From f55f273ea7ba2d58b74dfe66b0ea1fa299c9135c Mon Sep 17 00:00:00 2001
From: vecnode <vecnode@users.noreply.github.com>
Date: Sun, 18 Oct 2026 19:23:55 +0000
Subject: [PATCH 1/5] app: no web view, no window - one small front door
 (0.1.1)

The panel and the pane were 15.1 MB of a 15.5 MB binary, and removing wry alone
saved 0.3 MB: the weight was the window, not the engine. Both are gone.

vncode is now a ~0.5 MB console program with five verbs (start, install,
uninstall, status, key). It decides the root and the harness home, writes the key,
runs scripts/setup/install.* when that profile lacks the pack, and then runs
scripts/run-web.* in the foreground - the same launcher a person double-clicks,
with a composed environment and -DshHome.

Deleted: crates vn-shell-pane (wry/WebView2/WKWebView/WebKitGTK), vn-shell-egui
(eframe/egui/wgpu/winit) and vn-shell-paths, plus core::{pane, windowstate,
firstrun, adopt, appprefs, browser, status, urlpolicy} and runtime::{view, adopt}.
-Mode embed now fails by name. Dependencies: serde_json and rpassword.

check-shell.mjs is rewritten: it drives start against stub scripts in a throwaway
tree, so the bridge is proved without starting node or opening a tab. It also
caught a real bug - run-web.bat documented -Help but only handled -h/--help/?/.
---
 .gitignore                                  |   30 +-
 app/Cargo.lock                              | 5544 +------------------
 app/Cargo.toml                              |   58 +-
 app/README.md                               |  620 +--
 app/assets/icons/icon.ico                   |  Bin 5158 -> 0 bytes
 app/assets/icons/icon.png                   |  Bin 5936 -> 0 bytes
 app/crates/vn-shell-core/Cargo.toml         |    4 +-
 app/crates/vn-shell-core/src/adopt.rs       |  461 --
 app/crates/vn-shell-core/src/appprefs.rs    |  350 --
 app/crates/vn-shell-core/src/browser.rs     | 1096 ----
 app/crates/vn-shell-core/src/firstrun.rs    |  736 ---
 app/crates/vn-shell-core/src/home.rs        |    5 +
 app/crates/vn-shell-core/src/keystate.rs    |    4 +-
 app/crates/vn-shell-core/src/lib.rs         |   37 +-
 app/crates/vn-shell-core/src/options.rs     |  301 +-
 app/crates/vn-shell-core/src/pane.rs        |  236 -
 app/crates/vn-shell-core/src/status.rs      |  296 -
 app/crates/vn-shell-core/src/urlpolicy.rs   |  155 -
 app/crates/vn-shell-core/src/userpath.rs    |    4 +-
 app/crates/vn-shell-core/src/windowstate.rs |  710 ---
 app/crates/vn-shell-egui/Cargo.toml         |   28 -
 app/crates/vn-shell-egui/src/lib.rs         | 2225 --------
 app/crates/vn-shell-pane/Cargo.toml         |   27 -
 app/crates/vn-shell-pane/src/engine.rs      |  423 --
 app/crates/vn-shell-pane/src/lib.rs         |   51 -
 app/crates/vn-shell-pane/src/page.rs        |  418 --
 app/crates/vn-shell-paths/Cargo.toml        |   11 -
 app/crates/vn-shell-paths/src/lib.rs        |  525 --
 app/crates/vn-shell-runtime/Cargo.toml      |   28 +-
 app/crates/vn-shell-runtime/src/adopt.rs    |  429 --
 app/crates/vn-shell-runtime/src/env.rs      |   22 +
 app/crates/vn-shell-runtime/src/lib.rs      |  832 +--
 app/crates/vn-shell-runtime/src/setup.rs    |    8 +-
 app/crates/vn-shell-runtime/src/view.rs     |   50 -
 app/crates/vn-shell/Cargo.toml              |   17 +-
 app/crates/vn-shell/src/main.rs             |  686 +--
 package.json                                |    2 +-
 scripts/checks/README.md                    |   33 +-
 scripts/checks/check-pane.mjs               |  166 -
 scripts/checks/check-shell.mjs              |  898 +--
 scripts/run-desktop.bat                     |   48 +-
 scripts/run-desktop.sh                      |   59 +-
 scripts/run-web.bat                         |   10 +-
 scripts/tools/make-desktop-icon.mjs         |  190 -
 scripts/tools/vendor.ps1                    |  312 --
 45 files changed, 1040 insertions(+), 17105 deletions(-)
 delete mode 100644 app/assets/icons/icon.ico
 delete mode 100644 app/assets/icons/icon.png
 delete mode 100644 app/crates/vn-shell-core/src/adopt.rs
 delete mode 100644 app/crates/vn-shell-core/src/appprefs.rs
 delete mode 100644 app/crates/vn-shell-core/src/browser.rs
 delete mode 100644 app/crates/vn-shell-core/src/firstrun.rs
 delete mode 100644 app/crates/vn-shell-core/src/pane.rs
 delete mode 100644 app/crates/vn-shell-core/src/status.rs
 delete mode 100644 app/crates/vn-shell-core/src/urlpolicy.rs
 delete mode 100644 app/crates/vn-shell-core/src/windowstate.rs
 delete mode 100644 app/crates/vn-shell-egui/Cargo.toml
 delete mode 100644 app/crates/vn-shell-egui/src/lib.rs
 delete mode 100644 app/crates/vn-shell-pane/Cargo.toml
 delete mode 100644 app/crates/vn-shell-pane/src/engine.rs
 delete mode 100644 app/crates/vn-shell-pane/src/lib.rs
 delete mode 100644 app/crates/vn-shell-pane/src/page.rs
 delete mode 100644 app/crates/vn-shell-paths/Cargo.toml
 delete mode 100644 app/crates/vn-shell-paths/src/lib.rs
 delete mode 100644 app/crates/vn-shell-runtime/src/adopt.rs
 delete mode 100644 app/crates/vn-shell-runtime/src/view.rs
 delete mode 100644 scripts/checks/check-pane.mjs
 delete mode 100644 scripts/tools/make-desktop-icon.mjs
 delete mode 100644 scripts/tools/vendor.ps1

diff --git a/.gitignore b/.gitignore
index 8956b60..cc7076b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -48,41 +48,13 @@ id_ed25519*
 # zero npm dependencies); if you ever need a committed one, force-add it.
 .npmrc
 
-# The DISTRIBUTION folder built by run-dist.bat / dist.sh. It is a COPY
-# of this repository (minus the trees listed in scripts/dist-manifest.txt) plus
-# the built shell binary, and it is a build OUTPUT like any other: it is rebuilt
-# by one command, it is regenerated per platform in CI, and nothing in it is
-# content. It must never be committed - a 22 MB tree of copies would also make
-# every plugin edit show up twice in a diff.
-dist/
-
-# The SECOND output folder. `run-dist.bat -OutDir dist2` (or any other path)
-# exists because a distribution that is RUNNING holds its own vncode.exe
-# open, and Windows refuses to overwrite or delete a file in use - so a new cut
-# has to be assembled somewhere else and swapped in once the window is closed.
-# Build output for exactly the same reasons as dist/ above.
-dist2/
-
-# The VENDORED RUNTIME built by scripts/dsh/vendor.ps1: runtime/<rid>/node plus
-# the whole pinned harness tree the shell launches instead of npx (~545 MB). It
-# is build output - resolved from the pin, reproducible by one command - and
-# committing it would put a 461 MB dependency tree in every clone and fork.
-/runtime/
 # The shell's Rust build tree (app/). Cargo writes hundreds of megabytes of
 # objects and binaries under app/target/, and none of it is content:
-# `run-desktop.bat` rebuilds it, and a fresh clone builds it once. The rule is
+# `run-desktop.*` rebuilds it, and a fresh clone builds it once. The rule is
 # written as a bare `target/` because a cargo WORKSPACE puts the directory at the
 # workspace root, and any crate added under app/crates/ keeps it there.
-# The icons are the opposite - generated by scripts/make-desktop-icon.mjs and
-# committed, so a clone can build without running the generator first.
 target/
 
-# tauri-build used to write ACL/capability JSON schemas into gen/schemas on every
-# build, for editor completion. That launcher is gone and nothing generates `gen`
-# now; the rule is kept because a stale checkout can still be carrying one, and
-# nothing in the repository ever reads it.
-app/gen/
-
 # The PROTOTYPING LAB (`dsh-proto-lab`) is a workshop, not an exhibit: `lab_new`
 # generates runs into `<workspace>/lab/` for the agent to try things in, and a
 # repository that accumulated every sketch anyone ever generated would stop being
diff --git a/app/Cargo.lock b/app/Cargo.lock
index 763192c..0e2a3ba 100644
--- a/app/Cargo.lock
+++ b/app/Cargo.lock
@@ -3,5564 +3,162 @@
 version = 4
 
 [[package]]
-name = "accesskit"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3b7f7f85a7e5f68090000ed7622545829afd484d210358702ae4cb97dd0c320"
-dependencies = [
- "uuid",
-]
-
-[[package]]
-name = "accesskit_atspi_common"
-version = "0.18.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e8c61bee90b42a772d39d06a740207dc71a4e780004ace1db8d99fb1baaa954"
-dependencies = [
- "accesskit",
- "accesskit_consumer 0.36.0",
- "atspi-common",
- "phf",
- "serde",
- "zvariant",
-]
-
-[[package]]
-name = "accesskit_consumer"
-version = "0.35.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53cf47daed85312e763fbf85ceca136e0d7abc68e0a7e12abe11f48172bc3b10"
-dependencies = [
- "accesskit",
- "hashbrown 0.16.1",
-]
-
-[[package]]
-name = "accesskit_consumer"
-version = "0.36.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25e0d7e25d06f4dc21d1774d67146e9e80d6789216cbd4d1e88185b0095dba60"
-dependencies = [
- "accesskit",
- "hashbrown 0.16.1",
-]
-
-[[package]]
-name = "accesskit_consumer"
-version = "0.38.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d10a236f96f87d70732e44520046785431ef01d5bcd6b041317bfadd2f88245"
-dependencies = [
- "accesskit",
- "hashbrown 0.16.1",
-]
-
-[[package]]
-name = "accesskit_macos"
-version = "0.26.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce02dc63b43f0c9296af9ac946312a2dc8814427d7a64d2d600971dac55b6076"
-dependencies = [
- "accesskit",
- "accesskit_consumer 0.38.0",
- "hashbrown 0.16.1",
- "objc2 0.5.2",
- "objc2-app-kit 0.2.2",
- "objc2-foundation 0.2.2",
-]
-
-[[package]]
-name = "accesskit_unix"
-version = "0.21.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b016ca8db0ea0ea2ceff29a9d6240391492d960716aa471967c00e8cc8cb197c"
-dependencies = [
- "accesskit",
- "accesskit_atspi_common",
- "async-channel",
- "async-executor",
- "async-task",
- "atspi",
- "futures-lite",
- "futures-util",
- "serde",
- "zbus",
-]
-
-[[package]]
-name = "accesskit_windows"
-version = "0.32.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eff7009f1a532e917d66970a1e80c965140c6cfbbabbdde3d64e5431e6c78e21"
-dependencies = [
- "accesskit",
- "accesskit_consumer 0.35.0",
- "hashbrown 0.16.1",
- "static_assertions",
- "windows",
- "windows-core",
-]
-
-[[package]]
-name = "accesskit_winit"
-version = "0.32.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fe9a94394896352cc4660ca2288bd4ef883d83238853c038b44070c8f134313"
-dependencies = [
- "accesskit",
- "accesskit_macos",
- "accesskit_unix",
- "accesskit_windows",
- "raw-window-handle",
- "winit",
-]
-
-[[package]]
-name = "adler2"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
-
-[[package]]
-name = "ahash"
-version = "0.8.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
-dependencies = [
- "cfg-if",
- "getrandom 0.3.4",
- "once_cell",
- "version_check",
- "zerocopy",
-]
-
-[[package]]
-name = "allocator-api2"
-version = "0.2.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
-
-[[package]]
-name = "android-activity"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f2a1bb052857d5dd49572219344a7332b31b76405648eabac5bc68978251bcd"
-dependencies = [
- "android-properties",
- "bitflags 2.13.2",
- "cc",
- "jni 0.22.4",
- "libc",
- "log",
- "ndk",
- "ndk-context",
- "ndk-sys",
- "num_enum",
- "thiserror 2.0.21",
-]
-
-[[package]]
-name = "android-properties"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc7eb209b1518d6bb87b283c20095f5228ecda460da70b44f0802523dea6da04"
-
-[[package]]
-name = "android_system_properties"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "arboard"
-version = "3.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0348a1c054491f4bfe6ab86a7b6ab1e44e45d899005de92f58b3df180b36ddaf"
-dependencies = [
- "clipboard-win",
- "image",
- "log",
- "objc2 0.6.4",
- "objc2-app-kit 0.3.2",
- "objc2-core-foundation",
- "objc2-core-graphics",
- "objc2-foundation 0.3.2",
- "parking_lot",
- "percent-encoding",
- "windows-sys 0.60.2",
- "x11rb",
-]
-
-[[package]]
-name = "arrayvec"
-version = "0.7.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
-
-[[package]]
-name = "as-raw-xcb-connection"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "175571dd1d178ced59193a6fc02dde1b972eb0bc56c892cde9beeceac5bf0f6b"
-
-[[package]]
-name = "ash"
-version = "0.38.0+1.3.281"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bb44936d800fea8f016d7f2311c6a4f97aebd5dc86f09906139ec848cf3a46f"
-dependencies = [
- "libloading",
-]
-
-[[package]]
-name = "async-broadcast"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "435a87a52755b8f27fcf321ac4f04b2802e337c8c4872923137471ec39c37532"
-dependencies = [
- "event-listener",
- "event-listener-strategy",
- "futures-core",
- "pin-project-lite",
-]
-
-[[package]]
-name = "async-channel"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2"
-dependencies = [
- "concurrent-queue",
- "event-listener-strategy",
- "futures-core",
- "pin-project-lite",
-]
-
-[[package]]
-name = "async-executor"
-version = "1.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c96bf972d85afc50bf5ab8fe2d54d1586b4e0b46c97c50a0c9e71e2f7bcd812a"
-dependencies = [
- "async-task",
- "concurrent-queue",
- "fastrand",
- "futures-lite",
- "pin-project-lite",
- "slab",
-]
-
-[[package]]
-name = "async-io"
-version = "2.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "456b8a8feb6f42d237746d4b3e9a178494627745c3c56c6ea55d92ba50d026fc"
-dependencies = [
- "autocfg",
- "cfg-if",
- "concurrent-queue",
- "futures-io",
- "futures-lite",
- "parking",
- "polling",
- "rustix 1.1.4",
- "slab",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "async-lock"
-version = "3.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
-dependencies = [
- "event-listener",
- "event-listener-strategy",
- "pin-project-lite",
-]
-
-[[package]]
-name = "async-process"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75"
-dependencies = [
- "async-channel",
- "async-io",
- "async-lock",
- "async-signal",
- "async-task",
- "blocking",
- "cfg-if",
- "event-listener",
- "futures-lite",
- "rustix 1.1.4",
-]
-
-[[package]]
-name = "async-recursion"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "async-signal"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52b5aaafa020cf5053a01f2a60e8ff5dccf550f0f77ec54a4e47285ac2bab485"
-dependencies = [
- "async-io",
- "async-lock",
- "atomic-waker",
- "cfg-if",
- "futures-core",
- "futures-io",
- "rustix 1.1.4",
- "signal-hook-registry",
- "slab",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "async-task"
-version = "4.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
-
-[[package]]
-name = "async-trait"
-version = "0.1.92"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.9",
-]
-
-[[package]]
-name = "atk"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "241b621213072e993be4f6f3a9e4b45f65b7e6faad43001be957184b7bb1824b"
-dependencies = [
- "atk-sys",
- "glib",
- "libc",
-]
-
-[[package]]
-name = "atk-sys"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5e48b684b0ca77d2bbadeef17424c2ea3c897d44d566a1617e7e8f30614d086"
-dependencies = [
- "glib-sys",
- "gobject-sys",
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "atomic-waker"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
-
-[[package]]
-name = "atspi"
-version = "0.29.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c77886257be21c9cd89a4ae7e64860c6f0eefca799bb79127913052bd0eefb3d"
-dependencies = [
- "atspi-common",
- "atspi-proxies",
-]
-
-[[package]]
-name = "atspi-common"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20c5617155740c98003016429ad13fe43ce7a77b007479350a9f8bf95a29f63d"
-dependencies = [
- "enumflags2",
- "serde",
- "static_assertions",
- "zbus",
- "zbus-lockstep",
- "zbus-lockstep-macros",
- "zbus_names",
- "zvariant",
-]
-
-[[package]]
-name = "atspi-proxies"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2230e48787ed3eb4088996eab66a32ca20c0b67bbd4fd6cdfe79f04f1f04c9fc"
-dependencies = [
- "atspi-common",
- "serde",
- "zbus",
-]
-
-[[package]]
-name = "autocfg"
-version = "1.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
-
-[[package]]
-name = "base64"
-version = "0.22.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
-
-[[package]]
-name = "bit-set"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
-dependencies = [
- "bit-vec 0.8.0",
-]
-
-[[package]]
-name = "bit-set"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2f926cc3060f09db9ebc5b52823d85268d24bb917e472c0c4bea35780a7d"
-dependencies = [
- "bit-vec 0.9.1",
-]
-
-[[package]]
-name = "bit-vec"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
-
-[[package]]
-name = "bit-vec"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "bitflags"
-version = "2.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
-
-[[package]]
-name = "block-buffer"
-version = "0.10.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "block2"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c132eebf10f5cad5289222520a4a058514204aed6d791f1cf4fe8088b82d15f"
-dependencies = [
- "objc2 0.5.2",
-]
-
-[[package]]
-name = "block2"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
-dependencies = [
- "objc2 0.6.4",
-]
-
-[[package]]
-name = "blocking"
-version = "1.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a70e4329df6cb94385eed412ec92375c3cdd8a6e502493d1229b6414e4036dfa"
-dependencies = [
- "async-channel",
- "async-task",
- "futures-io",
- "futures-lite",
- "piper",
-]
-
-[[package]]
-name = "bumpalo"
-version = "3.20.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
-
-[[package]]
-name = "bytemuck"
-version = "1.25.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
-dependencies = [
- "bytemuck_derive",
-]
-
-[[package]]
-name = "bytemuck_derive"
-version = "1.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a1f896587b6f2c069c73d2f0913e2d590c3990285cd2f0b6aa02b786b4c679c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.9",
-]
-
-[[package]]
-name = "byteorder-lite"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
-
-[[package]]
-name = "bytes"
-version = "1.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
-
-[[package]]
-name = "cairo-rs"
-version = "0.18.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ca26ef0159422fb77631dc9d17b102f253b876fe1586b03b803e63a309b4ee2"
-dependencies = [
- "bitflags 2.13.2",
- "cairo-sys-rs",
- "glib",
- "libc",
- "once_cell",
- "thiserror 1.0.69",
-]
-
-[[package]]
-name = "cairo-sys-rs"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "685c9fa8e590b8b3d678873528d83411db17242a73fccaed827770ea0fedda51"
-dependencies = [
- "glib-sys",
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "calloop"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b99da2f8558ca23c71f4fd15dc57c906239752dd27ff3c00a1d56b685b7cbfec"
-dependencies = [
- "bitflags 2.13.2",
- "log",
- "polling",
- "rustix 0.38.44",
- "slab",
- "thiserror 1.0.69",
-]
-
-[[package]]
-name = "calloop"
-version = "0.14.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dbf9978365bac10f54d1d4b04f7ce4427e51f71d61f2fe15e3fed5166474df7"
-dependencies = [
- "bitflags 2.13.2",
- "polling",
- "rustix 1.1.4",
- "slab",
- "tracing",
-]
-
-[[package]]
-name = "calloop-wayland-source"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95a66a987056935f7efce4ab5668920b5d0dac4a7c99991a67395f13702ddd20"
-dependencies = [
- "calloop 0.13.0",
- "rustix 0.38.44",
- "wayland-backend",
- "wayland-client",
-]
-
-[[package]]
-name = "calloop-wayland-source"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "138efcf0940a02ebf0cc8d1eff41a1682a46b431630f4c52450d6265876021fa"
-dependencies = [
- "calloop 0.14.4",
- "rustix 1.1.4",
- "wayland-backend",
- "wayland-client",
-]
-
-[[package]]
-name = "cc"
-version = "1.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50a649af8a827553c29fb0cb4bd4a6f1a0dd695bd3232b9bc98bd9c8a3ffbb8b"
-dependencies = [
- "find-msvc-tools",
- "jobserver",
- "libc",
- "shlex",
-]
-
-[[package]]
-name = "cesu8"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
-
-[[package]]
-name = "cfg-expr"
-version = "0.15.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d067ad48b8650848b989a59a86c6c36a995d02d2bf778d45c3c5d57bc2718f02"
-dependencies = [
- "smallvec",
- "target-lexicon",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
-
-[[package]]
-name = "cfg_aliases"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
-
-[[package]]
-name = "cgl"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ced0551234e87afee12411d535648dd89d2e7f34c78b753395567aff3d447ff"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "clipboard-win"
-version = "5.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bde03770d3df201d4fb868f2c9c59e66a3e4e2bd06692a0fe701e7103c7e84d4"
-dependencies = [
- "error-code",
-]
-
-[[package]]
-name = "codespan-reporting"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af491d569909a7e4dee0ad7db7f5341fef5c614d5b8ec8cf765732aba3cff681"
-dependencies = [
- "serde",
- "termcolor",
- "unicode-width",
-]
-
-[[package]]
-name = "color"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ec7c5eb7a16992b1904d76c517d170ab353b0e0b3d5a0c81a8a0cd1037893cf"
-dependencies = [
- "bytemuck",
-]
-
-[[package]]
-name = "combine"
-version = "4.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
-dependencies = [
- "bytes",
- "memchr",
-]
-
-[[package]]
-name = "concurrent-queue"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "cookie"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a373e3602691c3cdea496d2f0ee5935151e6168fe87739483c463db1b2f2f87"
-dependencies = [
- "time",
- "version_check",
-]
-
-[[package]]
-name = "core-foundation"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
-name = "core-foundation-sys"
-version = "0.8.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
-
-[[package]]
-name = "core-graphics"
-version = "0.23.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c07782be35f9e1140080c6b96f0d44b739e2278479f64e02fdab4e32dfd8b081"
-dependencies = [
- "bitflags 1.3.2",
- "core-foundation",
- "core-graphics-types",
- "foreign-types",
- "libc",
-]
-
-[[package]]
-name = "core-graphics-types"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45390e6114f68f718cc7a830514a96f903cccd70d02a8f6d9f643ac4ba45afaf"
-dependencies = [
- "bitflags 1.3.2",
- "core-foundation",
- "libc",
-]
-
-[[package]]
-name = "cpufeatures"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "crc32fast"
-version = "1.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "crossbeam-channel"
-version = "0.5.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98b0cc327b5bc766e7fda9c9260cc0fa81b43a8e240440422dff70788e3f9ef1"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
-
-[[package]]
-name = "crunchy"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
-
-[[package]]
-name = "crypto-common"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
-dependencies = [
- "generic-array",
- "typenum",
-]
-
-[[package]]
-name = "cssparser"
-version = "0.37.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c9cdaae01d5ed7882b04d795e7f752f46ff52d2fa3b50a20d28c464510bba98"
-dependencies = [
- "cssparser-macros",
- "dtoa-short",
- "itoa",
- "phf",
- "smallvec",
-]
-
-[[package]]
-name = "cssparser-macros"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d045de693cb712d0b22c6a64be5b953f67b3ce00ab5ad3dd5d8b441886ab8e1a"
-dependencies = [
- "quote",
- "syn 3.0.9",
-]
-
-[[package]]
-name = "cursor-icon"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"
-
-[[package]]
-name = "deranged"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
-
-[[package]]
-name = "derive_more"
-version = "2.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
-dependencies = [
- "derive_more-impl",
-]
-
-[[package]]
-name = "derive_more-impl"
-version = "2.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
-dependencies = [
- "proc-macro2",
- "quote",
- "rustc_version",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer",
- "crypto-common",
-]
-
-[[package]]
-name = "dirs"
-version = "7.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d57d423b3c82e89b9a24ca3091fee61f456a26edbd28d26c65906f4bc1dcd8f"
-dependencies = [
- "dirs-sys",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
-dependencies = [
- "libc",
- "option-ext",
- "redox_users",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "dispatch"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd0c93bb4b0c6d9b77f4435b0ae98c24d17f1c45b2ff844c6151a07256ca923b"
-
-[[package]]
-name = "dispatch2"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
-dependencies = [
- "bitflags 2.13.2",
- "objc2 0.6.4",
-]
-
-[[package]]
-name = "displaydoc"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.9",
-]
-
-[[package]]
-name = "dlib"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab8ecd87370524b461f8557c119c405552c396ed91fc0a8eec68679eab26f94a"
-dependencies = [
- "libloading",
-]
-
-[[package]]
-name = "document-features"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
-dependencies = [
- "litrs",
-]
-
-[[package]]
-name = "dom_query"
-version = "0.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fac5fca71e65e94cc718a6e2af65d6e0f9c6027751c2aa562fbb5087fda639bc"
-dependencies = [
- "bit-set 0.8.0",
- "cssparser",
- "foldhash",
- "html5ever",
- "precomputed-hash",
- "selectors",
- "tendril",
-]
-
-[[package]]
-name = "downcast-rs"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
-
-[[package]]
-name = "dpi"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
-
-[[package]]
-name = "dtoa"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
-
-[[package]]
-name = "dtoa-short"
-version = "0.3.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
-dependencies = [
- "dtoa",
-]
-
-[[package]]
-name = "dunce"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
-
-[[package]]
-name = "ecolor"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0656a7530b9e2841ee7a5f983965bdd9840c32f4012f759cfd44b912cced6b34"
-dependencies = [
- "bytemuck",
- "emath",
-]
-
-[[package]]
-name = "eframe"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55ad41fac6e3149abb4866e93df37dbd33baa95db525c3368c944584e95a5dc2"
-dependencies = [
- "ahash",
- "bytemuck",
- "document-features",
- "egui",
- "egui-wgpu",
- "egui-winit",
- "egui_glow",
- "glutin",
- "glutin-winit",
- "image",
- "js-sys",
- "log",
- "objc2 0.6.4",
- "objc2-app-kit 0.3.2",
- "objc2-foundation 0.3.2",
- "parking_lot",
- "percent-encoding",
- "pollster",
- "profiling",
- "raw-window-handle",
- "static_assertions",
- "wasm-bindgen",
- "web-sys",
- "web-time",
- "wgpu",
- "windows-sys 0.61.2",
- "winit",
-]
-
-[[package]]
-name = "egui"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc938cc27cd911415e1e4d151bc56ff9df063d8db081374e87aeb805ea74b2ba"
-dependencies = [
- "accesskit",
- "ahash",
- "bitflags 2.13.2",
- "emath",
- "epaint",
- "itertools",
- "log",
- "nohash-hasher",
- "profiling",
- "smallvec",
- "unicode-segmentation",
- "web-sys",
-]
-
-[[package]]
-name = "egui-wgpu"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cef1f6d1bba40b09a4d0d62cb822b81030922cfbf65c5373398c3a3caafc5bd"
-dependencies = [
- "ahash",
- "bytemuck",
- "document-features",
- "egui",
- "epaint",
- "log",
- "profiling",
- "thiserror 2.0.21",
- "type-map",
- "web-time",
- "wgpu",
- "winit",
-]
-
-[[package]]
-name = "egui-winit"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98466000559d66ba4db786a30448b01483946add4188e7f10f522a27b4fb89cc"
-dependencies = [
- "accesskit_winit",
- "arboard",
- "bytemuck",
- "egui",
- "log",
- "objc2 0.6.4",
- "objc2-foundation 0.3.2",
- "objc2-ui-kit 0.3.2",
- "profiling",
- "raw-window-handle",
- "smithay-clipboard",
- "web-time",
- "winit",
-]
-
-[[package]]
-name = "egui_glow"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "606ed4167daf341e5753d703285c4c1d562324b2c07aa8f405cd7d066fe58f3b"
-dependencies = [
- "bytemuck",
- "egui",
- "glow",
- "log",
- "profiling",
- "winit",
-]
-
-[[package]]
-name = "either"
-version = "1.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be"
-
-[[package]]
-name = "emath"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52c8d4141cf0f60fb2f7aefaf352d3ffa5171ef0ab09731c64391801e95e48f1"
-dependencies = [
- "bytemuck",
-]
-
-[[package]]
-name = "endi"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
-
-[[package]]
-name = "enumflags2"
-version = "0.7.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1027f7680c853e056ebcec683615fb6fbbc07dbaa13b4d5d9442b146ded4ecef"
-dependencies = [
- "enumflags2_derive",
- "serde",
-]
-
-[[package]]
-name = "enumflags2_derive"
-version = "0.7.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67c78a4d8fdf9953a5c9d458f9efe940fd97a0cab0941c075a813ac594733827"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "epaint"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0ec0308dc23130fc1a7d4623a8534c2ed069c6dc84e258ee4f3de99615aa1a3"
-dependencies = [
- "ahash",
- "bytemuck",
- "ecolor",
- "emath",
- "epaint_default_fonts",
- "font-types",
- "harfrust",
- "log",
- "nohash-hasher",
- "parking_lot",
- "profiling",
- "self_cell",
- "skrifa",
- "smallvec",
- "unicode-general-category",
- "unicode-segmentation",
- "vello_cpu",
-]
-
-[[package]]
-name = "epaint_default_fonts"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773fa9c96dd0dbef887e39d0ed6177f141cce4d68e6041df77570aa3702dfa13"
-
-[[package]]
-name = "equivalent"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
-
-[[package]]
-name = "errno"
-version = "0.3.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
-dependencies = [
- "libc",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "error-code"
-version = "3.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b5343afd4a8365a643ac588dab4cf234a190c7f6c88c9f6dd6ffe00837661b7"
-
-[[package]]
-name = "euclid"
-version = "0.22.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1a05365e3b1c6d1650318537c7460c6923f1abdd272ad6842baa2b509957a06"
-dependencies = [
- "num-traits",
-]
-
-[[package]]
-name = "event-listener"
-version = "5.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
-dependencies = [
- "parking",
- "pin-project-lite",
-]
-
-[[package]]
-name = "event-listener-strategy"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
-dependencies = [
- "event-listener",
- "pin-project-lite",
-]
-
-[[package]]
-name = "fastrand"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
-
-[[package]]
-name = "fax"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caf1079563223d5d59d83c85886a56e586cfd5c1a26292e971a0fa266531ac5a"
-
-[[package]]
-name = "fdeflate"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
-dependencies = [
- "simd-adler32",
-]
-
-[[package]]
-name = "fearless_simd"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b97b65636e5b9ef369943878ac74335ba1c55c1cb6adbf1e2c293c624248d693"
-
-[[package]]
-name = "field-offset"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38e2275cc4e4fc009b0669731a1e5ab7ebf11f469eaede2bab9309a5b4d6057f"
-dependencies = [
- "memoffset",
- "rustc_version",
-]
-
-[[package]]
-name = "find-msvc-tools"
-version = "0.1.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
-
-[[package]]
-name = "flate2"
-version = "1.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
-dependencies = [
- "crc32fast",
- "miniz_oxide 0.9.1",
- "zlib-rs",
-]
-
-[[package]]
-name = "foldhash"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
-
-[[package]]
-name = "font-types"
-version = "0.12.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c92d9081c7ab3bd83ef1eecdfad090f3d966e3ce74106779664114cfe1a6274"
-dependencies = [
- "bytemuck",
-]
-
-[[package]]
-name = "foreign-types"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
-dependencies = [
- "foreign-types-macros",
- "foreign-types-shared",
-]
-
-[[package]]
-name = "foreign-types-macros"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea5190182e6915eb873ddbc16e23b711b6eb1f9c00a0d0a3a91b5f6228475225"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.9",
-]
-
-[[package]]
-name = "foreign-types-shared"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b"
-
-[[package]]
-name = "form_urlencoded"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
-dependencies = [
- "percent-encoding",
-]
-
-[[package]]
-name = "futures-channel"
-version = "0.3.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
-dependencies = [
- "futures-core",
-]
-
-[[package]]
-name = "futures-core"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
-
-[[package]]
-name = "futures-executor"
-version = "0.3.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
-dependencies = [
- "futures-core",
- "futures-task",
- "futures-util",
-]
-
-[[package]]
-name = "futures-io"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
-
-[[package]]
-name = "futures-lite"
-version = "2.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f78e10609fe0e0b3f4157ffab1876319b5b0db102a2c60dc4626306dc46b44ad"
-dependencies = [
- "fastrand",
- "futures-core",
- "futures-io",
- "parking",
- "pin-project-lite",
-]
-
-[[package]]
-name = "futures-macro"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.9",
-]
-
-[[package]]
-name = "futures-task"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
-
-[[package]]
-name = "futures-util"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
-dependencies = [
- "futures-core",
- "futures-macro",
- "futures-task",
- "pin-project-lite",
- "slab",
-]
-
-[[package]]
-name = "gdk"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9f245958c627ac99d8e529166f9823fb3b838d1d41fd2b297af3075093c2691"
-dependencies = [
- "cairo-rs",
- "gdk-pixbuf",
- "gdk-sys",
- "gio",
- "glib",
- "libc",
- "pango",
-]
-
-[[package]]
-name = "gdk-pixbuf"
-version = "0.18.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50e1f5f1b0bfb830d6ccc8066d18db35c487b1b2b1e8589b5dfe9f07e8defaec"
-dependencies = [
- "gdk-pixbuf-sys",
- "gio",
- "glib",
- "libc",
- "once_cell",
-]
-
-[[package]]
-name = "gdk-pixbuf-sys"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9839ea644ed9c97a34d129ad56d38a25e6756f99f3a88e15cd39c20629caf7"
-dependencies = [
- "gio-sys",
- "glib-sys",
- "gobject-sys",
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "gdk-sys"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c2d13f38594ac1e66619e188c6d5a1adb98d11b2fcf7894fc416ad76aa2f3f7"
-dependencies = [
- "cairo-sys-rs",
- "gdk-pixbuf-sys",
- "gio-sys",
- "glib-sys",
- "gobject-sys",
- "libc",
- "pango-sys",
- "pkg-config",
- "system-deps",
-]
-
-[[package]]
-name = "gdkx11"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3caa00e14351bebbc8183b3c36690327eb77c49abc2268dd4bd36b856db3fbfe"
-dependencies = [
- "gdk",
- "gdkx11-sys",
- "gio",
- "glib",
- "libc",
- "x11",
-]
-
-[[package]]
-name = "gdkx11-sys"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e2e7445fe01ac26f11601db260dd8608fe172514eb63b3b5e261ea6b0f4428d"
-dependencies = [
- "gdk-sys",
- "glib-sys",
- "libc",
- "system-deps",
- "x11",
-]
-
-[[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
-
-[[package]]
-name = "gethostname"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bd49230192a3797a9a4d6abe9b3eed6f7fa4c8a8a4947977c6f80025f92cbd8"
-dependencies = [
- "rustix 1.1.4",
- "windows-link",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
-dependencies = [
- "cfg-if",
- "libc",
- "r-efi 5.3.0",
- "wasip2",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
-dependencies = [
- "cfg-if",
- "libc",
- "r-efi 6.0.0",
-]
-
-[[package]]
-name = "gio"
-version = "0.18.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4fc8f532f87b79cbc51a79748f16a6828fb784be93145a322fa14d06d354c73"
-dependencies = [
- "futures-channel",
- "futures-core",
- "futures-io",
- "futures-util",
- "gio-sys",
- "glib",
- "libc",
- "once_cell",
- "pin-project-lite",
- "smallvec",
- "thiserror 1.0.69",
-]
-
-[[package]]
-name = "gio-sys"
-version = "0.18.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37566df850baf5e4cb0dfb78af2e4b9898d817ed9263d1090a2df958c64737d2"
-dependencies = [
- "glib-sys",
- "gobject-sys",
- "libc",
- "system-deps",
- "winapi",
-]
-
-[[package]]
-name = "gl_generator"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a95dfc23a2b4a9a2f5ab41d194f8bfda3cabec42af4e39f08c339eb2a0c124d"
-dependencies = [
- "khronos_api",
- "log",
- "xml-rs",
-]
-
-[[package]]
-name = "glib"
-version = "0.18.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5"
-dependencies = [
- "bitflags 2.13.2",
- "futures-channel",
- "futures-core",
- "futures-executor",
- "futures-task",
- "futures-util",
- "gio-sys",
- "glib-macros",
- "glib-sys",
- "gobject-sys",
- "libc",
- "memchr",
- "once_cell",
- "smallvec",
- "thiserror 1.0.69",
-]
-
-[[package]]
-name = "glib-macros"
-version = "0.18.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bb0228f477c0900c880fd78c8759b95c7636dbd7842707f49e132378aa2acdc"
-dependencies = [
- "heck 0.4.1",
- "proc-macro-crate 2.0.0",
- "proc-macro-error",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "glib-sys"
-version = "0.18.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "063ce2eb6a8d0ea93d2bf8ba1957e78dbab6be1c2220dd3daca57d5a9d869898"
-dependencies = [
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "glifo"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed4a1bb24121291d27230c1b1b44e07d6a9b28cefdb32fe1581dfb84e14f940a"
-dependencies = [
- "bytemuck",
- "foldhash",
- "hashbrown 0.17.1",
- "log",
- "peniko",
- "skrifa",
- "smallvec",
- "vello_common",
-]
-
-[[package]]
-name = "glow"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29038e1c483364cc6bb3cf78feee1816002e127c331a1eec55a4d202b9e1adb5"
-dependencies = [
- "js-sys",
- "slotmap",
- "wasm-bindgen",
- "web-sys",
-]
-
-[[package]]
-name = "glutin"
-version = "0.32.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12124de845cacfebedff80e877bb37b5b75c34c5a4c89e47e1cdd67fb6041325"
-dependencies = [
- "bitflags 2.13.2",
- "cfg_aliases",
- "cgl",
- "dispatch2",
- "glutin_egl_sys",
- "glutin_glx_sys",
- "glutin_wgl_sys",
- "libloading",
- "objc2 0.6.4",
- "objc2-app-kit 0.3.2",
- "objc2-core-foundation",
- "objc2-foundation 0.3.2",
- "once_cell",
- "raw-window-handle",
- "wayland-sys",
- "windows-sys 0.52.0",
- "x11-dl",
-]
-
-[[package]]
-name = "glutin-winit"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85edca7075f8fc728f28cb8fbb111a96c3b89e930574369e3e9c27eb75d3788f"
-dependencies = [
- "cfg_aliases",
- "glutin",
- "raw-window-handle",
- "winit",
-]
-
-[[package]]
-name = "glutin_egl_sys"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c4680ba6195f424febdc3ba46e7a42a0e58743f2edb115297b86d7f8ecc02d2"
-dependencies = [
- "gl_generator",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "glutin_glx_sys"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7bb2938045a88b612499fbcba375a77198e01306f52272e692f8c1f3751185"
-dependencies = [
- "gl_generator",
- "x11-dl",
-]
-
-[[package]]
-name = "glutin_wgl_sys"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c4ee00b289aba7a9e5306d57c2d05499b2e5dc427f84ac708bd2c090212cf3e"
-dependencies = [
- "gl_generator",
-]
-
-[[package]]
-name = "gobject-sys"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0850127b514d1c4a4654ead6dedadb18198999985908e6ffe4436f53c785ce44"
-dependencies = [
- "glib-sys",
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "gpu-allocator"
-version = "0.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51255ea7cfaadb6c5f1528d43e92a82acb2b96c43365989a28b2d44ee38f8795"
-dependencies = [
- "ash",
- "hashbrown 0.16.1",
- "log",
- "presser",
- "thiserror 2.0.21",
- "windows",
-]
-
-[[package]]
-name = "gtk"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd56fb197bfc42bd5d2751f4f017d44ff59fbb58140c6b49f9b3b2bdab08506a"
-dependencies = [
- "atk",
- "cairo-rs",
- "field-offset",
- "futures-channel",
- "gdk",
- "gdk-pixbuf",
- "gio",
- "glib",
- "gtk-sys",
- "gtk3-macros",
- "libc",
- "pango",
- "pkg-config",
-]
-
-[[package]]
-name = "gtk-sys"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f29a1c21c59553eb7dd40e918be54dccd60c52b049b75119d5d96ce6b624414"
-dependencies = [
- "atk-sys",
- "cairo-sys-rs",
- "gdk-pixbuf-sys",
- "gdk-sys",
- "gio-sys",
- "glib-sys",
- "gobject-sys",
- "libc",
- "pango-sys",
- "system-deps",
-]
-
-[[package]]
-name = "gtk3-macros"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52ff3c5b21f14f0736fed6dcfc0bfb4225ebf5725f3c0209edeec181e4d73e9d"
-dependencies = [
- "proc-macro-crate 1.3.1",
- "proc-macro-error",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "guillotiere"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b17e70c989c36bad147b27a58d148c0741c51448aa5653436547323e524d0ab"
-dependencies = [
- "euclid",
-]
-
-[[package]]
-name = "half"
-version = "2.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
-dependencies = [
- "cfg-if",
- "crunchy",
- "num-traits",
- "zerocopy",
-]
-
-[[package]]
-name = "harfrust"
-version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c03d949a14aa089bbb282f7dd76a498a7f684428e4257202efc119ec010376f9"
-dependencies = [
- "bitflags 2.13.2",
- "bytemuck",
- "read-fonts",
- "smallvec",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.16.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
-dependencies = [
- "allocator-api2",
- "equivalent",
- "foldhash",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
-dependencies = [
- "foldhash",
-]
-
-[[package]]
-name = "heck"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
-
-[[package]]
-name = "heck"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
-
-[[package]]
-name = "hermit-abi"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
-
-[[package]]
-name = "hex"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
-
-[[package]]
-name = "html5ever"
-version = "0.39.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46a1761807faccc9a19e86944bbf40610014066306f96edcdedc2fb714bcb7b8"
-dependencies = [
- "log",
- "markup5ever",
-]
-
-[[package]]
-name = "http"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
-dependencies = [
- "bytes",
- "itoa",
-]
-
-[[package]]
-name = "icu_collections"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
-dependencies = [
- "displaydoc",
- "potential_utf",
- "utf8_iter",
- "yoke",
- "zerofrom",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locale_core"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
-dependencies = [
- "displaydoc",
- "litemap",
- "tinystr",
- "writeable",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
-dependencies = [
- "icu_collections",
- "icu_normalizer_data",
- "icu_properties",
- "icu_provider",
- "smallvec",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer_data"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
-
-[[package]]
-name = "icu_properties"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
-dependencies = [
- "displaydoc",
- "icu_collections",
- "icu_locale_core",
- "icu_properties_data",
- "icu_provider",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "icu_properties_data"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
-
-[[package]]
-name = "icu_provider"
-version = "2.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
-dependencies = [
- "displaydoc",
- "icu_locale_core",
- "writeable",
- "yoke",
- "zerofrom",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "idna"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
-dependencies = [
- "idna_adapter",
- "smallvec",
- "utf8_iter",
-]
-
-[[package]]
-name = "idna_adapter"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
-dependencies = [
- "icu_normalizer",
- "icu_properties",
-]
-
-[[package]]
-name = "image"
-version = "0.25.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85ab80394333c02fe689eaf900ab500fbd0c2213da414687ebf995a65d5a6104"
-dependencies = [
- "bytemuck",
- "byteorder-lite",
- "moxcms",
- "num-traits",
- "png",
- "tiff",
-]
-
-[[package]]
-name = "indexmap"
-version = "2.14.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
-dependencies = [
- "equivalent",
- "hashbrown 0.17.1",
-]
-
-[[package]]
-name = "itertools"
-version = "0.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b4baf93f58d4425749ca49a51c50ebab072c5df6994d08fed93541c331481dc"
-dependencies = [
- "either",
-]
-
-[[package]]
-name = "itoa"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
-
-[[package]]
-name = "javascriptcore-rs"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca5671e9ffce8ffba57afc24070e906da7fc4b1ba66f2cabebf61bf2ea257fcc"
-dependencies = [
- "bitflags 1.3.2",
- "glib",
- "javascriptcore-rs-sys",
-]
-
-[[package]]
-name = "javascriptcore-rs-sys"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af1be78d14ffa4b75b66df31840478fef72b51f8c2465d4ca7c194da9f7a5124"
-dependencies = [
- "glib-sys",
- "gobject-sys",
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "jni"
-version = "0.21.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
-dependencies = [
- "cesu8",
- "cfg-if",
- "combine",
- "jni-sys 0.3.1",
- "log",
- "thiserror 1.0.69",
- "walkdir",
- "windows-sys 0.45.0",
-]
-
-[[package]]
-name = "jni"
-version = "0.22.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
-dependencies = [
- "cfg-if",
- "combine",
- "jni-macros",
- "jni-sys 0.4.1",
- "log",
- "simd_cesu8",
- "thiserror 2.0.21",
- "walkdir",
- "windows-link",
-]
-
-[[package]]
-name = "jni-macros"
-version = "0.22.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
-dependencies = [
- "proc-macro2",
- "quote",
- "rustc_version",
- "simd_cesu8",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "jni-sys"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
-dependencies = [
- "jni-sys 0.4.1",
-]
-
-[[package]]
-name = "jni-sys"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
-dependencies = [
- "jni-sys-macros",
-]
-
-[[package]]
-name = "jni-sys-macros"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
-dependencies = [
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "jobserver"
-version = "0.1.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
-dependencies = [
- "getrandom 0.4.3",
- "libc",
-]
-
-[[package]]
-name = "js-sys"
-version = "0.3.104"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a"
-dependencies = [
- "cfg-if",
- "futures-util",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "khronos-egl"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6aae1df220ece3c0ada96b8153459b67eebe9ae9212258bb0134ae60416fdf76"
-dependencies = [
- "libc",
- "libloading",
- "pkg-config",
-]
-
-[[package]]
-name = "khronos_api"
-version = "3.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2db585e1d738fc771bf08a151420d3ed193d9d895a36df7f6f8a9456b911ddc"
-
-[[package]]
-name = "kurbo"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b60dfc32f652b926df6192e55525b16d186c69d47876c3ead4da5cc9f8450e2"
-dependencies = [
- "arrayvec",
- "euclid",
- "polycool",
- "smallvec",
-]
-
-[[package]]
-name = "libc"
-version = "0.2.190"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
-
-[[package]]
-name = "libloading"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
-dependencies = [
- "cfg-if",
- "windows-link",
-]
-
-[[package]]
-name = "libm"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
-
-[[package]]
-name = "libredox"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d0a00925a9f930d679b6789b721e3a7f9ed110f41b86d2497caa780c3a070a"
-dependencies = [
- "bitflags 2.13.2",
- "libc",
- "plain",
- "redox_syscall 0.9.3",
-]
-
-[[package]]
-name = "linebender_resource_handle"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4a5ff6bcca6c4867b1c4fd4ef63e4db7436ef363e0ad7531d1558856bae64f4"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
-
-[[package]]
-name = "litemap"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
-
-[[package]]
-name = "litrs"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4744e383959f0db86ede514b809b1c53251889093803c05267acc7d4e7030d70"
-
-[[package]]
-name = "lock_api"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
-dependencies = [
- "scopeguard",
-]
-
-[[package]]
-name = "log"
-version = "0.4.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
-
-[[package]]
-name = "markup5ever"
-version = "0.39.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7122d987ec5f704ee56f6e5b41a7d93722e9aae27ae07cafa4036c4d3f9757de"
-dependencies = [
- "log",
- "tendril",
- "web_atoms",
-]
-
-[[package]]
-name = "memchr"
-version = "2.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
-
-[[package]]
-name = "memmap2"
-version = "0.9.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "memoffset"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "miniz_oxide"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
-dependencies = [
- "adler2",
- "simd-adler32",
-]
-
-[[package]]
-name = "miniz_oxide"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
-dependencies = [
- "adler2",
- "simd-adler32",
-]
-
-[[package]]
-name = "moxcms"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb85c154ba489f01b25c0d36ae69a87e4a1c73a72631fc6c0eb6dde34a73e44b"
-dependencies = [
- "num-traits",
- "pxfm",
-]
-
-[[package]]
-name = "naga"
-version = "30.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a616d2fb8c89516ac2723a581f69d6c18576046bed761bd6b305e5618e6ae130"
-dependencies = [
- "arrayvec",
- "bit-set 0.10.0",
- "bitflags 2.13.2",
- "cfg-if",
- "cfg_aliases",
- "codespan-reporting",
- "half",
- "hashbrown 0.17.1",
- "indexmap",
- "libm",
- "log",
- "naga-types",
- "num-traits",
- "once_cell",
- "rustc-hash 1.1.0",
- "spirv",
- "thiserror 2.0.21",
- "unicode-ident",
-]
-
-[[package]]
-name = "naga-types"
-version = "30.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "590afbf58a6f4f62873cd5cff4468061844bafa1cdf399cc954537c22d768d49"
-dependencies = [
- "hashbrown 0.17.1",
- "indexmap",
- "rustc-hash 1.1.0",
- "thiserror 2.0.21",
-]
-
-[[package]]
-name = "ndk"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4"
-dependencies = [
- "bitflags 2.13.2",
- "jni-sys 0.3.1",
- "log",
- "ndk-sys",
- "num_enum",
- "raw-window-handle",
- "thiserror 1.0.69",
-]
-
-[[package]]
-name = "ndk-context"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
-
-[[package]]
-name = "ndk-sys"
-version = "0.6.0+11769913"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873"
-dependencies = [
- "jni-sys 0.3.1",
-]
-
-[[package]]
-name = "new_debug_unreachable"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
-
-[[package]]
-name = "nohash-hasher"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
-
-[[package]]
-name = "num-conv"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
-
-[[package]]
-name = "num-traits"
-version = "0.2.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
-dependencies = [
- "autocfg",
- "libm",
-]
-
-[[package]]
-name = "num_enum"
-version = "0.7.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d0bca838442ec211fa11de3a8b0e0e8f3a4522575b5c4c06ed722e005036f26"
-dependencies = [
- "num_enum_derive",
- "rustversion",
-]
-
-[[package]]
-name = "num_enum_derive"
-version = "0.7.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
-dependencies = [
- "proc-macro-crate 3.5.0",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "objc-sys"
-version = "0.3.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdb91bdd390c7ce1a8607f35f3ca7151b65afc0ff5ff3b34fa350f7d7c7e4310"
-
-[[package]]
-name = "objc2"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46a785d4eeff09c14c487497c162e92766fbb3e4059a71840cecc03d9a50b804"
-dependencies = [
- "objc-sys",
- "objc2-encode",
-]
-
-[[package]]
-name = "objc2"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f"
-dependencies = [
- "objc2-encode",
- "objc2-exception-helper",
-]
-
-[[package]]
-name = "objc2-app-kit"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4e89ad9e3d7d297152b17d39ed92cd50ca8063a89a9fa569046d41568891eff"
-dependencies = [
- "bitflags 2.13.2",
- "block2 0.5.1",
- "libc",
- "objc2 0.5.2",
- "objc2-core-data",
- "objc2-core-image",
- "objc2-foundation 0.2.2",
- "objc2-quartz-core 0.2.2",
-]
-
-[[package]]
-name = "objc2-app-kit"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c"
-dependencies = [
- "bitflags 2.13.2",
- "objc2 0.6.4",
- "objc2-core-foundation",
- "objc2-core-graphics",
- "objc2-foundation 0.3.2",
-]
-
-[[package]]
-name = "objc2-cloud-kit"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74dd3b56391c7a0596a295029734d3c1c5e7e510a4cb30245f8221ccea96b009"
-dependencies = [
- "bitflags 2.13.2",
- "block2 0.5.1",
- "objc2 0.5.2",
- "objc2-core-location",
- "objc2-foundation 0.2.2",
-]
-
-[[package]]
-name = "objc2-contacts"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5ff520e9c33812fd374d8deecef01d4a840e7b41862d849513de77e44aa4889"
-dependencies = [
- "block2 0.5.1",
- "objc2 0.5.2",
- "objc2-foundation 0.2.2",
-]
-
-[[package]]
-name = "objc2-core-data"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "617fbf49e071c178c0b24c080767db52958f716d9eabdf0890523aeae54773ef"
-dependencies = [
- "bitflags 2.13.2",
- "block2 0.5.1",
- "objc2 0.5.2",
- "objc2-foundation 0.2.2",
-]
-
-[[package]]
-name = "objc2-core-foundation"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
-dependencies = [
- "bitflags 2.13.2",
- "dispatch2",
- "objc2 0.6.4",
-]
-
-[[package]]
-name = "objc2-core-graphics"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
-dependencies = [
- "bitflags 2.13.2",
- "dispatch2",
- "objc2 0.6.4",
- "objc2-core-foundation",
- "objc2-io-surface",
-]
-
-[[package]]
-name = "objc2-core-image"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55260963a527c99f1819c4f8e3b47fe04f9650694ef348ffd2227e8196d34c80"
-dependencies = [
- "block2 0.5.1",
- "objc2 0.5.2",
- "objc2-foundation 0.2.2",
- "objc2-metal 0.2.2",
-]
-
-[[package]]
-name = "objc2-core-location"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "000cfee34e683244f284252ee206a27953279d370e309649dc3ee317b37e5781"
-dependencies = [
- "block2 0.5.1",
- "objc2 0.5.2",
- "objc2-contacts",
- "objc2-foundation 0.2.2",
-]
-
-[[package]]
-name = "objc2-encode"
-version = "4.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
-
-[[package]]
-name = "objc2-exception-helper"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7a1c5fbb72d7735b076bb47b578523aedc40f3c439bea6dfd595c089d79d98a"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "objc2-foundation"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ee638a5da3799329310ad4cfa62fbf045d5f56e3ef5ba4149e7452dcf89d5a8"
-dependencies = [
- "bitflags 2.13.2",
- "block2 0.5.1",
- "dispatch",
- "libc",
- "objc2 0.5.2",
-]
-
-[[package]]
-name = "objc2-foundation"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
-dependencies = [
- "bitflags 2.13.2",
- "block2 0.6.2",
- "objc2 0.6.4",
- "objc2-core-foundation",
-]
-
-[[package]]
-name = "objc2-io-surface"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
-dependencies = [
- "bitflags 2.13.2",
- "objc2 0.6.4",
- "objc2-core-foundation",
-]
-
-[[package]]
-name = "objc2-link-presentation"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1a1ae721c5e35be65f01a03b6d2ac13a54cb4fa70d8a5da293d7b0020261398"
-dependencies = [
- "block2 0.5.1",
- "objc2 0.5.2",
- "objc2-app-kit 0.2.2",
- "objc2-foundation 0.2.2",
-]
-
-[[package]]
-name = "objc2-metal"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd0cba1276f6023976a406a14ffa85e1fdd19df6b0f737b063b95f6c8c7aadd6"
-dependencies = [
- "bitflags 2.13.2",
- "block2 0.5.1",
- "objc2 0.5.2",
- "objc2-foundation 0.2.2",
-]
-
-[[package]]
-name = "objc2-metal"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0125f776a10d00af4152d74616409f0d4a2053a6f57fa5b7d6aa2854ac04794"
-dependencies = [
- "bitflags 2.13.2",
- "block2 0.6.2",
- "objc2 0.6.4",
- "objc2-foundation 0.3.2",
-]
-
-[[package]]
-name = "objc2-quartz-core"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e42bee7bff906b14b167da2bac5efe6b6a07e6f7c0a21a7308d40c960242dc7a"
-dependencies = [
- "bitflags 2.13.2",
- "block2 0.5.1",
- "objc2 0.5.2",
- "objc2-foundation 0.2.2",
- "objc2-metal 0.2.2",
-]
-
-[[package]]
-name = "objc2-quartz-core"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f"
-dependencies = [
- "bitflags 2.13.2",
- "objc2 0.6.4",
- "objc2-core-foundation",
- "objc2-core-graphics",
- "objc2-foundation 0.3.2",
- "objc2-metal 0.3.2",
-]
-
-[[package]]
-name = "objc2-symbols"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a684efe3dec1b305badae1a28f6555f6ddd3bb2c2267896782858d5a78404dc"
-dependencies = [
- "objc2 0.5.2",
- "objc2-foundation 0.2.2",
-]
-
-[[package]]
-name = "objc2-ui-kit"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8bb46798b20cd6b91cbd113524c490f1686f4c4e8f49502431415f3512e2b6f"
-dependencies = [
- "bitflags 2.13.2",
- "block2 0.5.1",
- "objc2 0.5.2",
- "objc2-cloud-kit",
- "objc2-core-data",
- "objc2-core-image",
- "objc2-core-location",
- "objc2-foundation 0.2.2",
- "objc2-link-presentation",
- "objc2-quartz-core 0.2.2",
- "objc2-symbols",
- "objc2-uniform-type-identifiers",
- "objc2-user-notifications",
-]
-
-[[package]]
-name = "objc2-ui-kit"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d87d638e33c06f577498cbcc50491496a3ed4246998a7fbba7ccb98b1e7eab22"
-dependencies = [
- "bitflags 2.13.2",
- "objc2 0.6.4",
- "objc2-core-foundation",
- "objc2-foundation 0.3.2",
-]
-
-[[package]]
-name = "objc2-uniform-type-identifiers"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44fa5f9748dbfe1ca6c0b79ad20725a11eca7c2218bceb4b005cb1be26273bfe"
-dependencies = [
- "block2 0.5.1",
- "objc2 0.5.2",
- "objc2-foundation 0.2.2",
-]
-
-[[package]]
-name = "objc2-user-notifications"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76cfcbf642358e8689af64cee815d139339f3ed8ad05103ed5eaf73db8d84cb3"
-dependencies = [
- "bitflags 2.13.2",
- "block2 0.5.1",
- "objc2 0.5.2",
- "objc2-core-location",
- "objc2-foundation 0.2.2",
-]
-
-[[package]]
-name = "objc2-web-kit"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2e5aaab980c433cf470df9d7af96a7b46a9d892d521a2cbbb2f8a4c16751e7f"
-dependencies = [
- "bitflags 2.13.2",
- "block2 0.6.2",
- "objc2 0.6.4",
- "objc2-app-kit 0.3.2",
- "objc2-core-foundation",
- "objc2-foundation 0.3.2",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.21.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
-
-[[package]]
-name = "option-ext"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
-
-[[package]]
-name = "orbclient"
-version = "0.3.55"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5df339f526ea9a60e371768d50efc2f2508c7203290731565d1f7a6f71d21747"
-dependencies = [
- "libc",
- "libredox",
-]
-
-[[package]]
-name = "ordered-float"
-version = "5.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c7c9e0d9b23589f26070720bac724174bfec1083e82f7854cdd0267518343c0"
-dependencies = [
- "num-traits",
-]
-
-[[package]]
-name = "ordered-stream"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aa2b01e1d916879f73a53d01d1d6cee68adbb31d6d9177a8cfce093cced1d50"
-dependencies = [
- "futures-core",
- "pin-project-lite",
-]
-
-[[package]]
-name = "pango"
-version = "0.18.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ca27ec1eb0457ab26f3036ea52229edbdb74dee1edd29063f5b9b010e7ebee4"
-dependencies = [
- "gio",
- "glib",
- "libc",
- "once_cell",
- "pango-sys",
-]
-
-[[package]]
-name = "pango-sys"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "436737e391a843e5933d6d9aa102cb126d501e815b83601365a948a518555dc5"
-dependencies = [
- "glib-sys",
- "gobject-sys",
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "parking"
-version = "2.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
-
-[[package]]
-name = "parking_lot"
-version = "0.12.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
-dependencies = [
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.9.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
-dependencies = [
- "cfg-if",
- "libc",
- "redox_syscall 0.5.18",
- "smallvec",
- "windows-link",
-]
-
-[[package]]
-name = "peniko"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "839c8299360d2e998bdb106dc0a6cd71dcc5f4df51df1b620361bf50e283cca6"
-dependencies = [
- "bytemuck",
- "color",
- "kurbo",
- "linebender_resource_handle",
- "smallvec",
-]
-
-[[package]]
-name = "percent-encoding"
-version = "2.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
-
-[[package]]
-name = "phf"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
-dependencies = [
- "phf_macros",
- "phf_shared",
- "serde",
-]
-
-[[package]]
-name = "phf_codegen"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
-dependencies = [
- "phf_generator",
- "phf_shared",
-]
-
-[[package]]
-name = "phf_generator"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
-dependencies = [
- "fastrand",
- "phf_shared",
-]
-
-[[package]]
-name = "phf_macros"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
-dependencies = [
- "phf_generator",
- "phf_shared",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "phf_shared"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
-dependencies = [
- "siphasher",
-]
-
-[[package]]
-name = "pin-project"
-version = "1.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
-dependencies = [
- "pin-project-internal",
-]
-
-[[package]]
-name = "pin-project-internal"
-version = "1.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "pin-project-lite"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
-
-[[package]]
-name = "piper"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c835479a4443ded371d6c535cbfd8d31ad92c5d23ae9770a61bc155e4992a3c1"
-dependencies = [
- "atomic-waker",
- "fastrand",
- "futures-io",
-]
-
-[[package]]
-name = "pkg-config"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
-
-[[package]]
-name = "plain"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
-
-[[package]]
-name = "png"
-version = "0.18.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
-dependencies = [
- "bitflags 2.13.2",
- "crc32fast",
- "fdeflate",
- "flate2",
- "miniz_oxide 0.8.9",
-]
-
-[[package]]
-name = "polling"
-version = "3.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218"
-dependencies = [
- "cfg-if",
- "concurrent-queue",
- "hermit-abi",
- "pin-project-lite",
- "rustix 1.1.4",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "pollster"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc6355899e1c9462875b6757c79f3caa011a1fdae12bbb1a2e72dd1f234f8336"
-
-[[package]]
-name = "polycool"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50596ddc09eb5ad5f75cacd40209568e66df71baf86e1499a0e99c4cff12a5a6"
-dependencies = [
- "arrayvec",
-]
-
-[[package]]
-name = "portable-atomic"
-version = "1.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
-
-[[package]]
-name = "portable-atomic-util"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
-dependencies = [
- "portable-atomic",
-]
-
-[[package]]
-name = "potential_utf"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
-dependencies = [
- "zerovec",
-]
-
-[[package]]
-name = "powerfmt"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
-
-[[package]]
-name = "precomputed-hash"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
-
-[[package]]
-name = "presser"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8cf8e6a8aa66ce33f63993ffc4ea4271eb5b0530a9002db8455ea6050c77bfa"
-
-[[package]]
-name = "proc-macro-crate"
-version = "1.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
-dependencies = [
- "once_cell",
- "toml_edit 0.19.15",
-]
-
-[[package]]
-name = "proc-macro-crate"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e8366a6159044a37876a2b9817124296703c586a5c92e2c53751fa06d8d43e8"
-dependencies = [
- "toml_edit 0.20.7",
-]
-
-[[package]]
-name = "proc-macro-crate"
-version = "3.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
-dependencies = [
- "toml_edit 0.25.13+spec-1.1.0",
-]
-
-[[package]]
-name = "proc-macro-error"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
-dependencies = [
- "proc-macro-error-attr",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
- "version_check",
-]
-
-[[package]]
-name = "proc-macro-error-attr"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
-dependencies = [
- "proc-macro2",
- "quote",
- "version_check",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.107"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "profiling"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d595e54a326bc53c1c197b32d295e14b169e3cfeaa8dc82b529f947fba6bcf5"
-
-[[package]]
-name = "pxfm"
-version = "0.1.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d55d956fa96f5ec02be2e13af0e20391a5aa83d6a074e3ad368959d0fab299ea"
-
-[[package]]
-name = "quick-error"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
-
-[[package]]
-name = "quick-xml"
-version = "0.41.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.47"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "r-efi"
-version = "5.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
-
-[[package]]
-name = "r-efi"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
-
-[[package]]
-name = "range-alloc"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca45419789ae5a7899559e9512e58ca889e41f04f1f2445e9f4b290ceccd1d08"
-
-[[package]]
-name = "raw-window-handle"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539"
-
-[[package]]
-name = "raw-window-metal"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40d213455a5f1dc59214213c7330e074ddf8114c9a42411eb890c767357ce135"
-dependencies = [
- "objc2 0.6.4",
- "objc2-core-foundation",
- "objc2-foundation 0.3.2",
- "objc2-quartz-core 0.3.2",
-]
-
-[[package]]
-name = "read-fonts"
-version = "0.41.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "046a7d674daf459825b32f5062056d6882db0d2f5a479fbd76ccfc870ac18709"
-dependencies = [
- "bytemuck",
- "font-types",
- "once_cell",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
-dependencies = [
- "bitflags 1.3.2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.5.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
-dependencies = [
- "bitflags 2.13.2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d678d17679829e73d371e96880897e98fee2ded7acc0a50bdf8af2affa4b2fe5"
-dependencies = [
- "bitflags 2.13.2",
-]
-
-[[package]]
-name = "redox_users"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
-dependencies = [
- "getrandom 0.2.17",
- "libredox",
- "thiserror 2.0.21",
-]
-
-[[package]]
-name = "renderdoc-sys"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19b30a45b0cd0bcca8037f3d0dc3421eaf95327a17cad11964fb8179b4fc4832"
-
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
-[[package]]
-name = "rustc-hash"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
-
-[[package]]
-name = "rustc_version"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
-dependencies = [
- "semver",
-]
-
-[[package]]
-name = "rustix"
-version = "0.38.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
-dependencies = [
- "bitflags 2.13.2",
- "errno",
- "libc",
- "linux-raw-sys 0.4.15",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "rustix"
-version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
-dependencies = [
- "bitflags 2.13.2",
- "errno",
- "libc",
- "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "rustversion"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
-
-[[package]]
-name = "same-file"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "scoped-tls"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
-
-[[package]]
-name = "scopeguard"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
-
-[[package]]
-name = "selectors"
-version = "0.38.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8adfa1c298912827b8a28b223b3b874357397ae706e6190acd9bf28cee99114d"
-dependencies = [
- "bitflags 2.13.2",
- "cssparser",
- "derive_more",
- "log",
- "new_debug_unreachable",
- "phf",
- "phf_codegen",
- "precomputed-hash",
- "rustc-hash 2.1.3",
- "servo_arc",
- "smallvec",
-]
-
-[[package]]
-name = "self_cell"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ab42ca02749e120097e328d91d415325bdf43b1c72c4c8badf37375fe40a813"
-
-[[package]]
-name = "semver"
-version = "1.0.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
-
-[[package]]
-name = "serde"
-version = "1.0.229"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
-dependencies = [
- "serde_core",
- "serde_derive",
-]
-
-[[package]]
-name = "serde_core"
-version = "1.0.229"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.229"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.9",
-]
-
-[[package]]
-name = "serde_json"
-version = "1.0.154"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
-dependencies = [
- "itoa",
- "memchr",
- "serde",
- "serde_core",
- "zmij",
-]
-
-[[package]]
-name = "serde_repr"
-version = "0.1.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.9",
-]
-
-[[package]]
-name = "serde_spanned"
-version = "0.6.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "servo_arc"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "170fb83ab34de17dc69aa7c67482b22218ddb85da56546f9bd6b929e32a05930"
-dependencies = [
- "stable_deref_trait",
-]
-
-[[package]]
-name = "sha2"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
-[[package]]
-name = "shlex"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
-
-[[package]]
-name = "signal-hook-registry"
-version = "1.4.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
-dependencies = [
- "errno",
- "libc",
-]
-
-[[package]]
-name = "simd-adler32"
-version = "0.3.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
-
-[[package]]
-name = "simd_cesu8"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
-dependencies = [
- "rustc_version",
- "simdutf8",
-]
-
-[[package]]
-name = "simdutf8"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
-
-[[package]]
-name = "siphasher"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
-
-[[package]]
-name = "skrifa"
-version = "0.44.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819ab7d62b1d3e72d9d9dea5650bac30424f9111364bb94928dbf5ecad1baa68"
-dependencies = [
- "bytemuck",
- "read-fonts",
-]
-
-[[package]]
-name = "slab"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
-
-[[package]]
-name = "slotmap"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdd58c3c93c3d278ca835519292445cb4b0d4dc59ccfdf7ceadaab3f8aeb4038"
-dependencies = [
- "version_check",
-]
-
-[[package]]
-name = "smallvec"
-version = "1.16.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b3dc8af474f516a851ff4bd12db780f948b9250ad37211e4eec0bccea54e01b"
-
-[[package]]
-name = "smithay-client-toolkit"
-version = "0.19.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3457dea1f0eb631b4034d61d4d8c32074caa6cd1ab2d59f2327bd8461e2c0016"
-dependencies = [
- "bitflags 2.13.2",
- "calloop 0.13.0",
- "calloop-wayland-source 0.3.0",
- "cursor-icon",
- "libc",
- "log",
- "memmap2",
- "rustix 0.38.44",
- "thiserror 1.0.69",
- "wayland-backend",
- "wayland-client",
- "wayland-csd-frame",
- "wayland-cursor",
- "wayland-protocols",
- "wayland-protocols-wlr",
- "wayland-scanner",
- "xkeysym",
-]
-
-[[package]]
-name = "smithay-client-toolkit"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0512da38f5e2b31201a93524adb8d3136276fa4fe4aafab4e1f727a82b534cc0"
-dependencies = [
- "bitflags 2.13.2",
- "calloop 0.14.4",
- "calloop-wayland-source 0.4.1",
- "cursor-icon",
- "libc",
- "log",
- "memmap2",
- "rustix 1.1.4",
- "thiserror 2.0.21",
- "wayland-backend",
- "wayland-client",
- "wayland-csd-frame",
- "wayland-cursor",
- "wayland-protocols",
- "wayland-protocols-experimental",
- "wayland-protocols-misc",
- "wayland-protocols-wlr",
- "wayland-scanner",
- "xkeysym",
-]
-
-[[package]]
-name = "smithay-clipboard"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71704c03f739f7745053bde45fa203a46c58d25bc5c4efba1d9a60e9dba81226"
-dependencies = [
- "libc",
- "smithay-client-toolkit 0.20.0",
- "wayland-backend",
-]
-
-[[package]]
-name = "smol_str"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd538fb6910ac1099850255cf94a94df6551fbdd602454387d0adb2d1ca6dead"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "soup3"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "471f924a40f31251afc77450e781cb26d55c0b650842efafc9c6cbd2f7cc4f9f"
-dependencies = [
- "futures-channel",
- "gio",
- "glib",
- "libc",
- "soup3-sys",
-]
-
-[[package]]
-name = "soup3-sys"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ebe8950a680a12f24f15ebe1bf70db7af98ad242d9db43596ad3108aab86c27"
-dependencies = [
- "gio-sys",
- "glib-sys",
- "gobject-sys",
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "spirv"
-version = "0.4.0+sdk-1.4.341.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9571ea910ebd84c86af4b3ed27f9dbdc6ad06f17c5f96146b2b671e2976744f"
-dependencies = [
- "bitflags 2.13.2",
-]
-
-[[package]]
-name = "stable_deref_trait"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
-
-[[package]]
-name = "static_assertions"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
-
-[[package]]
-name = "string_cache"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901"
-dependencies = [
- "new_debug_unreachable",
- "parking_lot",
- "phf_shared",
- "precomputed-hash",
-]
-
-[[package]]
-name = "string_cache_codegen"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "585635e46db231059f76c5849798146164652513eb9e8ab2685939dd90f29b69"
-dependencies = [
- "phf_generator",
- "phf_shared",
- "proc-macro2",
- "quote",
-]
-
-[[package]]
-name = "syn"
-version = "1.0.109"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.119"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "3.0.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "synstructure"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.9",
-]
-
-[[package]]
-name = "system-deps"
-version = "6.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3e535eb8dded36d55ec13eddacd30dec501792ff23a0b1682c38601b8cf2349"
-dependencies = [
- "cfg-expr",
- "heck 0.5.0",
- "pkg-config",
- "toml",
- "version-compare",
-]
-
-[[package]]
-name = "tao-macros"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f7eeb6d99155545da6150a1795945f16ac9c178deb2a5f2e74d776107bd5849"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "target-lexicon"
-version = "0.12.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
-
-[[package]]
-name = "tempfile"
-version = "3.27.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
-dependencies = [
- "fastrand",
- "getrandom 0.4.3",
- "once_cell",
- "rustix 1.1.4",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "tendril"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fed54709c5b3a53d09bb1c113ea4f5ceafd1e772ddcb0030a82e1d56c087b08"
-dependencies = [
- "new_debug_unreachable",
-]
-
-[[package]]
-name = "termcolor"
-version = "1.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "thiserror"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
-dependencies = [
- "thiserror-impl 1.0.69",
-]
-
-[[package]]
-name = "thiserror"
-version = "2.0.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
-dependencies = [
- "thiserror-impl 2.0.21",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "2.0.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.9",
-]
-
-[[package]]
-name = "tiff"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b63feaf3343d35b6ca4d50483f94843803b0f51634937cc2ec519fc32232bc52"
-dependencies = [
- "fax",
- "flate2",
- "half",
- "quick-error",
- "weezl",
- "zune-jpeg",
-]
-
-[[package]]
-name = "time"
-version = "0.3.55"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
-dependencies = [
- "deranged",
- "num-conv",
- "powerfmt",
- "serde_core",
- "time-core",
- "time-macros",
-]
-
-[[package]]
-name = "time-core"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
-
-[[package]]
-name = "time-macros"
-version = "0.2.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
-dependencies = [
- "num-conv",
- "time-core",
-]
-
-[[package]]
-name = "tinystr"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
-dependencies = [
- "displaydoc",
- "zerovec",
-]
-
-[[package]]
-name = "toml"
-version = "0.8.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
-dependencies = [
- "serde",
- "serde_spanned",
- "toml_datetime 0.6.11",
- "toml_edit 0.22.27",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "0.6.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "1.1.2+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
-dependencies = [
- "serde_core",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.19.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
-dependencies = [
- "indexmap",
- "toml_datetime 0.6.11",
- "winnow 0.5.40",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.20.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70f427fce4d84c72b5b732388bf4a9f4531b53f74e2887e3ecb2481f68f66d81"
-dependencies = [
- "indexmap",
- "toml_datetime 0.6.11",
- "winnow 0.5.40",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.22.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
-dependencies = [
- "indexmap",
- "serde",
- "serde_spanned",
- "toml_datetime 0.6.11",
- "winnow 0.7.15",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.25.13+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6975367e4d2ef766d86af01ffad14b622fecc8d4357a998fbc4deb6e9bacaf9b"
-dependencies = [
- "indexmap",
- "toml_datetime 1.1.2+spec-1.1.0",
- "toml_parser",
- "winnow 1.0.4",
-]
-
-[[package]]
-name = "toml_parser"
-version = "1.1.5+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
-dependencies = [
- "winnow 1.0.4",
-]
-
-[[package]]
-name = "tracing"
-version = "0.1.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
-dependencies = [
- "log",
- "pin-project-lite",
- "tracing-attributes",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-attributes"
-version = "0.1.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "tracing-core"
-version = "0.1.36"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
-dependencies = [
- "once_cell",
-]
-
-[[package]]
-name = "type-map"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb30dbbd9036155e74adad6812e9898d03ec374946234fbcebd5dfc7b9187b90"
-dependencies = [
- "rustc-hash 2.1.3",
-]
-
-[[package]]
-name = "typenum"
-version = "1.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
-
-[[package]]
-name = "uds_windows"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
-dependencies = [
- "memoffset",
- "tempfile",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "unicode-general-category"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"
-
-[[package]]
-name = "unicode-segmentation"
-version = "1.13.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
-
-[[package]]
-name = "unicode-width"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
-
-[[package]]
-name = "url"
-version = "2.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
-dependencies = [
- "form_urlencoded",
- "idna",
- "percent-encoding",
- "serde",
-]
-
-[[package]]
-name = "utf8_iter"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
-
-[[package]]
-name = "uuid"
-version = "1.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cc1186384beb7dd8eedea376413fd654937285ea6c9cfbb928dc3043ea4b606"
-dependencies = [
- "js-sys",
- "serde_core",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "vello_common"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2e9aed918117e8152c9eddfd8362d73c465c23f26c44786aa331707b8a64fa2"
-dependencies = [
- "bytemuck",
- "fearless_simd",
- "guillotiere",
- "log",
- "peniko",
- "smallvec",
- "thiserror 2.0.21",
-]
-
-[[package]]
-name = "vello_cpu"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac7349e1f55f6b801c7c277958df4ea53e7f20f21e8014910ad888b2ecda93ea"
-dependencies = [
- "bytemuck",
- "glifo",
- "hashbrown 0.17.1",
- "vello_common",
-]
-
-[[package]]
-name = "version-compare"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03c2856837ef78f57382f06b2b8563a2f512f7185d732608fd9176cb3b8edf0e"
-
-[[package]]
-name = "version_check"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
-
-[[package]]
-name = "vn-shell"
-version = "0.1.0"
-dependencies = [
- "eframe",
- "url",
- "vn-shell-core",
- "vn-shell-egui",
- "vn-shell-paths",
- "vn-shell-runtime",
-]
-
-[[package]]
-name = "vn-shell-core"
-version = "0.1.0"
-dependencies = [
- "flate2",
- "serde_json",
- "url",
-]
-
-[[package]]
-name = "vn-shell-egui"
-version = "0.1.0"
-dependencies = [
- "eframe",
- "egui",
- "vn-shell-core",
- "vn-shell-pane",
- "vn-shell-paths",
- "vn-shell-runtime",
-]
-
-[[package]]
-name = "vn-shell-pane"
-version = "0.1.0"
-dependencies = [
- "egui",
- "vn-shell-core",
- "wry",
-]
-
-[[package]]
-name = "vn-shell-paths"
-version = "0.1.0"
-dependencies = [
- "vn-shell-core",
-]
-
-[[package]]
-name = "vn-shell-runtime"
-version = "0.1.0"
-dependencies = [
- "libc",
- "serde_json",
- "url",
- "vn-shell-core",
- "vn-shell-paths",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "walkdir"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
-dependencies = [
- "same-file",
- "winapi-util",
-]
-
-[[package]]
-name = "wasi"
-version = "0.11.1+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
-
-[[package]]
-name = "wasip2"
-version = "1.0.4+wasi-0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
-dependencies = [
- "wit-bindgen",
-]
-
-[[package]]
-name = "wasm-bindgen"
-version = "0.2.127"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70"
-dependencies = [
- "cfg-if",
- "once_cell",
- "rustversion",
- "wasm-bindgen-macro",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-futures"
-version = "0.4.77"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b7777d5cc23d0e91404e53ce2d5e8ec7acae3026b16233dba62cd3246457950"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "wasm-bindgen-macro"
-version = "0.2.127"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1"
-dependencies = [
- "quote",
- "wasm-bindgen-macro-support",
-]
-
-[[package]]
-name = "wasm-bindgen-macro-support"
-version = "0.2.127"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284"
-dependencies = [
- "bumpalo",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-shared"
-version = "0.2.127"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "wayland-backend"
-version = "0.3.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38a91b4eaddff87b1cd1074985e3713da4af2c49742d1b356b2c01670a67a078"
-dependencies = [
- "cc",
- "downcast-rs",
- "rustix 1.1.4",
- "scoped-tls",
- "smallvec",
- "wayland-sys",
-]
-
-[[package]]
-name = "wayland-client"
-version = "0.31.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3c36a0f861ad76d0901f2800b46321410d9f73f2ea88aac0650d86c32688073"
-dependencies = [
- "bitflags 2.13.2",
- "rustix 1.1.4",
- "wayland-backend",
- "wayland-scanner",
-]
-
-[[package]]
-name = "wayland-csd-frame"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "625c5029dbd43d25e6aa9615e88b829a5cad13b2819c4ae129fdbb7c31ab4c7e"
-dependencies = [
- "bitflags 2.13.2",
- "cursor-icon",
- "wayland-backend",
-]
-
-[[package]]
-name = "wayland-cursor"
-version = "0.31.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a52d18780be9b1314328a3de5f930b73d2200112e3849ca6cb11822793fb34d"
-dependencies = [
- "rustix 1.1.4",
- "wayland-client",
- "xcursor",
-]
-
-[[package]]
-name = "wayland-protocols"
-version = "0.32.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23d0c813de3daa2ed6520af85a3bd49b0e722a3078506899aa9686fea58dc4b6"
-dependencies = [
- "bitflags 2.13.2",
- "wayland-backend",
- "wayland-client",
- "wayland-scanner",
-]
-
-[[package]]
-name = "wayland-protocols-experimental"
-version = "20250721.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40a1f863128dcaaec790d7b4b396cc9b9a7a079e878e18c47e6c2d2c5a8dcbb1"
-dependencies = [
- "bitflags 2.13.2",
- "wayland-backend",
- "wayland-client",
- "wayland-protocols",
- "wayland-scanner",
-]
-
-[[package]]
-name = "wayland-protocols-misc"
-version = "0.3.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e9567599ef23e09b8dad6e429e5738d4509dfc46b3b21f32841a304d16b29c8"
-dependencies = [
- "bitflags 2.13.2",
- "wayland-backend",
- "wayland-client",
- "wayland-protocols",
- "wayland-scanner",
-]
-
-[[package]]
-name = "wayland-protocols-plasma"
-version = "0.3.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b6d8cf1eb2c1c31ed1f5643c88a6e53538129d4af80030c8cabd1f9fa884d91"
-dependencies = [
- "bitflags 2.13.2",
- "wayland-backend",
- "wayland-client",
- "wayland-protocols",
- "wayland-scanner",
-]
-
-[[package]]
-name = "wayland-protocols-wlr"
-version = "0.3.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb04e52f7836d7c7976c78ca0250d61e33873c34156a2a1fc9474828ec268234"
-dependencies = [
- "bitflags 2.13.2",
- "wayland-backend",
- "wayland-client",
- "wayland-protocols",
- "wayland-scanner",
-]
-
-[[package]]
-name = "wayland-scanner"
-version = "0.31.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0"
-dependencies = [
- "proc-macro2",
- "quick-xml",
- "quote",
-]
-
-[[package]]
-name = "wayland-sys"
-version = "0.31.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8eab23fefc9e41f8e841df4a9c707e8a8c4ed26e944ef69297184de2785e3be"
-dependencies = [
- "dlib",
- "log",
- "once_cell",
- "pkg-config",
-]
-
-[[package]]
-name = "web-sys"
-version = "0.3.104"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c435338968042f4f59a557f690a253676d47ce13ceb55d70100e7facf6620a30"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "web-time"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "web_atoms"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba8b815c1b593dc0baf78dd0f4fc8fdb2de53198fb1163738093e9a311c33fb3"
-dependencies = [
- "phf",
- "phf_codegen",
- "string_cache",
- "string_cache_codegen",
-]
-
-[[package]]
-name = "webkit2gtk"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1027150013530fb2eaf806408df88461ae4815a45c541c8975e61d6f2fc4793"
-dependencies = [
- "bitflags 1.3.2",
- "cairo-rs",
- "gdk",
- "gdk-sys",
- "gio",
- "gio-sys",
- "glib",
- "glib-sys",
- "gobject-sys",
- "gtk",
- "gtk-sys",
- "javascriptcore-rs",
- "libc",
- "once_cell",
- "soup3",
- "webkit2gtk-sys",
-]
-
-[[package]]
-name = "webkit2gtk-sys"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "916a5f65c2ef0dfe12fff695960a2ec3d4565359fdbb2e9943c974e06c734ea5"
-dependencies = [
- "bitflags 1.3.2",
- "cairo-sys-rs",
- "gdk-sys",
- "gio-sys",
- "glib-sys",
- "gobject-sys",
- "gtk-sys",
- "javascriptcore-rs-sys",
- "libc",
- "pkg-config",
- "soup3-sys",
- "system-deps",
-]
-
-[[package]]
-name = "webview2-com"
-version = "0.39.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f89fca7a704cee10dcb3654c1dbb8941d1783132f1917358af75bec37a7d7e6"
-dependencies = [
- "webview2-com-macros",
- "webview2-com-sys",
- "windows",
- "windows-core",
-]
-
-[[package]]
-name = "webview2-com-macros"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67a921c1b6914c367b2b823cd4cde6f96beec77d30a939c8199bb377cf9b9b54"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "webview2-com-sys"
-version = "0.39.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3a07132775117d6065853d9d1178157b8c90e228de47129d6bce2c7edebedfb"
-dependencies = [
- "thiserror 2.0.21",
- "windows",
- "windows-core",
-]
-
-[[package]]
-name = "weezl"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a28ac98ddc8b9274cb41bb4d9d4d5c425b6020c50c46f25559911905610b4a88"
-
-[[package]]
-name = "wgpu"
-version = "30.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "527ccdf43dd5b2e8676eed9984ce00e2bbb0a1b85b70c1969dcb6cd2eb55ab9e"
-dependencies = [
- "arrayvec",
- "bitflags 2.13.2",
- "bytemuck",
- "cfg-if",
- "cfg_aliases",
- "document-features",
- "hashbrown 0.17.1",
- "js-sys",
- "log",
- "naga",
- "parking_lot",
- "portable-atomic",
- "profiling",
- "raw-window-handle",
- "smallvec",
- "static_assertions",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
- "wgpu-core",
- "wgpu-hal",
- "wgpu-types",
-]
-
-[[package]]
-name = "wgpu-core"
-version = "30.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c018fce9b6270aa203c2fdd56f3cce996713534bd757e4ea58c8560b121f14"
-dependencies = [
- "arrayvec",
- "bit-set 0.10.0",
- "bit-vec 0.9.1",
- "bitflags 2.13.2",
- "bytemuck",
- "cfg_aliases",
- "document-features",
- "hashbrown 0.17.1",
- "indexmap",
- "log",
- "naga",
- "naga-types",
- "once_cell",
- "parking_lot",
- "portable-atomic",
- "profiling",
- "raw-window-handle",
- "rustc-hash 1.1.0",
- "smallvec",
- "thiserror 2.0.21",
- "wgpu-core-deps-apple",
- "wgpu-core-deps-emscripten",
- "wgpu-core-deps-wasm",
- "wgpu-core-deps-windows-linux-android",
- "wgpu-hal",
- "wgpu-naga-bridge",
- "wgpu-types",
-]
-
-[[package]]
-name = "wgpu-core-deps-apple"
-version = "30.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "061f3d319a40d39d00b1ecc2c33b89fe21d4e6fe01859df3500a3a8ecccd6b68"
-dependencies = [
- "wgpu-hal",
-]
-
-[[package]]
-name = "wgpu-core-deps-emscripten"
-version = "30.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98b86cf4abf524a902dd35f18ca6a3f08fc2ae9847c8f10b48e30491b1f0b86"
-dependencies = [
- "wgpu-hal",
-]
-
-[[package]]
-name = "wgpu-core-deps-wasm"
-version = "30.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d260ca2ca8adc654f513a869bf3cac0b47f5b8d3f87803d6942015f8de597aae"
-dependencies = [
- "wgpu-hal",
-]
-
-[[package]]
-name = "wgpu-core-deps-windows-linux-android"
-version = "30.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7586165fd5f6d881cb9ce4bb71f40d6caab2c0f1837e3fc1d9788a197fb6004f"
-dependencies = [
- "wgpu-hal",
-]
-
-[[package]]
-name = "wgpu-hal"
-version = "30.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6b7fb58561a792bc237628ba0792e332de418fefe145f13b5ed8201e6d52f58"
-dependencies = [
- "android_system_properties",
- "arrayvec",
- "ash",
- "bit-set 0.10.0",
- "bitflags 2.13.2",
- "block2 0.6.2",
- "bytemuck",
- "cfg-if",
- "cfg_aliases",
- "glow",
- "glutin_wgl_sys",
- "gpu-allocator",
- "hashbrown 0.17.1",
- "js-sys",
- "khronos-egl",
- "libc",
- "libloading",
- "log",
- "naga",
- "naga-types",
- "ndk-sys",
- "objc2 0.6.4",
- "objc2-core-foundation",
- "objc2-core-graphics",
- "objc2-foundation 0.3.2",
- "objc2-metal 0.3.2",
- "objc2-quartz-core 0.3.2",
- "once_cell",
- "ordered-float",
- "parking_lot",
- "portable-atomic",
- "portable-atomic-util",
- "profiling",
- "range-alloc",
- "raw-window-handle",
- "raw-window-metal",
- "renderdoc-sys",
- "smallvec",
- "static_assertions",
- "thiserror 2.0.21",
- "wasm-bindgen",
- "wayland-sys",
- "web-sys",
- "wgpu-naga-bridge",
- "wgpu-types",
- "windows",
- "windows-core",
- "windows-result",
-]
-
-[[package]]
-name = "wgpu-naga-bridge"
-version = "30.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2f62e73117bb7a62bfd9c5a5841438a823f6566c6442a808ee269d2d055c081"
-dependencies = [
- "naga",
- "wgpu-types",
-]
-
-[[package]]
-name = "wgpu-types"
-version = "30.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99dad6f1fbdbbdb4c278a6508b059d44688f5cebddf78d005a46a31340269286"
-dependencies = [
- "bitflags 2.13.2",
- "bytemuck",
- "js-sys",
- "log",
- "naga-types",
- "raw-window-handle",
- "static_assertions",
- "web-sys",
-]
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
-dependencies = [
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
-[[package]]
-name = "windows"
-version = "0.62.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580"
-dependencies = [
- "windows-collections",
- "windows-core",
- "windows-future",
- "windows-numerics",
-]
-
-[[package]]
-name = "windows-collections"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610"
-dependencies = [
- "windows-core",
-]
-
-[[package]]
-name = "windows-core"
-version = "0.62.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
-dependencies = [
- "windows-implement",
- "windows-interface",
- "windows-link",
- "windows-result",
- "windows-strings",
-]
-
-[[package]]
-name = "windows-future"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb"
-dependencies = [
- "windows-core",
- "windows-link",
- "windows-threading",
-]
-
-[[package]]
-name = "windows-implement"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "windows-interface"
-version = "0.59.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "windows-link"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
-
-[[package]]
-name = "windows-numerics"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26"
-dependencies = [
- "windows-core",
- "windows-link",
-]
-
-[[package]]
-name = "windows-result"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-strings"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets 0.42.2",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.61.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
-dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
-dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
-]
-
-[[package]]
-name = "windows-threading"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-version"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4060a1da109b9d0326b7262c8e12c84df67cc0dbc9e33cf49e01ccc2eb63631"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
-[[package]]
-name = "winit"
-version = "0.30.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6755fa58a9f8350bd1e472d4c3fcc25f824ec358933bba33306d0b63df5978d"
-dependencies = [
- "ahash",
- "android-activity",
- "atomic-waker",
- "bitflags 2.13.2",
- "block2 0.5.1",
- "bytemuck",
- "calloop 0.13.0",
- "cfg_aliases",
- "concurrent-queue",
- "core-foundation",
- "core-graphics",
- "cursor-icon",
- "dpi",
- "js-sys",
- "libc",
- "memmap2",
- "ndk",
- "objc2 0.5.2",
- "objc2-app-kit 0.2.2",
- "objc2-foundation 0.2.2",
- "objc2-ui-kit 0.2.2",
- "orbclient",
- "percent-encoding",
- "pin-project",
- "raw-window-handle",
- "redox_syscall 0.4.1",
- "rustix 0.38.44",
- "smithay-client-toolkit 0.19.2",
- "smol_str",
- "tracing",
- "unicode-segmentation",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "wayland-backend",
- "wayland-client",
- "wayland-protocols",
- "wayland-protocols-plasma",
- "web-sys",
- "web-time",
- "windows-sys 0.52.0",
- "x11-dl",
- "x11rb",
- "xkbcommon-dl",
-]
-
-[[package]]
-name = "winnow"
-version = "0.5.40"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "winnow"
-version = "0.7.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "winnow"
-version = "1.0.4"
+name = "itoa"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
-dependencies = [
- "memchr",
-]
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
-name = "wit-bindgen"
-version = "0.57.1"
+name = "libc"
+version = "0.2.190"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
 
 [[package]]
-name = "writeable"
-version = "0.6.4"
+name = "memchr"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
-name = "wry"
-version = "0.57.0"
+name = "proc-macro2"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a819957a01b3119af85e638a38d242af76dbc87d130dca67bfd0441072e21ff0"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
- "base64",
- "block2 0.6.2",
- "cookie",
- "crossbeam-channel",
- "dirs",
- "dom_query",
- "dpi",
- "dunce",
- "gdkx11",
- "gtk",
- "http",
- "javascriptcore-rs",
- "jni 0.21.1",
- "libc",
- "ndk",
- "objc2 0.6.4",
- "objc2-app-kit 0.3.2",
- "objc2-core-foundation",
- "objc2-foundation 0.3.2",
- "objc2-ui-kit 0.3.2",
- "objc2-web-kit",
- "once_cell",
- "percent-encoding",
- "raw-window-handle",
- "sha2",
- "soup3",
- "tao-macros",
- "thiserror 2.0.21",
- "url",
- "webkit2gtk",
- "webkit2gtk-sys",
- "webview2-com",
- "windows",
- "windows-core",
- "windows-version",
- "x11-dl",
+ "unicode-ident",
 ]
 
 [[package]]
-name = "x11"
-version = "2.21.0"
+name = "quote"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "502da5464ccd04011667b11c435cb992822c2c0dbde1770c988480d312a0db2e"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
- "libc",
- "pkg-config",
+ "proc-macro2",
 ]
 
 [[package]]
-name = "x11-dl"
-version = "2.21.0"
+name = "rpassword"
+version = "7.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38735924fedd5314a6e548792904ed8c6de6636285cb9fec04d5b1db85c1516f"
+checksum = "2da316a15f47e3d053de9cb2c439650bd8fa4aaeb9365f2e5f27f492ff73c196"
 dependencies = [
  "libc",
- "once_cell",
- "pkg-config",
+ "rtoolbox",
+ "windows-sys",
 ]
 
 [[package]]
-name = "x11rb"
-version = "0.13.2"
+name = "rtoolbox"
+version = "0.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9993aa5be5a26815fe2c3eacfc1fde061fc1a1f094bf1ad2a18bf9c495dd7414"
+checksum = "9a1efe12a1469752d0e6ff5ebec0b6ef4924cc5c4c71046b0ec730040535819d"
 dependencies = [
- "as-raw-xcb-connection",
- "gethostname",
  "libc",
- "libloading",
- "once_cell",
- "rustix 1.1.4",
- "x11rb-protocol",
+ "windows-sys",
 ]
 
 [[package]]
-name = "x11rb-protocol"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea6fc2961e4ef194dcbfe56bb845534d0dc8098940c7e5c012a258bfec6701bd"
-
-[[package]]
-name = "xcursor"
-version = "0.3.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "163b33ed8786455e2fa5d72f554057ce3f3182425434f756cd39c99839d88e23"
-
-[[package]]
-name = "xkbcommon-dl"
-version = "0.4.2"
+name = "serde"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d039de8032a9a8856a6be89cea3e5d12fdd82306ab7c94d74e6deab2460651c5"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
- "bitflags 2.13.2",
- "dlib",
- "log",
- "once_cell",
- "xkeysym",
+ "serde_core",
 ]
 
 [[package]]
-name = "xkeysym"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9cc00251562a284751c9973bace760d86c0276c471b4be569fe6b068ee97a56"
-
-[[package]]
-name = "xml-rs"
-version = "0.8.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
-
-[[package]]
-name = "yoke"
-version = "0.8.3"
+name = "serde_core"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
- "stable_deref_trait",
- "yoke-derive",
- "zerofrom",
+ "serde_derive",
 ]
 
 [[package]]
-name = "yoke-derive"
-version = "0.8.4"
+name = "serde_derive"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.9",
- "synstructure",
+ "syn",
 ]
 
 [[package]]
-name = "zbus"
-version = "5.19.0"
+name = "serde_json"
+version = "1.0.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5db4be7c075cb421e4b7ee645541604239bd243ba7c357511f4ff3a74b555907"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
 dependencies = [
- "async-broadcast",
- "async-executor",
- "async-io",
- "async-lock",
- "async-process",
- "async-recursion",
- "async-task",
- "async-trait",
- "blocking",
- "enumflags2",
- "event-listener",
- "futures-core",
- "futures-lite",
- "hex",
- "libc",
- "ordered-stream",
- "rustix 1.1.4",
+ "itoa",
+ "memchr",
  "serde",
- "serde_repr",
- "tracing",
- "uds_windows",
- "uuid",
- "windows-sys 0.61.2",
- "winnow 1.0.4",
- "zbus_macros",
- "zbus_names",
- "zvariant",
-]
-
-[[package]]
-name = "zbus-lockstep"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6998de05217a084b7578728a9443d04ea4cd80f2a0839b8d78770b76ccd45863"
-dependencies = [
- "zbus_xml",
- "zvariant",
-]
-
-[[package]]
-name = "zbus-lockstep-macros"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10da05367f3a7b7553c8cdf8fa91aee6b64afebe32b51c95177957efc47ca3a0"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
- "zbus-lockstep",
- "zbus_xml",
- "zvariant",
+ "serde_core",
+ "zmij",
 ]
 
 [[package]]
-name = "zbus_macros"
-version = "5.19.0"
+name = "syn"
+version = "3.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2990635d09ade6df1868f72f8cac69a876a90981e8bd3c40b1be413f8dc88f40"
+checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
 dependencies = [
- "proc-macro-crate 3.5.0",
  "proc-macro2",
  "quote",
- "syn 3.0.9",
- "zbus_names",
- "zvariant",
- "zvariant_utils",
-]
-
-[[package]]
-name = "zbus_names"
-version = "4.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8bf88b4a3ff53e883001e0e0115b297a9d53c31b9c1edd2bfdd853e3428624e"
-dependencies = [
- "serde",
- "winnow 1.0.4",
- "zvariant",
-]
-
-[[package]]
-name = "zbus_xml"
-version = "5.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1586c021a01ca0a9216dcd874e546382e156a5cbab5fab6cb5f10087e22682a"
-dependencies = [
- "serde",
- "winnow 1.0.4",
- "zbus_names",
- "zvariant",
-]
-
-[[package]]
-name = "zcheapstr"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1afec51604565183aeb5c54c20aeab286120d4e4460f7f76e3e8bb8c0d99473"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "zerocopy"
-version = "0.8.62"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86502bf56ac7c77571a32e2647bb2a15894565e981fb2a48d7bde2d91c965a9d"
-dependencies = [
- "zerocopy-derive",
+ "unicode-ident",
 ]
 
 [[package]]
-name = "zerocopy-derive"
-version = "0.8.62"
+name = "unicode-ident"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5457206954b06561e2608c7e19cf58b1926586d999c246eebe4502f7e2039d1a"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
+checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"
 
 [[package]]
-name = "zerofrom"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+name = "vn-shell"
+version = "0.1.1"
 dependencies = [
- "zerofrom-derive",
+ "rpassword",
+ "vn-shell-core",
+ "vn-shell-runtime",
 ]
 
 [[package]]
-name = "zerofrom-derive"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
+name = "vn-shell-core"
+version = "0.1.1"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.9",
- "synstructure",
+ "serde_json",
 ]
 
 [[package]]
-name = "zerotrie"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+name = "vn-shell-runtime"
+version = "0.1.1"
 dependencies = [
- "displaydoc",
- "yoke",
- "zerofrom",
+ "serde_json",
+ "vn-shell-core",
 ]
 
 [[package]]
-name = "zerovec"
-version = "0.11.8"
+name = "windows-link"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
-dependencies = [
- "yoke",
- "zerofrom",
- "zerovec-derive",
-]
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
 [[package]]
-name = "zerovec-derive"
-version = "0.11.6"
+name = "windows-sys"
+version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.9",
+ "windows-link",
 ]
 
-[[package]]
-name = "zlib-rs"
-version = "0.6.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112"
-
 [[package]]
 name = "zmij"
 version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
-
-[[package]]
-name = "zune-core"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d56377fd46368984a170bc5aac5567e52ca5da874caa60bea39fcbca78fb658b"
-
-[[package]]
-name = "zune-jpeg"
-version = "0.5.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27bc9d5b815bc103f142aa054f561d9187d191692ec7c2d1e2b4737f8dbd7296"
-dependencies = [
- "zune-core",
-]
-
-[[package]]
-name = "zvariant"
-version = "5.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1d34c27cc6cdd1f458427519dd6b8612f7b7e3f7b9a0b2355d041dda9869147"
-dependencies = [
- "endi",
- "enumflags2",
- "serde",
- "winnow 1.0.4",
- "zcheapstr",
- "zvariant_derive",
- "zvariant_utils",
-]
-
-[[package]]
-name = "zvariant_derive"
-version = "5.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "864155e69b4352db0c7f374917bf45d1e0c8d17659c8b3dbf9795f3673f8c497"
-dependencies = [
- "proc-macro-crate 3.5.0",
- "proc-macro2",
- "quote",
- "syn 3.0.9",
- "zvariant_utils",
-]
-
-[[package]]
-name = "zvariant_utils"
-version = "4.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bad0294361a320b694a328460dc73add56c306150f5cb6bfafc44446120008a3"
-dependencies = [
- "proc-macro2",
- "quote",
- "serde",
- "syn 3.0.9",
- "winnow 1.0.4",
-]
diff --git a/app/Cargo.toml b/app/Cargo.toml
index ddbd393..85cca16 100644
--- a/app/Cargo.toml
+++ b/app/Cargo.toml
@@ -3,17 +3,14 @@ resolver = "2"
 members = [
     "crates/vn-shell-core",
     "crates/vn-shell-runtime",
-    "crates/vn-shell-paths",
-    "crates/vn-shell-egui",
-    "crates/vn-shell-pane",
     "crates/vn-shell",
 ]
 
 # One pin per dependency, so the shell cannot end up with two of anything. The
-# binary is `vncode.exe` because that is the name the distribution ships, the
-# launcher looks for and the built shell is named: the distribution is this app.
+# binary is `vncode` because that is the name the distribution ships and the
+# launcher looks for.
 [workspace.package]
-version = "0.1.0"
+version = "0.1.1"
 edition = "2021"
 license = "MIT"
 publish = false
@@ -22,45 +19,26 @@ rust-version = "1.95"
 [workspace.dependencies]
 vn-shell-core = { path = "crates/vn-shell-core" }
 vn-shell-runtime = { path = "crates/vn-shell-runtime" }
-vn-shell-paths = { path = "crates/vn-shell-paths" }
-vn-shell-egui = { path = "crates/vn-shell-egui" }
-vn-shell-pane = { path = "crates/vn-shell-pane" }
 
 serde_json = "1"
-flate2 = "1"
-url = "2"
 
-# The ONE web engine in this workspace, and it is optional: only `vn-shell-pane`'s `pane`
-# feature turns it on, and the default build compiles none of it. Nothing is vendored -
-# `wry` drives the engine the OS already has (WebView2 / WKWebView / WebKitGTK), and it
-# takes any `HasWindowHandle`, so the window stays eframe's: `tao` is a dev-dependency of
-# wry's own examples, not a requirement.
-#
-# 0.57 rather than 0.55, and the reason is a SECURITY SEAM rather than a feature: the
-# permission handler exists only from 0.57. In the 0.55.1 source the string "permission"
-# appears twice - once in the Windows backend, where it ALLOWS clipboard reads and lets
-# every other kind fall through to the engine's own default, and once in the macOS
-# delegate, where it GRANTS media capture outright. A pane whose rule is "deny everything
-# the harness does not need" cannot be built on a version a page can ask for a camera
-# through.
-wry = "0.57"
+# The ONE dependency this app has that is not `std` plus JSON, and it is about a secret:
+# the DeepSeek key is typed at a terminal, so the terminal must not echo it. ~10 KB, three
+# platforms, no transitive tree.
+rpassword = "7"
 
-# The window and the panel. `0.36` is the line this shell is pinned to: Rust 1.95,
-# edition 2024, wgpu as the DEFAULT renderer (through 0.33 it was glow) and
-# accesskit as a default feature, so the panel is exposed to a screen reader on
-# all three platforms.
-eframe = { version = "0.36", default-features = false, features = [
-    "accesskit",
-    "default_fonts",
-    "wgpu",
-    "wayland",
-    "x11",
-] }
-egui = "0.36"
+# THERE IS NO WEB ENGINE IN THIS WORKSPACE, and no GUI toolkit either - as a rule rather
+# than a default. `wry` (WebView2 / WKWebView / WebKitGTK), `egui`, `eframe` and `wgpu`
+# left with the window they drew: they were 13 of this binary's 15 MB. The page is the
+# harness's, it is served on loopback, and the browser that shows it is started by
+# `scripts/run-web.*`.
 
 [profile.release]
-# What the shipped binary is built with. Symbols off and one codegen unit is the
-# ordinary release shape; `lto = "thin"` is the one that pays for itself in a
-# binary that links a GPU stack.
+# What the shipped binary is built with - and the settings are a size decision, measured.
+# `strip` removes what nothing reads; `lto = "thin"` pays for itself by removing duplicate
+# generic instantiations across crates; `panic = "abort"` drops the unwinding tables a
+# console app never uses. `codegen-units = 1` is what makes LTO able to see everything.
 lto = "thin"
 strip = "symbols"
+panic = "abort"
+codegen-units = 1
diff --git a/app/README.md b/app/README.md
index 14075f4..3beff09 100644
--- a/app/README.md
+++ b/app/README.md
@@ -1,573 +1,97 @@
-# `app/` - the vncode shell
+# `app/` - the vncode front door
 
-A small native application that owns the instance: it opens on a **control panel**,
-decides where the harness home is and creates it, installs this pack with one button,
-starts the pinned `dsh web` harness when you press **Start**, shows it in the browser it
-found on your machine, and ends the whole instance again on **Stop**. It draws the shipped
-interface only when it is built to: the default build compiles no engine and shows the harness
-in a browser it found, and `cargo build --release -p vn-shell --features pane` shows it inside
-this window instead - one optional dependency on `wry`, nothing vendored. Either way the panel's
-job is to say which surface is in use, and to make changing your mind one click.
+One small console program (~0.5 MB) with no window and no web view. It decides four things
+- the root, the harness home, the key and the pack - and then it runs the script a person
+would run: `scripts/run-web.bat` on Windows, `scripts/run-web.sh` everywhere else, in the
+foreground, with a composed environment and `-DshHome` so both halves agree about which
+home is in use.
 
-It is a **launcher, not a desktop edition**: it starts the same pinned harness on a
-free loopback port that `scripts\run-web.bat` / `./scripts/run-web.sh` start, and the
-one thing it installs is this pack, into the `web` profile, through this pack's own
-installer. `Start` is that same command; the app adds a window, a status line, a
-location map, the buttons - and the root the harness home lives in.
-
-**And it starts the SAME home `run-web` now starts.** A folder that is a **portable
-installation** - it carries `.vncode/PORTABLE`, or `.vncode/home` already exists - keeps
-the pack, the sessions, the key, the preferences, the npm cache and the window record
-inside itself, and both launchers resolve `<tree>/.vncode/home` as `DSH_HOME`: the panel
-through its root ladder, `run-web` through the same rule implemented in its worker (the
-portable rung sits below an explicit `-DshHome` and an inherited `DSH_HOME`, and above
-`~/.dsh`). Before this, the panel and `run-web` pointed at different homes, which was
-measured on a real machine as the panel reporting 24 installed bundles while `run-web`
-started a home that had none. Nothing in the user's profile is needed, which is what makes
-a checkout - or a copy of one - portable across machines. The core harness is untouched:
-`DSH_HOME` is still set explicitly for the child, and `~/.dsh` remains the harness's own
-default for any folder that is not portable.
+It is **not** a desktop edition and not a second harness: `scripts/run-web.*` needs none of
+this and works on its own. What the app adds is one command from nothing to a served page.
 
 ```sh
-cargo build --release          # in this folder; the binary is target/release/vncode
-./target/release/vncode        # the control panel
-./target/release/vncode -Help  # the flags, without starting anything
+cargo build --release --locked   # in this folder; the binary is target/release/vncode
+./target/release/vncode status   # the facts, and nothing started
+./target/release/vncode          # install if needed, key if needed, then run-web
+./target/release/vncode -Help    # the verbs and flags
 ```
 
-`scripts\run-desktop.bat` / `./scripts/run-desktop.sh` build and run it. A source
-checkout needs the **Rust toolchain** ([rustup.rs](https://rustup.rs)) and Node.js
-22+, which the npx fallback needs; a folder that carries a vendored `runtime/<rid>/`
-needs neither.
+`scripts\run-desktop.bat` / `./scripts/run-desktop.sh` build it when it is missing and then
+run it. A build needs the **Rust toolchain** ([rustup.rs](https://rustup.rs)) and nothing
+else: there is no system library to install, which is what the size cut bought.
 
-## The lifetime it implements
+## What it does
 
-| | what happens |
+| verb | what happens |
 |---|---|
-| **open** | One native window. **No child process, no port bound, no web view.** Nothing is decided before the first screen: if nobody has named a home (`-DshHome`, an inherited `DSH_HOME`, or a choice remembered from last time), the window **is** the home question - see below. After that, the panel resolves the app root and the home (by writing, not by assuming), reads the pin, the key layers, the location map and whether the pack is installed - all of them files on disk - and detects the browsers on this machine |
-| **Install pack** | Runs `scripts/setup/install.bat` (Windows) or `scripts/setup/install.sh`, the same entry point a person clicks, with its output streaming into the panel's log. It is given `-DshHome <the chosen home>`, the same composed environment as the harness (see below), and **`-Resume`** - which undoes the `-Force` a double-click implies, so a second press adds only what the profile is missing instead of re-adding all 24 bundles |
-| **Uninstall pack** | The matching pair, `scripts/setup/uninstall.*` |
-| **Start** | **One press to a working interface**: if the chosen home's profile lists none of this pack's bundles, the installer runs FIRST and the harness starts when it succeeds (the installer re-links the profile, so it must not run under a live harness - and nothing is running yet). With no installer beside the app, Start **refuses** with a sentence instead of opening the bare interface. Then the port is chosen (`-Port`, else a free port of this app's own - never the shared `3080`), the child's environment is composed, the harness is spawned from the best rung available (see below), and the shell watches for the ready line for up to 180 s. Stop works during this wait, in 200 ms steps |
-| **Running** | The URL the harness printed is handed to the **chosen browser** - Chrome first when it is installed, the OS opener always in the table - as ONE argv element, and every rung is then WATCHED for one settle window: a program that exits zero handed the URL to a browser that was already running, one that is still alive IS the browser, one that exits with a failure status did not open anything and the next rung is tried - where the second rung is the same browser with a profile inside this folder, and the floor's exit status is reported as unverifiable because `rundll32` always exits zero. **Every rung's sentence reaches the log**, so the transcript says which one took the page. `Open tab` opens another one on demand, with the launch token the panel never draws |
-| **Stop** | The whole tree dies - `taskkill /T` on Windows, one signal to the child's own process *group* elsewhere - and the port is then **checked**, not assumed: free, and nothing answers on it. The panel says so, or names the port something still holds |
-| **close** | Same as Stop, plus the window geometry is written once, synchronously, into the app's own root. A close request while a copy or an install is in flight is **refused once**, with a sentence: measured, the npm log stopped mid-resolution and the profile was left listing the bare harness. Closing again is honoured |
-
-Stopping something that was never started is not an error: the shell returns to
-the state it opened in.
-
-### The first screen is the home question
+| *(none)* / `start` | **one press to a working instance.** If the home in use does not list the pack's bundles, `scripts/setup/install.*` runs first - it re-links the profile, so it must not run under a live harness, and nothing is running yet. Then, if no DeepSeek key is found in any of the four layers, it is asked for at the terminal (a piped run never blocks: it says so and continues). Then `scripts/run-web.*` is started in the foreground and owns everything from there |
+| `install` / `uninstall` | the matching `scripts/setup/*` entry point, in this console, with the same environment the launcher gets |
+| `status` | the pin, the root, the home and why it was chosen, the pack, which key layer answered, where the launcher is, and `node`/`npx` - then exits without starting anything |
+| `key` | asks for `DEEPSEEK_API_KEY` and writes it into `<home>/.env`. The value goes from the terminal into one file and nowhere else: it is not printed, not logged, and not read back. The sentence names the FILE |
 
-The panel used to be fifteen rows and a `~/.dsh` that was chosen for you. It is now a
-choice, then four rows - and the choice comes first:
+Flags: `-Port <n>` (handed to the launcher), `-DshHome <dir>`, `-DshVersion <ver>`,
+`-Help`, `-Version`. There is **no `-Mode`**: `panel`, `chrome`, `headless` and `embed`
+described a window this build does not have, and `-Mode embed` now fails *by name* rather
+than quietly selecting a browser - a flag that silently means something else is a flag
+nobody can trust.
 
-```text
-  Where should your sessions, skills and key live?
-  Pick one. It is remembered, and Change on the next screen brings this back.
+## The bridge
 
-  ┌ ▸ Copy it here, and use the copy                                   ┐
-  │ copies into <app root>\home                                         │
-  │ ▸ details                          [ Copy it here and continue ]    │
-  ├   Use the home in this folder                                      ┤
-  │ <app root>\home · empty, and private to this app                    │
-  │ ▸ details          [ Create the home here and continue ]            │
-  └─────────────────────────────────────────────────────────────────────┘
-  [ Copy it here and continue ] · the card marked ▸ above
 ```
-
-Two cards when this machine already has a home to copy from, **one** when it does not (a
-card that says "nothing found" teaches nothing). Each card draws **one line open** - the
-path, and the fact that decides it - and folds everything else into its own `details`
-disclosure, closed by default: measured on a real machine, with every fact open, three cards
-filled the window and pushed each card's own reason and its button off the bottom of it. The
-decision is `vn_shell_core::firstrun`, which is `cargo test` cases - and the facts come from
-`profile.rs` and `adopt.rs`, the same readers the log's "this home has no pack" note uses, so
-the card and the log cannot disagree.
-
-**Every card ends inside this folder.** The card that used to come first - "use the DeepSeek
-home already on this machine" - ran the harness against `~/.dsh`, and it is gone: a folder
-that carries everything it needs must not reach into a person's profile to START. What that
-rung was for is answered here instead - **Start** installs the pack into the home in use, and
-the **key** row asks for the key - so the one thing left that reads `~/.dsh` is the COPY,
-which only reads.
-
-**The reason is never collapsed, and the arrow decides.** `×` marks a card that cannot be
-taken here, and its sentence is drawn open under it: the answer to "why can I not press
-this" is not something to hide behind a disclosure. `▸` marks the card the app suggests - the
-copy while there is something to bring, the folder otherwise, and never both - and the
-**button at the foot of the screen** takes exactly that card, so a screen that honestly
-offers one answer is never a dead end.
-
-Nothing the panel draws carries markup: these sentences reach the reader through a label that
-renders no markdown, so `**Install pack**`, a backticked `Change` and a backticked `dsh web`
-all arrived as literal punctuation - measured on this very screen. A test now refuses `**` or
-a backtick in any card sentence or plan note.
-
-| the card | when it is offered | what it does |
-|---|---|---|
-| **copy it here, and use the copy** | that home can be READ **and there is something left to bring** (a durable tree the target lacks, or a key it lacks - from the copy's own plan, not the source's inventory) | a ONE-WAY import: copies the durable things (skills, sessions, storages, attachments, and the key if ticked) into this app's own home, then **installs the pack into that copy** - the card's own second half, which nothing used to act on |
-| **use the home in this folder** / **make a fresh home in this project** | always; the title says which of the two it is | this app's own root. Empty and private when nothing is there; when it already holds your sessions the card says so and says nothing is deleted - it never deletes anything. Start (or the install that follows a copy) puts the pack into it |
-
-There is deliberately **no** card that runs the harness against a home outside this folder,
-because nothing outside this folder is ever the home it runs against - see the ladder below.
-
-The copy card is a promise about what the next click does, so it is offered exactly when
-the next click would do something, and it advertises only what its own plan would really
-bring - a card that could not be pressed used to promise a key and a pack while the red
-sentence beside it said there was nothing to bring. A copy that fails says so at the top of
-the screen: its own sentence used to live inside `Details`, which is how a press that did
-nothing looked like a broken button.
-
-A card that cannot be honoured says why in one sentence instead of offering a button that
-would fail, and the app never writes the choice for you:
-`prefs.json` is written by a click, `Change` on the panel brings the question back, and a
-`-DshHome` or an inherited `DSH_HOME` skips the screen entirely because somebody else
-already answered it.
-
-### The panel, after that
-
-```text
-  vncode  ● running on 127.0.0.1:53412      [ Start ]  [ Stop ]  [ Open tab ]   up 2m
-  ────────────────────────────────────────────────────────────────────────────────
-  home     C:\Users\you\proj\.vncode\home · this app's own home (the default)   [Change]
-  pack     installed · 24 bundles
-  DeepSeek key  found in the credentials file
-  browser  [ Google Chrome ▾ ] · opened in Google Chrome (a new tab)
-
-  ▸ Details · 1 refused path(s)
+vncode ──spawn──▶ scripts/run-web.bat|.sh ──npx──▶ dsh web --no-open --port N
+   │                        │
+   │                        └─ watches the ready line, opens the tab (Chrome first)
+   └─ composed env: DSH_HOME, npm cache, temp; VNCODE_* removed
 ```
 
-Four rows, and every row is either a fact or an action. **`Details`** holds everything
-that did not earn a place there - the pin, the runtime, the root and its origin, the
-composed environment, the profile, the pid, the last setup and stop, the location map with
-its sizes and its `reveal` buttons, the provider row, the refusals and the plan's notes -
-because an inspector is not a control panel. A refusal shows as a badge on the disclosure,
-so it can never be the thing that is hidden.
-
-### The one trap the composer clears
-
-`scripts/console/adapt.cmd` marks a run it has set up with `VNCODE_CONSOLE=1`, and an
-entry point that sees the marker does **not** take its arguments from `%*` (and
-`adapt.cmd` returns immediately), so any flags a caller passed are dropped. That is
-correct for the paths it was designed for and a trap here: this app is started *by*
-that layer, so it inherits the marker. It is removed from every child's environment by
-`vn-shell-runtime`'s one composer (`env.rs`), for the installer **and** the harness.
-Measured, not assumed: the first version of the Install button ran
-`install.bat -NoTerminal -NoPause -Help` and started a full install. And a second
-leak of the same family was measured while this was written: `VNCODE_HOME`, set for
-the app, was still in the child - because an environment is inherited unless a
-variable is REMOVED, which is why the composer removes rather than merely omits.
-
-### Where the harness comes from
-
-Four rungs, best first, and the second one is why Start does not need npm:
-
-| rung | what it runs | needs |
-|---|---|---|
-| the vendored runtime | `runtime/<rid>/node/node …/harness/…/lib/bin.js web --no-open --port N` | the three pieces; no npm, no cache, no network |
-| **the installation this machine already has** | `node <npm cache>/_npx/…/@deepseek-ai/dsh/lib/bin.js web …` | the Node on PATH. It is the harness a browser tab is already running, resolved through the profile's own link first |
-| `npx` | `npx --yes @deepseek-ai/dsh@<pin> web --no-open --port N` | a writable npm cache, and the network on a first run |
-| the test seam | whatever `VNCODE_STUB_CLI` names | nothing; a check only |
-
-The second rung is skipped unless its `package.json` names the pin, because a machine
-can have several harness installations cached (yours has four) and this shell must not
-quietly run a different harness than `scripts\run-web.bat` does.
-
-**And it is searched in THIS folder's caches before the machine's own.** Measured on the
-machine this was written on: an app whose root, home, pack, sessions and key were all inside a
-portable folder still started its harness out of `%LOCALAPPDATA%\npm-cache\_npx\…` - the one
-directory that made "everything is in this folder" untrue on every single Start. The order is
-`<app root>/npm-cache` (where this app's own installs land, and the cache it hands every child
-as `npm_config_cache`), then `runtime/npm-cache` inside the checkout, then the machine's shared
-cache - which keeps a portable folder portable while still finding the harness a `run-web` on
-the same machine already installed.
-
-### The home: the app's root, and the harness home inside it
-
-`$VNCODE_HOME` is the app's own root. It creates it, proves it by writing, and the
-harness home is `<root>/home` inside it - so the keys, the sessions and the profiles
-live in a directory this app controls rather than in `~/.dsh`, which belongs to
-whichever harness used it first. `VNCODE_HOME` names another root; a **portable folder**
-(marker, or a home already inside it) is next; the platform's own per-user data
-directory is the default; `<tree>/.vncode` is the last resort (a workspace-scoped
-confinement, which this repository's own checks run inside).
-[`docs/PATHS.md`](../docs/PATHS.md) is the whole map.
-
-**Everything the app owns lives under that ONE root** - the window record, `prefs.json`,
-the npm cache and the home - and that is a rule rather than tidiness. The preferences used
-to be written into the platform's data directory while the root the ladder had chosen was
-beside the checkout, so on a machine whose ladder fell through to `<tree>/.vncode` the
-home somebody chose was written where the next run could not read it and the first-run
-question came back on every launch. `prefs.json` is now read from the ladder's root, with
-the platform copy as a **read-only fallback** for exactly that migration, and saved into
-the ladder's root.
-
-The home itself is chosen by a ladder over paths that have already been CLEANED
-(`userpath.rs`): a leading `~` is expanded the way the harness expands it, a relative path is
-resolved against the directory the app was started in, `.` and `..` are folded lexically, a
-NUL or an empty value is refused by name, and what is exported is the REAL path (with the
-Windows `\\?\` form stripped). **The first candidate that passes a real write probe wins**:
-
-| # | candidate | when |
-|---|---|---|
-| 1 | `-DshHome <dir>` | the person named it. A refusal here **ends the run**, naming the flag - an explicit instruction is never silently ignored |
-| 2 | the home chosen on the first-run screen | the click outranks an environment variable; `Change` in the panel brings the question back |
-| 3 | an inherited `DSH_HOME` | it is writable: the app JOINS the home of the session that started it, sharing that session's sessions and key |
-| 4 | `<VNCODE_HOME>/home` | the default, created and proved by the app |
-
-**Rungs 1 and 2 skip the first-run screen** - somebody already answered the question - and
-rungs 3 and 4 are what the screen is FOR: the app would otherwise be guessing.
-
-**Nothing outside this app's own root is ever the home it runs against.** The harness's own
-default (`~/.dsh`) was once rung 4 here, a one-time courtesy used while this app's own home was
-still empty, and it is gone: the two things it existed for - a home with no pack, a home with no
-key - are answered by this app itself. **Start** installs the pack into the home in use, and the
-**key** row asks for the key. What `~/.dsh` is still read for is the first-run COPY, which
-brings a person's own sessions and key INTO the folder; `adopt::home_is_untouched_by_a_person`
-is the measurement both that offer and the app's own home share - no `skills/`, no `sessions/`,
-no credentials file with content. The harness's own first-boot furniture (a composed
-`profiles/`, an empty `.credentials.yaml`, a `storages/`) does not count as a person's work.
-
-### A portable folder: one installation, kept where it is
-
-A folder that carries `<tree>/.vncode/PORTABLE`, **or that already holds a home**, is a
-portable installation: its own `.vncode` is the root the next start uses, ahead of the
-platform's data directory. Both halves matter. The marker is the explicit choice, written
-by **`Keep everything in this folder`** on the `vncode root` row in `Details`; a home
-already inside the folder is the same answer without anybody pressing anything, which is
-what makes a confined run - whose only writable root was the folder - remember where it
-put the person's sessions instead of starting a second installation beside them.
-
-The running app cannot move its own root (the home, the geometry and the preferences all
-live in it), so the button writes the marker and says **restart**, rather than pretending
-the click took effect. On the next start the root ladder reports the change as "this
-folder, because it is a portable installation", and everything - home, `prefs.json`,
-`window.json`, `npm-cache` - is inside the folder. Set `VNCODE_HOME` to overrule it.
-
-A directory the app CREATED is hardened to `0700` on Unix, because it holds
-`.credentials.yaml` and an npm cache; a directory the app merely JOINED is never touched,
-which is why the probe reports whether it created it. The app never writes a note, a log or
-anything else into a home it refused - the one write it makes outside its own root is the
-probe file, created and deleted at the root of a home it is considering, because "can a child
-write here" is not knowable any other way.
-
-A home this account cannot write in used to be a **refusal** - one sentence asking the
-person to start the app differently, which cannot fix a parent process that confines
-what its children may write (an agent session, an IDE runner, a CI sandbox; this
-repository's own checks run inside one). It is now a **rung that was refused**: the
-reason is a line in the log and a row in the panel, and the run continues in a home the
-app created. Measured on the machine this was written on: `%USERPROFILE%\.dsh` is
-owned by the signed-in account and takes a write; the same directory refuses a child
-whose parent confines it.
-
-### Every child's environment is composed, never inherited
-
-The harness, the installer, and the browser hand-off all get an environment built from
-the plan, because a variable that is merely *not set* is still inherited:
-
-| variable | value |
-|---|---|
-| `DSH_HOME` | the chosen home, always - the harness is TOLD, never asked |
-| `npm_config_cache` | the cache chosen by write probe; **removed** when none was usable, so npm's own default stands rather than an inherited value |
-| `PATH` | the vendored runtime's `node` directory first, when one is used |
-| `TMP`, `TEMP`, `TMPDIR` | `<app root>/tmp` - but **only** when the machine's temp is not writable by a child. Measured, from a real run: `dsh-spill-local: EPERM … mkdtemp 'C:\Users\…\AppData\Local\Temp\dsh-spill-XXXXXX'`, and the row that owned it did not activate. The machine's temp is left alone whenever it works |
-| the working directory | the workspace the panel names, captured once - `keystate` reads `<cwd>/.env` because the harness inherits it, so one value serves both |
-| `VNCODE_HOME` and the seven `VNCODE_*` console markers | **removed** - the app's own word for its root, and the launcher's own markers, are none of a child's business |
-
-What is *not* removed is everything the machine owns (`PATH`, `HOME`, `TEMP`,
-`SystemRoot`, proxies). The rule is precise: every variable this app owns is set or
-removed deliberately - and `check-shell.mjs` reads the child's own answer back, which
-is how an inherited `VNCODE_HOME` was caught.
-
-### The surface: the browser, and only the browser
-
-This app draws no part of the shipped interface. `browser.rs` is a table, Chrome first, and
-the last rung is the platform's own opener - so *every* browser works, including one the
-table has never heard of:
-
-| family | entries | how it is started |
-|---|---|---|
-| Chromium | Google Chrome, Microsoft Edge, Brave, Chromium, Vivaldi, Opera | the program, with the URL as exactly ONE argv element |
-| Firefox | Mozilla Firefox | the same |
-| the floor | `rundll32.exe url.dll,FileProtocolHandler` (Windows), `open` (macOS), `xdg-open` (Linux) | the same - a program, never a command string |
-
-The Windows floor is `rundll32`, not `explorer.exe`: the latter is unreliable from a
-non-interactive child, and it was measured doing **nothing at all** when the panel's button
-spawned it. `rundll32 url.dll,FileProtocolHandler <url>` is the documented way a program (not
-a shell) asks the shell for the default browser.
-
-The choice is remembered in `<app root>/prefs.json` as an **id**, never a program path, so a
-hand-edited preferences file cannot name something to run; a remembered browser that has been
-uninstalled falls through to the first one found rather than refusing to show the page; and
-the panel's `surface` row is a chooser over what was actually detected, plus which browser the
-last launch used. Detection is a pure function of the facts, so the table AND its order are
-`cargo test` cases on every platform, including the OS guards that stop a Windows install path
-being probed on Linux. Three rules travel with every launch: the URL is one argv element, only
-a **loopback** URL is accepted (checked again here, at the last function before a process
-starts), and no shell is ever in the middle.
-
-**And a fourth rule, which is the one that was missing: a spawned process is not a page.**
-`spawn()` says a process was CREATED and nothing else, and the panel used to take it for a tab
-that opened - so a browser that died on the way up was reported as `opened in Google Chrome (a
-new tab)` over a window that never appeared, and the reader's report was "I press it and
-nothing happens". Measured on the machine this was written on, and then on the owner's:
-
-```text
-[vncode] Google Chrome exited with status 0x80000003 before it could show the page, so no tab was opened
-[vncode] handed the page to the default browser, which was already running   <- and no page appeared
-[vncode] opened http://127.0.0.1:58511/ in the default browser               <- a claim nothing could back
-```
-
-Chrome's own words, from the same run: `CreateFile …\Google\Chrome\User Data\Crashpad\
-settings.dat: Access is denied`. So every rung is watched for one **settle window**
-(`browser::SETTLE`, 1.5 s), and the verdict is all the panel may say:
-
-| the program | what it did | what the panel says |
-|---|---|---|
-| still running when the window closes | it IS the browser - the only verdict a browser of this app's own making can give | which browser took the page |
-| exited **zero** | a browser that was already running took the URL and the relay left (measured at 60-90 ms) | the same |
-| exited **zero**, and the rung is the platform's opener | **nothing: `rundll32` exits zero whether or not a window appears** | `asked … for the page; it reports success without saying whether a window appeared, so this app cannot tell` - never "opened" |
-| exited with a failure status | it never showed the page | its status, in hex when it is an NTSTATUS, then the **next rung** |
-
-The rungs are, in order: **the browser the person chose** → **the same browser with a profile
-inside this app's own root** → **the platform's own opener**. The middle rung is the one that
-answers the measured failure: a confinement that refuses a browser its own profile directory
-cannot refuse one under the root this app has already proved it can write - the same rule that
-hands a CHILD `<app root>/tmp` when the machine's temp is refused. It is the fallback, and it is
-used FIRST when this app's own temp probe was refused, because that is what a session which
-confines what this app starts looks like and a doomed launch is owed to nobody. A page there is
-not a tab in the person's own browser: the row says
-`a window of its own, with a profile in this folder`, and their Chrome is left completely alone.
-
-**Every rung's own sentence goes into the transcript**, the `browser` row says `opening in …`
-with a spinner while the walk is in flight, and the walk runs on its own thread - 1.5 s of a
-blocked UI thread reads as a hang, and a walk already in flight is never restarted, so pressing
-the button twice cannot open two tabs.
-
-When nothing takes the page and this app has the measurement that names the reason - its own
-probe of the machine's temp directory was refused, which is what a confined parent looks like -
-the notice says so and names the step that exists: start vncode by double-clicking
-`scripts\run-desktop.bat`, outside that session.
-
-### The copy, and why it is the only thing that reads a home this app did not create
-
-The copy is a ONE-WAY import into this app's own home: `skills/`, `sessions/`, `storages/`
-and `attachments/`, with `.credentials.yaml` behind its own tick. It only ever READS the
-source, which is what makes it the way through a confinement - a home that refuses
-`%LOCALAPPDATA%` refuses `~/.dsh` with it, and a copy needs neither.
-
-Two rules came out of a real run, and both were bugs before they were rules:
-
-* **The copy only needs a home it can READ.** The offer used to be filtered by whether a
-  child could WRITE in the source - which is what running against it needs, and nothing the
-  copy does - so a person whose `~/.dsh` was unwritable got *no* way to reach their key.
-* **A copy is offered while there is something left to bring, and nothing to overwrite.**
-  The test used to be "the home has no `profiles/`", which was wrong twice over: the
-  harness composes `profiles/<name>/` on its FIRST boot and writes an empty
-  `.credentials.yaml` and a `storages/` beside it, so a home the app created stopped
-  looking "untouched" after one run and the offer vanished. Measured: the panel said
-  `DeepSeek key: not found` while the key sat in `~/.dsh`, with no button to press. A
-  durable tree is now offered when the source has it and the target has nothing in it; the
-  credential document when the source's has **content** and the target's is absent or empty
-  - a file SIZE, never a read, so the presence-only rule stands.
-
-A third came out of the same machine, and it was the click that did nothing: the card was
-offered on *"the source can be read"* alone, so pressing it over a home **already copied
-here** planned no items at all, the runner refused with one sentence - and that sentence was
-drawn inside `Details`. The card is now unavailable in exactly that state, with the reason
-on it, and both the copy's own line and the panel's notices stand at the top of the screen.
-
-And the copy is only half of what the card promises. **The pack is installed into the copy
-by the app itself** the moment the copy finishes, because the installer must not run under a
-live harness and nothing is running yet: one press of the copy card reaches a home with the
-sessions *and* the pack in it, and Start is then the ordinary Start.
-
-The caches are never copied (512 MiB, 200 MiB and up to 8 GiB, all reproducible),
-`profiles/` is never copied (the installer re-creates it, and the pack's links point into
-this repository), nothing is ever written into the source home, a file that already exists
-is never overwritten, and a link is skipped rather than followed.
-
-The install half of that works under the same confinement, and it is measured rather than
-hoped for: with `%LOCALAPPDATA%` deliberately unwritable and only the cache and temp handed
-over (which the environment composer already does), the installer lands 24 bundles and 23
-skills, exit 0. Without the cache it fails with `ENOTDIR` inside the blocked directory.
-
-### The install is resumable, visible, and not killed by closing the window
-
-Three measurements shaped this, all from one machine's own npm logs and from the profile left
-behind. An install spent a whole `npm exec @deepseek-ai/dsh@<pin>` **per bundle** - npm
-re-resolving the harness's entire dependency graph each time, ~1500 log lines before pnpm was
-even reached, twenty-four of them in a row - so the installer now selects what is missing and
-issues **one** `plugin add` with every folder: `dsh plugin` is a thin pnpm forwarder, so that
-is one pnpm run. The entry point IMPLIES `-Force` for a double-click, which is right for a
-person and wrong for a button pressed again over a half-finished install, so the panel passes
-**`-Resume`**.
-
-**And the silence is named, because that is what killed an install here.** The first phase is
-`npm exec`, which resolves the harness and prints *nothing* while it does: measured on this
-machine at about 50-60 s cold and a few seconds warm, with pnpm itself taking under a second
-(`Done in 416ms`). An installer whose last line was `- adding dsh-vn-master ...` therefore
-looked stuck on the last bundle, the window was killed 60 seconds in, and the profile still
-listed only the base bundles - a run that "did not work" that had in fact not finished. So:
-
-* the installer prints `selected …` per bundle (not `adding …` - nothing is being added yet),
-  then `adding N bundle(s) in ONE pnpm run` and the sentence that the silence is normal;
-* the `pack` row carries a spinner, the installer's own last line, **the elapsed time**, and -
-  after 20 s with no new output - a line saying so and naming the phase;
-* a close request while a copy or an install is in flight is refused once with a sentence.
-
-The plugin's own `plugin add` semantics are the reason all three are needed: it is a pnpm
-forwarder that reconciles `dsh.profile.bundles` against what is installed, so adding is
-idempotent, so `-Resume` makes a second press cheap, and the only thing that was ever
-expensive was how many times it was called.
-
-### The port: a port of this app's own, never the shared one
-
-`3080` is what every `dsh web` on the machine reaches for, and the app **no longer asks for it**.
-Measured on the machine this was written on: an app instance bound `127.0.0.1:3080` while another
-harness answered on it, so the tab the app opened was served by the wrong process, whose launch
-token the app did not have - and the button that should have opened a tab looked broken. A free
-port costs nothing here, because the app opens the tab itself with the token in it: nobody types
-an address and nothing has to be remembered per origin. `-Port 3080` is still the way to ask for
-the shared origin on purpose, and Stop asserts BOTH that the port is free and that nothing
-answers on it any more.
-
-### Where npm's cache goes, and why it is chosen rather than assumed
-
-The `npx` fallback needs a cache npm can write in, and a cache it cannot write in
-fails the whole launch with `EPERM` and then advises running as Administrator - which
-is the advice that *created* the unwritable directory. So the cache is picked:
-
-1. `$VNCODE_HOME/npm-cache` - `%LOCALAPPDATA%\vncode\npm-cache` by default;
-2. the harness home, `$DSH_HOME/vncode/npm-cache`;
-3. `runtime/npm-cache` inside the checkout.
-
-It is the SAME first choice the harness rung searches first (`launch::harness_caches`), so
-the cache the app writes into and the cache it reads a harness out of are one directory.
-
-The child's **temp directory** is chosen the same way, and for the same kind of reason:
-the machine's `TMP`/`TEMP`/`TMPDIR` is used when a child can write in it, and
-`$VNCODE_HOME/tmp` when it cannot — the case a real log showed, where the harness's own
-`dsh-spill-local` row died on `mkdtemp` and did not activate.
-
-Each candidate is probed **where npm actually writes** (`<cache>/_cacache/tmp`, not
-the cache root - a cache whose root is writable while its `_cacache` tree belongs to
-an elevated run fails in exactly the reported way), the first usable one wins, and a
-refused candidate prints a line saying so. A vendored runtime reads no cache at all,
-which is why `scripts/tools/vendor.ps1` removes this problem rather than working
-around it.
-
-## The first page
-
-A control panel, not a splash screen - and after the home is chosen it is **four rows and
-three buttons** (the layout is drawn above; the long version is in
-[`docs/PLAN-egui-shell.md`](../docs/PLAN-egui-shell.md)):
-
-| row | what it is |
-|---|---|
-| `home` | the path in use, its origin, whether this app created it, and **`Change`** - which puts the first-run question back in front of you |
-| `pack` | whether this pack is in the profile the harness will load, and `Install pack here` (or `Stop and install`) when it is not |
-| `DeepSeek key` | which of `keystate`'s four layers supplied a key - a layer NAME, never a value - and, when there is none, **`Add key`**: a masked field in this window that writes `DEEPSEEK_API_KEY=<value>` into this home's `.env`. A key found in the managed store says to change it in the harness's own Settings > Models instead, because that store sits ABOVE the `.env` fallback and a field here would be ignored - a button that looks like it changes something and does not is worse than no button |
-| `browser` | the chooser over what was actually detected, plus which browser the last launch used |
-
-**The key is asked for, once, in this window.** A fresh portable home has no credentials
-document and no key at all, and rather than telling somebody their key is missing the panel
-opens the masked field itself: paste, Save, and `DEEPSEEK_API_KEY=<value>` is written into
-`<home>/.env` - a layer the harness's **own** credential resolution reads
-(`@deepseek-ai/dsh-credentials-local` resolves the managed store first, then the invoking
-project's `.env`, then the home's). Nothing is read from the machine on the way, the value is
-never parsed back, never drawn, never logged (the log line and the note name the FILE), the
-write is atomic and `0600` on Unix, and every other line of an existing `.env` survives. That
-is what makes a portable folder self-contained: the key travels with it. A key that is
-ALREADY in the managed store is left alone - that store outranks `.env`, so the row points at
-the harness's own Settings > Models instead of offering a field that would be ignored.
-
-**`Open tab`** is the one control that carries the launch token: the panel draws the URL
-*without* its query, because that URL is a credential, so this button is how a tab is opened
-- or re-opened after it was closed. It reads `Opening…` with a spinner on the row below while
-the settle walk is in flight, and **the walk's own lines land in the log**, so the transcript
-answers "which rung took the page" and "why did nothing open" without anybody having to guess.
-**`Details`** (closed by default, badged when a path was refused) holds everything else: the pin, the runtime, the app's root and its origin, the
-composed environment, the profile, the pid, the last setup and stop, the **location map**
-(`docs/PATHS.md` as rows, each with a size and a `reveal` button), the model provider - a
-chooser with one entry (`DeepSeek (official)`), read-only while a harness is live because the
-route is read at boot - the refusals, and the plan's notes. The Install/Uninstall pair lives
-there too: uninstall is not a twice-a-day action, and the install the panel offers is on the
-pack row.
-
-The chrome takes its palette from the profile's own `cordis.patch.yml`
-(`ui-state`'s theme, `ui-theme`'s preference), so the native frame and the page it
-frames are not two different applications.
+The app never starts node, never binds a port, and never touches the launch token. The
+`-NoTerminal` flag it passes on Windows is the one that matters: without it the console
+layer may relaunch the run into a Windows Terminal window this process would not wait for,
+and the app would report an instant, silent success.
 
 ## The crates
 
 | crate | what it is |
 |---|---|
-| `crates/vn-shell-core` | the **pure** halves, each driven by `cargo test`: `readyline` (the ready line, its refusals and the token redaction), `windowstate` (the geometry record and its trust rules), `keystate` (the four key layers, presence only), `appdata` (the app's root, the home inside it, the write probe and the npm cache), `userpath` (what a person typed, turned into a path a child may be given), `browser` (the per-OS browser table, the argv rule, and the settle-window verdict that makes a spawned process not a page), `appprefs` (the browser id and the chosen home), `adopt` (what may be copied out of a home this app did not create), plus `options`, `home` (the two ladders), `ports`, `launch`, `log`, `prefs`, `status` and `urlpolicy` |
-| `crates/vn-shell-runtime` | the supervisor: one thread owns one child, resolves the plan, spawns, drains both streams, watches the ready line, takes Stop, kills the tree and checks the port. Also `env` (the one composer every child's environment comes from), `console` (the one transcript), `setup` (the installer runner behind the panel's buttons) and `adopt` (the copy runner behind its own) |
-| `crates/vn-shell-paths` | the location map as data, with the per-OS roots and a bounded size walk |
-| `crates/vn-shell-pane` | the pane: the ONE crate that depends on a web engine (`wry`, optional, behind the `pane` feature) plus the page that draws it - tab strip, bar, rectangle, placeholder. It owns no policy: visibility, the DPI arithmetic and the loopback re-check are `vn_shell_core::pane` and `cargo test` cases |
-| `crates/vn-shell-egui` | the panel, the palette, the pages and the status grid |
-| `crates/vn-shell` | the binary (`vncode`): flags, wiring, and the mode that opens no window |
-
-The four load-bearing modules were **moved** from the old Tauri launcher rather
-than rewritten, comments and tests included: `readyline.rs`, `windowstate.rs`,
-`keystate.rs` and `appdata.rs` are each the record of a bug that was measured on a
-real machine.
-
-## Modes
-
-`-Mode panel` opens idle and starts nothing; `-Mode headless` opens **no window** and takes
-`stop`, `quit`, `install [args]` and `uninstall [args]` on stdin - it is the mode a server
-wants, and the one `scripts/checks/check-shell.mjs` drives against a stub. The default is
-**`-Mode chrome`**: the harness UI, in a browser the app found - or, in a build with the pane,
-inside this window.
-
-**`-Mode embed` is a mode only a build WITH the pane has.** Without it the flag is refused **by
-name**, with the reason, rather than quietly opening a browser - a flag that silently means
-something else is a flag nobody can trust. With `--features pane` it is real: it opens with the
-harness page already in front. `scripts/checks/check-pane.mjs` is what proves the two builds
-disagree, because "the pane exists" and "the pane is reachable" are different claims and only the
-second one is worth anything.
-
-`-Mode headless` with `-DshVersion` set is a complete supervisor for a machine
-with no display:
-
-```sh
-./target/release/vncode -Mode headless -Port 3080 < /dev/null
-printf 'install\nquit\n' | ./target/release/vncode -Mode headless
-```
-
-## The two rules that must survive any edit
-
-The ready line carries the **launch token**, a live credential for the running
-process. Both rules are pinned by tests in
-`crates/vn-shell-core/src/readyline.rs` and by `vn-shell-core`'s `status` module:
-
-1. **The token is read in memory** - never written to a file, never handed to a
-   shell, never echoed: the shell prints `token=REDACTED`, the log redacts on the
-   way IN so a line cannot reach the panel redaction-free, and `Status`'s `Debug`
-   is written by hand precisely so a panic cannot print it. The one reader of the
-   full URL is `Status::navigate_url`, which the browser launch uses.
-2. **Only a loopback URL is loaded.** A ready line naming any other host is
-   refused and reported, and `browser::command` checks the same rule again before a
-   process is started with that URL in its argv; a link clicked inside the page goes
-   to the browser as an ordinary navigation.
-
-`scripts/checks/check-shell.mjs` drives both: it starts the shell against a stub
-CLI that prints a ready line carrying a recognisable token and one naming a
-foreign host, and asserts that the token appears in no stream and no file the run
-created - in **both** roots the run writes, the app's own and the harness home.
+| `crates/vn-shell-core` | the **pure** halves, each driven by `cargo test`: `home` (the two ladders), `appdata` (the root, the home inside it, the write probe, the npm cache), `userpath` (what a person typed, turned into a path a child may be given), `keystate` (the four key layers, presence only), `launch` (the pin and the tree's own root), `readyline` (the token, and its redaction), `options` (the verbs and flags), plus `ports`, `prefs`, `profile`, `log` |
+| `crates/vn-shell-runtime` | the decided facts: `plan` (which home, which pin, which cache, which temp), `env` (the one composer every child's environment comes from) and `setup` (the runner behind `install`/`uninstall`) |
+| `crates/vn-shell` | the binary (`vncode`): the verbs, the key prompt and the bridge |
+
+The load-bearing modules were **moved** from the old Tauri launcher rather than rewritten,
+comments and tests included: `readyline.rs`, `keystate.rs` and `appdata.rs` are each the
+record of a bug that was measured on a real machine.
+
+## The modules that are gone, and why they are not coming back
+
+`wry` (and with it WebView2, WKWebView and WebKitGTK), `egui`/`eframe`/`wgpu`/`winit`, the
+panel, the window record, the first-run cards, the browser table and the location map: 13
+of this binary's former 15 MB, and every one of them existed to draw something that is not
+this app's to draw. The interface is a web application served on loopback; the browser
+already on the machine shows it.
+
+The size is enforced rather than hoped for: CI fails a build over **6 MB**, and
+`check-shell.mjs` fails over 12 MB. A dependency that draws a window or a web view is the
+only way back over either line.
+
+## The rules that must survive any edit
+
+1. **The key is never printed.** A layer NAME, never a value; written to one file, `0600`
+   on POSIX, atomically, and never read back.
+2. **A child's environment is composed, not inherited.** A variable that is merely unset is
+   still inherited - which is how `VNCODE_HOME` once reached the harness, and how a leaked
+   `VNCODE_CONSOLE` once turned `-Help` into a full install.
+3. **The launcher is the only thing that starts node**, and it is the same file a person
+   runs. If the app needs a harness command, it asks `scripts/run-web.*`, never a copy.
+4. **The token is not this app's business.** It is read in memory by the launcher, opened
+   only on a loopback host, and handed to a browser as one argv element.
 
 ## Files
 
 | Path | What it is |
 |---|---|
-| `Cargo.toml` | the workspace, one pin per dependency, and the release profile the shipped binary is built with |
-| `crates/vn-shell/src/main.rs` | the wiring: flags, the panel, and headless mode |
-| `crates/vn-shell-core/src/{readyline,windowstate,keystate,appdata}.rs` | the moved pure halves, with the tests that pin them (`payload`, the single-file container reader, left with the distributer that produced such files) |
-| `crates/vn-shell-core/src/{userpath,browser,appprefs,home,adopt}.rs` | where a typed path becomes a usable one; the per-OS browser table and the argv rule; the app's own small preferences; the two ladders; and what may be copied out of a home this app did not create |
-| `crates/vn-shell-egui/src/lib.rs` | the panel: the header, the buttons, the status grid, the paths table, the provider row, the log |
-| `crates/vn-shell-runtime/src/lib.rs` | the supervisor, and the console both it and the installer write to |
-| `crates/vn-shell-runtime/src/env.rs` | the ONE composer every child's environment comes from: what is set, what is removed, and the working directory |
-| `crates/vn-shell-runtime/src/setup.rs` | the installer runner behind the panel's two buttons, given the same environment and `-DshHome` |
-| `crates/vn-shell-runtime/src/adopt.rs` | the copy runner behind the Adopt button: a bounded recursive copy, no overwrites, links skipped |
-| `assets/icons/` | the window and exe icons, generated by `node scripts/tools/make-desktop-icon.mjs` from `assets/vncode.svg` |
+| `Cargo.toml` | the workspace: three crates, two dependencies (`serde_json`, `rpassword`), and the release profile the shipped binary is built with (`lto`, `strip`, `panic = "abort"`, one codegen unit) |
+| `crates/vn-shell/src/main.rs` | the verbs, the key prompt, the bridge |
+| `crates/vn-shell-runtime/src/lib.rs` | `plan`: the home, the pin, the cache, the temp, and the notes |
+| `crates/vn-shell-runtime/src/env.rs` | the ONE composer: what is set, what is removed, the working directory |
+| `crates/vn-shell-runtime/src/setup.rs` | the runner behind `install` and `uninstall` |
+| `crates/vn-shell-core/src/*.rs` | the pure rules, one module per question, each with its tests |
diff --git a/app/assets/icons/icon.ico b/app/assets/icons/icon.ico
deleted file mode 100644
index b3fda0f156591a443bc9d2097d2c545b99ccedfa..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 5158
zcmai2cQjmG*S|AnFc=vInW&?e6g`g;j5<0AQBrg!qKhtK5M7i(kZ6e(X=;cTH9?3j
zY8WJBgs8!&-z0h0x86U#Z#`$NyY~K_eeXJZ|Mop+?{xqG1keHq1VE8!AP)e5D9Xda
z@)uWAbU_dRpiqBt9|ccPFdF?A|D@m&FaStM{KcjeTRIg0U@(7i1qG8J0D#B;#Ud2_
z5jEu_%J{vW0}KG#=l~$r*bob+W2a~UTt{2u3Pn;p0uZ#n-{sjlv84zn9Sv2}fXP>>
z-S8F(T1ZKF_58IPde84jSF07qL@%hvg{3b#T4d4hh+$;uXzD>AAIyr|3;J8}9Vt!~
zsmB7lLc_Jcl8xl&C6eDwEq~21gri1SB0OPpLd6M^joP9wIF*IQ<W<yPm;5rH84Rba
z2<T`UYP?pn3I9LbqYwnJ{BiF=EEk*tg8#brCVddzf~JLf;D64UGPV)UwIMFL9o~wm
z&<gt+5__75uPyWjhEzYEfGYs#WQ12;de-U2fv=8A{_K^&CSjs`vUvHKlOG^sZ6c3{
zzj6VLoBggQTTKZfEUw_^9=3}M7P+-?C?1lE7^2fQ(xq&Y-r+eIooIX%1ZtoBi_erK
z0;oSe6aAI;C?Nf>&+pR*Veioln*EF(@r+AsU%DhY`RyV5_pT%lMGq|*Q0-#pm7Yn4
zWh_v!<b$aLy6j$Q^c9S^ub{g4{S_|e8=$O5?bZgSxij-BnF^0=XY#%-<?zH;&t8oe
zhwQzn|ERWQQbc14%HIKyz)PC90I?Jxvv%`XS`}|533;%Je!5U}vxmm;W0yY1zTQ0j
zSbR|RBDBciU!p-%?C3wy+zATWrhqqpqZu`Ch2zl-jnM2!R*P24@yIh4ac58<6<J9w
z%|Y+<ugdp5X`0mN4?P0_5C)PAxxCoOR*EEm^Di1ZygCREAbh$l{B&h7WRwgg$4w(2
zk*VgD7KMe&bl3gua#^8Y9|}L^BY(~;DK(>MtuPD?q<756OAV20rT7pKh}q$(kYrjg
zK@_x&7%<Q_Qr}m1m=`S$)!JSg*HBdx@78B268h+kd=MM^xmW+r^NVckFP<U`Tt8+1
zOSF^?21xvg)*MWZrtBV$ztOH<YlTNhFf{t(NaxPvpR5o-<Kdu6O=_D224Z!3g6UN}
zI+9RT?!%)&WK38c2QntgIRF|o5Cc#HXYeAG-0?w)!?Gn)kG0DLdbDC*`{EFxjqcfE
z+WovF*;BO*^{Vo;m)E>v$hzjGUgw+tA+OWS&(a2`tQn$Jp4#8tY-obb0%WFlLX+C+
zU<VhUIC#nlL&b|!Q)iYJgqyc5FxO0`(mqsJDE@+g_lpP?w2-bFqJ2c=cz2c<2;|{-
zv#2nG1~^I-l%<WyWkzd&I|_lI(@#%gNbMpad<Eiy-{a-?y(c@OqVDNA+nE^6nn@0h
zKlM2O=+@6ix5^%)JTp;}S*Xn{RMn$1K99+x#7gT`7#H;q&#dU_qJQBOL$PE2aQfWY
zYlgyUz<)S>ESVS~fzY(Z)}0qzBGOe?r)Be>Hz#tZWw)MR$}h5gLrCFcsYnE<c6dnt
zFu@Laf-}$b<MkJ(q|h{U`PCvTILliOCi&oNEdWyDB%<4DYI3dEh(8CA9Z*d6)$|CJ
zt~+S{0xX1ejG<PQ+-t?G5_=9r^mlSIrt-GfFELx&m-l<d%ARJnF4)jHr1|cyaZeSO
zx4P~BwvLw!UF@~sYY1o#T{vAS{jezzAn&Goe)s#%t#SNC7_zk5)XWt}lWJXl)({0o
z*o-4*`of4m%H@A?P91b{4Owu`x<_YbXAfCL4!+4XrqRBqy2^*)DF>S3w;oe<7E8b6
zL*!2~=Rd&U{qz827~rIb7X^cgUxjya!j#$cH)9}O>INbHMO}^>;525;b&R2LnJQF`
zE;5}#l*>$2Lr{`c^D5g|YfRz?AGzlXUb5QHG_?$_+)gzqD7@x4dhV59AYA{JgO<7p
z`{Q9^p%%_@V_Y07cfVkQjrHVT5{9SP@qZH5u58-_090%LNmvfAx0os-Dl}r6-ZP4}
zgZ)C7D%u-#0k3M4f)Zd0Yt`}$qdj+;2)4LkRb(}WY<$}0?&R+j^safiOji)%*Wf>q
z`?EP%;P>(Xko|-pLy$?4$*3k&r&Om_XZT3`T=nM&{xp4zb65jOwHObX4qY3HE__i~
zhH0D(e!VIkm8qyq?U&&$coVE}aMfz1O4#pQzHsk~%K>*QsXw6B{?S~nyYbW)KfNvr
ztg?UQHMO>J)Trc0+{Rs+kjF;_Wcc)rZzNrsk`Loq=Q0ja@IK^MS><e{ni1gQQanz<
zD&lNnGs@KJ#3nZEm#lXUxak*$vYT5rPP{Jbx*y}K@-~TeJH}YuiNz1`odQEL6(erT
zjlsI;PhPiN`d~XYHLY{ZOV9;^BF}|@#rCiE;i87i+1;-hZ$AubI?t5agESQg3^HO9
zOqUdB;t+Pz@96)CzNd2<+u=BJMe5g~%r-<MkPf%@@##MaxtzhHC~nCBg4*y*;S}nU
zfg$Z7Ev@2vMJ>bJ96xl9q$iu(Ez|vHsHjd@yVGboXX8k`?UvmDVS_Egsne~Co*1QC
zwQxRd3x|@vPMu|Wf4snEunWks-q~*j1%@tDX`H;Io&*(@oq~FuWsuC}VC+6J;kcC`
z8+E7M_c1+@s=aOwOObJN)9aJPW2f55b_G^#Ow@Nena*IO!u82E^|Wr*)k#fwIAzWt
zmEI=0b=qs}D|p;q!hgB|tj5&=ZGpD%<FSA$S{2=cc^D=Tt_?|{6JphujIl#}v-#Lc
ztA@CbhN&}0iLhK2sq}Q1lZhHYskxwD*~&x@aq0%kt<E_>^mq`hF_~@Hj(kQjZD>cP
zTquK-P@-x|pwxK2wiy*v>x3b`FRyj?w9}2d$_&aEawjpMy3m@0jn=-J1l!?fm&QrO
zmt8qBE(T9vGxzbsjVjkW7eCF^Bsy+=mznsnI9Q$JIK88Z(I%c|u;)bN*lT_O3u`Q>
z#R7xc#db-?&x{efueV>Np>A(SG?5N(3(|>2oiX263nTHxQdn@rbnvk1WwRydInup@
z(KT+x!szZUHdiXx#E!d`{*x{}A`ow7xH;k-7gxQJMEar&#S;f?%g2h-5^{-U@DE}r
z!L#vZ;1iiBL6||3q|9A;oB6|v^@$Q6MO>qzi@M_OV8sH{aBl;_h#RR;LC~Jk7fPRA
zv2dCG40n1cQ78PcUg>^zH`TolE#T*Fg)Cd|m4lh>SUC2SqIMc@P6ccyA8_4RRT|ql
zqu!fiv})_%Pnu>H=a^FW@UWhuIS9msUY~Fg-f3oaqI8Xv@p_%+u$Xn>32#K$Z}|T=
zXCR7|($)U%9dCF)a{>U^+5emqUwDmf>aetIAoZb%=yF;$ZQAe=`^%Y&FwXE1K7_1D
zuL;~bpYdu0`YpA2ByX3HIIXKXZJteSnWC#-!$4$b!*1U+`6xBCa$=QjrZ+oqw=Y{B
z`Fpwl8u&|rNG5uw3Qi^uemj1?i~M$H`DQdb(Bun84WG7gGsP!3-XktRis9!d%iCb4
z4M{#_Y{ys(O0y$G<4{s?ZFrU}dz6qw!nqgCwhDk`x^y*MPiU)cHL{Cs4*8|AB!7<L
zSzpaskT^~`q$-h$bob-zSGV9i<#vgX;=nKThmR*%II&D#mY(G*V?EoJwL>_X=XVQd
zlVZeKA%`bq!8eiS)Z34K#mFVZoK-z3G%tPd8Gd>@tSCkfv5hpMrYVJo*=5GYa3$@U
zgc^+NxY0XwU%NJ4k1T%>m@ygf$y5D8f_YUx1otDisD?(twwB=5z+A)X564!&mxJzH
zBRVemE_38pv@|o_nh3V%YpLe>g$2Km!&<@DC*L>GhnY5>W~1L={%~Di7+m6?JFeWZ
zmZ?+n8KT$Br7O}_#?ZKAUaKr2u_AdP(Dxkr`7gN#Ak!|n+Cwvh>6#lm{j>Y>v-@}F
zoox&QwnJTvq)vrqXgKtgmsrd#>G{zOAlY(0E!~%;Ws5W-CmqhhoeaPGmqEU5wgQW3
zhv@8&^Qo#mq6az_-}=?+W7_bJ$Xq?nj~QN~BoAs)j-AJq-^dk~d#u;at$nOAu+5;E
zq83o}zP{(%6C9Dubzp_^YtL=%)HjVNcie$1I4!;_XE~ICwb-jPF}8&BoM&h=<8fn}
z_tjCRX3;aP9AFs=cHFD@nxN|3j;uu2<|)Z55`jU8+-RqA4qpeoXKvmy%rs6{+0^pc
zl^O=-og1>$c{Z0pMrK!TnZB9B8rMITP3P=X@pPtf8UDsUbKtC$@4h%a+8NhWdZc!x
zcDvFq$pwDQm1A`5Q}W@`$#pKH<L#Q7Eim^{x2`pmTH*2C5!Km<P$51og-3TsF2^y!
zR0<(a?o|}u>BiN4?t~FFItl%o8uj9$25<kl@!fb+(`s9A&)-)_KBXZf6L399N%f#-
zd(d#$HD<YeGa_-HP^KcaGL^T@V$3$CkeD4eW_GNj2!8Kb+TK+fB>E#MjVn_Lrx54b
zAuW8YEex&trcIObASmt5n><A>jf=}SUtf(#BMVJQ_DIcN*cF(PZ0OO<@S&S{t|xB*
z&?ww@9gWBq!k^_*t69E!p|$z7beG|cep|5I2$O>_chI456SdEWI776eZ&44-#+oKM
zr(T>KoyIbvP{p3t+h!T5q8+Kmc_hfiWVW01vitK7XrGIZ)Y+w`lhn_kYqrl?yI*qF
z$b+(7Jf+U|Ph|r?W#zKccQ;RTmcZ<|>*}eN^=_c#YQ(rm3Hzhoq2Y@{_>?H2DxVRb
z_2$7YhtKbvy}=fvEe@Yw>w<)eApf-GQVUi2m37021r%k+J{8%5gX=r3E(r<a%h)q}
zC(FD6?K;2^L@<Qvg82lg48ovrJ+?VDB(kM4N-*BDE*3_7MN!t>C^J#NX9{9rHYV)^
z&9@{pf`l0`4J@(k=DR!A0g)IecVJ@F2MS>=X8{sx3m@8<Y2YH-nZuY5A<CpJCLzi?
zZi^nWMR$hjbcV4)cv&HrnG?>9e9#RSrPE#XD9}_*hYD}i3|0~^Q1en`yy^|O)}mX1
zc|;v&TJMyWIE^nl=H)tifa=9>*GGkffo_aLkq*Wi)D?FJ;FcR5aCn$oBMD-VmB}h<
zr*Pv2H*g~PaUfgbev>44t*sPO`P2m8?ERX;^Cgcv;Bthv*;_zFF!QAZbkBV8H`!Z*
zQW@+yy=^_;@%(Tjr@70gk$7LAvTgT-#!2>4R%F#6leLWUM5*;t^&MYeqV(XVA<zd+
zPXBtM@;;rC_zf{BqA@l(Cm^#OQvRBs@_Qudud`#!_V!L%!Wen4|3a6*Y;>ZNU)8f@
z@ruU0M3a|9{d^cE;uPf#0cj?$k~>{mO?nj%1rupgl`icc-1zK+n0V%rB9Bvub?vAU
z0V379xLJ>l#gkWNdPHJwa%mZkei2D<$<Z==|3f5Mi3@A^zDXpFBM1BL<6{w&5y+uv
z_V`qS51)KW!FP}!q)XTAIB#AJM-boS3%b98sVuP!?f<4xLfK^kK{2V}4n~HD1|N-=
z2+h7IC8rNHX!4X>bJllxDlP-%Wwh9w1upeuQ%=l|m(Sf-fjm6Lg1q`9L5`fEcv;j6
z`hBq3Zjtkh(>H9$(o^q3m`T0IH*Lhz`*|O|>O@>N;yq8q<C!+T5N-O8az7}%q!|cS
zx%VwXwJmpFH9#fFh?+ilQP}oKst?Y-({X3+(nMgG2lXlX-RlnmkB9A)_<q9q*p@@s
z+XJAFshR10P4*0<-6CQm>(0BDP)@(N$UUpK7b6;|vl@cisx5cmQclb7)@5ME>+L@P
zrJeRR^!dG3HeR=1PbM6A&qTONw;K_RqMY0N7|S0_-y=0;RT5cvIh042Y>Yt9gfUCx
zvsg#o=U+|auhTu)Oov_?T|b+xDcC7*OL89#4!+-m-Mevfa&W;M?9a3*>TzjvH&4En
zd5bCO=7{C#1;q&u_~CMsfjx+|lIWbj?-3HK6r-w<0MU?5ypl&1Ds5kq|A_VYOgooR
z#ZEgiY)H}Q$}G5lMye4Z_deLx<y4vN*gmFWjoc6=Ui>~+;He!UaOAss0kZWCrl-#(
zEUCsCegSH=WEC`m9gB~|fh&Cb&;8^TrqnE~3b*<i1ZO`}bg?EU+BHk3?%QpI{;unB
zB7{5b!xarqjgEBmy$bWv)rSoH+hLT#qMq7%LVfh4a_YO{S(21a87%Zo>%H5^d<CcB
z+dG#9r{Xe5RqjRoj6|N^5+bTNUPSlZ=8AGil<mI$R{iPBm2_K0=#X<U4ypC0^pEl@
z4WK>v>|`m$-^51cn6|#3X+sveaFo{EjU}xeXW#p5wLkHK<PS=o6QI=4H-8(EFSivL
tr~OOC`p`#PX8Rr-r2Y#fC+41%%ewy_4&8atJ*JxMn_|E3wEnlp`X8JI*YE%U

diff --git a/app/assets/icons/icon.png b/app/assets/icons/icon.png
deleted file mode 100644
index de4d5af4ef10c1179068e19417f623723a55b90c..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 5936
zcmbu@c{J4P{{Zl3h)K4(-R$f2K?{>zgr=2AC@IU3kt|`z$dYxseapQ+OBpc=nX-iJ
zJ443R9Swz$ef=_aGua9Gea5}N-#x$oe&>A8an8Iv&wM`T!{>RP_wxHyb7R2+5(fYP
zf*6wvmH=?U<O2J7;g6M|uI~VdtYa>mwF>HA7_#^+!GCvmQB?8LS^n4iMB@&Aq+N}=
zaFF~<m8ZJg&lg9n)bRHEfB98TOYRNzg4m$g{vYRkMFpz(o}<+s(H>Kx(Du-|1~2=K
z9qr+?aF<QD$&|Sizp#S2#eX$TPQIspZA)AK8uSAqL74yKr(+*B{!SPv2g1hBUnx1k
z@FE#vgrFA|1Qo_2q#U1enV`?;gQnu`kG7I`=kIT_Q&e`7otbIAlx<D7mffb-rCq%n
z;ewtjkr1YF)s-}(afgg#H9*QF`^yAv#=@D%#YSkiM?<)!aKU4<{MFI=wZ5g07pQt&
z3@Lbk8X?pyjhQ4#nGw_(F_5s`sovx@%J!|3i6dL~o25ZL70)35Of!sYb3I=gX6ZU9
zQ$}F(tZKrUbWLWPSJt-pWl~pjcVhkFU46zmlC0o&x~xFBN<@Vt`OI8-MJjZ6ur6&P
zO5>TgSo>kW^t=X97c&Usu`<G{B+FtVMmj`C7uWd@)t~e%AF|+sFz@b~J-F7tG%ylw
zveb*q?;bCCvg~43=Wva*VwD^}Z&8vo5!cXX`?OhtebN(!nYEoGh1wgfOulO9#jZEY
zY*fwjVJwl@A6+$dm;$j-gQkQM<18srOfHovyBr=rku^p?KBN-T<aoryQW1|KoMNb+
zkA5<EJj5evToD8RfBYte6*vDZy8R*iSO~tqI6i|>_CECdkoNiC`KoWOjRrSeBV8J~
zviXZR_isAYHfvc>PD5hEVDJa*TJ}W#W8>{34<W%GW#%KSfQUz#%~}z3mj|yRJ2X48
zHq&9jGubkn2<^OMp7hc4v}yNsYq>?v7+$ZoUh3=&JQ&K_FrCHvKz-{|JV8BjlqptX
z>9;4IXD!JCSB<VM2#cOEU_K@2=u{~|{yFQU&^c1%k<E$}aZGLn)8_{E-s?uRNT}xP
zjQ;-T6B+zc622uV$1ooF7Pg<!*dI^gPK}lBgUa(ONm71i8*QXcxS5lby5C`hlxzvd
z8f{b)O4oBeO**QQO_$z9i7CzY5JVL3PJ}(5sEHD_V+QLble&Urq3Ve@k8e_~T5}=6
zp*c)!jm_)h#w~pb84q8sme*cg?K#+1Lx=LSR52nBly<%-<`vTpzYs;nAyK9K9dQJ@
z;!KV!X)pkD?(GoD&4E;6#0W%PnoeLh_mR6g1C$?(YW(X~@KqMT7|y0bqV_~|HUF@$
z>g6GyP5jw<>IyMpV+hNe$yy5_X`=K;d0L-S&siGxCrrF=5wv-@#cX|M^`ObYod#m5
zMw$8pi4$3-0%CuBCXh{XGwM(%%GnTyca~Hvd7`%EfY`%jW^7znNdQzmPU5;WZC>pO
zm1l&ZlyK2&)d87|H9Jx#N&&}ZPCjkYk+h}8XhX^4eho(j#$~9l+LDY>vJ@VfgwvRg
z-;x8zfT|WdIPp?vKQv{pfsRT&5txwi<mF|;5R=PlG`PAH66|Y*>Z`4Y|FwOSg~D*J
zWk&7G?j;xa-d&X@JOI-7KKi5bYkA1L?ehEu{xg57)(5YZv~W#RT88E245@;cf*Ob@
zM73k-V=`x;N_!!+@Zj;lS6y2biq&jO5IhlHy_GRsv2E0+NJg}uH#Ite4#U%Vz_$t1
z^We_6LWZ>6^_*ggQQ3eKa^vX`{ZY-JwU8doFU;jicGPFRL2y#r&Hm#z<hO%zo5g2{
z^+L~TM}=wp+?gVi`Qc#rm+V)}^Wh-W=2>vJdE^m_uaS;TzISrl8d9t;5V^r6UtV%|
zWEQDrxgM5K)ZhJNNxDbqD9wH7cwm9nVz*ND>{YJl&tD1amk%$LH11amAjim>mGDF!
z#N8H&mN$EIUPzYqL0ThLtM&c;X<#>Q>Wmrxh};1i6uH&B9H?H;9po=#tJ5>-*zgvH
zf207VydWfma_Ng+BtK=fRovR6<U!;Cio`NK@#VB;Bp*dTP25o;OE}(u@C@WGXAh2b
z<c6p++Jp|F%i$MTU6yNp+5mh#jZe9&z2N5#^qtd+vl7Z0oe<M0()8q8T{Tdk)X&7$
z>g%kanHQ;nCP06#R{gD8dCwS_uC1e|{^-+*<f7<Sh=+WCmn^go?K7ygRyODxiJ%0=
zN=EE>lh1>8EH%0z9A2nfLICYEbg~p}I2Zj{xIM%zx-neavy=PkCyA(?=~SqG;2Ze4
zp4>-?4Qy~ljyj^mo(_3enhDYT=5>^)ecvHruY2It_}LdnW^G3L20`tIK)Ori%i<h_
z&1-SzQpq~fM1`Or?Z6PK^n60#2UlKPLabPtf90P_yf`#A`b#jj>>)y|{f)Yvn-NQt
z=(L$M+8k`iFq9M}$`75;yqIvmD~pFBZyfVg|2xf<hvFnFR=B_>#T-C4qQnaqSPIEM
z6Ax{EOv3y0;ID#96E*4st&?8n;F4Es72di~Y4a<6AMQiAs;05(48@F(mL#PWFz^M7
zN%S%S^gB79WX!6ZbrgVez^9E=FG>74pmZl)-JsgMmk6$W<Z}+vz?W=-q#`r=;>PK_
z;|Mh;<(TnB9hXi-`%l;DOB;4YW5E4)9_I%Jb#A4Ib`7?8TRIynDM(D*><*H_OL}Pl
zJC8@|hBZP1I8fH*<Q%M37dIg+DL_p8p8n~$_MlNRKQVE@&0crJK@t|#(_VLAO6Lej
z*cj~fF7VX(86;G>dg*osB=ZrQy>#D4vh!m0p<P-fMjFe%C~;9NC1VyFk}DsA?5<jM
zqo8#!IdI&+O-we=!b=7mU;o|r{dW<(6gXb#o>EwFH<_0ho21iiJ$y(K)~VZhA&au$
zmO%EDmUAg+SJ$L(wNTyDVTs19i&hRRAt>qHlFMyAPX)Qq#tZ6`X=#N!Jd}5#W<~2i
zxJNY+E7p--0zjYj%y)MryjUGfS2;#+y&brH9kd_DM(@<0_JWt%;mDYsda4UYmC-x9
z<$bPz;-(|H%h1)~0*1>mi)n*phrslU<S^ME*L4uUQ2Xl?l31q$fMI!Mn=r8U0w8$y
zvSZ|~ev~k}Eq`vDo7N;ELwvPW^;8(VRWSgDfw{2O_tf@w7lA&rI(r?lj=cwhZbzia
z01?$wz@WI7JXWv7P~aB=76!*li<cLQdcn8n(qTa$sj?l`rjY^I#=S<29y@bCY@^U@
zsrMW=?YazEysxhUdj|w%EjWaOQ|=EDqc4O4HW8yC`~skDC5$W!WbAP8bfkmy4>r~w
z1ifCTZh&u(AM+4JzrTqR2K*u-;FkMqSh^}Iptd~*6%L-kv*fuhBp1G%0*ZdYQdhvY
zavmPyk<EU7fS~as-m#4N4}cR(&SV*osB#qKeYCWGva1xu2i}$B@CyS?k)Oa#7rHgz
zM(^JL_q&H}HYUI(LDL}!Y%tDo(Q>yZqyZRB1z%SSF76{fti>*K(}ei<1Ma?Suu^#7
zu}@#O!M!dnE*d(v8`c+&P#iUK<lVImzR@_6>C)dGDGLH>&viXRK~lv%STho`Ai(Yv
z5NmFQ<*F(L1YEj%I1gjBSx!?{fq!RSh!F<lJz2uC=6r|g0jqLP0kDMk<b-dGh`Gp3
zyp)$SgTU4Ca8wAZ`Bwy5A<H8e^m;S^${}o+Fq}kN+!#R?wQyzvHh+-=(`mWy54u0)
zTr&?}Jxb(ADjU9fnDd=U&tP!Mm2-6ye4kU^d*Y1U<w%($7mnU?X7PLCjCpe8#*q(4
zQ?ROV9ElnLKtzHF9sqtEphdxNDhkvI9t5?5?MMUyotpbyPEM9b0DR7#O(%wl9|T(I
zxhJ`o{Ar*)I`_R$&_55gcRM8Kk8|eSI0RNwIS#b{*7s5d1lXzp_YVae*>Thgt71>x
zu(DLdfY$BYEF^JNL;y$>zlWv0C#8hd_BROHRhg_mys?~@vjD%Gg1y)D6&A{tGnNU<
z+=ipyVF~TcHoyv%KL`ZeD(FZsf&`$k&lcWiWskXuudnpL%Q=gq+838YaEkyZCv54f
zt0D&kCN6yz2BNAQ-G*hnCwEwWA_oDlhV}nhbX3mRlJ{{R#xL*!RmtSuxg(Fj-3Xuk
zgPSJK4=-#&7QC?Ei->`nQ#er>;Hm<Fyyh#gbZj|`+ib>Um=8V`f{`@G9rv>c+{N(u
z4sP17oNZ$}4Xa1wXK-_34rK_u{&!aub^ppm`>#B+rW&Vfh|$O18IK;w%Yl_?9%97m
zKU<WIwc+gB&Mz`{@CMF`oVhoG<?LxTbsLPngSUJiXUpTLJiJ7={$VDP$Q0HM@`{7c
zil@{K1bUZ+<QD`MoAQS4!<<87a_bu?YUC(jWekBcBN>ZGf>%LSuFfaz%0|Jr54VH6
z!Z`=gJiC*d=E{+md0UO!7sPaR$c)oJXPPWF2n4gnjf_BE={K-4ShG@gLPVDMs)i&}
z*~1GcZ`an~$7<#%t7F-_e;-)+^!eyW?|%4GmtJqdvyT!1AGN!4iJt-5Vo+mkmsKQ)
zKwC)ZtnGS7apa}Gmc|lI<|4*!{aLl^^Uryng@;de@BXTYfF3U)pg;RkeRq4UR}S3o
zl5zgAnO}JpOlPmsx1*@;@qYyjvaT~HbihHRxyB6+Cx_OfSK*NV1VK@V6`M0U3;=tl
z$JDOuF328y1IHz!VqaLw^lDLVuF*du?3|W$4uXW2x^$#Zy5K%^rjEpTqklIX<22l2
z*kc3U3W%#O7U+SRn=f&|W6U!`a^6q!0P%9Dx0mjKL-K*Yg6D`4Cyed|R7uQ_qH5rt
zbEY}3W52%FBSgDpWX#N$@&;aRN~VrjXZiv*8IHr8Kpn>Ja|dOgLg>puc13-EMf6a!
zzI&kT!}DT;Ve|g`;7TuMJZKwVviMgva7W*18KEYx96iP;|H8WucTPv5F@7P*Y(FhY
zS~FaEgp*-h`YXdIr##YufHR@J7jMByNV5JXA@OLX!<>vB2nZOO+=shRAX&Pwpdk5o
zLK8^#vIG(Vj39i3Y;QKun&%!bkB#lm16mW=#da2j%GGY2TxuC1E?L=cT=DkciI!(d
zci)@O{4}CS%$MMS+uYo06ji$WkaY3y2%Ag=y4wyX8T%~oS28B;PJhCSd+Zwh*?TqB
zOps<8>SiBMxQdbK9RvnVk2FqnH3STd!t{178E`0KAU4SSbm#RDWd>X4H29P4qLYo>
zOu~U5{~iwy=@w6xp{%!xMefWkK<oH$;&6?l>%-t)6cSJ>1H>Qgu&Utjf4V8=jA~$~
z6PS)kroZ~(k<5)~mmG*T+$pUS;z3U>XtP%GT2D)XRR7_m&Sg9DMC^I4cD=x6>63<)
z(n1H&Q}b%WWu!Gd6_8roX4C1Rzt9e>*k!(1U*T#fO<IQNv1897-2EB`SK;UPT}?G+
z3XyqPn#jL0ZjUz);M{vJ3!hIp&(j_}6@5Z`s2}Q)MiIMfZm~Ra7PCm(lg|)ktv<}y
z#7o`gNI{B!fP{sFv7^2h$Y0DX&hQQR_?kPZ>O4J8>C3N;NHukS`ZJ|I7r0cIM@gP}
zdB4R+uX<Jut|o5ytY63WKbuHA&!<MHY)(B<o;3rlOPdqpsvTK&IsSOll8I+rTHZN>
z#g?ASXU_toX=6h?-HFHjQ*`m0m*2Zy^N97orT^~XRoTd|Ry0Ka&4YC!QVjR?y@pZO
z<4Gx3;*n%coe6nB`$pdO2SnK|(_3QuM|mPFFFuHpBUXOTdAnI82V|GhUsZGlB7xx#
zuLxQ8yIYl?EBA95`i+Qgne2Mjgf^8&A*O4v?>nr6YdBS$)ZbOyt_Pmfg5sk*LXl6K
zcktWYvjx&6qjuz*!}4$uh={bG>X_Z?U?QyMO?#@ef?C+|JD)FdSxxA&7s)U09%uNI
z4_tjX$805aU2Q3RWjIAZ*v+R{e>Y9{99HBmYp<QNl?Y2yd@%6`!fy0hbvzW4BOJdy
zzl2blo+5~1B>V~$^%j2OQX0Kq{RlEE3WE#Xy{dPuOo1USdRXmTV6%flj!V8NVOWtT
znzl)3GV$;Yakz<ov{rL7Gq@kFtfTn<uB?m3QR+C*<d9~$vv8R(@|ZV|wnK0;nKkiI
z)*B~q-x|GAeFE|?>VxX3({KS_Hz-KbA3lviRjm*SqP638&%b|VLBjULc2nVIX}O%Y
z`4&s5EeC^{RKl9#F-?p&RqS=AH@Osru~@xKQb1v*GZdK7a9d%3bmz-szSJU{)-ou+
zido4s<oEDg0_%ZiT80x`;9MggvtqjIQAt|&Ic<yEf442PhmA1>RQK063dp6$FbX~>
zMj`4}Qnq7@?emP{H4oAwOrre<wVS5Q`MOyNk``n5GT~FEfU|F2iXO(pOfo*@-q}Wz
zl%sA}NOl8Rkg`K>`)~2gD;P^{Gez5b58)0>vp6ZkBjhBb5_R7u&Zp%?Tt;h|JYx)s
zsG1l%7V*5axItS!r=>3Ljw6YR3J+#^>+$<ki9oCQZSnS+`=?)cy0A?x*#oa8@*2=h
zsj49kq?N+NktqYV=WjE;Jxi@2!u3#otp!O%Le9#gc-{%qK{Qj=`}bQet0kW;<K|Zh
zkaq7CQWUSCs$cQE8Qh-0rrmiOcu;N3dWn53<QhrqA*Ww;lyUOOPYP?MeV*YTPGVF&
zO*b!;W1k!mtiG|<CDLR{nsxUh`H%*+KG<X?yRf|iqM;mCV*L%g59!1c$u{52`9mW#
zWsEf5f%G&!WvTm*;d&RgRUiMH6hCIxvE|I<kfTu*Gp?a`uT!_49){_thr67{o73I0
zBm<pO?^dhw#zJj7wJR#2yP5f_j>7~s#yUnuA}@cnDDO){iK{2x5n~z8=^aA+7;mxK
zf0~C9TNZp3N}DwT8M5&z;_WfE$0M@%nQcMuBB*4jyxNSpJVuUy!ju>mG6J{srz4I>
z+(fpd4Ji$nkh&6vRZm_{HYJpW#(i3PS}MDO`*`MPeNPl~-N^cf%5b?Vgb8DPUea4W
z9semY;;>QNL`T}AB@fboYMA`L8<#w(cH#NT&4pnV+qbe>*k&Y1@XO03)%(|(><{F~
z`2vl5<oeev^n<N|VyG!TMMXB)@Bh`i9loXfAGMH48I09k@NMfFCF;n61l$P+n2Y8Y
J3eMqv{clyn`@R4G

diff --git a/app/crates/vn-shell-core/Cargo.toml b/app/crates/vn-shell-core/Cargo.toml
index be557c6..05aa8f0 100644
--- a/app/crates/vn-shell-core/Cargo.toml
+++ b/app/crates/vn-shell-core/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "vn-shell-core"
-description = "The vncode shell's pure half: the ready line, the window record, the key layers, the payload container, the launch decision."
+description = "The vncode shell's pure half: the home ladders, the key layers, the ready line, the pin and the flags."
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -9,5 +9,3 @@ rust-version.workspace = true
 
 [dependencies]
 serde_json.workspace = true
-flate2.workspace = true
-url.workspace = true
diff --git a/app/crates/vn-shell-core/src/adopt.rs b/app/crates/vn-shell-core/src/adopt.rs
deleted file mode 100644
index 9be3d82..0000000
--- a/app/crates/vn-shell-core/src/adopt.rs
+++ /dev/null
@@ -1,461 +0,0 @@
-//! Adopt: what this app may copy out of a home it did not create.
-//!
-//! The app's own home starts empty, while the user's real installation - sessions,
-//! skills, the model key - is usually in the harness's default `~/.dsh`. **Adopt** is
-//! the one-click answer: copy the durable, SMALL things into the home the app proved
-//! it can write, and never the caches.
-//!
-//! Three rules, and they are the whole module:
-//!
-//! 1. **Nothing is written into the source.** Adopt reads from it and writes into the
-//!    home it proved it can write; a source that cannot be read offers no Adopt at
-//!    all (see [`Offer`]).
-//! 2. **The caches are never adopted.** `docs/PATHS.md` puts ceilings on them (512
-//!    MiB of PDF artifacts, 200 MiB of diagram artifacts, up to 8 GiB of playable
-//!    media) and every byte of them is reproducible, so copying them would turn a
-//!    one-click gesture into a multi-gigabyte one for nothing.
-//! 3. **`profiles/` is never adopted either**, because the panel's own Install button
-//!    re-creates it from this checkout: copying it would fight the installer.
-//!
-//! The credentials file is the deliberate exception to "copy the durable things",
-//! and it is a separate gesture: `SECURITY.md` promises this app touches that file
-//! for PRESENCE only, and a byte-for-byte copy is the only form of "copy" that keeps
-//! that promise - the value is never parsed, never held in a `KeyState`, never drawn.
-
-use std::path::{Path, PathBuf};
-
-/// The durable, small things Adopt copies, in the order the panel lists them.
-pub const DURABLE: [(&str, &str); 4] = [
-    ("skills", "the skills the harness loads, including the ones this pack copies"),
-    ("sessions", "one file per conversation - the durable transcript"),
-    ("storages", "workspace.json and the session projection caches"),
-    ("attachments", "files pasted or attached into a conversation"),
-];
-
-/// The pack's caches and the composed profile: never adopted, and the reason why.
-pub const NEVER: [(&str, &str); 4] = [
-    ("profiles", "re-created by the Install button, so copying it would fight the installer"),
-    ("dsh-pdf", "a cache with a 512 MiB ceiling - reproducible"),
-    ("dsh-diagrams", "a cache with a 200 MiB ceiling - reproducible"),
-    ("dsh-media", "up to 8 GiB of provisioned binaries and playable media - reproducible"),
-];
-
-/// The harness's own credential document, inside a home.
-pub const CREDENTIALS: &str = ".credentials.yaml";
-
-/// One thing to copy.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Item {
-    pub name: &'static str,
-    pub note: &'static str,
-    pub from: PathBuf,
-    pub to: PathBuf,
-}
-
-/// What an Adopt run would do: where from, where to, and what.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Adoption {
-    pub source: PathBuf,
-    pub target: PathBuf,
-    pub items: Vec<Item>,
-}
-
-impl Adoption {
-    /// The source's own credential document, when it has one.
-    ///
-    /// Never part of [`Adoption::items`]: it is the second, separate click.
-    pub fn credential(&self) -> Option<PathBuf> {
-        let path = self.source.join(CREDENTIALS);
-        path.is_file().then_some(path)
-    }
-
-    /// One line naming what will be copied, for the log.
-    pub fn line(&self) -> String {
-        if self.items.is_empty() {
-            return format!(
-                "there is nothing to adopt from {} - it has none of {}",
-                self.source.display(),
-                names()
-            );
-        }
-        format!(
-            "adopting {} from {} into {}",
-            self.items
-                .iter()
-                .map(|item| item.name)
-                .collect::<Vec<_>>()
-                .join(", "),
-            self.source.display(),
-            self.target.display()
-        )
-    }
-}
-
-/// `skills, sessions, storages, attachments`.
-fn names() -> String {
-    let mut names = DURABLE.iter().map(|(name, _)| *name).collect::<Vec<_>>();
-    let last = names.pop().unwrap_or_default();
-    format!("{} or {}", names.join(", "), last)
-}
-
-/// Whether a directory has anything in it at all, without reading any of it.
-fn has_content(path: &Path) -> bool {
-    std::fs::read_dir(path).map(|mut entries| entries.next().is_some()).unwrap_or(false)
-}
-
-/// Whether a credentials document holds anything, by SIZE - never by reading it.
-///
-/// `SECURITY.md` promises this app touches that file for presence only. A length is
-/// presence: it answers "is there a key here" without a byte of the value reaching
-/// this process, and that is exactly the question the offer needs. The harness writes
-/// an empty `.credentials.yaml` into a fresh home on its first boot, so counting mere
-/// existence as "yours" would close the offer for the one thing a person wants most.
-fn credentials_have_content(path: &Path) -> bool {
-    std::fs::metadata(path).map(|meta| meta.len() > 0).unwrap_or(false)
-}
-
-/// Whether a home holds nothing of YOURS yet.
-///
-/// "Yours" is what a person accumulates and what only they can replace: skills, the
-/// session transcripts, and a credentials file with CONTENT. The harness's own
-/// furniture does not count - it composes `profiles/<name>/`, writes an empty
-/// `.credentials.yaml` and a `storages/` into a fresh home on its very first boot.
-///
-/// This is the guard for a decision with real consequences: **using an installation
-/// that is already on the machine** (see `home::Origin::Found`). It is what keeps that
-/// from ever overriding a home somebody has actually used.
-pub fn home_is_untouched_by_a_person(home: &Path) -> bool {
-    !has_content(&home.join("skills"))
-        && !has_content(&home.join("sessions"))
-        && !credentials_have_content(&home.join(CREDENTIALS))
-}
-
-/// Whether the credentials document would actually be brought across: the source has one
-/// with CONTENT and the target's is absent or empty.
-///
-/// Public because two places must agree about it and neither may guess: the offer itself
-/// ([`target_has_room_for`]) and the first-run card's own facts, which used to advertise
-/// "your key, if you tick it" beside a red sentence saying there was nothing left to
-/// bring - measured on a machine where the key sat in both homes. A file SIZE on both
-/// sides, and never a read, so the presence-only rule stands.
-pub fn credentials_can_be_brought(source: &Path, target: &Path) -> bool {
-    credentials_have_content(&source.join(CREDENTIALS))
-        && !credentials_have_content(&target.join(CREDENTIALS))
-}
-
-/// Whether there is anything left to bring across - the rule that decides whether the
-/// panel offers Adopt at all.
-///
-/// It used to be `!target.join("profiles").exists()`, and both halves of that were
-/// wrong in the same way: the harness composes `profiles/` on its FIRST boot AND
-/// writes an empty `.credentials.yaml` and a `storages/` beside it, so a home the app
-/// created stopped looking "untouched" after one run - and the key and sessions a
-/// person most wants to bring across could never be offered again. Measured against a
-/// real run: the profile held only the base bundles, the panel said `DeepSeek key: not
-/// found`, and there was no button to press.
-///
-/// The honest rule is what Adopt itself promises: **something to bring, and nothing
-/// to overwrite**. A durable tree counts when the source has it and the target has
-/// nothing there (or nothing in it); the credential document counts when the source
-/// has one with content and the target's is absent or empty.
-pub fn target_has_room_for(source: &Path, target: &Path) -> bool {
-    DURABLE.iter().any(|(name, _)| {
-        let from = source.join(name);
-        from.exists() && !has_content(&target.join(name))
-    }) || credentials_can_be_brought(source, target)
-}
-
-/// Whether the source can be read at all. A source that cannot is not adopted
-/// quietly: the panel says so and offers nothing.
-pub fn source_is_readable(source: &Path) -> bool {
-    std::fs::read_dir(source).is_ok()
-}
-
-/// What the panel should offer, decided from two paths and the filesystem.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum Offer {
-    /// Nothing to offer: the ordinary first run with no other home on the machine, or
-    /// a home that already has everything this one could bring.
-    Nothing,
-    /// Adopt is available, with this list.
-    Available(Adoption),
-    /// There IS another home, and it cannot be read - which the panel says out loud
-    /// rather than showing a button that would fail.
-    Unreadable(PathBuf),
-}
-
-/// Decide the offer from the source (usually `~/.dsh`) and the chosen home.
-///
-/// The source is deliberately NOT filtered by writability, and that is a bug this
-/// wiring had: `Use it` needs a home a child can write in, but **Adopt exists exactly
-/// for the home that cannot be written** - it only has to be READ. Passing the
-/// writable-filtered path here meant a person whose `~/.dsh` was unwritable got
-/// neither button, which is the worst of both.
-pub fn offer(source: Option<&Path>, home: Option<&Path>) -> Offer {
-    let (Some(source), Some(home)) = (source, home) else {
-        return Offer::Nothing;
-    };
-    if !source.is_dir() {
-        return Offer::Nothing;
-    }
-    if !source_is_readable(source) {
-        return Offer::Unreadable(source.to_path_buf());
-    }
-    if !target_has_room_for(source, home) {
-        return Offer::Nothing;
-    }
-    let adoption = plan(source, home);
-    if adoption.items.is_empty() && adoption.credential().is_none() {
-        Offer::Nothing
-    } else {
-        Offer::Available(adoption)
-    }
-}
-
-/// Build the list of things to copy: the durable trees the source has and the target
-/// has nothing of. The copy itself never overwrites, so this is about the OFFER - a
-/// tree already present is not something to advertise.
-pub fn plan(source: &Path, target: &Path) -> Adoption {
-    let mut items = Vec::new();
-    for (name, note) in DURABLE {
-        let from = source.join(name);
-        if !from.exists() || has_content(&target.join(name)) {
-            continue;
-        }
-        items.push(Item {
-            name,
-            note,
-            from: from.clone(),
-            to: target.join(name),
-        });
-    }
-    Adoption { source: source.to_path_buf(), target: target.to_path_buf(), items }
-}
-
-/// The bytes a directory tree holds, walking at most `budget` entries.
-///
-/// The same bounded walk the location map uses, for the same reason: a cache with a
-/// million tiny files must not freeze the window while the panel asks how big it is.
-/// `None` means "nothing there"; the caller shows a `+` when the budget was reached.
-pub fn size_of(root: &Path, budget: usize) -> Option<(u64, bool)> {
-    if !root.exists() {
-        return None;
-    }
-    let mut total = 0u64;
-    let mut seen = 0usize;
-    let mut capped = false;
-    let mut stack = vec![root.to_path_buf()];
-    while let Some(directory) = stack.pop() {
-        let Ok(entries) = std::fs::read_dir(&directory) else {
-            continue;
-        };
-        for entry in entries.flatten() {
-            seen += 1;
-            if seen > budget {
-                capped = true;
-                break;
-            }
-            let Ok(meta) = entry.metadata() else {
-                continue;
-            };
-            if meta.is_dir() {
-                stack.push(entry.path());
-            } else {
-                total += meta.len();
-            }
-        }
-        if capped {
-            break;
-        }
-    }
-    Some((total, capped))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn scratch(name: &str) -> PathBuf {
-        let root = match std::env::var_os("VNCODE_TEST_DIR") {
-            Some(value) if !value.is_empty() => PathBuf::from(value),
-            _ => std::env::temp_dir(),
-        };
-        let path = root.join(format!("vncode-adopt-{}-{name}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&path);
-        std::fs::create_dir_all(&path).unwrap();
-        path
-    }
-
-    #[test]
-    fn only_the_durable_small_things_are_planned_and_only_what_exists() {
-        let root = scratch("plan");
-        let source = root.join(".dsh");
-        let target = root.join("home");
-        for name in ["skills", "sessions", "dsh-media", "dsh-pdf"] {
-            std::fs::create_dir_all(source.join(name)).unwrap();
-        }
-        std::fs::create_dir_all(&target).unwrap();
-        let adoption = plan(&source, &target);
-        let names: Vec<&str> = adoption.items.iter().map(|item| item.name).collect();
-        assert_eq!(names, vec!["skills", "sessions"], "{names:?}");
-        // The caches are NOT planned, and neither is the composed profile.
-        for never in ["dsh-media", "dsh-pdf", "profiles"] {
-            assert!(!names.contains(&never), "{never} was planned for adoption");
-        }
-        assert!(adoption.line().contains("skills, sessions"), "{}", adoption.line());
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn the_credentials_file_is_not_an_item_and_is_offered_separately() {
-        let root = scratch("credentials");
-        let source = root.join(".dsh");
-        std::fs::create_dir_all(source.join("skills")).unwrap();
-        std::fs::write(source.join(CREDENTIALS), b"deepseek: {apiKey: placeholder}\n").unwrap();
-        let adoption = plan(&source, &root.join("home"));
-        assert!(adoption.items.iter().all(|item| item.name != CREDENTIALS));
-        assert_eq!(adoption.credential(), Some(source.join(CREDENTIALS)));
-        // ...and a home with no credentials file offers none.
-        let bare = scratch("bare");
-        std::fs::create_dir_all(bare.join(".dsh").join("skills")).unwrap();
-        assert_eq!(plan(&bare.join(".dsh"), &bare.join("home")).credential(), None);
-        let _ = std::fs::remove_dir_all(&root);
-        let _ = std::fs::remove_dir_all(&bare);
-    }
-
-    #[test]
-    fn adopt_is_offered_whenever_there_is_something_left_to_bring() {
-        let root = scratch("offer");
-        let source = root.join(".dsh");
-        std::fs::create_dir_all(source.join("sessions")).unwrap();
-        std::fs::write(source.join("sessions").join("c1.json"), b"{}").unwrap();
-        std::fs::create_dir_all(source.join("skills")).unwrap();
-        std::fs::write(source.join(CREDENTIALS), b"deepseek: {apiKey: x}\n").unwrap();
-        let target = root.join("home");
-        std::fs::create_dir_all(&target).unwrap();
-
-        assert!(matches!(offer(Some(&source), Some(&target)), Offer::Available(_)));
-
-        // A home the harness has already booted in is STILL offered. It composes
-        // `profiles/`, an EMPTY `.credentials.yaml` and a `storages/` by itself, so
-        // counting any of those as "yours" is how a person's key and sessions stopped
-        // being offered after one run - measured: the log said `DeepSeek key: not
-        // found` while the key sat in `~/.dsh`, with no button to press.
-        std::fs::create_dir_all(target.join("profiles").join("web")).unwrap();
-        std::fs::create_dir_all(target.join("storages")).unwrap();
-        std::fs::write(target.join(CREDENTIALS), b"").unwrap();
-        assert!(
-            matches!(offer(Some(&source), Some(&target)), Offer::Available(_)),
-            "a composed profile and an EMPTY credentials file must not close the offer"
-        );
-
-        // Both trees land, and the key is still the separate click.
-        let available = match offer(Some(&source), Some(&target)) {
-            Offer::Available(adoption) => adoption,
-            other => panic!("expected an offer, got {other:?}"),
-        };
-        let names: Vec<&str> = available.items.iter().map(|item| item.name).collect();
-        assert_eq!(names, vec!["skills", "sessions"], "{names:?}");
-        assert!(available.credential().is_some(), "the key must still be on offer");
-
-        // A home that already HAS them has nothing left to offer - which is what
-        // keeps the panel from nagging - and a target tree with content is not
-        // advertised even while the other one is.
-        std::fs::create_dir_all(target.join("skills")).unwrap();
-        std::fs::write(target.join("skills").join("a.md"), b"#").unwrap();
-        let available = match offer(Some(&source), Some(&target)) {
-            Offer::Available(adoption) => adoption,
-            other => panic!("sessions are still missing: {other:?}"),
-        };
-        assert_eq!(
-            available.items.iter().map(|item| item.name).collect::<Vec<_>>(),
-            vec!["sessions"]
-        );
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn a_fresh_home_is_untouched_even_after_the_harness_has_booted_in_it() {
-        let root = scratch("untouched");
-        let home = root.join("home");
-        std::fs::create_dir_all(&home).unwrap();
-        assert!(home_is_untouched_by_a_person(&home), "an empty home is untouched");
-        // What the harness writes by itself must not change that answer.
-        std::fs::create_dir_all(home.join("profiles").join("web")).unwrap();
-        std::fs::create_dir_all(home.join("storages")).unwrap();
-        std::fs::write(home.join(CREDENTIALS), b"").unwrap();
-        assert!(
-            home_is_untouched_by_a_person(&home),
-            "a composed profile, storages and an EMPTY credentials file are the harness's own"
-        );
-        // What a PERSON leaves there does.
-        std::fs::write(home.join(CREDENTIALS), b"deepseek: {apiKey: x}\n").unwrap();
-        assert!(!home_is_untouched_by_a_person(&home), "a key with content is yours");
-        std::fs::write(home.join(CREDENTIALS), b"").unwrap();
-        std::fs::create_dir_all(home.join("sessions")).unwrap();
-        std::fs::write(home.join("sessions").join("c1.json"), b"{}").unwrap();
-        assert!(!home_is_untouched_by_a_person(&home), "a transcript is yours");
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn a_target_with_its_own_session_and_key_has_nothing_left_to_bring() {
-        let root = scratch("nothing-left");
-        let source = root.join(".dsh");
-        std::fs::create_dir_all(source.join("sessions")).unwrap();
-        std::fs::write(source.join("sessions").join("old.json"), b"{}").unwrap();
-        std::fs::write(source.join(CREDENTIALS), b"deepseek: {apiKey: old}\n").unwrap();
-        let target = root.join("home");
-        std::fs::create_dir_all(target.join("sessions")).unwrap();
-        std::fs::write(target.join("sessions").join("mine.json"), b"{}").unwrap();
-        std::fs::write(target.join(CREDENTIALS), b"deepseek: {apiKey: mine}\n").unwrap();
-        assert_eq!(offer(Some(&source), Some(&target)), Offer::Nothing);
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn a_source_that_cannot_be_read_offers_nothing_and_says_so() {
-        let root = scratch("unreadable");
-        // A FILE where a home should be: it exists, so Adopt is considered, and it is
-        // not a directory, so there is nothing to adopt and nothing to promise.
-        let not_a_home = root.join(".dsh");
-        std::fs::write(&not_a_home, b"not a directory").unwrap();
-        let target = root.join("home");
-        std::fs::create_dir_all(&target).unwrap();
-        assert_eq!(offer(Some(&not_a_home), Some(&target)), Offer::Nothing);
-        // No source at all (a first run on a clean machine) is also nothing.
-        assert_eq!(offer(None, Some(&target)), Offer::Nothing);
-        assert_eq!(offer(Some(&root.join("absent")), Some(&target)), Offer::Nothing);
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn a_home_with_none_of_the_durable_trees_has_nothing_to_offer() {
-        let root = scratch("empty-source");
-        let source = root.join(".dsh");
-        std::fs::create_dir_all(source.join("cache")).unwrap();
-        let target = root.join("home");
-        std::fs::create_dir_all(&target).unwrap();
-        assert_eq!(offer(Some(&source), Some(&target)), Offer::Nothing);
-        assert!(plan(&source, &target).line().contains("nothing to adopt"));
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn the_size_walk_is_bounded_and_says_when_it_stopped() {
-        let root = scratch("size");
-        let tree = root.join("sessions");
-        std::fs::create_dir_all(&tree).unwrap();
-        for index in 0..8 {
-            std::fs::write(tree.join(format!("s{index}.json")), b"0123456789").unwrap();
-        }
-        let (bytes, capped) = size_of(&tree, 100).unwrap();
-        assert_eq!(bytes, 80);
-        assert!(!capped);
-        // A budget smaller than the tree reports the cap rather than a wrong total.
-        let (_, capped) = size_of(&tree, 3).unwrap();
-        assert!(capped, "the walk did not report that it stopped early");
-        assert_eq!(size_of(&root.join("absent"), 100), None);
-        let _ = std::fs::remove_dir_all(&root);
-    }
-}
diff --git a/app/crates/vn-shell-core/src/appprefs.rs b/app/crates/vn-shell-core/src/appprefs.rs
deleted file mode 100644
index 4767f8d..0000000
--- a/app/crates/vn-shell-core/src/appprefs.rs
+++ /dev/null
@@ -1,350 +0,0 @@
-//! The app's own small preferences: which browser shows the harness, and which home
-//! the person chose.
-//!
-//! It lives in the APP ROOT (`<root>/prefs.json`), not in the harness home, and that
-//! is the whole reason it can exist: the home is one of the things this file decides,
-//! so the record of that decision cannot live inside it. The window record moved here
-//! for the same reason - see `appdata.rs`'s header.
-//!
-//! ## Two rules, and they are `windowstate`'s
-//!
-//! 1. **A record this build cannot vouch for is DISCARDED, never repaired.** A
-//!    malformed file, a version this build does not know, a browser id that is not in
-//!    the table, a home path that is empty: each one is simply absent, and the app
-//!    falls back to what it would have done on a first run. Repairing somebody's
-//!    preferences is a bigger promise than reading them.
-//! 2. **It is written atomically**: a temporary file beside it, then a rename, so a
-//!    crash mid-write leaves the old record rather than half of a new one.
-//!
-//! ## Which root it is read from, and why that is one root and not two
-//!
-//! The record is written into **the root the ladder chose** - the same root as the
-//! window geometry, the npm cache and the home - so a portable folder, a confined run
-//! and an ordinary install all remember the person's answer in the place that answer
-//! belongs to. [`AppPrefs::load_from`] takes that root first and one FALLBACK second,
-//! read only: the platform's own data directory, where every version before this one
-//! wrote the file. Without the fallback, a person whose ladder had already fallen
-//! through to `<tree>/.vncode` would have lost the home they chose - which is the
-//! measured bug this exists for: the file was written under `%LOCALAPPDATA%` while the
-//! root in use was beside the checkout, so the choice could never be read back and the
-//! first-run question returned on every launch.
-
-use std::path::{Path, PathBuf};
-
-use crate::browser;
-use crate::userpath;
-
-/// The file, inside the app root.
-pub const FILENAME: &str = "prefs.json";
-
-/// The record's shape. A different number is a record this build does not read.
-pub const VERSION: u64 = 1;
-
-/// What the app remembers between runs.
-#[derive(Clone, Debug, Default, PartialEq, Eq)]
-pub struct AppPrefs {
-    /// A browser id from [`browser::known_ids`], or `None` for "the first one found".
-    pub browser: Option<String>,
-    /// The home the person chose in the panel, absolute and normalised. `None` means
-    /// the ladder decides, which is the ordinary case.
-    pub home: Option<PathBuf>,
-}
-
-/// What one root's `prefs.json` is.
-enum Read {
-    /// No file there at all: the next candidate may answer.
-    Absent,
-    /// A file this build cannot vouch for. The search STOPS: an older root's record
-    /// must not stand in for one somebody has already written over.
-    Unusable,
-    Ok(AppPrefs),
-}
-
-impl AppPrefs {
-    /// Read the record, or an empty one when there is nothing usable there.
-    ///
-    /// Never fails: a preferences file is a convenience, and an app that refused to
-    /// start because its own convenience file was corrupt would be a worse app.
-    pub fn load(root: Option<&Path>) -> AppPrefs {
-        Self::load_from(root, None).0
-    }
-
-    /// Read the record from the root the LADDER chose, falling back to a second root,
-    /// and say which of the two answered.
-    ///
-    /// The fallback exists for exactly one migration, and it is a real one: the app used
-    /// to write this file into `appdata::app_root()` (the platform's data directory)
-    /// while the window record went into the ladder's root - so on a machine whose
-    /// ladder fell through to `<tree>/.vncode` the chosen home was written where the
-    /// next run could not read it, and the first-run question came back every launch.
-    /// Reading the platform copy once keeps that person's answer; the moment the panel
-    /// saves, the record lands in the ladder's own root, and the fallback goes quiet.
-    ///
-    /// Nothing is ever written into the fallback: it is read, and that is all.
-    pub fn load_from(primary: Option<&Path>, fallback: Option<&Path>) -> (AppPrefs, Option<PathBuf>) {
-        let mut candidates: Vec<&Path> = Vec::new();
-        if let Some(root) = primary {
-            candidates.push(root);
-        }
-        if let Some(root) = fallback.filter(|fallback| Some(*fallback) != primary) {
-            candidates.push(root);
-        }
-        for root in candidates {
-            match Self::read(root) {
-                Read::Ok(prefs) => return (prefs, Some(root.to_path_buf())),
-                // A record this build cannot vouch for is DISCARDED, never repaired -
-                // and never replaced by an older root's record either: that would
-                // resurrect a choice somebody has already overwritten.
-                Read::Unusable => return (AppPrefs::default(), Some(root.to_path_buf())),
-                Read::Absent => continue,
-            }
-        }
-        (AppPrefs::default(), None)
-    }
-
-    /// What one root's record is: absent, there but unusable, or usable.
-    fn read(root: &Path) -> Read {
-        let Ok(text) = std::fs::read_to_string(root.join(FILENAME)) else {
-            return Read::Absent;
-        };
-        let Ok(json) = serde_json::from_str::<serde_json::Value>(&text) else {
-            return Read::Unusable;
-        };
-        if json.get("version").and_then(serde_json::Value::as_u64) != Some(VERSION) {
-            return Read::Unusable;
-        }
-        Read::Ok(AppPrefs {
-            browser: json
-                .get("browser")
-                .and_then(serde_json::Value::as_str)
-                .map(str::trim)
-                .filter(|id| browser::known_ids().contains(id))
-                .map(str::to_string),
-            home: json
-                .get("home")
-                .and_then(serde_json::Value::as_str)
-                .map(str::trim)
-                .filter(|path| !path.is_empty())
-                .map(PathBuf::from)
-                .filter(|path| userpath::is_plausible(path)),
-        })
-    }
-
-    /// Write the record, atomically, creating the app root if it is not there.
-    pub fn save(&self, root: &Path) -> Result<(), String> {
-        std::fs::create_dir_all(root)
-            .map_err(|error| format!("could not create {}: {error}", root.display()))?;
-        let mut json = serde_json::Map::new();
-        json.insert("version".to_string(), serde_json::Value::from(VERSION));
-        json.insert(
-            "browser".to_string(),
-            match &self.browser {
-                Some(id) => serde_json::Value::from(id.as_str()),
-                None => serde_json::Value::Null,
-            },
-        );
-        json.insert(
-            "home".to_string(),
-            match &self.home {
-                Some(path) => serde_json::Value::from(path.to_string_lossy().to_string()),
-                None => serde_json::Value::Null,
-            },
-        );
-        let text = serde_json::Value::Object(json).to_string();
-        let target = root.join(FILENAME);
-        // Beside the target, so the rename is within one directory and therefore
-        // atomic on every platform this ships on.
-        let temporary = root.join(format!("{FILENAME}.tmp-{}", std::process::id()));
-        std::fs::write(&temporary, text.as_bytes())
-            .map_err(|error| format!("could not write {}: {error}", temporary.display()))?;
-        match std::fs::rename(&temporary, &target) {
-            Ok(()) => Ok(()),
-            Err(error) => {
-                let _ = std::fs::remove_file(&temporary);
-                Err(format!("could not replace {}: {error}", target.display()))
-            }
-        }
-    }
-
-    /// Remember a browser by id. An id this build does not know is refused rather
-    /// than stored: a preferences file must not be able to name a program.
-    pub fn set_browser(&mut self, id: &str) -> bool {
-        let id = id.trim();
-        if !browser::known_ids().contains(&id) {
-            return false;
-        }
-        self.browser = Some(id.to_string());
-        true
-    }
-
-    /// Remember a home, resolved and normalised.
-    pub fn set_home(&mut self, typed: &str, cwd: Option<&Path>) -> Result<(), String> {
-        let resolved = userpath::resolve(typed, cwd, crate::home::home_dir().as_deref())?;
-        self.home = Some(resolved);
-        Ok(())
-    }
-
-    /// Forget the remembered home, so the ladder decides again.
-    pub fn clear_home(&mut self) {
-        self.home = None;
-    }
-
-    /// The line the panel and the log draw.
-    pub fn line(&self) -> String {
-        format!(
-            "browser={} · home={}",
-            self.browser.as_deref().unwrap_or("the first one found"),
-            self.home
-                .as_deref()
-                .map(|path| path.display().to_string())
-                .unwrap_or_else(|| "chosen by the ladder".to_string())
-        )
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn scratch(name: &str) -> PathBuf {
-        let root = match std::env::var_os("VNCODE_TEST_DIR") {
-            Some(value) if !value.is_empty() => PathBuf::from(value),
-            _ => std::env::temp_dir(),
-        };
-        let path = root.join(format!("vncode-prefs-{}-{name}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&path);
-        std::fs::create_dir_all(&path).unwrap();
-        path
-    }
-
-    #[test]
-    fn what_is_written_is_what_is_read_back() {
-        let root = scratch("round-trip");
-        let mut prefs = AppPrefs::default();
-        assert!(prefs.set_browser("firefox"));
-        prefs.set_home("/tmp/chosen-home", None).unwrap();
-        prefs.save(&root).unwrap();
-        assert_eq!(AppPrefs::load(Some(&root)), prefs);
-        // ...and no temporary file is left beside it.
-        let left: Vec<String> = std::fs::read_dir(&root)
-            .unwrap()
-            .flatten()
-            .map(|entry| entry.file_name().to_string_lossy().to_string())
-            .collect();
-        assert_eq!(left, vec![FILENAME.to_string()], "{left:?}");
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn a_record_this_build_cannot_vouch_for_is_discarded_not_repaired() {
-        let root = scratch("discard");
-        let write = |text: &str| std::fs::write(root.join(FILENAME), text).unwrap();
-
-        write("not json at all");
-        assert_eq!(AppPrefs::load(Some(&root)), AppPrefs::default());
-
-        // A version this build does not read.
-        write(r#"{"version":99,"browser":"firefox","home":"/tmp/x"}"#);
-        assert_eq!(AppPrefs::load(Some(&root)), AppPrefs::default());
-
-        // A browser this build does not know, and a home that is not a path: each
-        // field is dropped on its own, so the good part still survives.
-        write(r#"{"version":1,"browser":"netscape","home":"   "}"#);
-        assert_eq!(AppPrefs::load(Some(&root)), AppPrefs::default());
-        write(r#"{"version":1,"browser":"brave","home":"/tmp/ok"}"#);
-        let prefs = AppPrefs::load(Some(&root));
-        assert_eq!(prefs.browser.as_deref(), Some("brave"));
-        assert_eq!(prefs.home.as_deref(), Some(Path::new("/tmp/ok")));
-
-        // No file at all, and no root at all, are both the default.
-        std::fs::remove_file(root.join(FILENAME)).unwrap();
-        assert_eq!(AppPrefs::load(Some(&root)), AppPrefs::default());
-        assert_eq!(AppPrefs::load(None), AppPrefs::default());
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn the_record_is_read_from_the_ladder_root_and_only_falls_back_when_it_is_absent() {
-        // The migration this exists for: the ladder's root is `<tree>/.vncode` and the
-        // chosen home was written into the platform root by an older build. Reading the
-        // fallback keeps the answer, and the root it came from is reported so the panel
-        // knows where this run will save.
-        let tree = scratch("fallback-tree");
-        let platform = scratch("fallback-platform");
-        std::fs::create_dir_all(&tree).unwrap();
-        std::fs::create_dir_all(&platform).unwrap();
-        let mut older = AppPrefs::default();
-        older.set_home("/tmp/from-the-platform-root", None).unwrap();
-        older.save(&platform).unwrap();
-
-        let (prefs, from) = AppPrefs::load_from(Some(&tree), Some(&platform));
-        assert_eq!(prefs.home.as_deref(), Some(Path::new("/tmp/from-the-platform-root")));
-        assert_eq!(from.as_deref(), Some(platform.as_path()));
-        // ...and nothing was written into the fallback, or into the tree, by reading.
-        assert!(!tree.join(FILENAME).exists());
-
-        // A record in the ladder's own root WINS, and the fallback is not consulted.
-        let mut current = AppPrefs::default();
-        current.set_home("/tmp/from-the-ladder-root", None).unwrap();
-        current.save(&tree).unwrap();
-        let (prefs, from) = AppPrefs::load_from(Some(&tree), Some(&platform));
-        assert_eq!(prefs.home.as_deref(), Some(Path::new("/tmp/from-the-ladder-root")));
-        assert_eq!(from.as_deref(), Some(tree.as_path()));
-
-        // A record the build cannot vouch for STOPS the search: the older root's answer
-        // must not stand in for one that was already written over.
-        std::fs::write(tree.join(FILENAME), b"{ this is not a record }").unwrap();
-        let (prefs, from) = AppPrefs::load_from(Some(&tree), Some(&platform));
-        assert_eq!(prefs, AppPrefs::default());
-        assert_eq!(from.as_deref(), Some(tree.as_path()));
-
-        // With no primary root at all, the fallback still answers - which is the case
-        // where the ladder found nothing writable and the app has no memory.
-        std::fs::remove_file(tree.join(FILENAME)).unwrap();
-        let (prefs, from) = AppPrefs::load_from(None, Some(&platform));
-        assert_eq!(prefs.home.as_deref(), Some(Path::new("/tmp/from-the-platform-root")));
-        assert_eq!(from.as_deref(), Some(platform.as_path()));
-        let _ = std::fs::remove_dir_all(&tree);
-        let _ = std::fs::remove_dir_all(&platform);
-    }
-
-    #[test]
-    fn a_preferences_file_can_never_name_a_program() {
-        // The security property: the only thing stored is an ID the table already
-        // holds, so a hand-edited `prefs.json` cannot make the app run an arbitrary
-        // program - which a stored path would.
-        let mut prefs = AppPrefs::default();
-        assert!(!prefs.set_browser("/bin/sh"));
-        assert!(!prefs.set_browser("chrome.exe"));
-        assert!(!prefs.set_browser(""));
-        assert_eq!(prefs.browser, None);
-        assert!(prefs.set_browser("chrome"));
-        assert_eq!(prefs.browser.as_deref(), Some("chrome"));
-    }
-
-    #[test]
-    fn the_line_says_what_will_happen_rather_than_what_was_stored() {
-        let empty = AppPrefs::default();
-        assert!(empty.line().contains("the first one found"), "{}", empty.line());
-        assert!(empty.line().contains("chosen by the ladder"), "{}", empty.line());
-        let mut prefs = AppPrefs::default();
-        prefs.set_browser("edge");
-        prefs.set_home("/tmp/home", None).unwrap();
-        assert!(prefs.line().contains("browser=edge"), "{}", prefs.line());
-        // The line draws the RESOLVED path, which is what the ladder will probe - so
-        // it is built the same way here rather than spelled by hand.
-        let resolved = userpath::resolve("/tmp/home", None, None).unwrap();
-        assert!(prefs.line().contains(&resolved.display().to_string()), "{}", prefs.line());
-    }
-
-    #[test]
-    fn a_chosen_home_is_resolved_and_cleared() {
-        let mut prefs = AppPrefs::default();
-        prefs.set_home("sub/home", Some(Path::new("/here"))).unwrap();
-        assert_eq!(prefs.home.as_deref(), Some(Path::new("/here/sub/home")));
-        prefs.clear_home();
-        assert_eq!(prefs.home, None);
-        // A path that cannot be resolved is refused rather than stored as typed.
-        assert!(prefs.set_home("   ", None).is_err());
-    }
-}
diff --git a/app/crates/vn-shell-core/src/browser.rs b/app/crates/vn-shell-core/src/browser.rs
deleted file mode 100644
index 2de0bd9..0000000
--- a/app/crates/vn-shell-core/src/browser.rs
+++ /dev/null
@@ -1,1096 +0,0 @@
-//! Which browser shows the harness, and how it is started.
-//!
-//! The app owns the surface but not the renderer: the shipped interface is a web
-//! application, and the process that draws it is a browser this app found on the
-//! machine. Chrome first, because that is what `scripts\run-web.bat` opens and the
-//! two entry points should behave the same way - and **everything else works**,
-//! because the last rung is the platform's own opener, which by definition handles a
-//! browser this table has never heard of.
-//!
-//! ## The four rules a launch keeps
-//!
-//! 1. **The URL is ONE argv element**, never a command string. It carries the launch
-//!    token, which is a live credential: a shell in the middle of that is a shell
-//!    that can be made to do something else with it.
-//! 2. **Only a loopback URL is ever launched.** Checked here as well as at the ready
-//!    line - this is the last function before a process starts with that URL in its
-//!    argv, and a rule that holds at only one end of a pipe is not a rule.
-//! 3. **No shell, anywhere.** `explorer.exe`, `open` and `xdg-open` are programs, not
-//!    command lines; the Chrome-family entries are programs.
-//! 4. **A spawned process is not a page.** `spawn()` says a process was CREATED and
-//!    nothing more, so every rung is watched for one settle window ([`SETTLE`]) and a
-//!    program that died on the way up is reported as a failure and falls through to the
-//!    next rung - see [`Attempt`] for the measurement that made this a rule.
-//!
-//! Detection is a pure function of [`Facts`] and one `probe` predicate, so the table
-//! and the ORDER in it are `cargo test` cases on every platform, rather than
-//! something only a machine with five browsers installed could check.
-
-use std::ffi::OsString;
-use std::path::{Path, PathBuf};
-use std::process::Command;
-use std::time::{Duration, Instant};
-
-use crate::urlpolicy;
-
-/// How long a program this app started is given to prove it is a browser.
-///
-/// A Chromium or Firefox that is ALREADY running is a relay: it hands the URL to the
-/// running instance and exits, measured on this repository's own machine at 60-90 ms. A
-/// browser that is not running stays alive, because it IS the browser. A program that
-/// cannot start exits quickly with a FAILURE status - and this window is what makes that
-/// visible, because `spawn()` returning `Ok` says only that the process was CREATED.
-pub const SETTLE: Duration = Duration::from_millis(1500);
-
-/// How often the settle loop asks.
-const POLL: Duration = Duration::from_millis(25);
-
-/// Which operating system's table to read. Passed in rather than read from `cfg!`
-/// inside the table, so a test can check all three on any host.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Os {
-    Windows,
-    MacOs,
-    Linux,
-}
-
-impl Os {
-    pub fn here() -> Os {
-        if cfg!(windows) {
-            Os::Windows
-        } else if cfg!(target_os = "macos") {
-            Os::MacOs
-        } else {
-            Os::Linux
-        }
-    }
-}
-
-/// What a browser accepts on its command line.
-///
-/// Today every family takes the URL and nothing else - a URL alone means "open a tab"
-/// in both - so this is documentation with teeth: a flag (`--new-tab`,
-/// `--incognito`, `--profile-directory`) is only safe where the family says it is,
-/// and nothing here guesses at one.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Family {
-    /// Chrome, Edge, Brave, Chromium, Vivaldi, Opera.
-    Chromium,
-    /// Firefox.
-    Firefox,
-    /// The platform's own opener: whatever the person set as their default browser,
-    /// including one this table has never heard of.
-    Default,
-}
-
-/// One way to show the page.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Browser {
-    /// Stable, lower case, safe in a preferences file: `chrome`, `edge`, `default`…
-    pub id: &'static str,
-    /// What the panel draws.
-    pub label: &'static str,
-    pub family: Family,
-    /// The program, or `None` for [`Family::Default`] (the opener is decided at
-    /// launch time, per platform, by [`urlpolicy::opener_command`]).
-    pub program: Option<PathBuf>,
-}
-
-impl Browser {
-    pub fn is_default(&self) -> bool {
-        self.family == Family::Default
-    }
-
-    /// The rung that is always present, and always last.
-    pub fn default_opener() -> Browser {
-        Browser {
-            id: "default",
-            label: "the default browser",
-            family: Family::Default,
-            program: None,
-        }
-    }
-}
-
-/// Everything a detection reads, so the table can be tested without a machine.
-#[derive(Clone, Debug, Default, PartialEq, Eq)]
-pub struct Facts {
-    pub os_windows: bool,
-    pub os_macos: bool,
-    pub program_files: Option<PathBuf>,
-    pub program_files_x86: Option<PathBuf>,
-    pub local_app_data: Option<PathBuf>,
-    pub home: Option<PathBuf>,
-    /// `PATH`, for the Linux and macOS names and for a Windows install that put
-    /// itself on it.
-    pub path: Option<OsString>,
-}
-
-impl Facts {
-    /// The facts of the machine this is running on.
-    pub fn from_env() -> Facts {
-        fn var(name: &str) -> Option<PathBuf> {
-            std::env::var_os(name)
-                .filter(|value| !value.is_empty())
-                .map(PathBuf::from)
-        }
-        Facts {
-            os_windows: cfg!(windows),
-            os_macos: cfg!(target_os = "macos"),
-            program_files: var("ProgramFiles"),
-            program_files_x86: var("ProgramFiles(x86)"),
-            local_app_data: var("LOCALAPPDATA"),
-            home: crate::home::home_dir(),
-            path: std::env::var_os("PATH").filter(|value| !value.is_empty()),
-        }
-    }
-
-    /// A facts set for one OS, for tests and for the tables' own checks.
-    pub fn for_os(os: Os) -> Facts {
-        Facts {
-            os_windows: os == Os::Windows,
-            os_macos: os == Os::MacOs,
-            ..Facts::default()
-        }
-    }
-}
-
-/// One entry in the table: an id, a label, a family, and the places to look.
-struct Entry {
-    id: &'static str,
-    label: &'static str,
-    family: Family,
-    /// Absolute candidates, in order. `{ROOT}` tokens are substituted from [`Facts`].
-    absolute: &'static [&'static str],
-    /// Program names to look for on `PATH`.
-    on_path: &'static [&'static str],
-}
-
-/// The table, the Chrome family first and Firefox after it: the order a person with
-/// several browsers gets, and the order `scripts\run-web.bat` already prefers.
-const TABLE: &[Entry] = &[
-    Entry {
-        id: "chrome",
-        label: "Google Chrome",
-        family: Family::Chromium,
-        absolute: &[
-            r"{PROGRAM_FILES}\Google\Chrome\Application\chrome.exe",
-            r"{PROGRAM_FILES_X86}\Google\Chrome\Application\chrome.exe",
-            r"{LOCAL_APP_DATA}\Google\Chrome\Application\chrome.exe",
-            "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
-            "{HOME}/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
-        ],
-        on_path: &["google-chrome", "google-chrome-stable", "chrome"],
-    },
-    Entry {
-        id: "edge",
-        label: "Microsoft Edge",
-        family: Family::Chromium,
-        absolute: &[
-            r"{PROGRAM_FILES_X86}\Microsoft\Edge\Application\msedge.exe",
-            r"{PROGRAM_FILES}\Microsoft\Edge\Application\msedge.exe",
-            "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge",
-        ],
-        on_path: &["microsoft-edge", "microsoft-edge-stable", "msedge"],
-    },
-    Entry {
-        id: "brave",
-        label: "Brave",
-        family: Family::Chromium,
-        absolute: &[
-            r"{PROGRAM_FILES}\BraveSoftware\Brave-Browser\Application\brave.exe",
-            r"{PROGRAM_FILES_X86}\BraveSoftware\Brave-Browser\Application\brave.exe",
-            r"{LOCAL_APP_DATA}\BraveSoftware\Brave-Browser\Application\brave.exe",
-            "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser",
-        ],
-        on_path: &["brave-browser", "brave"],
-    },
-    Entry {
-        id: "chromium",
-        label: "Chromium",
-        family: Family::Chromium,
-        absolute: &[
-            r"{PROGRAM_FILES}\Chromium\Application\chrome.exe",
-            r"{LOCAL_APP_DATA}\Chromium\Application\chrome.exe",
-            "/Applications/Chromium.app/Contents/MacOS/Chromium",
-        ],
-        on_path: &["chromium", "chromium-browser"],
-    },
-    Entry {
-        id: "vivaldi",
-        label: "Vivaldi",
-        family: Family::Chromium,
-        absolute: &[
-            r"{LOCAL_APP_DATA}\Vivaldi\Application\vivaldi.exe",
-            r"{PROGRAM_FILES}\Vivaldi\Application\vivaldi.exe",
-            "/Applications/Vivaldi.app/Contents/MacOS/Vivaldi",
-        ],
-        on_path: &["vivaldi", "vivaldi-stable"],
-    },
-    Entry {
-        id: "opera",
-        label: "Opera",
-        family: Family::Chromium,
-        absolute: &[
-            r"{LOCAL_APP_DATA}\Programs\Opera\opera.exe",
-            r"{PROGRAM_FILES}\Opera\opera.exe",
-            "/Applications/Opera.app/Contents/MacOS/Opera",
-        ],
-        on_path: &["opera"],
-    },
-    Entry {
-        id: "firefox",
-        label: "Mozilla Firefox",
-        family: Family::Firefox,
-        absolute: &[
-            r"{PROGRAM_FILES}\Mozilla Firefox\firefox.exe",
-            r"{PROGRAM_FILES_X86}\Mozilla Firefox\firefox.exe",
-            "/Applications/Firefox.app/Contents/MacOS/firefox",
-        ],
-        on_path: &["firefox"],
-    },
-];
-
-/// Substitute the per-machine roots into a template, or `None` when it cannot apply
-/// here - an unknown root, or a template belonging to another operating system.
-///
-/// The OS guards are the point: a Windows install path is never a Linux browser, and
-/// a macOS app bundle is never a candidate on Windows. Without them, a table shared
-/// by three platforms silently probes paths that cannot exist.
-fn expand(template: &str, facts: &Facts) -> Option<PathBuf> {
-    let is_macos_template = template.contains(".app/Contents/MacOS");
-    let is_windows_template = template.contains('\\');
-    if is_macos_template && !facts.os_macos {
-        return None;
-    }
-    if is_windows_template && !facts.os_windows {
-        return None;
-    }
-    let mut text = template.to_string();
-    for (token, value) in [
-        ("{PROGRAM_FILES_X86}", facts.program_files_x86.as_deref()),
-        ("{PROGRAM_FILES}", facts.program_files.as_deref()),
-        ("{LOCAL_APP_DATA}", facts.local_app_data.as_deref()),
-        ("{HOME}", facts.home.as_deref()),
-    ] {
-        if let Some(at) = text.find(token) {
-            let value = value?;
-            text.replace_range(at..at + token.len(), &value.to_string_lossy());
-        }
-    }
-    Some(PathBuf::from(text))
-}
-
-/// Every place on `PATH` where `name` could be, in `PATH` order.
-fn on_path(name: &str, path: Option<&OsString>, probe: &dyn Fn(&Path) -> bool) -> Option<PathBuf> {
-    for directory in std::env::split_paths(path?) {
-        let candidate = directory.join(name);
-        if probe(&candidate) {
-            return Some(candidate);
-        }
-    }
-    None
-}
-
-/// The browsers this machine has, Chrome first, with the OS opener always last.
-///
-/// `probe` answers "may this be run?" - a file that exists, with the executable bit
-/// where that means anything ([`is_runnable`]). Tests pass their own, which is what
-/// makes the whole table checkable on any host.
-pub fn detect_with(facts: &Facts, probe: &dyn Fn(&Path) -> bool) -> Vec<Browser> {
-    let mut found = Vec::new();
-    for entry in TABLE {
-        let mut program = None;
-        for template in entry.absolute {
-            if let Some(path) = expand(template, facts) {
-                if probe(&path) {
-                    program = Some(path);
-                    break;
-                }
-            }
-        }
-        if program.is_none() {
-            for name in entry.on_path {
-                if let Some(path) = on_path(name, facts.path.as_ref(), probe) {
-                    program = Some(path);
-                    break;
-                }
-            }
-        }
-        if let Some(program) = program {
-            found.push(Browser {
-                id: entry.id,
-                label: entry.label,
-                family: entry.family,
-                program: Some(program),
-            });
-        }
-    }
-    // The floor, and the reason "all other browsers should work" is true rather than
-    // hoped for: an opener the OS provides, which knows the browser this table does
-    // not.
-    found.push(Browser::default_opener());
-    found
-}
-
-/// The browsers on THIS machine.
-pub fn detect() -> Vec<Browser> {
-    detect_with(&Facts::from_env(), &is_runnable)
-}
-
-/// Whether a program can be run: it exists, and on Unix it is executable.
-pub fn is_runnable(path: &Path) -> bool {
-    let Ok(meta) = std::fs::metadata(path) else {
-        return false;
-    };
-    if !meta.is_file() {
-        return false;
-    }
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::PermissionsExt;
-        if meta.permissions().mode() & 0o111 == 0 {
-            return false;
-        }
-    }
-    true
-}
-
-/// The browser this run will use: the remembered one when it is still here, else the
-/// first detected (Chrome when there is one), else the OS opener.
-///
-/// A remembered browser that has since been uninstalled is NOT an error - it falls
-/// through, and the caller may say so. Refusing to show the page because somebody
-/// uninstalled Chrome would be a worse app than one that opens Firefox.
-pub fn resolve(preferred: Option<&str>, detected: &[Browser]) -> Browser {
-    if let Some(id) = preferred.map(str::trim).filter(|id| !id.is_empty()) {
-        if let Some(browser) = detected.iter().find(|browser| browser.id == id) {
-            return browser.clone();
-        }
-    }
-    detected.first().cloned().unwrap_or_else(Browser::default_opener)
-}
-
-/// The command that shows `url`, or the reason it may not be shown.
-///
-/// A Chromium given a `profile` gets `--user-data-dir=<profile>` in front of the URL, and
-/// the URL is still exactly ONE argv element. See [`own_profile_dir`] for why that is the
-/// one flag this table adds: it is the difference between a browser that writes its profile
-/// wherever the machine's data directory is - which a confinement can refuse, measured as
-/// `Crashpad … settings.dat: Access is denied` and exit `0x80000003` - and one that writes
-/// it inside this app's own root, where the app has already proved it can write.
-pub fn command_with(
-    browser: &Browser,
-    url: &str,
-    profile: Option<&Path>,
-) -> Result<Command, String> {
-    let parsed = url::Url::parse(url).map_err(|error| format!("'{url}' is not a URL: {error}"))?;
-    if !urlpolicy::is_internal(&parsed) {
-        return Err(format!(
-            "refusing to open {}: only a loopback URL may be shown by this app",
-            parsed.host_str().unwrap_or("that address")
-        ));
-    }
-    let mut command = match browser.family {
-        Family::Default => urlpolicy::opener_command(url),
-        _ => {
-            let program = browser
-                .program
-                .as_ref()
-                .ok_or_else(|| format!("{} has no program to run", browser.label))?;
-            let mut command = Command::new(program);
-            // The profile flag, where the family documents one, and never a guessed flag.
-            if browser.family == Family::Chromium {
-                if let Some(profile) = profile {
-                    command.arg(format!("--user-data-dir={}", profile.display()));
-                }
-            }
-            // ONE argv element. Nothing here is a command string.
-            command.arg(url);
-            command
-        }
-    };
-    command.stdin(std::process::Stdio::null());
-    command.stdout(std::process::Stdio::null());
-    command.stderr(std::process::Stdio::null());
-    Ok(command)
-}
-
-/// [`command_with`] with no profile of its own.
-pub fn command(browser: &Browser, url: &str) -> Result<Command, String> {
-    command_with(browser, url, None)
-}
-
-/// Where a browser this app starts keeps its profile when it cannot keep it where it
-/// normally would: **inside this app's own root**.
-///
-/// The measured failure this answers, from a real run of this shell:
-/// `Google Chrome exited with status 0x80000003 before it could show the page`, and Chrome's
-/// own words were `CreateFile C:\Users\…\AppData\Local\Google\Chrome\User Data\Crashpad\
-/// settings.dat: Access is denied`. A session that confines what it starts denies the
-/// browser the one directory it cannot work without - and it is the same shape of problem
-/// this app already answers for its CHILDREN, which are handed `<app root>/tmp` when the
-/// machine's temp is refused. The browser gets the same treatment: a profile under the root
-/// the app has proved it can write in, and the person's own Chrome is left completely alone
-/// - the retry is a second window, never a second profile in their browser.
-pub fn own_profile_dir(app_root: &Path) -> PathBuf {
-    app_root.join("browser")
-}
-
-/// What one attempt to show the page actually did.
-///
-/// The distinction exists because `spawn()` is not a page: it says a process was
-/// CREATED, and a browser that dies on the way up - a confined parent that denies it its
-/// own profile, a broken install - is created just as successfully as one that opens a
-/// window. Measured on the machine this was written on: `Command::spawn()` returned `Ok`
-/// while Chrome exited `0x80000003` (STATUS_BREAKPOINT) after
-/// `Crashpad … settings.dat: Access is denied`, and the panel went on saying
-/// "opened in Google Chrome (a new tab)" over a window that never appeared.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Attempt {
-    /// Still running when the settle window closed: this process IS the browser.
-    Running,
-    /// Exited ZERO inside the window: a browser that was already running took the URL and
-    /// the relay left. Success, and the measured shape of one.
-    Handed,
-    /// Exited ZERO, but **nothing about this rung's status can be evidence** - the
-    /// platform's own opener reports success whether or not a page appears. The walk stops
-    /// here only because there is nothing left to try; the panel says exactly this rather
-    /// than claiming a tab.
-    Unverified,
-    /// Exited with a failure status before it could show the page. It did NOT open.
-    Died { code: Option<i32> },
-}
-
-impl Attempt {
-    /// Whether the URL is KNOWN to have reached a browser.
-    pub fn took_the_url(self) -> bool {
-        matches!(self, Attempt::Running | Attempt::Handed)
-    }
-
-    /// What happened, in words, for the panel's log.
-    pub fn line(self, label: &str) -> String {
-        match self {
-            Attempt::Running => format!("started {label}, which is still running"),
-            Attempt::Handed => {
-                format!("handed the page to {label}, which was already running")
-            }
-            Attempt::Unverified => format!(
-                "asked {label} for the page; it reports success without saying whether a window appeared, so this app cannot tell"
-            ),
-            Attempt::Died { code } => format!(
-                "{label} exited with {} before it could show the page, so no tab was opened",
-                match code {
-                    // An NTSTATUS failure is printed the way Windows names it, because
-                    // `0x80000003` is a sentence a search engine understands and
-                    // `-2147483645` is not.
-                    Some(code) if code < 0 => format!("status 0x{:08X}", code as u32),
-                    Some(code) => format!("exit code {code}"),
-                    None => "no exit code at all (killed)".to_string(),
-                }
-            ),
-        }
-    }
-}
-
-/// What an exited program's status means.
-///
-/// `verified` is false for a rung whose exit status proves nothing: the platform's own
-/// opener is a `rundll32` call that **always exits zero**, whether or not a window
-/// appeared - measured on a real run, where the log said `handed the page to the default
-/// browser, which was already running` and no page appeared at all. A status that cannot
-/// be evidence must not be reported as if it were.
-pub fn read_status(code: Option<i32>, verified: bool) -> Attempt {
-    match code {
-        Some(0) if verified => Attempt::Handed,
-        Some(0) => Attempt::Unverified,
-        Some(code) => Attempt::Died { code: Some(code) },
-        None => Attempt::Died { code: None },
-    }
-}
-
-/// One way of asking for the page: a program, and whether it is given a profile of its own
-/// inside this app's root.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Rung {
-    pub browser: Browser,
-    /// `Some` for the retry that gets through a confinement (`own_profile_dir`).
-    pub profile: Option<PathBuf>,
-}
-
-impl Rung {
-    fn plain(browser: Browser) -> Rung {
-        Rung { browser, profile: None }
-    }
-
-    /// What the panel and the log call this rung.
-    pub fn label(&self) -> &'static str {
-        self.browser.label
-    }
-}
-
-/// The rungs a hand-off tries, in order.
-///
-/// 1. **the browser this run chose**, as the person's own browser - where it normally is;
-/// 2. **the same browser with a profile inside this app's root**, when it is a Chromium and
-///    an app root exists. This is the rung that answers the measured failure: Chrome exited
-///    `0x80000003` because a confinement refused it its own profile directory, and a profile
-///    under the root the app has already proved it can write is the one thing that changes;
-/// 3. **the platform's own opener**, always last.
-///
-/// `prefer_profile` moves rung 2 in FRONT of rung 1, and the caller sets it from a
-/// measurement rather than a hunch: when this app's own probe of the machine's temp
-/// directory was refused, this session confines what the app starts, so the person's own
-/// browser profile is already known to be unreachable and a doomed launch is not owed to
-/// anybody.
-pub fn rungs(chosen: &Browser, profile_dir: Option<&Path>, prefer_profile: bool) -> Vec<Rung> {
-    let mut rungs = Vec::new();
-    let own = profile_dir
-        .filter(|_| chosen.family == Family::Chromium)
-        .map(|dir| Rung { browser: chosen.clone(), profile: Some(dir.to_path_buf()) });
-    if prefer_profile {
-        if let Some(own) = own.clone() {
-            rungs.push(own);
-        }
-    }
-    rungs.push(Rung::plain(chosen.clone()));
-    if !prefer_profile {
-        if let Some(own) = own {
-            rungs.push(own);
-        }
-    }
-    if !chosen.is_default() {
-        rungs.push(Rung::plain(Browser::default_opener()));
-    }
-    rungs
-}
-
-/// What a whole hand-off did: one line per rung, and which one took the URL.
-#[derive(Clone, Debug, Default, PartialEq, Eq)]
-pub struct HandOff {
-    /// The browser that took the URL, when one did.
-    pub took: Option<&'static str>,
-    /// Whether the rung that took it was given a profile inside this app's own root.
-    pub own_profile: bool,
-    /// One line per rung, in the order they were tried - the panel's log.
-    pub lines: Vec<String>,
-    /// Why nothing took it, when nothing did.
-    pub problem: Option<String>,
-}
-
-impl HandOff {
-    pub fn ok(&self) -> bool {
-        self.took.is_some()
-    }
-
-    /// The sentence a reader gets when the page did not reach a browser.
-    pub fn refusal(&self) -> String {
-        let tried: Vec<String> = self.lines.clone();
-        format!(
-            "{} - no browser took the page: {}",
-            self.problem.as_deref().unwrap_or("every browser this app knows refused the page"),
-            tried.join("; ")
-        )
-    }
-}
-
-/// Start `browser` on `url`, and watch it long enough to tell a browser from a program
-/// that died on the way up.
-///
-/// The URL still leaves as ONE argv element of a program, never through a shell, and the
-/// loopback rule is checked again inside [`command_with`] - this function only adds the
-/// measurement the old one was missing.
-pub fn attempt(rung: &Rung, url: &str, settle: Duration) -> Result<Attempt, String> {
-    let watched = rung.browser.label;
-    let mut child = command_with(&rung.browser, url, rung.profile.as_deref())?
-        .spawn()
-        .map_err(|error| format!("could not start {watched}: {error}"))?;
-    // A rung whose exit status is evidence: a browser's relay exit means the running
-    // instance took the URL, and the platform's opener has no such meaning.
-    let verified = !rung.browser.is_default();
-    let deadline = Instant::now() + settle;
-    loop {
-        match child.try_wait() {
-            Ok(Some(status)) => return Ok(read_status(status.code(), verified)),
-            Ok(None) => {}
-            Err(error) => return Err(format!("could not watch {watched}: {error}")),
-        }
-        if Instant::now() >= deadline {
-            // Still alive: it is the browser. The handle is dropped and the process is
-            // left alone - `Child` has no `Drop` that kills, which is exactly what is
-            // wanted here.
-            return Ok(Attempt::Running);
-        }
-        std::thread::sleep(POLL);
-    }
-}
-
-/// Walk the rungs until one takes the URL, with the runner passed in.
-///
-/// Split from [`hand_off`] so the LADDER - the order, the stop, the profile retry and what
-/// is reported when every rung refuses - is a `cargo test` case rather than a reading of
-/// the spawn site.
-pub fn walk(
-    chosen: &Browser,
-    profile_dir: Option<&Path>,
-    prefer_profile: bool,
-    mut run: impl FnMut(&Rung) -> Result<Attempt, String>,
-) -> HandOff {
-    let mut report = HandOff::default();
-    for rung in rungs(chosen, profile_dir, prefer_profile) {
-        match run(&rung) {
-            Ok(attempt) => {
-                report.lines.push(attempt.line(rung.label()));
-                if attempt.took_the_url() {
-                    report.took = Some(rung.label());
-                    report.own_profile = rung.profile.is_some();
-                    return report;
-                }
-                // An UNVERIFIED rung is the last one that can be tried - the opener is the
-                // floor - so the walk ends with the honest "cannot tell" rather than with a
-                // claim. Nothing left to try means nothing left to say.
-                if attempt == Attempt::Unverified && rung.browser.is_default() {
-                    report.took = None;
-                    report.problem = Some(format!(
-                        "{} could not show the page, and the platform's own opener reports success without telling this app whether a window appeared",
-                        chosen.label
-                    ));
-                    return report;
-                }
-            }
-            Err(error) => report.lines.push(error),
-        }
-    }
-    report.problem = Some(format!(
-        "{} could not show the page, and neither could the platform's own opener",
-        chosen.label
-    ));
-    report
-}
-
-/// Show `url` in the chosen browser, falling through to a profile of this app's own and
-/// then to the platform's opener.
-///
-/// **Why a fall-through rather than one program.** A browser started as a raw child of a
-/// confined process is a browser the confinement can refuse: measured on a real run, Chrome
-/// exited `0x80000003` after `Access is denied` on its own profile directory - and the same
-/// Chrome, given a profile inside the root this app has proved it can write, is a different
-/// proposition. One rung that dies is therefore not the end of the road, and a rung that
-/// dies is never reported as a tab that opened.
-pub fn hand_off(
-    chosen: &Browser,
-    url: &str,
-    profile_dir: Option<&Path>,
-    prefer_profile: bool,
-    settle: Duration,
-) -> HandOff {
-    walk(chosen, profile_dir, prefer_profile, |rung| attempt(rung, url, settle))
-}
-
-/// The stable ids this build knows, for validating a preferences file.
-pub fn known_ids() -> Vec<&'static str> {
-    let mut ids: Vec<&'static str> = TABLE.iter().map(|entry| entry.id).collect();
-    ids.push("default");
-    ids
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// A Windows machine with Chrome and Firefox, and nothing else.
-    fn windows() -> (Facts, Vec<PathBuf>) {
-        let program_files = PathBuf::from(r"C:\Program Files");
-        let chrome = program_files.join(r"Google\Chrome\Application\chrome.exe");
-        let firefox = program_files.join(r"Mozilla Firefox\firefox.exe");
-        let facts = Facts {
-            os_windows: true,
-            os_macos: false,
-            program_files: Some(program_files),
-            program_files_x86: Some(PathBuf::from(r"C:\Program Files (x86)")),
-            local_app_data: Some(PathBuf::from(r"C:\Users\me\AppData\Local")),
-            home: Some(PathBuf::from(r"C:\Users\me")),
-            path: Some(OsString::from(r"C:\Windows\system32")),
-        };
-        (facts, vec![chrome, firefox])
-    }
-
-    fn present(programs: &[PathBuf]) -> impl Fn(&Path) -> bool + '_ {
-        move |path: &Path| programs.iter().any(|program| program == path)
-    }
-
-    #[test]
-    fn chrome_comes_first_and_the_default_opener_is_always_last() {
-        let (facts, programs) = windows();
-        let detected = detect_with(&facts, &present(&programs));
-        let ids: Vec<&str> = detected.iter().map(|browser| browser.id).collect();
-        assert_eq!(ids, vec!["chrome", "firefox", "default"], "{ids:?}");
-        assert!(detected.last().unwrap().is_default(), "the floor must be the last rung");
-        assert!(!detected[0].is_default(), "Chrome must win when it is installed");
-    }
-
-    #[test]
-    fn a_machine_with_no_browser_at_all_still_has_the_floor() {
-        // The promise "all other browsers should work": an unknown browser is the
-        // OS's business, and the app never refuses to show the page because its own
-        // table does not know the program.
-        let (facts, _) = windows();
-        let detected = detect_with(&facts, &|_path| false);
-        assert_eq!(detected.len(), 1);
-        assert!(detected[0].is_default());
-        let browser = resolve(Some("chrome"), &detected);
-        assert!(browser.is_default(), "an uninstalled Chrome must fall through, not refuse");
-    }
-
-    #[test]
-    fn a_remembered_browser_is_used_and_an_unknown_id_falls_back() {
-        let (facts, programs) = windows();
-        let detected = detect_with(&facts, &present(&programs));
-        assert_eq!(resolve(Some("firefox"), &detected).id, "firefox");
-        assert_eq!(resolve(Some("  firefox  "), &detected).id, "firefox");
-        // Nothing remembered: the first detected, which is Chrome when there is one.
-        assert_eq!(resolve(None, &detected).id, "chrome");
-        assert_eq!(resolve(Some("netscape"), &detected).id, "chrome");
-        assert_eq!(resolve(Some(""), &detected).id, "chrome");
-        assert_eq!(resolve(Some("chrome"), &[]).id, "default");
-    }
-
-    #[test]
-    fn path_lookup_finds_a_linux_browser_and_no_other_os_leaks_in() {
-        // `PATH` is the HOST's, so the separator is the host's too - the table is
-        // what is being tested for OS-correctness here, not the variable's syntax.
-        let separator = if cfg!(windows) { ";" } else { ":" };
-        let joined = format!("/usr/bin{separator}/opt/weird/bin");
-        let facts = Facts {
-            path: Some(OsString::from(joined)),
-            ..Facts::for_os(Os::Linux)
-        };
-        let wanted = PathBuf::from("/opt/weird/bin/brave-browser");
-        let detected = detect_with(&facts, &|candidate| candidate == wanted);
-        assert_eq!(detected[0].id, "brave");
-        assert_eq!(detected[0].program.as_deref(), Some(wanted.as_path()));
-        // ...and a macOS app bundle is never a Linux candidate, whatever exists.
-        let detected = detect_with(&facts, &|candidate| {
-            candidate.to_string_lossy().contains("Google Chrome.app")
-        });
-        assert_eq!(detected.len(), 1, "a macOS app bundle was detected on Linux");
-        assert!(detected[0].is_default());
-        // A Windows template is never a candidate off Windows either.
-        let detected = detect_with(&Facts::for_os(Os::MacOs), &|candidate| {
-            candidate.to_string_lossy().contains(r"Google\Chrome")
-        });
-        assert_eq!(detected.len(), 1, "a Windows install path was detected on macOS");
-    }
-
-    #[test]
-    fn a_macos_bundle_is_found_with_a_home_relative_application() {
-        let home = PathBuf::from("/Users/me");
-        let bundle = home.join("Applications/Google Chrome.app/Contents/MacOS/Google Chrome");
-        let facts = Facts { home: Some(home), ..Facts::for_os(Os::MacOs) };
-        let detected = detect_with(&facts, &|candidate| candidate == bundle);
-        assert_eq!(detected[0].id, "chrome");
-        assert_eq!(detected[0].program.as_deref(), Some(bundle.as_path()));
-    }
-
-    #[test]
-    fn the_url_is_one_argv_element_and_the_default_opener_is_a_program() {
-        let chrome = Browser {
-            id: "chrome",
-            label: "Google Chrome",
-            family: Family::Chromium,
-            program: Some(PathBuf::from(r"C:\Program Files\Google\Chrome\Application\chrome.exe")),
-        };
-        let url = "http://127.0.0.1:3080/?token=a-secret";
-        let built = command(&chrome, url).unwrap();
-        let args: Vec<String> =
-            built.get_args().map(|arg| arg.to_string_lossy().to_string()).collect();
-        assert_eq!(args, vec![url.to_string()], "the URL must be exactly one argument");
-        assert_eq!(
-            built.get_program().to_string_lossy(),
-            r"C:\Program Files\Google\Chrome\Application\chrome.exe"
-        );
-
-        // The floor runs the OS's own opener, and it is still a program, not a shell.
-        let floor = command(&Browser::default_opener(), url).unwrap();
-        let program = floor.get_program().to_string_lossy().to_string();
-        let expected = if cfg!(windows) {
-            // NOT `explorer.exe`, which is unreliable from a non-interactive child -
-            // measured: a button that spawned it appeared to do nothing.
-            "rundll32.exe"
-        } else if cfg!(target_os = "macos") {
-            "open"
-        } else {
-            "xdg-open"
-        };
-        assert_eq!(program, expected);
-    }
-
-    #[test]
-    fn only_a_loopback_url_may_be_launched() {
-        let chrome = Browser {
-            id: "chrome",
-            label: "Google Chrome",
-            family: Family::Chromium,
-            program: Some(PathBuf::from("chrome")),
-        };
-        for refused in [
-            "http://evil.example/?token=x",
-            "https://127.0.0.1.evil.example/",
-            "file:///etc/passwd",
-            "not a url at all",
-        ] {
-            assert!(command(&chrome, refused).is_err(), "{refused} was accepted");
-        }
-        // The loopback spellings are all fine.
-        for allowed in ["http://127.0.0.1:3080/?token=x", "http://localhost:3080/"] {
-            assert!(command(&chrome, allowed).is_ok(), "{allowed} was refused");
-        }
-    }
-
-    #[test]
-    fn a_browser_with_no_program_is_never_run_directly() {
-        let broken = Browser {
-            id: "chrome",
-            label: "Google Chrome",
-            family: Family::Chromium,
-            program: None,
-        };
-        let error = command(&broken, "http://127.0.0.1:3080/").unwrap_err();
-        assert!(error.contains("no program"), "{error}");
-    }
-
-    #[test]
-    fn the_known_ids_are_safe_for_a_preferences_file() {
-        for id in known_ids() {
-            assert!(
-                id.chars().all(|ch| ch.is_ascii_lowercase() || ch.is_ascii_digit() || ch == '-'),
-                "{id} is not a safe id"
-            );
-        }
-        assert!(known_ids().contains(&"default"));
-        assert!(known_ids().contains(&"chrome"));
-    }
-
-    // -----------------------------------------------------------------------
-    // A spawned process is not a page
-    // -----------------------------------------------------------------------
-
-    fn chrome() -> Browser {
-        Browser {
-            id: "chrome",
-            label: "Google Chrome",
-            family: Family::Chromium,
-            program: Some(PathBuf::from("chrome")),
-        }
-    }
-
-    #[test]
-    fn a_relay_that_left_cleanly_took_the_url_and_a_crash_did_not() {
-        // The measured pair: a browser that was already running exits 0, and the Chrome
-        // this repository watched die exits 0x80000003 after Crashpad was refused.
-        assert_eq!(read_status(Some(0), true), Attempt::Handed);
-        assert!(read_status(Some(0), true).took_the_url());
-        assert_eq!(
-            read_status(Some(0x80000003u32 as i32), true),
-            Attempt::Died { code: Some(-2147483645) }
-        );
-        assert!(!read_status(Some(0x80000003u32 as i32), true).took_the_url());
-        assert!(!read_status(Some(101), true).took_the_url(), "a non-zero exit is never a tab");
-        assert!(!read_status(None, true).took_the_url());
-        // The words a person reads, and the reason the high half is printed as hex.
-        let line = read_status(Some(0x80000003u32 as i32), true).line("Google Chrome");
-        assert!(line.contains("0x80000003"), "{line}");
-        assert!(line.contains("no tab was opened"), "{line}");
-        assert!(read_status(Some(0), true).line("Google Chrome").contains("already running"));
-    }
-
-    #[test]
-    fn the_platform_opener_reports_success_it_cannot_back_up() {
-        // MEASURED, from a real run: `rundll32 url.dll,FileProtocolHandler <url>` exits
-        // ZERO whether or not a window appears - the log said "handed the page to the
-        // default browser, which was already running" over a screen with nothing on it. A
-        // status that cannot be evidence is not reported as one, and the walk does not
-        // claim a tab for it.
-        let unverified = read_status(Some(0), false);
-        assert_eq!(unverified, Attempt::Unverified);
-        assert!(!unverified.took_the_url());
-        let line = unverified.line("the default browser");
-        assert!(line.contains("cannot tell"), "{line}");
-        // ...and a FAILURE status from the opener is still a failure.
-        assert_eq!(read_status(Some(1), false), Attempt::Died { code: Some(1) });
-    }
-
-    #[test]
-    fn a_rung_that_died_falls_through_to_the_profile_of_this_apps_own() {
-        // The measured failure this rung exists for: Chrome dies on its OWN profile
-        // directory, and the same Chrome given one inside this app's root is a different
-        // proposition. The walk stops at the first rung that takes the URL.
-        let mut tried: Vec<(String, bool)> = Vec::new();
-        let report = walk(&chrome(), Some(Path::new("/root/browser")), false, |rung| {
-            tried.push((rung.browser.id.to_string(), rung.profile.is_some()));
-            if rung.profile.is_some() {
-                Ok(Attempt::Running)
-            } else {
-                Ok(Attempt::Died { code: Some(0x80000003u32 as i32) })
-            }
-        });
-        assert_eq!(
-            tried,
-            vec![("chrome".to_string(), false), ("chrome".to_string(), true)],
-            "the person's own browser first, then one with a profile of ours"
-        );
-        assert!(report.ok());
-        assert_eq!(report.took, Some("Google Chrome"));
-        assert!(report.own_profile, "the row must say the window is this app's own");
-        assert_eq!(report.lines.len(), 2, "{:?}", report.lines);
-        assert!(report.lines[1].contains("still running"), "{:?}", report.lines);
-    }
-
-    #[test]
-    fn a_confined_session_is_offered_the_profile_of_our_own_first() {
-        // `prefer_profile` is set from a measurement - this app's own temp probe was
-        // refused - so the person's profile is already known to be unreachable and a
-        // doomed launch is not owed to anybody.
-        let ladder = super::rungs(&chrome(), Some(Path::new("/root/browser")), true);
-        assert_eq!(ladder.len(), 3, "{ladder:?}");
-        assert!(ladder[0].profile.is_some(), "the profile of our own comes first");
-        assert!(ladder[1].profile.is_none());
-        assert!(ladder[2].browser.is_default());
-        // The ordinary order, when nothing measured a confinement.
-        let ladder = super::rungs(&chrome(), Some(Path::new("/root/browser")), false);
-        assert!(ladder[0].profile.is_none());
-        assert!(ladder[1].profile.is_some());
-        assert!(ladder[2].browser.is_default());
-    }
-
-    #[test]
-    fn only_a_chromium_is_given_a_profile_flag_and_the_url_stays_one_argument() {
-        // The flag goes where the family documents one - Chrome and its relatives - and
-        // the URL is STILL exactly one argv element, which is the rule that carries the
-        // launch token.
-        let url = "http://127.0.0.1:3080/?token=x";
-        let built = command_with(&chrome(), url, Some(Path::new(r"C:\root\browser"))).unwrap();
-        let args: Vec<String> =
-            built.get_args().map(|arg| arg.to_string_lossy().to_string()).collect();
-        assert_eq!(args.len(), 2, "{args:?}");
-        assert_eq!(args[0], r"--user-data-dir=C:\root\browser");
-        assert_eq!(args[1], url, "the URL must still be exactly one argument");
-
-        // Firefox has no such flag in this table, so it is never given one.
-        let firefox = Browser {
-            id: "firefox",
-            label: "Mozilla Firefox",
-            family: Family::Firefox,
-            program: Some(PathBuf::from("firefox")),
-        };
-        let built = command_with(&firefox, url, Some(Path::new("/root/browser"))).unwrap();
-        let args: Vec<String> =
-            built.get_args().map(|arg| arg.to_string_lossy().to_string()).collect();
-        assert_eq!(args, vec![url.to_string()], "{args:?}");
-
-        // ...and the floor never takes one either: it is handed a URL, not a browser.
-        let built = command_with(&Browser::default_opener(), url, Some(Path::new("/root/b")))
-            .unwrap();
-        let args: Vec<String> =
-            built.get_args().map(|arg| arg.to_string_lossy().to_string()).collect();
-        assert!(args.iter().all(|arg| !arg.starts_with("--user-data-dir")), "{args:?}");
-        assert_eq!(args.last().map(String::as_str), Some(url));
-
-        // The loopback rule still holds with a profile in front of the URL.
-        assert!(command_with(&chrome(), "http://evil.example/", Some(Path::new("/root/b"))).is_err());
-    }
-
-    #[test]
-    fn the_profile_this_app_offers_lives_inside_its_own_root() {
-        let dir = own_profile_dir(Path::new("/root"));
-        assert_eq!(dir, Path::new("/root").join("browser"));
-        assert!(dir.starts_with("/root"), "the browser writes where the app can: {}", dir.display());
-    }
-
-    #[test]
-    fn a_rung_that_died_falls_through_to_the_platforms_own_opener() {
-        // The rung that DIED is not the end of the road: the floor is tried, and the
-        // report names the browser that really took the URL.
-        let mut tried: Vec<&'static str> = Vec::new();
-        let report = walk(&chrome(), None, false, |rung| {
-            tried.push(rung.browser.id);
-            if rung.browser.is_default() {
-                Ok(Attempt::Running)
-            } else {
-                Ok(Attempt::Died { code: Some(0x80000003u32 as i32) })
-            }
-        });
-        assert_eq!(tried, vec!["chrome", "default"], "the floor must be the last rung");
-        assert!(report.ok());
-        assert_eq!(report.took, Some("the default browser"));
-        assert_eq!(report.lines.len(), 2);
-        assert!(report.lines[0].contains("no tab was opened"), "{:?}", report.lines);
-        assert!(report.lines[1].contains("still running"), "{:?}", report.lines);
-    }
-
-    #[test]
-    fn the_first_rung_that_takes_the_url_ends_the_walk() {
-        let mut tried: Vec<&'static str> = Vec::new();
-        let report = walk(&chrome(), None, false, |rung| {
-            tried.push(rung.browser.id);
-            Ok(Attempt::Handed)
-        });
-        assert_eq!(tried, vec!["chrome"], "a working rung must not be followed by another tab");
-        assert_eq!(report.took, Some("Google Chrome"));
-        // A refusal to start at all is a rung that failed, not an error out of the walk.
-        let report = walk(&chrome(), None, false, |rung| {
-            if rung.browser.is_default() {
-                Ok(Attempt::Handed)
-            } else {
-                Err("could not start Google Chrome: access is denied".to_string())
-            }
-        });
-        assert!(report.ok());
-        assert!(report.lines[0].contains("access is denied"), "{:?}", report.lines);
-    }
-
-    #[test]
-    fn a_chosen_default_opener_is_not_tried_twice() {
-        let floor = super::rungs(&Browser::default_opener(), None, false);
-        assert_eq!(floor.len(), 1, "the floor must not be followed by itself");
-        let ladder = super::rungs(&chrome(), None, false);
-        assert_eq!(ladder.len(), 2);
-        assert!(ladder[1].browser.is_default());
-        // Every rung the walk tries is a real one, in the table's own order.
-        let (facts, programs) = windows();
-        let detected = detect_with(&facts, &present(&programs));
-        assert_eq!(super::rungs(&detected[1], None, false)[0].browser.id, "firefox");
-    }
-
-    #[test]
-    fn nothing_taking_the_url_is_reported_with_every_rung_it_tried() {
-        let report = walk(&chrome(), None, false, |_rung| Ok(Attempt::Died { code: Some(5) }));
-        assert!(!report.ok());
-        assert_eq!(report.took, None);
-        let refusal = report.refusal();
-        assert!(refusal.contains("Google Chrome"), "{refusal}");
-        assert!(refusal.contains("platform's own opener"), "{refusal}");
-        // Each rung's own sentence survives into the refusal, so the reader can see
-        // that BOTH were tried.
-        assert_eq!(refusal.matches("no tab was opened").count(), 2, "{refusal}");
-    }
-
-    #[test]
-    fn an_opener_that_reports_success_over_nothing_is_never_called_a_tab() {
-        // The real run this pins: Chrome died, the opener exited 0, and the panel said
-        // "opened ... in the default browser" while the screen stayed empty. The walk now
-        // ends in a refusal that names what could NOT be verified.
-        let report = walk(&chrome(), Some(Path::new("/root/browser")), true, |rung| {
-            if rung.browser.is_default() {
-                Ok(Attempt::Unverified)
-            } else {
-                Ok(Attempt::Died { code: Some(0x80000003u32 as i32) })
-            }
-        });
-        assert!(!report.ok(), "an unverifiable opener is not a tab");
-        assert_eq!(report.took, None);
-        let refusal = report.refusal();
-        assert!(refusal.contains("reports success without telling this app"), "{refusal}");
-        assert_eq!(report.lines.len(), 3, "all three rungs were tried: {:?}", report.lines);
-    }
-}
diff --git a/app/crates/vn-shell-core/src/firstrun.rs b/app/crates/vn-shell-core/src/firstrun.rs
deleted file mode 100644
index aa6b299..0000000
--- a/app/crates/vn-shell-core/src/firstrun.rs
+++ /dev/null
@@ -1,736 +0,0 @@
-//! The first-run choice: **where your sessions, skills and key live**, made once, in
-//! one place, before anything else happens.
-//!
-//! This module is the whole of that decision. It surveys what this machine already has,
-//! turns it into the cards the panel draws, and says what each card would DO - so the
-//! window is a two-button screen rather than a table of fifteen rows, and so the
-//! decision itself is a `cargo test` case rather than a reading of the drawing code.
-//!
-//! **Two answers, and both of them end inside this folder.**
-//!
-//! | card | what it is for |
-//! |---|---|
-//! | **copy it here and use the copy** | a one-way import: the harness's own default (`~/.dsh`) is READ, and what is durable in it is brought into this app's own root. Offered while there is something to bring AND room to put it - a card that promised a copy of a home that had already been copied here did nothing at all when pressed |
-//! | **make a fresh home here** | this app's own root; empty when it is untouched, and honest when it is not - nothing is ever deleted, so the card says which of the two it is |
-//!
-//! **The card that used to be first is gone: "use the home already on this machine".** It
-//! ran the harness against `~/.dsh`, and a folder that carries everything it needs must
-//! not reach into a person's profile to START - the reason that rung existed (a home with
-//! no pack, a home with no key) is answered by this app itself: Start installs the pack
-//! into the home in use, and the key row asks for the key. `~/.dsh` survives as the
-//! SOURCE of the copy alone, which is read and never run against.
-//!
-//! Nothing here decides on its own: [`Where::cards`] says what is possible and what each
-//! choice means, and the person picks. The copy is recommended while there is something
-//! to bring, because the alternative is leaving a person's own sessions behind.
-//!
-//! The card that is *unavailable* carries the sentence saying why, because that sentence
-//! is the whole answer to "why can I not use my own sessions?".
-//!
-//! ## What the survey still measures about that source
-//!
-//! `sessions` and `key` are counted and sized (never read) so the copy card can say what
-//! is there; `readable` is what a copy needs; `has_pack` is what the copy's own second
-//! half promises. **Writability is no longer surveyed**: nothing runs against that home
-//! any more, so whether a child can write in it decides nothing.
-
-use std::path::{Path, PathBuf};
-
-use crate::adopt;
-use crate::profile;
-
-/// What this machine already has, told as facts a card can be trusted to print.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Existing {
-    pub path: PathBuf,
-    /// Its directory can be listed, which is what a copy needs.
-    pub readable: bool,
-    /// Whether this pack is among the bundles its `web` profile lists - what the copy's
-    /// own second half (the install that follows it) is promised on.
-    pub has_pack: bool,
-    /// Session transcripts with content, and whether a credentials file with content is
-    /// there. Both by COUNT and SIZE - never by reading a value.
-    pub sessions: usize,
-    pub key: bool,
-}
-
-/// Everything the first-run screen needs, and no more.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Where {
-    /// The harness's own default home, when it is a harness home at all.
-    pub existing: Option<Existing>,
-    /// This app's own home: `<app root>/home`.
-    pub project: PathBuf,
-    pub app_root: PathBuf,
-}
-
-/// Which card was picked.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Kind {
-    /// Copy what is durable out of the machine's own home, here, and use the copy.
-    CopyExisting,
-    /// Make a fresh, empty home here.
-    CreateHere,
-}
-
-/// One card, ready to draw: what it would do, whether it can, and why not.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Card {
-    pub kind: Kind,
-    /// The path this card would end up using.
-    pub path: PathBuf,
-    pub title: String,
-    /// **The one line the card always draws**: where it goes, and the fact that decides
-    /// it. Open, because a card whose path is hidden asks somebody to choose blind.
-    pub summary: String,
-    /// Everything else, drawn inside the card's own `details` disclosure - closed by
-    /// default.
-    ///
-    /// Measured on a real machine: with every fact drawn open, three cards filled the
-    /// window and pushed the reason and the button off the bottom of it, which is how a
-    /// screen with exactly one usable answer read as bloat. Nothing was deleted - the
-    /// facts moved one click away, and [`Card::summary`] keeps the part a decision needs.
-    pub facts: Vec<String>,
-    pub available: bool,
-    /// Why not, in one sentence, when it cannot be offered. **Always drawn open**: it is
-    /// the answer to "why can I not press this", and hiding it behind a disclosure is how
-    /// a greyed-out button turns into a bug report.
-    pub unavailable: Option<String>,
-    /// The one the app would suggest, without deciding anything.
-    pub recommended: bool,
-    /// **The wording of the one button that is always in the same place**: the panel
-    /// draws it under the cards, and it TAKES the card marked `▸`.
-    ///
-    /// It exists because this screen can honestly offer one card and grey out two - the
-    /// home on this machine is not writable from a confined parent, and the copy has
-    /// nothing left to bring - and a reader who sees two red paragraphs and a card named
-    /// "Make a fresh home" over a home that already exists has no way on. The label is
-    /// decided HERE, where the state is known, rather than in the drawing code.
-    pub continue_label: String,
-}
-
-impl Card {
-    /// A stable id for this card's own `details` disclosure, unique on the screen.
-    ///
-    /// The panel needs it because egui remembers an open/closed state per id: without one,
-    /// opening the first card's details would open - or close - all three.
-    pub fn id(&self) -> u32 {
-        match self.kind {
-            Kind::CopyExisting => 1,
-            Kind::CreateHere => 2,
-        }
-    }
-}
-
-/// The choice, ready to apply.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct Choice {
-    pub kind: Kind,
-    /// Only meaningful for [`Kind::CopyExisting`]: take the credentials file too.
-    pub include_key: bool,
-}
-
-impl Choice {
-    pub fn new(kind: Kind) -> Self {
-        Choice { kind, include_key: false }
-    }
-
-    /// The home this choice puts in use. Both cards end inside this app's own root -
-    /// the copy brings things INTO it, and the fresh home creates it.
-    pub fn home(&self, place: &Where) -> PathBuf {
-        place.project.clone()
-    }
-}
-
-impl Where {
-    /// Survey this machine. `default_home` is the harness's own default (`~/.dsh`), and
-    /// `app_root` is this app's root; `project` is `<app_root>/home`.
-    ///
-    /// Reads only. The writability of the existing home IS probed, because that is the
-    /// difference between the first card and the second, and a card that promises "use
-    /// this one" over a home the harness cannot compose into would be a lie.
-    pub fn survey(default_home: Option<&Path>, app_root: &Path) -> Where {
-        let existing = default_home
-            .filter(|path| crate::home::looks_like_a_harness_home(path))
-            .map(|path| Existing {
-                path: path.to_path_buf(),
-                readable: adopt::source_is_readable(path),
-                has_pack: profile::bundles(path, crate::launch::PROFILE)
-                    .map(|bundles| profile::has_pack(&bundles))
-                    .unwrap_or(false),
-                sessions: count_files(&path.join("sessions")),
-                key: credentials_hold_something(&path.join(".credentials.yaml")),
-            });
-        Where {
-            existing,
-            project: crate::appdata::owned_home(app_root),
-            app_root: app_root.to_path_buf(),
-        }
-    }
-
-    /// The cards, in the order they are drawn.
-    ///
-    /// The existing-installation cards appear **only when there is one**: a card that
-    /// says "no home found" teaches nothing and is exactly the clutter this screen
-    /// exists to remove.
-    ///
-    /// Two states shape the wording, and both were measured on a real machine: the home
-    /// on this machine may be unwritable (so that card cannot be pressed), and this
-    /// app's own home may already hold the person's sessions (so "make a fresh home" is
-    /// a lie and "copy it here" has nothing to copy). A screen where two cards are red
-    /// and the third misnames itself has no way on - which is what the third card's
-    /// adaptive title and every card's `continue_label` are for.
-    pub fn cards(&self) -> Vec<Card> {
-        // "This app's own home already holds something of the person's." The same
-        // measurement Adopt uses, so the card and the copy offer cannot disagree.
-        let project_is_ours = !adopt::home_is_untouched_by_a_person(&self.project);
-        let mut cards = Vec::new();
-        // Whether the COPY is the card the screen opens on. Exactly one card is ever
-        // marked: the button at the foot of the screen takes the marked one, and a screen
-        // whose arrow is on no card is the dead end this screen exists to remove.
-        let mut copy_recommended = false;
-        if let Some(existing) = self.existing.as_ref() {
-            // THE CARD THAT USED TO BE FIRST IS GONE. "Use the DeepSeek home already on
-            // this machine" ran the harness against `~/.dsh`, and a folder that carries
-            // everything it needs must not reach into a person's profile to start. What
-            // remains is the one-way COPY: it only reads the source, and it is how a
-            // person brings their own sessions and key into the folder.
-            // What a copy would ACTUALLY bring, from the same plan the copy runs: the
-            // facts used to be composed from the source's own inventory, so a card that
-            // could not be pressed still advertised a key and a pack to bring - the
-            // contradiction the red sentence beside it was pointing out.
-            let planned = adopt::plan(&existing.path, &self.project);
-            let key_to_bring = adopt::credentials_can_be_brought(&existing.path, &self.project);
-            let something_to_bring = !planned.items.is_empty() || key_to_bring;
-            cards.push(Card {
-                kind: Kind::CopyExisting,
-                path: self.project.clone(),
-                title: "Copy it here, and use the copy".to_string(),
-                summary: if something_to_bring {
-                    format!("copies into {}", self.project.display())
-                } else {
-                    format!("everything durable is already in {}", self.project.display())
-                },
-                facts: if something_to_bring {
-                    let mut facts: Vec<String> =
-                        planned.items.iter().map(|item| item.name.to_string()).collect();
-                    if existing.key {
-                        facts.push("a key is there, if you tick it".to_string());
-                    }
-                    if existing.has_pack {
-                        facts.push("the pack is installed into the copy next".to_string());
-                    }
-                    facts
-                } else {
-                    vec![
-                        format!(
-                            "every tree and the key from {} are already here",
-                            existing.path.display()
-                        ),
-                        "nothing is copied again, and nothing is overwritten".to_string(),
-                    ]
-                },
-                // AVAILABLE ONLY WHEN THERE IS SOMETHING LEFT TO BRING. It used to be
-                // "the source can be read", which offered a copy of a home that had
-                // already been copied here: the click then did nothing at all, and the
-                // only sentence saying so was drawn inside `Details`. A card is a
-                // promise about what the next click does.
-                available: existing.readable && something_to_bring,
-                unavailable: if !existing.readable {
-                    Some(format!(
-                        "{} exists but cannot be read, so nothing can be copied out of it",
-                        existing.path.display()
-                    ))
-                } else {
-                    Some(format!(
-                        "there is nothing left to bring: {} already holds everything durable in {}. The home in use is {} - press Start and the pack is installed into it",
-                        self.project.display(),
-                        existing.path.display(),
-                        self.project.display()
-                    ))
-                },
-                // Only suggested when it can actually be pressed: a card that is both
-                // "recommended" and greyed out is the worst of both. And never when the
-                // folder's own home already holds this person's work - then the answer is
-                // the folder, and there is nothing left to bring anyway.
-                recommended: something_to_bring && !project_is_ours,
-                continue_label: "Copy it here and continue".to_string(),
-            });
-            copy_recommended = something_to_bring && !project_is_ours;
-        }
-        cards.push(Card {
-            kind: Kind::CreateHere,
-            path: self.project.clone(),
-            title: if project_is_ours {
-                // NOT "make a fresh home" over a home that already holds somebody's
-                // sessions: the card never deletes anything, and this is the state in
-                // which it is the way ON rather than a fresh start.
-                "Use the home in this folder".to_string()
-            } else {
-                "Make a fresh home in this project".to_string()
-            },
-            // "EMPTY" IS A MEASUREMENT, NOT A HOPE. The card is always available and it
-            // never deletes anything - so when this app's own home already holds the
-            // person's sessions the card must say that instead of promising a fresh
-            // start it cannot deliver. It says it in the SUMMARY, because that is the line
-            // that decides the card.
-            summary: if project_is_ours {
-                format!("{} · this app's home already, and it stays", self.project.display())
-            } else {
-                format!("{} · empty, and private to this app", self.project.display())
-            },
-            facts: if project_is_ours {
-                vec![
-                    "your sessions, skills and key are there already; nothing is deleted, and nothing is copied again".to_string(),
-                    "the pack is installed into it next if the profile does not list it (Start does it)".to_string(),
-                ]
-            } else {
-                vec!["the pack is installed into it next (one press, no network)".to_string()]
-            },
-            available: true,
-            unavailable: None,
-            // The folder is the answer unless the copy is - exactly one card is marked.
-            recommended: !copy_recommended,
-            continue_label: if project_is_ours {
-                "Continue with the home in this folder".to_string()
-            } else {
-                "Create the home here and continue".to_string()
-            },
-        });
-        // ONE ANSWER IS NOT A CHOICE. When the home on this machine cannot be written and
-        // the copy has nothing left to bring, the folder's own home is the only card that
-        // can be taken - and drawing the other two as red paragraphs is exactly the noise
-        // the owner measured: *"it starts already on second page with what I am copying
-        // here"* - two greyed cards above the one that works, and a reader looking for a
-        // way on. They are folded into the surviving card's own `details`, reasons and
-        // paths included, so nothing is hidden and nothing is promised that cannot be
-        // pressed.
-        let available = cards.iter().filter(|card| card.available).count();
-        if available == 1 && cards.len() > 1 {
-            let mut folded: Vec<String> = cards
-                .iter()
-                .filter(|card| !card.available)
-                .map(|card| {
-                    format!(
-                        "not offered here: {} - {}",
-                        card.title,
-                        card.unavailable.clone().unwrap_or_default()
-                    )
-                })
-                .collect();
-            let mut kept: Vec<Card> = cards.into_iter().filter(|card| card.available).collect();
-            if let Some(card) = kept.last_mut() {
-                folded.extend(std::mem::take(&mut card.facts));
-                card.facts = folded;
-            }
-            return kept;
-        }
-        cards
-    }
-
-    /// The card the screen opens on: the recommended one, else the first available one.
-    pub fn preselected(&self) -> Option<Card> {
-        let cards = self.cards();
-        cards
-            .iter()
-            .find(|card| card.recommended && card.available)
-            .or_else(|| cards.iter().find(|card| card.available))
-            .cloned()
-    }
-}
-
-/// How many files a directory holds, without reading any of them. A directory that
-/// cannot be listed counts as none: this is a fact for a card, not a probe.
-fn count_files(directory: &Path) -> usize {
-    std::fs::read_dir(directory)
-        .map(|entries| entries.flatten().filter(|entry| entry.path().is_file()).count())
-        .unwrap_or(0)
-}
-
-/// Whether a credentials file holds anything - by SIZE, never by reading it.
-fn credentials_hold_something(path: &Path) -> bool {
-    std::fs::metadata(path).map(|meta| meta.len() > 0).unwrap_or(false)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn scratch(name: &str) -> PathBuf {
-        let root = match std::env::var_os("VNCODE_TEST_DIR") {
-            Some(value) if !value.is_empty() => PathBuf::from(value),
-            _ => std::env::temp_dir(),
-        };
-        let path = root.join(format!("vncode-firstrun-{}-{name}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&path);
-        std::fs::create_dir_all(&path).unwrap();
-        path
-    }
-
-    /// A home shaped like a real installation: a profile listing the pack, sessions,
-    /// and a credentials file with content in it.
-    fn installation(root: &Path, name: &str) -> PathBuf {
-        let home = root.join(name);
-        std::fs::create_dir_all(profile::directory(&home, crate::launch::PROFILE)).unwrap();
-        std::fs::write(
-            profile::directory(&home, crate::launch::PROFILE).join("package.json"),
-            br#"{"dsh":{"profile":{"bundles":["@deepseek-ai/dsh-base","dsh-rightbar","dsh-editor"]}}}"#,
-        )
-        .unwrap();
-        std::fs::create_dir_all(home.join("sessions")).unwrap();
-        for index in 0..3 {
-            std::fs::write(home.join("sessions").join(format!("c{index}.json")), b"{}").unwrap();
-        }
-        std::fs::create_dir_all(home.join("skills")).unwrap();
-        std::fs::write(home.join(".credentials.yaml"), b"deepseek: {apiKey: x}\n").unwrap();
-        home
-    }
-
-    #[test]
-    fn an_installation_on_this_machine_is_offered_as_a_one_way_copy_only() {
-        // THE REMOVED CARD, PINNED AS ABSENT. "Use the DeepSeek home already on this
-        // machine" ran the harness against `~/.dsh`; a folder that carries everything it
-        // needs must not reach into a person's profile to START. What is offered is the
-        // COPY, which only reads - and the copy is the card the screen opens on, because
-        // the alternative is leaving this person's own sessions and key behind.
-        let root = scratch("copy-only");
-        let app_root = root.join("app");
-        std::fs::create_dir_all(&app_root).unwrap();
-        let home = installation(&root, ".dsh");
-        let place = Where::survey(Some(&home), &app_root);
-
-        let cards = place.cards();
-        assert_eq!(cards.len(), 2, "the folder and the copy: {cards:#?}");
-        assert!(
-            !cards.iter().any(|card| card.title.contains("already on this machine")),
-            "{:?}",
-            cards.iter().map(|card| card.title.clone()).collect::<Vec<_>>()
-        );
-
-        let copy = &cards[0];
-        assert_eq!(copy.kind, Kind::CopyExisting);
-        assert!(copy.available);
-        assert!(copy.recommended, "the way in is the one to suggest");
-        assert_eq!(copy.path, place.project, "and it lands inside the folder");
-        // The facts come from the copy's own plan: the skills the source holds are named,
-        // and the key is the separate tick.
-        assert!(copy.facts.iter().any(|fact| fact.contains("skills")), "{:?}", copy.facts);
-        assert!(copy.facts.iter().any(|fact| fact.contains("if you tick it")), "{:?}", copy.facts);
-
-        let create = &cards[1];
-        assert_eq!(create.kind, Kind::CreateHere);
-        assert!(create.available);
-        assert!(!create.recommended, "exactly one card is marked");
-        // Every card lands inside this app's own root, and the choice says where.
-        assert_eq!(Choice::new(Kind::CopyExisting).home(&place), place.project);
-        assert_eq!(Choice::new(Kind::CreateHere).home(&place), place.project);
-        assert_eq!(place.preselected().map(|card| card.kind), Some(Kind::CopyExisting));
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn the_copy_is_offered_because_it_reads_and_writability_decides_nothing() {
-        // The survey no longer asks whether a child can WRITE in the machine's home:
-        // nothing runs against it any more. A read-only source is still a source, and the
-        // copy is still the way in - the pack is then installed into the COPY.
-        let root = scratch("read-only-copy");
-        let app_root = root.join("app");
-        std::fs::create_dir_all(&app_root).unwrap();
-        let home = installation(&root, ".dsh");
-        let place = Where::survey(Some(&home), &app_root);
-
-        let cards = place.cards();
-        let copy = cards.iter().find(|card| card.kind == Kind::CopyExisting).expect("a copy card");
-        assert!(copy.available, "a copy only has to READ the source");
-        assert!(copy.recommended);
-        assert_eq!(place.preselected().map(|card| card.kind), Some(Kind::CopyExisting));
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn a_source_that_cannot_be_read_offers_only_a_fresh_home() {
-        let root = scratch("unreadable");
-        let app_root = root.join("app");
-        std::fs::create_dir_all(&app_root).unwrap();
-        let home = installation(&root, ".dsh");
-        let mut place = Where::survey(Some(&home), &app_root);
-        place.existing.as_mut().unwrap().readable = false;
-        let cards = place.cards();
-        // One card: a copy of a source that cannot be read can be neither offered nor
-        // taken, and its reason travels in the surviving card's details.
-        assert_eq!(cards.len(), 1, "{cards:#?}");
-        assert_eq!(cards[0].kind, Kind::CreateHere);
-        assert!(cards[0].available);
-        let folded = cards[0].facts.join("\n");
-        assert!(folded.contains("cannot be read"), "{folded}");
-        assert_eq!(place.preselected().map(|card| card.kind), Some(Kind::CreateHere));
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn a_machine_with_no_harness_home_shows_one_card_and_no_clutter() {
-        let root = scratch("nothing");
-        let app_root = root.join("app");
-        std::fs::create_dir_all(&app_root).unwrap();
-        let place = Where::survey(None, &app_root);
-        let cards = place.cards();
-        assert_eq!(cards.len(), 1, "there is nothing to say about a home that is not there");
-        assert_eq!(cards[0].kind, Kind::CreateHere);
-        assert!(cards[0].recommended);
-        assert!(place.preselected().is_some());
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn a_home_that_already_has_the_copy_offers_no_copy_and_says_why() {
-        // MEASURED: the click that did nothing. The source was readable, so the card
-        // was offered; the four durable trees were already in this app's own home, so
-        // the copy planned no items at all and `Adopt::start` refused - with its one
-        // sentence drawn inside `Details`, where nobody was looking. The card is now
-        // unavailable and carries the reason, and neither it nor a de-duplicated
-        // "fresh" card may promise anything the folder cannot deliver.
-        let root = scratch("already-copied");
-        let app_root = root.join("app");
-        std::fs::create_dir_all(&app_root).unwrap();
-        let home = installation(&root, ".dsh");
-        let place = Where::survey(Some(&home), &app_root);
-        // Stand in for the earlier run: the copy is already in this app's own home.
-        for name in ["skills", "sessions", "storages", "attachments"] {
-            std::fs::create_dir_all(place.project.join(name)).unwrap();
-            std::fs::write(place.project.join(name).join("something"), b"x").unwrap();
-        }
-        std::fs::write(place.project.join(".credentials.yaml"), b"deepseek: {apiKey: x}\n").unwrap();
-
-        let cards = place.cards();
-        // ONE CARD, because one answer can be taken. The owner's report, verbatim: "it
-        // starts already on second page with what I am copying here" - two greyed cards
-        // above the only one that works. They are still described, inside the surviving
-        // card's `details`.
-        assert_eq!(cards.len(), 1, "a screen with one answer must not draw the other: {cards:#?}");
-        let only = &cards[0];
-        assert_eq!(only.kind, Kind::CreateHere);
-        assert!(only.available);
-        assert_eq!(only.title, "Use the home in this folder");
-        assert!(only.summary.contains("this app's home already"), "{}", only.summary);
-        // Nothing is hidden: the refusal - and the path it names - is in the details.
-        assert!(
-            only.facts.iter().any(|fact| fact.starts_with("not offered here: Copy it here")),
-            "{:?}",
-            only.facts
-        );
-        assert!(
-            only.facts.iter().any(|fact| fact.contains(place.project.to_string_lossy().as_ref())),
-            "the paths stay on the screen: {:?}",
-            only.facts
-        );
-        assert_eq!(
-            place.preselected().map(|card| card.kind),
-            Some(Kind::CreateHere),
-            "the button at the foot takes the one card"
-        );
-        // ...and the facts it already had are still there, after the folded reasons.
-        assert!(
-            only.facts.iter().any(|fact| fact.contains("nothing is deleted")),
-            "{:?}",
-            only.facts
-        );
-        // Every sentence a label will draw is still free of markup.
-        for text in std::iter::once(only.title.as_str())
-            .chain(std::iter::once(only.summary.as_str()))
-            .chain(std::iter::once(only.continue_label.as_str()))
-            .chain(only.facts.iter().map(String::as_str))
-        {
-            assert!(
-                !text.contains("**") && !text.contains('`'),
-                "a card sentence carries markup a label cannot render: {text}"
-            );
-        }
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn two_answers_are_still_a_choice_and_are_both_drawn() {
-        // The single-card rule is for the state where NOTHING else can be pressed. A
-        // readable installation with something left to bring, beside a fresh folder,
-        // keeps both cards: there the choice is real, and hiding one would be deciding
-        // for the person.
-        let root = scratch("two-answers");
-        let app_root = root.join("app");
-        std::fs::create_dir_all(&app_root).unwrap();
-        let home = installation(&root, ".dsh");
-        let place = Where::survey(Some(&home), &app_root);
-        let cards = place.cards();
-        assert_eq!(cards.len(), 2, "{cards:#?}");
-        assert!(cards[0].available && cards[1].available);
-        assert_eq!(place.preselected().map(|card| card.kind), Some(Kind::CopyExisting));
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn the_copy_is_the_card_that_says_where_it_lands_and_why_not_when_it_cannot() {
-        // Each card still names the button under it, so the footer is never a mystery -
-        // and the one that cannot be pressed carries its own reason in words.
-        let root = scratch("refusal-points-on");
-        let app_root = root.join("app");
-        std::fs::create_dir_all(&app_root).unwrap();
-        let home = installation(&root, ".dsh");
-        let place = Where::survey(Some(&home), &app_root);
-
-        // Nothing copied here yet: the copy can be pressed, and it says where it goes.
-        let cards = place.cards();
-        let copy = cards.iter().find(|card| card.kind == Kind::CopyExisting).unwrap();
-        assert!(copy.available);
-        assert_eq!(copy.continue_label, "Copy it here and continue");
-        assert!(copy.summary.contains(&place.project.display().to_string()), "{}", copy.summary);
-
-        // The copy already happened: pointing at it would be a dead end, so the screen is
-        // ONE card and the refusal is read inside its details.
-        for name in ["skills", "sessions", "storages", "attachments"] {
-            std::fs::create_dir_all(place.project.join(name)).unwrap();
-            std::fs::write(place.project.join(name).join("something"), b"x").unwrap();
-        }
-        std::fs::write(place.project.join(".credentials.yaml"), b"deepseek: {apiKey: x}\n").unwrap();
-        let cards = place.cards();
-        assert_eq!(cards.len(), 1, "only the folder's home can be taken now: {cards:#?}");
-        let folded = cards[0].facts.join("\n");
-        assert!(folded.contains("nothing left to bring"), "{folded}");
-        assert!(folded.contains(&place.project.display().to_string()), "{folded}");
-        for card in &cards {
-            assert!(!card.continue_label.is_empty(), "{card:?}");
-        }
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn the_screen_a_confined_machine_sees_reads_as_a_way_on() {
-        // THE MEASURED SCREEN, pinned as one case. A machine where:
-        //   * `~/.dsh` is a complete installation (24 bundles, a key, sessions) and a
-        //     child CANNOT write in it - so that card cannot be taken;
-        //   * this app's own home already holds the copy (the durable trees AND a
-        //     credentials file with content) - so there is nothing left to copy;
-        //   * and the folder is a portable installation, so its own home is the root.
-        //
-        // What that used to look like: two red cards and a third named "Make a fresh
-        // home in this project" over a home that already existed, with no visible way to
-        // continue. Every line below is the answer to that, so it is a test rather than
-        // a paragraph in a plan.
-        let root = scratch("measured-screen");
-        let app_root = root.join("app");
-        std::fs::create_dir_all(&app_root).unwrap();
-        let home = root.join(".dsh");
-        std::fs::create_dir_all(profile::directory(&home, crate::launch::PROFILE)).unwrap();
-        std::fs::write(
-            profile::directory(&home, crate::launch::PROFILE).join("package.json"),
-            br#"{"dsh":{"profile":{"bundles":["@deepseek-ai/dsh-base","@deepseek-ai/dsh-web-app","dsh-rightbar","dsh-editor"]}}}"#,
-        )
-        .unwrap();
-        std::fs::create_dir_all(home.join("sessions")).unwrap();
-        std::fs::write(home.join("sessions").join("c1.json"), b"{}").unwrap();
-        std::fs::write(home.join(".credentials.yaml"), b"deepseek: {apiKey: x}\n").unwrap();
-
-        let place = Where::survey(Some(&home), &app_root);
-        for name in ["skills", "sessions", "storages", "attachments"] {
-            std::fs::create_dir_all(place.project.join(name)).unwrap();
-            std::fs::write(place.project.join(name).join("something"), b"x").unwrap();
-        }
-        std::fs::write(place.project.join(".credentials.yaml"), b"deepseek: {apiKey: y}\n").unwrap();
-
-        let cards = place.cards();
-        let taken = place.preselected().expect("one card can always be taken");
-
-        // The screen, as the panel draws it: the summary open, the facts behind
-        // `details`, the reason never collapsed.
-        for card in &cards {
-            println!(
-                "{} {}{}\n    {}\n    [ details ] {}",
-                if card.available { "▸" } else { "×" },
-                card.title,
-                if card.recommended { "  (recommended)" } else { "" },
-                card.summary,
-                card.facts.join("\n                ")
-            );
-            if let Some(reason) = card.unavailable.as_deref() {
-                println!("    ! {reason}");
-            }
-            println!("    [ {} ]", card.continue_label);
-        }
-        println!("[ {} ]  <- the way on, always in the same place", taken.continue_label);
-
-        // 1. ONE CARD, and it is the one that can be taken - the owner's report was "it
-        //    starts already on second page with what I am copying here", two greyed cards
-        //    above the answer. Nothing is lost: the refusal, with its path and its reason,
-        //    is in the details.
-        assert_eq!(cards.len(), 1, "one answer is not a choice: {cards:#?}");
-        let only = &cards[0];
-        assert!(only.available);
-        assert_eq!(only.title, "Use the home in this folder");
-        assert_eq!(only.kind, Kind::CreateHere);
-        assert!(only.summary.contains("this app's home already"), "{}", only.summary);
-        assert!(only.facts.iter().any(|fact| fact.contains("nothing is deleted")));
-        let folded = only.facts.join("\n");
-        assert!(folded.contains("not offered here: Copy it here"), "{folded}");
-        assert!(folded.contains("nothing left to bring"), "{folded}");
-        assert!(folded.contains("nothing is copied again"), "{folded}");
-        // ...and it never advertises a key it would skip: the target already has a
-        // credentials file, so the tick must not be offered anywhere.
-        assert!(!folded.contains("if you tick it"), "{folded}");
-        assert_eq!(taken.kind, Kind::CreateHere);
-        assert_eq!(taken.continue_label, "Continue with the home in this folder");
-
-        // NOTHING THE PANEL DRAWS CARRIES MARKUP. Every one of these strings reaches the
-        // reader through `ui.label`, which renders no markdown and no code spans - so
-        // `**Install pack**` arrived as literal asterisks and a backticked `Change` as a
-        // grave accent, measured on this very screen. The rule is checked where the
-        // strings are MADE, because a drawing function cannot fix a sentence.
-        for card in &cards {
-            let drawn: Vec<&str> = std::iter::once(card.title.as_str())
-                .chain(std::iter::once(card.summary.as_str()))
-                .chain(std::iter::once(card.continue_label.as_str()))
-                .chain(card.facts.iter().map(String::as_str))
-                .chain(card.unavailable.as_deref())
-                .collect();
-            for text in drawn {
-                assert!(
-                    !text.contains("**") && !text.contains('`'),
-                    "a card sentence carries markup a label cannot render: {text}"
-                );
-            }
-            // One id per card, so opening one card's details cannot open another's.
-            assert!(card.id() >= 1);
-        }
-        let ids: Vec<u32> = cards.iter().map(Card::id).collect();
-        let mut unique = ids.clone();
-        unique.sort_unstable();
-        unique.dedup();
-        assert_eq!(ids.len(), unique.len(), "two cards share a disclosure id: {ids:?}");
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn a_home_without_the_pack_is_still_worth_copying_and_the_card_says_so() {
-        // The source holds the person's sessions and key, and the pack is installed into
-        // the COPY next - so the copy is still the answer, and the card has to say that
-        // the pack is not in the source, or "recommended" would be misleading.
-        let root = scratch("no-pack");
-        let app_root = root.join("app");
-        std::fs::create_dir_all(&app_root).unwrap();
-        let home = installation(&root, ".dsh");
-        std::fs::write(
-            profile::directory(&home, crate::launch::PROFILE).join("package.json"),
-            br#"{"dsh":{"profile":{"bundles":["@deepseek-ai/dsh-base"]}}}"#,
-        )
-        .unwrap();
-        let place = Where::survey(Some(&home), &app_root);
-        let cards = place.cards();
-        let copy = cards.iter().find(|card| card.kind == Kind::CopyExisting).expect("a copy card");
-        assert!(copy.available);
-        assert!(copy.recommended, "the copy is the way in whenever there is something to bring");
-        assert!(
-            !copy.facts.iter().any(|fact| fact.contains("the pack is installed into the copy next")),
-            "the source has no pack, so the install into the copy is not a fact: {:?}",
-            copy.facts
-        );
-        assert_eq!(place.preselected().map(|card| card.kind), Some(Kind::CopyExisting));
-        let _ = std::fs::remove_dir_all(&root);
-    }
-}
diff --git a/app/crates/vn-shell-core/src/home.rs b/app/crates/vn-shell-core/src/home.rs
index d4cf812..4076db2 100644
--- a/app/crates/vn-shell-core/src/home.rs
+++ b/app/crates/vn-shell-core/src/home.rs
@@ -457,6 +457,11 @@ pub fn resolve_with(
 
 /// The inputs both resolvers are built from, so the root ladder alone and the whole
 /// resolution see one environment.
+///
+/// Nine of them and not a struct, because this is the ONE place the environment is read
+/// and grouping it would only move the same nine fields one call up. The count is the
+/// shape of the environment, not a design smell.
+#[allow(clippy::too_many_arguments)]
 fn inputs_from_env<'a>(
     named_root: Option<&'a str>,
     flag: Option<&'a str>,
diff --git a/app/crates/vn-shell-core/src/keystate.rs b/app/crates/vn-shell-core/src/keystate.rs
index a32d07b..f3ba1be 100644
--- a/app/crates/vn-shell-core/src/keystate.rs
+++ b/app/crates/vn-shell-core/src/keystate.rs
@@ -146,9 +146,7 @@ pub fn read(home: Option<&Path>) -> KeyState {
 pub fn console_line(state: &KeyState) -> String {
     match state.source() {
         Some(source) => format!("[vncode] DeepSeek key: loaded from {}", source.label()),
-        None => format!(
-            "[vncode] DeepSeek key: not found (checked the environment, the credentials file and .env) - add one in Settings > Models"
-        ),
+        None => "[vncode] DeepSeek key: not found (checked the environment, the credentials file and .env) - add one in Settings > Models".to_string(),
     }
 }
 
diff --git a/app/crates/vn-shell-core/src/lib.rs b/app/crates/vn-shell-core/src/lib.rs
index af6f213..c4ccbe7 100644
--- a/app/crates/vn-shell-core/src/lib.rs
+++ b/app/crates/vn-shell-core/src/lib.rs
@@ -1,40 +1,33 @@
 //! The vncode shell's PURE half.
 //!
-//! Everything here is decided by `cargo test` and nothing here opens a window,
-//! draws a pixel or owns a process. The split is the shell's whole safety
-//! argument: the rules that keep the launch token and the model API key inside
-//! (`readyline`, `keystate`) and the rules that decide WHICH harness this shell
-//! shows (`home`, `launch`, `ports`) are testable without a display, without a
-//! network and without a harness on disk.
+//! Everything here is decided by `cargo test`, and nothing here opens a window, draws a
+//! pixel, binds a port or owns a process. The split is the shell's whole safety argument:
+//! the rules that keep the model API key inside (`keystate`) and the rules that decide
+//! WHICH harness home this shell runs against (`home`, `appdata`, `userpath`) are testable
+//! without a display, without a network and without a harness on disk.
 //!
-//! The four modules that carry the load-bearing rules were MOVED here from the
-//! old `app/src-tauri` tree rather than rewritten, comments and tests included:
-//! `readyline`, `windowstate`, `keystate` and — as what is now `appdata` — the
-//! application-data root. A rewrite of any of them would be a regression by
-//! definition, because each one is the record of a bug that was measured on a real
-//! machine. (`payload`, the single-file container reader, was the fourth and left
-//! with the distributer that produced such files; `appdata` is the part of it that
-//! was still load-bearing.)
+//! There is no web engine here and no window state. The page is the harness's, it is
+//! served on loopback, and the browser that shows it is started by `scripts/run-web.*` -
+//! which is also the only thing that ever reads a launch token.
+//!
+//! The modules that carry the load-bearing rules were MOVED here from the old
+//! `app/src-tauri` tree rather than rewritten, comments and tests included: `readyline`
+//! (the token, and its redaction), `keystate` (the four key layers, presence only) and -
+//! as what is now `appdata` - the application-data root. A rewrite of any of them would be
+//! a regression by definition, because each one is the record of a bug that was measured
+//! on a real machine.
 
-pub mod adopt;
 pub mod appdata;
-pub mod appprefs;
-pub mod browser;
-pub mod firstrun;
 pub mod home;
 pub mod keystate;
 pub mod launch;
 pub mod log;
 pub mod options;
-pub mod pane;
 pub mod ports;
 pub mod prefs;
 pub mod profile;
 pub mod readyline;
-pub mod status;
-pub mod urlpolicy;
 pub mod userpath;
-pub mod windowstate;
 
 /// Where a test writes. Test-only, and overridable so the checks can run on a
 /// host that denies the system temp directory.
diff --git a/app/crates/vn-shell-core/src/options.rs b/app/crates/vn-shell-core/src/options.rs
index 66e93cd..48ee55b 100644
--- a/app/crates/vn-shell-core/src/options.rs
+++ b/app/crates/vn-shell-core/src/options.rs
@@ -1,81 +1,65 @@
-//! The flags, mirroring `scripts\run-web.bat` / `scripts\run-desktop.bat`, so the
-//! three stay interchangeable.
+//! The flags and the verbs, mirroring `scripts\run-web.bat` / `scripts/run-web.sh`,
+//! so the app and the launchers stay interchangeable.
 //!
 //! Both spellings of each flag are accepted (`-Port` and `--port`) and matching is
-//! case-insensitive, because `-Port` is what the batch files document and
-//! `--port` is what a shell user types. An unknown flag is an ERROR that names
-//! the flag, never something quietly ignored: the flags a typo turns into are the
-//! ones that decide which harness runs and on which port.
+//! case-insensitive, because `-Port` is what the batch files document and `--port` is what
+//! a shell user types. An unknown flag, and an unknown verb, are an ERROR that names what
+//! was not understood: the things a typo turns into are the ones that decide which harness
+//! home is used and which script is run.
+//!
+//! There is no `-Mode` any more, and its absence is the change this shell is made of: it
+//! draws no window and no web view, so "panel or browser or embed" ceased to be a choice.
+//! What is left is what it DOES - install, ask for the key, start the web launcher - and
+//! each of those is a verb.
 
 use std::fmt;
 
-/// The shapes the shell can take. `Panel` means "start nothing", which is the state the
-/// app OPENS in.
+/// What this run is asked to do.
 ///
-/// `Embed` is the pane, and it exists only in a build that has one: this crate is the pure
-/// half and has no engine, so the PARSER is told whether the pane is there ([`Mode::parse_with`])
-/// rather than reading a feature flag. A build without it still refuses `-Mode embed` BY
-/// NAME, with the reason, because a flag that silently means something else is a flag nobody
-/// can trust.
+/// `Start` is what no verb means: the whole path, from "is the pack installed" to "the
+/// browser has the page".
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Mode {
-    /// The control panel and nothing else. The harness is not started.
-    Panel,
-    /// The panel, with the harness UI opened in a browser this app chose - or, in a build
-    /// that has the pane, inside this window.
-    Chrome,
-    /// No window at all: a supervisor and a log, for a server or a check.
-    Headless,
-    /// The harness page in front, drawn inside this window by the OS web engine.
-    Embed,
+pub enum Command {
+    /// Install the pack if the profile lacks it, ask for the key if there is none, then
+    /// run `scripts/run-web.*` in the foreground.
+    Start,
+    /// Run `scripts/setup/install.*` against the home in use.
+    Install,
+    /// Run the matching pair.
+    Uninstall,
+    /// Print the facts and start nothing.
+    Status,
+    /// Ask for the DeepSeek key and write it into `<home>/.env`.
+    Key,
 }
 
-impl Mode {
+impl Command {
     pub fn name(self) -> &'static str {
         match self {
-            Mode::Panel => "panel",
-            Mode::Chrome => "chrome",
-            Mode::Headless => "headless",
-            Mode::Embed => "embed",
+            Command::Start => "start",
+            Command::Install => "install",
+            Command::Uninstall => "uninstall",
+            Command::Status => "status",
+            Command::Key => "key",
         }
     }
 
-    /// The mode a build WITHOUT a pane parses: `embed` is refused by name.
-    pub fn parse(value: &str) -> Result<Mode, String> {
-        Mode::parse_with(value, false)
-    }
-
-    /// The mode a build parses, told whether it can show the harness in its own window.
-    ///
-    /// The answer travels as a VALUE rather than as a feature flag, because this crate has
-    /// no engine and must not learn of one: the binary asks its panel, and both answers are
-    /// `cargo test` cases here.
-    pub fn parse_with(value: &str, pane_available: bool) -> Result<Mode, String> {
+    pub fn parse(value: &str) -> Result<Command, String> {
         match value.to_ascii_lowercase().as_str() {
-            "panel" => Ok(Mode::Panel),
-            "chrome" | "browser" => Ok(Mode::Chrome),
-            "headless" => Ok(Mode::Headless),
-            "embed" | "pane" if pane_available => Ok(Mode::Embed),
-            // Named, so somebody who read a plan that promised a pane learns WHY this build
-            // has none rather than wondering whether they typed it wrong.
-            "embed" | "pane" => Err(
-                "-Mode embed is not a mode this build has: it was compiled without the pane, so it draws no web view. The harness UI opens in a browser - `-Mode chrome`, which is the default. See docs/PLAN-egui-shell.md"
-                    .to_string(),
-            ),
+            "start" | "run" => Ok(Command::Start),
+            "install" | "add" => Ok(Command::Install),
+            "uninstall" | "remove" => Ok(Command::Uninstall),
+            "status" | "info" => Ok(Command::Status),
+            "key" | "token" => Ok(Command::Key),
             other => Err(format!(
-                "-Mode expects one of panel, chrome, headless or embed - got '{other}'"
+                "unknown command '{other}' - expected one of start, install, uninstall, status or key \
+                 (no command means start)"
             )),
         }
     }
-
-    /// The mode this build uses when no flag was given: `chrome`, which shows the
-    /// harness in a browser and is what every launcher in this repository does.
-    pub fn default_mode() -> Mode {
-        Mode::Chrome
-    }
 }
 
-impl fmt::Display for Mode {
+impl fmt::Display for Command {
     fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
         formatter.write_str(self.name())
     }
@@ -84,31 +68,25 @@ impl fmt::Display for Mode {
 /// The flags this shell parses.
 #[derive(Clone, Default, Debug, PartialEq, Eq)]
 pub struct Options {
-    /// Explicit port; 0 means "pick a free one".
+    /// What to do; `None` is `Command::Start`.
+    pub command: Option<Command>,
+    /// Explicit port handed to the web launcher; 0 means "let the harness decide".
     pub port: u16,
     pub dsh_home: Option<String>,
     pub dsh_version: Option<String>,
-    pub mode: Option<Mode>,
     pub help: bool,
+    pub version: bool,
 }
 
 impl Options {
-    /// The mode this run will use.
-    pub fn mode(&self) -> Mode {
-        self.mode.unwrap_or_else(Mode::default_mode)
+    /// The verb this run will perform.
+    pub fn command(&self) -> Command {
+        self.command.unwrap_or(Command::Start)
     }
 }
 
-/// Parse the flags for a build WITH NO PANE: `-Mode embed` is refused by name.
+/// Parse the flags and the one optional verb.
 pub fn parse_args(args: impl Iterator<Item = String>) -> Result<Options, String> {
-    parse_args_with(args, false)
-}
-
-/// Parse the flags, told whether this build can show the harness in its own window.
-pub fn parse_args_with(
-    args: impl Iterator<Item = String>,
-    pane_available: bool,
-) -> Result<Options, String> {
     let mut options = Options::default();
     let mut args = args;
     while let Some(argument) = args.next() {
@@ -127,16 +105,26 @@ pub fn parse_args_with(
             "-dshversion" | "--dshversion" => {
                 options.dsh_version = Some(next_value(&mut args, "-DshVersion")?)
             }
-            "-mode" | "--mode" => {
-                options.mode =
-                    Some(Mode::parse_with(&next_value(&mut args, "-Mode")?, pane_available)?)
-            }
             "-help" | "--help" | "-h" | "/?" => options.help = true,
-            other => {
+            "-version" | "--version" | "-v" => options.version = true,
+            other if other.starts_with('-') || other.starts_with('/') => {
                 return Err(format!(
-                    "unknown flag '{other}' - run scripts\\run-desktop.bat -Help for the accepted flags"
+                    "unknown flag '{other}' - run `vncode -Help` for the accepted flags"
                 ))
             }
+            verb => {
+                // ONE verb, and it goes first by convention - but a flag before it is
+                // ordinary (`vncode -DshHome C:\h start`), so the verb is taken wherever
+                // it appears rather than only at argv[0].
+                let parsed = Command::parse(verb)?;
+                if options.command.is_some() {
+                    return Err(format!(
+                        "only one command may be given - this run already asked for '{}'",
+                        options.command().name()
+                    ));
+                }
+                options.command = Some(parsed);
+            }
         }
     }
     Ok(options)
@@ -147,33 +135,35 @@ fn next_value(args: &mut impl Iterator<Item = String>, flag: &str) -> Result<Str
         .ok_or_else(|| format!("{flag} needs a value after it"))
 }
 
-/// The usage text. One string, so the flags this shell accepts live in exactly one
-/// place and `check-shell.mjs` can drive the binary and read it back.
+/// The usage text. One string, so the verbs and flags this shell accepts live in exactly
+/// one place and a check can drive the binary and read it back.
 pub const USAGE: &str = "\
-Usage: scripts\\run-desktop.bat [flags]
+Usage: vncode [start|install|uninstall|status|key] [flags]
+
+  (no command)       install the pack if this home lacks it, ask for the DeepSeek key
+                     if there is none, then start the harness and open it - this runs
+                     scripts/run-web.bat (Windows) or scripts/run-web.sh, in the
+                     foreground, exactly as double-clicking that file does
+  start              the same thing, spelled out
+  install            run scripts/setup/install.* against the home in use
+  uninstall          run scripts/setup/uninstall.* against it
+  status             print the pin, the home and why it was chosen, the pack, the key
+                     layer and where the launcher is; start nothing
+  key                ask for the DeepSeek key and write it into <home>/.env (0600)
 
-  -Port <n>          listen on this port instead of a free one
+  -Port <n>          hand this port to the web launcher instead of the harness default
   -DshHome <dir>     use this harness home instead of the one the app chose
                      (a leading ~ is expanded; a relative path is resolved here)
   -DshVersion <ver>  override the pinned dsh version from .dsh-version.json
-  -Mode <mode>       chrome (the harness UI in a browser - the default),
-                     panel (open idle and start nothing) or headless (no window)
   -Help              print this help
+  -Version           print the version
 
-Opens on a control panel: nothing is started until you press Start, and Stop ends
-the instance and frees its port. Start runs the same pinned harness, on the same
-port and with the same flags as scripts\\run-web.bat - anything a browser tab can
-do in that profile, this window can do, because it is the same server. There is no
-embedded web view: the interface opens in a browser, and the panel offers Google
-Chrome first when it is installed.
+vncode is the app's front door, not a second harness: it decides the root, the key and
+the pack, and then runs the SAME scripts a person would run. Launching only the web
+needs none of this - scripts/run-web.bat or ./scripts/run-web.sh works on its own.
 
-The app owns a root ($VNCODE_HOME) and the harness home is <root>/home inside it.
-The panel shows which home is in use and why, offers to use or adopt an existing
-harness home (~/.dsh), and installs the pack into the home it chose.
-
-Install, Uninstall and Adopt in that panel run scripts/setup/install.*,
-scripts/setup/uninstall.* and this app's own copy - the same files a person would
-click.";
+The app owns a root ($VNCODE_HOME) and the harness home is <root>/home inside it. This
+command never draws the interface: the page opens in a browser it found.";
 
 pub fn print_usage() {
     println!();
@@ -181,26 +171,8 @@ pub fn print_usage() {
     println!();
 }
 
-/// The usage text for a build, told whether it has the pane.
-///
-/// `USAGE` above is the text for a build WITHOUT one, and it stays the text the checks read
-/// back. A build with the pane prints the same flags plus the one it gained, as an
-/// ADDITION rather than as a second copy of the whole text - so the flags, the reasons and
-/// the wording cannot drift apart between the two builds.
-pub fn usage(pane_available: bool) -> String {
-    if !pane_available {
-        return USAGE.to_string();
-    }
-    format!(
-        "{USAGE}\n\n  -Mode embed        open with the harness page in front, drawn inside this\n                     window by the OS web engine (this build has the pane)\n\nThis build has the pane: the harness can be shown inside this window, and the\nbrowser hand-off becomes the floor under it - `Open in my browser` on the pane's\nown bar. Without it the interface opens in a browser, and the panel offers Google\nChrome first when it is installed.\n"
-    )
-}
-
-/// Print the usage text for a build that may have the pane.
-pub fn print_usage_with(pane_available: bool) {
-    println!();
-    println!("{}", usage(pane_available));
-    println!();
+pub fn print_version() {
+    println!("vncode {}", env!("CARGO_PKG_VERSION"));
 }
 
 #[cfg(test)]
@@ -228,11 +200,30 @@ mod tests {
         assert_eq!(long.dsh_home.as_deref(), Some("/tmp/g"));
     }
 
+    #[test]
+    fn no_command_is_start_and_every_command_parses() {
+        assert_eq!(parse_args(args(&[])).unwrap().command(), Command::Start);
+        assert_eq!(parse_args(args(&["start"])).unwrap().command(), Command::Start);
+        assert_eq!(parse_args(args(&["INSTALL"])).unwrap().command(), Command::Install);
+        assert_eq!(parse_args(args(&["uninstall"])).unwrap().command(), Command::Uninstall);
+        assert_eq!(parse_args(args(&["status"])).unwrap().command(), Command::Status);
+        assert_eq!(parse_args(args(&["key"])).unwrap().command(), Command::Key);
+        // A flag before the verb is ordinary, and the verb is found where it appears.
+        let options = parse_args(args(&["-DshHome", "/tmp/h", "install"])).unwrap();
+        assert_eq!(options.command(), Command::Install);
+        assert_eq!(options.dsh_home.as_deref(), Some("/tmp/h"));
+        // Two verbs is one too many.
+        let error = parse_args(args(&["install", "status"])).unwrap_err();
+        assert!(error.contains("only one command"), "{error}");
+        let error = parse_args(args(&["sideways"])).unwrap_err();
+        assert!(error.contains("unknown command 'sideways'"), "{error}");
+        assert!(error.contains("start, install, uninstall, status or key"), "{error}");
+    }
+
     #[test]
     fn an_unknown_flag_is_refused_and_named() {
-        // The failure this prevents: a typo silently becoming a default, so the
-        // shell runs a different harness or a different port than the one asked
-        // for and reports nothing.
+        // The failure this prevents: a typo silently becoming a default, so the shell
+        // runs a different harness or a different port than the one asked for.
         let error = parse_args(args(&["-Prot", "3099"])).unwrap_err();
         assert!(error.contains("-prot"), "{error}");
         assert!(error.contains("unknown flag"), "{error}");
@@ -246,8 +237,6 @@ mod tests {
 
     #[test]
     fn port_zero_is_refused_rather_than_meaning_a_random_port() {
-        // 0 is the OS's "pick one for me"; the flag that means that is no flag at
-        // all, because the shell prefers the harness's own default origin first.
         assert!(parse_args(args(&["-Port", "0"]))
             .unwrap_err()
             .contains("above zero"));
@@ -257,67 +246,37 @@ mod tests {
     }
 
     #[test]
-    fn the_mode_flag_names_what_it_accepts_and_refuses_what_it_does_not() {
-        assert_eq!(parse_args(args(&["-Mode", "chrome"])).unwrap().mode, Some(Mode::Chrome));
-        assert_eq!(parse_args(args(&["-mode", "HEADLESS"])).unwrap().mode, Some(Mode::Headless));
-        assert_eq!(parse_args(args(&["-Mode", "panel"])).unwrap().mode, Some(Mode::Panel));
-        let error = parse_args(args(&["-Mode", "sideways"])).unwrap_err();
-        assert!(error.contains("panel, chrome, headless or embed"), "{error}");
-        // `embed` is a mode a build WITHOUT the pane does not have, and it says so by name
-        // rather than quietly opening a browser and letting the reader think a pane exists.
+    fn there_is_no_mode_flag_any_more_and_no_embedded_web_view() {
+        // The pane is gone. A `-Mode embed` that used to select it must FAIL, and the
+        // usage text must not advertise a surface this build does not have.
         let error = parse_args(args(&["-Mode", "embed"])).unwrap_err();
-        assert!(error.contains("draws no web view"), "{error}");
-        assert!(error.contains("chrome"), "{error}");
-        // ...and the SAME spelling is a real mode in a build that has one. That is why the
-        // answer is passed in rather than compiled in: both are cases here.
-        assert_eq!(
-            parse_args_with(args(&["-Mode", "embed"]), true).unwrap().mode,
-            Some(Mode::Embed)
-        );
-        assert_eq!(Mode::parse_with("pane", true).unwrap(), Mode::Embed);
-        assert_eq!(Mode::name(Mode::Embed), "embed");
-        assert!(Mode::parse_with("embed", false).is_err());
-        // The usage text grows the one flag the pane adds and keeps every other one.
-        let with_pane = usage(true);
-        assert!(with_pane.contains("-Mode embed"), "{with_pane}");
-        for flag in ["-Port", "-DshHome", "-DshVersion", "-Mode", "-Help"] {
-            assert!(with_pane.contains(flag), "the pane's usage text lost {flag}");
+        assert!(error.contains("unknown flag"), "{error}");
+        for word in ["embed", "pane", "-Mode"] {
+            assert!(!USAGE.contains(word), "the usage text still mentions {word}");
+        }
+        // ...and every verb and flag it DOES accept is named in it.
+        for word in ["install", "uninstall", "status", "key", "-Port", "-DshHome", "-Help"] {
+            assert!(USAGE.contains(word), "the usage text never mentions {word}");
         }
-        assert!(
-            !usage(false).contains("-Mode embed"),
-            "a build with no pane must not advertise one"
-        );
     }
 
     #[test]
     fn the_launchers_flags_are_not_silently_swallowed() {
-        // -NoPause/-NoTerminal/-NoBuild belong to the launcher and are stripped
-        // there; reaching this parser means they were NOT stripped, and the shell
-        // must say so rather than run with a flag it ignored.
+        // -NoPause/-NoTerminal/-NoBuild belong to the launcher scripts and are stripped
+        // there; reaching this parser means they were NOT stripped, and the shell must
+        // say so rather than run with a flag it ignored.
         for flag in ["-NoPause", "-NoTerminal", "-NoBuild"] {
             assert!(parse_args(args(&[flag])).is_err(), "{flag} was accepted");
         }
     }
 
     #[test]
-    fn the_usage_text_names_every_flag_the_parser_takes() {
-        for flag in ["-Port", "-DshHome", "-DshVersion", "-Mode", "-Help"] {
-            assert!(USAGE.contains(flag), "the usage text never mentions {flag}");
-        }
-    }
-
-    #[test]
-    fn the_default_mode_is_the_one_every_launcher_in_this_repository_uses() {
-        // `chrome`: the harness UI in a browser. There is no pane to prefer, and no
-        // platform on which the answer differs - which is what makes the flag set,
-        // the launcher and the docs agree.
-        assert_eq!(Mode::default_mode(), Mode::Chrome);
-        let nothing_asked = Options::default();
-        assert_eq!(nothing_asked.mode(), Mode::Chrome);
-        // ...and an explicit flag always wins.
-        let asked = Options { mode: Some(Mode::Headless), ..Options::default() };
-        assert_eq!(asked.mode(), Mode::Headless);
-        let idle = Options { mode: Some(Mode::Panel), ..Options::default() };
-        assert_eq!(idle.mode(), Mode::Panel);
+    fn help_and_version_are_flags_not_verbs() {
+        assert!(parse_args(args(&["-Help"])).unwrap().help);
+        assert!(parse_args(args(&["--help"])).unwrap().help);
+        assert!(parse_args(args(&["-Version"])).unwrap().version);
+        assert!(parse_args(args(&["--version"])).unwrap().version);
+        // ...and asking for help is not asking for a verb.
+        assert_eq!(parse_args(args(&["-Help"])).unwrap().command(), Command::Start);
     }
 }
diff --git a/app/crates/vn-shell-core/src/pane.rs b/app/crates/vn-shell-core/src/pane.rs
deleted file mode 100644
index 42e5466..0000000
--- a/app/crates/vn-shell-core/src/pane.rs
+++ /dev/null
@@ -1,236 +0,0 @@
-//! The pane: where the harness is drawn inside the shell's own window, when it may be
-//! seen, and what it may load.
-//!
-//! ## The measured fact this module exists for
-//!
-//! An OS web view created as a **child of the window** is a sibling of the surface the
-//! panel paints on (`pane-spike`, P0: `WEBVIEW-UP` + `PAGE-LOADED` + `JS-RAN` with the
-//! engine's own runtime `155.0.4283.45`, while `chrome.exe` launched by the same process
-//! died `0x80000003`). Being a sibling and not a layer, it is drawn **above** everything
-//! egui draws, and it cannot be clipped, scrolled or drawn over. There is no z-order to
-//! negotiate: there is only *is it visible right now*, and getting that wrong shows a web
-//! page through the panel's own dialog.
-//!
-//! So the decision is a pure function of facts the panel already has, and it is
-//! `cargo test` cases rather than something anybody checks by looking at a window.
-//!
-//! ## The one arithmetic a scaled display gets wrong
-//!
-//! The panel measures in egui **points**; the engine wants **physical pixels**. The
-//! conversion happens here, once, with the window's own scale factor, and there is a test
-//! per scale the three platforms actually use - because the alternative is a rectangle
-//! that is right on a 100% display and half-size on a 200% one.
-//!
-//! No engine is named in this module and none is needed to test any of it.
-
-use url::Url;
-
-/// A rectangle in egui points (logical pixels): what the panel measures.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub struct RectPoints {
-    pub min_x: f32,
-    pub min_y: f32,
-    pub width: f32,
-    pub height: f32,
-}
-
-/// A rectangle in physical pixels: what the engine is given.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct PhysicalRect {
-    pub x: i32,
-    pub y: i32,
-    pub width: u32,
-    pub height: u32,
-}
-
-/// Everything the panel knows when it decides whether the pane may be seen.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub struct PanePolicy {
-    /// The pane's own page is the one in front, and the control panel is not.
-    pub is_active_page: bool,
-    /// The harness printed its ready line, so there is something to show.
-    pub harness_ready: bool,
-    /// An egui overlay is open: a modal, a combo box's open list, the first-run screen.
-    /// Every one of those would be drawn *under* the pane, so the pane gets out of the way.
-    pub overlay_open: bool,
-    /// The rectangle the pane would occupy, in points.
-    pub rect: RectPoints,
-}
-
-/// What the pane should do about it.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct PaneView {
-    /// Whether the engine's view may be shown. Everything else about it is unchanged.
-    pub visible: bool,
-    /// The rectangle it occupies, in physical pixels - reported **even when hidden**, so
-    /// the engine is positioned before it is shown and showing never moves it.
-    pub bounds: PhysicalRect,
-}
-
-/// Whether the pane may be seen, and where it goes.
-pub fn decide(policy: &PanePolicy, scale_factor: f32) -> PaneView {
-    let bounds = physical(policy.rect, scale_factor);
-    // A rectangle with no extent is not a pane: showing it would be showing a 0-pixel
-    // child window, which some engines treat as a full-window one.
-    let has_extent = bounds.width > 0 && bounds.height > 0;
-    let visible =
-        policy.is_active_page && policy.harness_ready && !policy.overlay_open && has_extent;
-    PaneView { visible, bounds }
-}
-
-/// Points to physical pixels.
-///
-/// A scale factor that is not one - zero, negative, NaN, infinite - falls back to 1.0
-/// rather than poisoning the rectangle: a window that reports a nonsense scale is a
-/// window whose pane should be *missized honestly*, not invisible or enormous.
-pub fn physical(rect: RectPoints, scale_factor: f32) -> PhysicalRect {
-    let scale = if scale_factor.is_finite() && scale_factor > 0.0 { scale_factor } else { 1.0 };
-    PhysicalRect {
-        // A child view is inside its parent: a negative origin is not a place.
-        x: coordinate(rect.min_x * scale),
-        y: coordinate(rect.min_y * scale),
-        width: extent(rect.width * scale),
-        height: extent(rect.height * scale),
-    }
-}
-
-fn coordinate(value: f32) -> i32 {
-    if !value.is_finite() || value <= 0.0 {
-        return 0;
-    }
-    value.round().min(i32::MAX as f32) as i32
-}
-
-fn extent(value: f32) -> u32 {
-    if !value.is_finite() || value <= 0.0 {
-        return 0;
-    }
-    value.round().min(u32::MAX as f32) as u32
-}
-
-/// The URL the pane may be given, or why it may not.
-///
-/// The same rule as the ready line and as `browser::command_with`, applied at the last
-/// function before a navigation - a rule that holds at only one end of a pipe is not a
-/// rule. A URL that is not the harness's own loopback address is refused by name; a link
-/// the reader clicks inside the page belongs to their browser, not to this window.
-pub fn may_load(url: &str) -> Result<Url, String> {
-    let parsed = Url::parse(url).map_err(|error| format!("'{url}' is not a URL: {error}"))?;
-    if !crate::urlpolicy::is_internal(&parsed) {
-        return Err(format!(
-            "refusing to load {}: only the harness's own loopback address may be shown inside this window",
-            parsed.host_str().unwrap_or("that address")
-        ));
-    }
-    Ok(parsed)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn rect() -> RectPoints {
-        RectPoints { min_x: 10.0, min_y: 20.0, width: 800.0, height: 600.0 }
-    }
-
-    fn policy(is_active_page: bool, harness_ready: bool, overlay_open: bool) -> PanePolicy {
-        PanePolicy { is_active_page, harness_ready, overlay_open, rect: rect() }
-    }
-
-    #[test]
-    fn the_pane_is_shown_only_in_front_ready_and_uncovored() {
-        // Written as a table because every one of the three is a measured way to show a
-        // web page through the panel: the other page, no harness behind it, a dialog.
-        let cases = [
-            (true, true, false, true),
-            (false, true, false, false),
-            (true, false, false, false),
-            (true, true, true, false),
-            (false, false, true, false),
-        ];
-        for (is_active_page, harness_ready, overlay_open, expected) in cases {
-            let view = decide(&policy(is_active_page, harness_ready, overlay_open), 1.0);
-            assert_eq!(
-                view.visible, expected,
-                "active={is_active_page} ready={harness_ready} overlay={overlay_open}"
-            );
-        }
-    }
-
-    #[test]
-    fn a_rectangle_that_is_not_a_rectangle_is_never_shown() {
-        for rect in [
-            RectPoints { min_x: 0.0, min_y: 0.0, width: 0.0, height: 600.0 },
-            RectPoints { min_x: 0.0, min_y: 0.0, width: 800.0, height: 0.0 },
-            RectPoints { min_x: 0.0, min_y: 0.0, width: -800.0, height: 600.0 },
-            RectPoints { min_x: 0.0, min_y: 0.0, width: f32::NAN, height: 600.0 },
-        ] {
-            let view = decide(&PanePolicy { rect, ..policy(true, true, false) }, 1.0);
-            assert!(!view.visible, "{rect:?} was shown");
-        }
-    }
-
-    #[test]
-    fn points_become_physical_pixels_at_every_scale_the_platforms_use() {
-        // Windows 100/125/150%, macOS 200%, and a fractional one that does not round.
-        assert_eq!(physical(rect(), 1.0), PhysicalRect { x: 10, y: 20, width: 800, height: 600 });
-        assert_eq!(physical(rect(), 1.25), PhysicalRect { x: 13, y: 25, width: 1000, height: 750 });
-        assert_eq!(physical(rect(), 1.5), PhysicalRect { x: 15, y: 30, width: 1200, height: 900 });
-        assert_eq!(physical(rect(), 1.75), PhysicalRect { x: 18, y: 35, width: 1400, height: 1050 });
-        assert_eq!(physical(rect(), 2.0), PhysicalRect { x: 20, y: 40, width: 1600, height: 1200 });
-    }
-
-    #[test]
-    fn a_scale_factor_that_is_not_a_scale_factor_falls_back_to_one() {
-        let honest = physical(rect(), 1.0);
-        for nonsense in [0.0, -1.5, f32::NAN, f32::INFINITY, f32::NEG_INFINITY] {
-            assert_eq!(physical(rect(), nonsense), honest, "{nonsense} was not caught");
-        }
-    }
-
-    #[test]
-    fn a_negative_origin_is_clamped_into_the_window() {
-        let off = RectPoints { min_x: -50.0, min_y: -8.0, width: 800.0, height: 600.0 };
-        assert_eq!(physical(off, 1.0), PhysicalRect { x: 0, y: 0, width: 800, height: 600 });
-    }
-
-    #[test]
-    fn bounds_are_reported_even_when_the_pane_is_hidden() {
-        // The engine is positioned before it is shown, so showing it never moves it - a
-        // pane that jumps on the frame it appears is the sort of thing a person reports
-        // as "it flickers".
-        let view = decide(&policy(false, true, false), 1.5);
-        assert!(!view.visible);
-        assert_eq!(view.bounds, PhysicalRect { x: 15, y: 30, width: 1200, height: 900 });
-    }
-
-    #[test]
-    fn only_the_harness_loopback_address_may_be_loaded() {
-        for allowed in [
-            // A placeholder, deliberately too short to look like a credential: the check
-            // that scans this repository fires on a launch-token shape, and a test that
-            // ships what looks like a live token is a test that fails the pack's own
-            // no-secrets check.
-            "http://127.0.0.1:51347/?token=x",
-            "http://localhost:51347/",
-            "https://[::1]:9/",
-        ] {
-            assert!(may_load(allowed).is_ok(), "{allowed} was refused");
-        }
-        for refused in [
-            "http://evil.example/?token=x",
-            "https://127.0.0.1.evil.example/",
-            "file:///etc/passwd",
-            "data:text/html,<h1>hi</h1>",
-            "javascript:alert(1)",
-            "about:blank",
-            "not a url at all",
-        ] {
-            let error = may_load(refused).unwrap_err();
-            assert!(error.contains("not a URL") || error.contains("refusing to load"), "{error}");
-        }
-        // The refusal names what it refused, so a log line is evidence.
-        let error = may_load("http://evil.example/").unwrap_err();
-        assert!(error.contains("evil.example"), "{error}");
-    }
-}
diff --git a/app/crates/vn-shell-core/src/status.rs b/app/crates/vn-shell-core/src/status.rs
deleted file mode 100644
index 53ea5d1..0000000
--- a/app/crates/vn-shell-core/src/status.rs
+++ /dev/null
@@ -1,296 +0,0 @@
-//! What the panel draws, and the one field in it that must never be printed.
-//!
-//! The harness prints its ready line with the launch token in it, and the shell
-//! hands that URL to the pane. So the live URL has to be held somewhere - and
-//! everything about this module exists to make holding it safe:
-//!
-//! - it is PRIVATE, reachable only through [`Status::navigate_url`], whose doc
-//!   says out loud that it is for the pane and nothing else;
-//! - [`Status::public_url`] is the displayable form, with the query (and with it
-//!   the token) stripped;
-//! - [`Status`]'s `Debug` is written BY HAND, because a derived one would print
-//!   the token into a panic message, a log line or a test failure - which is
-//!   exactly the accident the launch-token rules exist to prevent;
-//! - [`Status::safe_line`], which is what the console prints, is built from the
-//!   safe parts alone.
-
-use std::fmt;
-use std::time::{Duration, Instant};
-
-use url::Url;
-
-/// Where the instance is in its life. Nothing here is a guess: `Running` is set
-/// from the ready line, and `Stopped` only after the tree is dead and the port has
-/// been checked.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Phase {
-    /// The app just opened. Nothing has been started, and nothing will be until
-    /// Start is pressed.
-    Idle,
-    /// A child exists and its ready line has not arrived yet.
-    Starting,
-    /// The ready line arrived; the URL is known.
-    Running,
-    /// Stop was pressed and the tree is being taken down.
-    Stopping,
-    /// Stopped, with the port checked.
-    Stopped,
-    /// Something went wrong. `detail` says what, in words safe to paste.
-    Failed,
-}
-
-impl Phase {
-    pub fn label(self) -> &'static str {
-        match self {
-            Phase::Idle => "stopped",
-            Phase::Starting => "starting",
-            Phase::Running => "running",
-            Phase::Stopping => "stopping",
-            Phase::Stopped => "stopped",
-            Phase::Failed => "failed",
-        }
-    }
-
-    /// Whether a child process exists in this phase.
-    pub fn is_live(self) -> bool {
-        matches!(self, Phase::Starting | Phase::Running | Phase::Stopping)
-    }
-}
-
-/// The status the panel renders, shared between the supervisor thread and the UI.
-///
-/// `Clone` is what lets the panel take a snapshot each frame instead of holding
-/// the lock while it draws. Cloning the URL clones the token with it, which is
-/// fine - it stays in memory either way, and `Debug` is still hand-written.
-#[derive(Clone)]
-pub struct Status {
-    pub phase: Phase,
-    pub port: Option<u16>,
-    pub pid: Option<u32>,
-    /// The loopback URL, WITH the launch token. Private on purpose - see the
-    /// module header.
-    url: Option<Url>,
-    /// A message that is safe to show and to paste: it never contains the token.
-    pub detail: Option<String>,
-    /// The result of the post-Stop port check. `None` means "not checked".
-    pub port_free: Option<bool>,
-    started: Option<Instant>,
-}
-
-impl Default for Status {
-    fn default() -> Self {
-        Status {
-            phase: Phase::Idle,
-            port: None,
-            pid: None,
-            url: None,
-            detail: None,
-            port_free: None,
-            started: None,
-        }
-    }
-}
-
-impl Status {
-    pub fn idle() -> Status {
-        Status::default()
-    }
-
-    pub fn set_url(&mut self, url: Url) {
-        self.url = Some(url);
-    }
-
-    /// The full URL, token included: for handing to the pane, and for nothing
-    /// else. Every other reader wants [`Status::public_url`].
-    pub fn navigate_url(&self) -> Option<&str> {
-        self.url.as_ref().map(Url::as_str)
-    }
-
-    /// The displayable URL: scheme, host and port, with the query dropped.
-    pub fn public_url(&self) -> Option<String> {
-        let url = self.url.as_ref()?;
-        let host = url.host_str()?;
-        let port = url.port().map(|port| format!(":{port}")).unwrap_or_default();
-        Some(format!("{}://{host}{port}/", url.scheme()))
-    }
-
-    pub fn uptime(&self) -> Option<Duration> {
-        self.started.map(|started| started.elapsed())
-    }
-
-    /// How long it has been up, in words: `3s`, `1m 04s`, `2h 07m`.
-    pub fn uptime_label(&self) -> Option<String> {
-        let seconds = self.uptime()?.as_secs();
-        Some(match seconds {
-            0..=59 => format!("{seconds}s"),
-            60..=3599 => format!("{}m {:02}s", seconds / 60, seconds % 60),
-            _ => format!("{}h {:02}m", seconds / 3600, (seconds % 3600) / 60),
-        })
-    }
-
-    /// One line for the console and the log: the safe parts only.
-    pub fn safe_line(&self) -> String {
-        match self.phase {
-            Phase::Idle => "[vncode] idle - nothing is running".to_string(),
-            Phase::Starting => format!(
-                "[vncode] starting the {} harness on 127.0.0.1:{}",
-                self.detail.as_deref().unwrap_or("pinned"),
-                self.port.map(|port| port.to_string()).unwrap_or_else(|| "?".to_string())
-            ),
-            Phase::Running => format!(
-                "[vncode] running on {} (pid {})",
-                self.public_url().unwrap_or_else(|| "?".to_string()),
-                self.pid.map(|pid| pid.to_string()).unwrap_or_else(|| "?".to_string())
-            ),
-            Phase::Stopping => "[vncode] stopping the harness".to_string(),
-            Phase::Stopped => match self.port_free {
-                Some(true) => "[vncode] stopped; the port is free again".to_string(),
-                Some(false) => {
-                    "[vncode] stopped, but something STILL holds the port - see the log".to_string()
-                }
-                None => "[vncode] stopped".to_string(),
-            },
-            Phase::Failed => format!(
-                "[vncode] failed: {}",
-                self.detail.as_deref().unwrap_or("no reason recorded")
-            ),
-        }
-    }
-
-    /// Move into `Running`, which is also where the clock starts.
-    pub fn mark_running(&mut self, url: Url, pid: Option<u32>) {
-        self.url = Some(url);
-        self.pid = pid;
-        self.phase = Phase::Running;
-        self.started = Some(Instant::now());
-        self.port_free = None;
-    }
-
-    /// Move into `Stopped`, recording what the port check found.
-    pub fn mark_stopped(&mut self, port_free: bool) {
-        self.phase = Phase::Stopped;
-        self.pid = None;
-        self.url = None;
-        self.started = None;
-        self.port_free = Some(port_free);
-    }
-
-    pub fn mark_failed(&mut self, detail: impl Into<String>) {
-        self.phase = Phase::Failed;
-        self.detail = Some(detail.into());
-        self.pid = None;
-        self.url = None;
-        self.started = None;
-    }
-}
-
-impl fmt::Debug for Status {
-    /// Hand-written, and the reason is in the module header: a derived `Debug`
-    /// would print the launch token.
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("Status")
-            .field("phase", &self.phase)
-            .field("port", &self.port)
-            .field("pid", &self.pid)
-            .field("url", &self.public_url().map(|_| "<redacted>"))
-            .field("detail", &self.detail)
-            .field("port_free", &self.port_free)
-            .field("uptime", &self.uptime_label())
-            .finish()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// Assembled at runtime so no token-shaped literal exists in this repository.
-    fn token() -> String {
-        format!("{}{}", "deadbeef", "0123456789abcdef")
-    }
-
-    fn running() -> Status {
-        let url = Url::parse(&format!("http://127.0.0.1:3080/?token={}", token())).unwrap();
-        let mut status = Status::idle();
-        status.port = Some(3080);
-        status.mark_running(url, Some(4321));
-        status
-    }
-
-    #[test]
-    fn the_displayed_url_never_carries_the_launch_token() {
-        let status = running();
-        let public = status.public_url().unwrap();
-        assert_eq!(public, "http://127.0.0.1:3080/");
-        assert!(!public.contains(&token()));
-        assert!(!public.contains("token"));
-    }
-
-    #[test]
-    fn the_full_url_is_reachable_only_through_the_navigator_accessor() {
-        let status = running();
-        // The pane needs it, token and all: that is ONE documented reader.
-        assert!(status.navigate_url().unwrap().contains(&token()));
-        // ...and the two things a person can see never show it.
-        assert!(!status.safe_line().contains(&token()));
-        assert!(!format!("{status:?}").contains(&token()));
-        assert!(!status.safe_line().contains("token="));
-    }
-
-    #[test]
-    fn the_console_line_names_the_safe_url_and_the_pid() {
-        let line = running().safe_line();
-        assert!(line.contains("http://127.0.0.1:3080/"), "{line}");
-        assert!(line.contains("4321"), "{line}");
-    }
-
-    #[test]
-    fn stopping_clears_the_url_so_a_dead_instance_cannot_be_reopened() {
-        let mut status = running();
-        status.mark_stopped(true);
-        assert_eq!(status.phase, Phase::Stopped);
-        assert_eq!(status.navigate_url(), None);
-        assert_eq!(status.public_url(), None);
-        assert!(status.safe_line().contains("the port is free again"), "{}", status.safe_line());
-    }
-
-    #[test]
-    fn a_port_something_still_holds_is_reported_rather_than_hidden() {
-        let mut status = running();
-        status.mark_stopped(false);
-        assert_eq!(status.port_free, Some(false));
-        assert!(status.safe_line().contains("STILL holds the port"), "{}", status.safe_line());
-    }
-
-    #[test]
-    fn a_failure_says_what_failed_and_forgets_the_url() {
-        let mut status = running();
-        status.mark_failed("the harness did not print its ready line within 90 seconds");
-        assert_eq!(status.phase, Phase::Failed);
-        assert_eq!(status.navigate_url(), None);
-        assert!(status.safe_line().contains("90 seconds"), "{}", status.safe_line());
-    }
-
-    #[test]
-    fn uptime_is_reported_in_words() {
-        let mut status = running();
-        assert!(status.uptime_label().is_some());
-        status.started = Some(Instant::now() - Duration::from_secs(64));
-        assert_eq!(status.uptime_label().as_deref(), Some("1m 04s"));
-        status.started = Some(Instant::now() - Duration::from_secs(7800));
-        assert_eq!(status.uptime_label().as_deref(), Some("2h 10m"));
-        status.mark_stopped(true);
-        assert_eq!(status.uptime_label(), None, "a stopped instance has no uptime");
-    }
-
-    #[test]
-    fn only_the_live_phases_are_live() {
-        assert!(Phase::Starting.is_live());
-        assert!(Phase::Running.is_live());
-        assert!(Phase::Stopping.is_live());
-        assert!(!Phase::Idle.is_live());
-        assert!(!Phase::Stopped.is_live());
-        assert!(!Phase::Failed.is_live());
-    }
-}
diff --git a/app/crates/vn-shell-core/src/urlpolicy.rs b/app/crates/vn-shell-core/src/urlpolicy.rs
deleted file mode 100644
index 4753d48..0000000
--- a/app/crates/vn-shell-core/src/urlpolicy.rs
+++ /dev/null
@@ -1,155 +0,0 @@
-//! Which URLs this shell may load itself, and what happens to the rest.
-//!
-//! The rule is short and it is the whole reason the pane can be trusted with a
-//! page: the shell navigates to the harness's own loopback URL and to nothing
-//! else. A link clicked inside the rendered app goes to the reader's browser,
-//! which is a different process with a different blast radius.
-
-use std::process::{Command, Stdio};
-
-use url::Url;
-
-use crate::readyline::is_loopback_host;
-
-/// Whether a URL may be loaded into this shell's own pane.
-pub fn is_internal(url: &Url) -> bool {
-    match url.scheme() {
-        "http" | "https" => match url.host_str() {
-            Some(host) => is_loopback_host(host),
-            None => false,
-        },
-        _ => false,
-    }
-}
-
-/// The platform's own "open this URL" program, with the URL as ONE argv element.
-///
-/// **Windows** gets `rundll32.exe url.dll,FileProtocolHandler <url>`: the documented
-/// way for a PROGRAM (rather than a shell) to ask the shell for the default browser.
-/// `explorer.exe <url>` was the previous spelling and it is unreliable from a
-/// non-interactive child - measured on the machine this was written on, where a button
-/// that spawned `explorer.exe` appeared to do nothing at all. **macOS/Linux** get
-/// `open` / `xdg-open`.
-///
-/// Both are programs with the URL as one argument - never a command string, never a
-/// shell - and both are returned as a `Command` rather than run here, so a caller can
-/// start one (and a check can read the argv) without a browser opening as a side effect
-/// of running the tests.
-pub fn opener_command(url: &str) -> Command {
-    let mut command = if cfg!(target_os = "windows") {
-        let mut command = Command::new("rundll32.exe");
-        command.arg("url.dll,FileProtocolHandler");
-        command
-    } else if cfg!(target_os = "macos") {
-        Command::new("open")
-    } else {
-        Command::new("xdg-open")
-    };
-    command.arg(url);
-    command
-}
-
-/// Open a URL in the platform's own browser, with argv only - never a shell.
-///
-/// The floor under `browser`: used when nothing in that table matched, and by any
-/// caller that has no browser preference of its own.
-pub fn open_external(url: &str) {
-    if let Err(error) = opener_command(url)
-        .stdin(Stdio::null())
-        .stdout(Stdio::null())
-        .stderr(Stdio::null())
-        .spawn()
-    {
-        eprintln!("[vncode] could not open {url} in a browser: {error}");
-    }
-}
-
-/// Open whatever holds a path: the folder itself, or the file's own folder.
-///
-/// The panel's "reveal" action. `explorer.exe /select,` is the Windows spelling;
-/// `open -R` is macOS's; Linux has no portable "select", so the containing folder
-/// is opened instead - which is a smaller promise, and the honest one.
-pub fn reveal(path: &std::path::Path, is_dir: bool) {
-    let (program, args): (&str, Vec<String>) = if cfg!(target_os = "windows") {
-        if is_dir {
-            ("explorer.exe", vec![path.display().to_string()])
-        } else {
-            ("explorer.exe", vec!["/select,".to_string(), path.display().to_string()])
-        }
-    } else if cfg!(target_os = "macos") {
-        if is_dir {
-            ("open", vec![path.display().to_string()])
-        } else {
-            ("open", vec!["-R".to_string(), path.display().to_string()])
-        }
-    } else {
-        let folder = if is_dir {
-            path.to_path_buf()
-        } else {
-            path.parent().map(|parent| parent.to_path_buf()).unwrap_or_else(|| path.to_path_buf())
-        };
-        ("xdg-open", vec![folder.display().to_string()])
-    };
-    if let Err(error) = Command::new(program)
-        .args(&args)
-        .stdin(Stdio::null())
-        .stdout(Stdio::null())
-        .stderr(Stdio::null())
-        .spawn()
-    {
-        eprintln!("[vncode] could not reveal {}: {error}", path.display());
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn the_opener_is_a_program_with_the_url_as_one_argument() {
-        // The rule the launch path depends on: one program, exactly one URL argument,
-        // and no shell in between.
-        let url = "http://127.0.0.1:3080/?token=x";
-        let command = opener_command(url);
-        let program = command.get_program().to_string_lossy().to_string();
-        let args: Vec<String> =
-            command.get_args().map(|arg| arg.to_string_lossy().to_string()).collect();
-        if cfg!(target_os = "windows") {
-            assert_eq!(program, "rundll32.exe");
-            assert_eq!(args, vec!["url.dll,FileProtocolHandler".to_string(), url.to_string()]);
-        } else {
-            let expected = if cfg!(target_os = "macos") { "open" } else { "xdg-open" };
-            assert_eq!(program, expected);
-            assert_eq!(args, vec![url.to_string()]);
-        }
-    }
-
-    #[test]
-    fn loopback_is_internal_and_everything_else_is_not() {
-        for allowed in ["http://127.0.0.1:3080/?token=x", "http://localhost:3080/", "https://[::1]:9/"] {
-            let url = Url::parse(allowed).unwrap();
-            assert!(is_internal(&url), "{allowed} should be loadable");
-        }
-        for refused in [
-            "http://evil.example/?token=x",
-            "https://127.0.0.1.evil.example/",
-            "file:///etc/passwd",
-            "tauri://localhost/index.html",
-            "data:text/html,<h1>hi</h1>",
-            "javascript:alert(1)",
-        ] {
-            let url = Url::parse(refused).unwrap();
-            assert!(!is_internal(&url), "{refused} must never be loaded by the shell");
-        }
-    }
-
-    #[test]
-    fn only_http_and_https_over_loopback_may_be_loaded_by_the_shell() {
-        // The scheme is part of the rule, not just the host: `ftp://127.0.0.1/`
-        // names a loopback address and still has no business in the pane.
-        for refused in ["ftp://127.0.0.1/", "ws://127.0.0.1:3080/", "file://127.0.0.1/x"] {
-            let url = Url::parse(refused).unwrap();
-            assert!(!is_internal(&url), "{refused} must never be loaded by the shell");
-        }
-    }
-}
diff --git a/app/crates/vn-shell-core/src/userpath.rs b/app/crates/vn-shell-core/src/userpath.rs
index a80b839..68486bf 100644
--- a/app/crates/vn-shell-core/src/userpath.rs
+++ b/app/crates/vn-shell-core/src/userpath.rs
@@ -75,10 +75,8 @@ pub fn resolve(typed: &str, cwd: Option<&Path>, user_home: Option<&Path>) -> Res
 pub fn expand_home(typed: &str, user_home: Option<&Path>) -> Result<PathBuf, String> {
     let rest = if typed == "~" {
         Some("")
-    } else if let Some(rest) = typed.strip_prefix("~/").or_else(|| typed.strip_prefix("~\\")) {
-        Some(rest)
     } else {
-        None
+        typed.strip_prefix("~/").or_else(|| typed.strip_prefix("~\\"))
     };
     match rest {
         Some("") => user_home
diff --git a/app/crates/vn-shell-core/src/windowstate.rs b/app/crates/vn-shell-core/src/windowstate.rs
deleted file mode 100644
index aa7326f..0000000
--- a/app/crates/vn-shell-core/src/windowstate.rs
+++ /dev/null
@@ -1,710 +0,0 @@
-//! The window's own memory: where it was and how big it was, across launches.
-//!
-//! A window that forgets its size every launch is a window the reader has to
-//! place again every morning, so the shell keeps ONE small record of geometry
-//! and restores it. The record lives at `<harness home>/vncode/window.json`
-//! - the `$DSH_HOME`-rooted shape the rest of this pack uses for its own state
-//! (`$DSH_HOME/dsh-pdf`, `$DSH_HOME/dsh-diagrams`). The home itself is resolved
-//! by `main.rs` through `reported_home` and handed in here; this module never
-//! looks at `DSH_HOME` itself, and never invents a directory to write into.
-//!
-//! ```json
-//! { "version": 1, "width": 1440, "height": 900, "x": 100, "y": 100, "maximized": false }
-//! ```
-//!
-//! Five rules govern that file, and every one of them exists so that a record
-//! written by a DIFFERENT build - or truncated by a machine that lost power
-//! mid-write - can never stop the window from opening:
-//!
-//! 1. `width`/`height` are the window's INNER size and `x`/`y` the OUTER
-//!    position, all four in LOGICAL pixels. Logical is the unit the window
-//!    builder takes, and it is the only unit that means the same thing on a
-//!    100% and on a 150% display; `main.rs` divides the physical readings by
-//!    the window's scale factor on the way in and hands the values straight
-//!    back out.
-//! 2. A record this build cannot vouch for is DISCARDED, never repaired: an
-//!    unreadable file, JSON that does not parse, a `version` that is not 1, a
-//!    width or height that is absent, non-numeric, non-finite, or below the
-//!    smallest window the shell builds. The caller falls back to exactly the
-//!    geometry the shell opened at before this file existed.
-//! 3. A width or height ABOVE the platform's practical ceiling is CLAMPED
-//!    rather than refused, because the number is plausible and the platform
-//!    simply cannot honour it - and discarding the record would also discard
-//!    the position and the maximized flag sitting beside it.
-//! 4. A position is honoured only when BOTH `x` and `y` are present, numeric
-//!    and finite ([`WindowState::position`]). A half-written pair, a string or
-//!    `null` means "centre the window", never "trust the one number that was
-//!    there". Whether the point names a monitor that still exists is a question
-//!    only a live machine can answer, so the pair is handed out and `main.rs`
-//!    runs it past Tauri's monitor list.
-//! 5. A write is ATOMIC - a temp sibling, then a rename - and creates the
-//!    containing directory. A reader of this file therefore sees the whole of
-//!    one version or the whole of the other, never a half-written line, and a
-//!    failure costs one launch's geometry and nothing else.
-//!
-//! Nothing here refers to a `tauri` type: this is the pure half of the feature,
-//! and `cargo test` drives all of it directly (see the tests at the bottom).
-
-use std::fmt;
-use std::path::{Path, PathBuf};
-
-/// The size the shell opens at when there is nothing to restore - today's
-/// geometry, unchanged, and the answer to every rejection above.
-pub const DEFAULT_WIDTH: f64 = 1440.0;
-pub const DEFAULT_HEIGHT: f64 = 900.0;
-
-/// The smallest window worth restoring, and the same floor the builder puts on
-/// the live window (`min_inner_size`).
-///
-/// A record below it is not a window the shell could have produced, so it is a
-/// foreign or damaged number rather than a choice to honour - and growing a
-/// window the reader deliberately shrank is not this file's decision to make.
-pub const MIN_WIDTH: f64 = 960.0;
-pub const MIN_HEIGHT: f64 = 640.0;
-
-/// The platform's practical ceiling for a window dimension: the largest value
-/// Win32's coordinates carry, and no display in existence is wider.
-///
-/// Above it the number is clamped rather than refused - see rule 3 in the
-/// module docs for why the whole record is worth keeping.
-pub const MAX_SIDE: f64 = 32767.0;
-
-/// The format version this build writes and the only one it reads.
-///
-/// It exists so that a future layout can be told apart from this one instead of
-/// being misread field by field; a `version` that is missing, non-numeric or
-/// not this number is therefore unknown, and "no version" is deliberately not
-/// treated as "version 1".
-const VERSION: i64 = 1;
-
-/// The folder this record lives in under the harness home. The harness home is
-/// `~/.dsh` itself - not `~` - so the full path is `~/.dsh/vncode/window.json`.
-const STATE_DIR: &str = "vncode";
-
-/// The file name inside [`STATE_DIR`].
-const STATE_FILE: &str = "window.json";
-
-/// Where the record lives for a given harness home.
-///
-/// A plain join on purpose: the home has already been resolved by the one
-/// resolver this shell has, and a second rule about where `$DSH_HOME` points is
-/// exactly the bug `main.rs` documents at length.
-pub fn state_path(home: &Path) -> PathBuf {
-    home.join(STATE_DIR).join(STATE_FILE)
-}
-
-// ---------------------------------------------------------------------------
-// The record
-// ---------------------------------------------------------------------------
-/// The remembered geometry: two sizes, an optional point, and one flag.
-///
-/// `x`/`y` are read through [`WindowState::position`] rather than directly, so
-/// that the "both, numeric and finite, or centre" rule is applied in one place.
-#[derive(Debug, Clone, PartialEq)]
-pub struct WindowState {
-    /// The window's inner size in logical pixels.
-    pub width: f64,
-    pub height: f64,
-    /// The window's outer position in logical pixels, when there is one.
-    pub x: Option<f64>,
-    pub y: Option<f64>,
-    /// Whether the window was maximized when the record was written.
-    ///
-    /// The size beside it is still the RESTORED size, because that is the one
-    /// worth keeping: see [`WindowState::merge`].
-    pub maximized: bool,
-}
-
-impl WindowState {
-    /// The geometry today's behaviour means: 1440x900, centred, not maximized.
-    pub fn first_launch() -> Self {
-        WindowState {
-            width: DEFAULT_WIDTH,
-            height: DEFAULT_HEIGHT,
-            x: None,
-            y: None,
-            maximized: false,
-        }
-    }
-
-    /// The point to restore, or `None` for "centre the window".
-    ///
-    /// The one decision the pure half can make about a position: the numbers
-    /// are honoured only TOGETHER and only when both are real. Which monitor
-    /// (if any) that point names is the caller's check, because it needs the
-    /// machine's monitor list.
-    pub fn position(&self) -> Option<(f64, f64)> {
-        match (self.x, self.y) {
-            (Some(x), Some(y)) if x.is_finite() && y.is_finite() => Some((x, y)),
-            _ => None,
-        }
-    }
-
-    /// Whether this is a size the shell could have built a window at.
-    ///
-    /// A live window reports 0x0 and an off-screen position while it is
-    /// MINIMIZED on Windows, so this is what tells a real reading from a
-    /// minimized one. Two rules lean on it: [`WindowState::merge`] keeps the
-    /// recorded size when a reading is not one, and [`save`] refuses to write a
-    /// state that is not one - so a bad reading can neither be recorded nor
-    /// destroy the record that is already on disk.
-    pub fn size_is_usable(&self) -> bool {
-        self.width.is_finite()
-            && self.height.is_finite()
-            && self.width >= MIN_WIDTH
-            && self.height >= MIN_HEIGHT
-    }
-
-    /// Fold a fresh reading of the LIVE window into the record worth writing.
-    ///
-    /// A maximized window reports the SCREEN's size and the position the
-    /// window manager parked it at, and a minimized one on Windows reports
-    /// 0x0 - none of which is the geometry the reader chose. So a reading that
-    /// is not a size the window could have been built at, or that arrives
-    /// maximized, keeps the size and the position already recorded and only
-    /// updates the flag. That is what makes "restore the size, then maximize"
-    /// mean something: un-maximizing gives back the window the reader had,
-    /// instead of a window the size of the display.
-    pub fn merge(&self, reading: &WindowState) -> WindowState {
-        let chosen = reading.size_is_usable() && !reading.maximized;
-        WindowState {
-            width: if chosen { reading.width } else { self.width },
-            height: if chosen { reading.height } else { self.height },
-            x: if chosen { reading.x } else { self.x },
-            y: if chosen { reading.y } else { self.y },
-            maximized: reading.maximized,
-        }
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Reading the record
-// ---------------------------------------------------------------------------
-/// Why a remembered geometry was not used.
-///
-/// Every variant means the same thing to the window - build [`WindowState::first_launch`] -
-/// and they exist so the console can say WHICH, and so the tests can pin each
-/// rule separately. Nothing here is a failure of the shell: a missing file is
-/// the ordinary first launch.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum Unusable {
-    /// No file yet: the first launch, which is not a fault and wants no line
-    /// on the console.
-    Absent,
-    /// The file is there but could not be read (permissions, a directory in
-    /// its place, a bad disk).
-    Unreadable,
-    /// Not JSON at all, or JSON that is not an object.
-    Malformed,
-    /// A `version` that is missing, not a number, or not one this build knows.
-    UnknownVersion,
-    /// A width or height that is absent, not a number, or not finite.
-    Size,
-    /// A width or height below the smallest window the shell builds.
-    TooSmall,
-}
-
-impl fmt::Display for Unusable {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        let reason = match self {
-            Unusable::Absent => "there is no remembered geometry yet",
-            Unusable::Unreadable => "the file could not be read",
-            Unusable::Malformed => "the file is not a JSON object",
-            Unusable::UnknownVersion => "the file is not a window record this build knows (version 1)",
-            Unusable::Size => "the width or height is missing, or is not a finite number",
-            Unusable::TooSmall => "the width or height is below the smallest window this shell builds (960x640)",
-        };
-        formatter.write_str(reason)
-    }
-}
-
-/// Read the record from disk, or say why it was not used.
-///
-/// A missing file is [`Unusable::Absent`] rather than an I/O error because the
-/// two want different treatment: the first launch is silent, and anything else
-/// earns one line on the console.
-pub fn load(path: &Path) -> Result<WindowState, Unusable> {
-    match std::fs::read_to_string(path) {
-        Ok(text) => parse(&text),
-        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Err(Unusable::Absent),
-        Err(_) => Err(Unusable::Unreadable),
-    }
-}
-
-/// Turn the file's text into the record, or say which rule refused it.
-pub fn parse(text: &str) -> Result<WindowState, Unusable> {
-    let json: serde_json::Value = serde_json::from_str(text).map_err(|_| Unusable::Malformed)?;
-    let object = json.as_object().ok_or(Unusable::Malformed)?;
-
-    // A version check before anything else is read: the fields below are only
-    // this shape's fields if the file says it is this shape.
-    if object.get("version").and_then(serde_json::Value::as_i64) != Some(VERSION) {
-        return Err(Unusable::UnknownVersion);
-    }
-
-    let width = number(object, "width").ok_or(Unusable::Size)?;
-    let height = number(object, "height").ok_or(Unusable::Size)?;
-    let (width, height) = clamp_size(width, height)?;
-
-    Ok(WindowState {
-        width,
-        height,
-        // A position that is not a pair of real numbers is not a position: the
-        // window is centred, and the size above is still restored.
-        x: number(object, "x"),
-        y: number(object, "y"),
-        // Absent means false, which is also what an unreadable flag means: the
-        // window is not maximized unless the file says so in so many words.
-        maximized: object
-            .get("maximized")
-            .and_then(serde_json::Value::as_bool)
-            .unwrap_or(false),
-    })
-}
-
-/// The size rules, in one place: refuse what is not a window, clamp what the
-/// platform cannot honour.
-fn clamp_size(width: f64, height: f64) -> Result<(f64, f64), Unusable> {
-    // A string, `null` or `true` never gets this far - [`number`] drops those -
-    // but a live reading and a hand-built state can still carry a NaN or an
-    // infinity, JSON cannot spell one, and neither is a window size.
-    if !width.is_finite() || !height.is_finite() {
-        return Err(Unusable::Size);
-    }
-    if width < MIN_WIDTH || height < MIN_HEIGHT {
-        return Err(Unusable::TooSmall);
-    }
-    Ok((width.min(MAX_SIDE), height.min(MAX_SIDE)))
-}
-
-/// One optional number out of the object, accepted only when it is finite.
-fn number(object: &serde_json::Map<String, serde_json::Value>, key: &str) -> Option<f64> {
-    object.get(key)?.as_f64().filter(|value| value.is_finite())
-}
-
-// ---------------------------------------------------------------------------
-// Writing the record
-// ---------------------------------------------------------------------------
-/// Write the record so the next launch restores it.
-///
-/// A state the window could not have been built at is REFUSED rather than
-/// written: a bad reading must never be able to destroy a good record on disk,
-/// and the caller treats the refusal like any other write failure - one line on
-/// the console, and the launch goes on.
-pub fn save(path: &Path, state: &WindowState) -> std::io::Result<()> {
-    if !state.size_is_usable() {
-        return Err(std::io::Error::new(
-            std::io::ErrorKind::InvalidInput,
-            format!("refusing to remember a window size of {}x{}", state.width, state.height),
-        ));
-    }
-    let mut text = serde_json::to_string_pretty(&to_json(state))
-        // Unreachable for a `Value` built here, and still not a panic: the
-        // caller's contract is that a write failure is never fatal.
-        .map_err(|error| std::io::Error::new(std::io::ErrorKind::Other, error))?;
-    text.push('\n');
-    atomic_write(path, text.as_bytes())
-}
-
-/// The record as JSON, in the shape documented at the top of this module.
-///
-/// The position is written as a PAIR or not at all, so a half pair can never
-/// reach the disk; `maximized` is always written, because a record that states
-/// the flag is easier to read than one that leaves it out.
-pub fn to_json(state: &WindowState) -> serde_json::Value {
-    let mut object = serde_json::Map::new();
-    object.insert("version".to_string(), serde_json::json!(VERSION));
-    object.insert("width".to_string(), number_json(state.width));
-    object.insert("height".to_string(), number_json(state.height));
-    if let Some((x, y)) = state.position() {
-        object.insert("x".to_string(), number_json(x));
-        object.insert("y".to_string(), number_json(y));
-    }
-    object.insert("maximized".to_string(), serde_json::Value::Bool(state.maximized));
-    serde_json::Value::Object(object)
-}
-
-/// One number as JSON: a whole value goes in as an INTEGER, because these are
-/// whole pixel counts and `1440.0` in the file reads like a measurement rather
-/// than the count it is. A fractional logical coordinate (a window on a HiDPI
-/// display can sit on half a pixel) keeps its fraction.
-fn number_json(value: f64) -> serde_json::Value {
-    const LARGEST_EXACT: f64 = 9_007_199_254_740_992.0; // 2^53
-    if value.is_finite() && value.fract() == 0.0 && value.abs() <= LARGEST_EXACT {
-        return serde_json::Value::Number(serde_json::Number::from(value as i64));
-    }
-    serde_json::Number::from_f64(value)
-        .map(serde_json::Value::Number)
-        .unwrap_or(serde_json::Value::Null)
-}
-
-/// Write the bytes through a temp sibling and a rename.
-///
-/// The temp file is a SIBLING so the rename stays on one filesystem - a rename
-/// across filesystems is a copy, which is neither atomic nor cheap - and its
-/// name carries this process's id so two shells can never tread on each other's
-/// temp file. There is deliberately no `fsync`: this is window geometry, and a
-/// machine that dies mid-save loses one launch's size rather than an asset,
-/// while the rename still guarantees nobody ever reads a half-written file.
-fn atomic_write(path: &Path, bytes: &[u8]) -> std::io::Result<()> {
-    if let Some(directory) = path.parent() {
-        std::fs::create_dir_all(directory)?;
-    }
-    let temp = temp_sibling(path);
-    if let Err(error) = std::fs::write(&temp, bytes) {
-        let _ = std::fs::remove_file(&temp);
-        return Err(error);
-    }
-    if let Err(error) = std::fs::rename(&temp, path) {
-        let _ = std::fs::remove_file(&temp);
-        return Err(error);
-    }
-    Ok(())
-}
-
-/// `window.json` -> `window.json.<pid>.tmp`, beside it.
-fn temp_sibling(path: &Path) -> PathBuf {
-    let name = path
-        .file_name()
-        .map(|name| name.to_os_string())
-        .unwrap_or_else(|| std::ffi::OsString::from(STATE_FILE));
-    let mut temp = name;
-    temp.push(format!(".{}.tmp", std::process::id()));
-    path.with_file_name(temp)
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-/// The rules above, pinned.
-///
-/// These are pure on purpose, like `readyline`'s: what a saved window may and
-/// may not restore is decided here, so a `cargo test` with no window, no
-/// display and no harness server can still prove that a corrupt record costs a
-/// reader nothing but the default geometry.
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// The documented record, spelled the way the module docs spell it.
-    ///
-    /// A JSON object has no order, and this build's serde_json writes the keys
-    /// sorted, so nothing here depends on the order these fields are written in
-    /// - only on the set of them.
-    const RECORD: &str = r#"{
-  "version": 1,
-  "width": 1440,
-  "height": 900,
-  "x": 100,
-  "y": 100,
-  "maximized": false
-}
-"#;
-
-    /// A scratch folder of our own, so a test never touches a real home.
-    fn scratch(name: &str) -> PathBuf {
-        let mut path = crate::scratch::root();
-        path.push(format!("vncode-windowstate-{}-{name}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&path);
-        path
-    }
-
-    #[test]
-    fn a_full_record_round_trips() {
-        let state = parse(RECORD).expect("the documented record must parse");
-        assert_eq!(state.width, 1440.0);
-        assert_eq!(state.height, 900.0);
-        assert_eq!(state.position(), Some((100.0, 100.0)));
-        assert!(!state.maximized);
-
-        // Through the file, which is the trip that matters.
-        let home = scratch("round-trip");
-        let path = state_path(&home);
-        save(&path, &state).expect("the record must save");
-        assert_eq!(load(&path), Ok(state.clone()));
-        // The bytes on disk, so the contract in the module docs is pinned as
-        // text and not only as a re-parse of itself.
-        let written = std::fs::read_to_string(&path).unwrap();
-        assert!(written.contains("\"version\": 1"), "the record must state its version: {written}");
-        assert!(written.contains("\"width\": 1440"), "whole pixels are integers: {written}");
-        assert!(written.ends_with('\n'), "a text file ends with a newline: {written:?}");
-
-        // ...and through the text, so a fractional logical coordinate survives
-        // a HiDPI display too.
-        let fractional = WindowState {
-            width: 1440.0,
-            height: 900.0,
-            x: Some(100.5),
-            y: Some(-12.25),
-            maximized: true,
-        };
-        let text = serde_json::to_string(&to_json(&fractional)).unwrap();
-        assert_eq!(parse(&text), Ok(fractional));
-        let _ = std::fs::remove_dir_all(&home);
-    }
-
-    #[test]
-    fn optional_fields_may_be_absent() {
-        // x, y and maximized are all optional: the size is the whole record.
-        let state = parse(r#"{"version":1,"width":1440,"height":900}"#).unwrap();
-        assert_eq!(state.width, 1440.0);
-        assert_eq!(state.height, 900.0);
-        assert_eq!(state.position(), None, "no x/y means centre, not a guess");
-        assert!(!state.maximized, "an absent flag means not maximized");
-        // Nothing was written that the file did not say.
-        assert!(to_json(&state).get("x").is_none());
-        assert!(to_json(&state).get("y").is_none());
-    }
-
-    #[test]
-    fn malformed_json_is_refused() {
-        for text in ["", "   ", "not json", "{\"version\":1,", "[1,2,3]", "42", "\"window\"", "null"] {
-            assert!(
-                matches!(parse(text), Err(Unusable::Malformed)),
-                "{text:?} should be refused as malformed"
-            );
-        }
-    }
-
-    #[test]
-    fn an_unknown_version_is_refused() {
-        // A version this build does not know, a version that is not a number,
-        // and a record with no version at all: "no version" is not "version 1",
-        // because a file written by some other tool is not one this build can
-        // vouch for field by field.
-        for text in [
-            r#"{"version":2,"width":1440,"height":900}"#,
-            r#"{"version":0,"width":1440,"height":900}"#,
-            r#"{"version":"1","width":1440,"height":900}"#,
-            r#"{"version":1.0,"width":1440,"height":900}"#,
-            r#"{"width":1440,"height":900}"#,
-        ] {
-            assert!(
-                matches!(parse(text), Err(Unusable::UnknownVersion)),
-                "{text:?} should be refused as an unknown version"
-            );
-        }
-    }
-
-    #[test]
-    fn a_size_below_the_minimum_is_refused() {
-        for text in [
-            r#"{"version":1,"width":959,"height":900}"#,
-            r#"{"version":1,"width":1440,"height":639}"#,
-            r#"{"version":1,"width":100,"height":100}"#,
-            r#"{"version":1,"width":-1440,"height":-900}"#,
-            r#"{"version":1,"width":0,"height":0}"#,
-        ] {
-            assert!(
-                matches!(parse(text), Err(Unusable::TooSmall)),
-                "{text:?} should be refused as too small"
-            );
-        }
-        // The floor itself is allowed.
-        assert!(parse(r#"{"version":1,"width":960,"height":640}"#).is_ok());
-    }
-
-    #[test]
-    fn an_absurd_size_is_clamped_never_refused() {
-        // The size is believable and the platform cannot honour it, so it is
-        // clamped - the position and the flag beside it survive.
-        let state = parse(r#"{"version":1,"width":40000,"height":90000,"x":10,"y":20,"maximized":true}"#).unwrap();
-        assert_eq!(state.width, MAX_SIDE);
-        assert_eq!(state.height, MAX_SIDE);
-        assert_eq!(state.position(), Some((10.0, 20.0)));
-        assert!(state.maximized);
-        // The ceiling itself is not above the ceiling.
-        assert_eq!(parse(r#"{"version":1,"width":32767,"height":32767}"#).unwrap().width, MAX_SIDE);
-    }
-
-    #[test]
-    fn a_non_numeric_or_non_finite_size_is_refused() {
-        for text in [
-            r#"{"version":1,"width":"1440","height":900}"#,
-            r#"{"version":1,"width":null,"height":900}"#,
-            r#"{"version":1,"width":true,"height":900}"#,
-            r#"{"version":1,"width":[1440],"height":900}"#,
-        ] {
-            assert!(
-                matches!(parse(text), Err(Unusable::Size)),
-                "{text:?} should be refused as a size that is not a number"
-            );
-        }
-        // NaN and infinity cannot be written as JSON at all, so they are pinned
-        // where they can arrive: a live reading or a hand-built state.
-        assert!(matches!(clamp_size(f64::NAN, 900.0), Err(Unusable::Size)));
-        assert!(matches!(clamp_size(1440.0, f64::NAN), Err(Unusable::Size)));
-        assert!(matches!(clamp_size(f64::INFINITY, 900.0), Err(Unusable::Size)));
-        assert!(matches!(clamp_size(1440.0, f64::NEG_INFINITY), Err(Unusable::Size)));
-        assert_eq!(clamp_size(1440.0, 900.0), Ok((1440.0, 900.0)));
-    }
-
-    #[test]
-    fn a_record_with_no_usable_position_is_centred() {
-        let no_position = parse(RECORD).unwrap();
-        // Both numbers present is the only case that is a position.
-        assert_eq!(no_position.position(), Some((100.0, 100.0)));
-        for text in [
-            r#"{"version":1,"width":1440,"height":900}"#,
-            r#"{"version":1,"width":1440,"height":900,"x":null,"y":null}"#,
-            r#"{"version":1,"width":1440,"height":900,"x":"100","y":100}"#,
-            r#"{"version":1,"width":1440,"height":900,"x":100}"#,
-            r#"{"version":1,"width":1440,"height":900,"y":100}"#,
-            // A position that is not a number is dropped WITHOUT costing the
-            // size: only the point is unusable.
-            r#"{"version":1,"width":1400,"height":700,"x":true,"y":100}"#,
-        ] {
-            let state = parse(text).unwrap_or_else(|error| panic!("{text:?} should parse: {error}"));
-            assert_eq!(state.position(), None, "{text:?} should mean centre");
-            assert!(state.width >= MIN_WIDTH && state.height >= MIN_HEIGHT);
-        }
-    }
-
-    #[test]
-    fn a_reading_that_is_not_the_readers_size_keeps_the_record() {
-        let remembered = WindowState {
-            width: 1200.0,
-            height: 800.0,
-            x: Some(40.0),
-            y: Some(60.0),
-            maximized: false,
-        };
-
-        // Maximized: the window reports the SCREEN, so the restored geometry is
-        // kept and only the flag changes - which is what makes the next launch
-        // able to restore a size worth un-maximizing to.
-        let maximized = remembered.merge(&WindowState {
-            width: 2560.0,
-            height: 1440.0,
-            x: Some(0.0),
-            y: Some(0.0),
-            maximized: true,
-        });
-        assert_eq!((maximized.width, maximized.height), (1200.0, 800.0));
-        assert_eq!(maximized.position(), Some((40.0, 60.0)));
-        assert!(maximized.maximized);
-
-        // Minimized on Windows: 0x0 and an off-screen point are not a choice.
-        let minimized = remembered.merge(&WindowState {
-            width: 0.0,
-            height: 0.0,
-            x: Some(-32000.0),
-            y: Some(-32000.0),
-            maximized: false,
-        });
-        assert_eq!((minimized.width, minimized.height), (1200.0, 800.0));
-        assert_eq!(minimized.position(), Some((40.0, 60.0)));
-        assert!(!minimized.maximized);
-
-        // A real drag replaces everything.
-        let moved = remembered.merge(&WindowState {
-            width: 1000.0,
-            height: 700.0,
-            x: Some(200.0),
-            y: Some(150.0),
-            maximized: false,
-        });
-        assert_eq!((moved.width, moved.height), (1000.0, 700.0));
-        assert_eq!(moved.position(), Some((200.0, 150.0)));
-    }
-
-    #[test]
-    fn a_size_the_window_could_not_be_built_at_is_never_written() {
-        let home = scratch("unusable");
-        let path = state_path(&home);
-        save(&path, &WindowState::first_launch()).unwrap();
-
-        let tiny = WindowState { width: 0.0, height: 0.0, x: None, y: None, maximized: false };
-        assert!(save(&path, &tiny).is_err(), "an unusable size must be refused");
-        // ...and the good record on disk is untouched by the refusal.
-        assert_eq!(load(&path), Ok(WindowState::first_launch()));
-        let _ = std::fs::remove_dir_all(&home);
-    }
-
-    #[test]
-    fn saving_creates_the_directory_and_leaves_no_temp_file() {
-        let home = scratch("fresh");
-        let path = state_path(&home);
-        assert!(!home.exists(), "the scratch folder must not exist yet");
-
-        save(&path, &WindowState::first_launch()).unwrap();
-        assert!(path.is_file(), "the record must be written: {}", path.display());
-        assert!(!temp_sibling(&path).exists(), "the temp sibling must be renamed away");
-
-        // The write is a rename onto the real name, so a second save simply
-        // leaves the newer record where the older one was.
-        let moved = WindowState { width: 1000.0, height: 700.0, x: Some(-5.0), y: Some(5.0), maximized: true };
-        save(&path, &moved).unwrap();
-        assert_eq!(load(&path), Ok(moved));
-        let _ = std::fs::remove_dir_all(&home);
-    }
-
-    #[test]
-    fn the_written_record_has_the_documented_shape() {
-        let json = to_json(&WindowState::first_launch());
-        assert_eq!(json.get("version").and_then(serde_json::Value::as_i64), Some(1));
-        // Whole pixels are written as INTEGERS, which is what the documented
-        // example shows: 1440, not 1440.0.
-        assert_eq!(json.get("width").and_then(serde_json::Value::as_i64), Some(1440));
-        assert_eq!(json.get("height").and_then(serde_json::Value::as_i64), Some(900));
-        assert_eq!(json.get("maximized").and_then(serde_json::Value::as_bool), Some(false));
-        assert!(json.get("x").is_none());
-        assert!(json.get("y").is_none());
-
-        let placed = to_json(&WindowState {
-            width: 1440.0,
-            height: 900.0,
-            x: Some(100.0),
-            y: Some(100.0),
-            maximized: false,
-        });
-        assert_eq!(placed.get("x").and_then(serde_json::Value::as_i64), Some(100));
-        assert_eq!(placed.get("y").and_then(serde_json::Value::as_i64), Some(100));
-        // Field for field with the documented contract. Sorted, because the
-        // ORDER of a JSON object is not part of a contract - and it depends on
-        // how serde_json was built, which this test must not care about.
-        let mut keys: Vec<&str> = placed.as_object().unwrap().keys().map(String::as_str).collect();
-        keys.sort_unstable();
-        assert_eq!(keys, ["height", "maximized", "version", "width", "x", "y"]);
-    }
-
-    #[test]
-    fn a_missing_file_is_absent_and_not_a_fault() {
-        let home = scratch("missing");
-        assert_eq!(load(&state_path(&home)), Err(Unusable::Absent));
-        // A file that is there and cannot be read is a different answer, and
-        // the difference is visible: only this one earns a line on the console.
-        // A directory where the record should be is the cheapest way to make
-        // one without touching permissions.
-        let path = state_path(&home);
-        std::fs::create_dir_all(&path).unwrap();
-        assert_eq!(load(&path), Err(Unusable::Unreadable));
-        let _ = std::fs::remove_dir_all(&home);
-    }
-
-    #[test]
-    fn the_path_hangs_off_the_harness_home_not_the_user_home() {
-        // The bug this pins is the one `main.rs` documents: `DSH_HOME` names
-        // `~/.dsh` itself, so the record goes UNDER it and never beside it.
-        let harness_home = Path::new("/home/someone/.dsh");
-        let path = state_path(harness_home);
-        assert_eq!(path, harness_home.join("vncode").join("window.json"));
-        assert!(path.starts_with(harness_home));
-        assert_ne!(path.parent().and_then(Path::parent), Some(Path::new("/home/someone")), "the record belongs under the harness home");
-    }
-
-    #[test]
-    fn display_says_something_a_reader_can_act_on() {
-        for reason in [
-            Unusable::Absent,
-            Unusable::Unreadable,
-            Unusable::Malformed,
-            Unusable::UnknownVersion,
-            Unusable::Size,
-            Unusable::TooSmall,
-        ] {
-            let text = reason.to_string();
-            assert!(!text.is_empty(), "{reason:?} needs a reason a reader can read");
-        }
-    }
-}
diff --git a/app/crates/vn-shell-egui/Cargo.toml b/app/crates/vn-shell-egui/Cargo.toml
deleted file mode 100644
index 8e9da7f..0000000
--- a/app/crates/vn-shell-egui/Cargo.toml
+++ /dev/null
@@ -1,28 +0,0 @@
-[package]
-name = "vn-shell-egui"
-description = "The vncode shell's control panel: the first page, the status, the location map and the log."
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-publish.workspace = true
-rust-version.workspace = true
-
-[features]
-default = []
-# The pane: a child web view inside this window, via `vn-shell-pane`. OFF by default, so
-# the default build compiles no engine, adds no dependency to the graph it links, and keeps
-# the browser hand-off as its only surface.
-#
-# The pane crate's OWN feature is named as well, and that is not redundancy: enabling the
-# dependency is not enabling its engine, so without `vn-shell-pane/pane` the engine and the
-# page are `#[cfg]`-compiled out and every use of them fails as "found an item that was
-# configured out".
-pane = ["vn-shell-pane/pane"]
-
-[dependencies]
-vn-shell-core.workspace = true
-vn-shell-runtime.workspace = true
-vn-shell-paths.workspace = true
-vn-shell-pane = { workspace = true, optional = true }
-eframe.workspace = true
-egui.workspace = true
diff --git a/app/crates/vn-shell-egui/src/lib.rs b/app/crates/vn-shell-egui/src/lib.rs
deleted file mode 100644
index 6670a13..0000000
--- a/app/crates/vn-shell-egui/src/lib.rs
+++ /dev/null
@@ -1,2225 +0,0 @@
-//! The control panel: the page the shell OPENS on, and the only place the instance
-//! can be ended.
-//!
-//! Five rules shape everything in this file.
-//!
-//! 1. **One decision comes first.** A home is chosen once, on the first-run screen, and
-//!    that screen is the whole window: the cards that answer it, one of them
-//!    recommended, and nothing else. Everything a person needs is ON the card (what is
-//!    in that home, what a copy would bring, where a fresh one would go), and the
-//!    decision itself is `vn_shell_core::firstrun` - a `cargo test` case, not a reading
-//!    of this file.
-//! 2. **Nothing is started until Start**, and Start runs the same launch path the
-//!    two launcher scripts already use. Opening the app spawns no child process and
-//!    binds no port.
-//! 3. **The panel never writes the status.** It reads what the supervisor recorded
-//!    and sends orders; one writer is what keeps "is it running" from having two
-//!    answers.
-//! 4. **The panel never draws a secret.** The key row is built from
-//!    `keystate::console_line`'s inputs (a flag and a layer NAME), and the URL is
-//!    drawn through `Status::public_url`, which has no query and therefore no
-//!    launch token.
-//! 5. **The panel does not draw the harness.** There is no web view here and there
-//!    is not going to be one: the interface is a web application, this app opens it
-//!    in a browser it found (`browser.rs`), and the panel's job is to say which one,
-//!    and to make changing your mind one click.
-//!
-//! After the choice the window is four rows and three buttons - home, pack, key,
-//! browser, with Start / Open tab / Stop - and **every diagnostic is one disclosure
-//! away** (`Details`, closed by default). Nothing was deleted to get there: the pin,
-//! the runtime, the composed environment, the pid, the location map, the refusals and
-//! the notes all moved, because an inspector is not a control panel.
-//!
-//! The three things it can do to the machine - install the pack, adopt a home, and
-//! choose the browser - all go through the same rule: the panel decides, the
-//! supervisor or the runner performs, and the log carries the evidence.
-
-// The hand-off cluster below - `start_hand_off`, `finish_hand_off`, `confined_hint` and the two
-// fields they share - is a BUILD-conditional path. A build WITH the pane starts no browser, so
-// nothing in that build's UI reaches them; a build WITHOUT one has no other surface, so they
-// are kept rather than deleted. The lint is silenced for that one build and nowhere else: the
-// default build, which is what ships, keeps every warning.
-#![cfg_attr(feature = "pane", allow(dead_code))]
-
-use std::sync::{Arc, Mutex};
-use std::time::Duration;
-
-use eframe::egui;
-use egui::{Color32, RichText};
-
-use vn_shell_core::appprefs::AppPrefs;
-use vn_shell_core::browser::{self, Browser};
-use vn_shell_core::firstrun::{self, Card, Kind as CardKind, Where};
-use vn_shell_core::home::Origin;
-use vn_shell_core::keystate::{self as keystate, KeyState};
-use vn_shell_core::options::Options;
-use vn_shell_core::prefs::Preferences;
-use vn_shell_core::status::{Phase, Status};
-use vn_shell_core::windowstate::WindowState;
-use vn_shell_core::{appdata, urlpolicy, windowstate};
-use vn_shell_paths::{human, Kind, Row};
-use vn_shell_runtime::{
-    Adopt, Console, EntryPoints, Plan, Setup, SetupKind, StopOutcome, Supervisor,
-};
-
-/// Whether THIS build can show the harness inside its own window.
-///
-/// The binary asks, so that `-Mode embed` is a refusal by name in a build with no engine and
-/// a real mode in one that has. The answer travels as a value because `vn-shell-core` is
-/// the pure half and has no engine to learn about.
-///
-/// With the pane it comes from the crate that OWNS the engine rather than from a second
-/// `cfg!` here: one place decides whether this build has an engine, and it is not this one.
-#[cfg(feature = "pane")]
-pub const fn pane_available() -> bool {
-    vn_shell_pane::available()
-}
-
-/// A build without the pane has no engine, and says so without asking anybody.
-#[cfg(not(feature = "pane"))]
-pub const fn pane_available() -> bool {
-    false
-}
-
-/// How often the panel re-reads the supervisor even when nothing has happened.
-const POLL: Duration = Duration::from_millis(250);
-
-/// How many log lines the panel draws. The RING keeps more; this is what fits on
-/// screen at once.
-const LOG_LINES: usize = 400;
-
-/// The two colours a row needs when it is telling somebody something is wrong, or that
-/// something is right. The palette's own accent is for the app's own voice.
-const WARN: Color32 = Color32::from_rgb(0xe5, 0x39, 0x35);
-const OK: Color32 = Color32::from_rgb(0x4c, 0xaf, 0x50);
-
-// ---------------------------------------------------------------------------
-// The palette
-// ---------------------------------------------------------------------------
-/// Two colours the panel needs, taken from the profile's own theme.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct Palette {
-    pub background: Color32,
-    pub accent: Color32,
-}
-
-impl Palette {
-    /// The page's theme, as the native chrome's palette.
-    ///
-    /// These are the pack's own extension themes plus the two base preferences,
-    /// and the values are chosen to sit beside the page rather than to match it
-    /// pixel for pixel - the seam that matters is the FIRST frame, and a dark
-    /// frame around a green page is what makes an embedded UI look bolted on.
-    /// An unknown name falls back to the base preference and then to dark, so a
-    /// theme this build has never heard of cannot make the panel unreadable.
-    pub fn for_theme(name: &str) -> Palette {
-        match name {
-            "light" => Palette {
-                background: Color32::from_rgb(0xf7, 0xf7, 0xf5),
-                accent: Color32::from_rgb(0x2b, 0x5d, 0xd6),
-            },
-            "hacker" => Palette {
-                background: Color32::from_rgb(0x0a, 0x0e, 0x0a),
-                accent: Color32::from_rgb(0x00, 0xff, 0x41),
-            },
-            "nord" => Palette {
-                background: Color32::from_rgb(0x2e, 0x34, 0x40),
-                accent: Color32::from_rgb(0x88, 0xc0, 0xd0),
-            },
-            "monokai" => Palette {
-                background: Color32::from_rgb(0x27, 0x28, 0x22),
-                accent: Color32::from_rgb(0xf9, 0x26, 0x72),
-            },
-            "cyber" => Palette {
-                background: Color32::from_rgb(0x04, 0x06, 0x0d),
-                accent: Color32::from_rgb(0x00, 0xd9, 0xff),
-            },
-            _ => Palette {
-                background: Color32::from_rgb(0x14, 0x16, 0x1a),
-                accent: Color32::from_rgb(0x4f, 0x8c, 0xff),
-            },
-        }
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Everything the panel was handed
-// ---------------------------------------------------------------------------
-/// What the binary knows and the panel draws.
-pub struct ShellContext {
-    pub options: Options,
-    pub plan: Plan,
-    pub supervisor: Arc<Supervisor>,
-    /// The one transcript: the supervisor and the installer both write to it, and
-    /// the log panel draws it.
-    pub console: Arc<Console>,
-    /// Install and uninstall, run through the same entry points a person clicks.
-    pub setup: Arc<Setup>,
-    /// The runner behind a copy out of a home this app did not create.
-    pub adopt: Arc<Adopt>,
-    /// Where those entry points are. `None` means this app is not sitting beside a
-    /// checkout - a fact the panel shows rather than an error.
-    pub setup_entries: Option<EntryPoints>,
-    /// The checkout or distribution root, for the message when `setup_entries` is
-    /// `None`.
-    pub root: Option<std::path::PathBuf>,
-    pub paths: Vec<Row>,
-    pub profiles: Vec<String>,
-    pub prefs: Preferences,
-    pub key_state: KeyState,
-    /// Shared with the binary, which writes it on the way out. The panel only ever
-    /// folds a reading into it through `WindowState::merge`.
-    pub geometry: Arc<Mutex<WindowState>>,
-    /// The browsers found on this machine, Chrome first, with the OS opener last.
-    pub browsers: Vec<Browser>,
-    /// The one this run will use.
-    pub browser: Browser,
-    /// The app's own preferences, and the root they are written into. The panel is
-    /// the ONLY writer: a browser choice or a home choice is a click, and a click
-    /// that did not persist would be a click that lied. The root is the LADDER's -
-    /// the same one the window record, the npm cache and the home live in - so a
-    /// portable folder, a confined run and an ordinary install all remember the
-    /// answer in the place the answer belongs to.
-    pub app_prefs: AppPrefs,
-    pub prefs_root: Option<std::path::PathBuf>,
-}
-
-/// What to do the moment the step now running has finished.
-///
-/// One field rather than a queue: at most one thing can be waiting, and each variant
-/// exists because the action behind it must not run at the same time as the action in
-/// front of it. `InstallPack` waits for a Stop (the installer re-links the profile);
-/// `Start` waits for an install (a home with no pack would start a bare harness).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-enum Next {
-    InstallPack,
-    Start,
-}
-
-/// What the pack row says, from the profile's own file.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-enum PackState {
-    /// This pack is in the profile the harness will load.
-    Installed(usize),
-    /// It is not, and the number says how big the profile is anyway.
-    Bare(usize),
-}
-
-/// The running application.
-pub struct Shell {
-    context: ShellContext,
-    sizes: Vec<Option<u64>>,
-    /// The pid whose URL has already been opened in a browser, so one tab is opened
-    /// per instance and not one per frame.
-    opened_for: Option<u32>,
-    /// A Stop is in flight: the button is disabled and the label says so.
-    stopping: bool,
-    /// Where the thread running Stop publishes its answer.
-    stop_outcome: Option<Arc<Mutex<Option<StopOutcome>>>>,
-    last_stop: Option<StopOutcome>,
-    /// The last thing the panel itself had to say (a refused Start, say).
-    notice: Option<String>,
-    /// Whether the web profile lists this pack, and when that was last checked.
-    /// Re-read on a slow tick rather than every frame: it is a file on disk, and
-    /// the answer changes only when an install or an uninstall has run.
-    pack_note: Option<String>,
-    pack_checked: Option<std::time::Instant>,
-    /// So a setup run finishing forces that re-read without polling for it.
-    setup_was_running: bool,
-    /// The second click of Adopt: take the credentials file too. Off by default, and
-    /// it is a byte copy - the key's value is never read into this process.
-    adopt_key: bool,
-    /// What the panel last had to say about the offer itself (an unreadable source).
-    adopt_note: Option<String>,
-    /// Which browser the launch actually used, and whether it worked: the panel says
-    /// so rather than leaving the reader to guess whether the tab opened.
-    surface: Option<String>,
-    /// **The harness page, and the engine behind it.**
-    ///
-    /// Compiled only with the `pane` feature. With the feature off this field does not
-    /// exist and the browser hand-off is the surface, exactly as before - which is what
-    /// keeps the default build's behaviour and its checks unchanged.
-    #[cfg(feature = "pane")]
-    pane: vn_shell_pane::PanePage,
-    /// The home question, surveyed ONCE.
-    ///
-    /// Surveyed rather than computed per frame, because a survey PROBES - it writes a
-    /// file - and a probe per frame would be a write per frame. `None` means this app
-    /// has no root of its own, which is a named failure the panel draws rather than a
-    /// screen it cannot honour.
-    place: Option<Where>,
-    /// **A browser hand-off in flight, and where its answer lands.**
-    ///
-    /// On its own thread because the rungs are WATCHED for up to `browser::SETTLE`
-    /// (1.5 s) - a window that stopped drawing for that long would read as a hang. The
-    /// panel starts one, keeps drawing, and picks the report up in `logic`.
-    hand_off: Option<Arc<Mutex<Option<browser::HandOff>>>>,
-    /// A step waiting for the one now running (see [`Next`]).
-    next: Option<Next>,
-    /// The one disclosure: everything diagnostic, closed by default.
-    details_open: bool,
-    /// A close request was already refused because a copy or an install was in flight.
-    /// The SECOND request is honoured: a window that cannot be closed at all is a
-    /// worse bug than a build interrupted on purpose.
-    close_refused: bool,
-    /// **When the install in flight started, and when it last said anything.**
-    ///
-    /// Measured on a real machine: the installer's first phase is one `npm exec` that
-    /// resolves the harness's whole dependency graph and prints nothing while it does, so
-    /// the pack row sat on its last line for a minute, the window was killed 60 seconds
-    /// in, and nothing had been written to the profile yet. "installing" with a clock
-    /// beside it is the difference between work and a hang; the installer's own line,
-    /// when it arrives, moves `installer_last_at`.
-    setup_started: Option<std::time::Instant>,
-    installer_last: Option<String>,
-    installer_last_at: std::time::Instant,
-    /// **The key field.** `Some` while it is open, and the value is the person's typing.
-    ///
-    /// Three rules travel with it, and they are `keystate::write_env_key`'s: the value is
-    /// drawn with `password(true)` so it cannot be shoulder-read, it is never written into
-    /// a label, a notice, the log or `prefs.json`, and the only thing that comes back out
-    /// of a save is the PATH it was written to. It is cleared the moment it is saved or
-    /// cancelled.
-    key_entry: Option<String>,
-    /// The sentence after a save or a refusal - never the value.
-    key_note: Option<String>,
-    /// Asked once per run: a home with no key gets the field opened for it, because a
-    /// fresh portable home starts with no key at all and the alternative is a person
-    /// staring at "not found" with no way to fix it in the window they are looking at.
-    key_prompted: bool,
-}
-
-impl Shell {
-    pub fn new(context: ShellContext) -> Shell {
-        let sizes = context.paths.iter().map(Row::size).collect();
-        let place = context.plan.app_root().map(|root| {
-            Where::survey(vn_shell_core::home::existing_default_home().as_deref(), root)
-        });
-        // `-Mode embed` opens with the harness page in front: the same window and the same
-        // two tabs, one of them already showing the instance.
-        #[cfg(feature = "pane")]
-        let pane = {
-            let page = vn_shell_pane::PanePage::new();
-            if context.options.mode == Some(vn_shell_core::options::Mode::Embed) {
-                page.in_front()
-            } else {
-                page
-            }
-        };
-        Shell {
-            context,
-            sizes,
-            place,
-            next: None,
-            details_open: false,
-            opened_for: None,
-            stopping: false,
-            stop_outcome: None,
-            last_stop: None,
-            notice: None,
-            pack_note: None,
-            pack_checked: None,
-            setup_was_running: false,
-            adopt_key: false,
-            adopt_note: None,
-            surface: None,
-            #[cfg(feature = "pane")]
-            pane,
-            hand_off: None,
-            close_refused: false,
-            setup_started: None,
-            installer_last: None,
-            installer_last_at: std::time::Instant::now(),
-            key_entry: None,
-            key_note: None,
-            key_prompted: false,
-        }
-    }
-
-    // -----------------------------------------------------------------------
-    // The first-run choice
-    // -----------------------------------------------------------------------
-
-    /// Whether the home has to be chosen before the panel means anything.
-    ///
-    /// Asked of the person exactly once, and only while NOBODY ELSE has named the home:
-    /// a `-DshHome` is somebody typing a path, and an inherited `DSH_HOME` is the
-    /// session that started this app saying where its own state lives. Everything else
-    /// - the installation on the machine, this app's own root - is the app GUESSING, and
-    /// a guess is exactly what this screen replaces.
-    fn needs_setup(&self) -> bool {
-        if self.place.is_none() || self.context.app_prefs.home.is_some() {
-            return false;
-        }
-        if self.context.options.dsh_home.is_some() {
-            return false;
-        }
-        !matches!(
-            self.context.plan.home.home.as_ref().map(|selection| selection.origin),
-            Some(Origin::Inherited)
-        )
-    }
-
-    /// The whole window, while the home is unchosen: one question, and the cards that
-    /// answer it.
-    fn setup_screen(&mut self, ui: &mut egui::Ui) {
-        let Some(place) = self.place.clone() else { return };
-        let cards = place.cards();
-        let preselected = place.preselected().map(|card| card.kind);
-        egui::CentralPanel::default().show(ui, |ui| {
-            egui::ScrollArea::vertical().show(ui, |ui| {
-                ui.add_space(14.0);
-                ui.label(
-                    RichText::new("Where should your sessions, skills and key live?")
-                        .size(19.0)
-                        .strong(),
-                );
-                ui.label(
-                    RichText::new(
-                        // NO MARKDOWN, AND NO BACKTICKS: this is drawn with `ui.label`,
-                        // so emphasis and code spans reach the reader as punctuation. A
-                        // screen of literal asterisks and grave accents is what the
-                        // owner saw, and it reads as a broken build.
-                        "Pick one. It is remembered, and Change on the next screen brings this back.",
-                    )
-                    .weak(),
-                );
-                ui.add_space(12.0);
-                for card in &cards {
-                    self.setup_card(ui, card, preselected == Some(card.kind));
-                    ui.add_space(8.0);
-                }
-                // THE WAY ON, IN ONE FIXED PLACE. This screen can honestly offer one card
-                // and grey out two - measured: the home on this machine is not writable
-                // from a confined parent, and the copy has nothing left to bring - and a
-                // reader looking at two red paragraphs and a third card has no way to
-                // tell that the choice is already made for them. The arrow marks the card
-                // the app would take; this button TAKES it.
-                if let Some(taken) = place.preselected() {
-                    let busy = self.context.setup.is_running() || self.context.adopt.is_running();
-                    ui.add_space(2.0);
-                    ui.horizontal_wrapped(|ui| {
-                        if ui
-                            .add_enabled(
-                                !busy,
-                                egui::Button::new(RichText::new(&taken.continue_label).strong()),
-                            )
-                            .on_hover_text(format!(
-                                "takes the card marked with the arrow above: {} - {}",
-                                taken.title,
-                                taken.path.display()
-                            ))
-                            .clicked()
-                        {
-                            self.apply_choice(taken.kind);
-                        }
-                        ui.label(
-                            RichText::new("· the card marked ▸ above, the one the app suggests")
-                                .weak(),
-                        );
-                    });
-                    let taken_count = cards.iter().filter(|card| card.available).count();
-                    if taken_count < cards.len() {
-                        ui.label(
-                            RichText::new(format!(
-                                "{taken_count} of {} can be taken on this machine; each card that cannot says why",
-                                cards.len()
-                            ))
-                            .weak(),
-                        );
-                    }
-                    ui.add_space(6.0);
-                }
-                if !self.notices().is_empty() {
-                    ui.add_space(4.0);
-                    self.draw_notices(ui);
-                }
-                ui.add_space(8.0);
-                ui.separator();
-                // The one fact about this app's own root the choice depends on.
-                ui.label(RichText::new(root_line(&self.context.plan)).weak());
-                for note in self.context.plan.notes.clone() {
-                    ui.label(RichText::new(format!("note: {note}")).weak());
-                }
-            });
-        });
-    }
-
-    /// One card. Everything a person needs to choose is on it, the button IS the
-    /// choice, and a card that cannot be honoured says why in one sentence rather than
-    /// offering a button that would fail.
-    ///
-    /// A card that cannot be taken has its button DISABLED and carries the reason in
-    /// words - never a button that would fail, and never a silent grey chip.
-    fn setup_card(&mut self, ui: &mut egui::Ui, card: &Card, preselected: bool) {
-        let busy = self.context.setup.is_running() || self.context.adopt.is_running();
-        ui.group(|ui| {
-            ui.horizontal(|ui| {
-                if card.available {
-                    ui.label(
-                        RichText::new(if preselected { "▸" } else { " " })
-                            .color(self.palette().accent)
-                            .strong(),
-                    );
-                } else {
-                    ui.label(RichText::new("×").color(WARN).strong())
-                        .on_hover_text("this one cannot be taken here - the reason is on the card");
-                }
-                ui.label(RichText::new(&card.title).strong());
-                if card.recommended {
-                    ui.label(RichText::new("· recommended").color(self.palette().accent));
-                }
-            });
-            // THE ONE LINE THAT DECIDES IT, ALWAYS OPEN: where the card goes and what is
-            // there now. The rest of the facts go behind `details`, closed by default -
-            // measured: with every fact drawn open, three cards filled the window and
-            // pushed each card's own reason and button off the bottom of it.
-            ui.label(RichText::new(&card.summary));
-            if !card.facts.is_empty() {
-                egui::CollapsingHeader::new("details")
-                    .id_salt(card.id())
-                    .default_open(false)
-                    .show(ui, |ui| {
-                        for fact in &card.facts {
-                            ui.label(RichText::new(fact).weak());
-                        }
-                    });
-            }
-            // THE REASON IS NEVER COLLAPSED. It is the answer to "why can I not press
-            // this", and a greyed-out button with its explanation one click away is a bug
-            // report waiting to happen.
-            if let Some(reason) = card.unavailable.as_deref() {
-                ui.label(RichText::new(reason).color(WARN));
-            }
-            ui.horizontal(|ui| {
-                if card.kind == CardKind::CopyExisting && card.available {
-                    // The offer is decided by the file's SIZE; this tick is what makes
-                    // the copy itself a byte copy, still never a read.
-                    ui.checkbox(&mut self.adopt_key, "include my key")
-                        .on_hover_text("copies .credentials.yaml byte for byte");
-                }
-                // ONE WORDING PER ACTION, and the card's own is the one that counts: the
-                // button here and the one at the foot of the screen take the same card,
-                // so they say the same thing. Deciding the label in the drawing code is
-                // how the foot of the screen and the card drift apart.
-                if ui
-                    .add_enabled(card.available && !busy, egui::Button::new(&card.continue_label))
-                    .clicked()
-                {
-                    self.apply_choice(card.kind);
-                }
-            });
-        });
-    }
-
-    /// Put the choice into effect: remember the home, copy first if that is the choice,
-    /// and RE-PLAN so nothing on the next screen describes a home the app left behind.
-    fn apply_choice(&mut self, kind: CardKind) {
-        self.notice = None;
-        let Some(place) = self.place.clone() else { return };
-        let choice = firstrun::Choice { kind, include_key: self.adopt_key };
-        let home = choice.home(&place);
-        let cwd = std::env::current_dir().ok();
-        if let Err(message) =
-            self.context.app_prefs.set_home(&home.to_string_lossy(), cwd.as_deref())
-        {
-            self.notice = Some(message);
-            return;
-        }
-        self.save_prefs();
-        // A copy runs first and on its own thread, and the pack follows it into the home
-        // it just filled (see the chain in `logic`). ONE place decides "this home has no
-        // pack yet", which is why the chain is a decision function rather than a second
-        // copy of the rule.
-        if kind == CardKind::CopyExisting {
-            if let Some(existing) = place.existing.as_ref() {
-                let adoption = vn_shell_core::adopt::plan(&existing.path, &home);
-                self.run_adopt(adoption);
-            }
-        }
-        self.replan();
-    }
-
-    /// **The one place in this app that holds a secret**, and the whole of what it does
-    /// with it.
-    ///
-    /// The value is drawn masked, kept in this struct only while the field is open, handed
-    /// to `keystate::write_env_key` - which returns the PATH and never the value - and
-    /// cleared on save. What the panel may print is the path: the log line and the note
-    /// both name the file, because a transcript is the easiest place to leak a key and the
-    /// only safe thing to say about one is where it went.
-    fn key_field(&mut self, ui: &mut egui::Ui) {
-        if self.key_entry.is_none() {
-            if let Some(note) = self.key_note.clone() {
-                ui.label(RichText::new(note).weak());
-            }
-            return;
-        }
-        let mut value = self.key_entry.clone().unwrap_or_default();
-        let mut save = false;
-        let mut cancel = false;
-        ui.horizontal_wrapped(|ui| {
-            ui.label(RichText::new("key").weak());
-            ui.add(
-                egui::TextEdit::singleline(&mut value)
-                    .password(true)
-                    .desired_width(300.0)
-                    .hint_text("paste the value from the DeepSeek console"),
-            );
-            save = ui
-                .add_enabled(!value.trim().is_empty(), egui::Button::new("Save"))
-                .on_hover_text("writes DEEPSEEK_API_KEY into this home's .env")
-                .clicked();
-            cancel = ui.button("Cancel").clicked();
-        });
-        let where_line = match self.context.plan.home_path() {
-            Some(home) => format!(
-                "written to {} as DEEPSEEK_API_KEY - inside this home, so it travels with the folder. It is never read back and never logged",
-                home.join(keystate::ENV_FILE).display()
-            ),
-            None => "there is no home in use, so there is nowhere to write a key".to_string(),
-        };
-        ui.label(RichText::new(where_line).weak());
-        if let Some(note) = self.key_note.clone() {
-            ui.label(RichText::new(note).weak());
-        }
-        if cancel {
-            self.key_entry = None;
-            self.key_note = None;
-            self.key_prompted = true;
-            return;
-        }
-        // Keep the typing between frames, and save only on the click.
-        self.key_entry = Some(value);
-        if save {
-            self.save_key();
-        }
-    }
-
-    /// Save what is in the field, and say where it went - never what it was.
-    fn save_key(&mut self) {
-        let Some(value) = self.key_entry.clone() else { return };
-        let Some(home) = self.context.plan.home_path().map(std::path::Path::to_path_buf) else {
-            self.key_note =
-                Some("there is no home in use, so there is nowhere to write a key".to_string());
-            return;
-        };
-        match keystate::write_env_key(&home, &value) {
-            Ok(path) => {
-                self.key_entry = None;
-                self.key_prompted = true;
-                self.context.console.push(&format!(
-                    "[vncode] the model key was saved to {} (the value is never read back and never written to a log)",
-                    path.display()
-                ));
-                // Re-read the layers, so the row turns green from the SAME reader the log
-                // line and the harness use - not from an assumption about what was written.
-                self.context.key_state = keystate::read(self.context.plan.home_path());
-                self.key_note = Some(format!(
-                    "saved to {} - the harness resolves it from there as its DEEPSEEK_API_KEY fallback layer",
-                    path.display()
-                ));
-            }
-            // The value stays in the field so it can be fixed, and the sentence never
-            // contains it.
-            Err(message) => self.key_note = Some(message),
-        }
-    }
-
-    /// Rebuild everything the home choice decided, and say so if it cannot be.
-    fn replan(&mut self) {
-        match vn_shell_runtime::view::view(
-            &self.context.options,
-            self.context.app_prefs.home.as_deref(),
-        ) {
-            Ok(view) => {
-                self.sizes = view.paths.iter().map(Row::size).collect();
-                self.context.plan = view.plan;
-                self.context.paths = view.paths;
-                self.context.profiles = view.profiles;
-                self.context.prefs = view.prefs;
-                self.context.key_state = view.key_state;
-                // The profile's own answer is re-read on the next tick rather than
-                // assumed: an install may be what changed it.
-                self.pack_checked = None;
-            }
-            Err(message) => self.notice = Some(message),
-        }
-    }
-
-    /// Whether the home in use has this pack in it. One file, read on a click.
-    fn pack_missing(&self) -> bool {
-        self.context
-            .plan
-            .home_path()
-            .map(|home| {
-                !vn_shell_core::profile::bundles(home, vn_shell_core::launch::PROFILE)
-                    .map(|bundles| vn_shell_core::profile::has_pack(&bundles))
-                    .unwrap_or(false)
-            })
-            .unwrap_or(false)
-    }
-
-    /// What the pack row says, from the profile the harness will load.
-    fn pack_state(&self) -> PackState {
-        match self.context.plan.home_path() {
-            Some(home) => {
-                match vn_shell_core::profile::bundles(home, vn_shell_core::launch::PROFILE) {
-                    Some(bundles) if vn_shell_core::profile::has_pack(&bundles) => {
-                        PackState::Installed(bundles.len())
-                    }
-                    Some(bundles) => PackState::Bare(bundles.len()),
-                    None => PackState::Bare(0),
-                }
-            }
-            None => PackState::Bare(0),
-        }
-    }
-
-    /// What the panel itself has to say, and what the copy had to say.
-    ///
-    /// The copy's own sentence used to be drawn ONLY inside `Details`, which is how a
-    /// press that did nothing at all - "there is nothing to adopt from that home" - read
-    /// as a button that does nothing. Both now stand at the top of whichever screen the
-    /// reader is on: the first-run choice and the panel.
-    fn notices(&self) -> Vec<String> {
-        let mut lines = Vec::new();
-        if let Some(notice) = self.notice.as_ref() {
-            lines.push(notice.clone());
-        }
-        if let Some(note) = self.adopt_note.as_ref() {
-            lines.push(note.clone());
-        }
-        lines
-    }
-
-    fn draw_notices(&self, ui: &mut egui::Ui) {
-        for line in self.notices() {
-            ui.horizontal_wrapped(|ui| {
-                ui.label(RichText::new("! ").color(WARN));
-                ui.label(line);
-            });
-        }
-    }
-
-    fn palette(&self) -> Palette {
-        Palette::for_theme(self.context.prefs.palette())
-    }
-}
-
-impl Shell {
-    /// Re-read the profile's own answer to "is this pack installed here".
-    ///
-    /// Two triggers, and both are cheap: a two-second tick, and a setup run that
-    /// has just FINISHED - which is the one moment the answer can change. Without
-    /// the second one the row would go on saying "the pack is missing" for up to
-    /// two seconds after a successful install, which reads as a failed install.
-    fn refresh_pack_state(&mut self) {
-        let running = self.context.setup.is_running();
-        let just_finished = self.setup_was_running && !running;
-        self.setup_was_running = running;
-        let stale = self
-            .pack_checked
-            .map(|at| at.elapsed() > Duration::from_secs(2))
-            .unwrap_or(true);
-        if stale || just_finished {
-            self.pack_note = vn_shell_runtime::missing_pack_note(
-                self.context.plan.home_path(),
-                vn_shell_core::launch::PROFILE,
-            );
-            self.pack_checked = Some(std::time::Instant::now());
-        }
-    }
-
-    fn status(&self) -> Status {
-        self.context.supervisor.status()
-    }
-
-    /// Start the harness - and, when the chosen home has no pack in it yet, install
-    /// that FIRST.
-    ///
-    /// **One press to a working interface.** The installer re-links the profile, which
-    /// must never happen under a live harness, and at this moment nothing is running -
-    /// which is exactly the window it needs. A home whose profile lists no bundle of
-    /// this pack starts the BARE harness (no right bar, no editor, no themes), a state
-    /// that reads as a broken app; folding the install into Start is what makes "choose
-    /// a home, press Start" enough.
-    ///
-    /// It follows that Start must never take the other way out either: with no installer
-    /// beside this app it REFUSES with a sentence rather than opening a bare interface
-    /// and leaving the reader to work out why the pack is missing.
-    fn start(&mut self) {
-        self.notice = None;
-        let action = start_action(
-            self.pack_missing(),
-            self.context.setup_entries.is_some(),
-            self.context.setup.is_running(),
-        );
-        match action {
-            // The install runs first, and the Start that was waiting for it goes ahead
-            // when it succeeds (see the finish handler in `logic`).
-            StartAction::Install => {
-                self.next = Some(Next::Start);
-                self.run_setup(SetupKind::Install);
-                return;
-            }
-            StartAction::Wait => {
-                self.next = Some(Next::Start);
-                self.notice = Some(
-                    "the pack is being installed into this home - the harness starts as soon as it finishes".to_string(),
-                );
-                return;
-            }
-            StartAction::Refuse => {
-                self.notice = Some(
-                    "this home has none of this pack's bundles, and there is no installer beside this app (scripts/setup/ is missing), so starting the harness here would open the bare interface without the right bar, the editor or the themes. Run the app from the vncode folder, or install the pack yourself, and press Start again.".to_string(),
-                );
-                return;
-            }
-            StartAction::Launch => {}
-        }
-        self.opened_for = None;
-        self.last_stop = None;
-        self.surface = None;
-        // A hand-off from the previous instance has nothing to say about this one.
-        self.hand_off = None;
-        let remembered = self.context.app_prefs.home.clone();
-        if let Err(error) =
-            self.context.supervisor.start(self.context.options.clone(), remembered)
-        {
-            self.notice = Some(error);
-        }
-    }
-
-    /// Open the harness in the chosen browser, WITH the launch token.
-    ///
-    /// The one place in the panel that hands the token to another process, and it does
-    /// it the only way the security rules allow: the URL leaves as a single argv
-    /// element of a program this app found, never through a shell and never onto a
-    /// disk. The panel's own address row keeps drawing the token-less form.
-    ///
-    /// The work happens on a thread (`browser::SETTLE` is up to 1.5 s, and a walk can take
-    /// several) and the answer is picked up in `logic`. **A hand-off already in flight is
-    /// not restarted**: pressing the button twice must not open two tabs, and the settle
-    /// window is exactly what a second press would otherwise race.
-    ///
-    /// Two facts travel with the walk, and both are MEASUREMENTS rather than policy: the
-    /// profile directory this app can offer a Chromium (`<app root>/browser`, so a
-    /// confinement that refuses the browser its own profile is answered rather than merely
-    /// reported), and whether that retry goes FIRST - it does when this app's own probe of
-    /// the machine's temp directory was refused, because that is what a session which
-    /// confines what this app starts looks like, and a doomed launch is owed to nobody.
-    fn start_hand_off(&mut self) {
-        if self.hand_off.is_some() {
-            return;
-        }
-        self.notice = None;
-        let Some(url) = self.status().navigate_url().map(str::to_string) else {
-            self.notice = Some(
-                "there is no address to open yet - press Start and wait for the harness to be ready"
-                    .to_string(),
-            );
-            return;
-        };
-        let chosen = self.context.browser.clone();
-        let profile = self
-            .context
-            .plan
-            .app_root()
-            .or(self.context.prefs_root.as_deref())
-            .map(browser::own_profile_dir);
-        let confined = self.context.plan.temp.is_some();
-        let slot = Arc::new(Mutex::new(None));
-        let landing = Arc::clone(&slot);
-        self.hand_off = Some(slot);
-        std::thread::spawn(move || {
-            let report =
-                browser::hand_off(&chosen, &url, profile.as_deref(), confined, browser::SETTLE);
-            if let Ok(mut landing) = landing.lock() {
-                *landing = Some(report);
-            }
-        });
-    }
-
-    /// What the hand-off did, in the log and on the `browser` row.
-    ///
-    /// **Every rung's own sentence goes into the transcript**, because "I pressed the
-    /// button and nothing happened" is a bug report this panel used to be unable to
-    /// answer: the launch's result lived only in a row that said "opened in Google
-    /// Chrome (a new tab)" - which is what it said while Chrome was dying on the way up,
-    /// and what it said while the platform's opener exited zero over a window that never
-    /// appeared. The console redacts on the way in, so the address can be named in full.
-    fn finish_hand_off(&mut self, report: browser::HandOff) {
-        for line in &report.lines {
-            self.context.console.push(&format!("[vncode] {line}"));
-        }
-        match report.took {
-            Some(label) => {
-                // A page in a browser of the person's own, or a window of this app's own
-                // making: the row says which, because they are different windows.
-                self.surface = Some(if report.own_profile {
-                    format!("{label} (a window of its own, with a profile in this folder)")
-                } else {
-                    format!("{label} (a new tab)")
-                });
-                let address = self
-                    .status()
-                    .public_url()
-                    .unwrap_or_else(|| "the harness".to_string());
-                self.context.console.push(&format!("[vncode] opened {address} in {label}"));
-            }
-            None => {
-                self.surface = None;
-                self.context.console.push(&format!("[vncode] {}", report.refusal()));
-                self.notice = Some(format!("{}.{}", report.refusal(), self.confined_hint()));
-            }
-        }
-    }
-
-    /// The sentence that explains a browser that could not start, when this app has the
-    /// measurement that names the reason.
-    ///
-    /// A browser needs its own profile directory, and a process this app starts inherits
-    /// whatever confinement this app runs under. The app already MEASURES that: when the
-    /// machine's temp directory refuses the probe, a child of this process is confined
-    /// (`env::choose_temp`), and a confined Chrome dies at startup -
-    /// `Crashpad … settings.dat: Access is denied`, measured. The walk answers that with a
-    /// profile inside this folder, so this sentence is what is left when even that did not
-    /// work, and it names the step that exists rather than leaving a grey button.
-    fn confined_hint(&self) -> String {
-        if self.context.plan.temp.is_none() {
-            return String::new();
-        }
-        // MEASURED, and what used to end here was WRONG. The old sentence said "Start vncode
-        // by double-clicking scripts\run-desktop.bat, outside that session, and the tab
-        // opens." The run that disproved it was launched from Explorer - outside every
-        // session - and a launched Chrome still exited `0x80000003` there, while the OS web
-        // engine drew the same page inside this window. Both facts came from ONE process (P0),
-        // so this no longer promises that starting somewhere else helps.
-        if pane_available() {
-            " A browser this app starts is refused on this machine (measured: Chrome exits 0x80000003 here AND when the app is launched from Explorer, so starting it somewhere else is not the answer). Use the `harness` tab above: it draws the harness in this window and starts no browser.".to_string()
-        } else {
-            " A browser this app starts is refused on this machine (measured: Chrome exits 0x80000003 here AND when the app is launched from Explorer, so starting it somewhere else is not the answer). This build has no pane - it is an opt-in feature - so there is no surface left on this machine that can show the page.".to_string()
-        }
-    }
-
-    /// Remember a browser, and say so if the preferences file could not be written.
-    ///
-    /// The choice takes effect on the NEXT Start, because the tab is opened once the
-    /// ready line arrives - which is the same rule the home choice follows, and the
-    /// panel says so in both places rather than pretending otherwise.
-    fn choose_browser(&mut self, id: &str) {
-        if !self.context.app_prefs.set_browser(id) {
-            self.notice = Some(format!("'{id}' is not a browser this build knows"));
-            return;
-        }
-        self.context.browser = browser::resolve(self.context.app_prefs.browser.as_deref(), &self.context.browsers);
-        self.save_prefs();
-    }
-
-    /// Bring the home question back.
-    ///
-    /// This is the way back to the first-run screen, and it is the ONLY home control
-    /// now: the four buttons that used to sit beside Start (`Use …`, `Adopt …`, `Use my
-    /// own home`, `Forget it`) were four answers to one question, asked in a place where
-    /// the question was not visible. Clearing the remembered home puts the question back
-    /// in front of the person, with the machine's installation and this app's own root
-    /// both on offer again.
-    fn change_home(&mut self) {
-        self.context.app_prefs.clear_home();
-        self.save_prefs();
-        self.notice = None;
-        self.pack_checked = None;
-        // Re-surveyed, because a copy or an install may have changed what the cards
-        // should say.
-        self.place = self.context.plan.app_root().map(|root| {
-            Where::survey(vn_shell_core::home::existing_default_home().as_deref(), root)
-        });
-        self.replan();
-    }
-
-    fn save_prefs(&mut self) {
-        let Some(root) = self.context.prefs_root.clone() else {
-            self.notice = Some(
-                "there is nowhere to remember that: this app could not create its own root"
-                    .to_string(),
-            );
-            return;
-        };
-        if let Err(error) = self.context.app_prefs.save(&root) {
-            self.notice = Some(error);
-        }
-    }
-
-    fn stop(&mut self) {
-        if self.stopping {
-            return;
-        }
-        self.stopping = true;
-        let shell = Arc::clone(&self.context.supervisor);
-        let outcome = Arc::new(Mutex::new(None));
-        let slot = Arc::clone(&outcome);
-        // Stop blocks until the tree is down and the port has been CHECKED, which
-        // is up to a few seconds. On a thread, so the window keeps drawing and can
-        // say what it is waiting for.
-        std::thread::spawn(move || {
-            let report = shell.stop();
-            if let Ok(mut slot) = slot.lock() {
-                *slot = Some(report);
-            }
-        });
-        self.last_stop = None;
-        self.stop_outcome = Some(outcome);
-    }
-
-    /// Fold this frame's window geometry into the shared record.
-    fn observe(&self, ctx: &egui::Context) {
-        let info = ctx.input(|input| input.viewport().clone());
-        let Some(inner) = info.inner_rect else {
-            return;
-        };
-        let reading = WindowState {
-            width: inner.width() as f64,
-            height: inner.height() as f64,
-            x: info.outer_rect.map(|rect| rect.min.x as f64),
-            y: info.outer_rect.map(|rect| rect.min.y as f64),
-            maximized: info.maximized.unwrap_or(false),
-        };
-        if let Ok(mut slot) = self.context.geometry.lock() {
-            *slot = slot.merge(&reading);
-        }
-    }
-
-    fn theme(&self, ctx: &egui::Context) {
-        let palette = Palette::for_theme(self.context.prefs.palette());
-        let mut visuals = if self.context.prefs.palette() == "light" {
-            egui::Visuals::light()
-        } else {
-            egui::Visuals::dark()
-        };
-        visuals.panel_fill = palette.background;
-        visuals.window_fill = palette.background;
-        visuals.selection.bg_fill = palette.accent.gamma_multiply(0.35);
-        ctx.set_visuals(visuals);
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Drawing
-// ---------------------------------------------------------------------------
-//
-// egui 0.36 splits an application in two: `logic`, which may not draw and is also
-// called while the window is hidden, and `ui`, which is handed the root `Ui` and
-// draws into it. Panels are therefore shown INSIDE that `Ui`
-// (`egui::Panel::top(...).show(ui, …)`) rather than against the context, which is
-// the shape this file is written to.
-impl eframe::App for Shell {
-    fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
-        // A stop that was started on a thread: pick up its answer when it lands.
-        if let Some(outcome) = self
-            .stop_outcome
-            .as_ref()
-            .and_then(|slot| slot.lock().ok().and_then(|slot| slot.clone()))
-        {
-            self.last_stop = Some(outcome);
-            self.stopping = false;
-            self.stop_outcome = None;
-            // ...and if the reader asked "install the pack here" while the harness was
-            // up, this is the moment it may run: the installer re-links the profile,
-            // which it must not do under a live harness.
-            if self.next == Some(Next::InstallPack) {
-                self.next = None;
-                self.run_setup(SetupKind::Install);
-            }
-        }
-
-        self.theme(ctx);
-        self.observe(ctx);
-        // A WINDOW THAT CLOSES MID-INSTALL TAKES THE INSTALLER WITH IT. Measured on a
-        // real machine: the npm log stopped in the middle of resolving the harness's
-        // dependency graph, the profile was left listing the bare harness, and the next
-        // attempt re-added all twenty-four bundles from scratch because the entry point
-        // implies `-Force`. So the first close request while work is in flight is
-        // refused with a sentence; the second is honoured, because a window nobody can
-        // close is worse.
-        let busy_now = self.context.setup.is_running() || self.context.adopt.is_running();
-        if !busy_now {
-            self.close_refused = false;
-        }
-        if busy_now && !self.close_refused && ctx.input(|input| input.viewport().close_requested())
-        {
-            self.close_refused = true;
-            ctx.send_viewport_cmd(egui::ViewportCommand::CancelClose);
-            self.notice = Some(
-                "an install or a copy is in flight: the window stayed open so it can finish (closing again stops it, and the profile is left as it stands)".to_string(),
-            );
-        }
-        // A step that was asked for while another was running. The "was" is read BEFORE
-        // the refresh, because the refresh is what consumes the transition.
-        let setup_was = self.context.setup.is_running();
-        let adopt_was = self.context.adopt.is_running();
-        self.refresh_pack_state();
-        // The install's clock. A step that starts timestamps itself, and every new line
-        // the installer prints moves the second mark, so the row can say "nothing for
-        // 40s" about the phase that really is silent instead of about the whole run.
-        let setup_now = self.context.setup.status();
-        if setup_now.running {
-            if self.setup_started.is_none() {
-                self.setup_started = Some(std::time::Instant::now());
-                self.installer_last = None;
-                self.installer_last_at = std::time::Instant::now();
-            }
-            if setup_now.last != self.installer_last {
-                self.installer_last = setup_now.last.clone();
-                self.installer_last_at = std::time::Instant::now();
-            }
-        } else {
-            self.setup_started = None;
-        }
-
-        // An install or an uninstall just finished: the homes changed under us - a
-        // profile exists now that did not, and a pack may have appeared in it.
-        if setup_was && !self.context.setup.is_running() {
-            let finished_well = self.context.setup.status().exit == Some(0);
-            self.replan();
-            match self.next.take() {
-                // A Start that was waiting for the pack. It only goes ahead if the
-                // install WORKED: starting a bare harness because the installer failed
-                // would hide the failure behind a window that looks merely empty.
-                Some(Next::Start) if finished_well => self.start(),
-                Some(Next::Start) => {
-                    self.notice = Some(
-                        "the pack could not be installed, so the harness was not started - the log has the installer's own output".to_string(),
-                    );
-                }
-                _ => {}
-            }
-        }
-        // ASK ONCE, WHEN THERE IS NO KEY AT ALL - and ask in THIS window.
-        //
-        // A fresh portable home starts keyless by construction: nothing is copied from the
-        // machine, and `$DSH_HOME/.env` does not exist yet. Measured: the panel said
-        // "DeepSeek key: not found" beside a home that had 24 bundles and no way to do
-        // anything about it in the screen the person was looking at. So the field opens
-        // itself once per run, the person pastes, and the key lands in the folder.
-        if !self.context.key_state.loaded() && !self.key_prompted && !self.needs_setup() {
-            self.key_prompted = true;
-            self.key_entry = Some(String::new());
-            self.key_note = Some(
-                "this home has no model key yet: paste it here and press Save - it is written into this folder as DEEPSEEK_API_KEY, never read back and never logged (or add it in the harness's Settings > Models once it is running)"
-                    .to_string(),
-            );
-        }
-        // A copy just finished: the home it copied INTO is the one in use, so the
-        // location map and the key state are re-read rather than assumed - and the
-        // second half of the card's own promise is kept. "The pack is installed into
-        // the copy next" was a sentence nothing acted on: the copy landed, the pack row
-        // went on saying "not installed here yet", and the person had to work out that
-        // a second press was owed. The installer must not run under a live harness and
-        // nothing is running at this moment, so it starts here.
-        if adopt_was && !self.context.adopt.is_running() {
-            self.replan();
-            let copied = self.context.adopt.state().failed.is_none();
-            if copied {
-                let live = self.status().phase.is_live();
-                match chain_after_copy(
-                    self.pack_missing(),
-                    self.context.setup_entries.is_some(),
-                    self.context.setup.is_running(),
-                    live,
-                ) {
-                    Some(kind) => self.run_setup(kind),
-                    None if live && self.pack_missing() => {
-                        self.notice = Some(
-                            "the copy is in the home now in use; the pack is installed into it by Stop and install on the pack row, because the installer must not re-link a profile a running harness has read".to_string(),
-                        );
-                    }
-                    None => {}
-                }
-            }
-        }
-
-        // The browser tab is opened once the ready line names a loopback URL - the
-        // same hand-off `scripts/run-web` makes, with the URL as ONE argv element,
-        // through a program this app found rather than through a shell. One tab per
-        // INSTANCE (keyed on the pid), not one per frame.
-        //
-        // A hand-off already in flight is picked up here rather than waited on: the
-        // rungs are watched for up to `browser::SETTLE`, and a window that stopped
-        // drawing for that long would read as a hang.
-        if let Some(report) = self
-            .hand_off
-            .as_ref()
-            .and_then(|slot| slot.lock().ok().and_then(|slot| slot.clone()))
-        {
-            self.hand_off = None;
-            self.finish_hand_off(report);
-        }
-        let status = self.status();
-        if status.phase == Phase::Running && self.opened_for != status.pid {
-            self.opened_for = status.pid;
-            // With an engine compiled in, the harness is shown in THIS window and the
-            // automatic hand-off is not started at all: `Open in my browser` on the pane's
-            // own bar is the way to a browser, and it is a click rather than a surprise.
-            #[cfg(not(feature = "pane"))]
-            self.start_hand_off();
-        }
-
-        // Poll: the supervisor's state changes on its own thread.
-        ctx.request_repaint_after(POLL);
-    }
-
-    fn ui(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame) {
-        // The frame carries the window handle the pane is created against, so a build WITHOUT
-        // the pane has nothing to do with it. It is named here rather than prefixed with an
-        // underscore on purpose: the pane build DOES use it, and one name for one parameter is
-        // what keeps both builds the same function instead of two that drift.
-        #[cfg(not(feature = "pane"))]
-        let _ = frame;
-
-        // THE CHOICE COMES FIRST, and while it is unmade it IS the window: no header,
-        // no log, no rows - one question and the cards that answer it.
-        if self.needs_setup() {
-            self.setup_screen(ui);
-            return;
-        }
-        let status = self.status();
-        self.header(ui, &status);
-
-        // **The harness page, when this build has an engine.**
-        //
-        // It owns everything below the header, and that is the whole reason it can be a
-        // child view at all: a child web view paints ABOVE the surface this panel draws on
-        // and cannot be clipped, so nothing of ours may go inside its rectangle. The page
-        // is drawn INSTEAD of the rows, never over them.
-        //
-        // It is asked for nothing and hands nothing back: with the pane this app starts no
-        // browser, so there is no token to hand to another program, and Stop is one control
-        // in the header this page sits under.
-        #[cfg(feature = "pane")]
-        {
-            let data_dir = self.context.plan.app_root().map(|root| root.join("webview"));
-            self.pane.show(ui, frame, &status, data_dir, false);
-            if self.pane.owns_the_area() {
-                return;
-            }
-        }
-
-        self.log_panel(ui);
-        self.body(ui, &status);
-    }
-}
-
-impl Shell {
-    /// The whole bar: what the harness is doing, and the three things that can be done
-    /// about it. One line, and everything that is neither a state nor an action is in
-    /// `Details` below.
-    fn header(&mut self, ui: &mut egui::Ui, status: &Status) {
-        egui::Panel::top("header").show(ui, |ui| {
-            ui.add_space(6.0);
-            ui.horizontal(|ui| {
-                ui.label(RichText::new("vncode").strong().size(18.0));
-                ui.add_space(8.0);
-                let (colour, text) = phase_badge(status.phase);
-                ui.label(RichText::new(format!("● {text}")).color(colour));
-                ui.add_space(12.0);
-
-                let live = status.phase.is_live();
-                let busy = self.context.setup.is_running() || self.context.adopt.is_running();
-                ui.add_enabled_ui(!live && !self.stopping && !busy, |ui| {
-                    let label = if busy { "Working…" } else { "Start" };
-                    if ui
-                        .button(label)
-                        .on_hover_text(
-                            "starts the pinned harness - and installs this pack first if this home has none",
-                        )
-                        .clicked()
-                    {
-                        self.start();
-                    }
-                });
-                ui.add_enabled_ui(live && !self.stopping, |ui| {
-                    let label = if self.stopping { "Stopping…" } else { "Stop" };
-                    if ui.button(label).clicked() {
-                        self.stop();
-                    }
-                });
-                // THE BUTTON THAT CARRIES THE TOKEN. The panel draws the URL without
-                // its query, because that URL is a credential; this opens the one with
-                // it, in the chosen browser, as one argv element. It is also the way
-                // back in after a tab is closed by accident. It stays live while a
-                // hand-off is in flight - the button is the control the reader pressed,
-                // and the row below says what the press is doing.
-                //
-                // **Present only in a build WITHOUT the pane.** With the pane this app opens
-                // no browser, so a button that opened one would be a control that contradicts
-                // the surface: the harness is already in this window, one tab away.
-                #[cfg(not(feature = "pane"))]
-                {
-                    let running = status.phase == Phase::Running;
-                    let label = if self.hand_off.is_some() { "Opening…" } else { "Open tab" };
-                    let open = ui
-                        .add_enabled(running || self.hand_off.is_some(), egui::Button::new(label))
-                        .on_hover_text(
-                            "opens the harness in the chosen browser, with the launch token the panel never draws",
-                        );
-                    if open.clicked() {
-                        self.start_hand_off();
-                    }
-                    if !running {
-                        open.on_disabled_hover_text(
-                            "the harness is not running - press Start, and Open tab lights up",
-                        );
-                    }
-                }
-
-                if let Some(uptime) = status.uptime_label() {
-                    ui.add_space(12.0);
-                    ui.label(RichText::new(format!("up {uptime}")).weak());
-                }
-            });
-            ui.add_space(6.0);
-        });
-    }
-
-    /// Ask the installer to run, and say why if it cannot.
-    ///
-    /// It is given the SAME composed environment and the same `-DshHome` the harness
-    /// will be given: an installer that defaulted to the harness's own home would put
-    /// this pack into a profile the app is not running, which is the one way a
-    /// working Install button can look like a broken one. It is also given `-Resume`,
-    /// which is the difference between a second attempt that costs seconds and one
-    /// that re-adds every bundle the profile already lists (see [`setup_extras`]).
-    fn run_setup(&mut self, kind: SetupKind) {
-        self.notice = None;
-        let Some(entries) = self.context.setup_entries.clone() else {
-            self.notice = Some(
-                "there is no installer beside this app - scripts/setup/ is missing, so this build can only supervise a pack that is already installed".to_string(),
-            );
-            return;
-        };
-        let entry = entries.for_kind(kind).to_path_buf();
-        let extra = setup_extras(kind);
-        let (environment, home_arguments) = self.installer_plan();
-        if let Err(message) =
-            self.context.setup.start(kind, &entry, &extra, &environment, &home_arguments)
-        {
-            self.notice = Some(message);
-        }
-    }
-
-    /// What the installer is given, from the plan the panel is already drawing.
-    fn installer_plan(&self) -> (vn_shell_runtime::ChildEnv, Vec<std::ffi::OsString>) {
-        (
-            vn_shell_runtime::env::for_plan(&self.context.plan),
-            vn_shell_runtime::env::dsh_home_arguments(&self.context.plan.home),
-        )
-    }
-
-    /// Copy the durable things out of the home this app did not create.
-    fn run_adopt(&mut self, adoption: vn_shell_core::adopt::Adoption) {
-        self.notice = None;
-        self.adopt_note = None;
-        if let Err(message) = self.context.adopt.start(adoption, self.adopt_key) {
-            self.adopt_note = Some(message);
-        }
-    }
-
-    /// The panel, after the home is settled: what is happening, four facts, and
-    /// everything diagnostic one disclosure away.
-    fn body(&mut self, ui: &mut egui::Ui, status: &Status) {
-        egui::CentralPanel::default().show(ui, |ui| {
-            if !self.notices().is_empty() {
-                self.draw_notices(ui);
-                ui.separator();
-            }
-            egui::ScrollArea::vertical().show(ui, |ui| {
-                ui.add_space(6.0);
-                self.summary(ui, status);
-                ui.add_space(10.0);
-                self.details(ui, status);
-            });
-        });
-    }
-
-    /// **The four rows.** Each is a fact about the home in use, and the ones that can be
-    /// acted on carry their own action: `home` asks the question again, `pack` installs
-    /// this pack where the harness will read it, `browser` chooses what opens the tab.
-    fn summary(&mut self, ui: &mut egui::Ui, status: &Status) {
-        let live = status.phase.is_live();
-        let busy = self.context.setup.is_running() || self.context.adopt.is_running();
-        egui::Grid::new("summary").num_columns(2).spacing([18.0, 8.0]).show(ui, |ui| {
-            // --- home ---------------------------------------------------------------
-            ui.label(RichText::new("home").strong());
-            let (path, why) = self.context.plan.home.row();
-            ui.horizontal_wrapped(|ui| {
-                ui.label(RichText::new(&path).monospace());
-                ui.label(RichText::new(format!("· {why}")).weak());
-                if self.context.plan.home_created() {
-                    ui.label(RichText::new("· created by this app").weak());
-                }
-                // The way back to the question, and the ONLY home control the panel has:
-                // the four buttons that used to sit beside Start were four answers to one
-                // question, asked where the answer could not be seen.
-                if ui
-                    .add_enabled(!live && !busy, egui::Button::new("Change"))
-                    .on_hover_text(format!(
-                        "ask where your sessions, skills and key should live ({})",
-                        shorten(std::path::Path::new(&path))
-                    ))
-                    .clicked()
-                {
-                    self.change_home();
-                }
-            });
-            ui.end_row();
-
-            // --- pack ---------------------------------------------------------------
-            ui.label(RichText::new("pack").strong());
-            ui.horizontal_wrapped(|ui| {
-                let setup = self.context.setup.status();
-                if setup.running {
-                    // WHAT IS IT DOING, HOW FAR ALONG, AND HOW LONG IT HAS BEEN QUIET.
-                    // The installer's own lines are in the log below, but "installing…"
-                    // with nothing moving is what an install looked like while npm
-                    // resolved the harness's whole dependency graph in silence: minutes of
-                    // nothing, and the word for it was "it doesn't work". The last line,
-                    // the elapsed time and the quiet time are three facts that cannot be
-                    // mistaken for a hang - and the quiet one names the phase, because
-                    // npm's resolution really does print nothing.
-                    ui.spinner();
-                    let elapsed = self
-                        .setup_started
-                        .map(|started| started.elapsed())
-                        .unwrap_or_default();
-                    let quiet = self.installer_last_at.elapsed();
-                    let mut line = format!(
-                        "{}ing · {}",
-                        setup.kind.map(SetupKind::label).unwrap_or("work"),
-                        match setup.last.as_deref() {
-                            Some(last) => last.to_string(),
-                            None => "starting the installer".to_string(),
-                        }
-                    );
-                    line.push_str(&format!(" · {}", short_duration(elapsed)));
-                    if quiet.as_secs() >= QUIET_AFTER_SECS {
-                        line.push_str(&format!(
-                            " · no new output for {} - npm is resolving the harness's dependency graph, which prints nothing (normal, seconds when the cache is warm)",
-                            short_duration(quiet)
-                        ));
-                    }
-                    ui.label(RichText::new(line).color(WARN));
-                } else {
-                    match self.pack_state() {
-                        PackState::Installed(bundles) => {
-                            ui.label(RichText::new(format!("installed · {bundles} bundles")).color(OK));
-                        }
-                        PackState::Bare(0) => {
-                            ui.label(RichText::new("not installed here yet").color(WARN));
-                        }
-                        PackState::Bare(bundles) => {
-                            ui.label(
-                                RichText::new(format!(
-                                    "this profile lists {bundles} bundles, none of them this pack"
-                                ))
-                                .color(WARN),
-                            );
-                        }
-                    }
-                }
-                if !setup.running && self.pack_missing() && self.context.setup_entries.is_some() {
-                    if live {
-                        if ui
-                            .add_enabled(!busy && !self.stopping, egui::Button::new("Stop and install"))
-                            .on_hover_text(
-                                "the installer re-links the profile, so the harness has to stop first - this does both",
-                            )
-                            .clicked()
-                        {
-                            self.next = Some(Next::InstallPack);
-                            self.stop();
-                        }
-                    } else if ui
-                        .add_enabled(!busy, egui::Button::new("Install pack here"))
-                        .on_hover_text(
-                            "runs scripts/setup/install.* with this home's -DshHome, resuming what is already installed",
-                        )
-                        .clicked()
-                    {
-                        self.run_setup(SetupKind::Install);
-                    }
-                    ui.label(RichText::new("· Start installs it for you too").weak());
-                } else if !setup.running && self.context.setup_entries.is_none() {
-                    ui.label(RichText::new("no installer beside this app").weak());
-                }
-                if let Some(code) = setup.exit.filter(|code| *code != 0) {
-                    ui.label(
-                        RichText::new(format!("· the last install FAILED (exit {code}) - the log has the installer's own output"))
-                            .color(WARN),
-                    );
-                }
-            });
-            ui.end_row();
-
-            // --- key ----------------------------------------------------------------
-            ui.label(RichText::new("DeepSeek key").strong());
-            ui.horizontal_wrapped(|ui| {
-                match self.context.key_state.source() {
-                    // The layer's NAME, never a value - see `keystate`.
-                    Some(source) => {
-                        ui.label(RichText::new(format!("found in {}", source.label())).color(OK));
-                        // NO "REPLACE" HERE, deliberately. The managed
-                        // `$DSH_HOME/.credentials.yaml` sits ABOVE the `.env` fallback in
-                        // the harness's own resolution, so a key typed into this window
-                        // would be ignored while a stored one exists - and a button that
-                        // looks like it changes something and does not is worse than no
-                        // button. Changing a stored key is the harness's own Models page.
-                        ui.label(
-                            RichText::new("· change it in the harness's Settings > Models")
-                                .weak(),
-                        );
-                    }
-                    None => {
-                        ui.label(RichText::new("not found").color(WARN));
-                        // THE FIELD IS IN THIS WINDOW, because a fresh portable home starts
-                        // with no key and the person is looking at THIS screen. What it
-                        // writes is `<home>/.env` - a layer the harness's own credential
-                        // resolution reads (`@deepseek-ai/dsh-credentials-local` falls back
-                        // to the invoking project's and the home's `.env`) - and never the
-                        // managed `.credentials.yaml`, which this app has no business
-                        // rewriting.
-                        if ui
-                            .button("Add key")
-                            .on_hover_text(format!(
-                                "type it here: it is written to {} as DEEPSEEK_API_KEY, never read back and never logged",
-                                keystate::ENV_FILE
-                            ))
-                            .clicked()
-                        {
-                            self.key_entry = Some(String::new());
-                            self.key_note = None;
-                        }
-                        ui.label(
-                            RichText::new("· or add one in the harness's Settings > Models")
-                                .weak(),
-                        );
-                    }
-                };
-            });
-            ui.end_row();
-            if self.key_entry.is_some() || self.key_note.is_some() {
-                ui.label("");
-                ui.vertical(|ui| self.key_field(ui));
-                ui.end_row();
-            }
-
-            // --- browser ------------------------------------------------------------
-            // **Absent from a build WITH the pane.** That build never starts a browser, so a
-            // chooser and a "which browser took it" line would be a row about nothing - and a
-            // control whose answer nothing reads is worse than no control.
-            #[cfg(not(feature = "pane"))]
-            {
-                ui.label(RichText::new("browser").strong());
-                ui.horizontal_wrapped(|ui| {
-                    let current = self.context.browser.id;
-                    let mut chosen = current;
-                    egui::ComboBox::from_id_salt("browser")
-                        .selected_text(self.context.browser.label)
-                        .show_ui(ui, |ui| {
-                            for browser in &self.context.browsers {
-                                if ui.selectable_label(browser.id == current, browser.label).clicked()
-                                {
-                                    chosen = browser.id;
-                                }
-                            }
-                        });
-                    if chosen != current {
-                        self.choose_browser(chosen);
-                    }
-                    match &self.surface {
-                        Some(what) => ui.label(RichText::new(format!("· opened in {what}")).weak()),
-                        None if self.hand_off.is_some() => {
-                            ui.spinner();
-                            ui.label(
-                                RichText::new(format!(
-                                    "· opening in {} - the log says which rung took it",
-                                    self.context.browser.label
-                                ))
-                                .weak(),
-                            )
-                        }
-                        None => ui.label(
-                            RichText::new(match status.phase {
-                                Phase::Running => "· Open tab opens a new one",
-                                _ => "· a new tab when Start runs",
-                            })
-                            .weak(),
-                        ),
-                    };
-                });
-                ui.end_row();
-            }
-        });
-    }
-
-    /// Everything the panel knows that is not one of the four rows, folded away.
-    ///
-    /// Nothing was deleted to make the panel small: the pin, the runtime, the composed
-    /// environment, the pid, the location map with its sizes, the refusals and the notes
-    /// are all here - and the title carries a badge when a path was refused, because a
-    /// refusal must never be the thing that is hidden.
-    fn details(&mut self, ui: &mut egui::Ui, status: &Status) {
-        let refused = self.context.plan.home.refused.len();
-        let title = if refused > 0 {
-            format!("Details · {refused} refused path(s)")
-        } else {
-            "Details".to_string()
-        };
-        egui::CollapsingHeader::new(title)
-            .default_open(self.details_open)
-            .show(ui, |ui| {
-                self.details_open = true;
-                self.status_table(ui, status);
-                ui.add_space(8.0);
-                // The pack's maintenance pair. It lives here rather than beside Start:
-                // uninstall is not a twice-a-day action, and the install the panel OFFERS
-                // is on the pack row above.
-                self.setup_buttons(ui, status);
-                ui.add_space(10.0);
-                self.paths_table(ui);
-                ui.add_space(10.0);
-                self.provider_table(ui, status);
-                if !self.context.plan.notes.is_empty() {
-                    ui.add_space(10.0);
-                    ui.separator();
-                    for note in self.context.plan.notes.clone() {
-                        ui.label(RichText::new(format!("note: {note}")).weak());
-                    }
-                }
-                for refusal in self.context.plan.home.refused.clone() {
-                    ui.label(RichText::new(refusal.line()).weak());
-                }
-                if let Some(note) = self.adopt_note.clone() {
-                    ui.label(RichText::new(note).color(WARN));
-                }
-            });
-    }
-
-    /// Install and uninstall, with the same rule the header used to carry: neither may
-    /// run while the harness is live, because the installer re-links the profile under it.
-    fn setup_buttons(&mut self, ui: &mut egui::Ui, status: &Status) {
-        let setup = self.context.setup.status();
-        let busy = setup.running || self.context.adopt.is_running();
-        let live = status.phase.is_live();
-        let can = can_run_setup(self.context.setup_entries.is_some(), live, busy);
-        ui.horizontal_wrapped(|ui| {
-            ui.add_enabled_ui(can, |ui| {
-                if ui.button("Install pack").clicked() {
-                    self.run_setup(SetupKind::Install);
-                }
-            });
-            ui.add_enabled_ui(can, |ui| {
-                if ui.button("Uninstall pack").clicked() {
-                    self.run_setup(SetupKind::Uninstall);
-                }
-            });
-            if self.context.setup_entries.is_none() {
-                ui.label(RichText::new("no installer beside this app").weak());
-            } else if live {
-                ui.label(RichText::new("stop the harness first").weak());
-            } else if busy {
-                ui.label(
-                    RichText::new(format!(
-                        "{}ing…",
-                        setup.kind.map(SetupKind::label).unwrap_or("work")
-                    ))
-                    .weak(),
-                );
-            }
-        });
-    }
-
-    /// The rows that did not earn a place in the summary: what this app knows, and
-    /// nothing it can be asked to do.
-    fn status_table(&mut self, ui: &mut egui::Ui, status: &Status) {
-        egui::Grid::new("status").num_columns(2).spacing([18.0, 6.0]).show(ui, |ui| {
-            ui.label(RichText::new("pin").strong());
-            ui.label(format!("{} (from .dsh-version.json)", self.context.plan.version));
-            ui.end_row();
-
-            ui.label(RichText::new("runtime").strong());
-            ui.label(self.context.plan.runtime_line());
-            ui.end_row();
-
-            ui.label(RichText::new("vncode root").strong());
-            match self.context.plan.app_root() {
-                Some(root) => {
-                    let tree = self.context.root.clone();
-                    let portable = tree
-                        .as_deref()
-                        .map(|tree| appdata::portable_root(tree).is_some())
-                        .unwrap_or(false);
-                    ui.horizontal_wrapped(|ui| {
-                        ui.label(
-                            RichText::new(format!(
-                                "{}  ({})",
-                                root.display(),
-                                self.context.plan.home.app_root_origin_label()
-                            ))
-                            .monospace(),
-                        );
-                        // KEEP EVERYTHING IN THIS FOLDER. One click leaves the marker the
-                        // root ladder reads, so the NEXT start puts the home, the
-                        // preferences, the window record and the npm cache inside this
-                        // folder - a portable installation, which is what a folder copied
-                        // to another machine needs. The running app cannot move its own
-                        // root, so the button says "restart" rather than pretending.
-                        if portable {
-                            ui.label(
-                                RichText::new("· this folder, and kept next time").color(OK),
-                            );
-                        } else if let Some(tree) = tree {
-                            let busy = self.context.setup.is_running()
-                                || self.context.adopt.is_running();
-                            if ui
-                                .add_enabled(!busy, egui::Button::new("Keep everything in this folder"))
-                                .on_hover_text(format!(
-                                    "writes {} and restarts the app into it - the home, the preferences and the caches then live inside this folder",
-                                    appdata::portable_marker(&tree).display()
-                                ))
-                                .clicked()
-                            {
-                                match appdata::mark_portable(&tree) {
-                                    Ok(root) => {
-                                        self.notice = Some(format!(
-                                            "this folder is now a portable installation: {} is the root from the next start on - close the app and open it again",
-                                            root.display()
-                                        ));
-                                    }
-                                    Err(error) => self.notice = Some(error),
-                                }
-                            }
-                        }
-                    });
-                }
-                None => {
-                    ui.label(RichText::new("none could be written").color(WARN));
-                }
-            };
-            ui.end_row();
-
-            ui.label(RichText::new("harness env").strong());
-            ui.label(RichText::new(self.context.plan.env_line()).monospace().weak());
-            ui.end_row();
-
-            ui.label(RichText::new("profile").strong());
-            ui.label(profile_line(&self.context.profiles));
-            ui.end_row();
-
-            ui.label(RichText::new("last setup").strong());
-            let setup = self.context.setup.status();
-            match (setup.running, setup.exit) {
-                (true, _) => ui.label(
-                    RichText::new(format!(
-                        "{}ing…",
-                        setup.kind.map(SetupKind::label).unwrap_or("work")
-                    ))
-                    .color(WARN),
-                ),
-                (false, Some(0)) => ui.label(
-                    RichText::new(format!(
-                        "{} finished",
-                        setup.kind.map(SetupKind::label).unwrap_or("setup")
-                    ))
-                    .color(OK),
-                ),
-                (false, Some(code)) => ui.label(
-                    RichText::new(format!(
-                        "{} failed (exit {code}) - see the log",
-                        setup.kind.map(SetupKind::label).unwrap_or("setup")
-                    ))
-                    .color(WARN),
-                ),
-                (false, None) => ui.label(RichText::new("—").weak()),
-            };
-            ui.end_row();
-
-            ui.label(RichText::new("address").strong());
-            ui.horizontal_wrapped(|ui| {
-                match status.public_url() {
-                    // The displayable URL: no query, therefore no launch token.
-                    Some(url) => {
-                        ui.label(RichText::new(url).monospace());
-                        ui.label(
-                            RichText::new("· the launch token is added by Open tab, never drawn")
-                                .weak(),
-                        );
-                    }
-                    None => {
-                        ui.label(
-                            RichText::new(match status.port {
-                                Some(port) => format!("127.0.0.1:{port} (not listening yet)"),
-                                None => "not chosen yet".to_string(),
-                            })
-                            .weak(),
-                        );
-                    }
-                };
-            });
-            ui.end_row();
-
-            ui.label(RichText::new("process").strong());
-            match status.pid {
-                Some(pid) => ui.label(format!("pid {pid}")),
-                None => ui.label(RichText::new("nothing running").weak()),
-            };
-            ui.end_row();
-
-            ui.label(RichText::new("last stop").strong());
-            match &self.last_stop {
-                Some(outcome) if outcome.port_free => {
-                    ui.label(RichText::new("the port is free again").color(OK))
-                }
-                Some(outcome) => ui.label(
-                    RichText::new(format!(
-                        "something STILL holds port {}",
-                        outcome.port.map(|port| port.to_string()).unwrap_or_else(|| "?".into())
-                    ))
-                    .color(WARN),
-                ),
-                None => ui.label(RichText::new("—").weak()),
-            };
-            ui.end_row();
-        });
-    }
-
-    fn paths_table(&mut self, ui: &mut egui::Ui) {
-        ui.horizontal(|ui| {
-            ui.label(RichText::new("where things live").strong());
-            if ui.small_button("measure").clicked() {
-                self.sizes = self.context.paths.iter().map(Row::size).collect();
-            }
-            ui.label(RichText::new("(reveal opens the folder or selects the file)").weak());
-        });
-        egui::Grid::new("paths").num_columns(4).spacing([18.0, 4.0]).striped(true).show(ui, |ui| {
-            for (index, row) in self.context.paths.iter().enumerate() {
-                ui.label(match row.kind {
-                    Kind::Home | Kind::Workspace => RichText::new(row.label).strong(),
-                    _ => RichText::new(row.label),
-                });
-                match &row.path {
-                    Some(path) => ui.label(RichText::new(path.display().to_string()).monospace()),
-                    None => ui.label(RichText::new("unknown").weak()),
-                };
-                let size = self.sizes.get(index).copied().flatten();
-                ui.label(
-                    RichText::new(match (row.state(), size) {
-                        ("present", Some(bytes)) => format!("present · {}", human(bytes)),
-                        (state, _) => state.to_string(),
-                    })
-                    .weak(),
-                );
-                if let Some(path) = row.path.clone() {
-                    ui.add_enabled_ui(path.exists(), |ui| {
-                        if ui.small_button("reveal").clicked() {
-                            urlpolicy::reveal(&path, path.is_dir());
-                        }
-                    });
-                } else {
-                    ui.label("");
-                }
-                ui.end_row();
-            }
-        });
-        ui.label(
-            RichText::new(self.context.paths.first().map(|row| row.note.clone()).unwrap_or_default())
-                .weak(),
-        );
-    }
-
-    fn provider_table(&mut self, ui: &mut egui::Ui, status: &Status) {
-        ui.label(RichText::new("model provider").strong());
-        egui::Grid::new("provider").num_columns(2).spacing([18.0, 6.0]).show(ui, |ui| {
-            ui.label("provider");
-            ui.horizontal(|ui| {
-                // ONE entry today, and deliberately a chooser: Ollama becomes a
-                // second entry here and not a new page. Read-only while a harness
-                // is live, because the harness reads its route at boot.
-                ui.add_enabled_ui(false, |ui| {
-                    let mut selected = "deepseek-official";
-                    egui::ComboBox::from_id_salt("provider")
-                        .selected_text("DeepSeek (official)")
-                        .show_ui(ui, |ui| {
-                            ui.selectable_value(&mut selected, "deepseek-official", "DeepSeek (official)");
-                        });
-                });
-                ui.label(RichText::new("Ollama: not yet - planned, see docs/PLAN-egui-shell.md").weak());
-            });
-            ui.end_row();
-            ui.label("route");
-            ui.label("the profile's own cordis.patch.yml decides it; this shell only names it");
-            ui.end_row();
-            if status.phase.is_live() {
-                ui.label("");
-                ui.label(RichText::new("read-only while a harness is running").weak());
-                ui.end_row();
-            }
-        });
-    }
-
-    fn log_panel(&mut self, ui: &mut egui::Ui) {
-        // A FULL-WIDTH panel of a FIXED thickness, with a drag seam.
-        //
-        // egui panels auto-shrink to their content, so the first version collapsed
-        // to nothing while the log was empty and grew a line at a time - which reads
-        // as "there is no log panel" and leaves no seam to grab. `min_size` keeps
-        // the panel where the reader put it, and `auto_shrink([false, false])` on
-        // the scroll area inside stops its content from deciding the height OR the
-        // width.
-        egui::Panel::bottom("log")
-            .resizable(true)
-            .default_size(240.0)
-            .min_size(120.0)
-            .max_size(720.0)
-            .show(ui, |ui| {
-                ui.horizontal(|ui| {
-                    ui.label(RichText::new("log").strong());
-                    ui.label(
-                        RichText::new(
-                            "(the harness and the installer, token redacted on the way in)",
-                        )
-                        .weak(),
-                    );
-                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                        ui.label(RichText::new("drag this bar to resize").weak());
-                    });
-                });
-                // ONE transcript, drawn from the console both writers write to, so
-                // an install's output and the harness's output share a cursor.
-                let lines = self.context.console.tail(LOG_LINES);
-                egui::ScrollArea::vertical()
-                    .auto_shrink([false, false])
-                    .stick_to_bottom(true)
-                    .show(ui, |ui| {
-                        ui.set_min_width(ui.available_width());
-                        if lines.is_empty() {
-                            ui.label(
-                                RichText::new("nothing yet - press Start, or Install pack").weak(),
-                            );
-                        }
-                        for line in lines {
-                            ui.label(RichText::new(line).monospace().size(12.0));
-                        }
-                    });
-            });
-    }
-}
-
-/// Whether the Install and Uninstall buttons may be pressed.
-///
-/// Three conditions, and each is a fact rather than a preference:
-///
-/// - an entry point was FOUND beside this app (a folder with only `app/` in it has
-///   nothing to run, and the panel says so instead of offering a dead button);
-/// - no harness is LIVE - installing while one is running would re-link the profile
-///   under a process that has already read it;
-/// - no setup run is already in flight, because two installers at once would race
-///   over the same profile.
-fn can_run_setup(has_entry_points: bool, harness_live: bool, setup_busy: bool) -> bool {
-    has_entry_points && !harness_live && !setup_busy
-}
-
-/// How long an install may print nothing before the pack row says so out loud.
-///
-/// Measured: the silent phase is npm resolving the harness (`npm exec`), about 50-60 s on
-/// a cold cache and seconds when it is warm. Twenty seconds is long enough that the row
-/// does not narrate ordinary gaps, short enough that nobody concludes it has hung.
-const QUIET_AFTER_SECS: u64 = 20;
-
-/// A duration a person reads at a glance: `4s`, `1m 05s`, `12m`.
-fn short_duration(elapsed: std::time::Duration) -> String {
-    let seconds = elapsed.as_secs();
-    if seconds < 60 {
-        return format!("{seconds}s");
-    }
-    let minutes = seconds / 60;
-    let rest = seconds % 60;
-    if minutes < 60 {
-        return format!("{minutes}m {rest:02}s");
-    }
-    format!("{}h {:02}m", minutes / 60, minutes % 60)
-}
-
-/// What **Start** must do, from three facts the panel already has.
-///
-/// It is a decision rather than four lines inside the button handler because each arm
-/// is a different promise, and one of them was wrong: with the pack missing and no
-/// installer beside the app, the old `if` fell through and started the harness anyway -
-/// the bare interface, which is exactly the state this app's own comments call "reads as
-/// a broken app".
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-enum StartAction {
-    /// The home has the pack: start the harness.
-    Launch,
-    /// No pack, and an installer is here: install first, then start.
-    Install,
-    /// An install is already in flight: wait - it starts the harness when it succeeds.
-    Wait,
-    /// No pack and nothing to install it with: refuse, with a sentence.
-    Refuse,
-}
-
-fn start_action(pack_missing: bool, has_installer: bool, installing: bool) -> StartAction {
-    if !pack_missing {
-        return StartAction::Launch;
-    }
-    if !has_installer {
-        return StartAction::Refuse;
-    }
-    if installing {
-        return StartAction::Wait;
-    }
-    StartAction::Install
-}
-
-/// The step a finished **copy** owes the person: install the pack into the home it just
-/// filled, when there is one to install, none already running, and no harness LIVE.
-///
-/// The live case is the installer's own rule rather than a caution: re-linking a profile
-/// under a process that has already read it is what the disabled Install button prevents,
-/// and a copy can be started from the first-run screen while an instance started on
-/// another home is still up. `None` there - the pack row's own `Stop and install` is the
-/// way, and the panel says so.
-///
-/// `None` in every other case too, including a home that already has the pack: the copy
-/// is then the whole job.
-fn chain_after_copy(
-    pack_missing: bool,
-    has_installer: bool,
-    installing: bool,
-    harness_live: bool,
-) -> Option<SetupKind> {
-    (pack_missing && has_installer && !installing && !harness_live).then_some(SetupKind::Install)
-}
-
-/// The flags the panel hands the installer, and the reason each one is there.
-///
-/// `-Resume` is the whole difference between a second attempt that costs seconds and
-/// one that costs a quarter of an hour. The entry point IMPLIES `-Force` so that a
-/// double-click always installs the latest edits, which is right for a person and wrong
-/// for this panel: it re-adds all twenty-four bundles even when twenty-three are already
-/// in the profile at the same version - measured on a real machine, where an install
-/// interrupted by closing the window left the profile listing the bare harness, and the
-/// next press re-resolved the whole dependency graph for every bundle again. `-Resume`
-/// asks for the installer's own default: add what is missing, skip what is current.
-///
-/// Nothing is passed for an uninstall: it has no implied flag to undo.
-fn setup_extras(kind: SetupKind) -> Vec<String> {
-    match kind {
-        SetupKind::Install => vec!["-Resume".to_string()],
-        SetupKind::Uninstall => Vec::new(),
-    }
-}
-
-fn phase_badge(phase: Phase) -> (Color32, &'static str) {    match phase {
-        Phase::Idle => (Color32::from_rgb(0x90, 0x94, 0x9a), "stopped"),
-        Phase::Starting => (Color32::from_rgb(0xff, 0xb0, 0x00), "starting"),
-        Phase::Running => (Color32::from_rgb(0x4c, 0xaf, 0x50), "running"),
-        Phase::Stopping => (Color32::from_rgb(0xff, 0xb0, 0x00), "stopping"),
-        Phase::Stopped => (Color32::from_rgb(0x90, 0x94, 0x9a), "stopped"),
-        Phase::Failed => (Color32::from_rgb(0xe5, 0x39, 0x35), "failed"),
-    }
-}
-
-fn profile_line(profiles: &[String]) -> String {
-    if profiles.is_empty() {
-        "none found under this home yet".to_string()
-    } else {
-        profiles.join(", ")
-    }
-}
-
-/// The one line about this app's own root that the first-run screen owes a reader:
-/// where a fresh home would go, and why the root is where it is.
-///
-/// It is on that screen because "Create it here" is a card about a PATH, and a card that
-/// does not say which path it means is asking somebody to guess.
-fn root_line(plan: &Plan) -> String {
-    match plan.app_root() {
-        Some(root) => format!(
-            "this app's own root: {} ({})",
-            root.display(),
-            plan.home.app_root_origin_label()
-        ),
-        None => "this app could not create a root of its own - the log names every path it tried".to_string(),
-    }
-}
-
-// ---------------------------------------------------------------------------
-// The window
-// ---------------------------------------------------------------------------
-/// A path a person reads at a glance: its last two components.
-///
-/// The panel is 700-odd points wide and a home path is much longer than that, so the
-/// button says `me/.dsh` while the row above it - and the hover text - carry the whole
-/// path. Nothing here is used to OPEN anything; it is a label.
-fn shorten(path: &std::path::Path) -> String {
-    let name = path.file_name().map(|name| name.to_string_lossy().to_string());
-    let parent = path.parent().and_then(|parent| parent.file_name());
-    match (parent, name) {
-        (Some(parent), Some(name)) => format!("{}/{name}", parent.to_string_lossy()),
-        (None, Some(name)) => name,
-        _ => path.display().to_string(),
-    }
-}
-
-/// Build the viewport this window should open with, from a remembered record.
-///
-/// The record's RULES live in `windowstate` and are driven by `cargo test`; this is
-/// only the translation into egui's builder. The POSITION is deliberately not
-/// restored here: this toolkit cannot ask which monitors exist before the window is
-/// built, and a window restored onto a display that is no longer plugged in is one
-/// nobody can see - a worse outcome than a centred window. Size and the maximized
-/// flag are restored, and the recorded position is still written back.
-pub fn viewport(remembered: &WindowState, title: &str) -> egui::ViewportBuilder {
-    egui::ViewportBuilder::default()
-        .with_title(title)
-        .with_inner_size([remembered.width as f32, remembered.height as f32])
-        .with_min_inner_size([
-            windowstate::MIN_WIDTH as f32,
-            windowstate::MIN_HEIGHT as f32,
-        ])
-        .with_maximized(remembered.maximized)
-        .with_resizable(true)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_long_path_is_shortened_to_the_two_parts_a_person_reads() {
-        assert_eq!(shorten(std::path::Path::new("/home/me/.dsh")), "me/.dsh");
-        if cfg!(windows) {
-            assert_eq!(shorten(std::path::Path::new("C:\\Users\\me\\.dsh")), "me/.dsh");
-        }
-        // A path with nothing to shorten is returned whole rather than emptied.
-        assert_eq!(shorten(std::path::Path::new("/")), "/");
-    }
-
-    #[test]
-    fn the_install_buttons_are_enabled_only_when_they_can_work() {
-        // Idle with an installer beside the app: the one state where a press means
-        // what it says.
-        assert!(can_run_setup(true, false, false));
-        // A harness is running: install would re-link the profile under it.
-        assert!(!can_run_setup(true, true, false));
-        // One setup run at a time.
-        assert!(!can_run_setup(true, false, true));
-        // Nothing to run (a folder carrying only app/).
-        assert!(!can_run_setup(false, false, false));
-        assert!(!can_run_setup(false, true, true));
-    }
-
-    #[test]
-    fn start_installs_refuses_or_waits_rather_than_opening_a_bare_harness() {
-        // The pack is there: the ordinary Start.
-        assert_eq!(start_action(false, true, false), StartAction::Launch);
-        assert_eq!(start_action(false, false, false), StartAction::Launch);
-        // No pack, and an installer beside the app: install first.
-        assert_eq!(start_action(true, true, false), StartAction::Install);
-        // No pack, an installer, and a run already in flight: wait for it.
-        assert_eq!(start_action(true, true, true), StartAction::Wait);
-        // NO PACK AND NOTHING TO INSTALL IT WITH: refuse. This is the arm that used to
-        // fall through and start the bare interface.
-        assert_eq!(start_action(true, false, false), StartAction::Refuse);
-        assert_eq!(start_action(true, false, true), StartAction::Refuse);
-    }
-
-    #[test]
-    fn a_finished_copy_owes_an_install_exactly_when_one_is_missing_and_possible() {
-        assert_eq!(chain_after_copy(true, true, false, false), Some(SetupKind::Install));
-        // The home already has the pack: the copy was the whole job.
-        assert_eq!(chain_after_copy(false, true, false, false), None);
-        // No installer beside this app: the panel says so instead of pretending.
-        assert_eq!(chain_after_copy(true, false, false, false), None);
-        // One installer at a time.
-        assert_eq!(chain_after_copy(true, true, true, false), None);
-        // A LIVE harness: the installer must not re-link the profile it has read - the
-        // pack row's own "Stop and install" is the way, and the panel says so.
-        assert_eq!(chain_after_copy(true, true, false, true), None);
-    }
-
-    #[test]
-    fn the_panel_asks_the_installer_to_resume_and_never_to_force_all_of_it() {
-        // The entry point implies `-Force` for a double-click; the panel must undo that
-        // or a second attempt re-adds every bundle the profile already lists.
-        assert_eq!(setup_extras(SetupKind::Install), vec!["-Resume".to_string()]);
-        // An uninstall has no implied flag to undo, so the panel passes nothing.
-        assert!(setup_extras(SetupKind::Uninstall).is_empty());
-    }
-
-    #[test]
-    fn a_duration_is_written_the_way_a_person_reads_a_clock() {
-        use std::time::Duration;
-        assert_eq!(short_duration(Duration::from_secs(4)), "4s");
-        assert_eq!(short_duration(Duration::from_secs(59)), "59s");
-        // The measured silent phase: npm resolving the harness, about a minute.
-        assert_eq!(short_duration(Duration::from_secs(65)), "1m 05s");
-        assert_eq!(short_duration(Duration::from_secs(600)), "10m 00s");
-        assert_eq!(short_duration(Duration::from_secs(3_725)), "1h 02m");
-    }
-
-    #[test]
-    fn the_page_theme_becomes_the_native_palette() {
-        assert_eq!(Palette::for_theme("hacker").accent, Color32::from_rgb(0x00, 0xff, 0x41));
-        assert_eq!(Palette::for_theme("light").background, Color32::from_rgb(0xf7, 0xf7, 0xf5));
-        // An unknown or missing theme is readable rather than invisible.
-        let fallback = Palette::for_theme("something-new");
-        assert_eq!(fallback, Palette::for_theme("dark"));
-        assert_ne!(fallback.background, Color32::TRANSPARENT);
-    }
-
-    #[test]
-    fn the_browser_choice_is_the_one_the_panel_draws_and_it_is_never_a_pane() {
-        // There is no `embed` to offer: this app draws no web view, and the whole
-        // surface is a browser it found. The row that used to be a destination
-        // switch is now a chooser over the detected browsers.
-        let detected = vec![
-            Browser {
-                id: "chrome",
-                label: "Google Chrome",
-                family: browser::Family::Chromium,
-                program: Some(std::path::PathBuf::from("chrome")),
-            },
-            Browser::default_opener(),
-        ];
-        assert_eq!(browser::resolve(Some("chrome"), &detected).label, "Google Chrome");
-        assert_eq!(browser::resolve(Some("firefox"), &detected).id, "chrome");
-        assert!(detected.last().unwrap().is_default());
-    }
-
-    #[test]
-    fn the_viewport_restores_size_and_maximized_and_never_invents_a_position() {
-        let remembered = WindowState {
-            width: 1200.0,
-            height: 800.0,
-            x: Some(4000.0),
-            y: Some(2000.0),
-            maximized: true,
-        };
-        let builder = viewport(&remembered, "vncode");
-        // The builder is opaque, so this asserts what CAN be read back: the size
-        // rule lives in `windowstate`'s own tests, and the position is not passed
-        // at all - see this function's doc comment.
-        assert_eq!(builder.inner_size, Some(egui::vec2(1200.0, 800.0)));
-        assert_eq!(builder.maximized, Some(true));
-        assert_eq!(builder.title.as_deref(), Some("vncode"));
-    }
-
-    #[test]
-    fn a_profile_list_is_never_an_empty_sentence() {
-        assert!(profile_line(&[]).contains("none found"));
-        assert_eq!(profile_line(&["desktop".into(), "web".into()]), "desktop, web");
-    }
-}
diff --git a/app/crates/vn-shell-pane/Cargo.toml b/app/crates/vn-shell-pane/Cargo.toml
deleted file mode 100644
index d06bd26..0000000
--- a/app/crates/vn-shell-pane/Cargo.toml
+++ /dev/null
@@ -1,27 +0,0 @@
-[package]
-name = "vn-shell-pane"
-description = "The one crate that owns a web engine: the child web view the panel draws the harness in, behind a default-off `pane` feature."
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-publish.workspace = true
-rust-version.workspace = true
-
-[features]
-default = []
-# The engine. OFF by default, and that is a rule rather than caution: with it off this
-# crate compiles to `available() == false`, no engine dependency is built, and the shell
-# behaves exactly as it does today - the browser hand-off is the only surface. The
-# feature is turned on by whoever asks for the pane, and P5 is the phase that flips it.
-pane = ["dep:wry", "dep:egui"]
-
-[dependencies]
-vn-shell-core.workspace = true
-# The ONLY dependency on a web engine anywhere in this workspace, and it is optional.
-# Nothing is vendored: `wry` drives the engine the OS already has - WebView2 on Windows,
-# WKWebView on macOS, WebKitGTK on Linux - so the pane adds no engine to ship.
-wry = { workspace = true, optional = true }
-# The page itself is drawn with the same egui the panel uses, so the tab strip and the bar
-# are the window's own widgets and not a second look. `egui` and not `eframe`: the window
-# belongs to the shell, and this crate only borrows a `Ui` and a window handle.
-egui = { workspace = true, optional = true }
diff --git a/app/crates/vn-shell-pane/src/engine.rs b/app/crates/vn-shell-pane/src/engine.rs
deleted file mode 100644
index d4ff276..0000000
--- a/app/crates/vn-shell-pane/src/engine.rs
+++ /dev/null
@@ -1,423 +0,0 @@
-//! The engine, and only the engine: a child web view inside the shell's own window.
-//!
-//! Compiled only with the `pane` feature. Everything decided *about* the pane - may it be
-//! seen, where does it go, which URL may it load - is [`vn_shell_core::pane`], so this
-//! file is deliberately thin and has no policy of its own beyond quoting that module.
-//!
-//! The three rules it keeps:
-//!
-//! 1. **The loopback check happens again here**, at the last function before a
-//!    navigation, and in the navigation handler as well - a rule that holds at only one
-//!    end of a pipe is not a rule. `browser::command_with` re-checks the same rule before
-//!    a process starts with the URL in its argv, and this is the pane's equivalent.
-//! 2. **A navigation the pane did not ask for is refused, not followed.** A page that can
-//!    move this window to another origin is a page that can take the launch token with it.
-//! 3. **Dropping the engine destroys the view.** `WebView`'s own `Drop` takes the child
-//!    window with it, which is what makes "Stop leaves no live page holding a stale
-//!    token" a property of the type rather than a thing a caller has to remember.
-
-use std::fmt;
-use std::path::{Path, PathBuf};
-
-use vn_shell_core::pane::{self, PaneView, PhysicalRect};
-use wry::dpi::{PhysicalPosition, PhysicalSize};
-use wry::raw_window_handle::HasWindowHandle;
-use wry::{
-    NewWindowResponse, PageLoadEvent, PermissionKind, PermissionResponse, Rect as WryRect,
-    WebContext, WebView, WebViewBuilder,
-};
-
-/// What the page told us about itself.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum LoadState {
-    /// The engine has begun loading the URL it was given.
-    Started,
-    /// The page finished loading. This is the earliest moment there is something to see.
-    Finished,
-}
-
-/// Why the engine could not do what it was asked.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct EngineError(pub String);
-
-impl fmt::Display for EngineError {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str(&self.0)
-    }
-}
-
-impl std::error::Error for EngineError {}
-
-/// A live child web view inside the shell's window.
-pub struct Engine {
-    view: WebView,
-    /// Kept alive on purpose, and never read: `wry` documents that dropping the context
-    /// takes some actions with it (custom protocols on macOS) while the view is alive.
-    _context: WebContext,
-    /// What was last applied, so a frame that changes nothing costs nothing. Comparing
-    /// here rather than in the caller means a caller may hand this the same decision
-    /// sixty times a second.
-    applied_bounds: Option<PhysicalRect>,
-    applied_visible: bool,
-}
-
-impl Engine {
-    /// Create the child view for `url` inside `window`, calling `on_load` as the page
-    /// reports itself.
-    ///
-    /// `data_dir` is the engine's own profile - the pane's is `<app root>/webview`, inside
-    /// the root the shell has already proved it can write, and deliberately NOT the
-    /// directory the Chrome rung uses: an engine profile and a browser profile in one
-    /// directory is a way to lose both.
-    pub fn attach<W: HasWindowHandle>(
-        window: &W,
-        url: &str,
-        data_dir: Option<PathBuf>,
-        on_load: impl Fn(LoadState) + 'static,
-    ) -> Result<Engine, EngineError> {
-        // Rule 1, at the last function before a navigation.
-        let parsed =
-            pane::may_load(url).map_err(|error| EngineError(format!("the pane refused: {error}")))?;
-        // A platform this cannot be built on yet refuses BY NAME rather than panicking -
-        // see `platform_supported` for the Linux half and the work it names.
-        platform_supported().map_err(|reason| EngineError(reason.to_string()))?;
-        let mut context = WebContext::new(data_dir);
-        let view = WebViewBuilder::new_with_web_context(&mut context)
-            .with_url(parsed.as_str())
-            // The inspector is a debug build's tool, never a shipped one's.
-            .with_devtools(cfg!(debug_assertions))
-            // **The three seams, and each one is a rule rather than a preference.**
-            //
-            // The page is the harness and nothing else, so the pane grants what a chat
-            // interface cannot work without and refuses the rest BY NAME - a refusal the
-            // engine cannot talk its way out of, because the decision is taken here and
-            // handed to it.
-            //
-            // Why the whole set is possible at all: `with_permission_handler` arrives in
-            // wry 0.57. In 0.55 the only mention of a permission in the Windows backend
-            // ALLOWS clipboard reads and lets every other kind fall through to the engine's
-            // own default, and the macOS delegate GRANTS media capture outright - so a pane
-            // that denies camera and microphone could not be built on it.
-            .with_permission_handler(permission_response)
-            // A window is never opened from inside the pane. A page that can put a window
-            // on the desktop is a page that can put one over the panel, and the reader's
-            // own way to a browser is a click on the bar.
-            .with_new_window_req_handler(|_url, _features| NewWindowResponse::Deny)
-            // The pane shows the harness; it does not fetch files. Refused with no path
-            // offered, so nothing can be written anywhere the app has not chosen.
-            .with_download_started_handler(|_url, _path| false)
-            // Copy and paste work for the same reason the ONE granted permission does: the
-            // harness's own buttons and composer use them. Without this the page has no
-            // clipboard at all on Windows and Linux.
-            .with_clipboard(true)
-            // Rule 2: the handler answers the same question the URL did.
-            .with_navigation_handler(|target| pane::may_load(&target).is_ok())
-            .with_on_page_load_handler(move |event, _url| match event {
-                PageLoadEvent::Started => on_load(LoadState::Started),
-                PageLoadEvent::Finished => on_load(LoadState::Finished),
-            })
-            .build_as_child(window)
-            .map_err(|error| {
-                EngineError(format!("the web engine would not start: {error}"))
-            })?;
-        Ok(Engine {
-            view,
-            _context: context,
-            applied_bounds: None,
-            applied_visible: false,
-        })
-    }
-
-    /// Apply a decision from [`vn_shell_core::pane::decide`]: position always, visibility
-    /// only when it changed.
-    pub fn apply(&mut self, want: &PaneView) -> Result<(), EngineError> {
-        if self.applied_bounds != Some(want.bounds) {
-            self.view.set_bounds(rect(want.bounds)).map_err(|error| {
-                EngineError(format!("could not place the pane: {error}"))
-            })?;
-            self.applied_bounds = Some(want.bounds);
-        }
-        if self.applied_visible != want.visible {
-            self.view.set_visible(want.visible).map_err(|error| {
-                EngineError(format!("could not show or hide the pane: {error}"))
-            })?;
-            self.applied_visible = want.visible;
-        }
-        Ok(())
-    }
-
-    /// Hide the view without giving up the page.
-    ///
-    /// The panel is in front, or an overlay is: the page stays loaded, keeps its scroll
-    /// position and keeps its connection, and only stops being drawn. This is the whole
-    /// reason the airspace rule is cheap here - the pane is a *page* of one window, so
-    /// hiding it is a page switch rather than a z-order negotiation.
-    pub fn conceal(&mut self) -> Result<(), EngineError> {
-        if self.applied_visible {
-            self.view
-                .set_visible(false)
-                .map_err(|error| EngineError(format!("could not hide the pane: {error}")))?;
-            self.applied_visible = false;
-        }
-        Ok(())
-    }
-
-    /// Point the view at another URL of the SAME harness - a new port and token after a
-    /// Stop and Start, never a different origin.
-    pub fn navigate(&mut self, url: &str) -> Result<(), EngineError> {
-        let parsed =
-            pane::may_load(url).map_err(|error| EngineError(format!("the pane refused: {error}")))?;
-        self.view.load_url(parsed.as_str()).map_err(|error| {
-            EngineError(format!("could not navigate the pane: {error}"))
-        })
-    }
-}
-
-/// Whether the pane can be built on this platform YET, and why not when it cannot.
-///
-/// Windows and macOS are the engine's own documented paths: on macOS `build_as_child` makes
-/// the view an `NSView` subview, which needs no extra pump, and on Windows it is a child HWND.
-///
-/// **Linux needs one, and that is why it refuses here.** wry documents that its Linux
-/// `build_as_child` requires `gtk::init` plus `gtk::main_iteration_do` advanced alongside
-/// winit's event loop - and that it **PANICS** when `gtk::init` was not called in the thread.
-/// It is also X11-only, so a Wayland session needs XWayland. That is P4's work, on a machine
-/// with libwebkit2gtk to measure it; until then a Linux build gets a sentence instead of a
-/// panic, and the browser hand-off stays the surface there.
-#[cfg(target_os = "linux")]
-fn platform_supported() -> Result<(), &'static str> {
-    Err(
-        "the pane is not built for Linux yet: wry's child web view needs a GTK loop pumped \
-         beside winit's and works on X11 (or XWayland) only - see P4 of \
-         docs/PLAN-egui-shell.md. A Linux build without `--features pane` uses the browser \
-         hand-off, which is the floor under the pane everywhere",
-    )
-}
-
-#[cfg(not(target_os = "linux"))]
-fn platform_supported() -> Result<(), &'static str> {
-    Ok(())
-}
-
-/// Which permissions the pane grants: the clipboard, and nothing else.
-///
-/// The one exception is deliberate and narrow. A chat interface's copy buttons and its
-/// composer are clipboard work, and wry 0.55 made the same choice on Windows for the same
-/// reason. Everything a viewer has no business asking for - camera, microphone, screen
-/// capture, location, notifications, MIDI, sensors, and whatever the engine adds next -
-/// falls to `Deny` rather than to the engine's default, because "the engine will probably
-/// ask the person" is not a rule.
-fn permission_response(kind: PermissionKind) -> PermissionResponse {
-    match kind {
-        PermissionKind::ClipboardRead => PermissionResponse::Allow,
-        _ => PermissionResponse::Deny,
-    }
-}
-
-/// Physical pixels into the engine's own rectangle type.
-fn rect(bounds: PhysicalRect) -> WryRect {
-    WryRect {
-        position: PhysicalPosition::new(bounds.x, bounds.y).into(),
-        size: PhysicalSize::new(bounds.width, bounds.height).into(),
-    }
-}
-
-/// What a purge took away, and what it could not.
-#[derive(Debug, Default, PartialEq, Eq)]
-pub struct PurgeReport {
-    /// The files and directories that were removed, by name.
-    pub removed: Vec<String>,
-    /// Files that STILL contain `token=` after the purge. Named, never hidden: a build that
-    /// cannot keep a rule has to say which file broke it.
-    pub still_carrying: Vec<String>,
-}
-
-/// The file names a web engine records a VISIT in, matched by PREFIX so the `-journal` siblings
-/// come with them.
-///
-/// MEASURED on this machine, after the pane had loaded the harness once: `?token=` was found in
-/// `History`, `Favicons` and `Top Sites` under `EBWebView/Default`, inside the pane's own profile.
-const NAVIGATION_RECORDS: &[&str] = &[
-    "History",
-    "Favicons",
-    "Top Sites",
-    "Visited Links",
-    "Network Action Predictor",
-    "Shortcuts",
-    "Current Session",
-    "Current Tabs",
-    "Last Session",
-    "Last Tabs",
-];
-
-/// Take away what the engine recorded about **where the pane went**.
-///
-/// ## Why this exists, and why it is a security rule rather than a tidy-up
-///
-/// The launch token is a live credential, and the oldest rule in this pack is that it is never
-/// written to a file. A web engine keeps a browsing record and the pane's engine is no
-/// exception: MEASURED, the full URL - `?token=` and all - was sitting in three files inside the
-/// pane's own profile. No amount of care in this app changes what the engine does with a URL it
-/// was given, so the app takes the record away again.
-///
-/// ## When it runs, and why that matters
-///
-/// At STARTUP, before any view exists - and again, best effort, when a view is given up. Startup
-/// is the one that is guaranteed: a delete while the engine is alive is a sharing violation, so
-/// the pass that cannot fail is the one that runs before anything holds the files.
-///
-/// The list is a prefix list plus a scan rather than a closed list, because engine versions add
-/// files: anything left that still carries the token is RETURNED rather than hidden, so the next
-/// engine version that invents a record file is visible instead of silent.
-pub fn purge_navigation_records(data_dir: &Path) -> PurgeReport {
-    let mut report = PurgeReport::default();
-    let profile = data_dir.join("EBWebView").join("Default");
-    let Ok(entries) = std::fs::read_dir(&profile) else {
-        // No profile yet - a first run. Nothing to take away, and that is not a failure.
-        return report;
-    };
-    for entry in entries.flatten() {
-        let name = entry.file_name().to_string_lossy().to_string();
-        if !NAVIGATION_RECORDS.iter().any(|prefix| name.starts_with(prefix)) {
-            continue;
-        }
-        let path = entry.path();
-        let gone = if path.is_dir() {
-            std::fs::remove_dir_all(&path).is_ok()
-        } else {
-            std::fs::remove_file(&path).is_ok()
-        };
-        if gone {
-            report.removed.push(name);
-        }
-    }
-
-    // What is left, in case an engine version records a visit somewhere this build has never
-    // heard of. Bounded per file, so a cache blob is never read into memory to be searched.
-    let mut stack = vec![profile];
-    while let Some(directory) = stack.pop() {
-        let Ok(entries) = std::fs::read_dir(&directory) else { continue };
-        for entry in entries.flatten() {
-            let path = entry.path();
-            if path.is_dir() {
-                stack.push(path);
-                continue;
-            }
-            let Ok(metadata) = entry.metadata() else { continue };
-            if metadata.len() > 4 * 1024 * 1024 {
-                continue;
-            }
-            let Ok(bytes) = std::fs::read(&path) else { continue };
-            if bytes.windows(6).any(|window| window == &b"token="[..]) {
-                report.still_carrying.push(
-                    path.file_name().map(|name| name.to_string_lossy().to_string()).unwrap_or_default(),
-                );
-            }
-        }
-    }
-    report
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_rectangle_reaches_the_engine_in_physical_pixels() {
-        let converted = rect(PhysicalRect { x: 15, y: 30, width: 1200, height: 900 });
-        assert_eq!(
-            converted.position,
-            wry::dpi::Position::Physical(PhysicalPosition::new(15, 30))
-        );
-        assert_eq!(
-            converted.size,
-            wry::dpi::Size::Physical(PhysicalSize::new(1200, 900))
-        );
-    }
-
-    #[test]
-    fn the_purge_takes_the_visit_record_away_and_names_what_it_cannot() {
-        // A scratch root the harness can point away from, mirroring vn-shell-core's rule: a
-        // host that denies %TEMP% to a child must not turn this into a failure about the host.
-        let root = match std::env::var_os("VNCODE_TEST_DIR") {
-            Some(value) if !value.is_empty() => PathBuf::from(value),
-            _ => std::env::temp_dir(),
-        };
-        let dir = root.join(format!("vncode-pane-purge-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        let default = dir.join("EBWebView").join("Default");
-        std::fs::create_dir_all(&default).unwrap();
-        std::fs::write(default.join("History"), b"http://127.0.0.1:1/?token=x").unwrap();
-        std::fs::write(default.join("History-journal"), b"junk").unwrap();
-        std::fs::write(default.join("Favicons"), b"http://127.0.0.1:1/?token=x").unwrap();
-        std::fs::write(default.join("Cookies"), b"a file that is not a visit record").unwrap();
-
-        let report = purge_navigation_records(&dir);
-        assert!(!default.join("History").exists(), "the history database must go");
-        assert!(!default.join("History-journal").exists(), "its -journal sibling goes with it");
-        assert!(!default.join("Favicons").exists(), "the favicon record carries the same URL");
-        assert!(default.join("Cookies").exists(), "a file that is not a visit record stays");
-        assert!(report.removed.iter().any(|name| name == "History"), "{report:?}");
-        assert!(report.still_carrying.is_empty(), "{report:?}");
-
-        // A file this build does not know about is NAMED rather than hidden - that is how the
-        // next engine version that invents a record file gets noticed.
-        std::fs::write(default.join("SomethingNew"), b"http://127.0.0.1:1/?token=x").unwrap();
-        let report = purge_navigation_records(&dir);
-        assert_eq!(report.still_carrying, vec!["SomethingNew".to_string()], "{report:?}");
-
-        // ...and a directory that does not exist yet is not a failure: that is the first run.
-        let report = purge_navigation_records(&dir.join("never-created"));
-        assert_eq!(report, PurgeReport::default());
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn a_platform_the_pane_is_not_built_for_yet_refuses_by_name() {
-        // The point of the function is that it is TOTAL: wherever this is compiled, asking
-        // whether the platform is supported gives an answer rather than reaching wry's
-        // documented panic on Linux. On the platforms this can be run on, the answer is yes.
-        #[cfg(target_os = "linux")]
-        {
-            let reason = platform_supported().expect_err("Linux has no pumped GTK loop yet");
-            assert!(reason.contains("P4"), "{reason}");
-            assert!(reason.contains("hand-off"), "{reason}");
-        }
-        #[cfg(not(target_os = "linux"))]
-        assert!(platform_supported().is_ok());
-    }
-
-    #[test]
-    fn the_pane_grants_the_clipboard_and_denies_everything_else() {
-        assert!(matches!(
-            permission_response(PermissionKind::ClipboardRead),
-            PermissionResponse::Allow
-        ));
-        // A viewer asks for none of these, and the pane answers for itself rather than
-        // leaving it to the engine's default flow.
-        for kind in [
-            PermissionKind::Microphone,
-            PermissionKind::Camera,
-            PermissionKind::DisplayCapture,
-            PermissionKind::Geolocation,
-            PermissionKind::Notifications,
-            PermissionKind::Midi,
-            PermissionKind::Sensors,
-        ] {
-            assert!(
-                matches!(permission_response(kind), PermissionResponse::Deny),
-                "a permission other than the clipboard was not denied"
-            );
-        }
-    }
-
-    #[test]
-    fn the_engine_quotes_the_same_loopback_rule_as_the_rest_of_the_shell() {
-        // The refusal has to come from `pane::may_load` and not from a second copy of the
-        // rule, so this pins that an engine given a foreign URL refuses it in the same
-        // words the pure half uses.
-        let refusal = pane::may_load("http://evil.example/").unwrap_err();
-        assert!(refusal.contains("refusing to load"), "{refusal}");
-        assert!(pane::may_load("http://127.0.0.1:3080/?token=x").is_ok());
-    }
-}
diff --git a/app/crates/vn-shell-pane/src/lib.rs b/app/crates/vn-shell-pane/src/lib.rs
deleted file mode 100644
index 7361c00..0000000
--- a/app/crates/vn-shell-pane/src/lib.rs
+++ /dev/null
@@ -1,51 +0,0 @@
-//! The one crate that owns a web engine.
-//!
-//! ## Why this is a crate and not a module
-//!
-//! Three reasons, and each one is a rule this repository already keeps:
-//!
-//! 1. **The engine's dependency tree is large and platform-specific.** `wry` brings
-//!    `webview2-com` and `windows` on Windows, `objc2-web-kit` on macOS and
-//!    `gtk`/`webkit2gtk` on Linux. Isolating it here keeps the pure halves pure, keeps
-//!    `cargo test` fast, and keeps a machine with no engine able to build everything.
-//! 2. **It is optional.** The `pane` feature is off by default, so a build without it
-//!    compiles no engine at all and this crate answers `available() == false`. Nothing
-//!    the shell does today changes when the feature is off.
-//! 3. **The decision is not here.** Visibility and the rectangle are
-//!    [`vn_shell_core::pane`] - pure, tested, and provable with no engine in the room.
-//!    This crate is the engine and nothing else: create, position, show, hide, navigate,
-//!    destroy.
-//!
-//! ## What it deliberately does not do
-//!
-//! No IPC handler and no injected script. The moment the pane has a channel into the
-//! shell, a page the harness serves has a way to reach the shell's process - and the
-//! pane's whole security argument is that the reverse direction is one loopback URL.
-//! Permissions, `window.open` and downloads are refused in P2, alongside the check that
-//! proves a foreign navigation cannot be followed.
-
-/// Whether a web engine is compiled into this build.
-pub const fn available() -> bool {
-    cfg!(feature = "pane")
-}
-
-#[cfg(feature = "pane")]
-mod engine;
-
-#[cfg(feature = "pane")]
-mod page;
-
-#[cfg(feature = "pane")]
-pub use engine::{Engine, EngineError, LoadState};
-
-#[cfg(feature = "pane")]
-pub use page::PanePage;
-
-#[cfg(test)]
-mod tests {
-    /// The default build has no engine, and says so rather than pretending.
-    #[test]
-    fn the_default_build_has_no_engine() {
-        assert_eq!(super::available(), cfg!(feature = "pane"));
-    }
-}
diff --git a/app/crates/vn-shell-pane/src/page.rs b/app/crates/vn-shell-pane/src/page.rs
deleted file mode 100644
index c4416d3..0000000
--- a/app/crates/vn-shell-pane/src/page.rs
+++ /dev/null
@@ -1,418 +0,0 @@
-//! The pane's page: the tab strip, the bar above the view, and the rectangle the engine
-//! is given.
-//!
-//! This is the whole user-visible half of the pane, and it lives beside the engine rather
-//! than inside the panel's own file (`vn-shell-egui`) for two reasons: the panel is two
-//! thousand lines of control panel with a different job, and the pane's rules belong with
-//! the thing they constrain.
-//!
-//! ## The airspace rule, kept the easy way
-//!
-//! A child web view paints above the GPU surface and cannot be clipped, scrolled or drawn
-//! over. So the pane must never be *covered* - and this page keeps that by construction
-//! rather than by cleverness: the view is given everything below the tab strip and the
-//! bar, and nothing is ever drawn there, because the control panel is a **different page**
-//! of the same window. The engine is only ever hidden: when the panel is in front, when
-//! the host reports an overlay, and when nothing is running.
-//!
-//! ## Two identities, and why the URL is one
-//!
-//! A Stop and a Start produce a new port **and a new launch token**, so a page belongs to
-//! one instance. The engine is rebuilt when the URL changes and **retired the moment the
-//! instance stops** - a hidden page still holding the previous token is a credential
-//! nobody is watching, which is the same rule `Status::mark_stopped` keeps by clearing
-//! the URL. The URL is therefore the identity, and it is never printed: the bar draws
-//! `Status::public_url`, which has the token stripped by construction.
-
-use std::path::PathBuf;
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::Arc;
-
-use egui::{Align2, Color32, FontId, RichText, Ui};
-use vn_shell_core::pane::{self, PanePolicy, RectPoints};
-use vn_shell_core::status::{Phase, Status};
-use wry::raw_window_handle::HasWindowHandle;
-
-use crate::engine::{Engine, LoadState};
-
-/// Which page of the window is in front.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-enum Page {
-    Panel,
-    Harness,
-}
-
-/// The harness page, and the engine behind it.
-pub struct PanePage {
-    front: Page,
-    engine: Option<Engine>,
-    /// The URL the engine was built for: the instance's identity. NEVER printed, never
-    /// logged - it carries the launch token.
-    built_for: Option<String>,
-    /// Whether the page in the engine has finished loading, set from its own callback.
-    loaded: Arc<AtomicBool>,
-    /// The last thing the engine refused, in its own words, so a refusal is visible
-    /// rather than a rectangle that quietly stays blank.
-    problem: Option<String>,
-    /// The engine's own profile, kept so that what the ENGINE records about where the pane
-    /// went can be taken away again - see `purge_navigation_records`.
-    data_dir: Option<PathBuf>,
-    /// Whether this run has done its startup purge: once per run, not once per frame.
-    purged: bool,
-    /// A live view has been given up, so the next one owes an explicit load.
-    restarted: bool,
-}
-
-impl Default for PanePage {
-    fn default() -> Self {
-        PanePage::new()
-    }
-}
-
-impl PanePage {
-    /// The page opens on the CONTROL PANEL: the pane is a page you go to, not a window
-    /// that starts on somebody's web page before they have pressed anything.
-    pub fn new() -> PanePage {
-        PanePage {
-            front: Page::Panel,
-            engine: None,
-            built_for: None,
-            loaded: Arc::new(AtomicBool::new(false)),
-            problem: None,
-            data_dir: None,
-            purged: false,
-            restarted: false,
-        }
-    }
-
-    /// Start with the harness page in front.
-    ///
-    /// What `-Mode embed` asks for: the same window and the same two tabs, with the instance
-    /// already in view instead of the control panel.
-    pub fn in_front(mut self) -> PanePage {
-        self.front = Page::Harness;
-        self
-    }
-
-    /// Whether this page owns everything below the header, so the panel must not draw its
-    /// own rows underneath the view.
-    pub fn owns_the_area(&self) -> bool {
-        self.front == Page::Harness
-    }
-
-    /// Draw the page.
-    ///
-    /// It returns **nothing**, and that is deliberate. This page used to hand two actions back
-    /// to the panel - "open in my browser" and "stop" - and both are gone: with the pane the
-    /// app starts no browser at all, and Stop is one control in the header rather than two.
-    /// What the page owns is the engine and the rectangle; it asks for nothing.
-    pub fn show<W: HasWindowHandle>(
-        &mut self,
-        ui: &mut Ui,
-        window: &W,
-        status: &Status,
-        data_dir: Option<PathBuf>,
-        overlay_open: bool,
-    ) {
-        // ONCE PER RUN, BEFORE ANY VIEW EXISTS: take away what the engine recorded about where
-        // the pane went last time. This is the pass that CANNOT fail, because nothing is
-        // holding those files open yet - `purge_navigation_records` has the measurement that
-        // made this necessary, and it is a rule about the launch token, not a tidy-up.
-        if !self.purged {
-            self.purged = true;
-            self.data_dir = data_dir.clone();
-            if let Some(dir) = self.data_dir.clone() {
-                let report = crate::engine::purge_navigation_records(&dir);
-                if !report.still_carrying.is_empty() {
-                    // Something this build does not know how to remove is holding the token.
-                    // Saying so is the only honest option: a rule that cannot be kept silently
-                    // is worse than one that names the file that broke it.
-                    self.problem = Some(format!(
-                        "the engine kept the launch token on disk in {} - this build does not know that file, please report it",
-                        report.still_carrying.join(", ")
-                    ));
-                }
-            }
-        }
-        self.tabs(ui);
-        if self.front == Page::Panel {
-            // The engine is KEPT and hidden: a page that reloads every time somebody looks
-            // at the panel is a page that loses where they were.
-            self.conceal();
-            return;
-        }
-        self.bar(ui, status);
-        self.view(ui, window, status, data_dir, overlay_open);
-    }
-
-    /// The two pages.
-    ///
-    /// **The state is NOT repeated here.** The header already carries `● running`, and the same
-    /// word twice on one screen is the sort of thing that makes a window look unfinished.
-    fn tabs(&mut self, ui: &mut Ui) {
-        ui.horizontal(|ui| {
-            ui.selectable_value(&mut self.front, Page::Panel, "control panel");
-            ui.selectable_value(&mut self.front, Page::Harness, "harness");
-        });
-    }
-
-    /// The bar: where the harness is, and the one thing worth doing to it from here.
-    ///
-    /// **Reload is the only button this page has**, which is the point rather than an
-    /// omission: with the pane this app starts no browser - `Open in my browser` used to live
-    /// here - and **Stop is the header's own control**, so there is one Stop in the window
-    /// instead of two that mean the same thing.
-    ///
-    /// The address is `public_url` - scheme, host and port, with the query dropped - so
-    /// **the launch token is never drawn**, exactly as the panel's own address row never
-    /// drew it.
-    fn bar(&mut self, ui: &mut Ui, status: &Status) {
-        let running = status.phase == Phase::Running;
-        let has_engine = self.engine.is_some();
-        let loaded = self.loaded.load(Ordering::Relaxed);
-        let mut reload = false;
-
-        ui.horizontal(|ui| {
-            // ONE font, ONE size, for the whole row. The address used to be drawn in a monospace
-            // face, which in this theme renders wider and reads as a bigger, louder label than
-            // everything beside it - a bar where one item shouts looks broken. It is `.strong()`
-            // instead: the address is the fact this row is about.
-            match status.public_url() {
-                Some(address) => {
-                    ui.label(RichText::new(address).strong());
-                }
-                None => {
-                    ui.label(RichText::new("no address yet").weak());
-                }
-            }
-            if let Some(uptime) = status.uptime_label() {
-                ui.add_space(8.0);
-                ui.label(RichText::new(format!("· up {uptime}")).weak());
-            }
-            if running && has_engine && !loaded {
-                ui.add_space(8.0);
-                ui.spinner();
-                ui.label(RichText::new("loading…").weak());
-            }
-            // The one action this page owns, held at the far end so the row reads as facts on
-            // the left and a control on the right instead of one long queue of widgets.
-            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                ui.add_enabled_ui(running && has_engine, |ui| {
-                    if ui
-                        .button("Reload")
-                        .on_hover_text("ask the engine for the page again")
-                        .clicked()
-                    {
-                        reload = true;
-                    }
-                });
-            });
-        });
-
-        if reload {
-            self.reload();
-        }
-    }
-
-    /// The engine's rectangle, and the page inside it.
-    fn view<W: HasWindowHandle>(
-        &mut self,
-        ui: &mut Ui,
-        window: &W,
-        status: &Status,
-        data_dir: Option<PathBuf>,
-        overlay_open: bool,
-    ) {
-        let rect = ui.available_rect_before_wrap();
-        let running = status.phase == Phase::Running;
-        let url = if running { status.navigate_url() } else { None };
-
-        // An instance that is not running has no page, and one that has been restarted has
-        // a different one.
-        if !running || !page_is_current(self.built_for.as_deref(), url) {
-            self.retire();
-        }
-
-        if let (Some(url), None) = (url, self.engine.as_ref()) {
-            let loaded = Arc::clone(&self.loaded);
-            match Engine::attach(window, url, data_dir, move |state| {
-                if state == LoadState::Finished {
-                    loaded.store(true, Ordering::Relaxed);
-                }
-            }) {
-                Ok(mut engine) => {
-                    self.loaded.store(false, Ordering::Relaxed);
-                    // MEASURED, from a real run: Stop and then Start left the pane WHITE until
-                    // the page was asked for again by hand. A view recreated on the same engine
-                    // profile inside one process comes up without a paint, so the page is loaded
-                    // a second time here - which is exactly what pressing Reload does. Only when
-                    // this REPLACES a live view: a first view loads the URL it was built with.
-                    if self.restarted {
-                        if let Err(error) = engine.navigate(url) {
-                            self.problem = Some(error.to_string());
-                        }
-                        self.restarted = false;
-                    }
-                    self.engine = Some(engine);
-                    self.built_for = Some(url.to_string());
-                    self.problem = None;
-                }
-                Err(error) => {
-                    // Named, never silent: an engine that refuses is the one failure this
-                    // page must not hide, because the hand-off behind the button is the
-                    // way round it.
-                    self.problem = Some(error.to_string());
-                }
-            }
-        }
-
-        let policy = PanePolicy {
-            is_active_page: true,
-            harness_ready: running,
-            overlay_open,
-            rect: RectPoints {
-                min_x: rect.min.x,
-                min_y: rect.min.y,
-                width: rect.width(),
-                height: rect.height(),
-            },
-        };
-        let want = pane::decide(&policy, ui.ctx().pixels_per_point());
-        if let Some(engine) = &mut self.engine {
-            if let Err(error) = engine.apply(&want) {
-                self.problem = Some(error.to_string());
-            }
-        }
-
-        // The engine draws over this rectangle; nothing of ours goes inside it.
-        ui.allocate_rect(rect, egui::Sense::hover());
-
-        if !running {
-            ui.painter().text(
-                rect.center(),
-                Align2::CENTER_CENTER,
-                "the harness is not running — press Start above and it opens here",
-                FontId::proportional(15.0),
-                ui.visuals().weak_text_color(),
-            );
-        }
-        if let Some(problem) = &self.problem {
-            ui.colored_label(Color32::from_rgb(0xE0, 0x6C, 0x75), problem);
-        }
-    }
-
-    /// Ask the engine for the page again.
-    fn reload(&mut self) {
-        let Some(url) = self.built_for.clone() else { return };
-        self.loaded.store(false, Ordering::Relaxed);
-        if let Some(engine) = &mut self.engine {
-            if let Err(error) = engine.navigate(&url) {
-                self.problem = Some(error.to_string());
-            }
-        }
-    }
-
-    /// Give up the page, and with it the child view: `Engine`'s own `Drop` destroys the
-    /// window, which is what makes "nothing is left holding a stale token" a property of
-    /// the type instead of a thing a caller has to remember.
-    ///
-    /// Two things come with giving it up: the NEXT view owes an explicit load (measured - see
-    /// `needs_an_explicit_load`), and what the engine wrote about where the pane went is taken
-    /// away again, best effort. The reliable purge is the one at startup, because a delete while
-    /// the engine is alive is a sharing violation - this one is the attempt that sometimes wins.
-    fn retire(&mut self) {
-        self.restarted = needs_an_explicit_load(self.engine.is_some());
-        self.engine = None;
-        self.built_for = None;
-        if let Some(dir) = &self.data_dir {
-            let _ = crate::engine::purge_navigation_records(dir);
-        }
-    }
-
-    /// Hide the view without giving up the page.
-    fn conceal(&mut self) {
-        if let Some(engine) = &mut self.engine {
-            if let Err(error) = engine.conceal() {
-                self.problem = Some(error.to_string());
-            }
-        }
-    }
-}
-
-/// Whether the engine in hand is the page for the instance that is running.
-///
-/// The URL is the identity because it is what actually changes: a Stop and a Start give a
-/// new port and a new launch token, so the old page is a page for an instance that no
-/// longer exists.
-fn page_is_current(built_for: Option<&str>, url: Option<&str>) -> bool {
-    matches!((built_for, url), (Some(built), Some(url)) if built == url)
-}
-
-/// Whether the view that replaces a retired one needs an explicit load.
-///
-/// MEASURED: a view recreated on the same engine profile inside one process comes up without a
-/// paint - Stop and then Start left the pane blank until it was reloaded by hand. So a page that
-/// is replacing a LIVE view is loaded a second time, and a first view is not: it loads the URL
-/// it was built with.
-fn needs_an_explicit_load(replacing_a_live_view: bool) -> bool {
-    replacing_a_live_view
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn the_page_opens_on_the_control_panel_and_not_on_a_web_page() {
-        let page = PanePage::new();
-        assert!(!page.owns_the_area(), "the pane must not own the window before Start");
-        assert_eq!(page.front, Page::Panel);
-    }
-
-    #[test]
-    fn a_restarted_instance_is_a_different_page() {
-        // A Stop and a Start change the port AND the token, so the old page is a page for
-        // an instance that no longer exists.
-        let one = "http://127.0.0.1:51347/?token=one";
-        let two = "http://127.0.0.1:51348/?token=two";
-        assert!(page_is_current(Some(one), Some(one)));
-        assert!(!page_is_current(Some(one), Some(two)), "a new instance needs a new page");
-        // Nothing built yet, or nothing running: both are "no page".
-        assert!(!page_is_current(None, Some(one)));
-        assert!(!page_is_current(Some(one), None));
-    }
-
-    #[test]
-    fn only_the_harness_page_owns_the_area() {
-        // This is the guard the panel's own hook asks, and getting it wrong draws the
-        // panel's rows UNDER a web page: the panel in front, the pane still owns the
-        // rectangle.
-        let mut page = PanePage::new();
-        assert!(!page.owns_the_area(), "the panel is in front at the start");
-        page.front = Page::Harness;
-        assert!(page.owns_the_area(), "the harness page owns everything below the header");
-    }
-
-    #[test]
-    fn only_a_page_that_replaces_a_live_view_is_loaded_twice() {
-        assert!(
-            needs_an_explicit_load(true),
-            "a recreated view comes up blank - measured on a real Stop and Start"
-        );
-        assert!(
-            !needs_an_explicit_load(false),
-            "a first view loads the URL it was built with, and loading it twice would flash"
-        );
-    }
-
-    #[test]
-    fn an_instance_that_is_not_running_has_no_page() {
-        // `view` keeps the page in exactly one phase and retires it in every other, so a
-        // stopped instance cannot leave a live page holding its token behind.
-        let kept = |phase: Phase| phase == Phase::Running;
-        assert!(kept(Phase::Running));
-        for phase in [Phase::Idle, Phase::Starting, Phase::Stopping, Phase::Stopped, Phase::Failed] {
-            assert!(!kept(phase), "{phase:?} must not keep a page");
-        }
-    }
-}
diff --git a/app/crates/vn-shell-paths/Cargo.toml b/app/crates/vn-shell-paths/Cargo.toml
deleted file mode 100644
index d00dfc5..0000000
--- a/app/crates/vn-shell-paths/Cargo.toml
+++ /dev/null
@@ -1,11 +0,0 @@
-[package]
-name = "vn-shell-paths"
-description = "The vncode shell's location map: what lives under the harness home, what lives outside it, and where a size or a reveal comes from."
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-publish.workspace = true
-rust-version.workspace = true
-
-[dependencies]
-vn-shell-core.workspace = true
diff --git a/app/crates/vn-shell-paths/src/lib.rs b/app/crates/vn-shell-paths/src/lib.rs
deleted file mode 100644
index 1ea96de..0000000
--- a/app/crates/vn-shell-paths/src/lib.rs
+++ /dev/null
@@ -1,525 +0,0 @@
-//! The location map the control panel's first page shows.
-//!
-//! It is `docs/PATHS.md` as data, and the discipline that page states is the
-//! discipline here: the harness keeps all user data under ONE root with the same
-//! shape on all three operating systems, the pack's own state lives under it too,
-//! and the only things outside it are named (the npm cache, the pnpm store, the
-//! vendored runtime) because those are the ones a stuck machine needs to find.
-//!
-//! Two rules are structural rather than commented:
-//!
-//! - a row exists even when its path does NOT, so the panel can say "missing"
-//!   instead of hiding the thing the reader is looking for;
-//! - there is no accessor that returns a file's CONTENT. The credentials row
-//!   carries a path and a presence flag, which is the whole of what this crate
-//!   knows about a credential.
-
-use std::path::{Path, PathBuf};
-
-/// What a row is, so the panel can group and colour it without parsing labels.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Kind {
-    /// The harness home itself, and the reason for it.
-    Home,
-    /// Something the harness owns.
-    Harness,
-    /// Something this pack owns under the home.
-    Pack,
-    /// Something outside the home that the shell needs to name.
-    Outside,
-    /// The model credential FILE. Path and presence only.
-    Credentials,
-    /// This shell's own record.
-    Shell,
-    /// The folder being worked in.
-    Workspace,
-}
-
-/// One line of the map.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Row {
-    /// Stable id, for tests and for the panel's own layout.
-    pub key: &'static str,
-    pub label: &'static str,
-    /// `None` only when nothing could be resolved at all.
-    pub path: Option<PathBuf>,
-    /// Why this path, or what it currently holds. Never a file's content.
-    pub note: String,
-    pub kind: Kind,
-}
-
-impl Row {
-    pub fn exists(&self) -> bool {
-        self.path.as_ref().map(|path| path.exists()).unwrap_or(false)
-    }
-
-    /// What the row says about itself: present or not, plus the note.
-    pub fn state(&self) -> &'static str {
-        match (&self.path, self.exists()) {
-            (None, _) => "unknown",
-            (Some(_), true) => "present",
-            (Some(_), false) => "missing",
-        }
-    }
-
-    /// The size of a directory row, or of a file row.
-    pub fn size(&self) -> Option<u64> {
-        let path = self.path.as_ref()?;
-        if path.is_dir() {
-            dir_size(path, SIZE_BUDGET)
-        } else if path.is_file() {
-            std::fs::metadata(path).ok().map(|meta| meta.len())
-        } else {
-            None
-        }
-    }
-}
-
-/// Everything a row set needs to know.
-pub struct Input<'a> {
-    /// The harness home as this app resolved it, for REPORTING only.
-    pub home: Option<&'a Path>,
-    /// The origin's own words, from `vn_shell_core::home::Origin::label`.
-    pub home_origin: &'a str,
-    /// The app's own root (`$VNCODE_HOME`): the furniture this app owns, and the
-    /// directory the home sits inside. `None` when even that could not be written.
-    pub app_root: Option<&'a Path>,
-    /// Where `.dsh-version.json` was found, if it was.
-    pub repo_root: Option<&'a Path>,
-    /// The directory the shell was started in.
-    pub workspace: Option<&'a Path>,
-    /// The profile this shell will start the harness with.
-    pub profile: &'a str,
-    /// The profiles this home has, for the profiles row's note.
-    pub profiles: &'a [String],
-}
-
-/// The map, in reading order: the app's own root, the home, what the harness owns,
-/// what the pack owns, then the few things outside it.
-pub fn rows(input: &Input<'_>) -> Vec<Row> {
-    let mut rows = Vec::new();
-    let home = input.home;
-
-    // The app's own root first, because it is the one folder this app created and the
-    // one a reader can move, back up or delete without touching the harness.
-    rows.push(Row {
-        key: "vncode-root",
-        label: "vncode root",
-        path: input.app_root.map(Path::to_path_buf),
-        note: "this app's own root: the window record and the npm cache, and the home inside it"
-            .to_string(),
-        kind: Kind::Shell,
-    });
-
-    rows.push(Row {
-        key: "home",
-        label: "harness home",
-        path: home.map(Path::to_path_buf),
-        note: input.home_origin.to_string(),
-        kind: Kind::Home,
-    });
-
-    let under_home: [(&'static str, &'static str, &'static str); 5] = [
-        ("profiles", "profiles", "one folder per profile; the profile is mostly links, so installing needs no registry"),
-        ("sessions", "sessions", "one file per conversation - the durable transcript"),
-        ("storages", "storages", "workspace.json and the session projection caches"),
-        ("skills", "skills", "the skills the harness loads, including the ones this pack copies"),
-        ("attachments", "attachments", "files pasted or attached into a conversation"),
-    ];
-    for (key, label, note) in under_home {
-        let note = if key == "profiles" && !input.profiles.is_empty() {
-            format!("{note} - here: {}", input.profiles.join(", "))
-        } else {
-            note.to_string()
-        };
-        rows.push(Row {
-            key,
-            label,
-            path: home.map(|home| home.join(key)),
-            note,
-            kind: Kind::Harness,
-        });
-    }
-
-    // The pack's own trees. Three are caches with a ceiling and one is the single
-    // PROGRAM the pack writes (only after the bytes match the SHA-256 it pins).
-    let pack: [(&'static str, &'static str, &'static str, &'static str); 4] = [
-        ("dsh-pdf", "dsh-pdf artifacts", "PDF parse cache", "artifacts"),
-        ("dsh-diagrams", "dsh-diagrams artifacts", "diagram artifact cache and the shared library", "artifacts"),
-        ("dsh-media", "dsh-media bin", "the provisioned ffmpeg copy - absent where ffmpeg is on PATH", "bin"),
-        ("dsh-media", "dsh-media playable", "the browser-playable remux cache", "playable"),
-    ];
-    for (package, label, note, child) in pack {
-        rows.push(Row {
-            key: match (package, child) {
-                ("dsh-pdf", _) => "cache-pdf",
-                ("dsh-diagrams", _) => "cache-diagrams",
-                (_, "bin") => "cache-media-bin",
-                _ => "cache-media-playable",
-            },
-            label,
-            path: home.map(|home| home.join(package).join(child)),
-            note: note.to_string(),
-            kind: Kind::Pack,
-        });
-    }
-
-    // The credential FILE. A path and a presence flag; the shell has no code that
-    // reads it, which is why the note can say so and be true.
-    rows.push(Row {
-        key: "credentials",
-        label: "model credential",
-        path: home.map(|home| home.join(".credentials.yaml")),
-        note: "the harness's own file - this shell names it and never reads it".to_string(),
-        kind: Kind::Credentials,
-    });
-
-    rows.push(Row {
-        key: "record",
-        label: "window record",
-        // The APP ROOT, not the home: the geometry is this app's furniture and must
-        // survive a `-DshHome` that points at a folder shared with run-web.
-        path: input.app_root.map(vn_shell_core::windowstate::state_path),
-        note: "this shell's size and position, discarded rather than repaired if unusable"
-            .to_string(),
-        kind: Kind::Shell,
-    });
-
-    // Outside the home: the three things a stuck machine actually needs named.
-    rows.push(Row {
-        key: "runtime",
-        label: "vendored runtime",
-        path: input.repo_root.map(|root| root.join("runtime").join(vn_shell_core::launch::host_rid())),
-        note: "node + harness + VENDOR.json; all three or the shell falls back to npx".to_string(),
-        kind: Kind::Outside,
-    });
-    rows.push(Row {
-        key: "npm-cache",
-        label: "npm / npx cache",
-        path: npm_cache_root(),
-        note: "used only by the npx fallback, which points npm_config_cache at the app's own root"
-            .to_string(),
-        kind: Kind::Outside,
-    });
-    rows.push(Row {
-        key: "pnpm-store",
-        label: "pnpm store",
-        path: pnpm_store_root(),
-        note: "the store the profile was verified against".to_string(),
-        kind: Kind::Outside,
-    });
-
-    rows.push(Row {
-        key: "repo",
-        label: "checkout",
-        path: input.repo_root.map(Path::to_path_buf),
-        note: "where .dsh-version.json, and so the pin, was found".to_string(),
-        kind: Kind::Outside,
-    });
-    rows.push(Row {
-        key: "workspace",
-        label: "workspace",
-        path: input.workspace.map(Path::to_path_buf),
-        note: format!("the folder this shell was started in; the {} profile runs here", input.profile),
-        kind: Kind::Workspace,
-    });
-
-    rows
-}
-
-/// The per-OS npm cache root, from `docs/PATHS.md`'s own table.
-pub fn npm_cache_root() -> Option<PathBuf> {
-    if cfg!(target_os = "windows") {
-        std::env::var_os("LOCALAPPDATA").map(|base| PathBuf::from(base).join("npm-cache"))
-    } else {
-        std::env::var_os("HOME").map(|home| PathBuf::from(home).join(".npm"))
-    }
-}
-
-/// The per-OS pnpm store root, from the same table.
-pub fn pnpm_store_root() -> Option<PathBuf> {
-    if cfg!(target_os = "windows") {
-        std::env::var_os("LOCALAPPDATA").map(|base| PathBuf::from(base).join("pnpm").join("store"))
-    } else if cfg!(target_os = "macos") {
-        std::env::var_os("HOME").map(|home| PathBuf::from(home).join("Library/pnpm/store"))
-    } else {
-        std::env::var_os("HOME").map(|home| PathBuf::from(home).join(".local/share/pnpm/store"))
-    }
-}
-
-/// How many directory entries a size is allowed to visit.
-///
-/// The panel asks for sizes, and a cache with a million tiny files must not make
-/// the window stop responding. Past the budget the answer is "at least this much",
-/// which the caller shows as a `+`.
-pub const SIZE_BUDGET: usize = 20_000;
-
-/// The size of a directory tree, bounded by `budget` entries.
-pub fn dir_size(root: &Path, budget: usize) -> Option<u64> {
-    if !root.exists() {
-        return None;
-    }
-    let mut total = 0u64;
-    let mut seen = 0usize;
-    let mut stack = vec![root.to_path_buf()];
-    while let Some(directory) = stack.pop() {
-        let Ok(entries) = std::fs::read_dir(&directory) else {
-            continue;
-        };
-        for entry in entries.flatten() {
-            seen += 1;
-            if seen > budget {
-                return Some(total);
-            }
-            let Ok(meta) = entry.metadata() else {
-                continue;
-            };
-            if meta.is_dir() {
-                stack.push(entry.path());
-            } else {
-                total += meta.len();
-            }
-        }
-    }
-    Some(total)
-}
-
-/// Bytes in words: `0 B`, `512 B`, `1.5 KiB`, `223 MiB`, `8.0 GiB`.
-pub fn human(bytes: u64) -> String {
-    const UNITS: [&str; 4] = ["B", "KiB", "MiB", "GiB"];
-    if bytes < 1024 {
-        return format!("{bytes} B");
-    }
-    let mut value = bytes as f64;
-    let mut unit = 0;
-    while value >= 1024.0 && unit < UNITS.len() - 1 {
-        value /= 1024.0;
-        unit += 1;
-    }
-    format!("{value:.1} {}", UNITS[unit])
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn input<'a>(home: Option<&'a Path>, profiles: &'a [String]) -> Input<'a> {
-        Input {
-            home,
-            home_origin: "this app's own home (the default)",
-            app_root: home.and_then(Path::parent),
-            repo_root: None,
-            workspace: None,
-            profile: "web",
-            profiles,
-        }
-    }
-
-    #[test]
-    fn every_row_docs_paths_names_is_present() {
-        // The map is only useful if it is COMPLETE: a reader looking for the
-        // diagram cache and not finding it learns nothing about where it is.
-        let profiles = vec!["desktop".to_string(), "web".to_string()];
-        let root = PathBuf::from("/home/u/.vncode/home");
-        let rows = rows(&input(Some(&root), &profiles));
-        let keys: Vec<&str> = rows.iter().map(|row| row.key).collect();
-        for expected in [
-            "vncode-root",
-            "home",
-            "profiles",
-            "sessions",
-            "storages",
-            "skills",
-            "attachments",
-            "cache-pdf",
-            "cache-diagrams",
-            "cache-media-bin",
-            "cache-media-playable",
-            "credentials",
-            "record",
-            "runtime",
-            "npm-cache",
-            "pnpm-store",
-            "repo",
-            "workspace",
-        ] {
-            assert!(keys.contains(&expected), "the map has no {expected} row: {keys:?}");
-        }
-    }
-
-    #[test]
-    fn the_home_row_carries_the_reason_it_is_that_path() {
-        // A path with no reason is what made the old splash ambiguous: a reader
-        // could not tell whether they had set the home or the app had.
-        let root = PathBuf::from("/home/u/.vncode/home");
-        let rows = rows(&input(Some(&root), &[]));
-        let home = rows.iter().find(|row| row.key == "home").unwrap();
-        assert_eq!(home.path.as_deref(), Some(root.as_path()));
-        assert!(home.note.contains("app's own home"), "{}", home.note);
-        assert_eq!(home.kind, Kind::Home);
-        // ...and the app's root is its parent, named in its own row.
-        let app_root = rows.iter().find(|row| row.key == "vncode-root").unwrap();
-        assert_eq!(app_root.path.as_deref(), Some(Path::new("/home/u/.vncode")));
-    }
-
-    #[test]
-    fn the_window_record_follows_the_app_root_and_not_the_home() {
-        // The M0 rule `appdata`'s header argues for: the geometry is this app's
-        // furniture, so a `-DshHome` pointing at a shared `~/.dsh` does not drag it
-        // into somebody else's folder.
-        let home = PathBuf::from("/app/vncode/home");
-        let app_root = home.parent().unwrap().to_path_buf();
-        let elsewhere = PathBuf::from("/home/u/.dsh");
-        let rows = rows(&Input {
-            home: Some(&elsewhere),
-            home_origin: "from -DshHome",
-            app_root: Some(&app_root),
-            repo_root: None,
-            workspace: None,
-            profile: "web",
-            profiles: &[],
-        });
-        let record = rows.iter().find(|row| row.key == "record").unwrap();
-        let path = record.path.clone().unwrap();
-        assert!(path.starts_with("/app/vncode"), "{}", path.display());
-        assert!(!path.starts_with("/home/u/.dsh"), "{}", path.display());
-    }
-
-    #[test]
-    fn a_row_exists_even_when_its_path_does_not() {
-        // "missing" is information; a hidden row is not. Every row here names a
-        // path because the input resolved everything a row can need - and the rows
-        // that live under the home are the ones this can assert are absent.
-        let root = PathBuf::from("/definitely/not/here/.dsh");
-        let app_root = PathBuf::from("/definitely/not/here/app");
-        let repo = PathBuf::from("/definitely/not/here/repo");
-        let workspace = PathBuf::from("/definitely/not/here/work");
-        let rows = rows(&Input {
-            home: Some(&root),
-            home_origin: "the harness's own default (this shell passes none)",
-            app_root: Some(&app_root),
-            repo_root: Some(&repo),
-            workspace: Some(&workspace),
-            profile: "web",
-            profiles: &[],
-        });
-        for row in &rows {
-            assert!(row.path.is_some(), "{} is a row with no path at all", row.key);
-        }
-        for key in [
-            "vncode-root",
-            "home",
-            "profiles",
-            "sessions",
-            "storages",
-            "skills",
-            "attachments",
-            "cache-pdf",
-            "cache-diagrams",
-            "cache-media-bin",
-            "cache-media-playable",
-            "credentials",
-            "record",
-            "runtime",
-        ] {
-            let row = rows.iter().find(|row| row.key == key).unwrap();
-            assert!(!row.exists(), "{key} claims to exist under a home that does not");
-            assert_eq!(row.state(), "missing");
-        }
-    }
-
-    #[test]
-    fn with_no_home_the_own_rows_say_unknown_rather_than_guessing() {
-        let rows = rows(&input(None, &[]));
-        let home = rows.iter().find(|row| row.key == "home").unwrap();
-        assert_eq!(home.path, None);
-        assert_eq!(home.state(), "unknown");
-        // The rows that live under the home must not invent a parent.
-        for key in ["sessions", "skills", "credentials", "record", "vncode-root"] {
-            let row = rows.iter().find(|row| row.key == key).unwrap();
-            assert_eq!(row.path, None, "{key} invented a path with no home");
-        }
-    }
-
-    #[test]
-    fn the_profiles_row_names_the_profiles_it_found() {
-        let profiles = vec!["desktop".to_string(), "web".to_string()];
-        let root = PathBuf::from("/home/u/.dsh");
-        let rows = rows(&input(Some(&root), &profiles));
-        let row = rows.iter().find(|row| row.key == "profiles").unwrap();
-        assert!(row.note.contains("desktop, web"), "{}", row.note);
-    }
-
-    #[test]
-    fn the_credentials_row_is_a_path_and_nothing_else() {
-        // Structural, not commented: there is no function in this crate that
-        // returns a file's contents, so a row cannot carry a key even by accident.
-        let rows = rows(&input(Some(Path::new("/home/u/.dsh")), &[]));
-        let row = rows.iter().find(|row| row.key == "credentials").unwrap();
-        assert_eq!(row.kind, Kind::Credentials);
-        assert!(row.path.as_ref().unwrap().ends_with(".credentials.yaml"));
-        assert!(row.note.contains("never reads it"), "{}", row.note);
-    }
-
-    /// A scratch directory for this crate's tests.
-    ///
-    /// `VNCODE_TEST_DIR` first, for the same reason `vn-shell-core` reads it: a
-    /// host that denies the system temp directory would otherwise fail tests that
-    /// have nothing to do with the change under test.
-    fn scratch_dir(name: &str) -> PathBuf {
-        let root = match std::env::var_os("VNCODE_TEST_DIR") {
-            Some(value) if !value.is_empty() => PathBuf::from(value),
-            _ => std::env::temp_dir(),
-        };
-        let path = root.join(format!("vncode-paths-{}-{name}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&path);
-        path
-    }
-
-    #[test]
-    fn a_size_is_measured_and_a_missing_path_has_none() {
-        let root = scratch_dir("size");
-        std::fs::create_dir_all(root.join("sub")).unwrap();
-        std::fs::write(root.join("a.txt"), vec![0u8; 1500]).unwrap();
-        std::fs::write(root.join("sub").join("b.txt"), vec![0u8; 500]).unwrap();
-        assert_eq!(dir_size(&root, SIZE_BUDGET), Some(2000));
-        assert_eq!(dir_size(&root.join("absent"), SIZE_BUDGET), None);
-        // The budget stops the walk rather than running to the end of a big tree.
-        assert!(dir_size(&root, 1).unwrap() < 2000);
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn sizes_are_human_readable_at_the_boundaries() {
-        assert_eq!(human(0), "0 B");
-        assert_eq!(human(512), "512 B");
-        assert_eq!(human(1024), "1.0 KiB");
-        assert_eq!(human(1536), "1.5 KiB");
-        assert_eq!(human(223 * 1024 * 1024), "223.0 MiB");
-        assert_eq!(human(8 * 1024 * 1024 * 1024), "8.0 GiB");
-    }
-
-    #[test]
-    fn the_two_outside_roots_follow_the_platform_table() {
-        // These are the paths `docs/PATHS.md` states per OS; the test asserts the
-        // shape of THIS platform's answer rather than all three, because only one
-        // of them can be right here.
-        if let Some(cache) = npm_cache_root() {
-            if cfg!(target_os = "windows") {
-                assert!(cache.ends_with("npm-cache"), "{}", cache.display());
-            } else {
-                assert!(cache.ends_with(".npm"), "{}", cache.display());
-            }
-        }
-        if let Some(store) = pnpm_store_root() {
-            let text = store.display().to_string();
-            if cfg!(target_os = "windows") {
-                assert!(text.ends_with("pnpm\\store") || text.ends_with("pnpm/store"), "{text}");
-            } else if cfg!(target_os = "macos") {
-                assert!(text.ends_with("Library/pnpm/store"), "{text}");
-            } else {
-                assert!(text.ends_with(".local/share/pnpm/store"), "{text}");
-            }
-        }
-    }
-}
diff --git a/app/crates/vn-shell-runtime/Cargo.toml b/app/crates/vn-shell-runtime/Cargo.toml
index f7336ce..3e07cee 100644
--- a/app/crates/vn-shell-runtime/Cargo.toml
+++ b/app/crates/vn-shell-runtime/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "vn-shell-runtime"
-description = "The vncode shell's supervisor: start the pinned harness, watch its ready line, stop the whole tree and prove the port came free."
+description = "The vncode shell's decided facts: the plan, the child environment and the runner behind the install and uninstall verbs."
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -9,30 +9,4 @@ rust-version.workspace = true
 
 [dependencies]
 vn-shell-core.workspace = true
-# For the location map `view` builds: the rows the panel draws and the binary logs
-# follow the home, so the crate that owns the home choice owns their construction.
-vn-shell-paths.workspace = true
-url.workspace = true
 serde_json.workspace = true
-
-[target.'cfg(unix)'.dependencies]
-# ONE call: `kill(-pgid, …)`, so Stop can take down the whole process group the
-# child was given. Without it the POSIX half would have to shell out to `kill`,
-# which is not on every PATH, or leave the tree to leak - which is what the old
-# shell did.
-libc = "0.2"
-
-[target.'cfg(windows)'.dependencies]
-# Windows only, for ONE call: a Job Object with KILL_ON_JOB_CLOSE, so the harness
-# dies with this shell even when the shell is killed outright rather than closed.
-# Three features, each for a real reason: Win32_Security gates
-# `CreateJobObjectW` (it takes a SECURITY_ATTRIBUTES pointer),
-# Win32_System_JobObjects is the module itself, and Win32_System_Threading gates
-# `JOBOBJECT_EXTENDED_LIMIT_INFORMATION`, which embeds that module's
-# IO_COUNTERS.
-windows-sys = { version = "0.61", features = [
-    "Win32_Foundation",
-    "Win32_Security",
-    "Win32_System_JobObjects",
-    "Win32_System_Threading",
-] }
diff --git a/app/crates/vn-shell-runtime/src/adopt.rs b/app/crates/vn-shell-runtime/src/adopt.rs
deleted file mode 100644
index f33d548..0000000
--- a/app/crates/vn-shell-runtime/src/adopt.rs
+++ /dev/null
@@ -1,429 +0,0 @@
-//! Adopt, run: copy the durable small things out of a home this app did not create.
-//!
-//! The DECISION - what may be copied, and whether to offer it at all - is pure and
-//! lives in `vn_shell_core::adopt`, with its own tests. This module is the part that
-//! touches the filesystem and the console: a bounded recursive copy, one line per
-//! tree, and the credentials file behind its own call.
-//!
-//! Three rules travel with it:
-//!
-//! 1. **Nothing is written into the source.** Only the target is created.
-//! 2. **A file that already exists is never overwritten.** Adopt runs against the
-//!    app's untouched home by construction (`adopt::target_is_untouched`), so a
-//!    collision means somebody got there first - and the right answer to that is to
-//!    skip it and say so, not to merge two installations.
-//! 3. **A symlink is skipped, not followed.** A junction inside `skills/` could point
-//!    anywhere, and a copy that follows one has left the home it was asked to read.
-
-use std::path::{Path, PathBuf};
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::{Arc, Mutex};
-use std::thread;
-
-use vn_shell_core::adopt::{self, Adoption};
-
-use crate::console::Console;
-
-/// What an Adopt run is doing, in words the panel may draw.
-#[derive(Clone, Debug, Default, PartialEq, Eq)]
-pub struct AdoptState {
-    pub running: bool,
-    /// The trees that were copied, in the order they were planned.
-    pub copied: Vec<String>,
-    /// How many files were copied.
-    pub files: usize,
-    /// How many files were left alone because the target already had them.
-    pub skipped: usize,
-    /// How many links were skipped rather than followed.
-    pub links: usize,
-    pub bytes: u64,
-    /// The first thing that went wrong, if anything did.
-    pub failed: Option<String>,
-    /// Whether this run took the credentials file with it.
-    pub with_credentials: bool,
-}
-
-impl AdoptState {
-    pub fn line(&self) -> String {
-        match (&self.failed, self.running, self.copied.is_empty()) {
-            (Some(error), _, _) => format!("[vncode] adopt FAILED: {error}"),
-            (None, true, _) => "[vncode] adopting...".to_string(),
-            (None, false, true) => "[vncode] nothing was adopted".to_string(),
-            (None, false, false) => format!(
-                "[vncode] adopted {} ({} file(s){}, {}{}{})",
-                self.copied.join(", "),
-                self.files,
-                if self.skipped > 0 {
-                    format!(", {} left alone", self.skipped)
-                } else {
-                    String::new()
-                },
-                human(self.bytes),
-                if self.with_credentials { ", credentials file included" } else { "" },
-                if self.links > 0 { ", links skipped" } else { "" }
-            ),
-        }
-    }
-}
-
-/// A small human size, so the log line reads like a person wrote it.
-fn human(bytes: u64) -> String {
-    const UNITS: [(&str, u64); 3] = [("GiB", 1 << 30), ("MiB", 1 << 20), ("KiB", 1 << 10)];
-    for (unit, scale) in UNITS {
-        if bytes >= scale {
-            return format!("{:.1} {unit}", bytes as f64 / scale as f64);
-        }
-    }
-    format!("{bytes} B")
-}
-
-/// The runner: one run at a time, one writer of the state, on its own thread.
-pub struct Adopt {
-    console: Arc<Console>,
-    state: Mutex<AdoptState>,
-    worker: Mutex<Option<thread::JoinHandle<()>>>,
-    running: AtomicBool,
-}
-
-impl Adopt {
-    pub fn new(console: Arc<Console>) -> Self {
-        Adopt {
-            console,
-            state: Mutex::new(AdoptState::default()),
-            worker: Mutex::new(None),
-            running: AtomicBool::new(false),
-        }
-    }
-
-    pub fn state(&self) -> AdoptState {
-        match self.state.lock() {
-            Ok(state) => state.clone(),
-            Err(poisoned) => poisoned.into_inner().clone(),
-        }
-    }
-
-    pub fn is_running(&self) -> bool {
-        self.running.load(Ordering::SeqCst)
-    }
-
-    /// Copy the planned trees, optionally taking the credential document too.
-    pub fn start(self: &Arc<Self>, adoption: Adoption, with_credentials: bool) -> Result<(), String> {
-        if self.is_running() {
-            return Err("an adopt run is already in flight".to_string());
-        }
-        if adoption.items.is_empty() && !with_credentials {
-            return Err("there is nothing to adopt from that home".to_string());
-        }
-        {
-            let mut state = self.state.lock().unwrap_or_else(|error| error.into_inner());
-            *state = AdoptState { running: true, with_credentials, ..AdoptState::default() };
-        }
-        self.running.store(true, Ordering::SeqCst);
-        let shell = Arc::clone(self);
-        let handle = thread::spawn(move || run(shell, adoption, with_credentials));
-        let mut slot = self.worker.lock().unwrap_or_else(|error| error.into_inner());
-        *slot = Some(handle);
-        Ok(())
-    }
-
-    /// Wait for a run in flight. The panel never calls this; a check does.
-    pub fn join(&self) {
-        let handle = self.worker.lock().unwrap_or_else(|error| error.into_inner()).take();
-        if let Some(handle) = handle {
-            let _ = handle.join();
-        }
-    }
-
-    fn finish(&self, change: impl FnOnce(&mut AdoptState)) {
-        {
-            let mut state = self.state.lock().unwrap_or_else(|error| error.into_inner());
-            state.running = false;
-            change(&mut state);
-        }
-        self.running.store(false, Ordering::SeqCst);
-        self.console.push(&self.state().line());
-    }
-}
-
-fn run(shell: Arc<Adopt>, adoption: Adoption, with_credentials: bool) {
-    shell.console.push(&format!("[vncode] {}", adoption.line()));
-    let mut copied = Vec::new();
-    let mut files = 0usize;
-    let mut skipped = 0usize;
-    let mut links = 0usize;
-    let mut bytes = 0u64;
-
-    for item in &adoption.items {
-        match copy_tree(&item.from, &item.to) {
-            Ok(report) => {
-                files += report.files;
-                skipped += report.skipped;
-                links += report.links;
-                bytes += report.bytes;
-                copied.push(item.name.to_string());
-                shell.console.push(&format!(
-                    "[vncode] adopted {} ({} file(s), {})",
-                    item.name,
-                    report.files,
-                    human(report.bytes)
-                ));
-            }
-            Err(error) => {
-                shell.finish(|state| {
-                    state.copied = copied;
-                    state.files = files;
-                    state.skipped = skipped;
-                    state.links = links;
-                    state.bytes = bytes;
-                    state.with_credentials = with_credentials;
-                    state.failed = Some(error);
-                });
-                return;
-            }
-        }
-    }
-
-    // The credentials file, when the person asked for it. A byte copy: the value is
-    // never parsed, never held, never drawn - which is what keeps `SECURITY.md`'s
-    // "presence only" promise true.
-    if with_credentials {
-        if let Some(from) = adoption.credential() {
-            let to = adoption.target.join(adopt::CREDENTIALS);
-            match copy_file(&from, &to) {
-                Ok(Some(written)) => {
-                    bytes += written;
-                    shell.console.push(
-                        "[vncode] the credentials file was copied - the key itself was never read",
-                    );
-                }
-                Ok(None) => shell.console.push(
-                    "[vncode] the credentials file was left alone: the chosen home already has one",
-                ),
-                Err(error) => {
-                    shell.finish(|state| {
-                        state.copied = copied;
-                        state.files = files;
-                        state.skipped = skipped;
-                        state.links = links;
-                        state.bytes = bytes;
-                        state.with_credentials = true;
-                        state.failed = Some(error);
-                    });
-                    return;
-                }
-            }
-        }
-    }
-
-    shell.finish(|state| {
-        state.copied = copied;
-        state.files = files;
-        state.skipped = skipped;
-        state.links = links;
-        state.bytes = bytes;
-        state.with_credentials = with_credentials;
-    });
-}
-
-/// What one tree's copy did.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-pub struct Report {
-    pub files: usize,
-    pub bytes: u64,
-    pub skipped: usize,
-    pub links: usize,
-}
-
-/// Copy a tree, creating directories and never overwriting a file.
-fn copy_tree(from: &Path, to: &Path) -> Result<Report, String> {
-    let mut report = Report::default();
-    if !from.is_dir() {
-        return Err(format!("{} is not a directory any more", from.display()));
-    }
-    let mut stack = vec![(from.to_path_buf(), to.to_path_buf())];
-    while let Some((source, target)) = stack.pop() {
-        std::fs::create_dir_all(&target)
-            .map_err(|error| format!("could not create {}: {error}", target.display()))?;
-        let entries = std::fs::read_dir(&source)
-            .map_err(|error| format!("could not read {}: {error}", source.display()))?;
-        for entry in entries.flatten() {
-            let path = entry.path();
-            let destination = target.join(entry.file_name());
-            let Ok(meta) = entry.metadata() else {
-                continue;
-            };
-            // A link is skipped, not followed: see this module's header.
-            let is_link = std::fs::symlink_metadata(&path)
-                .map(|meta| meta.file_type().is_symlink())
-                .unwrap_or(false);
-            if is_link {
-                report.links += 1;
-                continue;
-            }
-            if meta.is_dir() {
-                stack.push((path, destination));
-            } else {
-                match copy_file(&path, &destination)? {
-                    Some(bytes) => {
-                        report.files += 1;
-                        report.bytes += bytes;
-                    }
-                    None => report.skipped += 1,
-                }
-            }
-        }
-    }
-    Ok(report)
-}
-
-/// Copy one file. `Ok(None)` means the target already had it.
-fn copy_file(from: &Path, to: &Path) -> Result<Option<u64>, String> {
-    if to.exists() {
-        return Ok(None);
-    }
-    if let Some(parent) = to.parent() {
-        std::fs::create_dir_all(parent)
-            .map_err(|error| format!("could not create {}: {error}", parent.display()))?;
-    }
-    let written = std::fs::copy(from, to)
-        .map_err(|error| format!("could not copy {} to {}: {error}", from.display(), to.display()))?;
-    Ok(Some(written))
-}
-
-/// The app root a home sits inside, for the panel's own row.
-pub fn root_of(home: &Path) -> Option<PathBuf> {
-    home.parent().map(Path::to_path_buf)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn scratch(name: &str) -> PathBuf {
-        let root = match std::env::var_os("VNCODE_TEST_DIR") {
-            Some(value) if !value.is_empty() => PathBuf::from(value),
-            _ => std::env::temp_dir(),
-        };
-        let path = root.join(format!("vncode-adoptrun-{}-{name}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&path);
-        std::fs::create_dir_all(&path).unwrap();
-        path
-    }
-
-    #[test]
-    fn a_tree_is_copied_and_nothing_in_the_source_changes() {
-        let root = scratch("copy");
-        let source = root.join(".dsh").join("skills");
-        std::fs::create_dir_all(source.join("mermaid-diagrams")).unwrap();
-        std::fs::write(source.join("mermaid-diagrams").join("SKILL.md"), b"# diagrams").unwrap();
-        let target = root.join("home").join("skills");
-
-        let report = copy_tree(&source, &target).unwrap();
-        assert_eq!(report.files, 1);
-        assert_eq!(report.bytes, 10);
-        assert!(target.join("mermaid-diagrams").join("SKILL.md").is_file());
-        // ...and the source is untouched.
-        assert!(source.join("mermaid-diagrams").join("SKILL.md").is_file());
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn a_file_that_is_already_there_is_never_overwritten() {
-        let root = scratch("no-overwrite");
-        let source = root.join("from");
-        let target = root.join("to");
-        std::fs::create_dir_all(&source).unwrap();
-        std::fs::create_dir_all(&target).unwrap();
-        std::fs::write(source.join("a.txt"), b"NEW").unwrap();
-        std::fs::write(target.join("a.txt"), b"OLD").unwrap();
-
-        let report = copy_tree(&source, &target).unwrap();
-        assert_eq!(report.files, 0);
-        assert_eq!(report.skipped, 1);
-        assert_eq!(std::fs::read(target.join("a.txt")).unwrap(), b"OLD");
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn the_credentials_file_is_copied_byte_for_byte_and_never_parsed() {
-        let root = scratch("credentials");
-        let source = root.join(".dsh");
-        std::fs::create_dir_all(source.join("skills")).unwrap();
-        let secret_looking = b"deepseek:\n  apiKey: not-a-real-key\n";
-        std::fs::write(source.join(adopt::CREDENTIALS), secret_looking).unwrap();
-
-        let adoption = adopt::plan(&source, &root.join("home"));
-        let console = Arc::new(Console::new());
-        let runner = Arc::new(Adopt::new(Arc::clone(&console)));
-        runner.start(adoption, true).unwrap();
-        runner.join();
-
-        let state = runner.state();
-        assert!(state.failed.is_none(), "{state:?}");
-        assert!(state.with_credentials);
-        let written = std::fs::read(root.join("home").join(adopt::CREDENTIALS)).unwrap();
-        assert_eq!(written, secret_looking, "the copy must be byte-for-byte");
-        // The transcript says what happened and never a value.
-        let log = console.tail(20).join("\n");
-        assert!(log.contains("never read"), "{log}");
-        assert!(!log.contains("not-a-real-key"), "a credential value reached the log: {log}");
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn a_run_that_cannot_start_reports_rather_than_pretends() {
-        let console = Arc::new(Console::new());
-        let runner = Arc::new(Adopt::new(console));
-        let empty = adopt::Adoption {
-            source: PathBuf::from("/nowhere"),
-            target: PathBuf::from("/nowhere-else"),
-            items: Vec::new(),
-        };
-        assert!(runner.start(empty, false).is_err());
-        assert!(!runner.is_running());
-    }
-
-    #[test]
-    fn a_failed_tree_is_reported_and_does_not_take_the_run_down_quietly() {
-        let root = scratch("failed");
-        let adoption = adopt::Adoption {
-            source: root.clone(),
-            target: root.join("home"),
-            items: vec![adopt::Item {
-                name: "sessions",
-                note: "a tree that is not there",
-                from: root.join("absent"),
-                to: root.join("home").join("sessions"),
-            }],
-        };
-        let console = Arc::new(Console::new());
-        let runner = Arc::new(Adopt::new(Arc::clone(&console)));
-        runner.start(adoption, false).unwrap();
-        runner.join();
-        let state = runner.state();
-        assert!(state.failed.is_some(), "{state:?}");
-        assert!(console.tail(10).join("\n").contains("adopt FAILED"));
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn the_line_is_human_and_says_what_was_adopted() {
-        let state = AdoptState {
-            running: false,
-            copied: vec!["skills".into(), "sessions".into()],
-            files: 12,
-            skipped: 2,
-            links: 1,
-            bytes: 2 * 1024 * 1024,
-            failed: None,
-            with_credentials: true,
-        };
-        let line = state.line();
-        assert!(line.contains("skills, sessions"), "{line}");
-        assert!(line.contains("12 file(s)"), "{line}");
-        assert!(line.contains("2 left alone"), "{line}");
-        assert!(line.contains("2.0 MiB"), "{line}");
-        assert!(line.contains("credentials file included"), "{line}");
-        assert!(line.contains("links skipped"), "{line}");
-    }
-}
diff --git a/app/crates/vn-shell-runtime/src/env.rs b/app/crates/vn-shell-runtime/src/env.rs
index 34796ea..d160974 100644
--- a/app/crates/vn-shell-runtime/src/env.rs
+++ b/app/crates/vn-shell-runtime/src/env.rs
@@ -115,6 +115,28 @@ impl ChildEnv {
         }
         parts.join(" · ")
     }
+
+    /// The same composition, as a console SENTENCE rather than an inspector row.
+    ///
+    /// `PATH` is left out on purpose: the inherited path on an ordinary machine is a
+    /// thousand characters of somebody else's installers, and printing it on every run
+    /// buries the four variables this app actually decided. `status` prints the whole line
+    /// for anyone who wants it.
+    pub fn summary(&self) -> String {
+        let mut parts: Vec<String> = self
+            .pairs
+            .iter()
+            .filter(|(name, _)| !name.eq_ignore_ascii_case("PATH"))
+            .map(|(name, value)| {
+                format!("{}={}", name.to_string_lossy(), value.to_string_lossy())
+            })
+            .collect();
+        if self.pairs.iter().any(|(name, _)| name.eq_ignore_ascii_case("PATH")) {
+            parts.push("PATH=composed".to_string());
+        }
+        parts.push(format!("{} console markers removed", self.removed.len()));
+        parts.join(" · ")
+    }
 }
 
 /// Everything the composer needs, as plain values - so the composition is a `cargo
diff --git a/app/crates/vn-shell-runtime/src/lib.rs b/app/crates/vn-shell-runtime/src/lib.rs
index 0327354..667a00a 100644
--- a/app/crates/vn-shell-runtime/src/lib.rs
+++ b/app/crates/vn-shell-runtime/src/lib.rs
@@ -1,72 +1,38 @@
-//! The supervisor: everything that owns a process.
+//! Everything that decides WHICH harness this app runs against, and nothing that owns a
+//! process.
 //!
-//! One thread owns one child. The panel does not kill anything itself and does not
-//! write the status itself - it sends an ORDER and reads what the worker recorded.
-//! That is the whole design, and it is why there is exactly one writer of
-//! [`Status`]: two writers would be two answers to "is it running", and the panel
-//! would eventually disagree with the process table.
+//! The app is a front door, not a supervisor: it resolves the root, the home, the pin and
+//! the child's environment, and then it runs `scripts/run-web.*` - the same file a person
+//! double-clicks - in the foreground. So there is no worker thread, no status record and no
+//! tree-killer here any more: Ctrl+C reaches the launcher because it is the process the
+//! console already has, and the launcher owns the node child exactly as it does when it is
+//! started by hand.
 //!
-//! The lifetime this implements is the one docs/PLAN-egui-shell.md describes:
-//!
-//! ```text
-//! open        nothing is spawned, nothing is bound, no pane exists
-//! Start       choose the port, spawn, watch the ready line (90 s)
-//! Running     the URL is known; the pane or the browser shows it
-//! Stop        the WHOLE tree dies, and the port is then CHECKED, not assumed
-//! ```
+//! What is left is the half a person cannot see and a check can: [`plan`], which answers
+//! "which home, which pin, which cache, which temp" before anything is spawned.
 
-use std::io::{BufRead, BufReader};
 use std::path::{Path, PathBuf};
-use std::process::{Child, Command, Stdio};
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::mpsc::{self, RecvTimeoutError, Sender};
-use std::sync::{Arc, Mutex};
-use std::thread;
-use std::time::Duration;
 
-use url::Url;
-use vn_shell_core::status::{Phase, Status};
-use vn_shell_core::{home, keystate, launch, options::Options, ports, readyline};
+use vn_shell_core::{home, launch, options::Options, ports};
 
-pub mod adopt;
 pub mod console;
 pub mod env;
 pub mod setup;
-pub mod view;
 
-pub use adopt::{Adopt, AdoptState};
 pub use console::Console;
 pub use env::ChildEnv;
 pub use setup::{EntryPoints, Setup, SetupKind, SetupStatus};
-pub use view::View;
-
-/// How long to wait for the ready line.
-///
-/// Generous on purpose, and this number is about the SLOW path: with no vendored
-/// runtime, the first launch of a pin downloads the whole harness closure through
-/// npx before a server exists. Ninety seconds was the old launcher's number and it
-/// is tight for a cold fetch on an ordinary connection; three minutes is not a
-/// hang, and it is not a wait anybody is trapped in either - the panel shows the
-/// installer's and npm's output as it arrives, and Stop works during it.
-pub const READY_TIMEOUT: Duration = Duration::from_secs(180);
-
-/// How often the worker looks at the child, and how long the panel may go without
-/// a repaint of the status.
-pub const POLL_INTERVAL: Duration = Duration::from_millis(500);
-
-/// How long a stopped tree is given to die before it is killed outright.
-pub const STOP_GRACE: Duration = Duration::from_secs(5);
 
 // ---------------------------------------------------------------------------
-// The plan: what Start will do, decided before anything is spawned
+// The plan: what a start will act on, decided before anything is spawned
 // ---------------------------------------------------------------------------
-/// Everything the panel shows before Start, and everything Start then acts on.
+/// Everything the app decided before it runs a script, and every fact it prints.
 #[derive(Clone, Debug)]
 pub struct Plan {
     pub version: String,
     pub launch: launch::Launch,
     /// Where the app's root and the harness home are, and what had to be refused.
-    /// Since M0 this is a ladder's answer rather than an inherited path.
+    /// A ladder's answer rather than an inherited path.
     pub home: home::Resolution,
     /// The npm cache a child is given, chosen by writing where npm really writes.
     pub npm_cache: Option<vn_shell_core::appdata::CacheChoice>,
@@ -81,12 +47,11 @@ pub struct Plan {
     /// The checkout or distribution root, when one was found. Carried here so the
     /// launch decision and the npm-cache choice see the same facts.
     pub root: Option<PathBuf>,
-    /// What [`ports::choose_port`] answers right now. A HINT: Start really does
-    /// choose again, because a port that was free when the panel opened may be
-    /// held by the time Start is pressed.
+    /// What [`ports::choose_port`] answers right now. A HINT: the harness really does
+    /// choose again, because a port that was free when this app looked may be held by
+    /// the time the launcher starts.
     pub port_hint: Option<u16>,
-    /// Lines worth printing and worth showing in the panel: a refused home, a
-    /// missing pack, a half-vendored runtime, a cache that had to move.
+    /// Lines worth printing: a refused home, a missing pack, a cache that had to move.
     pub notes: Vec<String>,
 }
 
@@ -96,41 +61,28 @@ impl Plan {
         self.home.home_path()
     }
 
-    /// The app's own root - what the panel's `vncode` row draws.
+    /// The app's own root.
     pub fn app_root(&self) -> Option<&Path> {
         self.home.app_root_path()
     }
 
-    /// The composed environment, as one line. What the panel's `harness env` row
-    /// draws, and what the log records before a child is spawned.
+    /// The composed environment, as one line - the whole thing, `PATH` included.
     pub fn env_line(&self) -> String {
         env::for_plan(self).line()
     }
 
-    /// The app root's own words, for the panel's `vncode` row.
-    pub fn app_root_origin_label(&self) -> &'static str {
-        self.home.app_root_origin_label()
-    }
-
-    /// Whether the home in use was created by this app - the panel says so, because
-    /// "I made this" and "I joined this" are different promises.
-    pub fn home_created(&self) -> bool {
-        self.home.home_created()
+    /// The same composition as a console sentence: the four variables this app decided,
+    /// and a marker count instead of the machine's thousand-character `PATH`.
+    pub fn env_summary(&self) -> String {
+        env::for_plan(self).summary()
     }
 
-    /// The home somebody chose in this panel, when there is one, so a Start can be
-    /// given it without the panel re-reading its own preferences file.
-    pub fn remembered_home(&self) -> Option<&Path> {
-        self.home
-            .home
-            .as_ref()
-            .filter(|selection| selection.origin == home::Origin::Remembered)
-            .map(|selection| selection.chosen.as_path())
+    /// The app root's own words.
+    pub fn app_root_origin_label(&self) -> &'static str {
+        self.home.app_root_origin_label()
     }
-}
 
-impl Plan {
-    /// One line naming what will actually run - never what was hoped for.
+    /// One line naming what the launcher will actually run - never what was hoped for.
     pub fn runtime_line(&self) -> String {
         match &self.launch {
             launch::Launch::Vendored { node, .. } => {
@@ -145,46 +97,24 @@ impl Plan {
             }
         }
     }
-
-    /// How the harness will be started, in the words the panel and the console
-    /// both use.
-    pub fn start_line(&self, port: u16) -> String {
-        match &self.launch {
-            launch::Launch::Vendored { .. } => format!(
-                "[vncode] starting the harness on 127.0.0.1:{port} (vendored runtime, no npx)"
-            ),
-            launch::Launch::Npx => format!(
-                "[vncode] starting the harness on 127.0.0.1:{port} (npx --yes @deepseek-ai/dsh@{} web --no-open)",
-                self.version
-            ),
-            launch::Launch::Installed { bin, .. } => format!(
-                "[vncode] starting the harness on 127.0.0.1:{port} (the installation this machine already has at {}, so no npm and no network)",
-                bin.display()
-            ),
-            launch::Launch::Stub { .. } => format!(
-                "[vncode] starting the STUB on 127.0.0.1:{port} (VNCODE_STUB_CLI is set - this is a check, not a harness)"
-            ),
-        }
-    }
 }
 
-/// Decide everything Start needs, without spawning anything.
+/// Decide everything a start needs, without spawning anything.
 ///
-/// The ladders are resolved HERE, by writing where the harness will write, so the
-/// panel can say "this home was refused, this one is in use" the moment it opens
-/// rather than after a three-minute wait for a ready line that cannot arrive.
+/// The ladders are resolved HERE, by writing where the harness will write, so the app can
+/// say "this home was refused, this one is in use" the moment it opens rather than after a
+/// three-minute wait for a ready line that cannot arrive.
 ///
-/// `remembered` is the home somebody chose in the panel (read from the app root by
-/// the caller): it sits above the inherited `DSH_HOME` and below `-DshHome`.
+/// `remembered` is a home chosen by an earlier build of this app: it sits above the
+/// inherited `DSH_HOME` and below `-DshHome`.
 pub fn plan(options: &Options, remembered: Option<&Path>) -> Result<Plan, String> {
     let root = launch::repo_root();
     let version = launch::resolve_version(options)?;
-    // NOTHING OUTSIDE THIS APP'S OWN ROOT IS EVER THE HOME. The "installation already on
-    // this machine" rung is gone: a folder that carries everything it needs must not
-    // reach into a person's profile to start, and the two things that rung answered - a
-    // home with no pack, and a home with no key - are answered by Start (which installs
-    // the pack into the home in use) and by the key row. `~/.dsh` survives as the source
-    // of the COPY offer alone, which only reads.
+    // NOTHING OUTSIDE THIS APP'S OWN ROOT IS EVER THE HOME. A folder that carries
+    // everything it needs must not reach into a person's profile to start, and the two
+    // things a home outside it answered - a home with no pack, and a home with no key -
+    // are answered by this command (which installs the pack into the home in use) and by
+    // the key prompt.
     let resolved = home::from_env(options.dsh_home.as_deref(), remembered);
     let chosen = launch::choose_launch(
         root.as_deref(),
@@ -193,9 +123,8 @@ pub fn plan(options: &Options, remembered: Option<&Path>) -> Result<Plan, String
         &version,
     );
     let mut notes = resolved.notes();
-    // The preflight, as a NOTE here rather than a refusal: the panel says it the
-    // moment it opens. Only an explicit `-DshHome` actually stops a Start (see
-    // `Supervisor::start`).
+    // The preflight, as a NOTE here rather than a refusal: only an explicit `-DshHome`
+    // actually stops a run (see `home::Resolution::problem`).
     if let Some(problem) = resolved.problem() {
         notes.push(problem);
     }
@@ -216,10 +145,6 @@ pub fn plan(options: &Options, remembered: Option<&Path>) -> Result<Plan, String
     if let Some(note) = cache_note {
         notes.push(note);
     }
-    // ...and a temp directory the child can write in. The machine's is preferred and
-    // left alone when it works; it is moved only for the measured case where a
-    // confinement grants this app its own root and denies `%TEMP%` to the process
-    // under it - which is how the harness's `dsh-spill-local` row failed to activate.
     let (temp, temp_note) = env::choose_temp(
         resolved.app_root_path(),
         vn_shell_core::appdata::machine_temp(),
@@ -241,28 +166,22 @@ pub fn plan(options: &Options, remembered: Option<&Path>) -> Result<Plan, String
     })
 }
 
-/// A friendly nudge, never a refusal - the harness runs fine without the pack, so
-/// a profile that never had it installed still starts, just unadorned. This is the
-/// same warning `run-web.ps1` prints, from the same source of truth: the web
-/// profile's own bundle list.
-///
-/// The words name the PANEL's own controls, which is where a reader of this note is
-/// standing: **Start** installs the pack into THIS home before it starts the harness, and
-/// **Install pack here** does the same on demand. Measured on a real run: the note said
-/// "run scripts/setup/install.bat" to somebody looking at a window that has a button for
-/// it, and the app went on looking broken.
+/// A friendly nudge, never a refusal - the harness runs fine without the pack, so a
+/// profile that never had it installed still starts, just unadorned. This is the same
+/// warning `run-web.ps1` prints, from the same source of truth: the web profile's own
+/// bundle list.
 ///
-/// NO MARKDOWN, and that is a rule rather than a preference: this string is drawn with
-/// `ui.label`, so `**Install pack**` reaches the reader as literal asterisks - measured
-/// on the first-run screen, beside the cards. Emphasis belongs in the docs, not in a
-/// sentence a person reads in the window.
+/// The words name a command the reader can actually run. They used to name a button on a
+/// window this app no longer opens, which is the same mistake in a different costume.
 pub fn missing_pack_note(home: Option<&Path>, profile: &str) -> Option<String> {
     let home = home?;
     let profile_dir = home.join("profiles").join(profile);
     let manifest = profile_dir.join("package.json");
     if !manifest.is_file() {
         return Some(format!(
-            "there is no {profile} profile at {} yet, so the harness will come up unadorned. Start installs this pack into THIS home first, or press Install pack here on the pack row",
+            "there is no {profile} profile at {} yet, so the harness will come up unadorned. \
+             `vncode install` puts this pack into THIS home first, and so does a plain \
+             `vncode start`",
             profile_dir.display()
         ));
     }
@@ -281,556 +200,28 @@ pub fn missing_pack_note(home: Option<&Path>, profile: &str) -> Option<String> {
         None
     } else {
         Some(format!(
-            "the {profile} profile at {} does not list this pack's bundles, so the harness comes up unadorned (no right bar, no editor, no themes). Start installs them into THIS home first (or press Install pack here on the pack row). To run the home that already has them instead, press Change and choose it",
+            "the {profile} profile at {} does not list this pack's bundles, so the harness \
+             comes up unadorned (no right bar, no editor, no themes). `vncode install` adds \
+             them to THIS home, and so does a plain `vncode start`",
             profile_dir.display()
         ))
     }
 }
 
-// ---------------------------------------------------------------------------
-// The supervisor
-// ---------------------------------------------------------------------------
-/// The order the panel sends to the worker. There are only two.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-enum Order {
-    /// Take the tree down, check the port, and leave the app idle.
-    Stop,
-}
-
-/// What Stop found.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct StopOutcome {
-    /// Whether the port the harness held is free again. This is measured with a
-    /// bind, never assumed from the kill's exit code.
-    pub port_free: bool,
-    /// The port that was checked, when there was one.
-    pub port: Option<u16>,
-}
-
-impl StopOutcome {
-    /// The line `check-shell.mjs` reads, and the one a reader wants.
-    pub fn line(&self) -> String {
-        match (self.port, self.port_free) {
-            (Some(port), true) => format!("[vncode] stopped port={port} free=yes"),
-            (Some(port), false) => format!("[vncode] stopped port={port} free=no"),
-            (None, _) => "[vncode] stopped (nothing was running)".to_string(),
-        }
-    }
-}
-
-pub struct Supervisor {
-    status: Mutex<Status>,
-    /// The transcript the panel draws. Shared with the installer, so there is one
-    /// log and one place that redacts.
-    console: Arc<Console>,
-    worker: Mutex<Option<thread::JoinHandle<()>>>,
-    orders: Mutex<Option<Sender<Order>>>,
-    /// Read by the worker's loop and by `stop()`, so a second Stop is a no-op
-    /// rather than a second kill aimed at a recycled pid.
-    live: AtomicBool,
-}
-
-impl Supervisor {
-    pub fn new(console: Arc<Console>) -> Self {
-        Supervisor {
-            status: Mutex::new(Status::idle()),
-            console,
-            worker: Mutex::new(None),
-            orders: Mutex::new(None),
-            live: AtomicBool::new(false),
-        }
-    }
-
-    /// The panel's whole view of the instance.
-    pub fn status(&self) -> Status {
-        match self.status.lock() {
-            Ok(status) => status.clone(),
-            Err(poisoned) => poisoned.into_inner().clone(),
-        }
-    }
-
-    pub fn log_tail(&self, count: usize) -> Vec<String> {
-        self.console.tail(count)
-    }
-
-    /// A cursor for [`Supervisor::log_since`]: the console's place in the log.
-    pub fn log_position(&self) -> u64 {
-        self.console.position()
-    }
-
-    /// Every line pushed since `position`, so a console can follow the log
-    /// without printing a line twice or skipping one.
-    pub fn log_since(&self, position: u64) -> Vec<String> {
-        self.console.since(position)
-    }
-
-    pub fn is_live(&self) -> bool {
-        self.live.load(Ordering::SeqCst)
-    }
-
-    fn push_log(&self, line: &str) {
-        self.console.push(line);
-    }
-
-    fn with_status(&self, change: impl FnOnce(&mut Status)) {
-        match self.status.lock() {
-            Ok(mut status) => change(&mut status),
-            Err(poisoned) => change(&mut poisoned.into_inner()),
-        }
-    }
-
-    fn fail(&self, message: impl Into<String>) {
-        let message = message.into();
-        self.with_status(|status| status.mark_failed(message.clone()));
-        self.push_log(&format!("[vncode] {message}"));
-        self.live.store(false, Ordering::SeqCst);
-    }
-
-    /// Start the pinned harness. Returns as soon as the worker is running; the
-    /// panel follows the status from there.
-    pub fn start(self: &Arc<Self>, options: Options, remembered: Option<PathBuf>) -> Result<(), String> {
-        if self.is_live() {
-            return Err("the harness is already running - press Stop first".to_string());
-        }
-        // The plan is resolved HERE, on the caller's thread, so a bad pin or an
-        // unusable home is reported synchronously instead of appearing as a
-        // failed thread a moment later.
-        let plan = plan(&options, remembered.as_deref())?;
-        // ...and a home that cannot be used is refused BEFORE anything is spawned.
-        // Only an explicit `-DshHome` gets here: every other candidate falls through
-        // the ladder to a home this app creates, which is the whole point of M0.
-        if let Some(problem) = plan.home.problem() {
-            return Err(problem);
-        }
-        let (orders, inbox) = mpsc::channel::<Order>();
-        self.live.store(true, Ordering::SeqCst);
-        {
-            let mut slot = self.orders.lock().unwrap_or_else(|error| error.into_inner());
-            *slot = Some(orders);
-        }
-        let shell = Arc::clone(self);
-        let handle = thread::spawn(move || work(shell, options, plan, inbox));
-        let mut slot = self.worker.lock().unwrap_or_else(|error| error.into_inner());
-        *slot = Some(handle);
-        Ok(())
-    }
-
-    /// Stop the tree, wait for it, and CHECK the port.
-    ///
-    /// Blocking on purpose: this is what makes "Stop" a claim with evidence
-    /// behind it, and what lets `check-shell.mjs` assert the port is free the
-    /// moment the process exits.
-    pub fn stop(&self) -> StopOutcome {
-        if let Some(orders) = self.orders.lock().unwrap_or_else(|error| error.into_inner()).take() {
-            let _ = orders.send(Order::Stop);
-        }
-        if let Some(handle) =
-            self.worker.lock().unwrap_or_else(|error| error.into_inner()).take()
-        {
-            let _ = handle.join();
-        }
-        let status = self.status();
-        StopOutcome { port_free: status.port_free.unwrap_or(true), port: status.port }
-    }
-}
-
-/// The worker: one child, one owner, one writer of the status.
-fn work(shell: Arc<Supervisor>, options: Options, plan: Plan, inbox: mpsc::Receiver<Order>) {
-    let Some(port) = ports::choose_port(&options) else {
-        shell.fail("could not find a free loopback port to listen on");
-        return;
-    };
-    shell.with_status(|status| {
-        status.port = Some(port);
-        status.phase = Phase::Starting;
-        status.detail = Some(plan.runtime_line());
-    });
-    shell.push_log(&format!("[vncode] Pinned dsh version: {}", plan.version));
-    let (path, why) = plan.home.row();
-    shell.push_log(&format!("[vncode] DSH_HOME: {path} ({why})"));
-    shell.push_log(&keystate::console_line(&keystate::read(plan.home_path())));
-    for note in &plan.notes {
-        shell.push_log(&format!("[vncode] note: {note}"));
-    }
-
-    let spec = launch::program_and_args(&plan.launch, &plan.version, port);
-    let mut command = Command::new(&spec.program);
-    command.args(&spec.args).stdin(Stdio::null()).stdout(Stdio::piped()).stderr(Stdio::piped());
-
-    // Its own process group, so Stop can signal the WHOLE tree - npx, the shell it
-    // spawns and the node under both - with one call. Without this the POSIX half
-    // has only the direct child, and killing that leaves a `node` holding the port.
-    #[cfg(unix)]
-    {
-        use std::os::unix::process::CommandExt;
-        command.process_group(0);
-    }
-    // ...and, on Linux, the kernel's own answer to "the shell was killed outright":
-    // the child dies with the parent thread that forked it, whatever the parent died
-    // of. On macOS the process group above is the whole answer.
-    arm_parent_death_signal(&mut command);
-
-    // THE CHILD'S ENVIRONMENT IS COMPOSED, NEVER INHERITED. One composer builds it -
-    // `DSH_HOME`, the npm cache, `PATH`, the working directory, and the console
-    // markers removed - so a variable cannot be set for the harness and forgotten for
-    // the installer. See `env`'s header for the measured bugs behind each row.
-    let composed = env::for_plan(&plan);
-    composed.apply(&mut command);
-    shell.push_log(&format!("[vncode] child environment: {}", composed.line()));
-
-    shell.push_log(&plan.start_line(port));
-
-    let mut child = match command.spawn() {
-        Ok(child) => child,
-        Err(error) => {
-            shell.fail(format!(
-                "could not run {}: {error}. Install Node.js 22 or newer, or build the vendored runtime with scripts/tools/vendor.ps1.",
-                spec.program.to_string_lossy()
-            ));
-            return;
-        }
-    };
-    // Before anything else can go wrong: make the harness die with this shell.
-    confine_to_job(&child);
-    let pid = child.id();
-    shell.with_status(|status| status.pid = Some(pid));
-
-    let stdout = child.stdout.take();
-    let stderr = child.stderr.take();
-    let (ready_tx, ready_rx) = mpsc::channel::<Url>();
-    if let Some(stdout) = stdout {
-        drain(shell.clone(), stdout, Some(ready_tx));
-    }
-    if let Some(stderr) = stderr {
-        drain(shell.clone(), stderr, None);
-    }
-
-    // The ready line - watched in short slices rather than in one 90-second
-    // block, so that STOP CAN INTERRUPT A SLOW START. That is not a nicety: the
-    // first run of an unvendored pin can spend a minute inside npx, and a Stop
-    // button that does nothing for a minute is a button that lies. The same loop
-    // is what lets a refusal (a ready line naming a foreign host) be followed by
-    // an orderly stop instead of a 90-second wait.
-    let deadline = std::time::Instant::now() + READY_TIMEOUT;
-    let mut ready: Option<Url> = None;
-    let mut stopped_while_starting = false;
-    loop {
-        match ready_rx.recv_timeout(Duration::from_millis(200)) {
-            Ok(url) => {
-                ready = Some(url);
-                break;
-            }
-            // Every sender is gone: the drain thread ends with the pipe, so this is
-            // "the child stopped", not "it hung".
-            Err(RecvTimeoutError::Disconnected) => break,
-            Err(RecvTimeoutError::Timeout) => {
-                if matches!(inbox.try_recv(), Ok(Order::Stop) | Err(mpsc::TryRecvError::Disconnected))
-                {
-                    stopped_while_starting = true;
-                    break;
-                }
-                if std::time::Instant::now() >= deadline {
-                    break;
-                }
-            }
-        }
-    }
-
-    if stopped_while_starting {
-        shell.with_status(|status| status.phase = Phase::Stopping);
-        shell.push_log("[vncode] stopping the harness before it was ready");
-        kill_tree(&mut child);
-        let free = ports::port_is_free(port) && ports::port_is_unanswered(port);
-        shell.with_status(|status| status.mark_stopped(free));
-        shell.push_log(&shell.status().safe_line());
-        shell.live.store(false, Ordering::SeqCst);
-        return;
-    }
-
-    match ready {
-        Some(url) => {
-            shell.with_status(|status| status.mark_running(url.clone(), Some(pid)));
-            shell.push_log("[vncode] the harness is ready; the launch token stays in memory");
-            shell.push_log(&shell.status().safe_line());
-        }
-        None => {
-            // Two ways to get here, and the child itself says which: it exited
-            // before printing a ready line, or it is still running and the clock
-            // ran out.
-            let exited = child.try_wait().ok().flatten();
-            kill_tree(&mut child);
-            match exited {
-                Some(exit) => shell.fail(format!(
-                    "the harness stopped before it printed a ready line{}",
-                    exit.code().map(|code| format!(" (exit code {code})")).unwrap_or_default()
-                )),
-                None => shell.fail(format!(
-                    "the harness did not print its ready line within {} seconds. See the log.",
-                    READY_TIMEOUT.as_secs()
-                )),
-            }
-            return;
-        }
-    }
-
-    // From here the worker is a loop with three ways out: an order, the child
-    // dying on its own, or this process ending.
-    let mut stopped_by_order = false;
-    loop {
-        match inbox.recv_timeout(POLL_INTERVAL) {
-            Ok(Order::Stop) => {
-                stopped_by_order = true;
-                break;
-            }
-            Err(RecvTimeoutError::Timeout) => {}
-            // The panel dropped the sender: treat it as an order to stop, which is
-            // what closing the window means.
-            Err(RecvTimeoutError::Disconnected) => {
-                stopped_by_order = true;
-                break;
-            }
-        }
-        if let Ok(Some(exit)) = child.try_wait() {
-            shell.push_log(&format!(
-                "[vncode] the harness exited on its own{}",
-                exit.code().map(|code| format!(" (exit code {code})")).unwrap_or_default()
-            ));
-            break;
-        }
-    }
-
-    if stopped_by_order {
-        shell.with_status(|status| status.phase = Phase::Stopping);
-        shell.push_log("[vncode] stopping the harness");
-    }
-    kill_tree(&mut child);
-
-    // The measurement, not the assumption: the port is asked whether it is free
-    // again - and whether anything ANSWERS on it, which is the stronger question now
-    // that the app takes a port of its own. A kill that returns success while a
-    // grandchild survives is exactly the failure this catches.
-    let free = ports::port_is_free(port) && ports::port_is_unanswered(port);
-    shell.with_status(|status| status.mark_stopped(free));
-    shell.push_log(&shell.status().safe_line());
-    shell.live.store(false, Ordering::SeqCst);
-}
-
-/// Drain one of the child's streams: every line is redacted into the log, and the
-/// first loopback ready URL is handed to the worker.
-///
-/// Both streams must keep being drained for as long as the harness runs - a pipe
-/// nobody reads fills up and blocks the process writing to it.
-fn drain<R: std::io::Read + Send + 'static>(
-    shell: Arc<Supervisor>,
-    reader: R,
-    ready: Option<Sender<Url>>,
-) {
-    thread::spawn(move || {
-        let mut reported = false;
-        for line in BufReader::new(reader).lines().map_while(Result::ok) {
-            shell.push_log(&line);
-            if reported {
-                continue;
-            }
-            let Some(sender) = ready.as_ref() else {
-                continue;
-            };
-            let Some(candidate) = readyline::extract_ready_url(&line) else {
-                continue;
-            };
-            match Url::parse(&candidate) {
-                Ok(url) if url.host_str().map(readyline::is_loopback_host).unwrap_or(false) => {
-                    if sender.send(url).is_ok() {
-                        reported = true;
-                    }
-                }
-                Ok(_) => {
-                    shell.push_log(
-                        "[vncode] the harness printed a URL that does not name a loopback address; it was NOT opened",
-                    );
-                }
-                Err(error) => shell.push_log(&format!(
-                    "[vncode] the harness printed a URL this shell could not parse: {error}"
-                )),
-            }
-        }
-    });
-}
-
-// ---------------------------------------------------------------------------
-// Taking the tree down
-// ---------------------------------------------------------------------------
-/// Stop the harness, and everything npx started underneath it.
-///
-/// `npx` is a launcher: the process this shell spawned is a shell script or a
-/// `cmd.exe` wrapper whose child is the harness itself, so killing the direct child
-/// alone would leave a `node` holding the port. Windows gets the whole tree from
-/// `taskkill /T`; elsewhere the child was given its own process GROUP at spawn, so
-/// one signal reaches every process in it.
-pub fn kill_tree(child: &mut Child) {
-    let pid = child.id();
-
-    #[cfg(target_os = "windows")]
-    {
-        let _ = Command::new("taskkill")
-            .args(["/PID", &pid.to_string(), "/T", "/F"])
-            .stdin(Stdio::null())
-            .stdout(Stdio::null())
-            .stderr(Stdio::null())
-            .status();
-    }
-    #[cfg(unix)]
-    {
-        // SAFETY: `kill` is called with a negative pid, which is the documented
-        // "signal this process group" form, and the group id is the child's own
-        // pid because it was made a group leader at spawn (`process_group(0)`).
-        // The return value is deliberately ignored: a group that is already gone
-        // is the ordinary case here, not an error.
-        unsafe {
-            libc::kill(-(pid as i32), libc::SIGTERM);
-        }
-        let deadline = std::time::Instant::now() + STOP_GRACE;
-        while std::time::Instant::now() < deadline {
-            if matches!(child.try_wait(), Ok(Some(_))) {
-                break;
-            }
-            thread::sleep(Duration::from_millis(50));
-        }
-        unsafe {
-            libc::kill(-(pid as i32), libc::SIGKILL);
-        }
-    }
-
-    let _ = child.kill();
-    let _ = child.wait();
-}
-
-/// Put the harness in a Job Object that kills everything in it when this shell
-/// dies - for ANY reason.
-///
-/// [`kill_tree`] handles the ordinary exit, but it only runs when the worker gets
-/// to run: a crash, a `TerminateProcess` from Task Manager or a force-killed shell
-/// never reaches it, and then `node` keeps the port. That is not a theory - it was
-/// measured: force-killing the old shell left two `node` processes and a listening
-/// port behind. A job object closes that hole, because the kernel does the killing
-/// when the last handle to the job closes, and the last handle closes when this
-/// process ends however it ends.
-///
-/// The job handle is deliberately LEAKED (never `CloseHandle`d): one handle for the
-/// lifetime of the process is the entire point, and closing it early would kill the
-/// harness we just started.
-///
-/// Children inherit job membership, so `cmd.exe`/`npx` and the `node` harness under
-/// it are all covered.
-#[cfg(target_os = "windows")]
-fn confine_to_job(child: &Child) {
-    use std::os::windows::io::AsRawHandle;
-    use windows_sys::Win32::Foundation::HANDLE;
-    use windows_sys::Win32::System::JobObjects::{
-        AssignProcessToJobObject, CreateJobObjectW, JobObjectExtendedLimitInformation,
-        SetInformationJobObject, JOBOBJECT_EXTENDED_LIMIT_INFORMATION,
-        JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,
-    };
-
-    // SAFETY: every call below is the documented Win32 sequence for a
-    // kill-on-close job: create, set the limit, assign the child's own inherited
-    // process handle. The struct is zero-initialised, which is what the API
-    // expects (only LimitFlags is meaningful here); its size is taken from the
-    // Rust type so it cannot drift from the C one; and the handle is left open on
-    // purpose, with the process exit closing it.
-    unsafe {
-        let job = CreateJobObjectW(std::ptr::null(), std::ptr::null());
-        if job.is_null() {
-            eprintln!("[vncode] warning: could not create a job object - if this shell is killed outright, the harness may keep running.");
-            return;
-        }
-        let mut limits: JOBOBJECT_EXTENDED_LIMIT_INFORMATION = std::mem::zeroed();
-        limits.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
-        let size = std::mem::size_of::<JOBOBJECT_EXTENDED_LIMIT_INFORMATION>() as u32;
-        if SetInformationJobObject(
-            job,
-            JobObjectExtendedLimitInformation,
-            &limits as *const JOBOBJECT_EXTENDED_LIMIT_INFORMATION as *const core::ffi::c_void,
-            size,
-        ) == 0
-        {
-            eprintln!("[vncode] warning: could not set kill-on-close on the job object - if this shell is killed outright, the harness may keep running.");
-            return;
-        }
-        if AssignProcessToJobObject(job, child.as_raw_handle() as HANDLE) == 0 {
-            eprintln!("[vncode] warning: could not put the harness in the job object - if this shell is killed outright, the harness may keep running.");
-        }
-    }
-}
-
-/// On macOS/Linux the process group is the mechanism (see [`kill_tree`]): the child
-/// is a group leader, so one `kill(-pgid, …)` reaches everything it started. A kill
-/// of the SHELL itself still leaks the tree there, which is the hole the Windows job
-/// object closes.
-///
-/// Linux answers it in the kernel: `PR_SET_PDEATHSIG` asks for a signal when the
-/// parent THREAD that forked dies, which is what happens when this process is killed
-/// however it is killed. The signal is set in the child between `fork` and `exec`, so
-/// it is inherited by nothing and cannot be observed by a program that has not
-/// started yet. macOS has no equivalent (`procctl`/`kqueue` need a kevent loop this
-/// supervisor does not have), so there the process group plus `kill_tree` is the
-/// whole answer, and a force-kill of the shell can leak - recorded as a known limit
-/// rather than papered over.
-#[cfg(target_os = "linux")]
-fn arm_parent_death_signal(command: &mut Command) {
-    use std::os::unix::process::CommandExt;
-    // SAFETY: the closure runs in the child after `fork` and before `exec`, so it may
-    // only call async-signal-safe functions. `prctl` is a raw syscall wrapper with no
-    // allocation, no lock and no Rust runtime behind it; the return value is ignored
-    // because a kernel that refuses the request leaves the process-group cleanup as
-    // the fallback, which is the behaviour that already existed.
-    unsafe {
-        command.pre_exec(|| {
-            libc::prctl(libc::PR_SET_PDEATHSIG, libc::SIGKILL);
-            Ok(())
-        });
-    }
-}
-
-/// Nothing to arm where the kernel has no such request.
-#[cfg(not(target_os = "linux"))]
-fn arm_parent_death_signal(_command: &mut Command) {}
-
-/// On macOS/Linux the process group is the mechanism (see [`kill_tree`]).
-#[cfg(not(target_os = "windows"))]
-fn confine_to_job(_child: &Child) {}
-
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::path::PathBuf;
 
-    #[test]
-    fn the_stop_line_is_what_a_check_reads() {
-        let outcome = StopOutcome { port_free: true, port: Some(3080) };
-        assert_eq!(outcome.line(), "[vncode] stopped port=3080 free=yes");
-        let leaked = StopOutcome { port_free: false, port: Some(3080) };
-        assert_eq!(leaked.line(), "[vncode] stopped port=3080 free=no");
-        let idle = StopOutcome { port_free: true, port: None };
-        assert_eq!(idle.line(), "[vncode] stopped (nothing was running)");
-    }
-
-    #[test]
-    fn a_fresh_supervisor_is_idle_and_has_never_spawned_anything() {
-        let shell = Supervisor::new(Arc::new(Console::new()));
-        assert!(!shell.is_live());
-        assert_eq!(shell.status().phase, Phase::Idle);
-        assert!(shell.log_tail(10).is_empty());
-    }
-
-    #[test]
-    fn stopping_something_that_never_started_is_not_a_failure() {
-        // The panel calls Stop in the idle state, and on the way out. It must not
-        // report a phantom leak.
-        let shell = Supervisor::new(Arc::new(Console::new()));
-        let outcome = shell.stop();
-        assert!(outcome.port_free);
-        assert_eq!(outcome.port, None);
+    /// A scratch directory for THIS crate's tests: `vn-shell-core`'s helper is
+    /// test-only and private to it, and a check may point both at one root.
+    fn scratch_dir(name: &str) -> PathBuf {
+        let root = match std::env::var_os("VNCODE_TEST_DIR") {
+            Some(value) if !value.is_empty() => PathBuf::from(value),
+            _ => std::env::temp_dir(),
+        };
+        let path = root.join(format!("vncode-runtime-{}-{name}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&path);
+        path
     }
 
     #[test]
@@ -845,55 +236,19 @@ mod tests {
             line.contains("vendored") || line.contains("npx") || line.contains("TEST SEAM"),
             "{line}"
         );
-        // The start line names the port it will really use.
-        let start = plan.start_line(3080);
-        assert!(start.contains("127.0.0.1:3080"), "{start}");
-        // ...and never the launch token, which does not exist yet at this point.
-        assert!(!start.contains("token="), "{start}");
-    }
-
-    #[test]
-    fn an_explicit_dshhome_that_cannot_be_written_refuses_and_names_the_flag() {
-        // The failure this pins, measured on a machine whose app was started from
-        // inside a program that confines its children: the harness died on
-        // `EPERM ... .dsh\profiles\web\cordis.yml` three minutes after Start, and the
-        // app could have known instantly. What changed in M0 is WHICH answer that is:
-        // an inherited or default home now falls through to one this app creates, and
-        // only a `-DshHome` the person typed is a refusal.
-        let root = scratch_dir("home-problem");
-        std::fs::create_dir_all(&root).unwrap();
-        // A home whose parent is a FILE can never be created on any platform.
-        let blocker = root.join("blocker");
-        std::fs::write(&blocker, b"a file, not a directory").unwrap();
-        let impossible = blocker.join(".dsh");
-
-        let shell = Arc::new(Supervisor::new(Arc::new(Console::new())));
-        let options = Options {
-            dsh_home: Some(impossible.display().to_string()),
-            dsh_version: Some("9.9.9".into()),
-            ..Options::default()
-        };
-        let error = shell
-            .start(options, None)
-            .expect_err("an impossible -DshHome must refuse");
-        assert!(error.contains("-DshHome names"), "{error}");
-        assert!(error.contains("blocker"), "{error}");
-        // ...and nothing was spawned by the refusal.
-        assert!(!shell.is_live());
-        let _ = std::fs::remove_dir_all(&root);
     }
 
     #[test]
     fn the_plan_always_names_a_home_and_an_app_root() {
-        // The ordinary case after M0: a home this app can write is always found, so
-        // "the plan exists" and "there is a harness home" are the same statement.
+        // The ordinary case: a home this app can write is always found, so "the plan
+        // exists" and "there is a harness home" are the same statement.
         let options = Options { dsh_version: Some("9.9.9".into()), ..Options::default() };
         let plan = plan(&options, None).expect("the plan must resolve with an explicit pin");
         let home = plan.home_path().expect("a home is always decided");
         let root = plan.app_root().expect("a root is always decided");
-        // The home is EITHER an inherited `DSH_HOME` that was writable (the app joins
-        // the session that started it) OR the default inside the app's own root. Both
-        // are correct; what must never happen is a home that is neither.
+        // The home is EITHER an inherited `DSH_HOME` that was writable (the app joins the
+        // session that started it) OR the default inside the app's own root. Both are
+        // correct; what must never happen is a home that is neither.
         let origin = plan.home.home.as_ref().unwrap().origin;
         match origin {
             vn_shell_core::home::Origin::Inherited | vn_shell_core::home::Origin::Flag => {}
@@ -907,17 +262,41 @@ mod tests {
         assert!(!line.contains("VNCODE_HOME="), "{line}");
     }
 
+    #[test]
+    fn an_explicit_dshhome_that_cannot_be_written_is_a_problem_that_names_the_flag() {
+        // The failure this pins, measured on a machine whose app was started from inside a
+        // program that confines its children: the harness died on `EPERM ... cordis.yml`
+        // three minutes after Start, and the app could have known instantly. An inherited
+        // or default home falls through to one this app creates; only a `-DshHome` the
+        // person typed is a refusal, and the refusal names the flag.
+        let root = scratch_dir("home-problem");
+        std::fs::create_dir_all(&root).unwrap();
+        let blocker = root.join("blocker");
+        std::fs::write(&blocker, b"a file, not a directory").unwrap();
+        let impossible = blocker.join(".dsh");
+
+        let options = Options {
+            dsh_home: Some(impossible.display().to_string()),
+            dsh_version: Some("9.9.9".into()),
+            ..Options::default()
+        };
+        let plan = plan(&options, None).expect("the plan itself still resolves");
+        let problem = plan.home.problem().expect("an impossible -DshHome is a problem");
+        assert!(problem.contains("-DshHome"), "{problem}");
+        assert!(problem.contains("blocker"), "{problem}");
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
     #[test]
     fn a_missing_profile_is_a_note_and_never_a_refusal() {
         let root = scratch_dir("missing-pack");
         std::fs::create_dir_all(root.join("profiles").join("web")).unwrap();
         let note = missing_pack_note(Some(&root), "web").expect("a note is due");
         assert!(note.contains("no web profile"), "{note}");
-        // The words point at the PANEL's own controls, which is where the reader is -
-        // not at an installer script they would have to run by hand, and not at a button
-        // this build no longer has.
-        assert!(note.contains("Start installs"), "{note}");
-        assert!(note.contains("Install pack here"), "{note}");
+        // The words point at a command the reader can run, and never at a button on a
+        // window this build no longer opens.
+        assert!(note.contains("vncode install"), "{note}");
+        assert!(!note.contains("press"), "{note}");
         // A profile with the manifest but without the pack gets the other note.
         std::fs::write(
             root.join("profiles").join("web").join("package.json"),
@@ -927,10 +306,7 @@ mod tests {
         let note = missing_pack_note(Some(&root), "web").expect("a note is due");
         assert!(note.contains("does not list this pack's bundles"), "{note}");
         assert!(note.contains("unadorned"), "{note}");
-        assert!(note.contains("press Change and choose it"), "{note}");
-        // MARKDOWN IS NOT RENDERED HERE. This sentence is drawn with `ui.label`, so
-        // `**bold**` reaches the reader as asterisks - measured on the first-run screen,
-        // where the note sat beside the cards. No emphasis, anywhere in a note.
+        // A note is a console line: no markup is rendered here, so no markup is written.
         for note in [
             missing_pack_note(Some(&root), "web").unwrap(),
             missing_pack_note(Some(&root.join("nothing")), "web").unwrap(),
@@ -946,16 +322,4 @@ mod tests {
         assert_eq!(missing_pack_note(Some(&root), "web"), None);
         let _ = std::fs::remove_dir_all(&root);
     }
-
-    /// A scratch directory for THIS crate's tests: `vn-shell-core`'s helper is
-    /// test-only and private to it, and a check may point both at one root.
-    fn scratch_dir(name: &str) -> PathBuf {
-        let root = match std::env::var_os("VNCODE_TEST_DIR") {
-            Some(value) if !value.is_empty() => PathBuf::from(value),
-            _ => std::env::temp_dir(),
-        };
-        let path = root.join(format!("vncode-runtime-{}-{name}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&path);
-        path
-    }
 }
diff --git a/app/crates/vn-shell-runtime/src/setup.rs b/app/crates/vn-shell-runtime/src/setup.rs
index 5805375..c530d75 100644
--- a/app/crates/vn-shell-runtime/src/setup.rs
+++ b/app/crates/vn-shell-runtime/src/setup.rs
@@ -137,7 +137,7 @@ pub fn command_for(
 }
 
 /// What a setup run is doing.
-#[derive(Clone, Debug, PartialEq, Eq)]
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct SetupStatus {
     pub kind: Option<SetupKind>,
     pub running: bool,
@@ -155,12 +155,6 @@ pub struct SetupStatus {
     pub last: Option<String>,
 }
 
-impl Default for SetupStatus {
-    fn default() -> Self {
-        SetupStatus { kind: None, running: false, exit: None, detail: None, last: None }
-    }
-}
-
 impl SetupStatus {
     /// One line for the panel's row and for the log.
     pub fn line(&self) -> String {
diff --git a/app/crates/vn-shell-runtime/src/view.rs b/app/crates/vn-shell-runtime/src/view.rs
deleted file mode 100644
index c3197bf..0000000
--- a/app/crates/vn-shell-runtime/src/view.rs
+++ /dev/null
@@ -1,50 +0,0 @@
-//! Everything a **home choice** changes, rebuilt in one place.
-//!
-//! The home is chosen once, on the panel's first-run screen, and it changes more than
-//! the home: the location map, which profiles exist, the harness's own preferences and
-//! the key state all follow it. Rebuilding that inside the panel would be a second,
-//! drifting copy of what `main.rs` builds at startup - so this IS that construction, in
-//! one function, and both callers use it.
-//!
-//! It is also the answer to "did that click take effect?": the panel re-plans through
-//! this the moment a choice is made and again when a copy or an install finishes, so no
-//! row it draws can describe a home the app is no longer using.
-
-use std::path::Path;
-
-use vn_shell_core::{keystate::KeyState, launch, prefs::Preferences};
-use vn_shell_paths::{self as paths, Row};
-
-use crate::{plan, Options, Plan};
-
-/// What the panel and the binary both need, and nothing else.
-pub struct View {
-    pub plan: Plan,
-    /// The location map for the plan's home, as rows.
-    pub paths: Vec<Row>,
-    /// The profile directories that exist in the plan's home.
-    pub profiles: Vec<String>,
-    /// The harness's own preferences for that home.
-    pub prefs: Preferences,
-    pub key_state: KeyState,
-}
-
-/// Plan, then read everything that follows from the plan.
-pub fn view(options: &Options, remembered: Option<&Path>) -> Result<View, String> {
-    let plan = plan(options, remembered)?;
-    let profiles = vn_shell_core::prefs::profile_names(plan.home_path());
-    let workspace = std::env::current_dir().ok();
-    let repo = launch::repo_root();
-    let rows = paths::rows(&paths::Input {
-        home: plan.home_path(),
-        home_origin: plan.home.row().1,
-        app_root: plan.app_root(),
-        repo_root: repo.as_deref(),
-        workspace: workspace.as_deref(),
-        profile: launch::PROFILE,
-        profiles: &profiles,
-    });
-    let prefs = vn_shell_core::prefs::read(plan.home_path(), launch::PROFILE);
-    let key_state = vn_shell_core::keystate::read(plan.home_path());
-    Ok(View { plan, paths: rows, profiles, prefs, key_state })
-}
diff --git a/app/crates/vn-shell/Cargo.toml b/app/crates/vn-shell/Cargo.toml
index 08a70e3..18b9b14 100644
--- a/app/crates/vn-shell/Cargo.toml
+++ b/app/crates/vn-shell/Cargo.toml
@@ -1,30 +1,21 @@
 [package]
 name = "vn-shell"
-description = "The vncode shell binary: the control panel that starts, watches and stops the pinned harness."
+description = "The vncode binary: the front door that installs the pack, takes the key and runs the web launcher."
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 publish.workspace = true
 rust-version.workspace = true
-# The distribution ships `vncode.exe`, `scripts/run-desktop.bat` looks for
-# `vncode.exe`, and the single-file build unpacks a folder whose START-HERE starts
-# `vncode`. ONE name, and it is not the crate's.
+# The distribution ships `vncode`, and every launcher and doc looks for that name.
+# ONE name, and it is not the crate's.
 [[bin]]
 name = "vncode"
 path = "src/main.rs"
 
 [features]
 default = []
-# The pane, forwarded from the panel: `cargo build --release --features pane` is how
-# somebody sees the harness inside this window before the default is flipped. OFF by
-# default so a plain `cargo build --release` - which is exactly what
-# `scripts\run-desktop.bat` runs - produces the binary it produced before the pane existed.
-pane = ["vn-shell-egui/pane"]
 
 [dependencies]
 vn-shell-core.workspace = true
 vn-shell-runtime.workspace = true
-vn-shell-egui.workspace = true
-vn-shell-paths.workspace = true
-eframe.workspace = true
-url.workspace = true
+rpassword.workspace = true
diff --git a/app/crates/vn-shell/src/main.rs b/app/crates/vn-shell/src/main.rs
index 0b2e2b1..8f82eb4 100644
--- a/app/crates/vn-shell/src/main.rs
+++ b/app/crates/vn-shell/src/main.rs
@@ -1,54 +1,45 @@
-//! vncode: the shell's binary, and nothing else.
+//! `vncode`: the front door, and nothing else.
 //!
-//! Wiring only. The flags, the pin, the home, the browser table, the port, the launch
-//! decision and the ready line all live in `vn-shell-core` (pure, `cargo test`ed); the
-//! process lifetime lives in `vn-shell-runtime`; the panel lives in `vn-shell-egui`.
-//! What is here is the order those are called in, and the two modes that never open a
-//! window.
-//!
-//! The lifetime this binary implements:
+//! This binary draws no window and no web view. It decides four things - the root, the
+//! home, the key and the pack - and then it runs the script a person would run:
+//! `scripts/run-web.bat` on Windows, `scripts/run-web.sh` everywhere else, in the
+//! foreground, with the composed environment and `-DshHome` so both halves agree about
+//! which home is in use.
 //!
 //! ```text
-//! vncode                     the control panel, idle: no child, no port bound
-//! vncode -Mode chrome        ...and Start opens the harness in a browser it found
-//! vncode -Mode headless      no window: `stop`, `quit`, `install`, `uninstall` on stdin
-//! vncode -Help               what it takes, without starting anything
+//! vncode              install if needed -> ask for the key if there is none -> run-web
+//! vncode install      scripts/setup/install.* against the home in use
+//! vncode uninstall    scripts/setup/uninstall.* against it
+//! vncode status       the facts, and nothing started
+//! vncode key          ask for the DeepSeek key, write it into <home>/.env
+//! vncode -Help        the verbs and flags, without starting anything
 //! ```
 //!
-//! There is no single-file build any more: it was a distribution the old
-//! distributer assembled, and the distribution is now this app beside the pack it
-//! installs (the panel's Install button runs `scripts/setup/install.*`).
+//! Two rules survive from the shell this replaces, because both are the record of a bug
+//! measured on a real machine:
+//!
+//! 1. **A key is never printed.** The panel-era rule was "a layer NAME, never a value";
+//!    the value now never leaves the prompt, is written to one file, and is not read back.
+//! 2. **Every child's environment is composed, not inherited** (`vn_shell_runtime::env`),
+//!    because a variable that is merely unset is still inherited from whoever started this.
 
-use std::path::Path;
-use std::sync::{mpsc, Arc, Mutex};
-use std::time::Duration;
+use std::io::IsTerminal;
+use std::path::{Path, PathBuf};
+use std::process::{Command as Process, Stdio};
 
-use vn_shell_core::appprefs::AppPrefs;
-use vn_shell_core::browser;
-use vn_shell_core::options::{parse_args_with, print_usage_with, Mode, Options};
-use vn_shell_core::prefs::Preferences;
-use vn_shell_core::status::Phase;
-use vn_shell_core::windowstate::{self, WindowState};
-use vn_shell_core::{appdata, home, keystate, launch};
-use vn_shell_egui::{Shell, ShellContext};
-use vn_shell_paths::{self as paths, Input};
-use vn_shell_runtime::{self as runtime, Console, Setup, SetupKind, Supervisor};
+use vn_shell_core::keystate::{self, KeyState};
+use vn_shell_core::options::{self, Command, Options};
+use vn_shell_core::{launch, profile};
+use vn_shell_runtime as runtime;
+use vn_shell_runtime::setup::{self, SetupKind};
+use vn_shell_runtime::Plan;
 
-/// The profile the shell starts, and the one the panel names. `dsh web` and
+/// The profile the launcher starts, and the one the pack is installed into. `dsh web` and
 /// `dsh --profile web` are the same profile: this is the alias, not a second one.
-/// It is defined in `vn-shell-core` so the supervisor, the prefs reader and the
-/// panel's "is the pack installed" row cannot disagree about it.
 const PROFILE: &str = launch::PROFILE;
 
-/// How often the headless loop looks at the supervisor.
-const HEADLESS_TICK: Duration = Duration::from_millis(200);
-
 fn main() {
-    // Whether this build has the pane decides whether `-Mode embed` is a mode or a refusal
-    // by name, and the answer comes from the panel rather than from a feature flag here: the
-    // flag belongs to the crate that owns the engine, and the pure half is told the answer.
-    let pane_available = vn_shell_egui::pane_available();
-    let options = match parse_args_with(std::env::args().skip(1), pane_available) {
+    let options = match options::parse_args(std::env::args().skip(1)) {
         Ok(options) => options,
         Err(message) => {
             eprintln!("[vncode] {message}");
@@ -56,36 +47,55 @@ fn main() {
         }
     };
     if options.help {
-        print_usage_with(pane_available);
+        options::print_usage();
         return;
     }
-
-    let mode = options.mode();
-    let code = match mode {
-        Mode::Headless => headless(options),
-        _ => window(options, mode),
+    if options.version {
+        options::print_version();
+        return;
+    }
+    let code = match run(&options) {
+        Ok(code) => code,
+        Err(message) => {
+            eprintln!("[vncode] {message}");
+            1
+        }
     };
     std::process::exit(code);
 }
 
-/// The one line every run prints, whatever the mode.
-fn banner(mode: Mode) {
-    println!("[vncode] vncode shell ({mode} mode)");
+/// Resolve, report, then do the one thing that was asked for.
+fn run(options: &Options) -> Result<i32, String> {
+    let plan = runtime::plan(options, None)?;
+    announce(&plan);
+    let environment = runtime::env::for_plan(&plan);
+    let home_arguments = runtime::env::dsh_home_arguments(&plan.home);
+
+    match options.command() {
+        Command::Status => {
+            status(&plan);
+            Ok(0)
+        }
+        Command::Key => {
+            // A key is not required for the command to have done its job: a person who
+            // changes their mind gets a sentence and exit 0, not a failure.
+            ask_and_save_key(&plan)?;
+            Ok(0)
+        }
+        Command::Install => setup_run(SetupKind::Install, &plan, &environment, &home_arguments),
+        Command::Uninstall => setup_run(SetupKind::Uninstall, &plan, &environment, &home_arguments),
+        Command::Start => start(options, &plan, &environment, &home_arguments),
+    }
 }
 
-/// The facts, for the WINDOW modes only.
-///
-/// In headless mode the worker records these same lines in the log and the log IS
-/// the console there, so announcing them as well would print every fact twice - a
-/// transcript that says everything two times is a transcript somebody stops
-/// reading.
-fn announce(plan: &runtime::Plan) {
-    println!("[vncode] Pinned dsh version: {}", plan.version);
+/// The facts, once, in the same words `run-web` uses.
+fn announce(plan: &Plan) {
+    println!("[vncode] pinned dsh version: {}", plan.version);
     match plan.app_root() {
         Some(root) => println!(
             "[vncode] VNCODE_HOME: {} ({})",
             root.display(),
-            plan.home.app_root_origin_label()
+            plan.app_root_origin_label()
         ),
         None => println!("[vncode] VNCODE_HOME: none could be written"),
     }
@@ -96,398 +106,232 @@ fn announce(plan: &runtime::Plan) {
     }
     println!("{}", keystate::console_line(&keystate::read(plan.home_path())));
     println!("[vncode] runtime: {}", plan.runtime_line());
-    println!("[vncode] child environment: {}", plan.env_line());
-    match plan.port_hint {
-        Some(port) => println!("[vncode] port: {port} (chosen again when Start is pressed)"),
-        None => println!("[vncode] port: none free right now"),
-    }
+    println!("[vncode] child environment: {}", plan.env_summary());
     for note in &plan.notes {
         println!("[vncode] note: {note}");
     }
 }
 
-/// The plan, the preferences, and where the preferences were read from.
-///
-/// **The root comes first, and it is the ladder's root.** `prefs.json`, the window
-/// record, the npm cache and the home are four things this app owns, and they live
-/// under ONE directory or the app has two memories: the geometry written into
-/// `<tree>/.vncode` while the home somebody chose was written into
-/// `%LOCALAPPDATA%\vncode`, which is a root the confined run that fell through to the
-/// tree cannot even write. The measured cost of that was the first-run question
-/// returning on every launch, for a person who had answered it.
-///
-/// The root ladder is decided by paths alone - the environment, a portable folder, a real
-/// write probe - so `home::root_from_env` answers it WITHOUT resolving a home, and
-/// nothing is created on the way: resolving a whole plan first would have created
-/// `<root>/home` as a side effect even when the remembered home is somewhere else, and
-/// "the app's own home is never created when it joins another" is a promise the checks
-/// drive. The platform root is then read as a FALLBACK (an older build wrote the record
-/// there) and never written, and ONE plan is resolved with the home that record names.
-struct Planned {
-    plan: runtime::Plan,
-    app_prefs: AppPrefs,
-    /// Where the preferences THIS run will save into: the ladder's root.
-    prefs_root: Option<std::path::PathBuf>,
-    /// Where they were READ from, when that is a different directory - the migration
-    /// the panel mentions once so the move is not silent.
-    read_from: Option<std::path::PathBuf>,
-}
-
-fn plan_and_prefs(options: &Options) -> Result<Planned, String> {
-    let platform = appdata::app_root();
-    let prefs_root = home::root_from_env().or_else(|| platform.clone());
-    let fallback = platform.filter(|platform| Some(platform.as_path()) != prefs_root.as_deref());
-    let (app_prefs, read_from) =
-        AppPrefs::load_from(prefs_root.as_deref(), fallback.as_deref());
-    let plan = runtime::plan(options, app_prefs.home.as_deref())?;
-    let read_from = read_from.filter(|from| Some(from.as_path()) != plan.app_root());
-    Ok(Planned {
-        prefs_root: plan.app_root().map(Path::to_path_buf),
-        plan,
-        app_prefs,
-        read_from,
-    })
-}
-
-/// The window: the control panel, and whatever the reader asks it to start.
-fn window(options: Options, mode: Mode) -> i32 {
-    // The app's own root is read FIRST, because two things live in it that decide
-    // what the harness gets: the remembered home, and the browser the person chose.
-    let planned = match plan_and_prefs(&options) {
-        Ok(planned) => planned,
-        Err(message) => {
-            eprintln!("[vncode] {message}");
-            return 1;
+/// The extra facts `status` adds: what is installed, and where the launcher is.
+fn status(plan: &Plan) {
+    match plan.home_path() {
+        Some(home) => match profile::bundles(home, PROFILE) {
+            Some(bundles) => println!(
+                "[vncode] pack: {} ({} bundle(s) in the {PROFILE} profile)",
+                if profile::has_pack(&bundles) { "installed" } else { "NOT installed" },
+                bundles.len()
+            ),
+            None => println!("[vncode] pack: no {PROFILE} profile in this home yet"),
+        },
+        None => println!("[vncode] pack: no home was decided, so nothing can be installed"),
+    }
+    match launcher(plan) {
+        Ok(entry) => println!("[vncode] launcher: {}", entry.display()),
+        Err(message) => println!("[vncode] launcher: {message}"),
+    }
+    match plan.root.as_deref() {
+        Some(root) => println!("[vncode] root: {}", root.display()),
+        None => println!("[vncode] root: none found above this binary"),
+    }
+    for (program, why) in [("node", "the harness needs it"), ("npx", "the launcher runs it")] {
+        match which(program) {
+            Some(path) => println!("[vncode] {program}: {}", path.display()),
+            None => println!("[vncode] {program}: NOT on PATH ({why})"),
         }
-    };
-    let Planned { plan, app_prefs, prefs_root, read_from } = planned;
-    println!("[vncode] app preferences: {}", app_prefs.line());
-    if let Some(from) = read_from.as_deref() {
-        println!(
-            "[vncode] note: your choice was remembered in {} by an older build; it is saved into {} from now on",
-            from.display(),
-            prefs_root
-                .as_deref()
-                .map(|root| root.display().to_string())
-                .unwrap_or_else(|| "this app's own root".to_string())
-        );
     }
-    banner(mode);
-    announce(&plan);
+}
 
-    // The geometry record lives in the APP ROOT, not the harness home: it is the
-    // app's own furniture, and it must survive a `-DshHome` that points at a folder
-    // shared with `scripts\run-web.bat` (`appdata`'s header has the argument, and the
-    // npm cache already follows it).
-    let state_path = plan.app_root().map(windowstate::state_path);
-    let remembered = match state_path.as_deref().map(windowstate::load) {
-        // No app root could be written, so there is nowhere honest to read from or
-        // write to: this window simply has no memory.
-        None => WindowState::first_launch(),
-        // The ordinary first launch: nothing to say, and nothing to fix.
-        Some(Err(windowstate::Unusable::Absent)) => WindowState::first_launch(),
-        Some(Err(reason)) => {
-            // One line, never a refusal: a record this build cannot vouch for
-            // costs the reader the default geometry and nothing else.
-            println!("[vncode] ignoring the remembered window geometry: {reason}.");
-            WindowState::first_launch()
+/// The whole path: the pack, then the key, then the launcher.
+fn start(
+    options: &Options,
+    plan: &Plan,
+    environment: &runtime::ChildEnv,
+    home_arguments: &[std::ffi::OsString],
+) -> Result<i32, String> {
+    // 1. THE PACK. Installed before anything runs, because the installer re-links the
+    // profile and must not run under a live harness - and nothing is running yet.
+    if !pack_is_installed(plan) {
+        println!("[vncode] this home does not list the pack's bundles - installing them first");
+        let code = setup_run(SetupKind::Install, plan, environment, home_arguments)?;
+        if code != 0 {
+            return Err(format!(
+                "the pack installer failed (exit code {code}), so nothing was started"
+            ));
         }
-        Some(Ok(remembered)) => remembered,
-    };
+    }
 
-    let profiles = vn_shell_core::prefs::profile_names(plan.home_path());
-    let prefs: Preferences = vn_shell_core::prefs::read(plan.home_path(), PROFILE);
-    let key_state = keystate::read(plan.home_path());
-    let workspace = std::env::current_dir().ok();
-    let repo = launch::repo_root();
-    let path_rows = paths::rows(&Input {
-        home: plan.home_path(),
-        home_origin: plan.home.row().1,
-        app_root: plan.app_root(),
-        repo_root: repo.as_deref(),
-        workspace: workspace.as_deref(),
-        profile: PROFILE,
-        profiles: &profiles,
-    });
+    // 2. THE KEY. Asked for only when there is none, and only at a terminal: an
+    // unattended run (a scheduler, a check) must not block on a prompt that nobody sees.
+    let key = keystate::read(plan.home_path());
+    if key.source().is_none() {
+        println!("[vncode] no DeepSeek key was found for this home");
+        ask_and_save_key(plan)?;
+    }
 
-    println!(
-        "[vncode] opening the control panel in {} mode - nothing is started until Start",
-        mode
-    );
-    // ONE console for both writers: the panel's log is a single transcript, so an
-    // install's output and the harness's output share a cursor and a redactor.
-    let console = Arc::new(Console::new());
-    let supervisor = Arc::new(Supervisor::new(Arc::clone(&console)));
-    let setup = Arc::new(Setup::new(Arc::clone(&console)));
-    let adopt = Arc::new(runtime::Adopt::new(Arc::clone(&console)));
-    let setup_entries = runtime::setup::locate(repo.as_deref().unwrap_or(Path::new(".")));
-    if setup_entries.is_none() {
-        println!(
-            "[vncode] no installer found under scripts/setup - this build can supervise a pack that is already installed, but the panel's Install and Uninstall buttons will be off"
-        );
+    // 3. THE LAUNCHER. The same file a person double-clicks, in the foreground: it runs
+    // the harness, watches for the URL line, opens the tab and takes Ctrl+C.
+    let entry = launcher(plan)?;
+    let mut command = launcher_command(&entry);
+    command.args(home_arguments);
+    if options.port > 0 {
+        command.arg("-Port").arg(options.port.to_string());
     }
+    environment.apply(&mut command);
+    println!("[vncode] running {}", entry.display());
+    println!("[vncode] keep this window open - the harness runs in it. Ctrl+C stops it.");
+    println!();
+    let status = command
+        .status()
+        .map_err(|error| format!("could not run {}: {error}", entry.display()))?;
+    Ok(status.code().unwrap_or(1))
+}
 
-    // What the panel offers about a home this app did not create: a COPY of it, and
-    // nothing else. The source is the harness's own default (`~/.dsh`), and the app never
-    // walks to it on its own - nothing outside this app's own root is ever the home it
-    // runs AGAINST (see `home.rs`), so the copy is a one-way import and the only thing
-    // that reads that directory at all.
-    let found_home = home::existing_default_home().filter(|path| home::looks_like_a_harness_home(path));
-    if let Some(path) = found_home.as_deref() {
-        // Compared in their REAL forms, so `~/.dsh` and a junction to it are one
-        // home rather than two.
-        let using_it = plan
-            .home_path()
-            .map(|in_use| {
-                vn_shell_core::userpath::canonical(in_use)
-                    == vn_shell_core::userpath::canonical(path)
-            })
-            .unwrap_or(false);
+/// Whether the pack's bundles are in the profile the launcher will start.
+fn pack_is_installed(plan: &Plan) -> bool {
+    plan.home_path()
+        .and_then(|home| profile::bundles(home, PROFILE))
+        .map(|bundles| profile::has_pack(&bundles))
+        .unwrap_or(false)
+}
+
+/// Run one of the two setup entry points, with the child's own output going straight to
+/// this console - the same thing a person sees when they run it themselves.
+fn setup_run(
+    kind: SetupKind,
+    plan: &Plan,
+    environment: &runtime::ChildEnv,
+    home_arguments: &[std::ffi::OsString],
+) -> Result<i32, String> {
+    let root = plan.root.as_deref().ok_or_else(|| {
+        "no checkout or distribution root was found above this binary, so there is no \
+         scripts/setup to run"
+            .to_string()
+    })?;
+    let entries = setup::locate(root).ok_or_else(|| {
+        format!(
+            "no installer under {} - a release folder carries scripts/setup beside the binary",
+            root.join("scripts").join("setup").display()
+        )
+    })?;
+    let entry = entries.for_kind(kind);
+    let mut command = setup::command_for(entry, &[], environment, home_arguments);
+    // `command_for` pipes both streams so a panel could draw them. There is no panel:
+    // this run's output is the console's, line for line, exactly as if it were typed.
+    command
+        .stdin(Stdio::inherit())
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::inherit());
+    println!("[vncode] {}: running {}", kind.label(), entry.display());
+    let status = command
+        .status()
+        .map_err(|error| format!("could not run {}: {error}", entry.display()))?;
+    Ok(status.code().unwrap_or(1))
+}
+
+/// Ask for the DeepSeek key and write it into this home's `.env`.
+///
+/// The value goes from the terminal into one file and nowhere else: it is not printed, it
+/// is not logged, and it is not read back. The sentence names the FILE.
+fn ask_and_save_key(plan: &Plan) -> Result<(), String> {
+    let home = plan.home_path().ok_or_else(|| {
+        "no harness home was decided, so there is nowhere to write a key".to_string()
+    })?;
+    if !std::io::stdin().is_terminal() {
         println!(
-            "[vncode] found an existing harness home at {}{}",
-            path.display(),
-            if using_it {
-                " (in use, because -DshHome or DSH_HOME named it)"
-            } else {
-                " - the panel offers a COPY of it, never to run against it"
-            }
+            "[vncode] stdin is not a terminal, so no key was asked for. Set {} in the \
+             environment, or write it into {}",
+            keystate::KEY_REF,
+            home.join(keystate::ENV_FILE).display()
         );
+        return Ok(());
     }
-    let adopt_offer = vn_shell_core::adopt::offer(found_home.as_deref(), plan.home_path());
-    match &adopt_offer {
-        vn_shell_core::adopt::Offer::Available(adoption) => {
-            println!("[vncode] adopt is available: {}", adoption.line())
-        }
-        vn_shell_core::adopt::Offer::Unreadable(path) => println!(
-            "[vncode] {} exists but cannot be read, so nothing can be adopted from it",
-            path.display()
-        ),
-        vn_shell_core::adopt::Offer::Nothing => {}
-    }
-    // The home question, surveyed for the LOG: the panel surveys it again for the
-    // screen, because the answer changes the moment a home is chosen.
-    if let Some(root) = plan.app_root() {
-        let place = vn_shell_core::firstrun::Where::survey(found_home.as_deref(), root);
-        for card in place.cards() {
-            println!(
-                "[vncode] home option: {} -> {} ({})",
-                card.title,
-                card.path.display(),
-                if card.available {
-                    if card.recommended {
-                        "available, suggested"
-                    } else {
-                        "available"
-                    }
-                } else {
-                    "not available"
-                }
-            );
-            if let Some(reason) = card.unavailable.as_deref() {
-                println!("[vncode]   {reason}");
-            }
-        }
-    }
-
-    // The browsers on this machine, Chrome first, with the OS opener last: the table
-    // is `browser.rs`, and this is the one place it is read.
-    let browsers = browser::detect();
-    let chosen = browser::resolve(app_prefs.browser.as_deref(), &browsers);
     println!(
-        "[vncode] browsers: {} (using {})",
-        browsers
-            .iter()
-            .map(|browser| browser.label)
-            .collect::<Vec<_>>()
-            .join(", "),
-        chosen.label
-    );
-
-    let geometry = Arc::new(Mutex::new(remembered.clone()));
-    let app = Shell::new(ShellContext {
-        options: options.clone(),
-        plan,
-        supervisor: Arc::clone(&supervisor),
-        console,
-        setup: Arc::clone(&setup),
-        adopt: Arc::clone(&adopt),
-        setup_entries,
-        root: repo.clone(),
-        paths: path_rows,
-        profiles,
-        prefs,
-        key_state,
-        geometry: Arc::clone(&geometry),
-        browsers,
-        browser: chosen,
-        app_prefs,
-        prefs_root,
-    });
-
-    let native = eframe::NativeOptions {
-        viewport: vn_shell_egui::viewport(&remembered, "vncode"),
-        ..Default::default()
-    };
-    let result = eframe::run_native(
-        "vncode",
-        native,
-        Box::new(|_context| Ok(Box::new(app) as Box<dyn eframe::App>)),
+        "[vncode] paste your DeepSeek API key. It is written to {} and never printed.",
+        home.join(keystate::ENV_FILE).display()
     );
-
-    // On the way out: the geometry, synchronously, because a value handed to a
-    // debounced writer might not reach the disk before the process ends - and
-    // then the harness, so closing the window never leaves a `node` holding a port.
-    if let Some(path) = state_path.as_deref() {
-        if let Ok(state) = geometry.lock() {
-            if let Err(error) = windowstate::save(path, &state) {
-                eprintln!(
-                    "[vncode] could not remember the window geometry in {}: {error}",
-                    path.display()
-                );
-            }
-        }
+    let value = rpassword::prompt_password(format!("{}: ", keystate::KEY_REF))
+        .map_err(|error| format!("could not read the key: {error}"))?;
+    let value = value.trim();
+    if value.is_empty() {
+        println!("[vncode] nothing was entered, so no key was written");
+        return Ok(());
     }
-    let outcome = supervisor.stop();
-    println!("{}", outcome.line());
+    let path = keystate::write_env_key(home, value)?;
+    println!("[vncode] wrote {} to {}", keystate::KEY_REF, path.display());
+    Ok(())
+}
 
-    match result {
-        Ok(()) => 0,
-        Err(error) => {
-            eprintln!("[vncode] could not open the control panel: {error}");
-            1
-        }
+/// The web launcher beside this tree: the ONE thing that starts node, watches the ready
+/// line and opens the tab.
+fn launcher(plan: &Plan) -> Result<PathBuf, String> {
+    let root = plan.root.as_deref().ok_or_else(|| {
+        "no .dsh-version.json was found above this binary, so the web launcher beside it \
+         cannot be found either - run vncode from its folder, or pass -DshHome and use \
+         scripts/run-web.* directly"
+            .to_string()
+    })?;
+    let name = if cfg!(windows) { "run-web.bat" } else { "run-web.sh" };
+    let path = root.join("scripts").join(name);
+    if !path.is_file() {
+        return Err(format!(
+            "{} is missing - this app starts the web launcher, and that file is what runs \
+             the harness",
+            path.display()
+        ));
     }
+    Ok(path)
 }
 
-/// The mode with no window: supervise, print what changes, and take `stop`,
-/// `quit`, `install` or `uninstall` on stdin.
+/// How the launcher is started.
 ///
-/// This is not filler. It is the mode that proves the supervisor is separable from
-/// the window (M1's exit criterion), it is what a server or a container wants, and
-/// it is what `scripts/checks/check-shell.mjs` drives: the check starts this
-/// process against a stub CLI, reads the ready line, asks it to stop, and asserts
-/// the port came free - with nothing on screen and no display needed. The two
-/// setup commands exist for the same reason as the panel's buttons: they run the
-/// real installer, so a check can drive the plumbing (`install -Help` installs
-/// nothing and proves every step of it).
-fn headless(options: Options) -> i32 {
-    banner(Mode::Headless);
-    println!("[vncode] commands on stdin: stop, quit, install [args], uninstall [args]");
-
-    let console = Arc::new(Console::new());
-    let supervisor = Arc::new(Supervisor::new(Arc::clone(&console)));
-    let setup = Arc::new(Setup::new(Arc::clone(&console)));
-    let root = launch::repo_root();
-    let entries = runtime::setup::locate(root.as_deref().unwrap_or(Path::new(".")));
-    // The plan is resolved HERE as well as inside `start`, because `install` and
-    // `uninstall` have to hand the installer the same composed environment and the
-    // same `-DshHome` the harness is given - and that is the plan's answer, not a
-    // second reading of the environment. A bad pin or an unusable home is still
-    // reported synchronously, which is why this mode resolves it rather than
-    // guessing. The remembered home comes from the app's own root, exactly as it does
-    // for the window, so a headless run and a panel run choose the same home.
-    // The plan and the remembered home are resolved by the SAME function the window
-    // uses, so a headless run and a panel run choose one root and one home - an install
-    // driven from here cannot land in a profile the panel is not running.
-    let planned = match plan_and_prefs(&options) {
-        Ok(planned) => planned,
-        Err(message) => {
-            eprintln!("[vncode] {message}");
-            return 1;
-        }
-    };
-    let app_prefs = planned.app_prefs;
-    let plan = planned.plan;
-    if let Err(message) = supervisor.start(options, app_prefs.home.clone()) {
-        eprintln!("[vncode] {message}");
-        return 1;
+/// On Windows a `.bat` needs `cmd`, and two flags are the launcher's own: `-NoTerminal`
+/// keeps the console layer from relaunching this run into a Windows Terminal window that
+/// this process would not wait for (it would look like an instant, silent exit), and
+/// `-NoPause` keeps it from holding a window open that already exists. On POSIX the
+/// script takes no such flags.
+fn launcher_command(entry: &Path) -> Process {
+    if cfg!(windows) {
+        let mut command = Process::new("cmd");
+        command.arg("/c").arg(entry).arg("-NoTerminal").arg("-NoPause");
+        command
+    } else {
+        let mut command = Process::new("sh");
+        command.arg(entry);
+        command
     }
+}
 
-    // stdin on its own thread, so the loop below can keep reporting the status
-    // while it waits - a supervisor that went quiet until a key was pressed would
-    // be useless to a person watching it.
-    let (commands, inbox) = mpsc::channel::<String>();
-    std::thread::spawn(move || {
-        use std::io::BufRead;
-        for line in std::io::stdin().lock().lines().map_while(Result::ok) {
-            if commands.send(line).is_err() {
-                return;
-            }
-        }
-    });
-
-    // The log IS the console here. Every line the worker records is printed once,
-    // through a cursor rather than a tail, so a line cannot be repeated or skipped
-    // - and it is the same transcript the panel draws, redaction included.
-    let mut cursor = supervisor.log_position();
-    loop {
-        for line in supervisor.log_since(cursor) {
-            println!("{line}");
-        }
-        cursor = supervisor.log_position();
-
-        let status = supervisor.status();
-        if !supervisor.is_live() {
-            // The harness ended on its own; there is nothing left to supervise.
-            if status.phase == Phase::Stopped {
-                println!("{}", status.safe_line());
-            }
-            return if status.phase == Phase::Failed { 1 } else { 0 };
+/// Where a program is, without running it - for `status` only.
+fn which(program: &str) -> Option<PathBuf> {
+    let extensions: Vec<String> = if cfg!(windows) {
+        std::env::var("PATHEXT")
+            .unwrap_or_else(|_| ".COM;.EXE;.BAT;.CMD".to_string())
+            .split(';')
+            .filter(|extension| !extension.is_empty())
+            .map(|extension| extension.to_ascii_lowercase())
+            .collect()
+    } else {
+        Vec::new()
+    };
+    let path = std::env::var_os("PATH")?;
+    for directory in std::env::split_paths(&path) {
+        let direct = directory.join(program);
+        if direct.is_file() {
+            return Some(direct);
         }
-        match inbox.recv_timeout(HEADLESS_TICK) {
-            Ok(command) => {
-                // A BYTE ORDER MARK is not a command. PowerShell writes one when it
-                // pipes a string into a native process (`"stop" | vncode …`), so
-                // without this strip every command from a PowerShell pipeline is
-                // "unknown command '<BOM>stop'" - measured, on the first attempt to
-                // drive an install from a shell.
-                let command = command.trim().trim_start_matches('\u{feff}').trim().to_string();
-                let (verb, rest) = match command.split_once(char::is_whitespace) {
-                    Some((verb, rest)) => (verb.to_ascii_lowercase(), rest.trim().to_string()),
-                    None => (command.to_ascii_lowercase(), String::new()),
-                };
-                match verb.as_str() {
-                    "stop" | "quit" | "exit" => {
-                        println!("{}", supervisor.stop().line());
-                        return 0;
-                    }
-                    "install" | "uninstall" => {
-                        let kind = if verb == "install" {
-                            SetupKind::Install
-                        } else {
-                            SetupKind::Uninstall
-                        };
-                        let Some(entries) = entries.as_ref() else {
-                            println!(
-                                "[vncode] no installer under scripts/setup - nothing to run"
-                            );
-                            continue;
-                        };
-                        let extra: Vec<String> = runtime::setup::split_args(&rest);
-                        let entry = entries.for_kind(kind).to_path_buf();
-                        let environment = runtime::env::for_plan(&plan);
-                        let home_arguments = runtime::env::dsh_home_arguments(&plan.home);
-                        if let Err(message) = setup
-                            .start(kind, &entry, &extra, &environment, &home_arguments)
-                        {
-                            println!("[vncode] {message}");
-                            continue;
-                        }
-                        // Blocking HERE is right for this mode: it has one job at a
-                        // time, and the next line the caller wants is the answer.
-                        setup.join();
-                    }
-                    "" => {}
-                    other => println!(
-                        "[vncode] unknown command '{other}' - commands: stop, quit, install, uninstall"
-                    ),
-                }
+        for extension in &extensions {
+            let candidate = directory.join(format!("{program}{extension}"));
+            if candidate.is_file() {
+                return Some(candidate);
             }
-            Err(mpsc::RecvTimeoutError::Timeout) => {}
-            // stdin is gone. That is NOT a reason to stop: a headless shell with no
-            // stdin is an ordinary way to run this (`vncode -Mode headless < /dev/null`
-            // serves until the harness ends), so it simply has no commands.
-            Err(mpsc::RecvTimeoutError::Disconnected) => {}
         }
     }
+    None
+}
+
+/// Kept honest by the type system rather than a comment: `KeyState` is only ever printed
+/// through `console_line`, which names a layer and never a value.
+#[allow(dead_code)]
+fn key_line(state: &KeyState) -> String {
+    keystate::console_line(state)
 }
diff --git a/package.json b/package.json
index 7d04826..2fe05bf 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "vncode",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": true,
   "description": "Personal plugin pack for DeepSeek Harness (Windows/MacOS/Linux). Installs into the raw web/CLI profile only (npx @deepseek-ai/dsh web).",
   "license": "MIT",
diff --git a/scripts/checks/README.md b/scripts/checks/README.md
index 0df09ca..f153053 100644
--- a/scripts/checks/README.md
+++ b/scripts/checks/README.md
@@ -9,14 +9,13 @@ you claim a fix.
 node scripts/checks/check-no-secrets.mjs        # before anything is pushed
 node scripts/checks/check-client-bundles.mjs    # every browser bundle, loaded and driven
 node scripts/checks/check-node-routes.mjs       # every Node route, tool, the manifest, the pack-wide patches
-node scripts/checks/check-scripts.mjs          # the scripts tree, the console contract, no CI
+node scripts/checks/check-scripts.mjs          # the scripts tree, the console contract, the two workflows
 node scripts/checks/check-media-node.mjs        # dsh-media: tools, routes, the ffmpeg pin
 node scripts/checks/check-pdf-node.mjs          # dsh-pdf: the five tools and the routes
 node scripts/checks/check-skill-examples.mjs    # every fenced example in the shipped skills
 node scripts/checks/check-media-examples.mjs    # every media/PDF example, shaped and really RUN
 node scripts/checks/check-browser-node.mjs      # dsh-browser: the host renderer and its policy
-node scripts/checks/check-shell.mjs            # the native shell, DRIVEN: ready line, token, stop
-node scripts/checks/check-pane.mjs             # the pane: the default build promises none, the pane build has one
+node scripts/checks/check-shell.mjs            # the app, DRIVEN: verbs, the bridge, the child env
 DSH_CHECK_LAUNCH=1 node scripts/checks/check-node-routes.mjs   # also opens a real directory picker
 ```
 
@@ -29,13 +28,13 @@ Windows PowerShell: `$env:DSH_CHECK_LAUNCH='1'; node scripts/checks/check-node-r
 | `check-no-secrets.mjs` | nothing credential-shaped would be staged by `git add -A`; the `.gitignore` credential rules are present; the scanner fires on a synthetic key, hides the value and stays quiet on clean text |
 | `check-client-bundles.mjs` | every browser half loads through the real module table (`window.__ModuleLoader__.load`), activates against a stub cordis context, and is rendered/driven with a **real React runtime**; the exported `__internals` pure halves are driven directly (e.g. the audio/image byte decode in every shape a carrier could use) |
 | `check-node-routes.mjs` | every Node route and tool of every host half, the git routes against a real repository, the skills registry, the manifest ⇄ `package.json` agreement, and the master's pack-wide row patches |
-| `check-scripts.mjs` | the `scripts/` layout (`run-web.*` and `run-desktop.*` at the top, everything else in `console/`, `setup/`, `tools/`, `checks/`), the console contract every Windows entry point must hold, **`setup/install.bat -Help` and `setup/uninstall.bat -Help` really run** with the console variables cleared the way the app clears them (they must print their usage, exit 0, and change nothing), and that `.github/workflows` stays absent |
+| `check-scripts.mjs` | the `scripts/` layout (`run-web.*` and `run-desktop.*` at the top, everything else in `console/`, `setup/`, `tools/`, `checks/`), the console contract every Windows entry point must hold, **`setup/install.bat -Help` and `setup/uninstall.bat -Help` really run** with the console variables cleared the way the app clears them (they must print their usage, exit 0, and change nothing), and that the two release workflows exist and name three OSes + a separate `vncode-web` artefact |
 | `check-media-node.mjs` | `dsh-media`'s pin against a **synthetic archive** built and served over loopback (download, hash verification, mismatch refusal, atomic install, resolution order), plus the ffmpeg-dependent half, which skips loudly without ffmpeg |
 | `check-pdf-node.mjs` | the five `pdf_*` tools and the PDF routes against documents the check builds itself, including the engine's buffer semantics |
 | `check-skill-examples.mjs` | every fenced example in the shipped skills parses or compiles (Mermaid, TikZ) |
 | `check-media-examples.mjs` | every media/PDF example is a well-formed tool call and, where this host can run one, actually runs |
 | `check-browser-node.mjs` | `dsh-browser`'s host half: the disposable sandboxed renderer and the fetch policy in front of it |
-| `check-shell.mjs` | the native shell, **driven rather than read**: `vncode -Mode headless` is started against a stub CLI that binds a real port, spawns a grandchild of its own and prints a ready line carrying a recognisable token — with the app's own root (`VNCODE_HOME`), the harness home, **the person's home (`USERPROFILE`/`HOME`)** and **the platform data root (`LOCALAPPDATA`/`XDG_DATA_HOME`, from which `prefs.json` is read as a fallback)** all pointed into scratch, so the check can never write into — or drive a harness against — a real `~/.dsh`. The check asserts a foreign ready line is refused, that the token reaches neither stream nor any file the run created (in BOTH roots), that `stop` frees the port and kills the grandchild, that the flags and their refusals behave — including a `-Mode` this build does not have (`embed`) being refused BY NAME, so no build can promise a web view it does not draw — **the home ladder** (an unwritable inherited `DSH_HOME` falls through to `<app root>/home` and is read back out of the CHILD's own environment, an impossible `-DshHome` refuses by name, a writable inherited one is joined and no second home is created, **an installation already on the machine is NOT used as the home in either state**, and **a home remembered in `prefs.json` is read from the root the ladder chose and used, with no second home created**), that a child whose `%TEMP%` is unwritable is handed `<app root>/tmp` instead (read back out of the child, with the reason in the log), that `install -Help` and `uninstall -Help` run through the SAME runner the panel's buttons use (the installer's own usage must reach the shell's log, and the profile must not change), that `app/src-tauri` is gone and the old distributer has not come back, and it runs `cargo test --workspace` with a scratch root it controls. It starts no browser: the hand-off is unit-tested instead — the argv (including the profile flag a Chromium may be given, with the URL still exactly one argument), the loopback refusal, the rung order (the person's browser, then the same browser with a profile inside this app's own root, then the platform's opener), and the settle-window verdict that reads an exited program (`Handed` on zero, `Died` on a failure status, `Running` while it lives, and `Unverified` for an opener whose zero proves nothing) — which is what stops a spawn, or a `rundll32` exit code, from being reported as a tab that opened. Needs the Rust toolchain; skips loudly without it |
+| `check-shell.mjs` | the app, **driven rather than read**: `-Version` and `-Help` answer; `-Mode embed` - the flag the deleted web view used to answer - is refused BY NAME; the binary is kept under a size ceiling a GUI stack cannot sneak past; and `start` is run against a **throwaway tree with stub scripts**, so the whole bridge is exercised without starting node: a home with no pack makes it run `scripts/setup/install.*` first, the launcher is handed `-DshHome` and, on Windows, `-NoTerminal`, both children's own environments are read back to prove `DSH_HOME` was composed and that the app's root and the console markers were REMOVED, no key file is written when there is no terminal to ask at, and `status` names the same home. It also proves `scripts/run-web.* -Help` answers with nothing but the web half present. Fixtures live under `.scratch/`, never in a temp directory the host may deny, and it runs `cargo test --workspace` with a scratch root it controls |
 
 ## The checks that live inside a package
 
@@ -62,21 +61,6 @@ browser is not evidence — read the output.
 |---|---|
 | `check-audio-browser.mjs` | the audio console's device/routing/tone claims against the real browser APIs |
 
-## The checks that need a build this host may not be able to make
-
-`check-pane.mjs` builds the shell **twice** — once with the opt-in `pane` feature and once
-without — and asserts that the two **disagree**, because that disagreement is the whole
-contract: the default build compiles no engine and refuses `-Mode embed` by name, and the
-pane build accepts it and says so in its usage. It runs the pane crate's own tests (the
-rectangle, the visibility table, the loopback re-check, the permission answer) with the
-feature on, and it leaves the DEFAULT binary behind.
-
-It skips loudly when the host cannot build the pane at all — no `cargo`, no route to
-crates.io for `wry`, or no system WebKitGTK on Linux. A build failure that is **not** one of
-those host reasons is a failure, not a skip, so a compile error can never hide behind it.
-It starts no window: `-Mode embed -Help` parses the flag and prints the usage, which is the
-observable that proves the mode is real.
-
 ## The standard a check follows
 
 1. **Drive behaviour, don't grep a call shape.** A source-text assertion is only
@@ -90,6 +74,9 @@ observable that proves the mode is real.
 4. **Never weaken a check to make a change fit.** Fix the code, or change the
    check deliberately and say why in the commit.
 
-There is **no CI on purpose**: these are run by hand. Wiring them into Actions
-would re-add a workflow the maintainer deleted, and `check-scripts.mjs`
-asserts that it has not come back.
+**CI does not run these.** They are run by hand, because most of them need a browser, a
+SuperCollider, ffmpeg or TeX that a runner does not have. `.github/workflows/ci.yml` runs
+what a runner *can* own - clippy with warnings denied, the workspace tests, a release build
+and the size budget - and `release.yml` calls that same workflow as its gate, so a tag is
+checked on all three OSes before anything is published. `check-scripts.mjs` asserts both
+workflows exist, so a deleted release pipeline cannot come back silently either.
diff --git a/scripts/checks/check-pane.mjs b/scripts/checks/check-pane.mjs
deleted file mode 100644
index 9523fb7..0000000
--- a/scripts/checks/check-pane.mjs
+++ /dev/null
@@ -1,166 +0,0 @@
-#!/usr/bin/env node
-// check-pane.mjs - the pane's contract, which is a contract about TWO BUILDS.
-//
-// The pane is opt-in (`cargo build --features pane`), so the one thing that has to be true
-// is that the two builds DISAGREE, in both directions:
-//
-//   the DEFAULT build compiles no engine at all, and refuses `-Mode embed` BY NAME;
-//   the build WITH the pane accepts it, and its usage text says so.
-//
-// Both halves are asserted, in that order, and the default binary is rebuilt at the end.
-// A check that only drove the pane build would pass while `-Mode embed` was a no-op
-// everywhere; one that only drove the default build would pass while the pane did not
-// exist. Neither is worth having.
-//
-// It SKIPS LOUDLY (exit 0) when this host cannot build the pane - no cargo, no way to
-// resolve `wry` from crates.io, or no system WebKitGTK on Linux - because that is the
-// pack's rule for a check a host cannot run: a green run there is not evidence, and the
-// output says so. A build failure that is NOT one of those host reasons is a FAILURE, not a
-// skip, so a compile error can never hide behind the skip.
-//
-// It starts no window and needs no browser engine at runtime: `-Mode embed -Help` parses
-// the flag and prints the usage, which is the observable that proves the mode is real.
-import { spawnSync } from 'node:child_process'
-import fs from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const here = path.dirname(fileURLToPath(import.meta.url))
-const root = path.resolve(here, '..', '..')
-const app = path.join(root, 'app')
-const exeName = process.platform === 'win32' ? 'vncode.exe' : 'vncode'
-
-const failures = []
-const fail = (message) => failures.push(message)
-const skip = (message) => {
-  console.log(`check-pane: SKIP - ${message}`)
-  process.exit(0)
-}
-const check = (what, ok, detail) => {
-  if (ok) {
-    console.log(`  ok    ${what}`)
-  } else {
-    console.log(`  FAIL  ${what}`)
-    fail(`${what}${detail ? `\n        ${detail}` : ''}`)
-  }
-}
-
-/** A failed build is only a SKIP when it failed for a reason that is about the HOST. */
-const HOST_REASONS =
-  /failed to (download|get|select|fetch)|network|registry|crates\.io index|no matching package|timed out|pkg-config|webkit2gtk|gtk\+|cannot find -l|linker .* not found|could not find system library/i
-
-function build(extra) {
-  const args = ['build', '-p', 'vn-shell']
-  if (extra) args.push(...extra)
-  const started = Date.now()
-  const built = spawnSync('cargo', args, { cwd: app, encoding: 'utf8', shell: false })
-  const text = `${built.stdout ?? ''}${built.stderr ?? ''}`
-  return { status: built.status, text, seconds: Math.round((Date.now() - started) / 1000), args }
-}
-
-function run(args) {
-  const binary = path.join(app, 'target', 'debug', exeName)
-  if (!fs.existsSync(binary)) return { status: null, stdout: '', stderr: '' }
-  return spawnSync(binary, args, { encoding: 'utf8', shell: false })
-}
-
-// ---------------------------------------------------------------------------
-// Is there a cargo to build with at all?
-// ---------------------------------------------------------------------------
-const cargo = spawnSync('cargo', ['--version'], { encoding: 'utf8', shell: false })
-if (cargo.error || cargo.status !== 0) {
-  skip('no cargo on PATH - the pane is a Rust build, so this host cannot run this check')
-}
-
-// ---------------------------------------------------------------------------
-// The build WITH the pane
-// ---------------------------------------------------------------------------
-console.log('check-pane: building the pane (cargo build -p vn-shell --features pane)...')
-const pane = build(['--features', 'pane'])
-if (pane.status !== 0) {
-  if (HOST_REASONS.test(pane.text)) {
-    skip(`the pane cannot be built on this host: ${pane.text.trim().split('\n').pop()}`)
-  }
-  fail(`the pane build failed:\n${pane.text}`)
-  report()
-}
-console.log(`  ok    the pane build links (${pane.seconds}s, wry + the OS engine bindings)`)
-
-// The flag is a real mode in THIS build, and the usage text admits it.
-const embedHelp = run(['-Mode', 'embed', '-Help'])
-check('the pane build accepts -Mode embed', embedHelp.status === 0, `exit ${embedHelp.status}`)
-check(
-  'the pane build\'s usage names -Mode embed',
-  (embedHelp.stdout ?? '').includes('-Mode embed'),
-)
-// The flag list the rest of the repo depends on is still complete in this build.
-for (const flag of ['-Port', '-DshHome', '-DshVersion', '-Mode', '-Help']) {
-  check(`the pane build's usage still names ${flag}`, (embedHelp.stdout ?? '').includes(flag))
-}
-
-// The pane's own rules - the rectangle, the visibility table, the loopback re-check, the
-// permission answer, and the purge of what the engine records about where the pane went - are
-// unit tests in the crate, and they run with the feature on. Two of them write real files, so
-// they are given a scratch root inside the checkout: a host that denies %TEMP% to a child would
-// otherwise turn those into a failure about the host rather than about the code, which is the
-// same reason `check-shell.mjs` points VNCODE_TEST_DIR here.
-const scratch = path.join(root, '.scratch', 'cargo-test')
-fs.mkdirSync(scratch, { recursive: true })
-const paneTests = spawnSync('cargo', ['test', '-p', 'vn-shell-pane', '--features', 'pane'], {
-  cwd: app,
-  encoding: 'utf8',
-  shell: false,
-  env: { ...process.env, VNCODE_TEST_DIR: scratch },
-})
-check(
-  'the pane\'s own tests pass with the feature on',
-  paneTests.status === 0,
-  `${(paneTests.stdout ?? '').split('\n').filter((line) => line.includes('test result')).join(' | ')}`,
-)
-
-// ---------------------------------------------------------------------------
-// The build WITHOUT it - and the two must disagree
-// ---------------------------------------------------------------------------
-console.log('check-pane: rebuilding the default shell (cargo build -p vn-shell)...')
-const plain = build(null)
-if (plain.status !== 0) {
-  fail(`the default build failed:\n${plain.text}`)
-  report()
-}
-console.log(`  ok    the default build compiles no engine (${plain.seconds}s)`)
-
-const noPane = run(['-Mode', 'embed'])
-check('the default build refuses -Mode embed', noPane.status === 1, `exit ${noPane.status}`)
-check(
-  'the refusal says this build draws no web view',
-  /draws no web view/.test(noPane.stderr ?? ''),
-  noPane.stderr ?? '',
-)
-check(
-  'the refusal names the mode that does work',
-  /chrome/.test(noPane.stderr ?? ''),
-  noPane.stderr ?? '',
-)
-
-const plainHelp = run(['-Help'])
-check('the default build\'s usage does NOT promise a pane', plainHelp.status === 0 && !(plainHelp.stdout ?? '').includes('-Mode embed'))
-check(
-  'the default build\'s usage still names every flag it takes',
-  ['-Port', '-DshHome', '-DshVersion', '-Mode', '-Help'].every((flag) =>
-    (plainHelp.stdout ?? '').includes(flag),
-  ),
-)
-
-// ---------------------------------------------------------------------------
-report()
-
-function report() {
-  if (failures.length > 0) {
-    console.error(`\ncheck-pane: ${failures.length} problem(s)`)
-    for (const failure of failures) console.error(`  - ${failure}`)
-    process.exit(1)
-  }
-  console.log(
-    '\ncheck-pane: OK - the default build promises no pane, and the pane build has one',
-  )
-}
diff --git a/scripts/checks/check-shell.mjs b/scripts/checks/check-shell.mjs
index 6c1d8ea..3bf615a 100644
--- a/scripts/checks/check-shell.mjs
+++ b/scripts/checks/check-shell.mjs
@@ -1,731 +1,311 @@
 #!/usr/bin/env node
-//  scripts/checks/check-shell.mjs - the native shell, DRIVEN rather than read.
+// check-shell.mjs - the native app, DRIVEN.
 //
-//  What this proves, and why each one is here rather than in a `cargo test`:
+// What this proves, and why each one is here:
 //
-//   1. the ready-line refusals. A stub CLI prints a ready line naming a host that
-//      is NOT loopback, and the shell must not open it and must say so. That rule
-//      is unit-tested in Rust too, but the unit test cannot prove the WIRING: that
-//      the URL the harness really printed is the one that reaches the policy.
-//   2. the launch token never leaves memory. The same stub prints a ready line
-//      carrying a recognisable token. The check then reads every byte the shell
-//      wrote: stdout, stderr, every file under the home it was given, and the log
-//      the panel draws. The token must appear in NONE of them. The shell has to
-//      hold it (the pane and the browser hand-off need it), so "not written down"
-//      is a claim that can only be tested by running it.
-//   3. Stop really stops. The stub BINDS the port it is told to use and spawns a
-//      grandchild of its own. After `stop` on stdin the check asserts the port is
-//      refused again, the grandchild's pid is gone, and the shell SAID so - the
-//      `free=yes` line is the shell's own measurement, not this check's.
-//   4. the flags. `-Help` prints the set the launchers share, an unknown flag is
-//      refused BY NAME, and a `-Mode` this build cannot honour is refused rather
-//      than silently downgraded.
-//   5. the move off Tauri is complete: `app/src-tauri` is gone, the shell's source
-//      is a cargo workspace under `app/`, and the ship list carries it.
-//   6. M0's claim: the home is one the app CREATED and proved, and the child's
-//      environment is composed rather than inherited. An unwritable inherited
-//      `DSH_HOME` falls through to `<app root>/home`; the same path as `-DshHome`
-//      refuses by name; a writable inherited one is joined. The stub prints the
-//      environment it was handed, so this is read back out of the CHILD.
+//   1. IT BUILDS, and it is small. `cargo build --release` in `app/` (skipped, loudly,
+//      when there is no cargo and no binary on this host), then a size ceiling a
+//      dependency that draws a window or a web view cannot sneak past.
+//   2. IT ANSWERS. `-Version`, `-Help`, and the flag the deleted web view used to answer:
+//      `-Mode embed` must FAIL BY NAME. A flag that quietly means something else is the
+//      bug this whole revision exists to remove.
+//   3. THE BRIDGE. `vncode start` is run against a THROWAWAY TREE: a `.dsh-version.json`,
+//      a copied binary, a home, and STUB scripts - `scripts/setup/install.*` and
+//      `scripts/run-web.*` that record what they were given and exit 0. So the app is
+//      driven end to end - install-when-missing, the key prompt declined at a pipe, the
+//      launcher handed the right flags - WITHOUT starting node, binding a port or
+//      opening a tab.
+//   4. THE ENVIRONMENT IS COMPOSED, NOT INHERITED. Each stub reads `DSH_HOME`,
+//      `VNCODE_HOME` and the console markers out of its OWN environment and says what it
+//      saw, so an inherited home or a leaked `VNCODE_CONSOLE` is a failure here rather
+//      than a mystery on somebody's machine. That leak is not hypothetical: the old app's
+//      first Install button ran a full install while being asked for `-Help`.
+//   5. NO KEY IS WRITTEN when there is no terminal to ask at, and no launch token reaches
+//      the console.
+//   6. THE WEB HALF STANDS ALONE. `scripts/run-web.* -Help` answers with no app involved.
 //
-//  Every run is confined to a scratch app root (`VNCODE_HOME`) and a scratch harness
-//  home, so this check never writes into a person's own `~/.dsh` or `%LOCALAPPDATA%`.
+// Every fixture lives under `.scratch/` inside the repository. A check must not depend on
+// a temp directory the host may deny - that is how a real bug once looked like a failure
+// of the host - and `VNCODE_TEST_DIR` points the Rust tests at the same place.
 //
-//  Run:  node scripts/checks/check-shell.mjs
-//        VNCODE_SHELL=/path/to/vncode  to test an already-built binary
-//
-//  A host with no Rust toolchain and no built binary SKIPS LOUDLY (exit 0). That
-//  is not a pass: read the output.
+// Run:  node scripts/checks/check-shell.mjs
 
-import { spawn, spawnSync } from 'node:child_process'
+import { spawnSync } from 'node:child_process'
 import fs from 'node:fs'
 import path from 'node:path'
-import net from 'node:net'
 import { fileURLToPath } from 'node:url'
 
 const here = path.dirname(fileURLToPath(import.meta.url))
 const repo = path.resolve(here, '..', '..')
 const app = path.join(repo, 'app')
-const scratch = path.join(repo, '.scratch', 'check-shell')
+const scratch = path.join(repo, '.scratch')
+const isWindows = process.platform === 'win32'
+
 const failures = []
 const notes = []
-
 const fail = (message) => failures.push(message)
-const skip = (message) => {
-  console.log(`check-shell: SKIP - ${message}`)
-  process.exit(0)
-}
+const note = (message) => notes.push(message)
 
-/** A token recognisable in a haystack, assembled so this file holds no literal. */
-const TOKEN = ['check', 'shell', '1234567890abcdef'].join('-')
-const EVIL_HOST = 'not-loopback.example'
+const built = path.join(app, 'target', 'release', 'vncode' + (isWindows ? '.exe' : ''))
 
 // ---------------------------------------------------------------------------
-// The binary
+// 1. It builds, and it is small
 // ---------------------------------------------------------------------------
-const exeName = process.platform === 'win32' ? 'vncode.exe' : 'vncode'
-
-function builtBinary() {
-  // DEBUG FIRST, because that is the profile this check builds (`cargo build`). A
-  // release binary left over from an earlier build would otherwise be tested
-  // instead - measured: this check reported an "unknown command" for a headless
-  // command that existed, because it was driving a release build from before the
-  // change.
-  for (const profile of ['debug', 'release']) {
-    const candidate = path.join(app, 'target', profile, exeName)
-    if (fs.existsSync(candidate)) return candidate
-  }
-  return null
-}
-
-function findBinary() {
-  if (process.env.VNCODE_SHELL) {
-    const given = process.env.VNCODE_SHELL
-    if (!fs.existsSync(given)) skip(`VNCODE_SHELL names ${given}, which does not exist`)
-    return given
-  }
-  const cargo = spawnSync('cargo', ['--version'], { encoding: 'utf8', shell: false })
-  if (cargo.error || cargo.status !== 0) {
-    const existing = builtBinary()
-    if (existing) {
-      notes.push('cargo is missing, so the binary on disk was tested AS IS - it may be stale')
-      return existing
+function build() {
+  if (!fs.existsSync(built)) {
+    const cargo = spawnSync('cargo', ['build', '--release', '--locked', '-p', 'vn-shell'], {
+      cwd: app,
+      encoding: 'utf8',
+    })
+    if (cargo.error) {
+      note(`cargo could not run (${cargo.error.message}) - the binary checks are SKIPPED`)
+      return false
+    }
+    if (cargo.status !== 0) {
+      fail(`cargo build failed:\n${cargo.stdout}\n${cargo.stderr}`)
+      return false
     }
-    skip('no cargo on PATH and no built vncode binary - build it with `cargo build` in app/')
   }
-  // Built EVERY run, not only when one is missing: cargo is a no-op while the
-  // sources are current, and a check that tested a stale binary would report OK
-  // about code nobody has.
-  console.log('check-shell: building the shell (cargo build -p vn-shell)...')
-  const build = spawnSync('cargo', ['build', '-p', 'vn-shell'], {
-    cwd: app,
-    encoding: 'utf8',
-    shell: false,
-  })
-  if (build.status !== 0) {
-    fail(`cargo build failed:\n${build.stdout ?? ''}${build.stderr ?? ''}`)
-    report()
+  const size = fs.statSync(built).size
+  note(`the binary is ${(size / 1024 / 1024).toFixed(2)} MB`)
+  // The release budget is 6 MB and CI owns it; this is the ceiling that catches the
+  // regression by SHAPE - a GUI stack or a web engine arriving as a dependency.
+  if (size > 12 * 1024 * 1024) {
+    fail(`the binary is ${(size / 1024 / 1024).toFixed(1)} MB - something with a GUI in it came back`)
   }
-  const built = builtBinary()
-  if (!built) fail('cargo reported success but no vncode binary was produced')
-  return built
+  return true
 }
 
 // ---------------------------------------------------------------------------
-// The stub CLI
+// 2. It answers, and refuses what it no longer has
 // ---------------------------------------------------------------------------
-const stubPath = path.join(scratch, 'stub-cli.mjs')
-
-/**
- * A stand-in for `dsh web`: it takes the SAME argv the real CLI takes, binds the
- * port it was given, prints a ready line, and stays alive until it is killed.
- *
- * `VNCODE_STUB_MODE=evil` swaps the ready line for one naming a foreign host.
- *
- * It also prints the environment it was GIVEN. That is not decoration: M0's whole
- * claim is that the child's environment is composed rather than inherited, and the
- * only proof of a composed environment is the child reading it back.
- */
-function writeStub() {
-  fs.mkdirSync(scratch, { recursive: true })
-  fs.writeFileSync(
-    stubPath,
-    `import net from 'node:net'
-import { spawn } from 'node:child_process'
-import fs from 'node:fs'
-
-const argv = process.argv.slice(2)
-const at = argv.indexOf('--port')
-const port = Number(argv[at + 1])
-const mode = process.env.VNCODE_STUB_MODE ?? 'good'
-const token = process.env.VNCODE_STUB_TOKEN
-const evilHost = process.env.VNCODE_STUB_HOST ?? 'example.invalid'
-const grandchildPidFile = process.env.VNCODE_STUB_PID_FILE
-
-// What this child was GIVEN, which is what the shell says it composed.
-process.stdout.write('[stub] DSH_HOME=' + (process.env.DSH_HOME ?? '(unset)') + '\\n')
-process.stdout.write('[stub] VNCODE_HOME=' + (process.env.VNCODE_HOME ?? '(unset)') + '\\n')
-process.stdout.write('[stub] npm_config_cache=' + (process.env.npm_config_cache ?? '(unset)') + '\\n')
-process.stdout.write('[stub] VNCODE_CONSOLE=' + (process.env.VNCODE_CONSOLE ?? '(unset)') + '\\n')
-process.stdout.write('[stub] TEMP=' + (process.env.TEMP ?? '(unset)') + '\\n')
-
-// A grandchild of our own: the process TREE is what Stop must take down, and a
-// supervisor that only killed its direct child would leave this one alive.
-if (grandchildPidFile) {
-  const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], {
-    stdio: 'ignore',
-    detached: false,
-  })
-  fs.writeFileSync(grandchildPidFile, String(child.pid))
-}
-
-// The ready line the real CLI prints, against a host the shell must refuse. The
-// port is NOT bound in this mode: there is no instance to reach.
-if (mode === 'evil') {
-  process.stdout.write('dsh web: http://' + evilHost + ':' + port + '/?token=' + token + '\\n')
-  setInterval(() => {}, 1000)
-} else {
-  // The port is really HELD, so "the port came free" is a measurement.
-  const server = net.createServer(() => {})
-  server.listen(port, '127.0.0.1', () => {
-    process.stdout.write('dsh web: http://127.0.0.1:' + port + '/?token=' + token + '\\n')
-  })
-  setInterval(() => {}, 1000)
-}
-`,
-  )
-}
-
-// ---------------------------------------------------------------------------
-// Running the shell
-// ---------------------------------------------------------------------------
-const isFree = (port) =>
-  new Promise((resolve) => {
-    const socket = net.connect({ host: '127.0.0.1', port })
-    socket.on('connect', () => {
-      socket.destroy()
-      resolve(false)
-    })
-    socket.on('error', () => resolve(true))
-    socket.setTimeout(1500, () => {
-      socket.destroy()
-      resolve(true)
-    })
+function runBinary(args, options = {}) {
+  const result = spawnSync(built, args, {
+    encoding: 'utf8',
+    cwd: options.cwd ?? repo,
+    env: options.env ?? process.env,
+    timeout: 120_000,
   })
-
-/**
- * Start `vncode -Mode headless` against the stub and collect everything it says.
- *
- * Every run is confined to a scratch APP ROOT (`VNCODE_HOME`), a scratch harness home,
- * AND a scratch USER HOME (`USERPROFILE`/`HOME`), so a check can never write into the
- * machine's own `~/.dsh` or into the `%LOCALAPPDATA%\vncode` a person's real app uses.
- * That last one is not decoration: the app USES an installation it finds on the machine
- * (`~/.dsh`), so a check that left `USERPROFILE` alone would drive the harness against a
- * person's real home. `env` overrides any of them, which is how the confined, joined and
- * found-installation cases are built.
- */
-function startShell({ mode = 'good', label, env = {}, dshHome, userHome, seed } = {}) {
-  const home = dshHome === undefined ? path.join(scratch, `home-${label}`) : dshHome
-  const appRoot = path.join(scratch, `app-${label}`)
-  const person = userHome === undefined ? path.join(scratch, `user-${label}`) : userHome
-  if (dshHome === undefined) {
-    fs.rmSync(home, { recursive: true, force: true })
-    fs.mkdirSync(home, { recursive: true })
+  return {
+    status: result.status,
+    stdout: result.stdout ?? '',
+    stderr: result.stderr ?? '',
+    error: result.error,
   }
-  fs.rmSync(appRoot, { recursive: true, force: true })
-  fs.mkdirSync(appRoot, { recursive: true })
-  fs.mkdirSync(person, { recursive: true })
-  // A case may seed the app's own root - which is how "this home already holds
-  // something of the person's" is built.
-  if (seed) seed(appRoot)
-  const pidFile = path.join(scratch, `grandchild-${label}.pid`)
-  fs.rmSync(pidFile, { force: true })
-  const args = ['-Mode', 'headless', '-DshVersion', '0.0.0-check']
-  // The flag is only passed when a home was named: `-DshHome` is the STRICT rung of
-  // the ladder, so an inherited-home case must not carry one.
-  if (dshHome !== undefined && dshHome !== null) args.push('-DshHome', dshHome)
-  let base = { ...process.env }
-  // THIS check's environment is not the app's. The machine running the check may well
-  // have a DSH_HOME of its own exported (the harness that started this shell does), and
-  // the app's ladder would rightly join it - so it is REMOVED here and every case that
-  // wants an inherited home passes one explicitly. Same for the app's own root.
-  delete base.DSH_HOME
-  delete base.VNCODE_HOME
-  const child = spawn(binary, args, {
-    cwd: repo,
-    env: {
-      ...base,
-      // The seam: the shell runs THIS instead of the pinned harness, through the
-      // same argv and the same ready-line watch as the real thing.
-      VNCODE_STUB_CLI: process.execPath,
-      VNCODE_STUB_ARGS: JSON.stringify([stubPath]),
-      VNCODE_STUB_MODE: mode,
-      VNCODE_STUB_HOST: EVIL_HOST,
-      VNCODE_STUB_TOKEN: TOKEN,
-      VNCODE_STUB_PID_FILE: pidFile,
-      // The app's own root, the home the run starts from, and the person's home - all
-      // in scratch. The caller's overrides win, which is how a refused, a joined or a
-      // found home is built.
-      VNCODE_HOME: appRoot,
-      USERPROFILE: person,
-      HOME: person,
-      // THE PLATFORM DATA ROOT TOO, and this one is not decoration: `prefs.json` is
-      // read from the root the ladder chose with the platform root as a read-only
-      // FALLBACK (the migration from an older build that wrote it there), so a check
-      // that left `%LOCALAPPDATA%` alone could pick up a real person's remembered home
-      // and drive the harness against it. `data_root()` reads LOCALAPPDATA on Windows,
-      // XDG_DATA_HOME else ~/.local/share on Linux, and HOME on macOS - the first two
-      // are named here; HOME is already scratch above.
-      LOCALAPPDATA: path.join(scratch, 'localappdata'),
-      XDG_DATA_HOME: path.join(scratch, 'localappdata'),
-      ...env,
-    },
-    stdio: ['pipe', 'pipe', 'pipe'],
-  })
-  const state = { child, home, appRoot, pidFile, out: '', err: '', exit: null }
-  child.stdout.on('data', (chunk) => (state.out += chunk))
-  child.stderr.on('data', (chunk) => (state.err += chunk))
-  child.on('exit', (code) => (state.exit = code))
-  return state
 }
 
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
-
-async function waitFor(state, predicate, timeoutMs, what) {
-  const deadline = Date.now() + timeoutMs
-  while (Date.now() < deadline) {
-    if (predicate()) return true
-    await sleep(100)
+function answers() {
+  const version = runBinary(['-Version'])
+  if (version.status !== 0 || !/\d+\.\d+\.\d+/.test(version.stdout)) {
+    fail(`-Version did not answer with a version: ${JSON.stringify(version.stdout)}`)
   }
-  fail(`timed out after ${timeoutMs}ms waiting for ${what}\n--- stdout ---\n${state.out}\n--- stderr ---\n${state.err}`)
-  return false
-}
 
-const runningPort = (state) => {
-  const match = state.out.match(/running on http:\/\/127\.0\.0\.1:(\d+)\//)
-  return match ? Number(match[1]) : null
-}
+  const help = runBinary(['-Help'])
+  if (help.status !== 0) fail(`-Help exited ${help.status}`)
+  for (const word of ['install', 'uninstall', 'status', 'key', '-DshHome', '-Port']) {
+    if (!help.stdout.includes(word)) fail(`-Help never mentions ${word}`)
+  }
+  if (help.stdout.includes('embed')) {
+    fail('-Help advertises an embedded web view this build does not have')
+  }
 
-/** Every file under a directory, for the "no secret on disk" scan. */
-function filesUnder(directory) {
-  const found = []
-  const walk = (current) => {
-    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
-      const full = path.join(current, entry.name)
-      if (entry.isDirectory()) walk(full)
-      else found.push(full)
-    }
+  // The pane's mode. It must be a refusal that NAMES the flag: "we removed it" and "it
+  // silently does nothing now" are different promises.
+  const embed = runBinary(['-Mode', 'embed'])
+  if (embed.status === 0) fail('-Mode embed was accepted by a build with no web view')
+  if (!/unknown flag/i.test(embed.stderr)) {
+    fail(`-Mode embed was refused without naming the flag: ${JSON.stringify(embed.stderr)}`)
   }
-  if (fs.existsSync(directory)) walk(directory)
-  return found
 }
 
 // ---------------------------------------------------------------------------
-// The checks
+// 3-5. The bridge, against stubs
 // ---------------------------------------------------------------------------
-async function checkRefusal() {
-  const state = startShell({ mode: 'evil', label: 'evil' })
-  await waitFor(state, () => /does not name a loopback address/.test(state.out + state.err), 15000, 'the refusal of a foreign ready line')
-  // The shell must NOT have reached "running": it refused the URL, so there is
-  // nothing to show.
-  if (/running on http/.test(state.out)) {
-    fail('the shell reported a running instance after refusing a non-loopback ready line')
-  }
-  if (state.out.includes(TOKEN) || state.err.includes(TOKEN)) {
-    fail('the refusal path echoed the launch token')
-  }
-  state.child.stdin.end('quit\n')
-  await waitFor(state, () => state.exit !== null, 15000, 'the refusal run to exit')
-  console.log('check-shell: a ready line naming a foreign host is refused, and the token is not echoed')
+/** A stub script: records what it was given, then exits 0. `up` walks to the tree root. */
+function stubScript(recordName, up) {
+  // `up` is `..` from `scripts/` and `../..` from `scripts/setup/`: the two stubs live at
+  // different depths, and a record written one level too high is a check that fails for
+  // its own bug rather than the app's.
+  if (isWindows) {
+    const parents = up.replace(/\//g, '\\')
+    return [
+      '@echo off',
+      `echo args=%* > "%~dp0${parents}\\${recordName}"`,
+      `echo DSH_HOME=%DSH_HOME% >> "%~dp0${parents}\\${recordName}"`,
+      `echo VNCODE_HOME=[%VNCODE_HOME%] >> "%~dp0${parents}\\${recordName}"`,
+      `echo VNCODE_CONSOLE=[%VNCODE_CONSOLE%] >> "%~dp0${parents}\\${recordName}"`,
+      `echo TMP=[%TMP%] >> "%~dp0${parents}\\${recordName}"`,
+      'exit /b 0',
+      '',
+    ].join('\r\n')
+  }
+  return [
+    '#!/bin/sh',
+    `record="$(dirname "$0")/${up}/${recordName}"`,
+    '{',
+    '  echo "args=$*"',
+    '  echo "DSH_HOME=$DSH_HOME"',
+    '  echo "VNCODE_HOME=[$VNCODE_HOME]"',
+    '  echo "VNCODE_CONSOLE=[$VNCODE_CONSOLE]"',
+    '  echo "TMP=[$TMPDIR]"',
+    '} > "$record"',
+    'exit 0',
+    '',
+  ].join('\n')
 }
 
-async function checkLifetime() {
-  const state = startShell({ mode: 'good', label: 'good' })
-  if (!(await waitFor(state, () => runningPort(state) !== null, 20000, 'the ready line'))) return
-  const port = runningPort(state)
-
-  if (await isFree(port)) {
-    // Sanity: if the stub never held the port, the "free again" assertion below
-    // would pass for the wrong reason.
-    fail(`the stub was expected to hold port ${port}, but nothing is listening on it`)
-  }
-
-  // 1. The token was never echoed, on either stream.
-  if (state.out.includes(TOKEN)) fail('the launch token reached stdout')
-  if (state.err.includes(TOKEN)) fail('the launch token reached stderr')
-  // ...and the safe line is still useful: it names the address.
-  if (!/http:\/\/127\.0\.0\.1:\d+\//.test(state.out)) {
-    fail('the running line does not name the loopback address at all')
-  }
+function bridge() {
+  const root = path.join(scratch, `shell-bridge-${process.pid}`)
+  fs.rmSync(root, { recursive: true, force: true })
+  fs.mkdirSync(path.join(root, 'bin'), { recursive: true })
+  fs.mkdirSync(path.join(root, 'scripts', 'setup'), { recursive: true })
+  fs.mkdirSync(path.join(root, 'data'), { recursive: true })
+
+  // The pin is what makes the tree a tree: `repo_root()` walks up from the binary for it.
+  fs.writeFileSync(path.join(root, '.dsh-version.json'), JSON.stringify({ dsh: '9.9.9' }))
+  fs.copyFileSync(built, path.join(root, 'bin', path.basename(built)))
+
+  const setup = path.join(root, 'scripts', 'setup')
+  const ext = isWindows ? '.bat' : '.sh'
+  fs.writeFileSync(path.join(setup, 'install' + ext), stubScript('install-record.txt', '../..'))
+  fs.writeFileSync(path.join(setup, 'uninstall' + ext), stubScript('uninstall-record.txt', '../..'))
+  fs.writeFileSync(
+    path.join(root, 'scripts', 'run-web' + ext),
+    stubScript('runweb-record.txt', '..'),
+  )
 
-  // 2. Stop, and the shell's OWN measurement of the port.
-  state.child.stdin.write('stop\n')
-  if (!(await waitFor(state, () => /\[vncode\] stopped port=\d+ free=yes/.test(state.out), 20000, 'the free=yes line'))) {
+  const home = path.join(root, 'data', 'home')
+  const binary = path.join(root, 'bin', path.basename(built))
+  // The seed of every "it printed the wrong thing" report: an inherited home and an
+  // inherited console marker. Neither may reach a child, and neither may be believed.
+  const env = { ...process.env, VNCODE_HOME: path.join(root, 'data'), VNCODE_CONSOLE: '1' }
+  env.VNCODE_ARGV = 'do-not-leak'
+  delete env.DSH_HOME
+  delete env.DEEPSEEK_API_KEY
+
+  const run = (args) =>
+    spawnSync(binary, args, { encoding: 'utf8', cwd: root, env, timeout: 180_000 })
+
+  // --- start, with nothing installed -------------------------------------
+  const start = run(['start'])
+  if (start.error) {
+    fail(`start could not run: ${start.error.message}`)
     return
   }
-  if (!(await isFree(port))) {
-    fail(`the shell said the port was free, but something still holds ${port}`)
+  if (start.status !== 0) {
+    fail(`vncode start exited ${start.status}\n${start.stdout}\n${start.stderr}`)
   }
+  const printed = `${start.stdout}\n${start.stderr}`
+  if (/token=/i.test(printed)) fail('a launch token reached the console')
 
-  // 3. The grandchild: a supervisor that killed only its direct child would leave
-  //    a path holding the port.
-  if (fs.existsSync(state.pidFile)) {
-    const pid = Number(fs.readFileSync(state.pidFile, 'utf8').trim())
-    let alive = true
-    try {
-      process.kill(pid, 0)
-    } catch {
-      alive = false
+  const install = readRecord(root, 'install-record.txt')
+  if (!install) {
+    fail('vncode start did not run the installer for a home with no pack in it')
+  } else {
+    if (!install.includes('-DshHome')) fail(`the installer was not told the home: ${install}`)
+    if (!install.includes(home)) fail(`the installer was not told THIS home (${home}): ${install}`)
+    if (!install.includes('VNCODE_HOME=[]')) {
+      fail(`the app's own root leaked into the installer: ${install}`)
     }
-    if (alive) {
-      fail(`the harness's grandchild (pid ${pid}) survived Stop`)
-      try {
-        process.kill(pid, 'SIGKILL')
-      } catch {
-        /* it is already gone */
-      }
+    if (!install.includes('DSH_HOME=' + home)) {
+      fail(`the installer's DSH_HOME is not the chosen home: ${install}`)
     }
-  } else {
-    notes.push('the stub recorded no grandchild pid, so the tree kill was not observed')
-  }
-
-  await waitFor(state, () => state.exit !== null, 15000, 'the shell to exit after Stop')
-
-  // 4. Nothing on disk carries the token: every file the run created, plus the
-  //    log the panel would draw. BOTH roots are scanned, because M0 changed where
-  //    files land: the home is the harness's, the app root is this app's.
-  for (const directory of [state.home, state.appRoot]) {
-    for (const file of filesUnder(directory)) {
-      const text = fs.readFileSync(file, 'utf8')
-      if (text.includes(TOKEN)) fail(`${path.relative(repo, file)} contains the launch token`)
+    if (!install.includes('VNCODE_CONSOLE=[]')) {
+      fail(`the launcher's console marker leaked into the installer: ${install}`)
     }
   }
-  const created = filesUnder(state.home).length + filesUnder(state.appRoot).length
-  console.log(
-    `check-shell: start, ready line, stop - port freed, tree killed, ${created} file(s) created by the run, none carrying the token`,
-  )
-}
-
-/**
- * M0: the child's environment is COMPOSED, and the home is one this app can write.
- *
- * Three cases, and each one is the behaviour the revision exists for:
- *
- *   1. an inherited `DSH_HOME` that cannot be written FALLS THROUGH to
- *      `<app root>/home` - the app comes up, where the old build refused with a
- *      sentence asking the person to start it differently;
- *   2. the same impossible path given as `-DshHome` still REFUSES, naming the flag -
- *      an explicit instruction is never silently ignored;
- *   3. a writable inherited `DSH_HOME` is JOINED, and the app's own `home/` is never
- *      created, so an app started from inside a harness session shares that session's
- *      home rather than making a second one.
- *
- * The stub prints the environment it was given, so every claim here is read back out
- * of the CHILD rather than out of the shell's own log line.
- */
-async function checkConfinedHome() {
-  // A directory that cannot exist: its parent is a FILE, which no platform allows.
-  const blocker = path.join(scratch, 'confined-home-blocker')
-  fs.mkdirSync(scratch, { recursive: true })
-  fs.writeFileSync(blocker, 'a file, not a directory')
-  const impossible = path.join(blocker, 'home')
-
-  // 1. inherited and unwritable: fall through to the app's own home. The MACHINE's
-  //    temp is made unwritable in the same run, because that is the pair measured on a
-  //    real machine: `%TEMP%` refused the child while the app's own root worked, and
-  //    the harness's spill store died on `mkdtemp` because of it.
-  const confined = startShell({
-    label: 'confined',
-    env: { DSH_HOME: impossible, TEMP: impossible, TMP: impossible, TMPDIR: impossible },
-  })
-  if (!(await waitFor(confined, () => runningPort(confined) !== null, 20000, 'a ready line with an unwritable inherited home'))) {
-    return
-  }
-  const expected = path.join(fs.realpathSync(confined.appRoot), 'home')
-  if (!confined.out.includes(`[stub] DSH_HOME=${expected}`)) {
-    fail(`the child was not given <app root>/home\nexpected: ${expected}\n--- stdout ---\n${confined.out}`)
-  }
-  // ...and the temp it was given must be one it can write in, which the machine's was
-  // not: the app's own `<app root>/tmp`.
-  const expectedTemp = path.join(fs.realpathSync(confined.appRoot), 'tmp')
-  if (!confined.out.toLowerCase().includes(`[stub] temp=${expectedTemp.toLowerCase()}`)) {
-    fail(`the child was not given a writable temp\nexpected: ${expectedTemp}\n--- stdout ---\n${confined.out}`)
-  }
-  if (!confined.out.includes('for temp instead')) {
-    fail(`moving the child's temp was not explained\n--- stdout ---\n${confined.out}`)
-  }
-  if (!confined.out.includes('was refused')) {
-    fail(`the refused inherited home was not named\n--- stdout ---\n${confined.out}`)
-  }
-  if (!confined.out.includes('[stub] VNCODE_HOME=(unset)')) {
-    fail('VNCODE_HOME reached the child: the harness knows DSH_HOME and nothing else')
-  }
-  if (!confined.out.includes('[stub] VNCODE_CONSOLE=(unset)')) {
-    fail('a console marker reached the harness - the panel inherits them from the launcher')
-  }
-  confined.child.stdin.write('stop\n')
-  await waitFor(confined, () => confined.exit !== null, 20000, 'the confined run to stop')
 
-  // 2. the same path as -DshHome: a refusal, by name, before anything is spawned.
-  const strict = startShell({ label: 'strict', dshHome: impossible })
-  if (!(await waitFor(strict, () => strict.exit !== null, 20000, 'the refusal of an impossible -DshHome'))) {
-    return
-  }
-  if (strict.exit !== 1) fail(`an impossible -DshHome exited ${strict.exit}, expected 1`)
-  if (!/-DshHome names/.test(strict.err + strict.out)) {
-    fail(`the refusal did not name the flag\n--- stderr ---\n${strict.err}`)
-  }
-  if (runningPort(strict) !== null) {
-    fail('a harness was started despite an impossible -DshHome')
-  }
-
-  // 3. a writable inherited DSH_HOME is joined, and no second home is made.
-  const shared = path.join(scratch, 'shared-home')
-  fs.rmSync(shared, { recursive: true, force: true })
-  fs.mkdirSync(shared, { recursive: true })
-  const joined = startShell({ label: 'joined', dshHome: null, env: { DSH_HOME: shared } })
-  if (!(await waitFor(joined, () => runningPort(joined) !== null, 20000, 'a ready line on a joined home'))) {
-    return
-  }
-  if (!joined.out.includes(`[stub] DSH_HOME=${shared}`)) {
-    fail(`a writable inherited home was not joined\n--- stdout ---\n${joined.out}`)
-  }
-  if (!joined.out.includes('from the inherited DSH_HOME')) {
-    fail(`the panel does not say the home was inherited\n--- stdout ---\n${joined.out}`)
-  }
-  if (fs.existsSync(path.join(joined.appRoot, 'home'))) {
-    fail('the app created its own home as well as joining the inherited one')
-  }
-  joined.child.stdin.write('stop\n')
-  await waitFor(joined, () => joined.exit !== null, 20000, 'the joined run to stop')
-
-  // 4. AN INSTALLATION AT `~/.dsh` IS NEVER THE HOME THE APP RUNS AGAINST. It used to
-  //    be: a courtesy rung that ran the harness against `~/.dsh` while the app's own home
-  //    was still empty, and the person's word for the world without it was "still does
-  //    not run normally". A folder that carries everything it needs must not reach into a
-  //    person's profile to START - so the app's own home is used whether or not that
-  //    directory is a complete installation, and whether or not it holds a session. The
-  //    person's home here is scratch, so the rule is proved without going near a real one.
-  const person = path.join(scratch, 'person-found')
-  const installed = path.join(person, '.dsh')
-  fs.rmSync(person, { recursive: true, force: true })
-  fs.mkdirSync(path.join(installed, 'profiles', 'web'), { recursive: true })
-  fs.mkdirSync(path.join(installed, 'sessions'), { recursive: true })
-  fs.writeFileSync(path.join(installed, 'sessions', 'c1.json'), '{}')
-  fs.writeFileSync(path.join(installed, '.credentials.yaml'), 'deepseek: {apiKey: x}\n')
-  const found = startShell({ label: 'found', dshHome: null, userHome: person })
-  if (!(await waitFor(found, () => runningPort(found) !== null, 20000, 'a ready line on the app\'s own home'))) {
-    return
-  }
-  const ownHome = path.join(found.appRoot, 'home')
-  if (!found.out.includes(`[stub] DSH_HOME=${ownHome}`)) {
-    fail(`an installation at ~/.dsh was used as the home\n--- stdout ---\n${found.out}`)
-  }
-  if (found.out.includes(`[stub] DSH_HOME=${installed}`)) {
-    fail('the harness was run against ~/.dsh')
-  }
-  if (!found.out.includes('this app\'s own home')) {
-    fail(`the panel does not say which home it is using\n--- stdout ---\n${found.out}`)
+  const runweb = readRecord(root, 'runweb-record.txt')
+  if (!runweb) {
+    fail('vncode start never ran the web launcher - the bridge is the whole point')
+  } else {
+    if (!runweb.includes('-DshHome')) fail(`the launcher was not told the home: ${runweb}`)
+    if (!runweb.includes(home)) fail(`the launcher was not told THIS home (${home}): ${runweb}`)
+    if (isWindows && !runweb.includes('-NoTerminal')) {
+      fail(`the launcher was not told -NoTerminal, so a relaunch would look like an instant exit: ${runweb}`)
+    }
+    if (!runweb.includes('DSH_HOME=' + home)) {
+      fail(`the launcher's DSH_HOME is not the chosen home: ${runweb}`)
+    }
+    if (!runweb.includes('VNCODE_HOME=[]')) {
+      fail(`the app's own root leaked into the launcher: ${runweb}`)
+    }
+    if (!runweb.includes('VNCODE_CONSOLE=[]')) {
+      fail(`the console marker leaked into the launcher: ${runweb}`)
+    }
   }
-  found.child.stdin.write('stop\n')
-  await waitFor(found, () => found.exit !== null, 20000, 'the own-home run to stop')
 
-  // 5. ...and the SAME answer once the app's own home already holds a session of the
-  //    person's: the rung is gone, so there is no state in which `~/.dsh` wins.
-  const theirs = startShell({
-    label: 'theirs',
-    dshHome: null,
-    userHome: person,
-    seed: (appRoot) => {
-      fs.mkdirSync(path.join(appRoot, 'home', 'sessions'), { recursive: true })
-      fs.writeFileSync(path.join(appRoot, 'home', 'sessions', 'mine.json'), '{}')
-    },
-  })
-  if (!(await waitFor(theirs, () => runningPort(theirs) !== null, 20000, 'a ready line on the app\'s own home'))) {
-    return
+  // --- the key is not asked for at a pipe, and nothing is written ---------
+  const envFile = path.join(home, '.env')
+  if (fs.existsSync(envFile)) {
+    fail(`a key file was written with no terminal to ask at: ${envFile}`)
   }
-  if (!theirs.out.includes(`[stub] DSH_HOME=${theirs.appRoot}${path.sep}home`)) {
-    fail(`a home holding a session of its own was overridden\n--- stdout ---\n${theirs.out}`)
+  if (!/not a terminal/.test(printed)) {
+    fail(`start did not say why it skipped the key prompt: ${printed}`)
   }
-  theirs.child.stdin.write('stop\n')
-  await waitFor(theirs, () => theirs.exit !== null, 20000, 'the own-home run to stop')
 
-  // 6. THE HOME THE PANEL REMEMBERED IS READ FROM THE ROOT THE LADDER CHOSE. This is
-  //    the one-root rule, driven: `prefs.json` used to be written into the platform's
-  //    data directory while the window record went into the ladder's root, so on a
-  //    machine whose ladder fell through to `<tree>/.vncode` the answer could never be
-  //    read back and the first-run question returned on every launch. The record is
-  //    seeded into the APP ROOT - the scratch root this run's ladder chooses - and the
-  //    child must be given the home it names, with no flag and no screen in between.
-  const remembered = path.join(scratch, 'remembered-home')
-  fs.rmSync(remembered, { recursive: true, force: true })
-  fs.mkdirSync(remembered, { recursive: true })
-  const chosen = startShell({
-    label: 'remembered',
-    dshHome: null,
-    seed: (appRoot) => {
-      fs.writeFileSync(
-        path.join(appRoot, 'prefs.json'),
-        JSON.stringify({ version: 1, browser: null, home: remembered }),
-      )
-    },
-  })
-  if (!(await waitFor(chosen, () => runningPort(chosen) !== null, 20000, 'a ready line on the remembered home'))) {
-    return
-  }
-  if (!chosen.out.includes(`[stub] DSH_HOME=${remembered}`)) {
-    fail(`the remembered home was not used\n--- stdout ---\n${chosen.out}`)
-  }
-  if (!chosen.out.includes('the home you chose in this panel')) {
-    fail('the panel does not say the home was the one somebody chose')
-  }
-  if (fs.existsSync(path.join(chosen.appRoot, 'home'))) {
-    fail('the app created its own home as well as using the remembered one')
+  // --- status reports the same home, and starts nothing ------------------
+  const status = run(['status'])
+  if (status.status !== 0) fail(`status exited ${status.status}`)
+  if (!status.stdout.includes(home)) {
+    fail(`status does not name the home in use (${home}):\n${status.stdout}`)
   }
-  chosen.child.stdin.write('stop\n')
-  await waitFor(chosen, () => chosen.exit !== null, 20000, 'the remembered-home run to stop')
+  if (!/launcher:/.test(status.stdout)) fail('status does not name the launcher')
 
-  console.log(
-    'check-shell: an unwritable inherited home falls through, an impossible -DshHome refuses by name, a writable one is joined, an installation at ~/.dsh is never the home in use, and the remembered home is read from the root the ladder chose',
-  )
+  fs.rmSync(root, { recursive: true, force: true })
+  note('start, the installer and the launcher were driven against stub scripts')
 }
 
-async function checkSetupButtons() {
-  // The panel's Install and Uninstall buttons run `scripts/setup/install.*` with
-  // `-NoTerminal -NoPause` and stream its output into the log. This drives the
-  // SAME path through the shell's own headless commands, with `-Help` as the one
-  // invocation that installs nothing - so the plumbing (locate, spawn through the
-  // console layer, stream, read an exit code) is proved without changing a
-  // profile.
-  const state = startShell({ mode: 'good', label: 'setup' })
-  if (!(await waitFor(state, () => runningPort(state) !== null, 20000, 'the ready line'))) return
+function readRecord(root, name) {
+  const file = path.join(root, name)
+  return fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : ''
+}
 
-  state.child.stdin.write('install -Help\n')
-  if (!(await waitFor(state, () => /\[vncode\] install finished successfully/.test(state.out), 90000, 'the installer to answer -Help'))) {
+// ---------------------------------------------------------------------------
+// 6. The web half stands alone
+// ---------------------------------------------------------------------------
+function webHalf() {
+  const script = path.join(repo, 'scripts', 'run-web' + (isWindows ? '.bat' : '.sh'))
+  if (!fs.existsSync(script)) {
+    fail(`${script} is missing - launching only the web is a supported thing to do`)
     return
   }
-  if (!/Usage: scripts\\setup\\install\.bat/.test(state.out)) {
-    fail("the installer's own usage never reached the shell's log")
-  }
-  if (/(adding|removing) dsh-/.test(state.out)) {
-    fail('install -Help changed the profile - the console layer dropped the flag')
-  }
-  // The uninstaller goes through the same runner, so one run of each is what
-  // proves both buttons rather than one button and a copy of its code.
-  state.child.stdin.write('uninstall -Help\n')
-  if (!(await waitFor(state, () => /\[vncode\] uninstall finished successfully/.test(state.out), 90000, 'the uninstaller to answer -Help'))) {
+  // THE CONSOLE MARKERS ARE CLEARED, and that is the whole point of running it here.
+  // `adapt.cmd` marks a run it has set up with `VNCODE_CONSOLE`, and an entry point that
+  // sees the marker takes its arguments from the relaunched shell instead of `%*` - so a
+  // check that inherited the marker would test a path no double-click ever takes. It was
+  // measured: with the marker inherited, `run-web.bat -Help` started a real harness.
+  const env = {}
+  for (const [name, value] of Object.entries(process.env)) {
+    if (!name.startsWith('VNCODE_')) env[name] = value
+  }
+  const result = isWindows
+    ? spawnSync('cmd', ['/c', script, '-Help'], { encoding: 'utf8', cwd: repo, env })
+    : spawnSync('sh', [script, '-Help'], { encoding: 'utf8', cwd: repo, env })
+  if (result.status !== 0) {
+    fail(`run-web -Help exited ${result.status}: ${result.stdout}${result.stderr}`)
     return
   }
-  if (!/Usage: scripts\\setup\\uninstall\.bat/.test(state.out)) {
-    fail("the uninstaller's own usage never reached the shell's log")
-  }
-
-  state.child.stdin.write('stop\n')
-  await waitFor(state, () => state.exit !== null, 20000, 'the shell to exit')
-  console.log('check-shell: install and uninstall run through the panel path, and -Help changes nothing')
-}
-
-function checkFlags() {
-  const help = spawnSync(binary, ['-Help'], { encoding: 'utf8', shell: false })
-  if (help.status !== 0) fail(`-Help exited ${help.status}`)
-  for (const flag of ['-Port', '-DshHome', '-DshVersion', '-Mode', '-Help']) {
-    if (!help.stdout.includes(flag)) fail(`-Help never mentions ${flag}`)
-  }
-  const unknown = spawnSync(binary, ['-NotAFlag'], { encoding: 'utf8', shell: false })
-  if (unknown.status !== 1) fail(`an unknown flag exited ${unknown.status}, expected 1`)
-  if (!/unknown flag/.test(unknown.stderr ?? '')) fail('an unknown flag was not named as such')
-  if (!/-notaflag/i.test(unknown.stderr ?? '')) fail('an unknown flag was refused without naming it')
-
-  const badMode = spawnSync(binary, ['-Mode', 'sideways'], { encoding: 'utf8', shell: false })
-  if (badMode.status !== 1) fail(`-Mode sideways exited ${badMode.status}, expected 1`)
-  if (!/panel, chrome, headless or embed/.test(badMode.stderr ?? '')) {
-    fail('-Mode sideways was refused without listing what it accepts')
-  }
-  // `embed` is a mode THIS build does not have - it was compiled without the pane, so it
-  // draws no web view - and the flag is refused BY NAME rather than quietly opening a
-  // browser instead. A test that only checked the accepted spellings would let this build
-  // promise a pane. The build that DOES have one is `check-pane.mjs`, and the two must
-  // DISAGREE about this flag: that disagreement is the whole contract.
-  const noPane = spawnSync(binary, ['-Mode', 'embed'], { encoding: 'utf8', shell: false })
-  if (noPane.status !== 1) fail(`-Mode embed exited ${noPane.status}, expected 1`)
-  if (!/draws no web view/.test(noPane.stderr ?? '')) {
-    fail('-Mode embed was refused without saying that this app has no web view')
+  if (!/Usage/i.test(`${result.stdout}${result.stderr}`)) {
+    fail('run-web -Help printed no usage')
   }
-  if (!/chrome/.test(noPane.stderr ?? '')) {
-    fail('-Mode embed was refused without naming the mode that does work')
-  }
-  console.log('check-shell: the flag set, both refusals, and this build promises no pane')
+  note('scripts/run-web.* answers on its own, with no vncode binary involved')
 }
 
-function checkTauriIsGone() {
-  // The move is a claim about the SOURCE TREE, and a half-finished move is worse
-  // than either end of it: two supervisors in one folder is how a "fix" lands in
-  // the one nobody runs.
-  if (fs.existsSync(path.join(app, 'src-tauri'))) {
-    fail('app/src-tauri still exists - the Tauri launcher was not removed')
-  }
-  if (!fs.existsSync(path.join(app, 'Cargo.toml'))) {
-    fail('app/Cargo.toml is missing - the shell is no longer a cargo workspace')
-  }
-  for (const crate of ['vn-shell-core', 'vn-shell-runtime', 'vn-shell-egui', 'vn-shell']) {
-    if (!fs.existsSync(path.join(app, 'crates', crate, 'Cargo.toml'))) {
-      fail(`app/crates/${crate} is missing`)
-    }
-  }
-  if (fs.existsSync(path.join(app, 'ui'))) {
-    fail('app/ui still exists - the HTML splash has no place in the egui shell')
-  }
-  // The old distribution machinery is gone, deliberately: the distribution is now
-  // this app beside the pack the panel installs.
-  for (const gone of ['dist.ps1', 'dist.sh', 'run-dist.bat', 'run-dist.ps1', 'dist-manifest.txt']) {
-    if (fs.existsSync(path.join(repo, 'scripts', gone))) {
-      fail(`scripts/${gone} is back - the old distribution machinery was erased on purpose`)
-    }
-  }
-  for (const needed of ['setup/install.bat', 'setup/install.sh', 'console/adapt.cmd']) {
-    if (!fs.existsSync(path.join(repo, 'scripts', needed))) {
-      fail(`scripts/${needed} is missing - the panel's Install button runs it`)
-    }
-  }
-  console.log('check-shell: the Tauri launcher is gone and the workspace is in its place')
-}
+// ---------------------------------------------------------------------------
+fs.mkdirSync(scratch, { recursive: true })
 
-function checkCargoTests() {
-  const cargo = spawnSync('cargo', ['--version'], { encoding: 'utf8', shell: false })
-  if (cargo.error || cargo.status !== 0) {
-    notes.push('cargo is missing, so the shell\'s own tests were not run')
-    return
-  }
-  // VNCODE_TEST_DIR is how the tests get a scratch root on a host that denies the
-  // system temp directory - which is exactly the host the pack's checks run on.
-  // VNCODE_HOME and DSH_HOME are pointed into the same scratch tree for the same
-  // reason M0 added them: a unit test must never create, join or probe a person's
-  // own harness home.
-  const test = spawnSync('cargo', ['test', '--workspace', '--quiet'], {
-    cwd: app,
-    encoding: 'utf8',
-    shell: false,
-    env: {
-      ...process.env,
-      VNCODE_TEST_DIR: path.join(scratch, 'cargo-test'),
-      VNCODE_HOME: path.join(scratch, 'cargo-test', 'app-root'),
-      DSH_HOME: path.join(scratch, 'cargo-test', 'dsh-home'),
-    },
-  })
-  const output = `${test.stdout ?? ''}${test.stderr ?? ''}`
-  if (test.status !== 0) {
-    fail(`cargo test --workspace failed:\n${output.split('\n').slice(-40).join('\n')}`)
-    return
-  }
-  const passed = [...output.matchAll(/test result: ok\. (\d+) passed/g)].reduce(
-    (total, match) => total + Number(match[1]),
-    0,
-  )
-  if (passed === 0) fail('cargo test reported success but ran no tests')
-  console.log(`check-shell: ${passed} unit test(s) in the workspace pass`)
+if (build()) {
+  answers()
+  bridge()
+  webHalf()
 }
 
-// ---------------------------------------------------------------------------
-function report() {
-  console.log('check-shell: the native shell')
-  for (const note of notes) console.log(`  - ${note}`)
-  if (failures.length) {
-    console.log(`\ncheck-shell: ${failures.length} problem(s).`)
-    for (const message of failures) console.log(`  - ${message}`)
-    process.exit(1)
-  }
-  console.log('\ncheck-shell: OK')
-  process.exit(0)
+console.log('check-shell: the native app, driven')
+for (const line of notes) console.log(`  - ${line}`)
+if (failures.length) {
+  console.log(`\ncheck-shell: ${failures.length} problem(s).`)
+  for (const message of failures) console.log(`  - ${message}`)
+  process.exit(1)
 }
-
-const binary = findBinary()
-if (failures.length) report()
-writeStub()
-checkTauriIsGone()
-checkFlags()
-await checkRefusal()
-await checkLifetime()
-await checkConfinedHome()
-await checkSetupButtons()
-checkCargoTests()
-report()
+console.log('\ncheck-shell: OK')
diff --git a/scripts/run-desktop.bat b/scripts/run-desktop.bat
index fd8f9bf..9e574c3 100644
--- a/scripts/run-desktop.bat
+++ b/scripts/run-desktop.bat
@@ -34,6 +34,7 @@ rem  building inside a distribution would demand a Rust toolchain from
 rem  somebody who was only ever asked to click a file.
 rem
 rem  Flags (forwarded to the shell; the same set as scripts/run-web.bat):
+rem    <command>          start (the default), install, uninstall, status or key
 rem    -Port <n>          listen on this port instead of a free one
 rem    -DshHome <dir>     override DSH_HOME (default: $DSH_HOME, else ~/.dsh)
 rem    -DshVersion <ver>  override the pinned dsh version from .dsh-version.json
@@ -74,18 +75,18 @@ if /I "%VN_FIRST%"=="-h" goto :help
 if /I "%VN_FIRST%"=="/?" goto :help
 
 rem --- the launcher's own flags must not reach the shell ---------------------
-rem The Rust shell takes -Port/-DshHome/-DshVersion and nothing else: an unknown
-rem flag exits 1 with the flag named (deliberately, so a typo is never ignored).
-rem These three are ours, so they are removed before the hand-over.
+rem The Rust shell takes -Port/-DshHome/-DshVersion/-Mode and nothing else: an
+rem unknown flag exits 1 with the flag named (deliberately, so a typo is never
+rem ignored). These are ours, so they are removed before the hand-over.
 set "VN_SHELL_ARGS=%VNCODE_ARGS%"
 set "VN_SHELL_ARGS=%VN_SHELL_ARGS:-NoPause=%"
 set "VN_SHELL_ARGS=%VN_SHELL_ARGS:-NoTerminal=%"
 set "VN_NOBUILD="
 if not "%VNCODE_ARGS:-NoBuild=%"=="%VNCODE_ARGS%" set "VN_NOBUILD=1"
-if not defined VN_NOBUILD goto :haverbuild
+if not defined VN_NOBUILD goto :whichartefact
 set "VN_SHELL_ARGS=%VN_SHELL_ARGS:-NoBuild=%"
 
-:haverbuild
+:whichartefact
 rem --- which artefact runs ---------------------------------------------------
 set "VN_BUILT=%~dp0..\vncode.exe"
 if exist "%VN_BUILT%" goto :run
@@ -124,7 +125,7 @@ if errorlevel 1 (
 )
 
 echo [vncode] Building app in the folder above ^(cargo does nothing when it is current^)...
-cargo build --release --manifest-path "%VN_MANIFEST%"
+cargo build --release -p vn-shell --manifest-path "%VN_MANIFEST%"
 if errorlevel 1 goto :buildfailed
 
 :afterbuild
@@ -148,29 +149,40 @@ exit /b %VN_EXIT%
 
 :help
 echo.
-echo Usage: scripts\run-desktop.bat [flags]
+echo Usage: scripts\run-desktop.bat [command] [flags]
 echo.
-echo   -Port ^<n^>          listen on this port instead of a free one
+echo   start              install the pack if this home lacks it, ask for the key if
+echo                      there is none, then start the harness and open it (the
+echo                      default when no command is given)
+echo   install            run scripts\setup\install.* against the home in use
+echo   uninstall          run scripts\setup\uninstall.* against it
+echo   status             print the pin, the home, the pack, the key and the launcher
+echo   key                ask for the DeepSeek key and write it into ^<home^>\.env
+echo.
+echo   -Port ^<n^>          hand this port to the web launcher
 echo   -DshHome ^<dir^>     use this harness home (default: the one the app chose;
 echo                      a leading ~ is expanded here)
 echo   -DshVersion ^<ver^>  override the pinned dsh version from .dsh-version.json
-echo   -Mode ^<mode^>       chrome (the harness UI in a browser - the default),
-echo                      panel (open idle and start nothing) or headless (no window)
 echo   -NoBuild           never run cargo; use the binary already built
 echo   -NoPause           never hold this window open
 echo   -NoTerminal        stay in this console; do not relaunch
 echo   -Help              print this help
+echo   -Version           print the version
+echo.
+echo vncode is a front door, not a second harness: it decides the root, the key and
+echo the pack, and then runs scripts\run-web.bat - the same file you would
+echo double-click - in this console, same pin, same profile, same flags. There is
+echo no window and no embedded web view: the interface is a web application and it
+echo opens in the browser the launcher found (Google Chrome first).
 echo.
-echo Runs the harness from the pinned dsh version in a native window instead of
-echo a Chrome tab - same pin, same profile and same flags as scripts\run-web.bat.
+echo Launching only the web needs none of this: scripts\run-web.bat works on its
+echo own, and so does every script under scripts\setup.
 echo.
-echo From a distribution folder it runs the vncode.exe in the folder above
-echo this one and needs nothing installed. From a source checkout it builds
-echo app there with cargo first, which needs the Rust toolchain and
-echo Node.js 22 or newer.
+echo This launcher builds the shell when there is none. From a source checkout that
+echo needs the Rust toolchain (https://rustup.rs) and Node.js 22 or newer; from a
+echo folder that carries a built vncode.exe it needs nothing.
 echo.
-echo macOS and Linux: the same shell builds with "cargo build --release" in
-echo app and runs beside ./scripts/run-web.sh, the browser launcher.
+echo macOS and Linux use ./scripts/run-desktop.sh, which does the same thing.
 echo.
 if "%VNCODE_PAUSE%"=="1" pause
 exit /b 0
diff --git a/scripts/run-desktop.sh b/scripts/run-desktop.sh
index 7ef4dea..3642780 100644
--- a/scripts/run-desktop.sh
+++ b/scripts/run-desktop.sh
@@ -7,6 +7,15 @@
 #  idle, starts the pinned harness when you press Start, shows it in
 #  your browser, and ends the whole instance when you press Stop.
 #
+#  THE PANE IS OPT-IN HERE. On Windows the launcher builds the shell WITH
+#  the pane, so the window has two tabs ("control panel" and "harness");
+#  on this host that build compiles (given libwebkit2gtk) but wry's child
+#  view still needs a GTK loop pumped beside winit's, which is not
+#  written yet - so the default is the panel-only build and `-Pane` asks
+#  for the other one. A plain `cargo build --release` in app/ still
+#  builds no engine at all; the feature is chosen by THIS script, not by
+#  the crate's default.
+#
 #  WHERE IT RUNS FROM, AND WHY THAT IS CHECKED FIRST
 #  ------------------------------------------------
 #  A DISTRIBUTION has the built shell in the folder ABOVE this one, so
@@ -24,7 +33,7 @@
 #
 #  Usage:
 #    ./scripts/run-desktop.sh [-Port <n>] [-DshHome <dir>] [-DshVersion <version>]
-#                             [-Mode <panel|chrome|headless>] [-NoBuild]
+#                             [-Mode <panel|chrome|headless>] [-NoBuild] [-Pane]
 # ============================================================
 set -u
 
@@ -46,32 +55,56 @@ repo_root=$(CDPATH= cd -- "$script_dir/.." && pwd)
 case " $* " in *" -NoPause "*) VNCODE_PAUSE=0 ;; esac
 
 no_build=0
-for argument in "$@"; do
+pane=0
+# THE LAUNCHER'S OWN FLAGS ARE REMOVED HERE, not merely read: this script execs the
+# shell with its arguments, and the shell refuses a flag it does not know by name.
+# The loop rotates the list - shift one off the front, append it at the back unless
+# it is ours - so a flag's value (-Port 3099) stays beside it and a path with a
+# space survives untouched.
+count=$#
+index=0
+while [ "$index" -lt "$count" ]; do
+  argument=$1
+  shift
   case "$argument" in
     -NoBuild|--no-build) no_build=1 ;;
+    # -NoPause was READ above, to set VNCODE_PAUSE for the console layer; it is
+    # dropped here so it cannot reach the shell, which refuses flags it does not know.
+    -NoPause) ;;
+    *) set -- "$@" "$argument" ;;
   esac
+  index=$((index + 1))
 done
 
 usage() {
   printf '%s\n' \
-    'Usage: sh scripts/run-desktop.sh [-Port <n>] [-DshHome <dir>] [-DshVersion <version>]' \
-    '                                [-Mode <panel|chrome|headless>] [-NoBuild]' \
+    'Usage: sh scripts/run-desktop.sh [command] [-Port <n>] [-DshHome <dir>] [-DshVersion <v>]' \
+    '                                [-NoBuild]' \
+    '' \
+    '  start              install the pack if this home lacks it, ask for the key if' \
+    '                     there is none, then start the harness and open it (the' \
+    '                     default when no command is given)' \
+    '  install            run scripts/setup/install.sh against the home in use' \
+    '  uninstall          run scripts/setup/uninstall.sh against it' \
+    '  status             print the pin, the home, the pack, the key and the launcher' \
+    '  key                ask for the DeepSeek key and write it into <home>/.env' \
     '' \
-    '  -Port <n>          listen on this port instead of a free one' \
+    '  -Port <n>          hand this port to the web launcher' \
     '  -DshHome <dir>     use this harness home (default: the one the app chose;' \
     '                     a leading ~ is expanded here)' \
     '  -DshVersion <ver>  override the pinned dsh version from .dsh-version.json' \
-    '  -Mode <mode>       chrome (the harness UI in a browser - the default),' \
-    '                     panel (open idle and start nothing) or headless (no' \
-    '                     window; stop/quit/install/uninstall on stdin)' \
     '  -NoBuild           never run cargo; use the binary already built' \
     '  -NoPause           never hold this window open' \
     '  -Help / -h / --help   print this help' \
+    '  -Version           print the version' \
+    '' \
+    'vncode is a front door, not a second harness: it decides the root, the key and' \
+    'the pack, and then runs scripts/run-web.sh - the same file you would run by' \
+    'hand - in this console. There is no window and no embedded web view: the' \
+    'interface is a web application and it opens in the browser the launcher found.' \
     '' \
-    'Opens on a control panel: nothing is started until Start, and Stop ends the' \
-    'instance and frees its port. It draws no web view: the harness UI opens in a' \
-    'browser the app found (Chrome first). Install and Uninstall there run' \
-    'scripts/setup/install.sh and scripts/setup/uninstall.sh.' \
+    'Launching only the web needs none of this: scripts/run-web.sh works on its own,' \
+    'and so does every script under scripts/setup.' \
     ''
 }
 
@@ -101,7 +134,7 @@ if ! command -v cargo >/dev/null 2>&1; then
 fi
 
 echo "[vncode] Building app/ (cargo does nothing when it is current)..."
-if ! (cd "$repo_root/app" && cargo build --release); then
+if ! (cd "$repo_root/app" && cargo build --release -p vn-shell); then
   echo "[vncode] cargo build failed - see the errors above." >&2
   # THE SHELL IT IS REPLACING MAY STILL BE RUNNING. Unix lets a build replace a
   # running program's file, so this cannot fail the way Windows does - but a
diff --git a/scripts/run-web.bat b/scripts/run-web.bat
index dc22d55..e70a04a 100644
--- a/scripts/run-web.bat
+++ b/scripts/run-web.bat
@@ -47,14 +47,20 @@ call "%~dp0console\adapt.cmd" "%~f0" "vncode"
 if errorlevel 10 exit /b 0
 if errorlevel 2 goto :nopowershell
 
-rem -h and /? are the two spellings PowerShell cannot bind; see install.bat for
-rem why only the first argument is inspected.
+rem -h, /?, --help and -Help as the FIRST argument. Only the first is inspected - see
+rem install.bat - so a -DshHome path that contains "-h" or "-Help" cannot turn a run
+rem into a help request.
+rem
+rem `-Help` is in this list because it is the spelling this file's own header documents
+rem and the spelling `vncode` forwards. It was missing, and the measured cost was exact:
+rem `run-web.bat -Help` fell through the whole file and started a real harness.
 set "VN_HELPREQ="
 set "VN_FIRST="
 for /f "tokens=1 delims= " %%A in ("%VNCODE_ARGV%") do set "VN_FIRST=%%A"
 if /I "%VN_FIRST%"=="-h" set "VN_HELPREQ=-Help"
 if /I "%VN_FIRST%"=="/?" set "VN_HELPREQ=-Help"
 if /I "%VN_FIRST%"=="--help" set "VN_HELPREQ=-Help"
+if /I "%VN_FIRST%"=="-help" set "VN_HELPREQ=-Help"
 
 rem If one of those was found, forward -Help and NOTHING else: the spelling that
 rem was there cannot be bound by PowerShell, and a help request has no use for the
diff --git a/scripts/tools/make-desktop-icon.mjs b/scripts/tools/make-desktop-icon.mjs
deleted file mode 100644
index 424c327..0000000
--- a/scripts/tools/make-desktop-icon.mjs
+++ /dev/null
@@ -1,190 +0,0 @@
-#!/usr/bin/env node
-/*
-    Generates the desktop shell's icons FROM the pack's own source artwork.
-
-        node scripts/tools/make-desktop-icon.mjs
-
-    Writes (and OVERWRITES, so the icons are reproducible from the SVG):
-
-        app/assets/icons/icon.ico   Windows: the .exe resource, and with it
-                                       the title bar and taskbar icon
-        app/assets/icons/icon.png   512px, for the bundle formats that want
-                                       a PNG later (macOS/Linux)
-
-    Why a generator instead of a checked-in drawing: assets/vncode.svg is
-    the mark's source of truth (a disc centred in a 24px box with a hairline
-    transparent margin), so the geometry is READ out of that file - cx, cy, r
-    and the viewBox - rather than restated here. Change the asset, re-run this,
-    and the icon follows; the two cannot drift into two different marks.
-
-    Why no image library: nothing here is installed to draw a circle. The PNG
-    encoder below is the whole of it (IHDR/IDAT/IEND, filter 0, one zlib
-    stream) and the ICO is the standard directory of PNG payloads, which every
-    Windows since Vista reads.
-
-    The file is written ASCII-only, like every other script in this repository.
-*/
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { dirname, join, relative } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { deflateSync } from 'node:zlib';
-
-const here = dirname(fileURLToPath(import.meta.url));   // scripts/tools/
-const repoRoot = join(here, '..', '..');
-const svgPath = join(repoRoot, 'assets', 'vncode.svg');
-const outDir = join(repoRoot, 'app', 'assets', 'icons');
-
-// ---------------------------------------------------------------------------
-// The geometry, read from the asset
-// ---------------------------------------------------------------------------
-const svg = readFileSync(svgPath, 'utf8');
-
-function numberAttribute(name) {
-    const match = new RegExp('\\b' + name + '\\s*=\\s*"([^"]+)"').exec(svg);
-    if (!match) throw new Error(svgPath + ' has no ' + name + ' attribute');
-    const value = Number.parseFloat(match[1]);
-    if (!Number.isFinite(value)) throw new Error(svgPath + ' has a non-numeric ' + name + ': ' + match[1]);
-    return value;
-}
-
-const viewBox = (() => {
-    const match = /\bviewBox\s*=\s*"([^"]+)"/.exec(svg);
-    if (!match) throw new Error(svgPath + ' has no viewBox attribute');
-    const parts = match[1].trim().split(/[\s,]+/).map(Number);
-    if (parts.length !== 4 || parts.some((n) => !Number.isFinite(n))) {
-        throw new Error(svgPath + ' has a viewBox this script cannot read: ' + match[1]);
-    }
-    if (parts[2] !== parts[3]) throw new Error(svgPath + ' is not square; the icon generator assumes a square viewBox');
-    return { width: parts[2], height: parts[3] };
-})();
-
-const centreX = numberAttribute('cx');
-const centreY = numberAttribute('cy');
-const radius = numberAttribute('r');
-
-// ---------------------------------------------------------------------------
-// Drawing: one disc, antialiased at the edge, over transparency
-// ---------------------------------------------------------------------------
-function render(size) {
-    const pixels = new Uint8Array(size * size * 4);
-    const scale = size / viewBox.width;
-    const cx = centreX * scale;
-    const cy = centreY * scale;
-    const r = radius * scale;
-    for (let y = 0; y < size; y += 1) {
-        for (let x = 0; x < size; x += 1) {
-            const dx = x + 0.5 - cx;
-            const dy = y + 0.5 - cy;
-            const distance = Math.sqrt(dx * dx + dy * dy);
-            // A one pixel feather: inside the disc is solid, outside is clear,
-            // and the ring between is a coverage fraction.
-            const coverage = Math.max(0, Math.min(1, r + 0.5 - distance));
-            const at = (y * size + x) * 4;
-            pixels[at] = 0x00;          // the mark is black, as the asset is
-            pixels[at + 1] = 0x00;
-            pixels[at + 2] = 0x00;
-            pixels[at + 3] = Math.round(coverage * 255);
-        }
-    }
-    return pixels;
-}
-
-// ---------------------------------------------------------------------------
-// PNG (8-bit RGBA, filter 0)
-// ---------------------------------------------------------------------------
-const CRC_TABLE = (() => {
-    const table = new Int32Array(256);
-    for (let n = 0; n < 256; n += 1) {
-        let c = n;
-        for (let k = 0; k < 8; k += 1) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
-        table[n] = c;
-    }
-    return table;
-})();
-
-function crc32(buffer) {
-    let c = 0xffffffff;
-    for (let i = 0; i < buffer.length; i += 1) c = CRC_TABLE[(c ^ buffer[i]) & 0xff] ^ (c >>> 8);
-    return (c ^ 0xffffffff) >>> 0;
-}
-
-function chunk(type, data) {
-    const length = Buffer.alloc(4);
-    length.writeUInt32BE(data.length, 0);
-    const body = Buffer.concat([Buffer.from(type, 'ascii'), data]);
-    const crc = Buffer.alloc(4);
-    crc.writeUInt32BE(crc32(body), 0);
-    return Buffer.concat([length, body, crc]);
-}
-
-function encodePng(size, pixels) {
-    const stride = size * 4;
-    const raw = Buffer.alloc((stride + 1) * size);
-    for (let y = 0; y < size; y += 1) {
-        raw[y * (stride + 1)] = 0;                                              // filter: none
-        Buffer.from(pixels.buffer, pixels.byteOffset + y * stride, stride)
-            .copy(raw, y * (stride + 1) + 1);
-    }
-    const header = Buffer.alloc(13);
-    header.writeUInt32BE(size, 0);
-    header.writeUInt32BE(size, 4);
-    header[8] = 8;      // bit depth
-    header[9] = 6;      // colour type: truecolour with alpha
-    header[10] = 0;     // compression
-    header[11] = 0;     // filter
-    header[12] = 0;     // interlace
-    return Buffer.concat([
-        Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
-        chunk('IHDR', header),
-        chunk('IDAT', deflateSync(raw, { level: 9 })),
-        chunk('IEND', Buffer.alloc(0)),
-    ]);
-}
-
-// ---------------------------------------------------------------------------
-// ICO: the standard directory of PNG payloads
-// ---------------------------------------------------------------------------
-const ICO_SIZES = [16, 20, 24, 32, 48, 64, 128, 256];
-const PNG_SIZE = 512;
-
-function encodeIco(images) {
-    const header = Buffer.alloc(6);
-    header.writeUInt16LE(0, 0);                 // reserved
-    header.writeUInt16LE(1, 2);                 // type: icon
-    header.writeUInt16LE(images.length, 4);
-
-    let offset = 6 + images.length * 16;
-    const entries = images.map((image) => {
-        const entry = Buffer.alloc(16);
-        const dimension = image.size >= 256 ? 0 : image.size;   // 0 means 256
-        entry[0] = dimension;                   // width
-        entry[1] = dimension;                   // height
-        entry[2] = 0;                           // palette colours
-        entry[3] = 0;                           // reserved
-        entry.writeUInt16LE(1, 4);              // colour planes
-        entry.writeUInt16LE(32, 6);             // bits per pixel
-        entry.writeUInt32LE(image.data.length, 8);
-        entry.writeUInt32LE(offset, 12);
-        offset += image.data.length;
-        return entry;
-    });
-
-    return Buffer.concat([header, ...entries, ...images.map((image) => image.data)]);
-}
-
-// ---------------------------------------------------------------------------
-// Write
-// ---------------------------------------------------------------------------
-mkdirSync(outDir, { recursive: true });
-
-const images = ICO_SIZES.map((size) => ({ size, data: encodePng(size, render(size)) }));
-const icoPath = join(outDir, 'icon.ico');
-const pngPath = join(outDir, 'icon.png');
-writeFileSync(icoPath, encodeIco(images));
-writeFileSync(pngPath, encodePng(PNG_SIZE, render(PNG_SIZE)));
-
-const show = (path) => relative(repoRoot, path).replace(/\\/g, '/');
-console.log('mark read from ' + show(svgPath) + ': centre (' + centreX + ', ' + centreY +
-    ') radius ' + radius + ' in a ' + viewBox.width + 'px box');
-console.log('wrote ' + show(icoPath) + ' (' + ICO_SIZES.join(', ') + 'px)');
-console.log('wrote ' + show(pngPath) + ' (' + PNG_SIZE + 'px)');
diff --git a/scripts/tools/vendor.ps1 b/scripts/tools/vendor.ps1
deleted file mode 100644
index 55404c5..0000000
--- a/scripts/tools/vendor.ps1
+++ /dev/null
@@ -1,312 +0,0 @@
-# scripts/tools/vendor.ps1 - materialise the runtime the shell launches.
-#
-# WHAT THIS PRODUCES, and why it is the end of the npm problems:
-#
-#   runtime/<rid>/node/node.exe                       the pinned Node
-#   runtime/<rid>/harness/node_modules/@deepseek-ai/dsh/lib/bin.js
-#   runtime/<rid>/VENDOR.json                         versions + a file count
-#
-# The shell launches `node <bin.js> web --no-open --port N` from this folder -
-# no npx, no npm, and nothing fetched at start-up. That matters beyond speed:
-#
-#   npm error code EPERM
-#   npm error path ...\npm-cache\_cacache\tmp\b143f96f
-#   npm error Log files were not written due to an error writing to the directory
-#
-# is what `npx` does on this machine. The folder above is owned by
-# BUILTIN\Administradores (an earlier elevated run created it), so npm's
-# temp-file dance fails with EPERM and its own message tells the reader to run
-# as Administrator - which makes the ownership problem worse, not better. With
-# the harness resolved once at BUILD time, npm is never invoked to start the app
-# and that whole failure mode stops existing rather than being worked around.
-#
-# THE SOURCE IS LOCAL FIRST, and that is deliberate rather than lazy: this
-# machine already holds the exact pinned tree (npx put it there, and it is the
-# tree the running session boots from), so the first cut copies it instead of
-# re-downloading ~461 MB. A tree is accepted only when its version matches the
-# pin AND it carries bin.js, and every candidate is tried in order, so a fresh
-# machine with none of them falls through to a registry install by name.
-#
-# FLAGS
-#   -Rid <rid>        target (default: the host's, win-x64)
-#   -Node <path>      the node.exe to vendor (default: the one on PATH)
-#   -Force            re-materialise even when the runtime is already complete
-#   -Help
-[CmdletBinding()]
-param(
-    [string]$Rid = '',
-    [string]$Node = '',
-    [switch]$Force,
-    [switch]$Help
-)
-
-$ErrorActionPreference = 'Stop'
-. (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'scripts\console\theme.ps1')
-Initialize-VnConsole
-
-$script:RepoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)   # scripts/tools -> repo
-
-function Show-Usage {
-    Write-Host ''
-    Write-Host 'Usage: powershell -File scripts\dsh\vendor.ps1 [flags]'
-    Write-Host ''
-    Write-Host '  -Rid <rid>     target runtime (default: this host, e.g. win-x64)'
-    Write-Host '  -Node <path>   the node executable to vendor (default: node on PATH)'
-    Write-Host '  -Force         rebuild even when runtime\<rid> is already complete'
-    Write-Host '  -Help          print this help'
-    Write-Host ''
-    Write-Host 'Produces runtime\<rid>\{node,harness} so the shell can launch the pinned'
-    Write-Host 'harness WITHOUT npx, npm or any network access at start-up.'
-    Write-Host ''
-}
-
-if ($Help) { Show-Usage; exit 0 }
-
-# --- the pin, from the one place that owns it -------------------------------
-$pinFile = Join-Path $script:RepoRoot '.dsh-version.json'
-if (-not (Test-Path -LiteralPath $pinFile)) { throw ".dsh-version.json is missing from $script:RepoRoot - the shell has no fallback pin." }
-$pin = [string](Get-Content -LiteralPath $pinFile -Raw | ConvertFrom-Json).dsh
-if (-not $pin) { throw '.dsh-version.json has no "dsh" pin.' }
-
-# --- the target, derived from the host when not given -----------------------
-function Get-HostRid {
-    if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') { return 'win-arm64' }
-    if ($env:PROCESSOR_ARCHITECTURE -eq 'x86') { return 'win-ia32' }
-    return 'win-x64'
-}
-if (-not $Rid) { $Rid = Get-HostRid }
-$runtimeRoot = Join-Path $script:RepoRoot (Join-Path 'runtime' $Rid)
-$nodeDir = Join-Path $runtimeRoot 'node'
-$harnessDir = Join-Path $runtimeRoot 'harness'
-$stamp = Join-Path $runtimeRoot 'VENDOR.json'
-$binRel = '@deepseek-ai\dsh\lib\bin.js'
-
-Write-VnStep "vncode runtime vendor"
-Write-VnStep "Repo:  $script:RepoRoot"
-Write-VnStep "Pin:   $pin"
-Write-VnStep "Rid:   $Rid"
-Write-VnStep "Into:  $runtimeRoot"
-
-# --- completeness: a runtime is usable ONLY as a whole ----------------------
-# A half-copied runtime is worse than none, because the shell would resolve it,
-# fail to find bin.js, and report a broken install. So completeness is checked
-# as one predicate over all three pieces.
-function Test-RuntimeComplete {
-    param([string]$Root, [string]$BinRel)
-    $node = Join-Path (Join-Path $Root 'node') 'node.exe'
-    $bin = Join-Path (Join-Path (Join-Path $Root 'harness') 'node_modules') $BinRel
-    $stampFile = Join-Path $Root 'VENDOR.json'
-    if (-not (Test-Path -LiteralPath $node)) { return $false }
-    if (-not (Test-Path -LiteralPath $bin)) { return $false }
-    if (-not (Test-Path -LiteralPath $stampFile)) { return $false }
-    try {
-        $j = Get-Content -LiteralPath $stampFile -Raw | ConvertFrom-Json
-        if ([string]$j.dsh -ne $pin) { return $false }
-        if ([string]$j.rid -ne $Rid) { return $false }
-    }
-    catch { return $false }
-    return $true
-}
-
-if (-not $Force -and (Test-RuntimeComplete -Root $runtimeRoot -BinRel $binRel)) {
-    $s = Get-ChildItem -LiteralPath $runtimeRoot -Recurse -File -Force | Measure-Object -Sum Length
-    Write-VnGood "Runtime is already complete for pin $pin - nothing to do (-Force rebuilds)."
-    Write-VnNote ("{0} files, {1:N1} MB at {2}" -f $s.Count, ($s.Sum / 1MB), $runtimeRoot)
-    exit 0
-}
-
-if ($Force -and (Test-Path -LiteralPath $runtimeRoot)) {
-    Write-VnNote 'Removing the existing runtime (-Force).'
-    Remove-Item -LiteralPath $runtimeRoot -Recurse -Force
-}
-New-Item -ItemType Directory -Force -Path $runtimeRoot, $nodeDir | Out-Null
-
-# --- 1. the Node runtime ----------------------------------------------------
-$nodeExe = if ($Node) { $Node } else { (Get-Command node -ErrorAction SilentlyContinue).Source }
-if (-not $nodeExe -or -not (Test-Path -LiteralPath $nodeExe)) {
-    throw "node was not found. Install Node.js 22+ or pass -Node <path to node.exe>."
-}
-$nodeVersion = (& $nodeExe --version) 2>$null
-Write-VnStep "Vendoring Node $nodeVersion from $nodeExe"
-Copy-Item -LiteralPath $nodeExe -Destination (Join-Path $nodeDir 'node.exe') -Force
-
-# --- 2. the harness tree ----------------------------------------------------
-# Candidates in order. The first two are the machine's OWN caches - the tree npx
-# already resolved for the running app, then the maintainer's npm cache - and
-# the third is a fresh resolve. Each is accepted only when its version matches
-# the pin AND bin.js is really there.
-function Find-LocalHarness {
-    param([string]$Pin, [string]$BinRel)
-    $roots = New-Object System.Collections.ArrayList
-    [void]$roots.Add((Join-Path (Join-Path $env:LOCALAPPDATA 'vncode\npm-cache') '_npx'))
-    [void]$roots.Add((Join-Path $env:LOCALAPPDATA 'npm-cache\_npx'))
-    [void]$roots.Add((Join-Path $script:RepoRoot '.upgrade'))
-    [void]$roots.Add((Join-Path $script:RepoRoot '.scratch'))
-
-    foreach ($root in $roots) {
-        if (-not (Test-Path -LiteralPath $root)) { continue }
-        # Direct: <root>/node_modules/... and <root>/<hash>/node_modules/...
-        $direct = @(
-            (Join-Path $root 'node_modules'),
-            (Join-Path (Join-Path (Join-Path $root 'dsh-prod') 'node_modules') '')
-        )
-        foreach ($d in $direct) {
-            if (Test-Path -LiteralPath (Join-Path $d $BinRel)) { return (Split-Path -Parent (Split-Path -Parent $d)) }
-        }
-        # One level down: every _npx/<hash>/node_modules
-        foreach ($child in (Get-ChildItem -LiteralPath $root -Directory -Force -ErrorAction SilentlyContinue)) {
-            $nm = Join-Path $child.FullName 'node_modules'
-            if (Test-Path -LiteralPath (Join-Path (Join-Path $nm 'node_modules') $BinRel)) {
-                $pkgJson = Join-Path (Join-Path $nm 'node_modules') '@deepseek-ai\dsh\package.json'
-                $pkgJson = Join-Path (Join-Path $nm '@deepseek-ai\dsh') 'package.json'
-                if (Test-Path -LiteralPath $pkgJson) {
-                    try {
-                        $v = [string](Get-Content -LiteralPath $pkgJson -Raw | ConvertFrom-Json).version
-                        if ($v -eq $Pin) { return (Split-Path -Parent $nm) }
-                    }
-                    catch { }
-                }
-            }
-        }
-    }
-    return $null
-}
-
-# The layout this script wants is runtime/<rid>/harness/node_modules, so the
-# source it copies is the folder that CONTAINS a node_modules holding the pin.
-function Get-HarnessSource {
-    param([string]$Pin, [string]$BinRel)
-    # A) an npx/prefix tree: <root>/node_modules/@deepseek-ai/dsh
-    $candidates = @()
-    $npxRoots = @(
-        (Join-Path (Join-Path $env:LOCALAPPDATA 'vncode\npm-cache') '_npx'),
-        (Join-Path $env:LOCALAPPDATA 'npm-cache\_npx')
-    )
-    foreach ($r in $npxRoots) {
-        if (-not (Test-Path -LiteralPath $r)) { continue }
-        foreach ($c in (Get-ChildItem -LiteralPath $r -Directory -Force -ErrorAction SilentlyContinue)) {
-            $nm = Join-Path $c.FullName 'node_modules'
-            $pj = Join-Path $nm '@deepseek-ai\dsh\package.json'
-            if (-not (Test-Path -LiteralPath (Join-Path $nm $BinRel))) { continue }
-            if (-not (Test-Path -LiteralPath $pj)) { continue }
-            try {
-                $v = [string](Get-Content -LiteralPath $pj -Raw | ConvertFrom-Json).version
-                if ($v -eq $Pin) { $candidates += [pscustomobject]@{ Prefix = $c.FullName; Version = $v; Where = $c.FullName } }
-            }
-            catch { }
-        }
-    }
-    # B) the maintainer's own npm install of the pin
-    foreach ($extra in @((Join-Path $script:RepoRoot '.upgrade\dsh020'), (Join-Path $script:RepoRoot '.scratch\dsh-prod'))) {
-        $nm = Join-Path $extra 'node_modules'
-        $pj = Join-Path $nm '@deepseek-ai\dsh\package.json'
-        if ((Test-Path -LiteralPath (Join-Path $nm $BinRel)) -and (Test-Path -LiteralPath $pj)) {
-            try {
-                $v = [string](Get-Content -LiteralPath $pj -Raw | ConvertFrom-Json).version
-                if ($v -eq $Pin) { $candidates += [pscustomobject]@{ Prefix = $extra; Version = $v; Where = $extra } }
-            }
-            catch { }
-        }
-    }
-    return $candidates
-}
-
-$sources = @(Get-HarnessSource -Pin $pin -BinRel $binRel)
-if ($sources.Count -gt 0) {
-    $src = $sources[0]
-    Write-VnStep "Found the pinned harness locally: $($src.Where)"
-    Write-VnNote "Copying its node_modules (~461 MB) - no download, no npm, no network."
-    New-Item -ItemType Directory -Force -Path $harnessDir | Out-Null
-    $target = Join-Path $harnessDir 'node_modules'
-    # -Force so a re-run replaces rather than nests.
-    Copy-Item -LiteralPath (Join-Path $src.Prefix 'node_modules') -Destination $target -Recurse -Force
-}
-else {
-    # Nothing local carries the pin: resolve it by name, once, at BUILD time -
-    # which is the whole point. It needs a network, and it needs npm to work.
-    Write-VnWarn "No local tree carries @deepseek-ai/dsh@$pin - resolving it from the registry."
-    $npm = (Get-Command npm.cmd -ErrorAction SilentlyContinue)
-    if (-not $npm) { $npm = Get-Command npm -ErrorAction SilentlyContinue }
-    if (-not $npm) { throw "npm is needed to resolve the pin and was not found. Install Node.js 22+, or build the runtime on a machine that has one." }
-    $tmp = Join-Path $runtimeRoot '.resolve'
-    New-Item -ItemType Directory -Force -Path $tmp | Out-Null
-    [System.IO.File]::WriteAllText((Join-Path $tmp 'package.json'), '{"name":"vncode-runtime","private":true,"version":"0.0.0"}')
-    $previous = $ErrorActionPreference
-    $ErrorActionPreference = 'Continue'
-    & $npm.Source install --prefix $tmp --omit=dev --ignore-scripts --no-audit --no-fund "@deepseek-ai/dsh@$pin" 2>&1 |
-        Select-Object -Last 5 | ForEach-Object { Write-VnNote $_ }
-    $code = $LASTEXITCODE
-    $ErrorActionPreference = $previous
-    if ($code -ne 0) { throw "npm could not resolve @deepseek-ai/dsh@$pin (exit $code)." }
-    New-Item -ItemType Directory -Force -Path $harnessDir | Out-Null
-    Copy-Item -LiteralPath (Join-Path $tmp 'node_modules') -Destination (Join-Path $harnessDir 'node_modules') -Recurse -Force
-    Remove-Item -LiteralPath $tmp -Recurse -Force -ErrorAction SilentlyContinue
-}
-
-# --- 3. prove it is usable before writing the stamp -------------------------
-# WAIT FOR THE COPY TO SETTLE FIRST. This is not defensive padding: a run of
-# this script was measured failing here while `Copy-Item` still had files in
-# flight, so the check reported "no bin.js" against a tree that was 216 MB of a
-# 462 MB copy and landed correctly moments later. A copy that is still moving
-# and a copy that has silently stopped look identical from the outside, so the
-# destination is watched until its file count stops changing, with a cap so a
-# copy that genuinely died cannot hang the build.
-$harnessModules = Join-Path $harnessDir 'node_modules'
-if (Test-Path -LiteralPath $harnessModules) {
-    $last = -1
-    for ($i = 0; $i -lt 60; $i++) {
-        $now = (Get-ChildItem -LiteralPath $harnessModules -Recurse -File -Force -ErrorAction SilentlyContinue |
-                Measure-Object).Count
-        if ($now -gt 0 -and $now -eq $last) { break }
-        $last = $now
-        Start-Sleep -Milliseconds 500
-    }
-    Write-VnNote "Harness tree settled at $last files."
-}
-
-$vendoredBin = Join-Path $harnessModules $binRel
-if (-not (Test-Path -LiteralPath $vendoredBin)) {
-    throw "The vendored harness has no bin.js at $vendoredBin - the runtime would be resolved and then fail to start."
-}
-$vendoredNode = Join-Path $nodeDir 'node.exe'
-
-# Ask the vendored pair for its own version. This is the cheapest proof that the
-# copied Node can actually execute the copied harness, and it is the check that
-# would catch a half-copy, a wrong architecture or a missing dependency at the
-# one moment somebody can still do something about it.
-Write-VnStep "Verifying the runtime by running the vendored harness..."
-$previous2 = $ErrorActionPreference
-$ErrorActionPreference = 'Continue'
-$reported = (& $vendoredNode $vendoredBin --version) 2>&1 | Select-Object -First 1
-$verifyCode = $LASTEXITCODE
-$ErrorActionPreference = $previous2
-if ($verifyCode -ne 0) {
-    throw "The vendored runtime could not report its version (exit $verifyCode): $reported"
-}
-Write-VnGood "The vendored harness reports: $reported"
-
-$measured = Get-ChildItem -LiteralPath $runtimeRoot -Recurse -File -Force | Measure-Object -Sum Length
-
-# --- 4. the stamp, written LAST --------------------------------------------
-# Its presence is what the shell and this script treat as "complete", so it is
-# written only after the runtime has been proven to run.
-$stampLines = @(
-    '{',
-    "  `"dsh`": `"$pin`",",
-    "  `"rid`": `"$Rid`",",
-    "  `"node`": `"$nodeVersion`",",
-    "  `"reported`": `"$reported`",",
-    "  `"bin`": `"$($binRel.Replace('\', '/'))`",",
-    "  `"files`": $($measured.Count),",
-    "  `"bytes`": $($measured.Sum),",
-    "  `"vendoredAt`": `"$((Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ'))`"",
-    '}'
-)
-[System.IO.File]::WriteAllText($stamp, (($stampLines -join "`n") + "`n"))
-
-Write-Host ''
-Write-VnGood "Runtime ready: $runtimeRoot"
-Write-VnNote ("{0} files, {1:N1} MB" -f $measured.Count, ($measured.Sum / 1MB))
-Write-VnNote "node:    $(Join-Path $nodeDir 'node.exe')"
-Write-VnNote "harness: $vendoredBin"
-Write-VnNote 'The shell resolves this FIRST, so no npx, no npm and no network at start-up.'

From 30780b7b0513b8def941ccf49f6f497b20a44ec3 Mon Sep 17 00:00:00 2001
From: vecnode <vecnode@users.noreply.github.com>
Date: Sun, 18 Oct 2026 19:23:59 +0000
Subject: [PATCH 2/5] ci: build the app on three OSes; publish the web half
 separately

ci.yml: clippy with warnings denied, the workspace tests, a release build, a 6 MB
size ceiling and a smoke run - one OS on a push to main, all three on a pull
request, the schedule, and release.yml, which calls it as its gate.

release.yml: gate -> draft -> windows-latest / ubuntu-22.04 / macos-latest, each
packaging its own binary, plus ONE vncode-web artefact for the node/JS half (the
same bytes on every platform), SHA256SUMS recomputed from what was actually
uploaded, then the draft is published.

check-scripts.mjs asserted 'the CI must stay deleted'. Inverted: it now requires
both workflows, workflow_call, the three OS names and the separate web artefact.
---
 .github/workflows/ci.yml         | 165 ++++++++++++++++++++++
 .github/workflows/release.yml    | 232 +++++++++++++++++++++++++++++++
 scripts/checks/check-scripts.mjs |  48 +++++--
 3 files changed, 437 insertions(+), 8 deletions(-)
 create mode 100644 .github/workflows/ci.yml
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..99ac080
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,165 @@
+name: CI
+
+# Three operating systems, but not on every commit.
+#
+# A push to main runs one job, on the platform a Windows development machine cannot check
+# for itself. The full matrix runs on a pull request, on the Monday schedule, when asked,
+# and - through `workflow_call` - as the gate a release passes before it publishes
+# anything. That is the whole policy: the check that must never be skipped is the one at
+# the cut, and it is the cut that now pays for it.
+#
+# This workflow builds the RUST app only. The node/JS half needs no build: it is the same
+# files on every platform, it is packaged by release.yml as its own archive, and
+# `scripts/run-web.*` works without this app at all.
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - 'assets/**'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - 'assets/**'
+  schedule:
+    # Monday, 04:17 UTC. Early enough in the week that a platform-only break has six days
+    # to be found before the next one, and off the hour so it does not join the queue of
+    # every other project's nightly.
+    - cron: '17 4 * * 1'
+  workflow_dispatch:
+  workflow_call:
+
+# A superseded push has nothing to say. Cancel it and let the cache serve the next one.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: '0'
+
+jobs:
+  # The matrix is chosen by the event rather than written twice, so the caller and the
+  # push cannot disagree about what "checked" means.
+  plan:
+    name: Choose the matrix
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    outputs:
+      os: ${{ steps.pick.outputs.os }}
+    steps:
+      - id: pick
+        run: |
+          if [ "${{ github.event_name }}" = "push" ]; then
+            echo 'os=["ubuntu-latest"]' >> "$GITHUB_OUTPUT"
+          else
+            echo 'os=["ubuntu-latest","windows-latest","macos-latest"]' >> "$GITHUB_OUTPUT"
+          fi
+
+  check:
+    name: ${{ matrix.os }}
+    needs: plan
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJSON(needs.plan.outputs.os) }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: app -> target
+          shared-key: vncode-ci
+          cache-on-failure: true
+
+      # Warnings denied, so a dependency that arrives with a warning is a failure rather
+      # than a line nobody reads. The workspace has no GUI toolkit and no web engine to
+      # link, so this needs no `apt-get install` on the Linux runner - which is one of the
+      # things the cut bought.
+      - name: Clippy
+        working-directory: app
+        run: cargo clippy --workspace --all-targets --locked -- -D warnings
+
+      # `VNCODE_TEST_DIR` keeps the tests' scratch files inside the checkout. They are
+      # writable in a CI temp directory, but a test that writes where a confined host
+      # denies it is how this suite reported failures about the HOST rather than the code.
+      - name: Test
+        working-directory: app
+        shell: bash
+        env:
+          VNCODE_TEST_DIR: ${{ github.workspace }}/.test-tmp
+        run: |
+          mkdir -p "$VNCODE_TEST_DIR"
+          cargo test --workspace --locked
+
+      - name: Build (release)
+        working-directory: app
+        shell: bash
+        run: |
+          if [ "$RUNNER_OS" = "Windows" ]; then
+            export RUSTFLAGS='-C target-feature=+crt-static'
+          fi
+          cargo build --release --locked -p vn-shell
+
+      # The budget is a test, not a hope. A dependency that quietly pulls a GUI stack or a
+      # web engine changes this number, and that is the change this project exists to
+      # prevent - so it fails here by name.
+      - name: Size budget
+        working-directory: app
+        shell: bash
+        run: |
+          BIN="target/release/vncode"
+          [ "$RUNNER_OS" = "Windows" ] && BIN="$BIN.exe"
+          BYTES=$(wc -c < "$BIN")
+          MB=$((BYTES / 1048576))
+          echo "vncode: $BYTES bytes (${MB} MB)"
+          if [ "$BYTES" -gt $((6 * 1048576)) ]; then
+            echo "::error::$BIN is ${MB} MB, over the 6 MB budget - a dependency that draws a window or a web view is the usual cause"
+            exit 1
+          fi
+
+      - name: Smoke
+        working-directory: app
+        shell: bash
+        run: |
+          BIN="target/release/vncode"
+          [ "$RUNNER_OS" = "Windows" ] && BIN="$BIN.exe"
+          "$BIN" --version
+          "$BIN" -Help > /dev/null
+          # `-Mode embed` is the flag the deleted web view used to answer. It must fail by
+          # name, not be silently ignored - that is what "no web view" means.
+          if "$BIN" -Mode embed 2>&1 | grep -q "unknown flag"; then
+            echo "the deleted mode is refused by name"
+          else
+            echo "::error::-Mode embed was accepted, or refused without naming it"
+            exit 1
+          fi
+
+  secrets:
+    name: No secrets
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      # The one check that is about the repository rather than a platform, and the one
+      # whose failure can never be undone by a later commit.
+      - name: check-no-secrets
+        run: node scripts/checks/check-no-secrets.mjs
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..25179d2
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,232 @@
+name: Release
+
+# Publishing a tag is what publishes a release. A tag cannot exist without its binaries,
+# because the build is what attaches them.
+#
+# TWO ARTIFACTS, ON PURPOSE, and they are separate things:
+#
+#   vncode-<ver>-<os>-<arch>   the Rust app: one small binary per platform. This is the
+#                              only per-OS artefact anywhere in the project.
+#   vncode-web-<ver>           the node/JS half: the pack and the launcher scripts, the
+#                              SAME bytes on every platform, built once. It runs on its
+#                              own - scripts/run-web.* needs no vncode binary at all -
+#                              and the app above is a front door that calls it.
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing tag to build and attach binaries to'
+        required: true
+
+permissions:
+  contents: write
+
+env:
+  CARGO_TERM_COLOR: always
+  STEM: vncode
+  GH_REPO: ${{ github.repository }}
+
+jobs:
+  # A tag is a promise that the commit it names was checked on three platforms. The gate
+  # calls the same workflow a pull request runs rather than a copy of it, so the two cannot
+  # drift: a red check stops the release here, before a draft exists to be published.
+  gate:
+    name: Gate
+    uses: ./.github/workflows/ci.yml
+    permissions:
+      contents: read
+
+  # Create the release once, as a draft. It becomes visible only after every archive and
+  # SHA256SUMS.txt are attached, so a half-finished release cannot be installed.
+  prepare:
+    name: Prepare release
+    needs: gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Create the draft release if it does not exist
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${{ github.event.inputs.tag || github.ref_name }}"
+          gh release view "$TAG" >/dev/null 2>&1 || \
+            gh release create "$TAG" --draft --title "${STEM} ${TAG}" --generate-notes
+
+  # ---- the Rust app: one binary per OS -------------------------------------
+  build:
+    name: ${{ matrix.target }}
+    needs: prepare
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # A STATIC CRT, so the Windows binary needs no redistributable: this app is one
+          # file somebody drops in a folder, and "install the VC++ runtime first" is the
+          # kind of requirement that makes a small app not worth installing.
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            os_name: windows
+            arch: x86_64
+            ext: zip
+            rustflags: '-C target-feature=+crt-static'
+          # 22.04 rather than `latest`, for the glibc floor: a binary built on 24.04 does
+          # not run on a distribution released before it.
+          - os: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+            os_name: linux
+            arch: x86_64
+            ext: tar.gz
+            rustflags: ''
+          - os: macos-latest
+            target: aarch64-apple-darwin
+            os_name: macos
+            arch: aarch64
+            ext: tar.gz
+            rustflags: ''
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: app -> target
+          key: release-${{ matrix.target }}
+          cache-on-failure: true
+
+      # No GUI toolkit and no web engine to link, which is why this workflow has no
+      # `apt-get` step: the app draws nothing.
+      - name: Build
+        working-directory: app
+        env:
+          RUSTFLAGS: ${{ matrix.rustflags }}
+        run: cargo build --release --locked -p vn-shell --target ${{ matrix.target }}
+
+      - name: Package
+        shell: bash
+        run: |
+          TAG="${{ github.event.inputs.tag || github.ref_name }}"
+          VERSION="${TAG#v}"
+          NAME="${STEM}-${VERSION}-${{ matrix.os_name }}-${{ matrix.arch }}"
+          ROOT="${STEM}-${VERSION}"
+          BIN="app/target/${{ matrix.target }}/release/vncode"
+          mkdir -p "dist/${ROOT}"
+          if [ "${{ matrix.os_name }}" = "windows" ]; then
+            cp "${BIN}.exe" "dist/${ROOT}/"
+            cp README.md LICENSE "dist/${ROOT}/"
+            cp "app/README.md" "dist/${ROOT}/APP-README.md"
+            # bsdtar writes forward-slash entries; the GNU tar in Git Bash does not make a
+            # zip at all, so the Windows bsdtar is called explicitly.
+            "/c/Windows/System32/tar.exe" -a -c -f "dist/${NAME}.zip" -C dist "${ROOT}"
+          else
+            cp "${BIN}" "dist/${ROOT}/"
+            cp README.md LICENSE "dist/${ROOT}/"
+            cp "app/README.md" "dist/${ROOT}/APP-README.md"
+            chmod +x "dist/${ROOT}/vncode"
+            (cd dist && tar -czf "${NAME}.tar.gz" "${ROOT}")
+          fi
+          cp "dist/${NAME}.${{ matrix.ext }}" .
+          echo "ASSET=${NAME}.${{ matrix.ext }}" >> "$GITHUB_ENV"
+
+      - name: Upload
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${{ github.event.inputs.tag || github.ref_name }}"
+          gh release upload "$TAG" "$ASSET" --clobber
+
+  # ---- the node/JS half: built once, because it is the same bytes everywhere ----
+  web:
+    name: Web half (node/JS)
+    needs: prepare
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      # The web half must work WITHOUT the app, so it is proved that way: the launcher
+      # answers its own -Help, the installer answers its own -Help, and neither touches a
+      # profile while doing it.
+      - name: It runs on its own
+        shell: bash
+        run: |
+          sh scripts/run-web.sh -Help > /dev/null
+          echo "run-web.sh -Help: ok"
+
+      - name: Package
+        shell: bash
+        run: |
+          TAG="${{ github.event.inputs.tag || github.ref_name }}"
+          VERSION="${TAG#v}"
+          NAME="${STEM}-web-${VERSION}"
+          ROOT="${STEM}-web"
+          mkdir -p "dist/${ROOT}"
+
+          # The pack, the launchers and the pin: everything the browser half needs on a
+          # machine that has Node.js. The Rust app is NOT in here.
+          cp -R packages scripts "dist/${ROOT}/"
+          cp .dsh-version.json package.json README.md LICENSE SECURITY.md ARCHITECTURE.md \
+             "dist/${ROOT}/"
+          cp -R docs "dist/${ROOT}/"
+
+          # Build output that a checkout may be carrying is not content.
+          rm -rf "dist/${ROOT}/scripts/checks/.tmp"
+          find "dist/${ROOT}" -name '*.log' -delete
+
+          (cd dist && tar -czf "${NAME}.tar.gz" "${ROOT}")
+          cp "dist/${NAME}.tar.gz" .
+          echo "ASSET=${NAME}.tar.gz" >> "$GITHUB_ENV"
+
+      - name: Upload
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${{ github.event.inputs.tag || github.ref_name }}"
+          gh release upload "$TAG" "$ASSET" --clobber
+
+  checksums:
+    name: SHA256SUMS.txt
+    needs: [build, web]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      # A checksum file computed before the last upload is a lie, so this job waits for
+      # every artefact and re-downloads what was actually published.
+      - name: Collect and publish SHA256SUMS.txt
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${{ github.event.inputs.tag || github.ref_name }}"
+          mkdir -p assets
+          gh release download "$TAG" --pattern '*' --dir assets
+          rm -f assets/SHA256SUMS.txt
+          (cd assets && sha256sum ./* > SHA256SUMS.txt)
+          gh release upload "$TAG" assets/SHA256SUMS.txt --clobber
+
+  publish:
+    name: Publish
+    needs: checksums
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Publish the release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${{ github.event.inputs.tag || github.ref_name }}"
+          gh release edit "$TAG" --draft=false
diff --git a/scripts/checks/check-scripts.mjs b/scripts/checks/check-scripts.mjs
index c75c381..0a12d19 100644
--- a/scripts/checks/check-scripts.mjs
+++ b/scripts/checks/check-scripts.mjs
@@ -25,8 +25,10 @@
 //      exactly as the app clears them, and must print the worker's usage and exit
 //      0. That is the whole path the panel's buttons take: locate, spawn through
 //      the console layer, and read an exit code - and `-Help` installs nothing.
-//   4. NO CI. `.github/workflows/` must not exist; Actions was removed on purpose
-//      and a deleted CI must not quietly return on a push.
+//   4. THE TWO WORKFLOWS. `.github/workflows/` must exist, and must do the one job CI is
+//      for here: `ci.yml` callable, `release.yml` building the Rust app on Windows, Linux
+//      and macOS and publishing the node/JS half as its own artefact. CI was deleted once
+//      on purpose; it is back for the release, and this is what keeps it honest.
 //
 //  Run:  node scripts/checks/check-scripts.mjs
 //  POSIX entry points are checked for shape only; driving them needs a POSIX host,
@@ -239,13 +241,43 @@ function checkWindowsEntryPoints() {
 }
 
 // ---------------------------------------------------------------------------
-// 4. No CI
+// 4. The two workflows, and what they promise
 // ---------------------------------------------------------------------------
-function checkNoCi() {
-  if (fs.existsSync(path.join(repo, '.github', 'workflows'))) {
-    fail('.github/workflows exists - the deleted CI came back (see docs/RELEASE.md)')
+// CI was once deleted on purpose ("the checks are run by hand"). It is back for ONE job:
+// building the Rust app on the three operating systems and attaching the artefacts to a
+// tag. The assertion is inverted rather than dropped, because "CI exists" and "CI builds
+// what we ship" are different claims and only the second is worth having.
+function checkCi() {
+  const workflows = path.join(repo, '.github', 'workflows')
+  if (!fs.existsSync(workflows)) {
+    fail('.github/workflows is missing - the release builds the app for three OSes (docs/RELEASE.md)')
+    return
+  }
+  const ci = path.join(workflows, 'ci.yml')
+  const release = path.join(workflows, 'release.yml')
+  for (const [file, label] of [[ci, 'ci.yml'], [release, 'release.yml']]) {
+    if (!fs.existsSync(file)) fail(`.github/workflows/${label} is missing`)
+  }
+  if (fs.existsSync(ci)) {
+    const text = fs.readFileSync(ci, 'utf8')
+    if (!text.includes('workflow_call')) {
+      fail('ci.yml is not callable - release.yml must run the same checks rather than a copy')
+    }
+  }
+  if (fs.existsSync(release)) {
+    const text = fs.readFileSync(release, 'utf8')
+    // The three operating systems, by name: this is what "the release is built on three
+    // platforms" means, and a matrix that quietly lost one is a release that does not run.
+    for (const os of ['windows-latest', 'ubuntu-22.04', 'macos-latest']) {
+      if (!text.includes(os)) fail(`release.yml does not build on ${os}`)
+    }
+    // The node/JS half is a SEPARATE artefact, built once: it is the same bytes on every
+    // platform, and `scripts/run-web.*` must keep working without the app.
+    if (!text.includes('vncode-web')) {
+      fail('release.yml does not publish the node/JS half as its own artefact')
+    }
   }
-  console.log('check-scripts: no .github/workflows - CI stays deleted')
+  console.log('check-scripts: ci.yml and release.yml exist, and release.yml names three OSes')
 }
 
 // ---------------------------------------------------------------------------
@@ -253,7 +285,7 @@ checkLayout()
 checkConsoleContract()
 checkPortableRootRule()
 checkWindowsEntryPoints()
-checkNoCi()
+checkCi()
 
 console.log('check-scripts: the scripts tree, its console contract, and its entry points')
 for (const note of notes) console.log(`  - ${note}`)

From 4bcc1d985f4f88dcce2383cad38c5173f2cae24a Mon Sep 17 00:00:00 2001
From: vecnode <vecnode@users.noreply.github.com>
Date: Sun, 18 Oct 2026 19:24:03 +0000
Subject: [PATCH 3/5] docs: every page rewritten for the controller

AGENTS (rules 1, 4, 5, 8 and the layout), ARCHITECTURE, SECURITY ('there is no
embedded engine', with the measured History/Favicons finding kept as the reason),
and docs/{INSTALL,BUILD,DEPLOY,RELEASE,PATHS,COMPATIBILITY} now describe what
ships: one ~0.5 MB binary per OS, the web half on its own, one tag that publishes
both. PLAN-egui-shell.md is a superseded stub so existing links resolve;
PLAN-controller.md is the plan and its measurements.

README: the Run section names the app and the browser-only path and carries the
commands; the 'Testing the compiled release, with the harness drawn inside the
window' section is gone with the window.
---
 AGENTS.md               | 100 +++--
 ARCHITECTURE.md         |  32 +-
 README.md               |  41 +--
 SECURITY.md             | 119 +++---
 docs/BUILD.md           | 123 +++----
 docs/COMPATIBILITY.md   |  19 +-
 docs/DEPLOY.md          | 141 +++----
 docs/INSTALL.md         | 139 ++++---
 docs/PATHS.md           |  30 +-
 docs/PLAN-controller.md |  92 +++++
 docs/PLAN-egui-shell.md | 792 +---------------------------------------
 docs/RELEASE.md         | 144 +++-----
 12 files changed, 502 insertions(+), 1270 deletions(-)
 create mode 100644 docs/PLAN-controller.md

diff --git a/AGENTS.md b/AGENTS.md
index 0eb6f57..961bd00 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -11,15 +11,14 @@ for its behaviour, `SECURITY.md` before touching credentials or the launcher, an
 ## Hard rules — do not break these
 
 1. **One install target.** The web profile only. No desktop edition, no
-   `-Target desktop`, no desktop detection. `app/` plus `scripts/run-desktop.*` is a
-   **launcher** of the same pinned `dsh web` on a free loopback port — it patches no
-   core file and adds no second server. It installs exactly one thing, and only when
-   asked: its panel's Install button runs this pack's own installer
-   (`scripts/setup/install.*`), which adds these bundles to the `web` profile and
-   nothing else — and it is given `-DshHome <the home the app chose>`, so the pack
-   lands in the profile the app will actually run. Uninstall runs the matching pair.
-   Both are disabled while a harness is running, and neither touches a row or a core
-   file.
+   `-Target desktop`, no desktop detection, **no window and no web view**. `app/` is a
+   **front door** to the same pinned `dsh web`: it decides the root and the home, writes
+   the key, runs this pack's own installer (`scripts/setup/install.*`, given `-DshHome
+   <the home it chose>`) when that profile lacks the bundles, and then runs
+   `scripts/run-web.*` — the same launcher a person double-clicks — in the foreground.
+   It starts no node, binds no port, opens no tab and draws nothing: **the launcher owns
+   the harness, the ready line and the browser tab.** Launching only the web must keep
+   working on a machine with no `vncode` at all.
 2. **Nothing patches core.** A row change is a new bundle layer.
    `dsh-vn-master` is the pack's final layer (it installs last), so pack-wide row
    patches belong there, and a package that *replaces* a row carries that row's
@@ -32,7 +31,8 @@ for its behaviour, `SECURITY.md` before touching credentials or the launcher, an
 4. **Launchers.** Every entry point lives in `scripts/`, one per action per host
    (`run-web.*`, `run-desktop.*`), and there are **no forwarders**. The install and
    uninstall pairs live one level down in `scripts/setup/`, beside the workers they
-   call, and the app's own buttons run those same entry points. Nothing else sits at
+   call, and the app's `install` / `uninstall` verbs run those same entry points. Nothing
+   else sits at
    the top level: `console/` is the shared console layer, `tools/` is
    maintainer-only, `checks/` is the contract, and `check-scripts.mjs` fails on a
    stray file. On Windows the entry point calls the PowerShell worker beside it (or
@@ -50,7 +50,8 @@ for its behaviour, `SECURITY.md` before touching credentials or the launcher, an
 5. **The launch token is a live credential.** It is read in memory, never written
    to a file, echoed, or handed to a shell, and a URL that is not loopback is
    refused rather than opened. It appears only in `scripts/run-web.ps1` /
-   `scripts/run-web.sh`.
+   `scripts/run-web.sh` — **never in `app/`**, which starts the launcher and reads its
+   exit code.
 6. **No secrets, ever.** Run `node scripts/checks/check-no-secrets.mjs` before
    pushing. A vendored bundle can ship its author's own credentials: redact them
    in the **build** (a patch under that engine's `vendor/<name>/patches/`, read
@@ -58,8 +59,14 @@ for its behaviour, `SECURITY.md` before touching credentials or the launcher, an
 7. **Zero npm dependencies** in shipped packages, and no network egress a plugin
    starts on its own. Engines are vendored under `lib/vendor/` or resolved from
    the harness already on disk.
-8. **No CI, on purpose.** The checks in `scripts/checks/` are run by hand; they
-   are the contract, and `scripts/checks/README.md` lists them.
+8. **CI builds the app; the checks prove it.** `.github/workflows/ci.yml` runs clippy
+   with warnings denied, the workspace tests, a release build, a **6 MB size ceiling**
+   and a smoke run - on one OS for a push to `main`, on all three for a pull request,
+   the Monday schedule, and `release.yml`, which calls it as its gate. A release
+   publishes **two** artefacts: one `vncode` per OS, and one `vncode-web` for the
+   node/JS half, which is the same bytes everywhere. The checks in `scripts/checks/`
+   are still run by hand; they are the contract, and `scripts/checks/README.md` lists
+   them.
 
 ## Layout
 
@@ -89,32 +96,25 @@ for its behaviour, `SECURITY.md` before touching credentials or the launcher, an
   makes them useful outside this repository) and they are ADDITIONAL to
   `scripts/checks/`, never a replacement for it: `dsh-supercollider` ships three,
   and the pack-wide checks still own the routes, the bundle and the manifest.
-- `scripts/` — the launchers (`run-web.*`, `run-desktop.*`), and three folders:
+- `scripts/` — the launchers (`run-web.*`, `run-desktop.*`), and four folders:
   `console/` (the shared console layer), `setup/` (install and uninstall, which the
-  app's buttons run), `tools/` (maintainer-only) and `checks/`.
-- `app/` — the Rust/**egui** shell: a cargo workspace whose binary is `vncode`, a
-  control panel that opens on **the home question** when nobody has named a home — one screen,
-  the cards that answer it (copy the machine's home here / make a fresh one in this folder),
-  decided in `vn_shell_core::firstrun` and remembered
-  only by a click — and then four rows (home, pack, key, browser) with every diagnostic behind
-  one collapsed `Details`. It resolves and creates the root its harness home lives
-  in (`$VNCODE_HOME`, with `DSH_HOME` at `<root>/home` unless `-DshHome`, a home chosen
-  on that screen, or a writable inherited `DSH_HOME` says otherwise — **nothing outside its
-  own root is ever the home it runs against**, so `~/.dsh` is the source of the copy offer
-  and nothing else), starts the pinned
-  harness on **Start** — installing the pack into that home first when its profile lists none of
-  the pack's bundles, so one press reaches a real interface — and ends it on **Stop** (a
-  launcher, not a desktop edition). It
-  composes every child's environment rather than inheriting one, cleans every path before
-  it uses one, and **draws the shipped interface only when it is built to**: the default
-  build compiles no engine and opens the harness in a browser it found (`browser.rs`), while
-  `--features pane` shows it inside this window instead - one OPTIONAL dependency on `wry`,
-  nothing vendored, and the default not flipped until Linux and macOS are measured.
-  `app/README.md` explains it and `docs/PLAN-egui-shell.md` is the plan it was built from.
-  `check-shell.mjs` and `check-pane.mjs` are what prove it, and they drive the real binary.
-- `docs/` — install, build, deploy, release, paths, compatibility, and the shell's
-  plan. There is no distributer and no ship list any more: the distribution is this
-  repository, and the app installs the pack itself.
+  app's verbs run), `tools/` (maintainer-only: the fork re-sync for the client bundles
+  this pack vendors) and `checks/`.
+- `app/` — the Rust **front door**: a cargo workspace of three crates whose binary is
+  `vncode`, about 0.5 MB, with **no window and no web view**. It decides the root its
+  harness home lives in (`$VNCODE_HOME`, with `DSH_HOME` at `<root>/home` unless a
+  `-DshHome` or a writable inherited `DSH_HOME` says otherwise — **nothing outside its
+  own root is ever the home it runs against**), composes every child's environment
+  rather than inheriting one, cleans every path before it uses one, writes the DeepSeek
+  key into `<home>/.env` when asked, runs `scripts/setup/install.*` when the profile
+  lacks the pack, and then runs `scripts/run-web.*` in the foreground. Its verbs are
+  `start` (default), `install`, `uninstall`, `status` and `key`; `-Mode embed` is
+  refused **by name**, because there is no embedded browser to select.
+  `app/README.md` explains it and `docs/PLAN-controller.md` is the plan it was cut
+  from. `check-shell.mjs` is what proves it, and it drives the real binary.
+- `docs/` — install, build, deploy, release, paths, compatibility, and the plan the app
+  was cut from. There is no distributer and no ship list: the distribution is this
+  repository plus the binary, and the app installs the pack itself.
 - `.dsh-version.json` — the pinned harness line and the pack manifest
   (its versions must match every `package.json`; `check-node-routes.mjs` enforces
   that).
@@ -131,22 +131,14 @@ Run the check that owns the area, and say which ones you ran:
 - `check-media-node.mjs`, `check-pdf-node.mjs`,
   `check-browser-node.mjs` — the tool
   and host halves;
-- `check-shell.mjs` — the native shell, **driven**: the ready line and its
-  refusals, the launch token in no stream and no file (in both roots a run writes),
-  Stop freeing the port and killing the tree, the flags (including a `-Mode` this build
-  does not have being refused BY NAME, so no build can promise a web view it does not
-  draw), the panel's install/uninstall path, the home ladder (an unwritable inherited
-  `DSH_HOME` falls through, an impossible `-DshHome` refuses by name, a writable inherited
-  one is joined, **an installation at `~/.dsh` is neither used nor offered as a home** in
-  either state, and `VNCODE_HOME` reaches no child — every run
-  confined on `VNCODE_HOME`, `DSH_HOME` and `USERPROFILE`/`HOME`), and that `app/src-tauri` is
-  gone (it also runs `cargo test --workspace`; it skips loudly with no cargo and no built
-  binary);
-- `check-pane.mjs` — the pane's contract, and it is a contract about **two builds**: the
-  default build compiles no engine and refuses `-Mode embed` by name, the pane build accepts
-  it and says so in its usage, and the pane crate's own tests pass with the feature on. It
-  skips loudly on a host that cannot build the pane at all, and FAILS on a build error that
-  is not one of those host reasons, so a compile error cannot hide behind the skip;
+- `check-shell.mjs` — the app, **driven**: the verbs and `-Help`; `-Mode embed` refused
+  BY NAME (the flag the deleted web view used to answer); a size ceiling a GUI stack
+  cannot pass; and `start` run against **stub scripts** in a throwaway tree — the
+  installer is run because that home lacks the pack, the launcher is handed `-DshHome`
+  and `-NoTerminal` and a **composed** environment, the app's own root and the console
+  markers are absent from both children, no key file is written with no terminal to ask
+  at, and `status` names the same home. It also proves `scripts/run-web.* -Help` answers
+  with no binary involved, and it skips loudly with no cargo and no built binary;
 - `check-audio-browser.mjs` — the check that drives a
   real browser (with none installed it skips loudly);
 - `check-skill-examples.mjs`, `check-media-examples.mjs` — every fenced example in
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 4f9b682..a01221c 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -3,16 +3,13 @@
 A plugin pack for **one install target**: the DeepSeek Harness **web** profile
 (`npx @deepseek-ai/dsh web`, profile `web` under `$DSH_HOME`, default `~/.dsh`).
 Every plugin here is a standard dsh **bundle**; nothing patches a harness file,
-and there is no desktop edition. (`app/` + `scripts/run-desktop.bat` is a
-*launcher*: a Rust/**egui** control panel that opens idle, owns the root its harness
-home lives in — `$VNCODE_HOME`, with the harness's `DSH_HOME` at `<root>/home` unless
-`-DshHome` or a writable inherited `DSH_HOME` says otherwise — starts the same pinned
-`dsh web` on a free loopback port when you press Start, shows that URL in the browser it
-found on the machine — Chrome first, everything else reachable, the OS opener as the floor;
-it draws the shipped interface only when it is built to — in the browser it found, or with
-`--features pane` inside its own window — and ends the whole instance when you press Stop. The one
-thing it installs is this pack, into the home it chose, by running the same installer a person
-would click.)
+and there is no desktop edition. (`app/` is a *front door*: a small Rust console
+program with no window and no web view that decides the root its harness home lives
+in — `$VNCODE_HOME`, with the harness's `DSH_HOME` at `<root>/home` unless `-DshHome`
+or a writable inherited `DSH_HOME` says otherwise — takes the key, installs the pack,
+and then runs `scripts/run-web.*`, the same launcher a person double-clicks. That
+launcher owns the harness, the ready line and the browser tab; the app owns none of
+them.)
 
 The three planes below are the whole system — what npm ships, what the `web`
 profile boots, and what the page renders:
@@ -99,12 +96,11 @@ disable/replace a core row **in its own layer** — a later layer wins per row.
 - operations: `docs/INSTALL.md`, `docs/BUILD.md`, `docs/DEPLOY.md`,
   `docs/RELEASE.md`, `docs/PATHS.md`,
   `docs/COMPATIBILITY.md`;
-- the shell: `app/README.md` (the control panel, the supervisor, the app's own root
-  and the harness home inside it, the browser table, and the crates);
-- a plan, and not shipped behaviour: `docs/PLAN-egui-shell.md` (the Rust/egui
-  shell: one chrome, one web pane, and the runtime and provider seams);
+- the app: `app/README.md` (the verbs, the bridge to `scripts/run-web.*`, the app's own
+  root and the harness home inside it, and the three crates);
+- a plan, and not shipped behaviour: `docs/PLAN-controller.md` (the cut that removed the
+  web view and the window, and why the size is a budget rather than a result);
 - security: `SECURITY.md`;
-- **the checks are the contract**: `scripts/checks/*.mjs` are run by hand (there
-  is no CI, on purpose) and pin route registrations, bundle wiring, budgets, the
-  launcher contract and the credential rules. `scripts/checks/README.md` lists
-  them.
+- **the checks are the contract**: `scripts/checks/*.mjs` pin route registrations, bundle
+  wiring, budgets, the launcher contract and the credential rules. They are run by hand;
+  CI runs the build, the tests and the size budget. `scripts/checks/README.md` lists them.
diff --git a/README.md b/README.md
index eceb2d8..e4d25b0 100644
--- a/README.md
+++ b/README.md
@@ -22,36 +22,33 @@ Cross-platform IDE/ADE. Wraps core [DSH](https://www.deepseek.com/harness/en/) w
 
 | | Windows | macOS / Linux |
 |---|---|---|
-| **Native window** | `scripts\run-desktop.bat` | `cargo build --release` in `app` |
-| **Browser tab** | `scripts\run-web.bat` | `./scripts/run-web.sh` |
+| **The app** | `scripts\run-desktop.bat` | `./scripts/run-desktop.sh` |
+| **Browser tab only** | `scripts\run-web.bat` | `./scripts/run-web.sh` |
 
-Both start the pinned harness and hand the URL it prints to a surface: `run-web` opens
-it in Chrome, falling back to your default browser, and the native window does the same
-unless it was built **with the pane**, in which case it draws the harness inside its own
-window and starts no browser at all. The URL is opened only when it names a **loopback**
-address, and the launch token is never written to a file - both rules are in
-[SECURITY.md](SECURITY.md).
+`run-web` starts the pinned harness and opens the URL it prints in Chrome, falling back to
+your default browser. `run-desktop` builds `vncode` when there is none and runs it: it
+installs the pack if the home in use lacks it, asks for the DeepSeek key if there is none,
+and then runs that same `run-web` in the foreground.
 
-The native window is a Rust **egui** shell: a small control panel that opens first and
-starts nothing, shows where everything lives, starts the pinned harness on **Start** (the
-same launch path `run-web` uses), shows it in a browser it found or - with the pane - in a
-`harness` tab of its own window, and ends the whole instance again on **Stop**. The plan it
-was built from is [`docs/PLAN-egui-shell.md`](docs/PLAN-egui-shell.md), including the
-**egui 0.36.2** line the badge above pins.
-
-### Testing the compiled release, with the harness drawn inside the window
+`vncode` is a small Rust binary - about **0.5 MB per OS** - with **no window and no embedded
+browser**: the interface is the same web application, in the browser you already use. Its
+verbs are `start` (the default), `install`, `uninstall`, `status` and `key`; `-Help` lists
+the flags, and [`app/README.md`](app/README.md) is the whole app on one page.
 
 ```sh
 cd app
-cargo build --release -p vn-shell --features pane
-.\target\release\vncode.exe        # macOS / Linux: ./target/release/vncode
+cargo build --release --locked          # -> app/target/release/vncode (~0.5 MB)
+./target/release/vncode status          # the pin, the home, the pack, the key, the launcher
+./target/release/vncode                 # install if needed, key if needed, then run-web
+./target/release/vncode key             # write DEEPSEEK_API_KEY into <home>/.env
+./target/release/vncode -Help           # every verb and flag
 ```
 
-Press **Start**, then click the **harness** tab. The pane is **opt-in**: a plain
-`cargo build --release` compiles no engine at all - which is exactly what
-`scripts\run-desktop.bat` runs - and `scripts/checks/check-pane.mjs` is what proves the
-two builds disagree.
+`vncode` never runs node itself: it starts `scripts/run-web.*`, which does. Nothing it does
+needs a window, a port or a browser of its own.
 
+The URL is opened only when it names a **loopback** address, and the launch token is never
+written to a file - both rules are in [SECURITY.md](SECURITY.md).
 
 ## Plugins
 
diff --git a/SECURITY.md b/SECURITY.md
index 243a6bc..e4e0cca 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -141,30 +141,22 @@ Four hardening rules travel with those paths, and each is a `cargo test` case:
    `rundll32.exe url.dll,FileProtocolHandler`, which is a program rather than a shell;
    `explorer.exe` was dropped because it silently did nothing from a child. The
    Chrome-first table's last rung is the platform's own opener, so "a browser this build
-   has never heard of" is still the OS's business rather than a refusal. **`Open tab` is
-   the one control that hands the token to a browser**, on demand and in memory: the
-   panel's address row draws the URL with its query stripped, and the log redacts
-   `token=` on the way in.
-
-**Adopt** is the one thing that reads such a home: it copies `skills/`, `sessions/`,
-`storages/` and `attachments/` into the home the app proved it can write, never the
-caches (`dsh-pdf` 512 MiB, `dsh-diagrams` 200 MiB, `dsh-media` up to 8 GiB — all
-reproducible), never the composed `profiles/`, never over a file that already exists,
-and never through a symlink it would have to follow. The credentials file is a
-**separate click** and a **byte-for-byte copy**: its value is never parsed, never held
-in a `KeyState`, never drawn — the presence-only rule above is exactly as it was, and the
-*offer* is decided by the file's SIZE (has the source's got content, is the target's
-absent or empty) rather than by reading it. **Use it** takes the other approach: it points
-the app at the existing home rather than copying it, which hands that home's keys to a
-process this app starts — the same trust the `scripts\run-web.bat` path already extends.
-
-**A key never has to come from the machine at all.** The panel's key field asks for it
-instead: a fresh **portable** home (everything inside `<repo>\.vncode`) starts with no
-credentials document and no key, so the panel opens the field once, the person pastes, and
-`keystate::write_env_key` puts `DEEPSEEK_API_KEY=<value>` into `<home>/.env`. That is a
-layer the harness's own resolution reads, it needs no machine credentials, and it keeps
-the secret inside the folder — which is the point of a portable installation. Nothing is
-read on the way: the field is one-way, and the only thing the panel learns afterwards is
+   has never heard of" is still the OS's business rather than a refusal. **The launcher is
+   the only process that ever hands the token to a browser** — once, in memory, as one argv
+   element, after the ready line has been checked. The app never holds it: `vncode` starts
+   the launcher and waits for its exit code.
+
+**No home is ever read to borrow a key, and nothing is copied out of one.** The first-run
+COPY and the "use the existing home" rung left with the panel that offered them: a home
+outside this app's own root is now nothing more than the harness's own default that the
+launcher falls back to. What replaced them is one prompt.
+
+**A key never has to come from the machine at all.** `vncode key` asks for it at the
+terminal — hidden input, no echo — and `keystate::write_env_key` puts
+`DEEPSEEK_API_KEY=<value>` into `<home>/.env` (`0600` on POSIX, atomic). That is a layer
+the harness's own resolution reads, it needs no machine credentials, and it keeps the
+secret inside the folder. Nothing is read on the way: the prompt is one-way, the value is
+not parsed back, not drawn and not logged, and the only thing the app learns afterwards is
 which layer a fresh `keystate::read` found a key in.
 
 Every child's environment is **composed rather than inherited**
@@ -175,54 +167,27 @@ the child by `check-shell.mjs` — and `TMP`/`TEMP`/`TMPDIR` point at `<app root
 the machine's own temp refuses a child, which is the case a real log measured (the
 harness's spill store died on `mkdtemp`).
 
-## The pane, when the build has one
-
-`cargo build --release -p vn-shell --features pane` compiles **one** optional dependency —
-`wry`, which drives the engine the operating system already has (WebView2, WKWebView,
-WebKitGTK) — and shows the harness inside this window instead of in a browser tab. The default
-build compiles none of it, so none of this is in the shipped default yet. Six rules travel with
-it, and the first is what the rest rest on:
-
-1. **The launch token never leaves the process.** There is no argv and no second program: the
-   token goes to an engine in this very process, which is strictly *less* exposure than the
-   hand-off's "one argv element of a program this app found". It is still never drawn, never
-   logged and never written — the pane's bar shows `Status::public_url`, whose query is stripped
-   by construction.
-2. **Only the harness's own loopback address is ever loaded**, checked at the last function
-   before a navigation *and* in the navigation handler — and the handler **refuses** a
-   navigation rather than following it, because a page that can move this window to another
-   origin is a page that can take the token with it.
-3. **No window is ever opened from inside the pane**, **no download is ever accepted**, and
-   **permissions are answered by the app rather than by the engine**: the clipboard is granted,
-   because a chat interface's copy buttons and its composer need it, and camera, microphone,
-   screen capture, geolocation, notifications, MIDI and sensors are denied by name rather than
-   left to the engine's own default flow. (`with_permission_handler` is why this workspace pins
-   `wry` at 0.57: measured, 0.55's macOS delegate GRANTS media capture itself, and its Windows
-   backend allows clipboard reads and lets every other kind through to the engine.)
-4. **No channel into the app.** There is no IPC handler and no injected script, so a page the
-   harness serves has no way to reach this process. The pane is a viewer, and the only direction
-   that exists is the one URL above.
-5. **Its own profile, inside the app's root** — `<app root>/webview`, and never the directory
-   the Chrome rung uses, because an engine profile and a browser profile in one directory is a
-   way to lose both. The engine is **destroyed** on Stop rather than hidden: a hidden page is
-   still a live page, and a live page holding a token that has stopped meaning anything is a
-   credential nobody is watching.
-6. **The rectangle is the app's to keep clear.** A child web view paints *above* the surface
-   egui draws on and cannot be clipped or drawn over, so it is shown only while its own page is
-   in front, the harness is ready, nothing overlays it and the rectangle has an extent — and the
-   panel draws its rows *instead of* it, never under it. That rule is `vn_shell_core::pane`, and
-   it is `cargo test` cases rather than something anybody checks by looking at a window.
-
-7. **What the engine records about WHERE the pane went is taken away again.** A web engine keeps
-   a browsing record, and this one is no exception: **MEASURED**, after a single load of the
-   harness the full URL — token and all — was sitting in `History`, `Favicons` and `Top Sites`
-   inside the pane's own profile under `<app root>/webview`. No care in this app changes what an
-   engine does with a URL it is given, so the app removes those files: at **startup**, before any
-   view exists (the pass that cannot fail, because a delete while the engine is alive is a
-   sharing violation), and again best-effort when a view is given up. Anything left that still
-   carries the token is **named in the pane's own bar** rather than hidden, so an engine version
-   that invents another record file is visible instead of silent — which is also why rule 1 above
-   says the token never leaves the *process* and not that it never touches a disk the engine owns.
+## There is no embedded engine
+
+The app draws no web view, and that is a security decision as much as a size one. `wry`,
+WebView2, WKWebView and WebKitGTK were all deleted with the pane, so:
+
+- the launch token reaches **one program**: the browser the person already runs, as one
+  argv element, from the launcher — not an engine inside this process;
+- there is no engine profile under the app's root to keep a browsing record, because there
+  is no engine. A browser keeps its own history, in its own profile, where the person can
+  see and manage it;
+- there is no IPC channel, no injected script, no download handler, no permission handler
+  and no navigation handler to audit, because there is no page in this process to attach
+  them to. The whole class of "the engine recorded the token" findings is gone rather than
+  mitigated: **measured**, after a single load of the harness a `wry` build had the full URL
+  — token and all — in `History`, `Favicons` and `Top Sites` inside its own profile;
+- the app's attack surface is the four things it does: write `.env`, run
+  `scripts/setup/install.*`, run `scripts/run-web.*`, and read the pin.
+
+The one rule that used to be about the pane survives, and now belongs to the launcher: only
+a **loopback** URL is ever opened, checked in the launcher immediately before the process
+starts.
 
 ## Lock it down
 
@@ -335,15 +300,15 @@ scanning and push protection as a second net.
 ## What the pack does not do
 
 - No API keys are read: `$DSH_HOME/.credentials.yaml` is touched for **presence**
-  only — a boolean, never a value. The app's **key field** is the same rule from the other
-  side: a value the person TYPES into the panel is written to `<home>/.env` as
+  only — a boolean, never a value. `vncode key` is the same rule from the other
+  side: a value the person TYPES at the prompt is written to `<home>/.env` as
   `DEEPSEEK_API_KEY`, which the harness's own credential resolution reads as a documented
   fallback layer (`@deepseek-ai/dsh-credentials-local`: the managed store first, then the
   invoking project's `.env`, then the home's). The managed document is **never written by
   this app** — it is a strict `CredentialRef`-to-string YAML the harness refuses to boot on
-  when it is malformed or readable beyond its owner. What the field guarantees, and what
-  `keystate::write_env_key` is: the value is masked in the window, held in memory only while
-  the field is open, never parsed back, never held in a `KeyState`, never drawn, never
+  when it is malformed or readable beyond its owner. What the prompt guarantees, and what
+  `keystate::write_env_key` is: the value is hidden as it is typed, held in memory only while
+  the prompt is open, never parsed back, never held in a `KeyState`, never drawn, never
   logged (the log line and the note name the FILE), written atomically with `0600` on Unix,
   and every other line of an existing `.env` is preserved. A value that cannot be carried
   unambiguously (a newline, a quote, a backslash) is refused by name, and the sentence
diff --git a/docs/BUILD.md b/docs/BUILD.md
index ed80385..4925fda 100644
--- a/docs/BUILD.md
+++ b/docs/BUILD.md
@@ -1,109 +1,92 @@
 # Building vncode
 
 Two verbs, deliberately separate: `scripts\run-desktop.bat` (or
-`./scripts/run-desktop.sh`) is the developer loop - build the Rust shell when it is
-stale and run it from the source checkout, where the profile's live links already
-point; `scripts/checks/` is what says whether the change is sound.
+`./scripts/run-desktop.sh`) is the developer loop - build the Rust app when it is missing
+and run it from the checkout, where the package folders are already live-linked into the
+profile; `scripts/checks/` is what says whether the change is sound.
 
 ## No JavaScript build step
 
 There is no JavaScript/TypeScript build here; the packages are hand-written:
 
-- `packages/*/lib/client.js` is the shipped browser bundle, loaded by the harness
-  as a live link - which is what makes a plugin edit visible on a reload.
+- `packages/*/lib/client.js` is the shipped browser bundle, loaded by the harness as a live
+  link - which is what makes a plugin edit visible on a reload.
 - Vendored engines keep their own `vendor/build.mjs` and the tracked hashes in
   `lib/vendor/VERSION.json`. Regenerate them, never hand-edit.
-- `app/` is a **cargo workspace** - the shell's crates, each with its own
-  `cargo test` - and `scripts/checks/` is the build gate: a build that fails a
-  check is not a build.
+- `app/` is a **cargo workspace** of three crates, each with its own `cargo test`, and
+  `scripts/checks/` is the build gate: a build that fails a check is not a build.
 
-## The three entry points, and why there is no distributer
+## The three entry points
 
 | | what it does |
 |---|---|
-| `scripts\run-web.bat` / `./scripts/run-web.sh` | starts the pinned harness and opens it in a browser tab |
-| `scripts\run-desktop.bat` / `./scripts/run-desktop.sh` | builds the shell when it is stale and runs it: the control panel that starts, watches and stops the harness |
+| `scripts\run-web.bat` / `./scripts/run-web.sh` | starts the pinned harness and opens it in a browser tab. **The web half - it needs no `vncode` binary at all** |
+| `scripts\run-desktop.bat` / `./scripts/run-desktop.sh` | builds `vncode` when there is none and runs it: install the pack if this home lacks it, ask for the key if there is none, then run the web launcher |
 | `scripts\setup\install.bat` / `./scripts/setup/install.sh` | adds this folder's bundles to the `web` profile - and the same pair under `uninstall` takes them out again |
 
-There is no `dist.ps1`, no `run-dist.*` and no ship list. **The distribution is
-this repository** (or this repository plus a built `vncode`), because the app
-installs the pack itself: the panel's Install and Uninstall buttons run the two
-`setup/` entry points above, with their output streaming into the app's own log.
-`check-scripts.mjs` asserts the layout and drives both of them with `-Help`, which
-installs nothing.
+There is no distributer, no self-contained folder and no vendored runtime any more. The
+distribution is this repository plus (optionally) a built `vncode`, and the app installs
+the pack itself by running the two `setup/` entry points above.
 
-A folder that carries a built binary beside it needs neither Rust nor a build step:
-`run-desktop.*` runs what is there. `scripts/run-web.*` needs only Node.js 22+.
+## The app
+
+`cargo build --release --locked --manifest-path app/Cargo.toml` produces
+`app/target/release/vncode` (~0.5 MB). No GUI toolkit, no web engine, no linker surprises:
+the only dependencies are `serde_json` and `rpassword`, so nothing has to be installed
+before a build and nothing has to be installed beside the binary.
+
+The size is a **budget, not a result**: `.github/workflows/ci.yml` fails the build over
+6 MB, and `check-shell.mjs` fails over 12 MB. A dependency that draws a window - `eframe`,
+`egui`, `wgpu`, `winit` - or a web view - `wry` and its three OS engines - is the only way
+to get back over either line, and it is the change this project exists to prevent.
 
 ## Runtime and launch path
 
-`scripts/tools/vendor.ps1` produces a complete vendored runtime under
-`runtime/<rid>/` (`node/`, `harness/`, `VENDOR.json`) from the pinned tree the
-machine already has, falling back to the registry only when nothing local carries
-the pin. `choose_launch()` in `app/crates/vn-shell-core/src/launch.rs` then picks the
-BEST of four rungs, in this order:
-
-| rung | what it runs | needs |
-|---|---|---|
-| vendored runtime | `runtime/<rid>/node/node <runtime>/harness/…/lib/bin.js web --no-open --port N` | the three pieces present; no npm, no cache, no network |
-| **already installed here** | `node <npm cache>/_npx/…/@deepseek-ai/dsh/lib/bin.js web …` | the Node on PATH. This is the installation a browser tab is ALREADY running, resolved through the profile's own link first |
-| `npx` fallback | `npx --yes @deepseek-ai/dsh@<pin> web --no-open --port N` | a writable npm cache and, on a first run, the network |
-| the test seam | whatever `VNCODE_STUB_CLI` names | nothing; a check only |
-
-The second rung is the one that matters when npm itself is broken: a cache an elevated
-run made unwritable, a machine that asks for an administrator, or no network at all
-are every one of them a reason to run what is ALREADY on disk rather than ask npm for
-it. It is skipped unless its `package.json` names the pin, because a machine can have
-several harness installations cached (this one has four) and the shell must not
-quietly run a different harness than `scripts\run-web.bat` does.
-
-When npm IS used, it is pointed at a cache the shell has checked it can write in -
-`<cache>/_cacache/tmp`, which is where npm really writes, not the cache root. See
-`appdata::choose_npm_cache`.
-
-`runtime/` is a distribution tree, never a repository tree: gitignored and absent
-from a clone.
-
-The supervisor that runs that command lives in
-`app/crates/vn-shell-runtime/src/lib.rs`, and the control panel that decides when to
-start it - and stops the whole tree again - is
-`app/crates/vn-shell-egui/src/lib.rs`.
+The app does not run node. It resolves the root, the home, the pin and the child's
+environment, and then it runs `scripts/run-web.*` **in the foreground** - the same file a
+person double-clicks, with `-DshHome <the home it chose>` so both halves agree, and with a
+composed environment (`vn_shell_runtime::env`): `DSH_HOME` set, the console markers and
+`VNCODE_HOME` removed, a writable npm cache and temp chosen by write probe.
+
+Everything about *which* harness runs lives in that launcher, not here: `npx --yes
+@deepseek-ai/dsh@<pin> web --no-open`, the ready line, the loopback check and the browser
+hand-off (Chrome first, the OS opener as the floor). `scripts\run-web.bat` is therefore the
+single source of truth for the harness command, and the app cannot disagree with it.
 
 ## Signing, and Windows SmartScreen
 
-Authenticode covers the exact bytes of a file, so sign the binary you are about to
-publish and nothing else: `signtool` on `app/target/release/vncode.exe`, with a
-certificate named by the environment (never committed). Nothing in this repository
-signs anything, and there is no longer a build step that appends a payload to a
-binary - the shell is one file as cargo produced it.
+Authenticode covers the exact bytes of a file, so sign the binary you are about to publish
+and nothing else: `signtool` on `app/target/release/vncode.exe`, with a certificate named
+by the environment (never committed). Nothing in this repository signs anything, and there
+is no build step that appends a payload to a binary - the app is one file as cargo produced
+it.
 
 UAC is not a concern: nothing elevates and there is no installer. SmartScreen is: a
-downloaded `.exe` warns until that file or publisher has reputation, and a
-self-signed certificate fixes nothing for other people. Until a real certificate
-exists, the honest thing is to say so in the Release notes and publish
-`SHA256SUMS.txt` beside the binary, so a reader who checks the hash is not relying
-on the warning being wrong.
+downloaded `.exe` warns until that file or publisher has reputation, and a self-signed
+certificate fixes nothing for other people. Until a real certificate exists, the honest
+thing is to say so in the release notes and publish `SHA256SUMS.txt` beside the binary, so
+a reader who checks the hash is not relying on the warning being wrong.
 
-## No CI
+## CI
 
-`.github/workflows/` does not exist, GitHub Actions is disabled on the repository,
-and `scripts/checks/check-scripts.mjs` **fails** if a workflow directory comes back
-- a deleted CI cannot quietly return on a push. A release is cut by hand
-([RELEASE.md](RELEASE.md) is the ritual), and any pipeline added later must run the
-same checks that ritual runs.
+`.github/workflows/ci.yml` runs clippy (`-D warnings`), the workspace tests, a release
+build, the size budget and a smoke run - on one OS for a push to `main`, on all three for a
+pull request, the Monday schedule, and `release.yml`, which calls the same workflow as its
+gate. There is no per-package JavaScript build to run in CI; the checks in
+`scripts/checks/` remain the contract and are run by hand.
 
 ## Checks
 
-Run the one that owns the area; a check that cannot run on this host skips loudly
-and exits 0. [scripts/checks/README.md](../scripts/checks/README.md) lists them all.
+Run the one that owns the area; a check that cannot run on this host skips loudly and exits
+0. [scripts/checks/README.md](../scripts/checks/README.md) lists them all.
 
 ```sh
 node scripts/checks/check-no-secrets.mjs       # before anything is pushed
-node scripts/checks/check-scripts.mjs          # the scripts layout, the console contract, no CI
+node scripts/checks/check-scripts.mjs          # the scripts layout, the console contract, the two workflows
 node scripts/checks/check-node-routes.mjs      # every Node route, the manifest, the patches
 node scripts/checks/check-client-bundles.mjs   # every browser bundle, driven for real
 node scripts/checks/check-media-node.mjs       # dsh-media's host half and its ffmpeg pin
 node scripts/checks/check-pdf-node.mjs         # the five pdf tools and their routes
 node scripts/checks/check-skill-examples.mjs   # every example in the shipped skills
-node scripts/checks/check-shell.mjs            # the native shell: ready line, token, stop, install
+node scripts/checks/check-shell.mjs            # the app, driven: verbs, the bridge, the env
 ```
diff --git a/docs/COMPATIBILITY.md b/docs/COMPATIBILITY.md
index b06f16a..4b904d2 100644
--- a/docs/COMPATIBILITY.md
+++ b/docs/COMPATIBILITY.md
@@ -1,15 +1,15 @@
 # Compatibility
 
 The pack targets the harness line DeepSeek ships to the raw web install
-(`npx @deepseek-ai/dsh web`). DSH Desktop is not supported: `app/` plus
-`scripts/run-desktop.bat` is a launcher of that same pinned `dsh web` (a launcher,
-not a second edition - it installs nothing and writes no profile file). It is a
-Rust/**egui** control panel that opens idle, starts the harness when you press
-Start and ends the whole instance when you press Stop; the harness UI itself is
-the same page a browser tab shows, opened in the browser the app found on the
-machine (Chrome first, every other browser reachable, the OS opener as the floor) -
-or, in a build made with `--features pane`, inside the app's own window, which is
-[M5 of the plan](PLAN-egui-shell.md) and opt-in.
+(`npx @deepseek-ai/dsh web`). DSH Desktop is not supported: `app/` is a **front door**
+to that same pinned `dsh web` (it installs nothing on its own and writes no profile
+file - it runs `scripts/run-web.*`, the launcher a person would run). It is a small
+Rust console program with no window and no web view: it decides the root and the
+harness home, takes the key, installs the pack with the same entry point a person
+clicks, and then hands over to the launcher, which owns the harness, the ready line
+and the browser tab (Chrome first, every other browser reachable, the OS opener as
+the floor). There is no embedded browser and therefore no per-OS web-engine
+requirement: `wry` and its three engines left with the window.
 
 ## Current pin
 
@@ -19,6 +19,7 @@ or, in a build made with `--features pane`, inside the app's own window, which i
 | Forked from | the same `0.2.0-rc.2` line (`.dsh-version.json`'s `vendoredFrom`) |
 | Install target | the web profile only (`$DSH_HOME/profiles/web`; `$DSH_HOME` defaults to `~/.dsh`) |
 | Host platforms | Windows (PowerShell 5.1 or 7) and macOS / Linux (POSIX shell plus Node.js 22+ with npm/npx - never PowerShell) |
+| The app | one Rust binary per OS, no system library, no runtime to install; CI builds and checks it on all three |
 | Plugin code | plain JavaScript and OS-neutral; the only per-OS code is a launcher choosing the host command |
 
 ## What the pack ships, per bundle
diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md
index f8b95e3..269bb7a 100644
--- a/docs/DEPLOY.md
+++ b/docs/DEPLOY.md
@@ -1,22 +1,29 @@
 # Deploying vncode
 
-What a distribution promises, the contract every launcher holds, and what it still
-depends on outside itself. [PATHS.md](PATHS.md) is the location map,
-[RELEASE.md](RELEASE.md) how a release is cut, [BUILD.md](BUILD.md) how the shell is
-built.
+What a distribution promises, the contract every launcher holds, and what it still depends
+on outside itself. [PATHS.md](PATHS.md) is the location map, [RELEASE.md](RELEASE.md) how a
+release is cut, [BUILD.md](BUILD.md) how the app is built.
 
-**A distribution is this repository.** There is no assembler and no ship list any
-more: the app beside the pack installs it. So "deploying" means putting the folder
-somewhere (or building `app/` and putting `vncode` beside it) and opening the app -
-its panel has the Install button.
+**A distribution is two artefacts, and they are independent.**
 
-## What the current build gets right
+| | | |
+|---|---|---|
+| **the web half** | this repository - the pack, the launchers, the console layer | runs with Node.js 22+ and nothing else. `scripts\run-web.bat` / `./scripts/run-web.sh` opens the browser interface on its own |
+| **the app** | one small `vncode` per OS (~0.5 MB) | a front door: decide the home, take the key, install the pack, then run the web half |
+
+Neither needs the other. The app adds "one command to a working instance"; dropping it
+beside the web half changes nothing about how the harness is launched, because the app
+calls the same `scripts/run-web.*` and passes it `-DshHome`.
+
+## What the build gets right
 
 | | |
 |---|---|
-| **The app installs the pack** | the panel's **Install pack** / **Uninstall pack** buttons run `scripts/setup/install.*` and `scripts/setup/uninstall.*` - the same entry points a person clicks - with their output streaming into the app's own log, and they are disabled while a harness is running |
-| **`check-scripts.mjs` drives them** | the layout, the console contract, and both entry points answering `-Help` (which installs nothing) |
-| **`check-shell.mjs` drives the whole path** | the ready line and its refusals, the launch token in no stream and no file, Stop freeing the port and killing the tree, and `install -Help` / `uninstall -Help` through the app's own runner |
+| **The app installs the pack** | `vncode install` (and a plain `vncode start` over a home that lacks it) runs `scripts/setup/install.*` - the same entry point a person clicks - in the app's own console, with the composed environment and `-DshHome <the home it chose>` |
+| **The app never draws the interface** | no `wry`, no WebView2 / WKWebView / WebKitGTK, no `egui`, no window. The page is the harness's and it opens in the browser the launcher found |
+| **The web half stands alone** | `check-shell.mjs` runs `scripts/run-web.* -Help` with no binary involved, and it must answer |
+| **`check-scripts.mjs` drives the entry points** | the layout, the console contract, `setup/install.bat -Help` and `setup/uninstall.bat -Help` (which install nothing), and the two release workflows |
+| **`check-shell.mjs` drives the app** | the verbs, `-Mode embed` refused by name, and `start` against **stub scripts** in a throwaway tree: the installer is run because the home lacks the pack, the launcher is handed `-DshHome`, `-NoTerminal` and a composed environment, and the app's own root and the console markers are absent from the child |
 
 ## The launcher contract
 
@@ -25,81 +32,53 @@ its panel has the Install button.
 | `scripts\setup\install.bat` / `scripts/setup/install.sh` | both | add this folder's bundles to the web profile; no admin, ever |
 | `scripts\setup\uninstall.bat` / `scripts/setup/uninstall.sh` | both | remove only what this pack added |
 | `scripts\run-web.bat` / `scripts/run-web.sh` | both | start the pinned harness and open it in Chrome (default browser as fallback) |
-| `scripts\run-desktop.bat` / `scripts/run-desktop.sh` | both | the same harness in the native shell: a control panel that opens idle, starts it on **Start** and ends it on **Stop** |
+| `scripts\run-desktop.bat` / `scripts/run-desktop.sh` | both | build `vncode` when there is none and run it; it decides nothing about the instance itself |
 | `scripts\console\adapt.cmd` + `theme.ps1` / `theme.sh` | both | the shared console layer (see below) |
-| `scripts\tools\*` | maintainer only | the vendored-runtime builder, the fork sync, the icon generator |
+| `scripts\tools\*` | maintainer only | the fork re-sync for the client bundles this pack vendors |
 
 Everything under `scripts/` that is not one of those entry points lives in a folder:
 `setup/` (install and uninstall), `console/` (the shared layer), `tools/`
-(maintainer-only) and `checks/`. `check-scripts.mjs` fails on a stray file at the
-top level, because "what I run" and "what it uses" must be tellable apart at a
-glance.
-
-The Windows entry points share one console layer. `adapt.cmd` relaunches into
-Windows Terminal when it exists and nothing is already inside one, runs the worker
-with `pwsh` 7 when present and Windows PowerShell 5.1 otherwise, and holds the
-window open on a double-clicked failure (`-NoPause` / `VNCODE_NOPAUSE=1` never
-does); `theme.ps1` prints colour only on a real terminal and never in a redirected
-log (`NO_COLOR` always wins). Exit codes are `0` success, `1` own failure or usage
-error and `2` a missing prerequisite - and every file answers `-Help`, `--help`, `-h`
-and `/?` with the same text. The POSIX halves mirror the behaviour in plain `/bin/sh`,
-never PowerShell, and nothing ever asks for elevation.
-
-**One trap, and the app clears it.** The console layer marks a run it has set up with
-`VNCODE_CONSOLE=1`, and an entry point that sees the marker keeps the arguments from
-the relaunched shell instead of its own `%*`. The app is started BY that layer, so it
-inherits the marker: every console variable is removed from the environment of the
-installer it spawns, which puts the entry point back on its first-entry path.
-Measured, not assumed - the first version of the Install button ran
-`install.bat -NoTerminal -NoPause -Help` and started a full install. `check-shell.mjs`
-drives that path, and `check-scripts.mjs` clears the same variables before it runs
-either entry point.
+(maintainer-only) and `checks/`. `check-scripts.mjs` fails on a stray file at the top
+level, because "what I run" and "what it uses" must be tellable apart at a glance.
+
+The Windows entry points share one console layer: `adapt.cmd` relaunches into Windows
+Terminal when it exists and nothing is already inside one, runs the worker with `pwsh` 7
+when present and Windows PowerShell 5.1 otherwise, and holds the window open on a
+double-clicked failure (`-NoPause` / `VNCODE_NOPAUSE=1` never does); `theme.ps1` prints
+colour only on a real terminal and never in a redirected log (`NO_COLOR` always wins). Exit
+codes are `0` success, `1` own failure or usage error and `2` a missing prerequisite. The
+POSIX halves mirror the behaviour in plain `/bin/sh`, never PowerShell, and nothing ever
+asks for elevation.
+
+**One trap, and every child of the app clears it.** The console layer marks a run it has
+set up with `VNCODE_CONSOLE=1`, and an entry point that sees the marker keeps the arguments
+from the relaunched shell instead of its own `%*`. The app is started BY that layer, so it
+inherits the marker: `vn_shell_runtime::env` removes it (and `VNCODE_HOME`) from the
+environment of the installer **and** the launcher. Measured, not assumed - without it,
+`install.bat -Help` ran a full install - and `check-shell.mjs` reads the child's own answer
+back.
 
 ## What a distribution still depends on
 
-`$DSH_HOME/profiles/node_modules` is a set of junctions into the npm/npx cache, so
-the folder is not self-contained: moving it does not move the installation,
-`npm cache clean --force` (or another `npm_config_cache`) leaves every junction
-dangling, and the cache grows about **223 MB per pin, per user**. Installing needs
-the network twice - `npx @deepseek-ai/dsh@<pin>` downloads that closure on first run,
-and the installer bootstraps pnpm into `./tools` (about **13 MB**) because
-`dsh plugin add` spawns `pnpm` from `PATH`. The registry itself is never consulted:
-`profiles/web/pnpm-lock.yaml` holds only `link:` specs, so a profile install needs
-the installation closure and a pnpm - but the target machine needs **Node.js 22+**.
-
-What the shell launches, and what the browser launchers do. `scripts/tools/vendor.ps1`
-materialises `runtime/<rid>/{node,harness,VENDOR.json}` once, and `choose_launch()` in
-`app/crates/vn-shell-core/src/launch.rs` picks the best of four rungs: the vendored
-runtime; the harness this machine ALREADY has, run with the Node on PATH straight from
-the npm cache the profile live-links (`node …/@deepseek-ai/dsh/lib/bin.js web
---no-open --port N`, no npm, no network); then `npx --yes @deepseek-ai/dsh@<pin> web`.
-The second rung is what a machine with a broken npm cache - or an administrator
-prompt - falls to, and it is why Start works without npm at all. The browser
-launchers (`scripts\run-web.bat` / `run-web.sh`) still call npx directly.
-
-`runtime/` is a distribution tree, never a repository tree: gitignored and absent from a
-clone, so a checkout takes the installed-or-npx path and everything works as it does today.
-
-## The intended shape
-
-Each rung is independently verifiable, and the target is **L2**: **L1** vendors the
-harness closure into the folder so the profile's junctions point inside it and the npm
-cache leaves the map; **L2** vendors a Node runtime per RID, checksum-verified against
-the official `SHASUMS256.txt` with npm/npx/corepack trimmed, so a machine with nothing
-installed can run the folder; **L3** vendors pnpm and pins its store inside `$DSH_HOME`.
-Native modules (`node-pty`, `sharp`, `koffi`) must be installed on the target OS, so the
-closure is built per OS rather than copied between them. A rung is proved by installing
-from the folder into a throwaway `DSH_HOME` **with the network closed on purpose**, so a
-warm cache cannot hide the dependency - the distributer's `-Verify` used to be that gate
-and it left with the distributer, so the next rung has to bring its own.
-`scripts/tools/vendor.ps1` builds L2's `runtime/<rid>/` today.
+The profile is a set of live links into the npm/npx cache, so a folder that carries the
+pack is not made self-contained by copying it: moving it does not move the installation,
+`npm cache clean --force` (or another `npm_config_cache`) leaves every link dangling, and
+the cache grows about **223 MB per pin, per user**. Installing needs the network twice -
+`npx @deepseek-ai/dsh@<pin>` downloads that closure on first run, and the installer
+bootstraps pnpm into `./tools` (about **13 MB**) because `dsh plugin add` spawns `pnpm`
+from `PATH`. The target machine needs **Node.js 22+**, and Windows needs PowerShell, which
+ships with it.
+
+The app composes what it can of this. It picks an npm cache by writing where npm really
+writes (`<cache>/_cacache/tmp`), hands the child a writable temp when the machine's is
+refused, and puts the vendored runtime's `node` first on `PATH` when a folder carries one.
 
 ## Deferred and open
-- **Deferred**: colour parity inside the POSIX workers' own messages.
-- **Open**: macOS double-click wrappers (`.command`); signing and notarization of the
-  binary; whether Windows Terminal should always win over a user's chosen default
-  console; and a `run-desktop.sh` that finds a system-wide install rather than the
-  binary beside the tree.
-- Nothing in `packages/` learns that a distribution exists, and optional host engines
-  (a TeX engine, poppler/mutool/Ghostscript and tesseract, ffmpeg) stay optional and
-  degrade in a sentence when absent.
\ No newline at end of file
+
+- **Deferred**: colour parity inside the POSIX workers' own messages; macOS double-click
+  wrappers (`.command`); signing and notarization of the binaries.
+- **Open**: whether the app should keep a cache of its own between runs; whether
+  `vncode open` (a second tab for a running instance) is worth the URL it would need.
+- Nothing in `packages/` learns that a distribution exists, and optional host engines (a
+  TeX engine, poppler/mutool/Ghostscript and tesseract, ffmpeg) stay optional and degrade
+  in a sentence when absent.
diff --git a/docs/INSTALL.md b/docs/INSTALL.md
index a27a867..d176f70 100644
--- a/docs/INSTALL.md
+++ b/docs/INSTALL.md
@@ -7,74 +7,106 @@
 | **Remove** | `scripts\setup\uninstall.bat` | `./scripts/setup/uninstall.sh` |
 | **The app** | `scripts\run-desktop.bat` | `./scripts/run-desktop.sh` |
 
-Double-click the `.bat` files on Windows; run the `.sh` files from anywhere (each
-resolves the repository root from its own location). **The app can do the install
-for you**: open the native shell and press **Install pack** in its control panel -
-it runs the same `setup/install.*` entry point and shows the installer's output in
-its own log. The two are interchangeable, and neither needs an administrator.
+Double-click the `.bat` files on Windows; run the `.sh` files from anywhere (each resolves
+the repository root from its own location). **The app can do the install for you**: its
+`install` verb runs the same `setup/install.*` entry point with the same output, and its
+plain `start` installs the pack first when the home in use does not list it. The two are
+interchangeable, and neither needs an administrator.
 
-`scripts/` carries the entry points a person runs (`run-web.*`, `run-desktop.*`) at
-its top level, and everything else in a folder: `setup/` (install and uninstall,
-with their workers), `console/` (the shared console layer), `tools/`
-(maintainer-only) and `checks/`. The repository root carries no `.bat` and no `.sh`.
+**Launching only the web is a supported thing to do.** `scripts\run-web.bat` /
+`./scripts/run-web.sh` is the whole browser experience and needs no `vncode` binary: the
+app is a front door (key, install, then this same file), not a requirement.
+
+`scripts/` carries the entry points a person runs (`run-web.*`, `run-desktop.*`) at its top
+level, and everything else in a folder: `setup/` (install and uninstall, with their
+workers), `console/` (the shared console layer), `tools/` (maintainer-only) and `checks/`.
+The repository root carries no `.bat` and no `.sh`.
 
 | | |
 |---|---|
 | Requirements | **Node.js 22+** on every platform; **Windows** uses Windows PowerShell 5.1 (shipped) or PowerShell 7, **macOS / Linux** a POSIX shell and never PowerShell; `pnpm` is reused when the system copy is new enough, else bootstrapped into `./tools` |
 | Install target | the **web profile** only, `$DSH_HOME/profiles/web` (`$DSH_HOME` = env var, else `~/.dsh`). `-Target web` and `-Target cli` both mean it; there is no desktop target. Overrides: `-DshHome <home>`, `-ProfileName <profile>` |
-| State | model credentials in `$DSH_HOME/.credentials.yaml`; sessions, settings, attachments and the pack's own caches under the same home |
+| State | model credentials in `$DSH_HOME/.credentials.yaml` or the home's `.env`; sessions, settings, attachments and the pack's own caches under the same home |
+
+## The app: `vncode`
+
+A small console program - no window, no embedded web view - that decides the root, the key
+and the pack and then runs the web launcher.
+
+```
+vncode                install the pack if this home lacks it, ask for the key if there
+                      is none, then start the harness and open it (scripts\run-web.bat)
+vncode start          the same thing, spelled out
+vncode install        run scripts/setup/install.* against the home in use
+vncode uninstall      run scripts/setup/uninstall.* against it
+vncode status         the pin, the home and why it was chosen, the pack, the key layer,
+                      where the launcher is; start nothing
+vncode key            ask for the DeepSeek key and write it into <home>/.env (0600)
+```
+
+Flags: `-Port <n>`, `-DshHome <dir>`, `-DshVersion <ver>`, `-Help`, `-Version`. The key is
+asked for only when there is none and only at a terminal; a piped run never blocks on it.
+
+**The app owns a root** (`$VNCODE_HOME`, default the platform's per-user data directory
+plus `vncode`) and the harness home is `<root>/home` inside it. A folder that carries
+`.vncode/PORTABLE` - or already holds a home - is a portable installation and uses its own
+`.vncode` instead, so everything travels with the folder. [PATHS.md](PATHS.md) is the map.
 
 ## Launchers
 
-On Windows each entry point calls the PowerShell worker beside it (`install.bat`
--> `install-all.ps1`, `uninstall.bat` -> `uninstall-all.ps1`, `run-web.bat` ->
-`run-web.ps1`), and `run-desktop.bat` builds and opens the native shell.
-`run-desktop.sh` is the same on macOS/Linux, in plain POSIX shell. The POSIX `.sh`
-files do the work themselves and need Node.js with npm/npx only. Direct calls:
-`powershell -NoProfile -ExecutionPolicy Bypass -File
-scripts\setup\install-all.ps1 -Force` and `sh scripts/setup/install-all.sh -Force` (the same
-with `uninstall-all.*` and `run-web.*`).
+On Windows each entry point calls the PowerShell worker beside it (`install.bat` ->
+`install-all.ps1`, `uninstall.bat` -> `uninstall-all.ps1`, `run-web.bat` -> `run-web.ps1`),
+and `run-desktop.bat` builds `vncode` when it is missing and then runs it. `run-desktop.sh`
+is the same on macOS/Linux, in plain POSIX shell. The POSIX `.sh` files do the work
+themselves and need Node.js with npm/npx only. Direct calls: `powershell -NoProfile
+-ExecutionPolicy Bypass -File scripts\setup\install-all.ps1 -Force` and `sh
+scripts/setup/install-all.sh -Force` (the same with `uninstall-all.*` and `run-web.*`).
 
 Flags on both halves: `-Force`, `-Plugin <name>`, `-DshHome`, `-ProfileName`,
-`-DshVersion`, `-Target web|cli`, `-NoPause`, and `-NoTerminal` on Windows;
-`-Help`, `-h`, `--help` and `/?` print the usage. The `-all` in a worker's name
-means it installs **every bundle the pack carries**; `-Plugin` narrows it to one.
-
-The Windows entry points share `scripts\console\`: `adapt.cmd` relaunches into
-Windows Terminal when it exists and nothing is already inside one (`-NoTerminal`
-or `VNCODE_NO_WT=1` opts out), runs the worker with `pwsh` 7 when present and
-Windows PowerShell 5.1 otherwise, and holds the window open on a double-clicked
-failure (`-NoPause` / `VNCODE_NOPAUSE=1` never pauses). `theme.ps1` / `theme.sh`
-own the colour policy: colour only on a real terminal, never in a redirected log,
-`NO_COLOR` always wins. Exit codes: `0` success, `1` own failure or usage error, `2` a
-missing prerequisite (no PowerShell, no Node). Nothing asks for administrator rights.
+`-DshVersion`, `-Target web|cli`, `-NoPause`, and `-NoTerminal` on Windows; `-Help`, `-h`,
+`--help` and `/?` print the usage. The `-all` in a worker's name means it installs **every
+bundle the pack carries**; `-Plugin` narrows it to one.
+
+The Windows entry points share `scripts\console\`: `adapt.cmd` relaunches into Windows
+Terminal when it exists and nothing is already inside one (`-NoTerminal` or
+`VNCODE_NO_WT=1` opts out), runs the worker with `pwsh` 7 when present and Windows
+PowerShell 5.1 otherwise, and holds the window open on a double-clicked failure
+(`-NoPause` / `VNCODE_NOPAUSE=1` never pauses). `theme.ps1` / `theme.sh` own the colour
+policy: colour only on a real terminal, never in a redirected log, `NO_COLOR` always wins.
+Exit codes: `0` success, `1` own failure or usage error, `2` a missing prerequisite (no
+PowerShell, no Node). Nothing asks for administrator rights.
+
+**The app clears that layer's markers for every child it starts.** `adapt.cmd` marks a run
+it has set up with `VNCODE_CONSOLE`, and an entry point that sees the marker takes its
+arguments from the relaunched shell instead of `%*`. Because the app is started *by* that
+layer, it inherits the marker - so it is removed from the launcher's and the installer's
+environment. Measured, not assumed: without that, `install.bat -Help` ran a full install.
 
 ## Running it
 
-`scripts\run-web.bat` / `./scripts/run-web.sh` starts the pinned harness with the
-browser hand-off attached. Flags: `-Port <n>`, `-DshHome <dir>`, `-DshVersion
-<ver>`, `-NoBrowser` (server only), `-DefaultBrowser` (skip Chrome). It runs
-`npx --yes @deepseek-ai/dsh@<pin> web --no-open` (plus `--port <n>`), streams the
-app's own output, watches for the ready line
-`dsh web: http://127.0.0.1:<port>/?token=<launch token>` and opens **that** URL in
-Google Chrome (`PATH`, the standard install folders, Windows' `App Paths`,
-`/Applications/Google Chrome.app`, `google-chrome`/`chromium`), falling back to
-the platform default browser. It stays in the foreground: Ctrl+C stops it and the
-terminal prints the app's exit status.
-
-- **The launch token is a live credential.** It is read from the app's output in
-  memory only - never written to a file, never echoed, never built into a command
-  string; it reaches the browser as one argv element. Treat a screenshot or a
-  pasted log of that pane like the session cookie itself.
-- **Only a loopback URL is opened.** A ready line naming anything but `127.0.0.1`,
-  `::1` or `localhost` is refused and reported instead of opened.
+`scripts\run-web.bat` / `./scripts/run-web.sh` starts the pinned harness with the browser
+hand-off attached. Flags: `-Port <n>`, `-DshHome <dir>`, `-DshVersion <ver>`, `-NoBrowser`
+(server only), `-DefaultBrowser` (skip Chrome). It runs `npx --yes
+@deepseek-ai/dsh@<pin> web --no-open` (plus `--port <n>`), streams the app's own output,
+watches for the ready line `dsh web: http://127.0.0.1:<port>/?token=<launch token>` and
+opens **that** URL in Google Chrome (`PATH`, the standard install folders, Windows' `App
+Paths`, `/Applications/Google Chrome.app`, `google-chrome`/`chromium`), falling back to the
+platform default browser. It stays in the foreground: Ctrl+C stops it and the terminal
+prints the app's exit status.
+
+- **The launch token is a live credential.** It is read from the app's output in memory
+  only - never written to a file, never echoed, never built into a command string; it
+  reaches the browser as one argv element. Treat a screenshot or a pasted log of that pane
+  like the session cookie itself.
+- **Only a loopback URL is opened.** A ready line naming anything but `127.0.0.1`, `::1` or
+  `localhost` is refused and reported instead of opened.
 
 ## Manual path and uninstall
 
-`npx --yes @deepseek-ai/dsh@0.2.0-rc.2 plugin --profile web add <bundle>` (with
-`pnpm` on `PATH`) installs one bundle by hand, and `remove <bundle>` takes it out.
-`scripts\setup\uninstall.bat` / `./scripts/setup/uninstall.sh` removes every bundle this pack
-added; both installers prune the retired names `dsh-files` and `dsh-focus` first.
+`npx --yes @deepseek-ai/dsh@0.2.0-rc.2 plugin --profile web add <bundle>` (with `pnpm` on
+`PATH`) installs one bundle by hand, and `remove <bundle>` takes it out.
+`scripts\setup\uninstall.bat` / `./scripts/setup/uninstall.sh` removes every bundle this
+pack added; both installers prune the retired names `dsh-files` and `dsh-focus` first.
 
 ## Troubleshooting
 
@@ -82,8 +114,9 @@ added; both installers prune the retired names `dsh-files` and `dsh-focus` first
 |---|---|
 | the run launcher says the port is in use | 3080 is taken; use that instance or pass `-Port 3099` |
 | `scripts\run-web.bat` flashes and closes, or no browser opens | run it from the repo root (the worker reads `.dsh-version.json` there) with `node`/`npx` on `PATH`; the URL is in the app's own output |
-| the app came up in a home you did not expect | that is the ladder in [docs/PATHS.md](PATHS.md): a `-DshHome` you typed is used or refused by name, a home you chose in the panel is remembered in `prefs.json`, a writable inherited `DSH_HOME` is joined, and otherwise the app creates `$VNCODE_HOME/home` (`%LOCALAPPDATA%\vncode\home`). The panel's `harness home` row names the path, the reason, whether the app created or joined it, and every candidate it refused |
+| `vncode` says the web launcher is missing | it starts `scripts/run-web.*`, so it must run from its folder: the git archive, or a folder that carries `scripts/` and `.dsh-version.json` beside the binary |
+| the app came up in a home you did not expect | that is the ladder in [PATHS.md](PATHS.md): a `-DshHome` you typed is used or refused by name, a writable inherited `DSH_HOME` is joined, and otherwise the app creates `$VNCODE_HOME/home`. `vncode status` names the path, the reason, and every candidate it refused |
 | the app's own data is somewhere you did not expect | `$VNCODE_HOME` names it. The default is the platform's per-user data directory plus `vncode`; `<tree>\.vncode` is used only when even that cannot be written (a workspace-scoped confinement) |
-| no browser opens when you press Start | the panel's `surface` row names the browser it will use and, after a launch, the one it did; the chooser lists everything detected plus `the default browser`, which is the OS's own opener and works for any browser this build does not know. `-Mode chrome` is the default; the address is on the panel either way, so a copy can always be pasted into a browser by hand |
+| no browser opens | the launcher's own log says which rung took the page, and the URL is printed either way, so it can be pasted into a browser by hand. `-DefaultBrowser` skips Chrome |
 | `Permission denied` on a `.sh` | `chmod +x scripts/*.sh` |
 | an edited plugin never appears after a refresh | it should: the host stat-polls every plugin's `client.js` (500 ms) and republishes it, so reload the page - and hard-reload if it still shows the old build, because the index ships no cache headers. A `lib/index.js` change (routes, tools) and any row/profile change DO need a host restart. `document.querySelector('[data-dsh-cmdbar-dock]').dataset.dshCmdbarVersion` names the build a page is running |
diff --git a/docs/PATHS.md b/docs/PATHS.md
index a0d4e38..042e92b 100644
--- a/docs/PATHS.md
+++ b/docs/PATHS.md
@@ -1,8 +1,8 @@
 # Where vncode keeps things
 
-Two roots, and the second one lives inside the first - and **one** of the first: the
-window record, `prefs.json`, the npm cache and the home all live under the single root
-the ladder chose, so a root that cannot be written never splits the app's memory in two.
+Two roots, and the second one lives inside the first - and **one** of the first: the npm
+cache and the home both live under the single root the ladder chose, so a root that cannot
+be written never splits the app's memory in two.
 
 ## `$VNCODE_HOME` — the app's own root
 
@@ -13,30 +13,24 @@ controls:
 
 ```text
 $VNCODE_HOME                     portable: <tree>\.vncode
-  ├── window.json                default: %LOCALAPPDATA%\vncode
-  ├── prefs.json                 the browser id and the home you chose
   ├── npm-cache/                 the npx fallback's cache - and nothing else's
-  ├── browser/                   a Chromium THIS app starts, when its own profile is refused
-  ├── webview/                   the pane's engine profile, in a build that has the pane
   └── home/                      DSH_HOME by default: everything that matters
       ├── profiles/  sessions/  storages/  attachments/  skills/
       ├── .credentials.yaml      the model key
+      ├── .env                   DEEPSEEK_API_KEY, when `vncode key` wrote one
       └── dsh-pdf/  dsh-diagrams/  dsh-media/   the pack's caches
 ```
 
-`browser/` and `webview/` are the two directories the app writes for **programs it starts**,
-and they live under this root for the same reason the npm cache does: a session that refuses
-the machine's own data directory does not refuse this one, so a browser or an engine that
-cannot keep its profile where it normally would can keep it here. They are kept **apart** on
-purpose - a Chromium profile and a WebView2 profile in one directory is a way to lose both -
-and neither is a cache: deleting one costs the browser its history, not the app any state.
+The app writes **nothing else** here. It starts no browser and no engine, so there is no
+profile for either: the page opens in the person's own browser, under their own profile,
+exactly as `scripts\run-web.bat` does when it is run by hand.
 
 The root ladder, in order, each rung proved by writing:
 
 | # | candidate | when it is used |
 |---|---|---|
 | 1 | `VNCODE_HOME` | the environment named it |
-| 2 | **`<tree>/.vncode`** | this folder is a **portable installation**: it carries the marker (`PORTABLE`, written by `Keep everything in this folder` in the panel's `Details`), **or** it already holds a home - the app has put this person's sessions there, and preferring the platform directory now would start a second installation beside them |
+| 2 | **`<tree>/.vncode`** | this folder is a **portable installation**: it carries the marker (`PORTABLE` - an empty file, written by hand or by an older build's `Keep everything in this folder`), **or** it already holds a home - the app has put this person's sessions there, and preferring the platform directory now would start a second installation beside them |
 | 3 | platform data root + `vncode` | the default |
 | 4 | `<tree>/.vncode` | the last resort, where even the data root cannot be written (a workspace-scoped confinement, which is what this repository's own checks run inside). It is gitignored |
 
@@ -64,9 +58,9 @@ an npm cache that can hold registry credentials); a directory it merely JOINED i
 touched, which is why the write probe reports whether it created it.
 
 **Why the furniture is outside the home.** `-DshHome` may point the harness home at
-`~/.dsh`, or at a folder shared with `scripts\run-web.bat`, and this app's own records
+`~/.dsh`, or at a folder shared with `scripts\run-web.bat`, and this app's own npm cache
 must survive that - the argument [app/crates/vn-shell-core/src/appdata.rs](../app/crates/vn-shell-core/src/appdata.rs)
-records for the npm cache, applied to the window record too.
+records for the cache, and it is the only thing left beside the home.
 
 ## `$DSH_HOME` — the harness home
 
@@ -77,11 +71,11 @@ its own ladder decides which folder that is:
 | # | candidate | when it is used |
 |---|---|---|
 | 1 | `-DshHome <dir>` | the person named it. **A refusal here ends the run** — an explicit instruction is never silently ignored |
-| 2 | the home chosen in the panel (`prefs.json`) | a click outranks an environment variable; if it has moved or gone, the ladder continues and says so |
+| 2 | a home remembered by an older build (`prefs.json`) | it outranks an environment variable; if it has moved or gone, the ladder continues and says so. Nothing writes this file any more - the app has no chooser - so the rung exists to honour a choice somebody already made |
 | 3 | an inherited `DSH_HOME` | it is writable: the app JOINS the home of the session that started it, sharing its sessions and its key |
 | 4 | `<VNCODE_HOME>/home` | **the default**, created and proved by the app |
 A candidate is used only after a real write probe, and every refused candidate is
-named in the log and in the panel — see `docs/PLAN-egui-shell.md` §2.
+named in the log and by `vncode status`.
 
 **Nothing outside the app's own root is ever the home it runs against.** The harness's own
 default (`~/.dsh`) was once row 4 here — a one-time courtesy, used while the app's own home
diff --git a/docs/PLAN-controller.md b/docs/PLAN-controller.md
new file mode 100644
index 0000000..f28942c
--- /dev/null
+++ b/docs/PLAN-controller.md
@@ -0,0 +1,92 @@
+# The plan: one small controller, and the web half on its own
+
+**Premise.** The interface is a web application served on loopback. `scripts\run-web.*`
+already starts it, watches the ready line and opens the tab. What was missing was a way to
+get from "a checkout on disk" to "a served page" in one command - and that was answered by a
+native window with a web engine in it, which is 15 MB of program to avoid typing two
+filenames.
+
+This page is the plan that replaced it. It is not shipped behaviour: `app/README.md` is the
+app, `docs/DEPLOY.md` is what a distribution promises.
+
+## The measurements it was decided on
+
+| what | before | after |
+|---|---|---|
+| `vncode.exe`, release | 15.51 MB | **0.50 MB** |
+| of which the web engine (`wry` + WebView2/WKWebView/WebKitGTK) | 0.3 MB | 0 |
+| of which the GUI stack (`egui`, `eframe`, `wgpu`, `naga`, `winit`, `accesskit`) | ~13 MB | 0 |
+| crates | 5 | 3 |
+| dependencies | 10 | 2 (`serde_json`, `rpassword`) |
+| the self-contained release folder | 336.7 MB | none |
+
+The first row is the one that decided the plan: **removing the web view alone saved 0.3 MB**.
+The web view was never the weight - the window was. So "remove the webview" and "get small"
+are two changes, and only the second one is worth anything.
+
+## The shape
+
+```
+vncode ──spawn──▶ scripts/run-web.bat|.sh ──npx──▶ dsh web --no-open --port N
+   │                        │
+   │                        └─ ready line, loopback check, the tab
+   └─ composed env: DSH_HOME, npm cache, temp; VNCODE_* removed
+```
+
+- **The app is a front door.** `start` (the default), `install`, `uninstall`, `status`, `key`.
+  It decides the root and the home, takes the key, installs the pack with the same entry
+  point a person clicks, and then runs the launcher in the foreground.
+- **The launcher is unchanged and is not the app's.** `scripts/run-web.*` keeps the harness,
+  the ready line, the token and the browser hand-off. Launching only the web must keep
+  working with no `vncode` on the machine - that is the test that keeps the bridge honest.
+- **Two release artefacts.** One `vncode` per OS (the only per-OS thing in the project) and
+  one `vncode-web` for the node/JS half, which is the same bytes everywhere.
+
+## What was NOT built, and why
+
+- **A Rust installer.** The first draft reimplemented `install-all.ps1`'s profile reconcile,
+  pnpm bootstrap and master-last ordering in Rust. It was dropped: those scripts are the
+  contract, they are already cross-platform, and a second implementation of profile
+  semantics is a second thing to be wrong. The app *runs* them.
+- **A vendored runtime.** `vendor.ps1` and `release.ps1` materialised 554 MB of Node and
+  harness so a folder could run with nothing installed. A controller that calls
+  `scripts/run-web.*` needs none of it, and the folder it produced is what "very very big"
+  meant. Both scripts were deleted.
+- **Fetching the pack through npm.** That existed only because the app was going to be the
+  installer. It is not: the web half ships as its own archive and the app runs it where it
+  already is.
+
+## What the cut removed
+
+`crates/vn-shell-pane` (the engine), `crates/vn-shell-egui` (the panel),
+`crates/vn-shell-paths` (the location map), `core::{pane, windowstate, firstrun, adopt,
+appprefs, browser, status, urlpolicy}` and `runtime::{view, adopt}` - with the panel's
+first-run cards, its four rows, its `Details` inspector, its log ring and its browser table.
+`scripts/tools/{release,vendor}.ps1` and `scripts/checks/check-pane.mjs` followed.
+
+What survived and why it is load-bearing: `home` (the two ladders), `appdata` (the root, the
+write probe, the npm cache), `keystate` (four key layers, presence only), `launch` (the pin
+and the tree's own root), `readyline` (the token and its redaction), `userpath`, `ports`,
+`profile` and `env` (the one composer). Each is the record of a bug measured on a real
+machine, and none of them needs a window to be useful.
+
+## The rules the plan would not trade
+
+1. **A child's environment is composed, not inherited.** A variable that is merely unset is
+   still inherited; the app removes `VNCODE_HOME` and the console markers from every child.
+   `check-shell.mjs` reads the child's own answer back.
+2. **The key is asked for once, hidden, and never read back.** `rpassword`, one file, `0600`.
+3. **The token is not the app's business.** It never appears in `app/`.
+4. **`-Mode embed` fails by name.** Deleting a surface must not turn a flag into a silent
+   default; it is a test, not a comment.
+5. **The size is a budget.** CI fails over 6 MB, `check-shell.mjs` over 12 MB. A dependency
+   that draws a window or a web view is the only way back over either line.
+
+## What is still open
+
+- `vncode open` - a second tab for an instance that is already running - would need the
+  URL the launcher holds, which is the one thing this app deliberately does not read.
+- A `vncode portable` verb, so the `.vncode/PORTABLE` marker does not have to be written by
+  hand now that nothing draws the button that wrote it.
+- macOS double-click (`.command`) and signing/notarization of the binaries; both are listed
+  in `docs/DEPLOY.md`.
diff --git a/docs/PLAN-egui-shell.md b/docs/PLAN-egui-shell.md
index 854129c..52c1b12 100644
--- a/docs/PLAN-egui-shell.md
+++ b/docs/PLAN-egui-shell.md
@@ -1,784 +1,14 @@
-# PLAN-egui-shell.md — the vncode shell, with the Rust app as the father
+# Superseded: the egui shell and the pane
 
-## The revision, in one paragraph
+This plan described a native **egui** control panel with an optional `wry` web view inside
+its own window — the `--features pane` build, `-Mode embed`, and the two tabs
+(`control panel`, `harness`).
 
-The shell that exists is a **supervisor**: it opens a control panel, starts the pinned
-`dsh web` when you press Start, and hands the printed address to your browser. It is not
-the **father** of that instance, and two failures follow from it. It *inherits* the
-harness home instead of choosing one, so a home this account cannot write in — an ACL an
-elevated run left behind, a read-only mount, or a parent process that confines what its
-children may write — is a refusal (`the harness home … is NOT writable`), and the app
-opens on a dead end. And it does not own the surface: it throws the URL at whatever
-`explorer.exe` happens to do with it, names no browser, and reports nothing if none opens.
-This revision makes the Rust app the father. It **resolves, creates and proves** one root it
-owns — `$VNCODE_HOME`, whose `home/` is handed to the harness as its `DSH_HOME`, so the keys,
-sessions, profiles and skills live in a directory this app created rather than in `~/.dsh`,
-which belongs to whichever harness used it first; it **composes** every child's environment
-instead of inheriting one; and it **owns the surface** — a browser table (`browser.rs`,
-Chrome first, everything else reachable, the OS opener as the floor), the choice remembered
-in its own root, and every path it uses cleaned, resolved and proved before a child sees it.
-TThe security core does not move: the launch token never leaves memory, only a
-loopback URL is loaded, Stop still kills the whole tree and proves the port free, no core
-file is patched, and there is still exactly one install target.
+All of it was **deleted** on purpose, and the reason is a measurement: the panel plus the
+engine was 15.1 MB of a 15.5 MB binary (removing `wry` alone saved 0.3 MB), it existed only
+to draw something that is not this app's to draw, and it required a web engine per OS
+(WebView2, WKWebView, WebKitGTK) that the machine already had a browser for.
 
-## Where this plan stands
-
-| phase | state |
-|---|---|
-| **M0 — the father's home** | **done.** `$VNCODE_HOME` is the root the app creates and proves, `<root>/home` is the default `DSH_HOME`, both ladders are data in `home.rs`, one composer builds every child's environment, the installer is given `-DshHome <chosen>`, the geometry moved to the root, the panel draws the root, the home with its refusals and the composed environment, Adopt copies the durable things, and `check-shell.mjs` drives all of it |
-| **M1 — supervisor parity** | **done.** The pure halves moved with their tests, the crates exist, and the ready line, the refusals, Stop and the port assertion are driven by `scripts/checks/check-shell.mjs` |
-| **M2 — the control panel** | **done.** It opens idle with no child process, shows the status, the install state, the location map and the log, starts on Start, stops the whole tree on Stop, and installs or removes the pack from its two buttons. **Revised after a real run**: the home is now a *first screen* rather than a row, and the panel behind it is four rows (home, pack, key, browser) with every diagnostic behind one collapsed `Details` |
-| **M3 — the surface** | **done.** No embedded web view *at the time* (the owner's decision, section 4): the app finds the browser on the machine with `browser.rs` - Chrome first, every other Chromium, Firefox, and the OS opener as the floor - remembers the choice in its own root, opens the loopback URL as ONE argv element, and says which browser it used. `-Mode embed` is refused by name **in a build without the pane** |
-| **M4 — distribution** | **done, differently.** `src-tauri` is deleted and `check-shell.mjs` is the contract. There is no distributer on purpose: the distribution is this app beside the pack it installs, and the panel's **Install pack** / **Uninstall pack** run `scripts/setup/install.*` / `uninstall.*`, the entry points a person clicks |
-| **M5 — the pane** | **done, behind an opt-in feature.** The §4 decision was reversed by a measurement, not a preference: a launched `chrome.exe` exits `0x80000003` where this app runs - reproduced from an Explorer double-click, so no agent session was involved - while the OS web engine drew the harness inside a rectangle of this window and ran its script, in the same process that watched Chrome die. `vn-shell-pane` owns the engine and the page, `vn_shell_core::pane` owns the visibility and DPI rules (tested), the security seams answer for themselves in the engine, `-Mode embed` is real, and `scripts/checks/check-pane.mjs` proves the two builds disagree. **The default is NOT flipped**: `cargo build --release` compiles no engine until Linux and macOS are measured on their own machines, and a Linux build refuses the pane BY NAME for now - wry's child view needs a GTK loop pumped beside winit's and is X11-only, which is P4's work on a machine that has libwebkit2gtk (`engine::platform_supported`) |
-| **Later** | the Ollama provider (appendix), a second runtime variant, and flipping the pane's default: unscheduled, and not dependencies of anything. **The pane itself is no longer on this list — it is M5** |
-
-The phase numbers changed in this revision: **M0 is now the father's home**, the pane that
-used to be M3 was removed from this plan and has since come back as **M5** - opt-in, and
-measured this time (sections 4 and 6). The comments and panel strings that
-called the pane "M0 of docs/PLAN-egui-shell.md" (`vn-shell/src/main.rs`,
-`vn-shell-egui/src/lib.rs`, `vn-shell/Cargo.toml`, `app/README.md`) were corrected with it,
-because a plan and the code that cites it disagreeing about which phase is which is how a
-"fix" lands in the phase nobody is working on.
-
-Three things this plan still treats as fixed:
-
-1. **The DeepSeek path is not touched.** The harness's own adapters, its credential layers
-   and its route are exactly as they are today (section 9).
-2. **One install target** — the `web` profile, started by the pinned `dsh web`, by the same
-   code path `scripts\run-web.bat` uses (section 6). The shell adds a window, a panel, a
-   pane and a Stop button; it patches no core file and starts no second server.
-3. **No CI**, on purpose.
-
----
-
-## 1. What "the father" means, as a contract
-
-A father app is not a wrapper around somebody else's process; it is the process that
-**decides** the facts its children live in. Six duties, each one testable, and each one a
-gap today:
-
-| | duty | today | after |
-|---|---|---|---|
-| **F1** | **own the home.** One root the app creates, proves by writing, and exports to the harness under the name the harness knows (`$VNCODE_HOME`, exported as `DSH_HOME`) — unless a person or a parent named another home | the harness's shared `~/.dsh` is inherited, unverified, and a refusal when unwritable | `DSH_HOME` is always exported, and its default is `<app root>/home` inside a root this app proved |
-| **F2** | **compose the child's environment** — `DSH_HOME`, `npm_config_cache`, `PATH`, the working directory, the console markers — and print what it composed | partially: the cache is chosen, the console markers are cleared for the installer only, `PATH`/`cwd` are inherited, and the home is exported only when the user named one | one `compose_env(plan)` per child, unit-tested, and the panel draws the result |
-| **F3** | **own the tree.** Stop kills everything the harness started, and the port is then *checked* | done on Windows (Job Object + `taskkill /T`) and in `kill_tree`; a kill of the shell itself still leaks on POSIX | unchanged, plus the POSIX detachment note in section 10 |
-| **F4** | **own the surface.** The harness UI appears in a window this app owns, or in a browser this app chose and can name | the browser hand-off only, with no pane and no record of which browser answered | `embed` where it works, `chrome` as the floor, and the choice printed |
-| **F5** | **own the install.** The pack goes into the home the father chose, not into whatever `~/.dsh` happens to be | the Install button runs the installer with no `-DshHome`, so it targets the harness's default home whatever the app chose | `-DshHome <chosen>` and a composed environment, on both entry points |
-| **F6** | **never invent a fact it has not proved.** A home is handed over only after a write succeeds; a runtime only after it prints a ready line; a URL only after it is loopback | already true of the runtime and the URL | extended to the home, which is the fact this revision adds |
-
-## 2. `$VNCODE_HOME`: the app's root, and the home inside it
-
-The failure to solve, in the app's own words:
-
-```text
-the harness home C:\Users\<you>\.dsh is NOT writable by this account, so the harness
-cannot compose its profile there and will not start. If this app was started from
-inside another program that restricts what its children may write, start it directly
-instead - double-click run-desktop.bat, or the built vncode binary.
-```
-
-**`~/.dsh` is not this app's directory, and that is the whole bug.** It is the harness's
-own default home: shared by the browser launcher, by `npx @deepseek-ai/dsh web`, by every
-harness installation on the machine, and created by whichever of them ran first. vncode
-owns nothing in it, so vncode can promise nothing about it. It can be unwritable for three
-different reasons, and only the first is about the file:
-
-| reason | whose problem it is | what answers it |
-|---|---|---|
-| **ACLs an elevated run left behind** — the directory owned by `BUILTIN\Administrators` rather than the signed-in user | the directory's history | nothing this app may do: repairing an ACL needs the rights this pack refuses to ask for (`appdata.rs` measures the same failure on the npm cache) |
-| a **read-only mount**, a locked-down profile, or a directory another account owns | the machine | a home the app creates for itself |
-| a **parent process that confines what its children may write** — an agent session, an IDE runner, a CI sandbox, this repository's own checks | the environment, not the file | a home the confinement actually grants |
-
-The third one is what produced the sentence above, and it is measurable rather than
-argued: from a session with unrestricted file access, `%USERPROFILE%\.dsh\vncode`,
-`%LOCALAPPDATA%\vncode` and `<tree>\.vncode` all take a write, and `~/.dsh` is owned by the
-signed-in account; hand the same app to a parent that confines its children and the *same*
-`~/.dsh` — same owner, same contents — refuses the child. That is also why the app must not
-answer with advice: the person cannot fix a confinement by double-clicking harder.
-
-**So the folder is the app's.** `$VNCODE_HOME` is that folder's name — the root the app
-creates, proves and controls — and `DSH_HOME` is the part of it that holds everything that
-matters, exported under the one name the harness understands: `<VNCODE_HOME>/home`, by
-default. The app decides both; the harness is told only the second. Two ladders, and the
-second one's default sits inside the first:
-
-```text
-$VNCODE_HOME                              the app's root — the furniture it owns
-├── window.json                           geometry (moves OUT of the home: see below)
-├── prefs.json                            the chosen home, the mode, the surface
-├── npm-cache/                            the npx fallback's cache
-├── logs/
-└── home/                                 ← DSH_HOME by default: everything that matters
-    ├── profiles/web/                     the pack, as live links
-    ├── sessions/  storages/  attachments/  skills/
-    ├── .credentials.yaml                 keys (presence only, never a value)
-    └── dsh-pdf/  dsh-diagrams/  dsh-media/   the pack's caches, under their own ceilings
-```
-
-**The app root** (`$VNCODE_HOME`) — the app's furniture AND its memory, all under one
-root (`prefs.json`, `window.json`, `npm-cache/`, `home/`), and the place the app can
-always write:
-
-| # | candidate | note |
-|---|---|---|
-| 1 | `VNCODE_HOME` in the environment | the app's own override; no new flag is added for it |
-| 2 | **`<tree>/.vncode` when the folder is a portable installation** | it carries the `PORTABLE` marker (written by *Keep everything in this folder* in `Details`), or it already holds a home. It sits above the data root because a folder that already holds this person's sessions must stay the root: otherwise every new run starts a second installation beside them. This is also what makes a confined run - whose only writable root was the folder - remember where it put them |
-| 3 | **`<OS data root>/vncode`** | the default: `%LOCALAPPDATA%\vncode`, `~/Library/Application Support/vncode`, `$XDG_DATA_HOME/vncode` else `~/.local/share/vncode` — `appdata::data_root`, already written and tested |
-| 4 | `<tree>/.vncode` | the one place a workspace-scoped confinement (this repository's own checks) always allows; gitignored with the rule |
-| 5 | nothing | a **named failure** listing every candidate and its exact error |
-
-`prefs.json` is read from the root this ladder chose, with the platform copy as a
-read-only fallback for the one migration that needed it (an older build wrote it under the
-platform root while the root in use was beside the checkout, so the choice could never be
-read back). Every save goes to the ladder's root.
-
-**The harness home** (`$DSH_HOME`) — everything that matters, and the home the panel's
-Install button targets:
-
-```mermaid
-flowchart TD
-    Flag["-DshHome given"] -->|probe| F{"writable?"}
-    F -->|"no"| Refuse["REFUSE, naming the flag and the path<br/>(an explicit instruction is never silently ignored)"]
-    F -->|"yes"| Use["export it as DSH_HOME"]
-    Found["the installation on this machine<br/>(~/.dsh: a harness home, writable,<br/>and this app's own home still fresh)"] -->|probe| G{"writable?"}
-    G -->|"yes"| Use
-    G -->|"no"| GNote["named in the log, and skipped"] --> Own
-    Env["inherited DSH_HOME"] -->|probe| E{"writable?"}
-    E -->|"yes"| Use
-    E -->|"no"| ENote["named in the log, and skipped"] --> Own
-    Own["&lt;VNCODE_HOME&gt;/home - THE DEFAULT"] -->|probe| O{"writable?"}
-    O -->|"yes"| Use
-    O -->|"no"| Fail["named failure: every candidate,<br/>and the exact error for each"]
-```
-
-| # | candidate | whose choice it is | when it is refused |
-|---|---|---|---|
-| 1 | `-DshHome <dir>` | the person's, typed — including `-DshHome %USERPROFILE%\.dsh` to share one home with `run-web` | **a refusal**, always, with the flag and the path named |
-| 2 | the home chosen in the panel (`prefs.json`) | the person's, clicked on the first-run screen — which is where **copy it here** / **make a fresh one** are decided, and what `Change` brings back | named and skipped if it has gone |
-| 3 | the inherited `DSH_HOME` | the parent process's — **joined when it works**, so an app launched from inside a harness session shares the sessions and the key that session already has | named and **skipped**, loudly: a parent's confinement is not a statement about where state should live |
-| 4 | **`<VNCODE_HOME>/home`** | the app's — **the default** | the app creates it and proves it; it is inside the root it already proved, and it is the home the Install button targets |
-
-**Row 4 used to be `~/.dsh`, as a courtesy, and it is gone.** It was a **measured correction**
-once: without it the app came up on a fresh, bare harness — no pack, no model key — beside a
-complete installation at `~/.dsh`, and its owner's word for that was *"still does not run
-normally"*. What it answered is answered here instead: **Start installs this pack into the home
-in use**, and the **key row** asks for the key. So the ladder never runs against a home outside
-this app's own root, and the one thing that still reads `~/.dsh` is the first-run **copy** —
-a one-way import that only reads.
-
-The measurement that offer and the app's own home still share is
-`adopt::home_is_untouched_by_a_person`: no `skills/`, no `sessions/`, no credentials file with
-content. The harness's own first-boot furniture does not count, and it is the same measurement
-that decides the copy offer in §8. The check drives it — a scratch "machine" home with sessions
-and a key is **not** used, in either state.
-
-It does **not** check whether that home is *live*: the harness keeps no lock to read, so an app
-started beside a running `dsh web` shares one home with it rather than two, which is the point
-of the rung and also its one caveat. The panel's `home` row names the path and its origin, so
-which home is in use is never a guess, and `-DshHome` or the **copy** card is the way to keep
-them apart.
-
-**Why the furniture sits outside the home.** Because the app must not write its own records
-into a home it did not create, and `appdata.rs`'s own header already says so about the npm
-cache: it lives where it lives precisely so that it *survives a `-DshHome` that points
-somewhere unusual*. Today the geometry contradicts that rule — `window.json` is written into
-`$DSH_HOME/vncode/` — so `windowstate::state_path` moves to the app root in M0. In the
-default case the furniture and the home are one tree, which is the whole point; point
-`-DshHome` at a shared `~/.dsh` and only the harness state moves.
-
-`VNCODE_HOME` is **the app's internal name**, not a second variable handed to children: the
-harness is told `DSH_HOME` and nothing else, because that is the only name it knows. The
-panel draws both, so the identity is visible rather than folklore.
-
-**What the father says when a home is refused.** Never silently. Every refusal is a line
-(`[vncode] home: C:\Users\…\.dsh was refused (Access is denied); using …`), the chosen path
-is always exported explicitly, and the panel's `home` row carries the chosen path, its
-origin **and** the refused candidates with their reasons. There is deliberately **no new
-flag**: `-DshHome` already means "do not decide this for me", and it still refuses rather
-than moving.
-
-**What it does not do.** It never writes a note, a log or a record into a home it refused —
-the one write it makes there is the probe file at that home's root, created and deleted, which
-is what "a child can write in it" means and the only way to know. It never *reads the value* of
-a credential: the Adopt offer and the freshness guard both go by file SIZE. And the only thing
-it ever does with `~/.dsh` besides probing it is to **use it** (row 4, when the conditions hold)
-or to offer **Adopt** (section 8), which copies from a home it can read into one it has proved
-it can write.
-
-## 3. The child's environment is composed, never inherited
-
-The rule that closes the whole family of confinement bugs, and the one the console-marker
-trap already taught this codebase the hard way: **nothing a child sees is inherited by
-accident.** Every process the father starts gets an environment built from the plan.
-
-| variable | value | why |
-|---|---|---|
-| `DSH_HOME` | the chosen home, **always** | the child's home must be a fact, not an inference. Today it is exported only when the user named one, so "which home is this instance using" is answered by the harness's own resolver and not by this app |
-| `npm_config_cache` | the app's own cache, chosen by write probe (`appdata::choose_npm_cache`) | already done for the `npx` rung; the same choice is right for the installer |
-| `PATH` | the vendored runtime's `node` directory first, when one is used | anything the harness or a skill spawns resolves the same Node the harness runs on |
-| `TMP`, `TEMP`, `TMPDIR` | `<app root>/tmp`, and **only** when the machine's own temp is not writable by a child | measured, from a real run: `dsh-spill-local: EPERM … mkdtemp 'C:\Users\…\AppData\Local\Temp\dsh-spill-XXXXXX'`, and the entry that owned it did not activate. The machine's temp is preferred and left untouched whenever it works, because it is the machine's |
-| the working directory | the workspace the panel names | a child that inherits whatever directory the app was launched from is a second, invisible decision. **This one has a coupling to keep**: `keystate.rs` reads `.env` in the *shell's* cwd because the harness inherits it, so the value the panel names as `ProjectEnv` and the value the harness reads must come from the same composed cwd — one commit, or the panel lies about where the key came from |
-| `VNCODE_HOME` and the seven `VNCODE_*` console markers | **removed** | the app's internal name for its root, and the launcher's own markers (`VNCODE_CONSOLE`, `VNCODE_ARGV`, `VNCODE_ARGS`, `VNCODE_PAUSE`, `VNCODE_NOPAUSE`, `VNCODE_QUIET`, `VNCODE_NO_WT`). A variable that is merely *not set* is still INHERITED - measured while M0 was built: `VNCODE_HOME`, set for the app, reached the harness, and the check now reads the child's own answer back |
-
-The installer matters as much as the harness here, because it is the other thing this app
-runs for you: it gets `-DshHome <chosen>`, the same `npm_config_cache`, the console
-variables removed and `-NoTerminal -NoPause`. **One environment builder, three children**
-(the harness, the installer, the browser hand-off through the OS), so a variable cannot be
-set for one of them and forgotten for the next.
-
-`env::compose` is pure - `Facts` in, `ChildEnv` out (the pairs it sets, the names it
-removes, the working directory) - so `cargo test` pins the exact set, and `check-shell.mjs`
-proves the wiring by having the stub CLI print what it was GIVEN: `DSH_HOME` must equal the
-home the app named, and `VNCODE_HOME` and `VNCODE_CONSOLE` must be `(unset)`.
-
-## 4. The surface: one URL, and the browser this machine has
-
-**The pane exists, behind an opt-in feature, and the paragraph that used to stand here was
-reversed by a measurement.** It used to read *"There is no embedded web view, and there is not
-going to be one"*, and the argument behind it was sound: two renderers, a DPI/focus seam, and
-no capability a browser did not already have. What changed is not a preference but a fact about
-the machine this was written on: **the browser hand-off cannot start a browser there.** A
-launched `chrome.exe` exits `0x80000003` — reproduced from an Explorer double-click, with no
-agent session involved — while the OS web engine drew the harness inside a rectangle of this
-very window, loaded the page and ran its script, in the same process that watched Chrome die
-(the P0 spike: `WEBVIEW-UP` + `PAGE-LOADED` + `JS-RAN`). So the pane is not a nicer surface; it
-is the only surface that works there.
-
-It is **opt-in**, and that is deliberate rather than cautious: `cargo build --release` compiles
-no engine, `scripts\run-desktop.bat` and every existing check behave exactly as they did, and
-the default is not flipped until Linux (where `build_as_child` is X11-only) and macOS are
-measured on their own machines. What this app owns is unchanged in kind — **which** engine, how
-it is started, what it may load, and what it says when it cannot be — and what it owns in
-addition is a rectangle it must keep clear, which is `vn_shell_core::pane`'s only subject.
-
-`browser.rs` is a table, Chrome first, and the last rung is the platform's own opener — so
-*"all other browsers work"* is structural rather than hopeful: a browser this table has never
-heard of is the OS's business, and it is always reachable.
-
-| family | entries | how it is started |
-|---|---|---|
-| **Chromium** | Google Chrome, Microsoft Edge, Brave, Chromium, Vivaldi, Opera | the program, with the URL as exactly ONE argv element |
-| **Firefox** | Mozilla Firefox | the same |
-| **the floor** | `explorer.exe` (Windows), `open` (macOS), `xdg-open` (Linux) | the same — a program, never a command string |
-
-* **Chrome first**, because that is what `scripts\run-web.bat` opens and the two entry points
-  should behave the same way. A remembered browser that has since been uninstalled **falls
-  through** to the first one found rather than refusing to show the page.
-* **Detection is a pure function of the facts** (`Facts`) plus one probe predicate, so the
-  table AND its order are `cargo test` cases on every platform — including the OS guards that
-  stop a Windows install path being probed on Linux.
-* **The choice is remembered in the app's own root** (`prefs.json`), not in the harness home,
-  and it stores an **id**, never a path: a hand-edited preferences file cannot name a program
-  to run. The panel's `browser` row draws a chooser over what was actually found, and says
-  which browser the last launch used.
-* **`Open tab` is the button that carries the launch token.** The panel's address row draws the
-  URL with its query stripped — that URL is a credential — so the button is the way in: it
-  opens the harness in the chosen browser, and it is also the way BACK in after a tab is
-  closed by accident or after the automatic open was missed. It is the only place in the panel
-  that hands the token to another process, and it does it the only way the rules allow: one
-  argv element of a program this app found, never a shell, never a disk.
-* **Three rules travel with every launch**: the URL is one argv element, only a loopback URL
-  is accepted (checked here *again*, at the last function before a process starts), and no
-  shell is ever in the middle. `check-shell.mjs` asserts the argv and the refusal without
-  opening a browser.
-* **`-Mode embed` is refused by name**, with the reason, rather than quietly opening a
-  browser — a flag that silently means something else is a flag nobody can trust.
-
-`headless` stays what it always was: no window, the URL printed, and
-`stop`/`quit`/`install`/`uninstall` on stdin.
-
-## 5. One launch path, three entry points
-
-Start must not become a second way to boot the harness. It is the same pin lookup, the
-same port choice, the same `--no-open --port N`, the same ready-line watch and the same
-token rule as the launcher that already exists:
-
-| entry point | host | what it does |
-|---|---|---|
-| `scripts\run-web.bat` / `scripts/run-web.sh` | both | the browser launcher: starts the pinned harness, opens Chrome (default browser as fallback) |
-| `scripts\run-desktop.bat` / `./scripts/run-desktop.sh` | both | **bootstrap only**: find the built `vncode`, build it if there is none, hand over the flags. It decides nothing about the instance |
-| the shell's **Start** | all three | the same harness on the same terms, plus a browser tab and a Stop |
-
-`run-desktop.*` staying a bootstrap is deliberate: it is the human entry point (a
-double-click), and the father is the process it launches. Everything the bootstrap learned
-the hard way stays — the built-binary-before-Cargo.toml check, the run-the-artefact-
-already-there fallback when a running shell blocks the build, `-NoBuild` — and nothing
-about the instance is decided there.
-
-## 6. What the shell is, and why it draws none of the interface
-
-The constraint that decides the whole design. The harness is a web application served by a
-Node host, and every plugin this pack ships is a browser bundle built out of DOM, CSS and
-React — twenty-odd surfaces none of which egui can draw. egui is an immediate-mode GPU
-painter for Rust widgets; it has no DOM and it will not get one.
-
-| | what the app draws | what happens to the twenty-odd bundles | verdict |
-|---|---|---|---|
-| **Native rewrite** | everything: chat, tools, editor, PDF, video | they are discarded; the product forks | a multi-year track that throws the pack's value away. Not this plan |
-| **egui panel + the machine's browser** | the panel, the status, the switches | they keep working, unchanged, in a tab | **this plan** |
-| **egui panel + an embedded web view** | the panel, plus a rectangle holding the engine the OS already has | they keep working, inside that rectangle | **built, opt-in (M5)**. The rejection that stood here was reversed by measurement, not by preference: the browser hand-off could not start a browser where this app runs, and the engine could. The costs it named are real and are paid: a child view paints *above* the surface, so nothing may be drawn over it (`vn_shell_core::pane` owns that rule and is tested), the engine's own profile becomes the app's business, and the shipped default still compiles no engine until Linux and macOS are measured |
-
-So egui owns the process, the machine and the files; the browser owns the shipped interface;
-and the boundary between them is one loopback URL that this app opens, names and can hand to
-anybody. That division is why the shell is small enough to trust with a launch token — and
-why "which browser" is a table of programs rather than a rendering stack.
-
-## 7. The panel
-
-The panel is the father's face: every fact on it is one the father decided, and the rows
-this revision adds are the ones that answer "why did it do that". It is drawn in two
-screens, and the order is the point.
-
-**First, the home question** — while nobody has named a home, this IS the window:
-
-```
-┌ vncode ─────────────────────────────────────────────────────────────┐
-│ Where should your sessions, skills and key live?                    │
-│ Pick one. It is remembered, and Change brings this back.            │
-│ ┌─────────────────────────────────────────────────────────────────┐ │
-│ │ ▸ Copy it here, and use the copy  · recommended                 │ │
-│ │   copies into C:\Users\you\proj\.vncode\home                    │ │
-│ │                                  [ Copy it here and continue ]  │ │
-│ └─────────────────────────────────────────────────────────────────┘ │
-│ ┌ Use the home in this folder ────────────────────────────────────┐ │
-│ │ C:\Users\you\proj\.vncode\home · empty, and private to this app │ │
-│ │                     [ Create the home here and continue ]       │ │
-│ └─────────────────────────────────────────────────────────────────┘ │
-│ this app's own root: …\proj\.vncode (this folder, portable)         │
-└─────────────────────────────────────────────────────────────────────┘
-```
-
-Every card ends inside this folder: the card that ran the harness against `~/.dsh` is gone
-(§2), and the one that remains is the copy, which only reads it.
-
-**Then the panel** — after the choice, four rows and three buttons, with every diagnostic
-one disclosure away:
-
-```
-┌ vncode ─────────────────────────────────────────────────────────────┐
-│ vncode  ● running   [ Start ]  [ Stop ]  [ Open tab ]   up 2m       │
-│ home     C:\Users\you\proj\.vncode\home · this app's own home [Change]│
-│ pack     installed · 24 bundles                                     │
-│ DeepSeek key  found in the credentials file                         │
-│ browser  [ Google Chrome ▾ ] · opened in Google Chrome (a new tab)  │
-│ ▸ Details · 1 refused path(s)                                       │
-│ ┌ the log ────────────────────────────────────────────────────────┐ │
-│ │ [vncode] running on http://127.0.0.1:53412/ (pid 26108)         │ │
-│ │ [vncode] handed the page to Google Chrome, which was already    │ │
-│ │          running                                                │ │
-│ └─────────────────────────────────────────────────────────────────┘ │
-└─────────────────────────────────────────────────────────────────────┘
-```
-
-`Details` (closed by default) carries the pin, the runtime, the app root and its origin, the
-composed environment, the profile, the pid, the last setup and stop, the location map, the
-provider row, the refusals and the notes — nothing was deleted to make the panel small, it
-moved. A refusal is a **badge on the disclosure**, because a refusal must never be the thing
-that is hidden.
-
-| row | reads | never |
-|---|---|---|
-| home | the home ladder's own record: the chosen path, its origin, whether this app created it — plus `Change`, which puts the question back | a path it has not proved writable, or a guess |
-| pack | the profile's own `package.json` (one reader: `profile.rs`), and the action that fixes it | a claim that the pack is installed: it is read, not remembered |
-| DeepSeek key | `keystate`'s layer NAME, and where the other home's key is when this one has none | a value: the credential file is read for presence and SIZE only |
-| browser | the browser table's answer, the remembered id, and which browser the last launch actually used | an assumption that a browser exists: the OS opener is always in the table |
-| harness env | `compose_env`'s own output (in Details) | a secret: the credential *file* is named by `keystate`, never read |
-| preferences | `<app root>/prefs.json` — the browser id and the chosen home, both validated on read, and the home written only by a click | a stored program path: only ids the table already knows are accepted |
-| state, pid, port, uptime | the supervisor's own child handle | a guess: the port is the one the harness printed |
-| pin | `.dsh-version.json`, walking up from the executable | a built-in fallback pin (there is none) |
-| runtime | `runtime/<rid>/` completeness, then the installed harness, then `node`/`npx` on `PATH` | starting a runtime to find out which one it is |
-| profile, provider, model | the profile's own files | writing them while a harness is live |
-| key | `keystate.rs`'s four layers — the **layer's name**, never a value | opening `.credentials.yaml` to show it |
-| paths | [docs/PATHS.md](PATHS.md), plus the app root this revision adds | deriving a root or a home the ladders did not choose |
-| log | the child's stdout/stderr, bounded with an LRU cap, redacted on the way in | letting a log file grow without one |
-
-### Starting and stopping
-
-- **Start** chooses the port (`-Port`, else a free port of this app's own — never the shared
-  `3080`, which every other `dsh web` on the machine wants), composes the
-  child's environment, spawns, and watches for the ready line. When it arrives, the URL goes
-  to the chosen browser, as ONE argv element, and the panel says which browser took it.
-- **Stop** stops the harness **and everything it spawned**, then asserts the port is free
-  again — a bind, not an assumption. Closing the window is Stop.
-- The provider row is read-only while a harness is live, because the route is read at boot.
-
-### The home this app did not create: two buttons, not a policy
-
-When `~/.dsh` (or wherever the harness's default lives) is a harness home, the first-run screen
-offers it as a card, and the app makes neither decision on its own:
-
-- **Use this home** — remember that path in `prefs.json` and run the harness against it from the
-  next Start, so the app and `scripts\run-web.bat` share one home: one set of sessions, skills
-  and keys. Offered only when a child can **write** there, because the harness composes its
-  profile at boot. **`Change`** on the panel brings the question back, because a home that
-  cannot be un-chosen is a trap.
-- **Copy it here and use it** — the copy described below, offered while the source can be
-  **read** *and* there is something left to bring, which is the case it exists for. Wiring both
-  from one writable-filtered path was a bug: a person whose `~/.dsh` was unwritable got
-  *neither*, and no way to reach their key. Offering it on readability alone was the second
-  bug, measured: over a home already copied here the press planned no items, refused, and drew
-  its one sentence inside `Details` - so the card is now unavailable in that state, with the
-  reason on it, and the app installs the pack into the copy itself when the copy finishes.
-
-### Adopt: what happens to the home the app did not choose
-
-The app's home starts empty, and the user's real installation — sessions, skills, the model
-key — is usually in `~/.dsh`. So the panel offers **Adopt** whenever the source has something
-left to bring and the target has nothing to overwrite: it copies the durable, *small* things
-across — `skills/`, `sessions/`, `storages/`, `attachments/` — and it never touches the caches
-(`dsh-pdf/artifacts`, `dsh-diagrams/*`, `dsh-media/*`, up to 8 GiB by `docs/PATHS.md`, all
-reproducible). Three things this rule learned from a real run, where the panel said
-`DeepSeek key: not found` while the key sat in `~/.dsh` and there was no button to press:
-
-* A composed `profiles/` does **not** make a home "used" — the harness creates it on its first
-  boot, and Adopt does not copy it anyway.
-* Neither does an **empty** `.credentials.yaml`, which the harness also writes on that boot.
-  The test is a file SIZE — "does the source's have content, and is the target's absent or
-  empty" — never a read, so `SECURITY.md`'s presence-only promise holds.
-* A durable tree is offered when the target's copy is missing **or empty**, which is what keeps
-  a half-filled home from closing the offer.
-
-This is also why joining a *writable* inherited `DSH_HOME` matters: an app started from inside a
-harness session is already on that session's home and needs no Adopt. Three rules:
-
-1. **Nothing is written into the source home**, ever. Adopt reads from it and writes into
-   the home it proved it can write.
-2. **`.credentials.yaml` is a separate, second click**, and it is a byte-for-byte copy:
-   `SECURITY.md` says this app touches that file for *presence* only, and a copy does not
-   read the value into this process. Off by default, because the honest alternative is
-   re-entering the key in the harness's own Models page.
-3. **A source home that cannot be read offers no Adopt at all**, and says so — as does one
-   that does not exist, which is also the ordinary first run.
-
-`-DshHome %USERPROFILE%\.dsh` is the other answer, and it is the one for a person who wants
-the app and `run-web` to share a single home rather than keep two.
-
-## 8. What must not change
-
-| rule | where it is pinned today | after |
-|---|---|---|
-| the launch token is read in memory, never written, never echoed | `readyline.rs` + its tests, `status.rs` | unchanged |
-| only a loopback URL is loaded — pane included | `readyline.rs`, `urlpolicy.rs` | unchanged, and the pane's URL comes from the same function |
-| key **presence** only, never a value | `keystate.rs` | unchanged; Adopt copies bytes and reads no value |
-| the model path is not touched | the harness's own adapters (section 9) | unchanged |
-| the window record is discarded, never repaired | `windowstate.rs` | unchanged, and it now lives under the *chosen* home |
-| one install target; the shell installs nothing by itself | `AGENTS.md`, `check-shell.mjs` | unchanged: the Install button runs the pack's own installer, now with `-DshHome` |
-| no core patch, no second server | the whole pack | unchanged |
-| no CI | `AGENTS.md` | unchanged |
-
-## 9. The provider: DeepSeek exactly as it is, Ollama later
-
-**What is protected, and stays exactly as it is.** The shell does not touch the model path
-in any way: it does not read, write, move or rewrite `.credentials.yaml` — the panel
-learns **which layer answered**, never a value; it does not set, unset or reorder
-`DEEPSEEK_API_KEY`, `$DEEPSEEK_BASE_URL` or the `.env` files; it does not add headers,
-retry, proxy, log or buffer a request, and it never becomes a middleman for model traffic;
-it writes a profile's `cordis.patch.yml` only when the user asks for a change, and only
-while no harness is running. The panel's provider row names the one route the profile
-already declares — `DeepSeek (official)`, with the model from `agent-default-model` — and
-is read-only while a harness is live. It is built as a **chooser with one entry**, so the
-future provider is a second entry and not a new page.
-
-The Ollama research is kept in the appendix and is **not scheduled**.
-
-## 10. Platforms, and what actually confines a child
-
-"Solve the restriction issues for all platforms" is not one bug per OS; it is one rule per
-OS's *shape* of confinement, answered by the same portable probe. The probe is a write —
-create the directory, write a file, delete it (`appdata::is_writable`) — because a
-permission bit is not the question and `exists()` is not either. No platform-specific
-cleverness, which is also what keeps this code OS-neutral.
-
-| platform | what confines a child's writes, in the cases that get reported | what the father does |
-|---|---|---|
-| **Windows** | a restricted token or AppContainer on the process tree; a job object that denies writes; ACLs an elevated run left on `%USERPROFILE%\.dsh` or `%LOCALAPPDATA%\npm-cache`; any parent that sandboxes its children (this repository's own checks are run inside one) | the default root is `%LOCALAPPDATA%\vncode` and the home inside it is `…\vncode\home`; when even the data root is refused, `<tree>\.vncode`. A refusal names the path **and the Win32 error**, never "run as Administrator" — that advice is what *created* the unwritable directory (`appdata.rs` records the measurement) |
-| **macOS** | App Sandbox (a container: `HOME` is inside `~/Library/Containers/<id>/Data`), TCC, the quarantine bit on a downloaded `.app`, a read-only `/Applications` tree | `~/Library/Application Support/vncode` resolves inside the container, so the default root is writable wherever the app's own data is; a distribution in `/Applications` cannot use `<tree>/.vncode`, and does not need to. POSIX shell only — never PowerShell |
-| **Linux** | snap/flatpak/bwrap confinement (HOME read-only or redirected), a container with a read-only mount, a read-only checkout | `$XDG_DATA_HOME/vncode` is where a confinement grants writes, and it is the default root by construction; no PowerShell anywhere on this path |
-| **all** | a parent process that confines what its children may write — an agent session, an IDE runner, a CI sandbox | a home the app creates and proves is the portable answer: the app must not require a write outside the paths the confinement permits in order to come up at all |
-
-Shipped parts, unchanged: **L1** vendors the harness closure into the folder, **L2** vendors
-a Node runtime per RID (checksum-verified, npm/npx/corepack trimmed), **L3** vendors pnpm
-with its store pinned inside `$DSH_HOME`. The shell inherits L2 as its floor: the panel and
-the surface need nothing installed but a browser — the machine's own, found by `browser.rs`,
-or the OS opener as the floor. **Nothing in this plan needs a browser ENGINE to be shipped**,
-which is the quiet benefit of not embedding one: WebKitGTK 4.1, WebView2 and WKWebView are
-all the OS's business now, and Linux is not the platform where the plan is thinnest any more.
-
-## 11. Where the work landed
-
-| file | what changed |
-|---|---|
-| `vn-shell-core/src/home.rs` | **the two ladders as data**: `Inputs`, `Candidate { path, origin, strict, problem }`, `Refusal`, `Selection { chosen, origin, created, refused }`, `Resolution { app_root, app_root_origin, home, refused, strict }`, and a pure `select`/`resolve_with` so precedence, the remembered choice, the fall-through, the strict `-DshHome`, a path that cannot be cleaned and "nothing writable anywhere" are `cargo test` cases. `~/.dsh` is not a candidate; `looks_like_a_harness_home` and `existing_default_home` exist so the panel can OFFER it |
-| `vn-shell-core/src/userpath.rs` | the path hygiene every rung goes through: `~` expansion, relative → absolute against the captured cwd, lexical `.`/`..` folding, a rooted-without-a-drive path attached to the current drive, NUL/empty refused by name, and `canonical` with the Windows verbatim prefix stripped |
-| `vn-shell-core/src/browser.rs` | the browser table per OS, `detect_with` (pure, so the order is testable on any host), `resolve` (remembered → first found → the OS opener), `command` (loopback re-checked; ONE argv element; never a shell) and `launch` |
-| `vn-shell-core/src/appprefs.rs` | `<app root>/prefs.json`: the browser id and the chosen home, written atomically, and DISCARDED rather than repaired when the version, the id or the path is not one this build knows. An id, never a program path |
-| `vn-shell-core/src/appdata.rs` | `app_root_with`/`app_root` (the first ladder), `root_in`, `tree_root`, `owned_home` = `<root>/home`, `probe` (the write probe, returning the REAL path and whether it created the directory), `harden_if_created` (0700 on Unix, only for a directory this app made), `npm_cache_dir` under the root, and the home probe moved from `<home>/vncode` to the home itself — so a refused candidate is left exactly as it was found |
-| `vn-shell-core/src/adopt.rs` | what may be copied and what never is, `target_is_untouched`, `source_is_readable`, the `Offer`, and a bounded size walk |
-| `vn-shell-core/src/options.rs` | `Mode` is `panel`/`chrome`/`headless`; **`embed` is refused by name** with the reason; the default is `chrome` |
-| `vn-shell-core/src/windowstate.rs` | untouched; the record's PATH is what moved — `state_path` is now called with the app root, so the geometry survives a `-DshHome` pointing at somebody else's folder |
-| `vn-shell-runtime/src/env.rs` | **the one composer**: `compose(Facts) -> ChildEnv` (pairs set, names removed, the working directory), `choose_cache`, `dsh_home_arguments`, `home_or_problem`, and `CONSOLE_VARIABLES` moved here from `setup` because the harness inherits the same markers |
-| `vn-shell-runtime/src/lib.rs` | `Plan` carries the `Resolution`, the chosen cache and the captured workspace; `plan(options, remembered)`; `start(options, remembered)` refuses only an explicit `-DshHome`; the spawn applies the composer's output and logs it; Linux arms `PR_SET_PDEATHSIG` so a force-killed shell does not leak the harness |
-| `vn-shell-runtime/src/setup.rs` | the installer gets the same composed environment plus `-DshHome <chosen>`, in one `command_for` |
-| `vn-shell-runtime/src/adopt.rs` | the copy runner: bounded recursion, no overwrite, links skipped, the credentials file byte-copied on its own click and never parsed |
-| `vn-shell-egui/src/lib.rs` | the first-run screen (the cards, the pre-selection, the facts), the four-row summary, the collapsed `Details`, the log; and the `Pane` trait, `PaneRect` and the destination switch DELETED |
-| `vn-shell-paths/src/lib.rs` | `Input` gains `app_root`; a `vncode-root` row is first in the map, and the window record follows the root |
-| `vn-shell/src/main.rs` | wiring only: the app preferences, the announce lines (including `VNCODE_HOME`, every refusal and the composed environment), the browser list, the existing-home offer, the geometry path, and the plan the headless installer also uses |
-| `scripts/checks/check-shell.mjs` | `checkConfinedHome()`, the `-Mode embed` refusal, and a scratch app root for every run, so the check never touches a person's own `~/.dsh` or `%LOCALAPPDATA%` |
-| `docs/PATHS.md`, `app/README.md`, `ARCHITECTURE.md`, `AGENTS.md`, `SECURITY.md`, `docs/INSTALL.md`, `scripts/checks/README.md`, `.gitignore` | the app root and the ladder, the path hygiene, the browser table, the Adopt rules, the composed environment, the troubleshooting rows, and the `/.vncode/` ignore — **one commit with the code**, because a state location that exists in the code and not on the map is how a home gets lost |
-
-Two deliberate refusals, unchanged: **no `tokio`** (the supervisor is blocking
-`std::process` plus threads, and it is the part that must not change behaviour) and **no
-second browser stack** — and the pane does not change that: there is no CEF, no Servo, no
-chromium download, and no engine vendored. `wry` is ONE optional dependency that drives the
-engine the OS already has, and the default build compiles none of it.
-
-## 12. The checks
-
-`cargo test --workspace` and `scripts/checks/check-shell.mjs` are the contract, and both
-grew with the work rather than after it. What landed (190 tests in the workspace):
-
-- the two ladders' precedence, and that **an unwritable inherited `DSH_HOME` falls through**
-  instead of refusing — the exact regression this revision exists to prevent;
-- that **the app root is resolved first and the home's default lives inside it**, and that
-  `~/.dsh` is never reached by the app's own choice;
-- that **a writable inherited `DSH_HOME` is joined**, and that the app's furniture stays
-  under the app root when it is — `state_path` names the root, not the home;
-- an unwritable **`-DshHome` still refuses**, and the message names the flag and the path;
-- the composed environment's exact output: `DSH_HOME` always present and equal to the chosen
-  home, `VNCODE_HOME` and the console markers **removed** (not merely unset — the leak the
-  first run of the check found), `npm_config_cache` removed when no cache was usable, the
-  vendored `node` first on `PATH` when there is one, and `TMP`/`TEMP`/`TMPDIR` all pointing at
-  `<app root>/tmp` when the machine's temp is unwritable;
-- the path hygiene, one case each: `~`, a relative path, `..` folding, a rooted path with no
-  drive, an empty value and a NUL, and the Windows verbatim form;
-- the browser table: Chrome first, the OS opener last, per-OS guards, a remembered id that has
-  gone falling through, the URL as **one argv element**, and the loopback refusal;
-- `ports::port_is_unanswered` — a port something ANSWERS on is not free, whatever a bind says —
-  and that `choose_port` never picks the shared default on its own initiative;
-- the first-run choice (`firstrun`): three cards for a machine that has an installation and
-  **one** for a machine that does not, "use it" unavailable with its reason when that home cannot
-  be written, the **copy** recommended in that case, and the facts a card prints (bundles,
-  sessions, a key) coming from the same `profile.rs` reader the log uses;
-- `profile.rs`: the bundle list read from the file the HARNESS loads, a bare profile answering
-  "no pack" rather than "missing", and a malformed manifest answering nothing at all;
-- the installer command carries `-DshHome` and the composed environment;
-- Adopt's own rules: only the durable trees, the credentials file as a separate byte copy that
-  never reaches the log, no overwrite, links skipped, a refused source named, and an offer that
-  survives the harness's own first boot (a composed `profiles/`, an empty `.credentials.yaml`
-  and a `storages/` are not "something of yours");
-- the app preferences: round-trip, atomic write, and a record this build cannot vouch for
-  DISCARDED rather than repaired — including a browser id it does not know, because a
-  preferences file must not be able to name a program;
-- no candidate at all (nothing resolvable, nothing creatable) is a **named failure listing
-  every path and every error**, never a bare "cannot start".
-
-`check-shell.mjs`'s `checkConfinedHome()`, which is the wiring proof, runs every time:
-
-1. run `vncode -Mode headless` with the stub CLI, with the inherited `DSH_HOME` pointing
-   under a path whose parent is a **file** (unwritable on every platform), and
-   `VNCODE_HOME` pointing at a scratch directory;
-2. assert it **starts** (the old build refuses), that the refused home and the chosen one
-   are both named, and that the chosen one is `<app root>/home`;
-3. assert the stub's own `process.env.DSH_HOME` equals the home the app named, and that
-   `process.env.VNCODE_HOME` and `VNCODE_CONSOLE` are `(unset)` — the composition reaching
-   the child, not the app's claim about itself;
-4. assert a second run that passes the same impossible path as **`-DshHome`** refuses,
-   naming the flag — the one case where an explicit instruction outranks a working
-   fallback;
-5. assert a third run whose inherited `DSH_HOME` **is** writable joins it, and that the app
-   root's `home/` is never created;
-6. assert a fourth run, with a scratch *person's* home holding a harness home (a profile, a
-   session, a credentials file with content), **uses the installation on that machine** — and
-   that a fifth run, with a session of its own already in `<app root>/home`, does **not**;
-7. re-run the token scan over whatever the run wrote — in BOTH roots, because M0 changed
-   where files land, and "the token reached no file" has to hold for the new location too.
-
-Every run is confined on all three axes — `VNCODE_HOME`, `DSH_HOME` **and** `USERPROFILE`/`HOME`
-— because the app now reads the person's home to decide rung 4. The check that did not control
-`USERPROFILE` would drive the harness against the real `~/.dsh` of whoever ran it, and the check
-that did not REMOVE an inherited `DSH_HOME` from its own environment would fail on a machine
-where one is exported (this one). Both were measured while rung 4 was written.
-
-The existing assertions stay exactly as they are: the foreign ready line is refused, the
-token is in no stream and no file, Stop frees the port and kills the grandchild, `-Help`
-lists the flags, an unknown flag is named, a `-Mode` this build does not have is refused by
-name, the installer path answers `-Help` without changing a profile, and `app/src-tauri` is
-gone.
-
-**The two screens themselves are not drivable by a check** — they are egui, and a check that
-clicked a card would be testing egui. What is testable is the decision behind them
-(`firstrun`, above), and the promise that the WINDOW can draw them is a smoke run: the real
-binary, started with a scratch app root, a scratch "person's home" holding an installation,
-and no remembered choice, must still be alive seconds later with the cards chosen, and again
-with `-DshHome` naming a home so the four-row panel draws. Both were run while this was
-written, and neither wrote a preference the person had not clicked.
-
-## 13. Phases
-
-Each phase ends with something measurable, and each has a kill criterion — the result that
-stops the plan rather than the phase.
-
-| phase | deliverable | exit criterion | kill criterion |
-|---|---|---|---|
-| **M0 — the father's home** | **done**: `$VNCODE_HOME` as the app root and `<root>/home` as the default `DSH_HOME`; the two ladders over `userpath`-cleaned paths; the one environment composer; the installer given `-DshHome`; the geometry moved to the root; the panel's root/home/environment rows; Adopt; the docs; `checkConfinedHome()` | handed an unwritable inherited `DSH_HOME` (and with `~/.dsh` unwritable), the app comes up on a root and a home it created and proved, hands the home to the harness *and* the installer, and names which candidate it refused and why; a writable inherited `DSH_HOME` is joined; `-DshHome` to an unwritable path still refuses | a case where the chosen home is one the harness then cannot use — which would mean the probe is testing the wrong operation, and the root is not a fix |
-| **M1 — supervisor parity** | **done** | every behaviour the launcher has, reproduced identically; Stop kills the tree and the port is free; on Linux a force-killed shell no longer leaks the harness | any behaviour that cannot be reproduced |
-| **M2 — the panel** | **done** | cold start to an interactive panel with **no child process**; every path row resolves or says why | a panel row that needs a second source of truth |
-| **M3 — the surface** | **done**: the browser table, the remembered choice, the chooser, the loopback re-check, the argv proof, and `-Mode embed` refused by name | Chrome is used when it is installed, every other browser on the machine is reachable in the chooser, the OS opener is always the last rung, a remembered browser that has been uninstalled falls through instead of refusing, and a non-loopback URL never reaches a launch | a browser launch that takes a command STRING rather than an argv element, or that accepts a URL the ready line would have refused |
-| **M4 — distribution** | **done** | the app runs beside the pack it installs, and the folder runs on a Linux box with nothing installed but a browser | a check that can only pass by being weakened |
-| **Later, by the owner's decision** | the Ollama provider (appendix), and any second runtime | — | — |
-
-## 14. Risks, ranked
-
-| risk | why it is real | the answer |
-|---|---|---|
-| **two homes on one machine** | the app's home is `<root>/home`, while `run-web` used to keep using `~/.dsh` — separate installations, measured as the panel reporting 24 installed bundles while `run-web` started a home that had none | **closed by the portable rung (§2)**: `run-web` and the panel resolve the SAME home when the folder is a portable installation (`.vncode/PORTABLE`, or a home already inside the root), so the pack, the sessions and the key live in the folder and the two launchers cannot disagree. A writable inherited `DSH_HOME` is still joined; `~/.dsh` stays the harness's own default for a folder that is not portable; otherwise the first-run screen makes the choice explicit — **use** the installation, **copy** it here, or **use the home in this folder** — and `Change` reopens it. When one card is the only one that can be taken, the others' reasons are folded into its `details` instead of being drawn as greyed cards |
-| **the app's home becomes a second-class citizen** | sessions, skills and the key live in `~/.dsh`, so a fresh home looks like a wiped install — and the harness's own first boot writes a `profiles/`, an EMPTY `.credentials.yaml` and a `storages/` into it, which is how the offer used to vanish after one run | the first-run screen's **use this home** card shares the existing home (offered when a child can write there), and **copy it here** brings what is missing (offered whenever the source can be read; the credentials file behind its own tick, decided by file SIZE rather than a read) |
-| **a home with no pack looks like a broken app** | the harness comes up as the bare DeepSeek Harness — no right bar, no editor, no themes — and on a home of its own no key either | **Start installs the pack first** when the chosen home's profile lists none of its bundles, so one press reaches a working interface; the `pack` row also offers **Install pack here**, and **Stop and install** when the harness is live, because the installer re-links the profile and must not run under it |
-| **two harnesses reach for one port** | `3080` is the default every `dsh web` wants, and a second instance landing on it serves the tab — with a launch token it does not know | the app takes **a port of its own** and never asks for the shared one; `-Port` is how somebody asks for it deliberately, and Stop asserts both that the port is free and that nothing answers on it |
-| **the probe tests the wrong operation** | the npm-cache bug is the precedent: a writable root over an unwritable `_cacache/tmp` passed a naive probe | the probe stays *the operation itself* (create, write, delete) and is run on the home the harness will actually compose into — and it now reports whether it CREATED the directory, which is what keeps "harden it to 0700" from touching somebody else's home |
-| **a path means two things to two processes** | `-DshHome ~/x` used to create a literal `~`, a relative path used to depend on when it was read, and Windows `/tmp/x` is drive-relative | every rung goes through `userpath`: `~` expanded, relative resolved against a cwd captured once, `.`/`..` folded, a rooted-without-a-drive path attached to the current drive, and the REAL path exported |
-| **a preferences file names a program to run** | a hand-edited file that stored a path would be an execution primitive | `prefs.json` stores an **id** the browser table already knows, validated on read; a record this build cannot vouch for is DISCARDED rather than repaired |
-| **Stop does not really stop** | a kill of the shell itself still leaks the tree | Windows has the Job Object; POSIX has the child's own process group; and on Linux `PR_SET_PDEATHSIG` asks the kernel to kill the harness when the thread that forked it dies. macOS has no equivalent, which is recorded rather than papered over |
-| **a runtime change sneaks in** | "node is slow to start" is a tempting reason to add Bun | there is no second runtime in this plan; a runtime is selectable only after it boots the CLI and prints a ready line |
-| **a browser is installed but not found** | a table of paths always misses somebody's setup, and the one that matters is the browser they actually use | the OS opener is the last rung and is always present, so an unknown browser is the OS's business; detection is pure and tested per OS; and the panel draws the chooser over what was found rather than a promise |
-| **the checks rot while the shell moves** | the ladder changes where files land, and a token-on-disk scan is only as good as the directories it walks | `checkConfinedHome()` re-runs the scan over the *new* home, in the same check that proves the move |
-
-## 15. What this plan does not do
-
-- It does not add a second install target, a desktop **edition**, or a `-Target desktop`:
-  `app/` stays a launcher of the same pinned `dsh web`.
-- **It draws the shipped interface only when it is built to.** The default build has no engine
-  and no `-Mode embed`: the interface is shown by a browser the app found, and `-Mode embed` is
-  refused by name. `--features pane` adds the pane (M5) — one optional dependency on `wry`,
-  nothing vendored — and `-Mode embed` becomes real. Flipping that default is what is left, and
-  it waits on Linux and macOS.
-- It does not rewrite, port or retire a single plugin bundle.
-- It does not touch the DeepSeek path, the credential files or the credential layers — and
-  it does not copy `.credentials.yaml` unless a person clicks for it.
-- It does not adopt a non-durable home (a temp directory), however writable it is: a home
-  that vanishes between runs is a worse answer than a named failure.
-- It does not invent a second name for the home on the wire: the harness is told `DSH_HOME`
-  and nothing else, and `$VNCODE_HOME` stays the app's own word for the root that contains it.
-- It does not make the app require an administrator, a specific shell, or PowerShell on
-  macOS/Linux.
-- It does not add an Ollama provider, a runtime seam implementation, a provider shim, or a
-  second server.
-- It does not add CI.
-
-## 16. Open questions for the owner
-
-**Decided in this revision, and no longer open**: the home is the app's, in a root the app
-creates (`$VNCODE_HOME`, defaulting to `<OS data root>/vncode`); the harness home is
-`<root>/home` unless somebody names another one; a writable inherited `DSH_HOME` is joined;
-and `~/.dsh` is never a default. What remains:
-
-1. **Adopt and the credentials file**: skills/sessions/storages/attachments copied in one
-   click, `.credentials.yaml` behind a second one — or never copied, and the key re-entered
-   in the harness's own Models page?
-2. **The installation already on this machine** — **decided, and REMOVED.** It was shipped as
-   §2 row 4 for one revision: used while the app's own home held nothing of the person's,
-   because the alternative was measured and it was a bare harness beside a working one. It is
-   gone because a folder that carries everything it needs must not reach into a person's
-   profile to START, and the app now answers both of that rung's reasons itself — Start
-   installs the pack into the home in use, and the key row asks for the key. `~/.dsh` remains
-   the SOURCE of the first-run copy, which only reads it.
-3. **The first-run screen** — **decided, and shipped**, on the owner's answers: the app's
-   harness takes **a port of its own** (never the shared `3080`); **Start installs the pack**
-   when the chosen home has none, so one press reaches a working interface; and the screen
-   offers **the copy and the folder** — every card ending inside this project. What remains
-   open is only how loud the panel should be about which home it is on.
-2. **A web view** — **decided, REVERSED, and shipped behind a feature (M5).** The original
-   decision was no `embed`, no pane, no engine vendored, and it was changed by a measurement
-   rather than by a preference: a launched Chrome dies where this app runs and the OS web
-   engine does not (section 4). What remains open is the DEFAULT — flipping it needs Linux and
-   macOS measured on their own machines, and `scripts/checks/check-pane.mjs` is what proves the
-   two builds still disagree in the meantime.
-3. **`<tree>/.vncode` (the last root candidate)** — **decided, and shipped as the portable
-   root**: the folder is not merely the last resort a workspace-scoped confinement grants
-   (this repository's own checks run inside one); it is where a folder that already holds a
-   home, or that carries the `PORTABLE` marker, keeps everything - so a folder copied to
-   another machine is one installation rather than a new one beside an old one. Untidiness
-   inside a checkout is the price, and `.gitignore` holds the rule. What is deliberately
-   NOT done is walking to it: nothing creates the marker, or claims the folder, without a
-   click or a home already inside it.
-4. **The two folder names** — **decided, and shipped**: the root is `…/vncode` and the
-   home inside it is `home` (`%LOCALAPPDATA%\vncode\home`). Renaming the inner one later is
-   a one-line change in `appdata::owned_home` plus `docs/PATHS.md`, but it would strand an
-   existing home, so it is worth not doing casually.
-5. **Does anything in the pack want `VNCODE_HOME`?** No, and M0 settled it the other way:
-   the variable is now **removed** from every child, because an environment is inherited
-   unless a variable is removed - a leak the check caught. If a plugin ever needs the app's
-   own root, that is a deliberate addition to `env::compose`, argued for rather than assumed.
-6. **Which browser should the panel prefer** when several are installed and nothing has been
-   chosen: the first found (Chrome, then the other Chromium family, then Firefox, then the OS
-   opener)? That is what it does today, and it is what `scripts\run-web.bat` does too - the
-   alternative is to ask on first run instead of choosing.
-7. **How much of the pack's look should the chrome wear?** The panel already reads the
-   profile's theme and zoom so the seam is invisible; the alternative is neutral chrome.
-
----
-
-## Appendix: Ollama, when it is built
-
-Kept here so the research is not lost, and explicitly **not scheduled**.
-
-1. **Anthropic-compatible first** — point a Messages-shaped route at
-   `http://127.0.0.1:11434`. Ollama's own docs say tool-choice controls, deferred tools and
-   hosted web search are not fully supported, and an agent harness leans hard on tool
-   calling, so this is a measurement, not an assumption.
-2. **OpenAI-compatible second** — a `dsh-llm-pi-ai` route with `api: openai-completions`,
-   `baseURL: http://127.0.0.1:11434/v1`, the model ids from `/api/tags`, and the
-   placeholder key the local server ignores.
-3. **Spike before UI** — hand-write the route, boot the pinned `0.2.0-rc.2` harness against
-   a local Ollama, and complete a tool-calling turn on each of the three platforms. No
-   provider UI is built until that passes;
-   [discussion #1866](https://github.com/deepseek-ai/deepseek-harness/discussions/1866) is
-   the reason the order is spike-first.
-4. **Then** the panel's provider row gets its second entry, a profile per provider
-   (`dsh --profile <name> web`), and Stop → Start to switch — because the route is read at
-   boot.
-
-## Where every claim here came from
-
-- the refusal this revision answers, in its own words: `vn-shell-runtime/src/lib.rs`
-  (`home_problem`) and its test `a_home_the_harness_cannot_write_in_is_refused_before_it_is_started`;
-  the same sentence in `app/README.md`.
-- the home precedence and the harness's boot-time writes: [docs/PATHS.md](PATHS.md), the
-  pinned `@deepseek-ai/dsh-home-paths` `resolveDshHome`, and `home.rs` / `keystate.rs`.
-- **the confinement measurement in section 2, run on the machine this was written on**: from
-  a session with unrestricted file access, a write probe (create, write, delete) succeeds in
-  `%USERPROFILE%\.dsh\vncode`, in `%LOCALAPPDATA%\vncode` and in `<tree>\.vncode`;
-  `~/.dsh` is owned by the signed-in account (`Get-Acl`); and `DSH_HOME` is **inherited**
-  into the process from the harness session that started it. The same `~/.dsh` refuses a
-  child whose parent confines its writes — which is why the message above names a home and
-  the cause is the environment.
-- the probe-by-writing rule and the `_cacache/tmp` measurement that taught it:
-  `vn-shell-core/src/appdata.rs` (`is_writable`, `npm_cache_is_usable`,
-  `choose_npm_cache`).
-- **why the app's furniture sits outside the harness home**: `appdata.rs`'s own module
-  header — the cache lives where it lives so that it *survives a `-DshHome` that points
-  somewhere unusual*. The geometry contradicts that rule today (`windowstate::state_path`
-  hangs off the home), and M0 is where the contradiction is resolved in the cache's favour.
-- **the layer coupling the composed `cwd` must not break**: `keystate.rs`'s module header
-  says the invocation cwd is the shell's cwd *because the harness inherits it*, which makes
-  `<cwd>/.env` the same file for both - so the cwd the panel reasons about and the cwd the
-  harness is spawned with have to be one value.
-- the console-marker trap that makes "compose the environment" a rule and not a
-  preference: `vn-shell-runtime/src/setup.rs`, `scripts/console/adapt.cmd`.
-- the existing security rules: [SECURITY.md](SECURITY.md) — the token in memory, the
-  loopback-only open (`urlpolicy.rs`), the four `keystate` layers.
-- the installer's flags, including `-DshHome` on both entry points:
-  `scripts/setup/install.bat`, `install.sh`, `install-all.ps1`, `install-all.sh`.
-- the browser table, the order in it and the argv rule: `vn-shell-core/src/browser.rs`, and
-  the same preference `scripts\run-web.ps1` already implements (Chrome, then the default).
-- the path hygiene every rung goes through, with the `~` rule taken from the harness's own
-  `resolveDshHome`: `vn-shell-core/src/userpath.rs`, and its tests.
-- the contract the checks hold today: `scripts/checks/check-shell.mjs`,
-  `scripts/checks/README.md`.
-- L1/L2/L3, the vendored runtime and the pnpm store: [docs/DEPLOY.md](DEPLOY.md),
-  [docs/PATHS.md](PATHS.md).
-- Ollama: [Anthropic compatibility](https://docs.ollama.com/api/anthropic-compatibility)
-  and [OpenAI compatibility](https://docs.ollama.com/api/openai-compatibility), plus
-  `/api/tags`; the risk:
-  [discussion #1866](https://github.com/deepseek-ai/deepseek-harness/discussions/1866).
+The app is now a ~0.5 MB console front door with no window and no web view, and
+[PLAN-controller.md](PLAN-controller.md) is the plan that replaced this one. Keep this page
+only because links to it exist; nothing here is shipped behaviour.
diff --git a/docs/RELEASE.md b/docs/RELEASE.md
index a79bd57..e2144c3 100644
--- a/docs/RELEASE.md
+++ b/docs/RELEASE.md
@@ -1,109 +1,79 @@
 # Cutting a vncode release
 
-**There is no CI in this repository, and that is deliberate.** `.github/workflows/`
-does not exist, GitHub Actions is disabled, and `check-scripts.mjs` fails if a
-workflow directory comes back.
-
-Since the distributer was erased, a release is **two things**, and neither of them
-is assembled by a script in this tree:
-
-1. **the source** - this repository at a tag. That is the whole application: the
-   plugin pack, the launchers, the shell's Rust workspace, and the panel that
-   installs the pack into the harness profile; and
-2. **the built shell**, one per OS, attached to the Release for anyone who would
-   rather not install a Rust toolchain. `scripts/run-desktop.bat` (Windows) and
-   `scripts/run-desktop.sh` (macOS/Linux) already prefer a built binary beside the
-   tree and build one only when there is none, so a binary dropped next to the
-   checkout is used as it stands.
-
-A release is therefore **one tag, one Release**, with `SHA256SUMS.txt` and, when
-the maintainer has built them, three assets: `vncode-<version>-win.exe`,
-`vncode-<version>-mac`, `vncode-<version>-linux`.
-
-Needs **Node.js 22+** and **the Rust toolchain** for the binaries, **`gh` logged
-in** (`gh auth status`), a **clean tree**, and - for a Windows binary - the MSVC
-toolchain and Windows SDK that `rustup` installs by default. The macOS and Linux
-binaries are *built on those systems*, not cross-compiled and labelled: a binary is
-the one artifact whose provenance a label cannot fake.
-
-## The ritual
-
-**1. Set the version.** `package.json`'s `version` names the tag and the release
-title; `.dsh-version.json`'s `packages` block must agree with every package's own
-`package.json` (a check enforces it), and its `dsh` pin is the harness line the
-release is tested against.
+A release is **two artefacts**, because the project is two things:
+
+| artefact | what it is | built |
+|---|---|---|
+| `vncode-<ver>-<os>-<arch>.zip` / `.tar.gz` | the Rust app: the front door that installs the pack, takes the key and runs the web launcher. **One per OS** - the only per-OS artefact in the project | `release.yml`, one matrix leg each |
+| `vncode-web-<ver>.tar.gz` | the node/JS half: `packages/`, `scripts/`, the pin and the docs. **The same bytes on every platform** | `release.yml`, once, on Linux |
+
+The web half is the product and it stands alone: `scripts/run-web.bat` /
+`./scripts/run-web.sh` starts the harness and opens the tab with no `vncode` binary
+anywhere on the machine. The app is a front door that calls it. That is why only the Rust
+half is per-OS, and why one leg failing cannot withhold the other.
+
+## What publishing a tag does
+
+`.github/workflows/release.yml`, on `v*` (or `workflow_dispatch` with an existing tag):
+
+1. **gate** - calls `ci.yml`, the same workflow a pull request runs. Three OSes, clippy
+   with warnings denied, the tests, a release build, a 6 MB size ceiling, and a smoke run.
+   A red gate stops the release **before** a draft exists.
+2. **prepare** - creates the Release as a **draft**. Nothing is visible while it is half
+   built.
+3. **build** - the matrix: `windows-latest` (x86_64, static CRT so no redistributable is
+   needed), `ubuntu-22.04` (x86_64, for the glibc floor), `macos-latest` (arm64). Each leg
+   packages `vncode` + `README.md` + `LICENSE` and uploads it.
+4. **web** - packs the pack, the launchers and the pin into `vncode-web-<ver>.tar.gz`,
+   after checking that `scripts/run-web.sh -Help` answers *with no app involved*.
+5. **checksums** - waits for every upload, **re-downloads what was actually published**,
+   and writes `SHA256SUMS.txt`. A hash computed before the last upload is a lie.
+6. **publish** - flips the draft. The release becomes visible only with every artefact and
+   its checksums attached.
+
+## Cutting one by hand
+
+The workflow is the only ritual that ships. If it is unavailable, the same steps run
+locally:
 
 ```powershell
-node -p "require('./package.json').version"
-node -p "require('./.dsh-version.json').dsh"
-```
-
-**2. Run the checks, then build the shell.** Every check must pass, and
-`check-shell.mjs` builds and drives the shell itself:
-
-```powershell
-git status --porcelain          # expect: empty
+git status --porcelain            # expect: empty
 Get-ChildItem scripts/checks/*.mjs | ForEach-Object { node $_.FullName }
-cargo build --release --manifest-path app/Cargo.toml
+cargo build --release --locked --manifest-path app/Cargo.toml
 ```
 
-**3. Smoke it once, as a user would.** From a source checkout on each OS:
+**Smoke it as a user would.** From a checkout, on each OS:
 
 ```powershell
-scripts\run-desktop.bat          # Windows: builds if needed, then the panel
-./scripts/run-desktop.sh         # macOS / Linux
+scripts\run-desktop.bat status    # the pin, the home, the pack, the key, the launcher
+scripts\run-desktop.bat           # install if needed, key if needed, then run-web
 ```
 
-The panel must open **idle** - no child process, no port bound - say where the
-harness home is, and offer Install. Press **Install pack**, watch the installer's
-own output arrive in the log, then **Start**: the harness opens in the browser and
-Stop ends it and frees the port.
+`status` must name the home and the launcher and start nothing. `start` must reach a
+served page in a browser, and Ctrl+C must stop it. On a machine with no pack installed,
+the same run installs it first and says so.
 
-**4. Collect and name the binaries, then write `SHA256SUMS.txt`** (two spaces
-separate the hash and the name):
+Then tag and push; the workflow does the rest:
 
 ```powershell
 $v = node -p "require('./package.json').version"
-New-Item -ItemType Directory -Force -Path dist/release | Out-Null
-Copy-Item app/target/release/vncode.exe "dist/release/vncode-$v-win.exe" -Force
-Push-Location dist/release
-Get-ChildItem vncode-* | Sort-Object Name | ForEach-Object { "{0}  {1}" -f (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLowerInvariant(), $_.Name } | Set-Content -LiteralPath SHA256SUMS.txt -Encoding ascii
-Pop-Location
-```
-
-**5. Commit, tag, push.** Nothing runs on the push - that is the intended state.
-
-```powershell
 git add -A; git commit -m "release: vncode $v"
 git tag -a "v$v" -m "vncode $v"; git push origin main "v$v"
 ```
 
-**6. Publish the Release and look at it.** Attach whatever was built and hashed.
-GitHub's own source archives carry the rest, so a Release with no binaries is still
-a complete release of a source distribution.
+## What NOT to do
 
-```powershell
-$assets = @(Get-ChildItem dist/release/vncode-*) + @(Get-Item dist/release/SHA256SUMS.txt)
-gh release create "v$v" --title "vncode $v" --generate-notes @($assets.FullName)
-gh release view "v$v"
-```
+- **Do not label a binary for an OS it was not built on.** A renamed `.exe` is not a macOS
+  or Linux binary; each leg runs on its own runner.
+- **Do not publish the web half per platform.** It has no native modules of its own - one
+  artefact, three OSes, the same bytes.
+- **Do not re-cut a tag** once an archive has been handed to somebody.
+- **Do not attach an artefact after `checksums` has run** - `SHA256SUMS.txt` would no
+  longer describe the release. Re-run the workflow instead; it re-hashes what is there.
 
-## What NOT to do
+Signing is not wired up yet: an Authenticode or Developer ID certificate would cover the
+exact bytes of each binary, and the honest interim is the `SHA256SUMS.txt` above plus a
+note in the release notes (BUILD.md has the details).
 
-- **Do not add a workflow** - the layout check fails on the directory, and a push is
-  meant to cost nothing.
-- **Do not resurrect the distributer.** There is no `scripts/dist.ps1`, no
-  `run-dist.*` and no ship list any more: the distribution is this repository (or
-  this repository plus a built binary), and the app installs the pack itself.
-- **Do not label a binary for an OS it was not built on.** A `.dmg`, an `.AppImage`
-  or a renamed `.exe` is not a macOS or Linux binary.
-- **Do not tag a version `package.json` does not have**, and do not rewrite an old
-  tag once an archive has been handed to somebody.
-
-If CI ever comes back these say so: `gh api repos/vecnode/vncode/actions/permissions`
-(expect `enabled = false`), `0` from its `caches` and `artifacts`, and
-`Test-Path .github/workflows` = `False`.
-
-[BUILD.md](BUILD.md) is the build and the checks; [DEPLOY.md](DEPLOY.md) what a
-distribution promises; [scripts/checks/README.md](../scripts/checks/README.md)
-every tracked check.
+[BUILD.md](BUILD.md) is the build itself; [DEPLOY.md](DEPLOY.md) is what a distribution
+promises; [scripts/checks/README.md](../scripts/checks/README.md) lists every check.

From d6654fa7eb24b48ae18fda04155c4920feeb0c11 Mon Sep 17 00:00:00 2001
From: vecnode <vecnode@users.noreply.github.com>
Date: Sun, 18 Oct 2026 19:27:32 +0000
Subject: [PATCH 4/5] ci: no third-party actions, because the repository policy
 is local_only

Measured: the first pull request produced a startup_failure in 0 s. The repo's
Actions policy is allowed_actions=local_only, so actions/checkout and every
marketplace action are refused before a job starts.

Rather than ask for the policy to be relaxed, both workflows now do the work with
the tools the runner images carry: git init/fetch/checkout by sha (or the PR merge
ref), the preinstalled rustc/cargo/clippy, node, and gh for the release. The
workflow_call gate is a local reference, which the policy allows.

Also fixes a YAML error the parser caught - a step name with a colon in it.
---
 .github/workflows/ci.yml      | 61 ++++++++++++++++++++++++-----------
 .github/workflows/release.yml | 51 ++++++++++++++++++-----------
 2 files changed, 75 insertions(+), 37 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 99ac080..16f0092 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,6 +11,12 @@ name: CI
 # This workflow builds the RUST app only. The node/JS half needs no build: it is the same
 # files on every platform, it is packaged by release.yml as its own archive, and
 # `scripts/run-web.*` works without this app at all.
+#
+# NO THIRD-PARTY ACTIONS, and that is a constraint rather than a taste: this repository's
+# Actions policy is `local_only`, so `actions/checkout` is refused at STARTUP (measured: a
+# pull request produced a `startup_failure` in 0 s). Every step below is a shell command
+# against a tool the runner image already carries - git, rustc, cargo, node, gh - so the
+# workflow runs under the policy instead of asking for the policy to be relaxed.
 on:
   push:
     branches: [main]
@@ -71,19 +77,30 @@ jobs:
       matrix:
         os: ${{ fromJSON(needs.plan.outputs.os) }}
     steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy
+      # The checkout step, without an action. `pull_request` checks the merge commit GitHub
+      # already built (refs/pull/N/merge); everything else checks the sha.
+      - name: Checkout
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          ref="$GITHUB_SHA"
+          if [ -n "$PR_NUMBER" ]; then ref="refs/pull/$PR_NUMBER/merge"; fi
+          git init -q .
+          git remote add origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git fetch -q --depth 1 origin "$ref"
+          git checkout -q FETCH_HEAD
 
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: app -> target
-          shared-key: vncode-ci
-          cache-on-failure: true
+      # The runner image carries the Rust toolchain and the clippy component. `rust-version`
+      # in app/Cargo.toml is the floor the code is written to; a toolchain below it fails
+      # here by name rather than somewhere inside a build.
+      - name: Toolchain
+        shell: bash
+        run: |
+          rustc --version
+          cargo --version
+          cargo clippy --version
 
       # Warnings denied, so a dependency that arrives with a warning is a failure rather
       # than a line nobody reads. The workspace has no GUI toolkit and no web engine to
@@ -153,13 +170,19 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
+      - name: Checkout (full history - the check reads what a push would stage)
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          ref="$GITHUB_SHA"
+          if [ -n "$PR_NUMBER" ]; then ref="refs/pull/$PR_NUMBER/merge"; fi
+          git init -q .
+          git remote add origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git fetch -q origin "$ref"
+          git checkout -q FETCH_HEAD
       # The one check that is about the repository rather than a platform, and the one
-      # whose failure can never be undone by a later commit.
+      # whose failure can never be undone by a later commit. `node` is on the runner image.
       - name: check-no-secrets
         run: node scripts/checks/check-no-secrets.mjs
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 25179d2..8cbaa65 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -88,19 +88,28 @@ jobs:
             ext: tar.gz
             rustflags: ''
     steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.tag || github.ref }}
-
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
+      # No third-party actions anywhere in this workflow: the repository's Actions policy
+      # is `local_only`, so a marketplace action is refused at startup. git, rustc/cargo
+      # and gh are already on the runner image.
+      - name: Checkout
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REF: ${{ github.event.inputs.tag || github.ref }}
+        run: |
+          git init -q .
+          git remote add origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git fetch -q --depth 1 origin "$REF"
+          git checkout -q FETCH_HEAD
 
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: app -> target
-          key: release-${{ matrix.target }}
-          cache-on-failure: true
+      - name: Toolchain
+        shell: bash
+        env:
+          TARGET: ${{ matrix.target }}
+        run: |
+          rustc --version
+          # A no-op when the target is the runner's own, which it is for all three legs.
+          rustup target add "$TARGET"
 
       # No GUI toolkit and no web engine to link, which is why this workflow has no
       # `apt-get` step: the app draws nothing.
@@ -151,13 +160,19 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.tag || github.ref }}
+      - name: Checkout
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REF: ${{ github.event.inputs.tag || github.ref }}
+        run: |
+          git init -q .
+          git remote add origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git fetch -q --depth 1 origin "$REF"
+          git checkout -q FETCH_HEAD
 
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
+      # No node setup step: this job only PACKAGES the JS, and the one thing it runs
+      # (`run-web.sh -Help`) needs no interpreter at all.
 
       # The web half must work WITHOUT the app, so it is proved that way: the launcher
       # answers its own -Help, the installer answers its own -Help, and neither touches a

From 86f12bcb00ecd07962e158e8e5fc2665001eb819 Mon Sep 17 00:00:00 2001
From: vecnode <vecnode@users.noreply.github.com>
Date: Sun, 18 Oct 2026 19:29:23 +0000
Subject: [PATCH 5/5] ci: the smoke step under pipefail, where a named refusal
 looked like a failure

The first real run failed all three legs on the same line: vncode exits 1 to
refuse -Mode embed, and with 'set -o pipefail' the pipeline reports that 1 even
when grep -q matched. Captured first, then matched.
---
 .github/workflows/ci.yml | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 16f0092..5a2e57a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -158,12 +158,18 @@ jobs:
           "$BIN" -Help > /dev/null
           # `-Mode embed` is the flag the deleted web view used to answer. It must fail by
           # name, not be silently ignored - that is what "no web view" means.
-          if "$BIN" -Mode embed 2>&1 | grep -q "unknown flag"; then
-            echo "the deleted mode is refused by name"
-          else
-            echo "::error::-Mode embed was accepted, or refused without naming it"
-            exit 1
-          fi
+          #
+          # Captured first, then matched. These steps run with `-o pipefail`, where
+          # `vncode ... | grep -q` reports the BINARY's exit 1 and turns a correct refusal
+          # into a failed pipeline - measured on the first run of this workflow.
+          OUT=$("$BIN" -Mode embed 2>&1 || true)
+          case "$OUT" in
+            *"unknown flag"*) echo "the deleted mode is refused by name" ;;
+            *)
+              echo "::error::-Mode embed was accepted, or refused without naming it"
+              exit 1
+              ;;
+          esac
 
   secrets:
     name: No secrets