rs            | 66 ++++++++++++++++
 userland/nonos_vt/src/term/print.rs           | 58 ++++++++++++++
 userland/nonos_vt/src/term/reflow/gather.rs   | 56 ++++++++++++++
 userland/nonos_vt/src/term/reflow/mod.rs      | 28 +++++++
 userland/nonos_vt/src/term/reflow/place.rs    | 68 +++++++++++++++++
 userland/nonos_vt/src/term/reflow/placed.rs   | 25 +++++++
 userland/nonos_vt/src/term/reflow/rewrap.rs   | 73 ++++++++++++++++++
 .../nonos_vt/src/term/reflow/rewrap_all.rs    | 61 +++++++++++++++
 userland/nonos_vt/src/term/reset.rs           | 59 +++++++++++++++
 userland/nonos_vt/src/term/resize.rs          | 72 ++++++++++++++++++
 userland/nonos_vt/src/term/save.rs            | 59 +++++++++++++++
 userland/nonos_vt/src/term/screen.rs          | 73 ++++++++++++++++++
 userland/nonos_vt/src/term/screen_modes.rs    | 62 +++++++++++++++
 userland/nonos_vt/src/term/scroll.rs          | 67 +++++++++++++++++
 userland/nonos_vt/src/term/search.rs          | 71 ++++++++++++++++++
 userland/nonos_vt/src/term/search_match.rs    | 39 ++++++++++
 userland/nonos_vt/src/term/sgr.rs             | 61 +++++++++++++++
 userland/nonos_vt/src/term/sgr_attr.rs        | 58 ++++++++++++++
 userland/nonos_vt/src/term/sgr_colour.rs      | 53 +++++++++++++
 userland/nonos_vt/src/term/soft_reset.rs      | 40 ++++++++++
 userland/nonos_vt/src/term/state.rs           | 71 ++++++++++++++++++
 userland/nonos_vt/src/term/tab_stops.rs       | 42 +++++++++++
 userland/nonos_vt/src/term/tabs.rs            | 60 +++++++++++++++
 userland/nonos_vt/src/term/text.rs            | 74 ++++++++++++++++++
 userland/nonos_vt/src/term/types.rs           | 56 ++++++++++++++
 userland/nonos_vt/src/term/view.rs            | 72 ++++++++++++++++++
 userland/nonos_vt/src/term/view_draw.rs       | 65 ++++++++++++++++
 userland/nonos_vt/src/term/view_text.rs       | 49 ++++++++++++
 userland/nonos_vt/src/url.rs                  | 68 +++++++++++++++++
 userland/nonos_vt/src/utf8/mod.rs             | 23 ++++++
 userland/nonos_vt/src/utf8/push.rs            | 58 ++++++++++++++
 userland/nonos_vt/src/utf8/state.rs           | 45 +++++++++++
 userland/nonos_vt/src/width/check.rs          | 43 +++++++++++
 userland/nonos_vt/src/width/lookup.rs         | 57 ++++++++++++++
 userland/nonos_vt/src/width/mod.rs            | 30 ++++++++
 userland/nonos_vt/src/width/wide.rs           | 40 ++++++++++
 userland/nonos_vt/src/width/zero_high.rs      | 43 +++++++++++
 userland/nonos_vt/src/width/zero_low.rs       | 45 +++++++++++
 userland/nonos_vt/tests/input.rs              | 60 +++++++++++++++
 userland/nonos_vt/tests/input_pointer.rs      | 57 ++++++++++++++
 userland/nonos_vt/tests/mutate.rs             | 61 +++++++++++++++
 userland/nonos_vt/tests/noise.rs              | 41 ++++++++++
 userland/nonos_vt/tests/parser.rs             | 61 +++++++++++++++
 userland/nonos_vt/tests/parser_strings.rs     | 58 ++++++++++++++
 userland/nonos_vt/tests/reflow.rs             | 55 ++++++++++++++
 userland/nonos_vt/tests/reflow_rows.rs        | 45 +++++++++++
 userland/nonos_vt/tests/refusals.rs           | 55 ++++++++++++++
 userland/nonos_vt/tests/report.rs             | 67 +++++++++++++++++
 userland/nonos_vt/tests/screen.rs             | 57 ++++++++++++++
 userland/nonos_vt/tests/screen_chars.rs       | 57 ++++++++++++++
 userland/nonos_vt/tests/screen_colour.rs      | 40 ++++++++++
 userland/nonos_vt/tests/screen_cursor.rs      | 72 ++++++++++++++++++
 userland/nonos_vt/tests/screen_region.rs      | 69 +++++++++++++++++
 userland/nonos_vt/tests/support/check.rs      | 58 ++++++++++++++
 userland/nonos_vt/tests/support/log.rs        | 55 ++++++++++++++
 userland/nonos_vt/tests/support/pieces.rs     | 67 +++++++++++++++++
 userland/nonos_vt/tests/support/rng.rs        | 34 +++++++++
 userland/nonos_vt/tests/support/term.rs       | 25 +++++++
 userland/nonos_vt/tests/text.rs               | 62 +++++++++++++++
 137 files changed, 7414 insertions(+)
 create mode 100644 userland/nonos_vt/Cargo.lock
 create mode 100644 userland/nonos_vt/Cargo.toml
 create mode 100644 userland/nonos_vt/src/cell/attr.rs
 create mode 100644 userland/nonos_vt/src/cell/data.rs
 create mode 100644 userland/nonos_vt/src/cell/mod.rs
 create mode 100644 userland/nonos_vt/src/cell/pen.rs
 create mode 100644 userland/nonos_vt/src/cell/underline.rs
 create mode 100644 userland/nonos_vt/src/charset.rs
 create mode 100644 userland/nonos_vt/src/color/mod.rs
 create mode 100644 userland/nonos_vt/src/color/name.rs
 create mode 100644 userland/nonos_vt/src/color/palette.rs
 create mode 100644 userland/nonos_vt/src/color/xterm.rs
 create mode 100644 userland/nonos_vt/src/input/keys.rs
 create mode 100644 userland/nonos_vt/src/input/keys_encode.rs
 create mode 100644 userland/nonos_vt/src/input/keys_seq.rs
 create mode 100644 userland/nonos_vt/src/input/mod.rs
 create mode 100644 userland/nonos_vt/src/input/mouse.rs
 create mode 100644 userland/nonos_vt/src/input/mouse_encode.rs
 create mode 100644 userland/nonos_vt/src/input/paste.rs
 create mode 100644 userland/nonos_vt/src/lib.rs
 create mode 100644 userland/nonos_vt/src/limits.rs
 create mode 100644 userland/nonos_vt/src/line/data.rs
 create mode 100644 userland/nonos_vt/src/line/marks.rs
 create mode 100644 userland/nonos_vt/src/line/mod.rs
 create mode 100644 userland/nonos_vt/src/line/shift.rs
 create mode 100644 userland/nonos_vt/src/line/trim.rs
 create mode 100644 userland/nonos_vt/src/line/write.rs
 create mode 100644 userland/nonos_vt/src/out.rs
 create mode 100644 userland/nonos_vt/src/params/collect.rs
 create mode 100644 userland/nonos_vt/src/params/mod.rs
 create mode 100644 userland/nonos_vt/src/params/read.rs
 create mode 100644 userland/nonos_vt/src/parser/advance.rs
 create mode 100644 userland/nonos_vt/src/parser/csi_states.rs
 create mode 100644 userland/nonos_vt/src/parser/dcs_states.rs
 create mode 100644 userland/nonos_vt/src/parser/escape.rs
 create mode 100644 userland/nonos_vt/src/parser/ground.rs
 create mode 100644 userland/nonos_vt/src/parser/handler.rs
 create mode 100644 userland/nonos_vt/src/parser/machine.rs
 create mode 100644 userland/nonos_vt/src/parser/mod.rs
 create mode 100644 userland/nonos_vt/src/parser/seq.rs
 create mode 100644 userland/nonos_vt/src/parser/strings.rs
 create mode 100644 userland/nonos_vt/src/term/abs.rs
 create mode 100644 userland/nonos_vt/src/term/alt.rs
 create mode 100644 userland/nonos_vt/src/term/answer/dcs.rs
 create mode 100644 userland/nonos_vt/src/term/answer/mod.rs
 create mode 100644 userland/nonos_vt/src/term/answer/reply.rs
 create mode 100644 userland/nonos_vt/src/term/answer/report.rs
 create mode 100644 userland/nonos_vt/src/term/answer/tcap.rs
 create mode 100644 userland/nonos_vt/src/term/answer/winops.rs
 create mode 100644 userland/nonos_vt/src/term/control.rs
 create mode 100644 userland/nonos_vt/src/term/csi.rs
 create mode 100644 userland/nonos_vt/src/term/csi_move.rs
 create mode 100644 userland/nonos_vt/src/term/csi_place.rs
 create mode 100644 userland/nonos_vt/src/term/cursor_style.rs
 create mode 100644 userland/nonos_vt/src/term/edit.rs
 create mode 100644 userland/nonos_vt/src/term/erase.rs
 create mode 100644 userland/nonos_vt/src/term/esc.rs
 create mode 100644 userland/nonos_vt/src/term/feed.rs
 create mode 100644 userland/nonos_vt/src/term/glyph.rs
 create mode 100644 userland/nonos_vt/src/term/handler.rs
 create mode 100644 userland/nonos_vt/src/term/history.rs
 create mode 100644 userland/nonos_vt/src/term/index.rs
 create mode 100644 userland/nonos_vt/src/term/join.rs
 create mode 100644 userland/nonos_vt/src/term/lines.rs
 create mode 100644 userland/nonos_vt/src/term/logical.rs
 create mode 100644 userland/nonos_vt/src/term/mod.rs
 create mode 100644 userland/nonos_vt/src/term/mode_state.rs
 create mode 100644 userland/nonos_vt/src/term/modes.rs
 create mode 100644 userland/nonos_vt/src/term/modes_type.rs
 create mode 100644 userland/nonos_vt/src/term/mouse_mode.rs
 create mode 100644 userland/nonos_vt/src/term/new.rs
 create mode 100644 userland/nonos_vt/src/term/osc/dispatch.rs
 create mode 100644 userland/nonos_vt/src/term/osc/links.rs
 create mode 100644 userland/nonos_vt/src/term/osc/mod.rs
 create mode 100644 userland/nonos_vt/src/term/osc/osc_color.rs
 create mode 100644 userland/nonos_vt/src/term/osc/osc_get.rs
 create mode 100644 userland/nonos_vt/src/term/osc/osc_misc.rs
 create mode 100644 userland/nonos_vt/src/term/osc/osc_palette.rs
 create mode 100644 userland/nonos_vt/src/term/pick.rs
 create mode 100644 userland/nonos_vt/src/term/print.rs
 create mode 100644 userland/nonos_vt/src/term/reflow/gather.rs
 create mode 100644 userland/nonos_vt/src/term/reflow/mod.rs
 create mode 100644 userland/nonos_vt/src/term/reflow/place.rs
 create mode 100644 userland/nonos_vt/src/term/reflow/placed.rs
 create mode 100644 userland/nonos_vt/src/term/reflow/rewrap.rs
 create mode 100644 userland/nonos_vt/src/term/reflow/rewrap_all.rs
 create mode 100644 userland/nonos_vt/src/term/reset.rs
 create mode 100644 userland/nonos_vt/src/term/resize.rs
 create mode 100644 userland/nonos_vt/src/term/save.rs
 create mode 100644 userland/nonos_vt/src/term/screen.rs
 create mode 100644 userland/nonos_vt/src/term/screen_modes.rs
 create mode 100644 userland/nonos_vt/src/term/scroll.rs
 create mode 100644 userland/nonos_vt/src/term/search.rs
 create mode 100644 userland/nonos_vt/src/term/search_match.rs
 create mode 100644 userland/nonos_vt/src/term/sgr.rs
 create mode 100644 userland/nonos_vt/src/term/sgr_attr.rs
 create mode 100644 userland/nonos_vt/src/term/sgr_colour.rs
 create mode 100644 userland/nonos_vt/src/term/soft_reset.rs
 create mode 100644 userland/nonos_vt/src/term/state.rs
 create mode 100644 userland/nonos_vt/src/term/tab_stops.rs
 create mode 100644 userland/nonos_vt/src/term/tabs.rs
 create mode 100644 userland/nonos_vt/src/term/text.rs
 create mode 100644 userland/nonos_vt/src/term/types.rs
 create mode 100644 userland/nonos_vt/src/term/view.rs
 create mode 100644 userland/nonos_vt/src/term/view_draw.rs
 create mode 100644 userland/nonos_vt/src/term/view_text.rs
 create mode 100644 userland/nonos_vt/src/url.rs
 create mode 100644 userland/nonos_vt/src/utf8/mod.rs
 create mode 100644 userland/nonos_vt/src/utf8/push.rs
 create mode 100644 userland/nonos_vt/src/utf8/state.rs
 create mode 100644 userland/nonos_vt/src/width/check.rs
 create mode 100644 userland/nonos_vt/src/width/lookup.rs
 create mode 100644 userland/nonos_vt/src/width/mod.rs
 create mode 100644 userland/nonos_vt/src/width/wide.rs
 create mode 100644 userland/nonos_vt/src/width/zero_high.rs
 create mode 100644 userland/nonos_vt/src/width/zero_low.rs
 create mode 100644 userland/nonos_vt/tests/input.rs
 create mode 100644 userland/nonos_vt/tests/input_pointer.rs
 create mode 100644 userland/nonos_vt/tests/mutate.rs
 create mode 100644 userland/nonos_vt/tests/noise.rs
 create mode 100644 userland/nonos_vt/tests/parser.rs
 create mode 100644 userland/nonos_vt/tests/parser_strings.rs
 create mode 100644 userland/nonos_vt/tests/reflow.rs
 create mode 100644 userland/nonos_vt/tests/reflow_rows.rs
 create mode 100644 userland/nonos_vt/tests/refusals.rs
 create mode 100644 userland/nonos_vt/tests/report.rs
 create mode 100644 userland/nonos_vt/tests/screen.rs
 create mode 100644 userland/nonos_vt/tests/screen_chars.rs
 create mode 100644 userland/nonos_vt/tests/screen_colour.rs
 create mode 100644 userland/nonos_vt/tests/screen_cursor.rs
 create mode 100644 userland/nonos_vt/tests/screen_region.rs
 create mode 100644 userland/nonos_vt/tests/support/check.rs
 create mode 100644 userland/nonos_vt/tests/support/log.rs
 create mode 100644 userland/nonos_vt/tests/support/pieces.rs
 create mode 100644 userland/nonos_vt/tests/support/rng.rs
 create mode 100644 userland/nonos_vt/tests/support/term.rs
 create mode 100644 userland/nonos_vt/tests/text.rs

diff --git a/userland/nonos_vt/Cargo.lock b/userland/nonos_vt/Cargo.lock
new file mode 100644
index 000000000..6f3f2f9ff
--- /dev/null
+++ b/userland/nonos_vt/Cargo.lock
@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "nonos_vt"
+version = "0.1.0"
diff --git a/userland/nonos_vt/Cargo.toml b/userland/nonos_vt/Cargo.toml
new file mode 100644
index 000000000..bc4c1753a
--- /dev/null
+++ b/userland/nonos_vt/Cargo.toml
@@ -0,0 +1,17 @@
+[package]
+name = "nonos_vt"
+version = "0.1.0"
+edition = "2021"
+authors = ["NONOS Contributors"]
+license = "AGPL-3.0"
+description = "Terminal emulation for NONOS: an xterm-compatible screen, parser and input encoder"
+
+[lib]
+name = "nonos_vt"
+path = "src/lib.rs"
+
+[dependencies]
+
+[profile.release]
+overflow-checks = true
+panic = "abort"
diff --git a/userland/nonos_vt/src/cell/attr.rs b/userland/nonos_vt/src/cell/attr.rs
new file mode 100644
index 000000000..75fdab5aa
--- /dev/null
+++ b/userland/nonos_vt/src/cell/attr.rs
@@ -0,0 +1,35 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Attribute bits on a cell.
+
+pub const BOLD: u16 = 1 << 0;
+pub const DIM: u16 = 1 << 1;
+pub const ITALIC: u16 = 1 << 2;
+/// Three bits holding an `Underline` style.
+pub const UNDERLINE_SHIFT: u16 = 3;
+pub const UNDERLINE_MASK: u16 = 0b111 << UNDERLINE_SHIFT;
+pub const BLINK: u16 = 1 << 6;
+pub const INVERSE: u16 = 1 << 7;
+pub const HIDDEN: u16 = 1 << 8;
+pub const STRIKE: u16 = 1 << 9;
+pub const OVERLINE: u16 = 1 << 10;
+/// The left half of a character two columns wide.
+pub const WIDE: u16 = 1 << 11;
+/// The right half. It draws nothing; the cell before it drew both halves.
+pub const WIDE_TAIL: u16 = 1 << 12;
+/// The attributes a pen carries. Width belongs to the character written.
+pub const PEN: u16 = !(WIDE | WIDE_TAIL);
diff --git a/userland/nonos_vt/src/cell/data.rs b/userland/nonos_vt/src/cell/data.rs
new file mode 100644
index 000000000..d71fbb27c
--- /dev/null
+++ b/userland/nonos_vt/src/cell/data.rs
@@ -0,0 +1,69 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! A cell, and the pen that writes cells.
+
+use super::attr;
+use super::pen::Pen;
+use super::Underline;
+use crate::color::Color;
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub struct Cell {
+    pub ch: char,
+    pub fg: Color,
+    pub bg: Color,
+    pub attr: u16,
+    /// OSC 8 target, 1-based into the terminal's link table; 0 is none.
+    pub link: u16,
+    /// Combining marks, 1-based into the line's mark table; 0 is none.
+    pub mark: u16,
+}
+
+impl Cell {
+    pub const BLANK: Cell =
+        Cell { ch: ' ', fg: Color::Default, bg: Color::Default, attr: 0, link: 0, mark: 0 };
+
+    /// An erased cell: blank, but keeping the pen's background, as xterm
+    /// erases.
+    pub fn erased(pen: &Pen) -> Cell {
+        Cell { bg: pen.bg, ..Cell::BLANK }
+    }
+
+    pub fn underline(&self) -> Underline {
+        Underline::from_bits((self.attr & attr::UNDERLINE_MASK) >> attr::UNDERLINE_SHIFT)
+    }
+
+    pub fn is_wide(&self) -> bool {
+        self.attr & attr::WIDE != 0
+    }
+
+    pub fn is_tail(&self) -> bool {
+        self.attr & attr::WIDE_TAIL != 0
+    }
+
+    /// Nothing a reader would miss if the cell were dropped from a line end.
+    pub fn is_plain_blank(&self) -> bool {
+        let quiet = self.attr == 0 && self.mark == 0 && self.link == 0;
+        self.ch == ' ' && self.bg == Color::Default && quiet
+    }
+}
+
+impl Default for Cell {
+    fn default() -> Cell {
+        Cell::BLANK
+    }
+}
diff --git a/userland/nonos_vt/src/cell/mod.rs b/userland/nonos_vt/src/cell/mod.rs
new file mode 100644
index 000000000..d21a70cbe
--- /dev/null
+++ b/userland/nonos_vt/src/cell/mod.rs
@@ -0,0 +1,26 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! One character position on the screen and the attributes it is drawn with.
+
+pub mod attr;
+mod data;
+mod pen;
+mod underline;
+
+pub use data::Cell;
+pub use pen::Pen;
+pub use underline::Underline;
diff --git a/userland/nonos_vt/src/cell/pen.rs b/userland/nonos_vt/src/cell/pen.rs
new file mode 100644
index 000000000..579522c34
--- /dev/null
+++ b/userland/nonos_vt/src/cell/pen.rs
@@ -0,0 +1,28 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The pen: what a program last set, which every cell it writes takes.
+
+use crate::color::Color;
+
+/// What newly written and erased cells take from the program.
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Default)]
+pub struct Pen {
+    pub fg: Color,
+    pub bg: Color,
+    pub attr: u16,
+    pub link: u16,
+}
diff --git a/userland/nonos_vt/src/cell/underline.rs b/userland/nonos_vt/src/cell/underline.rs
new file mode 100644
index 000000000..830428595
--- /dev/null
+++ b/userland/nonos_vt/src/cell/underline.rs
@@ -0,0 +1,40 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The underline styles SGR 4 selects with its sub-parameter.
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum Underline {
+    None,
+    Single,
+    Double,
+    Curly,
+    Dotted,
+    Dashed,
+}
+
+impl Underline {
+    pub fn from_bits(v: u16) -> Underline {
+        match v {
+            1 => Underline::Single,
+            2 => Underline::Double,
+            3 => Underline::Curly,
+            4 => Underline::Dotted,
+            5 => Underline::Dashed,
+            _ => Underline::None,
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/charset.rs b/userland/nonos_vt/src/charset.rs
new file mode 100644
index 000000000..5897b5516
--- /dev/null
+++ b/userland/nonos_vt/src/charset.rs
@@ -0,0 +1,71 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The character sets a program can switch in: the DEC line-drawing set
+//! that ncurses falls back to, and the UK set's pound sign.
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Default)]
+pub enum Charset {
+    #[default]
+    Ascii,
+    DecSpecial,
+    Uk,
+}
+
+/// G0 to G3 and which of them is in use.
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Default)]
+pub struct Charsets {
+    pub g: [Charset; 4],
+    /// The set GL maps: 0 after SI, 1 after SO.
+    pub gl: usize,
+    /// A single shift, SS2 or SS3, for the next character only.
+    pub single: Option<usize>,
+}
+
+impl Charsets {
+    /// Map a printable ASCII character through the set in use.
+    pub fn map(&mut self, c: char) -> char {
+        let set = match self.single.take() {
+            Some(i) => self.g[i],
+            None => self.g[self.gl.min(3)],
+        };
+        match set {
+            Charset::Ascii => c,
+            Charset::Uk if c == '#' => '£',
+            Charset::Uk => c,
+            Charset::DecSpecial => dec_special(c),
+        }
+    }
+}
+
+pub fn designate(final_byte: u8) -> Charset {
+    match final_byte {
+        b'0' => Charset::DecSpecial,
+        b'A' => Charset::Uk,
+        _ => Charset::Ascii,
+    }
+}
+
+fn dec_special(c: char) -> char {
+    const TABLE: [char; 32] = [
+        '\u{00A0}', '◆', '▒', '␉', '␌', '␍', '␊', '°', '±', '␤', '␋', '┘', '┐', '┌', '└', '┼', '⎺',
+        '⎻', '─', '⎼', '⎽', '├', '┤', '┴', '┬', '│', '≤', '≥', 'π', '≠', '£', '·',
+    ];
+    match c as u32 {
+        0x5F..=0x7E => TABLE[(c as u32 - 0x5F) as usize],
+        _ => c,
+    }
+}
diff --git a/userland/nonos_vt/src/color/mod.rs b/userland/nonos_vt/src/color/mod.rs
new file mode 100644
index 000000000..272131a2a
--- /dev/null
+++ b/userland/nonos_vt/src/color/mod.rs
@@ -0,0 +1,27 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Colours as a program names them, and the palette that turns them into
+//! pixels. A cell keeps the name, not the pixel, so a theme change or an
+//! OSC 4 recolour reaches text already on screen.
+
+mod name;
+mod palette;
+mod xterm;
+
+pub use name::{dim, rgb, Color};
+pub use palette::Palette;
+pub use xterm::xterm_color;
diff --git a/userland/nonos_vt/src/color/name.rs b/userland/nonos_vt/src/color/name.rs
new file mode 100644
index 000000000..dd2872ba5
--- /dev/null
+++ b/userland/nonos_vt/src/color/name.rs
@@ -0,0 +1,36 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! A colour as a cell records it.
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Default)]
+pub enum Color {
+    /// The theme's foreground or background, whichever slot this is.
+    #[default]
+    Default,
+    /// One of the 256 palette entries.
+    Indexed(u8),
+    Rgb(u8, u8, u8),
+}
+
+pub fn rgb(r: u8, g: u8, b: u8) -> u32 {
+    ((r as u32) << 16) | ((g as u32) << 8) | b as u32
+}
+
+/// Halve a colour toward black, for dim text.
+pub fn dim(c: u32) -> u32 {
+    (c >> 1) & 0x7F7F7F
+}
diff --git a/userland/nonos_vt/src/color/palette.rs b/userland/nonos_vt/src/color/palette.rs
new file mode 100644
index 000000000..67798cfd3
--- /dev/null
+++ b/userland/nonos_vt/src/color/palette.rs
@@ -0,0 +1,63 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Colours as 0xRRGGBB for each name a cell can carry.
+
+use super::name::{rgb, Color};
+use super::xterm::xterm_color;
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct Palette {
+    pub colors: [u32; 256],
+    pub fg: u32,
+    pub bg: u32,
+    pub cursor: u32,
+}
+
+impl Palette {
+    pub fn xterm() -> Palette {
+        let mut colors = [0u32; 256];
+        for (i, c) in colors.iter_mut().enumerate() {
+            *c = xterm_color(i as u8);
+        }
+        Palette { colors, fg: 0xE5E5E5, bg: 0x000000, cursor: 0xE5E5E5 }
+    }
+
+    /// The pixel for `c` in a foreground slot. `bright` is bold text asking
+    /// for the bright variant of the first eight colours, as xterm draws it.
+    pub fn fg_of(&self, c: Color, bright: bool) -> u32 {
+        match c {
+            Color::Default => self.fg,
+            Color::Indexed(i) if bright && i < 8 => self.colors[i as usize + 8],
+            Color::Indexed(i) => self.colors[i as usize],
+            Color::Rgb(r, g, b) => rgb(r, g, b),
+        }
+    }
+
+    pub fn bg_of(&self, c: Color) -> u32 {
+        match c {
+            Color::Default => self.bg,
+            Color::Indexed(i) => self.colors[i as usize],
+            Color::Rgb(r, g, b) => rgb(r, g, b),
+        }
+    }
+}
+
+impl Default for Palette {
+    fn default() -> Palette {
+        Palette::xterm()
+    }
+}
diff --git a/userland/nonos_vt/src/color/xterm.rs b/userland/nonos_vt/src/color/xterm.rs
new file mode 100644
index 000000000..c10156f6d
--- /dev/null
+++ b/userland/nonos_vt/src/color/xterm.rs
@@ -0,0 +1,38 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The xterm palette: sixteen named colours, a 6x6x6 cube, then a 24-step
+//! grey ramp.
+
+const BASE16: [u32; 16] = [
+    0x000000, 0xCD0000, 0x00CD00, 0xCDCD00, 0x0000EE, 0xCD00CD, 0x00CDCD, 0xE5E5E5, 0x7F7F7F,
+    0xFF0000, 0x00FF00, 0xFFFF00, 0x5C5CFF, 0xFF00FF, 0x00FFFF, 0xFFFFFF,
+];
+
+pub fn xterm_color(i: u8) -> u32 {
+    match i {
+        0..=15 => BASE16[i as usize],
+        16..=231 => {
+            let n = i - 16;
+            let level = |v: u8| if v == 0 { 0u32 } else { 55 + 40 * v as u32 };
+            (level(n / 36) << 16) | (level(n / 6 % 6) << 8) | level(n % 6)
+        }
+        _ => {
+            let g = 8 + 10 * (i as u32 - 232);
+            (g << 16) | (g << 8) | g
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/input/keys.rs b/userland/nonos_vt/src/input/keys.rs
new file mode 100644
index 000000000..cc54ab492
--- /dev/null
+++ b/userland/nonos_vt/src/input/keys.rs
@@ -0,0 +1,73 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Keys to bytes.
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum Key {
+    /// A character as typed, Shift already applied.
+    Char(char),
+    Enter,
+    Tab,
+    Backspace,
+    Escape,
+    Up,
+    Down,
+    Left,
+    Right,
+    Home,
+    End,
+    PageUp,
+    PageDown,
+    Insert,
+    Delete,
+    /// F1 to F12.
+    F(u8),
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Default)]
+pub struct Mods {
+    pub shift: bool,
+    pub alt: bool,
+    pub ctrl: bool,
+}
+
+impl Mods {
+    /// xterm's modifier parameter: 1 plus shift 1, alt 2, ctrl 4.
+    pub(super) fn param(&self) -> u8 {
+        1 + self.shift as u8 + 2 * self.alt as u8 + 4 * self.ctrl as u8
+    }
+
+    pub(super) fn any(&self) -> bool {
+        self.shift || self.alt || self.ctrl
+    }
+}
+
+/// Control-key bytes: letters and the punctuation around them.
+pub(super) fn ctrl_byte(c: char) -> Option<u8> {
+    Some(match c {
+        'a'..='z' => c as u8 - b'a' + 1,
+        'A'..='Z' => c as u8 - b'A' + 1,
+        '@' | ' ' | '2' => 0,
+        '[' | '3' => 0x1B,
+        '\\' | '4' => 0x1C,
+        ']' | '5' => 0x1D,
+        '^' | '6' => 0x1E,
+        '_' | '-' | '7' => 0x1F,
+        '?' | '8' => 0x7F,
+        _ => return None,
+    })
+}
diff --git a/userland/nonos_vt/src/input/keys_encode.rs b/userland/nonos_vt/src/input/keys_encode.rs
new file mode 100644
index 000000000..3c5983ec1
--- /dev/null
+++ b/userland/nonos_vt/src/input/keys_encode.rs
@@ -0,0 +1,75 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The bytes each key sends under the modes a program set.
+
+use alloc::vec::Vec;
+
+use super::keys::{ctrl_byte, Key, Mods};
+use super::keys_seq::{letter, tilde};
+use crate::term::Modes;
+
+/// Append the bytes for `key` to `out`. Returns false for a key that sends
+/// nothing.
+pub fn encode_key(key: Key, m: Mods, modes: &Modes, out: &mut Vec<u8>) -> bool {
+    let app = modes.cursor_keys;
+    match key {
+        Key::Char(c) => {
+            if m.alt {
+                out.push(0x1B);
+            }
+            match m.ctrl.then(|| ctrl_byte(c)).flatten() {
+                Some(b) => out.push(b),
+                None => {
+                    let mut buf = [0u8; 4];
+                    out.extend_from_slice(c.encode_utf8(&mut buf).as_bytes());
+                }
+            }
+        }
+        Key::Enter => {
+            if m.alt {
+                out.push(0x1B);
+            }
+            out.extend_from_slice(if modes.newline { b"\r\n" } else { b"\r" });
+        }
+        Key::Tab if m.shift => out.extend_from_slice(b"\x1b[Z"),
+        Key::Tab => out.push(b'\t'),
+        Key::Backspace => {
+            if m.alt {
+                out.push(0x1B);
+            }
+            out.push(if m.ctrl { 0x08 } else { 0x7F });
+        }
+        Key::Escape => out.push(0x1B),
+        Key::Up => letter(out, 'A', m, app),
+        Key::Down => letter(out, 'B', m, app),
+        Key::Right => letter(out, 'C', m, app),
+        Key::Left => letter(out, 'D', m, app),
+        Key::Home => letter(out, 'H', m, app),
+        Key::End => letter(out, 'F', m, app),
+        Key::Insert => tilde(out, 2, m),
+        Key::Delete => tilde(out, 3, m),
+        Key::PageUp => tilde(out, 5, m),
+        Key::PageDown => tilde(out, 6, m),
+        Key::F(n @ 1..=4) => letter(out, (b'P' + n - 1) as char, m, true),
+        Key::F(n @ 5..=12) => {
+            const CODES: [u8; 8] = [15, 17, 18, 19, 20, 21, 23, 24];
+            tilde(out, CODES[(n - 5) as usize], m);
+        }
+        Key::F(_) => return false,
+    }
+    true
+}
diff --git a/userland/nonos_vt/src/input/keys_seq.rs b/userland/nonos_vt/src/input/keys_seq.rs
new file mode 100644
index 000000000..833a1a124
--- /dev/null
+++ b/userland/nonos_vt/src/input/keys_seq.rs
@@ -0,0 +1,44 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The two shapes a special key's sequence takes.
+
+use alloc::vec::Vec;
+use core::fmt::Write;
+
+use super::keys::Mods;
+use crate::out::Out;
+
+/// A key with a final letter: `ESC [ A`, `ESC O A` in application mode,
+/// `ESC [ 1 ; m A` with modifiers.
+pub(super) fn letter(out: &mut Vec<u8>, fin: char, m: Mods, ss3: bool) {
+    if m.any() {
+        let _ = write!(Out(out), "\x1b[1;{}{fin}", m.param());
+    } else if ss3 {
+        let _ = write!(Out(out), "\x1bO{fin}");
+    } else {
+        let _ = write!(Out(out), "\x1b[{fin}");
+    }
+}
+
+/// A key numbered with a tilde: `ESC [ n ~`, `ESC [ n ; m ~`.
+pub(super) fn tilde(out: &mut Vec<u8>, n: u8, m: Mods) {
+    if m.any() {
+        let _ = write!(Out(out), "\x1b[{n};{}~", m.param());
+    } else {
+        let _ = write!(Out(out), "\x1b[{n}~");
+    }
+}
diff --git a/userland/nonos_vt/src/input/mod.rs b/userland/nonos_vt/src/input/mod.rs
new file mode 100644
index 000000000..0ba70fbd5
--- /dev/null
+++ b/userland/nonos_vt/src/input/mod.rs
@@ -0,0 +1,31 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! What a program reads when a person types, points or pastes, encoded as
+//! xterm encodes it under the modes the program set.
+
+mod keys;
+mod keys_encode;
+mod keys_seq;
+mod mouse;
+mod mouse_encode;
+mod paste;
+
+pub use keys::{Key, Mods};
+pub use keys_encode::encode_key;
+pub use mouse::{Button, MouseEvent, MouseKind};
+pub use mouse_encode::{encode_focus, encode_mouse};
+pub use paste::encode_paste;
diff --git a/userland/nonos_vt/src/input/mouse.rs b/userland/nonos_vt/src/input/mouse.rs
new file mode 100644
index 000000000..5ee5f9213
--- /dev/null
+++ b/userland/nonos_vt/src/input/mouse.rs
@@ -0,0 +1,60 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Pointer events to bytes, for programs that asked for them.
+
+use super::keys::Mods;
+use crate::term::MouseMode;
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum Button {
+    Left,
+    Middle,
+    Right,
+    WheelUp,
+    WheelDown,
+    /// Motion with no button held.
+    None,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum MouseKind {
+    Press,
+    Release,
+    Motion,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub struct MouseEvent {
+    pub kind: MouseKind,
+    pub button: Button,
+    /// Cell, 0-based.
+    pub col: usize,
+    pub row: usize,
+    pub mods: Mods,
+}
+
+pub(super) fn wanted(ev: &MouseEvent, mode: MouseMode) -> bool {
+    let wheel = matches!(ev.button, Button::WheelUp | Button::WheelDown);
+    match (mode, ev.kind) {
+        (MouseMode::Off, _) => false,
+        (MouseMode::Press, k) => k == MouseKind::Press,
+        (_, MouseKind::Press | MouseKind::Release) => !(wheel && ev.kind == MouseKind::Release),
+        (MouseMode::Drag, MouseKind::Motion) => ev.button != Button::None,
+        (MouseMode::Motion, MouseKind::Motion) => true,
+        (MouseMode::Click, MouseKind::Motion) => false,
+    }
+}
diff --git a/userland/nonos_vt/src/input/mouse_encode.rs b/userland/nonos_vt/src/input/mouse_encode.rs
new file mode 100644
index 000000000..30f95680b
--- /dev/null
+++ b/userland/nonos_vt/src/input/mouse_encode.rs
@@ -0,0 +1,73 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Pointer reports in the SGR form, or the old one-byte form when its
+//! coordinates fit.
+
+use alloc::vec::Vec;
+use core::fmt::Write;
+
+use super::mouse::{wanted, Button, MouseEvent, MouseKind};
+use crate::out::Out;
+use crate::term::{Modes, MouseMode};
+
+/// Append the report for `ev`, or return false when the program did not ask
+/// for it, or when the old encoding cannot carry its position.
+pub fn encode_mouse(ev: &MouseEvent, modes: &Modes, out: &mut Vec<u8>) -> bool {
+    if !wanted(ev, modes.mouse) {
+        return false;
+    }
+    let mut cb: u32 = match ev.button {
+        Button::Left => 0,
+        Button::Middle => 1,
+        Button::Right => 2,
+        Button::None => 3,
+        Button::WheelUp => 64,
+        Button::WheelDown => 65,
+    };
+    if ev.kind == MouseKind::Motion {
+        cb += 32;
+    }
+    if modes.mouse != MouseMode::Press {
+        let m = ev.mods;
+        cb += 4 * m.shift as u32 + 8 * m.alt as u32 + 16 * m.ctrl as u32;
+    }
+    let (x, y) = (ev.col + 1, ev.row + 1);
+    if modes.mouse_sgr {
+        let end = if ev.kind == MouseKind::Release { 'm' } else { 'M' };
+        let _ = write!(Out(out), "\x1b[<{cb};{x};{y}{end}");
+        return true;
+    }
+    // The old form has no release per button and one byte per coordinate.
+    if ev.kind == MouseKind::Release {
+        cb = (cb & !3) | 3;
+    }
+    if x > 223 || y > 223 {
+        return false;
+    }
+    out.extend_from_slice(b"\x1b[M");
+    out.extend_from_slice(&[(cb + 32) as u8, (x + 32) as u8, (y + 32) as u8]);
+    true
+}
+
+/// `CSI I` on focus, `CSI O` on losing it, when the program asked.
+pub fn encode_focus(focused: bool, modes: &Modes, out: &mut Vec<u8>) -> bool {
+    if !modes.focus {
+        return false;
+    }
+    out.extend_from_slice(if focused { b"\x1b[I" } else { b"\x1b[O" });
+    true
+}
diff --git a/userland/nonos_vt/src/input/paste.rs b/userland/nonos_vt/src/input/paste.rs
new file mode 100644
index 000000000..7b243e558
--- /dev/null
+++ b/userland/nonos_vt/src/input/paste.rs
@@ -0,0 +1,49 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Pasted text to bytes.
+//!
+//! Escape bytes and other controls are stripped first. Without that, text
+//! copied from a web page could carry `ESC [ 201 ~`, end the bracket early,
+//! and have the rest run as typed commands. Line ends become carriage
+//! returns, which is what the Enter key sends.
+
+use alloc::vec::Vec;
+
+use crate::term::Modes;
+
+pub fn encode_paste(text: &str, modes: &Modes, out: &mut Vec<u8>) {
+    if modes.bracketed_paste {
+        out.extend_from_slice(b"\x1b[200~");
+    }
+    let mut prev_cr = false;
+    for c in text.chars() {
+        match c {
+            '\n' if prev_cr => {}
+            '\r' | '\n' => out.push(b'\r'),
+            '\t' => out.push(b'\t'),
+            c if c.is_control() => {}
+            c => {
+                let mut buf = [0u8; 4];
+                out.extend_from_slice(c.encode_utf8(&mut buf).as_bytes());
+            }
+        }
+        prev_cr = c == '\r';
+    }
+    if modes.bracketed_paste {
+        out.extend_from_slice(b"\x1b[201~");
+    }
+}
diff --git a/userland/nonos_vt/src/lib.rs b/userland/nonos_vt/src/lib.rs
new file mode 100644
index 000000000..4355c869d
--- /dev/null
+++ b/userland/nonos_vt/src/lib.rs
@@ -0,0 +1,47 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Terminal emulation: the bytes a program writes become a screen of cells,
+//! and the keys a person presses become the bytes that program reads.
+//!
+//! The parser follows the DEC state machine, so every byte has one meaning in
+//! every state and nothing a program writes can leave it stuck. The screen
+//! answers what xterm answers for the sequences full-screen tools depend on,
+//! resizes by re-wrapping its lines, and keeps a bounded scrollback. Every
+//! buffer that hostile output could grow has a fixed ceiling in `limits`.
+
+#![no_std]
+
+extern crate alloc;
+
+pub mod cell;
+pub mod charset;
+pub mod color;
+pub mod input;
+pub mod limits;
+pub mod line;
+mod out;
+pub mod params;
+pub mod parser;
+pub mod term;
+pub mod url;
+pub mod utf8;
+pub mod width;
+
+pub use cell::{Cell, Pen, Underline};
+pub use color::{Color, Palette};
+pub use line::Line;
+pub use term::{ClipboardRequest, CursorShape, CursorView, Modes, MouseMode, Pos, Term};
diff --git a/userland/nonos_vt/src/limits.rs b/userland/nonos_vt/src/limits.rs
new file mode 100644
index 000000000..66872f643
--- /dev/null
+++ b/userland/nonos_vt/src/limits.rs
@@ -0,0 +1,57 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Ceilings on everything a program's output can make this crate hold.
+
+/// Screen size bounds. A resize outside them is clamped.
+pub const MIN_COLS: usize = 2;
+pub const MIN_ROWS: usize = 1;
+pub const MAX_COLS: usize = 1000;
+pub const MAX_ROWS: usize = 500;
+
+/// Scrollback lines kept when the host does not choose.
+pub const DEFAULT_SCROLLBACK: usize = 5000;
+pub const MAX_SCROLLBACK: usize = 100_000;
+
+/// Numeric parameters in one control sequence, and the largest value one
+/// may carry. A sequence with more parameters is ignored whole, because
+/// acting on a truncated list would apply the wrong settings.
+pub const MAX_PARAMS: usize = 32;
+pub const MAX_PARAM: u16 = u16::MAX;
+pub const MAX_INTERMEDIATES: usize = 2;
+
+/// String sequences: OSC and DCS payloads past these are dropped whole.
+pub const MAX_OSC: usize = 4096;
+pub const MAX_DCS: usize = 1024;
+
+pub const MAX_TITLE: usize = 256;
+pub const MAX_TITLE_STACK: usize = 10;
+
+/// Distinct OSC 8 hyperlink targets held, and the longest one kept.
+pub const MAX_LINKS: usize = 1024;
+pub const MAX_LINK: usize = 2048;
+
+/// Reply bytes held for a program that is not reading them. Past this the
+/// newest replies are dropped: a program that never reads cannot make the
+/// terminal allocate without bound by asking questions.
+pub const MAX_REPLY: usize = 4096;
+
+/// Combining marks one line may carry.
+pub const MAX_MARKS_PER_LINE: usize = 512;
+
+/// Repeat count accepted by REP, and prompt starts remembered for jumping.
+pub const MAX_REPEAT: usize = MAX_COLS * MAX_ROWS;
+pub const MAX_PROMPT_MARKS: usize = 1024;
diff --git a/userland/nonos_vt/src/line/data.rs b/userland/nonos_vt/src/line/data.rs
new file mode 100644
index 000000000..6b6798bb1
--- /dev/null
+++ b/userland/nonos_vt/src/line/data.rs
@@ -0,0 +1,69 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The line itself.
+
+use alloc::string::String;
+use alloc::vec;
+use alloc::vec::Vec;
+
+use crate::cell::Cell;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Line {
+    pub cells: Vec<Cell>,
+    /// The text ran on to the next line rather than ending here, so a copy or
+    /// a re-wrap joins the two.
+    pub wrapped: bool,
+    pub(super) marks: Vec<String>,
+}
+
+impl Line {
+    pub fn new(cols: usize, fill: Cell) -> Line {
+        Line { cells: vec![fill; cols], wrapped: false, marks: Vec::new() }
+    }
+
+    pub fn len(&self) -> usize {
+        self.cells.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.cells.is_empty()
+    }
+
+    pub fn cell(&self, x: usize) -> Cell {
+        self.cells.get(x).copied().unwrap_or(Cell::BLANK)
+    }
+
+    pub fn clear(&mut self, fill: Cell) {
+        for c in self.cells.iter_mut() {
+            *c = fill;
+        }
+        self.marks.clear();
+        self.wrapped = false;
+    }
+
+    /// Append `cell`, carrying its marks over from `src`.
+    pub fn push_from(&mut self, src: &Line, cell: Cell) {
+        self.cells.push(Cell { mark: 0, ..cell });
+        if let Some(s) = src.marks_of(&cell) {
+            let x = self.cells.len() - 1;
+            for ch in s.chars() {
+                self.add_mark(x, ch);
+            }
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/line/marks.rs b/userland/nonos_vt/src/line/marks.rs
new file mode 100644
index 000000000..873be7087
--- /dev/null
+++ b/userland/nonos_vt/src/line/marks.rs
@@ -0,0 +1,70 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Combining marks, held beside the cells they are drawn over.
+
+use alloc::string::String;
+
+use super::Line;
+use crate::cell::Cell;
+use crate::limits::MAX_MARKS_PER_LINE;
+
+impl Line {
+    /// The combining marks drawn over `cell`, if it has any.
+    pub fn marks_of(&self, cell: &Cell) -> Option<&str> {
+        let i = (cell.mark as usize).checked_sub(1)?;
+        self.marks.get(i).map(|s| s.as_str())
+    }
+
+    /// Put a combining mark over the cell at `x`. Refused, and the mark
+    /// dropped, once the line holds as many as it may.
+    pub fn add_mark(&mut self, x: usize, c: char) -> bool {
+        let Some(cell) = self.cells.get(x).copied() else { return false };
+        if let Some(i) = (cell.mark as usize).checked_sub(1) {
+            if let Some(s) = self.marks.get_mut(i) {
+                let room = s.len() < 32;
+                if room {
+                    s.push(c);
+                }
+                return room;
+            }
+        }
+        if self.marks.len() >= MAX_MARKS_PER_LINE {
+            self.compact_marks();
+            if self.marks.len() >= MAX_MARKS_PER_LINE {
+                return false;
+            }
+        }
+        self.marks.push(String::from(c));
+        self.cells[x].mark = self.marks.len() as u16;
+        true
+    }
+
+    /// Drop marks no cell points at any more, renumbering the rest.
+    fn compact_marks(&mut self) {
+        let old = core::mem::take(&mut self.marks);
+        for cell in self.cells.iter_mut() {
+            let Some(i) = (cell.mark as usize).checked_sub(1) else { continue };
+            cell.mark = match old.get(i) {
+                Some(s) => {
+                    self.marks.push(s.clone());
+                    self.marks.len() as u16
+                }
+                None => 0,
+            };
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/line/mod.rs b/userland/nonos_vt/src/line/mod.rs
new file mode 100644
index 000000000..b24b64c82
--- /dev/null
+++ b/userland/nonos_vt/src/line/mod.rs
@@ -0,0 +1,30 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! One row of cells, on screen or in scrollback.
+//!
+//! A screen line is always as wide as the screen. A scrollback line may be
+//! shorter: trailing blanks are dropped when it leaves the screen, and a
+//! reader asking past its end gets a blank. Every write keeps two-column
+//! characters whole: overwriting either half blanks the other.
+
+mod data;
+mod marks;
+mod shift;
+mod trim;
+mod write;
+
+pub use data::Line;
diff --git a/userland/nonos_vt/src/line/shift.rs b/userland/nonos_vt/src/line/shift.rs
new file mode 100644
index 000000000..a7d13afd6
--- /dev/null
+++ b/userland/nonos_vt/src/line/shift.rs
@@ -0,0 +1,68 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Moving a line's cells: inserting, deleting, resizing and trimming.
+
+use super::Line;
+use crate::cell::Cell;
+
+impl Line {
+    /// Open `n` blank cells at `x`, pushing the rest right and off the end.
+    pub fn insert_blanks(&mut self, x: usize, n: usize, fill: Cell) {
+        let len = self.cells.len();
+        if x >= len || n == 0 {
+            return;
+        }
+        let n = n.min(len - x);
+        self.split_wide_at(x);
+        self.cells[x..].rotate_right(n);
+        for c in &mut self.cells[x..x + n] {
+            *c = fill;
+        }
+        self.drop_cut_head();
+    }
+
+    /// Remove `n` cells at `x`, pulling the rest left and blanking the end.
+    pub fn delete_cells(&mut self, x: usize, n: usize, fill: Cell) {
+        let len = self.cells.len();
+        if x >= len || n == 0 {
+            return;
+        }
+        let n = n.min(len - x);
+        self.split_wide_at(x);
+        self.split_wide_at(x + n - 1);
+        self.cells[x..].rotate_left(n);
+        for c in &mut self.cells[len - n..] {
+            *c = fill;
+        }
+    }
+
+    /// A wide character pushed half off the right edge loses its head too.
+    fn drop_cut_head(&mut self) {
+        if let Some(last) = self.cells.last_mut() {
+            if last.is_wide() {
+                let bg = last.bg;
+                *last = Cell { bg, ..Cell::BLANK };
+            }
+        }
+    }
+
+    /// Change the width to `cols`, padding with `fill`.
+    pub fn resize(&mut self, cols: usize, fill: Cell) {
+        self.cells.resize(cols, fill);
+        self.drop_cut_head();
+    }
+}
diff --git a/userland/nonos_vt/src/line/trim.rs b/userland/nonos_vt/src/line/trim.rs
new file mode 100644
index 000000000..d104cf88b
--- /dev/null
+++ b/userland/nonos_vt/src/line/trim.rs
@@ -0,0 +1,35 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! What of a line is text, and dropping the rest when it leaves the screen.
+
+use super::Line;
+
+impl Line {
+    /// Cells up to the last one a reader would miss.
+    pub fn content_len(&self) -> usize {
+        self.cells.iter().rposition(|c| !c.is_plain_blank()).map_or(0, |i| i + 1)
+    }
+
+    /// Drop trailing blanks, for a line leaving the screen. A wrapped line
+    /// keeps them: its spaces run on into the next line and are text.
+    pub fn trim(&mut self) {
+        if !self.wrapped {
+            let n = self.content_len();
+            self.cells.truncate(n);
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/line/write.rs b/userland/nonos_vt/src/line/write.rs
new file mode 100644
index 000000000..80435e7a7
--- /dev/null
+++ b/userland/nonos_vt/src/line/write.rs
@@ -0,0 +1,70 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Writes into a line that keep two-column characters whole.
+
+use super::Line;
+use crate::cell::Cell;
+
+impl Line {
+    /// Blank the other half of any wide character that has a cell at `x`
+    /// about to be overwritten.
+    pub(super) fn split_wide_at(&mut self, x: usize) {
+        let Some(c) = self.cells.get(x).copied() else { return };
+        if c.is_tail() && x > 0 {
+            let bg = self.cells[x - 1].bg;
+            self.cells[x - 1] = Cell { bg, ..Cell::BLANK };
+        }
+        if c.is_wide() {
+            if let Some(t) = self.cells.get_mut(x + 1) {
+                let bg = t.bg;
+                *t = Cell { bg, ..Cell::BLANK };
+            }
+        }
+    }
+
+    pub fn put(&mut self, x: usize, cell: Cell) {
+        if x >= self.cells.len() {
+            return;
+        }
+        self.split_wide_at(x);
+        self.cells[x] = cell;
+    }
+
+    /// Write a two-column character: its head at `x`, its tail after.
+    pub fn put_pair(&mut self, x: usize, head: Cell, tail: Cell) {
+        if x + 1 >= self.cells.len() {
+            return;
+        }
+        self.split_wide_at(x);
+        self.split_wide_at(x + 1);
+        self.cells[x] = head;
+        self.cells[x + 1] = tail;
+    }
+
+    /// Blank `[from, to)`.
+    pub fn erase(&mut self, from: usize, to: usize, fill: Cell) {
+        let to = to.min(self.cells.len());
+        if from >= to {
+            return;
+        }
+        self.split_wide_at(from);
+        self.split_wide_at(to - 1);
+        for c in &mut self.cells[from..to] {
+            *c = fill;
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/out.rs b/userland/nonos_vt/src/out.rs
new file mode 100644
index 000000000..81011fadf
--- /dev/null
+++ b/userland/nonos_vt/src/out.rs
@@ -0,0 +1,30 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Formatting straight into a byte buffer, for the sequences this crate
+//! writes.
+
+use alloc::vec::Vec;
+use core::fmt::Write;
+
+pub(crate) struct Out<'a>(pub(crate) &'a mut Vec<u8>);
+
+impl Write for Out<'_> {
+    fn write_str(&mut self, s: &str) -> core::fmt::Result {
+        self.0.extend_from_slice(s.as_bytes());
+        Ok(())
+    }
+}
diff --git a/userland/nonos_vt/src/params/collect.rs b/userland/nonos_vt/src/params/collect.rs
new file mode 100644
index 000000000..f3e1cbe72
--- /dev/null
+++ b/userland/nonos_vt/src/params/collect.rs
@@ -0,0 +1,72 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Collecting parameters as their bytes arrive.
+
+use crate::limits::{MAX_PARAM, MAX_PARAMS};
+
+#[derive(Clone, Default, Debug)]
+pub struct Params {
+    pub(super) vals: [u16; MAX_PARAMS],
+    /// Bit `i` set: value `i` followed a colon, a sub-parameter of the one
+    /// before it.
+    pub(super) sub: u32,
+    pub(super) len: usize,
+    /// More parameters than fit; the sequence is ignored.
+    pub overflow: bool,
+}
+
+impl Params {
+    pub fn clear(&mut self) {
+        self.len = 0;
+        self.sub = 0;
+        self.overflow = false;
+    }
+
+    pub fn len(&self) -> usize {
+        self.len
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.len == 0
+    }
+
+    pub fn digit(&mut self, d: u8) {
+        if self.len == 0 {
+            self.len = 1;
+            self.vals[0] = 0;
+        }
+        let v = &mut self.vals[self.len - 1];
+        *v = (*v as u32 * 10 + d as u32).min(MAX_PARAM as u32) as u16;
+    }
+
+    /// A separator: `colon` makes the next value a sub-parameter.
+    pub fn separator(&mut self, colon: bool) {
+        if self.len == 0 {
+            self.len = 1;
+            self.vals[0] = 0;
+        }
+        if self.len == MAX_PARAMS {
+            self.overflow = true;
+            return;
+        }
+        self.vals[self.len] = 0;
+        if colon {
+            self.sub |= 1 << self.len;
+        }
+        self.len += 1;
+    }
+}
diff --git a/userland/nonos_vt/src/params/mod.rs b/userland/nonos_vt/src/params/mod.rs
new file mode 100644
index 000000000..e73ac6c74
--- /dev/null
+++ b/userland/nonos_vt/src/params/mod.rs
@@ -0,0 +1,25 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The numbers in a control sequence. `;` separates parameters and `:`
+//! separates the sub-parameters of one, as in `38:2::255:0:0`, so a colour
+//! written either way reads the same.
+
+mod collect;
+mod read;
+
+pub use collect::Params;
+pub use read::Groups;
diff --git a/userland/nonos_vt/src/params/read.rs b/userland/nonos_vt/src/params/read.rs
new file mode 100644
index 000000000..7d9033e9a
--- /dev/null
+++ b/userland/nonos_vt/src/params/read.rs
@@ -0,0 +1,68 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Reading parameters back, by position or grouped with their
+//! sub-parameters.
+
+use super::Params;
+
+impl Params {
+    /// Value `i`, top-level and sub-parameters counted alike.
+    pub fn raw(&self, i: usize) -> Option<u16> {
+        (i < self.len).then(|| self.vals[i])
+    }
+
+    /// Parameter `i` counting only top-level values, 0 when absent.
+    pub fn get(&self, i: usize) -> u16 {
+        self.groups().nth(i).and_then(|g| g.first().copied()).unwrap_or(0)
+    }
+
+    /// Parameter `i`, with 0 and absent both meaning `d`, as most sequences
+    /// read a count or a position.
+    pub fn count(&self, i: usize, d: u16) -> u16 {
+        match self.get(i) {
+            0 => d,
+            v => v,
+        }
+    }
+
+    /// Each top-level value with its sub-parameters.
+    pub fn groups(&self) -> Groups<'_> {
+        Groups { p: self, i: 0 }
+    }
+}
+
+pub struct Groups<'a> {
+    p: &'a Params,
+    i: usize,
+}
+
+impl<'a> Iterator for Groups<'a> {
+    type Item = &'a [u16];
+
+    fn next(&mut self) -> Option<&'a [u16]> {
+        let start = self.i;
+        if start >= self.p.len {
+            return None;
+        }
+        let mut end = start + 1;
+        while end < self.p.len && self.p.sub & (1 << end) != 0 {
+            end += 1;
+        }
+        self.i = end;
+        Some(&self.p.vals[start..end])
+    }
+}
diff --git a/userland/nonos_vt/src/parser/advance.rs b/userland/nonos_vt/src/parser/advance.rs
new file mode 100644
index 000000000..2068086f6
--- /dev/null
+++ b/userland/nonos_vt/src/parser/advance.rs
@@ -0,0 +1,62 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! One byte through the machine: the transitions every state shares, then
+//! the state's own.
+
+use super::handler::Handler;
+use super::machine::{Parser, State};
+
+impl Parser {
+    pub fn advance<H: Handler>(&mut self, h: &mut H, b: u8) {
+        match b {
+            // CAN and SUB abandon whatever was being collected.
+            0x18 | 0x1A => {
+                self.flush_utf8(h);
+                h.execute(b);
+                self.state = State::Ground;
+                return;
+            }
+            // ESC ends a string, dispatching it, and starts a new sequence.
+            0x1B => {
+                match self.state {
+                    State::Osc => self.end_osc(h),
+                    State::DcsPass => self.end_dcs(h),
+                    _ => {}
+                }
+                self.flush_utf8(h);
+                self.seq.clear();
+                self.state = State::Escape;
+                return;
+            }
+            _ => {}
+        }
+        match self.state {
+            State::Ground => self.ground(h, b),
+            State::Escape => self.escape(h, b),
+            State::EscapeInter => self.escape_inter(h, b),
+            State::CsiEntry | State::CsiParam | State::CsiInter | State::CsiIgnore => {
+                self.csi_state(h, b)
+            }
+            State::DcsEntry | State::DcsParam | State::DcsInter | State::DcsIgnore => {
+                self.dcs_state(b)
+            }
+            State::DcsPass => self.dcs_pass(b),
+            State::Osc => self.osc_byte(h, b),
+            State::Ignored => {}
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/parser/csi_states.rs b/userland/nonos_vt/src/parser/csi_states.rs
new file mode 100644
index 000000000..e81358d5f
--- /dev/null
+++ b/userland/nonos_vt/src/parser/csi_states.rs
@@ -0,0 +1,57 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Collecting the parameters of a CSI sequence, up to its final byte.
+
+use super::handler::Handler;
+use super::machine::{Parser, State};
+
+impl Parser {
+    pub(super) fn csi_state<H: Handler>(&mut self, h: &mut H, b: u8) {
+        let st = self.state;
+        match b {
+            0x00..=0x1F => h.execute(b),
+            0x7F => {}
+            0x40..=0x7E => {
+                if st != State::CsiIgnore && !self.seq.truncated() {
+                    self.seq.final_byte = b;
+                    h.csi(&self.seq);
+                }
+                self.state = State::Ground;
+            }
+            _ if st == State::CsiIgnore => {}
+            0x30..=0x39 if st != State::CsiInter => {
+                self.seq.params.digit(b - b'0');
+                self.state = State::CsiParam;
+            }
+            b';' | b':' if st != State::CsiInter => {
+                self.seq.params.separator(b == b':');
+                self.state = State::CsiParam;
+            }
+            // A private marker is only a marker as the first byte.
+            0x3C..=0x3F if st == State::CsiEntry => {
+                self.seq.private = b;
+                self.state = State::CsiParam;
+            }
+            0x20..=0x2F => {
+                self.seq.collect(b);
+                self.state = State::CsiInter;
+            }
+            // Anything else out of place: read to the final byte, then drop.
+            _ => self.state = State::CsiIgnore,
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/parser/dcs_states.rs b/userland/nonos_vt/src/parser/dcs_states.rs
new file mode 100644
index 000000000..2db8e5498
--- /dev/null
+++ b/userland/nonos_vt/src/parser/dcs_states.rs
@@ -0,0 +1,50 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Collecting the parameters of a DCS sequence, up to its final byte.
+
+use super::machine::{Parser, State};
+
+impl Parser {
+    pub(super) fn dcs_state(&mut self, b: u8) {
+        let st = self.state;
+        match b {
+            0x00..=0x1F | 0x7F => {}
+            0x40..=0x7E => {
+                self.seq.final_byte = b;
+                self.state = if st == State::DcsIgnore { State::DcsIgnore } else { State::DcsPass };
+            }
+            _ if st == State::DcsIgnore => {}
+            0x30..=0x39 if st != State::DcsInter => {
+                self.seq.params.digit(b - b'0');
+                self.state = State::DcsParam;
+            }
+            b';' | b':' if st != State::DcsInter => {
+                self.seq.params.separator(b == b':');
+                self.state = State::DcsParam;
+            }
+            0x3C..=0x3F if st == State::DcsEntry => {
+                self.seq.private = b;
+                self.state = State::DcsParam;
+            }
+            0x20..=0x2F => {
+                self.seq.collect(b);
+                self.state = State::DcsInter;
+            }
+            _ => self.state = State::DcsIgnore,
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/parser/escape.rs b/userland/nonos_vt/src/parser/escape.rs
new file mode 100644
index 000000000..f6ea1a034
--- /dev/null
+++ b/userland/nonos_vt/src/parser/escape.rs
@@ -0,0 +1,66 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! After ESC: an escape sequence, or the introducer of a longer one.
+
+use super::handler::Handler;
+use super::machine::{Parser, State};
+
+impl Parser {
+    pub(super) fn escape<H: Handler>(&mut self, h: &mut H, b: u8) {
+        match b {
+            0x00..=0x1F => h.execute(b),
+            0x20..=0x2F => {
+                self.seq.collect(b);
+                self.state = State::EscapeInter;
+            }
+            b'[' => self.state = State::CsiEntry,
+            b']' => self.start_string(State::Osc),
+            b'P' => self.start_string(State::DcsEntry),
+            b'X' | b'^' | b'_' => self.state = State::Ignored,
+            0x30..=0x7E => {
+                self.seq.final_byte = b;
+                h.esc(&self.seq);
+                self.state = State::Ground;
+            }
+            0x7F => {}
+            // Bytes past 0x7F are not part of any escape sequence.
+            _ => self.state = State::Ground,
+        }
+    }
+
+    pub(super) fn escape_inter<H: Handler>(&mut self, h: &mut H, b: u8) {
+        match b {
+            0x00..=0x1F => h.execute(b),
+            0x20..=0x2F => self.seq.collect(b),
+            0x30..=0x7E => {
+                self.seq.final_byte = b;
+                if !self.seq.truncated() {
+                    h.esc(&self.seq);
+                }
+                self.state = State::Ground;
+            }
+            0x7F => {}
+            _ => self.state = State::Ground,
+        }
+    }
+
+    pub(super) fn start_string(&mut self, state: State) {
+        self.buf.clear();
+        self.buf_full = false;
+        self.state = state;
+    }
+}
diff --git a/userland/nonos_vt/src/parser/ground.rs b/userland/nonos_vt/src/parser/ground.rs
new file mode 100644
index 000000000..bb6bcf9f9
--- /dev/null
+++ b/userland/nonos_vt/src/parser/ground.rs
@@ -0,0 +1,53 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The ground state: text, as UTF-8, and C0 controls.
+
+use super::handler::Handler;
+use super::machine::Parser;
+use crate::utf8::Step;
+
+impl Parser {
+    /// A character cut short by a control byte is shown as U+FFFD, not lost
+    /// silently and not merged with what follows.
+    pub(super) fn flush_utf8<H: Handler>(&mut self, h: &mut H) {
+        if self.utf8.pending() {
+            self.utf8.reset();
+            h.print(char::REPLACEMENT_CHARACTER);
+        }
+    }
+
+    pub(super) fn ground<H: Handler>(&mut self, h: &mut H, b: u8) {
+        if b < 0x20 {
+            self.flush_utf8(h);
+            h.execute(b);
+            return;
+        }
+        if b == 0x7F {
+            return;
+        }
+        match self.utf8.push(b) {
+            Step::Pending => {}
+            Step::Char(c) => h.print(c),
+            Step::Invalid { again } => {
+                h.print(char::REPLACEMENT_CHARACTER);
+                if again {
+                    self.ground(h, b);
+                }
+            }
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/parser/handler.rs b/userland/nonos_vt/src/parser/handler.rs
new file mode 100644
index 000000000..f080593a1
--- /dev/null
+++ b/userland/nonos_vt/src/parser/handler.rs
@@ -0,0 +1,34 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! What the parser reports as it recognises each piece of the byte stream.
+
+use super::seq::Seq;
+
+pub trait Handler {
+    /// A character to draw.
+    fn print(&mut self, c: char);
+    /// A C0 control byte.
+    fn execute(&mut self, b: u8);
+    /// `ESC [ ... final`.
+    fn csi(&mut self, seq: &Seq);
+    /// `ESC intermediates final`.
+    fn esc(&mut self, seq: &Seq);
+    /// `ESC ] ... BEL` or `ESC ] ... ESC \`.
+    fn osc(&mut self, data: &[u8]);
+    /// `ESC P ... final data ESC \`.
+    fn dcs(&mut self, seq: &Seq, data: &[u8]);
+}
diff --git a/userland/nonos_vt/src/parser/machine.rs b/userland/nonos_vt/src/parser/machine.rs
new file mode 100644
index 000000000..aa9f10206
--- /dev/null
+++ b/userland/nonos_vt/src/parser/machine.rs
@@ -0,0 +1,66 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The parser's states and the transitions every state shares.
+
+use alloc::vec::Vec;
+
+use super::handler::Handler;
+use super::seq::Seq;
+use crate::utf8::Utf8;
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Default)]
+pub(super) enum State {
+    #[default]
+    Ground,
+    Escape,
+    EscapeInter,
+    CsiEntry,
+    CsiParam,
+    CsiInter,
+    CsiIgnore,
+    DcsEntry,
+    DcsParam,
+    DcsInter,
+    DcsPass,
+    DcsIgnore,
+    Osc,
+    /// SOS, PM and APC: read to the terminator and dropped.
+    Ignored,
+}
+
+#[derive(Default)]
+pub struct Parser {
+    pub(super) state: State,
+    pub(super) seq: Seq,
+    pub(super) utf8: Utf8,
+    /// OSC or DCS payload being collected.
+    pub(super) buf: Vec<u8>,
+    /// The payload outgrew its ceiling; it is dropped when it ends.
+    pub(super) buf_full: bool,
+}
+
+impl Parser {
+    pub fn new() -> Parser {
+        Parser::default()
+    }
+
+    pub fn feed<H: Handler>(&mut self, h: &mut H, bytes: &[u8]) {
+        for &b in bytes {
+            self.advance(h, b);
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/parser/mod.rs b/userland/nonos_vt/src/parser/mod.rs
new file mode 100644
index 000000000..7058e38b9
--- /dev/null
+++ b/userland/nonos_vt/src/parser/mod.rs
@@ -0,0 +1,32 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The DEC control-sequence state machine, after Paul Williams' description
+//! of the VT500 parser, with UTF-8 in the ground state.
+
+mod advance;
+mod csi_states;
+mod dcs_states;
+mod escape;
+mod ground;
+mod handler;
+mod machine;
+mod seq;
+mod strings;
+
+pub use handler::Handler;
+pub use machine::Parser;
+pub use seq::Seq;
diff --git a/userland/nonos_vt/src/parser/seq.rs b/userland/nonos_vt/src/parser/seq.rs
new file mode 100644
index 000000000..f8a4ec717
--- /dev/null
+++ b/userland/nonos_vt/src/parser/seq.rs
@@ -0,0 +1,61 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! A control sequence as it was collected: private marker, parameters,
+//! intermediate bytes and the final byte that names it.
+
+use crate::limits::MAX_INTERMEDIATES;
+use crate::params::Params;
+
+#[derive(Clone, Default, Debug)]
+pub struct Seq {
+    /// `?`, `>`, `=` or `<` straight after the introducer, else 0.
+    pub private: u8,
+    pub params: Params,
+    inter: [u8; MAX_INTERMEDIATES],
+    ninter: usize,
+    /// More intermediates than fit; the sequence is ignored.
+    pub overflow: bool,
+    pub final_byte: u8,
+}
+
+impl Seq {
+    pub fn clear(&mut self) {
+        self.private = 0;
+        self.params.clear();
+        self.ninter = 0;
+        self.overflow = false;
+        self.final_byte = 0;
+    }
+
+    pub fn collect(&mut self, b: u8) {
+        if self.ninter < MAX_INTERMEDIATES {
+            self.inter[self.ninter] = b;
+            self.ninter += 1;
+        } else {
+            self.overflow = true;
+        }
+    }
+
+    pub fn inter(&self) -> &[u8] {
+        &self.inter[..self.ninter]
+    }
+
+    /// Whether the sequence carries anything it could not hold whole.
+    pub fn truncated(&self) -> bool {
+        self.overflow || self.params.overflow
+    }
+}
diff --git a/userland/nonos_vt/src/parser/strings.rs b/userland/nonos_vt/src/parser/strings.rs
new file mode 100644
index 000000000..5dda09851
--- /dev/null
+++ b/userland/nonos_vt/src/parser/strings.rs
@@ -0,0 +1,63 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! OSC and DCS payloads: collected up to a ceiling and handed over whole
+//! when they end, or dropped whole when they outgrew it.
+
+use super::handler::Handler;
+use super::machine::{Parser, State};
+use crate::limits::{MAX_DCS, MAX_OSC};
+
+impl Parser {
+    fn keep(&mut self, b: u8, max: usize) {
+        if self.buf.len() < max {
+            self.buf.push(b);
+        } else {
+            self.buf_full = true;
+        }
+    }
+
+    pub(super) fn osc_byte<H: Handler>(&mut self, h: &mut H, b: u8) {
+        match b {
+            0x07 => {
+                self.end_osc(h);
+                self.state = State::Ground;
+            }
+            0x00..=0x1F => {}
+            _ => self.keep(b, MAX_OSC),
+        }
+    }
+
+    pub(super) fn end_osc<H: Handler>(&mut self, h: &mut H) {
+        if !self.buf_full {
+            h.osc(&self.buf);
+        }
+        self.buf.clear();
+    }
+
+    pub(super) fn dcs_pass(&mut self, b: u8) {
+        if b != 0x7F {
+            self.keep(b, MAX_DCS);
+        }
+    }
+
+    pub(super) fn end_dcs<H: Handler>(&mut self, h: &mut H) {
+        if !self.buf_full && !self.seq.truncated() {
+            h.dcs(&self.seq, &self.buf);
+        }
+        self.buf.clear();
+    }
+}
diff --git a/userland/nonos_vt/src/term/abs.rs b/userland/nonos_vt/src/term/abs.rs
new file mode 100644
index 000000000..bb458f362
--- /dev/null
+++ b/userland/nonos_vt/src/term/abs.rs
@@ -0,0 +1,57 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Absolute line numbers: every line the terminal ever had, counted from
+//! its first, so a position in history survives scrolling.
+
+use super::state::Term;
+use super::types::Pos;
+use crate::line::Line;
+
+impl Term {
+    /// The oldest line still held, and the last line of the screen.
+    pub fn first_line(&self) -> u64 {
+        self.scrolled - self.scrollback.len() as u64
+    }
+
+    pub fn last_line(&self) -> u64 {
+        self.scrolled + self.rows as u64 - 1
+    }
+
+    pub fn line_at(&self, abs: u64) -> Option<&Line> {
+        if abs < self.first_line() {
+            return None;
+        }
+        if abs < self.scrolled {
+            return self.scrollback.get((abs - self.first_line()) as usize);
+        }
+        let y = usize::try_from(abs - self.scrolled).ok()?;
+        self.scr_ref().lines.get(y)
+    }
+
+    /// The absolute line shown on visible row `row`.
+    pub fn abs_of_row(&self, row: usize) -> u64 {
+        if self.alt_active {
+            return self.scrolled + row as u64;
+        }
+        (self.scrolled + row as u64).saturating_sub(self.view as u64)
+    }
+
+    pub fn cursor_pos(&self) -> Pos {
+        let s = self.scr_ref();
+        Pos { line: self.scrolled + s.cur.y as u64, col: s.cur.x }
+    }
+}
diff --git a/userland/nonos_vt/src/term/alt.rs b/userland/nonos_vt/src/term/alt.rs
new file mode 100644
index 000000000..9a4a43c42
--- /dev/null
+++ b/userland/nonos_vt/src/term/alt.rs
@@ -0,0 +1,59 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The alternate screen full-screen programs draw on, which leaves the
+//! normal screen and its history untouched underneath.
+
+use super::state::Term;
+
+impl Term {
+    /// Switch to the alternate screen. The cursor carries over, as the two
+    /// screens share one in xterm.
+    pub(super) fn enter_alt(&mut self, clear: bool) {
+        if !self.alt_active {
+            self.alt.cur = self.primary.cur;
+            self.alt.reset_region();
+            self.alt_active = true;
+            self.view = 0;
+        }
+        if clear {
+            let blank = self.alt.blank();
+            for line in self.alt.lines.iter_mut() {
+                line.clear(blank);
+            }
+        }
+        self.touch_all();
+    }
+
+    pub(super) fn leave_alt(&mut self, clear_first: bool) {
+        if !self.alt_active {
+            return;
+        }
+        if clear_first {
+            let blank = self.alt.blank();
+            for line in self.alt.lines.iter_mut() {
+                line.clear(blank);
+            }
+        }
+        self.primary.cur = self.alt.cur;
+        self.alt_active = false;
+        self.touch_all();
+    }
+
+    pub fn alt_active(&self) -> bool {
+        self.alt_active
+    }
+}
diff --git a/userland/nonos_vt/src/term/answer/dcs.rs b/userland/nonos_vt/src/term/answer/dcs.rs
new file mode 100644
index 000000000..a0999fc06
--- /dev/null
+++ b/userland/nonos_vt/src/term/answer/dcs.rs
@@ -0,0 +1,58 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! DCS requests: DECRQSS for a setting, and XTGETTCAP for terminfo
+//! capabilities. Editors ask these at start-up and wait for an answer, so
+//! each is answered, as unknown when it is.
+
+use crate::parser::Seq;
+use crate::term::state::Term;
+use crate::term::types::CursorShape;
+
+impl Term {
+    pub(in crate::term) fn dcs_dispatch(&mut self, seq: &Seq, data: &[u8]) {
+        match (seq.private, seq.inter(), seq.final_byte) {
+            (0, [b'$'], b'q') => self.decrqss(data),
+            (0, [b'+'], b'q') => self.xtgettcap(data),
+            _ => {}
+        }
+    }
+
+    fn decrqss(&mut self, what: &[u8]) {
+        let answer = match what {
+            b"r" => {
+                let s = self.scr_ref();
+                Some(alloc::format!("{};{}r", s.top + 1, s.bot + 1))
+            }
+            b" q" => {
+                let n = match (self.cursor_shape, self.modes.cursor_blink) {
+                    (CursorShape::Block, true) => 1,
+                    (CursorShape::Block, false) => 2,
+                    (CursorShape::Underline, true) => 3,
+                    (CursorShape::Underline, false) => 4,
+                    (CursorShape::Bar, true) => 5,
+                    (CursorShape::Bar, false) => 6,
+                };
+                Some(alloc::format!("{n} q"))
+            }
+            _ => None,
+        };
+        match answer {
+            Some(a) => self.reply_fmt(format_args!("\x1bP1$r{a}\x1b\\")),
+            None => self.reply(b"\x1bP0$r\x1b\\"),
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/answer/mod.rs b/userland/nonos_vt/src/term/answer/mod.rs
new file mode 100644
index 000000000..eff396953
--- /dev/null
+++ b/userland/nonos_vt/src/term/answer/mod.rs
@@ -0,0 +1,25 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Answers to what a program asks: identity, cursor position, modes, size
+//! and terminfo. Many programs wait for these, so an unanswered question
+//! can hang them.
+
+mod dcs;
+mod reply;
+mod report;
+mod tcap;
+mod winops;
diff --git a/userland/nonos_vt/src/term/answer/reply.rs b/userland/nonos_vt/src/term/answer/reply.rs
new file mode 100644
index 000000000..6f1a07ab5
--- /dev/null
+++ b/userland/nonos_vt/src/term/answer/reply.rs
@@ -0,0 +1,44 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The answers queued for the host to write back to the program.
+
+use crate::limits::MAX_REPLY;
+use crate::out::Out;
+use crate::term::state::Term;
+use alloc::vec::Vec;
+use core::fmt::Write;
+
+impl Term {
+    /// Queue an answer. A program that never reads cannot grow the queue
+    /// past its ceiling; the answer that would is dropped whole.
+    pub(in crate::term) fn reply(&mut self, bytes: &[u8]) {
+        if self.replies.len() + bytes.len() <= MAX_REPLY {
+            self.replies.extend_from_slice(bytes);
+        }
+    }
+
+    pub(in crate::term) fn reply_fmt(&mut self, args: core::fmt::Arguments) {
+        let mut buf = Vec::new();
+        let _ = Out(&mut buf).write_fmt(args);
+        self.reply(&buf);
+    }
+
+    /// Bytes the host must write back to the program, oldest first.
+    pub fn take_replies(&mut self) -> Vec<u8> {
+        core::mem::take(&mut self.replies)
+    }
+}
diff --git a/userland/nonos_vt/src/term/answer/report.rs b/userland/nonos_vt/src/term/answer/report.rs
new file mode 100644
index 000000000..9610eced0
--- /dev/null
+++ b/userland/nonos_vt/src/term/answer/report.rs
@@ -0,0 +1,64 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Answers to what a program asks: identity, cursor position, modes and
+//! size. Many programs wait for these, so an unanswered question can hang
+//! them. Answers queue for the host to write back to the program.
+
+use crate::term::state::Term;
+
+impl Term {
+    /// DA1: a VT220 with ANSI colour.
+    pub(in crate::term) fn reply_da1(&mut self) {
+        self.reply(b"\x1b[?62;22c");
+    }
+
+    /// DA2: terminal type 1, version 10.
+    pub(in crate::term) fn reply_da2(&mut self) {
+        self.reply(b"\x1b[>1;10;0c");
+    }
+
+    pub(in crate::term) fn reply_version(&mut self) {
+        self.reply(b"\x1bP>|NONOS vt 0.1\x1b\\");
+    }
+
+    /// DSR 5 is status, DSR 6 the cursor position, 1-based and counted from
+    /// the region in origin mode.
+    pub(in crate::term) fn reply_status(&mut self, what: u16, dec: bool) {
+        match what {
+            5 if !dec => self.reply(b"\x1b[0n"),
+            6 => {
+                let s = self.scr_ref();
+                let top = if self.modes.origin { s.top } else { 0 };
+                let (row, col) = (s.cur.y - top.min(s.cur.y) + 1, s.cur.x + 1);
+                let q = if dec { "?" } else { "" };
+                self.reply_fmt(format_args!("\x1b[{q}{row};{col}R"));
+            }
+            _ => {}
+        }
+    }
+
+    /// DECRQM: 1 set, 2 reset, 0 not recognised.
+    pub(in crate::term) fn reply_mode(&mut self, mode: u16, dec: bool) {
+        let v = match self.mode_state(mode, dec) {
+            Some(true) => 1,
+            Some(false) => 2,
+            None => 0,
+        };
+        let q = if dec { "?" } else { "" };
+        self.reply_fmt(format_args!("\x1b[{q}{mode};{v}$y"));
+    }
+}
diff --git a/userland/nonos_vt/src/term/answer/tcap.rs b/userland/nonos_vt/src/term/answer/tcap.rs
new file mode 100644
index 000000000..d01aa042b
--- /dev/null
+++ b/userland/nonos_vt/src/term/answer/tcap.rs
@@ -0,0 +1,57 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! XTGETTCAP: terminfo capabilities by name, hex encoded both ways.
+
+use alloc::string::String;
+use alloc::vec::Vec;
+
+use crate::term::state::Term;
+
+fn hex_decode(s: &[u8]) -> Option<Vec<u8>> {
+    if !s.len().is_multiple_of(2) {
+        return None;
+    }
+    let digit = |c: u8| (c as char).to_digit(16);
+    s.chunks(2).map(|p| Some((digit(p[0])? * 16 + digit(p[1])?) as u8)).collect()
+}
+
+fn hex_encode(b: &[u8]) -> String {
+    const H: &[u8; 16] = b"0123456789ABCDEF";
+    b.iter().flat_map(|&x| [H[(x >> 4) as usize] as char, H[(x & 15) as usize] as char]).collect()
+}
+
+impl Term {
+    pub(in crate::term) fn xtgettcap(&mut self, data: &[u8]) {
+        for name in data.split(|&b| b == b';') {
+            let Some(cap) = hex_decode(name) else { continue };
+            let value: Option<&[u8]> = match cap.as_slice() {
+                b"TN" | b"name" => Some(b"xterm-256color"),
+                b"Co" | b"colors" => Some(b"256"),
+                b"RGB" => Some(b"8/8/8"),
+                _ => None,
+            };
+            let n = hex_encode(&cap);
+            match value {
+                Some(v) => {
+                    let v = hex_encode(v);
+                    self.reply_fmt(format_args!("\x1bP1+r{n}={v}\x1b\\"));
+                }
+                None => self.reply_fmt(format_args!("\x1bP0+r{n}\x1b\\")),
+            }
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/answer/winops.rs b/userland/nonos_vt/src/term/answer/winops.rs
new file mode 100644
index 000000000..bcc7ba047
--- /dev/null
+++ b/userland/nonos_vt/src/term/answer/winops.rs
@@ -0,0 +1,42 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! XTWINOPS: only size reports and the title stack.
+
+use crate::params::Params;
+use crate::term::state::Term;
+
+impl Term {
+    /// XTWINOPS. Only size reports and the title stack: a program may not
+    /// move, resize, raise or iconify the window it runs in.
+    pub(in crate::term) fn window_op(&mut self, p: &Params) {
+        let (w, h) = self.cell_px;
+        match p.get(0) {
+            14 if w > 0 => {
+                let (pw, ph) = (w as usize * self.cols, h as usize * self.rows);
+                self.reply_fmt(format_args!("\x1b[4;{ph};{pw}t"));
+            }
+            16 if w > 0 => self.reply_fmt(format_args!("\x1b[6;{h};{w}t")),
+            18 => {
+                let (rows, cols) = (self.rows, self.cols);
+                self.reply_fmt(format_args!("\x1b[8;{rows};{cols}t"));
+            }
+            22 => self.push_title(),
+            23 => self.pop_title(),
+            _ => {}
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/control.rs b/userland/nonos_vt/src/term/control.rs
new file mode 100644
index 000000000..2f809efd5
--- /dev/null
+++ b/userland/nonos_vt/src/term/control.rs
@@ -0,0 +1,54 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! C0 control bytes, and the line movements they share with ESC sequences.
+
+use super::state::Term;
+
+impl Term {
+    pub(super) fn control(&mut self, b: u8) {
+        match b {
+            0x07 => self.bell = self.bell.saturating_add(1),
+            0x08 => self.backspace(),
+            0x09 => self.tab_forward(1),
+            0x0A..=0x0C => {
+                if self.modes.newline {
+                    self.carriage_return();
+                }
+                self.index();
+            }
+            0x0D => self.carriage_return(),
+            0x0E => self.charsets.gl = 1,
+            0x0F => self.charsets.gl = 0,
+            _ => {}
+        }
+    }
+
+    fn backspace(&mut self) {
+        let cur = &mut self.scr().cur;
+        if cur.pending_wrap {
+            cur.pending_wrap = false;
+        } else {
+            cur.x = cur.x.saturating_sub(1);
+        }
+    }
+
+    pub(super) fn carriage_return(&mut self) {
+        let cur = &mut self.scr().cur;
+        cur.x = 0;
+        cur.pending_wrap = false;
+    }
+}
diff --git a/userland/nonos_vt/src/term/csi.rs b/userland/nonos_vt/src/term/csi.rs
new file mode 100644
index 000000000..603f0d55d
--- /dev/null
+++ b/userland/nonos_vt/src/term/csi.rs
@@ -0,0 +1,72 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! `ESC [` sequences, routed by private marker, intermediates and final.
+
+use super::state::Term;
+use crate::parser::Seq;
+
+impl Term {
+    pub(super) fn csi_dispatch(&mut self, seq: &Seq) {
+        let p = &seq.params;
+        let n = |d: u16| p.count(0, d) as usize;
+        match (seq.private, seq.inter(), seq.final_byte) {
+            (0, [], b'@') => self.insert_chars(n(1)),
+            (0, [], b'A') => self.cursor_up(n(1)),
+            (0, [], b'B') | (0, [], b'e') => self.cursor_down(n(1)),
+            (0, [], b'C') | (0, [], b'a') => self.cursor_forward(n(1)),
+            (0, [], b'D') => self.cursor_back(n(1)),
+            (0, [], b'E') => self.cursor_line(n(1), true),
+            (0, [], b'F') => self.cursor_line(n(1), false),
+            (0, [], b'G') | (0, [], b'`') => self.cursor_column(n(1)),
+            (0, [], b'H') | (0, [], b'f') => {
+                self.cursor_to(p.count(0, 1) as usize, p.count(1, 1) as usize)
+            }
+            (0, [], b'I') => self.tab_forward(n(1)),
+            (0 | b'?', [], b'J') => self.erase_display(p.get(0)),
+            (0 | b'?', [], b'K') => self.erase_in_line(p.get(0)),
+            (0, [], b'L') => self.insert_lines(n(1)),
+            (0, [], b'M') => self.delete_lines(n(1)),
+            (0, [], b'P') => self.delete_chars(n(1)),
+            (0, [], b'S') => self.scroll_up(n(1)),
+            // Five parameters make it xterm's mouse highlight, not a scroll.
+            (0, [], b'T') if p.len() <= 1 => self.scroll_down(n(1)),
+            (0, [], b'X') => self.erase_chars(n(1)),
+            (0, [], b'Z') => self.tab_back(n(1)),
+            (0, [], b'b') => self.repeat_last(n(1)),
+            (0, [], b'c') if p.get(0) == 0 => self.reply_da1(),
+            (b'>', [], b'c') if p.get(0) == 0 => self.reply_da2(),
+            (0, [], b'd') => self.cursor_row(n(1)),
+            (0, [], b'g') => self.clear_tabs(p.get(0)),
+            (0, [], b'h') => self.set_ansi_modes(p, true),
+            (0, [], b'l') => self.set_ansi_modes(p, false),
+            (b'?', [], b'h') => self.set_dec_modes(p, true),
+            (b'?', [], b'l') => self.set_dec_modes(p, false),
+            (0, [], b'm') => self.sgr(p),
+            (0, [], b'n') => self.reply_status(p.get(0), false),
+            (b'?', [], b'n') => self.reply_status(p.get(0), true),
+            (0, [], b'r') => self.set_region(p.count(0, 1) as usize, p.count(1, 0) as usize),
+            (0, [], b's') => self.save_cursor(),
+            (0, [], b't') => self.window_op(p),
+            (0, [], b'u') => self.restore_cursor(),
+            (b'>', [], b'q') if p.get(0) == 0 => self.reply_version(),
+            (0 | b'?', [b'$'], b'p') => self.reply_mode(p.get(0), seq.private == b'?'),
+            (0, [b' '], b'q') => self.set_cursor_style(p.get(0)),
+            (0, [b'!'], b'p') => self.soft_reset(),
+            _ => {}
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/csi_move.rs b/userland/nonos_vt/src/term/csi_move.rs
new file mode 100644
index 000000000..d21be3444
--- /dev/null
+++ b/userland/nonos_vt/src/term/csi_move.rs
@@ -0,0 +1,67 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Cursor movement. Every move cancels a pending wrap. Relative moves stop
+//! at the scroll region's edges when they start inside it, and absolute
+//! rows count from the region when origin mode is on.
+
+use super::state::Term;
+
+impl Term {
+    pub(super) fn moved(&mut self, x: usize, y: usize) {
+        let (cols, rows) = (self.cols, self.rows);
+        let cur = &mut self.scr().cur;
+        cur.x = x.min(cols - 1);
+        cur.y = y.min(rows - 1);
+        cur.pending_wrap = false;
+    }
+
+    pub(super) fn cursor_up(&mut self, n: usize) {
+        let s = self.scr_ref();
+        let floor = if s.cur.y >= s.top { s.top } else { 0 };
+        let (x, y) = (s.cur.x, s.cur.y.saturating_sub(n).max(floor));
+        self.moved(x, y);
+    }
+
+    pub(super) fn cursor_down(&mut self, n: usize) {
+        let s = self.scr_ref();
+        let ceil = if s.cur.y <= s.bot { s.bot } else { self.rows - 1 };
+        let (x, y) = (s.cur.x, s.cur.y.saturating_add(n).min(ceil));
+        self.moved(x, y);
+    }
+
+    pub(super) fn cursor_forward(&mut self, n: usize) {
+        let s = self.scr_ref();
+        let (x, y) = (s.cur.x.saturating_add(n), s.cur.y);
+        self.moved(x, y);
+    }
+
+    pub(super) fn cursor_back(&mut self, n: usize) {
+        let s = self.scr_ref();
+        let (x, y) = (s.cur.x.saturating_sub(n), s.cur.y);
+        self.moved(x, y);
+    }
+
+    /// CNL and CPL: down or up `n` lines, to the first column.
+    pub(super) fn cursor_line(&mut self, n: usize, down: bool) {
+        if down {
+            self.cursor_down(n);
+        } else {
+            self.cursor_up(n);
+        }
+        self.carriage_return();
+    }
+}
diff --git a/userland/nonos_vt/src/term/csi_place.rs b/userland/nonos_vt/src/term/csi_place.rs
new file mode 100644
index 000000000..23728165d
--- /dev/null
+++ b/userland/nonos_vt/src/term/csi_place.rs
@@ -0,0 +1,67 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Absolute cursor positions and the scroll region, counted from the
+//! region in origin mode.
+
+use super::state::Term;
+
+impl Term {
+    /// CHA and HPA, 1-based.
+    pub(super) fn cursor_column(&mut self, col: usize) {
+        let y = self.scr_ref().cur.y;
+        self.moved(col.saturating_sub(1), y);
+    }
+
+    /// VPA, 1-based.
+    pub(super) fn cursor_row(&mut self, row: usize) {
+        let x = self.scr_ref().cur.x;
+        let y = self.origin_row(row);
+        self.moved(x, y);
+    }
+
+    /// CUP, 1-based.
+    pub(super) fn cursor_to(&mut self, row: usize, col: usize) {
+        let y = self.origin_row(row);
+        self.moved(col.saturating_sub(1), y);
+    }
+
+    pub(super) fn origin_row(&self, row: usize) -> usize {
+        let s = self.scr_ref();
+        let r = row.saturating_sub(1);
+        if self.modes.origin {
+            s.top.saturating_add(r).min(s.bot)
+        } else {
+            r
+        }
+    }
+
+    /// DECSTBM, 1-based and inclusive; 0 for the bottom means the last row.
+    /// An impossible region is ignored, as xterm ignores it.
+    pub(super) fn set_region(&mut self, top: usize, bot: usize) {
+        let rows = self.rows;
+        let bot = if bot == 0 { rows } else { bot.min(rows) };
+        let top = top.max(1);
+        if top >= bot {
+            return;
+        }
+        let scr = self.scr();
+        scr.top = top - 1;
+        scr.bot = bot - 1;
+        let home = if self.modes.origin { top - 1 } else { 0 };
+        self.moved(0, home);
+    }
+}
diff --git a/userland/nonos_vt/src/term/cursor_style.rs b/userland/nonos_vt/src/term/cursor_style.rs
new file mode 100644
index 000000000..77d4909bc
--- /dev/null
+++ b/userland/nonos_vt/src/term/cursor_style.rs
@@ -0,0 +1,40 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! DECSCUSR: the cursor shape and whether it blinks.
+
+use super::state::Term;
+use super::types::CursorShape;
+
+impl Term {
+    /// DECSCUSR: 0 and 1 blinking block, 2 steady block, 3 and 4 underline,
+    /// 5 and 6 bar, odd numbers blinking.
+    pub(super) fn set_cursor_style(&mut self, v: u16) {
+        let (shape, blink) = match v {
+            0 | 1 => (CursorShape::Block, true),
+            2 => (CursorShape::Block, false),
+            3 => (CursorShape::Underline, true),
+            4 => (CursorShape::Underline, false),
+            5 => (CursorShape::Bar, true),
+            6 => (CursorShape::Bar, false),
+            _ => return,
+        };
+        self.cursor_shape = shape;
+        self.modes.cursor_blink = blink;
+        let y = self.scr_ref().cur.y;
+        self.touch(y);
+    }
+}
diff --git a/userland/nonos_vt/src/term/edit.rs b/userland/nonos_vt/src/term/edit.rs
new file mode 100644
index 000000000..d07c0922d
--- /dev/null
+++ b/userland/nonos_vt/src/term/edit.rs
@@ -0,0 +1,66 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Inserting and deleting characters and lines in place.
+
+use super::state::Term;
+use crate::limits::MAX_REPEAT;
+use crate::width::width;
+
+impl Term {
+    pub(super) fn insert_chars(&mut self, n: usize) {
+        let scr = self.scr();
+        let (x, y) = (scr.cur.x, scr.cur.y);
+        let blank = scr.blank();
+        scr.lines[y].insert_blanks(x, n, blank);
+        scr.cur.pending_wrap = false;
+        self.touch(y);
+    }
+
+    pub(super) fn delete_chars(&mut self, n: usize) {
+        let scr = self.scr();
+        let (x, y) = (scr.cur.x, scr.cur.y);
+        let blank = scr.blank();
+        scr.lines[y].delete_cells(x, n, blank);
+        scr.cur.pending_wrap = false;
+        self.touch(y);
+    }
+
+    /// ECH: blank `n` cells from the cursor without moving anything.
+    pub(super) fn erase_chars(&mut self, n: usize) {
+        let scr = self.scr();
+        let (x, y) = (scr.cur.x, scr.cur.y);
+        let blank = scr.blank();
+        let end = x.saturating_add(n);
+        scr.lines[y].erase(x, end, blank);
+        scr.cur.pending_wrap = false;
+        self.touch(y);
+    }
+
+    /// REP: print the last character `n` more times. A screen's worth is
+    /// the most that can show, so more is not done.
+    pub(super) fn repeat_last(&mut self, n: usize) {
+        let Some(c) = self.last_char else { return };
+        let w = width(c);
+        if w == 0 {
+            return;
+        }
+        let n = n.min(MAX_REPEAT).min(self.cols * self.rows);
+        for _ in 0..n {
+            self.put_glyph(c, w);
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/erase.rs b/userland/nonos_vt/src/term/erase.rs
new file mode 100644
index 000000000..346308f43
--- /dev/null
+++ b/userland/nonos_vt/src/term/erase.rs
@@ -0,0 +1,73 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! ED and EL. Erasing never moves the cursor, and erased cells keep the
+//! pen's background, as xterm erases.
+
+use super::state::Term;
+
+impl Term {
+    pub(super) fn erase_in_line(&mut self, mode: u16) {
+        let cols = self.cols;
+        let scr = self.scr();
+        let (x, y) = (scr.cur.x, scr.cur.y);
+        let blank = scr.blank();
+        let line = &mut scr.lines[y];
+        match mode {
+            0 => {
+                line.erase(x, cols, blank);
+                line.wrapped = false;
+            }
+            1 => line.erase(0, x + 1, blank),
+            2 => line.clear(blank),
+            _ => return,
+        }
+        self.touch(y);
+    }
+
+    pub(super) fn erase_display(&mut self, mode: u16) {
+        let (cols, rows) = (self.cols, self.rows);
+        let scr = self.scr();
+        let (x, y) = (scr.cur.x, scr.cur.y);
+        let blank = scr.blank();
+        match mode {
+            0 => {
+                scr.lines[y].erase(x, cols, blank);
+                scr.lines[y].wrapped = false;
+                for line in &mut scr.lines[y + 1..rows] {
+                    line.clear(blank);
+                }
+            }
+            1 => {
+                for line in &mut scr.lines[..y] {
+                    line.clear(blank);
+                }
+                scr.lines[y].erase(0, x + 1, blank);
+            }
+            2 => {
+                for line in scr.lines.iter_mut() {
+                    line.clear(blank);
+                }
+            }
+            3 => {
+                self.clear_history();
+                return;
+            }
+            _ => return,
+        }
+        self.touch_all();
+    }
+}
diff --git a/userland/nonos_vt/src/term/esc.rs b/userland/nonos_vt/src/term/esc.rs
new file mode 100644
index 000000000..e9002e00a
--- /dev/null
+++ b/userland/nonos_vt/src/term/esc.rs
@@ -0,0 +1,66 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! `ESC` sequences that are not CSI, OSC or DCS.
+
+use super::state::Term;
+use crate::charset::designate;
+use crate::parser::Seq;
+
+impl Term {
+    pub(super) fn esc_dispatch(&mut self, seq: &Seq) {
+        let f = seq.final_byte;
+        match seq.inter() {
+            [] => match f {
+                b'7' => self.save_cursor(),
+                b'8' => self.restore_cursor(),
+                b'D' => self.index(),
+                b'E' => {
+                    self.carriage_return();
+                    self.index();
+                }
+                b'H' => self.set_tab(),
+                b'M' => self.reverse_index(),
+                b'c' => self.full_reset(),
+                b'=' => self.modes.keypad = true,
+                b'>' => self.modes.keypad = false,
+                b'N' => self.charsets.single = Some(2),
+                b'O' => self.charsets.single = Some(3),
+                b'Z' => self.reply_da1(),
+                _ => {}
+            },
+            [b'('] => self.charsets.g[0] = designate(f),
+            [b')'] => self.charsets.g[1] = designate(f),
+            [b'*'] => self.charsets.g[2] = designate(f),
+            [b'+'] => self.charsets.g[3] = designate(f),
+            [b'#'] if f == b'8' => self.align_test(),
+            _ => {}
+        }
+    }
+
+    /// DECALN: fill the screen with `E`, for lining up a display.
+    fn align_test(&mut self) {
+        let scr = self.scr();
+        for line in scr.lines.iter_mut() {
+            line.clear(crate::cell::Cell { ch: 'E', ..crate::cell::Cell::BLANK });
+        }
+        scr.reset_region();
+        scr.cur.x = 0;
+        scr.cur.y = 0;
+        scr.cur.pending_wrap = false;
+        self.touch_all();
+    }
+}
diff --git a/userland/nonos_vt/src/term/feed.rs b/userland/nonos_vt/src/term/feed.rs
new file mode 100644
index 000000000..eeb368781
--- /dev/null
+++ b/userland/nonos_vt/src/term/feed.rs
@@ -0,0 +1,60 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Bytes from the program in, through the parser, onto the screen.
+
+use super::screen::Screen;
+use super::state::Term;
+
+impl Term {
+    pub fn feed(&mut self, bytes: &[u8]) {
+        /*
+         * The parser is held outside the terminal while it runs, so it can
+         * hand the terminal to itself as the handler.
+         */
+        let mut parser = core::mem::take(&mut self.parser);
+        parser.feed(self, bytes);
+        self.parser = parser;
+    }
+
+    pub(super) fn scr(&mut self) -> &mut Screen {
+        if self.alt_active {
+            &mut self.alt
+        } else {
+            &mut self.primary
+        }
+    }
+
+    pub(super) fn scr_ref(&self) -> &Screen {
+        if self.alt_active {
+            &self.alt
+        } else {
+            &self.primary
+        }
+    }
+
+    pub(super) fn touch(&mut self, y: usize) {
+        if let Some(d) = self.dirty.get_mut(y) {
+            *d = true;
+        }
+    }
+
+    pub(super) fn touch_all(&mut self) {
+        for d in self.dirty.iter_mut() {
+            *d = true;
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/glyph.rs b/userland/nonos_vt/src/term/glyph.rs
new file mode 100644
index 000000000..81cd49432
--- /dev/null
+++ b/userland/nonos_vt/src/term/glyph.rs
@@ -0,0 +1,72 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Putting a character into cells at the cursor, wrapping first when the
+//! last column was already written.
+
+use super::state::Term;
+use crate::cell::{attr, Cell};
+
+impl Term {
+    pub(super) fn put_glyph(&mut self, c: char, w: usize) {
+        let cols = self.cols;
+        let autowrap = self.modes.autowrap;
+        if self.scr_ref().cur.pending_wrap {
+            self.scr().cur.pending_wrap = false;
+            self.wrap_to_next_line();
+        }
+        /*
+         * A wide character never straddles the edge: it wraps whole, or is
+         * dropped when wrapping is off.
+         */
+        if w == 2 && self.scr_ref().cur.x + 1 >= cols {
+            if !autowrap {
+                return;
+            }
+            self.wrap_to_next_line();
+        }
+        let insert = self.modes.insert;
+        let scr = self.scr();
+        let (x, y, pen) = (scr.cur.x, scr.cur.y, scr.cur.pen);
+        let blank = scr.blank();
+        let line = &mut scr.lines[y];
+        if insert {
+            line.insert_blanks(x, w, blank);
+        }
+        let base = Cell {
+            ch: c,
+            fg: pen.fg,
+            bg: pen.bg,
+            attr: pen.attr & attr::PEN,
+            link: pen.link,
+            mark: 0,
+        };
+        if w == 2 {
+            let head = Cell { attr: base.attr | attr::WIDE, ..base };
+            let tail = Cell { ch: ' ', attr: base.attr | attr::WIDE_TAIL, ..base };
+            line.put_pair(x, head, tail);
+        } else {
+            line.put(x, base);
+        }
+        if x + w >= cols {
+            scr.cur.x = cols - 1;
+            scr.cur.pending_wrap = autowrap;
+        } else {
+            scr.cur.x = x + w;
+        }
+        self.touch(y);
+    }
+}
diff --git a/userland/nonos_vt/src/term/handler.rs b/userland/nonos_vt/src/term/handler.rs
new file mode 100644
index 000000000..cf1cff7e1
--- /dev/null
+++ b/userland/nonos_vt/src/term/handler.rs
@@ -0,0 +1,47 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The parser's reports, each routed to the part of the terminal that acts
+//! on it.
+
+use super::state::Term;
+use crate::parser::{Handler, Seq};
+
+impl Handler for Term {
+    fn print(&mut self, c: char) {
+        self.print_char(c);
+    }
+
+    fn execute(&mut self, b: u8) {
+        self.control(b);
+    }
+
+    fn csi(&mut self, seq: &Seq) {
+        self.csi_dispatch(seq);
+    }
+
+    fn esc(&mut self, seq: &Seq) {
+        self.esc_dispatch(seq);
+    }
+
+    fn osc(&mut self, data: &[u8]) {
+        self.osc_dispatch(data);
+    }
+
+    fn dcs(&mut self, seq: &Seq, data: &[u8]) {
+        self.dcs_dispatch(seq, data);
+    }
+}
diff --git a/userland/nonos_vt/src/term/history.rs b/userland/nonos_vt/src/term/history.rs
new file mode 100644
index 000000000..174020db1
--- /dev/null
+++ b/userland/nonos_vt/src/term/history.rs
@@ -0,0 +1,49 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Scrollback: lines that left the top of the normal screen.
+
+use super::state::Term;
+use crate::line::Line;
+
+impl Term {
+    pub(super) fn push_history(&mut self, mut line: Line) {
+        self.scrolled = self.scrolled.saturating_add(1);
+        if self.scrollback_limit == 0 {
+            return;
+        }
+        line.trim();
+        if self.scrollback.len() >= self.scrollback_limit {
+            self.scrollback.pop_front();
+        }
+        self.scrollback.push_back(line);
+        if self.view > 0 {
+            /*
+             * Someone reading history keeps reading the same lines while
+             * output arrives below them.
+             */
+            self.view = (self.view + 1).min(self.scrollback.len());
+        }
+    }
+
+    /// CSI 3 J: forget the scrollback.
+    pub(super) fn clear_history(&mut self) {
+        self.scrollback.clear();
+        self.view = 0;
+        self.prompts.clear();
+        self.touch_all();
+    }
+}
diff --git a/userland/nonos_vt/src/term/index.rs b/userland/nonos_vt/src/term/index.rs
new file mode 100644
index 000000000..0661aa802
--- /dev/null
+++ b/userland/nonos_vt/src/term/index.rs
@@ -0,0 +1,53 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Moving down or up a line, scrolling the region at its edge.
+
+use super::state::Term;
+
+impl Term {
+    /// Down a line, scrolling the region when the cursor is at its foot.
+    pub(super) fn index(&mut self) {
+        let rows = self.rows;
+        let scr = self.scr();
+        scr.cur.pending_wrap = false;
+        if scr.cur.y == scr.bot {
+            self.scroll_up(1);
+        } else if scr.cur.y + 1 < rows {
+            scr.cur.y += 1;
+        }
+    }
+
+    /// Up a line, scrolling the region down when the cursor is at its top.
+    pub(super) fn reverse_index(&mut self) {
+        let scr = self.scr();
+        scr.cur.pending_wrap = false;
+        if scr.cur.y == scr.top {
+            self.scroll_down(1);
+        } else if scr.cur.y > 0 {
+            scr.cur.y -= 1;
+        }
+    }
+
+    /// Carry on at the start of the next line, marking this one as running
+    /// on so copying and re-wrapping join them.
+    pub(super) fn wrap_to_next_line(&mut self) {
+        let y = self.scr_ref().cur.y;
+        self.scr().lines[y].wrapped = true;
+        self.scr().cur.x = 0;
+        self.index();
+    }
+}
diff --git a/userland/nonos_vt/src/term/join.rs b/userland/nonos_vt/src/term/join.rs
new file mode 100644
index 000000000..6f367d53a
--- /dev/null
+++ b/userland/nonos_vt/src/term/join.rs
@@ -0,0 +1,49 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Drawing a mark over the character before it rather than in a cell of
+//! its own.
+
+use super::state::Term;
+use crate::cell::Cell;
+
+impl Term {
+    /// The cell the last character went into.
+    pub(super) fn prev_x(&self) -> Option<usize> {
+        let cur = self.scr_ref().cur;
+        let x = if cur.pending_wrap { cur.x } else { cur.x.checked_sub(1)? };
+        let line = &self.scr_ref().lines[cur.y];
+        if line.cell(x).is_tail() {
+            x.checked_sub(1)
+        } else {
+            Some(x)
+        }
+    }
+
+    pub(super) fn prev_cell(&self) -> Option<Cell> {
+        let x = self.prev_x()?;
+        let y = self.scr_ref().cur.y;
+        Some(self.scr_ref().lines[y].cell(x))
+    }
+
+    pub(super) fn attach_mark(&mut self, c: char) -> bool {
+        let Some(x) = self.prev_x() else { return false };
+        let y = self.scr_ref().cur.y;
+        let ok = self.scr().lines[y].add_mark(x, c);
+        self.touch(y);
+        ok
+    }
+}
diff --git a/userland/nonos_vt/src/term/lines.rs b/userland/nonos_vt/src/term/lines.rs
new file mode 100644
index 000000000..a112e377c
--- /dev/null
+++ b/userland/nonos_vt/src/term/lines.rs
@@ -0,0 +1,63 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Inserting and deleting whole lines inside the scroll region.
+
+use super::state::Term;
+
+impl Term {
+    /// IL: open `n` blank lines at the cursor's row, pushing the rest of the
+    /// region down and off its foot. Outside the region it does nothing.
+    pub(super) fn insert_lines(&mut self, n: usize) {
+        let scr = self.scr();
+        let (y, top, bot) = (scr.cur.y, scr.top, scr.bot);
+        if y < top || y > bot {
+            return;
+        }
+        let n = n.min(bot + 1 - y);
+        let blank = scr.blank();
+        scr.lines[y..=bot].rotate_right(n);
+        for line in &mut scr.lines[y..y + n] {
+            line.clear(blank);
+        }
+        scr.cur.x = 0;
+        scr.cur.pending_wrap = false;
+        for r in y..=bot {
+            self.touch(r);
+        }
+    }
+
+    /// DL: remove `n` lines at the cursor's row, pulling the rest of the
+    /// region up and blanking its foot.
+    pub(super) fn delete_lines(&mut self, n: usize) {
+        let scr = self.scr();
+        let (y, top, bot) = (scr.cur.y, scr.top, scr.bot);
+        if y < top || y > bot {
+            return;
+        }
+        let n = n.min(bot + 1 - y);
+        let blank = scr.blank();
+        scr.lines[y..=bot].rotate_left(n);
+        for line in &mut scr.lines[bot + 1 - n..=bot] {
+            line.clear(blank);
+        }
+        scr.cur.x = 0;
+        scr.cur.pending_wrap = false;
+        for r in y..=bot {
+            self.touch(r);
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/logical.rs b/userland/nonos_vt/src/term/logical.rs
new file mode 100644
index 000000000..37c3a4e0c
--- /dev/null
+++ b/userland/nonos_vt/src/term/logical.rs
@@ -0,0 +1,44 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! A logical line: the physical lines one run of text wrapped across.
+
+use super::state::Term;
+use super::types::Pos;
+use alloc::vec::Vec;
+
+impl Term {
+    /// The logical line starting at `first`: its characters, each with the
+    /// position of its cell, and the absolute line after it.
+    pub(super) fn logical(&self, first: u64) -> (Vec<(char, Pos)>, u64) {
+        let mut chars = Vec::new();
+        let mut n = first;
+        while let Some(line) = self.line_at(n) {
+            let len = if line.wrapped { line.len() } else { line.content_len() };
+            for x in 0..len.min(self.cols) {
+                let c = line.cell(x);
+                if !c.is_tail() {
+                    chars.push((c.ch, Pos { line: n, col: x }));
+                }
+            }
+            n += 1;
+            if !line.wrapped {
+                break;
+            }
+        }
+        (chars, n)
+    }
+}
diff --git a/userland/nonos_vt/src/term/mod.rs b/userland/nonos_vt/src/term/mod.rs
new file mode 100644
index 000000000..3bf17e66a
--- /dev/null
+++ b/userland/nonos_vt/src/term/mod.rs
@@ -0,0 +1,73 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The terminal: two screens, scrollback, modes, and everything a program
+//! can ask of them.
+
+mod abs;
+mod alt;
+mod answer;
+mod control;
+mod csi;
+mod csi_move;
+mod csi_place;
+mod cursor_style;
+mod edit;
+mod erase;
+mod esc;
+mod feed;
+mod glyph;
+mod handler;
+mod history;
+mod index;
+mod join;
+mod lines;
+mod logical;
+mod mode_state;
+mod modes;
+mod modes_type;
+mod mouse_mode;
+mod new;
+mod osc;
+mod pick;
+mod print;
+mod reflow;
+mod reset;
+mod resize;
+mod save;
+mod screen;
+mod screen_modes;
+mod scroll;
+mod search;
+mod search_match;
+mod sgr;
+mod sgr_attr;
+mod sgr_colour;
+mod soft_reset;
+mod state;
+mod tab_stops;
+mod tabs;
+mod text;
+mod types;
+mod view;
+mod view_draw;
+mod view_text;
+
+pub use modes_type::Modes;
+pub use mouse_mode::MouseMode;
+pub use screen::{Cursor, Screen};
+pub use state::Term;
+pub use types::{ClipboardRequest, CursorShape, CursorView, Pos};
diff --git a/userland/nonos_vt/src/term/mode_state.rs b/userland/nonos_vt/src/term/mode_state.rs
new file mode 100644
index 000000000..ab5035d1e
--- /dev/null
+++ b/userland/nonos_vt/src/term/mode_state.rs
@@ -0,0 +1,55 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Whether a mode is set, for DECRQM.
+
+use super::mouse_mode::MouseMode;
+use super::state::Term;
+
+impl Term {
+    /// Whether a mode is set: `Some(true)` set, `Some(false)` reset, `None`
+    /// not a mode this terminal knows.
+    pub(super) fn mode_state(&self, mode: u16, dec: bool) -> Option<bool> {
+        let m = &self.modes;
+        if !dec {
+            return match mode {
+                4 => Some(m.insert),
+                20 => Some(m.newline),
+                _ => None,
+            };
+        }
+        Some(match mode {
+            1 => m.cursor_keys,
+            5 => m.reverse_video,
+            6 => m.origin,
+            7 => m.autowrap,
+            12 => m.cursor_blink,
+            25 => m.cursor_visible,
+            66 => m.keypad,
+            9 => m.mouse == MouseMode::Press,
+            1000 => m.mouse == MouseMode::Click,
+            1002 => m.mouse == MouseMode::Drag,
+            1003 => m.mouse == MouseMode::Motion,
+            1004 => m.focus,
+            1006 => m.mouse_sgr,
+            1007 => m.alt_scroll,
+            2004 => m.bracketed_paste,
+            2026 => m.sync,
+            47 | 1047 | 1049 => self.alt_active,
+            _ => return None,
+        })
+    }
+}
diff --git a/userland/nonos_vt/src/term/modes.rs b/userland/nonos_vt/src/term/modes.rs
new file mode 100644
index 000000000..32c9ec9fb
--- /dev/null
+++ b/userland/nonos_vt/src/term/modes.rs
@@ -0,0 +1,73 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! SM, RM, DECSET and DECRST, each applied to every parameter given.
+
+use super::mouse_mode::MouseMode;
+use super::state::Term;
+use crate::params::Params;
+
+impl Term {
+    pub(super) fn set_ansi_modes(&mut self, p: &Params, on: bool) {
+        for g in p.groups() {
+            match g[0] {
+                4 => self.modes.insert = on,
+                20 => self.modes.newline = on,
+                _ => {}
+            }
+        }
+    }
+
+    pub(super) fn set_dec_modes(&mut self, p: &Params, on: bool) {
+        for g in p.groups() {
+            self.set_dec_mode(g[0], on);
+        }
+    }
+
+    fn set_dec_mode(&mut self, mode: u16, on: bool) {
+        let m = &mut self.modes;
+        match mode {
+            1 => m.cursor_keys = on,
+            5 => {
+                m.reverse_video = on;
+                self.touch_all();
+            }
+            6 => {
+                m.origin = on;
+                let home = if on { self.scr_ref().top } else { 0 };
+                let cur = &mut self.scr().cur;
+                cur.x = 0;
+                cur.y = home;
+                cur.pending_wrap = false;
+            }
+            7 => m.autowrap = on,
+            12 => m.cursor_blink = on,
+            25 => m.cursor_visible = on,
+            66 => m.keypad = on,
+            9 => m.mouse = if on { MouseMode::Press } else { MouseMode::Off },
+            1000 => m.mouse = if on { MouseMode::Click } else { MouseMode::Off },
+            1002 => m.mouse = if on { MouseMode::Drag } else { MouseMode::Off },
+            1003 => m.mouse = if on { MouseMode::Motion } else { MouseMode::Off },
+            1004 => m.focus = on,
+            1006 => m.mouse_sgr = on,
+            1007 => m.alt_scroll = on,
+            2004 => m.bracketed_paste = on,
+            2026 => m.sync = on,
+            47 | 1047 | 1048 | 1049 => self.set_screen_mode(mode, on),
+            _ => {}
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/modes_type.rs b/userland/nonos_vt/src/term/modes_type.rs
new file mode 100644
index 000000000..94169887d
--- /dev/null
+++ b/userland/nonos_vt/src/term/modes_type.rs
@@ -0,0 +1,74 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The modes a program sets, which change how its output is drawn and
+//! how keys and the pointer are reported to it.
+
+use super::mouse_mode::MouseMode;
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub struct Modes {
+    /// DECCKM: cursor keys send SS3 rather than CSI.
+    pub cursor_keys: bool,
+    /// DECKPAM: the keypad sends application sequences.
+    pub keypad: bool,
+    /// IRM: printing inserts rather than overwrites.
+    pub insert: bool,
+    /// LNM: line feed also returns the carriage, and Enter sends CR LF.
+    pub newline: bool,
+    /// DECOM: cursor positions count from the scroll region.
+    pub origin: bool,
+    /// DECAWM: printing past the last column wraps.
+    pub autowrap: bool,
+    /// DECSCNM: the whole screen is drawn inverted.
+    pub reverse_video: bool,
+    /// DECTCEM.
+    pub cursor_visible: bool,
+    pub cursor_blink: bool,
+    pub mouse: MouseMode,
+    /// ?1006: mouse reports in the SGR form, which has no coordinate limit.
+    pub mouse_sgr: bool,
+    /// ?1004: focus changes are reported.
+    pub focus: bool,
+    /// ?2004: pasted text is bracketed so a shell does not run it.
+    pub bracketed_paste: bool,
+    /// ?2026: the program is mid-frame; the host may hold the redraw.
+    pub sync: bool,
+    /// ?1007: the wheel sends cursor keys on the alternate screen.
+    pub alt_scroll: bool,
+}
+
+impl Default for Modes {
+    fn default() -> Modes {
+        Modes {
+            cursor_keys: false,
+            keypad: false,
+            insert: false,
+            newline: false,
+            origin: false,
+            autowrap: true,
+            reverse_video: false,
+            cursor_visible: true,
+            cursor_blink: true,
+            mouse: MouseMode::Off,
+            mouse_sgr: false,
+            focus: false,
+            bracketed_paste: false,
+            sync: false,
+            alt_scroll: true,
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/mouse_mode.rs b/userland/nonos_vt/src/term/mouse_mode.rs
new file mode 100644
index 000000000..6621bed7d
--- /dev/null
+++ b/userland/nonos_vt/src/term/mouse_mode.rs
@@ -0,0 +1,31 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Which pointer events a program asked to receive.
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Default)]
+pub enum MouseMode {
+    #[default]
+    Off,
+    /// ?9: button presses only.
+    Press,
+    /// ?1000: presses and releases.
+    Click,
+    /// ?1002: and motion while a button is held.
+    Drag,
+    /// ?1003: and all motion.
+    Motion,
+}
diff --git a/userland/nonos_vt/src/term/new.rs b/userland/nonos_vt/src/term/new.rs
new file mode 100644
index 000000000..0248f9d02
--- /dev/null
+++ b/userland/nonos_vt/src/term/new.rs
@@ -0,0 +1,71 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Making a terminal, and the full reset a program can ask for.
+
+use alloc::collections::VecDeque;
+use alloc::string::String;
+use alloc::vec;
+use alloc::vec::Vec;
+
+use super::modes_type::Modes;
+use super::resize::clamp_size;
+use super::screen::Screen;
+use super::state::Term;
+use super::tabs::default_tabs;
+use super::types::CursorShape;
+use crate::charset::Charsets;
+use crate::color::Palette;
+use crate::limits::MAX_SCROLLBACK;
+use crate::parser::Parser;
+
+impl Term {
+    pub fn new(cols: usize, rows: usize, scrollback: usize) -> Term {
+        let (cols, rows) = clamp_size(cols, rows);
+        Term {
+            cols,
+            rows,
+            primary: Screen::new(cols, rows),
+            alt: Screen::new(cols, rows),
+            alt_active: false,
+            scrollback: VecDeque::new(),
+            scrollback_limit: scrollback.min(MAX_SCROLLBACK),
+            scrolled: 0,
+            view: 0,
+            modes: Modes::default(),
+            tabs: default_tabs(cols),
+            charsets: Charsets::default(),
+            last_char: None,
+            after_zwj: false,
+            parser: Parser::new(),
+            replies: Vec::new(),
+            title: String::new(),
+            title_stack: Vec::new(),
+            title_gen: 0,
+            cwd: None,
+            clipboard: None,
+            clipboard_reads_refused: 0,
+            bell: 0,
+            theme: Palette::xterm(),
+            palette: Palette::xterm(),
+            links: Vec::new(),
+            cursor_shape: CursorShape::Block,
+            prompts: VecDeque::new(),
+            dirty: vec![true; rows],
+            cell_px: (0, 0),
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/osc/dispatch.rs b/userland/nonos_vt/src/term/osc/dispatch.rs
new file mode 100644
index 000000000..65fb67603
--- /dev/null
+++ b/userland/nonos_vt/src/term/osc/dispatch.rs
@@ -0,0 +1,75 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Routing an OSC by its number, and the title it most often sets.
+
+use alloc::string::String;
+
+use crate::limits::{MAX_TITLE, MAX_TITLE_STACK};
+use crate::term::state::Term;
+
+/// Text a program sent, kept only as far as it is printable: a title or a
+/// path cannot smuggle control bytes into the host's own display.
+pub(in crate::term) fn clean_text(b: &[u8], max: usize) -> String {
+    let s = String::from_utf8_lossy(b);
+    s.chars().filter(|c| !c.is_control()).take(max).collect()
+}
+
+impl Term {
+    pub(in crate::term) fn osc_dispatch(&mut self, data: &[u8]) {
+        let (num, rest) = match data.iter().position(|&b| b == b';') {
+            Some(i) => (&data[..i], &data[i + 1..]),
+            None => (data, &data[data.len()..]),
+        };
+        let Some(num) = core::str::from_utf8(num).ok().and_then(|s| s.parse::<u16>().ok()) else {
+            return;
+        };
+        match num {
+            0 | 2 => self.set_title(clean_text(rest, MAX_TITLE)),
+            4 => self.osc_palette(rest),
+            7 => self.set_cwd(rest),
+            8 => self.osc_link(rest),
+            10..=12 => self.osc_dynamic(num, rest),
+            52 => self.osc_clipboard(rest),
+            104 => self.osc_reset_palette(rest),
+            110 => self.palette.fg = self.theme.fg,
+            111 => self.palette.bg = self.theme.bg,
+            112 => self.palette.cursor = self.theme.cursor,
+            133 => self.osc_prompt(rest),
+            _ => {}
+        }
+        if matches!(num, 4 | 10 | 11 | 104 | 110 | 111) {
+            self.touch_all();
+        }
+    }
+
+    fn set_title(&mut self, t: String) {
+        self.title = t;
+        self.title_gen = self.title_gen.wrapping_add(1);
+    }
+
+    pub(in crate::term) fn push_title(&mut self) {
+        if self.title_stack.len() < MAX_TITLE_STACK {
+            self.title_stack.push(self.title.clone());
+        }
+    }
+
+    pub(in crate::term) fn pop_title(&mut self) {
+        if let Some(t) = self.title_stack.pop() {
+            self.set_title(t);
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/osc/links.rs b/userland/nonos_vt/src/term/osc/links.rs
new file mode 100644
index 000000000..b4cd0234a
--- /dev/null
+++ b/userland/nonos_vt/src/term/osc/links.rs
@@ -0,0 +1,50 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! OSC 8 hyperlinks: text a program marked as pointing somewhere. The host
+//! shows where before following one; the target is never followed here.
+
+use super::dispatch::clean_text;
+use crate::limits::{MAX_LINK, MAX_LINKS};
+use crate::term::state::Term;
+
+impl Term {
+    /// `8;params;uri` starts a link, `8;;` ends it.
+    pub(in crate::term) fn osc_link(&mut self, rest: &[u8]) {
+        let Some(i) = rest.iter().position(|&b| b == b';') else { return };
+        let uri = &rest[i + 1..];
+        let link = if uri.is_empty() || uri.len() > MAX_LINK { 0 } else { self.intern_link(uri) };
+        self.scr().cur.pen.link = link;
+    }
+
+    fn intern_link(&mut self, uri: &[u8]) -> u16 {
+        let uri = clean_text(uri, MAX_LINK);
+        if let Some(i) = self.links.iter().position(|l| *l == uri) {
+            return (i + 1) as u16;
+        }
+        if self.links.len() >= MAX_LINKS {
+            return 0;
+        }
+        self.links.push(uri);
+        self.links.len() as u16
+    }
+
+    /// The target a cell's link names.
+    pub fn link_target(&self, link: u16) -> Option<&str> {
+        let i = (link as usize).checked_sub(1)?;
+        self.links.get(i).map(|s| s.as_str())
+    }
+}
diff --git a/userland/nonos_vt/src/term/osc/mod.rs b/userland/nonos_vt/src/term/osc/mod.rs
new file mode 100644
index 000000000..51c37442b
--- /dev/null
+++ b/userland/nonos_vt/src/term/osc/mod.rs
@@ -0,0 +1,25 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! OSC: titles, colours, hyperlinks, the working directory, clipboard
+//! requests and shell prompt marks.
+
+mod dispatch;
+mod links;
+mod osc_color;
+mod osc_get;
+mod osc_misc;
+mod osc_palette;
diff --git a/userland/nonos_vt/src/term/osc/osc_color.rs b/userland/nonos_vt/src/term/osc/osc_color.rs
new file mode 100644
index 000000000..ac0fe88de
--- /dev/null
+++ b/userland/nonos_vt/src/term/osc/osc_color.rs
@@ -0,0 +1,53 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Colour specifications in OSC 4, 10, 11 and 12: `rgb:r/g/b` with one to
+//! four hex digits a channel, or `#rgb` to `#rrrrggggbbbb`. A `?` asks for
+//! the current value, answered as xterm answers.
+
+use crate::term::state::Term;
+
+fn hex(s: &str) -> Option<u32> {
+    if s.is_empty() || s.len() > 4 {
+        return None;
+    }
+    let v = u32::from_str_radix(s, 16).ok()?;
+    // Scale to 8 bits: one digit repeats, more keep the high byte.
+    let max = (1u32 << (4 * s.len())) - 1;
+    Some(v * 255 / max)
+}
+
+pub(in crate::term) fn parse_spec(spec: &[u8]) -> Option<u32> {
+    let s = core::str::from_utf8(spec).ok()?;
+    let (r, g, b) = if let Some(body) = s.strip_prefix("rgb:") {
+        let mut it = body.split('/');
+        let c = (hex(it.next()?)?, hex(it.next()?)?, hex(it.next()?)?);
+        if it.next().is_some() {
+            return None;
+        }
+        c
+    } else {
+        let h = s.strip_prefix('#')?;
+        if h.is_empty() || h.len() % 3 != 0 || h.len() > 12 {
+            return None;
+        }
+        let n = h.len() / 3;
+        (hex(&h[..n])?, hex(&h[n..2 * n])?, hex(&h[2 * n..])?)
+    };
+    Some((r << 16) | (g << 8) | b)
+}
+
+impl Term {}
diff --git a/userland/nonos_vt/src/term/osc/osc_get.rs b/userland/nonos_vt/src/term/osc/osc_get.rs
new file mode 100644
index 000000000..4701fee7b
--- /dev/null
+++ b/userland/nonos_vt/src/term/osc/osc_get.rs
@@ -0,0 +1,52 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! What the host reads back of what programs set through OSC.
+
+use crate::term::state::Term;
+use crate::term::types::ClipboardRequest;
+
+impl Term {
+    pub fn title(&self) -> &str {
+        &self.title
+    }
+
+    /// Changes each time the title does, so the host redraws it only then.
+    pub fn title_generation(&self) -> u32 {
+        self.title_gen
+    }
+
+    pub fn cwd(&self) -> Option<&str> {
+        self.cwd.as_deref()
+    }
+
+    pub fn take_clipboard_request(&mut self) -> Option<ClipboardRequest> {
+        self.clipboard.take()
+    }
+
+    pub fn clipboard_reads_refused(&self) -> u32 {
+        self.clipboard_reads_refused
+    }
+
+    /// Bells since the last call.
+    pub fn take_bell(&mut self) -> u32 {
+        core::mem::take(&mut self.bell)
+    }
+
+    pub fn prompt_lines(&self) -> impl Iterator<Item = u64> + '_ {
+        self.prompts.iter().copied()
+    }
+}
diff --git a/userland/nonos_vt/src/term/osc/osc_misc.rs b/userland/nonos_vt/src/term/osc/osc_misc.rs
new file mode 100644
index 000000000..17c4a792f
--- /dev/null
+++ b/userland/nonos_vt/src/term/osc/osc_misc.rs
@@ -0,0 +1,68 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! OSC requests that are not titles or colours: the working directory,
+//! the clipboard and shell prompt marks.
+
+use super::dispatch::clean_text;
+use crate::limits::MAX_PROMPT_MARKS;
+use crate::term::state::Term;
+use crate::term::types::ClipboardRequest;
+use alloc::string::String;
+use alloc::vec::Vec;
+
+impl Term {
+    /// `file://host/path`: the host part is dropped, the path kept.
+    pub(in crate::term) fn set_cwd(&mut self, rest: &[u8]) {
+        let s = clean_text(rest, 1024);
+        let path = match s.strip_prefix("file://") {
+            Some(r) => r.find('/').map(|i| String::from(&r[i..])).unwrap_or_default(),
+            None => s,
+        };
+        self.cwd = (!path.is_empty()).then_some(path);
+    }
+
+    /// `52;targets;base64`. A `?` asks to read the clipboard; it is refused
+    /// and counted, because a program that can read the clipboard can read
+    /// whatever the user copied from anywhere else.
+    pub(in crate::term) fn osc_clipboard(&mut self, rest: &[u8]) {
+        let Some(i) = rest.iter().position(|&b| b == b';') else { return };
+        let (targets, data) = (&rest[..i], &rest[i + 1..]);
+        if data == b"?" {
+            self.clipboard_reads_refused = self.clipboard_reads_refused.saturating_add(1);
+            return;
+        }
+        let ok = data.iter().all(|b| b.is_ascii_alphanumeric() || matches!(b, b'+' | b'/' | b'='));
+        if ok {
+            let targets = if targets.is_empty() { Vec::from(&b"s0"[..]) } else { targets.to_vec() };
+            self.clipboard = Some(ClipboardRequest { targets, base64: data.to_vec() });
+        }
+    }
+
+    /// `133;A` marks where a prompt starts, so the host can jump between
+    /// commands.
+    pub(in crate::term) fn osc_prompt(&mut self, rest: &[u8]) {
+        if rest.first() == Some(&b'A') && !self.alt_active {
+            let line = self.scrolled + self.primary.cur.y as u64;
+            if self.prompts.back() != Some(&line) {
+                if self.prompts.len() >= MAX_PROMPT_MARKS {
+                    self.prompts.pop_front();
+                }
+                self.prompts.push_back(line);
+            }
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/osc/osc_palette.rs b/userland/nonos_vt/src/term/osc/osc_palette.rs
new file mode 100644
index 000000000..526140ed6
--- /dev/null
+++ b/userland/nonos_vt/src/term/osc/osc_palette.rs
@@ -0,0 +1,73 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Setting and reporting palette colours: OSC 4, 10 to 12 and 104.
+
+use super::osc_color::parse_spec;
+use crate::term::state::Term;
+
+impl Term {
+    pub(in crate::term) fn reply_colour(&mut self, prefix: &str, c: u32) {
+        // Each channel as xterm reports it: sixteen bits, the byte repeated.
+        let ch = |shift: u32| ((c >> shift) & 0xFF) * 257;
+        let (r, g, b) = (ch(16), ch(8), ch(0));
+        self.reply_fmt(format_args!("\x1b]{prefix};rgb:{r:04x}/{g:04x}/{b:04x}\x1b\\"));
+    }
+
+    /// `4;index;spec[;index;spec...]`.
+    pub(in crate::term) fn osc_palette(&mut self, rest: &[u8]) {
+        let mut parts = rest.split(|&b| b == b';');
+        while let (Some(i), Some(spec)) = (parts.next(), parts.next()) {
+            let Some(i) = core::str::from_utf8(i).ok().and_then(|s| s.parse::<u8>().ok()) else {
+                return;
+            };
+            if spec == b"?" {
+                let c = self.palette.colors[i as usize];
+                self.reply_colour(&alloc::format!("4;{i}"), c);
+            } else if let Some(c) = parse_spec(spec) {
+                self.palette.colors[i as usize] = c;
+            }
+        }
+    }
+
+    /// 10 foreground, 11 background, 12 cursor.
+    pub(in crate::term) fn osc_dynamic(&mut self, num: u16, spec: &[u8]) {
+        let slot = match num {
+            10 => &mut self.palette.fg,
+            11 => &mut self.palette.bg,
+            _ => &mut self.palette.cursor,
+        };
+        if spec == b"?" {
+            let c = *slot;
+            self.reply_colour(&alloc::format!("{num}"), c);
+        } else if let Some(c) = parse_spec(spec) {
+            *slot = c;
+        }
+    }
+
+    /// 104 with no indices resets the whole palette to the theme.
+    pub(in crate::term) fn osc_reset_palette(&mut self, rest: &[u8]) {
+        if rest.is_empty() {
+            self.palette.colors = self.theme.colors;
+            return;
+        }
+        for i in rest.split(|&b| b == b';') {
+            if let Some(i) = core::str::from_utf8(i).ok().and_then(|s| s.parse::<u8>().ok()) {
+                self.palette.colors[i as usize] = self.theme.colors[i as usize];
+            }
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/pick.rs b/userland/nonos_vt/src/term/pick.rs
new file mode 100644
index 000000000..b149e9323
--- /dev/null
+++ b/userland/nonos_vt/src/term/pick.rs
@@ -0,0 +1,66 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The word or the whole line a double or triple click picks.
+
+use super::state::Term;
+use super::types::Pos;
+
+/// Characters a double click keeps together, so a path or a URL is picked
+/// whole.
+fn is_word(c: char) -> bool {
+    c.is_alphanumeric() || "_-./~:@%+#?&=".contains(c)
+}
+
+impl Term {
+    /// The word under `p`, as the positions of its first and last cells.
+    pub fn word_at(&self, p: Pos) -> (Pos, Pos) {
+        let Some(line) = self.line_at(p.line) else { return (p, p) };
+        let class = |x: usize| {
+            let c = line.cell(x);
+            if c.is_tail() {
+                None
+            } else {
+                Some(is_word(c.ch))
+            }
+        };
+        let here = class(p.col).unwrap_or(false);
+        let same = |x: usize| class(x).is_none_or(|w| w == here);
+        let mut l = p.col;
+        while l > 0 && same(l - 1) {
+            l -= 1;
+        }
+        let mut r = p.col;
+        while r + 1 < self.cols && same(r + 1) {
+            r += 1;
+        }
+        (Pos { line: p.line, col: l }, Pos { line: p.line, col: r })
+    }
+
+    /// The whole line `p` is on, following wraps both ways, for a triple
+    /// click.
+    pub fn line_bounds(&self, p: Pos) -> (Pos, Pos) {
+        let mut first = p.line;
+        while first > self.first_line() && self.line_at(first - 1).is_some_and(|l| l.wrapped) {
+            first -= 1;
+        }
+        let mut last = p.line;
+        while self.line_at(last).is_some_and(|l| l.wrapped) && last < self.last_line() {
+            last += 1;
+        }
+        (Pos { line: first, col: 0 }, Pos { line: last, col: self.cols - 1 })
+    }
+}
diff --git a/userland/nonos_vt/src/term/print.rs b/userland/nonos_vt/src/term/print.rs
new file mode 100644
index 000000000..c16a46b37
--- /dev/null
+++ b/userland/nonos_vt/src/term/print.rs
@@ -0,0 +1,58 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Drawing a character at the cursor.
+
+use super::state::Term;
+use crate::width::{is_emoji_modifier, width, ZWJ};
+
+impl Term {
+    pub(super) fn print_char(&mut self, c: char) {
+        let c = if (c as u32) < 0x80 {
+            self.charsets.map(c)
+        } else {
+            self.charsets.single = None;
+            c
+        };
+        /*
+         * A joiner, a skin tone after an emoji, and nonspacing marks are
+         * drawn over the character before them, not in a cell of their own.
+         */
+        if core::mem::take(&mut self.after_zwj) && self.attach_mark(c) {
+            return;
+        }
+        if c == ZWJ {
+            self.attach_mark(c);
+            self.after_zwj = true;
+            return;
+        }
+        if is_emoji_modifier(c)
+            && self.prev_cell().is_some_and(|p| p.is_wide())
+            && self.attach_mark(c)
+        {
+            return;
+        }
+        match width(c) {
+            0 => {
+                self.attach_mark(c);
+            }
+            w => {
+                self.put_glyph(c, w);
+                self.last_char = Some(c);
+            }
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/reflow/gather.rs b/userland/nonos_vt/src/term/reflow/gather.rs
new file mode 100644
index 000000000..59e6c8b22
--- /dev/null
+++ b/userland/nonos_vt/src/term/reflow/gather.rs
@@ -0,0 +1,56 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Taking the normal screen and its history apart into physical lines.
+
+use alloc::vec::Vec;
+
+use crate::line::Line;
+use crate::term::Term;
+
+pub(super) struct Gathered {
+    pub(super) phys: Vec<Line>,
+    /// The cursor's physical line, and its offset into that line; one past
+    /// the last column when it was waiting to wrap.
+    pub(super) cur_phys: usize,
+    pub(super) cur_col: usize,
+    /// Where the old screen starts among the physical lines.
+    pub(super) old_top: usize,
+}
+
+impl Term {
+    /// History then the screen down to its last used row, which the cursor
+    /// counts as using. Blank rows below are dropped.
+    pub(super) fn gather(&mut self) -> Gathered {
+        let cur = self.primary.cur;
+        let old_top = self.scrollback.len();
+        let mut phys: Vec<Line> = self.scrollback.drain(..).collect();
+        let used = self
+            .primary
+            .lines
+            .iter()
+            .rposition(|l| l.content_len() > 0 || l.wrapped)
+            .map_or(0, |i| i + 1)
+            .max(cur.y + 1);
+        phys.extend(self.primary.lines.drain(..).take(used));
+        Gathered {
+            phys,
+            cur_phys: old_top + cur.y,
+            cur_col: cur.x + cur.pending_wrap as usize,
+            old_top,
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/reflow/mod.rs b/userland/nonos_vt/src/term/reflow/mod.rs
new file mode 100644
index 000000000..8488ec436
--- /dev/null
+++ b/userland/nonos_vt/src/term/reflow/mod.rs
@@ -0,0 +1,28 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Re-wrapping the normal screen and its history to a new width.
+//!
+//! Lines that ran on into one another are joined back into the text that
+//! was written, then broken again at the new width, so a narrowed window
+//! does not cut words off and a widened one does not leave them broken. The
+//! cursor keeps its place in the text and, where it fits, its row.
+
+mod gather;
+mod place;
+mod placed;
+mod rewrap;
+mod rewrap_all;
diff --git a/userland/nonos_vt/src/term/reflow/place.rs b/userland/nonos_vt/src/term/reflow/place.rs
new file mode 100644
index 000000000..4f896f84f
--- /dev/null
+++ b/userland/nonos_vt/src/term/reflow/place.rs
@@ -0,0 +1,68 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Choosing which re-wrapped lines are the screen, and putting everything
+//! back.
+
+use alloc::vec::Vec;
+
+use super::placed::Placed;
+use super::rewrap_all::rewrap_all;
+use crate::cell::Cell;
+use crate::line::Line;
+use crate::term::Term;
+
+/// The first line of the new screen. The old top row stays on top unless
+/// the cursor would fall off the foot. Growing while at the foot, as after
+/// a command's output, brings back as many history lines as rows were
+/// added. Whatever the rules choose, the cursor ends on screen.
+fn screen_start(top_out: usize, at: &Placed, rows: usize, old_rows: usize, cur_y: usize) -> usize {
+    let mut start = top_out.min(at.line);
+    if rows > old_rows && cur_y + 1 == old_rows {
+        start = start.saturating_sub(rows - old_rows);
+    }
+    if at.line >= start + rows {
+        start = at.line + 1 - rows;
+    }
+    start
+}
+
+impl Term {
+    pub(in crate::term) fn reflow_primary(&mut self, cols: usize, rows: usize) {
+        let base = self.first_line();
+        let cur_y = self.primary.cur.y;
+        let g = self.gather();
+        let (mut out, at, top_out) = rewrap_all(&g, cols, self.cols);
+        let start = screen_start(top_out, &at, rows, self.rows, cur_y);
+        let mut screen: Vec<Line> = out.drain(start..).take(rows).collect();
+        screen.resize(rows, Line::new(cols, Cell::BLANK));
+        for mut line in out {
+            line.trim();
+            self.scrollback.push_back(line);
+        }
+        self.scrolled = base + self.scrollback.len() as u64;
+        while self.scrollback.len() > self.scrollback_limit {
+            self.scrollback.pop_front();
+        }
+        let s = &mut self.primary;
+        s.lines = screen;
+        s.cur.y = at.line - start;
+        s.cur.x = at.col.min(cols - 1);
+        s.cur.pending_wrap = at.pending;
+        s.reset_region();
+        self.prompts.clear();
+    }
+}
diff --git a/userland/nonos_vt/src/term/reflow/placed.rs b/userland/nonos_vt/src/term/reflow/placed.rs
new file mode 100644
index 000000000..be19937a6
--- /dev/null
+++ b/userland/nonos_vt/src/term/reflow/placed.rs
@@ -0,0 +1,25 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Where the cursor ended up after a re-wrap.
+
+/// Where the cursor ended up: output line, column, and whether it sits
+/// just past the last column waiting to wrap.
+pub(super) struct Placed {
+    pub(super) line: usize,
+    pub(super) col: usize,
+    pub(super) pending: bool,
+}
diff --git a/userland/nonos_vt/src/term/reflow/rewrap.rs b/userland/nonos_vt/src/term/reflow/rewrap.rs
new file mode 100644
index 000000000..8c844aea0
--- /dev/null
+++ b/userland/nonos_vt/src/term/reflow/rewrap.rs
@@ -0,0 +1,73 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Breaking one logical line at a new width, keeping wide characters whole
+//! and noting where the cursor lands.
+
+use alloc::vec::Vec;
+
+use super::placed::Placed;
+use crate::cell::{attr, Cell};
+use crate::line::Line;
+
+/// Break one logical line of `cells` (each tagged with the physical line it
+/// came from, for its marks) into lines `cols` wide.
+pub(super) fn rewrap(
+    phys: &[Line],
+    cells: &[(usize, Cell)],
+    cols: usize,
+    cursor: Option<usize>,
+    out: &mut Vec<Line>,
+    placed: &mut Option<Placed>,
+) {
+    let mut line = Line::new(0, Cell::BLANK);
+    let mut col: usize = 0;
+    for (i, &(src, cell)) in cells.iter().enumerate() {
+        if cell.is_tail() {
+            if cursor == Some(i) && placed.is_none() {
+                *placed =
+                    Some(Placed { line: out.len(), col: col.saturating_sub(1), pending: false });
+            }
+            continue;
+        }
+        let w = if cell.is_wide() && cols >= 2 { 2 } else { 1 };
+        if col + w > cols {
+            line.cells.resize(cols, Cell::BLANK);
+            line.wrapped = true;
+            out.push(core::mem::replace(&mut line, Line::new(0, Cell::BLANK)));
+            col = 0;
+        }
+        if cursor == Some(i) {
+            *placed = Some(Placed { line: out.len(), col, pending: false });
+        }
+        let head = if w == 2 { cell } else { Cell { attr: cell.attr & !attr::WIDE, ..cell } };
+        line.push_from(&phys[src], head);
+        if w == 2 {
+            let tail = (cell.attr & !attr::WIDE) | attr::WIDE_TAIL;
+            line.cells.push(Cell { ch: ' ', attr: tail, mark: 0, ..cell });
+        }
+        col += w;
+    }
+    if cursor == Some(cells.len()) {
+        *placed = Some(if col >= cols {
+            Placed { line: out.len(), col: cols - 1, pending: true }
+        } else {
+            Placed { line: out.len(), col, pending: false }
+        });
+    }
+    line.cells.resize(cols, Cell::BLANK);
+    out.push(line);
+}
diff --git a/userland/nonos_vt/src/term/reflow/rewrap_all.rs b/userland/nonos_vt/src/term/reflow/rewrap_all.rs
new file mode 100644
index 000000000..4e8ec7123
--- /dev/null
+++ b/userland/nonos_vt/src/term/reflow/rewrap_all.rs
@@ -0,0 +1,61 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Every logical line of the gathered text, broken at the new width.
+
+use alloc::vec::Vec;
+
+use super::gather::Gathered;
+use super::placed::Placed;
+use super::rewrap::rewrap;
+use crate::cell::Cell;
+use crate::line::Line;
+
+/// The re-wrapped lines, where the cursor went, and the line the old
+/// screen's first row became.
+pub(super) fn rewrap_all(g: &Gathered, cols: usize, old_cols: usize) -> (Vec<Line>, Placed, usize) {
+    let phys = &g.phys;
+    let mut out: Vec<Line> = Vec::new();
+    let mut placed: Option<Placed> = None;
+    let mut top_out = 0;
+    let mut i = 0;
+    while i < phys.len() {
+        let start = i;
+        while phys[i].wrapped && i + 1 < phys.len() {
+            i += 1;
+        }
+        let end = i;
+        i += 1;
+        let mut cells: Vec<(usize, Cell)> = Vec::new();
+        let mut cursor = None;
+        for (li, line) in phys.iter().enumerate().take(end + 1).skip(start) {
+            if li == g.cur_phys {
+                cursor = Some(cells.len() + g.cur_col);
+            }
+            let take = if li == end { line.content_len() } else { line.len() };
+            cells.extend(line.cells[..take].iter().map(|&c| (li, c)));
+        }
+        if let Some(o) = cursor {
+            cells.resize(cells.len().max(o), (end, Cell::BLANK));
+        }
+        if (start..=end).contains(&g.old_top) {
+            top_out = out.len() + (g.old_top - start) * old_cols / cols;
+        }
+        rewrap(phys, &cells, cols, cursor, &mut out, &mut placed);
+    }
+    let last = out.len().saturating_sub(1);
+    (out, placed.unwrap_or(Placed { line: last, col: 0, pending: false }), top_out)
+}
diff --git a/userland/nonos_vt/src/term/reset.rs b/userland/nonos_vt/src/term/reset.rs
new file mode 100644
index 000000000..1fe54faf0
--- /dev/null
+++ b/userland/nonos_vt/src/term/reset.rs
@@ -0,0 +1,59 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The full reset a program can ask for, and the settings the host makes.
+
+use super::modes_type::Modes;
+use super::screen::Screen;
+use super::state::Term;
+use super::tabs::default_tabs;
+use super::types::CursorShape;
+use crate::charset::Charsets;
+use crate::color::Palette;
+
+impl Term {
+    /// RIS: both screens blank, every mode and colour back to its start. The
+    /// scrollback stays; it is the user's, not the program's.
+    pub(super) fn full_reset(&mut self) {
+        self.primary = Screen::new(self.cols, self.rows);
+        self.alt = Screen::new(self.cols, self.rows);
+        self.alt_active = false;
+        self.view = 0;
+        self.modes = Modes::default();
+        self.tabs = default_tabs(self.cols);
+        self.charsets = Charsets::default();
+        self.last_char = None;
+        self.after_zwj = false;
+        self.title.clear();
+        self.title_stack.clear();
+        self.title_gen = self.title_gen.wrapping_add(1);
+        self.palette = self.theme.clone();
+        self.cursor_shape = CursorShape::Block;
+        self.touch_all();
+    }
+
+    /// Set the colours programs start from. Changes a program made are
+    /// dropped: the user chose a theme.
+    pub fn set_theme(&mut self, theme: Palette) {
+        self.theme = theme.clone();
+        self.palette = theme;
+        self.touch_all();
+    }
+
+    pub fn set_cell_pixels(&mut self, w: u16, h: u16) {
+        self.cell_px = (w, h);
+    }
+}
diff --git a/userland/nonos_vt/src/term/resize.rs b/userland/nonos_vt/src/term/resize.rs
new file mode 100644
index 000000000..8a5111959
--- /dev/null
+++ b/userland/nonos_vt/src/term/resize.rs
@@ -0,0 +1,72 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Changing the screen size. The normal screen re-wraps its text to the new
+//! width; the alternate screen is cut or padded, since the program drawing
+//! on it redraws when told of the new size.
+
+use alloc::vec;
+
+use super::state::Term;
+use crate::cell::Cell;
+use crate::limits::{MAX_COLS, MAX_ROWS, MIN_COLS, MIN_ROWS};
+use crate::line::Line;
+
+pub(super) fn clamp_size(cols: usize, rows: usize) -> (usize, usize) {
+    (cols.clamp(MIN_COLS, MAX_COLS), rows.clamp(MIN_ROWS, MAX_ROWS))
+}
+
+impl Term {
+    pub fn resize(&mut self, cols: usize, rows: usize) {
+        let (cols, rows) = clamp_size(cols, rows);
+        if cols == self.cols && rows == self.rows {
+            return;
+        }
+        self.reflow_primary(cols, rows);
+        self.resize_alt(cols, rows);
+        let old = self.tabs.len();
+        self.tabs.resize(cols, false);
+        for x in old..cols {
+            self.tabs[x] = x % 8 == 0;
+        }
+        self.cols = cols;
+        self.rows = rows;
+        self.dirty = vec![true; rows];
+        self.view = 0;
+    }
+
+    fn resize_alt(&mut self, cols: usize, rows: usize) {
+        let s = &mut self.alt;
+        for line in s.lines.iter_mut() {
+            line.resize(cols, Cell::BLANK);
+        }
+        let len = s.lines.len();
+        if rows < len {
+            // Keep the cursor's row on screen: lose lines above it first.
+            let above = (s.cur.y + 1).saturating_sub(rows).min(len - rows);
+            s.lines.drain(..above);
+            s.cur.y -= above;
+            s.lines.truncate(rows);
+        }
+        while s.lines.len() < rows {
+            s.lines.push(Line::new(cols, Cell::BLANK));
+        }
+        s.cur.x = s.cur.x.min(cols - 1);
+        s.cur.y = s.cur.y.min(rows - 1);
+        s.cur.pending_wrap = false;
+        s.reset_region();
+    }
+}
diff --git a/userland/nonos_vt/src/term/save.rs b/userland/nonos_vt/src/term/save.rs
new file mode 100644
index 000000000..e354f8a67
--- /dev/null
+++ b/userland/nonos_vt/src/term/save.rs
@@ -0,0 +1,59 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! DECSC and DECRC: the cursor, its pen and the modes that go with it.
+
+use super::screen::Cursor;
+use super::state::Term;
+use crate::charset::Charsets;
+
+/// What DECSC saves and DECRC restores.
+#[derive(Clone, Copy, Debug)]
+pub struct Saved {
+    pub cursor: Cursor,
+    pub origin: bool,
+    pub autowrap: bool,
+    pub charsets: Charsets,
+}
+
+impl Term {
+    pub(super) fn save_cursor(&mut self) {
+        let saved = Saved {
+            cursor: self.scr_ref().cur,
+            origin: self.modes.origin,
+            autowrap: self.modes.autowrap,
+            charsets: self.charsets,
+        };
+        self.scr().saved = Some(saved);
+    }
+
+    /// Restore what was saved, or the home position with a plain pen when
+    /// nothing was, as xterm does.
+    pub(super) fn restore_cursor(&mut self) {
+        let (cols, rows) = (self.cols, self.rows);
+        let saved = self.scr_ref().saved;
+        let (mut cur, origin, autowrap, charsets) = match saved {
+            Some(s) => (s.cursor, s.origin, s.autowrap, s.charsets),
+            None => (Cursor::default(), false, true, Charsets::default()),
+        };
+        cur.x = cur.x.min(cols - 1);
+        cur.y = cur.y.min(rows - 1);
+        self.modes.origin = origin;
+        self.modes.autowrap = autowrap;
+        self.charsets = charsets;
+        self.scr().cur = cur;
+    }
+}
diff --git a/userland/nonos_vt/src/term/screen.rs b/userland/nonos_vt/src/term/screen.rs
new file mode 100644
index 000000000..bfa772169
--- /dev/null
+++ b/userland/nonos_vt/src/term/screen.rs
@@ -0,0 +1,73 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! One screen: its lines, its cursor and its scroll region. The terminal has
+//! two, the normal one with scrollback and the alternate one without.
+
+use alloc::vec::Vec;
+
+use super::save::Saved;
+use crate::cell::{Cell, Pen};
+use crate::line::Line;
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct Cursor {
+    pub x: usize,
+    pub y: usize,
+    pub pen: Pen,
+    /// The last column was just written. The next character wraps first;
+    /// anything that moves the cursor cancels it. This is why a program can
+    /// fill the bottom-right cell without the screen scrolling.
+    pub pending_wrap: bool,
+}
+
+pub struct Screen {
+    pub lines: Vec<Line>,
+    pub cur: Cursor,
+    pub saved: Option<Saved>,
+    /// Scroll region, inclusive rows.
+    pub top: usize,
+    pub bot: usize,
+}
+
+impl Screen {
+    pub fn new(cols: usize, rows: usize) -> Screen {
+        let lines = (0..rows).map(|_| Line::new(cols, Cell::BLANK)).collect();
+        Screen { lines, cur: Cursor::default(), saved: None, top: 0, bot: rows - 1 }
+    }
+
+    pub fn rows(&self) -> usize {
+        self.lines.len()
+    }
+
+    pub fn full_region(&self) -> bool {
+        self.top == 0 && self.bot + 1 == self.lines.len()
+    }
+
+    pub fn reset_region(&mut self) {
+        self.top = 0;
+        self.bot = self.lines.len().saturating_sub(1);
+    }
+
+    pub fn blank(&self) -> Cell {
+        Cell::erased(&self.cur.pen)
+    }
+
+    pub fn line(&mut self) -> &mut Line {
+        let y = self.cur.y.min(self.lines.len() - 1);
+        &mut self.lines[y]
+    }
+}
diff --git a/userland/nonos_vt/src/term/screen_modes.rs b/userland/nonos_vt/src/term/screen_modes.rs
new file mode 100644
index 000000000..6de515470
--- /dev/null
+++ b/userland/nonos_vt/src/term/screen_modes.rs
@@ -0,0 +1,62 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The DEC modes that switch screens or save the cursor: 47 and 1047
+//! switch, 1047 clearing the alternate screen on the way back, 1048 saves
+//! and restores the cursor, and 1049 does both, as full-screen programs
+//! use it.
+
+use super::state::Term;
+
+impl Term {
+    pub(super) fn set_screen_mode(&mut self, mode: u16, on: bool) {
+        match mode {
+            47 => {
+                if on {
+                    self.enter_alt(false)
+                } else {
+                    self.leave_alt(false)
+                }
+            }
+            1047 => {
+                if on {
+                    self.enter_alt(false)
+                } else {
+                    self.leave_alt(true)
+                }
+            }
+            1048 => {
+                if on {
+                    self.save_cursor()
+                } else {
+                    self.restore_cursor()
+                }
+            }
+            1049 => {
+                if on {
+                    if !self.alt_active {
+                        self.save_cursor();
+                    }
+                    self.enter_alt(true);
+                } else if self.alt_active {
+                    self.leave_alt(false);
+                    self.restore_cursor();
+                }
+            }
+            _ => {}
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/scroll.rs b/userland/nonos_vt/src/term/scroll.rs
new file mode 100644
index 000000000..78056b8c5
--- /dev/null
+++ b/userland/nonos_vt/src/term/scroll.rs
@@ -0,0 +1,67 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Scrolling the region, and history for the lines that leave the top.
+
+use super::state::Term;
+
+impl Term {
+    /// Move the region's lines up `n`, blank lines entering at its foot. On
+    /// the normal screen with a full-height region, the lines leaving the
+    /// top go to scrollback; anywhere else they are gone, which is what a
+    /// status line pinned outside the region needs.
+    pub(super) fn scroll_up(&mut self, n: usize) {
+        let to_history = !self.alt_active && self.scr_ref().top == 0;
+        let (top, bot) = (self.scr_ref().top, self.scr_ref().bot);
+        let n = n.min(bot + 1 - top);
+        if n == 0 {
+            return;
+        }
+        if to_history {
+            for i in 0..n {
+                let line = self.primary.lines[top + i].clone();
+                self.push_history(line);
+            }
+        }
+        let scr = self.scr();
+        let blank = scr.blank();
+        scr.lines[top..=bot].rotate_left(n);
+        for line in &mut scr.lines[bot + 1 - n..=bot] {
+            line.clear(blank);
+        }
+        for y in top..=bot {
+            self.touch(y);
+        }
+    }
+
+    /// Move the region's lines down `n`, blank lines entering at its top.
+    pub(super) fn scroll_down(&mut self, n: usize) {
+        let (top, bot) = (self.scr_ref().top, self.scr_ref().bot);
+        let n = n.min(bot + 1 - top);
+        if n == 0 {
+            return;
+        }
+        let scr = self.scr();
+        let blank = scr.blank();
+        scr.lines[top..=bot].rotate_right(n);
+        for line in &mut scr.lines[top..top + n] {
+            line.clear(blank);
+        }
+        for y in top..=bot {
+            self.touch(y);
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/search.rs b/userland/nonos_vt/src/term/search.rs
new file mode 100644
index 000000000..c0f24c076
--- /dev/null
+++ b/userland/nonos_vt/src/term/search.rs
@@ -0,0 +1,71 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Finding text in the screen and its history. A match may run across a
+//! wrapped line end, as the text it matches did when it was written.
+
+use alloc::vec::Vec;
+
+use super::search_match::matches;
+use super::state::Term;
+use super::types::Pos;
+
+impl Term {
+    /// The logical lines, as the absolute line each starts on, in order.
+    fn logical_starts(&self) -> Vec<u64> {
+        let mut starts = Vec::new();
+        let mut n = self.first_line();
+        while n <= self.last_line() {
+            starts.push(n);
+            let (_, next) = self.logical(n);
+            n = next.max(n + 1);
+        }
+        starts
+    }
+
+    /// The next match after `from` (or before it when `back`), wrapping
+    /// round the whole history once. Returns its first and last cells.
+    pub fn find(&self, needle: &str, from: Pos, back: bool, case: bool) -> Option<(Pos, Pos)> {
+        let needle: Vec<char> = needle.chars().collect();
+        let starts = self.logical_starts();
+        if starts.is_empty() || needle.is_empty() {
+            return None;
+        }
+        let here = starts.iter().rposition(|&s| s <= from.line).unwrap_or(0);
+        let n = starts.len();
+        for step in 0..=n {
+            let idx = if back { (here + n * 2 - step) % n } else { (here + step) % n };
+            let (hay, _) = self.logical(starts[idx]);
+            let hits = matches(&hay, &needle, case);
+            let span = |i: usize| (hay[i].1, hay[i + needle.len() - 1].1);
+            let pick = if step == 0 {
+                if back {
+                    hits.iter().rev().find(|&&i| hay[i].1 < from).copied()
+                } else {
+                    hits.iter().find(|&&i| hay[i].1 > from).copied()
+                }
+            } else if back {
+                hits.last().copied()
+            } else {
+                hits.first().copied()
+            };
+            if let Some(i) = pick {
+                return Some(span(i));
+            }
+        }
+        None
+    }
+}
diff --git a/userland/nonos_vt/src/term/search_match.rs b/userland/nonos_vt/src/term/search_match.rs
new file mode 100644
index 000000000..dc341afea
--- /dev/null
+++ b/userland/nonos_vt/src/term/search_match.rs
@@ -0,0 +1,39 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Where a needle starts in a logical line's characters.
+
+use alloc::vec::Vec;
+
+use super::types::Pos;
+
+fn eq(a: char, b: char, case: bool) -> bool {
+    if case {
+        a == b
+    } else {
+        a.to_lowercase().eq(b.to_lowercase())
+    }
+}
+
+/// Every place `needle` starts in `hay`, by index.
+pub(super) fn matches(hay: &[(char, Pos)], needle: &[char], case: bool) -> Vec<usize> {
+    if needle.is_empty() || needle.len() > hay.len() {
+        return Vec::new();
+    }
+    (0..=hay.len() - needle.len())
+        .filter(|&i| needle.iter().enumerate().all(|(k, &c)| eq(hay[i + k].0, c, case)))
+        .collect()
+}
diff --git a/userland/nonos_vt/src/term/sgr.rs b/userland/nonos_vt/src/term/sgr.rs
new file mode 100644
index 000000000..09216f611
--- /dev/null
+++ b/userland/nonos_vt/src/term/sgr.rs
@@ -0,0 +1,61 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! SGR: the pen's colours and attributes. Colours read the same whether a
+//! program writes `38;2;r;g;b`, `38:2:r:g:b` or `38:2::r:g:b`.
+
+use super::sgr_attr::plain;
+use super::sgr_colour::{colour_from_group, colour_from_spread};
+use super::state::Term;
+use crate::cell::Pen;
+use crate::params::Params;
+
+impl Term {
+    pub(super) fn sgr(&mut self, p: &Params) {
+        let groups: alloc::vec::Vec<&[u16]> = p.groups().collect();
+        let mut pen = self.scr_ref().cur.pen;
+        if groups.is_empty() {
+            pen = Pen { link: pen.link, ..Pen::default() };
+        }
+        let mut i = 0;
+        while i < groups.len() {
+            let g = groups[i];
+            i += 1;
+            if !matches!(g[0], 38 | 48 | 58) {
+                plain(&mut pen, g);
+                continue;
+            }
+            let colour = if g.len() > 1 {
+                colour_from_group(g)
+            } else {
+                // The semicolon form spreads over the next groups.
+                let (c, used) = colour_from_spread(&groups[i..]);
+                i += used;
+                c
+            };
+            /*
+             * Underline colour (58) is read so its numbers are not taken for
+             * other attributes, and not drawn.
+             */
+            match (g[0], colour) {
+                (38, Some(c)) => pen.fg = c,
+                (48, Some(c)) => pen.bg = c,
+                _ => {}
+            }
+        }
+        self.scr().cur.pen = pen;
+    }
+}
diff --git a/userland/nonos_vt/src/term/sgr_attr.rs b/userland/nonos_vt/src/term/sgr_attr.rs
new file mode 100644
index 000000000..406bac138
--- /dev/null
+++ b/userland/nonos_vt/src/term/sgr_attr.rs
@@ -0,0 +1,58 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! SGR codes that set one attribute or one of the sixteen named colours.
+
+use crate::cell::{attr, Pen};
+use crate::color::Color;
+
+fn set_underline(pen: &mut Pen, style: u16) {
+    pen.attr = (pen.attr & !attr::UNDERLINE_MASK) | (style.min(5) << attr::UNDERLINE_SHIFT);
+}
+
+/// Apply group `g`, a code with any sub-parameters. Codes this terminal
+/// does not draw are read and ignored.
+pub(super) fn plain(pen: &mut Pen, g: &[u16]) {
+    let code = g[0];
+    match code {
+        0 => *pen = Pen { link: pen.link, ..Pen::default() },
+        1 => pen.attr |= attr::BOLD,
+        2 => pen.attr |= attr::DIM,
+        3 => pen.attr |= attr::ITALIC,
+        4 => set_underline(pen, g.get(1).copied().unwrap_or(1)),
+        5 | 6 => pen.attr |= attr::BLINK,
+        7 => pen.attr |= attr::INVERSE,
+        8 => pen.attr |= attr::HIDDEN,
+        9 => pen.attr |= attr::STRIKE,
+        21 => set_underline(pen, 2),
+        22 => pen.attr &= !(attr::BOLD | attr::DIM),
+        23 => pen.attr &= !attr::ITALIC,
+        24 => set_underline(pen, 0),
+        25 => pen.attr &= !attr::BLINK,
+        27 => pen.attr &= !attr::INVERSE,
+        28 => pen.attr &= !attr::HIDDEN,
+        29 => pen.attr &= !attr::STRIKE,
+        30..=37 => pen.fg = Color::Indexed((code - 30) as u8),
+        39 => pen.fg = Color::Default,
+        40..=47 => pen.bg = Color::Indexed((code - 40) as u8),
+        49 => pen.bg = Color::Default,
+        53 => pen.attr |= attr::OVERLINE,
+        55 => pen.attr &= !attr::OVERLINE,
+        90..=97 => pen.fg = Color::Indexed((code - 90 + 8) as u8),
+        100..=107 => pen.bg = Color::Indexed((code - 100 + 8) as u8),
+        _ => {}
+    }
+}
diff --git a/userland/nonos_vt/src/term/sgr_colour.rs b/userland/nonos_vt/src/term/sgr_colour.rs
new file mode 100644
index 000000000..8476514b7
--- /dev/null
+++ b/userland/nonos_vt/src/term/sgr_colour.rs
@@ -0,0 +1,53 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Extended colours after 38, 48 and 58, in either notation. A component
+//! past 255 makes the colour invalid, not wrapped.
+
+use crate::color::Color;
+
+fn byte(v: u16) -> Option<u8> {
+    u8::try_from(v).ok()
+}
+
+/// From a colon group: `[38, 5, n]`, `[38, 2, r, g, b]` or
+/// `[38, 2, space, r, g, b]`.
+pub(super) fn colour_from_group(g: &[u16]) -> Option<Color> {
+    match g.get(1)? {
+        5 => byte(*g.get(2)?).map(Color::Indexed),
+        2 => {
+            let rgb = if g.len() >= 6 { &g[3..6] } else { g.get(2..5)? };
+            Some(Color::Rgb(byte(rgb[0])?, byte(rgb[1])?, byte(rgb[2])?))
+        }
+        _ => None,
+    }
+}
+
+/// `5;n` or `2;r;g;b` spread over the groups after a 38 or 48. Returns the
+/// colour and how many groups it took, so a malformed colour cannot swallow
+/// what follows it beyond its own length.
+pub(super) fn colour_from_spread(rest: &[&[u16]]) -> (Option<Color>, usize) {
+    let v = |i: usize| rest.get(i).map(|g| g[0]);
+    match v(0) {
+        Some(5) => (v(1).and_then(byte).map(Color::Indexed), 2.min(rest.len())),
+        Some(2) => {
+            let c = (|| Some(Color::Rgb(byte(v(1)?)?, byte(v(2)?)?, byte(v(3)?)?)))();
+            (c, 4.min(rest.len()))
+        }
+        Some(_) => (None, 1),
+        None => (None, 0),
+    }
+}
diff --git a/userland/nonos_vt/src/term/soft_reset.rs b/userland/nonos_vt/src/term/soft_reset.rs
new file mode 100644
index 000000000..2e77e253d
--- /dev/null
+++ b/userland/nonos_vt/src/term/soft_reset.rs
@@ -0,0 +1,40 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! DECSTR: a soft reset.
+
+use super::state::Term;
+use crate::cell::Pen;
+use crate::charset::Charsets;
+
+impl Term {
+    /// DECSTR: modes and pen to their defaults, screen contents untouched.
+    pub(super) fn soft_reset(&mut self) {
+        let m = &mut self.modes;
+        m.insert = false;
+        m.origin = false;
+        m.autowrap = true;
+        m.cursor_visible = true;
+        m.keypad = false;
+        m.cursor_keys = false;
+        self.charsets = Charsets::default();
+        let scr = self.scr();
+        scr.reset_region();
+        scr.cur.pen = Pen::default();
+        scr.cur.pending_wrap = false;
+        scr.saved = None;
+    }
+}
diff --git a/userland/nonos_vt/src/term/state.rs b/userland/nonos_vt/src/term/state.rs
new file mode 100644
index 000000000..b6bcce53f
--- /dev/null
+++ b/userland/nonos_vt/src/term/state.rs
@@ -0,0 +1,71 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Everything the terminal holds.
+
+use alloc::collections::VecDeque;
+use alloc::string::String;
+use alloc::vec::Vec;
+
+use super::modes_type::Modes;
+use super::screen::Screen;
+use super::types::{ClipboardRequest, CursorShape};
+use crate::charset::Charsets;
+use crate::color::Palette;
+use crate::line::Line;
+use crate::parser::Parser;
+
+pub struct Term {
+    pub(super) cols: usize,
+    pub(super) rows: usize,
+    pub(super) primary: Screen,
+    pub(super) alt: Screen,
+    pub(super) alt_active: bool,
+    pub(super) scrollback: VecDeque<Line>,
+    pub(super) scrollback_limit: usize,
+    /// Lines that ever left the top of the normal screen. The first line of
+    /// the normal screen is absolute line `scrolled`.
+    pub(super) scrolled: u64,
+    /// How many lines the view is scrolled back into history.
+    pub(super) view: usize,
+    pub modes: Modes,
+    pub(super) tabs: Vec<bool>,
+    pub(super) charsets: Charsets,
+    /// For REP, and for joining the character after a zero width joiner.
+    pub(super) last_char: Option<char>,
+    pub(super) after_zwj: bool,
+    pub(super) parser: Parser,
+    pub(super) replies: Vec<u8>,
+    pub(super) title: String,
+    pub(super) title_stack: Vec<String>,
+    pub(super) title_gen: u32,
+    pub(super) cwd: Option<String>,
+    pub(super) clipboard: Option<ClipboardRequest>,
+    /// Clipboard reads a program asked for and was refused.
+    pub(super) clipboard_reads_refused: u32,
+    pub(super) bell: u32,
+    /// The theme the host set, and the palette programs may have changed.
+    pub(super) theme: Palette,
+    pub(super) palette: Palette,
+    pub(super) links: Vec<String>,
+    pub(super) cursor_shape: CursorShape,
+    /// Absolute lines where a shell prompt started (OSC 133 A).
+    pub(super) prompts: VecDeque<u64>,
+    /// Rows to redraw.
+    pub(super) dirty: Vec<bool>,
+    /// Cell size in pixels, set by the host, for programs that ask.
+    pub(super) cell_px: (u16, u16),
+}
diff --git a/userland/nonos_vt/src/term/tab_stops.rs b/userland/nonos_vt/src/term/tab_stops.rs
new file mode 100644
index 000000000..7853b8820
--- /dev/null
+++ b/userland/nonos_vt/src/term/tab_stops.rs
@@ -0,0 +1,42 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! HTS and TBC: setting and clearing tab stops.
+
+use super::state::Term;
+
+impl Term {
+    pub(super) fn set_tab(&mut self) {
+        let x = self.scr_ref().cur.x;
+        if let Some(t) = self.tabs.get_mut(x) {
+            *t = true;
+        }
+    }
+
+    /// TBC: 0 clears the stop at the cursor, 3 clears them all.
+    pub(super) fn clear_tabs(&mut self, mode: u16) {
+        match mode {
+            0 => {
+                let x = self.scr_ref().cur.x;
+                if let Some(t) = self.tabs.get_mut(x) {
+                    *t = false;
+                }
+            }
+            3 => self.tabs.iter_mut().for_each(|t| *t = false),
+            _ => {}
+        }
+    }
+}
diff --git a/userland/nonos_vt/src/term/tabs.rs b/userland/nonos_vt/src/term/tabs.rs
new file mode 100644
index 000000000..c8b186d0d
--- /dev/null
+++ b/userland/nonos_vt/src/term/tabs.rs
@@ -0,0 +1,60 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Tab stops: every eighth column until a program sets its own.
+
+use alloc::vec::Vec;
+
+use super::state::Term;
+
+pub(super) fn default_tabs(cols: usize) -> Vec<bool> {
+    (0..cols).map(|x| x > 0 && x % 8 == 0).collect()
+}
+
+impl Term {
+    pub(super) fn tab_forward(&mut self, n: usize) {
+        let last = self.cols - 1;
+        let mut x = self.scr_ref().cur.x;
+        for _ in 0..n.min(self.cols) {
+            match (x + 1..self.cols).find(|&c| self.tabs[c]) {
+                Some(next) => x = next,
+                None => {
+                    x = last;
+                    break;
+                }
+            }
+        }
+        let cur = &mut self.scr().cur;
+        cur.x = x;
+        cur.pending_wrap = false;
+    }
+
+    pub(super) fn tab_back(&mut self, n: usize) {
+        let mut x = self.scr_ref().cur.x;
+        for _ in 0..n.min(self.cols) {
+            match (0..x).rev().find(|&c| self.tabs[c]) {
+                Some(prev) => x = prev,
+                None => {
+                    x = 0;
+                    break;
+                }
+            }
+        }
+        let cur = &mut self.scr().cur;
+        cur.x = x;
+        cur.pending_wrap = false;
+    }
+}
diff --git a/userland/nonos_vt/src/term/text.rs b/userland/nonos_vt/src/term/text.rs
new file mode 100644
index 000000000..7e31ea713
--- /dev/null
+++ b/userland/nonos_vt/src/term/text.rs
@@ -0,0 +1,74 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Reading text back out, for copying a selection.
+
+use alloc::string::String;
+
+use super::state::Term;
+use super::types::Pos;
+use crate::line::Line;
+
+fn push_cell(out: &mut String, line: &Line, x: usize) {
+    let c = line.cell(x);
+    if c.is_tail() {
+        return;
+    }
+    out.push(c.ch);
+    if let Some(m) = line.marks_of(&c) {
+        out.push_str(m);
+    }
+}
+
+impl Term {
+    /// The text from `a` to `b`, both inclusive, in either order. Lines that
+    /// wrapped join without a break; other line ends lose trailing blanks
+    /// and become newlines. `block` takes the same columns from each line.
+    pub fn text_between(&self, a: Pos, b: Pos, block: bool) -> String {
+        let (s, e) = if a <= b { (a, b) } else { (b, a) };
+        let (left, right) = (s.col.min(e.col), s.col.max(e.col));
+        let mut out = String::new();
+        let mut line_no = s.line;
+        while line_no <= e.line {
+            let Some(line) = self.line_at(line_no) else {
+                line_no += 1;
+                continue;
+            };
+            let (from, to) = if block {
+                (left, right)
+            } else {
+                let from = if line_no == s.line { s.col } else { 0 };
+                let to = if line_no == e.line { e.col } else { self.cols - 1 };
+                (from, to)
+            };
+            let mut piece = String::new();
+            for x in from..=to.min(self.cols - 1) {
+                push_cell(&mut piece, line, x);
+            }
+            let runs_on = line.wrapped && !block && line_no != e.line;
+            if !runs_on {
+                let trimmed = piece.trim_end_matches(' ').len();
+                piece.truncate(trimmed);
+            }
+            out.push_str(&piece);
+            if line_no != e.line && !runs_on {
+                out.push('\n');
+            }
+            line_no += 1;
+        }
+        out
+    }
+}
diff --git a/userland/nonos_vt/src/term/types.rs b/userland/nonos_vt/src/term/types.rs
new file mode 100644
index 000000000..3c696e076
--- /dev/null
+++ b/userland/nonos_vt/src/term/types.rs
@@ -0,0 +1,56 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The terminal's modes and the small types its public surface uses.
+
+use alloc::vec::Vec;
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Default)]
+pub enum CursorShape {
+    #[default]
+    Block,
+    Underline,
+    Bar,
+}
+
+/// Where and how the cursor is drawn on the visible rows.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub struct CursorView {
+    pub x: usize,
+    pub y: usize,
+    /// False when the program hid it or the view is scrolled away from it.
+    pub visible: bool,
+    pub shape: CursorShape,
+    pub blink: bool,
+}
+
+/// A position in the whole history: an absolute line number, counted from
+/// the first line this terminal ever had, and a column.
+#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Debug, Default)]
+pub struct Pos {
+    pub line: u64,
+    pub col: usize,
+}
+
+/// OSC 52: a program asked to set a clipboard. The host decides whether to
+/// honour it. Asking to read a clipboard is never answered.
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct ClipboardRequest {
+    /// The selection names the program gave, such as `c` or `p`.
+    pub targets: Vec<u8>,
+    /// The text, still base64 encoded as the program sent it.
+    pub base64: Vec<u8>,
+}
diff --git a/userland/nonos_vt/src/term/view.rs b/userland/nonos_vt/src/term/view.rs
new file mode 100644
index 000000000..3105fb62d
--- /dev/null
+++ b/userland/nonos_vt/src/term/view.rs
@@ -0,0 +1,72 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! What the host draws: the visible rows, the cursor, which rows changed,
+//! and each cell's final colours.
+
+use super::state::Term;
+use crate::line::Line;
+
+impl Term {
+    pub fn cols(&self) -> usize {
+        self.cols
+    }
+
+    pub fn rows(&self) -> usize {
+        self.rows
+    }
+
+    pub fn history_len(&self) -> usize {
+        self.scrollback.len()
+    }
+
+    pub fn view_offset(&self) -> usize {
+        self.view
+    }
+
+    /// Row `row` of what is on view, history included when scrolled back.
+    pub fn visible_line(&self, row: usize) -> &Line {
+        let row = row.min(self.rows - 1);
+        if self.alt_active {
+            return &self.alt.lines[row];
+        }
+        let sb = self.scrollback.len();
+        let i = sb + row - self.view.min(sb);
+        if i < sb {
+            &self.scrollback[i]
+        } else {
+            &self.primary.lines[i - sb]
+        }
+    }
+
+    /// Scroll the view: positive goes back into history. The alternate
+    /// screen has none.
+    pub fn scroll_view(&mut self, delta: isize) {
+        if self.alt_active {
+            return;
+        }
+        let max = self.scrollback.len() as isize;
+        let v = (self.view as isize).saturating_add(delta).clamp(0, max) as usize;
+        if v != self.view {
+            self.view = v;
+            self.touch_all();
+        }
+    }
+
+    pub fn scroll_to_bottom(&mut self) {
+        self.scroll_view(isize::MIN);
+    }
+}
diff --git a/userland/nonos_vt/src/term/view_draw.rs b/userland/nonos_vt/src/term/view_draw.rs
new file mode 100644
index 000000000..572fad0f8
--- /dev/null
+++ b/userland/nonos_vt/src/term/view_draw.rs
@@ -0,0 +1,65 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! What a frame needs besides the rows: the cursor, which rows changed,
+//! and each cell's final colours.
+
+use super::state::Term;
+use super::types::CursorView;
+use crate::cell::{attr, Cell};
+use crate::color::{dim, Palette};
+use alloc::vec::Vec;
+
+impl Term {
+    pub fn cursor(&self) -> CursorView {
+        let s = self.scr_ref();
+        CursorView {
+            x: s.cur.x,
+            y: s.cur.y,
+            visible: self.modes.cursor_visible && self.view == 0,
+            shape: self.cursor_shape,
+            blink: self.modes.cursor_blink,
+        }
+    }
+
+    /// Which rows changed since the last call, then forgets.
+    pub fn take_dirty(&mut self) -> Vec<bool> {
+        let fresh = alloc::vec![false; self.rows];
+        core::mem::replace(&mut self.dirty, fresh)
+    }
+
+    pub fn palette(&self) -> &Palette {
+        &self.palette
+    }
+
+    /// The colours a cell is drawn in, after bold brightening, dim, inverse,
+    /// hidden and reverse video.
+    pub fn cell_colors(&self, cell: &Cell) -> (u32, u32) {
+        let bold = cell.attr & attr::BOLD != 0;
+        let mut fg = self.palette.fg_of(cell.fg, bold);
+        let mut bg = self.palette.bg_of(cell.bg);
+        if cell.attr & attr::DIM != 0 {
+            fg = dim(fg);
+        }
+        if (cell.attr & attr::INVERSE != 0) != self.modes.reverse_video {
+            core::mem::swap(&mut fg, &mut bg);
+        }
+        if cell.attr & attr::HIDDEN != 0 {
+            fg = bg;
+        }
+        (fg, bg)
+    }
+}
diff --git a/userland/nonos_vt/src/term/view_text.rs b/userland/nonos_vt/src/term/view_text.rs
new file mode 100644
index 000000000..49a6ef674
--- /dev/null
+++ b/userland/nonos_vt/src/term/view_text.rs
@@ -0,0 +1,49 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The visible rows as plain text, for self-tests, screen readers and
+//! whatever else needs what is shown rather than how.
+
+use alloc::string::String;
+use alloc::vec::Vec;
+
+use super::state::Term;
+
+impl Term {
+    /// Visible row `y` as text, marks included, trailing blanks dropped.
+    pub fn row_text(&self, y: usize) -> String {
+        let line = self.visible_line(y);
+        let mut s = String::new();
+        for x in 0..self.cols {
+            let c = line.cell(x);
+            if c.is_tail() {
+                continue;
+            }
+            s.push(c.ch);
+            if let Some(m) = line.marks_of(&c) {
+                s.push_str(m);
+            }
+        }
+        let n = s.trim_end().len();
+        s.truncate(n);
+        s
+    }
+
+    /// Every visible row, as `row_text` gives it.
+    pub fn screen_text(&self) -> Vec<String> {
+        (0..self.rows).map(|y| self.row_text(y)).collect()
+    }
+}
diff --git a/userland/nonos_vt/src/url.rs b/userland/nonos_vt/src/url.rs
new file mode 100644
index 000000000..8d7b171f9
--- /dev/null
+++ b/userland/nonos_vt/src/url.rs
@@ -0,0 +1,68 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Finding URLs in text a program printed, so the host can offer to open
+//! one. Only schemes a person would follow are recognised.
+
+const SCHEMES: [&str; 6] = ["https://", "http://", "file://", "ftp://", "ssh://", "git://"];
+
+fn url_char(c: char) -> bool {
+    !c.is_whitespace() && !c.is_control() && !"<>\"'`{}|\\^".contains(c)
+}
+
+/// Every URL in `text`, as char index ranges `[start, end)`. Trailing
+/// punctuation is dropped unless it closes a bracket the URL opened.
+pub fn find_urls(text: &[char]) -> alloc::vec::Vec<(usize, usize)> {
+    let mut out = alloc::vec::Vec::new();
+    let mut i = 0;
+    while i < text.len() {
+        let hit = SCHEMES.iter().find(|s| {
+            let n = s.chars().count();
+            i + n <= text.len()
+                && s.chars().zip(&text[i..i + n]).all(|(a, &b)| a.eq_ignore_ascii_case(&b))
+        });
+        let Some(s) = hit else {
+            i += 1;
+            continue;
+        };
+        let start = i;
+        let mut end = i + s.len();
+        while end < text.len() && url_char(text[end]) {
+            end += 1;
+        }
+        while end > start + s.len() {
+            let c = text[end - 1];
+            let opens = |o: char| text[start..end].iter().filter(|&&x| x == o).count();
+            let closes = |cl: char| text[start..end].iter().filter(|&&x| x == cl).count();
+            let unbalanced = match c {
+                ')' => closes(')') > opens('('),
+                ']' => closes(']') > opens('['),
+                '.' | ',' | ';' | ':' | '!' | '?' => true,
+                _ => false,
+            };
+            if unbalanced {
+                end -= 1;
+            } else {
+                break;
+            }
+        }
+        if end > start + s.len() {
+            out.push((start, end));
+        }
+        i = end.max(i + 1);
+    }
+    out
+}
diff --git a/userland/nonos_vt/src/utf8/mod.rs b/userland/nonos_vt/src/utf8/mod.rs
new file mode 100644
index 000000000..16c46eac6
--- /dev/null
+++ b/userland/nonos_vt/src/utf8/mod.rs
@@ -0,0 +1,23 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! UTF-8 decoding that survives a character split across two reads and never
+//! accepts an overlong form, a surrogate or a value past U+10FFFF.
+
+mod push;
+mod state;
+
+pub use state::{Step, Utf8};
diff --git a/userland/nonos_vt/src/utf8/push.rs b/userland/nonos_vt/src/utf8/push.rs
new file mode 100644
index 000000000..791ddaad3
--- /dev/null
+++ b/userland/nonos_vt/src/utf8/push.rs
@@ -0,0 +1,58 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! One byte into the decoder.
+
+use super::state::{Step, Utf8};
+
+impl Utf8 {
+    pub fn push(&mut self, b: u8) -> Step {
+        if self.need > 0 {
+            if b & 0xC0 != 0x80 {
+                self.reset();
+                return Step::Invalid { again: true };
+            }
+            self.cp = (self.cp << 6) | (b & 0x3F) as u32;
+            self.need -= 1;
+            if self.need > 0 {
+                return Step::Pending;
+            }
+            let (cp, min) = (self.cp, self.min);
+            self.reset();
+            if cp < min || (0xD800..=0xDFFF).contains(&cp) {
+                return Step::Invalid { again: false };
+            }
+            return match char::from_u32(cp) {
+                Some(c) => Step::Char(c),
+                None => Step::Invalid { again: false },
+            };
+        }
+        match b {
+            0x00..=0x7F => Step::Char(b as char),
+            0xC2..=0xDF => self.start(b & 0x1F, 1, 0x80),
+            0xE0..=0xEF => self.start(b & 0x0F, 2, 0x800),
+            0xF0..=0xF4 => self.start(b & 0x07, 3, 0x1_0000),
+            _ => Step::Invalid { again: false },
+        }
+    }
+
+    fn start(&mut self, bits: u8, need: u8, min: u32) -> Step {
+        self.cp = bits as u32;
+        self.need = need;
+        self.min = min;
+        Step::Pending
+    }
+}
diff --git a/userland/nonos_vt/src/utf8/state.rs b/userland/nonos_vt/src/utf8/state.rs
new file mode 100644
index 000000000..562b04a07
--- /dev/null
+++ b/userland/nonos_vt/src/utf8/state.rs
@@ -0,0 +1,45 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The decoder's state between bytes.
+
+#[derive(Clone, Copy, Default, Debug)]
+pub struct Utf8 {
+    pub(super) cp: u32,
+    pub(super) need: u8,
+    pub(super) min: u32,
+}
+
+pub enum Step {
+    /// More bytes are needed.
+    Pending,
+    Char(char),
+    /// The sequence was malformed. When `again` is set, the byte that broke
+    /// it starts something new and must be fed again.
+    Invalid {
+        again: bool,
+    },
+}
+
+impl Utf8 {
+    pub fn pending(&self) -> bool {
+        self.need > 0
+    }
+
+    pub fn reset(&mut self) {
+        *self = Utf8::default();
+    }
+}
diff --git a/userland/nonos_vt/src/width/check.rs b/userland/nonos_vt/src/width/check.rs
new file mode 100644
index 000000000..1cee93905
--- /dev/null
+++ b/userland/nonos_vt/src/width/check.rs
@@ -0,0 +1,43 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The lookup is a binary search, so each table must be sorted and its
+//! ranges must not overlap, and the two halves of the zero table must meet
+//! in order.
+
+use super::wide::WIDE;
+use super::zero_high::ZERO_HIGH;
+use super::zero_low::ZERO_LOW;
+
+fn sorted(t: &[(u32, u32)]) -> bool {
+    t.iter().all(|&(lo, hi)| lo <= hi) && t.windows(2).all(|w| w[0].1 < w[1].0)
+}
+
+#[test]
+fn tables_are_sorted_and_disjoint() {
+    assert!(sorted(ZERO_LOW) && sorted(ZERO_HIGH) && sorted(WIDE));
+    assert!(ZERO_LOW.last().unwrap().1 < ZERO_HIGH[0].0);
+}
+
+#[test]
+fn known_widths() {
+    use super::lookup::width;
+    for (c, w) in
+        [('a', 1), ('\u{301}', 0), ('漢', 2), ('한', 2), ('🚀', 2), ('\u{fe0f}', 0), ('│', 1)]
+    {
+        assert_eq!(width(c), w, "{c:?}");
+    }
+}
diff --git a/userland/nonos_vt/src/width/lookup.rs b/userland/nonos_vt/src/width/lookup.rs
new file mode 100644
index 000000000..bc91f0dfb
--- /dev/null
+++ b/userland/nonos_vt/src/width/lookup.rs
@@ -0,0 +1,57 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Looking a character up in the width tables.
+
+use super::wide::WIDE;
+use super::zero_high::ZERO_HIGH;
+use super::zero_low::ZERO_LOW;
+
+fn within(table: &[(u32, u32)], c: u32) -> bool {
+    table
+        .binary_search_by(|&(lo, hi)| {
+            if hi < c {
+                core::cmp::Ordering::Less
+            } else if lo > c {
+                core::cmp::Ordering::Greater
+            } else {
+                core::cmp::Ordering::Equal
+            }
+        })
+        .is_ok()
+}
+
+pub fn width(c: char) -> usize {
+    let u = c as u32;
+    if u < 0x300 {
+        return 1;
+    }
+    if within(ZERO_LOW, u) || within(ZERO_HIGH, u) {
+        0
+    } else if within(WIDE, u) {
+        2
+    } else {
+        1
+    }
+}
+
+/// Zero width joiner: the character after it joins the one before.
+pub const ZWJ: char = '\u{200D}';
+
+/// Skin tone modifiers, which join the emoji before them.
+pub fn is_emoji_modifier(c: char) -> bool {
+    matches!(c as u32, 0x1F3FB..=0x1F3FF)
+}
diff --git a/userland/nonos_vt/src/width/mod.rs b/userland/nonos_vt/src/width/mod.rs
new file mode 100644
index 000000000..7caacec15
--- /dev/null
+++ b/userland/nonos_vt/src/width/mod.rs
@@ -0,0 +1,30 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! How many columns a character takes: none for marks that combine with the
+//! character before them, two for East Asian wide and emoji presentation,
+//! else one. The tables follow Unicode 15 East Asian Width and general
+//! category Mn, the same split wcwidth makes, so a program's idea of a
+//! line's width and the screen's agree.
+
+#[cfg(test)]
+mod check;
+mod lookup;
+mod wide;
+mod zero_high;
+mod zero_low;
+
+pub use lookup::{is_emoji_modifier, width, ZWJ};
diff --git a/userland/nonos_vt/src/width/wide.rs b/userland/nonos_vt/src/width/wide.rs
new file mode 100644
index 000000000..714406fd6
--- /dev/null
+++ b/userland/nonos_vt/src/width/wide.rs
@@ -0,0 +1,40 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! East Asian Wide and Fullwidth, and emoji shown as emoji by default.
+
+#[rustfmt::skip]
+pub(super) const WIDE: &[(u32, u32)] = &[
+    (0x1100, 0x115F), (0x231A, 0x231B), (0x2329, 0x232A), (0x23E9, 0x23EC), (0x23F0, 0x23F0),
+    (0x23F3, 0x23F3), (0x25FD, 0x25FE), (0x2614, 0x2615), (0x2648, 0x2653), (0x267F, 0x267F),
+    (0x2693, 0x2693), (0x26A1, 0x26A1), (0x26AA, 0x26AB), (0x26BD, 0x26BE), (0x26C4, 0x26C5),
+    (0x26CE, 0x26CE), (0x26D4, 0x26D4), (0x26EA, 0x26EA), (0x26F2, 0x26F3), (0x26F5, 0x26F5),
+    (0x26FA, 0x26FA), (0x26FD, 0x26FD), (0x2705, 0x2705), (0x270A, 0x270B), (0x2728, 0x2728),
+    (0x274C, 0x274C), (0x274E, 0x274E), (0x2753, 0x2755), (0x2757, 0x2757), (0x2795, 0x2797),
+    (0x27B0, 0x27B0), (0x27BF, 0x27BF), (0x2B1B, 0x2B1C), (0x2B50, 0x2B50), (0x2B55, 0x2B55),
+    (0x2E80, 0x303E), (0x3041, 0x3247), (0x3250, 0x4DBF), (0x4E00, 0xA4CF), (0xA960, 0xA97F),
+    (0xAC00, 0xD7A3), (0xF900, 0xFAFF), (0xFE10, 0xFE19), (0xFE30, 0xFE6F), (0xFF00, 0xFF60),
+    (0xFFE0, 0xFFE6), (0x16FE0, 0x16FE4), (0x16FF0, 0x16FF1), (0x17000, 0x18CD5), (0x18D00, 0x18D08),
+    (0x1AFF0, 0x1B2FB), (0x1F004, 0x1F004), (0x1F0CF, 0x1F0CF), (0x1F18E, 0x1F18E), (0x1F191, 0x1F19A),
+    (0x1F200, 0x1F202), (0x1F210, 0x1F23B), (0x1F240, 0x1F248), (0x1F250, 0x1F251), (0x1F260, 0x1F265),
+    (0x1F300, 0x1F320), (0x1F32D, 0x1F335), (0x1F337, 0x1F37C), (0x1F37E, 0x1F393), (0x1F3A0, 0x1F3CA),
+    (0x1F3CF, 0x1F3D3), (0x1F3E0, 0x1F3F0), (0x1F3F4, 0x1F3F4), (0x1F3F8, 0x1F43E), (0x1F440, 0x1F440),
+    (0x1F442, 0x1F4FC), (0x1F4FF, 0x1F53D), (0x1F54B, 0x1F54E), (0x1F550, 0x1F567), (0x1F57A, 0x1F57A),
+    (0x1F595, 0x1F596), (0x1F5A4, 0x1F5A4), (0x1F5FB, 0x1F64F), (0x1F680, 0x1F6C5), (0x1F6CC, 0x1F6CC),
+    (0x1F6D0, 0x1F6D2), (0x1F6D5, 0x1F6D7), (0x1F6DC, 0x1F6DF), (0x1F6EB, 0x1F6EC), (0x1F6F4, 0x1F6FC),
+    (0x1F7E0, 0x1F7EB), (0x1F7F0, 0x1F7F0), (0x1F90C, 0x1F93A), (0x1F93C, 0x1F945), (0x1F947, 0x1F9FF),
+    (0x1FA70, 0x1FAFF), (0x20000, 0x2FFFD), (0x30000, 0x3FFFD),
+];
diff --git a/userland/nonos_vt/src/width/zero_high.rs b/userland/nonos_vt/src/width/zero_high.rs
new file mode 100644
index 000000000..7c576d7d3
--- /dev/null
+++ b/userland/nonos_vt/src/width/zero_high.rs
@@ -0,0 +1,43 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Nonspacing marks and format characters from U+180B up.
+
+#[rustfmt::skip]
+pub(super) const ZERO_HIGH: &[(u32, u32)] = &[
+    (0x180B, 0x180F), (0x1885, 0x1886), (0x18A9, 0x18A9), (0x1920, 0x1922), (0x1927, 0x1928),
+    (0x1932, 0x1932), (0x1939, 0x193B), (0x1A17, 0x1A18), (0x1A1B, 0x1A1B), (0x1A56, 0x1A56),
+    (0x1A58, 0x1A60), (0x1A62, 0x1A62), (0x1A65, 0x1A6C), (0x1A73, 0x1A7F), (0x1AB0, 0x1ACE),
+    (0x1B00, 0x1B03), (0x1B34, 0x1B34), (0x1B36, 0x1B3A), (0x1B3C, 0x1B3C), (0x1B42, 0x1B42),
+    (0x1B6B, 0x1B73), (0x1B80, 0x1B81), (0x1BA2, 0x1BA5), (0x1BA8, 0x1BA9), (0x1BAB, 0x1BAD),
+    (0x1BE6, 0x1BE6), (0x1BE8, 0x1BE9), (0x1BED, 0x1BED), (0x1BEF, 0x1BF1), (0x1C2C, 0x1C33),
+    (0x1C36, 0x1C37), (0x1CD0, 0x1CD2), (0x1CD4, 0x1CE0), (0x1CE2, 0x1CE8), (0x1CED, 0x1CED),
+    (0x1CF4, 0x1CF4), (0x1CF8, 0x1CF9), (0x1DC0, 0x1DFF), (0x200B, 0x200F), (0x2028, 0x202E),
+    (0x2060, 0x2064), (0x20D0, 0x20F0), (0x2CEF, 0x2CF1), (0x2D7F, 0x2D7F), (0x2DE0, 0x2DFF),
+    (0x302A, 0x302D), (0x3099, 0x309A), (0xA66F, 0xA672), (0xA674, 0xA67D), (0xA69E, 0xA69F),
+    (0xA6F0, 0xA6F1), (0xA802, 0xA802), (0xA806, 0xA806), (0xA80B, 0xA80B), (0xA825, 0xA826),
+    (0xA82C, 0xA82C), (0xA8C4, 0xA8C5), (0xA8E0, 0xA8F1), (0xA8FF, 0xA8FF), (0xA926, 0xA92D),
+    (0xA947, 0xA951), (0xA980, 0xA982), (0xA9B3, 0xA9B3), (0xA9B6, 0xA9B9), (0xA9BC, 0xA9BD),
+    (0xA9E5, 0xA9E5), (0xAA29, 0xAA2E), (0xAA31, 0xAA32), (0xAA35, 0xAA36), (0xAA43, 0xAA43),
+    (0xAA4C, 0xAA4C), (0xAA7C, 0xAA7C), (0xAAB0, 0xAAB0), (0xAAB2, 0xAAB4), (0xAAB7, 0xAAB8),
+    (0xAABE, 0xAABF), (0xAAC1, 0xAAC1), (0xAAEC, 0xAAED), (0xAAF6, 0xAAF6), (0xABE5, 0xABE5),
+    (0xABE8, 0xABE8), (0xABED, 0xABED), (0xD7B0, 0xD7FF), (0xFB1E, 0xFB1E), (0xFE00, 0xFE0F),
+    (0xFE20, 0xFE2F), (0xFEFF, 0xFEFF), (0xFFF9, 0xFFFB), (0x101FD, 0x101FD), (0x10376, 0x1037A),
+    (0x10A01, 0x10A0F), (0x10A38, 0x10A3F), (0x11001, 0x11001), (0x11038, 0x11046), (0x1107F, 0x11081),
+    (0x110B3, 0x110B6), (0x110B9, 0x110BA), (0x11100, 0x11102), (0x11127, 0x1112B), (0x1112D, 0x11134),
+    (0x1D167, 0x1D169), (0x1D173, 0x1D182), (0x1D185, 0x1D18B), (0x1D1AA, 0x1D1AD), (0x1E000, 0x1E02A),
+    (0x1E8D0, 0x1E8D6), (0x1E944, 0x1E94A), (0xE0001, 0xE0001), (0xE0020, 0xE007F), (0xE0100, 0xE01EF),
+];
diff --git a/userland/nonos_vt/src/width/zero_low.rs b/userland/nonos_vt/src/width/zero_low.rs
new file mode 100644
index 000000000..db72e4fac
--- /dev/null
+++ b/userland/nonos_vt/src/width/zero_low.rs
@@ -0,0 +1,45 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Nonspacing marks and format characters below U+180B, drawn over the
+//! cell before them.
+
+#[rustfmt::skip]
+pub(super) const ZERO_LOW: &[(u32, u32)] = &[
+    (0x0300, 0x036F), (0x0483, 0x0489), (0x0591, 0x05BD), (0x05BF, 0x05BF), (0x05C1, 0x05C2),
+    (0x05C4, 0x05C5), (0x05C7, 0x05C7), (0x0610, 0x061A), (0x061C, 0x061C), (0x064B, 0x065F),
+    (0x0670, 0x0670), (0x06D6, 0x06DC), (0x06DF, 0x06E4), (0x06E7, 0x06E8), (0x06EA, 0x06ED),
+    (0x0711, 0x0711), (0x0730, 0x074A), (0x07A6, 0x07B0), (0x07EB, 0x07F3), (0x07FD, 0x07FD),
+    (0x0816, 0x0819), (0x081B, 0x0823), (0x0825, 0x0827), (0x0829, 0x082D), (0x0859, 0x085B),
+    (0x0898, 0x089F), (0x08CA, 0x08E1), (0x08E3, 0x0902), (0x093A, 0x093A), (0x093C, 0x093C),
+    (0x0941, 0x0948), (0x094D, 0x094D), (0x0951, 0x0957), (0x0962, 0x0963), (0x0981, 0x0981),
+    (0x09BC, 0x09BC), (0x09C1, 0x09C4), (0x09CD, 0x09CD), (0x09E2, 0x09E3), (0x09FE, 0x09FE),
+    (0x0A01, 0x0A02), (0x0A3C, 0x0A3C), (0x0A41, 0x0A51), (0x0A70, 0x0A71), (0x0A75, 0x0A75),
+    (0x0A81, 0x0A82), (0x0ABC, 0x0ABC), (0x0AC1, 0x0AC8), (0x0ACD, 0x0ACD), (0x0AE2, 0x0AE3),
+    (0x0AFA, 0x0AFF), (0x0B01, 0x0B01), (0x0B3C, 0x0B3C), (0x0B3F, 0x0B3F), (0x0B41, 0x0B44),
+    (0x0B4D, 0x0B56), (0x0B62, 0x0B63), (0x0B82, 0x0B82), (0x0BC0, 0x0BC0), (0x0BCD, 0x0BCD),
+    (0x0C00, 0x0C00), (0x0C04, 0x0C04), (0x0C3C, 0x0C3C), (0x0C3E, 0x0C40), (0x0C46, 0x0C56),
+    (0x0C62, 0x0C63), (0x0C81, 0x0C81), (0x0CBC, 0x0CBC), (0x0CCC, 0x0CCD), (0x0CE2, 0x0CE3),
+    (0x0D00, 0x0D01), (0x0D3B, 0x0D3C), (0x0D41, 0x0D44), (0x0D4D, 0x0D4D), (0x0D62, 0x0D63),
+    (0x0D81, 0x0D81), (0x0DCA, 0x0DCA), (0x0DD2, 0x0DD6), (0x0E31, 0x0E31), (0x0E34, 0x0E3A),
+    (0x0E47, 0x0E4E), (0x0EB1, 0x0EB1), (0x0EB4, 0x0EBC), (0x0EC8, 0x0ECE), (0x0F18, 0x0F19),
+    (0x0F35, 0x0F35), (0x0F37, 0x0F37), (0x0F39, 0x0F39), (0x0F71, 0x0F7E), (0x0F80, 0x0F84),
+    (0x0F86, 0x0F87), (0x0F8D, 0x0FBC), (0x0FC6, 0x0FC6), (0x102D, 0x1030), (0x1032, 0x1037),
+    (0x1039, 0x103A), (0x103D, 0x103E), (0x1058, 0x1059), (0x105E, 0x1060), (0x1071, 0x1074),
+    (0x1082, 0x1082), (0x1085, 0x1086), (0x108D, 0x108D), (0x109D, 0x109D), (0x1160, 0x11FF),
+    (0x135D, 0x135F), (0x1712, 0x1714), (0x1732, 0x1733), (0x1752, 0x1753), (0x1772, 0x1773),
+    (0x17B4, 0x17B5), (0x17B7, 0x17BD), (0x17C6, 0x17C6), (0x17C9, 0x17D3), (0x17DD, 0x17DD),
+];
diff --git a/userland/nonos_vt/tests/input.rs b/userland/nonos_vt/tests/input.rs
new file mode 100644
index 000000000..0f453cb65
--- /dev/null
+++ b/userland/nonos_vt/tests/input.rs
@@ -0,0 +1,60 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Keys, mouse and paste as a program reads them.
+
+use nonos_vt::input::{encode_key, Key, Mods};
+use nonos_vt::Modes;
+
+fn key(k: Key, m: Mods, modes: &Modes) -> Vec<u8> {
+    let mut v = Vec::new();
+    encode_key(k, m, modes, &mut v);
+    v
+}
+
+const NONE: Mods = Mods { shift: false, alt: false, ctrl: false };
+const CTRL: Mods = Mods { shift: false, alt: false, ctrl: true };
+const ALT: Mods = Mods { shift: false, alt: true, ctrl: false };
+
+#[test]
+fn cursor_keys_follow_the_mode() {
+    let mut m = Modes::default();
+    assert_eq!(key(Key::Up, NONE, &m), b"\x1b[A");
+    m.cursor_keys = true;
+    assert_eq!(key(Key::Up, NONE, &m), b"\x1bOA");
+    assert_eq!(key(Key::Right, CTRL, &m), b"\x1b[1;5C");
+}
+
+#[test]
+fn control_and_alt() {
+    let m = Modes::default();
+    assert_eq!(key(Key::Char('c'), CTRL, &m), [3]);
+    assert_eq!(key(Key::Char('['), CTRL, &m), [0x1b]);
+    assert_eq!(key(Key::Char('x'), ALT, &m), b"\x1bx");
+    assert_eq!(key(Key::Backspace, NONE, &m), [0x7f]);
+    assert_eq!(key(Key::Enter, NONE, &m), b"\r");
+    assert_eq!(key(Key::Tab, Mods { shift: true, ..NONE }, &m), b"\x1b[Z");
+}
+
+#[test]
+fn function_and_editing_keys() {
+    let m = Modes::default();
+    assert_eq!(key(Key::F(1), NONE, &m), b"\x1bOP");
+    assert_eq!(key(Key::F(5), NONE, &m), b"\x1b[15~");
+    assert_eq!(key(Key::F(12), CTRL, &m), b"\x1b[24;5~");
+    assert_eq!(key(Key::PageDown, NONE, &m), b"\x1b[6~");
+    assert_eq!(key(Key::Delete, NONE, &m), b"\x1b[3~");
+}
diff --git a/userland/nonos_vt/tests/input_pointer.rs b/userland/nonos_vt/tests/input_pointer.rs
new file mode 100644
index 000000000..51d539acf
--- /dev/null
+++ b/userland/nonos_vt/tests/input_pointer.rs
@@ -0,0 +1,57 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Paste, mouse reports and motion, as a program reads them.
+
+use nonos_vt::input::{encode_mouse, encode_paste, Button, Mods, MouseEvent, MouseKind};
+use nonos_vt::{Modes, MouseMode};
+
+const NONE: Mods = Mods { shift: false, alt: false, ctrl: false };
+
+#[test]
+fn paste_cannot_break_out_of_its_bracket() {
+    let m = Modes { bracketed_paste: true, ..Modes::default() };
+    let mut v = Vec::new();
+    encode_paste("ls\x1b[201~\nrm -rf ~\r\n", &m, &mut v);
+    assert_eq!(v, b"\x1b[200~ls[201~\rrm -rf ~\r\x1b[201~");
+}
+
+#[test]
+fn mouse_reports_only_when_asked() {
+    let ev =
+        MouseEvent { kind: MouseKind::Press, button: Button::Left, col: 4, row: 2, mods: NONE };
+    let mut v = Vec::new();
+    assert!(!encode_mouse(&ev, &Modes::default(), &mut v));
+    let m = Modes { mouse: MouseMode::Click, mouse_sgr: true, ..Modes::default() };
+    assert!(encode_mouse(&ev, &m, &mut v));
+    assert_eq!(v, b"\x1b[<0;5;3M");
+    let m = Modes { mouse: MouseMode::Click, ..Modes::default() };
+    let mut v = Vec::new();
+    encode_mouse(&ev, &m, &mut v);
+    assert_eq!(v, [0x1b, b'[', b'M', 32, 37, 35]);
+}
+
+#[test]
+fn motion_without_a_button_needs_any_motion_mode() {
+    let ev =
+        MouseEvent { kind: MouseKind::Motion, button: Button::None, col: 0, row: 0, mods: NONE };
+    let mut v = Vec::new();
+    let drag = Modes { mouse: MouseMode::Drag, mouse_sgr: true, ..Modes::default() };
+    assert!(!encode_mouse(&ev, &drag, &mut v));
+    let any = Modes { mouse: MouseMode::Motion, mouse_sgr: true, ..Modes::default() };
+    assert!(encode_mouse(&ev, &any, &mut v));
+    assert_eq!(v, b"\x1b[<35;1;1M");
+}
diff --git a/userland/nonos_vt/tests/mutate.rs b/userland/nonos_vt/tests/mutate.rs
new file mode 100644
index 000000000..6ae8708da
--- /dev/null
+++ b/userland/nonos_vt/tests/mutate.rs
@@ -0,0 +1,61 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Mutation fuzzing, deterministic and seeded, run as an ordinary test.
+//!
+//! Not coverage-guided: no libFuzzer is vendored in this tree. It builds
+//! byte streams from the pieces hostile output is made of (control
+//! sequences with random parameters and finals, strings, broken UTF-8, wide
+//! and combining characters, raw noise), interleaves resizes, scrolling,
+//! copying and searching, and after every step checks what must always
+//! hold: the cursor on screen, every screen row as wide as the screen, the
+//! reply queue under its ceiling. Debug builds trap on arithmetic overflow,
+//! so an overflow anywhere fails the test.
+
+use nonos_vt::Term;
+
+#[path = "support/check.rs"]
+mod check;
+#[path = "support/pieces.rs"]
+mod pieces;
+#[path = "support/rng.rs"]
+mod rng;
+
+use check::{check, poke};
+use pieces::piece;
+use rng::Rng;
+
+#[test]
+fn hostile_output_keeps_the_screen_sound() {
+    // A different seed explores different streams: NONOS_VT_SEED=n.
+    let seed = std::env::var("NONOS_VT_SEED").ok().and_then(|s| s.parse().ok()).unwrap_or(0x7E57);
+    let mut r = Rng::new(seed);
+    for round in 0..400 {
+        let mut t = Term::new(1 + (r.next() % 120) as usize, 1 + (r.next() % 50) as usize, 200);
+        for _ in 0..200 {
+            let mut bytes = Vec::new();
+            for _ in 0..(r.next() % 8) {
+                piece(&mut r, &mut bytes);
+            }
+            // Feed in pieces, so sequences split across reads too.
+            let cut = (r.next() as usize) % (bytes.len() + 1);
+            t.feed(&bytes[..cut]);
+            t.feed(&bytes[cut..]);
+            poke(&mut t, &mut r, round);
+            check(&mut t);
+        }
+    }
+}
diff --git a/userland/nonos_vt/tests/noise.rs b/userland/nonos_vt/tests/noise.rs
new file mode 100644
index 000000000..48bd3241b
--- /dev/null
+++ b/userland/nonos_vt/tests/noise.rs
@@ -0,0 +1,41 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Pure noise: random bytes with no structure, with the host resizing,
+//! scrolling and copying between them, which must never panic or leave the
+//! screen unsound.
+
+#[path = "support/check.rs"]
+mod check;
+#[path = "support/rng.rs"]
+mod rng;
+
+use check::{check, poke};
+use nonos_vt::Term;
+use rng::Rng;
+
+#[test]
+fn pure_noise_never_panics() {
+    let mut r = Rng::new(0xBAD);
+    let mut t = Term::new(80, 24, 1000);
+    for round in 0..20_000 {
+        let n = (r.next() % 64) as usize;
+        let bytes: Vec<u8> = (0..n).map(|_| (r.next() >> 56) as u8).collect();
+        t.feed(&bytes);
+        poke(&mut t, &mut r, round);
+        check(&mut t);
+    }
+}
diff --git a/userland/nonos_vt/tests/parser.rs b/userland/nonos_vt/tests/parser.rs
new file mode 100644
index 000000000..19f83d973
--- /dev/null
+++ b/userland/nonos_vt/tests/parser.rs
@@ -0,0 +1,61 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The parser on its own: what it reports for each kind of sequence, and
+//! that malformed input ends in a known state.
+
+#[path = "support/log.rs"]
+mod log;
+
+use log::run;
+
+#[test]
+fn private_marker_and_params() {
+    assert_eq!(run(b"\x1b[?1049h"), ["csi?h[1049]"]);
+    assert_eq!(run(b"\x1b[>c"), ["csi>c"]);
+    assert_eq!(run(b"\x1b[1;5H"), ["csi\0H[1][5]"]);
+}
+
+#[test]
+fn colon_sub_parameters_group() {
+    assert_eq!(run(b"\x1b[38:2::1:2:3m"), ["csi\0m[38, 2, 0, 1, 2, 3]"]);
+    assert_eq!(run(b"\x1b[4:3m"), ["csi\0m[4, 3]"]);
+}
+
+#[test]
+fn escape_inside_a_sequence_starts_a_new_one() {
+    assert_eq!(run(b"\x1b[12\x1b[Aa"), ["csi\0A", "pa"]);
+}
+
+#[test]
+fn cancel_abandons_a_sequence() {
+    assert_eq!(run(b"\x1b[12\x18A"), ["x18", "pA"]);
+}
+
+#[test]
+fn a_misplaced_marker_ignores_the_sequence() {
+    assert_eq!(run(b"\x1b[1?2hz"), ["pz"]);
+}
+
+#[test]
+fn too_many_params_ignores_the_sequence() {
+    let mut s = b"\x1b[".to_vec();
+    for _ in 0..40 {
+        s.extend_from_slice(b"1;");
+    }
+    s.extend_from_slice(b"mz");
+    assert_eq!(run(&s), ["pz"]);
+}
diff --git a/userland/nonos_vt/tests/parser_strings.rs b/userland/nonos_vt/tests/parser_strings.rs
new file mode 100644
index 000000000..8a46196ce
--- /dev/null
+++ b/userland/nonos_vt/tests/parser_strings.rs
@@ -0,0 +1,58 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! OSC, DCS and APC strings, oversized input, and UTF-8.
+
+#[path = "support/log.rs"]
+mod log;
+use log::{run, Log};
+use nonos_vt::parser::Parser;
+
+#[test]
+fn osc_ends_on_bel_or_st() {
+    assert_eq!(run(b"\x1b]0;hi\x07x"), ["osc0;hi", "px"]);
+    assert_eq!(run(b"\x1b]2;yo\x1b\\x"), ["osc2;yo", "esc\\", "px"]);
+}
+
+#[test]
+fn dcs_payload_and_apc_swallowed() {
+    assert_eq!(run(b"\x1bP+q544e\x1b\\"), ["dcs+q544e", "esc\\"]);
+    assert_eq!(run(b"\x1b_Gsecret\x1b\\z"), ["esc\\", "pz"]);
+}
+
+#[test]
+fn oversized_osc_is_dropped_whole() {
+    let mut s = b"\x1b]0;".to_vec();
+    s.extend(std::iter::repeat_n(b'a', 10_000));
+    s.extend_from_slice(b"\x07z");
+    assert_eq!(run(&s), ["pz"]);
+}
+
+#[test]
+fn utf8_split_across_feeds() {
+    let mut p = Parser::new();
+    let mut l = Log::default();
+    p.feed(&mut l, "é".as_bytes().split_at(1).0);
+    p.feed(&mut l, "é".as_bytes().split_at(1).1);
+    assert_eq!(l.0, ["pé"]);
+}
+
+#[test]
+fn utf8_cut_by_a_control_shows_a_replacement() {
+    assert_eq!(run(b"\xc3\n"), ["p\u{fffd}", "x0a"]);
+    assert_eq!(run(b"\xc0\xaf"), ["p\u{fffd}", "p\u{fffd}"]);
+    assert_eq!(run(b"\xed\xa0\x80"), ["p\u{fffd}"]);
+}
diff --git a/userland/nonos_vt/tests/reflow.rs b/userland/nonos_vt/tests/reflow.rs
new file mode 100644
index 000000000..a748d677b
--- /dev/null
+++ b/userland/nonos_vt/tests/reflow.rs
@@ -0,0 +1,55 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Resizing re-wraps text rather than cutting it.
+
+#[path = "support/term.rs"]
+mod support;
+
+use support::term;
+
+#[test]
+fn narrowing_wraps_and_widening_joins_again() {
+    let mut t = term(10, 3, "abcdefgh\r\nxy");
+    t.resize(4, 4);
+    assert_eq!(t.screen_text(), ["abcd", "efgh", "xy", ""]);
+    t.resize(10, 3);
+    assert_eq!(t.screen_text(), ["abcdefgh", "xy", ""]);
+}
+
+#[test]
+fn the_cursor_keeps_its_place_in_the_text() {
+    let mut t = term(10, 3, "abcdefgh");
+    assert_eq!((t.cursor().x, t.cursor().y), (8, 0));
+    t.resize(4, 3);
+    assert_eq!((t.cursor().x, t.cursor().y), (3, 1));
+    t.feed(b"Z");
+    assert_eq!(t.screen_text(), ["abcd", "efgh", "Z"]);
+}
+
+#[test]
+fn a_wide_character_is_never_split() {
+    let mut t = term(6, 2, "abc漢");
+    t.resize(4, 3);
+    assert_eq!(t.screen_text(), ["abc", "漢", ""]);
+}
+
+#[test]
+fn the_alternate_screen_is_cut_not_rewrapped() {
+    let mut t = term(8, 2, "\x1b[?1049habcdefgh");
+    t.resize(4, 2);
+    assert_eq!(t.screen_text(), ["abcd", ""]);
+}
diff --git a/userland/nonos_vt/tests/reflow_rows.rs b/userland/nonos_vt/tests/reflow_rows.rs
new file mode 100644
index 000000000..c41af36f9
--- /dev/null
+++ b/userland/nonos_vt/tests/reflow_rows.rs
@@ -0,0 +1,45 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Which rows a resize keeps on screen.
+
+#[path = "support/term.rs"]
+mod support;
+use support::term;
+
+#[test]
+fn lines_pushed_off_the_top_go_to_history() {
+    let mut t = term(4, 2, "a\r\nb");
+    t.resize(4, 1);
+    assert_eq!(t.screen_text(), ["b"]);
+    assert_eq!(t.history_len(), 1);
+}
+
+#[test]
+fn growing_at_the_foot_brings_history_back() {
+    let mut t = term(4, 2, "a\r\nb\r\nc");
+    assert_eq!(t.history_len(), 1);
+    t.resize(4, 3);
+    assert_eq!(t.screen_text(), ["a", "b", "c"]);
+    assert_eq!((t.cursor().x, t.cursor().y), (1, 2));
+}
+
+#[test]
+fn growing_mid_screen_opens_rows_below() {
+    let mut t = term(4, 3, "a\r\nb\r\nc\r\nd\x1b[1;1H");
+    t.resize(4, 5);
+    assert_eq!(t.screen_text(), ["b", "c", "d", "", ""]);
+}
diff --git a/userland/nonos_vt/tests/refusals.rs b/userland/nonos_vt/tests/refusals.rs
new file mode 100644
index 000000000..81ff9ee08
--- /dev/null
+++ b/userland/nonos_vt/tests/refusals.rs
@@ -0,0 +1,55 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! What a program may ask for and does not get, and the ceilings that keep
+//! a program from growing the terminal.
+
+#[path = "support/term.rs"]
+mod support;
+use nonos_vt::limits::MAX_REPLY;
+use support::term;
+
+#[test]
+fn a_program_that_never_reads_cannot_grow_the_queue() {
+    let mut t = term(80, 24, "");
+    for _ in 0..10_000 {
+        t.feed(b"\x1b[c");
+    }
+    assert!(t.take_replies().len() <= MAX_REPLY);
+}
+
+#[test]
+fn clipboard_reads_are_refused_and_writes_are_offered() {
+    let mut t = term(80, 24, "\x1b]52;c;?\x07");
+    assert!(t.take_replies().is_empty());
+    assert_eq!(t.clipboard_reads_refused(), 1);
+    t.feed(b"\x1b]52;c;aGk=\x07");
+    let r = t.take_clipboard_request().unwrap();
+    assert_eq!(r.base64, b"aGk=");
+}
+
+#[test]
+fn window_manipulation_is_ignored() {
+    // Move, resize and iconify: a program may not touch its window.
+    let mut t = term(80, 24, "\x1b[3;0;0t\x1b[8;1;1t\x1b[2t");
+    assert!(t.take_replies().is_empty());
+}
+
+#[test]
+fn titles_lose_control_bytes() {
+    let t = term(80, 24, "\x1b]0;a\u{9b}b\x07");
+    assert_eq!(t.title(), "ab");
+}
diff --git a/userland/nonos_vt/tests/report.rs b/userland/nonos_vt/tests/report.rs
new file mode 100644
index 000000000..d0dfbf642
--- /dev/null
+++ b/userland/nonos_vt/tests/report.rs
@@ -0,0 +1,67 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Answers a program waits for, and requests that are refused.
+
+#[path = "support/term.rs"]
+mod support;
+
+use support::term;
+
+fn replies(input: &str) -> String {
+    let mut t = term(80, 24, input);
+    String::from_utf8(t.take_replies()).unwrap()
+}
+
+#[test]
+fn identity_and_version() {
+    assert_eq!(replies("\x1b[c"), "\x1b[?62;22c");
+    assert_eq!(replies("\x1b[>c"), "\x1b[>1;10;0c");
+    assert!(replies("\x1b[>q").starts_with("\x1bP>|NONOS"));
+}
+
+#[test]
+fn cursor_position_is_one_based() {
+    assert_eq!(replies("\x1b[5;10H\x1b[6n"), "\x1b[5;10R");
+    assert_eq!(replies("\x1b[5n"), "\x1b[0n");
+}
+
+#[test]
+fn modes_are_reported() {
+    assert_eq!(replies("\x1b[?2004h\x1b[?2004$p"), "\x1b[?2004;1$y");
+    assert_eq!(replies("\x1b[?25$p"), "\x1b[?25;1$y");
+    assert_eq!(replies("\x1b[?9999$p"), "\x1b[?9999;0$y");
+}
+
+#[test]
+fn size_is_reported() {
+    assert_eq!(replies("\x1b[18t"), "\x1b[8;24;80t");
+}
+
+#[test]
+fn colours_are_reported() {
+    assert_eq!(replies("\x1b]11;?\x07"), "\x1b]11;rgb:0000/0000/0000\x1b\\");
+    assert_eq!(replies("\x1b]4;1;#ff0000\x07\x1b]4;1;?\x07"), "\x1b]4;1;rgb:ffff/0000/0000\x1b\\");
+}
+
+#[test]
+fn terminfo_queries_are_answered() {
+    // "TN" and an unknown "zz", hex encoded.
+    assert_eq!(
+        replies("\x1bP+q544e;7a7a\x1b\\"),
+        "\x1bP1+r544E=787465726D2D323536636F6C6F72\x1b\\\x1bP0+r7A7A\x1b\\"
+    );
+}
diff --git a/userland/nonos_vt/tests/screen.rs b/userland/nonos_vt/tests/screen.rs
new file mode 100644
index 000000000..c3d8c97ac
--- /dev/null
+++ b/userland/nonos_vt/tests/screen.rs
@@ -0,0 +1,57 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Printing, wrapping and history, against what xterm does for the
+//! sequences full-screen tools rely on.
+
+#[path = "support/term.rs"]
+mod support;
+
+use support::term;
+
+#[test]
+fn the_bottom_right_cell_does_not_scroll() {
+    // vim and htop draw their last line into the last cell.
+    let t = term(4, 2, "ab\r\nwxyz");
+    assert_eq!(t.screen_text(), ["ab", "wxyz"]);
+    assert_eq!((t.cursor().x, t.cursor().y), (3, 1));
+}
+
+#[test]
+fn a_full_line_then_newline_adds_no_blank_line() {
+    let t = term(4, 3, "abcd\r\nef");
+    assert_eq!(t.screen_text(), ["abcd", "ef", ""]);
+}
+
+#[test]
+fn printing_past_the_edge_wraps_and_marks_the_line() {
+    let t = term(4, 3, "abcdef");
+    assert_eq!(t.screen_text(), ["abcd", "ef", ""]);
+    assert!(t.visible_line(0).wrapped);
+}
+
+#[test]
+fn autowrap_off_overwrites_the_last_column() {
+    let t = term(4, 2, "\x1b[?7labcdef");
+    assert_eq!(t.screen_text(), ["abcf", ""]);
+}
+
+#[test]
+fn history_keeps_what_scrolls_off() {
+    let t = term(4, 2, "a\r\nb\r\nc\r\nd");
+    assert_eq!(t.history_len(), 2);
+    assert_eq!(t.row_text(0), "c");
+}
diff --git a/userland/nonos_vt/tests/screen_chars.rs b/userland/nonos_vt/tests/screen_chars.rs
new file mode 100644
index 000000000..7005571b0
--- /dev/null
+++ b/userland/nonos_vt/tests/screen_chars.rs
@@ -0,0 +1,57 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Wide and combining characters, and line drawing.
+
+#[path = "support/term.rs"]
+mod support;
+use support::term;
+
+#[test]
+fn wide_characters_take_two_cells_and_wrap_whole() {
+    let t = term(5, 2, "ab漢字");
+    assert_eq!(t.screen_text(), ["ab漢", "字"]);
+    assert!(t.visible_line(0).cell(2).is_wide());
+    assert!(t.visible_line(0).cell(3).is_tail());
+}
+
+#[test]
+fn overwriting_half_a_wide_character_blanks_the_other_half() {
+    let t = term(4, 1, "漢\x1b[1;2Hx");
+    let line = t.visible_line(0);
+    assert_eq!(line.cell(0).ch, ' ');
+    assert!(!line.cell(0).is_wide());
+    assert_eq!(line.cell(1).ch, 'x');
+}
+
+#[test]
+fn combining_marks_join_the_character_before() {
+    let t = term(4, 1, "e\u{301}x");
+    assert_eq!(t.row_text(0), "e\u{301}x");
+    assert_eq!((t.cursor().x, t.cursor().y), (2, 0));
+}
+
+#[test]
+fn emoji_joined_by_zwj_stay_in_one_cell_pair() {
+    let t = term(6, 1, "👩\u{200d}💻!");
+    assert_eq!(t.visible_line(0).cell(2).ch, '!');
+}
+
+#[test]
+fn dec_line_drawing() {
+    let t = term(4, 1, "\x1b(0lqk\x1b(Bq");
+    assert_eq!(t.row_text(0), "┌─┐q");
+}
diff --git a/userland/nonos_vt/tests/screen_colour.rs b/userland/nonos_vt/tests/screen_colour.rs
new file mode 100644
index 000000000..f6bb8133f
--- /dev/null
+++ b/userland/nonos_vt/tests/screen_colour.rs
@@ -0,0 +1,40 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! SGR colours and attributes as cells record them.
+
+#[path = "support/term.rs"]
+mod support;
+use nonos_vt::cell::attr;
+use nonos_vt::color::Color;
+use support::term;
+
+#[test]
+fn sgr_colours_in_both_notations() {
+    let t = term(4, 1, "\x1b[38;2;1;2;3ma\x1b[38:2::4:5:6mb\x1b[48;5;200mc\x1b[1;4:3md");
+    let l = t.visible_line(0);
+    assert_eq!(l.cell(0).fg, Color::Rgb(1, 2, 3));
+    assert_eq!(l.cell(1).fg, Color::Rgb(4, 5, 6));
+    assert_eq!(l.cell(2).bg, Color::Indexed(200));
+    assert_ne!(l.cell(3).attr & attr::BOLD, 0);
+    assert_eq!(l.cell(3).underline(), nonos_vt::Underline::Curly);
+}
+
+#[test]
+fn a_malformed_colour_does_not_eat_what_follows() {
+    let t = term(4, 1, "\x1b[38;2;300;1;1;1ma");
+    assert_ne!(t.visible_line(0).cell(0).attr & attr::BOLD, 0);
+}
diff --git a/userland/nonos_vt/tests/screen_cursor.rs b/userland/nonos_vt/tests/screen_cursor.rs
new file mode 100644
index 000000000..2ce67f96d
--- /dev/null
+++ b/userland/nonos_vt/tests/screen_cursor.rs
@@ -0,0 +1,72 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Saving the cursor, the alternate screen, tab stops, insert and origin
+//! modes.
+
+#[path = "support/term.rs"]
+mod support;
+use support::term;
+
+#[test]
+fn repeat_prints_the_last_character() {
+    let t = term(8, 1, "x\x1b[3b");
+    assert_eq!(t.row_text(0), "xxxx");
+}
+
+#[test]
+fn save_and_restore_the_cursor() {
+    let t = term(8, 3, "\x1b[2;3H\x1b7\x1b[H\x1b8X");
+    assert_eq!(t.row_text(1), "  X");
+    let t = term(8, 3, "\x1b[2;3H\x1b[s\x1b[H\x1b[uY");
+    assert_eq!(t.row_text(1), "  Y");
+}
+
+#[test]
+fn alternate_screen_restores_what_was_underneath() {
+    let t = term(8, 2, "shell\x1b[?1049hfull\x1b[?1049l");
+    assert_eq!(t.screen_text(), ["shell", ""]);
+    assert_eq!((t.cursor().x, t.cursor().y), (5, 0));
+    assert!(!t.alt_active());
+}
+
+#[test]
+fn alternate_screen_output_never_reaches_history() {
+    let mut t = term(4, 2, "\x1b[?1049h");
+    t.feed(b"1\r\n2\r\n3\r\n4\r\n");
+    t.feed(b"\x1b[?1049l");
+    assert_eq!(t.history_len(), 0);
+}
+
+#[test]
+fn tab_stops_set_and_cleared() {
+    let t = term(20, 1, "\ta");
+    assert_eq!((t.cursor().x, t.cursor().y), (9, 0));
+    let t = term(20, 1, "\x1b[3g\x1b[1;4H\x1bH\r\tb");
+    assert_eq!(t.row_text(0), "   b");
+}
+
+#[test]
+fn insert_mode_shifts_the_line() {
+    let t = term(6, 1, "abc\x1b[1;2H\x1b[4hX");
+    assert_eq!(t.row_text(0), "aXbc");
+}
+
+#[test]
+fn origin_mode_counts_from_the_region() {
+    let t = term(4, 4, "\x1b[2;3r\x1b[?6h\x1b[1;1HZ");
+    assert_eq!(t.row_text(1), "Z");
+}
diff --git a/userland/nonos_vt/tests/screen_region.rs b/userland/nonos_vt/tests/screen_region.rs
new file mode 100644
index 000000000..d677f772c
--- /dev/null
+++ b/userland/nonos_vt/tests/screen_region.rs
@@ -0,0 +1,69 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The scroll region, line insertion and deletion, and erasing.
+
+#[path = "support/term.rs"]
+mod support;
+use support::term;
+
+#[test]
+fn a_scroll_region_keeps_the_status_line() {
+    let t = term(6, 4, "\x1b[4;1Hstatus\x1b[1;3r\x1b[1;1Ha\r\nb\r\nc\r\nd");
+    assert_eq!(t.screen_text(), ["b", "c", "d", "status"]);
+}
+
+#[test]
+fn reverse_index_at_the_top_scrolls_down() {
+    let t = term(4, 3, "one\r\ntwo\x1b[H\x1bMnew");
+    assert_eq!(t.screen_text(), ["new", "one", "two"]);
+}
+
+#[test]
+fn insert_and_delete_lines_stay_inside_the_region() {
+    let t = term(4, 4, "a\r\nb\r\nc\r\nd\x1b[1;3r\x1b[2;1H\x1b[L");
+    assert_eq!(t.screen_text(), ["a", "", "b", "d"]);
+    let t = term(4, 4, "a\r\nb\r\nc\r\nd\x1b[1;3r\x1b[1;1H\x1b[M");
+    assert_eq!(t.screen_text(), ["b", "c", "", "d"]);
+}
+
+#[test]
+fn scroll_down_and_erase_chars() {
+    let t = term(4, 3, "a\r\nb\x1b[T");
+    assert_eq!(t.screen_text(), ["", "a", "b"]);
+    let t = term(6, 1, "abcdef\x1b[1;2H\x1b[3X");
+    assert_eq!(t.screen_text(), ["a   ef"]);
+    assert_eq!((t.cursor().x, t.cursor().y), (1, 0));
+}
+
+#[test]
+fn erase_to_start_includes_the_cursor_cell() {
+    let t = term(5, 1, "abcde\x1b[1;3H\x1b[1K");
+    assert_eq!(t.row_text(0), "   de");
+}
+
+#[test]
+fn erase_display_leaves_the_cursor() {
+    let t = term(5, 2, "ab\r\ncd\x1b[2J");
+    assert_eq!(t.screen_text(), ["", ""]);
+    assert_eq!((t.cursor().x, t.cursor().y), (2, 1));
+}
+
+#[test]
+fn a_huge_scroll_count_is_bounded() {
+    let t = term(4, 3, "a\x1b[65535S");
+    assert_eq!(t.screen_text(), ["", "", ""]);
+}
diff --git a/userland/nonos_vt/tests/support/check.rs b/userland/nonos_vt/tests/support/check.rs
new file mode 100644
index 000000000..d8fdf4820
--- /dev/null
+++ b/userland/nonos_vt/tests/support/check.rs
@@ -0,0 +1,58 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! What must hold after every step of a fuzz run, and the host actions a
+//! run interleaves with output.
+
+use nonos_vt::limits::MAX_REPLY;
+use nonos_vt::{Pos, Term};
+
+use super::rng::Rng;
+
+pub fn check(t: &mut Term) {
+    let c = t.cursor();
+    assert!(c.x < t.cols() && c.y < t.rows(), "cursor {c:?} off a {}x{}", t.cols(), t.rows());
+    if t.view_offset() == 0 {
+        for y in 0..t.rows() {
+            assert_eq!(t.visible_line(y).len(), t.cols(), "row {y}");
+        }
+    }
+    assert!(t.take_replies().len() <= MAX_REPLY);
+    assert_eq!(t.take_dirty().len(), t.rows());
+}
+
+fn pos(t: &Term, r: &mut Rng) -> Pos {
+    Pos { line: t.first_line() + r.next() % 300, col: (r.next() % 250) as usize }
+}
+
+/// Now and then resize, scroll, copy or search, as a person would while
+/// output streams in.
+pub fn poke(t: &mut Term, r: &mut Rng, round: usize) {
+    match r.next() % 16 {
+        0 => t.resize(1 + (r.next() % 200) as usize, 1 + (r.next() % 80) as usize),
+        1 => t.scroll_view((r.next() % 64) as isize - 32),
+        2 => {
+            let (a, b) = (pos(t, r), pos(t, r));
+            let _ = t.text_between(a, b, r.next().is_multiple_of(2));
+            let _ = t.word_at(a);
+            let _ = t.line_bounds(a);
+        }
+        3 if round.is_multiple_of(8) => {
+            let _ = t.find("fox", t.cursor_pos(), r.next().is_multiple_of(2), false);
+        }
+        _ => {}
+    }
+}
diff --git a/userland/nonos_vt/tests/support/log.rs b/userland/nonos_vt/tests/support/log.rs
new file mode 100644
index 000000000..67c3652b2
--- /dev/null
+++ b/userland/nonos_vt/tests/support/log.rs
@@ -0,0 +1,55 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! A parser handler that writes down what it was told, one entry a
+//! report, so a test can compare the sequence.
+
+use nonos_vt::parser::{Handler, Parser, Seq};
+
+#[derive(Default)]
+pub struct Log(pub Vec<String>);
+
+impl Handler for Log {
+    fn print(&mut self, c: char) {
+        self.0.push(format!("p{c}"));
+    }
+    fn execute(&mut self, b: u8) {
+        self.0.push(format!("x{b:02x}"));
+    }
+    fn csi(&mut self, s: &Seq) {
+        let g: Vec<String> = s.params.groups().map(|g| format!("{g:?}")).collect();
+        let i = String::from_utf8_lossy(s.inter()).to_string();
+        self.0.push(format!("csi{}{i}{}{}", s.private as char, s.final_byte as char, g.join("")));
+    }
+    fn esc(&mut self, s: &Seq) {
+        let i = String::from_utf8_lossy(s.inter()).to_string();
+        self.0.push(format!("esc{i}{}", s.final_byte as char));
+    }
+    fn osc(&mut self, d: &[u8]) {
+        self.0.push(format!("osc{}", String::from_utf8_lossy(d)));
+    }
+    fn dcs(&mut self, s: &Seq, d: &[u8]) {
+        let i = String::from_utf8_lossy(s.inter()).to_string();
+        self.0.push(format!("dcs{i}{}{}", s.final_byte as char, String::from_utf8_lossy(d)));
+    }
+}
+
+pub fn run(bytes: &[u8]) -> Vec<String> {
+    let mut p = Parser::new();
+    let mut l = Log::default();
+    p.feed(&mut l, bytes);
+    l.0
+}
diff --git a/userland/nonos_vt/tests/support/pieces.rs b/userland/nonos_vt/tests/support/pieces.rs
new file mode 100644
index 000000000..eeff0a51e
--- /dev/null
+++ b/userland/nonos_vt/tests/support/pieces.rs
@@ -0,0 +1,67 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The pieces hostile output is built from: control sequences with random
+//! parameters and finals, strings, broken UTF-8, wide and combining
+//! characters, controls, text and raw noise.
+
+use super::rng::Rng;
+
+const FINALS: &[u8] = b"@ABCDEFGHIJKLMPSTXZ`abcdefghlmnqrstu";
+
+pub fn piece(r: &mut Rng, out: &mut Vec<u8>) {
+    let n = |r: &mut Rng, m: u64| (r.next() % m) as usize;
+    match n(r, 12) {
+        0..=2 => {
+            out.extend_from_slice(b"\x1b[");
+            if n(r, 3) == 0 {
+                out.push(b"?><="[n(r, 4)]);
+            }
+            for _ in 0..n(r, 6) {
+                let v = [0, 1, 2, 5, 7, 25, 38, 48, 1049, 2004, 65535, 999_999][n(r, 12)];
+                out.extend_from_slice(v.to_string().as_bytes());
+                out.push(if n(r, 4) == 0 { b':' } else { b';' });
+            }
+            if n(r, 8) == 0 {
+                out.push(b" !$\"'"[n(r, 5)]);
+            }
+            out.push(FINALS[n(r, FINALS.len() as u64)]);
+        }
+        3 => {
+            out.extend_from_slice(b"\x1b]");
+            out.extend_from_slice(
+                ["0;t", "4;1;?", "8;;x", "52;c;?", "11;?", "133;A", "7;file:///p"][n(r, 7)]
+                    .as_bytes(),
+            );
+            out.extend_from_slice(if n(r, 2) == 0 { b"\x07" } else { b"\x1b\\" });
+        }
+        4 => out.extend_from_slice(
+            ["\x1bP+q544e\x1b\\", "\x1bP$qr\x1b\\", "\x1b_x\x1b\\"][n(r, 3)].as_bytes(),
+        ),
+        5 => out.extend_from_slice(
+            ["\x1b7", "\x1b8", "\x1bM", "\x1bc", "\x1b(0", "\x1b#8"][n(r, 6)].as_bytes(),
+        ),
+        6 => out.extend_from_slice("漢字👩\u{200d}💻e\u{301}\u{1f3fb}".as_bytes()),
+        7 => out.extend_from_slice(&[0xC3, 0xE2, 0x82, 0xF0, 0x9F, 0xED, 0xA0][..n(r, 7) + 1]),
+        8 => out.push([b'\n', b'\r', b'\t', 0x08, 0x0E, 0x0F, 0x18, 0x07][n(r, 8)]),
+        9 => out.extend_from_slice(b"the quick brown fox "),
+        _ => {
+            for _ in 0..n(r, 16) {
+                out.push((r.next() >> 56) as u8);
+            }
+        }
+    }
+}
diff --git a/userland/nonos_vt/tests/support/rng.rs b/userland/nonos_vt/tests/support/rng.rs
new file mode 100644
index 000000000..976070f44
--- /dev/null
+++ b/userland/nonos_vt/tests/support/rng.rs
@@ -0,0 +1,34 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! xorshift64*, the generator tools/nonos-zstd-vectors uses too.
+
+pub struct Rng(u64);
+
+impl Rng {
+    pub fn new(seed: u64) -> Self {
+        Rng(seed.max(1))
+    }
+
+    pub fn next(&mut self) -> u64 {
+        let mut s = self.0;
+        s ^= s >> 12;
+        s ^= s << 25;
+        s ^= s >> 27;
+        self.0 = s;
+        s.wrapping_mul(0x2545_F491_4F6C_DD1D)
+    }
+}
diff --git a/userland/nonos_vt/tests/support/term.rs b/userland/nonos_vt/tests/support/term.rs
new file mode 100644
index 000000000..5e79cecc7
--- /dev/null
+++ b/userland/nonos_vt/tests/support/term.rs
@@ -0,0 +1,25 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! A terminal fed a string, as every screen test starts.
+
+use nonos_vt::Term;
+
+pub fn term(cols: usize, rows: usize, input: &str) -> Term {
+    let mut t = Term::new(cols, rows, 100);
+    t.feed(input.as_bytes());
+    t
+}
diff --git a/userland/nonos_vt/tests/text.rs b/userland/nonos_vt/tests/text.rs
new file mode 100644
index 000000000..3f1d59a42
--- /dev/null
+++ b/userland/nonos_vt/tests/text.rs
@@ -0,0 +1,62 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Selection text, word picking, search and URLs.
+
+#[path = "support/term.rs"]
+mod support;
+
+use nonos_vt::url::find_urls;
+use nonos_vt::Pos;
+use support::term;
+
+fn p(line: u64, col: usize) -> Pos {
+    Pos { line, col }
+}
+
+#[test]
+fn a_wrapped_line_copies_as_one() {
+    let t = term(4, 3, "abcdef\r\ngh");
+    assert_eq!(t.text_between(p(0, 0), p(2, 3), false), "abcdef\ngh");
+}
+
+#[test]
+fn block_selection_takes_columns() {
+    let t = term(4, 2, "abcd\r\nefgh");
+    assert_eq!(t.text_between(p(0, 1), p(1, 2), true), "bc\nfg");
+}
+
+#[test]
+fn a_double_click_picks_a_path_whole() {
+    let t = term(20, 1, "cat /etc/hosts now");
+    let (a, b) = t.word_at(p(0, 7));
+    assert_eq!((a.col, b.col), (4, 13));
+}
+
+#[test]
+fn search_finds_across_a_wrap_and_wraps_around() {
+    let t = term(4, 3, "xxhello");
+    assert_eq!(t.find("hello", p(0, 0), false, true), Some((p(0, 2), p(1, 2))));
+    assert_eq!(t.find("HELLO", p(1, 3), false, false), Some((p(0, 2), p(1, 2))));
+    assert_eq!(t.find("nope", p(0, 0), false, true), None);
+}
+
+#[test]
+fn urls_drop_trailing_punctuation() {
+    let s: Vec<char> = "see https://a.io/x_(y). and http://b".chars().collect();
+    let found: Vec<String> = find_urls(&s).iter().map(|&(a, b)| s[a..b].iter().collect()).collect();
+    assert_eq!(found, ["https://a.io/x_(y)", "http://b"]);
+}

From 4e36246b0c3b0b610e265d302c194ae0f3fb48f4 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 12:56:51 +0000
Subject: [PATCH 08/29] app_skeleton: name the Insert and function keys the
 input drivers send

The PS/2 keymap already emits Insert as 0x1209 and F1 to F12 as 0x1101 to 0x110C.
Apps had no names for them, so none handled them.
---
 userland/app_skeleton/src/input/keys.rs | 4 ++++
 userland/app_skeleton/src/input/mod.rs  | 7 +++----
 userland/app_skeleton/src/lib.rs        | 4 ++--
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/userland/app_skeleton/src/input/keys.rs b/userland/app_skeleton/src/input/keys.rs
index 5023b38b6..d4c8573f2 100644
--- a/userland/app_skeleton/src/input/keys.rs
+++ b/userland/app_skeleton/src/input/keys.rs
@@ -29,4 +29,8 @@ pub const KEY_HOME: u32 = 0x1205;
 pub const KEY_END: u32 = 0x1206;
 pub const KEY_PAGE_UP: u32 = 0x1207;
 pub const KEY_PAGE_DOWN: u32 = 0x1208;
+pub const KEY_INSERT: u32 = 0x1209;
 pub const KEY_DELETE: u32 = 0x120A;
+/// F1; F2 to F12 follow in order.
+pub const KEY_F1: u32 = 0x1101;
+pub const KEY_F12: u32 = 0x110C;
diff --git a/userland/app_skeleton/src/input/mod.rs b/userland/app_skeleton/src/input/mod.rs
index 410bd6d17..14d61840e 100644
--- a/userland/app_skeleton/src/input/mod.rs
+++ b/userland/app_skeleton/src/input/mod.rs
@@ -22,9 +22,8 @@ mod modifiers;
 mod pointer;
 
 pub use event::InputEvent;
-pub use keys::{
-    KEY_BACKSPACE, KEY_DELETE, KEY_DOWN, KEY_END, KEY_ENTER, KEY_ESC, KEY_HOME, KEY_LEFT,
-    KEY_PAGE_DOWN, KEY_PAGE_UP, KEY_RIGHT, KEY_TAB, KEY_UP,
-};
+pub use keys::{KEY_BACKSPACE, KEY_DELETE, KEY_DOWN, KEY_END, KEY_ENTER, KEY_ESC, KEY_HOME};
+pub use keys::{KEY_F1, KEY_F12, KEY_INSERT};
+pub use keys::{KEY_LEFT, KEY_PAGE_DOWN, KEY_PAGE_UP, KEY_RIGHT, KEY_TAB, KEY_UP};
 pub use kind::InputKind;
 pub use modifiers::{MOD_ALT, MOD_ALTGR, MOD_CAPS, MOD_CTRL, MOD_META, MOD_NUM, MOD_SHIFT};
diff --git a/userland/app_skeleton/src/lib.rs b/userland/app_skeleton/src/lib.rs
index c494c98bc..97ff22bcd 100644
--- a/userland/app_skeleton/src/lib.rs
+++ b/userland/app_skeleton/src/lib.rs
@@ -32,8 +32,8 @@ pub use app::{App, AppManifest, EventOutcome, WindowKind};
 pub use clients::clipboard::{clipboard_copy, clipboard_paste};
 pub use input::{
     InputEvent, InputKind, KEY_BACKSPACE, KEY_DELETE, KEY_DOWN, KEY_END, KEY_ENTER, KEY_ESC,
-    KEY_HOME, KEY_LEFT, KEY_PAGE_DOWN, KEY_PAGE_UP, KEY_RIGHT, KEY_TAB, KEY_UP, MOD_ALT, MOD_CAPS,
-    MOD_CTRL, MOD_META, MOD_NUM, MOD_SHIFT,
+    KEY_F1, KEY_F12, KEY_HOME, KEY_INSERT, KEY_LEFT, KEY_PAGE_DOWN, KEY_PAGE_UP, KEY_RIGHT,
+    KEY_TAB, KEY_UP, MOD_ALT, MOD_CAPS, MOD_CTRL, MOD_META, MOD_NUM, MOD_SHIFT,
 };
 pub use paint::font_advance;
 pub use paint::PaintBuffer;

From bd52d02d31ee4e70aa00f84fe55b001121f9ca7f Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 12:57:18 +0000
Subject: [PATCH 09/29] terminal: run programs on an xterm-grade screen sized
 to the window

The fixed 96x40 grid and its partial VT layer give way to nonos_vt. The screen follows the window size and zoom, re-wrapping on resize, with 3000 lines of history a tab on a 64 MiB heap, and draws bold, dim, every underline style, strikethrough, overline, inverse, hidden, wide and combining characters, and the cursor shape a program sets. A program in the foreground or on the alternate screen owns the body; the prompt returns when it ends, with any modes it left on reset, and output is read up to 64 KiB a tick instead of 256 bytes.

A program reading raw gets keys as xterm sends them (taken as raw once it asks for the alternate screen, application cursor keys, bracketed paste or mouse reports, as there is no path for its tty settings yet); any other gets lines edited as a tty's canonical mode edits them. Ctrl+C interrupts, and a program's queries are answered on its stdin.

The pointer selects text (double click a word or path, triple click a line, Alt for a block), or goes to a program that asked for mouse reports unless Shift is held. Ctrl+Shift+C copies, Ctrl+Shift+V pastes, Ctrl+Shift+F searches history across wrapped lines, and the wheel scrolls history or sends cursor keys on the alternate screen. Proofs for the line editing and selection added to terminal_line_proofs.
---
 userland/capsule_terminal/Cargo.lock          |   5 +
 userland/capsule_terminal/Cargo.toml          |   1 +
 .../src/command/output/feed_raw.rs            |   9 +
 userland/capsule_terminal/src/event/clip.rs   |  46 ++++
 userland/capsule_terminal/src/event/cooked.rs |  58 +++++
 .../capsule_terminal/src/event/cooked_kill.rs |  46 ++++
 .../capsule_terminal/src/event/fg_cooked.rs   |  58 +++++
 .../capsule_terminal/src/event/fg_input.rs    |  44 ++++
 .../capsule_terminal/src/event/fg_keys.rs     |  70 ++++++
 .../capsule_terminal/src/event/find_bar.rs    |  72 ++++++
 .../capsule_terminal/src/event/find_seek.rs   |  45 ++++
 .../src/event/{fg_stdin.rs => interrupt.rs}   |  37 +--
 .../capsule_terminal/src/event/key_first.rs   |  43 ++++
 userland/capsule_terminal/src/event/keymap.rs |  52 ++++
 userland/capsule_terminal/src/event/mod.rs    |  14 +-
 .../capsule_terminal/src/event/on_ctrl.rs     |  23 +-
 userland/capsule_terminal/src/event/on_key.rs |  17 +-
 .../src/event/paste_program.rs                |  61 +++++
 .../capsule_terminal/src/jobs/external.rs     |  49 ++--
 .../capsule_terminal/src/jobs/external_io.rs  |  58 +++++
 userland/capsule_terminal/src/jobs/mod.rs     |   1 +
 userland/capsule_terminal/src/main.rs         |   6 +
 .../src/paint/block_chrome.rs                 |  18 +-
 .../capsule_terminal/src/paint/compose.rs     |  50 ++--
 .../capsule_terminal/src/paint/draw_grid.rs   |  95 --------
 .../capsule_terminal/src/paint/geometry.rs    |  57 +++++
 .../capsule_terminal/src/paint/line_text.rs   |   2 +-
 userland/capsule_terminal/src/paint/mod.rs    |   8 +-
 .../{term/grid/cell.rs => paint/vt/area.rs}   |  50 ++--
 .../capsule_terminal/src/paint/vt/body.rs     |  65 +++++
 .../capsule_terminal/src/paint/vt/cell.rs     |  52 ++++
 .../capsule_terminal/src/paint/vt/cursor.rs   |  47 ++++
 .../capsule_terminal/src/paint/vt/deco.rs     |  59 +++++
 .../capsule_terminal/src/paint/vt/fill.rs     |  47 ++++
 .../capsule_terminal/src/paint/vt/find_bar.rs |  50 ++++
 .../src/{term => paint}/vt/mod.rs             |  23 +-
 .../capsule_terminal/src/paint/vt/rows.rs     |  64 +++++
 .../capsule_terminal/src/term/block/ops.rs    |   4 +-
 .../capsule_terminal/src/term/dimensions.rs   |   3 +-
 .../capsule_terminal/src/term/grid/alt.rs     |  42 ----
 .../capsule_terminal/src/term/grid/erase.rs   |  69 ------
 .../src/term/grid/move_cells.rs               |  46 ----
 .../capsule_terminal/src/term/grid/new.rs     |  49 ----
 .../capsule_terminal/src/term/grid/put.rs     |  62 -----
 .../capsule_terminal/src/term/grid/scroll.rs  |  39 ---
 .../src/term/grid/scroll_region.rs            |  57 -----
 .../capsule_terminal/src/term/grid/types.rs   |  54 -----
 .../capsule_terminal/src/term/grid/view.rs    |  32 ---
 .../capsule_terminal/src/term/grid/width.rs   |  67 -----
 userland/capsule_terminal/src/term/mod.rs     |   3 +-
 .../src/term/scrollback/clear.rs              |   3 +-
 .../src/term/scrollback/feed_raw.rs           |  13 +-
 .../src/term/scrollback/fit.rs                |  45 ++++
 .../src/term/scrollback/jump_bottom.rs        |   2 +-
 .../src/term/scrollback/mod.rs                |   2 +
 .../src/term/scrollback/new.rs                |  13 +-
 .../feed.rs => scrollback/program_ended.rs}   |  31 ++-
 .../src/term/scrollback/push_dir_row.rs       |   8 +-
 .../src/term/scrollback/push_raw.rs           |  10 +-
 .../src/term/scrollback/push_styled.rs        |   4 +-
 .../src/term/scrollback/scroll_down.rs        |   3 +-
 .../src/term/scrollback/scroll_up.rs          |   3 +-
 .../src/term/scrollback/types.rs              |  11 +-
 userland/capsule_terminal/src/term/select.rs  |  74 ++++++
 .../capsule_terminal/src/term/state/mod.rs    |   1 +
 .../capsule_terminal/src/term/state/new.rs    |   3 +
 .../term/{grid/absline.rs => state/shade.rs}  |  18 +-
 .../capsule_terminal/src/term/state/types.rs  |   6 +
 .../src/term/terminal/app_impl_on_event.rs    |   3 +
 .../src/term/terminal/app_impl_paint.rs       |  16 ++
 .../capsule_terminal/src/term/terminal/mod.rs |   1 +
 .../capsule_terminal/src/term/terminal/new.rs |   2 +
 .../src/term/terminal/pointer/cells.rs        |  71 ++++++
 .../term/{grid => terminal/pointer}/mod.rs    |  26 +-
 .../src/term/terminal/pointer/press.rs        |  57 +++++
 .../src/term/terminal/pointer/report.rs       |  63 +++++
 .../src/term/terminal/pointer/select.rs       |  52 ++++
 .../pointer/state.rs}                         |  27 ++-
 .../src/term/terminal/pointer/wheel.rs        |  52 ++++
 .../src/term/terminal/selftest.rs             | 228 ++++++------------
 .../src/term/terminal/types.rs                |   3 +
 .../capsule_terminal/src/term/vt/color.rs     |  62 -----
 .../src/term/vt/csi_cursor.rs                 |  67 -----
 .../capsule_terminal/src/term/vt/csi_edit.rs  |  52 ----
 .../capsule_terminal/src/term/vt/decset.rs    |  41 ----
 .../capsule_terminal/src/term/vt/parser.rs    | 182 --------------
 userland/capsule_terminal/src/term/vt/sgr.rs  | 102 --------
 .../capsule_terminal/src/term/vt/state.rs     |  83 -------
 .../src/term/vt/utf8/finish.rs                |  38 ---
 .../capsule_terminal/src/term/vt/utf8/mod.rs  |  69 ------
 .../src/term/vt/utf8/state.rs                 |  43 ----
 userland/capsule_terminal/tests/utf8_host.rs  | 108 ---------
 userland/capsule_terminal/tests/width_host.rs |  86 -------
 userland/terminal_line_proofs/Cargo.lock      |   7 +
 userland/terminal_line_proofs/Cargo.toml      |   3 +
 .../terminal_line_proofs/src/cooked_tests.rs  |  75 ++++++
 userland/terminal_line_proofs/src/lib.rs      |  10 +
 97 files changed, 1981 insertions(+), 1927 deletions(-)
 create mode 100644 userland/capsule_terminal/src/event/clip.rs
 create mode 100644 userland/capsule_terminal/src/event/cooked.rs
 create mode 100644 userland/capsule_terminal/src/event/cooked_kill.rs
 create mode 100644 userland/capsule_terminal/src/event/fg_cooked.rs
 create mode 100644 userland/capsule_terminal/src/event/fg_input.rs
 create mode 100644 userland/capsule_terminal/src/event/fg_keys.rs
 create mode 100644 userland/capsule_terminal/src/event/find_bar.rs
 create mode 100644 userland/capsule_terminal/src/event/find_seek.rs
 rename userland/capsule_terminal/src/event/{fg_stdin.rs => interrupt.rs} (50%)
 create mode 100644 userland/capsule_terminal/src/event/key_first.rs
 create mode 100644 userland/capsule_terminal/src/event/keymap.rs
 create mode 100644 userland/capsule_terminal/src/event/paste_program.rs
 create mode 100644 userland/capsule_terminal/src/jobs/external_io.rs
 delete mode 100644 userland/capsule_terminal/src/paint/draw_grid.rs
 create mode 100644 userland/capsule_terminal/src/paint/geometry.rs
 rename userland/capsule_terminal/src/{term/grid/cell.rs => paint/vt/area.rs} (52%)
 create mode 100644 userland/capsule_terminal/src/paint/vt/body.rs
 create mode 100644 userland/capsule_terminal/src/paint/vt/cell.rs
 create mode 100644 userland/capsule_terminal/src/paint/vt/cursor.rs
 create mode 100644 userland/capsule_terminal/src/paint/vt/deco.rs
 create mode 100644 userland/capsule_terminal/src/paint/vt/fill.rs
 create mode 100644 userland/capsule_terminal/src/paint/vt/find_bar.rs
 rename userland/capsule_terminal/src/{term => paint}/vt/mod.rs (73%)
 create mode 100644 userland/capsule_terminal/src/paint/vt/rows.rs
 delete mode 100644 userland/capsule_terminal/src/term/grid/alt.rs
 delete mode 100644 userland/capsule_terminal/src/term/grid/erase.rs
 delete mode 100644 userland/capsule_terminal/src/term/grid/move_cells.rs
 delete mode 100644 userland/capsule_terminal/src/term/grid/new.rs
 delete mode 100644 userland/capsule_terminal/src/term/grid/put.rs
 delete mode 100644 userland/capsule_terminal/src/term/grid/scroll.rs
 delete mode 100644 userland/capsule_terminal/src/term/grid/scroll_region.rs
 delete mode 100644 userland/capsule_terminal/src/term/grid/types.rs
 delete mode 100644 userland/capsule_terminal/src/term/grid/view.rs
 delete mode 100644 userland/capsule_terminal/src/term/grid/width.rs
 create mode 100644 userland/capsule_terminal/src/term/scrollback/fit.rs
 rename userland/capsule_terminal/src/term/{grid/feed.rs => scrollback/program_ended.rs} (51%)
 create mode 100644 userland/capsule_terminal/src/term/select.rs
 rename userland/capsule_terminal/src/term/{grid/absline.rs => state/shade.rs} (67%)
 create mode 100644 userland/capsule_terminal/src/term/terminal/pointer/cells.rs
 rename userland/capsule_terminal/src/term/{grid => terminal/pointer}/mod.rs (73%)
 create mode 100644 userland/capsule_terminal/src/term/terminal/pointer/press.rs
 create mode 100644 userland/capsule_terminal/src/term/terminal/pointer/report.rs
 create mode 100644 userland/capsule_terminal/src/term/terminal/pointer/select.rs
 rename userland/capsule_terminal/src/term/{grid/scroll_view.rs => terminal/pointer/state.rs} (60%)
 create mode 100644 userland/capsule_terminal/src/term/terminal/pointer/wheel.rs
 delete mode 100644 userland/capsule_terminal/src/term/vt/color.rs
 delete mode 100644 userland/capsule_terminal/src/term/vt/csi_cursor.rs
 delete mode 100644 userland/capsule_terminal/src/term/vt/csi_edit.rs
 delete mode 100644 userland/capsule_terminal/src/term/vt/decset.rs
 delete mode 100644 userland/capsule_terminal/src/term/vt/parser.rs
 delete mode 100644 userland/capsule_terminal/src/term/vt/sgr.rs
 delete mode 100644 userland/capsule_terminal/src/term/vt/state.rs
 delete mode 100644 userland/capsule_terminal/src/term/vt/utf8/finish.rs
 delete mode 100644 userland/capsule_terminal/src/term/vt/utf8/mod.rs
 delete mode 100644 userland/capsule_terminal/src/term/vt/utf8/state.rs
 delete mode 100644 userland/capsule_terminal/tests/utf8_host.rs
 delete mode 100644 userland/capsule_terminal/tests/width_host.rs
 create mode 100644 userland/terminal_line_proofs/src/cooked_tests.rs

diff --git a/userland/capsule_terminal/Cargo.lock b/userland/capsule_terminal/Cargo.lock
index 19aa38d6c..155cef1b5 100644
--- a/userland/capsule_terminal/Cargo.lock
+++ b/userland/capsule_terminal/Cargo.lock
@@ -109,6 +109,7 @@ dependencies = [
  "nonos_tls",
  "nonos_toolkit",
  "nonos_userland_libc",
+ "nonos_vt",
 ]
 
 [[package]]
@@ -134,6 +135,10 @@ dependencies = [
  "linked_list_allocator",
 ]
 
+[[package]]
+name = "nonos_vt"
+version = "0.1.0"
+
 [[package]]
 name = "owned_ttf_parser"
 version = "0.25.1"
diff --git a/userland/capsule_terminal/Cargo.toml b/userland/capsule_terminal/Cargo.toml
index d17892367..f76df1402 100644
--- a/userland/capsule_terminal/Cargo.toml
+++ b/userland/capsule_terminal/Cargo.toml
@@ -36,6 +36,7 @@ nonos_policy_proto = { path = "../policy_proto" }
 nonos_socket = { path = "../nonos_socket" }
 nonos_tls = { path = "../nonos_tls" }
 nonos_toolkit = { path = "../toolkit", default-features = false }
+nonos_vt = { path = "../nonos_vt" }
 
 [profile.release]
 panic = "abort"
diff --git a/userland/capsule_terminal/src/command/output/feed_raw.rs b/userland/capsule_terminal/src/command/output/feed_raw.rs
index 90844b5f6..083fb30ad 100644
--- a/userland/capsule_terminal/src/command/output/feed_raw.rs
+++ b/userland/capsule_terminal/src/command/output/feed_raw.rs
@@ -20,4 +20,13 @@ impl<'a> Output<'a> {
     pub fn feed_raw(&mut self, bytes: &[u8]) {
         self.sb.feed_raw(bytes);
     }
+
+    /// Answers the screen owes the program that wrote to it.
+    pub fn take_replies(&mut self) -> alloc::vec::Vec<u8> {
+        self.sb.vt.take_replies()
+    }
+
+    pub fn program_ended(&mut self) {
+        self.sb.program_ended();
+    }
 }
diff --git a/userland/capsule_terminal/src/event/clip.rs b/userland/capsule_terminal/src/event/clip.rs
new file mode 100644
index 000000000..9932ce85f
--- /dev/null
+++ b/userland/capsule_terminal/src/event/clip.rs
@@ -0,0 +1,46 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Ctrl+Shift+C copies, Ctrl+Shift+V pastes, Ctrl+Shift+F searches. They
+//! are taken before a running program sees the key, since without Shift
+//! the same letters are the program's own.
+
+use crate::term::state::State;
+use nonos_app_skeleton::{clipboard_copy, EventOutcome, InputEvent, MOD_CTRL, MOD_SHIFT};
+
+pub fn clip_key(state: &mut State, event: &InputEvent) -> Option<EventOutcome> {
+    let both = MOD_CTRL | MOD_SHIFT;
+    if event.flags & both != both {
+        return None;
+    }
+    match char::from_u32(event.code)?.to_ascii_lowercase() {
+        'c' if state.sel.is_some() => Some(copy_selection(state)),
+        'v' if state.fg_running => Some(super::paste_program::paste_to_program(state)),
+        'f' => Some(super::find_bar::open(state)),
+        _ => None,
+    }
+}
+
+fn copy_selection(state: &mut State) -> EventOutcome {
+    let Some(sel) = state.sel else { return EventOutcome::Idle };
+    let (a, b) = sel.ordered();
+    let text = state.scrollback.vt.text_between(a, b, sel.block);
+    if clipboard_copy(text.as_bytes()).is_err() {
+        state.scrollback.push_line(b"copy: clipboard unavailable");
+        return EventOutcome::Repaint;
+    }
+    EventOutcome::Idle
+}
diff --git a/userland/capsule_terminal/src/event/cooked.rs b/userland/capsule_terminal/src/event/cooked.rs
new file mode 100644
index 000000000..e0d4ec1ba
--- /dev/null
+++ b/userland/capsule_terminal/src/event/cooked.rs
@@ -0,0 +1,58 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The line a foreground program has not been sent yet, edited as a tty's
+//! canonical mode edits it. Typed characters echo, Backspace erases the
+//! last one from the screen as well as the line, Ctrl+U the whole line and
+//! Ctrl+W the last word, and Enter sends the line with its newline.
+
+use alloc::vec::Vec;
+
+use nonos_vt::width::width;
+
+#[derive(Default)]
+pub struct Cooked {
+    pub line: Vec<char>,
+}
+
+/// What an edit asks the terminal to do.
+#[derive(Default)]
+pub struct Effect {
+    /// Bytes to put on the screen.
+    pub echo: Vec<u8>,
+    /// Bytes to send to the program.
+    pub send: Vec<u8>,
+}
+
+pub(super) fn erase(echo: &mut Vec<u8>, c: char) {
+    for _ in 0..width(c).max(1) {
+        echo.extend_from_slice(b"\x08 \x08");
+    }
+}
+
+impl Cooked {
+    pub fn char(&mut self, c: char, fx: &mut Effect) {
+        self.line.push(c);
+        let mut buf = [0u8; 4];
+        fx.echo.extend_from_slice(c.encode_utf8(&mut buf).as_bytes());
+    }
+
+    pub fn backspace(&mut self, fx: &mut Effect) {
+        if let Some(c) = self.line.pop() {
+            erase(&mut fx.echo, c);
+        }
+    }
+}
diff --git a/userland/capsule_terminal/src/event/cooked_kill.rs b/userland/capsule_terminal/src/event/cooked_kill.rs
new file mode 100644
index 000000000..40fd3ef40
--- /dev/null
+++ b/userland/capsule_terminal/src/event/cooked_kill.rs
@@ -0,0 +1,46 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Killing back to a word or line start, and Enter, in the line a program
+//! has not been sent yet.
+
+use super::cooked::{erase, Cooked, Effect};
+
+impl Cooked {
+    pub fn kill_line(&mut self, fx: &mut Effect) {
+        while let Some(c) = self.line.pop() {
+            erase(&mut fx.echo, c);
+        }
+    }
+
+    pub fn kill_word(&mut self, fx: &mut Effect) {
+        while self.line.last().is_some_and(|c| c.is_whitespace()) {
+            self.backspace(fx);
+        }
+        while self.line.last().is_some_and(|c| !c.is_whitespace()) {
+            self.backspace(fx);
+        }
+    }
+
+    pub fn enter(&mut self, fx: &mut Effect) {
+        fx.echo.extend_from_slice(b"\n");
+        for c in self.line.drain(..) {
+            let mut buf = [0u8; 4];
+            fx.send.extend_from_slice(c.encode_utf8(&mut buf).as_bytes());
+        }
+        fx.send.push(b'\n');
+    }
+}
diff --git a/userland/capsule_terminal/src/event/fg_cooked.rs b/userland/capsule_terminal/src/event/fg_cooked.rs
new file mode 100644
index 000000000..3d84d350b
--- /dev/null
+++ b/userland/capsule_terminal/src/event/fg_cooked.rs
@@ -0,0 +1,58 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Keys for a program reading lines: the line is edited here and sent on
+//! Enter, as a tty's canonical mode does.
+
+use nonos_app_skeleton::EventOutcome;
+use nonos_vt::input::{Key, Mods};
+
+use super::cooked::Effect;
+use super::fg_input::send;
+use super::interrupt::interrupt;
+use crate::term::state::State;
+
+pub(super) fn cooked(state: &mut State, key: Key, m: Mods) -> EventOutcome {
+    let mut fx = Effect::default();
+    let lc = |c: char| c.to_ascii_lowercase();
+    match key {
+        Key::Char(c) if m.ctrl => match lc(c) {
+            'c' => return interrupt(state),
+            'u' => state.cooked.kill_line(&mut fx),
+            'w' => state.cooked.kill_word(&mut fx),
+            'd' if state.cooked.line.is_empty() => {
+                /*
+                 * There is no end-of-input for a NONOS program's stdin yet;
+                 * saying so beats a key that silently does nothing.
+                 */
+                fx.echo.extend_from_slice(b"^D (end of input is not delivered to this program)\n");
+            }
+            _ => return EventOutcome::Idle,
+        },
+        Key::Char(c) => state.cooked.char(c, &mut fx),
+        Key::Tab => state.cooked.char('\t', &mut fx),
+        Key::Backspace => state.cooked.backspace(&mut fx),
+        Key::Enter => state.cooked.enter(&mut fx),
+        _ => return EventOutcome::Idle,
+    }
+    if !fx.echo.is_empty() {
+        state.scrollback.feed_raw(&fx.echo);
+    }
+    if !fx.send.is_empty() {
+        send(state, &fx.send);
+    }
+    EventOutcome::Repaint
+}
diff --git a/userland/capsule_terminal/src/event/fg_input.rs b/userland/capsule_terminal/src/event/fg_input.rs
new file mode 100644
index 000000000..edaa8b1ba
--- /dev/null
+++ b/userland/capsule_terminal/src/event/fg_input.rs
@@ -0,0 +1,44 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Whether the foreground program reads raw keys, and handing it bytes.
+
+use nonos_vt::{MouseMode, Term};
+
+use crate::jobs::JobWork;
+use crate::term::state::State;
+
+pub fn reads_raw(vt: &Term) -> bool {
+    let m = &vt.modes;
+    vt.alt_active() || m.cursor_keys || m.bracketed_paste || m.mouse != MouseMode::Off
+}
+
+/// Queue bytes for the foreground program. False when it cannot take input.
+pub fn send(state: &mut State, bytes: &[u8]) -> bool {
+    let Some(id) = state.jobs.foreground() else { return false };
+    match state.jobs.get_mut(id).map(|j| &mut j.work) {
+        Some(JobWork::ExternalStage { in_buf, .. }) => {
+            in_buf.extend_from_slice(bytes);
+            true
+        }
+        _ => false,
+    }
+}
+
+pub(super) fn takes_input(state: &State) -> bool {
+    let Some(id) = state.jobs.foreground() else { return false };
+    matches!(state.jobs.get(id).map(|j| &j.work), Some(JobWork::ExternalStage { .. }))
+}
diff --git a/userland/capsule_terminal/src/event/fg_keys.rs b/userland/capsule_terminal/src/event/fg_keys.rs
new file mode 100644
index 000000000..0853c1c64
--- /dev/null
+++ b/userland/capsule_terminal/src/event/fg_keys.rs
@@ -0,0 +1,70 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Keys while a program runs in the foreground.
+//!
+//! A program that drew a full screen reads keys raw, as the sequences
+//! xterm sends. Any other program reads lines, edited here as a tty's
+//! canonical mode edits them. Programs cannot yet say which they want: the
+//! terminal has no path for a program's tty settings. Until it does, a
+//! program is taken to read raw once it asks for the alternate screen,
+//! application cursor keys, bracketed paste or mouse reports, which only
+//! raw readers ask for.
+
+use nonos_app_skeleton::{EventOutcome, InputEvent};
+use nonos_vt::input::{encode_key, Key, Mods};
+
+use super::fg_input::{reads_raw, send, takes_input};
+use super::interrupt::interrupt;
+use super::keymap::key_of;
+use crate::term::state::State;
+
+pub fn fg_key(state: &mut State, event: InputEvent) -> Option<EventOutcome> {
+    if !state.fg_running {
+        return None;
+    }
+    let Some((key, m)) = key_of(&event) else { return Some(EventOutcome::Idle) };
+    // Shift with the page keys reads history, as in every terminal.
+    if m.shift && !m.ctrl && !state.scrollback.vt.alt_active() {
+        let page = state.scrollback.vt.rows().saturating_sub(2).max(1);
+        match key {
+            Key::PageUp => state.scrollback.scroll_up(page),
+            Key::PageDown => state.scrollback.scroll_down(page),
+            _ => return Some(raw_or_cooked(state, key, m)),
+        }
+        return Some(EventOutcome::Repaint);
+    }
+    Some(raw_or_cooked(state, key, m))
+}
+
+fn raw_or_cooked(state: &mut State, key: Key, m: Mods) -> EventOutcome {
+    if !takes_input(state) {
+        // A built-in job reads nothing; Ctrl+C still stops it.
+        if m.ctrl && key == Key::Char('c') {
+            return interrupt(state);
+        }
+        return EventOutcome::Idle;
+    }
+    state.scrollback.jump_bottom();
+    if reads_raw(&state.scrollback.vt) {
+        let mut bytes = alloc::vec::Vec::new();
+        if encode_key(key, m, &state.scrollback.vt.modes, &mut bytes) {
+            send(state, &bytes);
+        }
+        return EventOutcome::Repaint;
+    }
+    super::fg_cooked::cooked(state, key, m)
+}
diff --git a/userland/capsule_terminal/src/event/find_bar.rs b/userland/capsule_terminal/src/event/find_bar.rs
new file mode 100644
index 000000000..3703f0ac6
--- /dev/null
+++ b/userland/capsule_terminal/src/event/find_bar.rs
@@ -0,0 +1,72 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The scrollback search bar. Typing searches back from the newest line,
+//! Enter steps to the next older match and Shift+Enter to the newer one,
+//! Alt+C toggles case, Esc closes. The view follows the match.
+
+use nonos_app_skeleton::{
+    EventOutcome, InputEvent, KEY_BACKSPACE, KEY_ENTER, KEY_ESC, MOD_ALT, MOD_SHIFT,
+};
+
+use super::find_seek::{end, reveal, seek};
+use crate::term::select::Find;
+use crate::term::state::State;
+
+const MAX_QUERY: usize = 256;
+
+pub fn open(state: &mut State) -> EventOutcome {
+    state.find = Some(Find::default());
+    EventOutcome::Repaint
+}
+
+pub fn key(state: &mut State, event: InputEvent) -> EventOutcome {
+    let Some(mut f) = state.find.take() else { return EventOutcome::Idle };
+    let alt = event.flags & MOD_ALT != 0;
+    match event.code {
+        KEY_ESC => {
+            state.scrollback.jump_bottom();
+            return EventOutcome::Repaint;
+        }
+        KEY_ENTER => {
+            let from = f.hit.map(|h| h.0).unwrap_or(end(state));
+            f.hit = seek(state, &f, from, event.flags & MOD_SHIFT == 0).or(f.hit);
+        }
+        KEY_BACKSPACE => {
+            f.query.pop();
+            f.hit = seek(state, &f, end(state), true);
+        }
+        c if alt && matches!(c, 0x43 | 0x63) => {
+            f.case = !f.case;
+            f.hit = seek(state, &f, end(state), true);
+        }
+        c => {
+            let Some(ch) = char::from_u32(c).filter(|ch| !ch.is_control()) else {
+                state.find = Some(f);
+                return EventOutcome::Idle;
+            };
+            if f.query.len() < MAX_QUERY {
+                f.query.push(ch);
+            }
+            f.hit = seek(state, &f, end(state), true);
+        }
+    }
+    if let Some((a, _)) = f.hit {
+        reveal(state, a.line);
+    }
+    state.find = Some(f);
+    EventOutcome::Repaint
+}
diff --git a/userland/capsule_terminal/src/event/find_seek.rs b/userland/capsule_terminal/src/event/find_seek.rs
new file mode 100644
index 000000000..1c487c631
--- /dev/null
+++ b/userland/capsule_terminal/src/event/find_seek.rs
@@ -0,0 +1,45 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Where a search starts, the next match from a place, and bringing a
+//! match into view.
+
+use nonos_vt::Pos;
+
+use crate::term::select::Find;
+use crate::term::state::State;
+
+/// Just past the newest cell, so a backward search starts at the bottom.
+pub(super) fn end(state: &State) -> Pos {
+    Pos { line: state.scrollback.vt.last_line() + 1, col: 0 }
+}
+
+pub(super) fn seek(state: &State, f: &Find, from: Pos, older: bool) -> Option<(Pos, Pos)> {
+    if f.query.is_empty() {
+        return None;
+    }
+    state.scrollback.vt.find(&f.query, from, older, f.case)
+}
+
+/// Scroll history so `line` sits mid-screen.
+pub(super) fn reveal(state: &mut State, line: u64) {
+    let vt = &mut state.scrollback.vt;
+    let rows = vt.rows() as u64;
+    let bottom = vt.cursor_pos().line;
+    let back = (bottom + rows / 2).saturating_sub(line + rows);
+    vt.scroll_to_bottom();
+    vt.scroll_view(back.min(isize::MAX as u64) as isize);
+}
diff --git a/userland/capsule_terminal/src/event/fg_stdin.rs b/userland/capsule_terminal/src/event/interrupt.rs
similarity index 50%
rename from userland/capsule_terminal/src/event/fg_stdin.rs
rename to userland/capsule_terminal/src/event/interrupt.rs
index 6c200f3e5..17bec7158 100644
--- a/userland/capsule_terminal/src/event/fg_stdin.rs
+++ b/userland/capsule_terminal/src/event/interrupt.rs
@@ -14,31 +14,32 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+//! Ctrl+C: stop the foreground job, or drop the line being typed.
+
 use nonos_app_skeleton::EventOutcome;
+use nonos_libc::mk_kill;
 
-use crate::command::output::Output;
 use crate::jobs::JobWork;
 use crate::term::state::State;
 
-// A key typed while a foreground job runs: if that job is an interactive
-// external capsule, queue the byte on its stdin buffer (the on_tick pump feeds
-// it to the child via mk_proc_input) and echo it locally so the typist sees
-// what they entered. Any other foreground job swallows the key exactly as
-// Task 13's gate did, returning `Idle`.
-pub fn forward(state: &mut State, byte: u8) -> EventOutcome {
-    let mut fed = false;
-    if let Some(id) = state.jobs.foreground() {
-        if let Some(job) = state.jobs.get_mut(id) {
-            if let JobWork::ExternalStage { in_buf, .. } = &mut job.work {
-                in_buf.push(byte);
-                fed = true;
+const SIGINT: u64 = 2;
+
+pub fn interrupt(state: &mut State) -> EventOutcome {
+    if state.fg_running {
+        if let Some(id) = state.jobs.foreground() {
+            if let Some(job) = state.jobs.get_mut(id) {
+                if let JobWork::ExternalStage { pid, .. } = job.work {
+                    let _ = mk_kill(pid as u64, SIGINT);
+                }
+                job.cancel = true;
             }
         }
-    }
-    if fed {
-        Output::new(&mut state.scrollback).feed_raw(&[byte]);
-        EventOutcome::Repaint
+        state.cooked.line.clear();
     } else {
-        EventOutcome::Idle
+        state.line.clear();
+        state.history.reset_cursor();
     }
+    state.scrollback.push_line(b"^C");
+    state.scrollback.jump_bottom();
+    EventOutcome::Repaint
 }
diff --git a/userland/capsule_terminal/src/event/key_first.rs b/userland/capsule_terminal/src/event/key_first.rs
new file mode 100644
index 000000000..fac5a3742
--- /dev/null
+++ b/userland/capsule_terminal/src/event/key_first.rs
@@ -0,0 +1,43 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! What a key reaches before the shell's line editor: copy, paste and
+//! search, an open search bar, and a running program.
+
+use nonos_app_skeleton::{EventOutcome, InputEvent};
+
+use crate::term::state::State;
+
+pub fn key_first(state: &mut State, event: InputEvent) -> Option<EventOutcome> {
+    if let Some(out) = super::clip::clip_key(state, &event) {
+        return Some(out);
+    }
+    if state.find.is_some() {
+        return Some(super::find_bar::key(state, event));
+    }
+    // Typing moves on from whatever was picked.
+    state.sel = None;
+    /*
+     * A running program gets the keys first, Ctrl ones included: a full
+     * screen program binds them itself.
+     */
+    super::fg_keys::fg_key(state, event)
+}
+
+/// A page of history: the screen less two lines of overlap.
+pub fn page(state: &State) -> usize {
+    state.scrollback.vt.rows().saturating_sub(2).max(1)
+}
diff --git a/userland/capsule_terminal/src/event/keymap.rs b/userland/capsule_terminal/src/event/keymap.rs
new file mode 100644
index 000000000..e187771e2
--- /dev/null
+++ b/userland/capsule_terminal/src/event/keymap.rs
@@ -0,0 +1,52 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! A key press as the window reports it, as the key a terminal program
+//! reads.
+
+use nonos_app_skeleton::{
+    InputEvent, KEY_BACKSPACE, KEY_DELETE, KEY_DOWN, KEY_END, KEY_ENTER, KEY_ESC, KEY_F1, KEY_F12,
+    KEY_HOME, KEY_INSERT, KEY_LEFT, KEY_PAGE_DOWN, KEY_PAGE_UP, KEY_RIGHT, KEY_TAB, KEY_UP,
+    MOD_ALT, MOD_CTRL, MOD_SHIFT,
+};
+use nonos_vt::input::{Key, Mods};
+
+pub fn mods(flags: u16) -> Mods {
+    Mods { shift: flags & MOD_SHIFT != 0, alt: flags & MOD_ALT != 0, ctrl: flags & MOD_CTRL != 0 }
+}
+
+pub fn key_of(event: &InputEvent) -> Option<(Key, Mods)> {
+    let m = mods(event.flags);
+    let key = match event.code {
+        KEY_ENTER => Key::Enter,
+        KEY_TAB => Key::Tab,
+        KEY_BACKSPACE | 0x7F => Key::Backspace,
+        KEY_ESC => Key::Escape,
+        KEY_UP => Key::Up,
+        KEY_DOWN => Key::Down,
+        KEY_LEFT => Key::Left,
+        KEY_RIGHT => Key::Right,
+        KEY_HOME => Key::Home,
+        KEY_END => Key::End,
+        KEY_PAGE_UP => Key::PageUp,
+        KEY_PAGE_DOWN => Key::PageDown,
+        KEY_INSERT => Key::Insert,
+        KEY_DELETE => Key::Delete,
+        c @ KEY_F1..=KEY_F12 => Key::F((c - KEY_F1 + 1) as u8),
+        c => Key::Char(char::from_u32(c).filter(|ch| !ch.is_control())?),
+    };
+    Some((key, m))
+}
diff --git a/userland/capsule_terminal/src/event/mod.rs b/userland/capsule_terminal/src/event/mod.rs
index 22318e810..1c73669c5 100644
--- a/userland/capsule_terminal/src/event/mod.rs
+++ b/userland/capsule_terminal/src/event/mod.rs
@@ -16,9 +16,19 @@
 
 mod accept_suggestion;
 mod bool_to_outcome;
+mod clip;
 pub(crate) mod complete;
+pub(crate) mod cooked;
+mod cooked_kill;
 mod copy_line;
-mod fg_stdin;
+mod fg_cooked;
+mod fg_input;
+mod fg_keys;
+mod find_bar;
+mod find_seek;
+mod interrupt;
+mod key_first;
+pub(crate) mod keymap;
 mod on_ctrl;
 mod on_down;
 mod on_enter;
@@ -28,9 +38,11 @@ mod on_printable;
 mod on_tab;
 mod on_up;
 mod paste_clipboard;
+mod paste_program;
 pub(crate) mod search;
 pub(crate) mod search_edit;
 mod search_place;
 
+pub use fg_input::send as send_to_program;
 pub use on_enter::on_enter;
 pub use on_event::on_event;
diff --git a/userland/capsule_terminal/src/event/on_ctrl.rs b/userland/capsule_terminal/src/event/on_ctrl.rs
index 1dc20535d..8740ef08c 100644
--- a/userland/capsule_terminal/src/event/on_ctrl.rs
+++ b/userland/capsule_terminal/src/event/on_ctrl.rs
@@ -15,18 +15,14 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 use nonos_app_skeleton::{EventOutcome, KEY_LEFT, KEY_RIGHT, MOD_SHIFT};
-use nonos_libc::mk_kill;
 
 use super::accept_suggestion::accept_suggestion;
 use super::bool_to_outcome::bool_to_outcome;
 use super::copy_line::copy_line;
 use super::paste_clipboard::paste_clipboard;
 use super::search::{search_cancel, search_step};
-use crate::jobs::JobWork;
 use crate::term::state::State;
 
-const SIGINT: u64 = 2;
-
 const CTRL_A: u32 = 0x41;
 const CTRL_C: u32 = 0x43;
 const CTRL_E: u32 = 0x45;
@@ -73,24 +69,7 @@ pub fn on_ctrl(state: &mut State, code: u32, flags: u16) -> Option<EventOutcome>
             state.scrollback.jump_bottom();
             Some(EventOutcome::Repaint)
         }
-        CTRL_C | CTRL_C_LO => {
-            if state.fg_running {
-                if let Some(id) = state.jobs.foreground() {
-                    if let Some(job) = state.jobs.get_mut(id) {
-                        if let JobWork::ExternalStage { pid, .. } = job.work {
-                            let _ = mk_kill(pid as u64, SIGINT);
-                        }
-                        job.cancel = true;
-                    }
-                }
-            } else {
-                state.line.clear();
-                state.history.reset_cursor();
-            }
-            state.scrollback.push_line(b"^C");
-            state.scrollback.jump_bottom();
-            Some(EventOutcome::Repaint)
-        }
+        CTRL_C | CTRL_C_LO => Some(super::interrupt::interrupt(state)),
         CTRL_U | CTRL_U_LO => {
             state.line.kill_line();
             Some(EventOutcome::Repaint)
diff --git a/userland/capsule_terminal/src/event/on_key.rs b/userland/capsule_terminal/src/event/on_key.rs
index 1447accbd..91c26d8f9 100644
--- a/userland/capsule_terminal/src/event/on_key.rs
+++ b/userland/capsule_terminal/src/event/on_key.rs
@@ -26,24 +26,17 @@ use super::on_enter::on_enter;
 use super::on_printable::on_printable;
 use super::on_tab::on_tab;
 use super::on_up::on_up;
-use crate::term::dimensions::VISIBLE_ROWS;
 use crate::term::state::State;
 
 pub fn on_key(state: &mut State, event: InputEvent) -> EventOutcome {
+    if let Some(out) = super::key_first::key_first(state, event) {
+        return out;
+    }
     if event.flags & MOD_CTRL != 0 {
         if let Some(out) = on_ctrl(state, event.code, event.flags) {
             return out;
         }
     }
-    if state.fg_running && event.flags & MOD_CTRL == 0 {
-        match event.code {
-            KEY_ENTER => return super::fg_stdin::forward(state, b'\n'),
-            code if (0x20..=0x7E).contains(&code) => {
-                return super::fg_stdin::forward(state, code as u8)
-            }
-            _ => {}
-        }
-    }
     match event.code {
         // Clears the line. Esc used to close the window, so one stray press
         // took the scrollback, history and working directory with it. Closing
@@ -72,11 +65,11 @@ pub fn on_key(state: &mut State, event: InputEvent) -> EventOutcome {
         KEY_UP => on_up(state),
         KEY_DOWN => on_down(state),
         KEY_PAGE_UP => {
-            state.scrollback.scroll_up(VISIBLE_ROWS - 2);
+            state.scrollback.scroll_up(super::key_first::page(state));
             EventOutcome::Repaint
         }
         KEY_PAGE_DOWN => {
-            state.scrollback.scroll_down(VISIBLE_ROWS - 2);
+            state.scrollback.scroll_down(super::key_first::page(state));
             EventOutcome::Repaint
         }
         KEY_TAB => on_tab(state),
diff --git a/userland/capsule_terminal/src/event/paste_program.rs b/userland/capsule_terminal/src/event/paste_program.rs
new file mode 100644
index 000000000..1f04e1cac
--- /dev/null
+++ b/userland/capsule_terminal/src/event/paste_program.rs
@@ -0,0 +1,61 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! A paste into a running program: bracketed and stripped of escapes for a
+//! raw reader, typed line by line for a line reader.
+
+use alloc::string::String;
+use alloc::vec;
+
+use nonos_app_skeleton::{clipboard_paste, EventOutcome};
+use nonos_vt::input::encode_paste;
+
+use super::cooked::Effect;
+use super::fg_input::{reads_raw, send};
+use crate::term::state::State;
+
+/// Largest paste taken at once.
+const PASTE_MAX: usize = 16 * 1024;
+
+pub(super) fn paste_to_program(state: &mut State) -> EventOutcome {
+    let mut buf = vec![0u8; PASTE_MAX];
+    let n = match clipboard_paste(&mut buf) {
+        Ok(n) => n.min(buf.len()),
+        Err(_) => {
+            state.scrollback.push_line(b"paste: clipboard unavailable");
+            return EventOutcome::Repaint;
+        }
+    };
+    let text = String::from_utf8_lossy(&buf[..n]).into_owned();
+    if reads_raw(&state.scrollback.vt) {
+        let mut bytes = alloc::vec::Vec::new();
+        encode_paste(&text, &state.scrollback.vt.modes, &mut bytes);
+        send(state, &bytes);
+        return EventOutcome::Repaint;
+    }
+    // A line reader gets the paste as if typed: each line sent on its end.
+    let mut fx = Effect::default();
+    for c in text.chars() {
+        match c {
+            '\r' | '\n' => state.cooked.enter(&mut fx),
+            c if c.is_control() && c != '\t' => {}
+            c => state.cooked.char(c, &mut fx),
+        }
+    }
+    state.scrollback.feed_raw(&fx.echo);
+    send(state, &fx.send);
+    EventOutcome::Repaint
+}
diff --git a/userland/capsule_terminal/src/jobs/external.rs b/userland/capsule_terminal/src/jobs/external.rs
index 4f18afbf2..ac03dd3d6 100644
--- a/userland/capsule_terminal/src/jobs/external.rs
+++ b/userland/capsule_terminal/src/jobs/external.rs
@@ -14,52 +14,43 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-use nonos_libc::{mk_proc_input, mk_proc_output, mk_wait};
+use alloc::vec::Vec;
+
+use nonos_libc::{mk_proc_output, mk_wait};
 
 use crate::command::output::Output;
+use super::external_io::{drain_remaining, feed_stdin, TICK_BUDGET};
 use crate::jobs::JobProgress;
 
 const ERRNO_TIMEDOUT: i64 = -110;
-const MAX_PROC_INPUT: usize = 1024 * 1024;
-
 pub fn step_external(
     pid: u32,
-    in_buf: &[u8],
+    in_buf: &mut Vec<u8>,
     in_cursor: &mut usize,
     out: &mut Output<'_>,
 ) -> JobProgress {
     feed_stdin(pid, in_buf, in_cursor);
     let mut buf = [0u8; 256];
-    let n = mk_proc_output(pid, buf.as_mut_ptr(), buf.len());
-    if n > 0 {
-        out.feed_raw(&buf[..(n as usize).min(buf.len())]);
+    let mut taken = 0;
+    while taken < TICK_BUDGET {
+        let n = mk_proc_output(pid, buf.as_mut_ptr(), buf.len());
+        if n <= 0 {
+            break;
+        }
+        let n = (n as usize).min(buf.len());
+        out.feed_raw(&buf[..n]);
+        taken += n;
     }
+    /*
+     * What the program asked the terminal (its cursor position, its
+     * identity) is answered on its stdin, as a tty answers.
+     */
+    in_buf.extend_from_slice(&out.take_replies());
     let status = mk_wait(pid as u64, 0);
     if status == ERRNO_TIMEDOUT {
         return JobProgress::Running;
     }
     drain_remaining(pid, out, &mut buf);
+    out.program_ended();
     JobProgress::Done(status as i32)
 }
-
-fn feed_stdin(pid: u32, in_buf: &[u8], in_cursor: &mut usize) {
-    if *in_cursor >= in_buf.len() {
-        return;
-    }
-    let pending = &in_buf[*in_cursor..];
-    let chunk = &pending[..pending.len().min(MAX_PROC_INPUT)];
-    let sent = mk_proc_input(pid as u64, chunk.as_ptr(), chunk.len() as u64);
-    if sent > 0 {
-        *in_cursor += (sent as usize).min(chunk.len());
-    }
-}
-
-fn drain_remaining(pid: u32, out: &mut Output<'_>, buf: &mut [u8; 256]) {
-    loop {
-        let m = mk_proc_output(pid, buf.as_mut_ptr(), buf.len());
-        if m <= 0 {
-            break;
-        }
-        out.feed_raw(&buf[..(m as usize).min(buf.len())]);
-    }
-}
diff --git a/userland/capsule_terminal/src/jobs/external_io.rs b/userland/capsule_terminal/src/jobs/external_io.rs
new file mode 100644
index 000000000..1ff941914
--- /dev/null
+++ b/userland/capsule_terminal/src/jobs/external_io.rs
@@ -0,0 +1,58 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Moving bytes between the terminal and a running program: its stdin
+//! queue in, its output out, each bounded a tick.
+
+use alloc::vec::Vec;
+
+use nonos_libc::{mk_proc_input, mk_proc_output};
+
+use crate::command::output::Output;
+
+const MAX_PROC_INPUT: usize = 1024 * 1024;
+/// Output taken from a program in one tick. A program printing fast used to
+/// be read 256 bytes a tick, about 8 KiB a second; this keeps a frame
+/// bounded while letting a build log or a scan scroll at full speed.
+pub(super) const TICK_BUDGET: usize = 64 * 1024;
+
+pub(super) fn feed_stdin(pid: u32, in_buf: &mut Vec<u8>, in_cursor: &mut usize) {
+    if *in_cursor >= in_buf.len() {
+        // All of it went: start the buffer over rather than let it grow.
+        in_buf.clear();
+        *in_cursor = 0;
+        return;
+    }
+    let pending = &in_buf[*in_cursor..];
+    let chunk = &pending[..pending.len().min(MAX_PROC_INPUT)];
+    let sent = mk_proc_input(pid as u64, chunk.as_ptr(), chunk.len() as u64);
+    if sent > 0 {
+        *in_cursor += (sent as usize).min(chunk.len());
+    }
+}
+
+pub(super) fn drain_remaining(pid: u32, out: &mut Output<'_>, buf: &mut [u8; 256]) {
+    let mut taken = 0;
+    while taken < TICK_BUDGET {
+        let m = mk_proc_output(pid, buf.as_mut_ptr(), buf.len());
+        if m <= 0 {
+            break;
+        }
+        let m = (m as usize).min(buf.len());
+        out.feed_raw(&buf[..m]);
+        taken += m;
+    }
+}
diff --git a/userland/capsule_terminal/src/jobs/mod.rs b/userland/capsule_terminal/src/jobs/mod.rs
index 3662d5c5c..4b434c459 100644
--- a/userland/capsule_terminal/src/jobs/mod.rs
+++ b/userland/capsule_terminal/src/jobs/mod.rs
@@ -17,6 +17,7 @@
 mod classify;
 mod env;
 mod external;
+mod external_io;
 mod pipeline_job;
 mod pump;
 mod reap;
diff --git a/userland/capsule_terminal/src/main.rs b/userland/capsule_terminal/src/main.rs
index 2c1c4c841..e7e63ee71 100644
--- a/userland/capsule_terminal/src/main.rs
+++ b/userland/capsule_terminal/src/main.rs
@@ -40,6 +40,12 @@ use nonos_app_skeleton::run;
 /// It must not be called from Rust code.
 #[no_mangle]
 pub unsafe extern "C" fn _start() -> ! {
+    /*
+     * Each tab keeps a screen and its history. The default 16 MiB heap left
+     * room for a few hundred lines; this holds thousands in every tab.
+     */
+    const TERMINAL_HEAP: usize = 64 * 1024 * 1024;
+    let _ = nonos_libc::heap_init_sized(TERMINAL_HEAP);
     #[cfg(feature = "nonos-autorun-selftest")]
     {
         term::terminal::selftest::main()
diff --git a/userland/capsule_terminal/src/paint/block_chrome.rs b/userland/capsule_terminal/src/paint/block_chrome.rs
index be1549490..52c69ee07 100644
--- a/userland/capsule_terminal/src/paint/block_chrome.rs
+++ b/userland/capsule_terminal/src/paint/block_chrome.rs
@@ -19,8 +19,8 @@ use nonos_app_skeleton::PaintBuffer;
 use super::block_meta::draw_meta;
 use super::metrics::Metrics;
 use super::shade::elevate;
+use super::vt::Area;
 use crate::term::block::Status;
-use crate::term::dimensions::VISIBLE_ROWS;
 use crate::term::state::State;
 use crate::term::theme::types::Theme;
 
@@ -30,20 +30,22 @@ const STRIPE_GAP: u32 = 8;
 pub fn draw_block_chrome(
     state: &State,
     fb: &mut PaintBuffer,
-    ox: u32,
-    oy: u32,
-    max_y: u32,
-    max_x: u32,
+    a: &Area,
+    top: u64,
     m: &Metrics,
     t: &Theme,
 ) {
-    let g = &state.scrollback.grid;
-    for row in 0..VISIBLE_ROWS {
+    let (ox, oy, max_x, max_y) = (a.x, a.y, a.max_x, a.max_y);
+    let last = state.scrollback.vt.cursor_pos().line;
+    for row in 0.. {
         let y = crate::layout::row_top(row as u32, oy, m.lh);
         if y + m.lh > max_y {
             break;
         }
-        let abs = g.abs_of_visible_row(row);
+        let abs = top + row as u64;
+        if abs > last {
+            break;
+        }
         let (idx, status) = match block_for(state, abs) {
             Some(v) => v,
             None => continue,
diff --git a/userland/capsule_terminal/src/paint/compose.rs b/userland/capsule_terminal/src/paint/compose.rs
index 2ce84a2b7..8d6ad5fcd 100644
--- a/userland/capsule_terminal/src/paint/compose.rs
+++ b/userland/capsule_terminal/src/paint/compose.rs
@@ -17,16 +17,14 @@
 use nonos_app_skeleton::PaintBuffer;
 
 use super::block_chrome::draw_block_chrome;
-use super::constants::{BODY_PAD_TOP, HEADER_H, TEXT_LEFT};
-use super::draw_grid::{draw_grid, draw_grid_cursor};
 use super::draw_input_line::draw_input_line;
 use super::fetch::draw_fetch;
-use super::footer::{draw_footer, footer_h};
+use super::footer::draw_footer;
+use super::geometry::geometry;
 use super::header::draw_header;
-use super::metrics::Metrics;
 use super::rail_left;
-use crate::layout::limits::LEFT_RAIL_W;
-use crate::layout::{compute, Chrome, Layout, Rails};
+use super::vt::{draw_find_bar, draw_vt, Area, Frame, Rows};
+use crate::layout::Layout;
 use crate::palette::{Index, Palette};
 use crate::rail::Rail;
 use crate::term::prefs::types::Project;
@@ -66,34 +64,30 @@ pub fn paint(
 ) -> Layout {
     fb.clear(t.bg);
     draw_header(state, fb, t);
-    let m = Metrics::new(fb, font_scale);
-    let chrome = Chrome {
-        titlebar_h: HEADER_H,
-        tabstrip_h: 0,
-        body_pad_top: BODY_PAD_TOP,
-        footer_h: footer_h(),
-        text_left: TEXT_LEFT,
-        row_h: m.lh,
-    };
-    // The rail is off unless it was asked for. A terminal that opens with a
-    // quarter of the window given to charts is a dashboard that happens to
-    // accept commands; the grid is the window, and the telemetry is there for
-    // whoever wants it.
-    let left = if rail_open { LEFT_RAIL_W } else { 0 };
-    let l = compute(fb.width, fb.height, &chrome, Rails { left });
+    let (l, m, chrome) = geometry(fb, font_scale, rail_open);
     let text_x = l.body.x + chrome.text_left;
     let text_r = (l.body.x + l.body.w).saturating_sub(chrome.text_left);
-    let alt = state.scrollback.grid.alternate;
-    if alt {
-        draw_grid(&state.scrollback.grid, fb, text_x, l.body.y, l.footer.y, text_r, m, t);
-        draw_grid_cursor(&state.scrollback.grid, fb, text_x, l.body.y, m, t);
+    let vt = &state.scrollback.vt;
+    /*
+     * A program in the foreground, or on the alternate screen, owns the
+     * whole body and is drawn as its screen; the prompt returns at its end.
+     */
+    let owned = vt.alt_active() || state.fg_running;
+    let bottom = if owned { l.footer.y } else { l.input.y };
+    let area = Area { x: text_x, y: l.body.y, max_x: text_r, max_y: bottom };
+    let f = Frame { vt, area, m, t };
+    if owned {
+        draw_vt(&f, fb, Rows::Screen, state.shade());
     } else if state.fresh {
         draw_fetch(state, fb, text_x, l.body.y, text_r, t);
     } else {
-        draw_block_chrome(state, fb, text_x, l.body.y, l.input.y, text_r, &m, t);
-        draw_grid(&state.scrollback.grid, fb, text_x, l.body.y, l.input.y, text_r, m, t);
+        let rows = Rows::Shell { rows: (l.body.h / m.lh.max(1)) as usize, back: vt.view_offset() };
+        draw_block_chrome(state, fb, &f.area, rows.first(vt), &m, t);
+        draw_vt(&f, fb, rows, state.shade());
     }
-    if !alt {
+    if let Some(find) = &state.find {
+        draw_find_bar(find, fb, l.input, m, t);
+    } else if !owned {
         draw_input_line(state, fb, l.input, m, t);
     }
     draw_footer(fb, t);
diff --git a/userland/capsule_terminal/src/paint/draw_grid.rs b/userland/capsule_terminal/src/paint/draw_grid.rs
deleted file mode 100644
index a9c20f8c5..000000000
--- a/userland/capsule_terminal/src/paint/draw_grid.rs
+++ /dev/null
@@ -1,95 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-//! Draw the character grid with crisp monospace TrueType glyphs. Each cell is
-//! laid out on the measured advance and painted with `text_ttf_mono`, so the
-//! body reads like a real terminal rather than a scaled bitmap.
-
-use nonos_app_skeleton::PaintBuffer;
-
-use super::metrics::Metrics;
-use crate::term::dimensions::{COLS, VISIBLE_ROWS};
-use crate::term::grid::cell::{F_REVERSE, F_WIDE_TAIL};
-use crate::term::grid::types::Grid;
-use crate::term::theme::types::Theme;
-use crate::term::vt::color::DEFAULT_BG;
-
-fn glyph(fb: &mut PaintBuffer, x: u32, y: u32, ch: char, argb: u32, px: f32) {
-    // Blanks and control characters have no glyph. Everything else is handed
-    // to the face, which covers far more than ASCII and draws .notdef for
-    // what it does not have, so an unmapped character is visibly missing
-    // rather than silently absent.
-    if ch == ' ' || (ch as u32) < 0x20 || ch as u32 == 0x7f {
-        return;
-    }
-    let mut buf = [0u8; 4];
-    let s = ch.encode_utf8(&mut buf);
-    let _ = fb.text_ttf_mono(x as i32, y as i32, s, argb, px);
-}
-
-pub fn draw_grid_cursor(g: &Grid, fb: &mut PaintBuffer, ox: u32, oy: u32, m: Metrics, t: &Theme) {
-    if !g.cursor_visible {
-        return;
-    }
-    let x = ox + g.x as u32 * m.adv;
-    let y = oy + g.y as u32 * m.lh;
-    fb.fill_rect(x, y, m.adv, m.lh, t.accent);
-    glyph(fb, x, y, g.cells[Grid::idx(g.x, g.y)].ch, t.bg, m.px);
-}
-
-pub fn draw_grid(
-    g: &Grid,
-    fb: &mut PaintBuffer,
-    ox: u32,
-    oy: u32,
-    max_y: u32,
-    max_x: u32,
-    m: Metrics,
-    t: &Theme,
-) {
-    for row in 0..VISIBLE_ROWS {
-        let y = crate::layout::row_top(row as u32, oy, m.lh);
-        if y + m.lh > max_y {
-            break;
-        }
-        let rowcells = g.visible_row(row);
-        for (col, cell) in rowcells.iter().enumerate().take(COLS) {
-            let x = ox + col as u32 * m.adv;
-            if x + m.adv > max_x {
-                break;
-            }
-            let has_bg = cell.bg != DEFAULT_BG;
-            let mut fg = cell.fg;
-            // A default (transparent) background resolves to the terminal
-            // backdrop when it needs to become a visible colour, so reverse
-            // video and explicit fills both read correctly.
-            let mut bg = if has_bg { cell.bg } else { t.bg };
-            let reverse = cell.flags & F_REVERSE != 0;
-            if reverse {
-                core::mem::swap(&mut fg, &mut bg);
-            }
-            if has_bg || reverse {
-                fb.fill_rect(x, y, m.adv, m.lh, bg);
-            }
-            // The right half of a wide character carries the background and
-            // nothing else. Its glyph was drawn by the cell before it, which
-            // had both columns to draw into.
-            if cell.flags & F_WIDE_TAIL == 0 {
-                glyph(fb, x, y, cell.ch, fg, m.px);
-            }
-        }
-    }
-}
diff --git a/userland/capsule_terminal/src/paint/geometry.rs b/userland/capsule_terminal/src/paint/geometry.rs
new file mode 100644
index 000000000..cc5f3005b
--- /dev/null
+++ b/userland/capsule_terminal/src/paint/geometry.rs
@@ -0,0 +1,57 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Where the body and its cells fall in a window of a given size and zoom,
+//! for the painter and for sizing the screen before painting.
+
+use nonos_app_skeleton::PaintBuffer;
+
+use super::constants::{BODY_PAD_TOP, HEADER_H, TEXT_LEFT};
+use super::footer::footer_h;
+use super::metrics::Metrics;
+use crate::layout::limits::LEFT_RAIL_W;
+use crate::layout::{compute, Chrome, Layout, Rails};
+
+pub fn geometry(fb: &PaintBuffer, font_scale: u32, rail_open: bool) -> (Layout, Metrics, Chrome) {
+    let m = Metrics::new(fb, font_scale);
+    let chrome = Chrome {
+        titlebar_h: HEADER_H,
+        tabstrip_h: 0,
+        body_pad_top: BODY_PAD_TOP,
+        footer_h: footer_h(),
+        text_left: TEXT_LEFT,
+        row_h: m.lh,
+    };
+    /*
+     * The rail is off unless it was asked for. A terminal that opens with a
+     * quarter of the window given to charts is a dashboard that happens to
+     * accept commands; the grid is the window, and the telemetry is there for
+     * whoever wants it.
+     */
+    let left = if rail_open { LEFT_RAIL_W } else { 0 };
+    (compute(fb.width, fb.height, &chrome, Rails { left }), m, chrome)
+}
+
+/// The cells the body holds at this window size and zoom: columns between
+/// the text margins, rows over the body and the prompt row together, which
+/// a program in the foreground draws on.
+pub fn grid_size(fb: &PaintBuffer, font_scale: u32, rail_open: bool) -> (usize, usize, Metrics) {
+    let (l, m, chrome) = geometry(fb, font_scale, rail_open);
+    let width = l.body.w.saturating_sub(2 * chrome.text_left);
+    let cols = (width / m.adv.max(1)) as usize;
+    let rows = ((l.body.h + l.input.h) / m.lh.max(1)) as usize;
+    (cols.max(2), rows.max(1), m)
+}
diff --git a/userland/capsule_terminal/src/paint/line_text.rs b/userland/capsule_terminal/src/paint/line_text.rs
index bee5f5b85..3e0a0d98a 100644
--- a/userland/capsule_terminal/src/paint/line_text.rs
+++ b/userland/capsule_terminal/src/paint/line_text.rs
@@ -20,8 +20,8 @@ use nonos_app_skeleton::PaintBuffer;
 
 use super::line_chars::chars_of;
 use super::syntax::Part;
-use crate::term::grid::width::char_width;
 use crate::term::theme::types::Theme;
+use nonos_vt::width::width as char_width;
 
 // Draw text as crisp monospace, advancing by the columns each character
 // occupies. What is typed has to render the same as what the grid shows, or a
diff --git a/userland/capsule_terminal/src/paint/mod.rs b/userland/capsule_terminal/src/paint/mod.rs
index 4cea5556b..b3bd880de 100644
--- a/userland/capsule_terminal/src/paint/mod.rs
+++ b/userland/capsule_terminal/src/paint/mod.rs
@@ -19,7 +19,6 @@ mod block_meta;
 mod compose;
 mod constants;
 mod draw_cursor;
-mod draw_grid;
 mod draw_input_line;
 mod fetch;
 pub(crate) mod fetch_banner;
@@ -28,11 +27,12 @@ mod fetch_uptime;
 mod fetch_version;
 mod fit_text;
 mod footer;
+mod geometry;
 mod header;
 mod line_chars;
 mod line_text;
 mod line_window;
-mod metrics;
+pub(crate) mod metrics;
 mod palette;
 mod palette_row;
 mod prompt;
@@ -65,6 +65,10 @@ pub mod tab_pill;
 pub mod tokens;
 mod tool_icon;
 pub mod toolbar;
+mod vt;
 
 pub use compose::paint_tabs;
+pub use constants::TEXT_LEFT;
+pub use geometry::grid_size;
 pub use tab_bar::draw_tab_bar;
+pub use vt::{Rows, Shade};
diff --git a/userland/capsule_terminal/src/term/grid/cell.rs b/userland/capsule_terminal/src/paint/vt/area.rs
similarity index 52%
rename from userland/capsule_terminal/src/term/grid/cell.rs
rename to userland/capsule_terminal/src/paint/vt/area.rs
index 58e2797fc..c3fd43826 100644
--- a/userland/capsule_terminal/src/term/grid/cell.rs
+++ b/userland/capsule_terminal/src/paint/vt/area.rs
@@ -14,29 +14,35 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-pub const F_BOLD: u8 = 1;
-pub const F_UNDERLINE: u8 = 2;
-pub const F_REVERSE: u8 = 4;
-/// The right half of a character drawn two columns wide. It holds no glyph
-/// of its own; the cell before it drew both halves.
-pub const F_WIDE_TAIL: u8 = 8;
+//! Where the body is drawn, with what, and what is shaded over it.
 
-#[derive(Clone, Copy)]
-pub struct Cell {
-    pub ch: char,
-    // Full ARGB foreground and background, so 24-bit colour is preserved.
-    pub fg: u32,
-    pub bg: u32,
-    pub flags: u8,
+use nonos_vt::{Pos, Term};
+
+use crate::paint::metrics::Metrics;
+use crate::term::select::Selection;
+use crate::term::theme::types::Theme;
+
+pub const OPAQUE: u32 = 0xFF00_0000;
+
+/// What is shaded over the text.
+#[derive(Clone, Copy, Default)]
+pub struct Shade {
+    pub selection: Option<Selection>,
+    pub found: Option<(Pos, Pos)>,
+}
+
+/// The rectangle the body may draw in.
+pub struct Area {
+    pub x: u32,
+    pub y: u32,
+    pub max_x: u32,
+    pub max_y: u32,
 }
 
-impl Cell {
-    pub const fn blank() -> Cell {
-        Cell {
-            ch: ' ',
-            fg: crate::term::vt::color::DEFAULT_FG,
-            bg: crate::term::vt::color::DEFAULT_BG,
-            flags: 0,
-        }
-    }
+/// One frame's drawing context.
+pub struct Frame<'a> {
+    pub vt: &'a Term,
+    pub area: Area,
+    pub m: Metrics,
+    pub t: &'a Theme,
 }
diff --git a/userland/capsule_terminal/src/paint/vt/body.rs b/userland/capsule_terminal/src/paint/vt/body.rs
new file mode 100644
index 000000000..fec455270
--- /dev/null
+++ b/userland/capsule_terminal/src/paint/vt/body.rs
@@ -0,0 +1,65 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The body's rows: colours after every attribute, wide characters across
+//! two cells, and the selection and search match shaded.
+
+use nonos_app_skeleton::PaintBuffer;
+use nonos_vt::Line;
+
+use super::area::{Frame, Shade};
+use super::cell::text;
+use super::cursor::draw_cursor;
+use super::deco::decorations;
+use super::fill::background;
+use super::rows::Rows;
+
+pub fn draw_vt(f: &Frame, fb: &mut PaintBuffer, rows: Rows, shade: Shade) {
+    let top = rows.first(f.vt);
+    for i in 0.. {
+        let y = crate::layout::row_top(i as u32, f.area.y, f.m.lh);
+        if y + f.m.lh > f.area.max_y {
+            break;
+        }
+        let Some((abs, line)) = rows.get(f.vt, top, i) else { break };
+        draw_row(f, fb, line, abs, y, shade);
+        draw_cursor(f, fb, rows, abs, y);
+    }
+}
+
+fn draw_row(f: &Frame, fb: &mut PaintBuffer, line: &Line, abs: u64, y: u32, shade: Shade) {
+    let m = f.m;
+    for col in 0..f.vt.cols() {
+        let x = f.area.x + col as u32 * m.adv;
+        if x + m.adv > f.area.max_x {
+            break;
+        }
+        let cell = line.cell(col);
+        let (fg, bg) = f.vt.cell_colors(&cell);
+        if let Some(bg) = background(f, &cell, bg, abs, col, shade) {
+            fb.fill_rect(x, y, m.adv, m.lh, bg);
+        }
+        /*
+         * The right half of a wide character carries only its background;
+         * the head drew the glyph across both cells.
+         */
+        if !cell.is_tail() {
+            let w = if cell.is_wide() { 2 * m.adv } else { m.adv };
+            text(fb, line, &cell, x, y, fg, m);
+            decorations(fb, &cell, x, y, w, fg, m);
+        }
+    }
+}
diff --git a/userland/capsule_terminal/src/paint/vt/cell.rs b/userland/capsule_terminal/src/paint/vt/cell.rs
new file mode 100644
index 000000000..f6eb3960d
--- /dev/null
+++ b/userland/capsule_terminal/src/paint/vt/cell.rs
@@ -0,0 +1,52 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! A cell's glyph and the marks drawn over it.
+
+use nonos_app_skeleton::PaintBuffer;
+use nonos_vt::cell::attr;
+use nonos_vt::{Cell, Line};
+
+use super::area::OPAQUE;
+use crate::paint::metrics::Metrics;
+
+pub fn glyph(fb: &mut PaintBuffer, x: u32, y: u32, ch: char, argb: u32, px: f32) {
+    /*
+     * Blanks and controls have no glyph. Anything else goes to the face,
+     * which draws .notdef for what it lacks, so a missing character shows.
+     */
+    if ch == ' ' || ch == '\u{a0}' || ch.is_control() {
+        return;
+    }
+    let mut buf = [0u8; 4];
+    let _ = fb.text_ttf_mono(x as i32, y as i32, ch.encode_utf8(&mut buf), argb, px);
+}
+
+/// Draw the text of `cell` at `(x, y)` in `fg`. Bold is drawn twice a pixel
+/// apart: the face has no bold weight. It has no italic either, so italic
+/// text is drawn upright.
+pub fn text(fb: &mut PaintBuffer, line: &Line, cell: &Cell, x: u32, y: u32, fg: u32, m: Metrics) {
+    let fg = OPAQUE | fg;
+    glyph(fb, x, y, cell.ch, fg, m.px);
+    if cell.attr & attr::BOLD != 0 {
+        glyph(fb, x + 1, y, cell.ch, fg, m.px);
+    }
+    if let Some(marks) = line.marks_of(cell) {
+        for c in marks.chars() {
+            glyph(fb, x, y, c, fg, m.px);
+        }
+    }
+}
diff --git a/userland/capsule_terminal/src/paint/vt/cursor.rs b/userland/capsule_terminal/src/paint/vt/cursor.rs
new file mode 100644
index 000000000..8d059129c
--- /dev/null
+++ b/userland/capsule_terminal/src/paint/vt/cursor.rs
@@ -0,0 +1,47 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The cursor, in the shape the program set: block, underline or bar.
+
+use nonos_app_skeleton::PaintBuffer;
+use nonos_vt::CursorShape;
+
+use super::area::{Frame, OPAQUE};
+use super::cell::glyph;
+use super::rows::Rows;
+
+/// Draw the cursor if it is on the row at `abs`, drawn at `y`. The shell
+/// view draws its own cursor in the prompt instead.
+pub fn draw_cursor(f: &Frame, fb: &mut PaintBuffer, rows: Rows, abs: u64, y: u32) {
+    let c = f.vt.cursor();
+    if !matches!(rows, Rows::Screen) || !c.visible || f.vt.abs_of_row(c.y) != abs {
+        return;
+    }
+    let (m, x) = (f.m, f.area.x + c.x as u32 * f.m.adv);
+    if x + m.adv > f.area.max_x {
+        return;
+    }
+    let colour = OPAQUE | f.vt.palette().cursor;
+    match c.shape {
+        CursorShape::Block => {
+            fb.fill_rect(x, y, m.adv, m.lh, colour);
+            let under = f.vt.visible_line(c.y).cell(c.x);
+            glyph(fb, x, y, under.ch, OPAQUE | f.t.bg, m.px);
+        }
+        CursorShape::Underline => fb.fill_rect(x, y + m.lh.saturating_sub(2), m.adv, 2, colour),
+        CursorShape::Bar => fb.fill_rect(x, y, 2, m.lh, colour),
+    }
+}
diff --git a/userland/capsule_terminal/src/paint/vt/deco.rs b/userland/capsule_terminal/src/paint/vt/deco.rs
new file mode 100644
index 000000000..761305bc8
--- /dev/null
+++ b/userland/capsule_terminal/src/paint/vt/deco.rs
@@ -0,0 +1,59 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Lines drawn across a cell: the underline styles, strikethrough and
+//! overline.
+
+use nonos_app_skeleton::PaintBuffer;
+use nonos_vt::cell::attr;
+use nonos_vt::{Cell, Underline};
+
+use super::area::OPAQUE;
+use crate::paint::metrics::Metrics;
+
+fn curly(fb: &mut PaintBuffer, x: u32, base: u32, w: u32, fg: u32) {
+    let pts: alloc::vec::Vec<(i32, i32)> = (0..=w / 2)
+        .map(|i| {
+            let py = if i % 2 == 0 { base.saturating_sub(1) } else { base + 1 };
+            ((x + 2 * i) as i32, py as i32)
+        })
+        .collect();
+    fb.polyline(&pts, fg);
+}
+
+pub fn decorations(fb: &mut PaintBuffer, cell: &Cell, x: u32, y: u32, w: u32, fg: u32, m: Metrics) {
+    let fg = OPAQUE | fg;
+    let base = y + m.lh.saturating_sub(3);
+    match cell.underline() {
+        Underline::None => {}
+        Underline::Single => fb.fill_rect(x, base, w, 1, fg),
+        Underline::Double => {
+            fb.fill_rect(x, base.saturating_sub(2), w, 1, fg);
+            fb.fill_rect(x, base, w, 1, fg);
+        }
+        Underline::Curly => curly(fb, x, base, w, fg),
+        Underline::Dotted => (0..w).step_by(2).for_each(|i| fb.fill_rect(x + i, base, 1, 1, fg)),
+        Underline::Dashed => {
+            (0..w).step_by(5).for_each(|i| fb.fill_rect(x + i, base, 3.min(w - i), 1, fg))
+        }
+    }
+    if cell.attr & attr::STRIKE != 0 {
+        fb.fill_rect(x, y + m.lh / 2, w, 1, fg);
+    }
+    if cell.attr & attr::OVERLINE != 0 {
+        fb.fill_rect(x, y + 1, w, 1, fg);
+    }
+}
diff --git a/userland/capsule_terminal/src/paint/vt/fill.rs b/userland/capsule_terminal/src/paint/vt/fill.rs
new file mode 100644
index 000000000..be519d7ba
--- /dev/null
+++ b/userland/capsule_terminal/src/paint/vt/fill.rs
@@ -0,0 +1,47 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The fill behind a cell: the selection, a search match, its own
+//! background, or none where the theme's backdrop shows through.
+
+use nonos_toolkit::paint::mixer::mix;
+use nonos_vt::cell::attr;
+use nonos_vt::{Cell, Color};
+
+use super::area::{Frame, Shade, OPAQUE};
+use crate::term::select::in_span;
+
+/// The fill behind a cell, or none where the theme's backdrop shows.
+pub(super) fn background(
+    f: &Frame,
+    cell: &Cell,
+    bg: u32,
+    abs: u64,
+    col: usize,
+    shade: Shade,
+) -> Option<u32> {
+    if shade.selection.is_some_and(|s| s.contains(abs, col)) {
+        return Some(OPAQUE | mix(f.t.bg, f.t.accent, 90));
+    }
+    if in_span(shade.found, abs, col) {
+        return Some(OPAQUE | mix(f.t.bg, f.t.run, 150));
+    }
+    let plain = cell.bg == Color::Default && cell.attr & attr::INVERSE == 0;
+    if plain && !f.vt.modes.reverse_video {
+        return None;
+    }
+    Some(OPAQUE | bg)
+}
diff --git a/userland/capsule_terminal/src/paint/vt/find_bar.rs b/userland/capsule_terminal/src/paint/vt/find_bar.rs
new file mode 100644
index 000000000..5b489699d
--- /dev/null
+++ b/userland/capsule_terminal/src/paint/vt/find_bar.rs
@@ -0,0 +1,50 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The search bar, drawn where the prompt goes while a search is open.
+
+use nonos_app_skeleton::PaintBuffer;
+
+use crate::layout::Rect;
+use crate::paint::constants::TEXT_LEFT;
+use crate::paint::metrics::Metrics;
+use crate::paint::shade::elevate;
+use crate::term::select::Find;
+use crate::term::theme::types::Theme;
+
+pub fn draw_find_bar(f: &Find, fb: &mut PaintBuffer, r: Rect, m: Metrics, t: &Theme) {
+    let bar_x = r.x + TEXT_LEFT / 2;
+    let bar_y = r.y.saturating_sub(3);
+    fb.fill_rect(bar_x, bar_y, r.w.saturating_sub(TEXT_LEFT), m.lh + 4, elevate(t.bg, 12));
+    fb.fill_rect(bar_x, bar_y, 2, m.lh + 4, t.run);
+    let x = (r.x + TEXT_LEFT) as i32;
+    let label = "find ";
+    let _ = fb.text_ttf_mono(x, r.y as i32, label, t.dim, m.px);
+    let qx = x + (label.len() as u32 * m.adv) as i32;
+    let _ = fb.text_ttf_mono(qx, r.y as i32, &f.query, t.fg, m.px);
+    let state = match (f.query.is_empty(), f.hit.is_some()) {
+        (true, _) => "type to search history",
+        (false, true) => "Enter older, Shift+Enter newer, Esc close",
+        (false, false) => "no match",
+    };
+    let case = if f.case { "  case" } else { "" };
+    let hint_x = qx + ((f.query.chars().count() as u32 + 3) * m.adv) as i32;
+    let _ = fb.text_ttf_mono(hint_x, r.y as i32, state, t.dim, m.px);
+    if !case.is_empty() {
+        let cx = hint_x + (state.len() as u32 * m.adv) as i32;
+        let _ = fb.text_ttf_mono(cx, r.y as i32, case, t.accent, m.px);
+    }
+}
diff --git a/userland/capsule_terminal/src/term/vt/mod.rs b/userland/capsule_terminal/src/paint/vt/mod.rs
similarity index 73%
rename from userland/capsule_terminal/src/term/vt/mod.rs
rename to userland/capsule_terminal/src/paint/vt/mod.rs
index a112cf417..6bb765f95 100644
--- a/userland/capsule_terminal/src/term/vt/mod.rs
+++ b/userland/capsule_terminal/src/paint/vt/mod.rs
@@ -14,11 +14,18 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-pub mod color;
-pub mod csi_cursor;
-pub mod csi_edit;
-pub mod decset;
-pub mod parser;
-pub mod sgr;
-pub mod state;
-pub mod utf8;
+//! Drawing the terminal body from the screen and its history.
+
+mod area;
+mod body;
+mod cell;
+mod cursor;
+mod deco;
+mod fill;
+mod find_bar;
+mod rows;
+
+pub use area::{Area, Frame, Shade};
+pub use body::draw_vt;
+pub use find_bar::draw_find_bar;
+pub use rows::Rows;
diff --git a/userland/capsule_terminal/src/paint/vt/rows.rs b/userland/capsule_terminal/src/paint/vt/rows.rs
new file mode 100644
index 000000000..1bcbd7cf0
--- /dev/null
+++ b/userland/capsule_terminal/src/paint/vt/rows.rs
@@ -0,0 +1,64 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Which lines fill the body. The shell draws its history ending at the
+//! last line written, so output sits just above the prompt. A program in
+//! the foreground, or on the alternate screen, owns the whole body and is
+//! drawn as its screen.
+
+use nonos_vt::{Line, Term};
+
+#[derive(Clone, Copy)]
+pub enum Rows {
+    /// Screen rows `0..n`, as the program laid them out.
+    Screen,
+    /// `n` lines of history ending at the last line written, `back` lines
+    /// back into history.
+    Shell { rows: usize, back: usize },
+}
+
+impl Rows {
+    /// The absolute line of the first row drawn.
+    pub fn first(&self, vt: &Term) -> u64 {
+        match *self {
+            Rows::Screen => vt.abs_of_row(0),
+            Rows::Shell { rows, back } => {
+                let cur = vt.cursor_pos();
+                let written = vt.line_at(cur.line).is_some_and(|l| l.content_len() > 0);
+                let last =
+                    if cur.col > 0 || written { cur.line } else { cur.line.saturating_sub(1) };
+                let top = (last + 1).saturating_sub(rows as u64).saturating_sub(back as u64);
+                top.max(vt.first_line())
+            }
+        }
+    }
+
+    /// Row `i` of the body, given `top` from `first`: its absolute line
+    /// and the line itself.
+    pub fn get<'a>(&self, vt: &'a Term, top: u64, i: usize) -> Option<(u64, &'a Line)> {
+        match self {
+            Rows::Screen => (i < vt.rows()).then(|| (vt.abs_of_row(i), vt.visible_line(i))),
+            Rows::Shell { .. } => {
+                let abs = top + i as u64;
+                let cur = vt.cursor_pos().line;
+                if abs > cur {
+                    return None;
+                }
+                vt.line_at(abs).map(|l| (abs, l))
+            }
+        }
+    }
+}
diff --git a/userland/capsule_terminal/src/term/block/ops.rs b/userland/capsule_terminal/src/term/block/ops.rs
index 9cd23c1fa..db26f3783 100644
--- a/userland/capsule_terminal/src/term/block/ops.rs
+++ b/userland/capsule_terminal/src/term/block/ops.rs
@@ -21,7 +21,7 @@ const MAX_BLOCKS: usize = 256;
 
 impl State {
     pub fn open_block(&mut self, ts: [u8; 8]) {
-        let start_abs = self.scrollback.grid.current_abs_line();
+        let start_abs = self.scrollback.vt.cursor_pos().line;
         self.blocks.push(Block { start_abs, ts, status: Status::Running, dur_ms: 0 });
         if self.blocks.len() > MAX_BLOCKS {
             self.blocks.remove(0);
@@ -36,7 +36,7 @@ impl State {
     }
 
     pub fn evict_blocks(&mut self) {
-        let base = self.scrollback.grid.abs_base();
+        let base = self.scrollback.vt.first_line();
         let keep =
             self.blocks.iter().position(|b| b.start_abs >= base).unwrap_or(self.blocks.len());
         if keep > 1 {
diff --git a/userland/capsule_terminal/src/term/dimensions.rs b/userland/capsule_terminal/src/term/dimensions.rs
index 831a21765..bd009fab1 100644
--- a/userland/capsule_terminal/src/term/dimensions.rs
+++ b/userland/capsule_terminal/src/term/dimensions.rs
@@ -15,7 +15,8 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 pub const COLS: usize = 96;
-pub const SCROLLBACK_ROWS: usize = 256;
+/// History lines each tab keeps.
+pub const SCROLLBACK_ROWS: usize = 3000;
 pub const VISIBLE_ROWS: usize = 40;
 pub const HISTORY_DEPTH: usize = 32;
 pub const MIN_FONT_SCALE: u32 = 1;
diff --git a/userland/capsule_terminal/src/term/grid/alt.rs b/userland/capsule_terminal/src/term/grid/alt.rs
deleted file mode 100644
index bf7a16bdf..000000000
--- a/userland/capsule_terminal/src/term/grid/alt.rs
+++ /dev/null
@@ -1,42 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-use crate::term::dimensions::VISIBLE_ROWS;
-use crate::term::grid::types::Grid;
-
-impl Grid {
-    pub fn enter_alt(&mut self, clear: bool) {
-        if !self.alternate {
-            core::mem::swap(&mut self.cells, &mut self.alt);
-            self.alternate = true;
-        }
-        // A fresh screen starts with a full-screen scroll region.
-        self.scroll_top = 0;
-        self.scroll_bot = VISIBLE_ROWS - 1;
-        if clear {
-            self.clear();
-        }
-    }
-
-    pub fn leave_alt(&mut self) {
-        if self.alternate {
-            core::mem::swap(&mut self.cells, &mut self.alt);
-            self.alternate = false;
-        }
-        self.scroll_top = 0;
-        self.scroll_bot = VISIBLE_ROWS - 1;
-    }
-}
diff --git a/userland/capsule_terminal/src/term/grid/erase.rs b/userland/capsule_terminal/src/term/grid/erase.rs
deleted file mode 100644
index 4bf7713d3..000000000
--- a/userland/capsule_terminal/src/term/grid/erase.rs
+++ /dev/null
@@ -1,69 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-use crate::term::dimensions::{COLS, VISIBLE_ROWS};
-use crate::term::grid::types::Grid;
-
-impl Grid {
-    pub fn erase_line(&mut self, mode: u8) {
-        let blank = self.blank_cell();
-        let (start, end) = match mode {
-            0 => (self.x, COLS),
-            1 => (0, self.x),
-            _ => (0, COLS),
-        };
-        for x in start..end {
-            self.cells[Grid::idx(x, self.y)] = blank;
-        }
-    }
-    pub fn erase_display(&mut self, mode: u8) {
-        let blank = self.blank_cell();
-        match mode {
-            0 => {
-                for x in self.x..COLS {
-                    self.cells[Grid::idx(x, self.y)] = blank;
-                }
-                for y in (self.y + 1)..VISIBLE_ROWS {
-                    for x in 0..COLS {
-                        self.cells[Grid::idx(x, y)] = blank;
-                    }
-                }
-            }
-            1 => {
-                for y in 0..self.y {
-                    for x in 0..COLS {
-                        self.cells[Grid::idx(x, y)] = blank;
-                    }
-                }
-                for x in 0..self.x {
-                    self.cells[Grid::idx(x, self.y)] = blank;
-                }
-            }
-            _ => {
-                self.clear();
-            }
-        }
-    }
-    pub fn clear(&mut self) {
-        let blank = self.blank_cell();
-        for i in 0..self.cells.len() {
-            self.cells[i] = blank;
-        }
-        self.x = 0;
-        self.y = 0;
-        self.view_offset = 0;
-    }
-}
diff --git a/userland/capsule_terminal/src/term/grid/move_cells.rs b/userland/capsule_terminal/src/term/grid/move_cells.rs
deleted file mode 100644
index 5da67135c..000000000
--- a/userland/capsule_terminal/src/term/grid/move_cells.rs
+++ /dev/null
@@ -1,46 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-use crate::term::dimensions::{COLS, VISIBLE_ROWS};
-use crate::term::grid::types::Grid;
-
-impl Grid {
-    pub fn move_cells(
-        &mut self,
-        from_x: usize,
-        from_y: usize,
-        to_x: usize,
-        to_y: usize,
-        w: usize,
-        h: usize,
-    ) {
-        for ry in 0..h {
-            let fy = from_y + ry;
-            let ty = to_y + ry;
-            if fy >= VISIBLE_ROWS || ty >= VISIBLE_ROWS {
-                continue;
-            }
-            let fw = w.min(COLS.saturating_sub(from_x));
-            let tw = fw.min(COLS.saturating_sub(to_x));
-            if tw == 0 {
-                continue;
-            }
-            let src = Grid::idx(from_x, fy);
-            let dst = Grid::idx(to_x, ty);
-            self.cells.copy_within(src..src + tw, dst);
-        }
-    }
-}
diff --git a/userland/capsule_terminal/src/term/grid/new.rs b/userland/capsule_terminal/src/term/grid/new.rs
deleted file mode 100644
index 32114f7b4..000000000
--- a/userland/capsule_terminal/src/term/grid/new.rs
+++ /dev/null
@@ -1,49 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-use alloc::vec;
-
-use crate::term::dimensions::{COLS, SCROLLBACK_ROWS, VISIBLE_ROWS};
-use crate::term::grid::cell::Cell;
-use crate::term::grid::types::Grid;
-use crate::term::vt::color::{DEFAULT_BG, DEFAULT_FG};
-use crate::term::vt::parser::Parser;
-use crate::term::vt::utf8::Utf8;
-
-impl Grid {
-    pub fn new() -> Grid {
-        Grid {
-            cells: vec![Cell::blank(); COLS * VISIBLE_ROWS],
-            alt: vec![Cell::blank(); COLS * VISIBLE_ROWS],
-            history: vec![Cell::blank(); COLS * SCROLLBACK_ROWS],
-            hist_head: 0,
-            hist_count: 0,
-            view_offset: 0,
-            alternate: false,
-            cursor_visible: true,
-            x: 0,
-            y: 0,
-            fg: DEFAULT_FG,
-            bg: DEFAULT_BG,
-            flags: 0,
-            parser: Parser::new(),
-            utf8: Utf8::default(),
-            total_scrolled: 0,
-            scroll_top: 0,
-            scroll_bot: VISIBLE_ROWS - 1,
-        }
-    }
-}
diff --git a/userland/capsule_terminal/src/term/grid/put.rs b/userland/capsule_terminal/src/term/grid/put.rs
deleted file mode 100644
index 442df9c31..000000000
--- a/userland/capsule_terminal/src/term/grid/put.rs
+++ /dev/null
@@ -1,62 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-use crate::term::dimensions::{COLS, VISIBLE_ROWS};
-use crate::term::grid::cell::{Cell, F_WIDE_TAIL};
-use crate::term::grid::types::Grid;
-use crate::term::grid::width::char_width;
-
-impl Grid {
-    pub fn blank_cell(&self) -> Cell {
-        Cell { ch: ' ', fg: self.fg, bg: self.bg, flags: 0 }
-    }
-    pub fn put_char(&mut self, c: char) {
-        let w = char_width(c);
-        // A character drawn two columns wide cannot straddle the edge, so it
-        // wraps whole rather than being split across two lines.
-        if self.x + w > COLS {
-            self.x = 0;
-            self.line_feed();
-        }
-        let i = Grid::idx(self.x, self.y);
-        self.cells[i] = Cell { ch: c, fg: self.fg, bg: self.bg, flags: self.flags };
-        if w == 2 {
-            // The right half holds no glyph. It is still a cell, so that
-            // erasing, scrolling and background fills treat the pair as the
-            // two columns it occupies.
-            let tail = Grid::idx(self.x + 1, self.y);
-            self.cells[tail] =
-                Cell { ch: ' ', fg: self.fg, bg: self.bg, flags: self.flags | F_WIDE_TAIL };
-        }
-        self.x += w;
-        if self.x >= COLS {
-            self.x = 0;
-            self.line_feed();
-        }
-    }
-    pub fn line_feed(&mut self) {
-        if self.y == self.scroll_bot {
-            // At the foot of the scroll region the window shifts and the cursor
-            // stays put; elsewhere it just steps down within the screen.
-            self.scroll_region_up();
-        } else if self.y + 1 < VISIBLE_ROWS {
-            self.y += 1;
-        }
-    }
-    pub fn carriage_return(&mut self) {
-        self.x = 0;
-    }
-}
diff --git a/userland/capsule_terminal/src/term/grid/scroll.rs b/userland/capsule_terminal/src/term/grid/scroll.rs
deleted file mode 100644
index 06d97b4a6..000000000
--- a/userland/capsule_terminal/src/term/grid/scroll.rs
+++ /dev/null
@@ -1,39 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-use crate::term::dimensions::{COLS, SCROLLBACK_ROWS, VISIBLE_ROWS};
-use crate::term::grid::types::Grid;
-
-impl Grid {
-    pub fn scroll_up_one(&mut self) {
-        let slot = (self.hist_head + self.hist_count) % SCROLLBACK_ROWS;
-        let dst = slot * COLS;
-        for x in 0..COLS {
-            self.history[dst + x] = self.cells[Grid::idx(x, 0)];
-        }
-        if self.hist_count < SCROLLBACK_ROWS {
-            self.hist_count += 1;
-        } else {
-            self.hist_head = (self.hist_head + 1) % SCROLLBACK_ROWS;
-        }
-        self.total_scrolled += 1;
-        self.cells.copy_within(COLS..VISIBLE_ROWS * COLS, 0);
-        let blank = self.blank_cell();
-        for x in 0..COLS {
-            self.cells[Grid::idx(x, VISIBLE_ROWS - 1)] = blank;
-        }
-    }
-}
diff --git a/userland/capsule_terminal/src/term/grid/scroll_region.rs b/userland/capsule_terminal/src/term/grid/scroll_region.rs
deleted file mode 100644
index 8859af5b3..000000000
--- a/userland/capsule_terminal/src/term/grid/scroll_region.rs
+++ /dev/null
@@ -1,57 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-use crate::term::dimensions::{COLS, VISIBLE_ROWS};
-use crate::term::grid::types::Grid;
-
-impl Grid {
-    /// DECSTBM: set the vertical scrolling region to the inclusive 0-based rows
-    /// `[top, bot]`. An inverted or out-of-range window resets to the full
-    /// screen, matching xterm. Per the spec the cursor homes to the top-left of
-    /// the new region afterwards.
-    pub fn set_scroll_region(&mut self, top: usize, bot: usize) {
-        if top < bot && bot < VISIBLE_ROWS {
-            self.scroll_top = top;
-            self.scroll_bot = bot;
-        } else {
-            self.scroll_top = 0;
-            self.scroll_bot = VISIBLE_ROWS - 1;
-        }
-        self.x = 0;
-        self.y = self.scroll_top;
-    }
-
-    /// Scroll the active region up by one line. A full-screen region preserves
-    /// its top line into scrollback (the normal terminal history path); a
-    /// partial region simply drops its top line, so a pinned status bar outside
-    /// the window is left untouched.
-    pub fn scroll_region_up(&mut self) {
-        if self.scroll_top == 0 && self.scroll_bot == VISIBLE_ROWS - 1 {
-            self.scroll_up_one();
-            return;
-        }
-        let (top, bot) = (self.scroll_top, self.scroll_bot);
-        for y in top..bot {
-            let dst = y * COLS;
-            let src = (y + 1) * COLS;
-            self.cells.copy_within(src..src + COLS, dst);
-        }
-        let blank = self.blank_cell();
-        for x in 0..COLS {
-            self.cells[Grid::idx(x, bot)] = blank;
-        }
-    }
-}
diff --git a/userland/capsule_terminal/src/term/grid/types.rs b/userland/capsule_terminal/src/term/grid/types.rs
deleted file mode 100644
index a535c2571..000000000
--- a/userland/capsule_terminal/src/term/grid/types.rs
+++ /dev/null
@@ -1,54 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-use alloc::vec::Vec;
-
-use crate::term::dimensions::COLS;
-use crate::term::grid::cell::Cell;
-use crate::term::vt::parser::Parser;
-use crate::term::vt::utf8::Utf8;
-
-pub struct Grid {
-    pub cells: Vec<Cell>,
-    pub alt: Vec<Cell>,
-    pub history: Vec<Cell>,
-    pub hist_head: usize,
-    pub hist_count: usize,
-    pub view_offset: usize,
-    pub alternate: bool,
-    pub cursor_visible: bool,
-    pub x: usize,
-    pub y: usize,
-    pub fg: u32,
-    pub bg: u32,
-    pub flags: u8,
-    pub parser: Parser,
-    /// Rebuilds characters from the bytes they arrive in. It belongs to the
-    /// grid because a character can be split across two feeds.
-    pub utf8: Utf8,
-    pub total_scrolled: u64,
-    // DECSTBM vertical scroll region, inclusive 0-based rows. Defaults to the
-    // whole screen; full-screen TUIs set a smaller window so a status line at
-    // the top or bottom stays put while the body scrolls.
-    pub scroll_top: usize,
-    pub scroll_bot: usize,
-}
-
-impl Grid {
-    pub fn idx(x: usize, y: usize) -> usize {
-        y * COLS + x
-    }
-}
diff --git a/userland/capsule_terminal/src/term/grid/view.rs b/userland/capsule_terminal/src/term/grid/view.rs
deleted file mode 100644
index cf37a8557..000000000
--- a/userland/capsule_terminal/src/term/grid/view.rs
+++ /dev/null
@@ -1,32 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-use crate::term::dimensions::{COLS, SCROLLBACK_ROWS, VISIBLE_ROWS};
-use crate::term::grid::cell::Cell;
-use crate::term::grid::types::Grid;
-
-impl Grid {
-    pub fn visible_row(&self, i: usize) -> &[Cell] {
-        let ci = (self.hist_count + i).saturating_sub(self.view_offset);
-        if ci < self.hist_count {
-            let slot = (self.hist_head + ci) % SCROLLBACK_ROWS;
-            &self.history[slot * COLS..slot * COLS + COLS]
-        } else {
-            let live = (ci - self.hist_count).min(VISIBLE_ROWS - 1);
-            &self.cells[live * COLS..live * COLS + COLS]
-        }
-    }
-}
diff --git a/userland/capsule_terminal/src/term/grid/width.rs b/userland/capsule_terminal/src/term/grid/width.rs
deleted file mode 100644
index 369003239..000000000
--- a/userland/capsule_terminal/src/term/grid/width.rs
+++ /dev/null
@@ -1,67 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-//! How many columns a character takes.
-//!
-//! A grid assumes every character is one cell wide. That holds for Latin and
-//! stops holding the moment anything else arrives: a CJK ideograph or an
-//! emoji is drawn two columns wide, and treating it as one puts the next
-//! character on top of its right half. Every column after it on that line is
-//! then wrong, and so is anything that counts columns to place a cursor.
-
-/// Ranges drawn two columns wide.
-///
-/// Taken from the East Asian Wide and Fullwidth classes, which is where the
-/// double width ones live. Ranges rather than a table per codepoint: the
-/// blocks are contiguous and a table would be tens of kilobytes to say the
-/// same thing.
-const WIDE: &[(u32, u32)] = &[
-    (0x1100, 0x115F),   // Hangul Jamo initial consonants
-    (0x2E80, 0x303E),   // CJK radicals, Kangxi, CJK symbols
-    (0x3041, 0x33FF),   // Kana, Bopomofo, Hangul compatibility, enclosed
-    (0x3400, 0x4DBF),   // CJK unified ideographs extension A
-    (0x4E00, 0x9FFF),   // CJK unified ideographs
-    (0xA000, 0xA4CF),   // Yi syllables and radicals
-    (0xA960, 0xA97F),   // Hangul Jamo extended A
-    (0xAC00, 0xD7A3),   // Hangul syllables
-    (0xF900, 0xFAFF),   // CJK compatibility ideographs
-    (0xFE10, 0xFE19),   // Vertical forms
-    (0xFE30, 0xFE6F),   // CJK compatibility forms, small form variants
-    (0xFF00, 0xFF60),   // Fullwidth forms
-    (0xFFE0, 0xFFE6),   // Fullwidth signs
-    (0x1F300, 0x1F64F), // Symbols, pictographs, emoticons
-    (0x1F900, 0x1F9FF), // Supplemental symbols and pictographs
-    (0x20000, 0x3FFFD), // CJK unified ideographs, later extensions
-];
-
-/// Columns `ch` occupies.
-///
-/// Never zero. Combining marks are the case that would justify zero, and
-/// composing them onto the character before is work this grid does not do,
-/// so they are given their own cell instead: a decomposed accent shows as a
-/// separate mark rather than being silently dropped.
-pub fn char_width(ch: char) -> usize {
-    let cp = ch as u32;
-    for &(lo, hi) in WIDE {
-        if cp < lo {
-            break;
-        }
-        if cp <= hi {
-            return 2;
-        }
-    }
-    1
-}
diff --git a/userland/capsule_terminal/src/term/mod.rs b/userland/capsule_terminal/src/term/mod.rs
index 227020050..3fe2b1cf1 100644
--- a/userland/capsule_terminal/src/term/mod.rs
+++ b/userland/capsule_terminal/src/term/mod.rs
@@ -20,7 +20,6 @@ pub mod context;
 pub mod cwd;
 pub mod dimensions;
 pub mod dur;
-pub mod grid;
 pub mod history;
 pub mod identity;
 pub mod line;
@@ -30,10 +29,10 @@ pub mod prompt;
 pub mod rtc;
 pub mod scrollback;
 pub mod search;
+pub mod select;
 pub mod state;
 pub mod terminal;
 pub mod theme;
 pub mod util;
-pub mod vt;
 
 pub use terminal::Terminal;
diff --git a/userland/capsule_terminal/src/term/scrollback/clear.rs b/userland/capsule_terminal/src/term/scrollback/clear.rs
index c995a26bf..df8cadfe4 100644
--- a/userland/capsule_terminal/src/term/scrollback/clear.rs
+++ b/userland/capsule_terminal/src/term/scrollback/clear.rs
@@ -17,7 +17,8 @@
 use super::types::Scrollback;
 
 impl Scrollback {
+    /// Blank the screen and forget its history, cursor home.
     pub fn clear(&mut self) {
-        self.grid.clear();
+        self.vt.feed(b"\x1b[0m\x1b[H\x1b[2J\x1b[3J");
     }
 }
diff --git a/userland/capsule_terminal/src/term/scrollback/feed_raw.rs b/userland/capsule_terminal/src/term/scrollback/feed_raw.rs
index d5e5ec159..f930dfb06 100644
--- a/userland/capsule_terminal/src/term/scrollback/feed_raw.rs
+++ b/userland/capsule_terminal/src/term/scrollback/feed_raw.rs
@@ -17,7 +17,18 @@
 use super::types::Scrollback;
 
 impl Scrollback {
+    /// Bytes a program or the shell wrote, through output processing.
     pub fn feed_raw(&mut self, bytes: &[u8]) {
-        self.grid.feed(bytes);
+        if !self.onlcr {
+            self.vt.feed(bytes);
+            return;
+        }
+        let mut rest = bytes;
+        while let Some(i) = rest.iter().position(|&b| b == b'\n') {
+            self.vt.feed(&rest[..i]);
+            self.vt.feed(b"\r\n");
+            rest = &rest[i + 1..];
+        }
+        self.vt.feed(rest);
     }
 }
diff --git a/userland/capsule_terminal/src/term/scrollback/fit.rs b/userland/capsule_terminal/src/term/scrollback/fit.rs
new file mode 100644
index 000000000..06d934410
--- /dev/null
+++ b/userland/capsule_terminal/src/term/scrollback/fit.rs
@@ -0,0 +1,45 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+use nonos_vt::Palette;
+
+use super::types::Scrollback;
+use crate::term::theme::types::Theme;
+
+impl Scrollback {
+    /// Match the screen to the window. A resize re-wraps what is there.
+    pub fn fit(&mut self, cols: usize, rows: usize, cell_w: u32, cell_h: u32) {
+        self.vt.resize(cols, rows);
+        self.vt.set_cell_pixels(
+            cell_w.min(u16::MAX as u32) as u16,
+            cell_h.min(u16::MAX as u32) as u16,
+        );
+    }
+
+    /// Program colours start from the window's theme. Only a change of
+    /// theme resets them, so a colour a program set survives a repaint.
+    pub fn follow_theme(&mut self, index: u16, t: &Theme) {
+        if self.theme_of == Some(index) {
+            return;
+        }
+        let mut p = Palette::xterm();
+        p.fg = t.fg & 0x00FF_FFFF;
+        p.bg = t.bg & 0x00FF_FFFF;
+        p.cursor = t.accent & 0x00FF_FFFF;
+        self.vt.set_theme(p);
+        self.theme_of = Some(index);
+    }
+}
diff --git a/userland/capsule_terminal/src/term/scrollback/jump_bottom.rs b/userland/capsule_terminal/src/term/scrollback/jump_bottom.rs
index caad121f5..3cab442b9 100644
--- a/userland/capsule_terminal/src/term/scrollback/jump_bottom.rs
+++ b/userland/capsule_terminal/src/term/scrollback/jump_bottom.rs
@@ -18,6 +18,6 @@ use super::types::Scrollback;
 
 impl Scrollback {
     pub fn jump_bottom(&mut self) {
-        self.grid.jump_view_bottom();
+        self.vt.scroll_to_bottom();
     }
 }
diff --git a/userland/capsule_terminal/src/term/scrollback/mod.rs b/userland/capsule_terminal/src/term/scrollback/mod.rs
index 0b5462932..253a804c0 100644
--- a/userland/capsule_terminal/src/term/scrollback/mod.rs
+++ b/userland/capsule_terminal/src/term/scrollback/mod.rs
@@ -17,8 +17,10 @@
 mod capture;
 mod clear;
 mod feed_raw;
+mod fit;
 mod jump_bottom;
 mod new;
+mod program_ended;
 mod push_dir_row;
 mod push_error;
 mod push_line;
diff --git a/userland/capsule_terminal/src/term/scrollback/new.rs b/userland/capsule_terminal/src/term/scrollback/new.rs
index 06252a3c9..a8407102f 100644
--- a/userland/capsule_terminal/src/term/scrollback/new.rs
+++ b/userland/capsule_terminal/src/term/scrollback/new.rs
@@ -14,11 +14,20 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+use nonos_vt::Term;
+
 use super::types::Scrollback;
-use crate::term::grid::types::Grid;
+use crate::term::dimensions::{COLS, SCROLLBACK_ROWS, VISIBLE_ROWS};
 
 impl Scrollback {
+    /// The size here is only where it starts: the paint resizes it to the
+    /// window before anything is drawn.
     pub fn new() -> Self {
-        Self { capture: None, grid: Grid::new() }
+        Self {
+            capture: None,
+            vt: Term::new(COLS, VISIBLE_ROWS, SCROLLBACK_ROWS),
+            onlcr: true,
+            theme_of: None,
+        }
     }
 }
diff --git a/userland/capsule_terminal/src/term/grid/feed.rs b/userland/capsule_terminal/src/term/scrollback/program_ended.rs
similarity index 51%
rename from userland/capsule_terminal/src/term/grid/feed.rs
rename to userland/capsule_terminal/src/term/scrollback/program_ended.rs
index 5f3d85705..813b13b7d 100644
--- a/userland/capsule_terminal/src/term/grid/feed.rs
+++ b/userland/capsule_terminal/src/term/scrollback/program_ended.rs
@@ -14,23 +14,22 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-use crate::term::grid::types::Grid;
-use crate::term::vt::parser::Parser;
-use crate::term::vt::state::VtState;
+use super::types::Scrollback;
 
-impl Grid {
-    pub fn feed(&mut self, bytes: &[u8]) {
-        let mut parser = core::mem::replace(&mut self.parser, Parser::new());
-        // Both are taken out for the borrow and put back after. A character
-        // can be split across two feeds, so the decoder has to survive one.
-        let mut utf8 = core::mem::take(&mut self.utf8);
-        {
-            let mut vt = VtState { g: self, utf8: &mut utf8 };
-            for &b in bytes {
-                parser.advance(&mut vt, b);
-            }
+impl Scrollback {
+    /// A program ended. Whatever modes it left on are turned off, as `reset`
+    /// would: a full-screen program that crashed must not leave the shell on
+    /// its alternate screen, hide the cursor, or keep sending mouse reports
+    /// into the prompt. Output that stopped mid-line gets its line ended, so
+    /// the next command's output starts at the left.
+    pub fn program_ended(&mut self) {
+        self.vt.feed(
+            b"\x1b[?1049l\x1b[?1l\x1b[?2004l\x1b[?1000l\x1b[?1002l\x1b[?1003l\x1b[?1006l\
+              \x1b[?1004l\x1b[?25h\x1b[0m\x1b(B",
+        );
+        if self.vt.cursor().x > 0 {
+            self.vt.feed(b"\r\n");
         }
-        self.parser = parser;
-        self.utf8 = utf8;
+        self.onlcr = true;
     }
 }
diff --git a/userland/capsule_terminal/src/term/scrollback/push_dir_row.rs b/userland/capsule_terminal/src/term/scrollback/push_dir_row.rs
index fc1ffced4..212f2e53f 100644
--- a/userland/capsule_terminal/src/term/scrollback/push_dir_row.rs
+++ b/userland/capsule_terminal/src/term/scrollback/push_dir_row.rs
@@ -30,9 +30,9 @@ impl Scrollback {
             self.push_line(&joined);
             return;
         }
-        self.grid.feed(plain);
-        self.grid.feed(b"\x1b[94m");
-        self.grid.feed(name);
-        self.grid.feed(b"\x1b[0m\n");
+        self.feed_raw(plain);
+        self.feed_raw(b"\x1b[94m");
+        self.feed_raw(name);
+        self.feed_raw(b"\x1b[0m\n");
     }
 }
diff --git a/userland/capsule_terminal/src/term/scrollback/push_raw.rs b/userland/capsule_terminal/src/term/scrollback/push_raw.rs
index ca071c378..cb364edaa 100644
--- a/userland/capsule_terminal/src/term/scrollback/push_raw.rs
+++ b/userland/capsule_terminal/src/term/scrollback/push_raw.rs
@@ -21,13 +21,13 @@ impl Scrollback {
     pub(super) fn push_raw(&mut self, line: &[u8], role: Role) {
         match role {
             Role::Error => {
-                self.grid.feed(b"\x1b[31m");
-                self.grid.feed(line);
-                self.grid.feed(b"\x1b[0m\n");
+                self.feed_raw(b"\x1b[31m");
+                self.feed_raw(line);
+                self.feed_raw(b"\x1b[0m\n");
             }
             Role::Normal => {
-                self.grid.feed(line);
-                self.grid.feed(b"\n");
+                self.feed_raw(line);
+                self.feed_raw(b"\n");
             }
         }
     }
diff --git a/userland/capsule_terminal/src/term/scrollback/push_styled.rs b/userland/capsule_terminal/src/term/scrollback/push_styled.rs
index be559d0f1..ab9a17cc1 100644
--- a/userland/capsule_terminal/src/term/scrollback/push_styled.rs
+++ b/userland/capsule_terminal/src/term/scrollback/push_styled.rs
@@ -29,7 +29,7 @@ impl Scrollback {
             self.push_line(plain);
             return;
         }
-        self.grid.feed(styled);
-        self.grid.feed(b"\x1b[0m\n");
+        self.feed_raw(styled);
+        self.feed_raw(b"\x1b[0m\n");
     }
 }
diff --git a/userland/capsule_terminal/src/term/scrollback/scroll_down.rs b/userland/capsule_terminal/src/term/scrollback/scroll_down.rs
index 116ed6444..45d52fc17 100644
--- a/userland/capsule_terminal/src/term/scrollback/scroll_down.rs
+++ b/userland/capsule_terminal/src/term/scrollback/scroll_down.rs
@@ -17,7 +17,8 @@
 use super::types::Scrollback;
 
 impl Scrollback {
+    /// Forward toward the live screen by `lines`.
     pub fn scroll_down(&mut self, lines: usize) {
-        self.grid.scroll_view_down(lines);
+        self.vt.scroll_view(-(lines.min(isize::MAX as usize) as isize));
     }
 }
diff --git a/userland/capsule_terminal/src/term/scrollback/scroll_up.rs b/userland/capsule_terminal/src/term/scrollback/scroll_up.rs
index b7e093d46..9a7d28a3b 100644
--- a/userland/capsule_terminal/src/term/scrollback/scroll_up.rs
+++ b/userland/capsule_terminal/src/term/scrollback/scroll_up.rs
@@ -17,7 +17,8 @@
 use super::types::Scrollback;
 
 impl Scrollback {
+    /// Back into history by `lines`.
     pub fn scroll_up(&mut self, lines: usize) {
-        self.grid.scroll_view_up(lines);
+        self.vt.scroll_view(lines.min(isize::MAX as usize) as isize);
     }
 }
diff --git a/userland/capsule_terminal/src/term/scrollback/types.rs b/userland/capsule_terminal/src/term/scrollback/types.rs
index eff6bd4a6..1c157353d 100644
--- a/userland/capsule_terminal/src/term/scrollback/types.rs
+++ b/userland/capsule_terminal/src/term/scrollback/types.rs
@@ -16,9 +16,16 @@
 
 use alloc::vec::Vec;
 
-use crate::term::grid::types::Grid;
+use nonos_vt::Term;
 
 pub struct Scrollback {
     pub(super) capture: Option<Vec<Vec<u8>>>,
-    pub grid: Grid,
+    /// The screen and its history.
+    pub vt: Term,
+    /// Output processing a tty does by default: a line feed also returns
+    /// the carriage, since the shell and most programs end lines with `\n`
+    /// alone. A program that turns output processing off gets bare feeds.
+    pub onlcr: bool,
+    /// The theme the palette was last taken from.
+    pub(super) theme_of: Option<u16>,
 }
diff --git a/userland/capsule_terminal/src/term/select.rs b/userland/capsule_terminal/src/term/select.rs
new file mode 100644
index 000000000..e0b362f6d
--- /dev/null
+++ b/userland/capsule_terminal/src/term/select.rs
@@ -0,0 +1,74 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! A span of the screen and its history picked with the pointer, and the
+//! match a scrollback search is on.
+
+use nonos_vt::Pos;
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub struct Selection {
+    /// Where the press landed, and where the pointer is now.
+    pub anchor: Pos,
+    pub head: Pos,
+    /// Alt held: a rectangle of columns rather than a run of text.
+    pub block: bool,
+}
+
+impl Selection {
+    pub fn ordered(&self) -> (Pos, Pos) {
+        if self.anchor <= self.head {
+            (self.anchor, self.head)
+        } else {
+            (self.head, self.anchor)
+        }
+    }
+
+    pub fn contains(&self, line: u64, col: usize) -> bool {
+        let (a, b) = self.ordered();
+        if line < a.line || line > b.line {
+            return false;
+        }
+        if self.block {
+            let (l, r) = (a.col.min(b.col), a.col.max(b.col));
+            return col >= l && col <= r;
+        }
+        let from = if line == a.line { a.col } else { 0 };
+        let to = if line == b.line { b.col } else { usize::MAX };
+        col >= from && col <= to
+    }
+}
+
+/// A search through the screen and its history.
+#[derive(Clone, Default, Debug)]
+pub struct Find {
+    pub query: alloc::string::String,
+    /// The match on view, first and last cells.
+    pub hit: Option<(Pos, Pos)>,
+    /// Upper and lower case count as different.
+    pub case: bool,
+}
+
+/// A span to shade: a search match.
+pub fn in_span(span: Option<(Pos, Pos)>, line: u64, col: usize) -> bool {
+    match span {
+        Some((a, b)) => {
+            let p = Pos { line, col };
+            p >= a && p <= b
+        }
+        None => false,
+    }
+}
diff --git a/userland/capsule_terminal/src/term/state/mod.rs b/userland/capsule_terminal/src/term/state/mod.rs
index 9c23ee850..f457515c4 100644
--- a/userland/capsule_terminal/src/term/state/mod.rs
+++ b/userland/capsule_terminal/src/term/state/mod.rs
@@ -15,6 +15,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 mod new;
+mod shade;
 mod types;
 
 pub use types::State;
diff --git a/userland/capsule_terminal/src/term/state/new.rs b/userland/capsule_terminal/src/term/state/new.rs
index 110db7207..9dfadad74 100644
--- a/userland/capsule_terminal/src/term/state/new.rs
+++ b/userland/capsule_terminal/src/term/state/new.rs
@@ -44,6 +44,9 @@ impl State {
             jobs: JobTable::new(),
             fg_running: false,
             fg_started_ms: 0,
+            sel: None,
+            find: None,
+            cooked: crate::event::cooked::Cooked::default(),
         }
     }
 }
diff --git a/userland/capsule_terminal/src/term/grid/absline.rs b/userland/capsule_terminal/src/term/state/shade.rs
similarity index 67%
rename from userland/capsule_terminal/src/term/grid/absline.rs
rename to userland/capsule_terminal/src/term/state/shade.rs
index c89adb1e8..a5f66c814 100644
--- a/userland/capsule_terminal/src/term/grid/absline.rs
+++ b/userland/capsule_terminal/src/term/state/shade.rs
@@ -14,18 +14,12 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-use crate::term::grid::types::Grid;
+use super::types::State;
+use crate::paint::Shade;
 
-impl Grid {
-    pub fn current_abs_line(&self) -> u64 {
-        self.total_scrolled + self.y as u64
-    }
-
-    pub fn abs_base(&self) -> u64 {
-        self.total_scrolled - self.hist_count as u64
-    }
-
-    pub fn abs_of_visible_row(&self, row: usize) -> u64 {
-        self.total_scrolled + row as u64 - self.view_offset as u64
+impl State {
+    /// What the body shades over its text: the selection and the search hit.
+    pub fn shade(&self) -> Shade {
+        Shade { selection: self.sel, found: self.find.as_ref().and_then(|f| f.hit) }
     }
 }
diff --git a/userland/capsule_terminal/src/term/state/types.rs b/userland/capsule_terminal/src/term/state/types.rs
index cad5fdd14..27557c831 100644
--- a/userland/capsule_terminal/src/term/state/types.rs
+++ b/userland/capsule_terminal/src/term/state/types.rs
@@ -59,4 +59,10 @@ pub struct State {
     // close_block and last_status to the job's reap in the on_tick pump.
     pub fg_running: bool,
     pub fg_started_ms: i64,
+    /// Text picked with the pointer, if any.
+    pub sel: Option<crate::term::select::Selection>,
+    /// The scrollback search: what is typed, and the match it is on.
+    pub find: Option<crate::term::select::Find>,
+    /// The line editing a foreground program gets while it reads lines.
+    pub cooked: crate::event::cooked::Cooked,
 }
diff --git a/userland/capsule_terminal/src/term/terminal/app_impl_on_event.rs b/userland/capsule_terminal/src/term/terminal/app_impl_on_event.rs
index 88bb96190..5b133987d 100644
--- a/userland/capsule_terminal/src/term/terminal/app_impl_on_event.rs
+++ b/userland/capsule_terminal/src/term/terminal/app_impl_on_event.rs
@@ -34,6 +34,9 @@ impl Terminal {
         if let Some(outcome) = self.rail_click(event) {
             return outcome;
         }
+        if let Some(outcome) = self.body_pointer(event) {
+            return outcome;
+        }
         let outcome = on_event(self.cur(), event);
         self.drain_chrome_req();
         outcome
diff --git a/userland/capsule_terminal/src/term/terminal/app_impl_paint.rs b/userland/capsule_terminal/src/term/terminal/app_impl_paint.rs
index d3eecfe18..7531269e6 100644
--- a/userland/capsule_terminal/src/term/terminal/app_impl_paint.rs
+++ b/userland/capsule_terminal/src/term/terminal/app_impl_paint.rs
@@ -29,6 +29,12 @@ impl Terminal {
         }
         self.width = fb.width;
         let theme = crate::term::theme::profiles::by_index(self.theme);
+        let rail_open = self.prefs.rails & RAIL_VISIBLE != 0;
+        let (cols, rows, m) = crate::paint::grid_size(fb, self.font_scale, rail_open);
+        let theme_ix = self.theme;
+        let sb = &mut self.cur().scrollback;
+        sb.fit(cols, rows, m.adv, m.lh);
+        sb.follow_theme(theme_ix, theme);
         let l = crate::paint::paint_tabs(
             &self.tabs,
             self.active,
@@ -42,6 +48,16 @@ impl Terminal {
             &self.palette,
             self.prefs.rails & RAIL_VISIBLE != 0,
         );
+        let s = self.cur_ref();
+        let owned = s.scrollback.vt.alt_active() || s.fg_running;
+        self.cells = Some(super::pointer::CellGeom {
+            x: l.body.x + crate::paint::TEXT_LEFT,
+            y: l.body.y,
+            adv: m.adv,
+            lh: m.lh,
+            shell_rows: (l.body.h / m.lh.max(1)) as usize,
+            owned,
+        });
         self.layout = Some(l);
     }
 }
diff --git a/userland/capsule_terminal/src/term/terminal/mod.rs b/userland/capsule_terminal/src/term/terminal/mod.rs
index 8769ffdb5..0473afdc7 100644
--- a/userland/capsule_terminal/src/term/terminal/mod.rs
+++ b/userland/capsule_terminal/src/term/terminal/mod.rs
@@ -25,6 +25,7 @@ mod new;
 mod palette_act;
 mod palette_key;
 mod palette_pick;
+mod pointer;
 mod rail_click;
 mod rail_wheel;
 #[cfg(feature = "nonos-autorun-selftest")]
diff --git a/userland/capsule_terminal/src/term/terminal/new.rs b/userland/capsule_terminal/src/term/terminal/new.rs
index ba19cde5e..4f1c1007c 100644
--- a/userland/capsule_terminal/src/term/terminal/new.rs
+++ b/userland/capsule_terminal/src/term/terminal/new.rs
@@ -41,6 +41,8 @@ impl Terminal {
             rail_scroll: 0,
             layout: None,
             palette: Palette::new(),
+            cells: None,
+            ptr: Default::default(),
         }
     }
 }
diff --git a/userland/capsule_terminal/src/term/terminal/pointer/cells.rs b/userland/capsule_terminal/src/term/terminal/pointer/cells.rs
new file mode 100644
index 000000000..73338a349
--- /dev/null
+++ b/userland/capsule_terminal/src/term/terminal/pointer/cells.rs
@@ -0,0 +1,71 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Where the body's cells were drawn in the last paint, so a pointer event
+//! can be read back as a cell and a line.
+
+use nonos_vt::{Pos, Term};
+
+use crate::paint::Rows;
+
+#[derive(Clone, Copy)]
+pub struct CellGeom {
+    pub x: u32,
+    pub y: u32,
+    pub adv: u32,
+    pub lh: u32,
+    /// Rows of the body a shell drawing uses; the screen owns all rows.
+    pub shell_rows: usize,
+    pub owned: bool,
+}
+
+impl CellGeom {
+    pub fn rows(&self, vt: &Term) -> Rows {
+        if self.owned {
+            Rows::Screen
+        } else {
+            Rows::Shell { rows: self.shell_rows, back: vt.view_offset() }
+        }
+    }
+
+    /// The cell under `(px, py)`, clamped to the screen, and the row it is.
+    pub fn cell_at(&self, vt: &Term, px: i32, py: i32) -> (usize, usize) {
+        let col = ((px - self.x as i32).max(0) as u32 / self.adv.max(1)) as usize;
+        let row = ((py - self.y as i32).max(0) as u32 / self.lh.max(1)) as usize;
+        let max_row = if self.owned { vt.rows() } else { self.shell_rows };
+        (col.min(vt.cols() - 1), row.min(max_row.saturating_sub(1)))
+    }
+
+    pub fn pos_at(&self, vt: &Term, px: i32, py: i32) -> Pos {
+        let (col, row) = self.cell_at(vt, px, py);
+        let rows = self.rows(vt);
+        let line = match rows {
+            Rows::Screen => vt.abs_of_row(row),
+            Rows::Shell { .. } => rows.first(vt) + row as u64,
+        };
+        Pos { line, col }
+    }
+
+    pub fn inside(&self, vt: &Term, px: i32, py: i32) -> bool {
+        let w = vt.cols() as u32 * self.adv;
+        let rows = if self.owned { vt.rows() } else { self.shell_rows };
+        let h = rows as u32 * self.lh;
+        px >= self.x as i32
+            && py >= self.y as i32
+            && px < (self.x + w) as i32
+            && py < (self.y + h) as i32
+    }
+}
diff --git a/userland/capsule_terminal/src/term/grid/mod.rs b/userland/capsule_terminal/src/term/terminal/pointer/mod.rs
similarity index 73%
rename from userland/capsule_terminal/src/term/grid/mod.rs
rename to userland/capsule_terminal/src/term/terminal/pointer/mod.rs
index fb9ef8f21..6cacbb244 100644
--- a/userland/capsule_terminal/src/term/grid/mod.rs
+++ b/userland/capsule_terminal/src/term/terminal/pointer/mod.rs
@@ -14,17 +14,15 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-pub mod absline;
-pub mod alt;
-pub mod cell;
-pub mod erase;
-pub mod feed;
-pub mod move_cells;
-pub mod new;
-pub mod put;
-pub mod scroll;
-pub mod scroll_region;
-pub mod scroll_view;
-pub mod types;
-pub mod view;
-pub mod width;
+//! The pointer over the body: selecting text, and for a program that asked
+//! for them, mouse reports. Shift held selects even then, as xterm does.
+
+mod cells;
+mod press;
+mod report;
+mod select;
+mod state;
+mod wheel;
+
+pub use cells::CellGeom;
+pub use state::Pointer;
diff --git a/userland/capsule_terminal/src/term/terminal/pointer/press.rs b/userland/capsule_terminal/src/term/terminal/pointer/press.rs
new file mode 100644
index 000000000..82dd34123
--- /dev/null
+++ b/userland/capsule_terminal/src/term/terminal/pointer/press.rs
@@ -0,0 +1,57 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Choosing text: a press starts, a drag extends, a double click takes a
+//! word and a triple click a line, and Alt makes it a block.
+
+use crate::term::select::Selection;
+use crate::term::terminal::Terminal;
+use nonos_app_skeleton::{InputEvent, MOD_ALT};
+use nonos_vt::Pos;
+
+/// Presses closer together than this count as a double or triple click.
+const MULTI_CLICK_NS: u64 = 400_000_000;
+
+impl Terminal {
+    pub(super) fn press(&mut self, event: &InputEvent, pos: Pos) {
+        let p = &mut self.ptr;
+        let again =
+            event.timestamp_ns.saturating_sub(p.last_ns) < MULTI_CLICK_NS && p.last_pos == pos;
+        p.clicks = if again { p.clicks % 3 + 1 } else { 1 };
+        (p.last_ns, p.last_pos, p.start) = (event.timestamp_ns, pos, pos);
+        p.block = event.flags & MOD_ALT != 0;
+        p.selecting = true;
+        let clicks = p.clicks;
+        let state = self.cur();
+        let vt = &state.scrollback.vt;
+        let span = match clicks {
+            2 => Some(vt.word_at(pos)),
+            3 => Some(vt.line_bounds(pos)),
+            _ => None,
+        };
+        state.sel = span.map(|(a, b)| Selection { anchor: a, head: b, block: false });
+    }
+
+    pub(super) fn drag(&mut self, pos: Pos) {
+        let (start, block, clicks) = (self.ptr.start, self.ptr.block, self.ptr.clicks);
+        let state = self.cur();
+        if pos == start && state.sel.is_none() {
+            return;
+        }
+        let anchor = state.sel.map(|x| x.anchor).filter(|_| clicks > 1).unwrap_or(start);
+        state.sel = Some(Selection { anchor, head: pos, block });
+    }
+}
diff --git a/userland/capsule_terminal/src/term/terminal/pointer/report.rs b/userland/capsule_terminal/src/term/terminal/pointer/report.rs
new file mode 100644
index 000000000..7fff56af4
--- /dev/null
+++ b/userland/capsule_terminal/src/term/terminal/pointer/report.rs
@@ -0,0 +1,63 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Pointer events for a foreground program that asked for mouse reports.
+
+use nonos_app_skeleton::{InputEvent, InputKind, MOD_SHIFT};
+use nonos_vt::input::{encode_mouse, Button, MouseEvent, MouseKind};
+use nonos_vt::MouseMode;
+
+use super::select::{BTN_LEFT, BTN_RIGHT};
+use crate::event::keymap::mods;
+use crate::event::send_to_program;
+use crate::term::terminal::Terminal;
+
+impl Terminal {
+    /// Hand the event to the program when it asked for mouse reports and
+    /// Shift is not held. True when the program took it.
+    pub(super) fn program_mouse(&mut self, event: &InputEvent) -> bool {
+        let Some(g) = self.cells else { return false };
+        let state = self.cur_ref();
+        let vt = &state.scrollback.vt;
+        if !state.fg_running || vt.modes.mouse == MouseMode::Off || event.flags & MOD_SHIFT != 0 {
+            return false;
+        }
+        let (col, row) = g.cell_at(vt, event.x, event.y);
+        let (kind, button) = match event.kind {
+            InputKind::ButtonDown | InputKind::ButtonUp => {
+                let b = match event.code {
+                    BTN_LEFT => Button::Left,
+                    BTN_RIGHT => Button::Right,
+                    _ => Button::Middle,
+                };
+                let down = event.kind == InputKind::ButtonDown;
+                self.ptr.held = down.then_some(b);
+                (if down { MouseKind::Press } else { MouseKind::Release }, b)
+            }
+            InputKind::PointerAbs => (MouseKind::Motion, self.ptr.held.unwrap_or(Button::None)),
+            InputKind::Wheel if event.delta_y > 0 => (MouseKind::Press, Button::WheelUp),
+            InputKind::Wheel => (MouseKind::Press, Button::WheelDown),
+            _ => return false,
+        };
+        let ev = MouseEvent { kind, button, col, row, mods: mods(event.flags) };
+        let mut bytes = alloc::vec::Vec::new();
+        let state = self.cur();
+        if encode_mouse(&ev, &state.scrollback.vt.modes, &mut bytes) {
+            send_to_program(state, &bytes);
+        }
+        true
+    }
+}
diff --git a/userland/capsule_terminal/src/term/terminal/pointer/select.rs b/userland/capsule_terminal/src/term/terminal/pointer/select.rs
new file mode 100644
index 000000000..838e12db5
--- /dev/null
+++ b/userland/capsule_terminal/src/term/terminal/pointer/select.rs
@@ -0,0 +1,52 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Routing pointer events over the body: to the program, the wheel, or
+//! choosing text.
+
+use nonos_app_skeleton::{EventOutcome, InputEvent, InputKind};
+
+use crate::term::terminal::Terminal;
+
+pub(super) const BTN_LEFT: u32 = 1;
+pub(super) const BTN_RIGHT: u32 = 2;
+
+impl Terminal {
+    pub(crate) fn body_pointer(&mut self, event: InputEvent) -> Option<EventOutcome> {
+        let g = self.cells?;
+        let kinds =
+            [InputKind::ButtonDown, InputKind::ButtonUp, InputKind::PointerAbs, InputKind::Wheel];
+        if !kinds.contains(&event.kind) {
+            return None;
+        }
+        let inside = g.inside(&self.cur_ref().scrollback.vt, event.x, event.y);
+        if !inside && !self.ptr.selecting {
+            return None;
+        }
+        if self.program_mouse(&event) {
+            return Some(EventOutcome::Idle);
+        }
+        let pos = g.pos_at(&self.cur_ref().scrollback.vt, event.x, event.y);
+        match event.kind {
+            InputKind::Wheel => return Some(self.wheel(event)),
+            InputKind::ButtonDown if event.code == BTN_LEFT => self.press(&event, pos),
+            InputKind::PointerAbs if self.ptr.selecting => self.drag(pos),
+            InputKind::ButtonUp if event.code == BTN_LEFT => self.ptr.selecting = false,
+            _ => return Some(EventOutcome::Idle),
+        }
+        Some(EventOutcome::Repaint)
+    }
+}
diff --git a/userland/capsule_terminal/src/term/grid/scroll_view.rs b/userland/capsule_terminal/src/term/terminal/pointer/state.rs
similarity index 60%
rename from userland/capsule_terminal/src/term/grid/scroll_view.rs
rename to userland/capsule_terminal/src/term/terminal/pointer/state.rs
index 1657a8d9c..95f8dd226 100644
--- a/userland/capsule_terminal/src/term/grid/scroll_view.rs
+++ b/userland/capsule_terminal/src/term/terminal/pointer/state.rs
@@ -14,16 +14,21 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-use crate::term::grid::types::Grid;
+//! What the pointer is in the middle of.
 
-impl Grid {
-    pub fn scroll_view_up(&mut self, lines: usize) {
-        self.view_offset = (self.view_offset + lines).min(self.hist_count);
-    }
-    pub fn scroll_view_down(&mut self, lines: usize) {
-        self.view_offset = self.view_offset.saturating_sub(lines);
-    }
-    pub fn jump_view_bottom(&mut self) {
-        self.view_offset = 0;
-    }
+use nonos_vt::input::Button;
+use nonos_vt::Pos;
+
+#[derive(Default)]
+pub struct Pointer {
+    /// A left-button drag is choosing text: from where, and as a block.
+    pub selecting: bool,
+    pub start: Pos,
+    pub block: bool,
+    /// Counting presses in one place for double and triple clicks.
+    pub clicks: u8,
+    pub last_ns: u64,
+    pub last_pos: Pos,
+    /// The button held, for motion reports to a program.
+    pub held: Option<Button>,
 }
diff --git a/userland/capsule_terminal/src/term/terminal/pointer/wheel.rs b/userland/capsule_terminal/src/term/terminal/pointer/wheel.rs
new file mode 100644
index 000000000..204c7c04b
--- /dev/null
+++ b/userland/capsule_terminal/src/term/terminal/pointer/wheel.rs
@@ -0,0 +1,52 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The wheel reads history, or on the alternate screen, where there is
+//! none, sends the cursor keys a pager scrolls by.
+
+use nonos_app_skeleton::{EventOutcome, InputEvent};
+use nonos_vt::input::{encode_key, Key, Mods};
+
+use crate::event::send_to_program;
+use crate::term::terminal::Terminal;
+
+const WHEEL_LINES: usize = 3;
+
+impl Terminal {
+    pub(super) fn wheel(&mut self, event: InputEvent) -> EventOutcome {
+        let state = self.cur();
+        let vt = &state.scrollback.vt;
+        let up = event.delta_y > 0;
+        let lines = (event.delta_y.unsigned_abs() as usize).clamp(1, 10) * WHEEL_LINES;
+        if vt.alt_active() {
+            if state.fg_running && vt.modes.alt_scroll {
+                let key = if up { Key::Up } else { Key::Down };
+                let mut bytes = alloc::vec::Vec::new();
+                for _ in 0..lines {
+                    encode_key(key, Mods::default(), &vt.modes, &mut bytes);
+                }
+                send_to_program(state, &bytes);
+            }
+            return EventOutcome::Idle;
+        }
+        if up {
+            state.scrollback.scroll_up(lines);
+        } else {
+            state.scrollback.scroll_down(lines);
+        }
+        EventOutcome::Repaint
+    }
+}
diff --git a/userland/capsule_terminal/src/term/terminal/selftest.rs b/userland/capsule_terminal/src/term/terminal/selftest.rs
index 8875e1436..bc0880139 100644
--- a/userland/capsule_terminal/src/term/terminal/selftest.rs
+++ b/userland/capsule_terminal/src/term/terminal/selftest.rs
@@ -17,9 +17,9 @@
 use nonos_libc::{heap_init, mk_debug, mk_exit, mk_yield, HeapError};
 
 use crate::term::dimensions::{COLS, VISIBLE_ROWS};
-use crate::term::grid::types::Grid;
 use crate::term::state::State;
 use crate::term::util::copy_into;
+use nonos_vt::Term;
 
 mod git_test;
 mod jobs_test;
@@ -68,157 +68,91 @@ fn ready(state: &mut State) -> bool {
 pub fn vt_selftest() {
     mark(b"vt-skeleton", true);
     {
-        let ok = crate::term::vt::color::ansi_to_argb(1) == 0xFF80_0000
-            && crate::term::vt::color::ansi_to_argb(15) == 0xFFFF_FFFF;
-        mark(b"vt-color", ok);
+        let p = nonos_vt::Palette::xterm();
+        mark(b"vt-color", p.colors[1] == 0xCD_0000 && p.colors[15] == 0xFF_FFFF);
     }
     {
-        let g = crate::term::grid::types::Grid::new();
-        let ok = g.cells.len()
-            == crate::term::dimensions::COLS * crate::term::dimensions::VISIBLE_ROWS
-            && g.cells[0].ch == ' '
-            && g.x == 0
-            && g.y == 0;
-        mark(b"vt-grid", ok);
+        let t = Term::new(COLS, VISIBLE_ROWS, 10);
+        let ok =
+            t.cols() == COLS && t.rows() == VISIBLE_ROWS && t.visible_line(0).cell(0).ch == ' ';
+        mark(b"vt-grid", ok && t.cursor().x == 0 && t.cursor().y == 0);
     }
     {
-        let mut g = crate::term::grid::types::Grid::new();
-        for ch in "AB".chars() {
-            g.put_char(ch);
-        }
-        g.carriage_return();
-        g.put_char('C');
-        let row0_ok = g.cells[crate::term::grid::types::Grid::idx(0, 0)].ch == 'C'
-            && g.cells[crate::term::grid::types::Grid::idx(1, 0)].ch == 'B';
-        for _ in 0..crate::term::dimensions::VISIBLE_ROWS {
-            g.line_feed();
+        let mut t = Term::new(COLS, VISIBLE_ROWS, 10);
+        t.feed(b"AB\rC");
+        let row0_ok = row_text(&t, 0) == "CB";
+        for _ in 0..VISIBLE_ROWS {
+            t.feed(b"\n");
         }
-        let scrolled_ok = g.hist_count >= 1;
-        g.put_char('Z');
-        g.erase_display(2);
-        let cleared_ok = g.cells[0].ch == ' ' && g.x == 0 && g.y == 0;
-        mark(b"vt-grid-ops", row0_ok && scrolled_ok && cleared_ok);
+        let scrolled_ok = t.history_len() >= 1;
+        t.feed(b"Z\x1b[2J");
+        mark(b"vt-grid-ops", row0_ok && scrolled_ok && row_text(&t, 0).is_empty());
     }
     {
-        struct Rec {
-            prints: alloc::vec::Vec<u8>,
-            execs: alloc::vec::Vec<u8>,
-            csis: alloc::vec::Vec<(u8, i64)>,
-        }
-        impl crate::term::vt::parser::Perform for Rec {
-            fn print(&mut self, c: u8) {
-                self.prints.push(c);
+        // The parser on its own: prints, controls and CSI finals in order.
+        struct Rec(alloc::vec::Vec<u8>);
+        impl nonos_vt::parser::Handler for Rec {
+            fn print(&mut self, c: char) {
+                self.0.push(c as u8);
             }
             fn execute(&mut self, b: u8) {
-                self.execs.push(b);
+                self.0.push(b);
             }
-            fn csi(&mut self, c: u8, params: &[i64], _inter: &[u8]) {
-                self.csis.push((c, params.first().copied().unwrap_or(-1)));
+            fn csi(&mut self, s: &nonos_vt::parser::Seq) {
+                self.0.push(s.final_byte);
             }
-            fn esc(&mut self, _c: u8, _inter: &[u8]) {}
-            fn osc(&mut self, _data: &[u8]) {}
+            fn esc(&mut self, _s: &nonos_vt::parser::Seq) {}
+            fn osc(&mut self, _d: &[u8]) {}
+            fn dcs(&mut self, _s: &nonos_vt::parser::Seq, _d: &[u8]) {}
         }
-        let mut rec = Rec {
-            prints: alloc::vec::Vec::new(),
-            execs: alloc::vec::Vec::new(),
-            csis: alloc::vec::Vec::new(),
-        };
-        let mut parser = crate::term::vt::parser::Parser::new();
-        for &b in b"A\x1b[31mB\x1b[0m\n\x1b[2J" {
-            parser.advance(&mut rec, b);
-        }
-        let ok = rec.prints == b"AB"
-            && rec.execs == [0x0Au8]
-            && rec.csis == [(b'm', 31), (b'm', 0), (b'J', 2)];
-        mark(b"vt-parser", ok);
+        let mut rec = Rec(alloc::vec::Vec::new());
+        nonos_vt::parser::Parser::new().feed(&mut rec, b"A\x1b[31mB\x1b[0m\n\x1b[2J");
+        mark(b"vt-parser", rec.0 == b"AmBm\nJ");
     }
     {
-        let mut g2 = crate::term::grid::types::Grid::new();
-        let mut parser2 = crate::term::vt::parser::Parser::new();
-        {
-            let mut u = crate::term::vt::utf8::Utf8::default();
-            let mut vt = crate::term::vt::state::VtState { g: &mut g2, utf8: &mut u };
-            for &b in b"\x1b[5;3HX" {
-                parser2.advance(&mut vt, b);
-            }
-        }
-        let csi_pos_ok = g2.cells[crate::term::grid::types::Grid::idx(2, 4)].ch == 'X';
-        {
-            let mut u = crate::term::vt::utf8::Utf8::default();
-            let mut vt = crate::term::vt::state::VtState { g: &mut g2, utf8: &mut u };
-            for &b in b"\x1b[2J" {
-                parser2.advance(&mut vt, b);
-            }
-        }
-        let csi_clr_ok = g2.cells[0].ch == ' ' && g2.x == 0 && g2.y == 0;
-        mark(b"vt-csi", csi_pos_ok && csi_clr_ok);
+        let mut t = Term::new(COLS, VISIBLE_ROWS, 10);
+        t.feed(b"\x1b[5;3HX");
+        let pos_ok = t.visible_line(4).cell(2).ch == 'X';
+        t.feed(b"\x1b[2J");
+        mark(b"vt-csi", pos_ok && row_text(&t, 4).is_empty());
     }
     {
-        let mut g4 = crate::term::grid::types::Grid::new();
-        let mut p4 = crate::term::vt::parser::Parser::new();
-        {
-            let mut u = crate::term::vt::utf8::Utf8::default();
-            let mut vt = crate::term::vt::state::VtState { g: &mut g4, utf8: &mut u };
-            for &b in b"\x1b[1;31mZ" {
-                p4.advance(&mut vt, b);
-            }
-        }
-        let z = g4.cells[crate::term::grid::types::Grid::idx(0, 0)];
-        let sgr_set_ok =
-            (z.flags & crate::term::grid::cell::F_BOLD) != 0 && z.fg == 1 && z.ch == 'Z';
-        {
-            let mut u = crate::term::vt::utf8::Utf8::default();
-            let mut vt = crate::term::vt::state::VtState { g: &mut g4, utf8: &mut u };
-            for &b in b"\x1b[0mY" {
-                p4.advance(&mut vt, b);
-            }
-        }
-        let y = g4.cells[crate::term::grid::types::Grid::idx(1, 0)];
-        let sgr_reset_ok =
-            y.flags == 0 && y.fg == crate::term::vt::color::DEFAULT_FG && y.ch == 'Y';
-        mark(b"vt-sgr", sgr_set_ok && sgr_reset_ok);
+        let mut t = Term::new(COLS, VISIBLE_ROWS, 10);
+        t.feed(b"\x1b[1;31mZ\x1b[0mY");
+        let z = t.visible_line(0).cell(0);
+        let y = t.visible_line(0).cell(1);
+        let set = z.attr & nonos_vt::cell::attr::BOLD != 0 && z.fg == nonos_vt::Color::Indexed(1);
+        mark(b"vt-sgr", set && y.attr == 0 && y.fg == nonos_vt::Color::Default);
     }
     {
-        let mut g5 = crate::term::grid::types::Grid::new();
-        g5.feed(b"hi\x1b[32m!\n");
-        let feed_ok = g5.cells[crate::term::grid::types::Grid::idx(0, 0)].ch == 'h'
-            && g5.cells[crate::term::grid::types::Grid::idx(1, 0)].ch == 'i'
-            && g5.cells[crate::term::grid::types::Grid::idx(2, 0)].ch == '!'
-            && g5.cells[crate::term::grid::types::Grid::idx(2, 0)].fg == 2
-            && g5.y == 1
-            && g5.x == 0;
-        mark(b"vt-feed", feed_ok);
+        let mut sb = crate::term::scrollback::Scrollback::new();
+        sb.feed_raw(b"hi\x1b[32m!\n");
+        let bang = sb.vt.visible_line(0).cell(2);
+        let ok = row_text(&sb.vt, 0) == "hi!" && bang.fg == nonos_vt::Color::Indexed(2);
+        mark(b"vt-feed", ok && sb.vt.cursor().x == 0 && sb.vt.cursor().y == 1);
     }
     {
         let mut sb = crate::term::scrollback::Scrollback::new();
         sb.push_line(b"MIR");
-        let mirror_ok = sb.grid.cells[crate::term::grid::types::Grid::idx(0, 0)].ch == 'M';
-        mark(b"vt-mirror", mirror_ok);
+        mark(b"vt-mirror", row_text(&sb.vt, 0) == "MIR");
     }
     {
-        let mut gh = crate::term::grid::types::Grid::new();
-        let mut i = 0u8;
-        while i < crate::term::dimensions::VISIBLE_ROWS as u8 + 5 {
-            gh.feed(&[b'A' + i % 26]);
-            gh.feed(b"\n");
-            i += 1;
+        let mut t = Term::new(COLS, VISIBLE_ROWS, 100);
+        for i in 0..VISIBLE_ROWS as u8 + 5 {
+            t.feed(&[b'A' + i % 26, b'\r', b'\n']);
         }
-        let has_hist = gh.hist_count >= 5;
-        gh.scroll_view_up(1);
-        let off1 = gh.view_offset == 1;
-        gh.jump_view_bottom();
-        let off0 = gh.view_offset == 0;
-        mark(b"vt-history", has_hist && off1 && off0);
+        let has_hist = t.history_len() >= 5;
+        t.scroll_view(1);
+        let off1 = t.view_offset() == 1;
+        t.scroll_to_bottom();
+        mark(b"vt-history", has_hist && off1 && t.view_offset() == 0);
     }
     {
-        let mut ga = crate::term::grid::types::Grid::new();
-        ga.feed(b"MAIN");
-        ga.feed(b"\x1b[?1049h");
-        let in_alt = ga.alternate && ga.cells[crate::term::grid::types::Grid::idx(0, 0)].ch == ' ';
-        ga.feed(b"ALT");
-        ga.feed(b"\x1b[?1049l");
-        let back = !ga.alternate && ga.cells[crate::term::grid::types::Grid::idx(0, 0)].ch == 'M';
-        mark(b"vt-altscreen", in_alt && back);
+        let mut t = Term::new(COLS, VISIBLE_ROWS, 10);
+        t.feed(b"MAIN\x1b[?1049h");
+        let in_alt = t.alt_active() && row_text(&t, 0).is_empty();
+        t.feed(b"ALT\x1b[?1049l");
+        mark(b"vt-altscreen", in_alt && !t.alt_active() && row_text(&t, 0) == "MAIN");
     }
     {
         let mut st = crate::term::state::State::new();
@@ -239,13 +173,13 @@ pub fn vt_selftest() {
         mark(b"block-dur", ok);
     }
     {
-        let mut gb = crate::term::grid::types::Grid::new();
-        let start = gb.current_abs_line();
-        for _ in 0..(crate::term::dimensions::VISIBLE_ROWS + 3) {
-            gb.feed(b"x\n");
+        let mut t = Term::new(COLS, VISIBLE_ROWS, 100);
+        let start = t.cursor_pos().line;
+        for _ in 0..(VISIBLE_ROWS + 3) {
+            t.feed(b"x\r\n");
         }
-        let scrolled = gb.total_scrolled == 4 && gb.abs_base() == 4 - gb.hist_count as u64;
-        let row_abs = gb.abs_of_visible_row(0) == gb.total_scrolled - gb.view_offset as u64;
+        let scrolled = t.first_line() + t.history_len() as u64 == 4;
+        let row_abs = t.abs_of_row(0) == 4 - t.view_offset() as u64;
         mark(b"block-absline", start == 0 && scrolled && row_abs);
     }
     {
@@ -347,28 +281,16 @@ fn ok_cmd(state: &mut State, cmd: &[u8]) -> bool {
 }
 
 fn visible_has(state: &State, needle: &[u8]) -> bool {
-    let g = &state.scrollback.grid;
-    let mut row = 0;
-    while row < VISIBLE_ROWS {
-        let mut end = COLS;
-        while end > 0 && g.cells[Grid::idx(end - 1, row)].ch == ' ' {
-            end -= 1;
-        }
-        let mut buf = [0u8; COLS];
-        let mut c = 0;
-        while c < end {
-            // The needle is ASCII, so anything wider cannot match it and is
-            // stood in for by a byte that never appears in one.
-            let ch = g.cells[Grid::idx(c, row)].ch;
-            buf[c] = if ch.is_ascii() { ch as u8 } else { 0xFF };
-            c += 1;
-        }
-        if &buf[..end] == needle {
-            return true;
-        }
-        row += 1;
-    }
-    false
+    let vt = &state.scrollback.vt;
+    (0..vt.rows()).any(|row| row_text(vt, row).as_bytes() == needle)
+}
+
+/// Visible row `row` without trailing blanks.
+fn row_text(vt: &Term, row: usize) -> alloc::string::String {
+    let line = vt.visible_line(row);
+    let s: alloc::string::String =
+        (0..vt.cols()).map(|x| line.cell(x)).filter(|c| !c.is_tail()).map(|c| c.ch).collect();
+    alloc::string::String::from(s.trim_end())
 }
 
 fn mark(step: &[u8], ok: bool) {
diff --git a/userland/capsule_terminal/src/term/terminal/types.rs b/userland/capsule_terminal/src/term/terminal/types.rs
index 35f091cfd..0ddc3110f 100644
--- a/userland/capsule_terminal/src/term/terminal/types.rs
+++ b/userland/capsule_terminal/src/term/terminal/types.rs
@@ -55,6 +55,9 @@ pub struct Terminal {
     // The command overlay. It gates the whole key path while open, so it is
     // read before the tab bindings rather than beside them.
     pub(crate) palette: Palette,
+    /// Where the body's cells were drawn, and what the pointer is doing.
+    pub(crate) cells: Option<super::pointer::CellGeom>,
+    pub(crate) ptr: super::pointer::Pointer,
 }
 
 impl Terminal {
diff --git a/userland/capsule_terminal/src/term/vt/color.rs b/userland/capsule_terminal/src/term/vt/color.rs
deleted file mode 100644
index 392a1b928..000000000
--- a/userland/capsule_terminal/src/term/vt/color.rs
+++ /dev/null
@@ -1,62 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-// Colours are stored per cell as full ARGB now, so the whole 24-bit space from
-// `38;2;r;g;b` survives instead of being rounded to sixteen. The default
-// background is fully transparent so an unstyled cell shows the terminal's own
-// backdrop rather than a solid black.
-pub const DEFAULT_FG: u32 = 0xFFC0_C0C0;
-pub const DEFAULT_BG: u32 = 0x0000_0000;
-
-// Pack a 24-bit colour into opaque ARGB.
-pub fn pack_rgb(r: u8, g: u8, b: u8) -> u32 {
-    0xFF00_0000 | ((r as u32) << 16) | ((g as u32) << 8) | (b as u32)
-}
-
-pub fn ansi_to_argb(index: u8) -> u32 {
-    let pack = |r: u8, g: u8, b: u8| -> u32 {
-        0xFF00_0000 | ((r as u32) << 16) | ((g as u32) << 8) | (b as u32)
-    };
-    match index {
-        0 => pack(0x00, 0x00, 0x00),
-        1 => pack(0x80, 0x00, 0x00),
-        2 => pack(0x00, 0x80, 0x00),
-        3 => pack(0x80, 0x80, 0x00),
-        4 => pack(0x00, 0x00, 0x80),
-        5 => pack(0x80, 0x00, 0x80),
-        6 => pack(0x00, 0x80, 0x80),
-        7 => pack(0xc0, 0xc0, 0xc0),
-        8 => pack(0x80, 0x80, 0x80),
-        9 => pack(0xff, 0x00, 0x00),
-        10 => pack(0x00, 0xff, 0x00),
-        11 => pack(0xff, 0xff, 0x00),
-        12 => pack(0x00, 0x00, 0xff),
-        13 => pack(0xff, 0x00, 0xff),
-        14 => pack(0x00, 0xff, 0xff),
-        15 => pack(0xff, 0xff, 0xff),
-        16..=231 => {
-            let convert = |v: u8| if v == 0 { 0u8 } else { v * 0x28 + 0x28 };
-            let r = convert((index - 16) / 36 % 6);
-            let g = convert((index - 16) / 6 % 6);
-            let b = convert((index - 16) % 6);
-            pack(r, g, b)
-        }
-        232..=255 => {
-            let gray = (index - 232) * 10 + 8;
-            pack(gray, gray, gray)
-        }
-    }
-}
diff --git a/userland/capsule_terminal/src/term/vt/csi_cursor.rs b/userland/capsule_terminal/src/term/vt/csi_cursor.rs
deleted file mode 100644
index 2f04ccd6f..000000000
--- a/userland/capsule_terminal/src/term/vt/csi_cursor.rs
+++ /dev/null
@@ -1,67 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-use crate::term::dimensions::{COLS, VISIBLE_ROWS};
-use crate::term::grid::types::Grid;
-
-fn n1(params: &[i64]) -> usize {
-    params.first().copied().unwrap_or(1).max(1) as usize
-}
-
-fn arg(params: &[i64], i: usize) -> usize {
-    params.get(i).copied().unwrap_or(1).max(1) as usize
-}
-
-pub fn csi_cursor(g: &mut Grid, c: u8, params: &[i64]) {
-    match c {
-        b'A' => {
-            g.y = g.y.saturating_sub(n1(params));
-        }
-        b'B' => {
-            g.y = (g.y + n1(params)).min(VISIBLE_ROWS - 1);
-        }
-        b'C' => {
-            g.x = (g.x + n1(params)).min(COLS - 1);
-        }
-        b'D' => {
-            g.x = g.x.saturating_sub(n1(params));
-        }
-        b'E' => {
-            g.x = 0;
-            g.y = (g.y + n1(params)).min(VISIBLE_ROWS - 1);
-        }
-        b'F' => {
-            g.x = 0;
-            g.y = g.y.saturating_sub(n1(params));
-        }
-        b'G' => {
-            g.x = (arg(params, 0) - 1).min(COLS - 1);
-        }
-        b'H' | b'f' => {
-            g.y = (arg(params, 0) - 1).min(VISIBLE_ROWS - 1);
-            g.x = (arg(params, 1) - 1).min(COLS - 1);
-        }
-        b'd' => {
-            g.y = (arg(params, 0) - 1).min(VISIBLE_ROWS - 1);
-        }
-        b'S' => {
-            for _ in 0..n1(params) {
-                g.scroll_up_one();
-            }
-        }
-        _ => {}
-    }
-}
diff --git a/userland/capsule_terminal/src/term/vt/csi_edit.rs b/userland/capsule_terminal/src/term/vt/csi_edit.rs
deleted file mode 100644
index 869d674c1..000000000
--- a/userland/capsule_terminal/src/term/vt/csi_edit.rs
+++ /dev/null
@@ -1,52 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-use crate::term::dimensions::COLS;
-use crate::term::grid::types::Grid;
-
-fn n1(params: &[i64]) -> usize {
-    params.first().copied().unwrap_or(1).max(1) as usize
-}
-
-pub fn csi_edit(g: &mut Grid, c: u8, params: &[i64]) {
-    match c {
-        b'J' => {
-            g.erase_display(params.first().copied().unwrap_or(0) as u8);
-        }
-        b'K' => {
-            g.erase_line(params.first().copied().unwrap_or(0) as u8);
-        }
-        b'P' => {
-            let n = n1(params).min(COLS - g.x);
-            g.move_cells(g.x + n, g.y, g.x, g.y, COLS - (g.x + n), 1);
-            let bc = g.blank_cell();
-            for x in (COLS - n)..COLS {
-                let i = Grid::idx(x, g.y);
-                g.cells[i] = bc;
-            }
-        }
-        b'@' => {
-            let n = n1(params).min(COLS - g.x);
-            g.move_cells(g.x, g.y, g.x + n, g.y, COLS - (g.x + n), 1);
-            let bc = g.blank_cell();
-            for x in g.x..(g.x + n) {
-                let i = Grid::idx(x, g.y);
-                g.cells[i] = bc;
-            }
-        }
-        _ => {}
-    }
-}
diff --git a/userland/capsule_terminal/src/term/vt/decset.rs b/userland/capsule_terminal/src/term/vt/decset.rs
deleted file mode 100644
index 32d281fec..000000000
--- a/userland/capsule_terminal/src/term/vt/decset.rs
+++ /dev/null
@@ -1,41 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-use crate::term::grid::types::Grid;
-
-pub fn decset(g: &mut Grid, params: &[i64], inter: &[u8], set: bool) {
-    if !inter.contains(&b'?') {
-        return;
-    }
-    match params.first().copied().unwrap_or(0) {
-        25 => g.cursor_visible = set,
-        47 | 1047 => {
-            if set {
-                g.enter_alt(false);
-            } else {
-                g.leave_alt();
-            }
-        }
-        1049 => {
-            if set {
-                g.enter_alt(true);
-            } else {
-                g.leave_alt();
-            }
-        }
-        _ => {}
-    }
-}
diff --git a/userland/capsule_terminal/src/term/vt/parser.rs b/userland/capsule_terminal/src/term/vt/parser.rs
deleted file mode 100644
index 2f11946c6..000000000
--- a/userland/capsule_terminal/src/term/vt/parser.rs
+++ /dev/null
@@ -1,182 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-use alloc::vec::Vec;
-
-pub trait Perform {
-    fn print(&mut self, c: u8);
-    fn execute(&mut self, b: u8);
-    fn csi(&mut self, c: u8, params: &[i64], inter: &[u8]);
-    fn esc(&mut self, c: u8, inter: &[u8]);
-    fn osc(&mut self, data: &[u8]);
-}
-
-#[derive(Clone, Copy, PartialEq)]
-enum PState {
-    Ground,
-    Escape,
-    EscapeInter,
-    CsiEntry,
-    CsiParam,
-    CsiInter,
-    Osc,
-    OscEsc,
-}
-
-pub struct Parser {
-    state: PState,
-    params: [i64; 16],
-    num: usize,
-    inter: [u8; 4],
-    ninter: usize,
-    osc: Vec<u8>,
-}
-
-impl Parser {
-    pub fn new() -> Parser {
-        Parser {
-            state: PState::Ground,
-            params: [0; 16],
-            num: 0,
-            inter: [0; 4],
-            ninter: 0,
-            osc: Vec::new(),
-        }
-    }
-
-    fn reset_seq(&mut self) {
-        self.num = 0;
-        self.ninter = 0;
-    }
-
-    fn push_digit(&mut self, d: i64) {
-        if self.num == 0 {
-            self.num = 1;
-            self.params[0] = 0;
-        }
-        let i = self.num - 1;
-        if i < 16 {
-            self.params[i] = (self.params[i] * 10 + d).min(65535);
-        }
-    }
-
-    fn push_sep(&mut self) {
-        if self.num == 0 {
-            self.num = 1;
-            self.params[0] = 0;
-        }
-        if self.num < 16 {
-            self.num += 1;
-            self.params[self.num - 1] = 0;
-        }
-    }
-
-    fn push_inter(&mut self, b: u8) {
-        if self.ninter < 4 {
-            self.inter[self.ninter] = b;
-            self.ninter += 1;
-        }
-    }
-
-    pub fn advance<P: Perform>(&mut self, p: &mut P, b: u8) {
-        match self.state {
-            PState::Ground => match b {
-                0x1B => self.state = PState::Escape,
-                0x00..=0x1F => p.execute(b),
-                0x7F => {}
-                _ => p.print(b),
-            },
-            PState::Escape => {
-                self.reset_seq();
-                match b {
-                    b'[' => self.state = PState::CsiEntry,
-                    b']' => {
-                        self.osc.clear();
-                        self.state = PState::Osc;
-                    }
-                    0x20..=0x2F => {
-                        self.push_inter(b);
-                        self.state = PState::EscapeInter;
-                    }
-                    0x1B => {}
-                    0x30..=0x7E => {
-                        p.esc(b, &self.inter[..self.ninter]);
-                        self.state = PState::Ground;
-                    }
-                    _ => self.state = PState::Ground,
-                }
-            }
-            PState::EscapeInter => match b {
-                0x20..=0x2F => self.push_inter(b),
-                0x30..=0x7E => {
-                    p.esc(b, &self.inter[..self.ninter]);
-                    self.state = PState::Ground;
-                }
-                _ => self.state = PState::Ground,
-            },
-            PState::CsiEntry | PState::CsiParam => match b {
-                0x30..=0x39 => {
-                    self.push_digit((b - 0x30) as i64);
-                    self.state = PState::CsiParam;
-                }
-                0x3B => {
-                    self.push_sep();
-                    self.state = PState::CsiParam;
-                }
-                0x3A => {}
-                0x3C..=0x3F => self.push_inter(b),
-                0x20..=0x2F => {
-                    self.push_inter(b);
-                    self.state = PState::CsiInter;
-                }
-                0x40..=0x7E => {
-                    p.csi(b, &self.params[..self.num], &self.inter[..self.ninter]);
-                    self.state = PState::Ground;
-                }
-                0x00..=0x1F => p.execute(b),
-                _ => {}
-            },
-            PState::CsiInter => match b {
-                0x20..=0x2F => self.push_inter(b),
-                0x40..=0x7E => {
-                    p.csi(b, &self.params[..self.num], &self.inter[..self.ninter]);
-                    self.state = PState::Ground;
-                }
-                0x00..=0x1F => p.execute(b),
-                _ => self.state = PState::Ground,
-            },
-            PState::Osc => match b {
-                0x07 => {
-                    p.osc(&self.osc);
-                    self.state = PState::Ground;
-                }
-                0x1B => self.state = PState::OscEsc,
-                _ => {
-                    if self.osc.len() < 256 {
-                        self.osc.push(b);
-                    }
-                }
-            },
-            PState::OscEsc => match b {
-                b'\\' => {
-                    p.osc(&self.osc);
-                    self.state = PState::Ground;
-                }
-                _ => self.state = PState::Ground,
-            },
-        }
-    }
-}
diff --git a/userland/capsule_terminal/src/term/vt/sgr.rs b/userland/capsule_terminal/src/term/vt/sgr.rs
deleted file mode 100644
index 6a0031cf0..000000000
--- a/userland/capsule_terminal/src/term/vt/sgr.rs
+++ /dev/null
@@ -1,102 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-use crate::term::grid::cell::{F_BOLD, F_REVERSE, F_UNDERLINE};
-use crate::term::grid::types::Grid;
-use crate::term::vt::color::{ansi_to_argb, pack_rgb, DEFAULT_BG, DEFAULT_FG};
-
-pub fn sgr(g: &mut Grid, params: &[i64]) {
-    if params.is_empty() {
-        g.fg = DEFAULT_FG;
-        g.bg = DEFAULT_BG;
-        g.flags = 0;
-        return;
-    }
-    let mut i = 0;
-    while i < params.len() {
-        let v = params[i];
-        match v {
-            0 => {
-                g.fg = DEFAULT_FG;
-                g.bg = DEFAULT_BG;
-                g.flags = 0;
-            }
-            1 => {
-                g.flags |= F_BOLD;
-            }
-            4 => {
-                g.flags |= F_UNDERLINE;
-            }
-            7 => {
-                g.flags |= F_REVERSE;
-            }
-            21 | 22 => {
-                g.flags &= !F_BOLD;
-            }
-            24 => {
-                g.flags &= !F_UNDERLINE;
-            }
-            27 => {
-                g.flags &= !F_REVERSE;
-            }
-            30..=37 => {
-                g.fg = ansi_to_argb((v - 30) as u8);
-            }
-            38 => {
-                i += ext_color(params, i, &mut g.fg);
-            }
-            39 => {
-                g.fg = DEFAULT_FG;
-            }
-            40..=47 => {
-                g.bg = ansi_to_argb((v - 40) as u8);
-            }
-            48 => {
-                i += ext_color(params, i, &mut g.bg);
-            }
-            49 => {
-                g.bg = DEFAULT_BG;
-            }
-            90..=97 => {
-                g.fg = ansi_to_argb((v - 90 + 8) as u8);
-            }
-            100..=107 => {
-                g.bg = ansi_to_argb((v - 100 + 8) as u8);
-            }
-            _ => {}
-        }
-        i += 1;
-    }
-}
-
-// Extended colour after 38/48: `5;n` is a 256-colour index, `2;r;g;b` is true
-// 24-bit colour kept verbatim. Returns how many extra params were consumed.
-fn ext_color(params: &[i64], i: usize, slot: &mut u32) -> usize {
-    match params.get(i + 1).copied() {
-        Some(5) => {
-            *slot = ansi_to_argb(params.get(i + 2).copied().unwrap_or(0) as u8);
-            2
-        }
-        Some(2) => {
-            let r = params.get(i + 2).copied().unwrap_or(0) as u8;
-            let gg = params.get(i + 3).copied().unwrap_or(0) as u8;
-            let b = params.get(i + 4).copied().unwrap_or(0) as u8;
-            *slot = pack_rgb(r, gg, b);
-            4
-        }
-        _ => 0,
-    }
-}
diff --git a/userland/capsule_terminal/src/term/vt/state.rs b/userland/capsule_terminal/src/term/vt/state.rs
deleted file mode 100644
index 045685ad7..000000000
--- a/userland/capsule_terminal/src/term/vt/state.rs
+++ /dev/null
@@ -1,83 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-use crate::term::dimensions::COLS;
-use crate::term::grid::types::Grid;
-use crate::term::vt::csi_cursor::csi_cursor;
-use crate::term::vt::csi_edit::csi_edit;
-use crate::term::vt::parser::Perform;
-use crate::term::vt::utf8::Utf8;
-
-pub struct VtState<'a> {
-    pub g: &'a mut Grid,
-    /// Rebuilds characters from the bytes they arrive in. It lives across
-    /// calls because a character can be split over two reads.
-    pub utf8: &'a mut Utf8,
-}
-
-impl<'a> Perform for VtState<'a> {
-    fn print(&mut self, c: u8) {
-        let g = &mut *self.g;
-        self.utf8.push(c, |ch| g.put_char(ch));
-    }
-
-    fn execute(&mut self, b: u8) {
-        match b {
-            0x08 => {
-                self.g.x = self.g.x.saturating_sub(1);
-            }
-            0x09 => {
-                let next = ((self.g.x / 8) + 1) * 8;
-                self.g.x = next.min(COLS - 1);
-            }
-            0x0A => {
-                self.g.carriage_return();
-                self.g.line_feed();
-            }
-            0x0D => {
-                self.g.carriage_return();
-            }
-            _ => {}
-        }
-    }
-
-    fn csi(&mut self, c: u8, params: &[i64], inter: &[u8]) {
-        match c {
-            b'A' | b'B' | b'C' | b'D' | b'E' | b'F' | b'G' | b'H' | b'f' | b'd' | b'S' | b'T' => {
-                csi_cursor(self.g, c, params);
-            }
-            b'J' | b'K' | b'P' | b'@' => {
-                csi_edit(self.g, c, params);
-            }
-            b'm' => crate::term::vt::sgr::sgr(self.g, params),
-            b'h' => crate::term::vt::decset::decset(self.g, params, inter, true),
-            b'l' => crate::term::vt::decset::decset(self.g, params, inter, false),
-            b'r' if inter.is_empty() => {
-                // DECSTBM: top;bottom are 1-based; an empty request is the full
-                // screen. Private `?...r` (restore modes) carries an intermediate
-                // and is intentionally left to fall through.
-                let top = params.first().copied().filter(|&v| v > 0).unwrap_or(1);
-                let bot = params.get(1).copied().filter(|&v| v > 0).unwrap_or(i64::MAX);
-                self.g.set_scroll_region((top - 1) as usize, (bot - 1) as usize);
-            }
-            _ => {}
-        }
-    }
-
-    fn esc(&mut self, _c: u8, _inter: &[u8]) {}
-
-    fn osc(&mut self, _data: &[u8]) {}
-}
diff --git a/userland/capsule_terminal/src/term/vt/utf8/finish.rs b/userland/capsule_terminal/src/term/vt/utf8/finish.rs
deleted file mode 100644
index 75dc62048..000000000
--- a/userland/capsule_terminal/src/term/vt/utf8/finish.rs
+++ /dev/null
@@ -1,38 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-//! Turning gathered bits into a character, and what to do when they are not.
-
-/// What a malformed sequence is replaced with. Substituting rather than
-/// dropping keeps a column count that matches what was sent.
-pub const REPLACEMENT: char = '\u{FFFD}';
-
-/// Turn gathered bits into a character, refusing the encodings that are
-/// shorter forms written long. Those decode to the same value as a shorter
-/// sequence and exist only to slip past a check that reads the short one.
-pub fn finish(acc: u32, width: u8) -> char {
-    let overlong = match width {
-        1 => acc < 0x80,
-        2 => acc < 0x800,
-        _ => acc < 0x10000,
-    };
-    if overlong {
-        return REPLACEMENT;
-    }
-    // from_u32 also refuses surrogate halves, which encode cleanly in UTF-8
-    // and name nothing.
-    char::from_u32(acc).unwrap_or(REPLACEMENT)
-}
diff --git a/userland/capsule_terminal/src/term/vt/utf8/mod.rs b/userland/capsule_terminal/src/term/vt/utf8/mod.rs
deleted file mode 100644
index 5f4aaabca..000000000
--- a/userland/capsule_terminal/src/term/vt/utf8/mod.rs
+++ /dev/null
@@ -1,69 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-//! Rebuilding characters from the bytes they arrive in.
-//!
-//! Output reaches the terminal a byte at a time, and a character above ASCII
-//! is spread across two to four of them. Printing each byte as it lands turns
-//! one character into that many pieces of mojibake, which is what a grid of
-//! bytes can do and no more.
-
-use finish::{finish, REPLACEMENT};
-
-mod finish;
-mod state;
-
-pub use state::Utf8;
-
-impl Utf8 {
-    /// Offer one byte and emit the characters it completes.
-    ///
-    /// Zero, one or two come out. Two happens where a sequence is abandoned
-    /// part way: the bytes already taken are reported as damaged, and then
-    /// the byte that ended them is read on its own, because it is far more
-    /// likely to start a valid character than to belong to the broken one.
-    pub fn push<F: FnMut(char)>(&mut self, b: u8, mut emit: F) {
-        if self.left > 0 {
-            if b & 0xC0 != 0x80 {
-                self.reset();
-                emit(REPLACEMENT);
-                self.push(b, emit);
-                return;
-            }
-            self.acc = (self.acc << 6) | (b as u32 & 0x3F);
-            self.left -= 1;
-            if self.left > 0 {
-                return;
-            }
-            let width = self.width;
-            let acc = self.acc;
-            self.reset();
-            emit(finish(acc, width));
-            return;
-        }
-
-        match b {
-            0x00..=0x7F => emit(b as char),
-            // A continuation byte with nothing to continue.
-            0x80..=0xBF => emit(REPLACEMENT),
-            0xC0..=0xDF => self.begin(b as u32 & 0x1F, 1),
-            0xE0..=0xEF => self.begin(b as u32 & 0x0F, 2),
-            0xF0..=0xF4 => self.begin(b as u32 & 0x07, 3),
-            // 0xF5 and above encode nothing inside the Unicode range.
-            _ => emit(REPLACEMENT),
-        }
-    }
-}
diff --git a/userland/capsule_terminal/src/term/vt/utf8/state.rs b/userland/capsule_terminal/src/term/vt/utf8/state.rs
deleted file mode 100644
index 2e1556b37..000000000
--- a/userland/capsule_terminal/src/term/vt/utf8/state.rs
+++ /dev/null
@@ -1,43 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-//! What the decoder carries between bytes.
-
-/// Accumulates bytes until they form a character.
-#[derive(Default)]
-pub struct Utf8 {
-    /// Bits gathered so far from the bytes of the current sequence.
-    pub(super) acc: u32,
-    /// Continuation bytes still expected.
-    pub(super) left: u8,
-    /// How many the sequence asked for, kept so an overlong encoding can be
-    /// told from a legitimate one of the same value.
-    pub(super) width: u8,
-}
-
-impl Utf8 {
-    pub(super) fn begin(&mut self, bits: u32, follow: u8) {
-        self.acc = bits;
-        self.left = follow;
-        self.width = follow;
-    }
-
-    pub(super) fn reset(&mut self) {
-        self.acc = 0;
-        self.left = 0;
-        self.width = 0;
-    }
-}
diff --git a/userland/capsule_terminal/tests/utf8_host.rs b/userland/capsule_terminal/tests/utf8_host.rs
deleted file mode 100644
index 741e34067..000000000
--- a/userland/capsule_terminal/tests/utf8_host.rs
+++ /dev/null
@@ -1,108 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// Host-side harness for the terminal's UTF-8 decoder. Compiled with the host
-// toolchain so the byte-to-character logic is exercised without QEMU:
-//   rustc --edition 2021 --test tests/utf8_host.rs -o /tmp/utf8_host && /tmp/utf8_host
-//
-// The module is pulled in by path so this cannot pass against a copy that has
-// drifted from what the capsule runs.
-
-#[path = "../src/term/vt/utf8/mod.rs"]
-mod utf8;
-
-use utf8::Utf8;
-
-/// Feed a whole string and collect what comes back out.
-fn decode(bytes: &[u8]) -> String {
-    let mut u = Utf8::default();
-    let mut out = String::new();
-    for &b in bytes {
-        u.push(b, |ch| out.push(ch));
-    }
-    out
-}
-
-#[test]
-fn ascii_passes_through_unchanged() {
-    assert_eq!(decode(b"hello world"), "hello world");
-}
-
-/// The reason this exists. A character above ASCII arrives as several bytes,
-/// and printing each one turns it into that many pieces of mojibake.
-#[test]
-fn multibyte_characters_survive() {
-    for s in
-        ["\u{00D8}", "caf\u{00E9}", "\u{4F60}\u{597D}", "\u{1F512}", "\u{2502}\u{2500}\u{250C}"]
-    {
-        assert_eq!(decode(s.as_bytes()), s, "failed on {s}");
-    }
-}
-
-/// Output arrives in whatever chunks the reader hands over, so a character
-/// can be split across two feeds and the decoder has to carry state.
-#[test]
-fn a_character_split_across_feeds_survives() {
-    let s = "\u{4F60}\u{597D}";
-    let bytes = s.as_bytes();
-    for split in 1..bytes.len() {
-        let mut u = Utf8::default();
-        let mut out = String::new();
-        for &b in &bytes[..split] {
-            u.push(b, |ch| out.push(ch));
-        }
-        for &b in &bytes[split..] {
-            u.push(b, |ch| out.push(ch));
-        }
-        assert_eq!(out, s, "split at {split}");
-    }
-}
-
-/// An overlong encoding decodes to the same value as a shorter one and exists
-/// only to slip past a check that reads the short form.
-#[test]
-fn overlong_encodings_are_refused() {
-    // '/' written as two bytes, and as three.
-    assert_eq!(decode(&[0xC0, 0xAF]), "\u{FFFD}");
-    assert_eq!(decode(&[0xE0, 0x80, 0xAF]), "\u{FFFD}");
-    // NUL written long.
-    assert_eq!(decode(&[0xC0, 0x80]), "\u{FFFD}");
-}
-
-/// Surrogate halves are not characters. They encode cleanly in UTF-8 but
-/// name nothing.
-#[test]
-fn surrogates_are_refused() {
-    assert_eq!(decode(&[0xED, 0xA0, 0x80]), "\u{FFFD}");
-}
-
-/// Past the top of the Unicode range there is nothing to name.
-#[test]
-fn out_of_range_is_refused() {
-    // One for the lead byte, then one for each continuation with nothing to
-    // continue, which is what a standard decoder reports.
-    assert_eq!(decode(&[0xF5, 0x80, 0x80, 0x80]), "\u{FFFD}\u{FFFD}\u{FFFD}\u{FFFD}");
-    assert_eq!(decode(&[0xFF]), "\u{FFFD}");
-}
-
-/// A continuation byte with nothing to continue is not a character.
-#[test]
-fn a_stray_continuation_is_refused() {
-    assert_eq!(decode(&[0x80]), "\u{FFFD}");
-}
-
-/// A sequence cut short must not swallow the byte that follows it. That byte
-/// is far more likely to start a valid character than to belong to the
-/// broken one.
-#[test]
-fn a_truncated_sequence_does_not_eat_the_next_character() {
-    // Two bytes of a three byte character, then a plain 'A'.
-    assert_eq!(decode(&[0xE4, 0xBD, b'A']), "\u{FFFD}A");
-}
-
-/// A malformed sequence costs one column, not zero, so what is on screen
-/// still lines up with what was sent.
-#[test]
-fn every_bad_sequence_yields_exactly_one_character() {
-    assert_eq!(decode(&[0x80, 0x80, 0x80]).chars().count(), 3);
-}
diff --git a/userland/capsule_terminal/tests/width_host.rs b/userland/capsule_terminal/tests/width_host.rs
deleted file mode 100644
index f866dedfa..000000000
--- a/userland/capsule_terminal/tests/width_host.rs
+++ /dev/null
@@ -1,86 +0,0 @@
-// NONOS Operating System
-// Copyright (C) 2026 NONOS Contributors
-//
-// Host-side harness for character width. Compiled with the host toolchain:
-//   rustc --edition 2021 --test tests/width_host.rs -o /tmp/width_host && /tmp/width_host
-//
-// The module is pulled in by path so this cannot pass against a copy that has
-// drifted from what the capsule runs.
-
-#[path = "../src/term/grid/width.rs"]
-mod width;
-
-use width::char_width;
-
-#[test]
-fn latin_is_one_column() {
-    for ch in ['a', 'Z', '0', ' ', '~', '\u{00E9}', '\u{00D8}'] {
-        assert_eq!(char_width(ch), 1, "{ch:?}");
-    }
-}
-
-/// The case that made this necessary. Drawn two columns wide, so treating one
-/// as a single cell puts the next character over its right half.
-#[test]
-fn cjk_and_emoji_are_two_columns() {
-    for ch in ['\u{4F60}', '\u{597D}', '\u{3042}', '\u{AC00}', '\u{1F512}', '\u{FF21}'] {
-        assert_eq!(char_width(ch), 2, "{ch:?}");
-    }
-}
-
-/// Box drawing is what a terminal UI is made of, and it is single width.
-/// Treating it as wide would break every frame drawn with it.
-#[test]
-fn box_drawing_is_one_column() {
-    for ch in ['\u{2500}', '\u{2502}', '\u{250C}', '\u{2588}', '\u{2591}'] {
-        assert_eq!(char_width(ch), 1, "{ch:?}");
-    }
-}
-
-/// Never zero. A zero would let a character occupy no column and leave the
-/// cursor where it was, so the next write lands on top of it.
-#[test]
-fn width_is_never_zero() {
-    for cp in [0x0u32, 0x20, 0x300, 0x200B, 0xFFFD, 0x10FFFF] {
-        if let Some(ch) = char::from_u32(cp) {
-            assert!(char_width(ch) >= 1, "{cp:#x}");
-        }
-    }
-}
-
-/// The ranges are searched in order and the scan stops at the first one that
-/// starts above the codepoint. If they were out of order a later range would
-/// never be reached, so each block boundary is checked from both sides.
-#[test]
-fn every_wide_block_is_reachable() {
-    // (last narrow codepoint before the block, first codepoint of the block)
-    const EDGES: &[(u32, u32)] = &[
-        (0x10FF, 0x1100),
-        (0x2E7F, 0x2E80),
-        (0x3040, 0x3041),
-        (0x33FF + 1, 0x3400),
-        (0x4DBF + 1, 0x4E00),
-        (0x9FFF + 1, 0xA000),
-        (0xA95F, 0xA960),
-        (0xABFF, 0xAC00),
-        (0xF8FF, 0xF900),
-        (0xFE0F, 0xFE10),
-        (0xFE2F, 0xFE30),
-        (0xFEFF, 0xFF00),
-        (0xFFDF, 0xFFE0),
-        (0x1F2FF, 0x1F300),
-        (0x1F8FF, 0x1F900),
-        (0x1FFFF, 0x20000),
-    ];
-    for &(narrow, wide) in EDGES {
-        if let Some(ch) = char::from_u32(wide) {
-            assert_eq!(char_width(ch), 2, "block start {wide:#x} should be wide");
-        }
-        if let Some(ch) = char::from_u32(narrow) {
-            // Some of these fall inside a neighbouring wide block, which is
-            // fine; what matters is that the block above is still reached.
-            let w = char_width(ch);
-            assert!(w == 1 || w == 2, "{narrow:#x}");
-        }
-    }
-}
diff --git a/userland/terminal_line_proofs/Cargo.lock b/userland/terminal_line_proofs/Cargo.lock
index 83d077d68..8db62ac41 100644
--- a/userland/terminal_line_proofs/Cargo.lock
+++ b/userland/terminal_line_proofs/Cargo.lock
@@ -2,6 +2,13 @@
 # It is not intended for manual editing.
 version = 4
 
+[[package]]
+name = "nonos_vt"
+version = "0.1.0"
+
 [[package]]
 name = "terminal_line_proofs"
 version = "0.1.0"
+dependencies = [
+ "nonos_vt",
+]
diff --git a/userland/terminal_line_proofs/Cargo.toml b/userland/terminal_line_proofs/Cargo.toml
index a980372a5..f0a1ee41b 100644
--- a/userland/terminal_line_proofs/Cargo.toml
+++ b/userland/terminal_line_proofs/Cargo.toml
@@ -15,3 +15,6 @@ license = "AGPL-3.0-or-later"
 
 [lib]
 path = "src/lib.rs"
+
+[dependencies]
+nonos_vt = { path = "../nonos_vt" }
diff --git a/userland/terminal_line_proofs/src/cooked_tests.rs b/userland/terminal_line_proofs/src/cooked_tests.rs
new file mode 100644
index 000000000..4463d5cd3
--- /dev/null
+++ b/userland/terminal_line_proofs/src/cooked_tests.rs
@@ -0,0 +1,75 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The canonical-mode line editing a foreground program reads through, and
+//! which cells a pointer selection covers.
+
+use crate::cooked::{Cooked, Effect};
+use crate::select::Selection;
+use nonos_vt::Pos;
+
+fn type_str(c: &mut Cooked, s: &str, fx: &mut Effect) {
+    for ch in s.chars() {
+        c.char(ch, fx);
+    }
+}
+
+#[test]
+fn enter_sends_the_edited_line_with_its_newline() {
+    let (mut c, mut fx) = (Cooked::default(), Effect::default());
+    type_str(&mut c, "lx", &mut fx);
+    c.backspace(&mut fx);
+    type_str(&mut c, "s -l", &mut fx);
+    c.enter(&mut fx);
+    assert_eq!(fx.send, b"ls -l\n");
+    assert!(c.line.is_empty());
+}
+
+#[test]
+fn backspace_erases_a_wide_character_across_both_cells() {
+    let (mut c, mut fx) = (Cooked::default(), Effect::default());
+    c.char('漢', &mut fx);
+    fx.echo.clear();
+    c.backspace(&mut fx);
+    assert_eq!(fx.echo, b"\x08 \x08\x08 \x08");
+}
+
+#[test]
+fn kill_word_and_kill_line() {
+    let (mut c, mut fx) = (Cooked::default(), Effect::default());
+    type_str(&mut c, "git commit  ", &mut fx);
+    c.kill_word(&mut fx);
+    assert_eq!(c.line.iter().collect::<String>(), "git ");
+    c.kill_line(&mut fx);
+    assert!(c.line.is_empty());
+    assert!(fx.send.is_empty(), "nothing is sent before Enter");
+}
+
+#[test]
+fn a_selection_covers_whole_middle_lines() {
+    let s =
+        Selection { anchor: Pos { line: 5, col: 3 }, head: Pos { line: 3, col: 7 }, block: false };
+    assert!(s.contains(4, 0) && s.contains(4, 500));
+    assert!(s.contains(3, 7) && !s.contains(3, 6));
+    assert!(s.contains(5, 3) && !s.contains(5, 4));
+}
+
+#[test]
+fn a_block_selection_covers_columns() {
+    let s =
+        Selection { anchor: Pos { line: 1, col: 8 }, head: Pos { line: 3, col: 2 }, block: true };
+    assert!(s.contains(2, 5) && !s.contains(2, 9) && !s.contains(2, 1));
+}
diff --git a/userland/terminal_line_proofs/src/lib.rs b/userland/terminal_line_proofs/src/lib.rs
index 67e0c5fb1..5409c108c 100644
--- a/userland/terminal_line_proofs/src/lib.rs
+++ b/userland/terminal_line_proofs/src/lib.rs
@@ -69,9 +69,19 @@ pub mod cadence;
 #[path = "../../capsule_terminal/src/command/builtin/fs/grep_paint.rs"]
 pub mod grep_paint;
 
+// The line editing a foreground program gets, and the pointer selection.
+#[path = "../../capsule_terminal/src/event/cooked.rs"]
+pub mod cooked;
+#[path = "../../capsule_terminal/src/event/cooked_kill.rs"]
+pub mod cooked_kill;
+#[path = "../../capsule_terminal/src/term/select.rs"]
+pub mod select;
+
 #[cfg(test)]
 mod cadence_tests;
 #[cfg(test)]
+mod cooked_tests;
+#[cfg(test)]
 mod expand_tests;
 #[cfg(test)]
 mod filter_tests;

From e8f2093124fbaa7dd97dd4c6d362c8441a2d4729 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 14:34:27 +0000
Subject: [PATCH 10/29] kernel: tell a program whether its streams reach a
 terminal

A launcher that renders a child's output knows which of the child's
standard streams reach its screen; the child had no way to ask. MTTY lets
the parent record that, with the size in cells, under the same parent
rule that lets it drain the child's output, and it needs IPC as MTRN
does. MTTQ answers the caller about its own stream 0, 1 or 2 with the
size, or ENOTTY. The record is dropped as the process is finalized, so a
reused pid starts with no terminal. Both calls are published in the ABI
with libc wrappers, and the syscall checks pass with the unreachable
count unchanged.
---
 abi/syscalls.toml                             | 15 +++++
 src/process/exit/finalize.rs                  |  1 +
 src/syscall/abi/registry/mk.rs                |  2 +
 src/syscall/contract/cap_table/mk.rs          |  7 +++
 .../dispatch/router/microkernel_ops.rs        |  2 +
 src/syscall/microkernel/dispatch/process.rs   |  3 +
 src/syscall/microkernel/errnos.rs             |  1 +
 src/syscall/microkernel/mod.rs                |  2 +
 src/syscall/microkernel/numbers.rs            |  2 +
 src/syscall/microkernel/tty.rs                | 54 ++++++++++++++++++
 src/syscall/microkernel/tty_table.rs          | 55 +++++++++++++++++++
 src/syscall/numbers/defs.rs                   |  2 +
 userland/libc/src/lib.rs                      |  2 +
 userland/libc/src/syscall/mod.rs              |  3 +-
 userland/libc/src/syscall/numbers/core.rs     |  2 +
 userland/libc/src/tty.rs                      | 27 +++++++++
 16 files changed, 179 insertions(+), 1 deletion(-)
 create mode 100644 src/syscall/microkernel/tty.rs
 create mode 100644 src/syscall/microkernel/tty_table.rs
 create mode 100644 userland/libc/src/tty.rs

diff --git a/abi/syscalls.toml b/abi/syscalls.toml
index 798d02d5f..b84d3fca6 100644
--- a/abi/syscalls.toml
+++ b/abi/syscalls.toml
@@ -41,6 +41,7 @@ ENODEV       = -19
 ENOTDIR      = -20
 EISDIR       = -21
 EINVAL       = -22
+ENOTTY       = -25
 ETXTBSY      = -26
 ERANGE       = -34
 ENOSYS       = -38
@@ -118,6 +119,8 @@ MTMS = 0x534D544D
 MTRN = 0x4E52544D
 MTRT = 0x5452544D
 MTSP = 0x5053544D
+MTTQ = 0x5154544D
+MTTY = 0x5954544D
 MWAT = 0x5441574D
 CRND = 0x444E5243
 CHSH = 0x48534843
@@ -803,6 +806,18 @@ caps = ["IPC"]
 args = [{name="entry",type="u64",dir="in"},{name="stack",type="u64",dir="in"}]
 ret  = {type="i64"}
 
+[desc.MTTQ]
+nr   = 0x5154544D
+caps = ["valid_token"]
+args = [{name="fd",type="u64",dir="in"}]
+ret  = {type="i64"}
+
+[desc.MTTY]
+nr   = 0x5954544D
+caps = ["IPC"]
+args = [{name="pid",type="u64",dir="in"},{name="streams",type="u64",dir="in"},{name="cols",type="u64",dir="in"},{name="rows",type="u64",dir="in"}]
+ret  = {type="i64"}
+
 [desc.MWAT]
 nr   = 0x5441574D
 caps = ["IPC"]
diff --git a/src/process/exit/finalize.rs b/src/process/exit/finalize.rs
index 6fdcd9e1b..200f4681b 100644
--- a/src/process/exit/finalize.rs
+++ b/src/process/exit/finalize.rs
@@ -35,6 +35,7 @@ pub(super) fn finalize_teardown(pid: Pid) {
         let _ = crate::ipc::nonos_inbox::unregister_for_pid(pid);
     }
 
+    crate::syscall::microkernel::tty_table::forget(pid);
     crate::process::clear_interrupt_context(pid);
     crate::process::clear_fpu_state(pid);
     crate::process::core::init::reparent_orphans(pid);
diff --git a/src/syscall/abi/registry/mk.rs b/src/syscall/abi/registry/mk.rs
index 143365815..e4e0f9995 100644
--- a/src/syscall/abi/registry/mk.rs
+++ b/src/syscall/abi/registry/mk.rs
@@ -114,6 +114,8 @@ pub(super) const ENTRIES: &[AbiEntry] = &[
     e(b"MAPL", SyscallNumber::MkAppLaunch, "MkAppLaunch"),
     e(b"MAIS", SyscallNumber::MkAppInstallStatus, "MkAppInstallStatus"),
     e(b"MTRN", SyscallNumber::MkToolRun, "MkToolRun"),
+    e(b"MTTY", SyscallNumber::MkTtySet, "MkTtySet"),
+    e(b"MTTQ", SyscallNumber::MkTtyQuery, "MkTtyQuery"),
     e(b"MSOW", SyscallNumber::MkStdoutWrite, "MkStdoutWrite"),
     e(b"MSWR", SyscallNumber::MkStoreWrite, "MkStoreWrite"),
     e(b"MCVF", SyscallNumber::MkCapsuleVerify, "MkCapsuleVerify"),
diff --git a/src/syscall/contract/cap_table/mk.rs b/src/syscall/contract/cap_table/mk.rs
index fbbb0d282..11a51e176 100644
--- a/src/syscall/contract/cap_table/mk.rs
+++ b/src/syscall/contract/cap_table/mk.rs
@@ -199,6 +199,13 @@ pub(super) fn check(caps: &CapabilityToken, number: SyscallNumber) -> Option<boo
          * baked, attested set can be named.
          */
         SyscallNumber::MkToolRun => caps.can_ipc(),
+        /*
+         * Saying what a child's streams are on is part of driving its stdio,
+         * so it needs what running the child needed. Asking about one's own
+         * streams reveals nothing about anyone else.
+         */
+        SyscallNumber::MkTtySet => caps.can_ipc(),
+        SyscallNumber::MkTtyQuery => true,
 
         _ => return None,
     })
diff --git a/src/syscall/dispatch/router/microkernel_ops.rs b/src/syscall/dispatch/router/microkernel_ops.rs
index c158454b6..9b97a9cdf 100644
--- a/src/syscall/dispatch/router/microkernel_ops.rs
+++ b/src/syscall/dispatch/router/microkernel_ops.rs
@@ -106,6 +106,8 @@ pub(super) fn matches(nr: SyscallNumber) -> bool {
             | MkAppLaunch
             | MkAppInstallStatus
             | MkToolRun
+            | MkTtySet
+            | MkTtyQuery
     )
 }
 
diff --git a/src/syscall/microkernel/dispatch/process.rs b/src/syscall/microkernel/dispatch/process.rs
index dddf6a4a9..bea6847f6 100644
--- a/src/syscall/microkernel/dispatch/process.rs
+++ b/src/syscall/microkernel/dispatch/process.rs
@@ -52,6 +52,7 @@ use crate::syscall::microkernel::time::{
     sys_time_adjust, sys_time_millis, sys_time_monotonic, sys_time_rtc,
 };
 use crate::syscall::microkernel::tool_run::sys_tool_run;
+use crate::syscall::microkernel::tty::{sys_tty_query, sys_tty_set};
 use crate::syscall::microkernel::wait::sys_wait;
 
 pub(super) fn handle(nr: u64, a: Args) -> Option<i64> {
@@ -112,6 +113,8 @@ pub(super) fn handle(nr: u64, a: Args) -> Option<i64> {
         SYS_DEV_ROOT_CONFIRM => sys_dev_root_confirm(a.a0),
         SYS_SPAWN_INSTANCE => sys_spawn_instance(a.a0, a.a1),
         SYS_TOOL_RUN => sys_tool_run(a.a0, a.a1, a.a2, a.a3),
+        SYS_TTY_SET => sys_tty_set(a.a0, a.a1, a.a2, a.a3),
+        SYS_TTY_QUERY => sys_tty_query(a.a0),
         _ => return None,
     })
 }
diff --git a/src/syscall/microkernel/errnos.rs b/src/syscall/microkernel/errnos.rs
index fdd743208..88f82abf7 100644
--- a/src/syscall/microkernel/errnos.rs
+++ b/src/syscall/microkernel/errnos.rs
@@ -29,6 +29,7 @@ pub const ERRNO_BUSY: i64 = -16;
 pub const ERRNO_EXIST: i64 = -17;
 pub const ERRNO_NODEV: i64 = -19;
 pub const ERRNO_INVAL: i64 = -22;
+pub const ERRNO_NOTTY: i64 = -25;
 pub const ERRNO_NOSYS: i64 = -38;
 pub const ERRNO_NOTSUP: i64 = -95;
 pub const ERRNO_TIMEDOUT: i64 = -110;
diff --git a/src/syscall/microkernel/mod.rs b/src/syscall/microkernel/mod.rs
index fe29cae34..9b2e9c77c 100644
--- a/src/syscall/microkernel/mod.rs
+++ b/src/syscall/microkernel/mod.rs
@@ -66,6 +66,8 @@ pub mod stdout_write;
 pub mod store_write;
 pub mod time;
 pub mod tool_run;
+pub mod tty;
+pub mod tty_table;
 pub mod wait;
 
 pub use attest::sys_attest_status;
diff --git a/src/syscall/microkernel/numbers.rs b/src/syscall/microkernel/numbers.rs
index 630aef93c..4a60fe30f 100644
--- a/src/syscall/microkernel/numbers.rs
+++ b/src/syscall/microkernel/numbers.rs
@@ -144,3 +144,5 @@ pub const SYS_SPAWN_INSTANCE: u64 = tag4(b"MSPI");
 // Run a baked, attested command-line tool by name, parented to the caller so
 // it can drive the tool's stdin and stdout. Gated on the IPC capability.
 pub const SYS_TOOL_RUN: u64 = tag4(b"MTRN");
+pub const SYS_TTY_SET: u64 = tag4(b"MTTY");
+pub const SYS_TTY_QUERY: u64 = tag4(b"MTTQ");
diff --git a/src/syscall/microkernel/tty.rs b/src/syscall/microkernel/tty.rs
new file mode 100644
index 000000000..f256a4f9f
--- /dev/null
+++ b/src/syscall/microkernel/tty.rs
@@ -0,0 +1,54 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! `MkTtySet` and `MkTtyQuery`: how a program learns whether it is writing
+//! to a person or to a pipe. A launcher that renders a child's output
+//! knows which of the child's streams reach its screen; the child asks
+//! before choosing colour, columns and a pager.
+
+use super::errnos::{ERRNO_INVAL, ERRNO_NOTTY, ERRNO_PERM};
+use super::tty_table::{self, Tty, STREAMS_ALL};
+use crate::process::{current_pid, get_parent_pid};
+
+/// `MkTtySet(pid, streams, cols, rows)`. Only the parent of `pid` may say
+/// what its streams are on, the same rule that lets it drain them; anyone
+/// else would be telling a stranger's program it has a screen.
+pub fn sys_tty_set(pid: u64, streams: u64, cols: u64, rows: u64) -> i64 {
+    let fits = |v: u64| v <= u16::MAX as u64;
+    if pid == 0 || pid > u32::MAX as u64 || streams > STREAMS_ALL as u64 || !fits(cols) || !fits(rows)
+    {
+        return ERRNO_INVAL;
+    }
+    let caller = current_pid().unwrap_or(0);
+    if caller == 0 || get_parent_pid(pid as u32) != Some(caller) {
+        return ERRNO_PERM;
+    }
+    tty_table::set(pid as u32, Tty { streams: streams as u8, cols: cols as u16, rows: rows as u16 });
+    0
+}
+
+/// `MkTtyQuery(fd)`. For the caller's stdin, stdout or stderr on a
+/// terminal, its size as `rows << 16 | cols`; ENOTTY for anything else.
+pub fn sys_tty_query(fd: u64) -> i64 {
+    if fd > 2 {
+        return ERRNO_NOTTY;
+    }
+    let Some(pid) = current_pid() else { return ERRNO_NOTTY };
+    match tty_table::get(pid) {
+        Some(t) if t.streams & (1 << fd) != 0 => ((t.rows as i64) << 16) | t.cols as i64,
+        _ => ERRNO_NOTTY,
+    }
+}
diff --git a/src/syscall/microkernel/tty_table.rs b/src/syscall/microkernel/tty_table.rs
new file mode 100644
index 000000000..bdc373813
--- /dev/null
+++ b/src/syscall/microkernel/tty_table.rs
@@ -0,0 +1,55 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Which of a process's standard streams reach a terminal, and the size of
+//! that terminal in cells. Set by the parent that drains the process's
+//! output, read by the process, forgotten when it exits.
+
+use alloc::collections::BTreeMap;
+use spin::Mutex;
+
+/// Bit 0 stdin, bit 1 stdout, bit 2 stderr.
+pub const STREAMS_ALL: u8 = 0b111;
+
+#[derive(Clone, Copy)]
+pub struct Tty {
+    pub streams: u8,
+    pub cols: u16,
+    pub rows: u16,
+}
+
+static TABLE: Mutex<BTreeMap<u32, Tty>> = Mutex::new(BTreeMap::new());
+
+/// Record what `pid`'s streams are on. No streams at all clears the entry,
+/// which is what a stage whose output is redirected to a file gets.
+pub fn set(pid: u32, tty: Tty) {
+    let mut table = TABLE.lock();
+    if tty.streams == 0 {
+        table.remove(&pid);
+    } else {
+        table.insert(pid, tty);
+    }
+}
+
+pub fn get(pid: u32) -> Option<Tty> {
+    TABLE.lock().get(&pid).copied()
+}
+
+/// Called as a process is finalized, so a pid reused later starts with no
+/// terminal it never had.
+pub fn forget(pid: u32) {
+    TABLE.lock().remove(&pid);
+}
diff --git a/src/syscall/numbers/defs.rs b/src/syscall/numbers/defs.rs
index 7ffad31ca..862a9c0ef 100644
--- a/src/syscall/numbers/defs.rs
+++ b/src/syscall/numbers/defs.rs
@@ -80,6 +80,8 @@ pub enum SyscallNumber {
     MkDevRootRequest = tag4(b"MDRQ"),
     MkDevRootConfirm = tag4(b"MDRC"),
     MkToolRun = tag4(b"MTRN"),
+    MkTtySet = tag4(b"MTTY"),
+    MkTtyQuery = tag4(b"MTTQ"),
     MkCapGrant = tag4(b"MCGT"),
     MkCapRevoke = tag4(b"MCRV"),
     MkCapCheck = tag4(b"MCCK"),
diff --git a/userland/libc/src/lib.rs b/userland/libc/src/lib.rs
index 1ce8a42ca..324fa68dc 100644
--- a/userland/libc/src/lib.rs
+++ b/userland/libc/src/lib.rs
@@ -49,6 +49,7 @@ pub mod surface_registry;
 mod syscall;
 pub mod time;
 pub mod tool_run;
+pub mod tty;
 pub mod transport;
 mod unistd;
 
@@ -120,4 +121,5 @@ pub use surface_registry::{
 pub use syscall::call_raw as mk_syscall_raw;
 pub use time::{mk_time_adjust, mk_time_millis, mk_time_rtc, mk_uptime_ms, Deadline, RtcTime};
 pub use tool_run::mk_tool_run;
+pub use tty::{mk_tty_query, mk_tty_set, TTY_STDERR, TTY_STDIN, TTY_STDOUT};
 pub use unistd::{mk_exit, mk_idle_ms, mk_yield};
diff --git a/userland/libc/src/syscall/mod.rs b/userland/libc/src/syscall/mod.rs
index e56f2b5e6..4c78ed814 100644
--- a/userland/libc/src/syscall/mod.rs
+++ b/userland/libc/src/syscall/mod.rs
@@ -39,5 +39,6 @@ pub(crate) use numbers::{
     N_MK_PROC_STAT, N_MK_SERVICE_LOOKUP, N_MK_SERVICE_REGISTER, N_MK_SPAWN_INSTANCE,
     N_MK_STDIN_READ, N_MK_STORE_WRITE, N_MK_SURFACE_ATTACH, N_MK_SURFACE_PRESENT,
     N_MK_SURFACE_REGISTER, N_MK_SURFACE_RELEASE, N_MK_SURFACE_SHARE, N_MK_TIME_ADJUST,
-    N_MK_TIME_MILLIS, N_MK_TIME_MONOTONIC, N_MK_TIME_RTC, N_MK_TOOL_RUN, N_MK_WAIT, N_MK_YIELD,
+    N_MK_TIME_MILLIS, N_MK_TIME_MONOTONIC, N_MK_TIME_RTC, N_MK_TOOL_RUN, N_MK_TTY_QUERY,
+    N_MK_TTY_SET, N_MK_WAIT, N_MK_YIELD,
 };
diff --git a/userland/libc/src/syscall/numbers/core.rs b/userland/libc/src/syscall/numbers/core.rs
index f8289e783..ea6e2142f 100644
--- a/userland/libc/src/syscall/numbers/core.rs
+++ b/userland/libc/src/syscall/numbers/core.rs
@@ -43,6 +43,8 @@ pub(crate) const N_MK_CAP_GRANT: i64 = tag4(b"MCGT");
 pub(crate) const N_MK_CAP_REVOKE: i64 = tag4(b"MCRV");
 pub(crate) const N_MK_SPAWN_INSTANCE: i64 = tag4(b"MSPI");
 pub(crate) const N_MK_TOOL_RUN: i64 = tag4(b"MTRN");
+pub(crate) const N_MK_TTY_SET: i64 = tag4(b"MTTY");
+pub(crate) const N_MK_TTY_QUERY: i64 = tag4(b"MTTQ");
 pub(crate) const N_MK_WAIT: i64 = tag4(b"MWAT");
 pub(crate) const N_MK_KILL: i64 = tag4(b"MKIL");
 pub(crate) const N_MK_PROC_INPUT: i64 = tag4(b"MPIN");
diff --git a/userland/libc/src/tty.rs b/userland/libc/src/tty.rs
new file mode 100644
index 000000000..c3d6a834f
--- /dev/null
+++ b/userland/libc/src/tty.rs
@@ -0,0 +1,27 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+//! Whether a standard stream reaches a terminal, and its size. A launcher
+//! that renders a child's output says which of the child's streams reach
+//! its screen; the child asks before choosing colour and columns.
+
+use crate::syscall::{call_raw, N_MK_TTY_QUERY, N_MK_TTY_SET};
+
+/// Standard streams, as bits of `mk_tty_set`'s `streams`.
+pub const TTY_STDIN: u64 = 1 << 0;
+pub const TTY_STDOUT: u64 = 1 << 1;
+pub const TTY_STDERR: u64 = 1 << 2;
+
+/// Say which of child `pid`'s streams reach the caller's terminal, and its
+/// size in cells. Only the child's parent may; zero streams clears it.
+pub fn mk_tty_set(pid: u32, streams: u64, cols: u16, rows: u16) -> i64 {
+    call_raw(N_MK_TTY_SET, [pid as u64, streams, cols as u64, rows as u64, 0, 0])
+}
+
+/// The size, as `(cols, rows)`, of the terminal the caller's stream `fd`
+/// (0, 1 or 2) reaches, or `None` when it reaches none.
+pub fn mk_tty_query(fd: u32) -> Option<(u16, u16)> {
+    let rc = call_raw(N_MK_TTY_QUERY, [fd as u64, 0, 0, 0, 0, 0]);
+    (rc >= 0).then_some(((rc & 0xFFFF) as u16, ((rc >> 16) & 0xFFFF) as u16))
+}

From 8de62e9849a773d2576754134b75468654a03807 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 14:34:27 +0000
Subject: [PATCH 11/29] std: ask the kernel whether a standard stream is a
 terminal

Three answers disagreed on NONOS: std's IsTerminal fell to the
unsupported arm and said no, the vendored is-terminal said no, and the
atty shim said yes for every stream, so one tool could colour a pipe
while another printed plain text to a person. std now asks MTTQ for
streams 0 to 2, and both is-terminal copies and atty go through std, so
there is one answer and it is the launcher's.
---
 toolchain/nonos-std/README.md                 |  1 +
 toolchain/nonos-std/apply.sh                  |  6 ++++
 .../nonos-std/sys/io/is_terminal/nonos.rs     | 33 +++++++++++++++++++
 userland/upstream-src/atty-0.2.14/src/lib.rs  | 15 ++++++---
 .../is-terminal-0.4.17/src/lib.rs             |  8 ++---
 userland/vendor/is-terminal/src/lib.rs        |  7 ++--
 6 files changed, 57 insertions(+), 13 deletions(-)
 create mode 100644 toolchain/nonos-std/sys/io/is_terminal/nonos.rs

diff --git a/toolchain/nonos-std/README.md b/toolchain/nonos-std/README.md
index 46755ac21..3460aa4f2 100644
--- a/toolchain/nonos-std/README.md
+++ b/toolchain/nonos-std/README.md
@@ -24,6 +24,7 @@ returns `Unsupported` loudly; nothing pretends.
 | heap (`alloc`) | real | dlmalloc over `MMAP`, spin-locked (thread-safe) |
 | `println!` / stdout / stderr | real | `MDBG` serial sink, mirrored to `proc.<pid>` inbox |
 | stdin | real | blocking read of this process's kernel stdin channel (`MSRD`), fed by a launcher (the terminal); no EOF-on-close yet |
+| `IsTerminal` | real | `MTTQ`: true for a standard stream the launcher said reaches its screen (`MTTY`); a stage feeding a pipe or a file, or a process no terminal started, gets false |
 | `args` | real | `MKAR` |
 | env vars | real, process-local | in-process map; nothing is inherited across spawns yet |
 | `current_dir` | fixed `/` | capsules see the VFS from its root; `chdir` unsupported |
diff --git a/toolchain/nonos-std/apply.sh b/toolchain/nonos-std/apply.sh
index 3c15a44d0..35b38b0a9 100755
--- a/toolchain/nonos-std/apply.sh
+++ b/toolchain/nonos-std/apply.sh
@@ -15,6 +15,7 @@ SYS="$STD/src/sys"
 # 1. copy the platform modules
 cp "$HERE/sys/alloc/nonos.rs"            "$SYS/alloc/nonos.rs"
 cp "$HERE/sys/io/error/nonos.rs"         "$SYS/io/error/nonos.rs"
+cp "$HERE/sys/io/is_terminal/nonos.rs"   "$SYS/io/is_terminal/nonos.rs"
 cp "$HERE/sys/random/nonos.rs"           "$SYS/random/nonos.rs"
 cp "$HERE/sys/stdio/nonos.rs"            "$SYS/stdio/nonos.rs"
 cp "$HERE/sys/args/nonos.rs"             "$SYS/args/nonos.rs"
@@ -72,6 +73,11 @@ ARM_PAL = '    target_vendor = "nonos" => {\n        mod nonos;\n        pub use
 
 insert_before(f"{sysdir}/alloc/mod.rs", '    any(\n        target_family = "unix",', ARM_BARE, 'mod nonos')
 insert_before(f"{sysdir}/io/error/mod.rs", '    target_os = "hermit" => {', ARM, 'target_vendor = "nonos"')
+# IsTerminal: the arm sits inside `mod is_terminal`, one level deeper.
+ARM_TTY = ('        target_vendor = "nonos" => {\n            mod nonos;\n'
+    '            pub use nonos::*;\n        }\n')
+insert_before(f"{sysdir}/io/mod.rs", '        target_os = "hermit" => {\n            mod hermit;', ARM_TTY,
+    'target_vendor = "nonos" => {\n            mod nonos;')
 insert_before(f"{sysdir}/random/mod.rs", '    // Tier 1\n', ARM_FILL, 'target_vendor = "nonos"')
 insert_before(f"{sysdir}/stdio/mod.rs", '    any(target_family = "unix"', ARM, 'target_vendor = "nonos"')
 insert_before(f"{sysdir}/fs/mod.rs", '    any(target_family = "unix", target_os = "wasi") => {', ARM_IMP, 'target_vendor = "nonos"')
diff --git a/toolchain/nonos-std/sys/io/is_terminal/nonos.rs b/toolchain/nonos-std/sys/io/is_terminal/nonos.rs
new file mode 100644
index 000000000..ee68ed84b
--- /dev/null
+++ b/toolchain/nonos-std/sys/io/is_terminal/nonos.rs
@@ -0,0 +1,33 @@
+// NONOS std PAL: IsTerminal asks the kernel (MTTQ) whether this process's
+// stdin, stdout or stderr reaches a terminal. The launcher that renders the
+// process's output says so when it starts it, and says nothing for a stage
+// whose output feeds a pipe or a file, so a program picks colour and columns
+// for a person and plain bytes for a pipe, as it would on any other system.
+
+use crate::os::fd::{AsFd, AsRawFd};
+
+const fn tag4(b: &[u8; 4]) -> i64 {
+    (b[0] as i64) | ((b[1] as i64) << 8) | ((b[2] as i64) << 16) | ((b[3] as i64) << 24)
+}
+
+const N_MK_TTY_QUERY: i64 = tag4(b"MTTQ");
+
+pub fn is_terminal(fd: &impl AsFd) -> bool {
+    let fd = fd.as_fd().as_raw_fd();
+    // Only the three standard streams can reach a terminal; files and
+    // sockets sit in the descriptor table above them.
+    if !(0..=2).contains(&fd) {
+        return false;
+    }
+    let r: i64;
+    unsafe {
+        core::arch::asm!(
+            "syscall",
+            inout("rax") N_MK_TTY_QUERY => r,
+            in("rdi") fd as u64,
+            out("rcx") _,
+            out("r11") _,
+        );
+    }
+    r >= 0
+}
diff --git a/userland/upstream-src/atty-0.2.14/src/lib.rs b/userland/upstream-src/atty-0.2.14/src/lib.rs
index dd8b652cf..9c1554428 100644
--- a/userland/upstream-src/atty-0.2.14/src/lib.rs
+++ b/userland/upstream-src/atty-0.2.14/src/lib.rs
@@ -159,12 +159,17 @@ pub fn is(_stream: Stream) -> bool {
     false
 }
 
-/// returns true if this is a tty. On NONOS a capsule's stdio is wired to the
-/// nox terminal, so it is always a tty and tools enable color and interactive
-/// output.
+/// returns true if this is a tty. On NONOS the kernel knows: the launcher
+/// that renders this process's output says which of its streams reach a
+/// terminal, and a stage feeding a pipe or a file is told it reaches none.
 #[cfg(target_vendor = "nonos")]
-pub fn is(_stream: Stream) -> bool {
-    true
+pub fn is(stream: Stream) -> bool {
+    use std::io::IsTerminal;
+    match stream {
+        Stream::Stdin => std::io::stdin().is_terminal(),
+        Stream::Stdout => std::io::stdout().is_terminal(),
+        Stream::Stderr => std::io::stderr().is_terminal(),
+    }
 }
 
 #[cfg(test)]
diff --git a/userland/upstream-src/is-terminal-0.4.17/src/lib.rs b/userland/upstream-src/is-terminal-0.4.17/src/lib.rs
index bf8dc6bce..4e82d213d 100644
--- a/userland/upstream-src/is-terminal-0.4.17/src/lib.rs
+++ b/userland/upstream-src/is-terminal-0.4.17/src/lib.rs
@@ -101,12 +101,12 @@ impl<Stream: AsFd> IsTerminal for Stream {
             hermit_abi::isatty(self.as_fd().as_fd().as_raw_fd())
         }
 
-        // A NONOS capsule runs attached to the terminal surface it was launched
-        // from, so its standard streams are interactive by construction.
+        // NONOS asks the kernel, through std: the launcher that renders this
+        // process's output says which of its streams reach a terminal, and a
+        // stage feeding a pipe or a file is told it reaches none.
         #[cfg(target_vendor = "nonos")]
         {
-            let _ = self.as_fd();
-            true
+            std::io::IsTerminal::is_terminal(&self.as_fd())
         }
     }
 }
diff --git a/userland/vendor/is-terminal/src/lib.rs b/userland/vendor/is-terminal/src/lib.rs
index e45bf2617..ae0c4e3a7 100644
--- a/userland/vendor/is-terminal/src/lib.rs
+++ b/userland/vendor/is-terminal/src/lib.rs
@@ -99,12 +99,11 @@ impl<Stream: AsFd> IsTerminal for Stream {
             hermit_abi::isatty(self.as_fd().as_fd().as_raw_fd())
         }
 
-        // NONOS stdio is an IPC pipe to the terminal capsule, never a tty;
-        // "not a terminal" (colors off) is the honest headless answer.
+        // NONOS asks the kernel, through std: the launcher that renders this
+        // process's output says which of its streams reach a terminal.
         #[cfg(target_vendor = "nonos")]
         {
-            let _ = self.as_fd();
-            false
+            std::io::IsTerminal::is_terminal(&self.as_fd())
         }
     }
 }

From 5cc7edf58d2a065a98caa6241ecd256f81b744c5 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 14:34:27 +0000
Subject: [PATCH 12/29] toolkit: draw characters the UI face lacks from its
 mono face

Noto Sans has no arrows, no triangles and no not-equal sign, so every app
that printed one showed an empty box. A character the chosen built-in
face lacks is drawn from the other one when that has it, cached under the
face it came from, and measured the same way so layout and paint agree.
Kerning only pairs glyphs of one face.
---
 userland/toolkit/src/font/ttf/draw.rs     | 14 ++---
 userland/toolkit/src/font/ttf/fallback.rs | 65 +++++++++++++++++++++++
 userland/toolkit/src/font/ttf/metrics.rs  |  4 +-
 userland/toolkit/src/font/ttf/mod.rs      |  1 +
 4 files changed, 75 insertions(+), 9 deletions(-)
 create mode 100644 userland/toolkit/src/font/ttf/fallback.rs

diff --git a/userland/toolkit/src/font/ttf/draw.rs b/userland/toolkit/src/font/ttf/draw.rs
index 4419bd3b9..7e2f18f94 100644
--- a/userland/toolkit/src/font/ttf/draw.rs
+++ b/userland/toolkit/src/font/ttf/draw.rs
@@ -46,7 +46,7 @@ pub fn draw_text(
 // screen of crisp text cheap enough to repaint on every keystroke.
 #[allow(clippy::too_many_arguments)]
 fn draw_cached(
-    f: &FontRef,
+    f: &'static FontRef<'static>,
     mono: bool,
     buf: &mut [u32],
     stride: usize,
@@ -58,19 +58,21 @@ fn draw_cached(
     argb: u32,
     px: f32,
 ) -> i32 {
-    let sf = f.as_scaled(PxScale::from(px));
-    let baseline = top_y as f32 + sf.ascent();
+    let baseline = top_y as f32 + f.as_scaled(PxScale::from(px)).ascent();
     let px_bits = px.to_bits();
     let mut pen = x as f32;
-    let mut prev: Option<GlyphId> = None;
+    let mut prev: Option<(bool, GlyphId)> = None;
     for ch in text.chars() {
+        // Drawn from whichever built-in face has the glyph, cached under it.
+        let (mono, gf) = super::fallback::face_for(f, mono, ch);
+        let sf = gf.as_scaled(PxScale::from(px));
         let g = sf.scaled_glyph(ch);
-        if let Some(p) = prev {
+        if let Some((_, p)) = prev.filter(|(pm, _)| *pm == mono) {
             pen += sf.kern(p, g.id);
         }
         let adv = sf.h_advance(g.id);
         let gid = g.id.0;
-        prev = Some(g.id);
+        prev = Some((mono, g.id));
         let pen_i = pen as i32;
         let base_i = baseline as i32;
         cache::with_raster(
diff --git a/userland/toolkit/src/font/ttf/fallback.rs b/userland/toolkit/src/font/ttf/fallback.rs
new file mode 100644
index 000000000..d93bbd601
--- /dev/null
+++ b/userland/toolkit/src/font/ttf/fallback.rs
@@ -0,0 +1,65 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * One built-in face standing in for the other. Noto Sans has no arrows,
+ * no triangles and no not-equal sign; its mono cut has them. A character
+ * the chosen face lacks is drawn from the other rather than as a box,
+ * which reads as a bug in whatever app printed it.
+ */
+
+use ab_glyph::{Font, FontRef, GlyphId, PxScale, ScaleFont};
+
+use super::face::face;
+use super::readable::readable_px;
+
+/// The face that draws `ch`, as (is it the mono face, the face): the one
+/// asked for when it has the glyph, the other when only that one does.
+pub(super) fn face_for(
+    f: &'static FontRef<'static>,
+    mono: bool,
+    ch: char,
+) -> (bool, &'static FontRef<'static>) {
+    if f.glyph_id(ch).0 != 0 {
+        return (mono, f);
+    }
+    match face(!mono) {
+        Some(other) if other.glyph_id(ch).0 != 0 => (!mono, other),
+        _ => (mono, f),
+    }
+}
+
+/*
+ * The advance of `text` in the built-in faces, each glyph measured in the
+ * face that will draw it. Kerning only pairs glyphs of one face.
+ */
+pub fn measure(text: &str, px: f32, mono: bool) -> i32 {
+    let px = readable_px(px);
+    let Some(f) = face(mono) else { return 0 };
+    let mut pen = 0.0f32;
+    let mut prev: Option<(bool, GlyphId)> = None;
+    for ch in text.chars() {
+        let (m, gf) = face_for(f, mono, ch);
+        let sf = gf.as_scaled(PxScale::from(px));
+        let g = sf.glyph_id(ch);
+        if let Some((_, p)) = prev.filter(|(pm, _)| *pm == m) {
+            pen += sf.kern(p, g);
+        }
+        pen += sf.h_advance(g);
+        prev = Some((m, g));
+    }
+    pen as i32
+}
diff --git a/userland/toolkit/src/font/ttf/metrics.rs b/userland/toolkit/src/font/ttf/metrics.rs
index 373c8a222..dd30aee05 100644
--- a/userland/toolkit/src/font/ttf/metrics.rs
+++ b/userland/toolkit/src/font/ttf/metrics.rs
@@ -24,9 +24,7 @@ use super::readable::readable_px;
 // the readable floor, the same clamp draw_text applies, so measured runs match
 // what is painted.
 pub fn measure(text: &str, px: f32, mono: bool) -> i32 {
-    let px = readable_px(px);
-    let Some(f) = face(mono) else { return 0 };
-    measure_with(f, text, px)
+    super::fallback::measure(text, px, mono)
 }
 
 // Same measurement with a caller-provided face, matching draw_text_with.
diff --git a/userland/toolkit/src/font/ttf/mod.rs b/userland/toolkit/src/font/ttf/mod.rs
index fbeb307a4..390268948 100644
--- a/userland/toolkit/src/font/ttf/mod.rs
+++ b/userland/toolkit/src/font/ttf/mod.rs
@@ -23,6 +23,7 @@ mod blend;
 mod cache;
 mod draw;
 mod face;
+mod fallback;
 mod metrics;
 mod readable;
 mod slant;

From c6a4f6a1a4056ec85e4fb92edb227dcc51c79849 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 14:34:28 +0000
Subject: [PATCH 13/29] text_editor: draw folder chevrons in pixels, colour
 only code

The explorer drew its chevrons as characters the UI font does not have,
so every folder showed a box. They are now drawn on the pixel grid. The
code lexer ran over every buffer, so a note coloured `from` as a keyword
and a Markdown heading as a comment; plain text and Markdown are now
left as typed.
---
 .../src/editor/disclosure.rs                  | 38 +++++++++++++++++++
 .../capsule_text_editor/src/editor/edit.rs    |  1 -
 .../src/editor/language.rs                    | 13 +++++++
 .../capsule_text_editor/src/editor/mod.rs     |  1 +
 .../capsule_text_editor/src/editor/paint.rs   |  2 +-
 .../capsule_text_editor/src/editor/sidebar.rs |  3 +-
 6 files changed, 54 insertions(+), 4 deletions(-)
 create mode 100644 userland/capsule_text_editor/src/editor/disclosure.rs

diff --git a/userland/capsule_text_editor/src/editor/disclosure.rs b/userland/capsule_text_editor/src/editor/disclosure.rs
new file mode 100644
index 000000000..ec53f1617
--- /dev/null
+++ b/userland/capsule_text_editor/src/editor/disclosure.rs
@@ -0,0 +1,38 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * The chevron beside a folder, drawn in pixels: a font without the
+ * triangle characters draws them as empty boxes, and a shape this small
+ * reads better on the pixel grid than antialiased at twelve points anyway.
+ */
+
+use nonos_app_skeleton::PaintBuffer;
+
+/// Half the triangle's long side, in pixels.
+const HALF: u32 = 4;
+
+/// A chevron centred on `(cx, cy)`: pointing down when open, right when not.
+pub(super) fn disclosure(fb: &mut PaintBuffer, cx: u32, cy: u32, open: bool, argb: u32) {
+    for i in 0..HALF {
+        let span = 2 * (HALF - i) - 1;
+        if open {
+            fb.fill_rect(cx + 1 + i - HALF, cy + i - HALF / 2, span, 1, argb);
+        } else {
+            fb.fill_rect(cx + i - HALF / 2, cy + 1 + i - HALF, 1, span, argb);
+        }
+    }
+}
diff --git a/userland/capsule_text_editor/src/editor/edit.rs b/userland/capsule_text_editor/src/editor/edit.rs
index 2c87d6793..a0d1c1304 100644
--- a/userland/capsule_text_editor/src/editor/edit.rs
+++ b/userland/capsule_text_editor/src/editor/edit.rs
@@ -33,7 +33,6 @@ pub struct EditOp {
     pub id: u64,
 }
 
-
 impl State {
     /// Replace `buf[at..at+del]` with `ins`, recording an undo step and clearing
     /// the redo stack. Returns false if it would overflow the buffer.
diff --git a/userland/capsule_text_editor/src/editor/language.rs b/userland/capsule_text_editor/src/editor/language.rs
index 641d46fa1..2ef39734e 100644
--- a/userland/capsule_text_editor/src/editor/language.rs
+++ b/userland/capsule_text_editor/src/editor/language.rs
@@ -53,3 +53,16 @@ pub(super) fn language_name(path: &str) -> &'static str {
         _ => "Text",
     }
 }
+
+/*
+ * The colour class of each byte. Only code is lexed: prose is left as
+ * typed, since a word like `from` in a note is not a keyword and a
+ * Markdown heading is not a comment.
+ */
+pub(super) fn tokens(path: &[u8], buf: &[u8]) -> alloc::vec::Vec<super::highlight::Tok> {
+    let path = core::str::from_utf8(path).unwrap_or("");
+    if matches!(language_name(path), "Text" | "Markdown") {
+        return alloc::vec![super::highlight::Tok::Text; buf.len()];
+    }
+    super::highlight::classify(buf)
+}
diff --git a/userland/capsule_text_editor/src/editor/mod.rs b/userland/capsule_text_editor/src/editor/mod.rs
index b8b9ea7d5..61591373b 100644
--- a/userland/capsule_text_editor/src/editor/mod.rs
+++ b/userland/capsule_text_editor/src/editor/mod.rs
@@ -31,6 +31,7 @@ mod ctrl_open;
 mod ctrl_paste;
 mod ctrl_save;
 mod delete;
+mod disclosure;
 mod dismiss;
 mod doc_pos;
 mod edit;
diff --git a/userland/capsule_text_editor/src/editor/paint.rs b/userland/capsule_text_editor/src/editor/paint.rs
index 7ee542723..8a43d6064 100644
--- a/userland/capsule_text_editor/src/editor/paint.rs
+++ b/userland/capsule_text_editor/src/editor/paint.rs
@@ -112,7 +112,7 @@ fn paint_body(state: &State, fb: &mut PaintBuffer, adv: u32) {
     let invisibles = super::settings::live::show_invisibles();
     let px = body_px(state.font_scale);
     let lh = line_height(state.font_scale);
-    let toks = highlight::classify(&state.buf[..state.len]);
+    let toks = super::language::tokens(&state.path[..state.path_len], &state.buf[..state.len]);
     let sel = state.sel_range();
     let text = core::str::from_utf8(&state.buf[..state.len]).unwrap_or("");
     let left = text_left(state.pane_x);
diff --git a/userland/capsule_text_editor/src/editor/sidebar.rs b/userland/capsule_text_editor/src/editor/sidebar.rs
index 4e707564e..e5ddaa2a0 100644
--- a/userland/capsule_text_editor/src/editor/sidebar.rs
+++ b/userland/capsule_text_editor/src/editor/sidebar.rs
@@ -64,8 +64,7 @@ pub(super) fn paint_sidebar(
         let x = ACTIVITY_W + indent;
         if node.is_dir {
             let expanded = tree.expanded.contains(&node.path);
-            let mark = if expanded { "\u{25BE}" } else { "\u{25B8}" };
-            let _ = fb.text_ttf(x as i32, (y + 5) as i32, mark, th.muted, 12.0);
+            super::disclosure::disclosure(fb, x + 4, y + ROW_H / 2, expanded, th.muted);
         }
         let tx = x + 15;
         let color = if node.is_dir { th.folder } else { th.foreground };

From c77637b2eba5df5bdc5eae4c67a5ed0c89adae3b Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 14:34:28 +0000
Subject: [PATCH 14/29] terminal: readline keys, and chords that type nothing

A Ctrl or Alt chord the line editor did not bind fell through to the
printable arm, so Ctrl-F typed an f. Unbound chords are now swallowed,
AltGr excepted since some layouts type characters with it. Ctrl-F and
Ctrl-H step and rub out a character, Ctrl-P and Ctrl-N walk history, and
Alt-B, Alt-F and Alt-D move and cut by word, with Alt-D's cut going to
the ring Ctrl-Y reads. The skeleton exports MOD_ALTGR, which the PS/2
driver already sets. The arrow and page keys move to their own file.
---
 userland/app_skeleton/src/lib.rs              |  2 +-
 userland/capsule_terminal/src/event/mod.rs    |  2 +
 userland/capsule_terminal/src/event/on_key.rs | 28 +++-----
 userland/capsule_terminal/src/event/on_nav.rs | 51 ++++++++++++++
 .../capsule_terminal/src/event/readline.rs    | 62 +++++++++++++++++
 .../src/term/line/delete_word_right.rs        | 43 ++++++++++++
 .../capsule_terminal/src/term/line/mod.rs     |  1 +
 userland/terminal_line_proofs/src/lib.rs      |  2 +
 .../src/word_kill_tests.rs                    | 67 +++++++++++++++++++
 9 files changed, 237 insertions(+), 21 deletions(-)
 create mode 100644 userland/capsule_terminal/src/event/on_nav.rs
 create mode 100644 userland/capsule_terminal/src/event/readline.rs
 create mode 100644 userland/capsule_terminal/src/term/line/delete_word_right.rs
 create mode 100644 userland/terminal_line_proofs/src/word_kill_tests.rs

diff --git a/userland/app_skeleton/src/lib.rs b/userland/app_skeleton/src/lib.rs
index 97ff22bcd..c6ed3d541 100644
--- a/userland/app_skeleton/src/lib.rs
+++ b/userland/app_skeleton/src/lib.rs
@@ -33,7 +33,7 @@ pub use clients::clipboard::{clipboard_copy, clipboard_paste};
 pub use input::{
     InputEvent, InputKind, KEY_BACKSPACE, KEY_DELETE, KEY_DOWN, KEY_END, KEY_ENTER, KEY_ESC,
     KEY_F1, KEY_F12, KEY_HOME, KEY_INSERT, KEY_LEFT, KEY_PAGE_DOWN, KEY_PAGE_UP, KEY_RIGHT,
-    KEY_TAB, KEY_UP, MOD_ALT, MOD_CAPS, MOD_CTRL, MOD_META, MOD_NUM, MOD_SHIFT,
+    KEY_TAB, KEY_UP, MOD_ALT, MOD_ALTGR, MOD_CAPS, MOD_CTRL, MOD_META, MOD_NUM, MOD_SHIFT,
 };
 pub use paint::font_advance;
 pub use paint::PaintBuffer;
diff --git a/userland/capsule_terminal/src/event/mod.rs b/userland/capsule_terminal/src/event/mod.rs
index 1c73669c5..4ef83892d 100644
--- a/userland/capsule_terminal/src/event/mod.rs
+++ b/userland/capsule_terminal/src/event/mod.rs
@@ -34,11 +34,13 @@ mod on_down;
 mod on_enter;
 mod on_event;
 mod on_key;
+mod on_nav;
 mod on_printable;
 mod on_tab;
 mod on_up;
 mod paste_clipboard;
 mod paste_program;
+mod readline;
 pub(crate) mod search;
 pub(crate) mod search_edit;
 mod search_place;
diff --git a/userland/capsule_terminal/src/event/on_key.rs b/userland/capsule_terminal/src/event/on_key.rs
index 91c26d8f9..6eedd3c76 100644
--- a/userland/capsule_terminal/src/event/on_key.rs
+++ b/userland/capsule_terminal/src/event/on_key.rs
@@ -15,8 +15,8 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 use nonos_app_skeleton::{
-    EventOutcome, InputEvent, KEY_BACKSPACE, KEY_DELETE, KEY_DOWN, KEY_END, KEY_ENTER, KEY_ESC,
-    KEY_HOME, KEY_LEFT, KEY_PAGE_DOWN, KEY_PAGE_UP, KEY_RIGHT, KEY_TAB, KEY_UP, MOD_CTRL,
+    EventOutcome, InputEvent, KEY_BACKSPACE, KEY_DELETE, KEY_DOWN, KEY_ENTER, KEY_ESC, KEY_TAB,
+    KEY_UP, MOD_CTRL,
 };
 
 use super::bool_to_outcome::bool_to_outcome;
@@ -37,6 +37,12 @@ pub fn on_key(state: &mut State, event: InputEvent) -> EventOutcome {
             return out;
         }
     }
+    if let Some(out) = super::readline::readline_key(state, event.code, event.flags) {
+        return out;
+    }
+    if let Some(out) = super::on_nav::on_nav(state, event.code) {
+        return out;
+    }
     match event.code {
         // Clears the line. Esc used to close the window, so one stray press
         // took the scrollback, history and working directory with it. Closing
@@ -52,26 +58,8 @@ pub fn on_key(state: &mut State, event: InputEvent) -> EventOutcome {
         }
         KEY_BACKSPACE => bool_to_outcome(state.line.backspace()),
         KEY_DELETE => bool_to_outcome(state.line.delete()),
-        KEY_LEFT => bool_to_outcome(state.line.move_left()),
-        KEY_RIGHT => bool_to_outcome(state.line.move_right()),
-        KEY_HOME => {
-            state.line.move_home();
-            EventOutcome::Repaint
-        }
-        KEY_END => {
-            state.line.move_end();
-            EventOutcome::Repaint
-        }
         KEY_UP => on_up(state),
         KEY_DOWN => on_down(state),
-        KEY_PAGE_UP => {
-            state.scrollback.scroll_up(super::key_first::page(state));
-            EventOutcome::Repaint
-        }
-        KEY_PAGE_DOWN => {
-            state.scrollback.scroll_down(super::key_first::page(state));
-            EventOutcome::Repaint
-        }
         KEY_TAB => on_tab(state),
         code if (0x20..=0x7E).contains(&code) => on_printable(state, code as u8),
         _ => EventOutcome::Idle,
diff --git a/userland/capsule_terminal/src/event/on_nav.rs b/userland/capsule_terminal/src/event/on_nav.rs
new file mode 100644
index 000000000..48e4799fb
--- /dev/null
+++ b/userland/capsule_terminal/src/event/on_nav.rs
@@ -0,0 +1,51 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * Moving along the line and through history: the arrows, Home and End on
+ * the line, Page Up and Page Down on the scrollback.
+ */
+
+use nonos_app_skeleton::{
+    EventOutcome, KEY_END, KEY_HOME, KEY_LEFT, KEY_PAGE_DOWN, KEY_PAGE_UP, KEY_RIGHT,
+};
+
+use super::bool_to_outcome::bool_to_outcome;
+use crate::term::state::State;
+
+pub fn on_nav(state: &mut State, code: u32) -> Option<EventOutcome> {
+    Some(match code {
+        KEY_LEFT => bool_to_outcome(state.line.move_left()),
+        KEY_RIGHT => bool_to_outcome(state.line.move_right()),
+        KEY_HOME => {
+            state.line.move_home();
+            EventOutcome::Repaint
+        }
+        KEY_END => {
+            state.line.move_end();
+            EventOutcome::Repaint
+        }
+        KEY_PAGE_UP => {
+            state.scrollback.scroll_up(super::key_first::page(state));
+            EventOutcome::Repaint
+        }
+        KEY_PAGE_DOWN => {
+            state.scrollback.scroll_down(super::key_first::page(state));
+            EventOutcome::Repaint
+        }
+        _ => return None,
+    })
+}
diff --git a/userland/capsule_terminal/src/event/readline.rs b/userland/capsule_terminal/src/event/readline.rs
new file mode 100644
index 000000000..17625747d
--- /dev/null
+++ b/userland/capsule_terminal/src/event/readline.rs
@@ -0,0 +1,62 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * The readline keys a shell user types without thinking, beyond the ones
+ * on_ctrl owns: Ctrl-F and Ctrl-H step and rub out a character, Ctrl-P and
+ * Ctrl-N walk history, and Alt with B, F and D moves and cuts by word.
+ * Ctrl-B is the rail's, taken before the line sees it.
+ */
+
+use nonos_app_skeleton::{EventOutcome, MOD_ALT, MOD_ALTGR, MOD_CTRL};
+
+use super::bool_to_outcome::bool_to_outcome;
+use crate::term::state::State;
+
+pub fn readline_key(state: &mut State, code: u32, flags: u16) -> Option<EventOutcome> {
+    /* AltGr is how some layouts type characters: a key with it is text. */
+    if flags & MOD_ALTGR != 0 {
+        return None;
+    }
+    let letter = char::from_u32(code)?.to_ascii_lowercase();
+    if flags & MOD_CTRL != 0 {
+        return match letter {
+            'f' => Some(bool_to_outcome(state.line.move_right())),
+            'h' => Some(bool_to_outcome(state.line.backspace())),
+            'p' => Some(super::on_up::on_up(state)),
+            'n' => Some(super::on_down::on_down(state)),
+            _ => unbound(code),
+        };
+    }
+    if flags & MOD_ALT != 0 {
+        return match letter {
+            'b' => Some(bool_to_outcome(state.line.move_word_left())),
+            'f' => Some(bool_to_outcome(state.line.move_word_right())),
+            'd' => Some(bool_to_outcome(state.line.delete_word_right())),
+            _ => unbound(code),
+        };
+    }
+    None
+}
+
+/*
+ * A chord no binding took: typing its letter would put text on the line
+ * that nobody typed, so a printable one is swallowed. Named keys go on to
+ * the line editor, which gives Ctrl-Home and the like their plain meaning.
+ */
+fn unbound(code: u32) -> Option<EventOutcome> {
+    (0x20..=0x7E).contains(&code).then_some(EventOutcome::Idle)
+}
diff --git a/userland/capsule_terminal/src/term/line/delete_word_right.rs b/userland/capsule_terminal/src/term/line/delete_word_right.rs
new file mode 100644
index 000000000..97fee9fa1
--- /dev/null
+++ b/userland/capsule_terminal/src/term/line/delete_word_right.rs
@@ -0,0 +1,43 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+use super::types::Line;
+
+impl Line {
+    /*
+     * Delete the word after the cursor (Alt-D): the run Alt-F would step
+     * over, word first and then the gap, so the two keys agree.
+     */
+    pub fn delete_word_right(&mut self) -> bool {
+        let mut end = self.cursor;
+        while end < self.len && self.buf[end] != b' ' {
+            end += 1;
+        }
+        while end < self.len && self.buf[end] == b' ' {
+            end += 1;
+        }
+        let removed = end - self.cursor;
+        if removed == 0 {
+            return false;
+        }
+        let mut cut = [0u8; super::types::KILL_CAP];
+        cut[..removed].copy_from_slice(&self.buf[self.cursor..end]);
+        self.hold_killed(&cut[..removed]);
+        self.buf.copy_within(end..self.len, self.cursor);
+        self.len -= removed;
+        true
+    }
+}
diff --git a/userland/capsule_terminal/src/term/line/mod.rs b/userland/capsule_terminal/src/term/line/mod.rs
index 2cb1be106..93ce43d4a 100644
--- a/userland/capsule_terminal/src/term/line/mod.rs
+++ b/userland/capsule_terminal/src/term/line/mod.rs
@@ -19,6 +19,7 @@ mod backspace;
 mod clear;
 mod delete;
 mod delete_word;
+mod delete_word_right;
 mod insert;
 mod kill_ring;
 mod kill_to_end;
diff --git a/userland/terminal_line_proofs/src/lib.rs b/userland/terminal_line_proofs/src/lib.rs
index 5409c108c..7cc4259e6 100644
--- a/userland/terminal_line_proofs/src/lib.rs
+++ b/userland/terminal_line_proofs/src/lib.rs
@@ -99,3 +99,5 @@ mod suggest_tests;
 mod tree_tests;
 #[cfg(test)]
 mod usage_tests;
+#[cfg(test)]
+mod word_kill_tests;
diff --git a/userland/terminal_line_proofs/src/word_kill_tests.rs b/userland/terminal_line_proofs/src/word_kill_tests.rs
new file mode 100644
index 000000000..caa345328
--- /dev/null
+++ b/userland/terminal_line_proofs/src/word_kill_tests.rs
@@ -0,0 +1,67 @@
+// NONOS Operating System (AGPL-3.0-or-later)
+/*
+ * Alt-D, the forward twin of Ctrl-W: it cuts what Alt-F would step over,
+ * and what it cut comes back with Ctrl-Y.
+ */
+
+use crate::line::Line;
+
+fn typed(s: &str) -> Line {
+    let mut l = Line::new();
+    for b in s.bytes() {
+        l.insert(b);
+    }
+    l
+}
+
+fn text(l: &Line) -> String {
+    String::from_utf8(l.as_bytes().to_vec()).unwrap()
+}
+
+#[test]
+fn alt_d_cuts_the_word_and_its_gap() {
+    let mut l = typed("git push origin main");
+    l.move_home();
+    l.move_word_right();
+    assert!(l.delete_word_right());
+    assert_eq!(text(&l), "git origin main");
+    assert_eq!(l.cursor, 4);
+}
+
+#[test]
+fn alt_d_agrees_with_alt_f() {
+    let mut a = typed("ls -la /data");
+    a.move_home();
+    let mut b = typed("ls -la /data");
+    b.move_home();
+    b.move_word_right();
+    assert!(a.delete_word_right());
+    assert_eq!(text(&a).len(), "ls -la /data".len() - b.cursor);
+}
+
+#[test]
+fn alt_d_at_the_end_does_nothing() {
+    let mut l = typed("echo hi");
+    assert!(!l.delete_word_right());
+    assert_eq!(text(&l), "echo hi");
+}
+
+#[test]
+fn what_alt_d_cut_yanks_back() {
+    let mut l = typed("rm -rf /tmp/x");
+    l.move_home();
+    assert!(l.delete_word_right());
+    assert_eq!(text(&l), "-rf /tmp/x");
+    assert!(l.yank());
+    assert_eq!(text(&l), "rm -rf /tmp/x");
+}
+
+#[test]
+fn alt_d_mid_word_cuts_its_tail() {
+    let mut l = typed("cargo build");
+    l.move_home();
+    l.move_right();
+    l.move_right();
+    assert!(l.delete_word_right());
+    assert_eq!(text(&l), "cabuild");
+}

From ca9184269a95a282ac6876e2eed90e60231cc57d Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 14:34:28 +0000
Subject: [PATCH 15/29] terminal: help that fits 80 columns and names every key

The help tests parsed writeln calls that the table-driven help no longer
makes, so they read three rows and failed. The tables and row layout now
live in a file the proofs include, and the tests render every row the
terminal prints. That found the files and system rows at 82 and 85
columns; they are regrouped into files, disk, text, system and session.
The tools row names each program once. help keys now covers selection,
the clipboard, search and the readline keys.
---
 .../src/command/builtin/help.rs               | 27 ++-------
 .../src/command/builtin/help_layout.rs        | 56 +++++++++++++++++++
 .../src/command/builtin/help_pages.rs         | 12 ++--
 .../src/command/builtin/help_tools.rs         | 15 +----
 .../src/command/builtin/mod.rs                |  2 +
 .../src/command/builtin/tool_list.rs          | 45 +++++++++++++++
 .../terminal_line_proofs/src/help_rows.rs     | 50 +++++++++++++++++
 .../terminal_line_proofs/src/help_tests.rs    | 46 +++++++++++++++
 userland/terminal_line_proofs/src/lib.rs      | 12 ++++
 .../terminal_line_proofs/src/usage_tests.rs   | 42 --------------
 10 files changed, 227 insertions(+), 80 deletions(-)
 create mode 100644 userland/capsule_terminal/src/command/builtin/help_layout.rs
 create mode 100644 userland/capsule_terminal/src/command/builtin/tool_list.rs
 create mode 100644 userland/terminal_line_proofs/src/help_rows.rs
 create mode 100644 userland/terminal_line_proofs/src/help_tests.rs

diff --git a/userland/capsule_terminal/src/command/builtin/help.rs b/userland/capsule_terminal/src/command/builtin/help.rs
index 8b5be463e..062fe627c 100644
--- a/userland/capsule_terminal/src/command/builtin/help.rs
+++ b/userland/capsule_terminal/src/command/builtin/help.rs
@@ -20,30 +20,18 @@
 
 use crate::command::output::Output;
 
-const GROUPS: &[(&[u8], &[u8])] = &[
-    (b"files", b"ls  tree  cat  cd  pwd  mkdir  touch  rm  rmdir  mv  cp  stat  find  du"),
-    (b"text", b"head  tail  grep  wc  echo  sort  uniq  cut  nl  tac  rev"),
-    (b"system", b"capsules  service  ps  kill  sys  id  whoami  date  uptime  battery  about"),
-    (b"net", b"ping  ifconfig  nslookup  curl  nym"),
-    (b"apps", b"market  install  pkg  git  nox"),
-];
-
-const DEEPER: &[(&[u8], &[u8])] = &[
-    (b"help keys", b"editing, history, tabs and view keys"),
-    (b"help shell", b"pipes, redirects, jobs and aliases"),
-    (b"help <cmd>", b"what one command takes"),
-];
+use super::help_layout::{plain_row, DEEPER, DEEPER_PAD, GROUPS, GROUP_PAD, INTRO, PAGE_PAD};
 
 pub fn run(out: &mut Output<'_>) {
-    out.writeln(b"Type a command and press Enter. Tab completes.");
+    out.writeln(INTRO);
     out.writeln(b"");
     for (name, list) in GROUPS {
-        row(out, name, list, 9);
+        row(out, name, list, GROUP_PAD);
     }
     super::help_tools::tools(out);
     out.writeln(b"");
     for (name, what) in DEEPER {
-        row(out, name, what, 13);
+        row(out, name, what, DEEPER_PAD);
     }
 }
 
@@ -55,17 +43,14 @@ pub fn topic(out: &mut Output<'_>, name: &[u8]) -> bool {
         _ => return false,
     };
     for (name, what) in lines {
-        row(out, name, what, 10);
+        row(out, name, what, PAGE_PAD);
     }
     true
 }
 
 /// A label in the accent colour, padded to `pad`, then the text.
 pub(super) fn row(out: &mut Output<'_>, name: &[u8], text: &[u8], pad: usize) {
-    let mut plain = alloc::vec![b' '; 2];
-    plain.extend_from_slice(name);
-    plain.resize(2 + pad.max(name.len() + 1), b' ');
-    plain.extend_from_slice(text);
+    let plain = plain_row(name, text, pad);
     let mut styled = alloc::vec::Vec::with_capacity(plain.len() + 12);
     styled.extend_from_slice(b"  \x1b[36m");
     styled.extend_from_slice(name);
diff --git a/userland/capsule_terminal/src/command/builtin/help_layout.rs b/userland/capsule_terminal/src/command/builtin/help_layout.rs
new file mode 100644
index 000000000..26d4c0122
--- /dev/null
+++ b/userland/capsule_terminal/src/command/builtin/help_layout.rs
@@ -0,0 +1,56 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * What `help` shows and how its rows are laid out, with nothing else in the
+ * file, so the proofs render the same rows the terminal prints.
+ */
+
+use alloc::vec::Vec;
+
+/// The width `help` has to fit: what every terminal opens at.
+pub const WIDTH: usize = 80;
+/// Where the text column starts, after the label, in each table.
+pub const GROUP_PAD: usize = 9;
+pub const DEEPER_PAD: usize = 13;
+pub const PAGE_PAD: usize = 10;
+
+pub const INTRO: &[u8] = b"Type a command and press Enter. Tab completes.";
+
+pub const GROUPS: &[(&[u8], &[u8])] = &[
+    (b"files", b"ls  tree  cat  cd  pwd  mkdir  touch  rm  rmdir  mv  cp"),
+    (b"disk", b"stat  find  du"),
+    (b"text", b"head  tail  grep  wc  echo  sort  uniq  cut  nl  tac  rev"),
+    (b"system", b"capsules  service  ps  kill  sys  battery  about"),
+    (b"session", b"id  whoami  date  uptime"),
+    (b"net", b"ping  ifconfig  nslookup  curl  nym"),
+    (b"apps", b"market  install  pkg  git  nox"),
+];
+
+pub const DEEPER: &[(&[u8], &[u8])] = &[
+    (b"help keys", b"editing, history, tabs, selection and search keys"),
+    (b"help shell", b"pipes, redirects, jobs and aliases"),
+    (b"help <cmd>", b"what one command takes"),
+];
+
+/// A row as plain text: indent, the label padded to `pad`, then the text.
+pub fn plain_row(name: &[u8], text: &[u8], pad: usize) -> Vec<u8> {
+    let mut plain = alloc::vec![b' '; 2];
+    plain.extend_from_slice(name);
+    plain.resize(2 + pad.max(name.len() + 1), b' ');
+    plain.extend_from_slice(text);
+    plain
+}
diff --git a/userland/capsule_terminal/src/command/builtin/help_pages.rs b/userland/capsule_terminal/src/command/builtin/help_pages.rs
index 11be51125..0d22754d5 100644
--- a/userland/capsule_terminal/src/command/builtin/help_pages.rs
+++ b/userland/capsule_terminal/src/command/builtin/help_pages.rs
@@ -16,12 +16,16 @@
 
 //! The deeper help pages: keys and shell syntax.
 
-pub const KEYS: [(&[u8], &[u8]); 8] = [
-    (b"move", b"Ctrl-A start   Ctrl-E end   Ctrl-Left/Right by word"),
-    (b"cut", b"Ctrl-W word   Ctrl-K to end   Ctrl-U line   Ctrl-Y put back   Ctrl-D delete"),
+pub const KEYS: [(&[u8], &[u8]); 12] = [
+    (b"move", b"Ctrl-A start   Ctrl-E end   Ctrl-F a char   Alt-B/F a word"),
+    (b"cut", b"Ctrl-W word back   Alt-D word on   Ctrl-K to end   Ctrl-U line"),
+    (b"put", b"Ctrl-Y puts back the last cut   Ctrl-D or Ctrl-H delete a character"),
     (b"complete", b"Tab completes a command or a path"),
-    (b"recall", b"Up/Down walk history   Ctrl-R search it   Ctrl-C abandon the line"),
+    (b"recall", b"Up/Down or Ctrl-P/N walk history   Ctrl-R search it   Ctrl-C abandon"),
     (b"history", b"!! the last command   !n the nth   !text the last starting with text"),
+    (b"select", b"drag   double-click a word   triple-click a line   Alt+drag a block"),
+    (b"clipboard", b"Ctrl+Shift+C copy the selection   Ctrl+Shift+V paste"),
+    (b"search", b"Ctrl+Shift+F find in scrollback   Enter older   Shift+Enter newer"),
     (b"tabs", b"Ctrl+Shift+T new   Ctrl+Shift+W close   Ctrl+PgUp/PgDn switch"),
     (b"view", b"Ctrl-B side rail   Ctrl+= / Ctrl+- font size   Ctrl-L clear"),
     (b"theme", b"theme or profile to change colours"),
diff --git a/userland/capsule_terminal/src/command/builtin/help_tools.rs b/userland/capsule_terminal/src/command/builtin/help_tools.rs
index 558343920..3bc3af259 100644
--- a/userland/capsule_terminal/src/command/builtin/help_tools.rs
+++ b/userland/capsule_terminal/src/command/builtin/help_tools.rs
@@ -25,17 +25,6 @@ use crate::command::output::Output;
 /// nothing else on screen says they exist, and a tool nobody can discover may
 /// as well not be installed.
 pub fn tools(out: &mut Output<'_>) {
-    let mut list = alloc::vec::Vec::with_capacity(96);
-    for (typed, _) in super::tool::TOOLS {
-        // Two spaces between names, matching the groups above. A name that
-        // would not fit is dropped rather than wrapped: the list is a pointer
-        // to what exists, not the manual.
-        if list.len() + typed.len() + 2 > 84 {
-            break;
-        }
-        list.extend_from_slice(typed);
-        list.extend_from_slice(b"  ");
-    }
-    // Styled and aligned like every other group.
-    super::help::row(out, b"tools", &list, 9);
+    let list = super::tool_list::tool_list(super::tool::TOOLS);
+    super::help::row(out, b"tools", &list, super::help_layout::GROUP_PAD);
 }
diff --git a/userland/capsule_terminal/src/command/builtin/mod.rs b/userland/capsule_terminal/src/command/builtin/mod.rs
index 6246b43d9..d617e4b3f 100644
--- a/userland/capsule_terminal/src/command/builtin/mod.rs
+++ b/userland/capsule_terminal/src/command/builtin/mod.rs
@@ -25,6 +25,7 @@ pub mod exit_check;
 pub mod fs;
 pub mod git;
 pub mod help;
+mod help_layout;
 pub mod help_one;
 mod help_pages;
 mod help_tools;
@@ -39,6 +40,7 @@ pub mod receipt;
 pub mod service;
 pub mod theme;
 pub mod tool;
+mod tool_list;
 pub mod version;
 pub mod which;
 pub mod whoami;
diff --git a/userland/capsule_terminal/src/command/builtin/tool_list.rs b/userland/capsule_terminal/src/command/builtin/tool_list.rs
new file mode 100644
index 000000000..f9bf93078
--- /dev/null
+++ b/userland/capsule_terminal/src/command/builtin/tool_list.rs
@@ -0,0 +1,45 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The tools row of `help`, kept apart from the tool table that spawns them
+//! so the proofs can build it.
+
+use alloc::vec::Vec;
+
+use super::help_layout::{GROUP_PAD, WIDTH};
+
+/*
+ * The tools, one name for each: two names for one service run the same
+ * program, and listing both says there are two. A name that would push
+ * the row past the width is left out rather than wrapped; the list points
+ * at what exists.
+ */
+pub fn tool_list(tools: &[(&[u8], &[u8])]) -> Vec<u8> {
+    let room = WIDTH - 2 - GROUP_PAD;
+    let mut list: Vec<u8> = Vec::with_capacity(room);
+    for (i, (typed, service)) in tools.iter().enumerate() {
+        if tools[..i].iter().any(|(_, s)| s == service) {
+            continue;
+        }
+        let gap = if list.is_empty() { 0 } else { 2 };
+        if list.len() + gap + typed.len() > room {
+            break;
+        }
+        list.resize(list.len() + gap, b' ');
+        list.extend_from_slice(typed);
+    }
+    list
+}
diff --git a/userland/terminal_line_proofs/src/help_rows.rs b/userland/terminal_line_proofs/src/help_rows.rs
new file mode 100644
index 000000000..02f1c2d7f
--- /dev/null
+++ b/userland/terminal_line_proofs/src/help_rows.rs
@@ -0,0 +1,50 @@
+// NONOS Operating System (AGPL-3.0-or-later)
+/*
+ * The rows `help` prints, rendered by the terminal's own layout code from
+ * its own tables, so the tests read what a user sees.
+ */
+
+/*
+ * The tool table, read from the file that runs the tools: that file spawns
+ * processes, so it is parsed rather than compiled here.
+ */
+pub fn tool_table() -> Vec<(Vec<u8>, Vec<u8>)> {
+    let src = include_str!("../../capsule_terminal/src/command/builtin/tool.rs");
+    let mut out = Vec::new();
+    for line in src.lines() {
+        let Some(rest) = line.trim().strip_prefix("(b\"") else { continue };
+        let Some((typed, rest)) = rest.split_once("\", b\"") else { continue };
+        let Some((service, _)) = rest.split_once('"') else { continue };
+        out.push((typed.as_bytes().to_vec(), service.as_bytes().to_vec()));
+    }
+    out
+}
+
+/*
+ * Every table of rows `help` prints, each laid out by the function the
+ * terminal lays it out with, as (the table's name, its rows).
+ */
+pub fn help_tables() -> Vec<(&'static str, Vec<String>)> {
+    use crate::help_layout::*;
+    let render = |rows: &[(&[u8], &[u8])], pad| -> Vec<String> {
+        rows.iter().map(|(n, t)| String::from_utf8(plain_row(n, t, pad)).unwrap()).collect()
+    };
+    let owned = tool_table();
+    let tools: Vec<(&[u8], &[u8])> =
+        owned.iter().map(|(a, b)| (a.as_slice(), b.as_slice())).collect();
+    let list = crate::tool_list::tool_list(&tools);
+    let mut groups: Vec<(&[u8], &[u8])> = GROUPS.to_vec();
+    groups.push((b"tools", &list));
+    vec![
+        ("groups", render(&groups, GROUP_PAD)),
+        ("deeper", render(DEEPER, DEEPER_PAD)),
+        ("keys", render(&crate::help_pages::KEYS, PAGE_PAD)),
+        ("shell", render(&crate::help_pages::SHELL, PAGE_PAD)),
+    ]
+}
+
+pub fn help_rows() -> Vec<String> {
+    let mut rows = vec![String::from_utf8(crate::help_layout::INTRO.to_vec()).unwrap()];
+    rows.extend(help_tables().into_iter().flat_map(|(_, r)| r));
+    rows
+}
diff --git a/userland/terminal_line_proofs/src/help_tests.rs b/userland/terminal_line_proofs/src/help_tests.rs
new file mode 100644
index 000000000..4950d3cf4
--- /dev/null
+++ b/userland/terminal_line_proofs/src/help_tests.rs
@@ -0,0 +1,46 @@
+// NONOS Operating System (AGPL-3.0-or-later)
+//! `help` as it renders: its width, its columns, and the tools it names.
+
+use crate::help_rows::{help_rows, help_tables};
+
+/// `help` is the first thing anyone runs. A row wider than the terminal wraps,
+/// the columns stop lining up, and the screen that is supposed to orient a new
+/// reader is the one that looks broken.
+/// Eighty columns, not the 96-column buffer.
+///
+/// This test used to assert against `COLS`, the width of the line buffer, and
+/// passed while `help` was visibly clipped in a default window. The buffer is
+/// not the viewport. Eighty is the width every terminal has defaulted to for
+/// forty years and the one the window manifest now opens at.
+#[test]
+fn no_help_row_is_wider_than_the_terminal() {
+    const COLS: usize = 80;
+    let rows = help_rows();
+    assert!(rows.len() >= 15, "only parsed {} help rows", rows.len());
+    for row in rows {
+        assert!(row.len() <= COLS, "{} cols: {row:?}", row.len());
+    }
+}
+
+/*
+ * Each row is a label under the same indent with its text in one column
+ * down the table. A row whose text starts somewhere else is a row nobody
+ * can scan.
+ */
+#[test]
+fn every_help_row_is_a_label_or_a_continuation() {
+    for (table, rows) in help_tables() {
+        let column = |r: &str| {
+            let after = r[2..].find(' ').map(|i| i + 2).unwrap_or(r.len());
+            after + r[after..].len() - r[after..].trim_start().len()
+        };
+        let first = column(&rows[0]);
+        for row in &rows {
+            assert!(
+                row.starts_with("  ") && row[2..].starts_with(|c: char| c.is_ascii_lowercase()),
+                "{table}: unlabelled row {row:?}"
+            );
+            assert_eq!(column(row), first, "{table}: text out of column in {row:?}");
+        }
+    }
+}
diff --git a/userland/terminal_line_proofs/src/lib.rs b/userland/terminal_line_proofs/src/lib.rs
index 7cc4259e6..44071ac06 100644
--- a/userland/terminal_line_proofs/src/lib.rs
+++ b/userland/terminal_line_proofs/src/lib.rs
@@ -77,6 +77,14 @@ pub mod cooked_kill;
 #[path = "../../capsule_terminal/src/term/select.rs"]
 pub mod select;
 
+// What `help` prints and how its rows are laid out.
+#[path = "../../capsule_terminal/src/command/builtin/help_layout.rs"]
+pub mod help_layout;
+#[path = "../../capsule_terminal/src/command/builtin/help_pages.rs"]
+pub mod help_pages;
+#[path = "../../capsule_terminal/src/command/builtin/tool_list.rs"]
+pub mod tool_list;
+
 #[cfg(test)]
 mod cadence_tests;
 #[cfg(test)]
@@ -90,6 +98,10 @@ mod goto_tests;
 #[cfg(test)]
 mod grep_paint_tests;
 #[cfg(test)]
+mod help_rows;
+#[cfg(test)]
+mod help_tests;
+#[cfg(test)]
 mod line_tests;
 #[cfg(test)]
 mod quick_open_tests;
diff --git a/userland/terminal_line_proofs/src/usage_tests.rs b/userland/terminal_line_proofs/src/usage_tests.rs
index fc42494da..48e1aa1c9 100644
--- a/userland/terminal_line_proofs/src/usage_tests.rs
+++ b/userland/terminal_line_proofs/src/usage_tests.rs
@@ -70,48 +70,6 @@ fn nothing_overflows_the_terminal_width() {
     }
 }
 
-/// Every row of the grouped `help` output, read from its source.
-fn help_rows() -> Vec<String> {
-    let src = include_str!("../../capsule_terminal/src/command/builtin/help.rs");
-    let mut out = Vec::new();
-    for line in src.lines() {
-        let Some(rest) = line.trim().strip_prefix("out.writeln(b\"") else { continue };
-        let Some((body, _)) = rest.rsplit_once("\")") else { continue };
-        out.push(body.trim_end_matches('"').to_string());
-    }
-    out
-}
-
-/// `help` is the first thing anyone runs. A row wider than the terminal wraps,
-/// the columns stop lining up, and the screen that is supposed to orient a new
-/// reader is the one that looks broken.
-/// Eighty columns, not the 96-column buffer.
-///
-/// This test used to assert against `COLS`, the width of the line buffer, and
-/// passed while `help` was visibly clipped in a default window. The buffer is
-/// not the viewport. Eighty is the width every terminal has defaulted to for
-/// forty years and the one the window manifest now opens at.
-#[test]
-fn no_help_row_is_wider_than_the_terminal() {
-    const COLS: usize = 80;
-    let rows = help_rows();
-    assert!(rows.len() >= 15, "only parsed {} help rows", rows.len());
-    for row in rows {
-        assert!(row.len() <= COLS, "{} cols: {row:?}", row.len());
-    }
-}
-
-/// Each group is introduced by a label in the first column and continued by
-/// indented rows. A row that is neither is a row nobody can scan.
-#[test]
-fn every_help_row_is_a_label_or_a_continuation() {
-    for row in help_rows() {
-        let labelled = row.starts_with(|c: char| c.is_ascii_lowercase());
-        let continued = row.starts_with("         ");
-        assert!(labelled || continued, "unaligned help row: {row:?}");
-    }
-}
-
 /// Every name the dispatcher answers to, read from its match arms.
 fn dispatched_names() -> Vec<String> {
     let src = include_str!("../../capsule_terminal/src/command/dispatch/exec.rs");

From c2f4fe8d3195ada1b456af75bf8265fccb22ac76 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 14:34:29 +0000
Subject: [PATCH 16/29] terminal: drop rg, which no build registers, and name
 refusals

rg and ripgrep mapped to tool.ripgrep, which the kernel's tool registry
has never held: the ripgrep capsule is a boot-time service MkToolRun
cannot reach. Typing either printed "tool: launch failed" in every
build. A proof now checks each tool the terminal offers against
apps.list, and a refused launch names the tool and says whether it is
missing from the build or was refused.
---
 .../src/command/builtin/mod.rs                |  1 +
 .../src/command/builtin/tool.rs               | 17 +++-----
 .../src/command/builtin/tool_refused.rs       | 33 ++++++++++++++
 userland/terminal_line_proofs/src/lib.rs      |  2 +
 .../terminal_line_proofs/src/tool_tests.rs    | 43 +++++++++++++++++++
 5 files changed, 85 insertions(+), 11 deletions(-)
 create mode 100644 userland/capsule_terminal/src/command/builtin/tool_refused.rs
 create mode 100644 userland/terminal_line_proofs/src/tool_tests.rs

diff --git a/userland/capsule_terminal/src/command/builtin/mod.rs b/userland/capsule_terminal/src/command/builtin/mod.rs
index d617e4b3f..29368e780 100644
--- a/userland/capsule_terminal/src/command/builtin/mod.rs
+++ b/userland/capsule_terminal/src/command/builtin/mod.rs
@@ -41,6 +41,7 @@ pub mod service;
 pub mod theme;
 pub mod tool;
 mod tool_list;
+mod tool_refused;
 pub mod version;
 pub mod which;
 pub mod whoami;
diff --git a/userland/capsule_terminal/src/command/builtin/tool.rs b/userland/capsule_terminal/src/command/builtin/tool.rs
index 3574506e3..864405f58 100644
--- a/userland/capsule_terminal/src/command/builtin/tool.rs
+++ b/userland/capsule_terminal/src/command/builtin/tool.rs
@@ -15,13 +15,11 @@ use crate::term::state::State;
 
 /// The installed command-line tools: what you type, and the service it runs.
 ///
-/// The two are not always the same word. ripgrep installs as `rg`, which is the
-/// name its users have in their fingers, while its capsule serves
-/// `tool.ripgrep`. Mapping the pair here lets a tool keep the name it is known
-/// by without renaming its service, and both spellings can reach it.
-///
-/// Kept in step with `userland/apps.list` and the std tool capsules the desktop
-/// profile bakes.
+/// The typed name comes first because it need not be the service's: a tool
+/// can keep the name its users have in their fingers without renaming its
+/// capsule. Every service here is one `userland/apps.list` registers, which
+/// terminal_line_proofs checks, so a name on this list always has a program
+/// behind it.
 pub const TOOLS: &[(&[u8], &[u8])] = &[
     (b"grex", b"grex"),
     (b"dotenv-linter", b"dotenv-linter"),
@@ -30,8 +28,6 @@ pub const TOOLS: &[(&[u8], &[u8])] = &[
     (b"tokei", b"tokei"),
     (b"huniq", b"huniq"),
     (b"csview", b"csview"),
-    (b"rg", b"ripgrep"),
-    (b"ripgrep", b"ripgrep"),
 ];
 
 // `install` is absent for the same reason as `sd`: the builtin that installs
@@ -65,8 +61,7 @@ pub fn prepare(state: &mut State, args: &[&[u8]]) -> Option<InstallJob> {
     let argv = argv_blob(args);
     let rc = mk_tool_run(&service, &argv);
     if rc < 0 {
-        state.scrollback.push_error(b"tool: launch failed");
-        state.last_status = 1;
+        super::tool_refused::refused(state, name, rc);
         return None;
     }
     Some(InstallJob::new(rc as u32))
diff --git a/userland/capsule_terminal/src/command/builtin/tool_refused.rs b/userland/capsule_terminal/src/command/builtin/tool_refused.rs
new file mode 100644
index 000000000..2907ddd75
--- /dev/null
+++ b/userland/capsule_terminal/src/command/builtin/tool_refused.rs
@@ -0,0 +1,33 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! What the terminal says when the kernel will not start a tool.
+
+use crate::term::state::State;
+
+const ERRNO_NOENT: i64 = -2;
+
+/// Which tool the kernel would not start, and why, in its own words.
+pub fn refused(state: &mut State, name: &[u8], rc: i64) {
+    let why: &[u8] = match rc {
+        ERRNO_NOENT => b": not installed in this build",
+        _ => b": the kernel refused to start it",
+    };
+    let mut line = name.to_vec();
+    line.extend_from_slice(why);
+    state.scrollback.push_error(&line);
+    state.last_status = 1;
+}
diff --git a/userland/terminal_line_proofs/src/lib.rs b/userland/terminal_line_proofs/src/lib.rs
index 44071ac06..1fd024e26 100644
--- a/userland/terminal_line_proofs/src/lib.rs
+++ b/userland/terminal_line_proofs/src/lib.rs
@@ -108,6 +108,8 @@ mod quick_open_tests;
 #[cfg(test)]
 mod suggest_tests;
 #[cfg(test)]
+mod tool_tests;
+#[cfg(test)]
 mod tree_tests;
 #[cfg(test)]
 mod usage_tests;
diff --git a/userland/terminal_line_proofs/src/tool_tests.rs b/userland/terminal_line_proofs/src/tool_tests.rs
new file mode 100644
index 000000000..1171962f8
--- /dev/null
+++ b/userland/terminal_line_proofs/src/tool_tests.rs
@@ -0,0 +1,43 @@
+// NONOS Operating System (AGPL-3.0-or-later)
+//! The tools the terminal offers by name, against what the kernel runs.
+
+use crate::help_rows::{help_tables, tool_table};
+
+/*
+ * Every tool the terminal offers is one the kernel registers. The kernel's
+ * list is generated from apps.list, so a service missing there is a name
+ * that answers "not installed" in every build.
+ */
+#[test]
+fn every_tool_the_terminal_offers_is_registered() {
+    let apps = include_str!("../../apps.list");
+    let registered: Vec<&str> = apps
+        .lines()
+        .filter(|l| !l.trim_start().starts_with('#'))
+        .filter_map(|l| l.split_whitespace().next())
+        .collect();
+    let tools = tool_table();
+    assert!(!tools.is_empty(), "parsed no tools");
+    for (typed, service) in tools {
+        let service = String::from_utf8(service).unwrap();
+        let typed = String::from_utf8(typed).unwrap();
+        assert!(
+            registered.contains(&service.as_str()),
+            "{typed} runs tool.{service}, which apps.list does not register"
+        );
+    }
+}
+
+/// The tools row names each program once, however many names it answers to.
+#[test]
+fn the_tools_row_names_each_program_once() {
+    use crate::tool_list::tool_list;
+    let tools: [(&[u8], &[u8]); 3] =
+        [(b"rg", b"ripgrep"), (b"ripgrep", b"ripgrep"), (b"fd", b"fd")];
+    assert_eq!(tool_list(&tools), b"rg  fd".to_vec());
+    let row = help_tables()[0].1.last().unwrap().clone();
+    let mut names: Vec<&str> = row.split_whitespace().skip(1).collect();
+    let n = names.len();
+    names.dedup();
+    assert!(n >= 5 && names.len() == n, "{row:?}");
+}

From 6ac5bb8a0618d47e47b5646d77e4f982ab549a60 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 14:34:29 +0000
Subject: [PATCH 17/29] terminal: start a selection from the margin around the
 text

A press a few pixels left of the first column landed outside the cell
grid and started nothing. The hit area now takes in the margin painted
around the text, and the column clamps to the edge cell. The pixel to
cell maths moves to its own file.
---
 .../src/term/terminal/app_impl_paint.rs       |  1 +
 .../src/term/terminal/pointer/cells.rs        | 40 ++++----------
 .../src/term/terminal/pointer/cells_hit.rs    | 55 +++++++++++++++++++
 .../src/term/terminal/pointer/mod.rs          |  1 +
 4 files changed, 68 insertions(+), 29 deletions(-)
 create mode 100644 userland/capsule_terminal/src/term/terminal/pointer/cells_hit.rs

diff --git a/userland/capsule_terminal/src/term/terminal/app_impl_paint.rs b/userland/capsule_terminal/src/term/terminal/app_impl_paint.rs
index 7531269e6..68516dca7 100644
--- a/userland/capsule_terminal/src/term/terminal/app_impl_paint.rs
+++ b/userland/capsule_terminal/src/term/terminal/app_impl_paint.rs
@@ -55,6 +55,7 @@ impl Terminal {
             y: l.body.y,
             adv: m.adv,
             lh: m.lh,
+            pad: crate::paint::TEXT_LEFT,
             shell_rows: (l.body.h / m.lh.max(1)) as usize,
             owned,
         });
diff --git a/userland/capsule_terminal/src/term/terminal/pointer/cells.rs b/userland/capsule_terminal/src/term/terminal/pointer/cells.rs
index 73338a349..4bb0977bb 100644
--- a/userland/capsule_terminal/src/term/terminal/pointer/cells.rs
+++ b/userland/capsule_terminal/src/term/terminal/pointer/cells.rs
@@ -17,7 +17,7 @@
 //! Where the body's cells were drawn in the last paint, so a pointer event
 //! can be read back as a cell and a line.
 
-use nonos_vt::{Pos, Term};
+use nonos_vt::Term;
 
 use crate::paint::Rows;
 
@@ -27,12 +27,22 @@ pub struct CellGeom {
     pub y: u32,
     pub adv: u32,
     pub lh: u32,
+    /// The margin drawn around the text, which a press may land in.
+    pub pad: u32,
     /// Rows of the body a shell drawing uses; the screen owns all rows.
     pub shell_rows: usize,
     pub owned: bool,
 }
 
 impl CellGeom {
+    pub(super) fn body_rows(&self, vt: &Term) -> usize {
+        if self.owned {
+            vt.rows()
+        } else {
+            self.shell_rows
+        }
+    }
+
     pub fn rows(&self, vt: &Term) -> Rows {
         if self.owned {
             Rows::Screen
@@ -40,32 +50,4 @@ impl CellGeom {
             Rows::Shell { rows: self.shell_rows, back: vt.view_offset() }
         }
     }
-
-    /// The cell under `(px, py)`, clamped to the screen, and the row it is.
-    pub fn cell_at(&self, vt: &Term, px: i32, py: i32) -> (usize, usize) {
-        let col = ((px - self.x as i32).max(0) as u32 / self.adv.max(1)) as usize;
-        let row = ((py - self.y as i32).max(0) as u32 / self.lh.max(1)) as usize;
-        let max_row = if self.owned { vt.rows() } else { self.shell_rows };
-        (col.min(vt.cols() - 1), row.min(max_row.saturating_sub(1)))
-    }
-
-    pub fn pos_at(&self, vt: &Term, px: i32, py: i32) -> Pos {
-        let (col, row) = self.cell_at(vt, px, py);
-        let rows = self.rows(vt);
-        let line = match rows {
-            Rows::Screen => vt.abs_of_row(row),
-            Rows::Shell { .. } => rows.first(vt) + row as u64,
-        };
-        Pos { line, col }
-    }
-
-    pub fn inside(&self, vt: &Term, px: i32, py: i32) -> bool {
-        let w = vt.cols() as u32 * self.adv;
-        let rows = if self.owned { vt.rows() } else { self.shell_rows };
-        let h = rows as u32 * self.lh;
-        px >= self.x as i32
-            && py >= self.y as i32
-            && px < (self.x + w) as i32
-            && py < (self.y + h) as i32
-    }
 }
diff --git a/userland/capsule_terminal/src/term/terminal/pointer/cells_hit.rs b/userland/capsule_terminal/src/term/terminal/pointer/cells_hit.rs
new file mode 100644
index 000000000..281cfc859
--- /dev/null
+++ b/userland/capsule_terminal/src/term/terminal/pointer/cells_hit.rs
@@ -0,0 +1,55 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Reading a pointer position back as a cell.
+
+use nonos_vt::{Pos, Term};
+
+use super::cells::CellGeom;
+use crate::paint::Rows;
+
+impl CellGeom {
+    /// The cell under `(px, py)`, clamped to the screen, and the row it is.
+    pub fn cell_at(&self, vt: &Term, px: i32, py: i32) -> (usize, usize) {
+        let col = ((px - self.x as i32).max(0) as u32 / self.adv.max(1)) as usize;
+        let row = ((py - self.y as i32).max(0) as u32 / self.lh.max(1)) as usize;
+        (col.min(vt.cols() - 1), row.min(self.body_rows(vt).saturating_sub(1)))
+    }
+
+    pub fn pos_at(&self, vt: &Term, px: i32, py: i32) -> Pos {
+        let (col, row) = self.cell_at(vt, px, py);
+        let rows = self.rows(vt);
+        let line = match rows {
+            Rows::Screen => vt.abs_of_row(row),
+            Rows::Shell { .. } => rows.first(vt) + row as u64,
+        };
+        Pos { line, col }
+    }
+
+    /*
+     * Over the text or the margin around it: a press a few pixels short of
+     * the first column is aimed at it, and cell_at clamps it there.
+     */
+    pub fn inside(&self, vt: &Term, px: i32, py: i32) -> bool {
+        let w = vt.cols() as u32 * self.adv;
+        let h = self.body_rows(vt) as u32 * self.lh;
+        let left = self.x as i32 - self.pad as i32;
+        px >= left
+            && py >= self.y as i32
+            && px < (self.x + w + self.pad) as i32
+            && py < (self.y + h) as i32
+    }
+}
diff --git a/userland/capsule_terminal/src/term/terminal/pointer/mod.rs b/userland/capsule_terminal/src/term/terminal/pointer/mod.rs
index 6cacbb244..fb0184752 100644
--- a/userland/capsule_terminal/src/term/terminal/pointer/mod.rs
+++ b/userland/capsule_terminal/src/term/terminal/pointer/mod.rs
@@ -18,6 +18,7 @@
 //! for them, mouse reports. Shift held selects even then, as xterm does.
 
 mod cells;
+mod cells_hit;
 mod press;
 mod report;
 mod select;

From 69bb50b65ace35e52818467e6dcc91f7783d6084 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 14:34:29 +0000
Subject: [PATCH 18/29] terminal: tell the programs it shows that they reach a
 screen

A tool, store tool or exec'd program whose output this terminal renders
is told, through MTTY, that its three standard streams reach a terminal
of the current size, so it chooses colour and columns for a person. A
pipeline stage or redirected command is never told and writes plain
bytes. When the window resizes, the program in front is told the new
size.
---
 .../src/command/builtin/nox/exec.rs           |  1 +
 .../src/command/builtin/nox/install/job.rs    |  2 +-
 .../src/command/builtin/nox/install/run.rs    |  1 +
 .../src/command/builtin/tool.rs               |  1 +
 userland/capsule_terminal/src/jobs/mod.rs     |  1 +
 userland/capsule_terminal/src/jobs/tty.rs     | 46 +++++++++++++++++++
 .../src/term/scrollback/fit.rs                |  5 +-
 .../src/term/terminal/app_impl_paint.rs       |  5 +-
 8 files changed, 59 insertions(+), 3 deletions(-)
 create mode 100644 userland/capsule_terminal/src/jobs/tty.rs

diff --git a/userland/capsule_terminal/src/command/builtin/nox/exec.rs b/userland/capsule_terminal/src/command/builtin/nox/exec.rs
index c294783c5..96b2bd4ac 100644
--- a/userland/capsule_terminal/src/command/builtin/nox/exec.rs
+++ b/userland/capsule_terminal/src/command/builtin/nox/exec.rs
@@ -39,6 +39,7 @@ pub fn run(state: &mut State, args: &[&[u8]]) -> bool {
     let argv = argv_blob(stem, &args[1..]);
     match call_installer(stem, &argv) {
         Ok(pid) => {
+            crate::jobs::tty::attach(state, pid);
             let work = JobWork::ExternalStage { pid, in_buf: Vec::new(), in_cursor: 0 };
             let _ = submit(state, stem, false, work);
             state.fg_running = true;
diff --git a/userland/capsule_terminal/src/command/builtin/nox/install/job.rs b/userland/capsule_terminal/src/command/builtin/nox/install/job.rs
index 2d1a6f7c3..0b4669622 100644
--- a/userland/capsule_terminal/src/command/builtin/nox/install/job.rs
+++ b/userland/capsule_terminal/src/command/builtin/nox/install/job.rs
@@ -27,7 +27,7 @@ const DEADLINE_MS: i64 = 5000;
 // final flush of whatever is still buffered. Holds the progress cursor
 // (elapsed start, whether any output has been seen) between slices.
 pub struct InstallJob {
-    pid: u32,
+    pub(crate) pid: u32,
     start: i64,
     saw_output: bool,
 }
diff --git a/userland/capsule_terminal/src/command/builtin/nox/install/run.rs b/userland/capsule_terminal/src/command/builtin/nox/install/run.rs
index 8805cfe7b..762e03a64 100644
--- a/userland/capsule_terminal/src/command/builtin/nox/install/run.rs
+++ b/userland/capsule_terminal/src/command/builtin/nox/install/run.rs
@@ -37,6 +37,7 @@ pub fn run(state: &mut State, args: &[&[u8]]) -> bool {
     let argv = argv_blob(stem, &args[1..]);
     match call_installer(stem, &argv) {
         Ok(new_pid) => {
+            crate::jobs::tty::attach(state, new_pid);
             emit_ok(state, stem, new_pid);
             debug_marker(b"[TERMINAL-INSTALL] load ok\n");
             drain_output(state, new_pid);
diff --git a/userland/capsule_terminal/src/command/builtin/tool.rs b/userland/capsule_terminal/src/command/builtin/tool.rs
index 864405f58..6e393f926 100644
--- a/userland/capsule_terminal/src/command/builtin/tool.rs
+++ b/userland/capsule_terminal/src/command/builtin/tool.rs
@@ -64,6 +64,7 @@ pub fn prepare(state: &mut State, args: &[&[u8]]) -> Option<InstallJob> {
         super::tool_refused::refused(state, name, rc);
         return None;
     }
+    crate::jobs::tty::attach(state, rc as u32);
     Some(InstallJob::new(rc as u32))
 }
 
diff --git a/userland/capsule_terminal/src/jobs/mod.rs b/userland/capsule_terminal/src/jobs/mod.rs
index 4b434c459..58631c876 100644
--- a/userland/capsule_terminal/src/jobs/mod.rs
+++ b/userland/capsule_terminal/src/jobs/mod.rs
@@ -23,6 +23,7 @@ mod pump;
 mod reap;
 mod submit;
 mod table;
+pub mod tty;
 mod work;
 
 pub use classify::{is_job_command, is_store_tool, Verdict};
diff --git a/userland/capsule_terminal/src/jobs/tty.rs b/userland/capsule_terminal/src/jobs/tty.rs
new file mode 100644
index 000000000..5ece14486
--- /dev/null
+++ b/userland/capsule_terminal/src/jobs/tty.rs
@@ -0,0 +1,46 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Telling a program that its output reaches this screen, and how big the
+//! screen is. The kernel answers the program's own is-it-a-terminal
+//! question from this, so it picks colour and columns for a person. A
+//! stage that feeds a pipe or a file is never told, and writes plain bytes.
+
+use nonos_libc::{mk_tty_set, TTY_STDERR, TTY_STDIN, TTY_STDOUT};
+
+use super::JobWork;
+use crate::term::state::State;
+
+/// The program `pid` reads the keyboard and writes to this screen. A kernel
+/// without the call leaves it believing it writes to a pipe, which is where
+/// it started, so the answer is not checked.
+pub fn attach(state: &State, pid: u32) {
+    let vt = &state.scrollback.vt;
+    let (cols, rows) = (vt.cols().min(u16::MAX as usize), vt.rows().min(u16::MAX as usize));
+    let _ = mk_tty_set(pid, TTY_STDIN | TTY_STDOUT | TTY_STDERR, cols as u16, rows as u16);
+}
+
+/// The screen changed size: the program in front hears the new one the
+/// next time it asks.
+pub fn resized(state: &State) {
+    let Some(id) = state.jobs.foreground() else { return };
+    let pid = match state.jobs.get(id).map(|j| &j.work) {
+        Some(JobWork::ExternalStage { pid, .. }) => *pid,
+        Some(JobWork::InstallDrain(job)) => job.pid,
+        _ => return,
+    };
+    attach(state, pid);
+}
diff --git a/userland/capsule_terminal/src/term/scrollback/fit.rs b/userland/capsule_terminal/src/term/scrollback/fit.rs
index 06d934410..4841eb886 100644
--- a/userland/capsule_terminal/src/term/scrollback/fit.rs
+++ b/userland/capsule_terminal/src/term/scrollback/fit.rs
@@ -21,12 +21,15 @@ use crate::term::theme::types::Theme;
 
 impl Scrollback {
     /// Match the screen to the window. A resize re-wraps what is there.
-    pub fn fit(&mut self, cols: usize, rows: usize, cell_w: u32, cell_h: u32) {
+    /// True when the size in cells changed.
+    pub fn fit(&mut self, cols: usize, rows: usize, cell_w: u32, cell_h: u32) -> bool {
+        let changed = (cols, rows) != (self.vt.cols(), self.vt.rows());
         self.vt.resize(cols, rows);
         self.vt.set_cell_pixels(
             cell_w.min(u16::MAX as u32) as u16,
             cell_h.min(u16::MAX as u32) as u16,
         );
+        changed
     }
 
     /// Program colours start from the window's theme. Only a change of
diff --git a/userland/capsule_terminal/src/term/terminal/app_impl_paint.rs b/userland/capsule_terminal/src/term/terminal/app_impl_paint.rs
index 68516dca7..f0bcd3b98 100644
--- a/userland/capsule_terminal/src/term/terminal/app_impl_paint.rs
+++ b/userland/capsule_terminal/src/term/terminal/app_impl_paint.rs
@@ -33,8 +33,11 @@ impl Terminal {
         let (cols, rows, m) = crate::paint::grid_size(fb, self.font_scale, rail_open);
         let theme_ix = self.theme;
         let sb = &mut self.cur().scrollback;
-        sb.fit(cols, rows, m.adv, m.lh);
+        let resized = sb.fit(cols, rows, m.adv, m.lh);
         sb.follow_theme(theme_ix, theme);
+        if resized {
+            crate::jobs::tty::resized(self.cur_ref());
+        }
         let l = crate::paint::paint_tabs(
             &self.tabs,
             self.active,

From 17ce995b5450d004b8f31842bc6ecb60dbd6a0ce Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 15:04:01 +0000
Subject: [PATCH 19/29] build: drop std build caches when the std layer changes

-Zbuild-std fingerprints the sysroot crates by version rather than by
their sources, so a tool whose target dir already held a std kept
linking it after the NONOS std layer changed. Six of the tools shipped
that way without the new terminal query, and pastel still printed its
pipe output to a person. Applying the layer now clears the per-tool std
caches it just made stale.
---
 mk/20-build.mk | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/mk/20-build.mk b/mk/20-build.mk
index ae5e484be..288ac0eb1 100644
--- a/mk/20-build.mk
+++ b/mk/20-build.mk
@@ -327,6 +327,11 @@ $(NONOS_STD_PAL_STAMP): $(NONOS_STD_PAL_SRCS) | $(TARGET_DIR)/.nonos-toolchain.s
 	@echo "Applying NONOS std platform layer to rust-src..."
 	@PATH="$(HOME)/.cargo/bin:$$PATH" RUSTUP_TOOLCHAIN=$(TOOLCHAIN) \
 		toolchain/nonos-std/apply.sh
+	@# -Zbuild-std fingerprints the sysroot crates by version, not by their
+	@# sources, so a target dir that built std before the layer changed keeps
+	@# linking the old std and the tool ships without the new behaviour. The
+	@# layer just changed, so every such cache is stale: drop them.
+	@rm -rf userland/upstream-src/*/target userland/capsule_std_proof/target
 	@mkdir -p $(TARGET_DIR)
 	@touch $@
 

From c9125349e5c5da906740dbfed400ff73880f1b21 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 15:56:58 +0000
Subject: [PATCH 20/29] terminal: take commands longer than the screen is wide

The line buffer, the history and the kill ring were sized by COLS, the
screen's starting width of 96, so a longer command was cut at column 96.
An echo with a redirect lost its file name there and wrote to a
different file. Typed input now holds LINE_MAX, 1024 bytes, and the
prompt already scrolls sideways across a line wider than the window.
---
 .../src/command/builtin/echo.rs               |  4 +--
 .../src/command/builtin/history_cmd.rs        |  6 ++---
 .../capsule_terminal/src/event/on_enter.rs    | 10 ++++----
 .../src/event/paste_clipboard.rs              |  6 ++---
 .../capsule_terminal/src/term/dimensions.rs   |  3 +++
 .../capsule_terminal/src/term/history/new.rs  |  4 +--
 .../capsule_terminal/src/term/history/push.rs |  4 +--
 .../src/term/history/types.rs                 |  4 +--
 .../capsule_terminal/src/term/line/insert.rs  |  4 +--
 .../capsule_terminal/src/term/line/new.rs     |  4 +--
 .../capsule_terminal/src/term/line/replace.rs |  4 +--
 .../capsule_terminal/src/term/line/types.rs   | 10 ++++----
 userland/terminal_line_proofs/src/lib.rs      |  3 +++
 .../terminal_line_proofs/src/line_tests.rs    |  8 +++---
 .../src/long_line_tests.rs                    | 25 +++++++++++++++++++
 15 files changed, 65 insertions(+), 34 deletions(-)
 create mode 100644 userland/terminal_line_proofs/src/long_line_tests.rs

diff --git a/userland/capsule_terminal/src/command/builtin/echo.rs b/userland/capsule_terminal/src/command/builtin/echo.rs
index a02077ea7..c70ef0cb0 100644
--- a/userland/capsule_terminal/src/command/builtin/echo.rs
+++ b/userland/capsule_terminal/src/command/builtin/echo.rs
@@ -15,7 +15,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 use crate::command::output::Output;
-use crate::term::dimensions::COLS;
+use crate::term::dimensions::LINE_MAX;
 use crate::term::util::copy_into;
 
 pub fn run(out: &mut Output<'_>, argv: &[&[u8]]) {
@@ -23,7 +23,7 @@ pub fn run(out: &mut Output<'_>, argv: &[&[u8]]) {
         out.writeln(b"");
         return;
     }
-    let mut buf = [0u8; COLS];
+    let mut buf = [0u8; LINE_MAX];
     let mut n = 0;
     for (i, arg) in argv[1..].iter().enumerate() {
         if i > 0 && n < buf.len() {
diff --git a/userland/capsule_terminal/src/command/builtin/history_cmd.rs b/userland/capsule_terminal/src/command/builtin/history_cmd.rs
index 3ab105dfb..d08c4468a 100644
--- a/userland/capsule_terminal/src/command/builtin/history_cmd.rs
+++ b/userland/capsule_terminal/src/command/builtin/history_cmd.rs
@@ -15,7 +15,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 use crate::command::output::Output;
-use crate::term::dimensions::COLS;
+use crate::term::dimensions::LINE_MAX;
 use crate::term::history::History;
 use crate::term::util::format_u64;
 
@@ -24,7 +24,7 @@ pub fn run(out: &mut Output<'_>, history: &History, _argv: &[&[u8]]) {
         let mut numbuf = [0u8; 4];
         let nn = format_u64(i as u64, &mut numbuf);
         let p = nn.min(3);
-        let mut line = [0u8; COLS];
+        let mut line = [0u8; LINE_MAX];
         let mut o = 0;
         for k in 0..p {
             line[o] = numbuf[nn - p + k];
@@ -34,7 +34,7 @@ pub fn run(out: &mut Output<'_>, history: &History, _argv: &[&[u8]]) {
         line[o + 1] = b' ';
         o += 2;
         let body = history.get(i);
-        let take = body.len().min(COLS - o);
+        let take = body.len().min(LINE_MAX - o);
         line[o..o + take].copy_from_slice(&body[..take]);
         out.writeln(&line[..o + take]);
     }
diff --git a/userland/capsule_terminal/src/event/on_enter.rs b/userland/capsule_terminal/src/event/on_enter.rs
index 0e89b6809..5e9749954 100644
--- a/userland/capsule_terminal/src/event/on_enter.rs
+++ b/userland/capsule_terminal/src/event/on_enter.rs
@@ -21,7 +21,7 @@ use crate::command;
 use crate::jobs;
 use crate::term::context::context_line;
 use crate::term::cwd::home_var;
-use crate::term::dimensions::COLS;
+use crate::term::dimensions::LINE_MAX;
 use crate::term::identity::{hostname, USER};
 use crate::term::prompt::PROMPT_BYTES;
 use crate::term::state::State;
@@ -34,20 +34,20 @@ pub fn on_enter(state: &mut State) -> EventOutcome {
     state.fresh = false;
     let started = mk_time_millis();
     state.open_block(crate::term::rtc::rtc_hms());
-    let mut ctx = [0u8; COLS];
+    let mut ctx = [0u8; LINE_MAX];
     let cn = context_line(USER, hostname(), state.cwd.as_bytes(), home_var(state), &mut ctx);
     state.scrollback.push_line(&ctx[..cn]);
     // A `!` form is resolved before anything else sees the line, so what is
     // echoed, recorded in history and run are all the same text. Expanding
     // later would put one command on screen and another through the parser.
-    let mut entered = [0u8; COLS];
+    let mut entered = [0u8; LINE_MAX];
     let n;
     match crate::term::history::expand(state.line.as_bytes(), &state.history) {
         // The expansion is what gets echoed, which is the whole safety of the
         // feature: the reader sees the command that is about to run, not the
         // shorthand they typed for it.
         Some(Ok(line)) => {
-            n = line.len().min(COLS);
+            n = line.len().min(LINE_MAX);
             entered[..n].copy_from_slice(&line[..n]);
         }
         Some(Err(_)) => {
@@ -67,7 +67,7 @@ pub fn on_enter(state: &mut State) -> EventOutcome {
             entered[..n].copy_from_slice(body);
         }
     }
-    let mut echo = [0u8; COLS + 8];
+    let mut echo = [0u8; LINE_MAX + 8];
     let mut k = 0;
     k += copy_into(&mut echo[k..], PROMPT_BYTES);
     k += copy_into(&mut echo[k..], &entered[..n]);
diff --git a/userland/capsule_terminal/src/event/paste_clipboard.rs b/userland/capsule_terminal/src/event/paste_clipboard.rs
index 74814a43f..4bd16b40f 100644
--- a/userland/capsule_terminal/src/event/paste_clipboard.rs
+++ b/userland/capsule_terminal/src/event/paste_clipboard.rs
@@ -16,11 +16,11 @@
 
 use nonos_app_skeleton::{clipboard_paste, EventOutcome};
 
-use crate::term::dimensions::COLS;
+use crate::term::dimensions::LINE_MAX;
 use crate::term::state::State;
 
 pub fn paste_clipboard(state: &mut State) -> EventOutcome {
-    let mut buf = [0u8; COLS];
+    let mut buf = [0u8; LINE_MAX];
     let n = match clipboard_paste(&mut buf) {
         Ok(n) => n.min(buf.len()),
         Err(_) => return EventOutcome::Idle,
@@ -45,7 +45,7 @@ pub fn paste_clipboard(state: &mut State) -> EventOutcome {
             changed = true;
         }
     }
-    // The input line holds COLS bytes, so anything longer cannot fit. Say so
+    // The input line holds LINE_MAX bytes, so anything longer cannot fit. Say so
     // instead of leaving a silently shortened command on the prompt.
     if multiline {
         state.scrollback.push_line(b"paste: first line only");
diff --git a/userland/capsule_terminal/src/term/dimensions.rs b/userland/capsule_terminal/src/term/dimensions.rs
index bd009fab1..1f154b5a7 100644
--- a/userland/capsule_terminal/src/term/dimensions.rs
+++ b/userland/capsule_terminal/src/term/dimensions.rs
@@ -15,6 +15,9 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 pub const COLS: usize = 96;
+/// The longest command line the shell takes. Wider than any screen: a
+/// command wraps on screen, it is not cut off.
+pub const LINE_MAX: usize = 1024;
 /// History lines each tab keeps.
 pub const SCROLLBACK_ROWS: usize = 3000;
 pub const VISIBLE_ROWS: usize = 40;
diff --git a/userland/capsule_terminal/src/term/history/new.rs b/userland/capsule_terminal/src/term/history/new.rs
index 57fbd2b9a..5ff9e2b8d 100644
--- a/userland/capsule_terminal/src/term/history/new.rs
+++ b/userland/capsule_terminal/src/term/history/new.rs
@@ -15,12 +15,12 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 use super::types::History;
-use crate::term::dimensions::{COLS, HISTORY_DEPTH};
+use crate::term::dimensions::{LINE_MAX, HISTORY_DEPTH};
 
 impl History {
     pub const fn new() -> Self {
         Self {
-            entries: [[0; COLS]; HISTORY_DEPTH],
+            entries: [[0; LINE_MAX]; HISTORY_DEPTH],
             lengths: [0; HISTORY_DEPTH],
             count: 0,
             cursor: None,
diff --git a/userland/capsule_terminal/src/term/history/push.rs b/userland/capsule_terminal/src/term/history/push.rs
index 042a4bef2..17cc5e524 100644
--- a/userland/capsule_terminal/src/term/history/push.rs
+++ b/userland/capsule_terminal/src/term/history/push.rs
@@ -15,7 +15,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 use super::types::History;
-use crate::term::dimensions::{COLS, HISTORY_DEPTH};
+use crate::term::dimensions::{LINE_MAX, HISTORY_DEPTH};
 
 impl History {
     pub fn push(&mut self, line: &[u8]) {
@@ -37,7 +37,7 @@ impl History {
             self.count = HISTORY_DEPTH - 1;
         }
         let slot = self.count;
-        let n = line.len().min(COLS);
+        let n = line.len().min(LINE_MAX);
         self.entries[slot][..n].copy_from_slice(&line[..n]);
         self.lengths[slot] = n;
         self.count += 1;
diff --git a/userland/capsule_terminal/src/term/history/types.rs b/userland/capsule_terminal/src/term/history/types.rs
index 16563b38d..b685e96b0 100644
--- a/userland/capsule_terminal/src/term/history/types.rs
+++ b/userland/capsule_terminal/src/term/history/types.rs
@@ -14,10 +14,10 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-use crate::term::dimensions::{COLS, HISTORY_DEPTH};
+use crate::term::dimensions::{LINE_MAX, HISTORY_DEPTH};
 
 pub struct History {
-    pub(super) entries: [[u8; COLS]; HISTORY_DEPTH],
+    pub(super) entries: [[u8; LINE_MAX]; HISTORY_DEPTH],
     pub(super) lengths: [usize; HISTORY_DEPTH],
     pub(super) count: usize,
     pub(super) cursor: Option<usize>,
diff --git a/userland/capsule_terminal/src/term/line/insert.rs b/userland/capsule_terminal/src/term/line/insert.rs
index a7c117dc0..f754e9dd5 100644
--- a/userland/capsule_terminal/src/term/line/insert.rs
+++ b/userland/capsule_terminal/src/term/line/insert.rs
@@ -15,11 +15,11 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 use super::types::Line;
-use crate::term::dimensions::COLS;
+use crate::term::dimensions::LINE_MAX;
 
 impl Line {
     pub fn insert(&mut self, byte: u8) -> bool {
-        if self.len >= COLS {
+        if self.len >= LINE_MAX {
             return false;
         }
         if self.cursor < self.len {
diff --git a/userland/capsule_terminal/src/term/line/new.rs b/userland/capsule_terminal/src/term/line/new.rs
index f8f5046ac..9e8446242 100644
--- a/userland/capsule_terminal/src/term/line/new.rs
+++ b/userland/capsule_terminal/src/term/line/new.rs
@@ -15,12 +15,12 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 use super::types::Line;
-use crate::term::dimensions::COLS;
+use crate::term::dimensions::LINE_MAX;
 
 impl Line {
     pub const fn new() -> Self {
         Self {
-            buf: [0; COLS],
+            buf: [0; LINE_MAX],
             len: 0,
             cursor: 0,
             killed: [0; super::types::KILL_CAP],
diff --git a/userland/capsule_terminal/src/term/line/replace.rs b/userland/capsule_terminal/src/term/line/replace.rs
index 16500c741..78236903c 100644
--- a/userland/capsule_terminal/src/term/line/replace.rs
+++ b/userland/capsule_terminal/src/term/line/replace.rs
@@ -15,11 +15,11 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 use super::types::Line;
-use crate::term::dimensions::COLS;
+use crate::term::dimensions::LINE_MAX;
 
 impl Line {
     pub fn replace(&mut self, src: &[u8]) {
-        let n = src.len().min(COLS);
+        let n = src.len().min(LINE_MAX);
         self.buf[..n].copy_from_slice(&src[..n]);
         self.len = n;
         self.cursor = n;
diff --git a/userland/capsule_terminal/src/term/line/types.rs b/userland/capsule_terminal/src/term/line/types.rs
index 71f24f550..b56841e02 100644
--- a/userland/capsule_terminal/src/term/line/types.rs
+++ b/userland/capsule_terminal/src/term/line/types.rs
@@ -14,14 +14,14 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-use crate::term::dimensions::COLS;
+use crate::term::dimensions::LINE_MAX;
 
-/// How much cut text is held for Ctrl-Y. A line cannot exceed COLS, so a
-/// buffer that size can always hold whatever a single kill removed.
-pub const KILL_CAP: usize = COLS;
+/// How much cut text is held for Ctrl-Y. A line cannot exceed LINE_MAX, so
+/// a buffer that size can always hold whatever a single kill removed.
+pub const KILL_CAP: usize = LINE_MAX;
 
 pub struct Line {
-    pub buf: [u8; COLS],
+    pub buf: [u8; LINE_MAX],
     pub len: usize,
     pub cursor: usize,
     /// The last text a kill key removed, waiting to be yanked back.
diff --git a/userland/terminal_line_proofs/src/lib.rs b/userland/terminal_line_proofs/src/lib.rs
index 1fd024e26..e9a2194f1 100644
--- a/userland/terminal_line_proofs/src/lib.rs
+++ b/userland/terminal_line_proofs/src/lib.rs
@@ -12,6 +12,7 @@ extern crate alloc;
 pub mod term {
     pub mod dimensions {
         pub const COLS: usize = 96;
+        pub const LINE_MAX: usize = 1024;
     }
     pub mod util {
         pub use crate::fmt_u64::format_u64;
@@ -104,6 +105,8 @@ mod help_tests;
 #[cfg(test)]
 mod line_tests;
 #[cfg(test)]
+mod long_line_tests;
+#[cfg(test)]
 mod quick_open_tests;
 #[cfg(test)]
 mod suggest_tests;
diff --git a/userland/terminal_line_proofs/src/line_tests.rs b/userland/terminal_line_proofs/src/line_tests.rs
index 86885a36e..866d7eafa 100644
--- a/userland/terminal_line_proofs/src/line_tests.rs
+++ b/userland/terminal_line_proofs/src/line_tests.rs
@@ -163,13 +163,13 @@ fn delete_at_the_end_does_nothing() {
 /// bytes at once. It has to stop at the edge rather than run past it.
 #[test]
 fn yanking_into_a_nearly_full_line_stays_in_bounds() {
-    let wide = "x".repeat(crate::term::dimensions::COLS);
+    let wide = "x".repeat(crate::term::dimensions::LINE_MAX);
     let mut l = typed(&wide);
-    assert_eq!(l.len, crate::term::dimensions::COLS);
+    assert_eq!(l.len, crate::term::dimensions::LINE_MAX);
     l.kill_line();
     l.yank();
-    assert!(l.len <= crate::term::dimensions::COLS);
+    assert!(l.len <= crate::term::dimensions::LINE_MAX);
     l.yank();
-    assert!(l.len <= crate::term::dimensions::COLS);
+    assert!(l.len <= crate::term::dimensions::LINE_MAX);
     assert!(l.cursor <= l.len);
 }
diff --git a/userland/terminal_line_proofs/src/long_line_tests.rs b/userland/terminal_line_proofs/src/long_line_tests.rs
new file mode 100644
index 000000000..87d4eae3d
--- /dev/null
+++ b/userland/terminal_line_proofs/src/long_line_tests.rs
@@ -0,0 +1,25 @@
+// NONOS Operating System (AGPL-3.0-or-later)
+//! How long a command the line editor takes.
+
+use crate::line::Line;
+
+fn typed(s: &str) -> Line {
+    let mut l = Line::new();
+    for b in s.bytes() {
+        l.insert(b);
+    }
+    l
+}
+
+/*
+ * A command wider than the screen is typed whole. The buffer used to be the
+ * screen's width, so an echo with a redirect lost its file name at column
+ * 96 and wrote somewhere else.
+ */
+#[test]
+fn a_command_wider_than_the_screen_is_kept_whole() {
+    let cmd = format!("echo '{}' > /tmp/boot.json", "x".repeat(200));
+    let l = typed(&cmd);
+    assert_eq!(l.as_bytes(), cmd.as_bytes());
+    assert!(cmd.len() > crate::term::dimensions::COLS);
+}

From 8bf70646dce0a4d5015d064085d370f3192a3897 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 15:56:58 +0000
Subject: [PATCH 21/29] terminal: sixteen colours chosen for the window's
 ground

Programs name colours 0 to 15 and got xterm's, whose blue is #0000EE:
2.2:1 against the dark themes, so tokei's table headers could not be
read. Each theme's ground now picks a dark or a light set, and a proof
holds every text colour at 4.5:1 or better on every shipped ground.
---
 .../src/term/scrollback/fit.rs                |  1 +
 userland/capsule_terminal/src/term/theme.rs   |  1 +
 .../capsule_terminal/src/term/theme/ansi.rs   | 46 +++++++++++++++++
 userland/terminal_line_proofs/src/lib.rs      |  6 +++
 .../terminal_line_proofs/src/palette_tests.rs | 50 +++++++++++++++++++
 5 files changed, 104 insertions(+)
 create mode 100644 userland/capsule_terminal/src/term/theme/ansi.rs
 create mode 100644 userland/terminal_line_proofs/src/palette_tests.rs

diff --git a/userland/capsule_terminal/src/term/scrollback/fit.rs b/userland/capsule_terminal/src/term/scrollback/fit.rs
index 4841eb886..63f99cae4 100644
--- a/userland/capsule_terminal/src/term/scrollback/fit.rs
+++ b/userland/capsule_terminal/src/term/scrollback/fit.rs
@@ -39,6 +39,7 @@ impl Scrollback {
             return;
         }
         let mut p = Palette::xterm();
+        p.colors[..16].copy_from_slice(crate::term::theme::ansi::base16_for(t.bg));
         p.fg = t.fg & 0x00FF_FFFF;
         p.bg = t.bg & 0x00FF_FFFF;
         p.cursor = t.accent & 0x00FF_FFFF;
diff --git a/userland/capsule_terminal/src/term/theme.rs b/userland/capsule_terminal/src/term/theme.rs
index e0677148a..db3baea7b 100644
--- a/userland/capsule_terminal/src/term/theme.rs
+++ b/userland/capsule_terminal/src/term/theme.rs
@@ -27,5 +27,6 @@
 //! but derived from the active profile background via paint::shade::elevate,
 //! so every profile including the translucent ones stays complete.
 
+pub mod ansi;
 pub mod profiles;
 pub mod types;
diff --git a/userland/capsule_terminal/src/term/theme/ansi.rs b/userland/capsule_terminal/src/term/theme/ansi.rs
new file mode 100644
index 000000000..47145af1f
--- /dev/null
+++ b/userland/capsule_terminal/src/term/theme/ansi.rs
@@ -0,0 +1,46 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * The sixteen colours programs name, chosen for the ground they are drawn
+ * on. xterm's own set puts blue at #0000EE, which on a near-black window is
+ * text nobody can read; a tool that prints its table headers in blue should
+ * still be legible. The light set keeps each hue dark enough for a pale
+ * ground. Indices 16 and up stay xterm's, since programs that use them pick
+ * exact colours on purpose.
+ */
+
+const DARK: [u32; 16] = [
+    0x2A2F37, 0xE8646E, 0x6FD48A, 0xE6C170, 0x5FA8F5, 0xC77DE0, 0x4FD2DC, 0xD4D8DF, 0x6B7380,
+    0xFF7C86, 0x8FEBA6, 0xF3D68C, 0x86C1FF, 0xDB9CF0, 0x7AE6EE, 0xFFFFFF,
+];
+
+const LIGHT: [u32; 16] = [
+    0x1F2328, 0xB3261E, 0x1A7F37, 0x8A6100, 0x0B5CD5, 0x8E3FB0, 0x0A7A83, 0x5A626C,
+    0x57606A, 0xD1242F, 0x227E3C, 0x8E6800, 0x2C68DC, 0x974EB8, 0x157980, 0x24292F,
+];
+
+/// The set for a window whose ground is `bg` (0xAARRGGBB or 0xRRGGBB).
+pub fn base16_for(bg: u32) -> &'static [u32; 16] {
+    let (r, g, b) = ((bg >> 16) & 0xFF, (bg >> 8) & 0xFF, bg & 0xFF);
+    // Rec. 601 luma, in 0..=255 scaled by 1000.
+    let luma = 299 * r + 587 * g + 114 * b;
+    if luma > 128_000 {
+        &LIGHT
+    } else {
+        &DARK
+    }
+}
diff --git a/userland/terminal_line_proofs/src/lib.rs b/userland/terminal_line_proofs/src/lib.rs
index e9a2194f1..8c8e2c014 100644
--- a/userland/terminal_line_proofs/src/lib.rs
+++ b/userland/terminal_line_proofs/src/lib.rs
@@ -86,6 +86,10 @@ pub mod help_pages;
 #[path = "../../capsule_terminal/src/command/builtin/tool_list.rs"]
 pub mod tool_list;
 
+// The colours programs name.
+#[path = "../../capsule_terminal/src/term/theme/ansi.rs"]
+pub mod ansi;
+
 #[cfg(test)]
 mod cadence_tests;
 #[cfg(test)]
@@ -107,6 +111,8 @@ mod line_tests;
 #[cfg(test)]
 mod long_line_tests;
 #[cfg(test)]
+mod palette_tests;
+#[cfg(test)]
 mod quick_open_tests;
 #[cfg(test)]
 mod suggest_tests;
diff --git a/userland/terminal_line_proofs/src/palette_tests.rs b/userland/terminal_line_proofs/src/palette_tests.rs
new file mode 100644
index 000000000..399985da9
--- /dev/null
+++ b/userland/terminal_line_proofs/src/palette_tests.rs
@@ -0,0 +1,50 @@
+// NONOS Operating System (AGPL-3.0-or-later)
+/*
+ * The sixteen colours against every ground the terminal ships, measured as
+ * WCAG contrast. Blue at xterm's #0000EE on #07090B is 2.2:1, which is why
+ * a table header printed in it could not be read.
+ */
+
+use crate::ansi::base16_for;
+
+/// Every theme background in term/theme/profiles.rs.
+const GROUNDS: [u32; 4] = [0x07_090B, 0x0B_0E12, 0xF2_F4F7, 0x00_0308];
+
+fn luminance(c: u32) -> f64 {
+    let lin = |v: u32| {
+        let s = v as f64 / 255.0;
+        if s <= 0.03928 {
+            s / 12.92
+        } else {
+            ((s + 0.055) / 1.055).powf(2.4)
+        }
+    };
+    0.2126 * lin((c >> 16) & 0xFF) + 0.7152 * lin((c >> 8) & 0xFF) + 0.0722 * lin(c & 0xFF)
+}
+
+fn contrast(a: u32, b: u32) -> f64 {
+    let (x, y) = (luminance(a), luminance(b));
+    (x.max(y) + 0.05) / (x.min(y) + 0.05)
+}
+
+/*
+ * Index 0 is black and 8 grey: programs use them for rules and dim text,
+ * so they only need to be visible. Every other colour carries text and
+ * meets the 4.5:1 WCAG asks of body text.
+ */
+#[test]
+fn every_text_colour_is_readable_on_every_ground() {
+    for bg in GROUNDS {
+        let set = base16_for(bg);
+        for (i, &c) in set.iter().enumerate() {
+            let need = if matches!(i, 0 | 8) { 1.3 } else { 4.5 };
+            let r = contrast(c, bg);
+            assert!(r >= need, "colour {i} {c:06x} on {bg:06x} is {r:.2}:1");
+        }
+    }
+}
+
+#[test]
+fn the_old_blue_was_unreadable() {
+    assert!(contrast(0x0000EE, 0x07_090B) < 3.0);
+}

From d8b8baf66e0ec94af05733ccb806f5694f58de33 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 15:56:59 +0000
Subject: [PATCH 22/29] terminal: stroke box-drawing characters across the
 whole cell

A font draws a line character inside its glyph box, so the line gap left
a break between rows and csview's tables did not join. The light, heavy,
double and rounded line characters are now stroked from edge to edge of
the cell, arms meeting at the centre, and anything else still comes from
the font.
---
 .../capsule_terminal/src/paint/vt/box_arms.rs | 70 +++++++++++++++++++
 .../capsule_terminal/src/paint/vt/box_draw.rs | 56 +++++++++++++++
 .../capsule_terminal/src/paint/vt/cell.rs     |  4 ++
 userland/capsule_terminal/src/paint/vt/mod.rs |  2 +
 .../terminal_line_proofs/src/box_tests.rs     | 29 ++++++++
 userland/terminal_line_proofs/src/lib.rs      |  6 +-
 6 files changed, 166 insertions(+), 1 deletion(-)
 create mode 100644 userland/capsule_terminal/src/paint/vt/box_arms.rs
 create mode 100644 userland/capsule_terminal/src/paint/vt/box_draw.rs
 create mode 100644 userland/terminal_line_proofs/src/box_tests.rs

diff --git a/userland/capsule_terminal/src/paint/vt/box_arms.rs b/userland/capsule_terminal/src/paint/vt/box_arms.rs
new file mode 100644
index 000000000..7d2bf05e8
--- /dev/null
+++ b/userland/capsule_terminal/src/paint/vt/box_arms.rs
@@ -0,0 +1,70 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * Which arms a box-drawing character has, and how heavy each is. Tables
+ * that tools print with these characters only join up when the lines run
+ * to the edges of the cell, which a font's glyph does not: the line gap
+ * leaves a break between rows.
+ */
+
+/// An arm's weight: none, light, heavy or double.
+pub const NONE: u8 = 0;
+pub const LIGHT: u8 = 1;
+pub const HEAVY: u8 = 2;
+pub const DOUBLE: u8 = 3;
+
+/// Up, down, left and right arms of `ch`, or None when it is not one of
+/// the line characters drawn here.
+pub fn arms(ch: char) -> Option<[u8; 4]> {
+    let (l, h, d) = (LIGHT, HEAVY, DOUBLE);
+    Some(match ch {
+        '─' => [0, 0, l, l],
+        '━' => [0, 0, h, h],
+        '│' => [l, l, 0, 0],
+        '┃' => [h, h, 0, 0],
+        '┌' | '╭' => [0, l, 0, l],
+        '┐' | '╮' => [0, l, l, 0],
+        '└' | '╰' => [l, 0, 0, l],
+        '┘' | '╯' => [l, 0, l, 0],
+        '├' => [l, l, 0, l],
+        '┤' => [l, l, l, 0],
+        '┬' => [0, l, l, l],
+        '┴' => [l, 0, l, l],
+        '┼' => [l, l, l, l],
+        '┏' => [0, h, 0, h],
+        '┓' => [0, h, h, 0],
+        '┗' => [h, 0, 0, h],
+        '┛' => [h, 0, h, 0],
+        '┣' => [h, h, 0, h],
+        '┫' => [h, h, h, 0],
+        '┳' => [0, h, h, h],
+        '┻' => [h, 0, h, h],
+        '╋' => [h, h, h, h],
+        '═' => [0, 0, d, d],
+        '║' => [d, d, 0, 0],
+        '╔' => [0, d, 0, d],
+        '╗' => [0, d, d, 0],
+        '╚' => [d, 0, 0, d],
+        '╝' => [d, 0, d, 0],
+        '╠' => [d, d, 0, d],
+        '╣' => [d, d, d, 0],
+        '╦' => [0, d, d, d],
+        '╩' => [d, 0, d, d],
+        '╬' => [d, d, d, d],
+        _ => return None,
+    })
+}
diff --git a/userland/capsule_terminal/src/paint/vt/box_draw.rs b/userland/capsule_terminal/src/paint/vt/box_draw.rs
new file mode 100644
index 000000000..86a7669f5
--- /dev/null
+++ b/userland/capsule_terminal/src/paint/vt/box_draw.rs
@@ -0,0 +1,56 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! Box-drawing characters stroked across the whole cell.
+
+use nonos_app_skeleton::PaintBuffer;
+
+use super::box_arms::{arms, DOUBLE, HEAVY, NONE};
+
+/// Stroke `ch` over the cell at `(x, y)` sized `w` by `h`. False when it
+/// is not a line character, so the caller draws the glyph instead.
+pub fn stroke(fb: &mut PaintBuffer, ch: char, x: u32, y: u32, w: u32, h: u32, argb: u32) -> bool {
+    let Some([up, down, left, right]) = arms(ch) else { return false };
+    let t = (w / 8).max(1);
+    let (cx, cy) = (x + w / 2, y + h / 2);
+    for (arm, across, first) in
+        [(up, false, true), (down, false, false), (left, true, true), (right, true, false)]
+    {
+        if arm == NONE {
+            continue;
+        }
+        let k = if arm == HEAVY { 2 * t } else { t };
+        /*
+         * An arm runs from the cell's edge to just past the centre line, by
+         * half its own width, so the arms of a cross meet with no notch. A
+         * double arm is two strokes either side of the centre.
+         */
+        let gap = if arm == DOUBLE { t + 1 } else { 0 };
+        let past = k / 2 + gap + k % 2;
+        let sides: &[i32] = if arm == DOUBLE { &[-1, 1] } else { &[0] };
+        for &side in sides {
+            let lane = |c: u32| (c as i32 + side * gap as i32) as u32 - k / 2;
+            if across {
+                let (a, b) = if first { (x, cx + past) } else { (cx - past, x + w) };
+                fb.fill_rect(a, lane(cy), b - a, k, argb);
+            } else {
+                let (a, b) = if first { (y, cy + past) } else { (cy - past, y + h) };
+                fb.fill_rect(lane(cx), a, k, b - a, argb);
+            }
+        }
+    }
+    true
+}
diff --git a/userland/capsule_terminal/src/paint/vt/cell.rs b/userland/capsule_terminal/src/paint/vt/cell.rs
index f6eb3960d..64c3907f6 100644
--- a/userland/capsule_terminal/src/paint/vt/cell.rs
+++ b/userland/capsule_terminal/src/paint/vt/cell.rs
@@ -40,6 +40,10 @@ pub fn glyph(fb: &mut PaintBuffer, x: u32, y: u32, ch: char, argb: u32, px: f32)
 /// text is drawn upright.
 pub fn text(fb: &mut PaintBuffer, line: &Line, cell: &Cell, x: u32, y: u32, fg: u32, m: Metrics) {
     let fg = OPAQUE | fg;
+    // Line characters run to the cell's edges so tables join between rows.
+    if super::box_draw::stroke(fb, cell.ch, x, y, m.adv, m.lh, fg) {
+        return;
+    }
     glyph(fb, x, y, cell.ch, fg, m.px);
     if cell.attr & attr::BOLD != 0 {
         glyph(fb, x + 1, y, cell.ch, fg, m.px);
diff --git a/userland/capsule_terminal/src/paint/vt/mod.rs b/userland/capsule_terminal/src/paint/vt/mod.rs
index 6bb765f95..4388a76df 100644
--- a/userland/capsule_terminal/src/paint/vt/mod.rs
+++ b/userland/capsule_terminal/src/paint/vt/mod.rs
@@ -18,6 +18,8 @@
 
 mod area;
 mod body;
+mod box_arms;
+mod box_draw;
 mod cell;
 mod cursor;
 mod deco;
diff --git a/userland/terminal_line_proofs/src/box_tests.rs b/userland/terminal_line_proofs/src/box_tests.rs
new file mode 100644
index 000000000..3149a4d70
--- /dev/null
+++ b/userland/terminal_line_proofs/src/box_tests.rs
@@ -0,0 +1,29 @@
+// NONOS Operating System (AGPL-3.0-or-later)
+//! The box characters the terminal strokes instead of drawing from the font.
+
+use crate::box_arms::{arms, DOUBLE, NONE};
+
+#[test]
+fn every_line_character_has_arms_of_one_weight() {
+    for ch in '\u{2500}'..='\u{257F}' {
+        let Some(a) = arms(ch) else { continue };
+        assert!(a.iter().any(|&w| w != NONE), "{ch} has no arm");
+        let w: Vec<u8> = a.iter().copied().filter(|&w| w != NONE).collect();
+        assert!(w.iter().all(|&x| x == w[0]), "{ch} mixes weights");
+    }
+}
+
+#[test]
+fn the_characters_csview_draws_are_all_stroked() {
+    for ch in "─│┌┐└┘├┤┬┴┼═║╔╗╚╝╭╮╯╰".chars() {
+        assert!(arms(ch).is_some(), "{ch} falls back to the font");
+    }
+    assert_eq!(arms('╬'), Some([DOUBLE; 4]));
+}
+
+#[test]
+fn ordinary_text_is_left_to_the_font() {
+    for ch in "aZ|-+=#".chars() {
+        assert_eq!(arms(ch), None);
+    }
+}
diff --git a/userland/terminal_line_proofs/src/lib.rs b/userland/terminal_line_proofs/src/lib.rs
index 8c8e2c014..52664b731 100644
--- a/userland/terminal_line_proofs/src/lib.rs
+++ b/userland/terminal_line_proofs/src/lib.rs
@@ -86,10 +86,14 @@ pub mod help_pages;
 #[path = "../../capsule_terminal/src/command/builtin/tool_list.rs"]
 pub mod tool_list;
 
-// The colours programs name.
+// The colours programs name, and the box characters stroked per cell.
 #[path = "../../capsule_terminal/src/term/theme/ansi.rs"]
 pub mod ansi;
+#[path = "../../capsule_terminal/src/paint/vt/box_arms.rs"]
+pub mod box_arms;
 
+#[cfg(test)]
+mod box_tests;
 #[cfg(test)]
 mod cadence_tests;
 #[cfg(test)]

From 55c3c7f2befe650c1d92c780d35be3da3d1a8b98 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 16:03:30 +0000
Subject: [PATCH 23/29] wallet: talk to the RPC only after the server proves it
 is the host

The chain, anchor, hostname and validity checks ran only on the probe
connection, where they set status text. The connection that reads
balances, the nonce and the fee, and broadcasts, checked nothing but the
server's Finished, and CertificateVerify was never checked anywhere. A
server that replays the real chain and finishes the handshake on keys of
its own passed, and could name any gas price the wallet then signed at.

CertificateVerify is now verified with the leaf's own key over the
transcript to the Certificate, and every RPC call requires it together
with the chain, the pinned root, the hostname, validity against the
clock, and Finished. ClientHello offers only the ECDSA schemes there is
a verifier for.
---
 .../src/wallet/net/fetch_rpc.rs               |  9 +++
 .../src/wallet/tls13/cert_verify.rs           | 56 +++++++++++++++++++
 .../src/wallet/tls13/cert_verify_ecdsa.rs     | 39 +++++++++++++
 .../src/wallet/tls13/ext_sigalgs.rs           | 10 +++-
 .../src/wallet/tls13/mod.rs                   |  6 ++
 .../src/wallet/tls13/scan_cert_verify.rs      | 48 ++++++++++++++++
 .../wallet/tls13/server_cert_verify_flight.rs | 55 ++++++++++++++++++
 .../src/wallet/tls13/server_trusted_flight.rs | 35 ++++++++++++
 8 files changed, 255 insertions(+), 3 deletions(-)
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/tls13/cert_verify.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/tls13/cert_verify_ecdsa.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/tls13/scan_cert_verify.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/tls13/server_cert_verify_flight.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/tls13/server_trusted_flight.rs

diff --git a/userland/capsule_wallet_nonos/src/wallet/net/fetch_rpc.rs b/userland/capsule_wallet_nonos/src/wallet/net/fetch_rpc.rs
index c33e41282..b88771780 100644
--- a/userland/capsule_wallet_nonos/src/wallet/net/fetch_rpc.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/net/fetch_rpc.rs
@@ -31,6 +31,15 @@ fn fetch_connected(sockets_port: u32, handle: u32, ip: [u8; 4], body: &[u8]) ->
     let flight = super::super::tls13::client_flight(ETH_RPC_HOST)?;
     super::socket_send::socket_send(sockets_port, handle, &flight.record).ok()?;
     let server = super::read_tls_flight::read_tls_flight(sockets_port, handle).ok()?;
+    /*
+     * Balances, the nonce and the fee a transaction pays all come back on
+     * this connection, so it is used only once the server has proved it is
+     * the host. A clock that cannot be read fails the check.
+     */
+    let now = super::rtc_stamp::rtc_stamp()?;
+    if !super::super::tls13::server_trusted_flight(&flight, &server, ETH_RPC_HOST, now) {
+        return None;
+    }
     let http = super::super::rpc::http_post(ETH_RPC_HOST, body);
     let out = super::super::tls13::application_write(&flight, &server, &http)?;
     super::socket_send::socket_send(sockets_port, handle, &out).ok()?;
diff --git a/userland/capsule_wallet_nonos/src/wallet/tls13/cert_verify.rs b/userland/capsule_wallet_nonos/src/wallet/tls13/cert_verify.rs
new file mode 100644
index 000000000..6a2b8237a
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/tls13/cert_verify.rs
@@ -0,0 +1,56 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * CertificateVerify (RFC 8446 section 4.4.3): the server signs the
+ * transcript up to its Certificate with the key in that certificate. It
+ * is the only thing that ties the chain the server sent to the server on
+ * this connection. Without it anyone can replay a real chain, finish the
+ * handshake on keys of their own, and pass every other check.
+ */
+
+use alloc::vec::Vec;
+
+const ECDSA_P256_SHA256: u16 = 0x0403;
+const ECDSA_P384_SHA384: u16 = 0x0503;
+const CONTEXT: &[u8] = b"TLS 1.3, server CertificateVerify";
+
+/// Whether `body`, a CertificateVerify, is `leaf`'s signature over the
+/// transcript `before` it (every handshake message up to Certificate).
+pub fn check(leaf: &[u8], before: &[u8], body: &[u8]) -> bool {
+    if body.len() < 4 {
+        return false;
+    }
+    let scheme = u16::from_be_bytes([body[0], body[1]]);
+    let len = u16::from_be_bytes([body[2], body[3]]) as usize;
+    if 4 + len != body.len() {
+        return false;
+    }
+    let Some(hash) = super::hash_sha256::hash_sha256(before) else { return false };
+    let mut content = Vec::with_capacity(64 + CONTEXT.len() + 1 + hash.len());
+    content.resize(64, 0x20);
+    content.extend_from_slice(CONTEXT);
+    content.push(0);
+    content.extend_from_slice(&hash);
+    let Some(spki) = super::cert_spki::cert_spki(leaf) else { return false };
+    let Some(point) = super::spki_point::spki_point(spki) else { return false };
+    let sig_der = &body[4..];
+    match scheme {
+        ECDSA_P256_SHA256 => super::cert_verify_ecdsa::p256(point, sig_der, &content),
+        ECDSA_P384_SHA384 => super::cert_verify_ecdsa::p384(point, sig_der, &content),
+        _ => false,
+    }
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/tls13/cert_verify_ecdsa.rs b/userland/capsule_wallet_nonos/src/wallet/tls13/cert_verify_ecdsa.rs
new file mode 100644
index 000000000..ce14a55e4
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/tls13/cert_verify_ecdsa.rs
@@ -0,0 +1,39 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! A CertificateVerify signature checked with the leaf's own ECDSA key.
+
+pub fn p256(point: &[u8], sig_der: &[u8], content: &[u8]) -> bool {
+    let (Ok(pk), Some(digest)) =
+        (<[u8; 65]>::try_from(point), super::hash_sha256::hash_sha256(content))
+    else {
+        return false;
+    };
+    let mut sig = [0u8; 64];
+    super::ecdsa_sig_raw::ecdsa_sig_raw(sig_der, 32, &mut sig)
+        && super::verify_p256::verify_p256(&pk, &sig, &digest)
+}
+
+pub fn p384(point: &[u8], sig_der: &[u8], content: &[u8]) -> bool {
+    let (Ok(pk), Some(digest)) =
+        (<[u8; 97]>::try_from(point), super::hash_sha384::hash_sha384(content))
+    else {
+        return false;
+    };
+    let mut sig = [0u8; 96];
+    super::ecdsa_sig_raw::ecdsa_sig_raw(sig_der, 48, &mut sig)
+        && super::verify_p384::verify_p384(&pk, &sig, &digest)
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/tls13/ext_sigalgs.rs b/userland/capsule_wallet_nonos/src/wallet/tls13/ext_sigalgs.rs
index 265570b9b..40a66830a 100644
--- a/userland/capsule_wallet_nonos/src/wallet/tls13/ext_sigalgs.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/tls13/ext_sigalgs.rs
@@ -20,9 +20,13 @@ use super::constants::EXT_SIGNATURE_ALGORITHMS;
 
 pub fn ext_sigalgs(out: &mut Vec<u8>) {
     let mut body = Vec::with_capacity(8);
-    super::push::u16(&mut body, 6);
-    super::push::u16(&mut body, 0x0804);
-    super::push::u16(&mut body, 0x0805);
+    /*
+     * Only what CertificateVerify can check: ECDSA over P-256 and P-384.
+     * Offering RSA-PSS let a server answer with a signature this client
+     * has no verifier for.
+     */
+    super::push::u16(&mut body, 4);
     super::push::u16(&mut body, 0x0403);
+    super::push::u16(&mut body, 0x0503);
     super::push::ext(out, EXT_SIGNATURE_ALGORITHMS, &body);
 }
diff --git a/userland/capsule_wallet_nonos/src/wallet/tls13/mod.rs b/userland/capsule_wallet_nonos/src/wallet/tls13/mod.rs
index 9e86d1cc4..a1f66c924 100644
--- a/userland/capsule_wallet_nonos/src/wallet/tls13/mod.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/tls13/mod.rs
@@ -26,6 +26,8 @@ mod cert_spki;
 mod cert_tbs;
 mod cert_time_value;
 mod cert_valid_now;
+mod cert_verify;
+mod cert_verify_ecdsa;
 mod chain_anchor;
 mod chain_signatures;
 mod client_finished;
@@ -61,6 +63,7 @@ mod record;
 mod record_open;
 mod record_seal;
 mod scan_anchor;
+mod scan_cert_verify;
 mod scan_certificate;
 mod scan_chain;
 mod scan_finished;
@@ -71,6 +74,7 @@ mod scan_validity;
 mod schedule;
 mod self_check;
 mod server_anchor_flight;
+mod server_cert_verify_flight;
 mod server_certificate_flight;
 mod server_chain_flight;
 mod server_complete;
@@ -83,6 +87,7 @@ mod server_hello;
 mod server_hostname_flight;
 mod server_keys;
 mod server_signature_flight;
+mod server_trusted_flight;
 mod server_validity_flight;
 mod spki_point;
 mod traffic_keys;
@@ -105,4 +110,5 @@ pub use server_finished_flight_ready::server_finished_flight_ready;
 pub use server_first_flight::server_first_flight;
 pub use server_hostname_flight::server_hostname_flight;
 pub use server_signature_flight::server_signature_flight;
+pub use server_trusted_flight::server_trusted_flight;
 pub use server_validity_flight::server_validity_flight;
diff --git a/userland/capsule_wallet_nonos/src/wallet/tls13/scan_cert_verify.rs b/userland/capsule_wallet_nonos/src/wallet/tls13/scan_cert_verify.rs
new file mode 100644
index 000000000..f3eeada11
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/tls13/scan_cert_verify.rs
@@ -0,0 +1,48 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! One record's handshake messages, read for the leaf and its signature.
+
+use alloc::vec::Vec;
+
+const CERTIFICATE: u8 = 11;
+const CERTIFICATE_VERIFY: u8 = 15;
+
+/// Some(verdict) once CertificateVerify is reached; None to keep reading.
+pub fn scan(transcript: &mut Vec<u8>, leaf: &mut Option<Vec<u8>>, msgs: &[u8]) -> Option<bool> {
+    let mut pos = 0usize;
+    while pos + 4 <= msgs.len() {
+        let len = ((msgs[pos + 1] as usize) << 16)
+            | ((msgs[pos + 2] as usize) << 8)
+            | msgs[pos + 3] as usize;
+        let end = pos + 4 + len;
+        if end > msgs.len() {
+            return Some(false);
+        }
+        let body = &msgs[pos + 4..end];
+        match msgs[pos] {
+            CERTIFICATE => *leaf = super::cert_at::cert_at(body, 0).map(<[u8]>::to_vec),
+            CERTIFICATE_VERIFY => {
+                let Some(cert) = leaf.as_deref() else { return Some(false) };
+                return Some(super::cert_verify::check(cert, transcript, body));
+            }
+            _ => {}
+        }
+        transcript.extend_from_slice(&msgs[pos..end]);
+        pos = end;
+    }
+    None
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/tls13/server_cert_verify_flight.rs b/userland/capsule_wallet_nonos/src/wallet/tls13/server_cert_verify_flight.rs
new file mode 100644
index 000000000..e100671d4
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/tls13/server_cert_verify_flight.rs
@@ -0,0 +1,55 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * Walking the server's encrypted handshake for CertificateVerify, keeping
+ * the transcript and the leaf certificate as the messages go by. The walk
+ * spans records, since a server may split its flight across several.
+ */
+
+use alloc::vec::Vec;
+
+use super::flight::ClientFlight;
+
+pub fn server_cert_verify_flight(client: &ClientFlight, bytes: &[u8]) -> bool {
+    let Some(mut ctx) = super::server_keys::server_keys(client, bytes) else { return false };
+    let mut leaf: Option<Vec<u8>> = None;
+    let (mut pos, mut seq) = (ctx.used, 0u64);
+    while pos + 5 <= bytes.len() {
+        let len = u16::from_be_bytes([bytes[pos + 3], bytes[pos + 4]]) as usize;
+        let end = pos + 5 + len;
+        if end > bytes.len() {
+            return false;
+        }
+        if bytes[pos] == 23 {
+            let keys = &ctx.keys;
+            let Some(plain) =
+                super::record_open::open(&keys.server_key, &keys.server_iv, seq, &bytes[pos..end])
+            else {
+                return false;
+            };
+            let Some((msgs, 22)) = super::inner_plain::split(&plain) else { return false };
+            if let Some(verdict) =
+                super::scan_cert_verify::scan(&mut ctx.transcript, &mut leaf, msgs)
+            {
+                return verdict;
+            }
+            seq += 1;
+        }
+        pos = end;
+    }
+    false
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/tls13/server_trusted_flight.rs b/userland/capsule_wallet_nonos/src/wallet/tls13/server_trusted_flight.rs
new file mode 100644
index 000000000..46ab5be4b
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/tls13/server_trusted_flight.rs
@@ -0,0 +1,35 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * Everything that has to hold before a byte of application data goes to
+ * the server: a chain that reaches the pinned root with every signature
+ * good, a leaf naming the host and valid now, the leaf's key signing this
+ * handshake, and the server's Finished. The data path asks this, not the
+ * probe, so a status line can never stand in for a check.
+ */
+
+use super::flight::ClientFlight;
+
+pub fn server_trusted_flight(client: &ClientFlight, bytes: &[u8], host: &[u8], now: u64) -> bool {
+    super::server_chain_flight::server_chain_flight(client, bytes)
+        && super::server_anchor_flight::server_anchor_flight(client, bytes)
+        && super::server_signature_flight::server_signature_flight(client, bytes)
+        && super::server_hostname_flight::server_hostname_flight(client, bytes, host)
+        && super::server_validity_flight::server_validity_flight(client, bytes, now)
+        && super::server_cert_verify_flight::server_cert_verify_flight(client, bytes)
+        && super::server_finished_flight::server_finished_flight(client, bytes)
+}

From 596b428220b4f2cc0e80df61e5c579a830b1a618 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 16:03:30 +0000
Subject: [PATCH 24/29] wallet: show the recovery phrase, and make Esc go back

Creating a wallet set the backup flag, but the Etna Receive screen was
drawn over it, so the phrase never appeared, and the next Enter wiped
it. On a machine that cannot seal keys the account then lived only in
RAM with no way back. The phrase now has its own screen, straight after
creation, with no back button: confirming is the only way on, and it
wipes the words.

Esc used to close the window before any handler saw it, so every "Esc to
cancel" on screen was dead. It now closes an open panel, returns other
screens home, and does nothing at home.
---
 .../src/wallet/event/escape.rs                | 39 ++++++++++++
 .../src/wallet/event/etna_click.rs            | 11 +++-
 .../src/wallet/event/mod.rs                   |  1 +
 .../src/wallet/event/on_event.rs              |  3 +-
 .../src/wallet/event/on_key.rs                |  3 +
 .../src/wallet/paint/paint.rs                 |  4 ++
 .../src/wallet/screen/backup.rs               | 61 +++++++++++++++++++
 .../src/wallet/screen/backup_words.rs         | 48 +++++++++++++++
 .../src/wallet/screen/mod.rs                  |  2 +
 9 files changed, 169 insertions(+), 3 deletions(-)
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/event/escape.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/backup.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/backup_words.rs

diff --git a/userland/capsule_wallet_nonos/src/wallet/event/escape.rs b/userland/capsule_wallet_nonos/src/wallet/event/escape.rs
new file mode 100644
index 000000000..01e6a9d2f
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/event/escape.rs
@@ -0,0 +1,39 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * Esc goes back one step: an open panel closes, any other screen returns
+ * home, and home stays where it is. It used to close the window, so every
+ * "Esc to cancel" on screen was a promise the key could not keep, and a
+ * reader backing out of a send lost the wallet window instead.
+ */
+
+use nonos_app_skeleton::EventOutcome;
+
+use crate::wallet::state::{State, VIEW_HOME};
+
+pub fn escape(state: &mut State) -> EventOutcome {
+    if state.panel != 0 {
+        state.panel = 0;
+        return EventOutcome::Repaint;
+    }
+    if state.view != VIEW_HOME {
+        state.view = VIEW_HOME;
+        state.scroll = 0;
+        return EventOutcome::Repaint;
+    }
+    EventOutcome::Idle
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/event/etna_click.rs b/userland/capsule_wallet_nonos/src/wallet/event/etna_click.rs
index 80608f4e0..09eccc9e3 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/etna_click.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/etna_click.rs
@@ -27,7 +27,9 @@ use crate::wallet::state::{State, VIEW_HOME, VIEW_RECEIVE, VIEW_SEND, VIEW_SHIEL
 /// Whether the screen on show is drawn on the Etna frame.
 pub fn on_etna(state: &State) -> bool {
     state.panel == 0
-        && (state.view == VIEW_HOME || (state.view == VIEW_RECEIVE && !state.import_active))
+        && (state.backup_active
+            || state.view == VIEW_HOME
+            || (state.view == VIEW_RECEIVE && !state.import_active))
 }
 
 fn go(state: &mut State, view: u8) -> EventOutcome {
@@ -40,6 +42,13 @@ pub fn etna_click(state: &mut State, x: u32, y: u32) -> EventOutcome {
     let Some(press) = at(x, y) else {
         return EventOutcome::Idle;
     };
+    if state.backup_active {
+        if press != Press::Footer(0) {
+            return EventOutcome::Idle;
+        }
+        let _ = super::backup::confirm_backup(state);
+        return go(state, VIEW_HOME);
+    }
     match (press, state.view) {
         (Press::Footer(0), VIEW_HOME) if !state.address_ready => super::generate::generate(state),
         (Press::Footer(1), VIEW_HOME) if !state.address_ready => {
diff --git a/userland/capsule_wallet_nonos/src/wallet/event/mod.rs b/userland/capsule_wallet_nonos/src/wallet/event/mod.rs
index db8851aea..339885cb9 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/mod.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/mod.rs
@@ -17,6 +17,7 @@
 mod backup;
 mod broadcast;
 mod broadcast_arm;
+mod escape;
 mod etna_click;
 mod etna_scroll;
 mod edit_amount;
diff --git a/userland/capsule_wallet_nonos/src/wallet/event/on_event.rs b/userland/capsule_wallet_nonos/src/wallet/event/on_event.rs
index a4aa0f26b..075125543 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/on_event.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/on_event.rs
@@ -14,7 +14,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-use nonos_app_skeleton::{EventOutcome, InputEvent, InputKind, KEY_ESC};
+use nonos_app_skeleton::{EventOutcome, InputEvent, InputKind};
 
 use crate::wallet::state::State;
 
@@ -23,7 +23,6 @@ use crate::wallet::state::State;
 // UI responsive — every stray click no longer forces a full 1280x800 repaint.
 pub fn on_event(state: &mut State, event: InputEvent) -> EventOutcome {
     match event.kind {
-        InputKind::KeyDown if event.code == KEY_ESC => EventOutcome::Close,
         InputKind::KeyDown => super::on_key::on_key(state, event.code),
         InputKind::ButtonDown => super::on_pointer::on_pointer(state, event.x, event.y),
         InputKind::Wheel => super::etna_scroll::scroll(state, event.delta_y),
diff --git a/userland/capsule_wallet_nonos/src/wallet/event/on_key.rs b/userland/capsule_wallet_nonos/src/wallet/event/on_key.rs
index efc37aa77..6521a75c1 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/on_key.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/on_key.rs
@@ -57,6 +57,9 @@ pub fn on_key(state: &mut State, code: u32) -> EventOutcome {
     if let Some(out) = super::field_input::field_input(state, code) {
         return out;
     }
+    if code == nonos_app_skeleton::KEY_ESC {
+        return super::escape::escape(state);
+    }
     if code == b'r' as u32 || code == b'R' as u32 {
         hydrate(state);
         return EventOutcome::Repaint;
diff --git a/userland/capsule_wallet_nonos/src/wallet/paint/paint.rs b/userland/capsule_wallet_nonos/src/wallet/paint/paint.rs
index 84469460d..c734abbc6 100644
--- a/userland/capsule_wallet_nonos/src/wallet/paint/paint.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/paint/paint.rs
@@ -23,6 +23,10 @@ use crate::wallet::state::{
 pub fn paint(state: &State, fb: &mut PaintBuffer) {
     // Home and the first screen are drawn on the Etna frame, alone.
     if crate::wallet::event::on_etna(state) {
+        if state.backup_active {
+            crate::wallet::screen::backup::backup(state, fb);
+            return;
+        }
         match (state.view, state.address_ready) {
             (VIEW_RECEIVE, _) => crate::wallet::screen::receive::receive(state, fb),
             (_, true) => crate::wallet::screen::home::home(state, fb),
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/backup.rs b/userland/capsule_wallet_nonos/src/wallet/screen/backup.rs
new file mode 100644
index 000000000..057de12e8
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/backup.rs
@@ -0,0 +1,61 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! 02  RECOVERY PHRASE, shown once, straight after the wallet is made. The
+//! words are the wallet: without them a machine that cannot keep keys loses
+//! the account at the next reboot. There is no back button; the only way on
+//! is to say they are written down, which wipes them from this machine.
+
+use nonos_app_skeleton::PaintBuffer;
+
+use super::hits::{self, Press};
+use crate::wallet::etna::backdrop::Backdrop;
+use crate::wallet::etna::frame::{begin, end};
+use crate::wallet::etna::frame_spec::FrameSpec;
+use crate::wallet::etna::parts::action::Weight;
+use crate::wallet::etna::tokens::{GAP, TEXT_2, TEXT_3};
+use crate::wallet::etna::wrap::wrapped;
+use crate::wallet::etna::Role;
+use crate::wallet::state::State;
+
+const LEAD: &str = "Write these words on paper, in this order. They are shown once.";
+const WARN: &str = "Whoever holds them holds the account. Never type them into a website \
+                    and never photograph them.";
+
+pub fn backup(state: &State, fb: &mut PaintBuffer) {
+    hits::clear();
+    let status = super::status::parts(state);
+    let footer = [("I wrote them down", Weight::Primary, true)];
+    let spec = FrameSpec {
+        number: "02",
+        title: "Recovery phrase",
+        back: false,
+        backdrop: Some(Backdrop::Backup),
+        failure: None,
+        footer: &footer,
+        status: &status,
+        scroll: state.scroll,
+    };
+    let mut l = begin(fb, &spec);
+    let c = l.content;
+    let (x, w) = (c.x as i32, c.w as i32);
+    let mut y = c.y + wrapped(fb, x, c.y as i32, w, Role::Lead, LEAD, TEXT_2) as u32 + GAP;
+    y += super::backup_words::grid(state, fb, c.x, y, c.w) + GAP;
+    y += wrapped(fb, x, y as i32, w, Role::Fact, WARN, TEXT_3) as u32 + GAP;
+    hits::reach(y, state.scroll, l.content_bottom);
+    end(fb, &spec, &mut l);
+    hits::put(Press::Footer(0), l.footer[0]);
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/backup_words.rs b/userland/capsule_wallet_nonos/src/wallet/screen/backup_words.rs
new file mode 100644
index 000000000..1cf6628c5
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/backup_words.rs
@@ -0,0 +1,48 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+//! The recovery words as a numbered grid, read left to right, so the order
+//! a reader copies them in cannot be mistaken.
+
+use nonos_app_skeleton::PaintBuffer;
+
+use crate::wallet::etna::Role;
+use crate::wallet::etna::text::{draw, draw_in, line};
+use crate::wallet::etna::tokens::{CORNER, OUTLINE, TEXT_3, TIGHT};
+use crate::wallet::state::State;
+
+const COLS: u32 = 3;
+const PAD: u32 = 14;
+
+/// Draw the words at `x, y` across `w`; returns the grid's height.
+pub fn grid(state: &State, fb: &mut PaintBuffer, x: u32, y: u32, w: u32) -> u32 {
+    let count = state.backup_count as usize;
+    let cell_w = (w - (COLS - 1) * TIGHT) / COLS;
+    let cell_h = line(Role::RowValue) as u32 + 2 * PAD;
+    let rows = (count as u32).div_ceil(COLS);
+    for (i, &index) in state.backup_words.iter().take(count).enumerate() {
+        let (col, row) = (i as u32 % COLS, i as u32 / COLS);
+        let cx = x + col * (cell_w + TIGHT);
+        let cy = y + row * (cell_h + TIGHT);
+        fb.stroke_round(cx, cy, cell_w, cell_h, CORNER, 1, OUTLINE);
+        let n = alloc::format!("{:>2}", i + 1);
+        let top = (cy + PAD) as i32;
+        let after = draw_in(fb, (cx + PAD) as i32, top, Role::Fact, &n, TEXT_3);
+        let word = nonos_hd::ENGLISH_WORDLIST.get(index as usize).copied().unwrap_or("");
+        draw(fb, after + TIGHT as i32, top, Role::RowValue, word);
+    }
+    rows * cell_h + rows.saturating_sub(1) * TIGHT
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/mod.rs b/userland/capsule_wallet_nonos/src/wallet/screen/mod.rs
index 4f5ecc205..7454ae486 100644
--- a/userland/capsule_wallet_nonos/src/wallet/screen/mod.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/mod.rs
@@ -18,6 +18,8 @@
 //! status line, balances and the table of what can be pressed.
 
 pub mod amounts;
+pub mod backup;
+pub mod backup_words;
 pub mod hits;
 pub mod home;
 mod home_actions;

From 49dffbb1ecb7b8ec35cd2e7215a08a4d11c78bae Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 16:03:30 +0000
Subject: [PATCH 25/29] wallet: refuse to sign a transfer above a 1000 gwei gas
 price

The fee cap is twice the node's gas price with no upper bound, so a
broken node's reading would be signed as given. A transfer is now
refused above 1000 gwei, and the reason the refresh failed is the one
shown, instead of a single message for every cause.
---
 .../src/wallet/event/send_now.rs              |  4 +--
 .../src/wallet/event/sign_eth.rs              |  4 +--
 .../src/wallet/event/tx_freshen.rs            | 28 ++++++++++++++-----
 3 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/userland/capsule_wallet_nonos/src/wallet/event/send_now.rs b/userland/capsule_wallet_nonos/src/wallet/event/send_now.rs
index e7eb92201..b82fc4c2b 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/send_now.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/send_now.rs
@@ -54,8 +54,8 @@ fn sign_nox(state: &mut State) {
         return;
     }
     // Fresh nonce and fee at send time, or refuse rather than sign a bad tx.
-    if !super::tx_freshen::freshen_nonce_and_fee(state) {
-        state.status = b"cannot reach network for nonce and fee, try again";
+    if let Err(why) = super::tx_freshen::freshen_nonce_and_fee(state) {
+        state.status = why;
         return;
     }
     let raw = sign_nox_transfer(
diff --git a/userland/capsule_wallet_nonos/src/wallet/event/sign_eth.rs b/userland/capsule_wallet_nonos/src/wallet/event/sign_eth.rs
index 212a79854..b417e6026 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/sign_eth.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/sign_eth.rs
@@ -35,8 +35,8 @@ pub fn sign_eth(state: &mut State) -> EventOutcome {
         return EventOutcome::Repaint;
     }
     // Fresh nonce and fee at send time, or refuse rather than sign a bad tx.
-    if !super::tx_freshen::freshen_nonce_and_fee(state) {
-        state.status = b"cannot reach network for nonce and fee, try again";
+    if let Err(why) = super::tx_freshen::freshen_nonce_and_fee(state) {
+        state.status = why;
         return EventOutcome::Repaint;
     }
     let raw = sign_eth_transfer(
diff --git a/userland/capsule_wallet_nonos/src/wallet/event/tx_freshen.rs b/userland/capsule_wallet_nonos/src/wallet/event/tx_freshen.rs
index aff403758..d1d909434 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/tx_freshen.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/tx_freshen.rs
@@ -17,14 +17,22 @@
 use crate::wallet::net::read_field;
 use crate::wallet::state::State;
 
+/*
+ * No transfer is signed above this gas price. Mainnet runs at a few gwei
+ * and its worst spikes have been hundreds; a reading past a thousand is a
+ * broken or lying node, and the fee cap is twice the reading, so signing on
+ * it would spend real money on nothing.
+ */
+pub const FEE_CEILING_WEI: u64 = 1_000_000_000_000;
+
 /// Pull a fresh nonce and fee from the chain right before a transaction is
 /// built, so signing never uses a stale background value or a zero the probe
-/// had not filled yet. Both reads are the bounded per-field RPC calls. Returns
-/// true only when both are current; a caller that gets false must not sign,
-/// because a transaction with the wrong nonce or a zero fee would be rejected
-/// or stuck. The account nonce takes priority over the send screen's editable
-/// value so a resend after a confirmed transaction advances correctly.
-pub fn freshen_nonce_and_fee(state: &mut State) -> bool {
+/// had not filled yet. Both reads are the bounded per-field RPC calls. Ok only
+/// when both are current and the fee is under the ceiling; a caller that gets
+/// Err must not sign, and shows the reason. The account nonce takes priority
+/// over the send screen's editable value so a resend after a confirmed
+/// transaction advances correctly.
+pub fn freshen_nonce_and_fee(state: &mut State) -> Result<(), &'static [u8]> {
     if let Some(n) = read_field::nonce(&state.address) {
         state.live_nonce = n;
         state.send_nonce = n;
@@ -34,5 +42,11 @@ pub fn freshen_nonce_and_fee(state: &mut State) -> bool {
         state.fee_wei = f;
         state.fee_ready = true;
     }
-    state.nonce_ready && state.fee_ready && state.fee_wei != 0
+    if !(state.nonce_ready && state.fee_ready && state.fee_wei != 0) {
+        return Err(b"cannot reach network for nonce and fee, try again");
+    }
+    if state.fee_wei > FEE_CEILING_WEI {
+        return Err(b"network fee above 1000 gwei, not signing");
+    }
+    Ok(())
 }

From 9d3a712254650270a277c47f4d1c117823c4ac27 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 18:59:56 +0000
Subject: [PATCH 26/29] wallet: draw the Shield screens and say when no shield
 service answers

Shield opened the old dashboard. It now has its own Etna screens: home
with shielded balances first and the nox1 receive address, deposit and
withdraw in the pool's standard sizes only (0.01 to 10 ETH, 1,000 to
5,000,000 NOX), private send with the sentence the pool asks every
wallet to show, review, proof progress, history and the Sepolia
contracts in full.

The spend wait is a meter of 20 new notes and 6 hours; spending early
needs the typed words "spend early". A nox1 address is pasted with
Ctrl+V, since it is too long to type.

Nothing here pretends. Balances read from the note store show a dash
until notes exist, history and proofs show only what the shield
service reports, and Confirm goes through one request seam that
refuses with a sentence while this build cannot yet speak the
service's format.
---
 .../src/wallet/event/escape.rs                |  5 +-
 .../src/wallet/event/etna_click.rs            | 13 +---
 .../src/wallet/event/etna_scroll.rs           |  2 +-
 .../src/wallet/event/mod.rs                   |  3 +-
 .../src/wallet/event/on_etna.rs               | 31 ++++++++
 .../src/wallet/event/on_event.rs              | 10 ++-
 .../src/wallet/event/on_key.rs                |  3 +
 .../src/wallet/event/on_pointer.rs            |  2 +-
 .../src/wallet/paint/paint.rs                 |  3 +-
 .../src/wallet/screen/hits.rs                 |  7 +-
 .../src/wallet/screen/mod.rs                  |  1 +
 .../src/wallet/screen/shield/absent.rs        | 44 +++++++++++
 .../src/wallet/screen/shield/amounts.rs       | 55 ++++++++++++++
 .../src/wallet/screen/shield/check.rs         | 52 +++++++++++++
 .../src/wallet/screen/shield/chips.rs         | 65 ++++++++++++++++
 .../src/wallet/screen/shield/click.rs         | 70 +++++++++++++++++
 .../src/wallet/screen/shield/consts.rs        | 62 +++++++++++++++
 .../src/wallet/screen/shield/deposit.rs       | 74 ++++++++++++++++++
 .../src/wallet/screen/shield/edges.rs         | 45 +++++++++++
 .../src/wallet/screen/shield/field.rs         | 66 ++++++++++++++++
 .../src/wallet/screen/shield/footer.rs        | 57 ++++++++++++++
 .../src/wallet/screen/shield/history.rs       | 74 ++++++++++++++++++
 .../wallet/screen/shield/history_labels.rs    | 37 +++++++++
 .../src/wallet/screen/shield/home.rs          | 63 ++++++++++++++++
 .../src/wallet/screen/shield/home_more.rs     | 44 +++++++++++
 .../src/wallet/screen/shield/home_parts.rs    | 68 +++++++++++++++++
 .../src/wallet/screen/shield/home_receive.rs  | 53 +++++++++++++
 .../src/wallet/screen/shield/key.rs           | 69 +++++++++++++++++
 .../src/wallet/screen/shield/meter.rs         | 63 ++++++++++++++++
 .../src/wallet/screen/shield/mod.rs           | 50 +++++++++++++
 .../src/wallet/screen/shield/network.rs       | 73 ++++++++++++++++++
 .../src/wallet/screen/shield/paste.rs         | 42 +++++++++++
 .../src/wallet/screen/shield/pick.rs          | 50 +++++++++++++
 .../src/wallet/screen/shield/proving.rs       | 75 +++++++++++++++++++
 .../src/wallet/screen/shield/request.rs       | 34 +++++++++
 .../src/wallet/screen/shield/review.rs        | 70 +++++++++++++++++
 .../src/wallet/screen/shield/review_rows.rs   | 66 ++++++++++++++++
 .../src/wallet/screen/shield/review_text.rs   | 38 ++++++++++
 .../src/wallet/screen/shield/send.rs          | 68 +++++++++++++++++
 .../src/wallet/screen/shield/send_fields.rs   | 59 +++++++++++++++
 .../src/wallet/screen/shield/show.rs          | 35 +++++++++
 .../src/wallet/screen/shield/sizes.rs         | 72 ++++++++++++++++++
 .../src/wallet/screen/shield/status.rs        | 41 ++++++++++
 .../src/wallet/screen/shield/withdraw.rs      | 70 +++++++++++++++++
 .../src/wallet/state/mod.rs                   |  2 +
 .../src/wallet/state/new.rs                   |  1 +
 .../src/wallet/state/shield_log.rs            | 55 ++++++++++++++
 .../src/wallet/state/shield_ui.rs             | 63 ++++++++++++++++
 .../src/wallet/state/types.rs                 |  2 +
 49 files changed, 2091 insertions(+), 16 deletions(-)
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/event/on_etna.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/absent.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/amounts.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/check.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/chips.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/click.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/consts.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/deposit.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/edges.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/field.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/footer.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/history.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/history_labels.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/home.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/home_more.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/home_parts.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/home_receive.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/key.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/meter.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/mod.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/network.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/paste.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/pick.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/proving.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/request.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/review.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/review_rows.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/review_text.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/send.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/send_fields.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/show.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/sizes.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/status.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/withdraw.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/state/shield_log.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/state/shield_ui.rs

diff --git a/userland/capsule_wallet_nonos/src/wallet/event/escape.rs b/userland/capsule_wallet_nonos/src/wallet/event/escape.rs
index 01e6a9d2f..c54eb5864 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/escape.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/escape.rs
@@ -23,13 +23,16 @@
 
 use nonos_app_skeleton::EventOutcome;
 
-use crate::wallet::state::{State, VIEW_HOME};
+use crate::wallet::state::{State, VIEW_HOME, VIEW_SHIELD};
 
 pub fn escape(state: &mut State) -> EventOutcome {
     if state.panel != 0 {
         state.panel = 0;
         return EventOutcome::Repaint;
     }
+    if state.view == VIEW_SHIELD {
+        return crate::wallet::screen::shield::click::back(state);
+    }
     if state.view != VIEW_HOME {
         state.view = VIEW_HOME;
         state.scroll = 0;
diff --git a/userland/capsule_wallet_nonos/src/wallet/event/etna_click.rs b/userland/capsule_wallet_nonos/src/wallet/event/etna_click.rs
index 09eccc9e3..66eedcf49 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/etna_click.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/etna_click.rs
@@ -24,14 +24,6 @@ use nonos_app_skeleton::EventOutcome;
 use crate::wallet::screen::hits::{at, Press};
 use crate::wallet::state::{State, VIEW_HOME, VIEW_RECEIVE, VIEW_SEND, VIEW_SHIELD, VIEW_SWAP};
 
-/// Whether the screen on show is drawn on the Etna frame.
-pub fn on_etna(state: &State) -> bool {
-    state.panel == 0
-        && (state.backup_active
-            || state.view == VIEW_HOME
-            || (state.view == VIEW_RECEIVE && !state.import_active))
-}
-
 fn go(state: &mut State, view: u8) -> EventOutcome {
     state.view = view;
     state.scroll = 0;
@@ -49,6 +41,9 @@ pub fn etna_click(state: &mut State, x: u32, y: u32) -> EventOutcome {
         let _ = super::backup::confirm_backup(state);
         return go(state, VIEW_HOME);
     }
+    if state.view == VIEW_SHIELD {
+        return crate::wallet::screen::shield::click::click(state, press);
+    }
     match (press, state.view) {
         (Press::Footer(0), VIEW_HOME) if !state.address_ready => super::generate::generate(state),
         (Press::Footer(1), VIEW_HOME) if !state.address_ready => {
@@ -64,7 +59,7 @@ pub fn etna_click(state: &mut State, x: u32, y: u32) -> EventOutcome {
         (Press::Send, _) => go(state, VIEW_SEND),
         (Press::Receive, _) => go(state, VIEW_RECEIVE),
         (Press::Swap, _) => go(state, VIEW_SWAP),
-        (Press::Shield, _) => go(state, VIEW_SHIELD),
+        (Press::Shield, _) => crate::wallet::screen::shield::click::open(state),
         (Press::Settings | Press::Accounts, _) => {
             state.panel = 3;
             EventOutcome::Repaint
diff --git a/userland/capsule_wallet_nonos/src/wallet/event/etna_scroll.rs b/userland/capsule_wallet_nonos/src/wallet/event/etna_scroll.rs
index 7d00ef65b..45d170214 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/etna_scroll.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/etna_scroll.rs
@@ -18,7 +18,7 @@
 
 use nonos_app_skeleton::EventOutcome;
 
-use super::etna_click::on_etna;
+use super::on_etna::on_etna;
 use crate::wallet::screen::hits::limit;
 use crate::wallet::state::State;
 
diff --git a/userland/capsule_wallet_nonos/src/wallet/event/mod.rs b/userland/capsule_wallet_nonos/src/wallet/event/mod.rs
index 339885cb9..8e9c47537 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/mod.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/mod.rs
@@ -19,6 +19,7 @@ mod broadcast;
 mod broadcast_arm;
 mod escape;
 mod etna_click;
+mod on_etna;
 mod etna_scroll;
 mod edit_amount;
 mod edit_nonce;
@@ -57,6 +58,6 @@ mod tx_freshen;
 mod unstake_flow;
 mod keep;
 
-pub use etna_click::on_etna;
+pub use on_etna::on_etna;
 pub use on_event::on_event;
 pub use probe_tick::probe_tick;
diff --git a/userland/capsule_wallet_nonos/src/wallet/event/on_etna.rs b/userland/capsule_wallet_nonos/src/wallet/event/on_etna.rs
new file mode 100644
index 000000000..a8b796d09
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/event/on_etna.rs
@@ -0,0 +1,31 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * Whether the screen on show is drawn on the Etna frame. Everything else
+ * still paints the older chrome, so this decides which click handler and
+ * which painter a frame gets.
+ */
+
+use crate::wallet::state::{State, VIEW_HOME, VIEW_RECEIVE, VIEW_SHIELD};
+
+pub fn on_etna(state: &State) -> bool {
+    state.panel == 0
+        && (state.backup_active
+            || state.view == VIEW_HOME
+            || (state.view == VIEW_SHIELD && state.address_ready)
+            || (state.view == VIEW_RECEIVE && !state.import_active))
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/event/on_event.rs b/userland/capsule_wallet_nonos/src/wallet/event/on_event.rs
index 075125543..e53f16548 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/on_event.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/on_event.rs
@@ -23,7 +23,15 @@ use crate::wallet::state::State;
 // UI responsive — every stray click no longer forces a full 1280x800 repaint.
 pub fn on_event(state: &mut State, event: InputEvent) -> EventOutcome {
     match event.kind {
-        InputKind::KeyDown => super::on_key::on_key(state, event.code),
+        InputKind::KeyDown => {
+            let ctrl = event.flags & nonos_app_skeleton::MOD_CTRL != 0;
+            if ctrl && (event.code == b'v' as u32 || event.code == b'V' as u32) {
+                if let Some(out) = crate::wallet::screen::shield::paste::paste(state) {
+                    return out;
+                }
+            }
+            super::on_key::on_key(state, event.code)
+        }
         InputKind::ButtonDown => super::on_pointer::on_pointer(state, event.x, event.y),
         InputKind::Wheel => super::etna_scroll::scroll(state, event.delta_y),
         _ => EventOutcome::Idle,
diff --git a/userland/capsule_wallet_nonos/src/wallet/event/on_key.rs b/userland/capsule_wallet_nonos/src/wallet/event/on_key.rs
index 6521a75c1..4f33e0ccb 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/on_key.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/on_key.rs
@@ -54,6 +54,9 @@ pub fn on_key(state: &mut State, code: u32) -> EventOutcome {
         state.status = b"send cancelled";
         return EventOutcome::Repaint;
     }
+    if let Some(out) = crate::wallet::screen::shield::key::key(state, code) {
+        return out;
+    }
     if let Some(out) = super::field_input::field_input(state, code) {
         return out;
     }
diff --git a/userland/capsule_wallet_nonos/src/wallet/event/on_pointer.rs b/userland/capsule_wallet_nonos/src/wallet/event/on_pointer.rs
index 3b102440f..9146a13f4 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/on_pointer.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/on_pointer.rs
@@ -30,7 +30,7 @@ pub fn on_pointer(state: &mut State, x: i32, y: i32) -> EventOutcome {
         state.locked = false;
         return EventOutcome::Repaint;
     }
-    if super::etna_click::on_etna(state) {
+    if super::on_etna::on_etna(state) {
         return super::etna_click::etna_click(state, x, y);
     }
     if header_icon(state, x, y) {
diff --git a/userland/capsule_wallet_nonos/src/wallet/paint/paint.rs b/userland/capsule_wallet_nonos/src/wallet/paint/paint.rs
index c734abbc6..e6b4d40d6 100644
--- a/userland/capsule_wallet_nonos/src/wallet/paint/paint.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/paint/paint.rs
@@ -17,7 +17,7 @@
 use nonos_app_skeleton::PaintBuffer;
 
 use crate::wallet::state::{
-    State, VIEW_HOME, VIEW_NOX, VIEW_PROOF, VIEW_RECEIVE, VIEW_SEND, VIEW_SHIELDED, VIEW_SWAP,
+    State, VIEW_HOME, VIEW_NOX, VIEW_SHIELD, VIEW_PROOF, VIEW_RECEIVE, VIEW_SEND, VIEW_SHIELDED, VIEW_SWAP,
 };
 
 pub fn paint(state: &State, fb: &mut PaintBuffer) {
@@ -29,6 +29,7 @@ pub fn paint(state: &State, fb: &mut PaintBuffer) {
         }
         match (state.view, state.address_ready) {
             (VIEW_RECEIVE, _) => crate::wallet::screen::receive::receive(state, fb),
+            (VIEW_SHIELD, true) => crate::wallet::screen::shield::show::show(state, fb),
             (_, true) => crate::wallet::screen::home::home(state, fb),
             (_, false) => crate::wallet::screen::welcome::welcome(state, fb),
         }
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/hits.rs b/userland/capsule_wallet_nonos/src/wallet/screen/hits.rs
index 1221b57d4..e6c55ac34 100644
--- a/userland/capsule_wallet_nonos/src/wallet/screen/hits.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/hits.rs
@@ -33,9 +33,14 @@ pub enum Press {
     Back,
     Dismiss,
     Footer(u8),
+    /* The Shield screens: a screen to open, an asset, a size, a field. */
+    Go(u8),
+    Asset(u8),
+    Pick(u8),
+    Field(u8),
 }
 
-const MAX: usize = 16;
+const MAX: usize = 32;
 static HITS: Mutex<([(Press, Rect); MAX], usize)> =
     Mutex::new(([(Press::Back, Rect::new(0, 0, 0, 0)); MAX], 0));
 
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/mod.rs b/userland/capsule_wallet_nonos/src/wallet/screen/mod.rs
index 7454ae486..cf46266f0 100644
--- a/userland/capsule_wallet_nonos/src/wallet/screen/mod.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/mod.rs
@@ -26,5 +26,6 @@ mod home_actions;
 mod home_pills;
 pub mod receive;
 pub mod receive_address;
+pub mod shield;
 pub mod status;
 pub mod welcome;
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/absent.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/absent.rs
new file mode 100644
index 000000000..706119cb9
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/absent.rs
@@ -0,0 +1,44 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * What a Shield screen says when there is no shield service to do the work.
+ * The screens stay usable for reading and choosing; only the step that would
+ * hand work to the service is held back, and this is the sentence saying why.
+ */
+
+use crate::wallet::shield::probe::Shield;
+use crate::wallet::state::State;
+
+const ABSENT: &str = "No shield service is running on this machine. You can look and \
+     choose, but nothing is deposited, sent or withdrawn until one is installed.";
+const LOOKING: &str = "Looking for the shield service.";
+
+pub fn ready(state: &State) -> bool {
+    state.shield.available()
+}
+
+/* The banner for this screen: a failure the service reported, else absence. */
+pub fn banner(state: &State) -> Option<&'static str> {
+    if let Some(f) = state.shield_ui.failure {
+        return Some(f);
+    }
+    match state.shield {
+        Shield::Present => None,
+        Shield::Absent => Some(ABSENT),
+        Shield::Unknown => Some(LOOKING),
+    }
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/amounts.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/amounts.rs
new file mode 100644
index 000000000..60af479b0
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/amounts.rs
@@ -0,0 +1,55 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * Shielded balances as a person reads them: four places for ETH, two for
+ * NOX, and a dash while no note has been found, since an empty note store
+ * means nothing was scanned yet as often as it means nothing is held.
+ */
+
+use alloc::format;
+use alloc::string::String;
+
+use super::consts::{NOTE_ETH, NOTE_NOX};
+use crate::wallet::nox::format_nox;
+use crate::wallet::screen::amounts::UNREAD;
+use crate::wallet::state::State;
+
+const WEI: u128 = 1_000_000_000_000_000_000;
+
+fn eth(wei: u128) -> String {
+    format!("{}.{:04}", wei / WEI, (wei % WEI) / (WEI / 10_000))
+}
+
+fn nox(wei: u128) -> String {
+    let mut out = [0u8; 64];
+    let n = format_nox(wei, &mut out);
+    String::from(core::str::from_utf8(&out[..n]).unwrap_or(UNREAD))
+}
+
+pub fn shielded_eth(state: &State) -> String {
+    if state.notes.is_empty() {
+        return String::from(UNREAD);
+    }
+    eth(state.notes.balance(NOTE_ETH))
+}
+
+pub fn shielded_nox(state: &State) -> String {
+    if state.notes.is_empty() {
+        return String::from(UNREAD);
+    }
+    nox(state.notes.balance(NOTE_NOX))
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/check.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/check.rs
new file mode 100644
index 000000000..257d8a26b
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/check.rs
@@ -0,0 +1,52 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * What a private payment needs before it can be reviewed: a nox1 address
+ * made of the bech32 alphabet, a positive amount with at most 18 decimals,
+ * and either a note that has waited long enough or the typed override.
+ */
+
+use super::consts::OVERRIDE;
+use crate::wallet::state::shield_ui::ShieldUi;
+
+const BECH32: &[u8] = b"qpzry9x8gf2tvdw0s3jn54khce6mua7l";
+/* Short enough to reject a prefix typed by mistake, long before any key. */
+const MIN_ADDR: usize = 12;
+
+pub fn address_ok(to: &str) -> bool {
+    let Some(rest) = to.strip_prefix("nox1") else { return false };
+    to.len() >= MIN_ADDR && rest.bytes().all(|b| BECH32.contains(&b))
+}
+
+pub fn amount_ok(text: &str) -> bool {
+    let mut parts = text.splitn(2, '.');
+    let whole = parts.next().unwrap_or("");
+    let frac = parts.next().unwrap_or("");
+    let digits = |s: &str| s.bytes().all(|b| b.is_ascii_digit());
+    if (whole.is_empty() && frac.is_empty()) || !digits(whole) || !digits(frac) || frac.len() > 18 {
+        return false;
+    }
+    whole.bytes().chain(frac.bytes()).any(|b| b != b'0')
+}
+
+pub fn wait_ok(ui: &ShieldUi) -> bool {
+    super::meter::waited(ui) || ui.override_text == OVERRIDE
+}
+
+pub fn send_ready(ui: &ShieldUi) -> bool {
+    address_ok(&ui.to) && amount_ok(&ui.amount) && wait_ok(ui)
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/chips.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/chips.rs
new file mode 100644
index 000000000..bca7915a6
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/chips.rs
@@ -0,0 +1,65 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * A row of choices where exactly one may be picked: the asset, or one of the
+ * standard sizes. Four to a row, each a press the click table knows by its
+ * index, so the size picked is the size that was drawn under the pointer.
+ */
+
+use nonos_app_skeleton::PaintBuffer;
+
+use crate::wallet::etna::rect::Rect;
+use crate::wallet::etna::text::{draw_in, line, width};
+use crate::wallet::etna::tokens::{CORNER, INK, OUTLINE, TEXT, TEXT_2, TIGHT};
+use crate::wallet::etna::Role;
+use crate::wallet::screen::hits::{self, Press};
+
+const PER_ROW: u32 = 4;
+const CHIP_H: u32 = 40;
+
+fn chip(fb: &mut PaintBuffer, at: Rect, label: &str, picked: bool) {
+    if picked {
+        fb.fill_round(at.x, at.y, at.w, at.h, CORNER, TEXT);
+    } else {
+        fb.stroke_round(at.x, at.y, at.w, at.h, CORNER, 1, OUTLINE);
+    }
+    let ink = if picked { INK } else { TEXT_2 };
+    let tx = at.x as i32 + (at.w as i32 - width(Role::RowValue, label)) / 2;
+    let ty = at.y as i32 + (at.h as i32 - line(Role::RowValue)) / 2;
+    draw_in(fb, tx, ty, Role::RowValue, label, ink);
+}
+
+/* Lays the labels out and returns the height used. */
+pub fn chips(
+    fb: &mut PaintBuffer,
+    c: Rect,
+    y: u32,
+    labels: &[&str],
+    picked: Option<u8>,
+    press: fn(u8) -> Press,
+) -> u32 {
+    let per = PER_ROW.min(labels.len() as u32).max(1);
+    let cw = (c.w - TIGHT * (per - 1)) / per;
+    for (i, label) in labels.iter().enumerate() {
+        let (col, row) = (i as u32 % per, i as u32 / per);
+        let at = Rect::new(c.x + col * (cw + TIGHT), y + row * (CHIP_H + TIGHT), cw, CHIP_H);
+        chip(fb, at, label, picked == Some(i as u8));
+        hits::put(press(i as u8), at);
+    }
+    let rows = (labels.len() as u32).div_ceil(per);
+    rows * CHIP_H + rows.saturating_sub(1) * TIGHT
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/click.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/click.rs
new file mode 100644
index 000000000..45beca5c7
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/click.rs
@@ -0,0 +1,70 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * A press on a Shield screen. Back walks one step: from review to the
+ * screen it was opened from, from any other Shield screen to Shield home,
+ * and from Shield home to the wallet.
+ */
+
+use nonos_app_skeleton::EventOutcome;
+
+use crate::wallet::screen::hits::Press;
+use crate::wallet::state::shield_ui::{SHIELD_HOME, SHIELD_REVIEW};
+use crate::wallet::state::{State, VIEW_HOME, VIEW_SHIELD};
+
+/* Enter Shield from the wallet: ask whether a shield service is there. */
+pub fn open(state: &mut State) -> EventOutcome {
+    state.shield = crate::wallet::shield::probe::probe();
+    state.shield_ui.screen = SHIELD_HOME;
+    state.view = VIEW_SHIELD;
+    state.scroll = 0;
+    EventOutcome::Repaint
+}
+
+pub fn back(state: &mut State) -> EventOutcome {
+    let ui = &mut state.shield_ui;
+    ui.failure = None;
+    match ui.screen {
+        SHIELD_HOME => state.view = VIEW_HOME,
+        SHIELD_REVIEW => ui.screen = ui.from,
+        _ => ui.screen = SHIELD_HOME,
+    }
+    state.scroll = 0;
+    EventOutcome::Repaint
+}
+
+pub fn click(state: &mut State, press: Press) -> EventOutcome {
+    let ui = &mut state.shield_ui;
+    match press {
+        Press::Back => return back(state),
+        Press::Dismiss => ui.failure = None,
+        Press::Go(screen) => {
+            ui.screen = screen;
+            ui.failure = None;
+            state.scroll = 0;
+        }
+        Press::Asset(a) if a != ui.asset => {
+            ui.asset = a;
+            ui.size = None;
+        }
+        Press::Pick(i) => ui.size = Some(i),
+        Press::Field(f) => ui.focus = f,
+        Press::Footer(n) => return super::footer::footer(state, n),
+        _ => return EventOutcome::Idle,
+    }
+    EventOutcome::Repaint
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/consts.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/consts.rs
new file mode 100644
index 000000000..753a59ba6
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/consts.rs
@@ -0,0 +1,62 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * The Sepolia deployment the Shield screens name, and the privacy rules they
+ * state. Copied from the contracts lane's deployment record; the pool is the
+ * contract that refuses any amount off the standard ladder.
+ */
+
+pub const CHAIN_ID: &str = "11155111";
+pub const POOL: &str = "0xD0dBCe195c082DA39a218C62c01a732CE5b4d541";
+pub const POOL_FROM_BLOCK: &str = "11,786,912";
+pub const VERIFIER: &str = "0xde6110142b39730f480f9d66c408f150a7e823c1";
+pub const FAUCET: &str = "0x871bc3AD5DA20c399d631817637cB5FB29eB04B4";
+pub const RELAYER: &str = "j3fsu7dad6cmgi3r2i63dsgkkltrhg64z6hf6xajffajjwj4elvke6qd.onion";
+
+/* The asset numbers the note store is keyed by. The scanner that fills the
+ * store must record notes under the same two. */
+pub const NOTE_ETH: u32 = 0;
+pub const NOTE_NOX: u32 = 1;
+
+/* One flat relay fee, in the asset being moved. */
+pub const FEE_ETH: &str = "0.00005 ETH";
+pub const FEE_NOX: &str = "5 NOX";
+
+/* A note is spendable once the pool has grown by this much, and this long. */
+pub const WAIT_LEAVES: u32 = 20;
+pub const WAIT_HOURS: u32 = 6;
+/* What the holder types to spend a note before the wait is over. */
+pub const OVERRIDE: &str = "spend early";
+
+pub const SEND_LEAD: &str = "The proof hides who paid whom and how much. \
+     Deposits and withdrawals are public standard amounts.";
+
+pub fn fee(asset: u8) -> &'static str {
+    if asset == crate::wallet::state::shield_ui::ASSET_NOX {
+        FEE_NOX
+    } else {
+        FEE_ETH
+    }
+}
+
+pub fn ticker(asset: u8) -> &'static str {
+    if asset == crate::wallet::state::shield_ui::ASSET_NOX {
+        "NOX"
+    } else {
+        "ETH"
+    }
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/deposit.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/deposit.rs
new file mode 100644
index 000000000..27389079e
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/deposit.rs
@@ -0,0 +1,74 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * 05  DEPOSIT: a public payment from this account into the pool, in one of
+ * the standard sizes. What it reveals is said before the size is chosen,
+ * and when the note it makes can first be spent is said after.
+ */
+
+use nonos_app_skeleton::PaintBuffer;
+
+use super::consts::{POOL, WAIT_HOURS, WAIT_LEAVES};
+use crate::wallet::etna::backdrop::Backdrop;
+use crate::wallet::etna::frame::{begin, end};
+use crate::wallet::etna::frame_spec::FrameSpec;
+use crate::wallet::etna::parts::action::Weight;
+use crate::wallet::etna::parts::fact::fact;
+use crate::wallet::etna::tokens::{GAP, TEXT_3};
+use crate::wallet::etna::wrap::wrapped;
+use crate::wallet::etna::Role;
+use crate::wallet::screen::hits;
+use crate::wallet::state::shield_ui::ASSET_NOX;
+use crate::wallet::state::State;
+
+const LEAD: &str = "A deposit is public. Anyone can see that this account paid a \
+     standard amount into the pool; nobody can see where it goes next.";
+
+pub fn deposit(state: &State, fb: &mut PaintBuffer) {
+    hits::clear();
+    let ui = &state.shield_ui;
+    let status = super::status::parts(state);
+    let ready = ui.size.is_some();
+    let footer = [("Review deposit", Weight::Primary, ready)];
+    let spec = FrameSpec {
+        number: "05",
+        title: "Deposit",
+        back: true,
+        backdrop: Some(Backdrop::Deposit),
+        failure: super::absent::banner(state),
+        footer: &footer,
+        status: &status,
+        scroll: state.scroll,
+    };
+    let mut l = begin(fb, &spec);
+    let c = l.content;
+    let mut y = c.y
+        + wrapped(fb, c.x as i32, c.y as i32, c.w as i32, Role::Lead, LEAD, TEXT_3) as u32
+        + GAP;
+    y += super::pick::asset(fb, c, y, ui);
+    y += super::pick::size(fb, c, y, ui);
+    y += fact(fb, c.x, y, c.w, "pool", POOL);
+    let wait = alloc::format!("{WAIT_LEAVES} new notes and {WAIT_HOURS} hours");
+    y += fact(fb, c.x, y, c.w, "spendable after", &wait);
+    if ui.asset == ASSET_NOX {
+        y += fact(fb, c.x, y, c.w, "first", "one approval for the pool");
+    }
+    hits::reach(y, state.scroll, l.content_bottom);
+    end(fb, &spec, &mut l);
+    super::edges::put(state, &l);
+    super::edges::footer(&l, &[ready]);
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/edges.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/edges.rs
new file mode 100644
index 000000000..59cd1d72a
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/edges.rs
@@ -0,0 +1,45 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * The presses every Shield screen has in the same place: back in the bar,
+ * and the dismiss control on a failure the shield service reported. The
+ * absence banner has no dismiss; it goes away when a service answers.
+ */
+
+use crate::wallet::etna::frame_spec::FrameLayout;
+use crate::wallet::screen::hits::{self, Press};
+use crate::wallet::state::State;
+
+pub fn put(state: &State, l: &FrameLayout) {
+    if let Some(back) = l.back {
+        hits::put(Press::Back, back);
+    }
+    if state.shield_ui.failure.is_some() {
+        if let Some(d) = l.dismiss {
+            hits::put(Press::Dismiss, d);
+        }
+    }
+}
+
+/* The footer buttons that are enabled, as Footer(n) presses. */
+pub fn footer(l: &FrameLayout, enabled: &[bool]) {
+    for (i, on) in enabled.iter().enumerate() {
+        if *on {
+            hits::put(Press::Footer(i as u8), l.footer[i]);
+        }
+    }
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/field.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/field.rs
new file mode 100644
index 000000000..919736808
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/field.rs
@@ -0,0 +1,66 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * A one-line text field: its name above, the typed text or a hint inside,
+ * and a caret only in the field that has the keyboard. Text too long for the
+ * field shows its tail, which is the part being typed.
+ */
+
+use nonos_app_skeleton::PaintBuffer;
+
+use crate::wallet::etna::rect::Rect;
+use crate::wallet::etna::text::{draw_in, line, width};
+use crate::wallet::etna::tokens::{CORNER, CYAN, FIELD, OUTLINE, TEXT, TEXT_3, TIGHT};
+use crate::wallet::etna::Role;
+
+const FIELD_H: u32 = 44;
+const PAD: i32 = 12;
+
+fn tail(text: &str, room: i32) -> &str {
+    let mut start = 0;
+    while start < text.len() && width(Role::RowValue, &text[start..]) > room {
+        start += text[start..].chars().next().map_or(1, char::len_utf8);
+    }
+    &text[start..]
+}
+
+/* Returns the field's box, for the click table, and the height used. */
+pub fn field(
+    fb: &mut PaintBuffer,
+    c: Rect,
+    y: u32,
+    name: &str,
+    text: &str,
+    hint: &str,
+    focused: bool,
+) -> (Rect, u32) {
+    draw_in(fb, c.x as i32, y as i32, Role::Fact, name, TEXT_3);
+    let top = y + line(Role::Fact) as u32 + TIGHT / 2;
+    let at = Rect::new(c.x, top, c.w, FIELD_H);
+    fb.fill_round(at.x, at.y, at.w, at.h, CORNER, FIELD);
+    fb.stroke_round(at.x, at.y, at.w, at.h, CORNER, 1, if focused { CYAN } else { OUTLINE });
+    let ty = at.y as i32 + (FIELD_H as i32 - line(Role::RowValue)) / 2;
+    let room = at.w as i32 - 3 * PAD;
+    let shown = if text.is_empty() { hint } else { tail(text, room) };
+    let ink = if text.is_empty() { TEXT_3 } else { TEXT };
+    let end = draw_in(fb, at.x as i32 + PAD, ty, Role::RowValue, shown, ink);
+    if focused {
+        let cx = if text.is_empty() { at.x as i32 + PAD } else { end + 1 };
+        fb.fill_rect(cx as u32, ty as u32, 2, line(Role::RowValue) as u32, CYAN);
+    }
+    (at, top + FIELD_H - y)
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/footer.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/footer.rs
new file mode 100644
index 000000000..81d2cb3cf
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/footer.rs
@@ -0,0 +1,57 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * The footer buttons of the Shield screens. The three choosing screens
+ * open the review; the review confirms or goes back to edit; the network
+ * page copies the faucet's address.
+ */
+
+use nonos_app_skeleton::clients::clipboard::clipboard_copy;
+use nonos_app_skeleton::EventOutcome;
+
+use crate::wallet::state::shield_ui::*;
+use crate::wallet::state::State;
+
+pub fn footer(state: &mut State, n: u8) -> EventOutcome {
+    let screen = state.shield_ui.screen;
+    match (screen, n) {
+        (SHIELD_DEPOSIT | SHIELD_WITHDRAW, 0) if state.shield_ui.size.is_some() => open(state),
+        (SHIELD_SEND, 0) if super::check::send_ready(&state.shield_ui) => open(state),
+        (SHIELD_REVIEW, 0) => {
+            if let Err(why) = super::request::submit(state) {
+                state.shield_ui.failure = Some(why);
+            }
+            EventOutcome::Repaint
+        }
+        (SHIELD_REVIEW, 1) => super::click::back(state),
+        (SHIELD_NETWORK, 0) => {
+            let _ = clipboard_copy(super::consts::FAUCET.as_bytes());
+            state.status = b"faucet address copied";
+            EventOutcome::Repaint
+        }
+        _ => EventOutcome::Idle,
+    }
+}
+
+fn open(state: &mut State) -> EventOutcome {
+    let ui = &mut state.shield_ui;
+    ui.from = ui.screen;
+    ui.screen = SHIELD_REVIEW;
+    ui.failure = None;
+    state.scroll = 0;
+    EventOutcome::Repaint
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/history.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/history.rs
new file mode 100644
index 000000000..282775b81
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/history.rs
@@ -0,0 +1,74 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * 10  HISTORY: every deposit, payment, receipt and withdrawal the shield
+ * service has recorded, each with the state it has reached. Nothing is
+ * listed that the service did not report.
+ */
+
+use alloc::format;
+use nonos_app_skeleton::PaintBuffer;
+
+use super::history_labels::{kind, stage};
+use crate::wallet::etna::backdrop::Backdrop;
+use crate::wallet::etna::frame::{begin, end};
+use crate::wallet::etna::frame_spec::FrameSpec;
+use crate::wallet::etna::parts::tile::{row_height, tile, tile_row};
+use crate::wallet::etna::rect::Rect;
+use crate::wallet::etna::tokens::TEXT_3;
+use crate::wallet::etna::wrap::wrapped;
+use crate::wallet::etna::Role;
+use crate::wallet::screen::hits;
+use crate::wallet::state::State;
+
+const EMPTY: &str = "No shielded activity yet. Deposits, payments, receipts and \
+     withdrawals appear here with the state each one has reached.";
+
+pub fn history(state: &State, fb: &mut PaintBuffer) {
+    hits::clear();
+    let status = super::status::parts(state);
+    let spec = FrameSpec {
+        number: "10",
+        title: "History",
+        back: true,
+        backdrop: Some(Backdrop::History),
+        failure: super::absent::banner(state),
+        footer: &[],
+        status: &status,
+        scroll: state.scroll,
+    };
+    let mut l = begin(fb, &spec);
+    let c = l.content;
+    let log = &state.shield_ui.history;
+    let mut y = c.y;
+    if log.is_empty() {
+        y += wrapped(fb, c.x as i32, y as i32, c.w as i32, Role::Lead, EMPTY, TEXT_3) as u32;
+    } else {
+        let at = Rect::new(c.x, y, c.w, row_height() * log.len() as u32);
+        tile(fb, at);
+        for (i, e) in log.iter().enumerate() {
+            let name = format!("{} {} {}", kind(e.kind), e.amount, super::consts::ticker(e.asset));
+            let tx = e.tx.map(|t| format!("{}  0x{:02x}{:02x}..", stage(e.stage), t[0], t[1]));
+            let value = tx.unwrap_or_else(|| alloc::string::String::from(stage(e.stage)));
+            tile_row(fb, at, y + row_height() * i as u32, &name, &value, i + 1 == log.len());
+        }
+        y += at.h;
+    }
+    hits::reach(y, state.scroll, l.content_bottom);
+    end(fb, &spec, &mut l);
+    super::edges::put(state, &l);
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/history_labels.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/history_labels.rs
new file mode 100644
index 000000000..bd0824a0c
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/history_labels.rs
@@ -0,0 +1,37 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/* The words the history uses for each kind of entry and each state. */
+
+use crate::wallet::state::shield_log::{Kind, Stage};
+
+pub fn kind(k: Kind) -> &'static str {
+    match k {
+        Kind::Deposit => "Deposit",
+        Kind::Send => "Sent",
+        Kind::Receive => "Received",
+        Kind::Withdraw => "Withdrawal",
+    }
+}
+
+pub fn stage(s: Stage) -> &'static str {
+    match s {
+        Stage::Proving => "proving",
+        Stage::HandedOff => "handed off",
+        Stage::Settled => "settled",
+        Stage::Failed => "failed",
+    }
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/home.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/home.rs
new file mode 100644
index 000000000..8fe317119
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/home.rs
@@ -0,0 +1,63 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * 04  SHIELD, the private side of the wallet: what the pool holds for this
+ * account, the three things a holder does with it, the address others pay
+ * privately, and the way to the history and the network the pool is on.
+ */
+
+use nonos_app_skeleton::PaintBuffer;
+
+use super::home_more::more;
+use super::home_parts::{actions, balances, receive};
+use crate::wallet::etna::backdrop::Backdrop;
+use crate::wallet::etna::frame::{begin, end};
+use crate::wallet::etna::frame_spec::FrameSpec;
+use crate::wallet::etna::tokens::{GAP, TEXT_3};
+use crate::wallet::etna::wrap::wrapped;
+use crate::wallet::etna::Role;
+use crate::wallet::screen::hits;
+use crate::wallet::state::State;
+
+const LEAD: &str = "Shielded value lives in the pool as notes only this wallet can open.";
+
+pub fn home(state: &State, fb: &mut PaintBuffer) {
+    hits::clear();
+    let status = super::status::parts(state);
+    let spec = FrameSpec {
+        number: "04",
+        title: "Shield",
+        back: true,
+        backdrop: Some(Backdrop::Deposit),
+        failure: super::absent::banner(state),
+        footer: &[],
+        status: &status,
+        scroll: state.scroll,
+    };
+    let mut l = begin(fb, &spec);
+    let c = l.content;
+    let mut y = c.y
+        + wrapped(fb, c.x as i32, c.y as i32, c.w as i32, Role::Lead, LEAD, TEXT_3) as u32
+        + GAP;
+    y += balances(state, fb, c, y) + GAP;
+    y += actions(fb, c, y) + GAP;
+    y += receive(state, fb, c, y) + GAP;
+    y += more(state, fb, c, y);
+    hits::reach(y, state.scroll, l.content_bottom);
+    end(fb, &spec, &mut l);
+    super::edges::put(state, &l);
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/home_more.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/home_more.rs
new file mode 100644
index 000000000..9d319d9b3
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/home_more.rs
@@ -0,0 +1,44 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * The quiet rows at the foot of Shield home: a proof in progress when
+ * there is one, the history, and the network the pool is on.
+ */
+
+use alloc::vec::Vec;
+use nonos_app_skeleton::PaintBuffer;
+
+use crate::wallet::etna::parts::quiet::quiet_group;
+use crate::wallet::etna::rect::Rect;
+use crate::wallet::screen::hits::{self, Press};
+use crate::wallet::state::shield_ui::{SHIELD_HISTORY, SHIELD_NETWORK, SHIELD_PROVING};
+use crate::wallet::state::State;
+
+pub fn more(state: &State, fb: &mut PaintBuffer, c: Rect, y: u32) -> u32 {
+    let mut rows: Vec<(&str, bool, u8)> =
+        Vec::from([("History", true, SHIELD_HISTORY), ("Sepolia network", true, SHIELD_NETWORK)]);
+    if state.shield_ui.job.is_some() {
+        rows.insert(0, ("Proof in progress", true, SHIELD_PROVING));
+    }
+    let shown: Vec<(&str, bool)> = rows.iter().map(|(t, e, _)| (*t, *e)).collect();
+    let mut at = [Rect::default(); 3];
+    let h = quiet_group(fb, c.x, y, c.w, &shown, &mut at);
+    for (i, (_, _, screen)) in rows.iter().enumerate() {
+        hits::put(Press::Go(*screen), at[i]);
+    }
+    h
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/home_parts.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/home_parts.rs
new file mode 100644
index 000000000..ead541fb7
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/home_parts.rs
@@ -0,0 +1,68 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * The pieces of the Shield home: balances with the shielded rows first,
+ * the round actions and the private receive address.
+ */
+
+use alloc::string::String;
+use nonos_app_skeleton::PaintBuffer;
+
+use super::amounts::{shielded_eth, shielded_nox};
+use crate::wallet::etna::parts::round::{round_action, round_height};
+use crate::wallet::etna::parts::tile::{row_height, tile, tile_row};
+use crate::wallet::etna::rect::Rect;
+use crate::wallet::etna::symbol::Symbol;
+use crate::wallet::screen::amounts::{eth, nox};
+use crate::wallet::screen::hits::{self, Press};
+use crate::wallet::state::shield_ui::{SHIELD_DEPOSIT, SHIELD_SEND, SHIELD_WITHDRAW};
+use crate::wallet::state::State;
+
+pub fn balances(state: &State, fb: &mut PaintBuffer, c: Rect, y: u32) -> u32 {
+    let rows: [(&str, String); 4] = [
+        ("Shielded ETH", shielded_eth(state)),
+        ("Shielded NOX", shielded_nox(state)),
+        ("Public ETH", eth(state)),
+        ("Public NOX", nox(state)),
+    ];
+    let at = Rect::new(c.x, y, c.w, row_height() * 4);
+    tile(fb, at);
+    for (i, (name, value)) in rows.iter().enumerate() {
+        tile_row(fb, at, y + row_height() * i as u32, name, value, i == 3);
+    }
+    at.h
+}
+
+const ACTIONS: [(&str, Symbol, u8); 3] = [
+    ("Deposit", Symbol::LockShield, SHIELD_DEPOSIT),
+    ("Send", Symbol::ArrowUp, SHIELD_SEND),
+    ("Withdraw", Symbol::ArrowDownToLine, SHIELD_WITHDRAW),
+];
+
+pub fn actions(fb: &mut PaintBuffer, c: Rect, y: u32) -> u32 {
+    let cell = c.w / ACTIONS.len() as u32;
+    for (i, (title, sign, screen)) in ACTIONS.iter().enumerate() {
+        let at = Rect::new(c.x + cell * i as u32, y, cell, round_height());
+        round_action(fb, at, title, *sign, true);
+        hits::put(Press::Go(*screen), at);
+    }
+    round_height()
+}
+
+pub fn receive(state: &State, fb: &mut PaintBuffer, c: Rect, y: u32) -> u32 {
+    super::home_receive::receive(state, fb, c, y)
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/home_receive.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/home_receive.rs
new file mode 100644
index 000000000..173fcca24
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/home_receive.rs
@@ -0,0 +1,53 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * The private receive address. The nox1 address is derived from the
+ * recovery phrase by the shield service; until one has answered there is
+ * no address to show, and the screen says where it will come from.
+ */
+
+use nonos_app_skeleton::PaintBuffer;
+
+use crate::wallet::etna::parts::qr::qr;
+use crate::wallet::etna::parts::value::value_block;
+use crate::wallet::etna::rect::Rect;
+use crate::wallet::etna::tokens::{GAP, TEXT_3};
+use crate::wallet::etna::wrap::wrapped;
+use crate::wallet::etna::Role;
+use crate::wallet::state::State;
+
+const WAITING: &str = "Your private nox1 address appears here once the shield service has \
+     derived it from your recovery phrase. Share it to be paid privately.";
+const QR_SIDE: u32 = 200;
+
+pub fn receive(state: &State, fb: &mut PaintBuffer, c: Rect, y: u32) -> u32 {
+    let head = super::pick::label(fb, c, y, "RECEIVE PRIVATELY");
+    let mut h = head;
+    match &state.shield_ui.nox1 {
+        Some(addr) => {
+            if qr(fb, c.x, y + h, QR_SIDE, addr.as_bytes()) {
+                h += QR_SIDE + GAP;
+            }
+            h += value_block(fb, c.x, y + h, c.w, addr);
+        }
+        None => {
+            let t = (y + h) as i32;
+            h += wrapped(fb, c.x as i32, t, c.w as i32, Role::Lead, WAITING, TEXT_3) as u32;
+        }
+    }
+    h
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/key.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/key.rs
new file mode 100644
index 000000000..477051e8a
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/key.rs
@@ -0,0 +1,69 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * Typing on the private send screen: Tab moves between the fields shown,
+ * Backspace deletes, Enter opens the review, and each field keeps only
+ * what it can hold. Other Shield screens take no typed input.
+ */
+
+use nonos_app_skeleton::{EventOutcome, KEY_BACKSPACE, KEY_ENTER, KEY_TAB};
+
+use crate::wallet::state::shield_ui::*;
+use crate::wallet::state::{State, VIEW_SHIELD};
+
+const MAX_TO: usize = 4096;
+const MAX_SHORT: usize = 40;
+
+pub fn key(state: &mut State, code: u32) -> Option<EventOutcome> {
+    if state.view != VIEW_SHIELD || state.shield_ui.screen != SHIELD_SEND {
+        return None;
+    }
+    let early = !super::meter::waited(&state.shield_ui);
+    let ui = &mut state.shield_ui;
+    match code {
+        KEY_TAB => ui.focus = (ui.focus + 1) % if early { 3 } else { 2 },
+        KEY_ENTER => return Some(super::footer::footer(state, 0)),
+        KEY_BACKSPACE => {
+            let _ = field(ui).pop();
+        }
+        c if (0x20..0x7F).contains(&c) => push(ui, c as u8 as char),
+        _ => return None,
+    }
+    Some(EventOutcome::Repaint)
+}
+
+fn field(ui: &mut ShieldUi) -> &mut alloc::string::String {
+    match ui.focus {
+        FIELD_AMOUNT => &mut ui.amount,
+        FIELD_OVERRIDE => &mut ui.override_text,
+        _ => &mut ui.to,
+    }
+}
+
+pub fn push(ui: &mut ShieldUi, c: char) {
+    let (keep, max) = match ui.focus {
+        FIELD_AMOUNT => (c.is_ascii_digit() || c == '.', MAX_SHORT),
+        FIELD_OVERRIDE => (true, MAX_SHORT),
+        _ => (c.is_ascii_alphanumeric(), MAX_TO),
+    };
+    /* A bech32 address is written in lower case; the others keep case. */
+    let lower = ui.focus == FIELD_TO;
+    let f = field(ui);
+    if keep && f.len() < max {
+        f.push(if lower { c.to_ascii_lowercase() } else { c });
+    }
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/meter.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/meter.rs
new file mode 100644
index 000000000..d26eae78e
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/meter.rs
@@ -0,0 +1,63 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * The spend-wait meter: how far the pool has grown past the newest note and
+ * how long ago it landed, each against its threshold. Both must be met. An
+ * uncounted wait is said to be uncounted, never drawn as empty or full.
+ */
+
+use alloc::format;
+use nonos_app_skeleton::PaintBuffer;
+
+use super::consts::{WAIT_HOURS, WAIT_LEAVES};
+use crate::wallet::etna::parts::fact::fact;
+use crate::wallet::etna::rect::Rect;
+use crate::wallet::etna::text::line;
+use crate::wallet::etna::tokens::{CYAN, LINE_2, TIGHT};
+use crate::wallet::etna::Role;
+use crate::wallet::state::shield_ui::ShieldUi;
+
+const BAR: u32 = 4;
+
+fn bar(fb: &mut PaintBuffer, c: Rect, y: u32, name: &str, have: u32, need: u32) -> u32 {
+    let h = fact(fb, c.x, y, c.w, name, &format!("{} of {need}", have.min(need)));
+    let top = y + h + TIGHT / 2;
+    fb.fill_round(c.x, top, c.w, BAR, BAR / 2, LINE_2);
+    let lit = c.w * have.min(need) / need.max(1);
+    if lit > 0 {
+        fb.fill_round(c.x, top, lit, BAR, BAR / 2, CYAN);
+    }
+    h + TIGHT / 2 + BAR + TIGHT
+}
+
+/* Whether the newest note may be spent without the typed override. */
+pub fn waited(ui: &ShieldUi) -> bool {
+    matches!((ui.leaves_since, ui.hours_since), (Some(l), Some(h)) if l >= WAIT_LEAVES && h >= WAIT_HOURS)
+}
+
+pub fn meter(fb: &mut PaintBuffer, c: Rect, y: u32, ui: &ShieldUi) -> u32 {
+    match (ui.leaves_since, ui.hours_since) {
+        (Some(l), Some(h)) => {
+            let a = bar(fb, c, y, "Pool growth, leaves", l, WAIT_LEAVES);
+            a + bar(fb, c, y + a, "Time since deposit, hours", h, WAIT_HOURS)
+        }
+        _ => {
+            let h = fact(fb, c.x, y, c.w, "Spend wait", "not counted yet");
+            h + line(Role::Fact) as u32 / 2
+        }
+    }
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/mod.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/mod.rs
new file mode 100644
index 000000000..aedec1c69
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/mod.rs
@@ -0,0 +1,50 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/* The Shield screens on the Etna frame, and the parts only they use. */
+
+mod absent;
+mod amounts;
+mod check;
+mod chips;
+pub mod click;
+mod consts;
+mod deposit;
+mod edges;
+mod field;
+mod footer;
+mod history;
+mod history_labels;
+mod home;
+mod home_more;
+mod home_parts;
+mod home_receive;
+pub mod key;
+mod meter;
+mod network;
+pub mod paste;
+mod pick;
+mod proving;
+mod request;
+mod review;
+mod review_rows;
+mod review_text;
+mod send;
+mod send_fields;
+pub mod show;
+mod sizes;
+mod status;
+mod withdraw;
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/network.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/network.rs
new file mode 100644
index 000000000..84b229b76
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/network.rs
@@ -0,0 +1,73 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * 11  SEPOLIA: the one network Shield runs on for now, and the contracts
+ * this wallet talks to there, written out in full so they can be checked
+ * against the deployment record rather than trusted.
+ */
+
+use nonos_app_skeleton::PaintBuffer;
+
+use super::consts::{CHAIN_ID, FAUCET, POOL, POOL_FROM_BLOCK, RELAYER, VERIFIER};
+use crate::wallet::etna::backdrop::Backdrop;
+use crate::wallet::etna::frame::{begin, end};
+use crate::wallet::etna::frame_spec::FrameSpec;
+use crate::wallet::etna::parts::action::Weight;
+use crate::wallet::etna::parts::fact::fact;
+use crate::wallet::etna::parts::value::value_block;
+use crate::wallet::etna::tokens::{GAP, TEXT_3};
+use crate::wallet::etna::wrap::wrapped;
+use crate::wallet::etna::Role;
+use crate::wallet::screen::hits;
+use crate::wallet::state::State;
+
+const LEAD: &str = "Shield runs on the Sepolia test network for now. Test ETH and NOX \
+     come from the faucet, once a day, for this wallet's address.";
+
+pub fn network(state: &State, fb: &mut PaintBuffer) {
+    hits::clear();
+    let status = super::status::parts(state);
+    let footer = [("Copy faucet address", Weight::Secondary, true)];
+    let spec = FrameSpec {
+        number: "11",
+        title: "Sepolia",
+        back: true,
+        backdrop: Some(Backdrop::Settings),
+        failure: None,
+        footer: &footer,
+        status: &status,
+        scroll: state.scroll,
+    };
+    let mut l = begin(fb, &spec);
+    let c = l.content;
+    let mut y = c.y
+        + wrapped(fb, c.x as i32, c.y as i32, c.w as i32, Role::Lead, LEAD, TEXT_3) as u32
+        + GAP;
+    for (name, value) in [("chain id", CHAIN_ID), ("events from block", POOL_FROM_BLOCK)] {
+        y += fact(fb, c.x, y, c.w, name, value);
+    }
+    for (name, value) in
+        [("pool", POOL), ("verifier", VERIFIER), ("faucet", FAUCET), ("relayer", RELAYER)]
+    {
+        y += GAP / 2 + super::pick::label(fb, c, y + GAP / 2, name);
+        y += value_block(fb, c.x, y, c.w, value);
+    }
+    hits::reach(y, state.scroll, l.content_bottom);
+    end(fb, &spec, &mut l);
+    super::edges::put(state, &l);
+    super::edges::footer(&l, &[true]);
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/paste.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/paste.rs
new file mode 100644
index 000000000..8feee42d0
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/paste.rs
@@ -0,0 +1,42 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * Ctrl+V on the private send screen. A nox1 address carries the public
+ * keys a sender needs and is far too long to type, so pasting is the way
+ * one arrives; each character still passes the field's own filter.
+ */
+
+use nonos_app_skeleton::clients::clipboard::clipboard_paste;
+use nonos_app_skeleton::EventOutcome;
+
+use crate::wallet::state::shield_ui::SHIELD_SEND;
+use crate::wallet::state::{State, VIEW_SHIELD};
+
+const MAX_PASTE: usize = 4096;
+
+pub fn paste(state: &mut State) -> Option<EventOutcome> {
+    if state.view != VIEW_SHIELD || state.shield_ui.screen != SHIELD_SEND {
+        return None;
+    }
+    let mut buf = alloc::vec![0u8; MAX_PASTE];
+    let n = clipboard_paste(&mut buf).ok()?;
+    let text = core::str::from_utf8(&buf[..n.min(MAX_PASTE)]).ok()?;
+    for c in text.trim().chars() {
+        super::key::push(&mut state.shield_ui, c);
+    }
+    Some(EventOutcome::Repaint)
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/pick.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/pick.rs
new file mode 100644
index 000000000..516503e8f
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/pick.rs
@@ -0,0 +1,50 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * The asset and the standard size, the two choices a deposit and a
+ * withdrawal share. The pool refuses any other amount, so there is no
+ * field to type one into.
+ */
+
+use alloc::vec::Vec;
+use nonos_app_skeleton::PaintBuffer;
+
+use super::chips::chips;
+use super::sizes::sizes;
+use crate::wallet::etna::rect::Rect;
+use crate::wallet::etna::text::{draw_in, line};
+use crate::wallet::etna::tokens::{GAP, TEXT_3, TIGHT};
+use crate::wallet::etna::Role;
+use crate::wallet::screen::hits::Press;
+use crate::wallet::state::shield_ui::ShieldUi;
+
+pub fn label(fb: &mut PaintBuffer, c: Rect, y: u32, text: &str) -> u32 {
+    draw_in(fb, c.x as i32, y as i32, Role::Fact, text, TEXT_3);
+    line(Role::Fact) as u32 + TIGHT
+}
+
+pub fn asset(fb: &mut PaintBuffer, c: Rect, y: u32, ui: &ShieldUi) -> u32 {
+    let h = label(fb, c, y, "ASSET");
+    h + chips(fb, c, y + h, &["ETH", "NOX"], Some(ui.asset), Press::Asset) + GAP
+}
+
+pub fn size(fb: &mut PaintBuffer, c: Rect, y: u32, ui: &ShieldUi) -> u32 {
+    let h = label(fb, c, y, "STANDARD AMOUNT");
+    let all = sizes(ui.asset);
+    let labels: Vec<&str> = all.iter().map(|(s, _)| s.as_str()).collect();
+    h + chips(fb, c, y + h, &labels, ui.size, Press::Pick) + GAP
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/proving.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/proving.rs
new file mode 100644
index 000000000..d3a3d8e55
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/proving.rs
@@ -0,0 +1,75 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * 09  PROVING: the proof being built on this machine, with how far it has
+ * got and how long it has taken, then its hand-off to the relayer. Every
+ * error the prover can raise arrives with its own sentence.
+ */
+
+use alloc::format;
+use nonos_app_skeleton::PaintBuffer;
+
+use crate::wallet::etna::backdrop::Backdrop;
+use crate::wallet::etna::frame::{begin, end};
+use crate::wallet::etna::frame_spec::FrameSpec;
+use crate::wallet::etna::parts::fact::fact;
+use crate::wallet::etna::tokens::{BAD, CYAN, GAP, LINE_2, TEXT_3};
+use crate::wallet::etna::wrap::wrapped;
+use crate::wallet::etna::Role;
+use crate::wallet::screen::hits;
+use crate::wallet::state::State;
+
+const IDLE: &str = "Nothing is being proved right now. A proof starts when you confirm a \
+     private payment or a withdrawal, and can take several minutes on one core.";
+
+pub fn proving(state: &State, fb: &mut PaintBuffer) {
+    hits::clear();
+    let status = super::status::parts(state);
+    let spec = FrameSpec {
+        number: "09",
+        title: "Proving",
+        back: true,
+        backdrop: Some(Backdrop::Proving),
+        failure: super::absent::banner(state),
+        footer: &[],
+        status: &status,
+        scroll: state.scroll,
+    };
+    let mut l = begin(fb, &spec);
+    let c = l.content;
+    let (x, w) = (c.x as i32, c.w as i32);
+    let mut y = c.y;
+    match &state.shield_ui.job {
+        None => y += wrapped(fb, x, y as i32, w, Role::Lead, IDLE, TEXT_3) as u32,
+        Some(job) => {
+            y += fact(fb, c.x, y, c.w, "for", super::history_labels::kind(job.kind));
+            let (m, s) = (job.elapsed_s / 60, job.elapsed_s % 60);
+            y += fact(fb, c.x, y, c.w, "elapsed", &format!("{m} min {s:02} s"));
+            y += fact(fb, c.x, y, c.w, "progress", &format!("{} of {}", job.done, job.of));
+            fb.fill_round(c.x, y + GAP / 2, c.w, 6, 3, LINE_2);
+            let lit = c.w * job.done.min(job.of) as u32 / job.of.max(1) as u32;
+            fb.fill_round(c.x, y + GAP / 2, lit.max(1), 6, 3, CYAN);
+            y += GAP + 6;
+            if let Some(err) = job.error {
+                y += wrapped(fb, x, y as i32, w, Role::Lead, err, BAD) as u32;
+            }
+        }
+    }
+    hits::reach(y, state.scroll, l.content_bottom);
+    end(fb, &spec, &mut l);
+    super::edges::put(state, &l);
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/request.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/request.rs
new file mode 100644
index 000000000..1e3c3c0a8
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/request.rs
@@ -0,0 +1,34 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * The one place a Shield screen hands work to the shield service. This
+ * build of the wallet does not yet speak the service's request format, so
+ * a confirmed request is refused here with a sentence saying so, rather
+ * than shown as sent. When the format lands, it lands in this file.
+ */
+
+use crate::wallet::state::State;
+
+const NOT_YET: &str = "The shield service answered, but this build of the wallet cannot \
+     send it requests yet. Nothing was deposited, sent or withdrawn.";
+
+pub fn submit(state: &State) -> Result<(), &'static str> {
+    if let Some(text) = super::absent::banner(state) {
+        return Err(text);
+    }
+    Err(NOT_YET)
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/review.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/review.rs
new file mode 100644
index 000000000..bbda775f5
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/review.rs
@@ -0,0 +1,70 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * 08  REVIEW: everything the confirm button commits to, in one tile, with
+ * one sentence on what becomes public. Confirm hands the request to the
+ * shield service and is enabled only while one is answering.
+ */
+
+use nonos_app_skeleton::PaintBuffer;
+
+use super::review_rows::{lead, rows};
+use crate::wallet::etna::backdrop::Backdrop;
+use crate::wallet::etna::frame::{begin, end};
+use crate::wallet::etna::frame_spec::FrameSpec;
+use crate::wallet::etna::parts::action::Weight;
+use crate::wallet::etna::parts::tile::{row_height, tile, tile_row};
+use crate::wallet::etna::rect::Rect;
+use crate::wallet::etna::tokens::{GAP, TEXT_3};
+use crate::wallet::etna::wrap::wrapped;
+use crate::wallet::etna::Role;
+use crate::wallet::screen::hits;
+use crate::wallet::state::State;
+
+pub fn review(state: &State, fb: &mut PaintBuffer) {
+    hits::clear();
+    let status = super::status::parts(state);
+    let ready = super::absent::ready(state);
+    let footer = [("Confirm", Weight::Primary, ready), ("Edit", Weight::Secondary, true)];
+    let spec = FrameSpec {
+        number: "08",
+        title: "Review",
+        back: true,
+        backdrop: Some(Backdrop::Proving),
+        failure: super::absent::banner(state),
+        footer: &footer,
+        status: &status,
+        scroll: state.scroll,
+    };
+    let mut l = begin(fb, &spec);
+    let c = l.content;
+    let text = lead(&state.shield_ui);
+    let mut y = c.y
+        + wrapped(fb, c.x as i32, c.y as i32, c.w as i32, Role::Lead, text, TEXT_3) as u32
+        + GAP;
+    let all = rows(&state.shield_ui);
+    let at = Rect::new(c.x, y, c.w, row_height() * all.len() as u32);
+    tile(fb, at);
+    for (i, (name, value)) in all.iter().enumerate() {
+        tile_row(fb, at, y + row_height() * i as u32, name, value, i + 1 == all.len());
+    }
+    y += at.h;
+    hits::reach(y, state.scroll, l.content_bottom);
+    end(fb, &spec, &mut l);
+    super::edges::put(state, &l);
+    super::edges::footer(&l, &[ready, true]);
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/review_rows.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/review_rows.rs
new file mode 100644
index 000000000..6f131e446
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/review_rows.rs
@@ -0,0 +1,66 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/* What the review tile says for each shielded action. */
+
+use alloc::format;
+use alloc::string::String;
+use alloc::vec::Vec;
+
+use super::consts::{fee, ticker};
+use super::review_text::{short, standard};
+use crate::wallet::state::shield_ui::{ShieldUi, SHIELD_DEPOSIT, SHIELD_SEND};
+
+pub fn lead(ui: &ShieldUi) -> &'static str {
+    match ui.from {
+        SHIELD_DEPOSIT => "Check it before it goes. A deposit is public and cannot be undone.",
+        SHIELD_SEND => {
+            "The proof is built on this machine. A relayer submits it over an \
+             onion circuit and cannot see who pays whom."
+        }
+        _ => {
+            "The proof is built on this machine. The amount and the receiving address \
+             become public when it settles."
+        }
+    }
+}
+
+pub fn rows(ui: &ShieldUi) -> Vec<(&'static str, String)> {
+    let net = ("Network", String::from("Sepolia"));
+    match ui.from {
+        SHIELD_DEPOSIT => Vec::from([
+            ("Deposit", standard(ui)),
+            ("Into", String::from("the shield pool")),
+            ("Fee", String::from("network gas, from this account")),
+            ("Proof", String::from("none, a deposit is public")),
+            net,
+        ]),
+        SHIELD_SEND => Vec::from([
+            ("Pay privately", format!("{} {}", ui.amount, ticker(ui.asset))),
+            ("To", short(&ui.to)),
+            ("Relay fee", String::from(fee(ui.asset))),
+            ("Change", String::from("stays shielded")),
+            net,
+        ]),
+        _ => Vec::from([
+            ("Withdraw", standard(ui)),
+            ("To", String::from("a fresh address of this wallet")),
+            ("Relay fee", String::from(fee(ui.asset))),
+            ("Proof", String::from("built on this machine")),
+            net,
+        ]),
+    }
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/review_text.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/review_text.rs
new file mode 100644
index 000000000..063532aba
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/review_text.rs
@@ -0,0 +1,38 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/* The amount and receiver as the review tile writes them. */
+
+use alloc::format;
+use alloc::string::String;
+
+use super::consts::ticker;
+use super::sizes::sizes;
+use crate::wallet::state::shield_ui::ShieldUi;
+
+pub fn standard(ui: &ShieldUi) -> String {
+    let all = sizes(ui.asset);
+    let s = ui.size.and_then(|i| all.get(i as usize)).map_or("", |(s, _)| s.as_str());
+    format!("{s} {}", ticker(ui.asset))
+}
+
+pub fn short(a: &str) -> String {
+    if a.len() <= 22 {
+        String::from(a)
+    } else {
+        format!("{}...{}", &a[..12], &a[a.len() - 6..])
+    }
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/send.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/send.rs
new file mode 100644
index 000000000..cd1c78f23
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/send.rs
@@ -0,0 +1,68 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * 06  SEND PRIVATELY: to a nox1 address, from notes in the pool. The first
+ * sentence is the one the pool's authors asked every wallet to show; the
+ * change stays shielded, and the fee and the spend wait are named.
+ */
+
+use nonos_app_skeleton::PaintBuffer;
+
+use super::consts::{fee, SEND_LEAD};
+use crate::wallet::etna::backdrop::Backdrop;
+use crate::wallet::etna::frame::{begin, end};
+use crate::wallet::etna::frame_spec::FrameSpec;
+use crate::wallet::etna::parts::action::Weight;
+use crate::wallet::etna::parts::fact::fact;
+use crate::wallet::etna::tokens::{GAP, TEXT_3};
+use crate::wallet::etna::wrap::wrapped;
+use crate::wallet::etna::Role;
+use crate::wallet::screen::hits;
+use crate::wallet::state::State;
+
+pub fn send(state: &State, fb: &mut PaintBuffer) {
+    hits::clear();
+    let ui = &state.shield_ui;
+    let status = super::status::parts(state);
+    let ready = super::check::send_ready(ui);
+    let footer = [("Review payment", Weight::Primary, ready)];
+    let spec = FrameSpec {
+        number: "06",
+        title: "Send privately",
+        back: true,
+        backdrop: Some(Backdrop::Send),
+        failure: super::absent::banner(state),
+        footer: &footer,
+        status: &status,
+        scroll: state.scroll,
+    };
+    let mut l = begin(fb, &spec);
+    let c = l.content;
+    let mut y = c.y
+        + wrapped(fb, c.x as i32, c.y as i32, c.w as i32, Role::Lead, SEND_LEAD, TEXT_3) as u32
+        + GAP;
+    y += super::pick::asset(fb, c, y, ui);
+    y += super::send_fields::fields(fb, c, y, ui);
+    y += fact(fb, c.x, y, c.w, "relay fee", fee(ui.asset));
+    y += fact(fb, c.x, y, c.w, "change", "stays shielded");
+    y += GAP / 2 + super::meter::meter(fb, c, y + GAP / 2, ui);
+    y += super::send_fields::early(fb, c, y, ui);
+    hits::reach(y, state.scroll, l.content_bottom);
+    end(fb, &spec, &mut l);
+    super::edges::put(state, &l);
+    super::edges::footer(&l, &[ready]);
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/send_fields.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/send_fields.rs
new file mode 100644
index 000000000..836b8421e
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/send_fields.rs
@@ -0,0 +1,59 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * The typed parts of a private payment: the receiver, the amount, and the
+ * override for spending a note before its wait is over, which appears only
+ * while that wait is unmet and says what spending early costs.
+ */
+
+use nonos_app_skeleton::PaintBuffer;
+
+use super::consts::{ticker, OVERRIDE};
+use super::field::field;
+use crate::wallet::etna::rect::Rect;
+use crate::wallet::etna::tokens::{GAP, TEXT_3};
+use crate::wallet::etna::wrap::wrapped;
+use crate::wallet::etna::Role;
+use crate::wallet::screen::hits::{self, Press};
+use crate::wallet::state::shield_ui::{ShieldUi, FIELD_AMOUNT, FIELD_OVERRIDE, FIELD_TO};
+
+const EARLY: &str = "This note has not waited long enough. Spending it now makes this \
+     payment easier to link to its deposit. To go ahead anyway, type";
+
+pub fn fields(fb: &mut PaintBuffer, c: Rect, y: u32, ui: &ShieldUi) -> u32 {
+    let (to_at, a) =
+        field(fb, c, y, "TO", &ui.to, "nox1... (paste with Ctrl+V)", ui.focus == FIELD_TO);
+    hits::put(Press::Field(FIELD_TO), to_at);
+    let name = alloc::format!("AMOUNT, {}", ticker(ui.asset));
+    let focused = ui.focus == FIELD_AMOUNT;
+    let (am_at, b) = field(fb, c, y + a + GAP / 2, &name, &ui.amount, "0.0", focused);
+    hits::put(Press::Field(FIELD_AMOUNT), am_at);
+    a + GAP / 2 + b + GAP
+}
+
+pub fn early(fb: &mut PaintBuffer, c: Rect, y: u32, ui: &ShieldUi) -> u32 {
+    if super::meter::waited(ui) {
+        return 0;
+    }
+    let text = alloc::format!("{EARLY} \"{OVERRIDE}\".");
+    let t = y + GAP / 2;
+    let h = wrapped(fb, c.x as i32, t as i32, c.w as i32, Role::Lead, &text, TEXT_3) as u32;
+    let focused = ui.focus == FIELD_OVERRIDE;
+    let (at, f) = field(fb, c, t + h + GAP / 2, "OVERRIDE", &ui.override_text, OVERRIDE, focused);
+    hits::put(Press::Field(FIELD_OVERRIDE), at);
+    GAP / 2 + h + GAP / 2 + f + GAP
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/show.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/show.rs
new file mode 100644
index 000000000..967f6595b
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/show.rs
@@ -0,0 +1,35 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/* Paint whichever Shield screen is up. */
+
+use nonos_app_skeleton::PaintBuffer;
+
+use crate::wallet::state::shield_ui::*;
+use crate::wallet::state::State;
+
+pub fn show(state: &State, fb: &mut PaintBuffer) {
+    match state.shield_ui.screen {
+        SHIELD_DEPOSIT => super::deposit::deposit(state, fb),
+        SHIELD_SEND => super::send::send(state, fb),
+        SHIELD_WITHDRAW => super::withdraw::withdraw(state, fb),
+        SHIELD_REVIEW => super::review::review(state, fb),
+        SHIELD_PROVING => super::proving::proving(state, fb),
+        SHIELD_HISTORY => super::history::history(state, fb),
+        SHIELD_NETWORK => super::network::network(state, fb),
+        _ => super::home::home(state, fb),
+    }
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/sizes.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/sizes.rs
new file mode 100644
index 000000000..eecc65ac3
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/sizes.rs
@@ -0,0 +1,72 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * The standard amounts, 1, 2 or 5 times a power of ten: 0.01 to 10 ETH and
+ * 1,000 to 5,000,000 NOX. Both tokens have 18 decimals, so each size is also
+ * its amount in base units, which is what the pool compares.
+ */
+
+use alloc::format;
+use alloc::string::String;
+use alloc::vec::Vec;
+
+use crate::wallet::state::shield_ui::ASSET_NOX;
+
+const UNIT: u128 = 1_000_000_000_000_000_000;
+
+/* Every size between `lo` and `hi`, both counted in `step`s of the token. */
+fn ladder(lo: u128, hi: u128) -> Vec<u128> {
+    let mut out = Vec::new();
+    let mut ten = 1u128;
+    while ten <= hi {
+        for m in [1u128, 2, 5] {
+            let v = m * ten;
+            if v >= lo && v <= hi {
+                out.push(v);
+            }
+        }
+        ten *= 10;
+    }
+    out
+}
+
+fn grouped(mut v: u128) -> String {
+    let mut parts = Vec::new();
+    while v >= 1000 {
+        parts.push(format!("{:03}", v % 1000));
+        v /= 1000;
+    }
+    parts.push(format!("{v}"));
+    parts.reverse();
+    parts.join(",")
+}
+
+fn hundredths(c: u128) -> String {
+    match c % 100 {
+        0 => format!("{}", c / 100),
+        f if f % 10 == 0 => format!("{}.{}", c / 100, f / 10),
+        f => format!("{}.{:02}", c / 100, f),
+    }
+}
+
+/* Each size as it is shown and as base units. */
+pub fn sizes(asset: u8) -> Vec<(String, u128)> {
+    if asset == ASSET_NOX {
+        return ladder(1_000, 5_000_000).into_iter().map(|n| (grouped(n), n * UNIT)).collect();
+    }
+    ladder(1, 1_000).into_iter().map(|c| (hundredths(c), c * (UNIT / 100))).collect()
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/status.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/status.rs
new file mode 100644
index 000000000..583e6c5b5
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/status.rs
@@ -0,0 +1,41 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * The status line on the Shield screens: the network the pool lives on,
+ * whether a shield service answered, and where the keys are. Each part is
+ * read from state; none of it is what the wallet would like to be true.
+ */
+
+use alloc::vec::Vec;
+
+use crate::wallet::shield::probe::Shield;
+use crate::wallet::state::State;
+
+pub fn parts(state: &State) -> Vec<&'static str> {
+    let mut out = Vec::new();
+    out.push("Sepolia");
+    out.push(match state.shield {
+        Shield::Present => "shield service",
+        Shield::Absent => "no shield service",
+        Shield::Unknown => "looking",
+    });
+    if state.net.nym_ok {
+        out.push("Nym");
+    }
+    out.push(if state.vault_saved { "sealed" } else { "RAM only" });
+    out
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/withdraw.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/withdraw.rs
new file mode 100644
index 000000000..67d6694d0
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/withdraw.rs
@@ -0,0 +1,70 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * 07  WITHDRAW: a standard amount leaves the pool for a fresh public
+ * address of this wallet. The proof is built here and a relayer submits
+ * it, so the fee is named, and the spend wait is shown before anything is.
+ */
+
+use nonos_app_skeleton::PaintBuffer;
+
+use super::consts::fee;
+use crate::wallet::etna::backdrop::Backdrop;
+use crate::wallet::etna::frame::{begin, end};
+use crate::wallet::etna::frame_spec::FrameSpec;
+use crate::wallet::etna::parts::action::Weight;
+use crate::wallet::etna::parts::fact::fact;
+use crate::wallet::etna::tokens::{GAP, TEXT_3};
+use crate::wallet::etna::wrap::wrapped;
+use crate::wallet::etna::Role;
+use crate::wallet::screen::hits;
+use crate::wallet::state::State;
+
+const LEAD: &str = "A withdrawal is public: a standard amount leaves the pool for a \
+     fresh address of this wallet, never one it has used before.";
+
+pub fn withdraw(state: &State, fb: &mut PaintBuffer) {
+    hits::clear();
+    let ui = &state.shield_ui;
+    let status = super::status::parts(state);
+    let ready = ui.size.is_some();
+    let footer = [("Review withdrawal", Weight::Primary, ready)];
+    let spec = FrameSpec {
+        number: "07",
+        title: "Withdraw",
+        back: true,
+        backdrop: Some(Backdrop::Withdraw),
+        failure: super::absent::banner(state),
+        footer: &footer,
+        status: &status,
+        scroll: state.scroll,
+    };
+    let mut l = begin(fb, &spec);
+    let c = l.content;
+    let mut y = c.y
+        + wrapped(fb, c.x as i32, c.y as i32, c.w as i32, Role::Lead, LEAD, TEXT_3) as u32
+        + GAP;
+    y += super::pick::asset(fb, c, y, ui);
+    y += super::pick::size(fb, c, y, ui);
+    y += fact(fb, c.x, y, c.w, "relay fee", fee(ui.asset));
+    y += fact(fb, c.x, y, c.w, "to", "a fresh address of this wallet");
+    y += GAP / 2 + super::meter::meter(fb, c, y + GAP / 2, ui);
+    hits::reach(y, state.scroll, l.content_bottom);
+    end(fb, &spec, &mut l);
+    super::edges::put(state, &l);
+    super::edges::footer(&l, &[ready]);
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/state/mod.rs b/userland/capsule_wallet_nonos/src/wallet/state/mod.rs
index 828bb0eee..2f11ab430 100644
--- a/userland/capsule_wallet_nonos/src/wallet/state/mod.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/state/mod.rs
@@ -24,6 +24,8 @@ mod rail_allowed;
 mod record_tx;
 mod restore;
 mod restore_words;
+pub mod shield_log;
+pub mod shield_ui;
 mod types;
 
 pub use default_net::default_net;
diff --git a/userland/capsule_wallet_nonos/src/wallet/state/new.rs b/userland/capsule_wallet_nonos/src/wallet/state/new.rs
index eab7a36a7..0b73c7aa5 100644
--- a/userland/capsule_wallet_nonos/src/wallet/state/new.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/state/new.rs
@@ -117,5 +117,6 @@ pub fn new_state() -> State {
          * otherwise. Absence is the default all the way down.
          */
         shield: crate::wallet::shield::probe::Shield::Unknown,
+        shield_ui: super::shield_ui::ShieldUi::default(),
     }
 }
diff --git a/userland/capsule_wallet_nonos/src/wallet/state/shield_log.rs b/userland/capsule_wallet_nonos/src/wallet/state/shield_log.rs
new file mode 100644
index 000000000..20d0f07b1
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/state/shield_log.rs
@@ -0,0 +1,55 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * What the shield service reports back: each shielded action with where it
+ * has got to, and the proof being built now. Written by the service, read by
+ * the screens; nothing in the wallet invents an entry.
+ */
+
+use alloc::string::String;
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub enum Stage {
+    Proving,
+    HandedOff,
+    Settled,
+    Failed,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub enum Kind {
+    Deposit,
+    Send,
+    Receive,
+    Withdraw,
+}
+
+pub struct Entry {
+    pub kind: Kind,
+    pub asset: u8,
+    pub amount: String,
+    pub stage: Stage,
+    pub tx: Option<[u8; 32]>,
+}
+
+pub struct Job {
+    pub kind: Kind,
+    pub elapsed_s: u32,
+    pub done: u16,
+    pub of: u16,
+    pub error: Option<&'static str>,
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/state/shield_ui.rs b/userland/capsule_wallet_nonos/src/wallet/state/shield_ui.rs
new file mode 100644
index 000000000..0b1e28284
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/state/shield_ui.rs
@@ -0,0 +1,63 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * What the Shield screens remember between paints: which one is up and what
+ * the holder picked on it. The history and the running proof come from the
+ * shield service, so a screen never shows a state no service reported.
+ */
+
+use alloc::string::String;
+use alloc::vec::Vec;
+
+use super::shield_log::{Entry, Job};
+
+pub const SHIELD_HOME: u8 = 0;
+pub const SHIELD_DEPOSIT: u8 = 1;
+pub const SHIELD_SEND: u8 = 2;
+pub const SHIELD_WITHDRAW: u8 = 3;
+pub const SHIELD_REVIEW: u8 = 4;
+pub const SHIELD_PROVING: u8 = 5;
+pub const SHIELD_HISTORY: u8 = 6;
+pub const SHIELD_NETWORK: u8 = 7;
+
+/* Assets by index: 0 is ETH. */
+pub const ASSET_NOX: u8 = 1;
+
+pub const FIELD_TO: u8 = 0;
+pub const FIELD_AMOUNT: u8 = 1;
+pub const FIELD_OVERRIDE: u8 = 2;
+
+#[derive(Default)]
+pub struct ShieldUi {
+    pub screen: u8,
+    /* The screen the review was opened from, so back returns to it. */
+    pub from: u8,
+    pub asset: u8,
+    pub size: Option<u8>,
+    pub to: String,
+    pub amount: String,
+    pub override_text: String,
+    pub focus: u8,
+    /* The private receive address, once the shield service has derived it. */
+    pub nox1: Option<String>,
+    /* Pool growth since the newest note, as the scanner last counted it. */
+    pub leaves_since: Option<u32>,
+    pub hours_since: Option<u32>,
+    pub history: Vec<Entry>,
+    pub job: Option<Job>,
+    pub failure: Option<&'static str>,
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/state/types.rs b/userland/capsule_wallet_nonos/src/wallet/state/types.rs
index 9318f901d..a2852760a 100644
--- a/userland/capsule_wallet_nonos/src/wallet/state/types.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/state/types.rs
@@ -229,4 +229,6 @@ pub struct State {
     /// Starts `Unknown` and is only ever set from a real lookup, so the
     /// shielded screens cannot enable themselves by default.
     pub shield: crate::wallet::shield::probe::Shield,
+    /* The Shield screens: which is up and what was picked on it. */
+    pub shield_ui: super::shield_ui::ShieldUi,
 }

From e8dd078a841241c80a4fc54e119fb60097761249 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 19:16:09 +0000
Subject: [PATCH 27/29] wallet: make a withdrawal wait like a payment, and let
 the banner close

A withdrawal spends a note, so it now waits for the same 20 new notes
and 6 hours as a private payment, or the typed "spend early", before
it can be reviewed. The walk-through on the live image let one through
with the wait not even counted.

Each choosing screen starts with no size picked; the 10,000 NOX picked
on Deposit had been carried into Withdraw. The no-service banner's
Dismiss now hides it until Shield is next opened, where it did nothing.
The Sepolia page's labels are capitals like every other label.
---
 .../src/wallet/screen/shield/absent.rs                   | 1 +
 .../src/wallet/screen/shield/check.rs                    | 4 ++++
 .../src/wallet/screen/shield/click.rs                    | 5 ++++-
 .../src/wallet/screen/shield/edges.rs                    | 9 +++------
 .../src/wallet/screen/shield/footer.rs                   | 3 ++-
 .../capsule_wallet_nonos/src/wallet/screen/shield/key.rs | 8 ++++++--
 .../src/wallet/screen/shield/network.rs                  | 2 +-
 .../src/wallet/screen/shield/withdraw.rs                 | 3 ++-
 .../capsule_wallet_nonos/src/wallet/state/shield_ui.rs   | 2 ++
 9 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/absent.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/absent.rs
index 706119cb9..0140e558c 100644
--- a/userland/capsule_wallet_nonos/src/wallet/screen/shield/absent.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/absent.rs
@@ -38,6 +38,7 @@ pub fn banner(state: &State) -> Option<&'static str> {
     }
     match state.shield {
         Shield::Present => None,
+        Shield::Absent if state.shield_ui.absent_hidden => None,
         Shield::Absent => Some(ABSENT),
         Shield::Unknown => Some(LOOKING),
     }
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/check.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/check.rs
index 257d8a26b..10518ce70 100644
--- a/userland/capsule_wallet_nonos/src/wallet/screen/shield/check.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/check.rs
@@ -47,6 +47,10 @@ pub fn wait_ok(ui: &ShieldUi) -> bool {
     super::meter::waited(ui) || ui.override_text == OVERRIDE
 }
 
+pub fn withdraw_ready(ui: &ShieldUi) -> bool {
+    ui.size.is_some() && wait_ok(ui)
+}
+
 pub fn send_ready(ui: &ShieldUi) -> bool {
     address_ok(&ui.to) && amount_ok(&ui.amount) && wait_ok(ui)
 }
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/click.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/click.rs
index 45beca5c7..e927212bf 100644
--- a/userland/capsule_wallet_nonos/src/wallet/screen/shield/click.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/click.rs
@@ -30,6 +30,7 @@ use crate::wallet::state::{State, VIEW_HOME, VIEW_SHIELD};
 pub fn open(state: &mut State) -> EventOutcome {
     state.shield = crate::wallet::shield::probe::probe();
     state.shield_ui.screen = SHIELD_HOME;
+    state.shield_ui.absent_hidden = false;
     state.view = VIEW_SHIELD;
     state.scroll = 0;
     EventOutcome::Repaint
@@ -51,9 +52,11 @@ pub fn click(state: &mut State, press: Press) -> EventOutcome {
     let ui = &mut state.shield_ui;
     match press {
         Press::Back => return back(state),
-        Press::Dismiss => ui.failure = None,
+        Press::Dismiss if ui.failure.is_some() => ui.failure = None,
+        Press::Dismiss => ui.absent_hidden = true,
         Press::Go(screen) => {
             ui.screen = screen;
+            ui.size = None;
             ui.failure = None;
             state.scroll = 0;
         }
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/edges.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/edges.rs
index 59cd1d72a..97f8d6d35 100644
--- a/userland/capsule_wallet_nonos/src/wallet/screen/shield/edges.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/edges.rs
@@ -16,8 +16,7 @@
 
 /*
  * The presses every Shield screen has in the same place: back in the bar,
- * and the dismiss control on a failure the shield service reported. The
- * absence banner has no dismiss; it goes away when a service answers.
+ * and the dismiss control on whichever banner is up.
  */
 
 use crate::wallet::etna::frame_spec::FrameLayout;
@@ -28,10 +27,8 @@ pub fn put(state: &State, l: &FrameLayout) {
     if let Some(back) = l.back {
         hits::put(Press::Back, back);
     }
-    if state.shield_ui.failure.is_some() {
-        if let Some(d) = l.dismiss {
-            hits::put(Press::Dismiss, d);
-        }
+    if let Some(d) = l.dismiss {
+        hits::put(Press::Dismiss, d);
     }
 }
 
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/footer.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/footer.rs
index 81d2cb3cf..a1e61f45d 100644
--- a/userland/capsule_wallet_nonos/src/wallet/screen/shield/footer.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/footer.rs
@@ -29,7 +29,8 @@ use crate::wallet::state::State;
 pub fn footer(state: &mut State, n: u8) -> EventOutcome {
     let screen = state.shield_ui.screen;
     match (screen, n) {
-        (SHIELD_DEPOSIT | SHIELD_WITHDRAW, 0) if state.shield_ui.size.is_some() => open(state),
+        (SHIELD_DEPOSIT, 0) if state.shield_ui.size.is_some() => open(state),
+        (SHIELD_WITHDRAW, 0) if super::check::withdraw_ready(&state.shield_ui) => open(state),
         (SHIELD_SEND, 0) if super::check::send_ready(&state.shield_ui) => open(state),
         (SHIELD_REVIEW, 0) => {
             if let Err(why) = super::request::submit(state) {
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/key.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/key.rs
index 477051e8a..08b16be58 100644
--- a/userland/capsule_wallet_nonos/src/wallet/screen/shield/key.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/key.rs
@@ -29,13 +29,17 @@ const MAX_TO: usize = 4096;
 const MAX_SHORT: usize = 40;
 
 pub fn key(state: &mut State, code: u32) -> Option<EventOutcome> {
-    if state.view != VIEW_SHIELD || state.shield_ui.screen != SHIELD_SEND {
+    let screen = state.shield_ui.screen;
+    if state.view != VIEW_SHIELD || (screen != SHIELD_SEND && screen != SHIELD_WITHDRAW) {
         return None;
     }
+    if screen == SHIELD_WITHDRAW {
+        state.shield_ui.focus = FIELD_OVERRIDE;
+    }
     let early = !super::meter::waited(&state.shield_ui);
     let ui = &mut state.shield_ui;
     match code {
-        KEY_TAB => ui.focus = (ui.focus + 1) % if early { 3 } else { 2 },
+        KEY_TAB if screen == SHIELD_SEND => ui.focus = (ui.focus + 1) % if early { 3 } else { 2 },
         KEY_ENTER => return Some(super::footer::footer(state, 0)),
         KEY_BACKSPACE => {
             let _ = field(ui).pop();
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/network.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/network.rs
index 84b229b76..4fd86eee6 100644
--- a/userland/capsule_wallet_nonos/src/wallet/screen/shield/network.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/network.rs
@@ -63,7 +63,7 @@ pub fn network(state: &State, fb: &mut PaintBuffer) {
     for (name, value) in
         [("pool", POOL), ("verifier", VERIFIER), ("faucet", FAUCET), ("relayer", RELAYER)]
     {
-        y += GAP / 2 + super::pick::label(fb, c, y + GAP / 2, name);
+        y += GAP / 2 + super::pick::label(fb, c, y + GAP / 2, &name.to_uppercase());
         y += value_block(fb, c.x, y, c.w, value);
     }
     hits::reach(y, state.scroll, l.content_bottom);
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/withdraw.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/withdraw.rs
index 67d6694d0..042426ef0 100644
--- a/userland/capsule_wallet_nonos/src/wallet/screen/shield/withdraw.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/withdraw.rs
@@ -41,7 +41,7 @@ pub fn withdraw(state: &State, fb: &mut PaintBuffer) {
     hits::clear();
     let ui = &state.shield_ui;
     let status = super::status::parts(state);
-    let ready = ui.size.is_some();
+    let ready = super::check::withdraw_ready(ui);
     let footer = [("Review withdrawal", Weight::Primary, ready)];
     let spec = FrameSpec {
         number: "07",
@@ -63,6 +63,7 @@ pub fn withdraw(state: &State, fb: &mut PaintBuffer) {
     y += fact(fb, c.x, y, c.w, "relay fee", fee(ui.asset));
     y += fact(fb, c.x, y, c.w, "to", "a fresh address of this wallet");
     y += GAP / 2 + super::meter::meter(fb, c, y + GAP / 2, ui);
+    y += super::send_fields::early(fb, c, y, ui);
     hits::reach(y, state.scroll, l.content_bottom);
     end(fb, &spec, &mut l);
     super::edges::put(state, &l);
diff --git a/userland/capsule_wallet_nonos/src/wallet/state/shield_ui.rs b/userland/capsule_wallet_nonos/src/wallet/state/shield_ui.rs
index 0b1e28284..65250394c 100644
--- a/userland/capsule_wallet_nonos/src/wallet/state/shield_ui.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/state/shield_ui.rs
@@ -60,4 +60,6 @@ pub struct ShieldUi {
     pub history: Vec<Entry>,
     pub job: Option<Job>,
     pub failure: Option<&'static str>,
+    /* The absence banner, dismissed until Shield is next opened. */
+    pub absent_hidden: bool,
 }

From 3fe559b90451004c01f7443727d9ffa434cb6da0 Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 19:19:02 +0000
Subject: [PATCH 28/29] wallet: draw Swap on the Etna frame with every term in
 the open

Swap opened the old dashboard. It now has its own screen: the token
paid and the amount typed, the token bought and what the pool says
comes back, then rate, price impact, minimum received, slippage,
network fee and route in one tile, with a warning in words when the
impact is large. Picking the token already on the other side swaps
the pair, so a token is never traded for itself.

The quote source is still the stub, so an amount gets no price. The
screen says that in a banner instead of showing zero, and the button
stays "Enter an amount". Nothing signs a swap in this build.
---
 .../src/wallet/event/etna_click.rs            |  3 +
 .../src/wallet/event/on_etna.rs               |  4 +-
 .../src/wallet/paint/paint.rs                 |  1 +
 .../src/wallet/screen/mod.rs                  |  1 +
 .../src/wallet/screen/shield/mod.rs           |  1 +
 .../src/wallet/screen/shield/parts.rs         | 21 ++++++
 .../src/wallet/screen/swap/click.rs           | 72 +++++++++++++++++++
 .../src/wallet/screen/swap/mod.rs             | 22 ++++++
 .../src/wallet/screen/swap/pair.rs            | 60 ++++++++++++++++
 .../src/wallet/screen/swap/show.rs            | 70 ++++++++++++++++++
 .../src/wallet/screen/swap/terms.rs           | 70 ++++++++++++++++++
 11 files changed, 323 insertions(+), 2 deletions(-)
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/shield/parts.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/swap/click.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/swap/mod.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/swap/pair.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/swap/show.rs
 create mode 100644 userland/capsule_wallet_nonos/src/wallet/screen/swap/terms.rs

diff --git a/userland/capsule_wallet_nonos/src/wallet/event/etna_click.rs b/userland/capsule_wallet_nonos/src/wallet/event/etna_click.rs
index 66eedcf49..c78929bd6 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/etna_click.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/etna_click.rs
@@ -44,6 +44,9 @@ pub fn etna_click(state: &mut State, x: u32, y: u32) -> EventOutcome {
     if state.view == VIEW_SHIELD {
         return crate::wallet::screen::shield::click::click(state, press);
     }
+    if state.view == VIEW_SWAP {
+        return crate::wallet::screen::swap::click::click(state, press);
+    }
     match (press, state.view) {
         (Press::Footer(0), VIEW_HOME) if !state.address_ready => super::generate::generate(state),
         (Press::Footer(1), VIEW_HOME) if !state.address_ready => {
diff --git a/userland/capsule_wallet_nonos/src/wallet/event/on_etna.rs b/userland/capsule_wallet_nonos/src/wallet/event/on_etna.rs
index a8b796d09..3beb1f3cd 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/on_etna.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/on_etna.rs
@@ -20,12 +20,12 @@
  * which painter a frame gets.
  */
 
-use crate::wallet::state::{State, VIEW_HOME, VIEW_RECEIVE, VIEW_SHIELD};
+use crate::wallet::state::{State, VIEW_HOME, VIEW_RECEIVE, VIEW_SHIELD, VIEW_SWAP};
 
 pub fn on_etna(state: &State) -> bool {
     state.panel == 0
         && (state.backup_active
             || state.view == VIEW_HOME
-            || (state.view == VIEW_SHIELD && state.address_ready)
+            || ((state.view == VIEW_SHIELD || state.view == VIEW_SWAP) && state.address_ready)
             || (state.view == VIEW_RECEIVE && !state.import_active))
 }
diff --git a/userland/capsule_wallet_nonos/src/wallet/paint/paint.rs b/userland/capsule_wallet_nonos/src/wallet/paint/paint.rs
index e6b4d40d6..52d6ad8b7 100644
--- a/userland/capsule_wallet_nonos/src/wallet/paint/paint.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/paint/paint.rs
@@ -30,6 +30,7 @@ pub fn paint(state: &State, fb: &mut PaintBuffer) {
         match (state.view, state.address_ready) {
             (VIEW_RECEIVE, _) => crate::wallet::screen::receive::receive(state, fb),
             (VIEW_SHIELD, true) => crate::wallet::screen::shield::show::show(state, fb),
+            (VIEW_SWAP, true) => crate::wallet::screen::swap::show::show(state, fb),
             (_, true) => crate::wallet::screen::home::home(state, fb),
             (_, false) => crate::wallet::screen::welcome::welcome(state, fb),
         }
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/mod.rs b/userland/capsule_wallet_nonos/src/wallet/screen/mod.rs
index cf46266f0..52bc17571 100644
--- a/userland/capsule_wallet_nonos/src/wallet/screen/mod.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/mod.rs
@@ -27,5 +27,6 @@ mod home_pills;
 pub mod receive;
 pub mod receive_address;
 pub mod shield;
+pub mod swap;
 pub mod status;
 pub mod welcome;
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/mod.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/mod.rs
index aedec1c69..5356f8665 100644
--- a/userland/capsule_wallet_nonos/src/wallet/screen/shield/mod.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/mod.rs
@@ -35,6 +35,7 @@ mod home_receive;
 pub mod key;
 mod meter;
 mod network;
+pub mod parts;
 pub mod paste;
 mod pick;
 mod proving;
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/parts.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/parts.rs
new file mode 100644
index 000000000..f06d7537a
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/parts.rs
@@ -0,0 +1,21 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/* The Shield parts other Etna screens draw with too. */
+
+pub use super::chips::chips;
+pub use super::field::field;
+pub use super::pick::label;
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/swap/click.rs b/userland/capsule_wallet_nonos/src/wallet/screen/swap/click.rs
new file mode 100644
index 000000000..c5309566a
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/swap/click.rs
@@ -0,0 +1,72 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * Presses on the Swap screen, what its one button says, and the banner it
+ * shows. Choosing a token already on the other side swaps the two, so a
+ * pair can never be one token traded for itself. Nothing signs a swap in
+ * this build, and the banner says so once an amount is waiting for a price.
+ */
+
+use nonos_app_skeleton::EventOutcome;
+
+use crate::wallet::screen::hits::Press;
+use crate::wallet::state::{State, VIEW_HOME};
+use crate::wallet::swap::token;
+
+const UNPRICED: &str = "No liquidity pool is connected to this build yet, so this trade \
+     cannot be priced or sent. Nothing leaves this machine.";
+
+pub fn failure(state: &State) -> Option<&'static str> {
+    (state.swap_in > 0 && !state.swap_quote.ready).then_some(UNPRICED)
+}
+
+pub fn action(state: &State) -> &'static str {
+    if !state.swap_quote.ready {
+        "Enter an amount"
+    } else if !token(state.swap_from).is_native() && state.swap_step == 0 {
+        "Approve"
+    } else {
+        "Swap"
+    }
+}
+
+fn set(state: &mut State, pay: bool, i: u8) {
+    let (mine, other) =
+        if pay { (state.swap_from, state.swap_to) } else { (state.swap_to, state.swap_from) };
+    let other = if other == i { mine } else { other };
+    if pay {
+        (state.swap_from, state.swap_to) = (i, other);
+    } else {
+        (state.swap_to, state.swap_from) = (i, other);
+    }
+    state.swap_step = 0;
+    crate::wallet::event::swap_quote::refresh(state);
+}
+
+pub fn click(state: &mut State, press: Press) -> EventOutcome {
+    match press {
+        Press::Back => {
+            state.view = VIEW_HOME;
+            state.scroll = 0;
+        }
+        Press::Asset(i) => set(state, true, i),
+        Press::Pick(i) => set(state, false, i),
+        Press::Footer(0) => state.status = b"signing a swap is not wired in this build",
+        _ => return EventOutcome::Idle,
+    }
+    EventOutcome::Repaint
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/swap/mod.rs b/userland/capsule_wallet_nonos/src/wallet/screen/swap/mod.rs
new file mode 100644
index 000000000..1596225f2
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/swap/mod.rs
@@ -0,0 +1,22 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/* The Swap screen on the Etna frame. */
+
+pub mod click;
+mod pair;
+pub mod show;
+mod terms;
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/swap/pair.rs b/userland/capsule_wallet_nonos/src/wallet/screen/swap/pair.rs
new file mode 100644
index 000000000..200040e93
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/swap/pair.rs
@@ -0,0 +1,60 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * The two sides of the trade: the token paid and the amount typed, then
+ * the token bought and what the pool says comes back. The typed figure is
+ * shown as the amount a contract would be given, not as raw digits.
+ */
+
+use alloc::vec::Vec;
+use nonos_app_skeleton::PaintBuffer;
+
+use crate::wallet::etna::rect::Rect;
+use crate::wallet::etna::tokens::{GAP, TIGHT};
+use crate::wallet::screen::hits::Press;
+use crate::wallet::screen::shield::parts::{chips, field, label};
+use crate::wallet::state::State;
+use crate::wallet::swap::{amount_text, count, token};
+
+fn symbols() -> Vec<&'static str> {
+    (0..count()).map(|i| token(i).symbol).collect()
+}
+
+fn text(state: &State, paying: bool) -> alloc::string::String {
+    let mut b = [0u8; 48];
+    let n = amount_text(state, paying, &mut b);
+    alloc::string::String::from(core::str::from_utf8(&b[..n]).unwrap_or("0"))
+}
+
+pub fn pay(state: &State, fb: &mut PaintBuffer, c: Rect, y: u32) -> u32 {
+    let h = label(fb, c, y, "YOU PAY");
+    let k = chips(fb, c, y + h, &symbols(), Some(state.swap_from), Press::Asset);
+    let typed = if state.swap_in == 0 { alloc::string::String::new() } else { text(state, true) };
+    let name = token(state.swap_from).symbol;
+    let (_, f) = field(fb, c, y + h + k + TIGHT, name, &typed, "type an amount", true);
+    h + k + TIGHT + f + GAP
+}
+
+pub fn receive(state: &State, fb: &mut PaintBuffer, c: Rect, y: u32) -> u32 {
+    let h = label(fb, c, y, "YOU RECEIVE");
+    let k = chips(fb, c, y + h, &symbols(), Some(state.swap_to), Press::Pick);
+    let got =
+        if state.swap_quote.ready { text(state, false) } else { alloc::string::String::new() };
+    let name = token(state.swap_to).symbol;
+    let (_, f) = field(fb, c, y + h + k + TIGHT, name, &got, "no price yet", false);
+    h + k + TIGHT + f + GAP
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/swap/show.rs b/userland/capsule_wallet_nonos/src/wallet/screen/swap/show.rs
new file mode 100644
index 000000000..1c53dfd3d
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/swap/show.rs
@@ -0,0 +1,70 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * 12  SWAP: what goes in, what comes back, and every term of the trade in
+ * full before anything is signed. The quote is the pool's own reading or
+ * nothing at all; a trade with no price says so rather than showing zero.
+ */
+
+use nonos_app_skeleton::PaintBuffer;
+
+use super::pair::{pay, receive};
+use crate::wallet::etna::backdrop::Backdrop;
+use crate::wallet::etna::frame::{begin, end};
+use crate::wallet::etna::frame_spec::FrameSpec;
+use crate::wallet::etna::parts::action::Weight;
+use crate::wallet::etna::tokens::{GAP, TEXT_3};
+use crate::wallet::etna::wrap::wrapped;
+use crate::wallet::etna::Role;
+use crate::wallet::screen::hits::{self, Press};
+use crate::wallet::state::State;
+
+const LEAD: &str = "A swap is a public trade on Ethereum mainnet. Type an amount; the \
+     rate, price impact and minimum received are shown before you sign.";
+
+pub fn show(state: &State, fb: &mut PaintBuffer) {
+    hits::clear();
+    let status = super::super::status::parts(state);
+    let ready = state.swap_quote.ready;
+    let footer = [(super::click::action(state), Weight::Primary, ready)];
+    let spec = FrameSpec {
+        number: "12",
+        title: "Swap",
+        back: true,
+        backdrop: Some(Backdrop::Send),
+        failure: super::click::failure(state),
+        footer: &footer,
+        status: &status,
+        scroll: state.scroll,
+    };
+    let mut l = begin(fb, &spec);
+    let c = l.content;
+    let mut y = c.y
+        + wrapped(fb, c.x as i32, c.y as i32, c.w as i32, Role::Lead, LEAD, TEXT_3) as u32
+        + GAP;
+    y += pay(state, fb, c, y);
+    y += receive(state, fb, c, y);
+    y += super::terms::terms(state, fb, c, y);
+    hits::reach(y, state.scroll, l.content_bottom);
+    end(fb, &spec, &mut l);
+    if let Some(back) = l.back {
+        hits::put(Press::Back, back);
+    }
+    if ready {
+        hits::put(Press::Footer(0), l.footer[0]);
+    }
+}
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/swap/terms.rs b/userland/capsule_wallet_nonos/src/wallet/screen/swap/terms.rs
new file mode 100644
index 000000000..17f1ff3c7
--- /dev/null
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/swap/terms.rs
@@ -0,0 +1,70 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * Every term of the trade, open rather than folded away: the rate, how far
+ * the trade moves the price, the minimum the chain will enforce, slippage,
+ * the network fee and the route. A price impact large enough to hurt is
+ * written out as a warning under the tile, in words.
+ */
+
+use alloc::string::String;
+use alloc::vec::Vec;
+use nonos_app_skeleton::PaintBuffer;
+
+use crate::wallet::etna::parts::tile::{row_height, tile, tile_row};
+use crate::wallet::etna::rect::Rect;
+use crate::wallet::etna::tokens::{BAD, GAP, TEXT_3};
+use crate::wallet::etna::wrap::wrapped;
+use crate::wallet::etna::Role;
+use crate::wallet::state::State;
+use crate::wallet::swap::{self, token};
+
+const HURTS: &str = "This trade moves the price a long way against itself. A smaller \
+     amount would get a better rate.";
+
+fn s(f: impl Fn(&mut [u8]) -> usize) -> String {
+    let mut b = [0u8; 64];
+    let n = f(&mut b);
+    String::from(core::str::from_utf8(&b[..n]).unwrap_or(""))
+}
+
+pub fn terms(state: &State, fb: &mut PaintBuffer, c: Rect, y: u32) -> u32 {
+    let q = state.swap_quote;
+    if !q.ready {
+        return 0;
+    }
+    let (from, to) = (token(state.swap_from), token(state.swap_to));
+    let rows: Vec<(&str, String)> = Vec::from([
+        ("Rate", s(|b| swap::rate_text(state, b))),
+        ("Price impact", s(|b| swap::bps_text(q.impact_bps, b))),
+        ("Minimum received", s(|b| swap::min_out_text(state, b))),
+        ("Slippage", s(|b| swap::slippage_text(state, b))),
+        ("Network fee", s(|b| swap::gas_text(q.gas, b))),
+        ("Route", s(|b| swap::route_text(from, to, b))),
+    ]);
+    let at = Rect::new(c.x, y, c.w, row_height() * rows.len() as u32);
+    tile(fb, at);
+    for (i, (name, value)) in rows.iter().enumerate() {
+        tile_row(fb, at, y + row_height() * i as u32, name, value, i + 1 == rows.len());
+    }
+    let mut h = at.h + GAP;
+    if swap::is_warning(q.impact_bps) || swap::is_dangerous(q.impact_bps) {
+        let ink = if swap::is_dangerous(q.impact_bps) { BAD } else { TEXT_3 };
+        h += wrapped(fb, c.x as i32, (y + h) as i32, c.w as i32, Role::Lead, HURTS, ink) as u32;
+    }
+    h
+}

From 23f3c5599e01864f9bffbc59d85cdcb0ccfdb72c Mon Sep 17 00:00:00 2001
From: eKisNonos <ekisanon@proton.me>
Date: Mon, 28 Sep 2026 19:33:52 +0000
Subject: [PATCH 29/29] wallet: let the Swap banner close, and word the early
 spend for both

The Swap screen's no-price banner drew a Dismiss that did nothing; it now hides the banner until the amount is edited. The early-spend warning said "this payment" on the Withdraw screen too, and now reads for either.
---
 userland/capsule_wallet_nonos/src/wallet/event/swap_amount.rs  | 1 +
 .../src/wallet/screen/shield/send_fields.rs                    | 2 +-
 userland/capsule_wallet_nonos/src/wallet/screen/swap/click.rs  | 3 ++-
 userland/capsule_wallet_nonos/src/wallet/screen/swap/show.rs   | 3 +++
 userland/capsule_wallet_nonos/src/wallet/state/new.rs          | 1 +
 userland/capsule_wallet_nonos/src/wallet/state/types.rs        | 2 ++
 6 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/userland/capsule_wallet_nonos/src/wallet/event/swap_amount.rs b/userland/capsule_wallet_nonos/src/wallet/event/swap_amount.rs
index 634014fb2..2cf32af00 100644
--- a/userland/capsule_wallet_nonos/src/wallet/event/swap_amount.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/event/swap_amount.rs
@@ -67,5 +67,6 @@ pub fn backspace(state: &mut State) -> bool {
 /// A quote belongs to the amount it was fetched for, so a changed amount
 /// re-reads the pool rather than keeping the old figure.
 fn clear_quote(state: &mut State) {
+    state.swap_note_hidden = false;
     crate::wallet::event::swap_quote::refresh(state);
 }
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/shield/send_fields.rs b/userland/capsule_wallet_nonos/src/wallet/screen/shield/send_fields.rs
index 836b8421e..c33ee2caf 100644
--- a/userland/capsule_wallet_nonos/src/wallet/screen/shield/send_fields.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/shield/send_fields.rs
@@ -32,7 +32,7 @@ use crate::wallet::screen::hits::{self, Press};
 use crate::wallet::state::shield_ui::{ShieldUi, FIELD_AMOUNT, FIELD_OVERRIDE, FIELD_TO};
 
 const EARLY: &str = "This note has not waited long enough. Spending it now makes this \
-     payment easier to link to its deposit. To go ahead anyway, type";
+     easier to link to its deposit. To go ahead anyway, type";
 
 pub fn fields(fb: &mut PaintBuffer, c: Rect, y: u32, ui: &ShieldUi) -> u32 {
     let (to_at, a) =
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/swap/click.rs b/userland/capsule_wallet_nonos/src/wallet/screen/swap/click.rs
index c5309566a..a30b89dac 100644
--- a/userland/capsule_wallet_nonos/src/wallet/screen/swap/click.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/swap/click.rs
@@ -31,7 +31,7 @@ const UNPRICED: &str = "No liquidity pool is connected to this build yet, so thi
      cannot be priced or sent. Nothing leaves this machine.";
 
 pub fn failure(state: &State) -> Option<&'static str> {
-    (state.swap_in > 0 && !state.swap_quote.ready).then_some(UNPRICED)
+    (state.swap_in > 0 && !state.swap_quote.ready && !state.swap_note_hidden).then_some(UNPRICED)
 }
 
 pub fn action(state: &State) -> &'static str {
@@ -63,6 +63,7 @@ pub fn click(state: &mut State, press: Press) -> EventOutcome {
             state.view = VIEW_HOME;
             state.scroll = 0;
         }
+        Press::Dismiss => state.swap_note_hidden = true,
         Press::Asset(i) => set(state, true, i),
         Press::Pick(i) => set(state, false, i),
         Press::Footer(0) => state.status = b"signing a swap is not wired in this build",
diff --git a/userland/capsule_wallet_nonos/src/wallet/screen/swap/show.rs b/userland/capsule_wallet_nonos/src/wallet/screen/swap/show.rs
index 1c53dfd3d..cb0ac40f6 100644
--- a/userland/capsule_wallet_nonos/src/wallet/screen/swap/show.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/screen/swap/show.rs
@@ -67,4 +67,7 @@ pub fn show(state: &State, fb: &mut PaintBuffer) {
     if ready {
         hits::put(Press::Footer(0), l.footer[0]);
     }
+    if let Some(d) = l.dismiss {
+        hits::put(Press::Dismiss, d);
+    }
 }
diff --git a/userland/capsule_wallet_nonos/src/wallet/state/new.rs b/userland/capsule_wallet_nonos/src/wallet/state/new.rs
index 0b73c7aa5..a7c0fc3a0 100644
--- a/userland/capsule_wallet_nonos/src/wallet/state/new.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/state/new.rs
@@ -118,5 +118,6 @@ pub fn new_state() -> State {
          */
         shield: crate::wallet::shield::probe::Shield::Unknown,
         shield_ui: super::shield_ui::ShieldUi::default(),
+        swap_note_hidden: false,
     }
 }
diff --git a/userland/capsule_wallet_nonos/src/wallet/state/types.rs b/userland/capsule_wallet_nonos/src/wallet/state/types.rs
index a2852760a..b51af1e73 100644
--- a/userland/capsule_wallet_nonos/src/wallet/state/types.rs
+++ b/userland/capsule_wallet_nonos/src/wallet/state/types.rs
@@ -231,4 +231,6 @@ pub struct State {
     pub shield: crate::wallet::shield::probe::Shield,
     /* The Shield screens: which is up and what was picked on it. */
     pub shield_ui: super::shield_ui::ShieldUi,
+    /* The Swap screen's no-price banner, dismissed until the amount changes. */
+    pub swap_note_hidden: bool,
 }