diff --git a/CLAUDE.md b/CLAUDE.md
index cd41eebd8..240580afd 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -84,7 +84,7 @@ Every activity is a [MoonWalk](docs/moonwalk.md) process, the one home of its st
 
 ### Main and branch
 
-**The product owner creates every branch**, and main stays releasable: [the branch](docs/moonwalk.md#branch). A change goes from [a spec and a plan](docs/moonwalk.md#pick-spec-plan) to a pull request the plan describes. **Deleting the plan is the product owner's call**, because "the code is written" is not "the plan is realized".
+**The product owner creates every branch**, and main stays releasable: [the branch](docs/moonwalk.md#branch). A change goes from [a spec and a plan](docs/moonwalk.md#pick-spec-plan) to a pull request the plan describes. **Moving the plan to `docs/work/past/plans/` is the product owner's call**, because "the code is written" is not "the plan is realized".
 
 **A contributed pull request is one topic, max 400 changed lines and ten files**, tests included, based on main: [Contribute a pull request](docs/moonwalk.md#contribute-pr). The contributor vouches for every line, agent-written or not, answers reviewers in their own words, and says what an agent wrote and what was tested. **A contribution is reviewed and finished as [Review and finish a contribution](docs/moonwalk.md#review-contribution) describes**. The contributor fixes their own code first and the maintainer finishes, case by case. The merge keeps their commits and authorship.
 
diff --git a/CMakeLists.txt b/CMakeLists.txt
index af76d94bb..dd59c28b9 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -131,6 +131,7 @@ find_program(UV_EXECUTABLE NAMES uv REQUIRED
 add_library(mm_core STATIC
     src/core/module/Control.cpp
     src/core/util/JsonUtil.cpp
+    src/core/util/JsonFetch.cpp
     src/core/util/parse.cpp
     src/core/util/ScratchBuffer.cpp
     src/core/system/HttpServerModule.cpp
@@ -262,12 +263,9 @@ add_custom_target(ui_embed DEPENDS ${CMAKE_SOURCE_DIR}/src/ui/ui_embedded.h)
 # library while the device holds only what someone actually picked. Globbed, so the DEPENDS is the
 # directory contents rather than a file list that would drift; CONFIGURE_DEPENDS re-globs when a
 # script is added or removed.
-file(GLOB MOONLIVE_SCRIPTS CONFIGURE_DEPENDS
-     ${CMAKE_SOURCE_DIR}/moonlive/effects/*.mle
-     ${CMAKE_SOURCE_DIR}/moonlive/layouts/*.mll
-     ${CMAKE_SOURCE_DIR}/moonlive/modifiers/*.mlm
-     ${CMAKE_SOURCE_DIR}/moonlive/services/*.mls
-     ${CMAKE_SOURCE_DIR}/moonlive/palettes/*.mlp)
+file(GLOB_RECURSE MOONLIVE_SCRIPTS CONFIGURE_DEPENDS
+     ${CMAKE_SOURCE_DIR}/moonlive/*.mle ${CMAKE_SOURCE_DIR}/moonlive/*.mll ${CMAKE_SOURCE_DIR}/moonlive/*.mlm
+     ${CMAKE_SOURCE_DIR}/moonlive/*.mls ${CMAKE_SOURCE_DIR}/moonlive/*.mlp)
 # The file LIST itself is a dependency, not just each file's timestamp: DEPENDS notices an edited
 # script but not a DELETED one, so removing a script left it in the catalog and the device went on
 # offering a name that no longer exists upstream. The stamp is written at configure time from the
diff --git a/docs/contributing/documentation-standards.md b/docs/contributing/documentation-standards.md
index 9f44d6f92..ec7492e4b 100644
--- a/docs/contributing/documentation-standards.md
+++ b/docs/contributing/documentation-standards.md
@@ -126,7 +126,7 @@ Every page serves one of four reader needs, and only one. This is [Diátaxis](ht
 
 The test for any page is the cell it sits in. A tutorial that stops to explain, or a reference that starts to teach, is two pages: move the other half to where it belongs.
 
-Two kinds of page sit outside the grid on purpose. **The rules**, [coding-standards.md](coding-standards.md) and this page in `contributing/` and [CLAUDE.md](../../CLAUDE.md) at the repo root, are for contributors and bind every change. `legal/` sits outside it too. **Work not yet in the code** lives under `docs/work/`, and nothing there describes the system as it is. `future` is what does not exist, `present` is being built and deleted at its PR, `past` is what shipped.
+Two kinds of page sit outside the grid on purpose. **The rules**, [coding-standards.md](coding-standards.md) and this page in `contributing/` and [CLAUDE.md](../../CLAUDE.md) at the repo root, are for contributors and bind every change. `legal/` sits outside it too. **Work on its way to the code** lives under `docs/work/`, apart from the pages that describe the system. `future` holds what is planned, `present` what is being built, which moves to `past` at its PR, and `past` the closed plans, shipped or cancelled.
 
 Two scales below a page. **A module** has one reference card and one header (see [Module pages](#module-pages)); **a line of code** carries its own reason in a comment (see [Comments](#comments)).
 
diff --git a/docs/explanation/architecture/mooncore.md b/docs/explanation/architecture/mooncore.md
index ad2152113..1e6050b7e 100644
--- a/docs/explanation/architecture/mooncore.md
+++ b/docs/explanation/architecture/mooncore.md
@@ -101,7 +101,7 @@ The light domain plugs into the UI at three points. **A fixed top-level tree**:
 Only abstract what you need:
 
 - **Time**: `millis()`, `micros()`. Monotonic, microsecond resolution. (`esp_timer` / `std::chrono`)
-- **Memory**: `alloc(size)`, `free(ptr)`. Prefers PSRAM on ESP32, falls back to regular heap. `freeHeap()`, `maxAllocBlock()` for diagnostics. (`heap_caps_malloc` / `std::malloc`)
+- **Memory**: `alloc(size)`, `free(ptr)`. Prefers PSRAM on ESP32, falls back to regular heap; `allocInternal(size)` where only internal RAM will do (see [Internal RAM](#internal-ram)). `freeHeap()`, `maxAllocBlock()` for diagnostics. (`heap_caps_malloc` / `std::malloc`)
 - **Executable memory**: `allocExec(size)` / `freeExec(ptr, size)` allocate memory the CPU can *fetch and execute* from, and `writeExec(dst, src, len)` copies emitted machine code into it safely. Used by the MoonLive live-script engine (below) to place the native code it compiles. All the W^X and instruction-cache quirks live behind these three functions. On ESP32 that is IRAM via `MALLOC_CAP_EXEC`, with 32-bit-aligned stores and a cache sync so the core fetches fresh code. On POSIX desktops it is an `mmap` `PROT_EXEC` page, with `MAP_JIT` and a write-protect toggle on macOS-arm64. On Windows it is a `VirtualAlloc` `PAGE_EXECUTE_READWRITE` page plus `FlushInstructionCache`. (`heap_caps_malloc(MALLOC_CAP_EXEC)` / `mmap` / `VirtualAlloc`)
 - **Networking**: `UdpSocket` for ArtNet send. `TcpConnection` / `TcpServer` for HTTP + WebSocket; `TcpConnection::writeSome` is a non-blocking partial write (returns bytes written, 0 = would-block) so a backpressured browser can't stall the render loop. (lwIP sockets / BSD sockets)
 - **Scheduling**: `yield()` (cooperative yield to OS/RTOS), `delayMs(ms)` (blocking sleep, off-path only), `delayUs(us)` (a microsecond busy-wait, only for sub-millisecond hardware timing a driver owns, such as the WS2812 300 µs inter-frame latch in `RmtLedDriver`), and `reboot()`. General pacing uses the non-blocking `millis()` gate instead. (`vTaskDelay` / `esp_rom_delay_us` / `esp_restart` on ESP32; `std::this_thread::sleep_for` / `std::exit` on desktop)
@@ -109,6 +109,20 @@ Only abstract what you need:
 
 Abstractions are added when a concrete implementation needs them, not pre-designed.
 
+### Internal RAM
+
+On an ESP32 internal RAM is the scarce memory. WiFi, lwIP, the task stacks and every DMA buffer need it, while a board with PSRAM has megabytes of the other kind. **Whatever can live in PSRAM does.** Internal RAM is kept for what cannot leave it:
+
+- **What a DMA engine reads**, the LED drivers' buffers.
+- **What a cache-safe interrupt reads.** PSRAM sits behind the flash cache, and a flash write on either core switches that cache off, even in the middle of an interrupt on the other core. So the interrupt's data comes from `platform::allocInternal`, and an object it reads inherits `platform::InternalRamObject`, whose `new` places it there. `ParallelLedDriver` and `MoonI80Peripheral` are the examples; the LCD-MM ring refuses to run when what its refill reads fell back to PSRAM, rather than fault at the next save.
+- **The code and stacks of those paths.**
+
+Everything else asks for PSRAM first: a module through `MoonModule`'s `operator new`, a buffer through `platform::alloc`, a plain `malloc` through `CONFIG_SPIRAM_MALLOC_ALWAYSINTERNAL=0`. WiFi, lwIP and TLS do so through their options in `esp32/sdkconfig.defaults`, where each option carries its reason.
+
+**The floor.** `platform::kInternalFreeFloor`, 100 KB, is the internal RAM a board with PSRAM keeps free for WiFi, HTTP and the UI. Its largest free block stays at 50 KB, for a TLS handshake or a state send. What would take the rest respects it. LCD-MM's `ringAuto` sizes its ring by the lead the wire needs and stops at the floor. The HTTP server queues a send on a socket only while internal RAM stays above half of it, so a slow client waits rather than draining the board. `scenario_RAM_floor` holds the floor with the UI open on the S3 and the P4.
+
+**A board without PSRAM** runs the same calls, which fall back to internal RAM. Its network buffers then share that RAM, so it holds no floor, and the send back-pressure is what keeps an open UI on a weak link from exhausting it. The measurements are in [performance.md](../../reference/performance.md#internal-ram).
+
 **Platform boundary (hard rule).** All `#ifdef`, `#if defined`, platform-specific `#include`s, and hardware API calls live exclusively in `src/platform/`. Everything outside `src/platform/` compiles on every target without modification. Compile-time platform branching uses `if constexpr` on `platform_config.h` flags, never a preprocessor `#ifdef`. **Domain boundary.** A file in `src/core` includes nothing from `src/light`: core declares an interface, and the light domain implements and registers it.
 
 Both boundaries are rules of [the code check](../../reference/tests.md#check_code), each at zero, and a crossing raises the count the ratchet refuses. `LightOutput` is the domain boundary's shape: the light domain's `Drivers` implements it, and the WLED shim, MQTT and MoonStats read the device shape and the palettes through it.
diff --git a/docs/explanation/architecture/moonlight.md b/docs/explanation/architecture/moonlight.md
index a3da946cc..b1f1ac557 100644
--- a/docs/explanation/architecture/moonlight.md
+++ b/docs/explanation/architecture/moonlight.md
@@ -199,7 +199,7 @@ A modifier is a coordinate transform, applied in one of two ways (the fold contr
 
 The blend+map step walks each layer in turn: reads each logical light, uses that layer's LUT to find the physical position(s), blends the color into the physical output buffer. This is where logical space meets physical space.
 
-Each mapping LUT is a flat, contiguous lookup table allocated outside the hot path. It is built in `Layer::prepare()` and rebuilt whenever a Layout or Modifier control changes (the controls' `affectsPrepare` returns true) or a Modifier/Layout child is added/removed/replaced/moved; both triggers flow through the same core mechanism, see [Event triggering between modules](moonmodule.md#event-triggering-between-modules).
+Each mapping LUT is a flat, contiguous lookup table allocated outside the hot path. It is built in `Layer::prepare()`. A Layout or Modifier control change rebuilds it, a Modifier's reaching its own layer alone, and so does adding, removing, replacing or moving a Modifier or Layout child. Both triggers flow through the same core mechanism: [Event triggering between modules](moonmodule.md#event-triggering-between-modules).
 
 The LUT supports four mapping types:
 
diff --git a/docs/explanation/architecture/moonmodule.md b/docs/explanation/architecture/moonmodule.md
index 373f9bcd9..81476ec32 100644
--- a/docs/explanation/architecture/moonmodule.md
+++ b/docs/explanation/architecture/moonmodule.md
@@ -121,7 +121,7 @@ Control values and each module's `enabled` flag are persisted to flash so settin
 
 - **Storage**: one file per top-level module under `/.config/<TypeName>.json`, holding that module's [state document](../../reference/integrating.md#setting-everything-at-once), the shape a preset and `PATCH /api/state` carry, with the module's secrets in it since the file never leaves the device. Children are keyed by name, so a file applies through the same engine as every other document, as a stored file: a type this build lacks and a key no control matches are skipped and logged, and a value clamps to its control's bounds.
 - **Lifecycle**: the five phases the diagram above draws, read from persistence's side. `defineControls` binds every module's control set. The load hook then applies each file, creating children with their controls bound and setting values twice around a `rebuildControls`, so a control set that depends on a value (a driver's `peripheral`) restores. Each module's own `setup()` runs with the values already in place, and `applyState` sizes the buffers. The fifth phase sets the controls a MoonLive script declares as it compiles, which the load held until then. Modules themselves know nothing about persistence; they bind their variables.
-- **Save trigger**: HttpServerModule marks the target module dirty on every successful control mutation. FilesystemModule debounces 2 s in `tick1s()`, walks the tree, writes any subtree containing a dirty descendant via atomic write-and-rename.
+- **Save trigger**: `Scheduler::setControl` marks the target module dirty on every successful control mutation, except a live one. A live write is to a control declared live, or one a service script makes, which drives a value rather than configures it. FilesystemModule debounces 2 s in `tick1s()`, walks the tree, and writes any subtree holding a dirty descendant, with an atomic write-and-rename.
 - **Conditional controls**: every conditional control is always bound; the module sets a `hidden` flag (`controls_.setHidden(i, …)`) to tell the UI not to render it. The load path can therefore find persisted values regardless of the live conditional state.
 - **Code-wired children survive a stale file**: some children aren't created by the user; `main.cpp`'s boot wiring attaches them (`ImprovProvisioningModule` under `NetworkModule`; `NetworkSendDriver`, `PreviewDriver` under their parents). Each such child calls `markWiredByCode()` after `addChild()`, a one-bit flag meaning *"I belong here because the code put me here, not because a saved file or a user asked for me."* The problem it solves is a trim on load. A stored document says its children are exactly the ones it lists, so a child that exists in code but is absent from an older file, written before that child was added, would be dropped. The flag tells the apply step to keep it, and to keep its type where the file names another. Children added through the HTTP API or recreated from a file stay unmarked; those follow the file's tree shape exactly, so UI deletes still take effect.
 
@@ -168,10 +168,10 @@ Both shapes extend to any future producer/consumer pair (a sensor owning a state
 A control changes, or the module tree is mutated (a child added, deleted, replaced, moved), and other modules may need to react. The framework provides a three-tier split so each change costs only as much as it has to, from cheapest to most expensive:
 
 1. **`onControlChanged(controlName)`**: runs on *every* control change, but only on the module whose own control changed. A cheap, in-place, per-control reaction that touches nothing else: recompute a small derived table, re-bind a socket. Default no-op.
-2. **`affectsPrepare(controlName)`**: a gate, default `false`. A module returns `true` only for controls that change the size or shape of its derived state (and thus may ripple to other modules); for controls that tweak a value in place it stays `false`. When `true`, the framework runs the tree-wide rebuild; when `false`, it doesn't.
+2. **`affectsPrepare(controlName)`**: a gate, default `false`. A module returns `true` only for a control that changes the size or shape of its derived state, which may ripple to other modules. A control that tweaks a value in place stays `false`. When `true`, the framework runs the rebuild; when `false`, it doesn't. How far the rebuild reaches is `prepareScope()`: the whole tree by default, the module's container for a modifier, whose mapping belongs to its layer alone.
 3. **`prepare()`**: the module (re)builds its derived state (buffers, tables) for the current control values. Reached via `Scheduler::prepareTree()`, the coordinator-driven sweep that walks every module's `prepare`.
 
-`Scheduler::prepareTree()` fires from two triggers: a tier-2 gate returning true after a control change, **and** any tree mutation (HTTP add/delete/replace/move handlers all call it unconditionally, since a structural change is rare and unambiguously needs a rebuild). Both triggers funnel through the same sweep; each module's `prepare` is idempotent (such as an effect only reallocs when its grid count changed), so over-rebuilding is wasted work, not a correctness hazard.
+A rebuild runs at the next frame boundary. Up to four scopes are pending per frame, and a fifth widens the rebuild to the tree. After a scoped rebuild every top module still gets `onTreePrepared()`. A module reading what the scope reshaped then prepares itself again when that changed, as `Drivers` does with the first layer's shape it sized from. `Scheduler::prepareTree()` fires from two triggers: a tier-2 gate whose scope is the tree, **and** any tree mutation. The HTTP add, delete, replace and move handlers call it unconditionally, since a structural change is rare and needs a rebuild. Both triggers funnel through the same sweep. Each module's `prepare` is idempotent, an effect reallocating only when its grid count changed, so over-rebuilding wastes work without breaking anything.
 
 **`quiesce()`, the structural path's thread guard.** A module may hand work to another thread: `Drivers` ticks its Driver children on a core-1 task, see [Parallelism](#parallelism). That makes a *structural* mutation dangerous, and switching a module on or off with it. `addChild` reallocates the child array a worker may be walking, and `removeChild` is followed by the caller's `release()` and `deleteTree()`, which frees a module a worker may be inside `tick()` on. So `MoonModule` declares `virtual void quiesce()` (default no-op) and **core calls it on the parent before every child-array mutation** (`addChild` / `removeChild` / `replaceChildAt`); a module owning a worker overrides it to park that worker. The control path already funnels through `applyState()`/`prepareTree()`, where the owner quiesces itself, this is the same rule extended to the sibling (structural) path, and it lives in core so no HTTP handler has to remember it (CLAUDE.md § *when core already owns a mechanism for one path, extend it to the sibling path*). Deleting a driver from the UI mid-encode is therefore safe by construction, not by handler discipline.
 
diff --git a/docs/help/help.json b/docs/help/help.json
index fd3bbad81..1642a4cb8 100644
--- a/docs/help/help.json
+++ b/docs/help/help.json
@@ -3702,6 +3702,12 @@
       }
      ]
     },
+    "clockPin": {
+     "line": "The i80 write strobe (WR): the pixel clock, and the expander's shift clock."
+    },
+    "dcPin": {
+     "line": "The i80 bus's data/command select, which `LCD-IDF` mandates though WS2812 ignores it."
+    },
     "pinExpander": {
      "line": "A 74HCT595 per data pin: each pin then drives 8 strands.",
      "more": "It buys pins, not memory: the frame grows eightfold, about 1.1 KB per light, up to 64 strands. `i80` stops at about 96 lights per strand, `MoonI80` drives 128.",
@@ -3715,6 +3721,30 @@
     "latchPin": {
      "line": "The 74HCT595 latch (RCLK) pin, needed with the expander."
     },
+    "shiftOverclock": {
+     "line": "Shift the '595 at 26.67 MHz, not 20, for short wires; off if a panel scrambles."
+    },
+    "useRing": {
+     "line": "Stream the frame as a ring of small internal buffers, or send it whole from one block."
+    },
+    "ringSnapshot": {
+     "line": "Copy each frame before the ring sends it, so a frame never mixes with the next."
+    },
+    "ringAuto": {
+     "line": "Size the ring by itself and show the numbers it picked in the controls below."
+    },
+    "ringRows": {
+     "line": "Lights per DMA buffer: the ring's grain, and the RAM against interrupt-rate lever."
+    },
+    "ringBufs": {
+     "line": "How many buffers the DMA circulates, each `ringRows` rows of internal RAM."
+    },
+    "ringPadUs": {
+     "line": "Inter-buffer zero-pad in µs, buying refill deadline at a linear frame-time cost."
+    },
+    "ringDbg": {
+     "line": "The ring's live counters, once a second; `ab` counts lost frames, 0 on a healthy ring."
+    },
     "loopbackTest": {
      "line": "TX to RX self-test: send a known pattern, bit-verify the capture."
     },
@@ -3802,6 +3832,9 @@
     "maxBlock": {
      "line": "The largest free internal block, which bounds one allocation."
     },
+    "missing scripts": {
+     "line": "Shipped scripts a module names and the device lacks; an open page downloads them."
+    },
     "flash": {
      "line": "The flash chip size."
     },
@@ -4342,6 +4375,10 @@
     {
      "title": "Writing the script",
      "text": "Everything the script declares appears as a control on the card, and a slider move lands without a recompile. A compile error shows on the status line, and the service does nothing until it is fixed. A script runs on the 50 Hz poll rather than the render tick, so a heavy one costs its own tick."
+    },
+    {
+     "title": "Reading and sending JSON",
+     "text": "A service reads JSON from the internet with `getJson`, and sends its own documents with `pushJson` to this device or `pushJsonTo` to another. A show builds its own look this way, live and never saved. The calls: [the MoonLive language](https://moonmodules.org/MoonLight/moonmodules/light/moonlive.html#json-documents-in-a-service)."
     }
    ],
    "image": "https://moonmodules.org/MoonLight/assets/core/MoonLiveService.png",
diff --git a/docs/moonmodules/light/moonlive.md b/docs/moonmodules/light/moonlive.md
index 2cedc6aca..b1ea2cdce 100644
--- a/docs/moonmodules/light/moonlive.md
+++ b/docs/moonmodules/light/moonlive.md
@@ -55,13 +55,14 @@ void tick() {
 ```
 
 `string` names what comes back rather than introducing a string type: a script returns a literal, and building, joining or comparing text is out of scope.
+Text a script assembles, such as a temperature with its unit, lives in a [JSON document](#json-documents-in-a-service), which the host holds.
 
 ### Members, and which become controls
 
 `byte bpm = 30;` is state the script owns: visible in every function, surviving every tick. Naming it in `defineControls()` with `addControl("bpm", bpm, 1, 240)` also puts it on the UI as a slider, which is the same call a compiled module makes. A member no `addControl` names stays private to the script, which is how a stateful effect holds a value the user should not see.
 
 The default comes from the declaration, the range from the call, and the quoted name is the UI label, free to differ from the member's name.
-`addSelect("shape", shape, "disc|ball|egg")` makes a dropdown instead: `shape` holds 0, 1 or 2, the index of the name picked. The quoted names count against the script's 128 bytes of strings. The engine keeps every dropdown's names together in 96 bytes, each name with one byte for its end, up to 16 names in all.
+`addSelect("shape", shape, "disc|ball|egg")` makes a dropdown instead: `shape` holds 0, 1 or 2, the index of the name picked. The engine keeps every dropdown's names together in 96 bytes, each name with one byte for its end, up to 16 names in all.
 
 ### A member can be written
 
@@ -130,7 +131,7 @@ class RainEffect {
 
 Both reach the picker before a factory script is downloaded, because the build extracts them from the source into the catalog. That copy is for display only: once a script is on the device, the compiled script is what decides.
 
-## The five types
+## The six types
 
 A type says what a value means, and the storage is the compiler's business.
 Every scalar occupies the same 4-byte slot whatever its type, and only arrays pack by element.
@@ -143,10 +144,14 @@ That is where width still earns its keep: a `byte[]` heat map costs a quarter of
 | `bool` | `true` or `false` | a flag |
 | `fixed` | -32,768.0 to 32,767.99998, in steps of 1/65,536 | coordinates and anything fractional |
 | `string` | one of the script's own literals | a name passed to a builtin |
+| `json` | a document the host holds, or none | data a service reads from the internet or sends to a device |
 
 An initializer is range-checked against its type, so `byte n = 300;` is a compile error naming the member rather than a silent 44.
 A `string` array is refused, since there is no runtime string to fill one with.
 
+A script's literals live in a pool sized to them, so a long one costs only the script that holds it, up to 16 KB of text a script.
+`R"( ... )"` is C++'s raw literal: it spans lines and keeps every quote, so a JSON document pastes in as it is, and `R"x( ... )x"` takes a delimiter for text holding `)"`.
+
 ## RGB and Coord3D
 
 A color and a position travel as one value, under the names the compiled modules use for them.
@@ -279,11 +284,11 @@ The core owns the grammar and a generic call mechanism, and nothing else.
 | `addSelect(name, member, "a\|b\|c")` | surface a byte member as a dropdown of those names, its value the index picked |
 | `gpioRead(pin)`, `gpioWrite(pin, v)` | read and drive a pin, from a service script |
 | `adcRead(pin)`, `adcMv(pin)`, `adcMax()` | an analog reading: raw, in millivolts, and its full scale |
-| `setControl(module, control, v)` | drive another module's control, which is what a service does |
+| `setControl("fader2", v)` | move a slot of the Control surface, which drives whatever the slot targets: what a service does |
 
 Every audio call answers 0 without audio, so a script written for a rig with a microphone still runs on one without.
 A motion call reaches nothing on a light that carries no such channel, so one script serves a moving head and a strip.
-The last four belong to a service script, which runs on the poll rather than the render tick.
+The last three belong to a service script, which runs on the poll rather than the render tick, and so do the JSON calls below.
 
 Each particle call is one pass over the whole pool per frame rather than one per light.
 A 300-spark script therefore costs far less than a shader touching every pixel.
@@ -298,6 +303,53 @@ Its time axis must be monotonic, so feeding it a `beat()` sawtooth reads as a hi
 
 `turn(n)` exists because a full revolution is 65536, one past the largest number a script can write.
 
+## JSON documents in a service
+
+A service script reads JSON from the internet, builds documents of its own, and sends them to this device or another one.
+A `json` value is a handle to a document the host holds, in an int's slot, so text never passes through the script: it moves from document to document, and a number comes out as an `int` or a `fixed`.
+A path into a document is a JSON Pointer ([RFC 6901](https://www.rfc-editor.org/rfc/rfc6901)): `/current/temperature_2m`, `/results/0/title`.
+
+```c
+class Weather {
+  json w;
+  json show;
+
+  void tick20ms() {
+    w = getJson("https://api.open-meteo.com/v1/forecast?latitude=52.37&longitude=4.90&current=temperature_2m", 600);
+    if (jsonChanged(w)) {
+      show = R"({"Effects": {"Layer": {"Text": {"text": ""}}}})";
+      jsonSetText(show, "/Effects/Layer/Text/text", "Amsterdam ");
+      jsonAppend(show, "/Effects/Layer/Text/text", w, "/current/temperature_2m");
+      pushJson(show);
+    }
+  }
+}
+```
+
+| call | does |
+|---|---|
+| `json d = R"({...})";` | a document from the script's own text, parsed once: a string literal where a `json` value belongs is parsed into one |
+| `getJson(url, seconds)` | a document fetched from `url`, fetched again once `seconds` passed and it is read; it answers at once, with the last document that arrived |
+| `jsonChanged(d)` | true when a new document arrived since the script last asked |
+| `jsonStatus(d)` | the HTTP status of the last answer, 0 while none came |
+| `jsonInt(d, "/p")`, `jsonFixed(d, "/p")` | the number at a pointer, a quoted one such as `"252.11"` included, 0 when absent |
+| `jsonSize(d, "/p")` | how many elements or members the array or object at a pointer holds |
+| `jsonSetInt(d, "/p", v)`, `jsonSetFixed(d, "/p", v)`, `jsonSetText(d, "/p", "text")` | write a value, creating the members on the way |
+| `jsonAppendText(d, "/p", "text")`, `jsonAppend(d, "/p", src, "/q")` | join text onto a string: the script's own, or another document's value as it reads |
+| `jsonCopy(d, "/p", src, "/q")` | copy a value from one document to another, a whole object included |
+| `pushJson(d)` | apply a state document to this device, and answer the reply |
+| `pushJsonTo("MM-eye1.local", d)` | send it to another MoonLight, or `POST` it to a URL, and answer the reply |
+
+A fetch runs on a task of its own, so a DNS lookup or a TLS handshake never stalls the poll.
+A refresh that fails keeps the last good document, and an answer past 16 KB, 4 KB on a board without PSRAM, is refused rather than cut.
+On a board without PSRAM an HTTPS request waits while internal RAM cannot hold a TLS session, and `jsonStatus` reads 0 until it went.
+
+A push is live, never saved: it applies the way `PATCH /api/state?live=1` does, at the next frame boundary, so a script building its look pushes it again at start.
+A push to a target with one still on its way waits, replacing any that waited before it, so a script may push whenever something changed.
+A document naming a shipped script the device lacks lists that script on the System card, and an open page downloads it, as the picker does.
+
+`jsondemo.mls` in `moonlive/services` shows four feeds, the weather, a price, a match and a headline, as scrolling text, and builds its own four layers to do it.
+
 ## Debugging: print
 
 `print(v)` writes a value to the serial log and returns it, so it wraps any part of an expression without changing the result.
@@ -308,4 +360,5 @@ tick, so a print costs frame time every frame it survives. Each compile grants a
 
 ## Source
 
-[MoonLive](../../../src/core/moonlive/MoonLive.h) is the engine, [MoonLiveCompiler](../../../src/core/moonlive/MoonLiveCompiler.h) the front-end, and [MoonLiveBuiltins_light](../../../src/light/moonlive/MoonLiveBuiltins_light.h) the table registering every call above. [The lowering](../../../src/core/moonlive/moonlive_lower.h) turns the intermediate form into machine bytes, written once for every backend.
+[MoonLive](../../../src/core/moonlive/MoonLive.h) is the engine, [MoonLiveCompiler](../../../src/core/moonlive/MoonLiveCompiler.h) the front-end, and [MoonLiveBuiltins_light](../../../src/light/moonlive/MoonLiveBuiltins_light.h) the table registering every call above.
+The service and JSON calls are [MoonLiveBuiltins_service](../../../src/core/moonlive/MoonLiveBuiltins_service.h), each a thin wrapper over [JsonFetch](../../../src/core/util/JsonFetch.h) and [JsonUtil](../../../src/core/util/JsonUtil.h), which compiled code calls for the same reach. [The lowering](../../../src/core/moonlive/moonlive_lower.h) turns the intermediate form into machine bytes, written once for every backend.
diff --git a/docs/moonmodules/light/power-functions.md b/docs/moonmodules/light/power-functions.md
index ac8c656bb..bad2e47c4 100644
--- a/docs/moonmodules/light/power-functions.md
+++ b/docs/moonmodules/light/power-functions.md
@@ -11,6 +11,7 @@ Three consumers share this vocabulary, and each uses a different slice of it:
   (`core/moonlive/MoonLiveBuiltins.h`), which carries plain scalar arguments, so a script sees the flat form of a function, not the C++ callback form a compiled effect can use.
 
 Sources: [draw.h](../../../src/light/powerfunctions/draw.h) (drawing), `core/util/math16.h` (16-bit math), `core/util/noise.h` (fields).
+Reading and sending JSON serves every domain, so it lives in core rather than here: [JsonUtil](../../../src/core/util/JsonUtil.h) addresses and edits a document by JSON Pointer, and [JsonFetch](../../../src/core/util/JsonFetch.h) fetches one and pushes one to a device, the calls a [service script's JSON values](moonlive.md#json-documents-in-a-service) wrap.
 The caller lists below are generated by reading the call sites, so they record what the code does rather than what it intends.
 
 Many of the names here are **[FastLED](https://github.com/FastLED/FastLED)'s**, deliberately:
diff --git a/docs/reference/MIGRATING.md b/docs/reference/MIGRATING.md
index 3184c0a87..b025bc15b 100644
--- a/docs/reference/MIGRATING.md
+++ b/docs/reference/MIGRATING.md
@@ -24,12 +24,36 @@ For a device still on old firmware (no Backup button yet), the [installer page](
 | *re-set a control* | One value resets to its default; set it again in the UI if you had changed it. |
 | *re-add a module* | The module vanishes from the tree on boot; add it again and re-enter its controls. |
 | *update a file* | An on-device file must be edited or replaced. |
+| *install over USB* | The update cannot come over the air: one install from the installer page with a cable, after which updates over the air work again. |
 | *erase flash* | A full flash erase is required (the heaviest, a full reconfigure follows). |
 
 ---
 
 ## Unreleased
 
+### The StadBeest autopilot builds its looks, a layer each
+
+**Action: *nothing*, unless a desk or a preset switched the looks on `switch3` to `switch5`: use `encoder6` to `encoder8`.**
+
+`stadbeest-autopilot.mls` pushes every part its look at start, a layer per look. It crossfades between them through `encoder6` to `encoder8`, which set the three layers' opacity, where `switch3` to `switch5` turned three effects in one layer on and off, and it clears those three switch targets. The eyes and the mouth are reached by name, `MM-eye1.local`, `MM-eye2.local` and `MM-mouth.local`; a part named otherwise is renamed on its System card, or the names are edited in the script. [The StadBeest](examples/multi-board-installation.md#3-one-surface-layout-for-every-device) has the table.
+
+### LCD-MM's ring is smaller, and refuses PSRAM
+
+**Action: *nothing*, unless `ringSnapshot` was off on a board with PSRAM: turn it on.**
+
+`ringAuto` now sizes the ring by the lead the wire needs, 3-row buffers, where it took every byte of internal RAM above 64 KB. On a 3,840-light S3 that is 21 small buffers instead of 28 large ones, a ring of 37 KB where it took about 112 KB. Turn `ringAuto` off to set `ringRows` and `ringBufs` by hand as before.
+The ring refuses to run when its refill would read PSRAM, since a flash save can cut PSRAM off in the middle of a refill and crash the board. With `ringSnapshot` off it reads the live frame, which a board with PSRAM keeps there, so the card shows `ring refused: … turn ringSnapshot on`.
+
+### ESP32-S3 boards read their flash over four lines
+
+**Action: *install over USB* once, on an `esp32s3-n16r8`, `esp32s3-n8r8` or `esp32s3-zero` device; the others need *nothing*.**
+
+These three firmwares read code from flash over four data lines (QIO) where they used two (DIO), which makes an S3's tick about 16% faster.
+The flash mode is the bootloader's, and an update over the air replaces only the app, so ESP-IDF refuses an app whose mode differs from the running one.
+The Firmware card then reports `ESP_ERR_OTA_SPI_MODE_MISMATCH`.
+Install this release once over USB from the [installer page](https://moonmodules.org/MoonLight/install/), which writes the bootloader too.
+The partition table is unchanged, so with *Erase chip first* left unticked the config stays; take a backup first anyway.
+
 ### Rings 241 places a few lights one unit over
 
 **Action: *nothing*.**
@@ -82,7 +106,7 @@ Switching a device on and off four times, each within a few seconds, opens its a
 **Action: *nothing*.**
 
 The palette picker lists every factory palette at its place in the catalog, held or not, and your own scripted palettes after them. A saved selection is kept by name.
-A knob or a slot that stepped to a scripted palette by number may land on another one.
+A knob or a slot that stepped to a scripted palette by number may land on another one. `stadbeest-fire` is 65 and `temperature` 64, since the StadBeest palette sits in its project folder.
 One the device does not hold keeps the last palette until the UI downloads it.
 
 ### `stadbeest-legs` is `stadbeest-walk`, `stadbeest-eyes` is `stadbeest-frog-eye`
diff --git a/docs/reference/examples/multi-board-installation.md b/docs/reference/examples/multi-board-installation.md
index 0a8d27c53..26356b558 100644
--- a/docs/reference/examples/multi-board-installation.md
+++ b/docs/reference/examples/multi-board-installation.md
@@ -34,10 +34,10 @@ This is the case study of one multi-device installation. The steps for your own
 
 | part | hardware | lights | layout | effect |
 |---|---|---|---|---|
-| legs | LightCrafter 16 (ESP32-S3 N8R8) | 10 SK6812 RGBW strips of 144 | Tubes, `tubeDistance` 7 | [`stadbeest-walk.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/effects/stadbeest/stadbeest-walk.mle), [`stadbeest-orb.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/effects/stadbeest/stadbeest-orb.mle), [`stadbeest-thrusters.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/effects/stadbeest/stadbeest-thrusters.mle) |
-| left eye | ESP32-S3-Zero, 4 MB | a 241-light ring disc | Rings241 | [`stadbeest-frog-eye.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/effects/stadbeest/stadbeest-frog-eye.mle), [`stadbeest-eye-orb.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/effects/stadbeest/stadbeest-eye-orb.mle), [`stadbeest-sauron.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/effects/stadbeest/stadbeest-sauron.mle) |
+| legs | LightCrafter 16 (ESP32-S3 N8R8) | 10 SK6812 RGBW strips of 144 | Tubes, `tubeDistance` 7 | [`stadbeest-walk.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/projects/stadbeest/stadbeest-walk.mle), [`stadbeest-orb.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/projects/stadbeest/stadbeest-orb.mle), [`stadbeest-thrusters.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/projects/stadbeest/stadbeest-thrusters.mle) |
+| left eye | ESP32-S3-Zero, 4 MB | a 241-light ring disc | Rings241 | [`stadbeest-frog-eye.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/projects/stadbeest/stadbeest-frog-eye.mle), [`stadbeest-eye-orb.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/projects/stadbeest/stadbeest-eye-orb.mle), [`stadbeest-sauron.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/projects/stadbeest/stadbeest-sauron.mle) |
 | right eye | ESP32-S3-Zero, 4 MB | a 241-light ring disc | Rings241 | the same three as the left eye |
-| mouth | ESP32-C3 RGBWW PWM bulb | one RGBWW light | Grid 1×1×1 | [`stadbeest-mouth.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/effects/stadbeest/stadbeest-mouth.mle) |
+| mouth | ESP32-C3 RGBWW PWM bulb | one RGBWW light | Grid 1×1×1 | [`stadbeest-mouth.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/projects/stadbeest/stadbeest-mouth.mle) |
 
 The three looks, as each device's preview shows them; the mouth, one light, breathes along with each.
 
@@ -139,7 +139,7 @@ So they look the same way at the same moment, with no message between them.
 **Use them yourself.**
 The six looks and the autopilot are part of MoonLight's [script library](https://github.com/MoonModules/MoonLight/tree/main/moonlive).
 Every device running MoonLight lists them in its script picker and downloads one when it is chosen.
-The full code: [`stadbeest-walk.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/effects/stadbeest/stadbeest-walk.mle), [`stadbeest-orb.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/effects/stadbeest/stadbeest-orb.mle), [`stadbeest-thrusters.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/effects/stadbeest/stadbeest-thrusters.mle), [`stadbeest-frog-eye.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/effects/stadbeest/stadbeest-frog-eye.mle), [`stadbeest-eye-orb.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/effects/stadbeest/stadbeest-eye-orb.mle), [`stadbeest-sauron.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/effects/stadbeest/stadbeest-sauron.mle) and [`stadbeest-autopilot.mls`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/services/stadbeest-autopilot.mls); to write your own, start with [your first script](../../moonwalk.md#first-script).
+The full code: [`stadbeest-walk.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/projects/stadbeest/stadbeest-walk.mle), [`stadbeest-orb.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/projects/stadbeest/stadbeest-orb.mle), [`stadbeest-thrusters.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/projects/stadbeest/stadbeest-thrusters.mle), [`stadbeest-frog-eye.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/projects/stadbeest/stadbeest-frog-eye.mle), [`stadbeest-eye-orb.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/projects/stadbeest/stadbeest-eye-orb.mle), [`stadbeest-sauron.mle`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/projects/stadbeest/stadbeest-sauron.mle) and [`stadbeest-autopilot.mls`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/projects/stadbeest/stadbeest-autopilot.mls); to write your own, start with [your first script](../../moonwalk.md#first-script).
 
 ---
 
@@ -151,15 +151,12 @@ The first slot of each bank on a [Control](../../moonmodules/core/system.md#cont
 
 Every StadBeest effect that hears music declares `bpm`, `sensitivity` and `pulse` first, so those slots mean the same on the legs and on the eyes in every look.
 The rest are the look's own: on the walk `fader4` is `swing`, on the frog eye it is `pupil`.
-A slot assigned by hand keeps its target, which is how the look switches and the autopilot stay put.
+A slot assigned by hand keeps its target, which is how the look opacities and the autopilot stay put.
 
 | slot | legs | each eye | mouth |
 |---|---|---|---|
 | `switch1` | `Drivers.on` | `Drivers.on` | `Drivers.on` |
 | `switch2` | `pulse` | `pulse` | `pulse` |
-| `switch3` | `walk.enabled` | `frog-eye.enabled` | |
-| `switch4` | `orb.enabled` | `eye-orb.enabled` | |
-| `switch5` | `thrusters.enabled` | `sauron.enabled` | |
 | `switch8` | autopilot `run` | | |
 | `fader1` | `Drivers.brightness` | `Drivers.brightness` | `Drivers.brightness` |
 | `fader2` | `bpm` | `bpm` | `bpm` |
@@ -167,11 +164,14 @@ A slot assigned by hand keeps its target, which is how the look switches and the
 | `fader4` to `fader7` | the look's next numbers | the look's next numbers | `rest` |
 | `fader8` | autopilot `seconds` | | |
 | `encoder1` | `Drivers.palette` | `Drivers.palette` | `Drivers.palette` |
-| `encoder2` and on | the look's choices, such as the orb's `shape` | the same | |
+| `encoder2` to `encoder5` | the look's choices, such as the orb's `shape` | the same | |
+| `encoder6` | `WalkLayer.opacity` | `FrogLayer.opacity` | |
+| `encoder7` | `OrbLayer.opacity` | `EyeOrbLayer.opacity` | |
+| `encoder8` | `ThrustersLayer.opacity` | `SauronLayer.opacity` | |
 
 A slot holds the value of the control it drives, so `fader2` at 33 means `bpm` 33.
-Each look is an effect of its own on every device, named after its script without the `stadbeest-` prefix, and `switch3` to `switch5` turn them on and off through their `enabled`.
-So one switch changes the look on the legs and on both eyes at once, and the desk follows it.
+Each look is a layer of its own on every device, its effect named after its script without the `stadbeest-` prefix. `encoder6` to `encoder8` set the three layers' opacity.
+So one encoder fades a look on the legs and on both eyes at once, and the desk follows it. A layer at opacity 0 costs nothing, so the beast renders two looks only while they cross.
 
 ---
 
@@ -227,13 +227,16 @@ Every device runs the [Audio](../../moonmodules/core/services.md#audio) service
 
 ## 6. Running unattended
 
-A [MoonLiveService](../../moonmodules/core/services.md#moonliveservice) on the leader runs [`stadbeest-autopilot.mls`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/services/stadbeest-autopilot.mls), which plays the beast through a whole museum night without anyone at the desk.
+A [MoonLiveService](../../moonmodules/core/services.md#moonliveservice) on the leader runs [`stadbeest-autopilot.mls`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/projects/stadbeest/stadbeest-autopilot.mls), which plays the beast through a whole museum night without anyone at the desk.
 
 <img src="../../assets/reference/examples/multi-board/autopilot-card.png" width="300" alt="The autopilot service card: script, run and seconds">
 
+- **Building:** at start it pushes every part its look, a layer per look, with [`pushJson` and `pushJsonTo`](../../moonmodules/light/moonlive.md#json-documents-in-a-service). It reaches the legs, itself, and the eyes and the mouth by name: `MM-eye1.local`, `MM-eye2.local` and `MM-mouth.local`.
+  A push is live and never saved, so it pushes them again every half minute, and a part that boots late or reboots gets its look back. The same document applied again changes nothing.
+  A part whose look names a script it lacks lists it on its System card, and the page open on it downloads it.
 - **Scenes:** every `seconds`, three minutes by default, it picks a new scene.
-  A scene moves on to the next look, walking, the orb or the thrusters, by switching `switch3` to `switch5`.
-  It picks a built-in palette, in a third of the thruster scenes [`stadbeest-fire.mlp`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/palettes/stadbeest-fire.mlp), a mood from calm to wild, how much the music counts and `pulse` on or off.
+  A scene crossfades to the next look, walking, the orb or the thrusters, over three seconds through `encoder6` to `encoder8`.
+  It picks a built-in palette, in a third of the thruster scenes [`stadbeest-fire.mlp`](https://github.com/MoonModules/MoonLight/blob/main/moonlive/projects/stadbeest/stadbeest-fire.mlp), a mood from calm to wild, how much the music counts and `pulse` on or off.
   That palette is computed every frame: louder music burns hotter, a beat flares the hot end white, and the flames flicker.
   A palette has the same number on every device, so the eyes and the mouth pick the same one.
 - **Breathing:** within a scene the energy rises and falls once a minute, through `fader2`, the tempo of whatever look runs.
@@ -266,10 +269,10 @@ The browser is the bridge between desk and device, so the laptop keeps the leade
 |---|---|
 | track faders 1-7 | brightness, then the look's `bpm`, `sensitivity` and its own numbers |
 | track fader 8 | the autopilot's `seconds`, how long a scene lasts |
-| track knobs 1-8 | the palette, then the look's choices and the numbers past the faders |
+| track knobs 1-5 | the palette, then the look's choices and the numbers past the faders |
+| track knobs 6-8 | the looks, faded in and out: walking, the orb, the thrusters |
 | activator 1 | on and off |
 | activator 2 | `pulse`, legs and eyes together |
-| activators 3 to 5 | the look: walking, the orb, the thrusters |
 | activator 8 | the autopilot's `run` |
 | clip pads | the presets, the top-left pad being preset 1; a stored preset glows white and the applied one green |
 
diff --git a/docs/reference/hardware/led-drivers.md b/docs/reference/hardware/led-drivers.md
index 7bc28ce9a..a8d192a85 100644
--- a/docs/reference/hardware/led-drivers.md
+++ b/docs/reference/hardware/led-drivers.md
@@ -38,6 +38,34 @@ On an S3, P4 or S31 with `i80` or `MoonI80` as the `peripheral`, `pinExpander` o
 
 The expander buys pins, not memory: the register is serial-in, so the DMA frame grows eightfold, about 1.1 KB per light. `i80` holds the whole frame, which past about 96 lights per strand falls to PSRAM too slow for the expander's clock. `MoonI80` streams the frame and drives 128 reliably.
 
+## Sizing the MoonI80 ring
+
+`MoonI80` streams the frame through a ring of small buffers in internal RAM, refilled from an interrupt as the wire drains each one. The refill encodes faster than the wire drains, so the ring only absorbs the moments the interrupt is held off, up to about 1.1 ms. What prevents a lost frame is the ring's lead over the wire in rows, not its number of buffers. On a 3,840-light expander rig, 45 rows ran clean and 40 lost frames.
+
+`ringAuto` cuts the ring into 3-row buffers and takes enough for 54 rows of lead. It stops where free internal RAM would fall under 100 KB, and the status says when that cuts it short. With it off, `ringRows` and `ringBufs` are yours to set, at about 600 bytes a row on an 8-pin expander.
+
+`ringSnapshot` copies each frame into internal RAM before the ring sends it, 3 bytes per RGB light (11.5 KB for 3,840 lights). Off, the ring reads the live frame, and refuses where that frame is in PSRAM. A flash save on the other core switches PSRAM off in the middle of a refill.
+
+`ringDbg` shows the ring's counters once a second. `ab` and `ml` say whether the depth holds.
+
+| Field | Meaning |
+|---|---|
+| `sn`, `lv` | where the snapshot and the live frame live: `I` internal RAM, `P` PSRAM |
+| `sl/bf` | slices per frame, over buffers |
+| `co`, `cr` | refills deferred while the flash cache was off, and their longest run |
+| `ab` | stalls abandoned, each a lost frame: 0 on a healthy ring |
+| `dn`, `ld` | frames done, and the last drain |
+| `lt` | slices refilled after their drain began; the lead prevents it, so it stays 0 even while frames are lost |
+| `tx` | the frame's wire time, in µs |
+| `ipb`, `ci` | DMA items per buffer, and consumed |
+| `tn`, `de` | the chain terminator, and descriptor errors |
+| `enc`, `ea` | the slowest and the average refill, in µs |
+| `sg`, `se` | gather and emit cycles per row |
+| `tw`, `ts`, `tp` | the tick's wait, snapshot and prime, in µs |
+| `gap@` | the longest gap between refills within a frame in µs, and the slice it ended at |
+| `ml` | the fewest slices the refill stayed ahead of the drain |
+| `c` | the core the refill runs on |
+
 ## Testing the wire with the loopback
 
 `loopbackTest` sends a known pattern out of a strand and reads it back through a jumper to `loopbackRxPin`, with its verdict in the status field. A `PASS` means the chip and the peripheral are clean, so flicker that remains is [signal integrity](../troubleshooting.md#stray-pixels-or-wrong-colors-on-lights-that-should-be-off).
diff --git a/docs/reference/integrating.md b/docs/reference/integrating.md
index 8e16b5ab9..4c44248e1 100644
--- a/docs/reference/integrating.md
+++ b/docs/reference/integrating.md
@@ -52,6 +52,7 @@ The answer is `{"ok":true,"changes":N}`, or a 400 naming the first failure and w
 A failure only writing finds, such as a value out of range, leaves what came before it applied.
 A document is at most 32 KB, and a larger one is refused with a 413.
 `POST /api/state` takes the same document, for a client that cannot send `PATCH`.
+`PATCH /api/state?live=1` applies a document that drives rather than configures, as a show building its look on another device does. It is checked and applied the same way, and nothing it changes is marked to save, so a reboot returns the device to its saved state.
 Adding, replacing and removing a module through `/api/modules` applies a one-member document, so the same rules hold on both paths.
 
 `GET /api/modules/<name>/document` reads a module back as a document, its path from the top level around it, and a card's `{ }` button shows the same.
diff --git a/docs/reference/metrics/code.json b/docs/reference/metrics/code.json
index f8d07970b..97d904f1b 100644
--- a/docs/reference/metrics/code.json
+++ b/docs/reference/metrics/code.json
@@ -1,18 +1,18 @@
 {
  "#define used as a constant": 1,
- "(duplicated lines)": 3379,
- "(total)": 1672,
+ "(duplicated lines)": 3315,
+ "(total)": 1654,
  "blocking call on the render path": 194,
- "complex function": 296,
- "deeply nested": 111,
+ "complex function": 295,
+ "deeply nested": 110,
  "double in firmware code": 2,
- "duplicated block": 752,
+ "duplicated block": 738,
  "large file": 25,
- "large stack frame": 33,
+ "large stack frame": 32,
  "long function": 49,
  "long parameter list": 35,
  "module type in the UI": 78,
- "mutable static state": 44,
+ "mutable static state": 43,
  "name spread": 22,
  "raw allocation in light": 30
 }
diff --git a/docs/reference/metrics/docgen.json b/docs/reference/metrics/docgen.json
index fefbbcfae..0a16ebeb2 100644
--- a/docs/reference/metrics/docgen.json
+++ b/docs/reference/metrics/docgen.json
@@ -1,11 +1,11 @@
 {
  "(appendix lines)": 4376,
- "(total)": 3051,
+ "(total)": 3044,
  "appendix sections nothing refers to": 199,
- "member deep dives": 39,
+ "member deep dives": 38,
  "multi-line comment blocks": 307,
- "over-long sentences": 76,
- "over-wide comment lines": 1541,
+ "over-long sentences": 75,
+ "over-wide comment lines": 1536,
  "over-wide doc lines": 34,
  "split paragraphs": 855
 }
diff --git a/docs/reference/metrics/prose.json b/docs/reference/metrics/prose.json
index f20310b1a..d95a31214 100644
--- a/docs/reference/metrics/prose.json
+++ b/docs/reference/metrics/prose.json
@@ -1,12 +1,12 @@
 {
- "(total)": 2336,
- "MoonLight.EmDash": 1117,
+ "(total)": 2327,
+ "MoonLight.EmDash": 1114,
  "MoonLight.LinkText": 7,
  "MoonLight.NegatedHeading": 6,
  "MoonLight.SelfReference": 17,
- "MoonLight.SentenceLength": 320,
+ "MoonLight.SentenceLength": 316,
  "MoonLight.Spelling": 39,
- "MoonLight.Temporal": 185,
+ "MoonLight.Temporal": 183,
  "MoonLight.TonePadding": 1,
  "MoonLight.VagueClose": 28,
  "MoonLight.Weasel": 616
diff --git a/docs/reference/metrics/repo-health.json b/docs/reference/metrics/repo-health.json
index 7255af929..32310e515 100644
--- a/docs/reference/metrics/repo-health.json
+++ b/docs/reference/metrics/repo-health.json
@@ -1,43 +1,43 @@
 {
-  "commit": "80e19948",
+  "commit": "bfcc83f5",
   "flash": {
-    "esp32s3-n16r8": 2474896,
-    "esp32": 2281504,
+    "esp32s3-n16r8": 2491984,
+    "esp32": 2299696,
     "esp32p4rev1-eth": 2404800,
     "esp32p4rev1-eth-wifi": 2657056,
     "esp32s3-n8r8": 2437792,
     "esp32s31": 2744032,
-    "esp32-16mb": 2356048,
+    "esp32-16mb": 2399680,
     "esp32-eth": 1681040,
     "esp32-wrover": 1843760,
     "qemu": 1383648,
     "esp32p4rev3-eth": 2423840,
     "esp32s3-zero": 2224816,
     "esp32-pico": 2107168,
-    "desktop-macos": 2423016,
+    "desktop-macos": 2480264,
     "desktop-windows": 1925120,
     "esp32c3": 2335072,
     "desktop-linux": 2548000,
-    "esp32s3-n32r16": 2484400,
+    "esp32s3-n32r16": 2513856,
     "teensy41": 1271788
   },
   "measured": {
     "esp32p4rev1-eth": "2026-10-19",
     "esp32s31": "2026-10-13",
-    "esp32": "2026-10-21",
+    "esp32": "2026-10-23",
     "esp32-pico": "2026-09-09",
-    "esp32s3-n16r8": "2026-10-21",
+    "esp32s3-n16r8": "2026-10-23",
     "esp32s3-n8r8": "2026-10-13",
     "esp32s3-zero": "2026-10-13",
-    "esp32-16mb": "2026-10-13",
+    "esp32-16mb": "2026-10-22",
     "esp32p4rev1-eth-wifi": "2026-10-19",
     "esp32-eth": "2026-09-11",
     "esp32p4rev3-eth": "2026-10-21",
-    "desktop-macos": "2026-10-21",
+    "desktop-macos": "2026-10-23",
     "desktop-windows": "2026-09-30",
     "esp32c3": "2026-10-10",
     "desktop-linux": "2026-10-12",
-    "esp32s3-n32r16": "2026-10-16",
+    "esp32s3-n32r16": "2026-10-23",
     "teensy41": "2026-10-15"
   },
   "perf": {
@@ -365,6 +365,20 @@
           "last": "2026-10-14"
         }
       },
+      "RAM_floor": {
+        "esp32s3-n16r8": {
+          "p50": 11732,
+          "p95": 12527,
+          "n": 3,
+          "last": "2026-10-22"
+        },
+        "esp32p4rev1-eth": {
+          "p50": 2168,
+          "p95": 2168,
+          "n": 1,
+          "last": "2026-10-22"
+        }
+      },
       "perf_full": {
         "desktop-macos": {
           "p50": 256,
@@ -781,8 +795,8 @@
       }
     },
     "desktop-macos": {
-      "tick_us": 7,
-      "fps": 142857,
+      "tick_us": 8,
+      "fps": 125000,
       "scenario_p50": {
         "Effects_pipeline_builds_and_renders": {
           "p50": 7,
@@ -822,54 +836,54 @@
     }
   },
   "loc": {
-    "core": 30448,
-    "light": 31568,
-    "platform": 21750,
-    "ui": 12957,
-    "test": 71673,
-    "moondeck": 31938
+    "core": 32227,
+    "light": 31562,
+    "platform": 22123,
+    "ui": 12980,
+    "test": 73772,
+    "moondeck": 32132
   },
   "comments": {
     "core": {
-      "lines": 6336,
-      "ratio": 0.231
+      "lines": 6547,
+      "ratio": 0.225
     },
     "light": {
-      "lines": 6666,
+      "lines": 6653,
       "ratio": 0.237
     },
     "platform": {
-      "lines": 4104,
-      "ratio": 0.212
+      "lines": 4145,
+      "ratio": 0.21
     },
     "ui": {
-      "lines": 3489,
+      "lines": 3492,
       "ratio": 0.285
     },
     "test": {
-      "lines": 7277,
-      "ratio": 0.118
+      "lines": 7389,
+      "ratio": 0.116
     },
     "moondeck": {
-      "lines": 4460,
-      "ratio": 0.16
+      "lines": 4462,
+      "ratio": 0.159
     }
   },
   "tests": {
-    "cases": 2643,
-    "scenarios": 32
+    "cases": 2741,
+    "scenarios": 35
   },
   "docs": {
-    "md_files": 162,
-    "md_lines": 30528,
-    "plans_files": 53,
-    "backlog_lines": 4031,
-    "lessons_lines": 535,
+    "md_files": 164,
+    "md_lines": 30957,
+    "plans_files": 55,
+    "backlog_lines": 4083,
+    "lessons_lines": 546,
     "claude_md_lines": 119
   },
   "complexity": {
-    "functions": 5171,
-    "over_threshold": 349,
+    "functions": 5344,
+    "over_threshold": 351,
     "worst_ccn": 128
   }
 }
diff --git a/docs/reference/metrics/repo-health.md b/docs/reference/metrics/repo-health.md
index c96038956..e9424c8e3 100644
--- a/docs/reference/metrics/repo-health.md
+++ b/docs/reference/metrics/repo-health.md
@@ -1,6 +1,6 @@
 # Repo health
 
-Measured at `80e19948`. Generated by [`moondeck/check/repo_health.py`](../../../moondeck/check/repo_health.py) on every KPI-gate run. **Do not edit by hand.**
+Measured at `bfcc83f5`. Generated by [`moondeck/check/repo_health.py`](../../../moondeck/check/repo_health.py) on every KPI-gate run. **Do not edit by hand.**
 
 Current state only; the trend is this file's git history (`git log -p docs/reference/metrics/repo-health.md`). Nothing here fails a build: the numbers make growth visible, the judgment stays human.
 
@@ -9,29 +9,29 @@ Current state only; the trend is this file's git history (`git log -p docs/refer
 | Metric | v6.0.0 | Now | Change |
 |---|---:|---:|---:|
 | flash desktop-linux | - | 2,488 KB | new |
-| flash desktop-macos | 1,963 KB | 2,366 KB | +403.2 KB (+20.5%) |
-| flash esp32 | 2,061 KB | 2,228 KB | +166.8 KB (+8.1%) |
-| flash esp32-16mb | 2,012 KB | 2,301 KB | +288.8 KB (+14.4%) |
+| flash desktop-macos | 1,963 KB | 2,422 KB | +459.1 KB (+23.4%) |
+| flash esp32 | 2,061 KB | 2,246 KB | +184.6 KB (+9.0%) |
+| flash esp32-16mb | 2,012 KB | 2,343 KB | +331.4 KB (+16.5%) |
 | flash esp32c3 | - | 2,280 KB | new |
 | flash esp32p4rev1-eth | 2,022 KB | 2,348 KB | +326.7 KB (+16.2%) |
 | flash esp32p4rev1-eth-wifi | 2,304 KB | 2,595 KB | +291.2 KB (+12.6%) |
 | flash esp32p4rev3-eth | 2,025 KB | 2,367 KB | +341.8 KB (+16.9%) |
-| flash esp32s3-n16r8 | 2,111 KB | 2,417 KB | +305.4 KB (+14.5%) |
-| flash esp32s3-n32r16 | - | 2,426 KB | new |
+| flash esp32s3-n16r8 | 2,111 KB | 2,434 KB | +322.1 KB (+15.3%) |
+| flash esp32s3-n32r16 | - | 2,455 KB | new |
 | flash esp32s3-n8r8 | 2,038 KB | 2,381 KB | +342.4 KB (+16.8%) |
 | flash esp32s3-zero | 1,977 KB | 2,173 KB | +195.9 KB (+9.9%) |
 | flash esp32s31 | 2,395 KB | 2,680 KB | +284.3 KB (+11.9%) |
 | flash teensy41 | - | 1,242 KB | new |
 | tick Effects_pipeline_builds_and_renders (desktop-macos) | 7 µs | 7 µs | +0 (+0.0%) |
 | tick Layouts_resize_reallocates_live (desktop-macos) | 12 µs | 10 µs | -2 (-16.7%) |
-| lines core | 22,299 | 30,448 | +8,149 (+36.5%) |
-| lines light | 31,054 | 31,568 | +514 (+1.7%) |
-| lines platform | 16,798 | 21,750 | +4,952 (+29.5%) |
-| lines ui | 11,394 | 12,957 | +1,563 (+13.7%) |
-| lines test | 57,759 | 71,673 | +13,914 (+24.1%) |
-| lines moondeck | 29,325 | 31,938 | +2,613 (+8.9%) |
-| unit tests | 2,120 | 2,643 | +523 (+24.7%) |
-| scenarios | 21 | 32 | +11 (+52.4%) |
+| lines core | 22,299 | 32,227 | +9,928 (+44.5%) |
+| lines light | 31,054 | 31,562 | +508 (+1.6%) |
+| lines platform | 16,798 | 22,123 | +5,325 (+31.7%) |
+| lines ui | 11,394 | 12,980 | +1,586 (+13.9%) |
+| lines test | 57,759 | 73,772 | +16,013 (+27.7%) |
+| lines moondeck | 29,325 | 32,132 | +2,807 (+9.6%) |
+| unit tests | 2,120 | 2,741 | +621 (+29.3%) |
+| scenarios | 21 | 35 | +14 (+66.7%) |
 
 Against the release `v6.0.0`, the fixed point a user compares with; the tables below compare against the last commit. A firmware not rebuilt since `v6.0.0` is left out, and a measure the release did not record yet, such as the code check, joins from the next one.
 
@@ -39,25 +39,25 @@ Against the release `v6.0.0`, the fixed point a user compares with; the tables b
 
 | Target | Flash | Capacity | Used | Built |
 |---|---:|---:|---:|:--:|
-| desktop-linux | 2,488 KB | - | - | **STALE 9d** |
-| desktop-macos | 2,366 KB | - | - | yes |
-| desktop-windows | 1,880 KB | - | - | **STALE 21d** |
-| esp32 | 2,228 KB | 2,496 KB | 89% | yes |
-| esp32-16mb | 2,301 KB | 4,096 KB | 56% | **STALE 8d** |
-| esp32-eth | 1,642 KB | 2,496 KB | 66% | **STALE 40d** |
-| esp32-pico | 2,058 KB | 3,072 KB | 67% | **STALE 42d** |
+| desktop-linux | 2,488 KB | - | - | **STALE 11d** |
+| desktop-macos | 2,422 KB (+15 KB) ⚠ | - | - | yes |
+| desktop-windows | 1,880 KB | - | - | **STALE 23d** |
+| esp32 | 2,246 KB | 2,496 KB | 90% | yes |
+| esp32-16mb | 2,343 KB | 4,096 KB | 57% | carried 1d |
+| esp32-eth | 1,642 KB | 2,496 KB | 66% | **STALE 42d** |
+| esp32-pico | 2,058 KB | 3,072 KB | 67% | **STALE 44d** |
 | esp32-wrover | 1,801 KB | 2,496 KB | 72% | carried (age?) |
-| esp32c3 | 2,280 KB | 2,496 KB | 91% | **STALE 11d** |
-| esp32p4rev1-eth | 2,348 KB | 4,096 KB | 57% | carried 2d |
-| esp32p4rev1-eth-wifi | 2,595 KB | 4,096 KB | 63% | carried 2d |
-| esp32p4rev3-eth | 2,367 KB | 4,096 KB | 58% | yes |
-| esp32s3-n16r8 | 2,417 KB (+80 B) ⚠ | 4,096 KB | 59% | yes |
-| esp32s3-n32r16 | 2,426 KB | 4,096 KB | 59% | carried 5d |
-| esp32s3-n8r8 | 2,381 KB | 3,072 KB | 77% | **STALE 8d** |
-| esp32s3-zero | 2,173 KB | 2,496 KB | 87% | **STALE 8d** |
-| esp32s31 | 2,680 KB | 4,096 KB | 65% | **STALE 8d** |
+| esp32c3 | 2,280 KB | 2,496 KB | 91% | **STALE 13d** |
+| esp32p4rev1-eth | 2,348 KB | 4,096 KB | 57% | carried 4d |
+| esp32p4rev1-eth-wifi | 2,595 KB | 4,096 KB | 63% | carried 4d |
+| esp32p4rev3-eth | 2,367 KB | 4,096 KB | 58% | carried 2d |
+| esp32s3-n16r8 | 2,434 KB (+1 KB) ⚠ | 4,096 KB | 59% | yes |
+| esp32s3-n32r16 | 2,455 KB | 4,096 KB | 60% | yes |
+| esp32s3-n8r8 | 2,381 KB | 3,072 KB | 77% | **STALE 10d** |
+| esp32s3-zero | 2,173 KB | 2,496 KB | 87% | **STALE 10d** |
+| esp32s31 | 2,680 KB | 4,096 KB | 65% | **STALE 10d** |
 | qemu | 1,351 KB | - | - | carried (age?) |
-| teensy41 | 1,242 KB | 3,456 KB | 36% | carried 6d |
+| teensy41 | 1,242 KB | 3,456 KB | 36% | **STALE 8d** |
 
 `Built: yes` was measured this run. `carried (age?)` was not rebuilt either and predates this record, so its age is unknown: it dates itself on the next build. `carried Nd` was NOT rebuilt and its number is N days old, so an absent delta says nothing about the change. **STALE** marks a carry older than 7 days: the number has gone unchecked long enough that growth will surface later as one jump, blamed on whichever commit happens to rebuild that target. `Used` is against the app slot in the firmware's own partition table.
 
@@ -65,15 +65,15 @@ Against the release `v6.0.0`, the fixed point a user compares with; the tables b
 
 | Target | Net | New | Removed | Grown | Shrunk | Other | Since |
 |---|---:|---:|---:|---:|---:|---:|---|
-| esp32 | +0.0 KB | +0.0 KB | +0.0 KB | +0.0 KB | +0.0 KB | +0.0 KB | `80e19948` |
-| esp32p4rev3-eth | +0.0 KB | +0.0 KB | +0.0 KB | +0.0 KB | +0.0 KB | +0.0 KB | `80e19948` |
-| esp32s3-n16r8 | +0.1 KB | +0.0 KB | +0.0 KB | +0.1 KB | +0.0 KB | -0.0 KB | `80e19948` |
+| esp32 | +0.0 KB | +0.0 KB | +0.0 KB | +0.0 KB | +0.0 KB | +0.0 KB | `bfcc83f5` |
+| esp32s3-n16r8 | +1.1 KB | +2.9 KB | -2.3 KB | +1.5 KB | -1.0 KB | +0.1 KB | `bfcc83f5` |
+| esp32s3-n32r16 | +0.0 KB | +0.0 KB | +0.0 KB | +0.0 KB | +0.0 KB | +0.0 KB | `bfcc83f5` |
 
 Largest moves:
 
 - **esp32**: none
-- **esp32p4rev3-eth**: none
-- **esp32s3-n16r8**: `mm::ui::file10` +83 B
+- **esp32s3-n16r8**: `mm::Drivers::live_` +804 B, `mm::(anonymous namespace)::writeValue(mm::JsonSink&, mm::jso` -745 B, `mm::Drivers::liveNames_` -656 B, `mm::JsonFetch::worker(void*)` -384 B, `mm::JsonFetch::serve(mm::JsonFetch::Job const&, char*)` +316 B
+- **esp32s3-n32r16**: none
 
 What this commit's flash went to, symbol by symbol against the measurement at `Since`. New is new functionality, removed and shrunk are what a cleanup saved, and other is what no symbol owns, such as merged strings and alignment. A rename reads as removed plus new, which the largest moves expose.
 
@@ -82,7 +82,7 @@ What this commit's flash went to, symbol by symbol against the measurement at `S
 | Target | Tick | FPS |
 |---|---:|---:|
 | desktop-linux | 5 µs | 200,000 |
-| desktop-macos | 7 µs | 142,857 |
+| desktop-macos | 8 µs | 125,000 |
 | desktop-windows | 4 µs | 250,000 |
 | esp32 | 1,716 µs | 582 |
 
@@ -106,6 +106,7 @@ What this commit's flash went to, symbol by symbol against the measurement at `S
 | NetworkSend_one_sender_many_receivers | - | - | - | - | - | - | - | - | - | - | - | - | - | - | - | 3,847 ? | - | - |
 | Network_hardware_reconfigures_live | 21 ? | 2,834 ? | - | 8,692 ? | - | - | - | - | 2,147 ? | 237 ? | - | - | - | - | - | - | - | - |
 | Palettes_a_script_drives_the_effects | 7 | - | - | - | - | - | - | - | - | - | - | - | - | - | - | - | - | - |
+| RAM_floor | - | - | - | 11,732 ? | 2,168 ? | - | - | - | - | - | - | - | - | - | - | - | - | - |
 | State_one_document_adds_an_effect_with_its_controls | 7 | - | - | 2,505 ? | - | - | - | - | - | - | - | - | - | - | - | - | - | - |
 | perf_full | 256 | 592 ? | 5,313 | 25,340 ? | 11,711 ? | 13,373 ? | - | - | 6,797 ? | 2,438 ? | 5,469,660 ? | - | - | - | - | - | - | - |
 | perf_light | 16 | 35 ? | 2,510 | 3,044 | 1,117 ? | 1,378 ? | - | - | 662 ? | 780 ? | 5,385,763 ? | - | - | - | - | - | - | - |
@@ -114,7 +115,7 @@ What this commit's flash went to, symbol by symbol against the measurement at `S
 
 Microseconds. `?` marks a cell backed by fewer than 4 samples, which is a first impression rather than a percentile; several are months old and were captured during a network reconfigure, so they read as whole milliseconds. `-` means that target has never run that scenario.
 
-**Coverage: 115/378 cells measured (30%), 28 of them with 4+ samples (7%).** The blanks are the point: a regression on a target that has never run a scenario cannot be DETECTED in it, and the target cannot be compared against the others. Filling the matrix means running the scenario suite on each bench board, which is a standing task rather than a one-off.
+**Coverage: 117/396 cells measured (29%), 28 of them with 4+ samples (7%).** The blanks are the point: a regression on a target that has never run a scenario cannot be DETECTED in it, and the target cannot be compared against the others. Filling the matrix means running the scenario suite on each bench board, which is a standing task rather than a one-off.
 
 ### desktop-macos: isolated scenarios (p50 of the sample window)
 
@@ -138,36 +139,36 @@ These build a bare pipeline with no optional modules, so a change here is a chan
 
 | Area | Lines | Comments | Comment share |
 |---|---:|---:|---:|
-| core | 30,448 | 6,336 | 23.1 % |
-| light | 31,568 | 6,666 | 23.7 % |
-| platform | 21,750 | 4,104 | 21.2 % |
-| ui | 12,957 (+2) ⚠ | 3,489 | 28.5 % |
-| test | 71,673 (+9) ⚠ | 7,277 | 11.8 % |
-| moondeck | 31,938 (+117) ⚠ | 4,460 | 16.0 % |
+| core | 32,227 (+60) ⚠ | 6,547 | 22.5 % (−0.1 %) ✓ |
+| light | 31,562 (+2) ⚠ | 6,653 | 23.7 % |
+| platform | 22,123 (+30) ⚠ | 4,145 | 21.0 % |
+| ui | 12,980 | 3,492 | 28.5 % |
+| test | 73,772 (+17) ⚠ | 7,389 | 11.6 % |
+| moondeck | 32,132 | 4,462 | 15.9 % |
 
 ## Tests
 
 | Kind | Count |
 |---|---:|
-| unit cases | 2,643 |
-| scenarios | 32 |
+| unit cases | 2,741 (+2) ✓ |
+| scenarios | 35 |
 
 ## Complexity
 
 | Metric | Value |
 |---|---:|
-| functions | 5,171 |
-| over threshold | 349 |
+| functions | 5,344 (+29) ✓ |
+| over threshold | 351 (−8) ✓ |
 | worst CCN | 128 |
 
 ## Documentation
 
 | Metric | Value |
 |---|---:|
-| markdown files | 162 |
-| markdown lines | 30,528 (+47) ⚠ |
-| plan files | 53 |
-| backlog lines | 4,031 |
-| lessons lines | 535 |
+| markdown files | 164 |
+| markdown lines | 30,957 (−6) ✓ |
+| plan files | 55 |
+| backlog lines | 4,083 |
+| lessons lines | 546 |
 | CLAUDE.md lines | 119 |
 
diff --git a/docs/reference/openapi.yaml b/docs/reference/openapi.yaml
index 1352cf05e..33fd4735d 100644
--- a/docs/reference/openapi.yaml
+++ b/docs/reference/openapi.yaml
@@ -56,6 +56,12 @@ paths:
       tags: [State]
       operationId: applyState
       summary: Applies a state document as a JSON Merge Patch (RFC 7386); its rules are in Integrating.
+      parameters: &stateParameters
+        - name: live
+          in: query
+          required: false
+          description: 1 applies a document that drives rather than configures, such as a show building its look on another device, checked the same way and marking nothing to save.
+          schema: { type: integer, enum: [0, 1] }
       requestBody: { $ref: "#/components/requestBodies/StateDocument" }
       responses: &stateResponses
         "200": { $ref: "#/components/responses/StateResult" }
@@ -68,6 +74,7 @@ paths:
       tags: [State]
       operationId: applyStatePost
       summary: The same as PATCH, for a client that cannot send PATCH.
+      parameters: *stateParameters
       requestBody: { $ref: "#/components/requestBodies/StateDocument" }
       responses: *stateResponses
 
@@ -359,6 +366,7 @@ paths:
       responses:
         "200": { $ref: "#/components/responses/Ok" }
         "400": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
         "500": { $ref: "#/components/responses/Error" }
 
   /api/file:
diff --git a/docs/reference/performance.md b/docs/reference/performance.md
index 7534f4c86..63e814a63 100644
--- a/docs/reference/performance.md
+++ b/docs/reference/performance.md
@@ -300,6 +300,35 @@ The exec block is the emitted machine code, so its size varies by ISA. `lines.ml
 
 ---
 
+## Internal RAM
+
+What the ESP32's scarce memory holds and what freed it, measured 2026-10-21 and 2026-10-22 with BouncingBalls held fixed. The rule behind it is in [MoonCore](../explanation/architecture/mooncore.md#internal-ram); `scenario_RAM_floor` measures it on any board.
+
+**The S3** (shiffy, `esp32s3-n16r8`, 3,840 lights through 2 pins and the 74HCT595 expander on LCD-MM), with a browser on the UI:
+
+| | Free internal | Largest block | fps |
+|---|---|---|---|
+| Start, `ringAuto` taking all but 64 KB (28 buffers of 7 rows) | 66 KB | 30 KB | 75 |
+| WiFi, lwIP and TLS buffers in PSRAM, WiFi's code in flash | 110 KB | 31 KB | 72 |
+| ESP-IDF's 32 KB DMA reserve pool off (it capped the block at its own size) | 111 KB | 59 KB | 72 |
+| Every plain `malloc` asking PSRAM first, smaller stacks | 132 KB | 88 KB | 71 |
+| `ringAuto` sizing by lead, 3-row buffers (3 × 21, a 37 KB ring) | 145 KB | 94 KB | 81 |
+| The prime's core-0 helper removed | 150 to 155 KB | 108 KB | 102 to 107 |
+
+**The ring's depth** (`ringAuto` off, 40 s each, frames lost): what counts is the lead over the wire in rows. Before the encode sped up, 7 × 10 and 3 × 24 ran clean and 7 × 8 lost a frame in five. After it, 3 × 18 and 2 × 26 run clean, 3 × 14 loses one every few seconds, and 1-row buffers send nothing.
+
+| Per row of 64 strands | Before | After |
+|---|---|---|
+| Emit (transpose and store) | 5,800 cycles | 3,650 (its eight stores unrolled to constant shifts, and the empty second byte of a 16-bit bus skipped) |
+| Gather (correction per light) | 1,850 cycles | 1,300 (a plain RGB strip skips every optional fixture role) |
+| Refill of a slice, against its wire time | 220 µs vs 207 (7 rows) | 63 µs vs 89 (3 rows) |
+
+**The P4** (64 lights) holds 368 to 373 KB free with a 192 KB block through the same scenario.
+
+**The classic ESP32 without PSRAM** (the Olimex, WiFi, 64 lights) rests at about 70 KB free. A page load over a slow link once took it to 3.6 KB. The RAM went to 34 TCP segments of 1,536 bytes waiting for acknowledgement and 8 of WiFi's receive buffers. With the sends' back-pressure an open UI and preview hold 40 to 55 KB with a 40 KB block, where they held 12 to 23 KB. On the classic, WiFi's code in flash frees only the code-only region (22 to 55 KB, MoonLive's scripts use it), no data RAM.
+
+**Network receive** is unaffected by WiFi's code in flash. In `scenario_NetworkReceive_two_boards`, the P4 sending to the S3, every row matched the run with it in IRAM. That is 38 to 40 frames a second up to 4,096 lights, in Art-Net, E1.31 and DDP.
+
 ## Multi-pin LED driving (all three peripherals, 128×128 grid)
 
 The rows name the `ParallelLedDriver` backends by the class names they were measured under: `MultiPinLedDriver` is the `i80` peripheral, `MoonLedDriver` is `MoonI80`, and `ParlioLedDriver` is `Parlio`. The `peripheral` control selects the backend at one vtable dispatch per frame, so the timings hold.
diff --git a/docs/reference/testing.md b/docs/reference/testing.md
index ca3a1a656..54c5925c6 100644
--- a/docs/reference/testing.md
+++ b/docs/reference/testing.md
@@ -263,9 +263,9 @@ The run: [Run a scenario against a live device](../moonwalk.md#run-live-scenario
 
 #### Several boards
 
-A scenario naming `"boards": ["sender", ...]` drives those boards too, each mapped to a device by `--board NAME=HOST`; it is skipped while one is missing. A step with `"device": "<name>"` runs on that board, as an `apply_state`, a `set_control` or a `measure`. Every step's strings fill `{host}` and `{<name>}` with the boards' addresses, so a sender's `hosts` points at its receivers. Each board is restored from its own snapshot, before the device under test. The observations are keyed by the whole combination, such as `host=esp32s3-n16r8 sender=esp32p4rev1-eth`, so a WiFi pair and an Ethernet pair keep apart.
+A scenario naming `"boards": ["sender", ...]` drives those boards too, each mapped to a device by `--board NAME=HOST`; it is skipped while one is missing. A step with `"device": "<name>"` runs on that board, as an `apply_state`, a `set_control` or a `measure`. Every step's strings fill `{host}` and `{<name>}` with the boards' addresses, so a sender's `hosts` points at its receivers. Each board is restored from its own snapshot, before the device under test. `--keep` leaves the device under test as the last step set it, to watch or deploy what the scenario built. The observations are keyed by the whole combination, such as `host=esp32s3-n16r8 sender=esp32p4rev1-eth`, so a WiFi pair and an Ethernet pair keep apart.
 
-A `measure` step's `read` list names extra values to report: `"Module.control"` from the state, `"Module.tick"` for a module's tick time, or `"fps"`; `"<name>:"` in front reads another board, such as `"sender:fps"`. The run ends with one row per such step, which is what a sweep is read from.
+A measuring step waits `--settle` seconds before it reads, or its own `settle`. A `measure` step's `read` list names extra values to report: `"Module.control"` from the state, `"Module.tick"` for a module's tick time, or `"fps"`; `"<name>:"` in front reads another board, such as `"sender:fps"`. The run ends with one row per such step, which is what a sweep is read from.
 
 The run passes `--board sender=<host>` per board: [MoonDeck.md](../../moondeck/MoonDeck.md#live_scenario).
 
@@ -336,6 +336,12 @@ The runner compares each measurement to the contract and fails if the device mis
 
 - `tick_us` is a **ceiling**, the device must deliver this tick or faster. Going faster than contract is good news, never a failure.
 - `free_heap` is a **floor**, the device must deliver at least this much free heap. Growing heap is good news.
+- `max_alloc_block`, `free_internal` and `min_stack_free` are **floors** a step opts into, one for each of these:
+    - the largest free block, which an allocator needing one piece depends on;
+    - the internal RAM WiFi, HTTP and the UI need on a board with PSRAM, where `free_heap` counts the PSRAM too;
+    - the headroom of the tightest task stack, which the runner names.
+
+    The first two take the heap tolerance; a stack's headroom is exact. `scenario_RAM_floor` holds them with the UI open in a real browser, through the live runner's `browser` step (`action` open, refresh or close, with a `settle` in seconds).
 - Both are **hand-set promises**, not auto-captured last readings. Renegotiating a contract requires `--update-contract --reason "..."`, see below.
 - `set_by` records when the contract was last (re)negotiated; `reason` records why. Both stamped automatically by `--update-contract`.
 
@@ -425,7 +431,7 @@ Every `scenario_*.json` carries top-level metadata plus a `description` per step
 }
 ```
 
-`name` matches the filename stem exactly; `module` drives the doc grouping and the MoonDeck filter; `also` lists peer modules. `mode` is `construct` or `mutate` (see above). `fixture` is required for `mutate` scenarios that need to run in-process. `reset` (optional but recommended for mutate scenarios) normalizes controls before measurement so contract assertions aren't coupled to run order. `contract[<target>]` carries the per-target performance contract, see § Performance contracts. `observed[<target>]` carries the published summary of the observations per metric (tick_us, free_heap, max_alloc_block), written on request; see § Persistent observations. Per-step `description` is recommended (a missing one falls back to the step's `name`/`op` in the generated view). Optional top-level `"live_only": true` keeps the scenario out of the in-process runner. Optional per-step `"measure": true` triggers a measurement after the step, checked against the step's `contract`.
+`name` matches the filename stem exactly; `module` drives the doc grouping and the MoonDeck filter; `also` lists peer modules. `mode` is `construct` or `mutate` (see above). `fixture` is required for `mutate` scenarios that need to run in-process. `reset` (optional but recommended for mutate scenarios) normalizes controls before measurement so contract assertions aren't coupled to run order. `contract[<target>]` carries the per-target performance contract, see § Performance contracts. `observed[<target>]` carries the published summary of the observations per metric (tick_us, free_heap, max_alloc_block, and on a live device free_internal and min_stack_free), written on request; see § Persistent observations. Per-step `description` is recommended (a missing one falls back to the step's `name`/`op` in the generated view). Optional top-level `"live_only": true` keeps the scenario out of the in-process runner. Optional per-step `"measure": true` triggers a measurement after the step, checked against the step's `contract`.
 
 Unknown JSON keys are ignored by both runners (C++ and Python), so adding a new field is safe.
 
@@ -460,11 +466,11 @@ Steps to run them: [Run a scenario in-process on the desktop](../moonwalk.md#run
 
 **Step ops** the in-process runner understands today:
 
-- `set_control`: write a control on an already-added module (`id` + `key` + `value`). Mirrors `handleSetControl`: applies the typed write, calls `onControlChanged()`, and triggers `Scheduler::prepareTree()` if `affectsPrepare` returns true. Today supports Uint8 / Uint16 / Int16 / Bool / Text / Password / Select. A step may carry `"optional": true`, a best-effort write (e.g. shrink a grid that may not exist) that's skipped, not failed, when the target is absent.
+- `set_control`: write a control on an already-added module (`id` + `key` + `value`). Mirrors `handleSetControl`: applies the typed write, calls `onControlChanged()`, and rebuilds the scope `prepareScope()` names if `affectsPrepare` returns true. It supports Uint8 / Uint16 / Int16 / Bool / Text / Password / Select. A step may carry `"optional": true`, a best-effort write (e.g. shrink a grid that may not exist) that's skipped, not failed, when the target is absent.
 - `apply_state`: a state document (`document`) through the engine `PATCH /api/state` runs, from its text as written so key order holds; it is how a scenario changes the tree. A member with a `type` adds a module and a new `type` under the same name replaces one, `null` removes one, and `"$patch":"replace"` keeps only the children listed, so with none it clears a container (the "prepare my own canvas" primitive), keeping the ones main.cpp wires. With `error`, and optionally `at`, the step expects that failure; with `optional`, an unknown type is a skip, as for a peripheral another chip has. The live runner removes the modules a document created, and restores each container's document at the end.
 - `round_trip_state`: read every card back as its document and apply them as one document, which must apply. What the device shows is then proven to apply as it is, and live, the body outgrows the request buffer, so the streaming route runs.
 - `list_row`: reach a row of a list control as the list API does. `add` appends one with those fields, and `to` moves it there. Otherwise `match` finds a row by its fields, then the step writes a `field` (a button field presses it), runs the row's action (`"apply": true`, a pad click), deletes it (`"delete": true`), or with none of those only expects it.
-- `write_file` / `delete_file`: stage a file the way the editor saves one, and remove it again, so a scenario leaves the device as it found it. Both re-prepare the tree, as the live API does after a file changes.
+- `write_file` / `delete_file`: stage a file the way the editor saves one, and remove it again, so a scenario leaves the device as it found it. The text is in `value`, or in a repository file named in `from`. Both re-prepare the tree, as the live API does after a file changes.
 - `measure`: pure measurement step. Runs warmup + measure frames, prints per-step tick / FPS / lights / heap-delta, and checks the step's `contract`.
 
 A step can also set `"measure": true` on a non-measure op (e.g. mark the last `apply_state` as the one to measure after); the runner treats either shape identically.
diff --git a/docs/reference/troubleshooting.md b/docs/reference/troubleshooting.md
index 8bc62a4c5..44a111c5d 100644
--- a/docs/reference/troubleshooting.md
+++ b/docs/reference/troubleshooting.md
@@ -44,6 +44,14 @@ Confirm the firmware is innocent before reaching for the soldering iron: [Diagno
 
 How the bench found this is in [lessons.md](../work/past/lessons.md).
 
+## The lights stutter once a second
+
+At **logLevel** `Info` or above, the device writes a status line to its serial console once a second, from the loop that renders the frames. On an ESP32-S3 driving a large setup, that write stalls the loop long enough to see. Set **logLevel** on the System card to `Warn`: the line stops and the stutter with it. The first minute after boot always prints, since the installer reads the device's address from that line.
+
+## Free memory is low with the interface open
+
+The status bar's 🧠 is free internal RAM and 🧱 its largest block, the memory WiFi, the web server and the LED drivers share. A board with PSRAM keeps 100 KB free and a 50 KB block. A classic ESP32 without PSRAM runs with less. An open interface over a weak WiFi link takes more there, since what the board sends waits in that RAM until the browser acknowledges it. Ethernet, a better WiFi link or a closed preview gives it back. Where the RAM goes and what each board holds is in [performance.md](performance.md#internal-ram).
+
 ## Colors are wrong everywhere
 
 Red where you expect green usually means the channel order does not match the strip. Set it on the driver: the [fixture profile](../moonmodules/light/supporting.md#fixtureprofiles) names which channel carries which color.
diff --git a/docs/work/future/backlog-core.md b/docs/work/future/backlog-core.md
index 5da703968..d425f2b30 100644
--- a/docs/work/future/backlog-core.md
+++ b/docs/work/future/backlog-core.md
@@ -2,6 +2,22 @@
 
 Forward-looking to-build items for the **core / infrastructure** domain (`src/core/`, `src/platform/`, build, CI, network, persistence, UI). The light-domain counterpart is [backlog-light.md](backlog-light.md); items that genuinely span both are in [backlog-mixed.md](backlog-mixed.md). Index + overview: [README.md](index.md). Completed items are removed.
 
+### The `.deb` ships the systemd unit, raw Ethernet included (2026-10-22, from robwomp on Discord)
+
+The package holds only the binary, so a Pi or NanoPi user writes `/etc/systemd/system/moonlight.service` by hand from MoonWalk's "Run at boot" step. That unit grants no `CAP_NET_RAW`, so the panel card driver's `AF_PACKET` socket fails unless MoonLight runs as root, and the `setcap` alternative is lost whenever apt replaces `/usr/bin/MoonLight`. `CAP_NET_RAW` is all MoonLight needs, since it sets no interface flags. The fix: `package_desktop.py` installs the unit with `AmbientCapabilities=CAP_NET_RAW` and a dedicated `moonlight` user, so installing is `apt install` plus `systemctl enable --now moonlight`. MoonWalk's unit step shrinks to that enable, and the `setcap` step stays for a binary run by hand.
+
+### Downloads off the tick path (2026-10-13)
+
+Every upload moves through the transfer slots; a flash download still writes its whole file on one tick, bounded per chunk by the write deadline. Moving downloads onto the slots too needs a look at how many files the UI reads at once, since two slots answer a third request with 503. Firmware uploads drain whole by design and feed the watchdog.
+
+### An update's connection that would not open until a reset (2026-10-22, from the internal RAM plan)
+
+On 3.0.0 a board could not open the update's connection (`ESP_ERR_HTTP_CONNECT`) until it was reset, with 80 KB of internal RAM free. TLS has lived in PSRAM since then (`CONFIG_MBEDTLS_EXTERNAL_MEM_ALLOC`), which may be what cured it; it has not recurred. Recorded so a recurrence is recognized: the free internal RAM and largest block at that moment are the first readings to take.
+
+### The HTTP server is audited for the two PHP request-handling bug classes (2026-10-21)
+
+PHP's critical advisory of 2026-10-21 (CVE-2026-109618, CVE-2026-109619) names two bug classes any C++ server can have. **Out of memory mid-request**: an allocation fails while a request is half built, and cleanup or a later step treats the partial state as valid. That path is live here: a classic ESP32 fell to 916 bytes free during a page load. **State outliving its request**: a reused connection slot (`wsClients_`, `streams_`) keeps a pointer, length or buffer from its previous client. The audit is a read-only pass over `HttpServerModule` and the platform TCP layer, every allocation-failure path and every slot reuse, and each finding is pinned by a desktop test that forces the failure.
+
 ### Headers link the docs by page, not by host (2026-10-21, from the PR 150 review)
 
 Seventeen headers under `src/` carry absolute `https://moonmodules.org/MoonLight/...` links, so a docs move edits firmware sources and marks every firmware stale, as PR 150's move from `how-to/` to `reference/` did. A header names the page site-relative (`reference/hardware/panel-cards.md#...`) and `gen_help.py` resolves the host once, so the next docs move touches no source file.
@@ -260,7 +276,7 @@ The "public member has no `///`" rule reads a declaration's shape with a regex a
 
 ## A capture device on Linux feeds the Picture service (robwomp, 2026-10-21)
 
-The [Streams plan](../present/Plan-20261013%20-%20Streams,%20every%20frame%20from%20outside.md) brings capture to the ESP32: a USB grabber on the P4 ([#151](https://github.com/MoonModules/MoonLight/pull/151), [#152](https://github.com/MoonModules/MoonLight/pull/152)) and a MIPI-CSI camera.
+The [Streams plan](../present/Plan-20261013%20-%20Streams%2C%20every%20frame%20from%20outside%20(partial).md) brings capture to the ESP32: a USB grabber on the P4 ([#151](https://github.com/MoonModules/MoonLight/pull/151), [#152](https://github.com/MoonModules/MoonLight/pull/152)) and a MIPI-CSI camera.
 On the desktop build a capture device is read through Video4Linux (V4L2), which covers USB grabbers and the HDMI and CSI inputs of boards such as Rockchip SBCs.
 It is one more source of the picture family: the platform layer reads frames, and the Picture service takes them as it takes every other source.
 robwomp has such boards and offered to test on Discord.
@@ -335,7 +351,7 @@ declared rather than for a buffer to fill, and to time out on stall rather than
 - **Live RMII Ethernet reconfigure** — runtime PHY/pin config shipped (`ethType` + pin controls in NetworkModule, per-board defaults in `deviceModels.json`, `platform::setEthConfig`/`ethInit` dispatch). W5500 (SPI) on S3 applies **live** — `ethStop()` tears down the SPI bus and `ethInit()` re-runs on the next `loop1s()` with no reboot. RMII (classic/P4 internal EMAC) still saves config and asks for a restart to apply, because the EMAC bring-up is fiddlier to hot-cycle cleanly. Make RMII live too: a hot `esp_eth_stop` + EMAC/netif teardown + re-init on config change, matching the W5500 path, so every interface honours the no-reboot principle.
 - **GCC below 16 needs four warnings demoted, and nothing exercises those versions** - `-Wnull-dereference`, `-Wrestrict`, `-Wstringop-overflow` and `-Wformat-truncation` fire on provably correct code from GCC 12 through 15 (five of the twelve inside libstdc++ and glibc headers, unreachable from our source), so CMakeLists demotes them to non-fatal there and keeps them fatal on 16+. That unblocks CI and from-source builds on Debian and Raspberry Pi OS alike, but it is a suppression, not an understanding: nobody routinely compiles with 12-15, so a REAL instance of one of these on those versions is now a warning nobody reads. Revisit when the runner's default GCC reaches 16, at which point the whole block can be deleted.
 - **Installer UX polish** — clear "Pre-release (beta)" warning on RC/latest picks, yank-by-asset-tag instead of yank-by-release-deletion.
-- **Offer MoonLight/MoonLight as a library**: a downstream sketch where another firmware/app consumes the light pipeline (or a subset) as an embeddable dependency rather than running the whole binary. `library.json` is already a PlatformIO *library* manifest, so the seed exists. When this is designed, give it a small public **identity surface**: one runtime constant the consumer reads (a `kProjectName`, likely a `ProjectInfo` bundle of name + version + url) that the network wire-strings (ArtNet/E1.31 source-name + CID), the UI banner, and any "About" string all *derive from*: the one place a consumer queries "what am I embedding." This is the genuine home for the name-centralisation that the rename ([the MoonLight plan](../past/plans/Plan-20260922%20-%20MoonLight,%20from%20v5.0.0%20to%20the%20rename%20(shipped).md)) deliberately *didn't* do: the rename is a one-time sweep (a constant would just split it), but a library consumer references the identity ongoing and widely, which is the test a constant must pass. Build it *then*, against the real library API, not speculatively now.
+- **Offer MoonLight/MoonLight as a library**: a downstream sketch where another firmware/app consumes the light pipeline (or a subset) as an embeddable dependency rather than running the whole binary. `library.json` is already a PlatformIO *library* manifest, so the seed exists. When this is designed, give it a small public **identity surface**: one runtime constant the consumer reads (a `kProjectName`, likely a `ProjectInfo` bundle of name + version + url) that the network wire-strings (ArtNet/E1.31 source-name + CID), the UI banner, and any "About" string all *derive from*: the one place a consumer queries "what am I embedding." This is the genuine home for the name-centralisation that the rename ([the MoonLight plan](../past/plans/Plan-20260922%20-%20MoonLight%2C%20from%20v5.0.0%20to%20the%20rename%20(shipped).md)) deliberately *didn't* do: the rename is a one-time sweep (a constant would just split it), but a library consumer references the identity ongoing and widely, which is the test a constant must pass. Build it *then*, against the real library API, not speculatively now.
 - **HTTP: a request split across packets, or a body, that arrives a few ms late is dropped, intermittently (2026-08-20).** `handleConnection` runs SYNCHRONOUSLY inside `tick20ms`, so its waits are kept short to protect the render loop.
   A connection with no bytes yet is parked and served on a later tick (2026-10-09), but a request whose headers arrive in two parts gets **~5 ms** for the rest, and a body **~50 ms** (`empties > 50`).
   A client that misses either budget gets a request processed as truncated, or a `400 {"error":"incomplete request body"}`. Parking these too needs a buffer per parked connection.
@@ -859,7 +875,7 @@ Today the eth-only build profile compiles WiFi out (`MM_NO_WIFI`). Turning WiFi
 
 **Hardware-limit tail (not covered by the pin check).** Pin-uniqueness rejects the common case but not the controller-count limit: the S3 has **2 I2S controllers** regardless of pins, so a 3rd mic on distinct pins passes the pin check yet fails `i2s_new_channel` at runtime. That tail is already handled — the platform I2S init returns false on failure (no panic, module stays `inited_=false`); verified live (4 pinned AudioModules → error spam, no crash). So scope = pin-uniqueness check + the existing graceful-degrade; don't try to make the pin check also model controller counts.
 
-**Related:** the shipped "disabling releases resources" work (see [past plans](../past/plans/index.md)) — a disabled module freeing its pins is what lets the same GPIO be reassigned live without a conflict-reject.
+**Related:** the shipped "disabling releases resources" work (see [past plans](../past/index.md)) — a disabled module freeing its pins is what lets the same GPIO be reassigned live without a conflict-reject.
 
 ### PinsModule — strict reject-on-add mode (the one remaining increment)
 
diff --git a/docs/work/future/backlog-light.md b/docs/work/future/backlog-light.md
index c7d52a2fb..bb5e6c327 100644
--- a/docs/work/future/backlog-light.md
+++ b/docs/work/future/backlog-light.md
@@ -20,6 +20,22 @@ Forward-looking to-build items for the **light domain** (`src/light/`: drivers,
 
 ## Effects
 
+### The ring's refill jitter (2026-10-22, from the internal RAM plan)
+
+LCD-MM's refill interrupt fires every 89 µs at 3-row slices, yet almost every second it goes about 1.1 ms without firing.
+So `ringAuto` keeps 54 rows of lead (3 × 21 buffers, 37 KB on shiffy), where hpwit's S3 driver runs on 10.
+
+Measured with `ringDbg`'s `gap` (within a frame, `@` the slice it ended at), `ml` (the fewest slices of lead) and `c` (the interrupt's core). The gap ends mid-frame as often as at the idle tail.
+
+Ruled out:
+- the flash cache: `co` stays 0;
+- the core: registered on core 1 it was the same, and it broke the cache guard, so it stays on core 0;
+- `mmSnap`: removed.
+
+Next, the gap measured against the frame's own events, the arm and the snapshot, then against other interrupts on core 0.
+
+A lead of 10 rows would free most of the ring's internal RAM.
+
 ### A preview GIF for every MoonLive script (2026-10-19)
 
 The 140 compiled effects each show a GIF on their catalog card (`docs/assets/light/effects/<Type>.gif`, 25 MB in all); the 49 MoonLive effect scripts show none.
@@ -896,7 +912,7 @@ The LED-driver increments **shipped**: increment 1 (RMT/WS2812B single-strand on
 
   **Why it waits.** It is fourteen effects' worth of change across audio-reactive and simulation families, each needing its own judgement about whether to clear, fade, or seed differently — not a mechanical sweep. `unit_Effects_gridsweep.cpp` already measures it (`afterFirst`) and asserts only the settled frame, so the number is visible without blocking.
 
-- **A scripted modifier that animates every frame** (2026-10-11): `MoonLiveModifier` compiles a `modifyLive()` entry, so a script moves lights per frame with `t` (scroll, wobble, sweep) as the compiled Rotate does. Geometry only: dimming is a blend mode or an effect's `mulRGB`, per [the layer compositing plan](../present/Plan-20261011%20-%20Layer%20compositing,%20masks%20and%20transitions.md). Built once a script needs it; the cost to measure is one compiled-script call per light per frame, on an S3 at its largest grid.
+- **A scripted modifier that animates every frame** (2026-10-11): `MoonLiveModifier` compiles a `modifyLive()` entry, so a script moves lights per frame with `t` (scroll, wobble, sweep) as the compiled Rotate does. Geometry only: dimming is a blend mode or an effect's `mulRGB`, per [the layer compositing plan](../present/Plan-20261011%20-%20Layer%20compositing%2C%20masks%20and%20transitions%20(partial).md). Built once a script needs it; the cost to measure is one compiled-script call per light per frame, on an S3 at its largest grid.
 - **A scripted modifier needs a way to drop a light** (2026-08-10). A coordinate slot is a byte, so a script that computes past 255 wraps: `shift.mlv` with a large `amount` lands lights back at the left edge instead of walking them off it. The Layer already drops an out-of-bounds position, but a script has no way to SAY out-of-bounds — every value it can write is a valid coordinate. Needs a sentinel the binding recognizes (or a wider coordinate slot), at which point the "walks off the edge" behavior a scroll modifier wants becomes expressible.
 
 - **A scripted layout loses its control values across a reboot** (2026-08-11). Persistence SAVES them correctly (`/.config/Layouts.json` holds `"0.width":64`), but on boot they are loaded into a control set that does not exist yet: a script's controls are created by `defineControls`, which can only publish what the ENGINE declared, and the engine does not compile until `prepare()` — Scheduler phase 4, after the phase-2b re-bind. So the loaded value has nowhere to land and the script's declared default wins; a saved 64×64 grid comes back 16×16. Verified on the P4 bench.
diff --git a/docs/work/future/backlog-moonlive.md b/docs/work/future/backlog-moonlive.md
index ba1137525..b74cd8fa0 100644
--- a/docs/work/future/backlog-moonlive.md
+++ b/docs/work/future/backlog-moonlive.md
@@ -531,7 +531,7 @@ Two effects written in one session on real hardware: `stadbeest-walk.mle` (a wal
 
 ### 12. A one-to-one port of hpwit's scripts, for a like-for-like comparison (2026-10-19)
 
-hpwit's compiler (`hpwit/new-parser`, `asmparser2`) runs whole C-like programs. His `multi_effect_controller.sc` (800 lines) and the five `ProceduralEffects` were ported to MoonLive on 2026-10-18 (`moonlive/effects/hpwit/`), but as the same LOOK rather than the same program, so code size and frame time do not compare like for like. A one-to-one port needs the language to accept his programs as written. Each construct was compiled on the desktop on 2026-10-19:
+hpwit's compiler (`hpwit/new-parser`, `asmparser2`) runs whole C-like programs. His `multi_effect_controller.sc` (800 lines) and the five `ProceduralEffects` were ported to MoonLive on 2026-10-18 (`moonlive/projects/hpwit/`), but as the same LOOK rather than the same program, so code size and frame time do not compare like for like. A one-to-one port needs the language to accept his programs as written. Each construct was compiled on the desktop on 2026-10-19:
 
 | his scripts use | MoonLive today | what it takes | work |
 |---|---|---|---|
@@ -548,7 +548,7 @@ hpwit's compiler (`hpwit/new-parser`, `asmparser2`) runs whole C-like programs.
 
 Work is in days of agent implementation with the product owner's review, for the parser, the IR and all five backends, each with its tests; S is under a day, M one to two, L a week, XL two. In all about five weeks with `float` mapped onto `fixed`, about seven with a real `float`, the structs and the arena being most of it.
 
-Most rows are general language growth the MoonLive scripts want anyway; the `main()` shim and his host bindings exist only for the comparison, and stay behind a compatibility table rather than entering the standard vocabulary. **Decide first** whether the comparison is worth the compatibility layer, or whether comparing on the ported looks, now in `moonlive/effects/hpwit/`, is enough.
+Most rows are general language growth the MoonLive scripts want anyway; the `main()` shim and his host bindings exist only for the comparison, and stay behind a compatibility table rather than entering the standard vocabulary. **Decide first** whether the comparison is worth the compatibility layer, or whether comparing on the ported looks, now in `moonlive/projects/hpwit/`, is enough.
 
 ## How to know a step landed
 
diff --git a/docs/work/future/input-mapping-analysis.md b/docs/work/future/input-mapping-analysis.md
index 58cdf211c..8ac88f8a5 100644
--- a/docs/work/future/input-mapping-analysis.md
+++ b/docs/work/future/input-mapping-analysis.md
@@ -251,7 +251,7 @@ category confusing:
 - **Ultrasonic (HC-SR04)** is a trigger pulse plus an echo whose *width* is the distance. Neither
   I2C nor a plain read: it needs a **pulse-timing seam** that does not exist. The textbook answer on
   ESP32 is the same PCNT/RMT machinery an encoder wants, so the two features share a dependency.
-- **ToF** is I2C, so it rides the layer above. A **mmWave radar** such as the HLK-LD2450 is UART, so it needs the UART seam the [audio-reactive plan](../present/Plan-20261013%20-%20Audio%20reactive%20live%20performance.md) names.
+- **ToF** is I2C, so it rides the layer above. A **mmWave radar** such as the HLK-LD2450 is UART, so it needs the UART seam the [audio-reactive plan](../present/Plan-20261013%20-%20Audio%20reactive%20live%20performance%20%28not%20started%29.md) names.
 
 **I2S is audio-shaped, and should stay that way.** The platform's I2S surface is `audioMicInit` /
 `audioMicRead`, deliberately named for what it does rather than for the peripheral, and
diff --git a/docs/work/future/moonwalk.md b/docs/work/future/moonwalk.md
index bbd5854d9..fe9fc622e 100644
--- a/docs/work/future/moonwalk.md
+++ b/docs/work/future/moonwalk.md
@@ -1,6 +1,6 @@
 # MoonWalk
 
-Step 2 of [Processes, described once](../present/Plan-20261015%20-%20Processes%2C%20described%20once.md): MoonWalk, the model every process is written in and the map that shows them, chosen against [the inventory](processes-inventory.md) and approved on 2026-10-16. The schema is [moonwalk/moonwalk.schema.json](../../../moonwalk/moonwalk.schema.json).
+Step 2 of [Processes, described once](../present/Plan-20261015%20-%20Processes%2C%20described%20once%20(partial).md): MoonWalk, the model every process is written in and the map that shows them, chosen against [the inventory](processes-inventory.md) and approved on 2026-10-16. The schema is [moonwalk/moonwalk.schema.json](../../../moonwalk/moonwalk.schema.json).
 
 ## What it must do
 
diff --git a/docs/work/future/processes-inventory.md b/docs/work/future/processes-inventory.md
index 4949c2fa6..9e2e6693c 100644
--- a/docs/work/future/processes-inventory.md
+++ b/docs/work/future/processes-inventory.md
@@ -1,6 +1,6 @@
 # Processes inventory
 
-Step 1 of [Processes, described once](../present/Plan-20261015%20-%20Processes%2C%20described%20once.md), the Extract phase: every process MoonLight has, recorded by its content rather than the format it is stored in, counted on 2026-10-16 by three read-only Researchers. Part 1 is the end user's journey, Part 2 the contributor's, product owner's, agents' and CI's, and Part 3 the executable step lists: the scenarios and the MoonTube clips.
+Step 1 of [Processes, described once](../present/Plan-20261015%20-%20Processes%2C%20described%20once%20(partial).md), the Extract phase: every process MoonLight has, recorded by its content rather than the format it is stored in, counted on 2026-10-16 by three read-only Researchers. Part 1 is the end user's journey, Part 2 the contributor's, product owner's, agents' and CI's, and Part 3 the executable step lists: the scenarios and the MoonTube clips.
 
 ## What it found
 
diff --git a/docs/work/past/index.md b/docs/work/past/index.md
index 8117330f1..23fd97bfc 100644
--- a/docs/work/past/index.md
+++ b/docs/work/past/index.md
@@ -4,7 +4,7 @@ Shipped plans and dated records.
 
 **A shipped plan is a working document, not testimony.** Whatever its PR already carries is duplication and can be trimmed or deleted. What earns keeping is the part no PR and no commit holds: the alternatives considered and rejected, and the reason the chosen shape won.
 
-`plans/` holds the plans that shipped before the current rule, when a plan was archived rather than folded into its PR. They map onto merged PRs, and the mapping is the next thing to write here. From now on a plan ends at its PR ([CLAUDE.md, Branch](../../../CLAUDE.md#main-and-branch)), so this folder stops growing.
+`plans/` holds every plan that left `present`, each named with its status: `(shipped)` once every step is built and verified, the judgment steps included, or `(superseded)`, `(cancelled)` or `(attempted, reverted)`. A plan moves here in the pull request that ships or closes it, the product owner's call ([CLAUDE.md, Branch](../../../CLAUDE.md#main-and-branch)).
 
 The prior-version inventories beside it state what was true at a moment and stay unrewritten. Release notes live on [the GitHub release](https://github.com/MoonModules/MoonLight/releases) itself, which is their one home: a copy here drifts from what shipped, and the links in one pinned to an older tag went stale exactly that way.
 
@@ -15,31 +15,3 @@ The prior-version inventories beside it state what was true at a moment and stay
 The surveys of v1, v2 and MoonLight that once sat here are gone. They were written to decide what to harvest into v3, that decision shipped, and each described code that lives in its own repository and in git.
 
 The LED-driver and shift-register design analyses moved to [future](../future/index.md), where the other research documents sit: they were written to decide what to build, and that is what future holds.
-
-## Plans and their PRs
-
-21 plans, each mapped to the merged pull request that carries the same design plus the diff that implemented it. The mapping is derived from title words and merge date, so it is a starting point rather than a record: a `?` means no confident match, and any row is worth checking before it is trusted. 4 need a hand.
-
-| Date | Plan | PR |
-|---|---|---|
-| 2026-08-13 | [MoonLive on a stack machine: the frame is where values live](plans/Plan-20260813%20-%20MoonLive%20on%20a%20stack%20machine%20%E2%80%94%20the%20frame%20is%20where%20values%20live%20%28shipped%29.md) | [#63](https://github.com/MoonModules/MoonLight/pull/63) |
-| 2026-08-17 | [MoonLive scripts are classes](plans/Plan-20260817%20-%20MoonLive%20scripts%20are%20classes%20%28shipped%29.md) | [#65](https://github.com/MoonModules/MoonLight/pull/65) |
-| 2026-08-18 | [A file editor control and a filesystem change seam](plans/Plan-20260818%20-%20A%20file%20editor%20control%20and%20a%20filesystem%20change%20seam%20%28shipped%29.md) | [#67](https://github.com/MoonModules/MoonLight/pull/67) |
-| 2026-08-21 | [MoonLive on Windows](plans/Plan-20260821%20-%20MoonLive%20on%20Windows%20%28x86_64%20host-JIT%20backend%29%20%28shipped%29.md) | [#73](https://github.com/MoonModules/MoonLight/pull/73) |
-| 2026-08-21 | [Particles in MoonLive, plus a fade builtin](plans/Plan-20260821%20-%20Particles%20in%20MoonLive%2C%20plus%20a%20fade%20builtin%20%28shipped%29.md) | [#71](https://github.com/MoonModules/MoonLight/pull/71) |
-| 2026-08-22 | [Raw L2 Ethernet on Windows](plans/Plan-20260822%20-%20Raw%20L2%20Ethernet%20on%20Windows%20%28shipped%29.md) | [#73](https://github.com/MoonModules/MoonLight/pull/73) |
-| 2026-08-23 | [A Windows installer, and settings that persist](plans/Plan-20260823%20-%20A%20Windows%20installer%2C%20and%20settings%20that%20persist%20%28shipped%29.md) | [#74](https://github.com/MoonModules/MoonLight/pull/74) |
-| 2026-08-23 | [Five types for MoonLive scripts](plans/Plan-20260823%20-%20Five%20types%20for%20MoonLive%20scripts%20%28shipped%29.md) | [#77](https://github.com/MoonModules/MoonLight/pull/77) |
-| 2026-08-24 | [NDI output](plans/Plan-20260824%20-%20NDI%20output%20%28shipped%29.md) | [#80](https://github.com/MoonModules/MoonLight/pull/80) |
-| 2026-08-25 | [A lossy channel for the preview](plans/Plan-20260825%20-%20A%20lossy%20channel%20for%20the%20preview%20%28shipped%29.md) | [#81](https://github.com/MoonModules/MoonLight/pull/81) |
-| 2026-08-25 | [Client-driven preview adaptation](plans/Plan-20260825%20-%20Client-driven%20preview%20adaptation%20%28superseded%29.md) | [#81](https://github.com/MoonModules/MoonLight/pull/81) |
-| 2026-08-25 | [Lean preview transport](plans/Plan-20260825%20-%20Lean%20preview%20transport%20%28shipped%29.md) | [#81](https://github.com/MoonModules/MoonLight/pull/81) |
-| 2026-08-27 | [HLS on ESP32-P4](plans/Plan-20260827%20-%20HLS%20on%20ESP32-P4%20%28shipped%29.md) | [#78](https://github.com/MoonModules/MoonLight/pull/78) |
-| 2026-08-27 | [HLS streaming driver](plans/Plan-20260827%20-%20HLS%20streaming%20driver%20%28shipped%29.md) | [#85](https://github.com/MoonModules/MoonLight/pull/85) |
-| 2026-08-27 | [Raw-L2 interface dropdown](plans/Plan-20260827%20-%20Raw-L2%20interface%20dropdown%20%28shipped%29.md) | [#85](https://github.com/MoonModules/MoonLight/pull/85) |
-| 2026-08-27 | [Sprites and flying toasters](plans/Plan-20260827%20-%20Sprites%20and%20flying%20toasters%20%28shipped%29.md) | [#86](https://github.com/MoonModules/MoonLight/pull/86) |
-| 2026-08-30 | [Ship the MoonLive script library](plans/Plan-20260830%20-%20Ship%20the%20MoonLive%20script%20library%20%28shipped%29.md) | [#89](https://github.com/MoonModules/MoonLight/pull/89) |
-| 2026-08-31 | [Scripts declare dimensions and tags](plans/Plan-20260831%20-%20Scripts%20declare%20dimensions%20and%20tags%20%28shipped%29.md) | [#89](https://github.com/MoonModules/MoonLight/pull/89) |
-| 2026-09-22 | [MoonLight, from v5.0.0 to the rename](plans/Plan-20260922%20-%20MoonLight%2C%20from%20v5.0.0%20to%20the%20rename%20%28shipped%29.md) | [#119](https://github.com/MoonModules/MoonLight/pull/119) |
-| 2026-09-22 | [RTSP video out on the P4 and the desktop](plans/Plan-20260922%20-%20RTSP%20video%20out%20on%20the%20P4%20and%20the%20desktop%20%28shipped%29.md) | [#110](https://github.com/MoonModules/MoonLight/pull/110) |
-| 2026-10-02 | [One way to send to many receivers](plans/Plan-20261002%20-%20One%20way%20to%20send%20to%20many%20receivers%20%28shipped%29.md) | [#123](https://github.com/MoonModules/MoonLight/pull/123) |
diff --git a/docs/work/past/lessons.md b/docs/work/past/lessons.md
index 16cd0a1f6..95fae7669 100644
--- a/docs/work/past/lessons.md
+++ b/docs/work/past/lessons.md
@@ -3,7 +3,7 @@
 Hard-won debugging lessons and gotchas, recorded with the code that proved them. The PR-merge *carry-forward* gate writes new entries here (CLAUDE.md § Lifecycle Events). This is the **lesson** record: a bug, its root cause, and the fix. Two neighbours hold the other genres, and a lesson belongs in whichever fits:
 
 - A durable **rule** that graduated from a lesson lives in [CLAUDE.md](../../../CLAUDE.md) or [coding-standards.md](../../contributing/coding-standards.md), not here.
-- The forward-looking **design intent** of a feature is a [plan](plans/index.md).
+- The forward-looking **design intent** of a feature is a [plan](index.md).
 
 Entries run oldest-first by branch. A lesson fully absorbed into a rule doc or the code is pruned (per *Mandatory subtraction*): the git history is the permanent record, this file is the working narrative on top.
 
@@ -533,3 +533,14 @@ Two tests were written and both passed against the unfixed code before one final
 Three weeks without a Windows run left three build breaks waiting, while CI's `build-windows-x64` job was green on the same commit. They were not one bug: `if (anyKnownChip)` and `if (i2sLanes > 0)` are compile-time constants that **this** MSVC (19.44.35227) reports as C4127 and the toolset `windows-latest` pins does not, and `/WX` turns either into C2220. A non-ASCII literal raised C4566, which is not a toolset question at all but the system code page: MSVC alone assumes it for both the source and execution charset, so `/utf-8` settles it the way GCC and clang already behave. On the Python side the same code page is the default for `read_text`, `write_text`, `open` and `subprocess(text=True)`, and `PYTHONIOENCODING` masks only stdio, so a UTF-8 doc read crashes a script whose output looked fine.
 
 **The rule: a platform in CI is one toolchain on that platform, not the platform.** `windows-latest` is a moving pin, so green there says the code built with that toolset on that runner image, which is a weaker claim than it reads as. `if constexpr` is the textbook answer to C4127 and says what was meant anyway; explicit `encoding="utf-8"` is the answer everywhere Python touches a file. The second half of the lesson is cheaper than the first: the drift is silent and the cost scales with how long the platform goes unexercised, so the fix is to run it, not to reason about it.
+
+## Lessons from the internal RAM plan (2026-10-22)
+
+- **Measure at the low point, not on average.** Free RAM read once a second said 70 KB on a classic board whose page load dropped it to 3.6 KB; a task sampling every tick and recording the heap's block sizes at each new low named the owner (1,536-byte TCP segments) in one run.
+- **A block size is a fingerprint.** 32 KB blocks were ESP-IDF's DMA reserve pool, 1,536 bytes a TCP segment, 1,664 WiFi's receive buffers, 4,096 the ring's DMA nodes; matching sizes to owners attributed most of the heap without a tracer.
+- **The obvious owner can be wrong.** Thirty-two queued packets matched WiFi's transmit queue of 32 exactly, and halving that queue changed nothing: they were TCP's.
+- **A tick figure is wall-clock.** Control read 1.4 ms per tick because a helper task on its core preempted it; its own work was 150 µs. The helper itself, meant to halve the ring's prime, cost 12 fps by preempting the effects.
+- **A guard that holds on one core can fail on the other.** A cache-safe interrupt's cache-off check held on the core doing flash writes; moved to the other core, the cache went off mid-refill and the board panicked. Whatever such an interrupt reads must be internal, whichever core it runs on.
+- **Check the compiler's output before optimizing the algorithm.** Removing branches and a whole wasted transpose gained nothing measurable; the disassembly showed the store loop's variable shifts costing more than the transpose, and unrolling them gained 37%.
+- **A depth that runs clean is the measurement, not free RAM.** `ringAuto` took 28 buffers because RAM allowed it; 21 smaller ones run clean, and the RAM went back to WiFi and the UI.
+- **Two fix attempts, then stop.** The ring's 1.1 ms of jitter survived two; it is in the backlog with its measurements rather than chased further.
diff --git a/docs/work/present/Plan-20260915 - Native HUB75 output (shipped).md b/docs/work/past/plans/Plan-20260915 - Native HUB75 output (shipped).md
similarity index 78%
rename from docs/work/present/Plan-20260915 - Native HUB75 output (shipped).md
rename to docs/work/past/plans/Plan-20260915 - Native HUB75 output (shipped).md
index 97e07a006..a5ed92f31 100644
--- a/docs/work/present/Plan-20260915 - Native HUB75 output (shipped).md	
+++ b/docs/work/past/plans/Plan-20260915 - Native HUB75 output (shipped).md	
@@ -4,7 +4,7 @@ Answers [issue #102](https://github.com/MoonModules/MoonLight/issues/102). Phase
 
 ## The gap
 
-MoonLight drives HUB75 panels one way: [PanelCardDriver](../../../src/light/drivers/PanelCardDriver.h) emits ColorLight frames over raw Ethernet to a 5A-75B/E receiving card, which does the HUB75 driving. That path is excellent above roughly 16,384 pixels and it is what the [panel-cards guide](../../reference/hardware/panel-cards.md) documents.
+MoonLight drives HUB75 panels one way: [PanelCardDriver](../../../../src/light/drivers/PanelCardDriver.h) emits ColorLight frames over raw Ethernet to a 5A-75B/E receiving card, which does the HUB75 driving. That path is excellent above roughly 16,384 pixels and it is what the [panel-cards guide](../../../reference/hardware/panel-cards.md) documents.
 
 Below that size it is the wrong shape. The user buys a receiving card, configures it with LEDvision (a Windows tool, not ours), and runs a dedicated Ethernet link, all to light one 64×64 panel that a $10 board could drive from its own pins. WLED does this natively; MoonLight does not. That is the gap, and it is the whole of Phase 1.
 
@@ -18,7 +18,7 @@ frame bytes = (height / 2) × width × bitDepth
 
 Measured against the peripherals MoonLight already has:
 
-Measured from the encoder's own formula (`Hub75Geometry::frameBytes`, pinned by [unit_Hub75Slots.cpp](../../../test/unit/light/unit_Hub75Slots.cpp)), at 1/32 scan:
+Measured from the encoder's own formula (`Hub75Geometry::frameBytes`, pinned by [unit_Hub75Slots.cpp](../../../../test/unit/light/unit_Hub75Slots.cpp)), at 1/32 scan:
 
 | Panels | Geometry | 4-bit | 6-bit | Parlio (65,535 B cap) | LCD_CAM (internal RAM) |
 |---|---|---:|---:|:--|:--:|
@@ -28,9 +28,9 @@ Measured from the encoder's own formula (`Hub75Geometry::frameBytes`, pinned by
 
 Two bytes a slot, since the bus word is 16 bits. **Four panels miss the Parlio cap even at 4-bit, by one byte**, so four panels are an LCD_CAM job at any depth, and Parlio carries one panel at up to 6-bit. The encoder offers 2 to 6 bits; 8-bit waits on repeating the upper planes (backlog).
 
-**This is the fact the issue does not account for.** #102 proposes the P4-Nano as lead candidate because Espressif's reference uses PARLIO, but [platform_esp32_parlio.cpp:238](../../../src/platform/esp32/platform_esp32_parlio.cpp) records the hardware cap: `kParlioMaxTransferBytes = 0x7FFFF / 8` = 65,535 bytes, width-invariant. PARLIO carries one panel comfortably, reaches its limit at four, and cannot do sixteen at any useful depth.
+**This is the fact the issue does not account for.** #102 proposes the P4-Nano as lead candidate because Espressif's reference uses PARLIO, but [platform_esp32_parlio.cpp:238](../../../../src/platform/esp32/platform_esp32_parlio.cpp) records the hardware cap: `kParlioMaxTransferBytes = 0x7FFFF / 8` = 65,535 bytes, width-invariant. PARLIO carries one panel comfortably, reaches its limit at four, and cannot do sixteen at any useful depth.
 
-The route that scales is the one the [shift-register analysis](../future/shift-register-driver-analysis.md) already established for a structurally identical problem: **i80/LCD_CAM, whose DMA reaches PSRAM**, proven on this exact path to 16,384 lights. `hasLcdCam` is true on S3, P4 and S31.
+The route that scales is the one the [shift-register analysis](../../future/shift-register-driver-analysis.md) already established for a structurally identical problem: **i80/LCD_CAM, whose DMA reaches PSRAM**, proven on this exact path to 16,384 lights. `hasLcdCam` is true on S3, P4 and S31.
 
 ### GPIO requirements
 
@@ -43,21 +43,21 @@ HUB75 is pin-hungry in a way the memory table hides. One port needs:
 | Control | `clk lat oe` | 3 |
 | | **Total** | **12-14** |
 
-Against the per-chip free sets in [gpio-usage.md](../../reference/hardware/gpio-usage.md), which exclude flash/PSRAM, input-only, USB, UART0 and strapping pins:
+Against the per-chip free sets in [gpio-usage.md](../../../reference/hardware/gpio-usage.md), which exclude flash/PSRAM, input-only, USB, UART0 and strapping pins:
 
 | Chip | Usable output GPIOs | 1/16 scan (13 pins) | 1/32 scan (14 pins) |
 |---|---:|:--:|:--:|
 | **ESP32-S3** (N16R8) | 16 | ✅ 3 spare | ✅ 2 spare |
 | **ESP32-P4** (P4-NANO) | 20 | ✅ 7 spare | ✅ 6 spare |
-| **ESP32-S31** | board-specific | take from the [coreboard reference](../../reference/hardware/esp32-s31-coreboard.md) | |
+| **ESP32-S31** | board-specific | take from the [coreboard reference](../../../reference/hardware/esp32-s31-coreboard.md) | |
 | **ESP32 classic** | 13 | ❌ | ❌ |
 
 **This settles the target list, and it removes a chip the issue implies.** The classic ESP32 has 13 usable output GPIOs and would need every one for a 1/16-scan port, leaving nothing for the LED strand, a button or a mic; a 1/32 panel does not fit at all. gpio-usage.md already records the same squeeze for 16-lane i80 ("a 16-lane set must borrow strap pins, and GPIO 12 is the flash-voltage strap: driving it at reset can brick the boot"). So HUB75 is an **S3, P4 and S31 feature**, and the classic is out on pins before memory is even considered.
 
 Two consequences for the plan:
 
-- **The board catalog entries in step 5 are load-bearing, not polish.** An S3 has exactly 3 spare pins at 1/16 scan, so a user picking 13 by hand will land on octal-PSRAM (33-37), USB (19-20), UART0 (43-44) or a strap (0, 3, 45, 46). [PinsModule](../../moonmodules/core/system.md) flags a conflict after the fact; a catalog entry prevents it.
-- **Defaults stay unset.** Even with the pins available, a default would guess the user's wiring. Same rule the LED drivers follow, and the P4's own history is the argument: its first LED-driver default landed on strapping pins ([lessons.md](../past/lessons.md)).
+- **The board catalog entries in step 5 are load-bearing, not polish.** An S3 has exactly 3 spare pins at 1/16 scan, so a user picking 13 by hand will land on octal-PSRAM (33-37), USB (19-20), UART0 (43-44) or a strap (0, 3, 45, 46). [PinsModule](../../../moonmodules/core/system.md) flags a conflict after the fact; a catalog entry prevents it.
+- **Defaults stay unset.** Even with the pins available, a default would guess the user's wiring. Same rule the LED drivers follow, and the P4's own history is the argument: its first LED-driver default landed on strapping pins ([lessons.md](../lessons.md)).
 
 ### Refresh
 
@@ -69,7 +69,7 @@ frame time = (height / 2) x bitDepth x line time
 refresh    = 1 / frame time
 ```
 
-Predicted at a 20 MHz shift clock (the rate the i80 path already runs, per the [shift-register analysis](../future/shift-register-driver-analysis.md)), ignoring latch overhead, so these are ceilings rather than promises:
+Predicted at a 20 MHz shift clock (the rate the i80 path already runs, per the [shift-register analysis](../../future/shift-register-driver-analysis.md)), ignoring latch overhead, so these are ceilings rather than promises:
 
 | Geometry | 4-bit | 6-bit | 8-bit |
 |---|---:|---:|---:|
@@ -85,11 +85,11 @@ Predicted at a 20 MHz shift clock (the rate the i80 path already runs, per the [
 
 ### The driver
 
-`Hub75Driver : DriverBase`, registered in [main.cpp](../../../src/main.cpp) beside the others, gated on `platform::hasLcdCam || platform::parlioLanes` so it is offered only where it can run — the same inert-on-wrong-chip rule [ParlioLedDriver](../../../src/light/drivers/ParlioLedDriver.h) follows. That gate happens to exclude the classic ESP32, which § GPIO requirements shows could not host a port anyway.
+`Hub75Driver : DriverBase`, registered in [main.cpp](../../../../src/main.cpp) beside the others, gated on `platform::hasLcdCam || platform::parlioLanes` so it is offered only where it can run — the same inert-on-wrong-chip rule [ParlioLedDriver](../../../../src/light/drivers/ParlioLedDriver.h) follows. That gate happens to exclude the classic ESP32, which § GPIO requirements shows could not host a port anyway.
 
 It is **not** a `LedPeripheral` backend. That seam is shaped around the parallel WS2812 orchestrator (`supportsPinExpander`, `lanesAvailable`, slot encoding), and HUB75 shares none of it: different wire protocol, different buffer shape, different control set. Reusing it would mean a base class whose every method one subclass ignores, which is the abstraction CLAUDE.md's minimalism rule exists to prevent. What they legitimately share is the **platform DMA seam**, and that is where the sharing belongs.
 
-Controls, all defaulting to unset because a soldered pin must never be guessed ([lessons.md](../past/lessons.md)):
+Controls, all defaulting to unset because a soldered pin must never be guessed ([lessons.md](../lessons.md)):
 
 | Control | Why |
 |---|---|
@@ -101,7 +101,7 @@ Controls, all defaulting to unset because a soldered pin must never be guessed (
 | `sPWM` | The [WLED-MM sPWM commit](https://github.com/MoonModules/WLED-MM/commit/778ae558) case |
 | `peripheral` | Which silicon block drives the panel, where the chip has more than one |
 
-**Geometry is not a driver control.** [PanelLayout](../../../src/light/layouts/PanelLayout.h) and [PanelsLayout](../../../src/light/layouts/PanelsLayout.h) already model a serpentine panel and an M×N tiling of them, with configurable axis order and per-axis direction. A layout emits coordinates and the driver owns pins: that separation is the architecture, and HUB75 must not re-litigate it. The issue asks for "UI features to set panel dimensions and arrangement", and the honest answer is that MoonLight already has them.
+**Geometry is not a driver control.** [PanelLayout](../../../../src/light/layouts/PanelLayout.h) and [PanelsLayout](../../../../src/light/layouts/PanelsLayout.h) already model a serpentine panel and an M×N tiling of them, with configurable axis order and per-axis direction. A layout emits coordinates and the driver owns pins: that separation is the architecture, and HUB75 must not re-litigate it. The issue asks for "UI features to set panel dimensions and arrangement", and the honest answer is that MoonLight already has them.
 
 ### The platform seam
 
@@ -115,7 +115,7 @@ bool     hub75Transmit(Hub75Handle& h, uint8_t buffer);
 void     hub75Deinit(Hub75Handle& h);
 ```
 
-Two backends behind it, and **the user picks which**, through a `peripheral` select exactly like the one [ParallelLedDriver](../../../src/light/drivers/ParallelLedDriver.h) already carries. Each backend self-registers at static init, and `main.cpp` links it only where its SOC macro says the silicon exists, so the dropdown's options are per-chip rather than a fixed list: LCD_CAM on an S3 or S31, LCD_CAM and PARLIO on a P4, nothing on a classic.
+Two backends behind it, and **the user picks which**, through a `peripheral` select exactly like the one [ParallelLedDriver](../../../../src/light/drivers/ParallelLedDriver.h) already carries. Each backend self-registers at static init, and `main.cpp` links it only where its SOC macro says the silicon exists, so the dropdown's options are per-chip rather than a fixed list: LCD_CAM on an S3 or S31, LCD_CAM and PARLIO on a P4, nothing on a classic.
 
 **An earlier draft of this plan had the platform choose, on memory alone. That was wrong, and the reason is contention rather than capacity.** A P4 has both peripherals and only one of each. A user driving WS2812 strips from PARLIO needs HUB75 on LCD_CAM; another user wants the reverse. Both are correct, the difference is what else is plugged into that board, and the platform cannot know it. The sibling claim guard stops two drivers colliding on one block, but it cannot guess which driver should win — that is the user's call, and a select is how the repo already asks it.
 
@@ -127,7 +127,7 @@ A desktop stub returning false from everything keeps `mm_tests` and every non-HU
 
 The one genuinely new piece: rendered RGB → bit-plane-major scan buffer. Per bit plane, per scan row, pack six colour bits per pixel-column into the parallel word alongside the row address and the latch/OE timing.
 
-This is the same class of work as [ParallelSlots.h](../../../src/light/drivers/ParallelSlots.h) (serialise a frame through a parallel bus under a DMA ceiling) and is testable the same way: a host unit test that walks a known pattern through the encoder and asserts the exact bytes, including a walking-one per colour line. The '595 investigation's hardest lesson was that an encoder proven byte-for-byte on the host still left a wall-visible artifact, so the test pins the encoder and hardware verification stays the PO's.
+This is the same class of work as [ParallelSlots.h](../../../../src/light/drivers/ParallelSlots.h) (serialise a frame through a parallel bus under a DMA ceiling) and is testable the same way: a host unit test that walks a known pattern through the encoder and asserts the exact bytes, including a walking-one per colour line. The '595 investigation's hardest lesson was that an encoder proven byte-for-byte on the host still left a wall-visible artifact, so the test pins the encoder and hardware verification stays the PO's.
 
 ## End states considered
 
@@ -146,7 +146,7 @@ This is the same class of work as [ParallelSlots.h](../../../src/light/drivers/P
 3. **`Hub75Driver`.** Controls, pin claims through the existing `PinsModule` registry, status line reporting geometry and achieved refresh, registration in `main.cpp`.
 4. **A backend registry, then the PARLIO backend.** The seam built in step 1 picks its peripheral internally; this turns it into an interface the driver selects, mirroring `LedPeripheral` without reusing it (that one is WS2812-shaped — same pattern, own interface). Then PARLIO behind it, and the `peripheral` select on the card. This REVISES step 1 rather than only adding to it.
 5. **Board catalog entries**: Adafruit S3 Portal, Waveshare RGB Matrix, Lilygo S3, ESP32-S3-16MB-PSRAM. Catalog data in `deviceModels.json`, not driver work, and it is what makes the feature findable.
-6. **Docs**: a how-to beside [panel-cards.md](../../reference/hardware/panel-cards.md), the driver's catalog card, and a line in panel-cards.md saying which of the two paths a given wall wants.
+6. **Docs**: a how-to beside [panel-cards.md](../../../reference/hardware/panel-cards.md), the driver's catalog card, and a line in panel-cards.md saying which of the two paths a given wall wants.
 
 Steps 1-3 are the shippable unit. Steps 4-6 each stand alone.
 
@@ -178,7 +178,7 @@ The PO's MoonHub75 (a LILYGO T7-S3 on the passive adapter) drove a 64×64 1/32-s
 ## Risks
 
 - **Refresh at depth may disappoint on 16 panels.** The encoder cost is linear in bit planes and the scan is serial. **Settled by publishing the prediction, not by measuring first**: § Refresh computes the ceiling per geometry and depth, the driver reports what it actually achieves, and the docs name PanelCard as the path above whatever that turns out to be. A user meets the limit with an explanation rather than a surprise.
-- **The [48×256 white-flash](../future/backlog-light.md) is open on the i80 path.** Six theories ruled out, cause unfound. A HUB75 driver rides the same peripheral, so it may inherit it. **Settled by shipping and watching**: Phase 1 targets 1-4 panels, a size at which the flash has never been seen, so it does not block. If a tester on a large HUB75 wall reports it, that is the seventh theory the backlog entry is missing — the flash following a non-WS2812 encoder through the same peripheral would exonerate the WS2812 slot encoding, which six hardware tests could not do.
+- **The [48×256 white-flash](../../future/backlog-light.md) is open on the i80 path.** Six theories ruled out, cause unfound. A HUB75 driver rides the same peripheral, so it may inherit it. **Settled by shipping and watching**: Phase 1 targets 1-4 panels, a size at which the flash has never been seen, so it does not block. If a tester on a large HUB75 wall reports it, that is the seventh theory the backlog entry is missing — the flash following a non-WS2812 encoder through the same peripheral would exonerate the WS2812 slot encoding, which six hardware tests could not do.
 - **Pin count is the tightest constraint on the classic ESP32 and shapes the target list.** See § GPIO requirements: the classic cannot host a full port without a strap pin, so it is excluded rather than half-supported.
 
 ## What this plan does not do
diff --git a/docs/work/present/Plan-20261003 - Ethernet, WiFi and access point as Network submodules (shipped, partly verified).md b/docs/work/past/plans/Plan-20261003 - Ethernet, WiFi and access point as Network submodules (shipped).md
similarity index 98%
rename from docs/work/present/Plan-20261003 - Ethernet, WiFi and access point as Network submodules (shipped, partly verified).md
rename to docs/work/past/plans/Plan-20261003 - Ethernet, WiFi and access point as Network submodules (shipped).md
index 9811b275c..7943462fd 100644
--- a/docs/work/present/Plan-20261003 - Ethernet, WiFi and access point as Network submodules (shipped, partly verified).md	
+++ b/docs/work/past/plans/Plan-20261003 - Ethernet, WiFi and access point as Network submodules (shipped).md	
@@ -150,7 +150,7 @@ Waiting for more devices and a cable:
 
 ## Out of scope at first
 
-The advanced settings users will ask for sooner or later are listed in the backlog's [advanced network settings](../future/backlog-core.md) item: roaming, enterprise WiFi, pinning to one access point, power save, the country code, the access point's address, and IPv6 beyond link-local.
+The advanced settings users will ask for sooner or later are listed in the backlog's [advanced network settings](../../future/backlog-core.md) item: roaming, enterprise WiFi, pinning to one access point, power save, the country code, the access point's address, and IPv6 beyond link-local.
 
 ## Decided
 
diff --git a/docs/work/present/Plan-20261005 - The audio codec as runtime configuration (in PR 129, M3 unverified).md b/docs/work/past/plans/Plan-20261005 - The audio codec as runtime configuration (shipped).md
similarity index 100%
rename from docs/work/present/Plan-20261005 - The audio codec as runtime configuration (in PR 129, M3 unverified).md
rename to docs/work/past/plans/Plan-20261005 - The audio codec as runtime configuration (shipped).md
diff --git a/docs/work/present/Plan-20261009 - Safe mode and factory reset.md b/docs/work/past/plans/Plan-20261009 - Safe mode and factory reset (shipped).md
similarity index 100%
rename from docs/work/present/Plan-20261009 - Safe mode and factory reset.md
rename to docs/work/past/plans/Plan-20261009 - Safe mode and factory reset (shipped).md
diff --git a/docs/work/present/Plan-20261011 - MoonLive Coord3D and RGB types.md b/docs/work/past/plans/Plan-20261011 - MoonLive Coord3D and RGB types (shipped).md
similarity index 89%
rename from docs/work/present/Plan-20261011 - MoonLive Coord3D and RGB types.md
rename to docs/work/past/plans/Plan-20261011 - MoonLive Coord3D and RGB types (shipped).md
index 4553a6d5e..31dd9f3f3 100644
--- a/docs/work/present/Plan-20261011 - MoonLive Coord3D and RGB types.md	
+++ b/docs/work/past/plans/Plan-20261011 - MoonLive Coord3D and RGB types (shipped).md	
@@ -1,10 +1,10 @@
 # Plan: MoonLive `Coord3D` and `RGB` types
 
-Most of what a script handles is a position or a color, and today both are loose integers: a coordinate is three values or an index the script computes by hand, and a color is three bytes that cannot travel together. This plan adds the two predefined types the [language roadmap](../future/backlog-moonlive.md) names as item 4b, so a script reads as its compiled counterpart does: `addRGB(i, getRGB(j))`. It lands now because every script written before it is a script to revisit after it.
+Most of what a script handles is a position or a color, and today both are loose integers: a coordinate is three values or an index the script computes by hand, and a color is three bytes that cannot travel together. This plan adds the two predefined types the [language roadmap](../../future/backlog-moonlive.md) names as item 4b, so a script reads as its compiled counterpart does: `addRGB(i, getRGB(j))`. It lands now because every script written before it is a script to revisit after it.
 
 ## The rule it follows
 
-The vocabulary follows the compiled modules ([MoonLive architecture](../../explanation/architecture/moonlive.md)): `Coord3D` and `RGB` are the C++ types of the same names, and every builtin taking or returning one is a one-line call into the `draw` function that does the same for a compiled effect.
+The vocabulary follows the compiled modules ([MoonLive architecture](../../../explanation/architecture/moonlive.md)): `Coord3D` and `RGB` are the C++ types of the same names, and every builtin taking or returning one is a one-line call into the `draw` function that does the same for a compiled effect.
 
 ## The design: a struct is a named fixed-size array
 
diff --git a/docs/work/present/Plan-20261013 - State by subscription, streamed.md b/docs/work/past/plans/Plan-20261013 - State by subscription, streamed (shipped).md
similarity index 100%
rename from docs/work/present/Plan-20261013 - State by subscription, streamed.md
rename to docs/work/past/plans/Plan-20261013 - State by subscription, streamed (shipped).md
diff --git a/docs/work/present/Plan-20261014 - Help in the UI, from the docs.md b/docs/work/past/plans/Plan-20261014 - Help in the UI, from the docs (shipped).md
similarity index 92%
rename from docs/work/present/Plan-20261014 - Help in the UI, from the docs.md
rename to docs/work/past/plans/Plan-20261014 - Help in the UI, from the docs (shipped).md
index b7a5d9a59..7a19327d7 100644
--- a/docs/work/present/Plan-20261014 - Help in the UI, from the docs.md	
+++ b/docs/work/past/plans/Plan-20261014 - Help in the UI, from the docs (shipped).md	
@@ -114,7 +114,7 @@ The device serves the UI; the **browser** fetches the help whenever it has inter
 - **Without internet**, as on a device's own access point, it uses the cache; with no cache either, the cards show as they do today.
 - **Help per module** opens from the card's title in its levels: the line, then the summary, the picture and the controls, then the details, then the links to the source and the tests.
 - **Help per control** is Material's helper text, one persistent line under the field, never a hover-only tooltip, which Nielsen Norman Group's guidelines warn hides what people need and fails on touch. The pilot compared it with Pickering's ⓘ toggletip and kept the line, since the status bar's ⓘ already shows or hides all help at once. A control with more opens it from its line, behind the module help's arrow.
-- **Off until asked**: the ⓘ in the status bar turns help on, and the first time it asks before downloading, since the request shows GitHub, which hosts the docs site, the browser's address. Privacy by default, GDPR article 25's term; nothing is fetched before the yes. The [privacy policy](../../legal/privacy-policy.md) says so.
+- **Off until asked**: the ⓘ in the status bar turns help on, and the first time it asks before downloading, since the request shows GitHub, which hosts the docs site, the browser's address. Privacy by default, GDPR article 25's term; nothing is fetched before the yes. The [privacy policy](../../../legal/privacy-policy.md) says so.
 
 ## Steps
 
@@ -125,13 +125,13 @@ The change is gradual, the textbook strangler fig: the new path grows module by
 3. ✅ **Layouts, the second catalog.** All seventeen layouts carry their help in their headers, and `layouts.md` is generated from `help.json`: its intro and clip from `LayoutBase` through `@video`, its cards from the headers, and its details from `MoonLiveLayout`'s `@guide`. The layouts credit what they draw on, Boustrophedon for serpentine wiring, polar coordinates for the rings and a conical spiral, through the attribution catalog. A layout is built from others as objects again, its public settings set and placed through `LightEmitter::place`, the relay the Layouts container uses for its children: CarLights and Rings241 from rings, which gain a center, Tubes from columns, Panels from panels and GridBlacks from a grid. Done in 436f37e9.
 4. ✅ **Layouts composed in the tree.** A layout built from other layouts in code, as CarLights is from rings, has a runtime twin: the Layouts container placing each child at a position, so a user builds a car's lights from Ring children without code. To analyze: whether the position is the child's own control, such as a ring's center, or the container's per child, and how the bounding box and the light numbering follow. Done in 436f37e9: the position is the child's own control, Ring's `centerX` and `centerY`, so a user places rings side by side under the Layouts container.
 5. ✅ **Effects, the third catalog.** All seventy effects carry their help in their headers, and `effects.md` is generated from `help.json`: its intro from `EffectBase`, its cards from the headers, and its details from each effect's `@guide`. Each header gets the step 13 sweeps as it moves, as the layouts did: `@attribution` for its `Author:` and `Prior art:` lines, no predecessor links, one comment kind per declaration, a line per control and a trimmed `@technical`. Done in f2e1b2ee.
-6. ✅ **Drivers, the fourth catalog.** All eleven drivers carry their help in their headers, and `drivers.md` is generated from `help.json`: its intro and its two clips from `DriverBase`, its cards from the headers, and the shared controls read through `DriverBase`'s `defineControls`, as the virtual call resolves it. The card's details sections move by who reads them. In the app the user is at the card with a setting in hand, so the help is a glance: what the driver is, what to pick, the one fix when it does not work. On the website the user is sorting something out, which is a how-to page: [choosing and wiring an LED driver](../../reference/hardware/led-drivers.md), [driving a HUB75 panel](../../reference/hardware/hub75-panels.md), [watching the output as video](../../reference/watching-the-output.md) and the panel-card tutorial. So a control's longer help goes to a `/// @guide` line on its member, the choice to a `@guide` section of the module, which never explains a control, tables, steps and reasons to the how-to page the guide links, the mechanism to `@technical`, credit to `@attribution`, and what the code or another page holds is cut. `check_docgen` caps the app help on every generated catalog: 40 words for a control's longer help, 60 for a guide section, 250 for the whole. Done in ef20e444.
+6. ✅ **Drivers, the fourth catalog.** All eleven drivers carry their help in their headers, and `drivers.md` is generated from `help.json`: its intro and its two clips from `DriverBase`, its cards from the headers, and the shared controls read through `DriverBase`'s `defineControls`, as the virtual call resolves it. The card's details sections move by who reads them. In the app the user is at the card with a setting in hand, so the help is a glance: what the driver is, what to pick, the one fix when it does not work. On the website the user is sorting something out, which is a how-to page: [choosing and wiring an LED driver](../../../reference/hardware/led-drivers.md), [driving a HUB75 panel](../../../reference/hardware/hub75-panels.md), [watching the output as video](../../../reference/watching-the-output.md) and the panel-card tutorial. So a control's longer help goes to a `/// @guide` line on its member, the choice to a `@guide` section of the module, which never explains a control, tables, steps and reasons to the how-to page the guide links, the mechanism to `@technical`, credit to `@attribution`, and what the code or another page holds is cut. `check_docgen` caps the app help on every generated catalog: 40 words for a control's longer help, 60 for a guide section, 250 for the whole. Done in ef20e444.
 7. ✅ **System, Services and Supporting, the last catalogs.** Their modules carry their help in their headers by step 6's rules, and the three pages are generated: Services from its container's class comment, which is then no card, and System and Supporting from their own markdown kept as the intro the deck follows. Supporting's classes that are no module become one linked list. Control's details move into the control-surface, presets and home-automation how-tos, and Audio's into a new audio-input how-to. The separate deck pages go, every catalog page being a deck. Done in 18d069d1.
 8. ✅ **The header is the technical reference.** Doxygen, npx moxygen and `gen_api` go, with their installs in the docs job and the 262 pages they generate. The header is what a developer reads, in the repo or on GitHub, so a second rendering of it is a copy to keep in step. Every link into `moxygen/` becomes a link to the header, which the docs build already rewrites to its file on GitHub, and the help's Technical link goes, Source being the same file. `check_docgen` follows: an `@xref` still names a heading in its own file, read as text, and the rules that measured the generated pages (a page nothing links to, an appendix section no page links) go or read the header alone. The supporting lists link headers the same way. Done.
 9. ✅ **The migration**, module by module, each card deleted as its header takes over, so the site and the app stayed complete throughout. All 145 modules take their help from their headers, and a card's details section moved as step 6 sets out. The card bridge in `gen_help` is gone, `help.json` coming out byte for byte the same without it. Done.
-10. ✅ **The checks.** `check_docgen` checks the help in headers. Done: a stale `help.json` fails it, drawn cards meet the card limits, a control line may not state its default or range, every module and every control has its help line, the app help stays within its caps, a control's guide does not repeat its line, the module guide explains no control, a function carrying a macro such as `MM_NONBLOCKING` has its `///`, and every tag emoji groups at least two modules or factory scripts; `check_specs` counts a module documented when the help reads its header. Reading declarations from the clang AST rather than by pattern is in [the core backlog](../future/backlog-core.md).
+10. ✅ **The checks.** `check_docgen` checks the help in headers. Done: a stale `help.json` fails it, drawn cards meet the card limits, a control line may not state its default or range, every module and every control has its help line, the app help stays within its caps, a control's guide does not repeat its line, the module guide explains no control, a function carrying a macro such as `MM_NONBLOCKING` has its `///`, and every tag emoji groups at least two modules or factory scripts; `check_specs` counts a module documented when the help reads its header. Reading declarations from the clang AST rather than by pattern is in [the core backlog](../../future/backlog-core.md).
 11. ✅ **The end state.** The `?` button is gone, the help's Docs link taking its place. A catalog page writes each module under its deck as plain markdown from `help.json`, its name bold rather than a heading so the table of contents lists no card, which search indexes and a reader without JavaScript reads. `split_blocks`, `fill_cards_from_help`, the table renderer, `update_module_docs.py` and the table styles are gone. `check_docgen`'s card rules read `help.json`: the picture and its format, a control line's width, and a line stating its default or range. `check_specs` counts a module documented when the help reads its header, so its page lookup and drift guards are gone.
-12. ✅ **The attribution catalog as a deck.** [The attribution catalog](../../reference/attributions.md) is a card deck drawn from its own table. The table stays the one home, which search indexes and a reader without JavaScript sees, and the deck script turns its rendered rows into cards. A card shows the entry's picture, name and what it is known for, and its back the modules that name it. Its chips are a Kind column: 🧑 a person, 🏢 a company or shop, 🧰 a project or library, 📜 a standard or protocol, 🧮 an algorithm, 🎨 an art form or culture. 🧰 replaces the planned 📦, which the app's chips use for a compiled module. One card builder and one deck serve both kinds of card.
+12. ✅ **The attribution catalog as a deck.** [The attribution catalog](../../../reference/attributions.md) is a card deck drawn from its own table. The table stays the one home, which search indexes and a reader without JavaScript sees, and the deck script turns its rendered rows into cards. A card shows the entry's picture, name and what it is known for, and its back the modules that name it. Its chips are a Kind column: 🧑 a person, 🏢 a company or shop, 🧰 a project or library, 📜 a standard or protocol, 🧮 an algorithm, 🎨 an art form or culture. 🧰 replaces the planned 📦, which the app's chips use for a compiled module. One card builder and one deck serve both kinds of card.
 13. 🚧 **The sweeps**, the last commits before this branch merges: each a mechanical commit of its own, apart from behavioral changes, and under 100 files so a review still reads it whole. In order of size, counted on 2026-10-15:
 
     | # | Sweep | Status or size |
@@ -144,5 +144,5 @@ The change is gradual, the textbook strangler fig: the new path grows module by
     | 5 ✅ | One comment kind per declaration, and its rule | 561 notes in 92 headers, class and file scope; `check_docgen` reports a `//` on a declaration |
     | 6 ✅ | `@defgroup` goes | 137 files and three generators; a file's lead is its first `///` block before any code |
     | 7 ✅ | `@moreinfo` becomes `@technical` | 273 files: the marker, the generators, `check_docgen` and `check_clang_query`, the standards and the tests; the past plans keep the old name as history |
-    | 8 → | `@technical` trimmed, Guides that add | moved to [the processes plan](Plan-20261015%20-%20Processes%2C%20described%20once.md), step 12 |
+    | 8 → | `@technical` trimmed, Guides that add | moved to [the processes plan](../../present/Plan-20261015%20-%20Processes%2C%20described%20once%20(partial).md), step 12 |
 14. ✅ **Publishing.** Each release attaches its `help.json` as `MoonLight-help.json`, which the Pages deploy mirrors beside the release's binaries, and the app reads the copy of the release its device runs, falling back to the site's `help/help.json`. Both answered after the merge's run, and the fallback to the branch's copy is gone.
diff --git a/docs/work/present/Plan-20261020 - Test engine.md b/docs/work/past/plans/Plan-20261020 - Test engine (shipped).md
similarity index 93%
rename from docs/work/present/Plan-20261020 - Test engine.md
rename to docs/work/past/plans/Plan-20261020 - Test engine (shipped).md
index 172a64fd4..f4d30c52a 100644
--- a/docs/work/present/Plan-20261020 - Test engine.md	
+++ b/docs/work/past/plans/Plan-20261020 - Test engine (shipped).md	
@@ -2,7 +2,7 @@
 
 Plan, for the product owner's approval (2026-10-20). Automated tests are one of MoonLight's core strengths, and they run as several separate machines: C++ unit tests, scenarios on the desktop and on a live device, JS and Python tests, and the Python checks (docgen, prose, code, specs). Each has its own runner, its own output and its own report. This plan finds one model above them, so that what exists, what ran and what it found are described once and read by everyone it concerns: the help, MoonWalk, MoonDeck, the docs and CI.
 
-It starts from [Processes, described once](Plan-20261015%20-%20Processes%2C%20described%20once.md), step 17: the map should show which tests cover a step, and the help which tests cover a module and a control. That needs a machine-readable index of the tests, which does not exist. The index is this plan's first result, and the rest follows from it.
+It starts from [Processes, described once](../../present/Plan-20261015%20-%20Processes%2C%20described%20once%20(partial).md), step 17: the map should show which tests cover a step, and the help which tests cover a module and a control. That needs a machine-readable index of the tests, which does not exist. The index is this plan's first result, and the rest follows from it.
 
 ## Why
 
@@ -52,7 +52,7 @@ What the inventory settled:
 
 ## The model (step 2, approved 2026-10-20)
 
-[The schema](../../../moondeck/docs/tests.schema.json) holds the records. Three, all JSON; JUnit and SARIF are what runners and GitHub exchange, and the working model is ours:
+[The schema](../../../../moondeck/docs/tests.schema.json) holds the records. Three, all JSON; JUnit and SARIF are what runners and GitHub exchange, and the working model is ours:
 
 1. **The registry, `tests.json`**: every test by a derived id (`unit:test/unit/core/unit_X.cpp::the digest matches`, `scenario:<name>`, `scenario:<name>#<step>`, `python:`, `js:`, `check:`), with its kind, size, title, file, the **subjects** it is about, the **controls** it sets or expects, the **steps** it proves, and the call that runs it. Generated like `help.json`.
 2. **A run**, under `build/`, never committed: the test id, the git tree id it saw, a status, seconds, and **measurements** (target, metric, value, window). A runner that writes JUnit is read into it.
@@ -84,8 +84,8 @@ No runner is a prerequisite. doctest, the scenario runner, pytest and each check
 Each step ends in something that works and can be seen, and nothing waits for a later step to be useful.
 
 1. ✅ **Inventory**, done 2026-10-20: above.
-2. ✅ **The model**, approved 2026-10-20 with the derived id: this section and [the schema](../../../moondeck/docs/tests.schema.json).
-3. ✅ **`tests.json` and a drawn page on the website**, done 2026-10-20. `moondeck/docs/gen_tests.py` writes the sharded registry (2,607 tests, 195 subjects, an index of 13 KB and a largest shard of 235 KB, 44 KB gzipped), the docs build publishes it as `tests/index.json` and a shard per subject, and `docs/assets/tests.js` draws [the test page](../../reference/tests.md): subjects grouped by the help page of the module (Light · Effects, Core · Services) or by the domain of the tests for internals, with counts, a search, kind filters, each test with its file and line and the command that runs it, and a scenario's steps with the contract and observed range of each measured step, with every test's name in the page as plain text for search. `unit-tests.md` and `scenario-tests.md` are gone, redirected, and the help's Tests links point at the new page. The build found and the fix removed eleven unit tests duplicated in `unit_MoonLiveLayout.cpp`. MoonDeck still draws its own scenario views from `_test_metadata.py` and the perf table in `generate_test_docs.py`, which step 6 replaces with the registry.
+2. ✅ **The model**, approved 2026-10-20 with the derived id: this section and [the schema](../../../../moondeck/docs/tests.schema.json).
+3. ✅ **`tests.json` and a drawn page on the website**, done 2026-10-20. `moondeck/docs/gen_tests.py` writes the sharded registry (2,607 tests, 195 subjects, an index of 13 KB and a largest shard of 235 KB, 44 KB gzipped), the docs build publishes it as `tests/index.json` and a shard per subject, and `docs/assets/tests.js` draws [the test page](../../../reference/tests.md): subjects grouped by the help page of the module (Light · Effects, Core · Services) or by the domain of the tests for internals, with counts, a search, kind filters, each test with its file and line and the command that runs it, and a scenario's steps with the contract and observed range of each measured step, with every test's name in the page as plain text for search. `unit-tests.md` and `scenario-tests.md` are gone, redirected, and the help's Tests links point at the new page. The build found and the fix removed eleven unit tests duplicated in `unit_MoonLiveLayout.cpp`. MoonDeck still draws its own scenario views from `_test_metadata.py` and the perf table in `generate_test_docs.py`, which step 6 replaces with the registry.
 4. ✅ **Help and MoonWalk read it**, done 2026-10-20. A control's help lists the scenarios that set or expect it (46 controls, each link opening that test on the page, proved in the device app as well as on the site's decks), scenarios declare their instances' types once (`instances`, and the generator refuses a step naming an undeclared one), and a step shows "Tested by" for the tests that name it (`steps_proved` in a scenario, `// @step` above a unit test) and for the scenarios that share its control. The build refuses a test naming a step no process has. The unit tests ran 2,585 cases with none failing and the scenario sweep 17 passed with none failing, after the new keys went in. *Result: the links in the help and the map, on the site and in the device's app.*
 5. ✅ **The gaps**, done 2026-10-20: the page's Gaps view lists the 25 device-changing steps no test covers, the 18 help modules no test is about, and the 9 controls a scenario sets that the help does not know. *Result: the list of what to test next.*
 6. ✅ **Runs**, done 2026-10-20. MoonDeck's runners keep each test's last result as a run, in the model's shape (the derived id, a status, seconds, the git tree it saw), under `build/moondeck-logs/`, never committed (`moondeck/docs/test_runs.py`). The page shows it beside the test, "passed in 0 ms, on this tree" or "on an older tree", where the file exists; the public site shows none until CI records its own (step 10). Recorded from: doctest's JUnit (followed live, so MoonDeck's log still streams; subcase runs count for their case, and a shared `.inc` body is one test per target), pytest's and node's JUnit through their flags, each scenario's `PASS`, `FAIL` or `SKIP` from `run_scenario.py`, and MoonDeck's record of each check script. The registry now holds every kind, 3,526 tests: unit, scenario, live, Python, JS and the 15 checks as `check:<script>`, in groups of their own. Results shown on the first run: 2,581 of 2,679 unit tests, 476 of 478 Python, 319 of 322 JS, 17 of 17 scenarios and 6 of 15 checks. What has none, and why: 98 unit tests skipped on this host (arm64 and x86_64 codegen) or generated by a macro the parser cannot see; 15 live scenarios, which need a device; 9 checks MoonDeck has not run on this machine, which the gates fill; 2 Python and 3 JS tests the JUnit names do not reach. *Result: proof of what was tested, on the page.*
diff --git a/docs/work/past/plans/index.md b/docs/work/past/plans/index.md
deleted file mode 100644
index 82a859d76..000000000
--- a/docs/work/past/plans/index.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# Shipped plans
-
-The plans that shipped under the old rule, when a plan was archived rather than folded into its PR. Each maps onto a merged pull request, which carries the same design plus the diff that implemented it.
-
-**These are working documents, not testimony**: editable, trimmable, deletable. Whatever a plan's PR already says is duplication. What earns keeping is the part no PR and no commit holds, the alternatives considered and rejected.
-
-From now on a plan ends at its PR and never lands here ([CLAUDE.md, Branch](../../../../CLAUDE.md#main-and-branch)), so this folder stops growing.
diff --git a/docs/work/present/Plan-20261008 - ESP32-C3 and the Athom bulb.md b/docs/work/present/Plan-20261008 - ESP32-C3 and the Athom bulb (partial).md
similarity index 100%
rename from docs/work/present/Plan-20261008 - ESP32-C3 and the Athom bulb.md
rename to docs/work/present/Plan-20261008 - ESP32-C3 and the Athom bulb (partial).md
diff --git a/docs/work/present/Plan-20261009 - Boards known by name.md b/docs/work/present/Plan-20261009 - Boards known by name (not started).md
similarity index 100%
rename from docs/work/present/Plan-20261009 - Boards known by name.md
rename to docs/work/present/Plan-20261009 - Boards known by name (not started).md
diff --git a/docs/work/present/Plan-20261010 - Teensy 4.1.md b/docs/work/present/Plan-20261010 - Teensy 4.1 (partial).md
similarity index 100%
rename from docs/work/present/Plan-20261010 - Teensy 4.1.md
rename to docs/work/present/Plan-20261010 - Teensy 4.1 (partial).md
diff --git a/docs/work/present/Plan-20261011 - Layer compositing, masks and transitions.md b/docs/work/present/Plan-20261011 - Layer compositing, masks and transitions (partial).md
similarity index 100%
rename from docs/work/present/Plan-20261011 - Layer compositing, masks and transitions.md
rename to docs/work/present/Plan-20261011 - Layer compositing, masks and transitions (partial).md
diff --git a/docs/work/present/Plan-20261013 - Audio reactive live performance.md b/docs/work/present/Plan-20261013 - Audio reactive live performance (not started).md
similarity index 99%
rename from docs/work/present/Plan-20261013 - Audio reactive live performance.md
rename to docs/work/present/Plan-20261013 - Audio reactive live performance (not started).md
index fbabdb407..3740a86bb 100644
--- a/docs/work/present/Plan-20261013 - Audio reactive live performance.md	
+++ b/docs/work/present/Plan-20261013 - Audio reactive live performance (not started).md	
@@ -108,7 +108,7 @@ The sensors, from what is listed to what a stage needs:
 | <img src="../../assets/hardware/sensors/hlk-ld2450.webp" width="80" alt="HLK-LD2450"> | [mmWave radar, HLK-LD2450](https://www.tinytronics.nl/en/sensors/motion/hi-link-hlk-ld2450-24ghz-radar-sensor-module-with-bluetooth) | up to 3 targets with x and y, about 6 m, UART | the cheapest real tracker, working in darkness and haze | Tinytronics €7.00 |
 | <img src="../../assets/hardware/sensors/dw3000.webp" width="80" alt="DWM3000EVB"> | [UWB, Qorvo DWM3000EVB](https://www.digikey.nl/nl/products/detail/qorvo/DWM3000EVB/24367408) | about 10 cm, with anchors and a tag per performer | how professional radio trackers work | DigiKey €31.34 per node |
 | | [PosiStageNet in](https://posistage.net/) | positions from a professional system | MoonLight joining a rig that already tracks | free, open protocol, MIT-licensed SDK |
-| <img src="../../assets/hardware/sensors/p4-csi-camera.webp" width="80" alt="OV5647 camera"> | [A camera on the P4](https://www.tinytronics.nl/en/raspberry-pi/raspberry-pi-compatible-camera-5mp-v1.3) (OV5647, MIPI-CSI) | person detection | later, with the [streams](Plan-20261013%20-%20Streams%2C%20every%20frame%20from%20outside.md) work | Tinytronics €8.00 |
+| <img src="../../assets/hardware/sensors/p4-csi-camera.webp" width="80" alt="OV5647 camera"> | [A camera on the P4](https://www.tinytronics.nl/en/raspberry-pi/raspberry-pi-compatible-camera-5mp-v1.3) (OV5647, MIPI-CSI) | person detection | later, with the [streams](Plan-20261013%20-%20Streams%2C%20every%20frame%20from%20outside%20(partial).md) work | Tinytronics €8.00 |
 
 **On the bench (2026-10-19): two HLK-LD2450 kit B** from Hi-Link's own store, each with a USB-to-serial adapter, a Bluetooth antenna and a cable. The adapter lets the radar be tried on a computer with Hi-Link's tool before the UART seam exists: targets, range and zone exclusion on day one. Two units answer the stage questions: whether two 24 GHz radars side by side interfere, and how their targets merge where their views overlap.
 
diff --git a/docs/work/present/Plan-20261013 - Streams, every frame from outside.md b/docs/work/present/Plan-20261013 - Streams, every frame from outside (partial).md
similarity index 98%
rename from docs/work/present/Plan-20261013 - Streams, every frame from outside.md
rename to docs/work/present/Plan-20261013 - Streams, every frame from outside (partial).md
index fff44f112..6d9d60bd0 100644
--- a/docs/work/present/Plan-20261013 - Streams, every frame from outside.md	
+++ b/docs/work/present/Plan-20261013 - Streams, every frame from outside (partial).md	
@@ -405,6 +405,8 @@ P4 to P4 started the day at about 200 packets/s and 0 to 1 frames. What remains
 
 ## Backlog, found while measuring
 
+- **12,288 lights received at 270 packets a second, 2026-10-22.** P4 Ethernet to shiffy over WiFi, DDP at 40 fps: about 270 of 1,040 packets a second arrive and 10 frames, where the table above has 616 and 23. Not the 3,840-light ring shiffy now drives (the same with ParallelLed off), not WiFi's code in flash (the same with it in IRAM), and 64x64 Art-Net arrives whole at about 1,000 small packets a second; about 400 KB/s against 900 then points at the link, the access point's channel that day, a hypothesis until a run on another channel or access point. The scenario's observed values were not updated from it.
+
 - **A blocking HTTP write freezes the render task under a stream.** `serveState` writes the full `/api/state` (about 35 KB) with a blocking `lwip_write` on the render task; with the S3 receiving 12,288 lights over WiFi the client's acknowledgements slow, the send buffer fills, and the write holds the render task for seconds until the task watchdog reboots the board (backtrace: `handleConnection` → `serveState` → `JsonSink::flushStage` → `lwip_write`, 2026-10-14). The UI no longer reads the full state since state by subscription, so the trigger was the scenario runner's reads at every measure step; only the diagnostic bundle, assign mode and a backup restore still read it, each on a user's explicit action. The textbook fix: write without blocking and resume a partial write on the next tick, as uploads already stream. Check whether the WebSocket state pushes, smaller TCP writes on the same task, can block the same way.
 - **The UDP mailbox of 32 and the paced send task on boards without PSRAM.** `CONFIG_LWIP_UDP_RECVMBOX_SIZE=32` is in the base defaults for every board. It costs about 128 bytes per socket, and on WiFi the queued packets are WiFi's own receive buffers, capped at 32. On Ethernet without PSRAM they come from the internal heap at about 1.6 KB each, so a full queue holds about 50 KB on a classic board with 100 to 170 KB free, which could starve the HTTP server during a burst. Measure it with `scenario_NetworkReceive_two_boards` on a classic Ethernet board (the Olimex at 192.168.1.210) receiving from a P4, reading free heap and the HTTP answers; if it hurts, the 4 MB classic fragments override it with a smaller value. Measure Network Send's paced task there too, with the classic as the sender: about 5.5 KB of internal RAM per driver (a 4 KB stack, the 1.45 KB packet buffer, a timer), and on a single-core chip such as the C3 the send task outranks the frame loop, so each packet briefly interrupts it.
 - **The two-board scenarios on every platform.** `scenario_NetworkReceive_two_boards` and `scenario_NetworkSend_one_sender_many_receivers` run today on S3 boards over WiFi and P4 boards over Ethernet, in all four pairings. Add the Teensy 4.1 (Ethernet), desktop builds over WiFi, and the NanoPi over Ethernet, as sender and as receiver, so every platform's receive cost and loss sits in the same table. A desktop or NanoPi board joins with `--board name=<ip>:8080`. The Teensy build runs bare-metal with no scheduler, so Network Send and Network Receive work inside their tick (`spawnPinnedTask` returns false); QNEthernet fills its receive buffers in an interrupt, so a late drain loses less there. Its runs show whether threads (TeensyThreads or a FreeRTOS port, with stacks in its tight RAM and shared structures made thread-safe) are worth it.
diff --git a/docs/work/present/Plan-20261015 - Processes, described once.md b/docs/work/present/Plan-20261015 - Processes, described once (partial).md
similarity index 97%
rename from docs/work/present/Plan-20261015 - Processes, described once.md
rename to docs/work/present/Plan-20261015 - Processes, described once (partial).md
index 5158aa490..a26e6dcc2 100644
--- a/docs/work/present/Plan-20261015 - Processes, described once.md	
+++ b/docs/work/present/Plan-20261015 - Processes, described once (partial).md	
@@ -45,12 +45,12 @@ Steps 1 to 14 are done, each in a line; git holds how.
 13. ✅ **Tests link to the test list**, 2026-10-19: a module's Tests link opens its entry in the test inventory.
 14. ✅ **The rules on AI, compared**, 2026-10-19: the contributor vouches for every line, answers reviewers in their own words and says what an agent wrote; a root cause is a hypothesis until traced; an agent posts on GitHub only what the product owner read.
 
-**The order from step 15 on**, decided 2026-10-19: the steps run in their numbers. The checks (15) come first, since every later step leans on them. A step's `then` (16) is what the scenarios (17) converge on. The guides (18) are independent, and the standards and the test engine are [a plan of their own](Plan-20261020%20-%20Test%20engine.md). GitHub (19) needs the checks and the processes settled, and its Project (20) comes before the backlog moves into it (21). MoonCloud (22) is last.
+**The order from step 15 on**, decided 2026-10-19: the steps run in their numbers. The checks (15) come first, since every later step leans on them. A step's `then` (16) is what the scenarios (17) converge on. The guides (18) are independent, and the standards and the test engine are [a plan of their own](../past/plans/Plan-20261020%20-%20Test%20engine%20(shipped).md). GitHub (19) needs the checks and the processes settled, and its Project (20) comes before the backlog moves into it (21). MoonCloud (22) is last.
 
 15. ✅ **The checks.** Done 2026-10-20. A step that names a script, a scenario, a page with its anchor or an API operation that does not exist fails the build, as does a module or control `help.json` does not know. A process no runner verifies is reported: none of its steps has a test, CI or an agent that performs it, or a condition the device state answers, listed by `check_docgen` as information, not counted (14 processes today, the ones a person alone can judge), since a count of them could never fall. A check that could not run writes no report: `check_docgen` recorded a missing libclang as an error in `docgen.md`, which a contributor committed (#144); an unchecked result prints and leaves the report alone. [What it checks](../../reference/moonwalk.md#9-what-the-generator-checks).
 16. ✅📖 **Steps that know they are done.** Done 2026-10-20. A step's `then` is what the device shows once the step holds; it lets the app mark a step done and offer the next, and is a test's assertion. The generator derives it for an `add` and a `set`, whose result is their action, so it has one home. A writing `call` carries none unless one is written by hand, since its result is not in its action: the six device-changing steps of `http-api`, `apply-state` and `moonlive-api` now carry one, but a script-declared control such as `hue` is not in `help.json`, so that step has none. The measure holds: every process that changes the device marks itself done. The pass over the 221 manual steps found one that names a concrete control and value (`control-surface/share`), now two `set` steps; the rest name a choice or a value the reader picks. 29 of 478 steps carry a `then`, in 13 processes. The map shows each condition under its step, and a done process names its reason ([how](../../reference/moonwalk.md#2-what-the-map-knows-by-host)).
 17. **Examples of a process: the tests.** A process is the outline, a how-to with the reader's values left open. A scenario is an example of it, Gherkin's Scenario Outline and its Examples (specification by example): it fills in concrete values to prove behavior. What a scenario and a process share is small: the target keys, a module type and a control as `help.json` keys them, and the expectation shape, a scenario's `expect_control` converging on a process's `then`. The link is a key in the test naming the steps it proves, so the map shows a step tested and a renamed step fails the build. The pilot is `Layers_stack_and_blend_live`. The unit tests link the same way, so the process steps orchestrate the whole test system: a test, a scenario and a live run each name the step they prove, the link living in the test, and the map derives per step the tests that cover it, so a reader sees in MoonWalk that a process was tested. This step's check works both ways: a test naming no step that exists fails, and a step no test covers is reported. To decide: whether the step vocabulary learns a loop, so `run_network_live.py` and `run_network_roundtrip.py` become scenarios rather than scripts.
-    - **The test index and the test engine** are [their own plan](Plan-20261020%20-%20Test%20engine.md): `tests.json` replaces the generated test pages and carries the cross-links this step needs, from tests to steps, modules and controls.
+    - **The test index and the test engine** are [their own plan](../past/plans/Plan-20261020%20-%20Test%20engine%20(shipped).md): `tests.json` replaces the generated test pages and carries the cross-links this step needs, from tests to steps, modules and controls.
 18. **Guides that add, and `@technical` trimmed**, from the help plan. A control's `@guide` line says only what its line cannot hold, and a module with depth gets a guide about itself, how it works and how to get a look, rather than one walking its controls. An `@technical` appendix keeps only what neither the code, the test names, the base class nor the help says, one or two sentences each; a fact every module of a role shares is said once in the role's base class. Judgment work over hundreds of headers, read here for the processes it holds: a guide's "how to get a look" is a process's steps, so the inventory of step 1 reads the guides and appendices, and what is procedural moves into a process file rather than being trimmed twice. What is reference rather than reasoning, control tables, protocols and wire formats, moves to `reference/`, so it is the one folder for detail; why the code is built as it is stays at the code, where it changes with it, and the appendix line count falls rather than relocates.
 19. **Executions on GitHub.** A process file is the definition and one run of it is an instance, the split workflow engines make. GitHub keeps the instances; the definition stays in the repo as the one copy. To decide: whether a pull request template and a `CONTRIBUTING.md` are generated from `contribute-pr`, or README's Contributing section links the map. Steps come in two kinds:
     - **Volatile steps** act on a device or in the app, such as a user choosing an effect. Nothing records them, since nothing outside the device changes.
diff --git a/docs/work/present/Plan-20261021 - Internal RAM on the ESP32 (shipped).md b/docs/work/present/Plan-20261021 - Internal RAM on the ESP32 (shipped).md
new file mode 100644
index 000000000..0e3f8a843
--- /dev/null
+++ b/docs/work/present/Plan-20261021 - Internal RAM on the ESP32 (shipped).md	
@@ -0,0 +1,33 @@
+# Plan: internal RAM on the ESP32
+
+Plan of 2026-10-21, every step done 2026-10-22. An ESP32-S3 driving 3,840 lights through a pin expander ran with 63 KB of internal RAM free and a 30 KB largest block, enough for a TLS handshake to fail and a UI refresh to crash it. The goal: as much internal RAM free as the board allows, never less than 100 KB free with a 50 KB largest block.
+
+**Result**: the same board holds 150 to 155 KB free with a 108 KB block, the UI open, at 102 to 107 fps where it ran 75.
+
+## Where it lives now
+
+| What | Home |
+|---|---|
+| The rule: what must be internal and why, the floor, the sends' back-pressure, a board without PSRAM | [MoonCore, Internal RAM](../../explanation/architecture/mooncore.md#internal-ram) |
+| How deep the LCD-MM ring is, and its live counters | [LED drivers, Sizing the MoonI80 ring](../../reference/hardware/led-drivers.md#sizing-the-mooni80-ring) |
+| Each build option and its reason | `esp32/sdkconfig.defaults` |
+| The measurements: the S3 step by step, the ring's depth and encode cost, the P4, the classic, network receive | [performance.md, Internal RAM](../../reference/performance.md#internal-ram) |
+| The floor as a test, and the `browser` step | `scenario_RAM_floor`, [testing.md, Performance contracts](../../reference/testing.md#performance-contracts-contracttarget) |
+| What a user notices | [MIGRATING](../../reference/MIGRATING.md#lcd-mms-ring-is-smaller-and-refuses-psram), [troubleshooting](../../reference/troubleshooting.md#free-memory-is-low-with-the-interface-open) |
+| What it taught | [lessons](../past/lessons.md#lessons-from-the-internal-ram-plan-2026-10-22) |
+| Left open | the ring's refill jitter ([backlog-light](../future/backlog-light.md#the-rings-refill-jitter-2026-10-22-from-the-internal-ram-plan)), the 3.0.0 update-connection symptom ([backlog-core](../future/backlog-core.md#an-updates-connection-that-would-not-open-until-a-reset-2026-10-22-from-the-internal-ram-plan)) |
+
+## What was done
+
+1. WiFi, lwIP and TLS buffers in PSRAM (`CONFIG_SPIRAM_TRY_ALLOCATE_WIFI_LWIP`, `CONFIG_MBEDTLS_EXTERNAL_MEM_ALLOC`).
+2. WiFi's code in flash (`CONFIG_ESP_WIFI_IRAM_OPT`, `_RX_IRAM_OPT` off); network receive measured unchanged.
+3. ESP-IDF's 32 KB DMA reserve pool off (`CONFIG_SPIRAM_MALLOC_RESERVE_INTERNAL=0`), which capped the largest block at its size.
+4. Every plain `malloc` asks PSRAM first (`CONFIG_SPIRAM_MALLOC_ALWAYSINTERNAL=0`), after what a cache-safe interrupt reads went internal by `platform::InternalRamObject`: the bus states, then `ParallelLedDriver` and `MoonI80Peripheral` once a flash write on the other core was seen to cut PSRAM off mid-refill.
+5. Stacks trimmed where measured: `mmEncode` 8 to 5 KB, `improv` 6 to 4 KB; WiFi's NVS config cache off (4.9 KB).
+6. The audio transform's twiddle table built in and freed with the microphone (16 KB).
+7. The LCD-MM ring: its settings on the driver, so a peripheral switch keeps them and a fresh driver reports their defaults; the encode faster than the wire (emit 5,800 to 3,650 cycles a row, gather 1,850 to 1,300); `ringAuto` sized by lead with 3-row buffers (28 buffers to 21, 112 KB to 37 KB); the prime's core-0 helper `mmSnap` removed (+12 fps); the ring refusing PSRAM.
+8. The HTTP server's sends wait while internal RAM is short: embedded files stream across ticks (the LEDs no longer freeze for a slow client), and the file, state and preview sends hold back below half the floor.
+9. `scenario_RAM_floor` and the live runner's `free_internal`, `min_stack_free` and `browser` step.
+10. Found on the way: the Devices card saved the network config to flash on every multicast verdict, and the once-a-second status line at log level Info stalls the render loop on the S3 (troubleshooting).
+
+Decided against: Control following only when viewed (150 µs a second), a tick figure without interruptions (the preemption it served was `mmSnap`), fewer WiFi receive buffers and a smaller TCP send buffer (Art-Net's burst headroom, every board's throughput), `kInternalFreeFloor` as a refusal in every module's `prepare()`, ring buffers and the snapshot in PSRAM (the cache race), ESP-IDF's heap task tracking (it crashed; the standalone heap trace and a low-point sampler did the job).
diff --git a/docs/work/present/Plan-20261022 - Prepare only what a change reshapes (not started).md b/docs/work/present/Plan-20261022 - Prepare only what a change reshapes (not started).md
new file mode 100644
index 000000000..1e597dc40
--- /dev/null
+++ b/docs/work/present/Plan-20261022 - Prepare only what a change reshapes (not started).md	
@@ -0,0 +1,58 @@
+# Plan: prepare only what a change reshapes
+
+Plan of 2026-10-22, a Restructure. A control whose module says `affectsPrepare` makes `Scheduler::reactToControlChange` call `requestPrepareTree()`, and the next frame prepares every module in the tree. hpwit's show moves two Region windows from a service every 20 ms, so the whole tree is prepared 50 times a second. Measured:
+
+- **shiffy** (ESP32-S3, 3,840 lights, LCD-MM): one Region move costs about 0.5 s; with the service running a frame takes 1.0 to 1.7 s, where the five layers alone run at 23 to 28 fps. An opacity change, which prepares nothing, costs nothing.
+- **The desktop** (128×128, Art-Net to an FPP): the frame stays near 5 ms, but each prepare stops and restarts the Art-Net sender's task, and a 128×128 frame takes about 50 ms at its 500 µs packet gap, so the FPP never receives a whole frame.
+- **Both**: every move marks the tree dirty, so `Effects.json` is written to flash about once a second while a show runs.
+
+The goal: a Region move costs a frame or less on shiffy, the Art-Net output keeps flowing with the show running, and a service driving controls does not write flash once a second.
+
+## What exists
+
+- `MoonModule::affectsPrepare(control)` answers yes or no; `ModifierBase` answers yes for every control.
+- `Scheduler::prepareTree()` runs `applyState()` on every top module, which prepares each module and its children, then `onTreePrepared()`.
+- Some modules gate their own prepare: `ParallelLedDriver` reinits the bus only when `frameBytes_` changed. Others redo their work unconditionally: `NetworkSendDriver` stops and restarts its send task, and `MoonLiveEffect` rebuilds its controls.
+- A control declared `live` is driven continuously and is not configuration, so it never marks the tree dirty.
+
+## End states
+
+1. **A change prepares its scope.** `affectsPrepare` returns a scope instead of a yes: none, the module's subtree, its layer, or the tree. The scheduler prepares only that scope at the frame boundary. A module whose prepare changes what another reads, a buffer's size, a channel count or a light count, requests the tree itself. *Gains*: a Region move prepares one layer; drivers and other layers are untouched. *Loses*: every module's prepare must report when its outputs change, and a missed report leaves a stale reader.
+2. **Every prepare is cheap when nothing changed.** The tree is still walked, and each module skips its work when its inputs are unchanged, as `ParallelLedDriver` does. *Gains*: no scheduling change. *Loses*: every module needs its own gate, the walk itself still costs, and a missed gate is a silent slowdown.
+3. **Both: scoped prepares, and gates where a module is prepared anyway.** *Gains*: the smallest cost per change, and a tree prepare also gets cheaper. *Loses*: the most code of the three.
+
+Recommended: **1**. It is the textbook incremental rebuild: work follows the dependency, and the one rule is that a module requests the wider scope when its outputs change. End state 2's gates become optional optimizations inside it.
+
+## Steps
+
+1. **A scope per change.** `affectsPrepare` keeps saying whether a control reshapes; a new `prepareScope()` says how far, `Self`, `Parent` (the nearest container) or `Tree`, defaulting to `Tree` so every existing module behaves as today. `ModifierBase` answers `Parent`. The scheduler holds up to four pending containers per frame, each claimed with one atomic compare-and-swap whatever task asks, a fifth widening the request to the tree: the show moves two layers every frame. `onTreePrepared()` still runs across the tree after a container prepare, so the Control card re-resolves its targets. Unit test: a Region control change prepares its own layer, not a sibling layer, the layout or a driver.
+2. **Escalation by the reader.** `Drivers` records the first layer's shape it sized from (the layer, how many composite, its mapping, light count, channel count, and its buffer's count when the drivers read it directly) and prepares itself again in `onTreePrepared()` when that changed. The reader knows what it reads, so no layer has to guess. Unit test: an unchanged layer leaves the drivers alone, a channel-count change reaches them.
+3. **A service's writes are live.** A value a service writes through the control surface is driven, not configuration: it never marks the tree dirty, so it is never saved, while a person's move is. Unit test: a service script moving a slot leaves the tree clean, and the same move from the API marks it dirty.
+4. **Merging.** Several moves of one container in one frame prepare it once, two containers each once, five the tree. Unit tests.
+5. **A script is read only when it may have changed.** Measuring on shiffy put each layer's rebuild at 37 to 78 ms, almost all of it `MoonLiveScript::sync` reading the script file to hash it, 30 ms for 714 bytes and 70 ms for 1,924 under load. The file API already announces every change through `notifyFileChanged`; a script now reads its file again only after a change in or above its folders, or under a new name. Unit test: an edit nobody announced keeps the compiled program, an announced one recompiles.
+6. **A prepare that changed nothing a module holds keeps it.** The idempotent-prepare rule, broken by two modules met here: `AudioService` reopened its microphone and rebound its sync socket on every prepare, and `NetworkSendDriver` restarted its send task. Each now compares what it opened with. Unit tests for both.
+7. **A layer at opacity 0 above the bottom costs nothing**: it neither renders nor blends, so the show alternates voronoi and the mandala per scene by opacity, with no rebuild. Unit test.
+8. **Measure** with `scenario_MoonLive_hpwit_show` on shiffy and on the desktop with the FPP: the `show` step at 20 fps or more on shiffy, and the FPP still receiving while the service runs.
+
+## Decided
+
+- A value a service writes through the control surface is live and never saved; a person's move is saved (2026-10-22).
+- Core's scope names are domain-neutral: `Self`, `Parent`, `Tree`, a modifier answering `Parent` (2026-10-22).
+- `prepareScope()` beside `affectsPrepare`, rather than a scope replacing its yes or no: two files instead of 25 overrides, the same behavior.
+
+## Cost
+
+About 150 lines of code and 150 of tests. Under 40 bytes in the Scheduler, nothing per module, nothing per frame: the frame boundary already checks the pending prepare.
+
+## Measured (2026-10-22)
+
+| | Before | After |
+|---|---|---|
+| shiffy, show with its service | 1,300 to 1,700 ms a frame | 44 ms, 22 fps, the same as the layers standing still |
+| Waveshare 64×64 HUB75, same | 273 ms | 43 ms, 23 fps |
+| desktop 128×128 to the FPP | Art-Net frozen | about 1,100 fps, the sender undisturbed |
+| flash saves while a show runs | about one a second | none |
+
+## What it removes
+
+The whole-tree prepare on every structural control, and the flash write a running service caused once a second. It adds one virtual and one rule, a module asking for the tree when its outputs change; nothing existing goes, since `affectsPrepare` keeps its meaning.
diff --git a/docs/work/present/Plan-20261023 - JSON in MoonLive services (partial).md b/docs/work/present/Plan-20261023 - JSON in MoonLive services (partial).md
new file mode 100644
index 000000000..fa0b8d308
--- /dev/null
+++ b/docs/work/present/Plan-20261023 - JSON in MoonLive services (partial).md	
@@ -0,0 +1,141 @@
+# Plan: JSON in MoonLive services
+
+Plan of 2026-10-23, a Feature, for approval. A service script fetches JSON from the internet (weather, sports, stocks, news), reads values out of it, and sends JSON to a device, itself included, which is how a script builds its own effects. hpwit's show and the StadBeest autopilot create their layers instead of assuming them, the autopilot on the eyes and the mouth as well, and `jsondemo.mls` shows four live data feeds as scrolling text.
+
+## What exists
+
+- **JSON in core:** `JsonUtil.h` parses into a node tree (`parse`, `member`, `element`, `readInt`, `readString`). Numbers are integers only (`JsonType::Int`, a `long`), so `12.3` cannot be read as it is. `JsonSink` writes JSON.
+- **Applying JSON to the device:** `applyStateDocument` applies a state document in-process, the same engine `PATCH /api/state` and the presets run. A document's changes are saved; only a service's control writes are live (the Scheduler's live-write scope), so neither the API nor `StateSource` has a live document yet.
+- **HTTP in the platform layer:** `httpRequest` sends cleartext HTTP to a LAN host and returns the body; `httpsPost` posts over HTTPS and returns only the status. ESP32 has `esp_http_client` with the certificate bundle (used by the OTA); the desktop has libcurl or WinHTTP. **There is no HTTPS GET that returns a body**, and every public data API needs one.
+- **MoonLive strings:** a `string` is only one of the script's own literals, passed to a builtin; "building, joining or comparing text is out of scope". The script's literals share **128 bytes** (`CompileResult::kStringPool`), and four URLs alone run past that.
+- **Services** run `tick20ms` on the render loop and write only control-surface slots (`setControl("fader2", v)`), as integers.
+- **TextEffect** shows a `text` control (a text area), reachable from a state document.
+
+## The rule this plan follows
+
+The architecture says a script's vocabulary follows the compiled one: every builtin is a thin wrapper around a function compiled code can call. The request puts the JSON functions in the power functions library. That library is the light domain's drawing and math toolbox, and JSON and HTTP are domain-neutral. So the compiled home is core (`core/util` and a core service), as CLAUDE.md asks of a hard construct, and power-functions.md links to it. A compiled module gets every capability a script gets.
+
+## Design
+
+### The `json` type is a handle
+
+MoonLive has no runtime strings, so a JSON document lives on the host and a script holds a **handle** to it: a 4-byte slot like `int`, typed so it cannot be used in arithmetic. Text never passes through the script: it moves from document to document on the host (`jsonCopy`), and a number moves as an `int` or `fixed`.
+
+### Paths are JSON Pointers (RFC 6901)
+
+`"/current/temperature_2m"`, `"/results/0/title"`: the request's own `/x/y/z/temp`, and the textbook. Setting a value is JSON Patch's `replace` (RFC 6902) at a pointer.
+
+### Fetching never blocks the render loop
+
+A DNS lookup and a TLS handshake take seconds on an ESP32. So `getJson` registers a source and answers a handle at once, and a worker task, unpinned at the lowest priority, fetches it and refreshes it every `seconds`. The script reads the last good document (stale-while-revalidate), and `jsonChanged` says a new one arrived. `pushJson` queues likewise. Pushing to the device itself applies the document at the next frame boundary through `applyStateDocument`, as a **live** source, so a show's writes are never saved, the rule the scoped-prepare plan set. Pushing to another MoonLight device sends `PATCH /api/state?live=1`, which applies the document the same way there; any other REST endpoint gets the document as it is.
+
+A script that builds its look this way is the look's one source: the layers it pushes are gone after a reboot, and the script pushes them again at start.
+
+### The script vocabulary (proposal)
+
+| Builtin | Does |
+|---|---|
+| `json d = R"({"Effects": {...}})";` | a document from a literal, parsed once at start: assigning a string to a `json` is the parse |
+| `json d = getJson("https://…", seconds)` | a fetched document, refreshed in the background |
+| `bool jsonChanged(d)` | a new fetch arrived since the last ask |
+| `int jsonInt(d, "/ptr")`, `fixed jsonFixed(d, "/ptr")` | a number, 0 when absent |
+| `jsonSetInt(d, "/ptr", v)`, `jsonSetFixed(d, "/ptr", v)` | write a number |
+| `jsonCopy(dst, "/ptr", src, "/ptr")` | move a value, text included, from one document to another |
+| `json r = pushJson(d)`, `json r = pushJson("host", d)` | apply to this device, or send to another one (its `/api/state`) or any REST endpoint by URL; `d` is a document or a literal, and `r` is the reply |
+
+A JSON document is full of `"`, and a MoonLive literal today has no escapes and ends at the line. The literal gains C++'s raw form, `R"( … )"`: it spans lines and keeps quotes as they are, so a REST body pastes in unchanged. A script is then standalone: everything it sets up is in its own text.
+
+### A missing catalog script is the UI's to fetch
+
+A pushed document can name a catalog script the device does not hold yet, as a preset or a restored backup can. Today only the picker downloads one, in the browser (`mlDownloadScript`), so a push would leave the module empty. Instead the device reports the script as **missing** in its state, and any open UI downloads it with the same function and writes it to the device; the module starts when the file lands. That is a reconciliation loop: the state says what is wanted, the device says what is there, and a client closes the gap. It holds on every device, with HTTPS or without, and adds no download code to the firmware, as the firmware update already lets the browser carry the image for a device without TLS. Until a UI is open the module shows that it is missing. A script stays on the device once downloaded, so an installation that started once with a UI open runs offline.
+
+The request's `weather.getValue("/x")` method syntax would need member calls on a value type in the compiler; the free functions above give the same reach without that, and the sugar can follow.
+
+### The data sources (to verify in step 6: key, size, rate limit, HTTPS)
+
+| Feed | Endpoint (no key unless noted) | Pointer |
+|---|---|---|
+| Weather | Open-Meteo `api.open-meteo.com/v1/forecast?latitude=52.37&longitude=4.90&current=temperature_2m` | `/current/temperature_2m` |
+| Stocks | Alpha Vantage `…/query?function=GLOBAL_QUOTE&symbol=IBM&apikey=demo` (demo key, IBM only); crypto without a key: Coinbase `api.coinbase.com/v2/prices/BTC-USD/spot` | `/Global Quote/05. price`, `/data/amount` |
+| Sports | TheSportsDB test key `3`: `…/api/v1/json/3/eventslast.php?id=133604` | `/results/0/strEvent`, `/results/0/intHomeScore` |
+| News | Spaceflight News `api.spaceflightnewsapi.net/v4/articles/?limit=1` | `/results/0/title` |
+
+Each answer is a few KB or less; a feed that returns hundreds of KB (an ESPN scoreboard) is refused by the size cap rather than parsed.
+
+## Extensions
+
+**Core (compiled, the home):**
+- `JsonUtil`: JSON Pointer get, `replace` at a pointer, copy between documents, decimals read as `fixed` (a number type the parser gains), and serializing a document back to text.
+- `JsonFetch`, a core service with a worker task, unpinned at the lowest priority: a fixed table of sources (URL, period, last document, generation), a push queue, a response size cap (16 KB with PSRAM, 4 KB without), HTTPS on every ESP32 and the desktop, as OTA and MoonCloud use it today.
+- `StateSource::Live`: a document applied under the live-write scope, never saved; `PATCH /api/state?live=1` selects it.
+
+**Platform:** `httpsGet(url, out, cap, timeout)` returning status and body: `esp_http_client` with the certificate bundle on the ESP32, libcurl or WinHTTP on the desktop, unavailable on Teensy (it says so).
+
+**MoonLive:** the `json` keyword as a typed handle (compiler only; the backends see an `int` slot), raw string literals in the lexer, the builtins above in the service table, and a string pool sized to each script's literals instead of the fixed 128 bytes every engine reserves, so a 3 KB template costs 3 KB in the one script that has it.
+
+**UI:** a missing script in the state, from any module, is downloaded by `mlDownloadScript`, the picker's own path, which then has one caller more rather than a second copy.
+
+**Scripts:**
+- hpwit-show creates its six layers, windows and effects with one `pushJson` of a literal at start, then drives them as now.
+- `stadbeest-autopilot.mls` creates the whole beast at start: on the legs, itself, the three looks (walk, orb, thrusters) and the stadbeest-fire palette; on each eye the frog eye, eye orb and Sauron; on the mouth its one effect. Each device's document is a literal in the script, sent to the eyes and mouth by name, such as `stadbeest-eye-left.local`.
+- **One layer per look** on the legs and on each eye, instead of three effects in one layer switched by `enabled`. A scene change crossfades: the autopilot ramps the old look's layer opacity down and the new one's up, as hpwit-show alternates voronoi and mandala. A layer at opacity 0 is skipped, so outside a crossfade the beast renders one look, as now. `switch3` to `switch5` move from `<look>.enabled` to the look layers' opacity, so the eyes still follow over OSC; the StadBeest page's surface table changes with them.
+- `jsondemo.mls` fetches the four feeds and pushes a TextEffect layer per feed, re-pushing the text when `jsonChanged`.
+
+## Impact and challenges
+
+- **Memory.** A TLS handshake needs about 40 KB of heap for as long as the fetch lasts, freed after (`MBEDTLS_INTERNAL_MEM_ALLOC`, a 16 KB receive buffer); the worker's stack, 6 to 8 KB, is internal. Today OTA and MoonCloud start a handshake without looking at the heap: a failed allocation fails the request cleanly, but a handshake that succeeds on a near-full heap holds 40 KB for seconds that WiFi and the web server then miss, rare today and every minute with four feeds. So the client setup that `httpsPost` and `httpsGet` share refuses to start while free internal heap is under the floor plus the handshake, and the caller sees a failure it already handles: a feed skips a round and says so, a MoonCloud post waits for the next. The worker fetches one source at a time. Documents live in PSRAM where there is PSRAM, capped per source.
+- **Render path.** Nothing network-bound runs on it. A push to the device itself applies at the frame boundary; a new layer is a structural change, so the first push of a show rebuilds the tree once and its text updates afterwards prepare nothing.
+- **Security.** A pushed document can reshape the whole device, as the API can: a script is trusted code, the same as today. API keys sit in plain text in `/moonlive`. Fetches go only where the script names.
+- **Several devices.** A push to an eye that is off or rebooting fails; the autopilot pushes again when that device answers, so the beast assembles in any boot order.
+- **No internet at the venue.** The feeds stop and missing scripts stay missing; a show whose scripts were downloaded before runs as it is.
+- **Language.** A new type touches the compiler's type checking and the IR golden table, not the five backends. The string pool change touches every script's memory budget.
+- **Testing.** The desktop gets a stand-in fetch (canned documents per URL) so every builtin is pinned without a network; the real feeds are verified on the bench.
+
+## Estimate
+
+| Step | Work |
+|---|---|
+| 1. JSON Pointer, replace, copy, decimals, serialize, in `JsonUtil`, with tests | 1 day |
+| 2. `httpsGet` on ESP32 and desktop, with a desktop stand-in | 1 to 1.5 days |
+| 3. `JsonFetch`: worker, sources, refresh, push queue; `StateSource::Live` and `?live=1` | 2 days |
+| 4. MoonLive: the `json` handle type, raw string literals, the builtins, the per-script string pool; a missing script in the state, downloaded by the UI | 3 days |
+| 5. hpwit-show and the StadBeest autopilot create their effects; `jsondemo.mls` | 2 days, plus bench time |
+| 6. Verify the four feeds, document (moonlive.md, core services, power-functions link, the StadBeest page, a how-to), MoonWalk | 1 day |
+| **Total** | **about 9.5 to 10 days** |
+
+## Steps
+
+1. Core JSON: pointer get and replace, copy, `fixed` numbers, serialize; unit tests per RFC 6901's own examples.
+2. Platform `httpsGet` beside `httpsPost`, sharing its client setup, which gains the heap check both get; its desktop stand-in; a test against the stand-in, the real one on the bench.
+3. `JsonFetch`: sources, refresh, size cap, push queue; `StateSource::Live` and `?live=1`; tests through the stand-in.
+4. MoonLive: `json` keyword and type checks, raw string literals, the builtins, the per-script string pool; compile tests, IR golden table. A module naming a script the device lacks reports it missing in its state, and the UI downloads it; a UI test with the file absent.
+5. hpwit-show builds its own layers, measured on shiffy and the Waveshare; the StadBeest autopilot builds the legs, eyes and mouth, a layer per look, and crossfades its scenes, measured on the beast (the frame time during a crossfade, when two looks render); `jsondemo.mls` with the four feeds and TextEffect.
+6. Feeds verified, docs, MoonWalk process "Show live data from the internet".
+
+## Decisions (recommended)
+
+- **The compiled home in core** (`JsonUtil`, `JsonFetch`), which power-functions.md links to. JSON and HTTP serve every domain, and a compiled effect (a weather display) gets the same calls.
+- **Free functions now** (`jsonInt(d, "/p")`). They are one builtin each; `d.getValue("/p")` is sugar the compiler can add later as a rewrite to the same call, once scripts show they want it.
+- **Documents as raw literals in the script, with a per-script string pool.** A script that sets up its look is standalone, with no data file to ship beside it, and the pool sized to a script's literals costs no byte it does not use.
+- **A missing script is downloaded by the UI, not the device.** One download path for the picker, a push, a preset and a backup, on every device, Teensy included.
+- **HTTPS on every ESP32**, as OTA and MoonCloud use it today: a standalone device shows internet data with no other machine running. An HTTPS request, MoonCloud's included, waits for heap rather than taking the internal RAM floor.
+- **Every push is live, to the device itself and to another one.** The script is the look's one source and builds it again at start, so a show writes no flash and a reboot returns the device to its saved state.
+
+## What it removes
+
+Nothing in code: it adds a type, a service, a state source and a platform call. hpwit-show no longer needs its layers set up by a scenario first, so `scenario_MoonLive_hpwit_show`'s layer steps shrink to staging the scripts. The StadBeest page's per-device setup by hand becomes "install the autopilot on the legs".
+
+## Where it stands (2026-10-23)
+
+Steps 1 to 6 are built, desktop-tested and run on shiffy and the Waveshare; the StadBeest waits for the beast, which was offline.
+
+What the build changed from the plan:
+- **The rule for a busy target.** A second push to a target with one on its way waits and replaces any that waited before it, so no update is lost; dropping it lost text updates.
+- **Text and numbers from services.** Many services quote their numbers (`"price":"252.11"`), so `jsonInt` and `jsonFixed` read a quoted number, and a script joins text with `jsonAppendText` and `jsonAppend`. `\uXXXX` escapes decode to UTF-8. Every call a script has: [the MoonLive language](../../moonmodules/light/moonlive.md#json-documents-in-a-service).
+- **Certificates.** Every Google Trust Services site (Coinbase, TheSportsDB, Spaceflight News) failed on the ESP32 with "No matching trusted root certificate found": it serves GTS Root R4 cross-signed by GlobalSign. `CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY` fixes it, for every board.
+- **`.local` names.** `esp_http_client` resolves through DNS alone, so the ESP32's `httpFetch` looks a `.local` host up over mDNS first.
+- **TheSportsDB's test key** is `123`; `3` is retired.
+- **The StadBeest's looks** fade through `encoder6` to `encoder8`, since a switch writes true or false and an opacity needs 0 to 255; `switch3` to `switch5` are freed.
+- **`httpsPost`** is gone: MoonCloud posts through `JsonFetch` on the worker, over `httpFetch`, the one client every request shares, so the heap check covers it too.
+
+Still to see on hardware: the StadBeest (its parts' names, `MM-eye1.local`, `MM-eye2.local`, `MM-mouth.local`, are a guess for the mouth), a board without PSRAM fetching over HTTPS, and the missing-script download through an open page.
diff --git a/docs/work/present/index.md b/docs/work/present/index.md
index 59a86acac..991166ba1 100644
--- a/docs/work/present/index.md
+++ b/docs/work/present/index.md
@@ -2,22 +2,8 @@
 
 One file per plan being built now, as `Plan-YYYYMMDD - <title>.md`.
 
-A plan is written in plan mode, approved before work starts, and edited as reality changes. **Its life ends at its PR**: the plan becomes the PR description and the file is deleted in that same PR ([CLAUDE.md, Branch](../../../CLAUDE.md#main-and-branch)). The merged PR is then the design record, and it carries the diff the plan describes.
+A plan is written in plan mode, approved before work starts, and edited as reality changes. **It leaves at its PR**: the PR description links it, and the file moves to [past/plans](../past/index.md) in that same PR ([CLAUDE.md, Branch](../../../CLAUDE.md#main-and-branch)). The plan is then the design record beside the merged PR, which carries the diff it describes.
 
-A file here that no longer has work behind it is either finished, and belongs in its PR, or abandoned, and belongs deleted.
+A file here that no longer has work behind it is either finished, and belongs in past, or abandoned, and moves there as `(cancelled)`.
 
-## Next (2026-10-13)
-
-1. **[Boards known by name](Plan-20261009%20-%20Boards%20known%20by%20name.md)**, not started. A setting that points at another board resolves its name through MoonLight's own Devices discovery before mDNS, and cards name their peers. It also gives the Teensy board names, since its lwIP has no mDNS lookup: a `.local` name never resolves there, and a driver waits on it rather than saying so.
-2. **[Layer compositing](Plan-20261011%20-%20Layer%20compositing%2C%20masks%20and%20transitions.md), step 3: transitions.** Steps 1 and 2 shipped in #137. The old effect fades out while the new one fades in, with one ramp type shared with the boot soft start; a Discord request.
-3. **Downloads on the tick path.** Every upload now moves through the transfer slots; a flash download still writes its whole file on one tick, bounded per chunk by the write deadline. Moving downloads onto the slots too needs a look at how many files the UI reads at once, since two slots answer a third request with 503. Firmware uploads drain whole by design and feed the watchdog.
-
-| Plan | State |
-|---|---|
-| Teensy 4.1, State by subscription, MoonLive Coord3D and RGB | shipped in #137 |
-| Native HUB75 output | shipped |
-| Network submodules | shipped, partly verified |
-| Audio codec | in PR 129, M3 unverified |
-| ESP32-C3 and the Athom bulb | open, waiting on the bulb |
-| Input mapping, Gamepads and MIDI desks, Presets as state documents, Code ratchets | partial |
-| Test engine | built in PR 150, all ten steps |
+A file name carries its status as the [past plans](../past/index.md) do: `(not started)` before the first step, `(partial)` while some are built, and `(shipped)` once every step is built and verified, the judgment steps included.
diff --git a/esp32/main/CMakeLists.txt b/esp32/main/CMakeLists.txt
index 9a9e29ffa..5f5e9dd12 100644
--- a/esp32/main/CMakeLists.txt
+++ b/esp32/main/CMakeLists.txt
@@ -7,6 +7,7 @@ idf_component_register(
         "../../src/module_types.cpp"
         "../../src/core/module/Control.cpp"
         "../../src/core/util/JsonUtil.cpp"
+        "../../src/core/util/JsonFetch.cpp"
         "../../src/core/util/parse.cpp"
         "../../src/core/util/ScratchBuffer.cpp"
         "../../src/core/system/HttpServerModule.cpp"
@@ -183,8 +184,8 @@ add_custom_target(ui_embed DEPENDS ${UI_DIR}/ui_embedded.h)
 # a script is added or removed, so the catalog cannot go stale against the repo.
 set(MOONLIVE_DIR ${COMPONENT_DIR}/../../moonlive)
 set(MOONLIVE_GEN ${COMPONENT_DIR}/../../src/core/moonlive)
-file(GLOB MOONLIVE_SCRIPTS CONFIGURE_DEPENDS
-     ${MOONLIVE_DIR}/effects/*.mle ${MOONLIVE_DIR}/layouts/*.mll ${MOONLIVE_DIR}/modifiers/*.mlm)
+file(GLOB_RECURSE MOONLIVE_SCRIPTS CONFIGURE_DEPENDS
+     ${MOONLIVE_DIR}/*.mle ${MOONLIVE_DIR}/*.mll ${MOONLIVE_DIR}/*.mlm ${MOONLIVE_DIR}/*.mls ${MOONLIVE_DIR}/*.mlp)
 # See the desktop CMakeLists: the file LIST is a dependency, so a DELETED script regenerates the
 # catalog rather than lingering in it.
 string(REPLACE ";" "\n" MOONLIVE_SCRIPT_LIST "${MOONLIVE_SCRIPTS}")
diff --git a/esp32/sdkconfig.defaults b/esp32/sdkconfig.defaults
index 4c5a9e799..c9c71299c 100644
--- a/esp32/sdkconfig.defaults
+++ b/esp32/sdkconfig.defaults
@@ -116,3 +116,19 @@ CONFIG_PARLIO_OBJ_CACHE_SAFE=y
 
 # The SPI master's interrupt in flash, not IRAM: no SPI user here needs it while the flash cache is off, and IRAM is the classic's scarcest memory.
 CONFIG_SPI_MASTER_ISR_IN_IRAM=n
+
+# Internal RAM is kept for what DMA and the cache-off paths need (Plan Internal RAM on the ESP32).
+# WiFi, lwIP and TLS buffers in PSRAM; both depend on PSRAM in Kconfig, so a board without it drops them.
+CONFIG_SPIRAM_TRY_ALLOCATE_WIFI_LWIP=y
+CONFIG_MBEDTLS_EXTERNAL_MEM_ALLOC=y
+# A chain served through a cross-signed root, as every Google Trust Services site serves GTS Root R4 under GlobalSign, verifies against the bundled root anywhere in the chain rather than only the last issuer.
+CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY=y
+# No reserve pool: it carves 32 KB from the main internal region, which capped the largest block at 31 KB; the 100 KB free floor is the net instead.
+CONFIG_SPIRAM_MALLOC_RESERVE_INTERNAL=0
+# Every plain malloc asks PSRAM first; what an interrupt reads with the cache off asks for internal RAM by capability (platform::InternalRamObject).
+CONFIG_SPIRAM_MALLOC_ALWAYSINTERNAL=0
+# WiFi's hot paths run from flash rather than internal RAM (step 4): about 15 to 20 KB, at some WiFi throughput.
+CONFIG_ESP_WIFI_IRAM_OPT=n
+CONFIG_ESP_WIFI_RX_IRAM_OPT=n
+# WiFi keeps no copy of its config in NVS: the WiFi card hands it the credentials at every join, and the copy cost 4.9 KB of internal RAM.
+CONFIG_ESP_WIFI_NVS_ENABLED=n
diff --git a/esp32/sdkconfig.defaults.task-cpu-stats b/esp32/sdkconfig.defaults.task-cpu-stats
index 86ba6a297..d0be254d0 100644
--- a/esp32/sdkconfig.defaults.task-cpu-stats
+++ b/esp32/sdkconfig.defaults.task-cpu-stats
@@ -1,5 +1,5 @@
-# Opt-in FreeRTOS run-time stats — appended only for a --task-cpu-stats profiling build (see
-# build_esp32.py). Enables the per-task CPU% counter TasksModule shows behind MM_TASK_CPU_STATS.
+# Opt-in profiling — appended only for a --task-cpu-stats build (see build_esp32.py). Enables the per-task
+# CPU% counter TasksModule shows behind MM_TASK_CPU_STATS.
 # NOT in the base sdkconfig.defaults because it reads a timer on every context switch (~5% tick,
 # measured). The esp_timer clock source is the cheap default for the run-time counter.
 CONFIG_FREERTOS_GENERATE_RUN_TIME_STATS=y
diff --git a/moondeck/MoonDeck.md b/moondeck/MoonDeck.md
index d5e912333..7534ea69f 100644
--- a/moondeck/MoonDeck.md
+++ b/moondeck/MoonDeck.md
@@ -1050,7 +1050,9 @@ uv run moondeck/build/build_esp32.py --firmware esp32-16mb
 uv run moondeck/build/build_esp32.py --firmware esp32s3-n16r8
 ```
 
-Auto-detects ESP-IDF installation, sets target if needed, builds, and shows flash/RAM usage summary. Each firmware writes into `build/esp32-<firmware>/`, so switching firmwares (or building several in one session) keeps every variant on disk — no clean rebuild on switch.
+Auto-detects ESP-IDF installation, sets target if needed, builds, and shows flash/RAM usage summary. Each firmware writes into `build/esp32-<firmware>/`, so switching firmwares (or building several in one session) keeps every variant on disk, with no clean rebuild on switch.
+
+An edited `sdkconfig` fragment reaches every build that uses it. IDF seeds `sdkconfig` from the fragments only when the file is absent, so each build dir records a digest of its fragments in `sdkconfig.fragments.sha256`. When they differ, the build deletes that `sdkconfig` and runs `idf.py reconfigure` (`sdkconfig_fragments.py`, shared with the MoonBase build), so only what reads a changed option recompiles. A value set by hand in menuconfig goes with it: the fragments are the config's one source.
 
 The Ethernet PHY type and pin map are runtime config, not baked in: each firmware carries the driver(s) its chip can host (RMII EMAC for classic, W5500 SPI for S3), and `deviceModels.json` supplies the per-board PHY/pins. The `esp32` / `esp32-eth` builds default to the common LAN8720 RMII pins (PHY reset on GPIO 5, MDIO addr 0, clock GPIO 17 — e.g. the [Olimex ESP32-Gateway](https://www.olimex.com/Products/IoT/ESP32/ESP32-GATEWAY/open-source-hardware)); a board with different pins (e.g. WT32-ETH01: reset on GPIO 16) just needs a different `deviceModels.json` entry — no rebuild.
 
@@ -1110,13 +1112,15 @@ The script never touches git, since the commit and the tag stay yours.
 
 ### serve_firmware
 
-Serve a built firmware over HTTP so a board can install it by URL. Long-running.
+Serve a built firmware over HTTP so a board can install it by URL. Long-running: the **Serve for OTA** card on the ESP32 tab serves the selected firmware until Stop.
 
 ```bash
-uv run moondeck/run/serve_firmware.py esp32 --port 8099
-uv run moondeck/run/serve_firmware.py build/moonbase-esp32/MoonLight-moonbase.bin --port 8098
+uv run moondeck/run/serve_firmware.py --firmware esp32 --port 8099
+uv run moondeck/run/serve_firmware.py --firmware build/moonbase-esp32/MoonLight-moonbase.bin --port 8098
 ```
 
+For a device MoonDeck lists, the **OTA** button on its Live row does the same in one click: MoonDeck serves the image itself and hands the device the URL. The card is for a device it does not list, MoonBase's own page, or a board on another network.
+
 Takes a firmware name (resolved to the app image in `build/esp32-<name>/`) or a path to any `.bin`, and
 prints the LAN URL to paste into the Firmware card or MoonBase's own page. The file is re-read per
 request, so a rebuild needs no restart.
diff --git a/moondeck/build/build_esp32.py b/moondeck/build/build_esp32.py
index 87454a49c..d35dd2d8b 100644
--- a/moondeck/build/build_esp32.py
+++ b/moondeck/build/build_esp32.py
@@ -15,6 +15,7 @@
 from pathlib import Path
 
 import compute_version   # sibling: the one place a version string is derived
+import sdkconfig_fragments   # sibling: a changed fragment regenerates a build dir's sdkconfig
 from moonbase_images import MOONBASE_BIN, build_migrate, build_moonbase   # sibling: the images that carry MoonBase
 
 ROOT = Path(__file__).resolve().parent.parent.parent
@@ -731,6 +732,12 @@ def stale_feature_cache(build_dir: Path, extra: list[str], chip: str) -> str | N
     return None
 
 
+def fragment_paths(extra: list[str]) -> list[Path]:
+    """The sdkconfig fragments a build passes in SDKCONFIG_DEFAULTS, in their merge order."""
+    frags = next((a.split("=", 1)[1] for a in extra if a.startswith("-DSDKCONFIG_DEFAULTS=")), "")
+    return [ESP32_DIR / name for name in frags.split(";") if name]
+
+
 def build_dir_for(firmware: str) -> Path:
     """Return the per-firmware build directory.
 
@@ -841,12 +848,15 @@ def main():
               f"cache ({stale}); removing it for a clean reconfigure.")
         shutil.rmtree(build_dir)
 
+    # A chip in PREVIEW_TARGETS needs `--preview` on idf.py itself, before the action, or
+    # set-target and reconfigure refuse it.
+    preview = ["--preview"] if chip in PREVIEW_TARGETS else []
+    digest = sdkconfig_fragments.refresh(cmd + preview + b_arg + extra, build_dir,
+                                         fragment_paths(extra), ESP32_DIR, env)
+
     if not build_dir.exists():
         print(f"Setting target to {chip} (firmware: {firmware}, build dir: "
               f"{build_dir.relative_to(ROOT)})...")
-        # A preview chip (esp32s31 today) needs `--preview` on idf.py itself,
-        # before the action, or set-target refuses it.
-        preview = ["--preview"] if chip in PREVIEW_TARGETS else []
         r = subprocess.run(cmd + preview + b_arg + extra + ["set-target", chip],
                            cwd=ESP32_DIR, env=env)
         if r.returncode != 0:
@@ -856,6 +866,7 @@ def main():
     r = subprocess.run(cmd + b_arg + extra + ["build"], cwd=ESP32_DIR, env=env)
     if r.returncode != 0:
         sys.exit(r.returncode)
+    sdkconfig_fragments.record(build_dir, digest)
 
     # Show flash/RAM usage summary
     subprocess.run(cmd + b_arg + ["size"], cwd=ESP32_DIR, env=env)
diff --git a/moondeck/build/moonbase_images.py b/moondeck/build/moonbase_images.py
index 8f361bfc7..08c4695e3 100644
--- a/moondeck/build/moonbase_images.py
+++ b/moondeck/build/moonbase_images.py
@@ -4,13 +4,13 @@
 build_esp32.py calls both after the app build for a variant that carries them.
 """
 
-import shutil
 import subprocess
 import sys
 from pathlib import Path
 
 import compute_version   # sibling: the one place a version string is derived
 from generate_build_info import build_id   # sibling: the one place the build id is derived
+import sdkconfig_fragments   # sibling: a changed fragment regenerates a build dir's sdkconfig
 
 ROOT = Path(__file__).resolve().parent.parent.parent
 
@@ -40,15 +40,9 @@ def build_moonbase(cmd: list[str], env: dict, chip: str, version: str = "") -> N
         # The library.json default the app resolves through build_info.h's #ifndef, rather than a git-describe string the app cannot compare against.
         version = compute_version.compute("local", "")
     b_arg.append(f"-DPROJECT_VER={version}+{build_id()}")
-    # Same trap as stale_feature_cache: IDF generates sdkconfig from the defaults only when it is
-    # absent, so an edited moonbase/sdkconfig.defaults silently changes nothing. One defaults file
-    # here, so mtime is a sufficient staleness signal.
-    gen = build_dir / "sdkconfig"
-    defaults = moonbase_dir / "sdkconfig.defaults"
-    if gen.exists() and defaults.stat().st_mtime > gen.stat().st_mtime:
-        print(f"MoonBase build dir {build_dir.name} predates sdkconfig.defaults; "
-              "removing it for a clean reconfigure.")
-        shutil.rmtree(build_dir)
+    # An edited moonbase/sdkconfig.defaults regenerates the sdkconfig, as the app's fragments do.
+    digest = sdkconfig_fragments.refresh(cmd + b_arg, build_dir, [moonbase_dir / "sdkconfig.defaults"],
+                                         moonbase_dir, env)
     if not build_dir.exists():
         print(f"Setting MoonBase target to {chip}...")
         r = subprocess.run(cmd + b_arg + ["set-target", chip], cwd=moonbase_dir, env=env)
@@ -58,6 +52,7 @@ def build_moonbase(cmd: list[str], env: dict, chip: str, version: str = "") -> N
     r = subprocess.run(cmd + b_arg + ["build"], cwd=moonbase_dir, env=env)
     if r.returncode != 0:
         sys.exit(r.returncode)
+    sdkconfig_fragments.record(build_dir, digest)
     binp = build_dir / MOONBASE_BIN
     if binp.exists():
         kb = binp.stat().st_size / 1024
diff --git a/moondeck/build/sdkconfig_fragments.py b/moondeck/build/sdkconfig_fragments.py
new file mode 100644
index 000000000..aa4a3da25
--- /dev/null
+++ b/moondeck/build/sdkconfig_fragments.py
@@ -0,0 +1,49 @@
+"""Keep a build dir's generated sdkconfig in step with the fragments it was seeded from.
+
+IDF seeds sdkconfig from SDKCONFIG_DEFAULTS only when the file is absent, so a value changed
+inside a fragment never reaches an existing build dir. Each build dir records a digest of its
+fragments, names and contents in their merge order; when they differ, the sdkconfig is deleted
+and regenerated by `idf.py reconfigure`, which keeps the build incremental where a wiped dir
+would rebuild everything. A value set in menuconfig goes too, since the fragments are the one
+source of the config.
+"""
+
+import hashlib
+import subprocess
+import sys
+from pathlib import Path
+
+# The record of what a build dir's sdkconfig was generated from, beside it.
+RECORD = "sdkconfig.fragments.sha256"
+
+
+def digest(paths: list[Path]) -> str:
+    """The SHA-256 of the fragments, names and contents in their merge order, since the last one setting an option wins."""
+    h = hashlib.sha256()
+    for path in paths:
+        h.update(path.name.encode() + b"\0")
+        h.update((path.read_bytes() if path.exists() else b"") + b"\0")
+    return h.hexdigest()
+
+
+def changed(build_dir: Path, value: str) -> bool:
+    """Whether the fragments differ from the ones `build_dir`'s sdkconfig was generated from; a dir with no record counts as changed, since nothing says what seeded it."""
+    record = build_dir / RECORD
+    return not record.exists() or record.read_text(encoding="utf-8").strip() != value
+
+
+def refresh(idf: list[str], build_dir: Path, paths: list[Path], cwd: Path, env: dict) -> str:
+    """Regenerate `build_dir`'s sdkconfig when its fragments changed, `idf` being the idf.py command with its build-dir arguments; answers the digest to record once the build succeeded."""
+    value = digest(paths)
+    if build_dir.exists() and changed(build_dir, value):
+        print(f"The sdkconfig fragments changed since {build_dir.name} was configured; regenerating its sdkconfig from them.")
+        (build_dir / "sdkconfig").unlink(missing_ok=True)
+        r = subprocess.run(idf + ["reconfigure"], cwd=cwd, env=env)
+        if r.returncode != 0:
+            sys.exit(r.returncode)
+    return value
+
+
+def record(build_dir: Path, value: str) -> None:
+    """Note what the sdkconfig was generated from, once the build succeeded, so an interrupted configure is regenerated next time."""
+    (build_dir / RECORD).write_text(value + "\n", encoding="utf-8")
diff --git a/moondeck/docs/gen_help.py b/moondeck/docs/gen_help.py
index f40792f52..ce0bc1fdd 100644
--- a/moondeck/docs/gen_help.py
+++ b/moondeck/docs/gen_help.py
@@ -139,12 +139,24 @@ class ToolchainMissing(Exception):
     """libclang or the LLVM that carries it is not on this host: the help cannot be generated here, which is no fault of the help."""
 
 
+def know_every_cursor_kind(ci):
+    """Register each cursor kind the bindings lack under a placeholder name: the `libclang` wheel's bindings stop at an older list than the library they load, and a kind missing from it, such as a system header's `flag_enum` attribute, raises on `.kind`. No rule here matches a placeholder."""
+    kinds = getattr(ci.CursorKind, "_kinds", None)
+    if kinds is None:   # newer bindings are an Enum that knows its library's kinds
+        return
+    for value in range(1, 1024):
+        if value >= len(kinds) or kinds[value] is None:
+            setattr(ci.CursorKind, f"UNKNOWN_{value}", ci.CursorKind(value))
+            kinds = ci.CursorKind._kinds
+
+
 def load_clang():
     """libclang and the flags that find the standard headers. The library comes from the LLVM `check_clang_query` uses when one is installed, else from the `libclang` wheel; the resource dir comes from that LLVM's clang, as the wheel ships no headers."""
     try:
         import clang.cindex as ci
     except ImportError as e:
         raise ToolchainMissing(f"libclang for Python is not installed: {e}") from e
+    know_every_cursor_kind(ci)
     from check_clang_tidy import _find_tool, _toolchain_args
     anchor = _find_tool("clang-query") or _find_tool("clang")
     if not anchor:
@@ -159,12 +171,18 @@ def load_clang():
     return ci, (["-resource-dir", resource] if resource else []) + _toolchain_args()
 
 
-def _referenced_field(expr):
-    """The member an argument names, through casts and array decay; None for a temporary."""
+def _referenced_field(expr, through_accessor=False):
+    """The member an argument names, through casts and array decay, or with `through_accessor` the one an accessor it calls returns; None for a temporary."""
     for node in expr.walk_preorder():
         ref = node.referenced
         if ref is not None and ref.kind.name in ("FIELD_DECL", "VAR_DECL"):
             return ref
+        if through_accessor and node.kind.name == "CALL_EXPR" and ref is not None and ref.kind.name == "CXX_METHOD":
+            # An accessor such as `char* lastSavedStr() { return lastSaveStr_; }` publishes the member it returns.
+            body = ref.get_definition()
+            ret = next((n for n in body.walk_preorder() if n.kind.name == "RETURN_STMT"), None) if body is not None else None
+            if ret is not None:
+                return _referenced_field(ret, through_accessor)
     return None
 
 
@@ -199,7 +217,7 @@ def control_help(text: str) -> dict:
 
 
 def controls_of(cls) -> dict:
-    """Each control the `defineControls` the class runs publishes, in order, with its comment: the `///` on the member the `add…` call names, else the run above the call or a `///<` behind it; empty when there is neither. A call to one of the class's own methods is followed as the virtual call resolves it, so a base's template method and its helpers count, and a branch on a method returning a literal `true` or `false` follows that value."""
+    """Each control the `defineControls` the class runs publishes, in order, with its comment: the `///` on the member the `add…` call names, else the run above the call or a `///<` behind it, else the member an accessor in the call returns; empty when there is neither. A call to one of the class's own methods is followed as the virtual call resolves it, so a base's template method and its helpers count, and a branch on a method returning a literal `true` or `false` follows that value."""
     controls, entered = {}, set()
 
     def own(node):
@@ -230,14 +248,21 @@ def visit(node):
             name = _literal(args[0]) if args and callee.startswith("add") else None
             if name:
                 field = _referenced_field(args[1]) if len(args) > 1 else None
-                controls[name] = (comment_text(field.raw_comment) if field is not None else "") \
-                    or _line_comment(node)
+                # A member the call names says it; else the call's own comment, then the member an accessor returns.
+                named = comment_text(field.raw_comment) if field is not None else ""
+                behind = _referenced_field(args[1], through_accessor=True) if len(args) > 1 and not named else None
+                controls[name] = named or _line_comment(node) or (comment_text(behind.raw_comment) if behind is not None else "")
                 return
             method = own(node)
             if method is not None and method.hash not in entered:
                 entered.add(method.hash)
                 visit(method)
                 return
+            # A strategy handed the control list, such as a driver's peripheral, declares controls the module shows: each override can run, so each one's count.
+            for impl in _overrides_given_controls(node):
+                if impl.hash not in entered:
+                    entered.add(impl.hash)
+                    visit(impl)
         for child in node.get_children():
             visit(child)
 
@@ -247,6 +272,28 @@ def visit(node):
     return controls
 
 
+def _overrides_given_controls(call) -> list:
+    """Every definition of the virtual method `call` reaches on another object when it is handed a `ControlList`, one per class in the unit that derives from the method's class: which one runs is decided at run time, so each declares controls the module can show."""
+    ref = call.referenced
+    if ref is None or ref.kind.name != "CXX_METHOD" or not ref.is_virtual_method():
+        return []
+    if not any("ControlList" in a.type.spelling for a in ref.get_arguments()):
+        return []
+    base = ref.semantic_parent
+    unit = call.translation_unit.cursor
+    impls = []
+    for c in unit.walk_preorder():
+        if c.kind.name not in ("CLASS_DECL", "STRUCT_DECL") or not c.is_definition() or c.spelling == base.spelling:
+            continue
+        if not _is_base_or_self(c, base):
+            continue
+        method = _runs(c, ref.spelling)
+        if method is not None and method.semantic_parent is not None and method.semantic_parent.spelling != base.spelling \
+                and all(m.hash != method.hash for m in impls):
+            impls.append(method)
+    return impls
+
+
 def _is_base_or_self(cls, other) -> bool:
     """Whether `other` is the class or one of its bases, the classes whose methods a call on `this` reaches."""
     queue, seen = [cls], set()
diff --git a/moondeck/docs/gen_tests.py b/moondeck/docs/gen_tests.py
index f9e938e74..3416c7dff 100644
--- a/moondeck/docs/gen_tests.py
+++ b/moondeck/docs/gen_tests.py
@@ -5,8 +5,8 @@
 # ///
 """Generate the test registry: every unit test and scenario by a derived id, sharded by subject.
 
-The registry is the test engine's index (docs/work/present/Plan-20261020 - Test engine.md, its schema is
-tests.schema.json). `index.json` lists the subjects with their counts and `<subject>.json` holds the tests about
+The registry is the test engine's index, its schema tests.schema.json (the plan that designed it, Test engine,
+lives in docs/work while it is open). `index.json` lists the subjects with their counts and `<subject>.json` holds the tests about
 one subject, so a page or a device fetches only what it opens, as MoonWalk fetches a process's text. The docs build
 publishes them; run as a script, it writes only the tests of each process step, for the preview server.
 
diff --git a/moondeck/docs/screenshot_modules.py b/moondeck/docs/screenshot_modules.py
index 3aaaf0899..2554fcf24 100644
--- a/moondeck/docs/screenshot_modules.py
+++ b/moondeck/docs/screenshot_modules.py
@@ -400,12 +400,10 @@ def set_control(host: str, module: str, control: str, value) -> bool:
 # name a `script` control resolves against.
 SCRIPT_DIR = "/moonlive"
 
-# Where each script extension lives in the repo, imported rather than restated: catalog_scripts.py
-# is the one home for the extension-to-role-to-folder mapping, and a second copy here would drift
-# the moment a role is added.
+# The script extensions, imported rather than restated: catalog_scripts.py is their one home, and a
+# second copy here would drift the moment a role is added.
 sys.path.insert(0, str(ROOT / "src" / "core" / "moonlive"))
-from catalog_scripts import ROLE_BY_EXT, FOLDER_BY_ROLE   # noqa: E402
-SCRIPT_SRC = {ext: FOLDER_BY_ROLE[role] for ext, role in ROLE_BY_EXT.items()}
+from catalog_scripts import ROLE_BY_EXT   # noqa: E402
 
 
 def push_script(host: str, name: str) -> bool:
@@ -417,8 +415,8 @@ def push_script(host: str, name: str) -> bool:
 
     Byte-exact through /api/file, the same request the File Manager's upload makes.
     """
-    # Names are unique across a role's subfolders (the catalog generator enforces it), so the first match is the one.
-    src = next((ROOT / "moonlive" / SCRIPT_SRC.get(Path(name).suffix, "")).rglob(name), None) if Path(name).suffix in SCRIPT_SRC else None
+    # Names are unique across every folder under moonlive/ (the catalog generator enforces it), so the first match is the one.
+    src = next((ROOT / "moonlive").rglob(name), None) if Path(name).suffix in ROLE_BY_EXT else None
     if src is None or not src.is_file():
         return False
     r = _post(f"http://{host}/api/file?path={SCRIPT_DIR}/{name}",
diff --git a/moondeck/moondeck_config.json b/moondeck/moondeck_config.json
index 3b40add3b..c588a29c4 100644
--- a/moondeck/moondeck_config.json
+++ b/moondeck/moondeck_config.json
@@ -375,6 +375,17 @@
       "needs_firmware": true,
       "pass_port_device_model": true
     },
+    {
+      "id": "serve_firmware",
+      "tab": "esp32",
+      "group": "flash",
+      "label": "Serve for OTA",
+      "help": "serve_firmware",
+      "script": "run/serve_firmware.py",
+      "needs_firmware": true,
+      "long_running": true,
+      "process_name": "serve_firmware.py"
+    },
     {
       "id": "check_encodings",
       "tab": "esp32",
diff --git a/moondeck/run/serve_firmware.py b/moondeck/run/serve_firmware.py
index 3098843a3..38cc65d48 100644
--- a/moondeck/run/serve_firmware.py
+++ b/moondeck/run/serve_firmware.py
@@ -55,7 +55,8 @@ def _lan_ip() -> str:
 def main() -> int:
     ap = argparse.ArgumentParser(description=__doc__,
                                  formatter_class=argparse.RawDescriptionHelpFormatter)
-    ap.add_argument("firmware", help="path to the .bin, or a firmware name under build/esp32-<name>/")
+    ap.add_argument("--firmware", required=True,
+                    help="a firmware name, served from build/esp32-<name>/, or the path to any .bin")
     ap.add_argument("--port", type=int, default=8099)
     args = ap.parse_args()
 
diff --git a/moondeck/scenario/run_live_scenario.py b/moondeck/scenario/run_live_scenario.py
index d58b902cf..97671ca77 100644
--- a/moondeck/scenario/run_live_scenario.py
+++ b/moondeck/scenario/run_live_scenario.py
@@ -1,4 +1,8 @@
 #!/usr/bin/env python3
+# /// script
+# requires-python = ">=3.11"
+# dependencies = ["playwright"]
+# ///
 """Run scenario tests against a live device via HTTP.
 
 Same JSON format as the in-process runner. Executes steps via REST API
@@ -143,11 +147,64 @@ def collect_metrics(client: Client, settle_s: float = 1.5) -> dict:
     try:
         state = client.get("/api/state")
         metrics["dynamicBytesTotal"] = _sum_dynamic_bytes(state)
+        metrics["minStackFree"], metrics["minStackTask"] = _min_stack_free(state)
     except Exception:
         metrics["dynamicBytesTotal"] = None
     return metrics
 
 
+def _min_stack_free(state: dict):
+    """The task with the least stack headroom on the Tasks card, as (bytes, name), or (None, None) where the card lists none."""
+    least = (None, None)
+    def walk(modules):
+        nonlocal least
+        for m in modules:
+            for c in m.get("controls", []) if m.get("type") == "TasksModule" else []:
+                if c.get("name") != "tasks" or not isinstance(c.get("value"), list):
+                    continue
+                for t in c["value"]:
+                    free = t.get("stack")
+                    if isinstance(free, int) and (least[0] is None or free < least[0]):
+                        least = (free, t.get("name"))
+            walk(m.get("children", []))
+    walk(state.get("modules", []))
+    return least
+
+
+_browser = {}
+
+
+def _browser_page():
+    """The one browser page the run's `browser` steps share, started on first use; Playwright and Chromium are MoonDeck's, installed by install_playwright.py."""
+    if "page" not in _browser:
+        from playwright.sync_api import sync_playwright
+        _browser["pw"] = sync_playwright().start()
+        _browser["browser"] = _browser["pw"].chromium.launch()
+        _browser["page"] = _browser["browser"].new_page()
+    return _browser["page"]
+
+
+def _browser_close():
+    """Close the browser, if a `browser` step opened one; also run at exit, so a failed run leaves no viewer on the device."""
+    if "browser" in _browser:
+        _browser["browser"].close()
+        _browser["pw"].stop()
+    _browser.clear()
+
+
+atexit.register(_browser_close)
+
+
+def _floor_verdict(metric: str, value, floor, tolerance_pct: float):
+    """A contract floor: (passed, line). The device must deliver at least `floor`, less by more than the tolerance failing; a value of None or 0 against a positive floor fails, since the device then reports none."""
+    if not value or value <= 0:
+        return False, f"  FAIL  {metric} {value} (the device reports none) vs contract {floor}"
+    drop_pct = (floor - value) * 100.0 / floor if value < floor else 0
+    if drop_pct > tolerance_pct:
+        return False, f"  FAIL  {metric} {value} dropped {drop_pct:.1f}% below contract {floor}"
+    return True, f"  PASS  {metric} {value} >= contract {floor} (within -{tolerance_pct}% tolerance)"
+
+
 def _control_value(module: dict, name: str):
     """Return the value of a named control on a module, or None.
 
@@ -594,7 +651,7 @@ def _fixture_canvas(fixture: list) -> list:
 def run_scenario(client: Client, scenario_path: Path, settle_s: float = 1.5,
                  update_contract: bool = False, update_observed: bool = False,
                  update_reason: str | None = None, named: bool = True,
-                 network: str | None = None, boards: dict | None = None) -> dict:
+                 network: str | None = None, boards: dict | None = None, keep: bool = False) -> dict:
     """Run a scenario against a live device and return results.
 
     Mode handling (see docs/reference/testing.md § Scenario modes):
@@ -846,7 +903,8 @@ def run_scenario(client: Client, scenario_path: Path, settle_s: float = 1.5,
                 # absent file, so reporting PASSED afterwards is the silent pass this op exists
                 # to prevent: the same rule the desktop runner applies.
                 path_ = step.get("path")
-                body = step.get("value", "")
+                # `from` stages a file of the repository, such as a shipped script, so its source keeps one home.
+                body = (ROOT / step["from"]).read_text(encoding="utf-8") if "from" in step else step.get("value", "")
                 if not path_:
                     print(f"  WRITE {step_name}: missing path")
                     step_result["status"] = "skipped" if step.get("optional") else "error"
@@ -1246,6 +1304,21 @@ def redirect_request(self, *args, **kwargs):
                 if not holds:
                     results["passed"] = False
 
+            elif op == "browser":
+                # A real browser on the device's UI, for what a page load and an open card cost the device: open, refresh, close.
+                action = step.get("action", "open")
+                if action == "close":
+                    _browser_close()
+                else:
+                    page = _browser_page()
+                    if action == "open":
+                        page.goto(client.base + "/", wait_until="domcontentloaded")
+                    else:
+                        page.reload(wait_until="domcontentloaded")
+                    page.wait_for_timeout(int(float(step.get("settle", 5)) * 1000))
+                print(f"  BROWSER {action}")
+                step_result["status"] = "ok"
+
             elif op == "measure":
                 # Pure measurement step (introduced for the build-up scenario shape).
                 # No REST call; the measure block below picks it up via step["measure"]
@@ -1291,7 +1364,7 @@ def redirect_request(self, *args, **kwargs):
             # step, and break out of the step loop so end-of-run cleanup
             # (delete created modules) still fires.
             try:
-                metrics = collect_metrics(client, settle_s)
+                metrics = collect_metrics(client, float(step.get("settle", settle_s)))   # a step that needs longer to reach its steady state says so
             except Exception as e:
                 print(f"  FAIL  {step_name}: collect_metrics failed: {e}")
                 step_result["status"] = "error"
@@ -1310,8 +1383,8 @@ def redirect_request(self, *args, **kwargs):
             heap = metrics.get("freeHeap", 0)
             max_block = metrics.get("maxBlock", 0)
             model_bytes = metrics.get("dynamicBytesTotal")
-            print(f"  MEASURE  tick={tick_us}us (FPS={fps})  heap={heap}  "
-                  f"block={max_block}  model={model_bytes}")
+            print(f"  MEASURE  tick={tick_us}us (FPS={fps})  heap={heap}  internal={metrics.get('freeInternal')}  "
+                  f"block={max_block}  stack={metrics.get('minStackFree')} ({metrics.get('minStackTask')})  model={model_bytes}")
 
             # Per-step contract: { "contract": { "<target>": { "tick_us": N,
             #   "free_heap": M, "tick_tolerance_pct": P, "heap_tolerance_pct": Q,
@@ -1353,53 +1426,29 @@ def redirect_request(self, *args, **kwargs):
                     else:
                         print(f"  PASS  tick {tick_us}us vs contract {exp_tick}us "
                               f"(over by {overshoot:.0f}us within {allowed:.0f}us)")
-                if exp_heap is not None and exp_heap > 0:
-                    # Contract is a *floor*: the device must deliver at least this
-                    # much free heap. More is better; less by more than tolerance is
-                    # a regression. Tolerance applies because of legitimate run-to-
-                    # run drift in lwIP/TCP buffer pools.
-                    drop_pct = (exp_heap - heap) * 100.0 / exp_heap if heap < exp_heap else 0
-                    if drop_pct > heap_tol_pct:
-                        print(f"  FAIL  free_heap {heap} dropped {drop_pct:.1f}% "
-                              f"below contract {exp_heap}")
-                        results["passed"] = False
-                    else:
-                        print(f"  PASS  free_heap {heap} >= contract {exp_heap} "
-                              f"(within -{heap_tol_pct}% tolerance)")
-                # max_alloc_block contract is also a *floor*: opt-in per scenario.
-                # The LUT/buffer allocators need a single contiguous chunk; on a
-                # fragmented heap the largest block can be much smaller than free
-                # heap, and Layer silently degrades to 1:1 (mirror disappears) when
-                # the LUT won't fit. Scenarios that depend on that allocation
-                # succeeding assert a minimum block here.
-                exp_block = contract_block.get("max_alloc_block")
-                if exp_block is not None and exp_block > 0:
-                    # max_block of 0 always fails when a positive floor is
-                    # asserted: maxBlock is always served by current firmware
-                    # (src/core/system/HttpServerModule.cpp), so 0 means the device
-                    # reports zero contiguous heap: a real failure, not a
-                    # missing field. (Contrast with free_heap on desktop where 0
-                    # is the "unlimited" sentinel: that's a desktop-only
-                    # convention not used by the live runner.)
-                    if max_block <= 0:
-                        print(f"  FAIL  max_alloc_block {max_block} (device reports no "
-                              f"contiguous heap) vs contract {exp_block}")
+                # Floors: the device must deliver at least this much, less by more than the tolerance being a regression.
+                # Free heap and the largest block drift with lwIP's pools, so they carry the heap tolerance; a stack's headroom is exact.
+                # The block floor is what an allocator needing one contiguous chunk depends on, and free internal RAM is what WiFi and HTTP need on a board with PSRAM.
+                floors = (("free_heap", heap, exp_heap, heap_tol_pct),
+                          ("max_alloc_block", max_block, contract_block.get("max_alloc_block"), heap_tol_pct),
+                          ("free_internal", metrics.get("freeInternal"), contract_block.get("free_internal"), heap_tol_pct),
+                          ("min_stack_free", metrics.get("minStackFree"), contract_block.get("min_stack_free"), 0))
+                for metric, value, floor, tol in floors:
+                    if floor is None or floor <= 0:
+                        continue
+                    ok, line = _floor_verdict(metric, value, floor, tol)
+                    print(line + (f" ({metrics.get('minStackTask')})" if metric == "min_stack_free" else ""))
+                    if not ok:
                         results["passed"] = False
-                    else:
-                        drop_pct = (exp_block - max_block) * 100.0 / exp_block if max_block < exp_block else 0
-                        if drop_pct > heap_tol_pct:
-                            print(f"  FAIL  max_alloc_block {max_block} dropped {drop_pct:.1f}% "
-                                  f"below contract {exp_block}")
-                            results["passed"] = False
-                        else:
-                            print(f"  PASS  max_alloc_block {max_block} >= contract {exp_block} "
-                                  f"(within -{heap_tol_pct}% tolerance)")
 
             sample = {
                 "tick_us": int(tick_us),
                 "free_heap": int(heap),
                 "max_alloc_block": int(max_block),
             }
+            for metric, key in (("free_internal", "freeInternal"), ("min_stack_free", "minStackFree")):
+                if metrics.get(key) is not None:
+                    sample[metric] = int(metrics[key])
             # The window is this machine's, kept in the local store; the scenario file takes the summary only when asked.
             local = _observed.record(scenario.get("name", scenario_path.stem), step.get("name", "?"), obs_target, sample, _today_iso(), reset_window=update_contract)
             if update_observed or update_contract:
@@ -1442,6 +1491,10 @@ def redirect_request(self, *args, **kwargs):
                 # path: keep both files in sync if you change one.
                 if "max_alloc_block" in existing:
                     new_block["max_alloc_block"] = int(max_block)
+                # The internal-RAM and stack floors are requirements a person sets, not readings, so a renegotiation keeps them.
+                for k in ("free_internal", "min_stack_free"):
+                    if k in existing:
+                        new_block[k] = existing[k]
                 step.setdefault("contract", {})[obs_target] = new_block
 
         results["steps"].append(step_result)
@@ -1469,37 +1522,39 @@ def redirect_request(self, *args, **kwargs):
         if put_back:
             print(f"  restored {put_back} control(s) on {b}")
 
-    # Cleanup: delete modules that were created by this scenario
-    for module_id in reversed(created_modules):
-        try:
-            client.delete(_mod_path(module_id))
-            print(f"  -     {module_id} (cleanup)")
-        except Exception:
-            pass
+    # `--keep` leaves the device as the last step set it, files and all, to watch or deploy what the scenario built.
+    if not keep:
+        # Cleanup: delete modules that were created by this scenario
+        for module_id in reversed(created_modules):
+            try:
+                client.delete(_mod_path(module_id))
+                print(f"  -     {module_id} (cleanup)")
+            except Exception:
+                pass
 
-    # Restore: each container's document as it was, which removes, re-creates and re-types until the tree is the one the run started with.
-    for doc in snapshot_docs:
-        try:
-            client.patch("/api/state", doc)
-        except Exception as e:
-            print(f"  WARN: couldn't restore {next(iter(doc), '?')}: {e}")
-    # And the controls it wrote, after the tree, so a module the restore re-created takes its values.
-    put_back = _restore_controls(client, prior_controls)
-    if put_back:
-        print(f"  restored {put_back} control(s) the scenario had set")
-    # And the files it created that no step removed, after the controls, so nothing still selects a file as it goes.
-    for path_ in created_files:
-        try:
-            client.delete(f"/api/dir?path={urllib.parse.quote(path_)}")
-            print(f"  -     {path_} (cleanup)")
-        except Exception:
-            pass
-    for path_, before in prior_files.items():
-        try:
-            client.post_text(f"/api/file?path={urllib.parse.quote(path_)}", before)
-            print(f"  ~     {path_} (restored)")
-        except Exception as e:
-            print(f"  WARN  restore of {path_} failed: {e}")
+        # Restore: each container's document as it was, which removes, re-creates and re-types until the tree is the one the run started with.
+        for doc in snapshot_docs:
+            try:
+                client.patch("/api/state", doc)
+            except Exception as e:
+                print(f"  WARN: couldn't restore {next(iter(doc), '?')}: {e}")
+        # And the controls it wrote, after the tree, so a module the restore re-created takes its values.
+        put_back = _restore_controls(client, prior_controls)
+        if put_back:
+            print(f"  restored {put_back} control(s) the scenario had set")
+        # And the files it created that no step removed, after the controls, so nothing still selects a file as it goes.
+        for path_ in created_files:
+            try:
+                client.delete(f"/api/dir?path={urllib.parse.quote(path_)}")
+                print(f"  -     {path_} (cleanup)")
+            except Exception:
+                pass
+        for path_, before in prior_files.items():
+            try:
+                client.post_text(f"/api/file?path={urllib.parse.quote(path_)}", before)
+                print(f"  ~     {path_} (restored)")
+            except Exception as e:
+                print(f"  WARN  restore of {path_} failed: {e}")
 
     # Write the scenario JSON back if anything changed:
     #   - observed.<target> was updated by any measure step (every run); OR
@@ -1565,6 +1620,8 @@ def main():
                         help="Registry network (moondeck.json) the host and device share, for a scenario that moves the host's WiFi.")
     parser.add_argument("--board", action="append", default=[], metavar="NAME=HOST",
                         help="Another board a scenario names in `boards`, such as sender=192.168.1.156; repeat for each.")
+    parser.add_argument("--keep", action="store_true",
+                        help="Leave the device as the last step set it, rather than restoring it: to watch or deploy what a scenario built.")
     parser.add_argument("--settle", type=float, default=3.0,
                         help="Settle time in seconds between step and measurement")
     parser.add_argument("--update-observed", action="store_true",
@@ -1638,7 +1695,7 @@ def main():
         result = run_scenario(client, path, args.settle,
                               update_contract=args.update_contract, update_observed=args.update_observed,
                               update_reason=args.reason, named=bool(args.name), network=args.network,
-                              boards=boards)
+                              boards=boards, keep=args.keep)
         all_results[result["name"]] = result
         if not result["passed"]:
             all_passed = False
diff --git a/moonlive/README.md b/moonlive/README.md
index 5e60d6ab2..edb88d367 100644
--- a/moonlive/README.md
+++ b/moonlive/README.md
@@ -25,7 +25,7 @@ The engine stays role-blind either way, so a class defining several moments is s
 | `palettes/` | the `palette` control on [Drivers](https://moonmodules.org/MoonLight/moonmodules/light/supporting.html#drivers) | sixteen palette entries, once per frame |
 | `services/` | [MoonLiveService](https://moonmodules.org/MoonLight/moonmodules/core/services.html#moonliveservice) | hardware reads that drive controls |
 
-A folder may hold subfolders that group a collection, such as `effects/particles/` or `effects/hpwit/`. They exist only here: the catalog records each script's subfolder for its download. The device keeps every script in one flat folder, so a name is unique across all of them, and the build refuses a duplicate.
+A folder may hold subfolders that group a collection, such as `effects/particles/`. A project gets its own folder under `projects/`, holding every kind its look needs, such as `projects/stadbeest/` with its effects, its palette and the service that plays them. Folders exist only here: the catalog records each script's folder for its download. The device keeps every script in one flat folder, so a name is unique across all of them, and the build refuses a duplicate.
 
 Each module ships one of these as its default, so the folder doubles as the reference for what a working script looks like.
 
diff --git a/moonlive/effects/hpwit/twinkle-stars.mle b/moonlive/effects/hpwit/twinkle-stars.mle
deleted file mode 100644
index 4bdac9470..000000000
--- a/moonlive/effects/hpwit/twinkle-stars.mle
+++ /dev/null
@@ -1,20 +0,0 @@
-// Twinkling stars: pale lights in the upper half that swell where they land and fade slowly, after hpwit's multi_effect_controller.
-
-class TwinkleStarsEffect {
-  byte amount = 6;
-
-  int dimensions() { return 2; }
-
-  string tags() { return "💫"; }
-
-  void defineControls() {
-    addControl("amount", amount, 1, 20); // how many stars catch per frame
-  }
-
-  void tick() {
-    fade(12);
-    for (int i = 0; i < amount * 4; i = i + 1) {
-      addRGB(random16(height / 2) * width + random16(width), 90, 100, 160);
-    }
-  }
-}
diff --git a/moonlive/effects/hpwit/edge-comets.mle b/moonlive/projects/hpwit/edge-comets.mle
similarity index 100%
rename from moonlive/effects/hpwit/edge-comets.mle
rename to moonlive/projects/hpwit/edge-comets.mle
diff --git a/moonlive/effects/hpwit/fire.mle b/moonlive/projects/hpwit/fire.mle
similarity index 80%
rename from moonlive/effects/hpwit/fire.mle
rename to moonlive/projects/hpwit/fire.mle
index 4765f69e0..ab4b59593 100644
--- a/moonlive/effects/hpwit/fire.mle
+++ b/moonlive/projects/hpwit/fire.mle
@@ -1,10 +1,17 @@
 // Fire: embers along the bottom row re-lit in bursts, heat rising, spreading and cooling, after hpwit's ProceduralEffects. The lights are the heat field: each frame reads the heat back from the color it drew.
 
 class FireEffect {
+  byte sparks = 4;
+  byte cooling = 130;
   int dimensions() { return 2; }
 
   string tags() { return "💫"; }
 
+  void defineControls() {
+    addControl("sparks", sparks, 1, 12); // bursts of embers re-lit per frame
+    addControl("cooling", cooling, 128, 160); // how fast the heat fades as it rises: higher is shorter flames
+  }
+
   // Heat 0..255 through black, red, yellow and white.
   RGB color(int h) {
     if (h < 64) { return RGB(h * 4, 0, 0); }
@@ -23,7 +30,7 @@ class FireEffect {
   void tick() {
     int base = (height - 1) * width;
     for (int x = 0; x < width; x = x + 1) { setRGB(base + x, color(heat(base + x) * 13 / 16)); }
-    for (int b = 0; b < 4; b = b + 1) {
+    for (int b = 0; b < sparks; b = b + 1) {
       int x0 = random16(width);
       int w = 2 + random16(9);
       for (int k = 0; k < w; k = k + 1) { setRGB(base + mod(x0 + k, width), color(255)); }
@@ -34,7 +41,7 @@ class FireEffect {
       int under = min(y + 2, height - 1) * width;
       for (int x = 0; x < width; x = x + 1) {
         int s = heat(below + mod(x + width - 1, width)) + heat(below + x) + heat(below + mod(x + 1, width)) + heat(under + x);
-        setRGB(y * width + x, color(s * 32 / 130));
+        setRGB(y * width + x, color(s * 32 / cooling));
       }
     }
   }
diff --git a/moonlive/projects/hpwit/hpwit-show.mls b/moonlive/projects/hpwit/hpwit-show.mls
new file mode 100644
index 000000000..9af095d43
--- /dev/null
+++ b/moonlive/projects/hpwit/hpwit-show.mls
@@ -0,0 +1,80 @@
+// HpwitShow: plays hpwit's effects as a show. It builds its own look at start, six layers and the surface slots that drive them, with one push that is never saved. Every scene picks a palette and how the layers blend, and shows either the wandering voronoi window or the mandala, by opacity, since a layer at opacity 0 costs nothing; within it the plasma strip slides and breathes, and the effects' own controls drift. It drives the control surface, so each slot's target on the Control card says what it moves.
+
+class HpwitShow {
+  bool run = true;
+  byte seconds = 20;
+  bool built = false;      // the look is pushed once, at start
+
+  int scene = -1;          // the scene running, counted from boot
+  int sceneAt = -1000000;  // when it started, in ms
+  int plasmaBlend = 3;     // the scene's blend for the plasma strip
+  int ringsBlend = 1;      // and for the rings
+
+  void defineControls() {
+    addControl("run", run, 0, 1); // off leaves the layers where they are
+    addControl("seconds", seconds, 5, 120); // how long a scene lasts
+  }
+
+  // The six layers, cheapest first, and which slot moves what; the scenes start once it has landed.
+  void build() {
+    pushJson(R"({"Effects": {"$patch": "replace",
+      "Sky": {"type": "Layer", "blendMode": "additive",
+        "Stars": {"type": "MoonLiveEffect", "script": "twinkle-stars.mle"}},
+      "Rings": {"type": "Layer", "blendMode": "additive",
+        "Ripples": {"type": "MoonLiveEffect", "script": "ripple-rings.mle"}},
+      "Plasma": {"type": "Layer", "blendMode": "screen",
+        "PlasmaRegion": {"type": "RegionModifier", "startX": 0, "endX": 35},
+        "Waves": {"type": "MoonLiveEffect", "script": "plasma-ring.mle"}},
+      "Cells": {"type": "Layer", "blendMode": "lighten",
+        "CellsRegion": {"type": "RegionModifier", "startX": 0, "endX": 30, "startY": 0, "endY": 50},
+        "Seeds": {"type": "MoonLiveEffect", "script": "voronoi.mle"}},
+      "Mandala": {"type": "Layer", "blendMode": "lighten", "opacity": 0,
+        "MandalaRegion": {"type": "RegionModifier", "startX": 35, "endX": 65, "startY": 25, "endY": 75},
+        "Petals": {"type": "MoonLiveEffect", "script": "mandala.mle"}},
+      "Fountain": {"type": "Layer", "blendMode": "additive",
+        "Sparks": {"type": "MoonLiveEffect", "script": "particle-fountain.mle"}}},
+     "Control": {"fader2Target": "CellsRegion.startX", "fader3Target": "CellsRegion.endX",
+       "fader4Target": "CellsRegion.startY", "fader5Target": "CellsRegion.endY",
+       "fader6Target": "PlasmaRegion.startX", "fader7Target": "PlasmaRegion.endX", "fader8Target": "Plasma.opacity",
+       "encoder2Target": "Plasma.blendMode", "encoder3Target": "Rings.blendMode", "encoder4Target": "Waves.speed",
+       "encoder5Target": "Ripples.amount", "encoder6Target": "Mandala.opacity", "encoder7Target": "Cells.opacity"}})");
+  }
+
+  void tick20ms() {
+    if (!built) {
+      build();
+      built = true;
+      return;
+    }
+    if (run == 0) { return; }
+    if (t - sceneAt >= seconds * 1000) {
+      scene = scene + 1;
+      sceneAt = t;
+      plasmaBlend = 3 + random16(4);   // screen, darken, lighten or difference
+      ringsBlend = 1 + random16(2);    // additive or multiply
+      setControl("encoder1", random16(60));   // a built-in palette
+      setControl("encoder2", plasmaBlend);
+      setControl("encoder3", ringsBlend);
+      // The two expensive effects take turns: voronoi in even scenes, the mandala in odd ones.
+      int voronoiOn = 0;
+      if (mod(scene, 2) == 0) { voronoiOn = 1; }
+      setControl("encoder7", voronoiOn * 255);
+      setControl("encoder6", (1 - voronoiOn) * 255);
+    }
+    // The voronoi window, 30 by 50 percent, wandering on two slow sines.
+    int cx = beatsin(3, t, 70);
+    int cy = beatsin(2, t, 50);
+    setControl("fader2", cx);
+    setControl("fader3", cx + 30);
+    setControl("fader4", cy);
+    setControl("fader5", cy + 50);
+    // The plasma strip, 35 percent wide, sliding the other way and breathing.
+    int px = 65 - beatsin(2, t, 65);
+    setControl("fader6", px);
+    setControl("fader7", px + 35);
+    setControl("fader8", 120 + beatsin(5, t, 135));
+    // The effects' own controls drift with the scene.
+    setControl("encoder4", 20 + beatsin(1, t, 80));   // the plasma's speed
+    setControl("encoder5", 2 + beatsin(4, t, 10));    // how many rings at once
+  }
+}
diff --git a/moonlive/effects/hpwit/mandala.mle b/moonlive/projects/hpwit/mandala.mle
similarity index 73%
rename from moonlive/effects/hpwit/mandala.mle
rename to moonlive/projects/hpwit/mandala.mle
index 3655b75fd..78446a69c 100644
--- a/moonlive/effects/hpwit/mandala.mle
+++ b/moonlive/projects/hpwit/mandala.mle
@@ -1,10 +1,17 @@
 // Mandala: a six-fold kaleidoscope, petal rings drifting outward and swelling with a slow breath while the colors travel, after hpwit's ProceduralEffects.
 
 class MandalaEffect {
+  byte speed = 40;
+  int acc = 0;     // the phase in 1/1320 steps, carried from frame to frame
+  int lastT = 0;   // when it last advanced, in ms
   int dimensions() { return 2; }
 
   string tags() { return "💫"; }
 
+  void defineControls() {
+    addControl("speed", speed, 1, 120); // how fast it moves
+  }
+
   int wave(int i) { return sin(i * 256) / 256; }
 
   RGB hsv(int h, int s, int v) {
@@ -14,7 +21,11 @@ class MandalaEffect {
   }
 
   void tick() {
-    int f = mod(t / 33, 25600);
+    // The phase advances by the time since the last frame at the current speed, so a speed change moves on rather than jumping.
+    if (lastT == 0) { lastT = t; }
+    acc = mod(acc + (t - lastT) * speed, 33792000);   // 25600 phases of 1320
+    lastT = t;
+    int f = acc / 1320;
     int swell = 40 + wave(f / 2) / 3;
     int drift = 256 - mod(f, 256);
     for (int y = 0; y < height; y = y + 1) {
diff --git a/moonlive/effects/hpwit/particle-fountain.mle b/moonlive/projects/hpwit/particle-fountain.mle
similarity index 52%
rename from moonlive/effects/hpwit/particle-fountain.mle
rename to moonlive/projects/hpwit/particle-fountain.mle
index 73540406f..806d33ac8 100644
--- a/moonlive/effects/hpwit/particle-fountain.mle
+++ b/moonlive/projects/hpwit/particle-fountain.mle
@@ -1,7 +1,8 @@
-// Particle fountain: sparks thrown up from the middle, arcing over and falling back, after hpwit's multi_effect_controller.
+// Particle fountain: sparks thrown up from the floor, arcing over and falling back, after hpwit's multi_effect_controller.
 
 class ParticleFountainEffect {
   byte amount = 6;
+  byte lift = 140;
 
   int dimensions() { return 2; }
 
@@ -10,11 +11,12 @@ class ParticleFountainEffect {
   void defineControls() {
     pool(300);
     addControl("amount", amount, 1, 20); // sparks per frame
+    addControl("lift", lift, 40, 255); // how high the sparks are thrown
   }
 
   void tick() {
     fade(48);
-    emit(width / 2, height / 2, 45056 + random16(8192), height * 16, amount, 120, random16(256));
+    emit(width / 2, height - 1, 45056 + random16(8192), lift * height / 4, amount, 120, random16(256));
     gravity(height * 3);
     drag(2);
     step();
diff --git a/moonlive/effects/hpwit/plasma-ring.mle b/moonlive/projects/hpwit/plasma-ring.mle
similarity index 100%
rename from moonlive/effects/hpwit/plasma-ring.mle
rename to moonlive/projects/hpwit/plasma-ring.mle
diff --git a/moonlive/effects/hpwit/plasma-wander.mle b/moonlive/projects/hpwit/plasma-wander.mle
similarity index 60%
rename from moonlive/effects/hpwit/plasma-wander.mle
rename to moonlive/projects/hpwit/plasma-wander.mle
index 0729d2d70..deeb37525 100644
--- a/moonlive/effects/hpwit/plasma-wander.mle
+++ b/moonlive/projects/hpwit/plasma-wander.mle
@@ -1,15 +1,26 @@
 // Wandering plasma: four sine waves summed per light, the fourth a ring around a wandering center, after hpwit's ProceduralEffects.
 
 class WanderingPlasmaEffect {
+  byte speed = 40;
+  int acc = 0;     // the phase in 1/1320 steps, carried from frame to frame
+  int lastT = 0;   // when it last advanced, in ms
   int dimensions() { return 2; }
 
   string tags() { return "💫"; }
 
+  void defineControls() {
+    addControl("speed", speed, 1, 120); // how fast it moves
+  }
+
   // One of 256 steps round a sine, as 0..255.
   int wave(int i) { return sin(i * 256) / 256; }
 
   void tick() {
-    int f = mod(t / 33, 25600);
+    // The phase advances by the time since the last frame at the current speed, so a speed change moves on rather than jumping.
+    if (lastT == 0) { lastT = t; }
+    acc = mod(acc + (t - lastT) * speed, 33792000);   // 25600 phases of 1320
+    lastT = t;
+    int f = acc / 1320;
     int cx = wave(f) * (width - 1) / 255;
     int cy = wave(f * 2 + 64) * (height - 1) / 255;
     for (int y = 0; y < height; y = y + 1) {
diff --git a/moonlive/effects/hpwit/ripple-rings.mle b/moonlive/projects/hpwit/ripple-rings.mle
similarity index 100%
rename from moonlive/effects/hpwit/ripple-rings.mle
rename to moonlive/projects/hpwit/ripple-rings.mle
diff --git a/moonlive/effects/hpwit/spinning-squares.mle b/moonlive/projects/hpwit/spinning-squares.mle
similarity index 64%
rename from moonlive/effects/hpwit/spinning-squares.mle
rename to moonlive/projects/hpwit/spinning-squares.mle
index aa5845f24..f3df18290 100644
--- a/moonlive/effects/hpwit/spinning-squares.mle
+++ b/moonlive/projects/hpwit/spinning-squares.mle
@@ -1,16 +1,21 @@
 // Spinning squares: six gradient squares orbit the center, each spinning on itself, over a dim swirl of twisted squares, after hpwit's ProceduralEffects.
 
 class SpinningSquaresEffect {
-  byte qx[6];
-  byte qy[6];
-  byte qc[6];
-  byte qs[6];
+  byte speed = 40;
+  int acc = 0;     // the phase in 1/1320 steps, carried from frame to frame
+  int lastT = 0;   // when it last advanced, in ms
+  byte qxy[12];    // each square's place, x then 6 on its y, one array since two of six bytes would each start 4-byte aligned
+  byte qcs[12];    // the cosine of its spin, then 6 on its sine
   int qsize[6];
 
   int dimensions() { return 2; }
 
   string tags() { return "💫"; }
 
+  void defineControls() {
+    addControl("speed", speed, 1, 120); // how fast it moves
+  }
+
   int wave(int i) { return sin(i * 256) / 256; }
 
   RGB hsv(int h, int s, int v) {
@@ -24,18 +29,22 @@ class SpinningSquaresEffect {
     for (int i = 0; i < 6; i = i + 1) {
       int orbit = mod(f + i * 43, 256);
       int reach = (24 + mod(i, 2) * 16) * width / 128;
-      qx[i] = width / 2 + reach * (wave(orbit + 64) - 128) / 127;
-      qy[i] = height / 2 + reach * (wave(orbit) - 128) / 160;
+      qxy[i] = width / 2 + reach * (wave(orbit + 64) - 128) / 127;
+      qxy[i + 6] = height / 2 + reach * (wave(orbit) - 128) / 160;
       int spin = mod(f * 3 + i * 40, 256);
       if (mod(i, 2) == 1) { spin = 255 - spin; }
-      qc[i] = wave(spin + 64);
-      qs[i] = wave(spin);
+      qcs[i] = wave(spin + 64);
+      qcs[i + 6] = wave(spin);
       qsize[i] = max((9 + wave(f * 2 + i * 60) / 40) * 127 * width / 128, 127);
     }
   }
 
   void tick() {
-    int f = mod(t / 33, 25600);
+    // The phase advances by the time since the last frame at the current speed, so a speed change moves on rather than jumping.
+    if (lastT == 0) { lastT = t; }
+    acc = mod(acc + (t - lastT) * speed, 33792000);   // 25600 phases of 1320
+    lastT = t;
+    int f = acc / 1320;
     moveSquares(f);
     int flow = 256 - mod(f * 2, 256);
     for (int y = 0; y < height; y = y + 1) {
@@ -52,10 +61,10 @@ class SpinningSquaresEffect {
         int hue = m * 3 + f;
         int sat = 255;
         for (int i = 0; i < 6; i = i + 1) {
-          int ex = x - qx[i];
-          int ey = y - qy[i];
-          int across = ex * (qc[i] - 128) + ey * (qs[i] - 128);
-          int inside = max(abs(across), abs(ey * (qc[i] - 128) - ex * (qs[i] - 128)));
+          int ex = x - qxy[i];
+          int ey = y - qxy[i + 6];
+          int across = ex * (qcs[i] - 128) + ey * (qcs[i + 6] - 128);
+          int inside = max(abs(across), abs(ey * (qcs[i] - 128) - ex * (qcs[i + 6] - 128)));
           if (inside < qsize[i]) {
             int g = inside * 255 / qsize[i];
             v = 110 + g * 145 / 255;
diff --git a/moonlive/projects/hpwit/twinkle-stars.mle b/moonlive/projects/hpwit/twinkle-stars.mle
new file mode 100644
index 000000000..83dadbf74
--- /dev/null
+++ b/moonlive/projects/hpwit/twinkle-stars.mle
@@ -0,0 +1,22 @@
+// Twinkling stars: pale lights that swell where they land and fade slowly, over the top `cover` percent of the height, after hpwit's multi_effect_controller.
+
+class TwinkleStarsEffect {
+  byte amount = 6;
+  byte cover = 100;
+
+  int dimensions() { return 2; }
+
+  string tags() { return "💫"; }
+
+  void defineControls() {
+    addControl("amount", amount, 1, 20); // how many stars catch per frame
+    addControl("cover", cover, 10, 100); // how much of the height, from the top, the sky takes
+  }
+
+  void tick() {
+    fade(12);
+    for (int i = 0; i < amount * 4; i = i + 1) {
+      addRGB(random16(max(height * cover / 100, 1)) * width + random16(width), 90, 100, 160);
+    }
+  }
+}
diff --git a/moonlive/effects/hpwit/voronoi.mle b/moonlive/projects/hpwit/voronoi.mle
similarity index 78%
rename from moonlive/effects/hpwit/voronoi.mle
rename to moonlive/projects/hpwit/voronoi.mle
index 69ebfa731..fdb588a19 100644
--- a/moonlive/effects/hpwit/voronoi.mle
+++ b/moonlive/projects/hpwit/voronoi.mle
@@ -1,6 +1,9 @@
 // Voronoi: nine seeds wander on sine paths, cell borders glow at an even width and a ring pulses round each seed, after hpwit's ProceduralEffects.
 
 class VoronoiEffect {
+  byte speed = 40;
+  int acc = 0;     // the phase in 1/1320 steps, carried from frame to frame
+  int lastT = 0;   // when it last advanced, in ms
   byte sx[9];
   byte sy[9];
   byte ring[9];
@@ -9,6 +12,10 @@ class VoronoiEffect {
 
   string tags() { return "💫"; }
 
+  void defineControls() {
+    addControl("speed", speed, 1, 120); // how fast it moves
+  }
+
   int wave(int i) { return sin(i * 256) / 256; }
 
   // A palette color at brightness v, washed toward white as s falls.
@@ -27,7 +34,11 @@ class VoronoiEffect {
   }
 
   void tick() {
-    int f = mod(t / 33, 25600);
+    // The phase advances by the time since the last frame at the current speed, so a speed change moves on rather than jumping.
+    if (lastT == 0) { lastT = t; }
+    acc = mod(acc + (t - lastT) * speed, 33792000);   // 25600 phases of 1320
+    lastT = t;
+    int f = acc / 1320;
     moveSeeds(f);
     for (int y = 0; y < height; y = y + 1) {
       for (int x = 0; x < width; x = x + 1) {
diff --git a/moonlive/projects/stadbeest/stadbeest-autopilot.mls b/moonlive/projects/stadbeest/stadbeest-autopilot.mls
new file mode 100644
index 000000000..17c05d490
--- /dev/null
+++ b/moonlive/projects/stadbeest/stadbeest-autopilot.mls
@@ -0,0 +1,109 @@
+// StadBeestAutopilot: builds the StadBeest and runs it unattended. At start it pushes each part its look, never saved: on the legs, itself, a layer per look (walking, the orb, the thrusters), on each eye the eye's three, and on the mouth its one; it pushes them again every half minute, so a part that boots late or reboots gets its look back. Every few minutes a new scene crossfades to the next look and picks a palette (stadbeest-fire in a third of the thruster scenes), a mood, how much the music counts and whether it flashes on the beat; within a scene the energy breathes once a minute. It moves the control surface, so the legs follow here and the eyes over OSC, each on the look's own controls through automap.
+
+class StadBeestAutopilot {
+  bool run = true;
+  byte seconds = 180;
+
+  int scene = -1;          // the scene running, counted from boot
+  int sceneAt = -1000000;  // when it started, in ms, so a new length moves where it ends rather than restarting the count
+  int look = 0;            // the scene's look: 0 walking, 1 the orb, 2 the thrusters, a layer each
+  int prevLook = 0;        // the look it fades from
+  int fadeAt = -100000;    // when the crossfade started, in ms
+  int mood = 128;          // the scene's energy, 0 calm to 255 wild
+  int palette = 0;         // the scene's palette
+  int pulseOn = 0;         // whether the scene flashes on the beat
+  int hearing = 160;       // how much the music drives legs and eyes this scene
+  int lastGlide = -100000; // when the slots were last written, in ms
+  int nextSlot = 7;        // the slot written next; 7 means all are written
+  int builtAt = -100000;   // when the looks were last pushed, in ms
+
+  void defineControls() {
+    addControl("run", run, 0, 1); // off hands the beast back to people and desks
+    addControl("seconds", seconds, 1, 255); // how long a scene lasts
+  }
+
+  // Each part's look, a layer per look so a crossfade is two opacities, and the encoders 6 to 8 that set them, which the eyes hear over OSC.
+  void build() {
+    pushJson(R"({"Effects": {"$patch": "replace",
+      "WalkLayer": {"type": "Layer", "walk": {"type": "MoonLiveEffect", "script": "stadbeest-walk.mle"}},
+      "OrbLayer": {"type": "Layer", "orb": {"type": "MoonLiveEffect", "script": "stadbeest-orb.mle"}},
+      "ThrustersLayer": {"type": "Layer", "thrusters": {"type": "MoonLiveEffect", "script": "stadbeest-thrusters.mle"}}},
+     "Control": {"switch3Target": "", "switch4Target": "", "switch5Target": "",
+       "encoder6Target": "WalkLayer.opacity", "encoder7Target": "OrbLayer.opacity", "encoder8Target": "ThrustersLayer.opacity"}})");
+    json eye = R"({"Effects": {"$patch": "replace",
+      "FrogLayer": {"type": "Layer", "frog-eye": {"type": "MoonLiveEffect", "script": "stadbeest-frog-eye.mle"}},
+      "EyeOrbLayer": {"type": "Layer", "eye-orb": {"type": "MoonLiveEffect", "script": "stadbeest-eye-orb.mle"}},
+      "SauronLayer": {"type": "Layer", "sauron": {"type": "MoonLiveEffect", "script": "stadbeest-sauron.mle"}}},
+     "Control": {"switch3Target": "", "switch4Target": "", "switch5Target": "",
+       "encoder6Target": "FrogLayer.opacity", "encoder7Target": "EyeOrbLayer.opacity", "encoder8Target": "SauronLayer.opacity"}})";
+    pushJsonTo("MM-eye1.local", eye);
+    pushJsonTo("MM-eye2.local", eye);
+    pushJsonTo("MM-mouth.local", R"({"Effects": {"$patch": "replace",
+      "MouthLayer": {"type": "Layer", "mouth": {"type": "MoonLiveEffect", "script": "stadbeest-mouth.mle"}}}})");
+  }
+
+  // The energy around the scene's mood, breathing once a minute.
+  int energy() {
+    int phase = div(mod(t, 60000) * 1092, 1000);
+    int e = mood + div((sin(phase) - 32768) * 48, 32768);
+    if (e < 0) { e = 0; }
+    if (e > 255) { e = 255; }
+    return e;
+  }
+
+  // A look's opacity now: the new one rising and the old one falling over three seconds, the third one dark.
+  int level(int k) {
+    int p = div((t - fadeAt) * 255, 3000);
+    if (p > 255) { p = 255; }
+    if (k == look) { return p; }
+    if (k == prevLook) { return 255 - p; }
+    return 0;
+  }
+
+  // One slot per call: the three looks' opacities first, then the slots every look shares: the palette, pulse, bpm with the energy, and sensitivity.
+  void write(int k) {
+    if (k == 0) { setControl("encoder6", level(0)); }
+    if (k == 1) { setControl("encoder7", level(1)); }
+    if (k == 2) { setControl("encoder8", level(2)); }
+    if (k == 3) { setControl("encoder1", palette); }
+    if (k == 4) { setControl("switch2", pulseOn); }
+    if (k == 5) { setControl("fader2", 20 + div(energy() * 70, 255)); }
+    if (k == 6) { if (look != 1) { setControl("fader3", hearing); } } // the orb hears no music, and its fader3 is its spin
+  }
+
+  void tick20ms() {
+    // Every half minute, since a look pushed live is gone after its part reboots, and the same document applied again changes nothing.
+    if (t - builtAt >= 30000) {
+      builtAt = t;
+      build();
+    }
+    if (run == 0) { return; }
+    if (t - sceneAt >= seconds * 1000) {
+      scene = scene + 1;
+      sceneAt = t;
+      prevLook = look;
+      look = mod(scene, 3);
+      fadeAt = t;
+      palette = random16(60); // any built-in palette
+      if (look == 2) { if (random16(3) == 0) { palette = 65; } } // a third of the thruster scenes burn in stadbeest-fire, its place in the palette list on every device
+      mood = random16(256);
+      pulseOn = random16(2);
+      hearing = 80 + random16(150);
+      lastGlide = -100000;
+    }
+    // While the looks cross, their three opacities in turn, one a tick, so the eyes follow at 16 steps a second.
+    if (t - fadeAt < 3200) {
+      write(mod(div(t, 20), 3));
+      return;
+    }
+    // Every ten seconds all seven slots, one per tick: the eyes hear them over WiFi multicast, which drops a burst.
+    if (t - lastGlide >= 10000) {
+      lastGlide = t;
+      nextSlot = 0;
+    }
+    if (nextSlot < 7) {
+      write(nextSlot);
+      nextSlot = nextSlot + 1;
+    }
+  }
+}
diff --git a/moonlive/effects/stadbeest/stadbeest-eye-orb.mle b/moonlive/projects/stadbeest/stadbeest-eye-orb.mle
similarity index 100%
rename from moonlive/effects/stadbeest/stadbeest-eye-orb.mle
rename to moonlive/projects/stadbeest/stadbeest-eye-orb.mle
diff --git a/moonlive/palettes/stadbeest-fire.mlp b/moonlive/projects/stadbeest/stadbeest-fire.mlp
similarity index 100%
rename from moonlive/palettes/stadbeest-fire.mlp
rename to moonlive/projects/stadbeest/stadbeest-fire.mlp
diff --git a/moonlive/effects/stadbeest/stadbeest-frog-eye.mle b/moonlive/projects/stadbeest/stadbeest-frog-eye.mle
similarity index 100%
rename from moonlive/effects/stadbeest/stadbeest-frog-eye.mle
rename to moonlive/projects/stadbeest/stadbeest-frog-eye.mle
diff --git a/moonlive/effects/stadbeest/stadbeest-mouth.mle b/moonlive/projects/stadbeest/stadbeest-mouth.mle
similarity index 100%
rename from moonlive/effects/stadbeest/stadbeest-mouth.mle
rename to moonlive/projects/stadbeest/stadbeest-mouth.mle
diff --git a/moonlive/effects/stadbeest/stadbeest-orb.mle b/moonlive/projects/stadbeest/stadbeest-orb.mle
similarity index 100%
rename from moonlive/effects/stadbeest/stadbeest-orb.mle
rename to moonlive/projects/stadbeest/stadbeest-orb.mle
diff --git a/moonlive/effects/stadbeest/stadbeest-sauron.mle b/moonlive/projects/stadbeest/stadbeest-sauron.mle
similarity index 100%
rename from moonlive/effects/stadbeest/stadbeest-sauron.mle
rename to moonlive/projects/stadbeest/stadbeest-sauron.mle
diff --git a/moonlive/effects/stadbeest/stadbeest-thrusters.mle b/moonlive/projects/stadbeest/stadbeest-thrusters.mle
similarity index 100%
rename from moonlive/effects/stadbeest/stadbeest-thrusters.mle
rename to moonlive/projects/stadbeest/stadbeest-thrusters.mle
diff --git a/moonlive/effects/stadbeest/stadbeest-walk.mle b/moonlive/projects/stadbeest/stadbeest-walk.mle
similarity index 100%
rename from moonlive/effects/stadbeest/stadbeest-walk.mle
rename to moonlive/projects/stadbeest/stadbeest-walk.mle
diff --git a/moonlive/services/jsondemo.mls b/moonlive/services/jsondemo.mls
new file mode 100644
index 000000000..338af2d08
--- /dev/null
+++ b/moonlive/services/jsondemo.mls
@@ -0,0 +1,68 @@
+// JsonDemo: four live feeds as scrolling text, a band each: the weather in Amsterdam, the bitcoin price, Arsenal's last match and the newest spaceflight headline. It builds its own look, four text layers, with one push at start, and writes the bands again whenever a feed brings something new. The feeds are free and need no key, and each is read again on its own period.
+
+class JsonDemo {
+  bool built = false;
+  json weather;
+  json bitcoin;
+  json match;
+  json news;
+  json bands;    // the four texts, pushed as one document
+  json number;   // a whole number on its way into a text
+
+  void tick20ms() {
+    if (!built) {
+      // Four bands, a quarter of the height each, every one a Text effect scrolling its feed.
+      pushJson(R"({"Effects": {"$patch": "replace",
+        "Weather": {"type": "Layer",
+          "WeatherBand": {"type": "RegionModifier", "startY": 0, "endY": 25},
+          "WeatherText": {"type": "TextEffect", "text": "weather", "scroll": true, "speed": 20, "hue": 30}},
+        "Bitcoin": {"type": "Layer",
+          "BitcoinBand": {"type": "RegionModifier", "startY": 25, "endY": 50},
+          "BitcoinText": {"type": "TextEffect", "text": "bitcoin", "scroll": true, "speed": 25, "hue": 90}},
+        "Match": {"type": "Layer",
+          "MatchBand": {"type": "RegionModifier", "startY": 50, "endY": 75},
+          "MatchText": {"type": "TextEffect", "text": "football", "scroll": true, "speed": 30, "hue": 150}},
+        "News": {"type": "Layer",
+          "NewsBand": {"type": "RegionModifier", "startY": 75, "endY": 100},
+          "NewsText": {"type": "TextEffect", "text": "news", "scroll": true, "speed": 35, "hue": 210}}}})");
+      bands = R"({"Effects": {"Weather": {"WeatherText": {}}, "Bitcoin": {"BitcoinText": {}},
+                              "Match": {"MatchText": {}}, "News": {"NewsText": {}}}})";
+      number = R"({"n": 0})";
+      built = true;
+    }
+
+    // Asked every tick, each answered from what arrived last and fetched again once its period ran out.
+    weather = getJson("https://api.open-meteo.com/v1/forecast?latitude=52.37&longitude=4.90&current=temperature_2m", 600);
+    bitcoin = getJson("https://api.coinbase.com/v2/prices/BTC-USD/spot", 60);
+    match = getJson("https://www.thesportsdb.com/api/v1/json/123/eventslast.php?id=133604", 3600);
+    news = getJson("https://api.spaceflightnewsapi.net/v4/articles/?limit=1", 900);
+
+    bool fresh = false;
+    if (jsonChanged(weather)) {
+      jsonSetText(bands, "/Effects/Weather/WeatherText/text", "Amsterdam ");
+      jsonAppend(bands, "/Effects/Weather/WeatherText/text", weather, "/current/temperature_2m");
+      jsonAppendText(bands, "/Effects/Weather/WeatherText/text", " C");
+      fresh = true;
+    }
+    if (jsonChanged(bitcoin)) {
+      // The price comes quoted with three decimals, so it goes through a whole number first.
+      jsonSetInt(number, "/n", jsonInt(bitcoin, "/data/amount"));
+      jsonSetText(bands, "/Effects/Bitcoin/BitcoinText/text", "BTC $");
+      jsonAppend(bands, "/Effects/Bitcoin/BitcoinText/text", number, "/n");
+      fresh = true;
+    }
+    if (jsonChanged(match)) {
+      jsonCopy(bands, "/Effects/Match/MatchText/text", match, "/results/0/strEvent");
+      jsonAppendText(bands, "/Effects/Match/MatchText/text", " ");
+      jsonAppend(bands, "/Effects/Match/MatchText/text", match, "/results/0/intHomeScore");
+      jsonAppendText(bands, "/Effects/Match/MatchText/text", "-");
+      jsonAppend(bands, "/Effects/Match/MatchText/text", match, "/results/0/intAwayScore");
+      fresh = true;
+    }
+    if (jsonChanged(news)) {
+      jsonCopy(bands, "/Effects/News/NewsText/text", news, "/results/0/title");
+      fresh = true;
+    }
+    if (fresh) { pushJson(bands); }
+  }
+}
diff --git a/moonlive/services/stadbeest-autopilot.mls b/moonlive/services/stadbeest-autopilot.mls
deleted file mode 100644
index cc67f507f..000000000
--- a/moonlive/services/stadbeest-autopilot.mls
+++ /dev/null
@@ -1,68 +0,0 @@
-// StadBeestAutopilot: runs the StadBeest unattended. Every few minutes a new scene moves on to the next look (walking, the orb, the thrusters) and picks a palette (stadbeest-fire in a third of the thruster scenes), a mood, how much the music counts and whether it flashes on the beat; within a scene the energy breathes once a minute. It moves the control surface, so the legs follow here and the eyes over OSC, each on the look's own controls through automap.
-
-class StadBeestAutopilot {
-  bool run = true;
-  byte seconds = 180;
-
-  int scene = -1;          // the scene running, counted from boot
-  int sceneAt = -1000000;  // when it started, in ms, so a new length moves where it ends rather than restarting the count
-  int look = 0;            // the scene's look: 0 walking, 1 the orb, 2 the thrusters, one switch each
-  int mood = 128;          // the scene's energy, 0 calm to 255 wild
-  int palette = 0;         // the scene's palette
-  int pulseOn = 0;         // whether the scene flashes on the beat
-  int hearing = 160;       // how much the music drives legs and eyes this scene
-  int lastGlide = -100000; // when the slots were last written, in ms
-  int nextSlot = 7;        // the slot written next; 7 means all are written
-
-  void defineControls() {
-    addControl("run", run, 0, 1); // off hands the beast back to people and desks
-    addControl("seconds", seconds, 1, 255); // how long a scene lasts
-  }
-
-  // The energy around the scene's mood, breathing once a minute.
-  int energy() {
-    int phase = div(mod(t, 60000) * 1092, 1000);
-    int e = mood + div((sin(phase) - 32768) * 48, 32768);
-    if (e < 0) { e = 0; }
-    if (e > 255) { e = 255; }
-    return e;
-  }
-
-  // One slot per call: the look first, so automap has moved the desk to it before the rest lands, then the slots every look shares: the palette, pulse, bpm with the energy, and sensitivity.
-  void write(int k) {
-    // The look's own switch on, the other two off.
-    int on = 0;
-    if (k == look) { on = 1; }
-    if (k == 0) { setControl("switch3", on); }
-    if (k == 1) { setControl("switch4", on); }
-    if (k == 2) { setControl("switch5", on); }
-    if (k == 3) { setControl("encoder1", palette); }
-    if (k == 4) { setControl("switch2", pulseOn); }
-    if (k == 5) { setControl("fader2", 20 + div(energy() * 70, 255)); }
-    if (k == 6) { if (look != 1) { setControl("fader3", hearing); } } // the orb hears no music, and its fader3 is its spin
-  }
-
-  void tick20ms() {
-    if (run == 0) { return; }
-    if (t - sceneAt >= seconds * 1000) {
-      scene = scene + 1;
-      sceneAt = t;
-      look = mod(scene, 3);
-      palette = random16(60); // any built-in palette
-      if (look == 2) { if (random16(3) == 0) { palette = 64; } } // a third of the thruster scenes burn in stadbeest-fire, its place in the palette list on every device
-      mood = random16(256);
-      pulseOn = random16(2);
-      hearing = 80 + random16(150);
-      lastGlide = -100000;
-    }
-    // Every ten seconds all seven slots, one per tick: the eyes hear them over WiFi multicast, which drops a burst.
-    if (t - lastGlide >= 10000) {
-      lastGlide = t;
-      nextSlot = 0;
-    }
-    if (nextSlot < 7) {
-      write(nextSlot);
-      nextSlot = nextSlot + 1;
-    }
-  }
-}
diff --git a/moonwalk/06-advanced.yaml b/moonwalk/06-advanced.yaml
index 7a9da0ade..081948454 100644
--- a/moonwalk/06-advanced.yaml
+++ b/moonwalk/06-advanced.yaml
@@ -376,7 +376,7 @@ processes:
         say: Add a script service on the leader.
         when: { add: { module: Services, type: MoonLiveService } }
         detail: |
-          A script service writes the shared slots with `setControl("fader2", value)`, as a person moves a fader, one slot at a time with a pause between writes so no burst reaches the network. Declare a `run` switch in the script with `addControl` and assign it to a slot on the Control card, so off hands the installation back to people and desks.
+          A script service writes the shared slots with `setControl("fader2", value)`, as a person moves a fader, one slot at a time with a pause between writes so no burst reaches the network. Declare a `run` switch in the script with `addControl` and assign it to a slot on the Control card, so off hands the installation back to people and desks. It can also build every part's look with `pushJson` and `pushJsonTo`, pushed again every half minute, so a part that reboots gets it back.
       - id: desk
         say: Plug a desk into the leader.
         when: { open: { module: MidiService } }
diff --git a/moonwalk/08-integrate.yaml b/moonwalk/08-integrate.yaml
index 78fe0220d..ab7b10825 100644
--- a/moonwalk/08-integrate.yaml
+++ b/moonwalk/08-integrate.yaml
@@ -109,6 +109,38 @@ processes:
         when: { call: { operation: setControl, body: '{"module":"MoonLive","control":"hue","value":128}' } }
         detail: |
           They appear on the module once the script compiles. Writing the file again recompiles it on the next frame and keeps each control's live value, so a script is iterated on from an editor without touching the module.
+  - id: live-data
+    title: Show live data from the internet
+    actor: user
+    goal: The weather, a price, a score or a headline from a public service runs on the lights, refreshed on its own.
+    systems: [MoonLive]
+    dependsOn: [first-script]
+    intro: |
+      A [service script](moonmodules/light/moonlive.md#json-documents-in-a-service) reads JSON from the internet and sends the device a document of its own, so it builds the look that shows the data and keeps it current. `jsondemo.mls` does it for four free feeds, a band of scrolling text each.
+    steps:
+      - id: add
+        section: Run the demo
+        say: Add a script service and name jsondemo.mls.
+        when: { add: { module: Services, type: MoonLiveService } }
+        then:
+          - { module: MoonLiveService, exists: true }
+        detail: |
+          Open Services and press + add module. With the page open, a script the device lacks downloads by itself.
+
+          The device needs the internet. A board without PSRAM fetches over HTTPS only while internal RAM holds a TLS session, and waits otherwise.
+      - id: look
+        say: See the bands appear and fill.
+        when: { manual: "Four text layers appear under Effects; each fills once its feed answers." }
+        detail: |
+          The look is pushed live, never saved, so a reboot returns the device to its saved state and the script builds the look again.
+      - id: own
+        section: Make it yours
+        say: Point a copy at the data you want.
+        when: { manual: "Edit the URL and the JSON Pointer, such as /current/temperature_2m." }
+        detail: |
+          Open the URL in a browser to see the document, then name the value by its path. A service that quotes its numbers, such as `"price":"252.11"`, still reads as a number. Read a feed no more often than it changes: a price each minute, the weather each ten.
+    outro: |
+      Every JSON call: [MoonLive](moonmodules/light/moonlive.md#json-documents-in-a-service). A script sends another device its look with `pushJsonTo`, which is how [the StadBeest](reference/examples/multi-board-installation.md) builds its eyes.
   - id: smart-home-hub
     title: Set up a smart-home hub
     actor: user
diff --git a/moonwalk/09-plan-setup.yaml b/moonwalk/09-plan-setup.yaml
index e224f90bf..3511da885 100644
--- a/moonwalk/09-plan-setup.yaml
+++ b/moonwalk/09-plan-setup.yaml
@@ -15,7 +15,7 @@ processes:
     intro: |
       A topic is one module, effect, driver or capability. The plan is the contract for the branch. A draft may wait in `docs/work/future/` until its topic is picked.
 
-      The plan becomes the pull request description and is deleted in the same pull request, the product owner's call: the code being written is not the plan being realized, since verification, including the judgment steps, is part of it.
+      The pull request description links the plan, and the plan moves to `docs/work/past/plans/` in that same pull request, the product owner's call, with its status in its name: `(shipped)` once every step is built and verified, the judgment steps included, since the code being written is not the plan being realized; otherwise `(cancelled)`, `(superseded)` or `(attempted, reverted)`.
     steps:
       - id: pick
         say: Name one module, effect, driver or capability.
@@ -55,6 +55,11 @@ processes:
         when: { run: { command: "git switch -c <branch-name>" } }
         detail: |
           The product owner creates every branch, and whoever initiates a branch submits its pull request. The agent works on the branch it is given and asks when a change does not belong there. The one exception: a small fix, already verified, goes straight to main.
+      - id: session
+        say: Start a fresh agent session for the branch.
+        when: { manual: "A new Claude session, not the one the last branch used." }
+        detail: |
+          The previous topic's context steers the next one, and a long context costs every turn. A large commit is a point to start fresh too: the next commit then begins from the repository rather than from the conversation.
       - id: work
         say: Prove the change on the desktop.
         actor: contributor
diff --git a/src/core/module/MoonModule.h b/src/core/module/MoonModule.h
index 48cce161b..d18dfda58 100644
--- a/src/core/module/MoonModule.h
+++ b/src/core/module/MoonModule.h
@@ -34,6 +34,9 @@ inline const char* roleName(ModuleRole role) {
     }
 }
 
+/// How far a reshaping control change's rebuild reaches: the module itself, the container holding it, or the whole tree.
+enum class PrepareScope : uint8_t { Self, Parent, Tree };
+
 /// The base class for everything in the system, from effects and drivers to system services.
 ///
 /// It is the one deliberate hierarchy, so the UI renders any module with no per-module UI code: @xref{parent-and-child}. The base is the smallest possible, since dozens load at once without PSRAM: @xref{enabled-and-self-reporting}.
@@ -111,6 +114,8 @@ class MoonModule {
 
     /// Whether this control's change reshapes dimensions, and so triggers the build sweep.
     virtual bool affectsPrepare(const char* /*controlName*/) const { return false; }
+    /// How far that build sweep reaches: the whole tree unless this module knows its change stays closer, a reader of what changed re-preparing itself in onTreePrepared.
+    virtual PrepareScope prepareScope() const { return PrepareScope::Tree; }
 
     /// Declare every control, purely and idempotently, since this is re-run whenever a Select changes.
     virtual void defineControls() { for (uint8_t i = 0; i < childCount_; i++) children_[i]->defineControls(); }
diff --git a/src/core/module/Scheduler.cpp b/src/core/module/Scheduler.cpp
index d6e18d178..611febe78 100644
--- a/src/core/module/Scheduler.cpp
+++ b/src/core/module/Scheduler.cpp
@@ -57,10 +57,8 @@ void Scheduler::tick() MM_NONBLOCKING {
     uint32_t now = platform::millis();
     uint32_t tickStart = platform::micros();
 
-    // A requested rebuild runs here at a frame boundary; the analyzer reports prepareTree transitively and that finding stays on purpose, the only signal if the gate is lost.
-    if (prepareRequested_.exchange(false, std::memory_order_relaxed)) {
-        prepareTree();
-    }
+    // A requested rebuild runs here at a frame boundary; the analyzer reports it transitively and that finding stays on purpose, the only signal if the gate is lost.
+    preparePending();
 
     // Disabled modules do not tick, except system modules that override `respectsEnabled()` to return false so users can re-enable others through them.
     auto shouldRun = [](MoonModule* m) {
@@ -120,12 +118,57 @@ void Scheduler::release() {
     }
     moduleCount_ = 0;
     instance_ = nullptr;
+    // A document never applied goes with the tree it was meant for, and is answered as refused, so whoever queued it stops waiting.
+    for (auto& slot : pendingLive_) {
+        if (!slot.text) continue;
+        const PendingLive entry = slot;
+        slot = {};
+        platform::free(entry.text);
+        if (entry.done) {
+            StateDocumentResult refused;
+            refused.ok = false;
+            refused.error = "the device stopped before applying it";
+            entry.done(entry.tag, refused);
+        }
+    }
 }
 
 uint32_t Scheduler::elapsed() const {
     return platform::millis() - startTime_;
 }
 
+void Scheduler::preparePending() {
+    // A live document first, so the rebuild it asks for runs in this same frame.
+    applyPendingLive();
+    MoonModule* scopes[std::tuple_size_v<decltype(preparePending_)>];
+    uint8_t scopeCount = 0;
+    for (auto& slot : preparePending_)
+        if (MoonModule* m = slot.exchange(nullptr, std::memory_order_relaxed)) scopes[scopeCount++] = m;
+    if (prepareRequested_.exchange(false, std::memory_order_relaxed)) prepareTree();   // the tree covers every scope
+    else if (scopeCount) prepareSubtrees(scopes, scopeCount);
+}
+
+bool Scheduler::applyLive(char* text, LiveDone done, uintptr_t tag) {
+    if (!text) return false;
+    for (auto& slot : pendingLive_) {
+        if (slot.text) continue;
+        slot = {text, done, tag};
+        return true;
+    }
+    return false;
+}
+
+void Scheduler::applyPendingLive() {
+    for (auto& slot : pendingLive_) {
+        if (!slot.text) continue;
+        const PendingLive entry = slot;
+        slot = {};   // free before the apply, so a done callback may queue the next one
+        const StateDocumentResult r = applyStateDocument(*this, entry.text, StateSource::Live);
+        platform::free(entry.text);
+        if (entry.done) entry.done(entry.tag, r);
+    }
+}
+
 void Scheduler::prepareTree() {
     // This walk is the one a pending request asked for; a request made during it still stands.
     prepareRequested_.store(false, std::memory_order_relaxed);
@@ -138,6 +181,27 @@ void Scheduler::prepareTree() {
     for (uint8_t i = 0; i < moduleCount_; i++) modules_[i]->onTreePrepared();
 }
 
+namespace {
+// Whether `m` is `root` or below it, so a pending scope removed since it was requested is never touched.
+bool holds(const MoonModule* root, const MoonModule* m) {
+    if (root == m) return true;
+    for (uint8_t i = 0; i < root->childCount(); i++)
+        if (const MoonModule* c = root->child(i); c && holds(c, m)) return true;
+    return false;
+}
+}  // namespace
+
+void Scheduler::prepareSubtrees(MoonModule* const* scopes, uint8_t count) {
+    for (uint8_t s = 0; s < count; s++) {
+        bool present = false;
+        for (uint8_t i = 0; i < moduleCount_ && !present; i++) present = modules_[i] && holds(modules_[i], scopes[s]);
+        if (!present) { prepareTree(); return; }   // gone since the request: the tree it changed is rebuilt whole
+    }
+    for (uint8_t s = 0; s < count; s++) scopes[s]->applyState();
+    applyDeferredControls(*this);
+    for (uint8_t i = 0; i < moduleCount_; i++) modules_[i]->onTreePrepared();
+}
+
 namespace {
 // One walk for every tree-wide notification, so each hook reaches the same set of modules.
 template <class F>
@@ -196,15 +260,23 @@ MoonModule* Scheduler::firstByName(const char* name) {
 
 Scheduler::SetControlResult Scheduler::setControl(const char* moduleName,
                                                  const char* controlName,
-                                                 const char* valueJson) {
+                                                 const char* valueJson, bool live) {
     MoonModule* target = firstByName(moduleName);
     if (!target) return SetControlResult::ModuleNotFound;
+    // Restored however this returns, so only the writes this one makes inherit it.
+    struct LiveScope {
+        bool& flag; bool was;
+        LiveScope(bool& f, bool l) : flag(f), was(f) { flag = flag || l; }
+        ~LiveScope() { flag = was; }
+    } liveScope(liveWrite_, live);
 
     // Module-level "enabled" pseudo-control, toggles the flag, then a full rebuild so the disabled subtree stops/starts ticking.
     if (std::strcmp(controlName, "enabled") == 0) {
         target->setEnabled(mm::json::parseBool(valueJson, "value"));
-        target->markDirty();
-        if (noteDirtyHook_) noteDirtyHook_();
+        if (!liveWrite_) {   // a service flipping a look is driving it, as for any other control
+            target->markDirty();
+            if (noteDirtyHook_) noteDirtyHook_();
+        }
         requestPrepareTree();
         // `enabled` rides the FULL state, not the per-leaf patch, so a full resync (the schema-change signal) is what tells the client.
         MoonModule::notifySchemaChanged();
@@ -224,8 +296,8 @@ Scheduler::SetControlResult Scheduler::setControl(const char* moduleName,
             case ApplyResult::ReadOnly:   return SetControlResult::ReadOnly;
         }
         reactToControlChange(target, controlName);
-        // A live control (ControlDescriptor::live) is driven continuously and is not configuration, so it never marks the tree dirty; `c` is the descriptor just applied.
-        if (!c.live) {
+        // A live control (ControlDescriptor::live), or a live write such as a service's, is driven rather than configured, so it never marks the tree dirty; `c` is the descriptor just applied.
+        if (!c.live && !liveWrite_) {
             target->markDirty();
             if (noteDirtyHook_) noteDirtyHook_();
         }
@@ -238,7 +310,12 @@ void Scheduler::reactToControlChange(MoonModule* target, const char* controlName
     // The list rebuilds first, so defineControls() re-evaluates conditional visibility for the new value.
     target->rebuildControls();
     target->onControlChanged(controlName);
-    if (target->affectsPrepare(controlName)) requestPrepareTree();
+    if (!target->affectsPrepare(controlName)) return;
+    switch (target->prepareScope()) {
+        case PrepareScope::Self:   requestPrepare(target); break;
+        case PrepareScope::Parent: requestPrepare(target->parent()); break;   // a top module has none: the tree
+        case PrepareScope::Tree:   requestPrepareTree(); break;
+    }
 }
 
 namespace {
diff --git a/src/core/module/Scheduler.h b/src/core/module/Scheduler.h
index 2cf884b24..b8df47ef0 100644
--- a/src/core/module/Scheduler.h
+++ b/src/core/module/Scheduler.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include "core/module/MoonModule.h"
+#include "core/module/StateDocument.h"   // what a live document's apply answers
 
 #include <array>
 #include <atomic>
@@ -66,6 +67,28 @@ class Scheduler {
 
     /// Ask for a rebuild at the next frame boundary, which is safe from any task.
     void requestPrepareTree() { prepareRequested_.store(true, std::memory_order_relaxed); }
+    /// Ask for one subtree's rebuild at the next frame boundary, safe from any task: a few subtrees per frame, one more widening the request to the tree.
+    void requestPrepare(MoonModule* scope) {
+        if (!scope) { requestPrepareTree(); return; }
+        for (auto& slot : preparePending_) {
+            MoonModule* expected = nullptr;
+            if (slot.compare_exchange_strong(expected, scope, std::memory_order_relaxed) || expected == scope) return;
+        }
+        requestPrepareTree();
+    }
+    /// Rebuild these subtrees now, then let every top module react once, so a reader of what they reshaped re-prepares itself; the whole tree when one has left it.
+    void prepareSubtrees(MoonModule* const* scopes, uint8_t count);
+    /// The same for one subtree.
+    void prepareSubtree(MoonModule* scope) { prepareSubtrees(&scope, 1); }
+    /// Run what was asked for since the last frame, at the frame boundary: the live documents, then the rebuild of the tree or the subtrees.
+    void preparePending();
+
+    /// What a queued live document's apply reports, with the tag its caller gave.
+    using LiveDone = void (*)(uintptr_t tag, const StateDocumentResult& result);
+    /// Apply a state document as a live source at the next frame boundary, where no module is mid-tick, so a module may ask from its own tick. The queue frees `text`, from platform::alloc; false when full, the text then still the caller's.
+    bool applyLive(char* text, LiveDone done = nullptr, uintptr_t tag = 0);
+    /// Apply the queued live documents, in the order they came.
+    void applyPendingLive();
 
 
     /// Average microseconds per tick over the last second, which is the primary performance metric.
@@ -105,8 +128,7 @@ class Scheduler {
     };
 
     /// Set one control by module and control name, applying the whole control-change reaction.
-    SetControlResult setControl(const char* moduleName, const char* controlName,
-                                const char* valueJson);
+    SetControlResult setControl(const char* moduleName, const char* controlName, const char* valueJson, bool live = false);
 
     /// The reaction to a control that changed: visibility rebuilt, the module told, and the tree re-prepared when the control reshapes it.
     void reactToControlChange(MoonModule* target, const char* controlName);
@@ -126,6 +148,13 @@ class Scheduler {
     uint8_t moduleCount_ = 0;
     /// A rebuild request, atomic because a lost request means a script edit silently never applies.
     std::atomic<bool> prepareRequested_{false};
+    /// Pending subtree rebuilds, null where free: a show moves two or three containers a frame, and one more than fits widens to the tree.
+    std::array<std::atomic<MoonModule*>, 4> preparePending_{};
+    /// A live write is under way, so a write it makes in turn, a slot driving its target, is live too and saves nothing.
+    bool liveWrite_ = false;
+    /// Live documents waiting for the frame boundary, from the loop's own task only: a show builds a look in one or two.
+    struct PendingLive { char* text = nullptr; LiveDone done = nullptr; uintptr_t tag = 0; };
+    std::array<PendingLive, 4> pendingLive_{};
     LoadAllFn loadAllHook_ = nullptr;
     NoteDirtyFn noteDirtyHook_ = nullptr;
     uint32_t startTime_ = 0;
diff --git a/src/core/module/StateDocument.cpp b/src/core/module/StateDocument.cpp
index fbb9a9731..827bd9157 100644
--- a/src/core/module/StateDocument.cpp
+++ b/src/core/module/StateDocument.cpp
@@ -25,7 +25,7 @@ struct Deferred {
     char module[MoonModule::kNameLen];
     char key[32];
     char* valueJson;   // `{"value":...}`, on the heap
-    bool stored;       // from a stored file, so clamped and not marked dirty: it is what the file already holds
+    StateSource source;   // the document's, so the write replays as the document would have made it
 };
 constexpr uint8_t kMaxDeferred = 64;   // far past a script's controls; more is refused by name rather than dropped
 // On the heap only while something waits, so a device that never defers keeps the 3 KB.
@@ -47,7 +47,7 @@ void dropDeferredSince(uint8_t from, StateDocumentResult& r) {
     releaseDeferredTable();
 }
 
-bool defer(const char* module, const char* key, const char* valueJson, bool stored) {
+bool defer(const char* module, const char* key, const char* valueJson, StateSource source) {
     if (g_deferredCount >= kMaxDeferred) return false;
     if (!g_deferred && !(g_deferred = static_cast<Deferred*>(platform::alloc(sizeof(Deferred) * kMaxDeferred)))) return false;
     const size_t n = std::strlen(valueJson) + 1;
@@ -58,7 +58,7 @@ bool defer(const char* module, const char* key, const char* valueJson, bool stor
     std::snprintf(d.module, sizeof(d.module), "%s", module);
     std::snprintf(d.key, sizeof(d.key), "%s", key);
     d.valueJson = copy;
-    d.stored = stored;
+    d.source = source;
     return true;
 }
 
@@ -83,32 +83,6 @@ constexpr const char* kNameRule = "a module name has 1 to 15 characters";
 // Keys a module object reads itself rather than as a control or a child.
 bool reserved(const char* key) { return key[0] == '$' || std::strcmp(key, "type") == 0; }
 
-void writeValue(JsonSink& sink, const JsonDoc& doc, const JsonNode* n);
-
-// An array or an object, its members written in order.
-void writeContainer(JsonSink& sink, const JsonDoc& doc, const JsonNode* n) {
-    const bool isObject = n->type == JsonType::Object;
-    sink.append(isObject ? "{" : "[");
-    for (const JsonNode* c = doc.node(n->firstChild); c; c = doc.node(c->next)) {
-        if (c != doc.node(n->firstChild)) sink.append(",");
-        if (isObject) { sink.writeJsonString(c->key); sink.append(":"); }
-        writeValue(sink, doc, c);
-    }
-    sink.append(isObject ? "}" : "]");
-}
-
-// Write a value node back out as JSON, the form the control write path parses.
-void writeValue(JsonSink& sink, const JsonDoc& doc, const JsonNode* n) {
-    switch (n->type) {
-        case JsonType::Null:   sink.append("null"); break;
-        case JsonType::Bool:   sink.append(n->intValue ? "true" : "false"); break;
-        case JsonType::Int:    sink.appendf("%ld", n->intValue); break;
-        case JsonType::String: sink.writeJsonString(n->str); break;
-        case JsonType::Array:
-        case JsonType::Object: writeContainer(sink, doc, n); break;
-    }
-}
-
 MoonModule* childNamed(MoonModule* parent, const char* name) {
     for (uint8_t i = 0; i < parent->childCount(); i++) {
         MoonModule* c = parent->child(i);
@@ -157,8 +131,10 @@ struct Applier {
         return false;
     }
 
-    bool stored() const { return source != StateSource::Request; }
+    bool stored() const { return source == StateSource::Stored || source == StateSource::Boot; }
     bool boot() const { return source == StateSource::Boot; }
+    // A live document is driven rather than configured, as a service's control write is, so it marks nothing to save.
+    bool live() const { return source == StateSource::Live; }
 
     // A stored file goes on past what this build cannot place: the failure is logged and counted, and the rest still applies.
     bool skip() {
@@ -181,7 +157,7 @@ struct Applier {
     }
 
     void finishStructure(MoonModule* parent) {
-        if (!boot()) parent->markDirty();   // a boot load restores what the file holds, so nothing is left to save
+        if (!boot() && !live()) parent->markDirty();   // a boot load restores what the file holds, so nothing is left to save
         structural = true;
         r.changes++;
     }
@@ -354,7 +330,7 @@ struct Applier {
     // `{"value":...}`, the body the control write path takes; false when it does not fit.
     bool wrapValue(JsonSink& sink, const JsonNode* value) const {
         sink.append("{\"value\":");
-        writeValue(sink, doc, value);
+        json::write(sink, doc, value);
         sink.append("}");
         return !sink.overflowed();
     }
@@ -362,18 +338,18 @@ struct Applier {
     bool setControl(MoonModule* m, const char* key, const JsonNode* value) {
         JsonSink sink;
         if (!wrapValue(sink, value)) return fail("out of memory");
-        const Scheduler::SetControlResult result = s.setControl(m->name(), key, sink.data());
+        const Scheduler::SetControlResult result = s.setControl(m->name(), key, sink.data(), live());
         const bool compiles = m->declaresControlsAtPrepare();
         if (result == Scheduler::SetControlResult::Ok && compiles && m->affectsPrepare(key)) markRebuilt(m);
         // A control a script declares exists only after the rebuild, so it waits for it; on a module the document leaves as it is, an unknown control is a mistake.
-        if (result == Scheduler::SetControlResult::ControlNotFound && compiles && isRebuilt(m)) return deferControl(m, key, sink.data(), false);
+        if (result == Scheduler::SetControlResult::ControlNotFound && compiles && isRebuilt(m)) return deferControl(m, key, sink.data());
         if (const char* why = failureOf(result)) return fail(why);
         r.changes++;
         return true;
     }
 
-    bool deferControl(MoonModule* m, const char* key, const char* valueJson, bool fromFile) {
-        if (!defer(m->name(), key, valueJson, fromFile)) return fail("too many controls wait for the rebuild");
+    bool deferControl(MoonModule* m, const char* key, const char* valueJson) {
+        if (!defer(m->name(), key, valueJson, source)) return fail("too many controls wait for the rebuild");
         r.deferred++;
         return true;
     }
@@ -434,7 +410,7 @@ struct Applier {
     // A script's controls appear when it compiles; any other unknown key is one this build lacks, dropped as the file is rewritten.
     bool storeUnknown(MoonModule* m, const char* key, const char* valueJson, bool final) {
         if (!final || !m->declaresControlsAtPrepare()) return true;
-        return deferControl(m, key, valueJson, true);
+        return deferControl(m, key, valueJson);
     }
 
     void react(MoonModule* m, const char* key, bool live) {
@@ -631,13 +607,13 @@ void closePath(JsonSink& sink, uint8_t depth) {
 }
 
 // One prepare and one full resync for the whole document, however much it changed; the scripts compile at that prepare, and the controls they declare are set right after it.
-void settle(Scheduler& scheduler, bool structural, const StateDocumentResult& r) {
+void settle(Scheduler& scheduler, bool structural, const StateDocumentResult& r, bool live) {
     if (structural) {
         scheduler.requestPrepareTree();
         MoonModule::notifySchemaChanged();
     }
     if (r.deferred) scheduler.requestPrepareTree();
-    if (r.changes) scheduler.noteDirty();
+    if (r.changes && !live) scheduler.noteDirty();
 }
 
 }  // namespace
@@ -655,7 +631,7 @@ StateDocumentResult applyStateDocument(Scheduler& scheduler, const char* text, S
     // A failed document leaves nothing waiting for the rebuild: what came before the failure stays applied, but no deferred write lands after it.
     if (!r.ok) dropDeferredSince(deferredBefore, r);
     // At boot the phases after the load set up, build and prepare the whole tree, and the file already holds what was loaded.
-    if (source != StateSource::Boot) settle(scheduler, a.structural, r);
+    if (source != StateSource::Boot) settle(scheduler, a.structural, r, source == StateSource::Live);
     return r;
 }
 
@@ -711,7 +687,7 @@ void writeFlatValues(JsonSink& out, const JsonDoc& doc, const char* prefix) {
         out.append(",");
         out.writeJsonString(rest);
         out.append(":");
-        writeValue(out, doc, n);
+        json::write(out, doc, n);
     }
 }
 
@@ -806,14 +782,15 @@ void applyDeferredControls(Scheduler& scheduler) {
     for (uint8_t i = 0; i < g_deferredCount; i++) {
         Deferred& d = g_deferred[i];
         bool ok = true;
-        if (d.stored) {
+        if (d.source == StateSource::Stored || d.source == StateSource::Boot) {
             // What the file holds, so clamped, reacted to when it changed something, and never marked for a save.
             MoonModule* m = scheduler.firstByName(d.module);
             const ControlDescriptor* c = m ? controlNamed(*m, d.key) : nullptr;
             ok = c != nullptr;
             if (c && storeClamped(*c, d.valueJson)) scheduler.reactToControlChange(m, d.key);
         } else {
-            ok = scheduler.setControl(d.module, d.key, d.valueJson) == Scheduler::SetControlResult::Ok;
+            // A live document's write stays unsaved after the rebuild as it would have before it.
+            ok = scheduler.setControl(d.module, d.key, d.valueJson, d.source == StateSource::Live) == Scheduler::SetControlResult::Ok;
         }
         if (!ok) std::printf("state document: %s.%s did not apply after the rebuild\n", d.module, d.key);
         platform::free(d.valueJson);
diff --git a/src/core/module/StateDocument.h b/src/core/module/StateDocument.h
index 5fa1b05df..287dfc09a 100644
--- a/src/core/module/StateDocument.h
+++ b/src/core/module/StateDocument.h
@@ -18,6 +18,7 @@ class Scheduler;
 /// Where a document comes from, which decides how strictly it applies.
 enum class StateSource : uint8_t {
     Request,   ///< a client's document, refused whole on the first problem so nothing changes by half
+    Live,      ///< a request that drives rather than configures, such as a show building its look: checked the same, and nothing it changes is marked to save
     Stored,    ///< a file the device wrote, onto the running tree: what this build cannot place is skipped, values clamp, code-wired children stay
     Boot,      ///< the same file during boot, before any setup: no lifecycle and no reactions, which the boot phases run after it
 };
diff --git a/src/core/moonlive/MoonLive.cpp b/src/core/moonlive/MoonLive.cpp
index 9943875e2..13528029a 100644
--- a/src/core/moonlive/MoonLive.cpp
+++ b/src/core/moonlive/MoonLive.cpp
@@ -24,7 +24,7 @@ void MoonLive::freeCode() {
     hasErrorPos_ = false;
     // The entry table describes code that is gone, so entry() would hand out a freed address.
     entryCount_ = 0;
-    // The pool is reclaimed when the next compile interns from zero, not cleared mid-compile.
+    // The pool stays until the next compile replaces it, so text a control still names is never freed under it.
     controlCount_ = 0;
     stringLen_ = 0;
 }
@@ -82,11 +82,16 @@ bool MoonLive::compile(uint8_t r, uint8_t g, uint8_t b) {
 bool MoonLive::compile(const char* source, const BuiltinTable& table, const SysVarTable& sysvars) {
     Staging staging(codeCapFor(countTokens(source)));
     if (!staging) { freeCode(); error_ = "no memory to compile"; return false; }
-    // strings_ interns literals into memory outliving the compile, and freeCode owns clearing it.
+    // A pool sized to this script's literals, the new one beside the old until the compile succeeds, so a control name read meanwhile still points at text.
+    const uint32_t want = countStringBytes(source);
+    if (want > CompileResult::kMaxStrings) { freeCode(); error_ = "the script's strings pass 16 KB"; return false; }
+    char* pool = want ? static_cast<char*>(platform::alloc(want)) : nullptr;
+    if (want && !pool) { freeCode(); error_ = "no memory for the script's strings"; return false; }
     CompileResult cr = compileSource(source, table, sysvars, staging.p, staging.n,
-                                     nullptr, nullptr, strings_, CompileResult::kStringPool);
+                                     nullptr, nullptr, pool, static_cast<uint16_t>(want));
     // errorCol is one-based and every consumer counts from zero, so it converts at this boundary.
     if (!cr.ok) {
+        platform::free(pool);
         freeCode();
         // One file-static line, since a per-result buffer dangled and a per-engine one repeats.
         if (cr.error == kSpillRefused) {
@@ -104,10 +109,13 @@ bool MoonLive::compile(const char* source, const BuiltinTable& table, const SysV
         return false;
     }
     // Before publishing, since ensureArena reads the previous count to know which slots are new.
-    if (!ensureArena(cr.members, cr.memberCount)) { freeCode(); error_ = "no control memory"; return false; }
+    if (!ensureArena(cr.members, cr.memberCount)) { platform::free(pool); freeCode(); error_ = "no control memory"; return false; }
     // Publish the control set only once place() succeeds, never for code that is not running.
     void* block = place(staging.p, cr.len);
-    if (!block) return false;                                      // controlCount_/controls_ unchanged
+    if (!block) { platform::free(pool); return false; }            // controlCount_/controls_ unchanged
+    retirePool();
+    strings_ = pool;
+    stringCap_ = static_cast<uint16_t>(want);
     // Names included, since a result's `name` points into source the caller frees on return.
     entryCount_ = cr.entryCount < kMaxEntryPoints ? cr.entryCount : kMaxEntryPoints;
     for (uint8_t i = 0; i < entryCount_; i++) {
@@ -187,9 +195,24 @@ bool MoonLive::compileAnimated() {
     return true;
 }
 
+MoonLive::~MoonLive() {
+    free();
+    platform::free(retired_);   // nothing names its text once the engine goes
+}
+
+/// The current pool retires and the one retired before it goes: the module's controls name text in the current one until it rebuilds them.
+void MoonLive::retirePool() {
+    platform::free(retired_);
+    retired_ = strings_;
+    retiredCap_ = stringCap_;
+    strings_ = nullptr;
+    stringCap_ = 0;
+}
+
 /// Release everything: the exec block, the fn pointers and the control arena.
 void MoonLive::free() {
     freeCode();                       // exec block + fn pointers
+    retirePool();                     // the pool goes with the program, once the module's controls stop naming it
     if (ctrlArena_) platform::free(ctrlArena_);   // full release also releases the control arena
     ctrlArena_ = nullptr;
     controlCount_ = 0;
diff --git a/src/core/moonlive/MoonLive.h b/src/core/moonlive/MoonLive.h
index bf5e3e600..161980ac3 100644
--- a/src/core/moonlive/MoonLive.h
+++ b/src/core/moonlive/MoonLive.h
@@ -22,7 +22,7 @@ class MoonLive {
     /// An engine with nothing compiled, until a compile call fills it.
     MoonLive() = default;
     /// Release the exec block and the control arena.
-    ~MoonLive() { free(); }
+    ~MoonLive();
 
     /// Never copied: each scripted module holds its own engine, which owns a heap-backed exec block that a copy would double-free.
     MoonLive(const MoonLive&) = delete;
@@ -175,14 +175,19 @@ class MoonLive {
 
     /// Drop the compiled code, keeping the control arena, so a bound control pointer stays valid and keeps the live value the user set.
     void freeCode();
+    /// Retire the string pool, freeing the one retired before it.
+    void retirePool();
 
     /// How many bytes of machine code the current program is, which a script author asks, where `heapBytes` answers what the module takes from the heap.
     size_t codeLen() const { return codeLen_; }
     /// The allocated exec-block size, which is the heap held.
     size_t codeCap() const { return codeCap_; }
 
-    /// Every heap byte this engine holds: the exec block plus the control arena, without the inline string pool the module's own sizeof counts.
-    size_t heapBytes() const { return codeCap_ + (ctrlArena_ ? kArenaBytes : 0); }
+    /// Every heap byte this engine holds: the exec block, the control arena and the string pool.
+    size_t heapBytes() const { return codeCap_ + (ctrlArena_ ? kArenaBytes : 0) + stringCap_ + retiredCap_; }
+
+    /// The control arena's address, which names this engine to a host table holding things on its behalf, as `JsonFetch` holds documents.
+    const void* arena() const { return ctrlArena_; }
 
     /// Write the program's size and the one budget it is closest to exhausting into `out`, shown past half full, one budget since the others follow from code size.
     void describe(char* out, size_t cap) const {
@@ -192,7 +197,6 @@ class MoonLive {
         struct Budget { const char* name; uint32_t used, max; };
         const Budget budgets[] = {
             {"controls", controlCount_, kMaxCtrls},
-            {"strings",  stringLen_,    CompileResult::kStringPool},
             {"code",     static_cast<uint32_t>(codeLen_), kCodeCap},
             {"entries",  entryCount_,   kMaxEntryPoints},
         };
@@ -276,9 +280,15 @@ class MoonLive {
     uint8_t* ctrlArena_ = nullptr;   // live control + system-variable bytes (platform::alloc, kArenaBytes, fixed)
     uint8_t  controlCount_ = 0;      // controls the current program declared
     DeclaredControl controls_[kMaxCtrls] = {};   // the declared-control metadata for the binding
-    /// The string pool, copied so the engine outlives the source text it was built from.
-    char strings_[CompileResult::kStringPool] = {};
-    /// How much of the pool the current program uses, for the card's headroom readout.
+    /// The string pool, sized to the program's literals and copied so the engine outlives the source text it was built from; a script with none holds none.
+    char*    strings_ = nullptr;
+    /// Its size.
+    uint16_t stringCap_ = 0;
+    /// The previous program's pool, kept until the next swap, since a module's control names point into it until it rebuilds them.
+    char*    retired_ = nullptr;
+    /// Its size.
+    uint16_t retiredCap_ = 0;
+    /// How much of the pool the current program uses.
     uint16_t stringLen_ = 0;
 };
 
diff --git a/src/core/moonlive/MoonLiveBuiltins.h b/src/core/moonlive/MoonLiveBuiltins.h
index 94a9238ea..688f19420 100644
--- a/src/core/moonlive/MoonLiveBuiltins.h
+++ b/src/core/moonlive/MoonLiveBuiltins.h
@@ -16,7 +16,8 @@
 
 namespace mm::moonlive {
 
-enum class CtrlType : uint8_t { Int, Byte, Bool, Fixed, Str };
+/// A value's type: the numbers, a string literal, and a JSON document the host holds, which a script names by a handle in an int's slot.
+enum class CtrlType : uint8_t { Int, Byte, Bool, Fixed, Str, Json };
 
 /// Bytes one array element occupies, where packing pays: a byte array costs a quarter of an int one, with no PSRAM to absorb it.
 constexpr uint8_t ctrlWidth(CtrlType t) {
@@ -65,6 +66,10 @@ struct Builtin {
     const char*  retStruct = nullptr;
     /// Whether the arguments may be all whole or all fixed, with the result following them, as `min` and `abs` are.
     bool         sameTypeArgs = false;
+    /// Which arguments are JSON documents, a bit per position, where a string literal is parsed into one.
+    uint8_t      jsonArgs = 0;
+    /// Whether the result is a JSON document.
+    bool         jsonReturn = false;
 };
 
 /// Most fields a struct type carries: three for a color or a coordinate, four for a color with white.
@@ -92,6 +97,18 @@ struct StructDef {
         }                                                                             \
     } while (0)
 
+/// The entry among the first `count` of `items` named exactly the `len` characters at `name`, or null: the lookup both tables share.
+template <typename T>
+const T* findNamed(const T* items, uint8_t count, const char* name, size_t len) {
+    for (uint8_t i = 0; i < count; i++) {
+        const char* n = items[i].name;
+        size_t j = 0;
+        for (; j < len && n[j]; j++) if (n[j] != name[j]) break;
+        if (j == len && n[j] == 0) return &items[i];
+    }
+    return nullptr;
+}
+
 /// A fixed-capacity table the host fills and the compiler reads, looked up by name.
 struct BuiltinTable {
     /// How many builtins one table holds, with headroom because a full table fails silently.
@@ -143,15 +160,7 @@ struct BuiltinTable {
     /// Every registered name, for the overflow diagnostic. Not used on any hot path.
     uint8_t registered() const { return count; }
     /// The builtin registered under `name`, or null when there is none.
-    const Builtin* find(const char* name, size_t len) const {
-        for (uint8_t i = 0; i < count; i++) {
-            const char* n = items[i].name;
-            size_t j = 0;
-            for (; j < len && n[j]; j++) if (n[j] != name[j]) break;
-            if (j == len && n[j] == 0) return &items[i];
-        }
-        return nullptr;
-    }
+    const Builtin* find(const char* name, size_t len) const { return findNamed(items, count, name, len); }
 };
 
 /// Bytes the script's own members may occupy: the byte budget the arena allocates, where the count is what the record tables hold.
@@ -230,15 +239,7 @@ struct SysVarTable {
         return true;
     }
     /// The system variable registered under `name`, or null when there is none.
-    const SysVar* find(const char* name, size_t len) const {
-        for (uint8_t i = 0; i < count; i++) {
-            const char* n = items[i].name;
-            size_t j = 0;
-            for (; j < len && n[j]; j++) if (n[j] != name[j]) break;
-            if (j == len && n[j] == 0) return &items[i];
-        }
-        return nullptr;
-    }
+    const SysVar* find(const char* name, size_t len) const { return findNamed(items, count, name, len); }
 };
 
 }  // namespace mm::moonlive
diff --git a/src/core/moonlive/MoonLiveBuiltins_service.h b/src/core/moonlive/MoonLiveBuiltins_service.h
index 1ef2467fc..7889c1f51 100644
--- a/src/core/moonlive/MoonLiveBuiltins_service.h
+++ b/src/core/moonlive/MoonLiveBuiltins_service.h
@@ -5,6 +5,7 @@
 #include "core/module/Scheduler.h"
 #include "platform/platform.h"   // gpioInputBegin / gpioRead / gpioWrite
 #include "core/moonlive/MoonLiveBuiltins_common.h"   // the neutral half: math, waveforms, print
+#include "core/util/JsonFetch.h"   // the documents a script's json values name
 
 #include <cstdint>
 #include <cstdio>
@@ -18,7 +19,7 @@
 ///
 /// ## Its own table
 ///
-/// A service has no canvas, so a table offering pixel writes or coordinates would promise what it cannot keep. It gets the two things that make it a service instead: it reads a pin and it writes a control.
+/// A service has no canvas, so a table offering pixel writes or coordinates would promise what it cannot keep. It gets the things that make it a service instead: it reads a pin, it writes a control, and it reads and sends JSON.
 
 namespace mm::moonlive {
 
@@ -81,8 +82,149 @@ extern "C" inline uint32_t mm_service_setControl(const uintptr_t* args, uint32_t
     char valueJson[32];
     std::snprintf(valueJson, sizeof(valueJson), "{\"value\":%d}",
                   static_cast<int>(static_cast<int32_t>(args[1])));
-    // Through the primitive every transport uses, so a script write looks like an OSC message.
-    return sched->setControl("Control", name, valueJson) == Scheduler::SetControlResult::Ok ? 1u : 0u;
+    // Through the primitive every transport uses, so a script write looks like an OSC message; live, since a script drives a value rather than configures it, so nothing is saved.
+    return sched->setControl("Control", name, valueJson, /*live=*/true) == Scheduler::SetControlResult::Ok ? 1u : 0u;
+}
+
+// --- JSON: thin wrappers over JsonFetch and JsonUtil, the compiled reach -------------------------
+
+/// The document a handle names for the calling script, or null: the documents live in `JsonFetch`, and the arena every host call receives names their owner.
+inline json::JsonDoc* scriptDoc(uintptr_t handle, const uint8_t* arena) {
+    return JsonFetch::instance().doc(arena, static_cast<int>(handle));
+}
+
+/// A document parsed from the script's own text, which the compiler also calls where a string literal stands for a json value.
+extern "C" inline uint32_t mm_json_parse(const uintptr_t* args, uint32_t, const uint8_t* arena) {
+    return static_cast<uint32_t>(JsonFetch::instance().literal(arena, reinterpret_cast<const char*>(args[0])));
+}
+
+/// A document fetched from a URL, and again every `seconds` while the script reads it; one second at the least.
+extern "C" inline uint32_t mm_json_get(const uintptr_t* args, uint32_t, const uint8_t* arena) {
+    const int32_t seconds = signedArg(args[1]);
+    const uint32_t periodMs = seconds < 1 ? 1000u : static_cast<uint32_t>(seconds) * 1000u;
+    return static_cast<uint32_t>(JsonFetch::instance().fetch(arena, reinterpret_cast<const char*>(args[0]), periodMs));
+}
+
+/// 1 when a new document arrived since the script last asked.
+extern "C" inline uint32_t mm_json_changed(const uintptr_t* args, uint32_t, const uint8_t* arena) {
+    return JsonFetch::instance().changed(arena, static_cast<int>(args[0])) ? 1u : 0u;
+}
+
+/// The HTTP status of the last answer, 0 while none came.
+extern "C" inline uint32_t mm_json_status(const uintptr_t* args, uint32_t, const uint8_t* arena) {
+    return static_cast<uint32_t>(JsonFetch::instance().status(arena, static_cast<int>(args[0])));
+}
+
+/// The number at a JSON Pointer, a quoted one included, as a whole number and in fixed point; zeros when there is none.
+inline void scriptNumber(const uintptr_t* args, const uint8_t* arena, long& whole, int32_t& fixed) {
+    whole = 0;
+    fixed = 0;
+    const json::JsonDoc* d = scriptDoc(args[0], arena);
+    if (!d || !json::readNumber(json::at(*d, reinterpret_cast<const char*>(args[1])), whole, fixed)) { whole = 0; fixed = 0; }
+}
+
+/// The number at a JSON Pointer, truncated to a whole one; 0 when absent.
+extern "C" inline uint32_t mm_json_int(const uintptr_t* args, uint32_t, const uint8_t* arena) {
+    long whole; int32_t fixed;
+    scriptNumber(args, arena, whole, fixed);
+    return static_cast<uint32_t>(static_cast<int32_t>(whole));
+}
+
+/// The number at a JSON Pointer as fixed point, its fraction kept; 0 when absent.
+extern "C" inline uint32_t mm_json_fixed(const uintptr_t* args, uint32_t, const uint8_t* arena) {
+    long whole; int32_t fixed;
+    scriptNumber(args, arena, whole, fixed);
+    return static_cast<uint32_t>(fixed);
+}
+
+/// How many elements or members the array or object at a JSON Pointer holds; 0 for anything else.
+extern "C" inline uint32_t mm_json_size(const uintptr_t* args, uint32_t, const uint8_t* arena) {
+    const json::JsonDoc* d = scriptDoc(args[0], arena);
+    const json::JsonNode* n = d ? json::at(*d, reinterpret_cast<const char*>(args[1])) : nullptr;
+    if (!n || (n->type != json::JsonType::Array && n->type != json::JsonType::Object)) return 0;
+    uint32_t count = 0;
+    for (int i = n->firstChild; i >= 0; i = d->nodes[i].next) count++;
+    return count;
+}
+
+/// Set a whole number at a JSON Pointer, creating the members on the way; 1 when it took.
+extern "C" inline uint32_t mm_json_setInt(const uintptr_t* args, uint32_t, const uint8_t* arena) {
+    json::JsonDoc* d = scriptDoc(args[0], arena);
+    return d && json::setInt(*d, reinterpret_cast<const char*>(args[1]), signedArg(args[2])) ? 1u : 0u;
+}
+
+/// Set a fixed-point number at a JSON Pointer; 1 when it took.
+extern "C" inline uint32_t mm_json_setFixed(const uintptr_t* args, uint32_t, const uint8_t* arena) {
+    json::JsonDoc* d = scriptDoc(args[0], arena);
+    return d && json::setFixed(*d, reinterpret_cast<const char*>(args[1]), signedArg(args[2])) ? 1u : 0u;
+}
+
+/// Set the script's own text at a JSON Pointer; 1 when it took.
+extern "C" inline uint32_t mm_json_setText(const uintptr_t* args, uint32_t, const uint8_t* arena) {
+    json::JsonDoc* d = scriptDoc(args[0], arena);
+    return d && json::setString(*d, reinterpret_cast<const char*>(args[1]), reinterpret_cast<const char*>(args[2])) ? 1u : 0u;
+}
+
+/// Append the script's own text to the string at a JSON Pointer; 1 when it took.
+extern "C" inline uint32_t mm_json_appendText(const uintptr_t* args, uint32_t, const uint8_t* arena) {
+    json::JsonDoc* d = scriptDoc(args[0], arena);
+    return d && json::appendText(*d, reinterpret_cast<const char*>(args[1]), reinterpret_cast<const char*>(args[2])) ? 1u : 0u;
+}
+
+/// Append another document's value, as text, to the string at a JSON Pointer; 1 when it took.
+extern "C" inline uint32_t mm_json_append(const uintptr_t* args, uint32_t, const uint8_t* arena) {
+    json::JsonDoc* dst = scriptDoc(args[0], arena);
+    const json::JsonDoc* src = scriptDoc(args[2], arena);
+    return dst && src && json::appendValue(*dst, reinterpret_cast<const char*>(args[1]), *src,
+                                           reinterpret_cast<const char*>(args[3])) ? 1u : 0u;
+}
+
+/// Copy the value at one document's pointer to another's, text and whole objects included; 1 when it took.
+extern "C" inline uint32_t mm_json_copy(const uintptr_t* args, uint32_t, const uint8_t* arena) {
+    json::JsonDoc* dst = scriptDoc(args[0], arena);
+    const json::JsonDoc* src = scriptDoc(args[2], arena);
+    return dst && src && json::copyValue(*dst, reinterpret_cast<const char*>(args[1]), *src,
+                                         reinterpret_cast<const char*>(args[3])) ? 1u : 0u;
+}
+
+/// Apply a document to this device, live, and answer a handle to the reply.
+extern "C" inline uint32_t mm_json_push(const uintptr_t* args, uint32_t, const uint8_t* arena) {
+    return static_cast<uint32_t>(JsonFetch::instance().push(arena, nullptr, static_cast<int>(args[0])));
+}
+
+/// Send a document to another device by name, or to a URL, and answer a handle to the reply.
+extern "C" inline uint32_t mm_json_pushTo(const uintptr_t* args, uint32_t, const uint8_t* arena) {
+    return static_cast<uint32_t>(JsonFetch::instance().push(arena, reinterpret_cast<const char*>(args[0]),
+                                                            static_cast<int>(args[1])));
+}
+
+/// Register the JSON builtins: `json` converts a literal and the rest read, write and send documents.
+inline void addJsonBuiltins(BuiltinTable& t) {
+    auto add = [&t](const char* name, uint8_t argc, HostCallFn fn, uint8_t jsonArgs, uint8_t byStr,
+                    bool jsonReturn, uint8_t fixedArgs = 0, bool fixedReturn = false) {
+        Builtin b{name, argc, /*returns*/ true, BuiltinKind::Call, fn, {}};
+        b.jsonArgs = jsonArgs;
+        b.byStr = byStr;
+        b.jsonReturn = jsonReturn;
+        b.fixedArgs = fixedArgs;
+        b.fixedReturn = fixedReturn;
+        t.add(b);
+    };
+    add("json",         1, &mm_json_parse,    0x0, 0x1, true);
+    add("getJson",      2, &mm_json_get,      0x0, 0x1, true);
+    add("jsonChanged",  1, &mm_json_changed,  0x1, 0x0, false);
+    add("jsonStatus",   1, &mm_json_status,   0x1, 0x0, false);
+    add("jsonInt",      2, &mm_json_int,      0x1, 0x2, false);
+    add("jsonFixed",    2, &mm_json_fixed,    0x1, 0x2, false, 0x0, true);
+    add("jsonSize",     2, &mm_json_size,     0x1, 0x2, false);
+    add("jsonSetInt",   3, &mm_json_setInt,   0x1, 0x2, false);
+    add("jsonSetFixed", 3, &mm_json_setFixed, 0x1, 0x2, false, 0x4);
+    add("jsonSetText",  3, &mm_json_setText,  0x1, 0x6, false);
+    add("jsonCopy",     4, &mm_json_copy,     0x5, 0xA, false);
+    add("jsonAppendText", 3, &mm_json_appendText, 0x1, 0x6, false);
+    add("jsonAppend",   4, &mm_json_append,   0x5, 0xA, false);
+    add("pushJson",     1, &mm_json_push,     0x1, 0x0, true);
+    add("pushJsonTo",   2, &mm_json_pushTo,   0x2, 0x1, true);
 }
 
 // --- The tables ---------------------------------------------------------------------------------
@@ -114,6 +256,8 @@ inline const BuiltinTable& serviceBuiltins() {
     // setControl(name, v) -> 0/1, where byStr 0x1 marks the first argument as a quoted name.
     t.add({"setControl", 2, /*returns*/ true, BuiltinKind::Call, &mm_service_setControl, {},
            /*byRef*/ 0, /*byStr*/ 0x1});
+    // The JSON vocabulary: read the internet, build this device's look, send another device its own.
+    addJsonBuiltins(t);
         return t;
     }();
     return table;
diff --git a/src/core/moonlive/MoonLiveCompiler.cpp b/src/core/moonlive/MoonLiveCompiler.cpp
index bf8725dea..0e78e4955 100644
--- a/src/core/moonlive/MoonLiveCompiler.cpp
+++ b/src/core/moonlive/MoonLiveCompiler.cpp
@@ -75,6 +75,30 @@ struct Lexer {
         return true;
     }
 
+    /// Whether `q` is the `)delim"` that ends a raw literal.
+    static bool closesRaw(const char* q, const char* delim, size_t dLen) {
+        return *q == ')' && std::strncmp(q + 1, delim, dLen) == 0 && q[1 + dLen] == '"';
+    }
+
+    /// Whether a character may sit in a raw literal's delimiter, as C++ allows: none of a space, a parenthesis, a backslash or a quote.
+    static bool isDelimChar(char c) { return c && c != '(' && c != ')' && c != '\\' && c != '"' && !isSpace(c); }
+
+    /// Read a raw literal at `R"`, its text spanned between the delimiters with nothing decoded.
+    void readRawString() {
+        const char* delim = p + 2;
+        const char* open = delim;
+        while (open - delim < 16 && isDelimChar(*open)) open++;
+        if (*open != '(') { kind = Tok::Error; err = "a raw string opens with R\"( and closes with )\""; return; }
+        const size_t dLen = static_cast<size_t>(open - delim);
+        identBeg = open + 1;
+        const char* q = identBeg;
+        while (*q && !closesRaw(q, delim, dLen)) q++;
+        if (!*q) { kind = Tok::Error; err = "unterminated raw string"; return; }
+        identLen = static_cast<size_t>(q - identBeg);
+        p = q + 2 + dLen;
+        kind = Tok::String;
+    }
+
     /// Lex the next token into this lexer's fields.
     void advance() {
         for (;;) {
@@ -118,6 +142,8 @@ struct Lexer {
         // '/' only reaches here when it is NOT the `//` a comment starts with (handled above).
         if (c == '/') { p++; kind = Tok::Slash;   return; }
         if (c == '%') { p++; kind = Tok::Percent; return; }
+        // A raw literal, C++'s R"delim( ... )delim": it spans lines and keeps every quote, so a JSON document pastes in as it is.
+        if (c == 'R' && p[1] == '"') { readRawString(); return; }
         // A control's UI label, spanned like an identifier since both are source bytes; no escapes.
         if (c == '"') {
             p++;
@@ -151,6 +177,8 @@ struct Lexer {
 constexpr const char* kJoinsConditions = "&&, || and ! join the conditions of an if, not values";
 /// What a whole struct where one value belongs says.
 constexpr const char* kOneFieldAtATime = "a struct is read one field at a time: write name.field";
+/// What a JSON document where a number belongs says.
+constexpr const char* kJsonIsNoNumber = "a json value is a document: read a number with jsonInt";
 /// What a comparison after a negated value says.
 constexpr const char* kNegatesWhatFollows = "! negates what follows it: write !(a < b) to negate a comparison";
 
@@ -204,6 +232,8 @@ struct Parser {
     // No AST, so the type rides alongside the register and every parse function sets it.
     /// Whether the value last parsed is Q16.16 rather than a plain integer.
     bool               exprIsFixed = false;
+    /// Whether the value last parsed is a JSON document's handle, which no arithmetic takes.
+    bool               exprIsJson = false;
     /// Whether a same-type builtin's arguments, last parsed, were fixed, which its result follows.
     bool               argsFixed = false;
     // A literal converts by patching its Const, since its meaning is visible at the call site.
@@ -517,8 +547,10 @@ struct Parser {
             lex.advance();
             const bool lhsFixed = exprIsFixed;
             const int  lhsLit   = exprLitConst;
+            const bool lhsJson  = exprIsJson;
             VReg rhs = parseTerm();
             if (failed) return 0;
+            if (lhsJson || exprIsJson) { fail(kJsonIsNoNumber); return 0; }
             bool outFixed = false;
             if (!meet(lhsFixed, lhsLit, exprIsFixed, exprLitConst, outFixed)) return 0;
             exprIsFixed = outFixed;
@@ -559,6 +591,39 @@ struct Parser {
         return dst;
     }
 
+    // A string literal where a document belongs is parsed into one, as C++ converts through a constructor: the host's `json` builtin, named after the type.
+    /// Parse a JSON document: a string literal, converted, or an expression that is already one.
+    VReg parseJsonValue() {
+        if (lex.kind == Tok::String) return convertLiteral();
+        VReg v = parseExpr();
+        if (!failed && !exprIsJson) fail("this is a json document: a string literal or a json value");
+        return v;
+    }
+
+    /// Parse the string literal at the cursor into a document, through the host's `json` builtin.
+    VReg convertLiteral() {
+        const Builtin* ctor = table.find("json", 4);
+        if (!ctor || !ctor->jsonReturn || ctor->argc != 1 || ctor->kind != BuiltinKind::Call)
+            { fail("only a service script has json documents"); return 0; }
+        const char* interned = internString(lex.identBeg, lex.identLen);
+        if (!interned) { fail("no room for this script's strings"); return 0; }
+        lex.advance();
+        if (slotHighWater >= kMaxLocals) { fail("expression too deeply nested"); return 0; }
+        VReg text = alloc();
+        emit({IrOp::ConstPtr, text, 0,0,0,0, 0, nullptr, interned, {}});
+        const uint8_t argBase = slotHighWater;
+        emit({IrOp::Spill, 0, text, 0,0,0, slotHighWater++, nullptr, {}});
+        if (slotHighWater > slotsUsed) slotsUsed = slotHighWater;
+        freeTemp(text);
+        VReg doc = alloc();
+        emit({IrOp::Call, doc, 0, 1, 0, 0, argBase, ctor->fn, {}});
+        slotHighWater = argBase;
+        exprIsFixed = false;
+        exprIsJson = true;
+        exprLitConst = -1;
+        return doc;
+    }
+
     /// Parse a term: a run of primaries joined by the tighter-binding operators.
     VReg parseTerm() {
         VReg lhs = parsePrimary();
@@ -567,9 +632,11 @@ struct Parser {
             const Tok op = lex.kind;
             const bool lhsFixed = exprIsFixed;
             const int  lhsLit   = exprLitConst;
+            const bool lhsJson  = exprIsJson;
             lex.advance();
             VReg rhs = parsePrimary();
             if (failed) return 0;
+            if (lhsJson || exprIsJson) { fail(kJsonIsNoNumber); return 0; }
             bool bothFixed = false;
             if (!meet(lhsFixed, lhsLit, exprIsFixed, exprLitConst, bothFixed)) return 0;
             exprLitConst = -1;
@@ -617,6 +684,7 @@ struct Parser {
         if (!expect(Tok::LParen, "expected '(' after the conversion")) return 0;
         VReg v = parseExpr();
         if (failed) return 0;
+        if (exprIsJson) { fail(kJsonIsNoNumber); return 0; }
         if (up && exprIsFixed) { fail("this value is already fixed"); return 0; }
         if (!up && !exprIsFixed) { fail("this value is already a whole number"); return 0; }
         // A literal is range-checked here, since `toFixed(40000)` would shift past Q16.16.
@@ -670,6 +738,7 @@ struct Parser {
             VReg v = alloc();
             emit({IrOp::Reload, v, 0,0,0,0, locals[li].slot + f, nullptr, {}});
             exprIsFixed = (locals[li].type == CtrlType::Fixed);
+            exprIsJson = (locals[li].type == CtrlType::Json);
             return v;
         }
         // One lookup answers both, since a control is a member the UI shows.
@@ -680,6 +749,7 @@ struct Parser {
         parseCall(&out);   // otherwise a call used as an expression must return a value
         // The builtin's business: uvX and uvY hand back a fixed coordinate, and min follows its arguments.
         exprIsFixed = called && (called->fixedReturn || (called->sameTypeArgs && argsFixed));
+        exprIsJson = called && called->jsonReturn;
         exprLitConst = -1;
         return out;
     }
@@ -715,6 +785,7 @@ struct Parser {
         if (members[mi].count > 1) { fail("an array needs an index: write name[i]"); return 0; }
         VReg v = alloc();
         exprIsFixed = (members[mi].type == CtrlType::Fixed);
+        exprIsJson = (members[mi].type == CtrlType::Json);
         // One load for every scalar, since a slot already holds what its type promises.
         emit({IrOp::LoadCtrl32, v, 0,0,0,0, members[mi].offset, nullptr, {}});
         return v;
@@ -726,6 +797,7 @@ struct Parser {
         if (failed) return 0;
         // Set here, not per branch, so a new kind of primary cannot forget either question.
         exprIsFixed = false;
+        exprIsJson = false;
         exprLitConst = -1;
         if (lex.kind == Tok::Ident && (atKeyword("toFixed", 7) || atKeyword("toInt", 5))) return parseConversion();
         if (lex.kind == Tok::LParen) {                   // grouping
@@ -750,6 +822,7 @@ struct Parser {
             }
             VReg v = parsePrimary();
             if (failed) return 0;
+            if (exprIsJson) { fail(kJsonIsNoNumber); return 0; }
             VReg m = alloc();
             emit({IrOp::Const, m, 0,0,0,0, -1, nullptr, {}});
             VReg dst = alloc();
@@ -781,6 +854,8 @@ struct Parser {
             return v;
         }
         if (lex.kind == Tok::Ident) return parseNamePrimary();
+        // A token the lexer refused says why itself, which an unterminated raw string most needs.
+        if (lex.kind == Tok::Error) { fail(lex.err); return 0; }
         fail(lex.kind == Tok::Not ? kJoinsConditions : "expected a number, a control name, or a function call");
         return 0;
     }
@@ -893,6 +968,16 @@ struct Parser {
                 }
                 // A string label and a member by name, only where the builtin asks for them.
                 VReg v = 0;
+                if ((fn->jsonArgs >> n) & 1u) {
+                    v = parseJsonValue();
+                    if (failed) return false;
+                    if (slotHighWater >= kMaxLocals) { fail("too many arguments to hold"); return false; }
+                    emit({IrOp::Spill, 0, v, 0,0,0, slotHighWater++, nullptr, {}});
+                    freeTemp(v);
+                    n++;
+                    if (lex.kind == Tok::Comma) { lex.advance(); continue; }
+                    break;
+                }
                 const bool wantStr = (fn->byStr >> n) & 1u;
                 if (wantStr && lex.kind != Tok::String) {
                     fail("this argument must be a name in quotes"); return false;
@@ -913,7 +998,8 @@ struct Parser {
                     const int mi = findMember(lex.identBeg, lex.identLen);
                     if (mi < 0) { fail("no member of that name is declared in this class"); return false; }
                     // The type must have a widget, and drive one value rather than an array.
-                    if (members[mi].type == CtrlType::Fixed || members[mi].type == CtrlType::Str)
+                    if (members[mi].type == CtrlType::Fixed || members[mi].type == CtrlType::Str ||
+                        members[mi].type == CtrlType::Json)
                         { fail("a control binds an int, byte or bool member"); return false; }
                     if (members[mi].count > 1)
                         { fail("a control binds a single member, not an array"); return false; }
@@ -926,6 +1012,7 @@ struct Parser {
                     // One type across the arguments, a literal adopting it, and the result following it.
                     v = parseExpr();
                     if (failed) return false;
+                    if (exprIsJson) { fail(kJsonIsNoNumber); return false; }
                     if (n == 0) {
                         groupFixed = exprIsFixed;
                         groupLit = exprLitConst;
@@ -939,6 +1026,7 @@ struct Parser {
                     const bool wantFixed = ((fn->fixedArgs >> n) & 1u) != 0;
                     v = parseExpr();
                     if (failed) return false;
+                    if (exprIsJson) { fail(kJsonIsNoNumber); return false; }
                     // Against what the builtin declares, since a stray fixed reads 65,536 times off.
                     if (wantFixed != exprIsFixed) {
                         bool adopted = false;
@@ -1005,6 +1093,8 @@ struct Parser {
         if (isReservedWord(name, nameLen)) { fail("member name is a reserved word"); return; }
         if (table.findStruct(name, nameLen)) { fail("that name is a type"); return; }
         lex.advance();
+        // A document is named by a handle the host gives at run time, so a member starts with none.
+        if (type == CtrlType::Json) { parseJsonMember(name, nameLen); return; }
         // The length is a literal, since the arena is sized at compile time.
         uint8_t count = 1;
         if (lex.kind == Tok::LBracket) {
@@ -1078,6 +1168,7 @@ struct Parser {
                                       { fail("a bool member takes true or false"); return; }
                                   break;
             case CtrlType::Str:   fail("a string member cannot be initialized yet"); return;
+            case CtrlType::Json:  return;   // parseJsonMember took it before the '='
             case CtrlType::Int:   rangeErr = "default out of range";
                                   if (lex.numberIsFixed)
                                       { fail("an int member takes a whole number"); return; }
@@ -1113,12 +1204,27 @@ struct Parser {
         memberCount++;
     }
 
+    /// Parse the rest of `json name;`, the name consumed: a slot holding no document until a function gives it one.
+    void parseJsonMember(const char* name, size_t nameLen) {
+        if (lex.kind == Tok::LBracket) { fail("json arrays are not supported"); return; }
+        if (lex.kind == Tok::Assign) { fail("a json member starts empty: give it a document in a function"); return; }
+        if (!expect(Tok::Semicolon, "expected ';' after the member declaration")) return;
+        if (memberCount >= kMaxCtrls) { fail("too many members"); return; }
+        uint16_t at = memberBytes;
+        if ((at % 4) != 0) at = uint16_t(at + (4 - at % 4));
+        if (at + 4 > kCtrlBytes) { fail("the class declares more member data than the arena holds"); return; }
+        members[memberCount] = {name, 0, 0, 0, static_cast<uint8_t>(nameLen), CtrlType::Json,
+                                static_cast<uint8_t>(at), 1};
+        memberBytes = static_cast<uint8_t>(at + 4);
+        memberCount++;
+    }
+
     /// Whether a name is one the expression parser resolves before it looks for a member.
     static bool isReservedWord(const char* n, size_t len) {
         static const struct { const char* w; size_t len; } kWords[] = {
             {"toFixed", 7}, {"toInt", 5}, {"true", 4}, {"false", 5},
             // The type keywords too, since `int int = 5;` parsed and confused the class loop.
-            {"int", 3}, {"byte", 4}, {"bool", 4}, {"fixed", 5}, {"string", 6},
+            {"int", 3}, {"byte", 4}, {"bool", 4}, {"fixed", 5}, {"string", 6}, {"json", 4},
             // And the statement keywords, since `int if = 0;` made every later `if` a reference.
             {"if", 2}, {"else", 4}, {"for", 3}, {"return", 6}, {"class", 5}, {"void", 4}};
         for (const auto& k : kWords)
@@ -1144,10 +1250,10 @@ struct Parser {
         return lex.kind == Tok::Ident && lex.identLen == len && std::strncmp(lex.identBeg, kw, len) == 0;
     }
     // Names an author reaches for rather than storage widths, which are the compiler's business.
-    /// Whether the current token opens a type: int, byte, bool, fixed or string.
+    /// Whether the current token opens a type: int, byte, bool, fixed, string or json.
     bool atTypeKeyword() const {
         return atKeyword("int", 3) || atKeyword("byte", 4) || atKeyword("bool", 4) ||
-               atKeyword("fixed", 5) || atKeyword("string", 6);
+               atKeyword("fixed", 5) || atKeyword("string", 6) || atKeyword("json", 4);
     }
     // Not every member type, since `byte tick()` would suggest a narrowing the engine never does.
     /// Whether the current token opens a return type: void, int or string.
@@ -1166,6 +1272,7 @@ struct Parser {
         if (atKeyword("bool", 4))   return CtrlType::Bool;
         if (atKeyword("fixed", 5))  return CtrlType::Fixed;
         if (atKeyword("string", 6)) return CtrlType::Str;
+        if (atKeyword("json", 4))   return CtrlType::Json;
         return CtrlType::Int;
     }
 
@@ -1368,8 +1475,10 @@ struct Parser {
             }
             return false;
         }
-        VReg v = parseExpr();
+        const bool wantJson = (li >= 0 ? locals[li].type : members[mi].type) == CtrlType::Json;
+        VReg v = wantJson ? parseJsonValue() : parseExpr();
         if (failed) return false;
+        if (!wantJson && exprIsJson) { fail(kJsonIsNoNumber); return false; }
         // The wall holds at the store, since the slot holds raw bits with no scaling of its own.
         if (mi >= 0) {
             const bool wantFixed = (members[mi].type == CtrlType::Fixed);
@@ -1591,9 +1700,11 @@ struct Parser {
         }
         const bool aFixed = exprIsFixed;
         const int  aLit   = exprLitConst;
+        const bool aJson  = exprIsJson;
         lex.advance();
         VReg b = parseExpr();
         if (failed) { freeTemp(a); return false; }
+        if (aJson || exprIsJson) { freeTemp(b); freeTemp(a); fail(kJsonIsNoNumber); return false; }
         // Same wall as the operators, since Q16.16 preserves order but not magnitude.
         bool cmpFixed = false;
         if (!meet(aFixed, aLit, exprIsFixed, exprLitConst, cmpFixed)) { freeTemp(b); freeTemp(a); return false; }
@@ -1693,8 +1804,10 @@ struct Parser {
         }
         lex.advance();
         if (!expect(Tok::Assign, "a local variable is initialized: int x = 0;")) return false;
-        VReg init = parseExpr();
+        const bool wantJson = (declType == CtrlType::Json);
+        VReg init = wantJson ? parseJsonValue() : parseExpr();
         if (failed) return false;
+        if (!wantJson && exprIsJson) { fail(kJsonIsNoNumber); return false; }
         // The initializer sets the promised scaling, and a literal adopts it.
         if (wantFixed != exprIsFixed) {
             bool adopted = false;
@@ -1816,6 +1929,7 @@ struct Parser {
             if (curRet != RetType::Int) { fail("this function returns a string, not a number"); return false; }
             v = parseExpr();
             if (failed) return false;
+            if (exprIsJson) { fail(kJsonIsNoNumber); return false; }
         }
         // imm 1 says this return carries a value, which the spill pass reads.
         emit({IrOp::Ret, 0, v, 0,0,0, 1, nullptr, {}});
@@ -1987,6 +2101,14 @@ uint32_t countTokens(const char* source) {
     return tokens;
 }
 
+uint32_t countStringBytes(const char* source) {
+    if (!source) return 0;
+    uint32_t bytes = 0;
+    for (Lexer scan(source); scan.kind != Tok::End && scan.kind != Tok::Error; scan.advance())
+        if (scan.kind == Tok::String) bytes += static_cast<uint32_t>(scan.identLen) + 1;
+    return bytes;
+}
+
 /// Compile a script to bytes, answering what it declared and where it failed.
 CompileResult compileSource(const char* source, const BuiltinTable& table,
                             const SysVarTable& sysvars, uint8_t* out, size_t cap,
diff --git a/src/core/moonlive/MoonLiveCompiler.h b/src/core/moonlive/MoonLiveCompiler.h
index 50a4c37a3..397340b36 100644
--- a/src/core/moonlive/MoonLiveCompiler.h
+++ b/src/core/moonlive/MoonLiveCompiler.h
@@ -56,8 +56,8 @@ struct CompileResult {
     DeclaredControl members[kMaxCtrls];
     /// How many members the class declared.
     uint8_t         memberCount = 0;
-    /// Bytes of string-literal storage the engine holds, interned into a pool it owns because the source buffer is freed after a compile.
-    static constexpr uint16_t kStringPool = 128;
+    /// The most string-literal text one script holds, interned into a pool the engine sizes to the script because the source buffer is freed after a compile.
+    static constexpr uint16_t kMaxStrings = 16384;
     /// How much of the string pool is used, so a binding can report the headroom.
     uint16_t        stringLen = 0;
     /// The class name diagnostics report, so renaming a file does not change what a user is told.
@@ -80,4 +80,7 @@ CompileResult compileSource(const char* source, const BuiltinTable& table,
 /// Tokens in `source`, which both right-sized buffers derive from; one function, so a caller cannot measure a script differently from the compiler.
 uint32_t countTokens(const char* source);
 
+/// Bytes the string pool needs for `source`: every literal and its terminator, as the compiler interns them.
+uint32_t countStringBytes(const char* source);
+
 }  // namespace mm::moonlive
diff --git a/src/core/moonlive/MoonLiveMissing.h b/src/core/moonlive/MoonLiveMissing.h
new file mode 100644
index 000000000..ddac5ca41
--- /dev/null
+++ b/src/core/moonlive/MoonLiveMissing.h
@@ -0,0 +1,63 @@
+#pragma once
+
+#include <cstddef>
+#include <cstring>
+
+/// The shipped scripts a module names and the device does not hold, which an open page downloads.
+///
+/// The state says what is wanted and this list what is missing. Any open page closes the gap with the picker's own download, so a script a document names arrives as a picked one does.
+namespace mm::moonlive {
+
+/// Room for the missing names: a show naming five or six at once fits, and one more waits for the next pass.
+inline constexpr size_t kMissingText = 160;
+
+/// The missing names, `|`-separated, as System's hidden read-only control shows them to every page.
+inline char* missingScripts() {
+    static char text[kMissingText] = "";
+    return text;
+}
+
+/// Where `name` is in the list, or null.
+inline char* findMissing(const char* name) {
+    char* text = missingScripts();
+    const size_t n = std::strlen(name);
+    for (char* at = text; *at;) {
+        char* end = std::strchr(at, '|');
+        const size_t len = end ? static_cast<size_t>(end - at) : std::strlen(at);
+        if (len == n && std::strncmp(at, name, n) == 0) return at;
+        if (!end) break;
+        at = end + 1;
+    }
+    return nullptr;
+}
+
+/// Add `name`, once, from a compile on the loop's task, the list's one writer; a name past the room waits until one before it arrives.
+inline void noteScriptMissing(const char* name) {
+    if (!name || !*name || findMissing(name)) return;
+    char* text = missingScripts();
+    const size_t used = std::strlen(text), n = std::strlen(name);
+    if (used + (used ? 1 : 0) + n + 1 > kMissingText) return;
+    if (used) text[used] = '|';
+    std::memcpy(text + used + (used ? 1 : 0), name, n + 1);
+}
+
+/// Drop `name`, as its file has arrived.
+inline void noteScriptPresent(const char* name) {
+    if (!name || !*name) return;
+    char* at = findMissing(name);
+    if (!at) return;
+    char* text = missingScripts();
+    char* end = at + std::strlen(name);
+    if (*end == '|') end++;                       // the separator after it goes with it
+    else if (at > text) at--;                     // the last one takes the separator before it
+    std::memmove(at, end, std::strlen(end) + 1);
+}
+
+/// Drop the script a written file holds, wherever it landed, so a name whose module went before its download arrived leaves the list too.
+inline void noteScriptLanded(const char* path) {
+    if (!path) return;
+    const char* slash = std::strrchr(path, '/');
+    noteScriptPresent(slash ? slash + 1 : path);
+}
+
+}  // namespace mm::moonlive
diff --git a/src/core/moonlive/MoonLiveScript.h b/src/core/moonlive/MoonLiveScript.h
index c7cf61778..8e53e51d2 100644
--- a/src/core/moonlive/MoonLiveScript.h
+++ b/src/core/moonlive/MoonLiveScript.h
@@ -38,7 +38,11 @@ class MoonLiveScript {
 
     /// Re-read the file and recompile when its content hash moved, returning true when a new program was installed, which a modifier turns into a Layer rebuild.
     bool sync(const SysVarTable& sysvars, MoonModule& owner, const BuiltinTable& builtins) {
-        // Cheapest question first, since this runs on every prepare sweep and must not compile.
+        // Read only after an announced change or under another name: a flash read under load costs tens of milliseconds.
+        if (!stale_ && std::strcmp(syncedName_, name_) == 0 && ((engine_.ok() && haveCompiled_) || compileFailed_)) return false;
+        stale_ = false;
+        std::snprintf(syncedName_, sizeof(syncedName_), "%s", name_);
+        // Then the hash, since an unchanged file must not compile.
         uint32_t fileHash = 0;
         const bool readable = scriptFileHash(name_, fileHash);
         if (readable && engine_.ok() && haveCompiled_ && fileHash == compiledHash_) return false;
@@ -110,6 +114,9 @@ class MoonLiveScript {
     /// The script file this module runs.
     const char* name() const { return name_; }
 
+    /// Mark the script stale when a changed path may hold it, so the next sync() reads it again.
+    void fileChanged(const char* path) { if (moonlive::touchesScripts(path)) stale_ = true; }
+
     /// Point at a different script. The next sync() compiles it.
     void setName(const char* n) {
         if (!n) return;
@@ -133,6 +140,7 @@ class MoonLiveScript {
 
     /// Forget what is compiled, so the next sync rebuilds for a module coming back from disabled.
     void invalidate() {
+        stale_ = true;
         compiledHash_ = 0;
         haveCompiled_ = false;
         compileFailed_ = false;
@@ -209,6 +217,8 @@ class MoonLiveScript {
     /// The script file this module runs, empty on a fresh card, which reports "no script" until one is named.
     char     name_[kMaxScriptName + 1] = "";
     uint32_t compiledHash_ = 0;
+    bool     stale_ = true;   ///< the file may have changed since the last read
+    char     syncedName_[kMaxScriptName + 1] = "";   ///< the name the last read was for, since a control write changes `name_` in place
     bool     haveCompiled_ = false;   // 0 is a valid hash, so "is anything compiled" is its own flag
     /// Whether the last compile failed, latched by name and content both so a script fixed in place under the same name is retried.
     bool     compileFailed_ = false;
diff --git a/src/core/moonlive/MoonLiveScriptFile.h b/src/core/moonlive/MoonLiveScriptFile.h
index 27b3c9f41..b6e6e5897 100644
--- a/src/core/moonlive/MoonLiveScriptFile.h
+++ b/src/core/moonlive/MoonLiveScriptFile.h
@@ -2,6 +2,7 @@
 
 #include "core/module/MoonModule.h"   // safeMode: no script runs in it
 #include "core/moonlive/MoonLive.h"
+#include "core/moonlive/MoonLiveMissing.h"   // what a compile finds missing
 #include "core/moonlive/script_catalog.h"
 #include "core/util/fnv.h"   // the shipped names, for isFactoryScript below
 #include "platform/platform.h"
@@ -69,6 +70,18 @@ inline constexpr size_t kMaxScriptName = 40;
 /// FNV-1a over the script text, so a caller detecting a change keeps 4 bytes rather than a copy of the source.
 inline uint32_t scriptHash(const char* s, size_t len) { return fnv1a(s, len); }
 
+/// Whether `path` is in `dir`, is `dir`, or holds it.
+inline bool pathTouchesFolder(const char* path, const char* dir) {
+    const size_t p = std::strlen(path), d = std::strlen(dir);
+    if (p >= d) return std::strncmp(path, dir, d) == 0 && (path[d] == '/' || path[d] == 0);
+    return std::strncmp(dir, path, p) == 0 && (dir[p] == '/' || path[p - 1] == '/');
+}
+
+/// Whether a changed `path` may have changed a script: one in, or above, either script folder.
+inline bool touchesScripts(const char* path) {
+    return path && (pathTouchesFolder(path, kScriptDir) || pathTouchesFolder(path, kFactoryScriptDir));
+}
+
 /// Where `name` lives: the user's copy when there is one, else the factory copy; one resolver, so a fork never compiles from one directory and hashes from the other.
 inline bool resolveScript(const char* name, char* out, size_t outLen) {
     std::snprintf(out, outLen, "%s/%s", kScriptDir, name);
@@ -218,7 +231,10 @@ inline bool compileScriptFile(MoonLive& engine, const char* name,
     resolveScript(name, path, sizeof(path));
 
     const int64_t size = platform::fsSize(path);
+    // A shipped script the device lacks is listed for an open page to download, the picker's own path.
+    if (size < 0 && isFactoryScript(name)) { noteScriptMissing(name); err = "script missing: an open page downloads it"; return false; }
     if (size < 0)               { err = "script not found"; return false; }
+    noteScriptPresent(name);
     if (size == 0)              { err = "script is empty";  return false; }
     if (size > kScriptFileMax)  { err = "script too large"; return false; }
 
diff --git a/src/core/moonlive/catalog_scripts.cmake b/src/core/moonlive/catalog_scripts.cmake
index f4537f8f6..944dddc3a 100644
--- a/src/core/moonlive/catalog_scripts.cmake
+++ b/src/core/moonlive/catalog_scripts.cmake
@@ -21,13 +21,13 @@ elseif(NOT DEFINED PYTHON_CMD)
         "or -DPYTHON_CMD=<interpreter>.")
 endif()
 
-# The repo keeps each role in its own folder, subfolders grouping a collection; the device keeps one flat directory, the role in the extension, so folder and subfolder survive only as part of the fetch URL.
+# The repo groups scripts in folders, a role's own or a project's mixing roles; the device keeps one flat directory, the role in the extension, so a folder survives only as part of the fetch URL.
 file(GLOB_RECURSE SCRIPT_PATHS
-     "${SCRIPT_DIR}/effects/*.mle"
-     "${SCRIPT_DIR}/layouts/*.mll"
-     "${SCRIPT_DIR}/modifiers/*.mlm"
-     "${SCRIPT_DIR}/services/*.mls"
-     "${SCRIPT_DIR}/palettes/*.mlp")
+     "${SCRIPT_DIR}/*.mle"
+     "${SCRIPT_DIR}/*.mll"
+     "${SCRIPT_DIR}/*.mlm"
+     "${SCRIPT_DIR}/*.mls"
+     "${SCRIPT_DIR}/*.mlp")
 list(SORT SCRIPT_PATHS)   # deterministic output: the same input must give a byte-identical header
 
 list(LENGTH SCRIPT_PATHS SCRIPT_COUNT)
diff --git a/src/core/moonlive/catalog_scripts.py b/src/core/moonlive/catalog_scripts.py
index 624e02e71..99dfb500f 100644
--- a/src/core/moonlive/catalog_scripts.py
+++ b/src/core/moonlive/catalog_scripts.py
@@ -19,11 +19,6 @@
 ROLE_BY_EXT = {".mle": "Effect", ".mll": "Layout", ".mlm": "Modifier", ".mls": "Service",
                ".mlp": "Palette"}
 
-# Where each role lives in the repo. The device keeps one flat directory, so this is only ever part
-# of the download URL.
-FOLDER_BY_ROLE = {"Effect": "effects", "Layout": "layouts", "Modifier": "modifiers", "Service": "services",
-                  "Palette": "palettes"}
-
 
 # What a script DECLARES about itself, read from its source. The script is the one home for this
 # (a user-written script never appears in a catalog at all), so what a build extracts here is a
@@ -65,7 +60,7 @@ def main() -> int:
     out = Path(sys.argv[2])
     root = Path(sys.argv[3])
 
-    # A name is unique on the device, whose one flat directory drops the repo's folders, so a duplicate across roles or subfolders fails the build rather than overwriting silently.
+    # A name is unique on the device, whose one flat directory drops the repo's folders, so a duplicate across roles or folders fails the build rather than overwriting silently.
     seen: dict[str, Path] = {}
     for p in paths:
         if p.suffix not in ROLE_BY_EXT:
@@ -79,27 +74,26 @@ def main() -> int:
             return 1
         seen[p.name] = p
 
-    # One array per role rather than one array of {name, folder, role}. The folder is implied by
-    # the role ("effects" holds the effects) and the role by the extension, so storing either per
-    # entry would be the same value repeated once per script. It also makes the picker's job a
-    # range rather than a scan: it wants "every effect", which is now an array, not a filter.
+    # One array per role rather than one array of {name, folder, role}: the role follows from the
+    # extension, so storing it per entry would repeat one value per script. It also makes the
+    # picker's job a range rather than a scan: it wants "every effect", which is an array, not a filter.
     by_role: dict[str, list[str]] = {r: [] for r in ROLE_BY_EXT.values()}
     # What each script says it is, in the same order, so the picker can show a row the way the
     # module picker shows a type: its dimension and its emoji, before the script is downloaded.
     decl_by_role: dict[str, list[tuple[int, str]]] = {r: [] for r in ROLE_BY_EXT.values()}
-    # The subfolder under the role's folder, "" for most, as an index into one table, so a collection costs its name once rather than once per script.
-    subfolders: list[str] = [""]
-    sub_by_role: dict[str, list[int]] = {r: [] for r in ROLE_BY_EXT.values()}
+    # The folder under moonlive/, as an index into one table, so a collection costs its name once rather than once per script; a project folder mixes roles.
+    folders: list[str] = []
+    folder_by_role: dict[str, list[int]] = {r: [] for r in ROLE_BY_EXT.values()}
     for p in paths:
         role = ROLE_BY_EXT[p.suffix]
         by_role[role].append(p.name)
-        sub = "/".join(p.resolve().relative_to(root.resolve()).parts[1:-1])   # between the role's folder and the file
-        if sub not in subfolders:
-            if len(subfolders) == 256:   # an index is an unsigned char
-                print(f"catalog_scripts: {p} opens a 257th subfolder; the catalog indexes at most 256", file=sys.stderr)
+        folder = "/".join(p.resolve().relative_to(root.resolve()).parts[:-1])
+        if folder not in folders:
+            if len(folders) == 256:   # an index is an unsigned char
+                print(f"catalog_scripts: {p} opens a 257th folder; the catalog indexes at most 256", file=sys.stderr)
                 return 1
-            subfolders.append(sub)
-        sub_by_role[role].append(subfolders.index(sub))
+            folders.append(folder)
+        folder_by_role[role].append(folders.index(folder))
         try:
             decl_by_role[role].append(declared(p))
         except ValueError as e:
@@ -116,20 +110,19 @@ def main() -> int:
         "///\n",
         "/// A device carries names only and the UI fetches a script's text on first pick, so flash scales with the script count and the filesystem holds only what is used.\n",
         "///\n",
-        "/// There is one array per role: a script's role follows from its extension and its folder from its role, so neither is stored per entry. A subfolder is an index into one shared table.\n",
+        "/// There is one array per role, since a script's role follows from its extension. Its folder under `moonlive/` is an index into one shared table, so a project folder can hold every role.\n",
         "#include <cstddef>\n\n",
         "namespace mm::moonlive {\n\n",
     ]
 
-    parts.append("/// The subfolders a script may sit in under its role's folder upstream, \"\" first for the folder itself.\n")
-    parts.append("constexpr const char* kCatalogSubfolders[] = {\n")
-    parts.append("".join(f'    "{s}",\n' for s in subfolders))
+    parts.append("/// The folders a script sits in under `moonlive/` upstream.\n")
+    parts.append("constexpr const char* kCatalogFolders[] = {\n")
+    parts.append("".join(f'    "{s}",\n' for s in folders))
     parts.append("};\n\n")
 
     for role, names in by_role.items():
         lower = role.lower()
-        folder = FOLDER_BY_ROLE[role]
-        parts.append(f"/// Every factory {lower} by file name, from `moonlive/{folder}/` upstream.\n")
+        parts.append(f"/// Every factory {lower} by file name, from `moonlive/` upstream.\n")
         parts.append(f"constexpr const char* k{role}Catalog[] = {{\n")
         parts.append("".join(f'    "{n}",\n' for n in names))
         parts.append("};\n")
@@ -145,11 +138,10 @@ def main() -> int:
         parts.append(f"constexpr const char* k{role}CatalogTags[] = {{\n")
         parts.append("".join(f'    "{g}",\n' for _, g in decls))
         parts.append("};\n")
-        parts.append(f"/// Where each {lower} above sits under `moonlive/{folder}/`, as an index into kCatalogSubfolders.\n")
-        parts.append(f"constexpr unsigned char k{role}CatalogSub[] = {{\n")
-        parts.append("".join(f"    {i},\n" for i in sub_by_role[role]))
-        parts.append("};\n")
-        parts.append(f'constexpr const char* k{role}Folder = "{folder}";   ///< its directory upstream\n\n')
+        parts.append(f"/// Where each {lower} above sits under `moonlive/`, as an index into kCatalogFolders.\n")
+        parts.append(f"constexpr unsigned char k{role}CatalogFolder[] = {{\n")
+        parts.append("".join(f"    {i},\n" for i in folder_by_role[role]))
+        parts.append("};\n\n")
 
     total = sum(len(v) for v in by_role.values())
     parts.append(f"constexpr size_t kCatalogCount = {total};   ///< every factory script, all roles\n\n")
diff --git a/src/core/moonlive/script_catalog.h b/src/core/moonlive/script_catalog.h
index 2ed386aa1..c1e7bb1bb 100644
--- a/src/core/moonlive/script_catalog.h
+++ b/src/core/moonlive/script_catalog.h
@@ -8,25 +8,28 @@
 ///
 /// A device carries names only and the UI fetches a script's text on first pick, so flash scales with the script count and the filesystem holds only what is used.
 ///
-/// There is one array per role: a script's role follows from its extension and its folder from its role, so neither is stored per entry. A subfolder is an index into one shared table.
+/// There is one array per role, since a script's role follows from its extension. Its folder under `moonlive/` is an index into one shared table, so a project folder can hold every role.
 #include <cstddef>
 
 namespace mm::moonlive {
 
-/// The subfolders a script may sit in under its role's folder upstream, "" first for the folder itself.
-constexpr const char* kCatalogSubfolders[] = {
-    "",
-    "audio",
-    "basics",
-    "hpwit",
-    "moving-heads",
-    "particles",
-    "shaders",
-    "stadbeest",
-    "waves",
+/// The folders a script sits in under `moonlive/` upstream.
+constexpr const char* kCatalogFolders[] = {
+    "effects/audio",
+    "effects/basics",
+    "effects/moving-heads",
+    "effects/particles",
+    "effects/shaders",
+    "effects/waves",
+    "layouts",
+    "modifiers",
+    "palettes",
+    "projects/hpwit",
+    "projects/stadbeest",
+    "services",
 };
 
-/// Every factory effect by file name, from `moonlive/effects/` upstream.
+/// Every factory effect by file name, from `moonlive/` upstream.
 constexpr const char* kEffectCatalog[] = {
     "glow.mle",
     "pulse.mle",
@@ -39,16 +42,6 @@ constexpr const char* kEffectCatalog[] = {
     "lines.mle",
     "random-pixel.mle",
     "sparkle.mle",
-    "edge-comets.mle",
-    "fire.mle",
-    "mandala.mle",
-    "particle-fountain.mle",
-    "plasma-ring.mle",
-    "plasma-wander.mle",
-    "ripple-rings.mle",
-    "spinning-squares.mle",
-    "twinkle-stars.mle",
-    "voronoi.mle",
     "mh-aim.mle",
     "mh-ambient.mle",
     "mh-sweep.mle",
@@ -65,6 +58,21 @@ constexpr const char* kEffectCatalog[] = {
     "metal.mle",
     "nebula.mle",
     "trails.mle",
+    "aurora.mle",
+    "noise.mle",
+    "octopus.mle",
+    "plasma.mle",
+    "ripples.mle",
+    "edge-comets.mle",
+    "fire.mle",
+    "mandala.mle",
+    "particle-fountain.mle",
+    "plasma-ring.mle",
+    "plasma-wander.mle",
+    "ripple-rings.mle",
+    "spinning-squares.mle",
+    "twinkle-stars.mle",
+    "voronoi.mle",
     "stadbeest-eye-orb.mle",
     "stadbeest-frog-eye.mle",
     "stadbeest-mouth.mle",
@@ -72,11 +80,6 @@ constexpr const char* kEffectCatalog[] = {
     "stadbeest-sauron.mle",
     "stadbeest-thrusters.mle",
     "stadbeest-walk.mle",
-    "aurora.mle",
-    "noise.mle",
-    "octopus.mle",
-    "plasma.mle",
-    "ripples.mle",
 };
 constexpr size_t kEffectCatalogCount = 49;
 /// What each effect above declares about itself, in the same order, 0 meaning it says nothing and the device decides.
@@ -92,32 +95,33 @@ constexpr unsigned char kEffectCatalogDim[] = {
     2,
     1,
     3,
+    1,
+    1,
+    1,
+    1,
+    1,
     2,
     2,
     2,
+    1,
     2,
     2,
+    3,
     2,
     2,
+    3,
+    3,
+    3,
     2,
     2,
     2,
-    1,
-    1,
-    1,
-    1,
-    1,
     2,
     2,
     2,
-    1,
     2,
     2,
-    3,
     2,
     2,
-    3,
-    3,
     2,
     2,
     2,
@@ -125,7 +129,6 @@ constexpr unsigned char kEffectCatalogDim[] = {
     2,
     2,
     2,
-    3,
     2,
     2,
     2,
@@ -144,16 +147,6 @@ constexpr const char* kEffectCatalogTags[] = {
     "💫",
     "💫",
     "💫",
-    "💫✨",
-    "💫",
-    "💫",
-    "💫✨",
-    "💫",
-    "💫",
-    "💫",
-    "💫",
-    "💫",
-    "💫",
     "💫🎯",
     "🗼🎶🎯",
     "💫🎯",
@@ -171,20 +164,38 @@ constexpr const char* kEffectCatalogTags[] = {
     "💫🖌️",
     "💫🖌️",
     "💫",
+    "💫",
+    "💫🖌️",
+    "💫",
+    "💫",
+    "💫✨",
+    "💫",
+    "💫",
+    "💫✨",
+    "💫",
+    "💫",
+    "💫",
+    "💫",
+    "💫",
+    "💫",
+    "💫",
     "💫🎵🎶",
     "💫🎵",
     "💫",
     "💫🎵🎶",
     "💫🎵",
     "💫🎵",
-    "💫",
-    "💫",
-    "💫🖌️",
-    "💫",
-    "💫",
 };
-/// Where each effect above sits under `moonlive/effects/`, as an index into kCatalogSubfolders.
-constexpr unsigned char kEffectCatalogSub[] = {
+/// Where each effect above sits under `moonlive/`, as an index into kCatalogFolders.
+constexpr unsigned char kEffectCatalogFolder[] = {
+    0,
+    0,
+    0,
+    1,
+    1,
+    1,
+    1,
+    1,
     1,
     1,
     1,
@@ -193,13 +204,6 @@ constexpr unsigned char kEffectCatalogSub[] = {
     2,
     2,
     2,
-    2,
-    2,
-    2,
-    3,
-    3,
-    3,
-    3,
     3,
     3,
     3,
@@ -216,28 +220,26 @@ constexpr unsigned char kEffectCatalogSub[] = {
     5,
     5,
     5,
-    5,
-    6,
-    6,
-    6,
-    6,
-    6,
-    7,
-    7,
-    7,
-    7,
-    7,
-    7,
-    7,
-    8,
-    8,
-    8,
-    8,
-    8,
+    9,
+    9,
+    9,
+    9,
+    9,
+    9,
+    9,
+    9,
+    9,
+    9,
+    10,
+    10,
+    10,
+    10,
+    10,
+    10,
+    10,
 };
-constexpr const char* kEffectFolder = "effects";   ///< its directory upstream
 
-/// Every factory layout by file name, from `moonlive/layouts/` upstream.
+/// Every factory layout by file name, from `moonlive/` upstream.
 constexpr const char* kLayoutCatalog[] = {
     "backlight.mll",
     "diagonal.mll",
@@ -280,23 +282,22 @@ constexpr const char* kLayoutCatalogTags[] = {
     "🚥",
     "💫",
 };
-/// Where each layout above sits under `moonlive/layouts/`, as an index into kCatalogSubfolders.
-constexpr unsigned char kLayoutCatalogSub[] = {
-    0,
-    0,
-    0,
-    0,
-    0,
-    0,
-    0,
-    0,
-    0,
-    0,
-    0,
+/// Where each layout above sits under `moonlive/`, as an index into kCatalogFolders.
+constexpr unsigned char kLayoutCatalogFolder[] = {
+    6,
+    6,
+    6,
+    6,
+    6,
+    6,
+    6,
+    6,
+    6,
+    6,
+    6,
 };
-constexpr const char* kLayoutFolder = "layouts";   ///< its directory upstream
 
-/// Every factory modifier by file name, from `moonlive/modifiers/` upstream.
+/// Every factory modifier by file name, from `moonlive/` upstream.
 constexpr const char* kModifierCatalog[] = {
     "mirror.mlm",
     "shift.mlm",
@@ -315,23 +316,24 @@ constexpr const char* kModifierCatalogTags[] = {
     "💫",
     "💫",
 };
-/// Where each modifier above sits under `moonlive/modifiers/`, as an index into kCatalogSubfolders.
-constexpr unsigned char kModifierCatalogSub[] = {
-    0,
-    0,
-    0,
+/// Where each modifier above sits under `moonlive/`, as an index into kCatalogFolders.
+constexpr unsigned char kModifierCatalogFolder[] = {
+    7,
+    7,
+    7,
 };
-constexpr const char* kModifierFolder = "modifiers";   ///< its directory upstream
 
-/// Every factory service by file name, from `moonlive/services/` upstream.
+/// Every factory service by file name, from `moonlive/` upstream.
 constexpr const char* kServiceCatalog[] = {
+    "hpwit-show.mls",
+    "stadbeest-autopilot.mls",
     "button.mls",
     "chase.mls",
+    "jsondemo.mls",
     "power.mls",
-    "stadbeest-autopilot.mls",
     "sweep.mls",
 };
-constexpr size_t kServiceCatalogCount = 5;
+constexpr size_t kServiceCatalogCount = 7;
 /// What each service above declares about itself, in the same order, 0 meaning it says nothing and the device decides.
 constexpr unsigned char kServiceCatalogDim[] = {
     0,
@@ -339,6 +341,8 @@ constexpr unsigned char kServiceCatalogDim[] = {
     0,
     0,
     0,
+    0,
+    0,
 };
 /// The emoji each declares, "" when it declares none.
 constexpr const char* kServiceCatalogTags[] = {
@@ -347,25 +351,28 @@ constexpr const char* kServiceCatalogTags[] = {
     "",
     "",
     "",
+    "",
+    "",
 };
-/// Where each service above sits under `moonlive/services/`, as an index into kCatalogSubfolders.
-constexpr unsigned char kServiceCatalogSub[] = {
-    0,
-    0,
-    0,
-    0,
-    0,
+/// Where each service above sits under `moonlive/`, as an index into kCatalogFolders.
+constexpr unsigned char kServiceCatalogFolder[] = {
+    9,
+    10,
+    11,
+    11,
+    11,
+    11,
+    11,
 };
-constexpr const char* kServiceFolder = "services";   ///< its directory upstream
 
-/// Every factory palette by file name, from `moonlive/palettes/` upstream.
+/// Every factory palette by file name, from `moonlive/` upstream.
 constexpr const char* kPaletteCatalog[] = {
     "beat-flash.mlp",
     "drift.mlp",
     "fire.mlp",
     "spectrum.mlp",
-    "stadbeest-fire.mlp",
     "temperature.mlp",
+    "stadbeest-fire.mlp",
 };
 constexpr size_t kPaletteCatalogCount = 6;
 /// What each palette above declares about itself, in the same order, 0 meaning it says nothing and the device decides.
@@ -383,20 +390,19 @@ constexpr const char* kPaletteCatalogTags[] = {
     "🎨",
     "🎨",
     "🎨🎶",
-    "🎨🎶",
     "🎨",
+    "🎨🎶",
 };
-/// Where each palette above sits under `moonlive/palettes/`, as an index into kCatalogSubfolders.
-constexpr unsigned char kPaletteCatalogSub[] = {
-    0,
-    0,
-    0,
-    0,
-    0,
-    0,
+/// Where each palette above sits under `moonlive/`, as an index into kCatalogFolders.
+constexpr unsigned char kPaletteCatalogFolder[] = {
+    8,
+    8,
+    8,
+    8,
+    8,
+    10,
 };
-constexpr const char* kPaletteFolder = "palettes";   ///< its directory upstream
 
-constexpr size_t kCatalogCount = 74;   ///< every factory script, all roles
+constexpr size_t kCatalogCount = 76;   ///< every factory script, all roles
 
 } // namespace mm::moonlive
diff --git a/src/core/services/AudioService.h b/src/core/services/AudioService.h
index 6902dade5..260a4f820 100644
--- a/src/core/services/AudioService.h
+++ b/src/core/services/AudioService.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include "core/util/format.h"   // formatTo: nonblocking formatting into a fixed buffer
+#include "core/util/fnv.h"      // fnv1a: the sync hosts, compared as one number
 #include "core/util/Addressing.h"   // sendAddressed: the multicast rule every sender shares
 #include "core/util/HostList.h"     // the boards a unicast send goes to
 #include "core/util/HostResolver.h" // a named board's address, looked up off the render thread
@@ -267,12 +268,18 @@ class AudioService : public MoonModule {
     void prepare() override {
         micSeat_.claim();       // the first live instance wins the seat, in any mode
         if (mode == kLocalMode) {
-            reinit();           // only this mode runs a peripheral
+            // Only this mode runs a peripheral, reopened only when a setting it was opened with changed: a rebuild for another module must not cut the audio.
+            if (!inited_ || micConfig() != openedWith_) reinit();
         } else {
             deinit();           // the others free the channel and its pins
             clearStatus();      // a mic diagnosis would otherwise linger in a mode with no mic
         }
-        syncReinit();
+        // The socket likewise, rebound only when what it binds to changed.
+        if (!syncSet_ || syncConfig() != syncedWith_) {
+            syncReinit();
+            syncedWith_ = syncConfig();
+            syncSet_ = true;
+        }
         parseSyncHosts();
     }
     /// One-time wiring only: the acquire and the election live in the build.
@@ -485,6 +492,25 @@ class AudioService : public MoonModule {
 
     platform::AudioMicHandle mic_;
     bool inited_ = false;
+    /// What the microphone is opened with, so a prepare that changed none of it keeps it open.
+    struct MicConfig {
+        uint8_t device, micMode, sampleRateSel, codec, codecAddr;
+        int8_t sck, ws, sd, mclk;
+        bool operator==(const MicConfig&) const = default;
+    };
+    MicConfig micConfig() const { return {device, micMode, sampleRateSel, codec, codecAddr, sckPin, wsPin, sdPin, mclkPin}; }
+    MicConfig openedWith_{};
+    /// What the sync socket is set up for, so a prepare that changed none of it keeps it bound.
+    struct SyncConfig {
+        uint8_t mode, addressing;
+        bool send;
+        uint16_t port;
+        uint32_t hosts;
+        bool operator==(const SyncConfig&) const = default;
+    };
+    SyncConfig syncConfig() const { return {mode, addressing, send, syncPort, fnv1a(hosts, std::strlen(hosts))}; }
+    SyncConfig syncedWith_{};
+    bool syncSet_ = false;
     uint32_t codecBusGen_ = 0;   ///< the bus generation the codec last attached to, so a moved bus re-attaches it
     size_t filled_ = 0;         // samples accumulated toward the next full block
     DcBlocker dc_;              // ~40 Hz high-pass, continuous across blocks
@@ -535,6 +561,7 @@ class AudioService : public MoonModule {
     /// (Re)create the I2S channel for the current pins + rate.
     void reinit() {
         codecBusGen_ = platform::i2cBusGeneration();   // every path through here has seen this bus, so tick1s waits for the next change
+        openedWith_ = micConfig();                     // the settings this attempt opens with
         if constexpr (platform::hasAudioCapture) {
             // Desktop:
             deinit();
diff --git a/src/core/services/MoonLiveService.h b/src/core/services/MoonLiveService.h
index 6633e59c0..89d90db50 100644
--- a/src/core/services/MoonLiveService.h
+++ b/src/core/services/MoonLiveService.h
@@ -48,6 +48,10 @@ inline constexpr const char* kServicePick[3] = {kScriptDir, kServiceExt, kServic
 ///
 /// Everything the script declares appears as a control on the card, and a slider move lands without a recompile. A compile error shows on the status line, and the service does nothing until it is fixed. A script runs on the 50 Hz poll rather than the render tick, so a heavy one costs its own tick.
 ///
+/// ## Reading and sending JSON
+///
+/// A service reads JSON from the internet with `getJson`, and sends its own documents with `pushJson` to this device or `pushJsonTo` to another. A show builds its own look this way, live and never saved. The calls: [the MoonLive language](https://moonmodules.org/MoonLight/moonmodules/light/moonlive.html#json-documents-in-a-service).
+///
 /// @technical
 ///
 /// **Same as effects.** A compiled effect and a scripted one are interchangeable, and so are the input services. The engine is identical, and the service is added under the container, then pointed at a file.
@@ -57,6 +61,13 @@ inline constexpr const char* kServicePick[3] = {kScriptDir, kServiceExt, kServic
 /// **Reach.** A script reaches the pins for hardware and the control surface for output, as the mapping rows do. It cannot rewrite a driver's pins by naming it.
 class MoonLiveService : public MoonModule {
 public:
+    /// A service whose documents go with each program, so an edited script starts with none.
+    MoonLiveService() {
+        script_.setDefineHook([](void* self, moonlive::DefinePhase phase) {
+            if (phase == moonlive::DefinePhase::Compiling) static_cast<MoonLiveService*>(self)->releaseDocuments();
+        }, this);
+    }
+
     /// A service, so the container accepts it as a child.
     ModuleRole role() const MM_NONBLOCKING override { return ModuleRole::Service; }
 
@@ -96,8 +107,12 @@ class MoonLiveService : public MoonModule {
                                   nullptr, 0, 0, platform::millis());
     }
 
+    /// A changed file may be this module's script, which the next prepare then reads again.
+    void onFileChanged(const char* path) override { script_.fileChanged(path); }
+
     /// Free the compiled block and forget it, so re-enabling rebuilds from the file.
     void release() override {
+        releaseDocuments();           // before the arena that names them goes
         script_.engine().free();      // release the exec block
         script_.invalidate();         // and forget what was compiled, so re-enabling rebuilds it
         script_.releaseReporting(*this);
@@ -108,6 +123,11 @@ class MoonLiveService : public MoonModule {
     void setScript(const char* name) { script_.setName(name); }
 
 private:
+    /// Free the JSON documents this script's program holds, named by its arena.
+    void releaseDocuments() {
+        if (const void* owner = script_.engine().arena()) JsonFetch::instance().release(owner);
+    }
+
     moonlive::MoonLiveScript script_;
 };
 
diff --git a/src/core/system/DevicesModule.h b/src/core/system/DevicesModule.h
index bb64177ee..dda41aa88 100644
--- a/src/core/system/DevicesModule.h
+++ b/src/core/system/DevicesModule.h
@@ -156,8 +156,8 @@ class DevicesModule : public MoonModule, public ListSource {
         // A cached row coming back online is a status change even with no field edit.
         const bool wasCached = d->cached;
         d->cached = false;
-        if (persistChanged) sortByName();              // re-sort only on a real persisted change
-        if (persistChanged || wasCached) refreshStatus();
+        if (persistChanged) { sortByName(); listChanged(); }   // re-sort and save only on a real persisted change
+        else if (wasCached) refreshStatus();
     }
 
     /// Report the cached list on boot, which persistence restored before this ran.
@@ -384,7 +384,7 @@ class DevicesModule : public MoonModule, public ListSource {
         if (!d->name[0]) { formatDottedQuad(d->name, ip); persistChanged = true; }
         if (persistChanged) {                  // only a saved-field change touches disk + sort
             sortByName();
-            refreshStatus();
+            listChanged();
         }
     }
 
@@ -413,7 +413,7 @@ class DevicesModule : public MoonModule, public ListSource {
         }
         if (changed) {                 // only a real self-row change re-sorts + arms persistence
             sortByName();
-            refreshStatus();
+            listChanged();
         }
     }
 
@@ -453,16 +453,20 @@ class DevicesModule : public MoonModule, public ListSource {
         }
         if (w == deviceCount_) return;   // nothing dropped: common case, no churn
         deviceCount_ = w;
-        refreshStatus();
+        listChanged();
     }
 
-    /// Report how many devices are listed, and arm the save.
+    /// Report how many devices are listed and whether multicast arrives; the status is not saved, so this arms no save.
     void refreshStatus() {
         mm::formatTo(statusBuf_, sizeof(statusBuf_), "%u device%s%s",
                       deviceCount_, deviceCount_ == 1 ? "" : "s",
                       NetworkPath::multicastDropped ? ", multicast blocked: broadcasting too" : "");
         setStatus(statusBuf_);
-        // Persisted, so the next boot shows the set instantly.
+    }
+
+    /// A saved field changed: report it and arm the save, so the next boot shows the set instantly.
+    void listChanged() {
+        refreshStatus();
         markDirty();
         FilesystemModule::noteDirty();
     }
diff --git a/src/core/system/HttpServerModule.cpp b/src/core/system/HttpServerModule.cpp
index c8efae7e9..901b661a4 100644
--- a/src/core/system/HttpServerModule.cpp
+++ b/src/core/system/HttpServerModule.cpp
@@ -118,6 +118,7 @@ void HttpServerModule::release() {
     for (auto& ws : wsClients_) ws.close();
     for (auto& c : parked_) c.close();
     releaseTransfers();
+    for (auto& s : embeddedSends_) s.conn.close();
     // Every close site notifies the producer (see cancelBufferedSend), else ghost standing requests keep the driver gathering frames for nobody.
     for (int i = 0; i < MAX_PREVIEW_CLIENTS; i++) {
         if (previewClients_[i].valid() && clientSink_) clientSink_->onClientGone(i);
@@ -300,6 +301,7 @@ void HttpServerModule::driveTransfers() {
             if (now - budgetStart >= kTransferTickBudgetMs) break;
         }
     }
+    drainEmbeddedSends();   // an embedded file is a transfer too, its bytes already in flash
 }
 
 void HttpServerModule::tick1s() MM_NONBLOCKING {
@@ -318,6 +320,24 @@ bool HttpServerModule::anyWsClientOnAccessPoint() const MM_NONBLOCKING {
     return false;
 }
 
+// Whether the query holds the parameter `name=value` whole, as a query parameter is read: `xlive=1` and `live=10` are other parameters.
+static bool queryHas(const char* query, const char* name, const char* value) {
+    const size_t n = std::strlen(name), v = std::strlen(value);
+    for (const char* p = query; p && *p;) {
+        const char* end = std::strchr(p, '&');
+        const size_t len = end ? static_cast<size_t>(end - p) : std::strlen(p);
+        if (len == n + 1 + v && std::strncmp(p, name, n) == 0 && p[n] == '=' && std::strncmp(p + n + 1, value, v) == 0) return true;
+        p = end ? end + 1 : nullptr;
+    }
+    return false;
+}
+
+// Whether the request line is `prefix`, the method and the state path, ending there or going on with a query.
+static bool isStatePath(const char* req, const char* prefix) {
+    const size_t n = std::strlen(prefix);
+    return std::strncmp(req, prefix, n) == 0 && (req[n] == ' ' || req[n] == '?');
+}
+
 // A cheap scan of the query for a "/sd" path, which only sizes the Content-Length ceiling; parseFilePath is the real guard, downstream.
 static bool requestNamesSdPath(const char* req) {
     const char* query = std::strchr(req, '?');
@@ -426,9 +446,8 @@ bool HttpServerModule::handleConnection(platform::TcpConnection& conn, int patie
                     std::strncmp(req, "POST /api/firmware/upload", 25) == 0 ||
                     // A MoonBase image (~750 KB) streams too; the trailing space keeps `moonbase-update-url`, a small JSON body read whole, out of the match.
                     std::strncmp(req, "POST /api/firmware/moonbase-update ", 35) == 0 ||
-                    // A state document holding an effects stack outgrows the request buffer; the trailing space keeps a longer path out.
-                    std::strncmp(req, "PATCH /api/state ", 17) == 0 ||
-                    std::strncmp(req, "POST /api/state ", 16) == 0;
+                    // A state document holding an effects stack outgrows the request buffer; the space or query after it keeps a longer path out.
+                    isStatePath(req, "PATCH /api/state") || isStatePath(req, "POST /api/state");
                 if (bodyNeeded > sizeof(buf) - 1) {
                     if (!isStreamingRoute) {
                         sendResponse(conn, 413, "application/json",
@@ -529,7 +548,7 @@ bool HttpServerModule::handleConnection(platform::TcpConnection& conn, int patie
             // POST for a client that cannot send PATCH: the same document, the same engine.
             if (!hasContentLen) { sendResponse(conn, 411, "application/json", "{\"error\":\"length required\"}"); return true; }
             handleApplyState(conn, body, static_cast<size_t>(totalRead) - static_cast<size_t>(body - req),
-                             static_cast<size_t>(contentLen));
+                             static_cast<size_t>(contentLen), queryStart && queryHas(queryStart + 1, "live", "1"));
         } else if (std::strcmp(path, "/api/file") == 0 && body) {
             // File Manager: POST /api/file?path=<rel> streams the body to an atomic write; `body` holds the bytes that came with the headers, and a transfer slot pulls the rest off the socket.
             const size_t initialLen = static_cast<size_t>(totalRead) - static_cast<size_t>(body - req);
@@ -590,7 +609,7 @@ bool HttpServerModule::handleConnection(platform::TcpConnection& conn, int patie
         if (std::strcmp(path, "/api/state") == 0 && body) {
             if (!hasContentLen) { sendResponse(conn, 411, "application/json", "{\"error\":\"length required\"}"); return true; }
             handleApplyState(conn, body, static_cast<size_t>(totalRead) - static_cast<size_t>(body - req),
-                             static_cast<size_t>(contentLen));
+                             static_cast<size_t>(contentLen), queryStart && queryHas(queryStart + 1, "live", "1"));
         } else if (std::strncmp(path, "/api/list/", 10) == 0 && body) {
             handleListPatchRow(conn, path + 10, body);
         } else {
@@ -767,6 +786,11 @@ void HttpServerModule::handleRemoveEntry(platform::TcpConnection& conn, const ch
         sendResponse(conn, 400, "application/json", "{\"error\":\"bad path\"}");
         return;
     }
+    // A path that names nothing is the client's mistake, 404 as REST answers it, where a removal that fails is the device's.
+    if (!platform::fsExists(path)) {
+        sendResponse(conn, 404, "application/json", "{\"error\":\"not found\"}");
+        return;
+    }
     if (FilesystemModule::removeTree(path)) {
         // A removed file is a change to persistent state like a written one: a module derived from it must notice the file is gone.
         applyFileChanged(path);
@@ -923,7 +947,7 @@ static bool pullWholeBody(platform::TcpConnection& conn, const char* initialBody
 }
 
 void HttpServerModule::handleApplyState(platform::TcpConnection& conn, const char* initialBody, size_t initialLen,
-                                        size_t contentLen) {
+                                        size_t contentLen, bool live) {
     if (!scheduler_) { sendResponse(conn, 503, "application/json", "{\"error\":\"not ready\"}"); return; }
     if (contentLen > kStateDocumentMax) { sendResponse(conn, 413, "application/json", "{\"error\":\"document too large\"}"); return; }
     char* doc = static_cast<char*>(platform::alloc(contentLen + 1));
@@ -933,7 +957,8 @@ void HttpServerModule::handleApplyState(platform::TcpConnection& conn, const cha
         sendResponse(conn, 400, "application/json", "{\"error\":\"incomplete request body\"}");
         return;
     }
-    const StateDocumentResult r = applyStateDocument(*scheduler_, doc);
+    // `?live=1` drives rather than configures, as a show building its look on another device does: nothing it changes is marked to save.
+    const StateDocumentResult r = applyStateDocument(*scheduler_, doc, live ? StateSource::Live : StateSource::Request);
     platform::free(doc);
     // A growing sink, since a path of escaped names has no small fixed bound.
     JsonSink sink;
@@ -1008,6 +1033,8 @@ void HttpServerModule::applyFileChanged(const char* path) {
     if (auto* fs = FilesystemModule::instance()) fs->requestConfigApply(path);
     // A user script of a name the firmware also ships is a fork; record its origin here, where every writer passes, so the binding can flag an updated shipped copy.
     moonlive::noteForkedFrom(path);
+    // A script that landed leaves the missing list here, not at a compile that may never come.
+    moonlive::noteScriptLanded(path);
     if (!scheduler_) return;
     scheduler_->notifyFileChanged(path);
     // requestPrepareTree, never prepareTree: the flag is consumed at the frame boundary, so a multi-file upload costs one sweep.
@@ -1186,8 +1213,33 @@ void HttpServerModule::serveFile(platform::TcpConnection& conn, const ui::Embedd
         "\r\n",
         contentType, file.len,
         file.gzipped ? "Content-Encoding: gzip\r\n" : "");
-    conn.write(reinterpret_cast<const uint8_t*>(header), headerLen);
-    conn.write(file.data, file.len);
+    EmbeddedSend* slot = nullptr;
+    for (auto& s : embeddedSends_)
+        if (!s.conn.valid()) { slot = &s; break; }
+    // Every slot busy: answered rather than written whole, which would hold the render loop for the transfer.
+    if (!slot) { sendResponse(conn, 503, "application/json", "{\"error\":\"every send slot is busy\"}"); return; }
+    if (!conn.write(reinterpret_cast<const uint8_t*>(header), headerLen)) return;
+    slot->conn = std::move(conn);
+    slot->data = file.data;
+    slot->left = file.len;
+    slot->lastActivityMs = platform::millis();
+}
+
+void HttpServerModule::drainEmbeddedSends() {
+    const uint32_t now = platform::millis();
+    for (auto& s : embeddedSends_) {
+        if (!s.conn.valid()) continue;
+        // A send waiting on our memory counts as stalled too, so one that never gets room is closed and frees its share.
+        int n = 1;
+        while (s.left > 0 && n > 0 && sendHasHeadroom() && platform::millis() - now < kTransferTickBudgetMs) {
+            n = s.conn.writeSome(s.data, s.left);
+            if (n <= 0) break;
+            s.data += n;
+            s.left -= static_cast<size_t>(n);
+            s.lastActivityMs = now;
+        }
+        if (s.left == 0 || n < 0 || now - s.lastActivityMs > kTransferStallMs) s.conn.close();
+    }
 }
 
 void HttpServerModule::serveState(platform::TcpConnection& conn) {
@@ -2227,11 +2279,10 @@ void HttpServerModule::serveScriptCatalog(platform::TcpConnection& conn) {
     sink.append(",\"dir\":");
     sink.writeJsonString(moonlive::kFactoryScriptDir);
 
-    // Each name carries `dim` and `tags` from its source, for the picker, and `sub`, the subfolder the UI fetches it from; the device keeps scripts flat.
-    auto emit = [&sink](const char* key, const char* folder,
-                        const char* const* names, const unsigned char* dims,
-                        const char* const* tags, const unsigned char* subs, size_t count) {
-        sink.appendf(",\"%s\":{\"folder\":\"%s\",\"names\":[", key, folder);
+    // Each name carries `dim` and `tags` from its source, for the picker, and `folder`, where under moonlive/ the UI fetches it from; the device keeps scripts flat.
+    auto emit = [&sink](const char* key, const char* const* names, const unsigned char* dims,
+                        const char* const* tags, const unsigned char* folders, size_t count) {
+        sink.appendf(",\"%s\":{\"names\":[", key);
         for (size_t i = 0; i < count; i++) {
             if (i) sink.append(",");
             sink.writeJsonString(names[i]);
@@ -2243,27 +2294,27 @@ void HttpServerModule::serveScriptCatalog(platform::TcpConnection& conn) {
             if (i) sink.append(",");
             sink.writeJsonString(tags[i]);
         }
-        sink.append("],\"sub\":[");
+        sink.append("],\"folder\":[");
         for (size_t i = 0; i < count; i++) {
             if (i) sink.append(",");
-            sink.writeJsonString(moonlive::kCatalogSubfolders[subs[i]]);
+            sink.writeJsonString(moonlive::kCatalogFolders[folders[i]]);
         }
         sink.append("]}");
     };
-    emit("effects", moonlive::kEffectFolder, moonlive::kEffectCatalog,
-         moonlive::kEffectCatalogDim, moonlive::kEffectCatalogTags, moonlive::kEffectCatalogSub,
+    emit("effects", moonlive::kEffectCatalog,
+         moonlive::kEffectCatalogDim, moonlive::kEffectCatalogTags, moonlive::kEffectCatalogFolder,
          moonlive::kEffectCatalogCount);
-    emit("layouts", moonlive::kLayoutFolder, moonlive::kLayoutCatalog,
-         moonlive::kLayoutCatalogDim, moonlive::kLayoutCatalogTags, moonlive::kLayoutCatalogSub,
+    emit("layouts", moonlive::kLayoutCatalog,
+         moonlive::kLayoutCatalogDim, moonlive::kLayoutCatalogTags, moonlive::kLayoutCatalogFolder,
          moonlive::kLayoutCatalogCount);
-    emit("modifiers", moonlive::kModifierFolder, moonlive::kModifierCatalog,
-         moonlive::kModifierCatalogDim, moonlive::kModifierCatalogTags, moonlive::kModifierCatalogSub,
+    emit("modifiers", moonlive::kModifierCatalog,
+         moonlive::kModifierCatalogDim, moonlive::kModifierCatalogTags, moonlive::kModifierCatalogFolder,
          moonlive::kModifierCatalogCount);
-    emit("services", moonlive::kServiceFolder, moonlive::kServiceCatalog,
-         moonlive::kServiceCatalogDim, moonlive::kServiceCatalogTags, moonlive::kServiceCatalogSub,
+    emit("services", moonlive::kServiceCatalog,
+         moonlive::kServiceCatalogDim, moonlive::kServiceCatalogTags, moonlive::kServiceCatalogFolder,
          moonlive::kServiceCatalogCount);
-    emit("palettes", moonlive::kPaletteFolder, moonlive::kPaletteCatalog,
-         moonlive::kPaletteCatalogDim, moonlive::kPaletteCatalogTags, moonlive::kPaletteCatalogSub,
+    emit("palettes", moonlive::kPaletteCatalog,
+         moonlive::kPaletteCatalogDim, moonlive::kPaletteCatalogTags, moonlive::kPaletteCatalogFolder,
          moonlive::kPaletteCatalogCount);
     sink.append("}");
     sink.flush();
@@ -2914,6 +2965,8 @@ void HttpServerModule::drainPreviewSend() {
     LockGuard lease{wsLock_};
     if (!lease) return;
     if (!previewSend_.active) return;
+    // Short of internal RAM the frame waits, and the producer drops the frames behind it, as it does for a busy socket.
+    if (!sendHasHeadroom()) return;
     const size_t total = previewSend_.hdrLen + previewSend_.bodyLen;
     const size_t chunk = drainChunkBytes();
     bool anyLiveClient = false;
@@ -3005,7 +3058,7 @@ void HttpServerModule::drainStream(int client, size_t budget) {
     StateStream& s = streams_[client];
     auto& ws = wsClients_[client];
     if (!ws.valid()) { endStream(s); return; }
-    while (budget > 0) {
+    while (budget > 0 && sendHasHeadroom()) {   // short of internal RAM the stream resumes next tick
         if (!s.frame) {
             if (s.last) { endStream(s); return; }
             if (!nextStreamFrame(client)) { refuseFragment(client); return; }
diff --git a/src/core/system/HttpServerModule.h b/src/core/system/HttpServerModule.h
index b81d45265..5b26b8a35 100644
--- a/src/core/system/HttpServerModule.h
+++ b/src/core/system/HttpServerModule.h
@@ -406,7 +406,7 @@ class HttpServerModule : public MoonModule, public BinaryBroadcaster {
     std::array<FileTransfer, kTransferSlots> transfers_{};
     /// A free slot with its buffer, or null once it has answered: 503 when both slots are busy, 507 when the buffer does not fit.
     FileTransfer* claimTransfer(platform::TcpConnection& conn);
-    /// Advance every active slot by one bounded chunk; called once per tick, the drainXxxSend's sibling.
+    /// Advance every active slot by one bounded chunk, then the embedded file sends; called once per tick, the drainXxxSend's sibling.
     void driveTransfers();
     /// One upload slot's bounded chunk: socket to storage, then the stall guard. Returns whether real bytes moved.
     bool driveUpload(FileTransfer& t, uint32_t now);
@@ -417,6 +417,17 @@ class HttpServerModule : public MoonModule, public BinaryBroadcaster {
     /// Close every active slot's stream and socket; release()'s own cleanup, since going out of scope frees neither.
     void releaseTransfers();
 
+    /// An embedded UI file resuming across ticks, a slot per socket since a page load fetches several: a socket and an offset into flash, one non-blocking write a tick.
+    struct EmbeddedSend {
+        platform::TcpConnection conn;
+        const uint8_t* data = nullptr;     // the next byte to send
+        size_t left = 0;
+        uint32_t lastActivityMs = 0;       // the same stall guard the transfers use
+    };
+    std::array<EmbeddedSend, 16> embeddedSends_{};   // as many as the ESP32's CONFIG_LWIP_MAX_SOCKETS, so a page load never finds them all busy
+    /// Send what each slot's socket accepts now; close a slot once its file is out, its peer errs, or it stalls.
+    void drainEmbeddedSends();
+
     ClientMessageSink* clientSink_ = nullptr;   // the producer's inbound-message sink (PreviewDriver) @xref{crossing-the-domain-boundary}
 
     /// One resumable frame: a copied header plus a pointer into the caller's stable body buffer. @xref{why-the-preview-has-its-own-connections}
@@ -430,6 +441,13 @@ class HttpServerModule : public MoonModule, public BinaryBroadcaster {
     };
     PreviewSend previewSend_;
 public:
+    /// The internal RAM a send leaves free. On a board without PSRAM every unacknowledged segment is internal RAM, and a page load or a preview over a slow link queued 52 KB of them.
+    static constexpr size_t kSendHeadroom = platform::kInternalFreeFloor / 2;
+    /// Admission control for every send that queues on a socket: true while free internal RAM is above the headroom, or unreported (0).
+    static bool sendHasHeadroom() {
+        const size_t f = platform::freeInternalHeap();
+        return f == 0 || f > kSendHeadroom;
+    }
     /// What one control client views: modules named at any depth by name or type, each bringing its descendants. @xref{state-by-subscription}
     struct Subscription {
         static constexpr uint8_t kMaxModules = 8;   ///< a page names its root and five types it reads beside it
@@ -637,7 +655,8 @@ class HttpServerModule : public MoonModule, public BinaryBroadcaster {
 
     void handleSetControl(platform::TcpConnection& conn, const char* body);
     /// Apply a state document from the request body, which may outgrow the request buffer: `PATCH /api/state`.
-    void handleApplyState(platform::TcpConnection& conn, const char* initialBody, size_t initialLen, size_t contentLen);
+    void handleApplyState(platform::TcpConnection& conn, const char* initialBody, size_t initialLen, size_t contentLen,
+                          bool live);
 
     /// Delegates to the scheduler's own canonical tree walk, guarding a null scheduler first.
     MoonModule* findModuleByName(const char* name);
diff --git a/src/core/system/MoonCloudModule.h b/src/core/system/MoonCloudModule.h
index 70dcb2e7e..b37634630 100644
--- a/src/core/system/MoonCloudModule.h
+++ b/src/core/system/MoonCloudModule.h
@@ -9,6 +9,7 @@
 #include <cstring>
 
 #include "core/module/MoonModule.h"
+#include "core/util/JsonFetch.h"   // the worker an HTTPS post goes out on
 #include "core/util/sha256.h"
 #include "platform/platform.h"
 
@@ -25,25 +26,35 @@ namespace mm {
 ///
 /// A board with no TLS cannot post, so its one outbound call goes into a one-slot outbox, a hidden control the open page reads. The page posts it, then clears it by writing the request's `id` to the hidden `outbox sent`.
 ///
-/// A report goes out whenever someone has the page open, enough for a usage count. Two pages can both post the waiting request, a rare double the count tolerates. A board with HTTPS has neither control.
+/// A board without PSRAM sends itself while a TLS session fits in internal RAM, and uses the page otherwise; one with PSRAM always sends itself. Two pages can post the same request, a rare double a usage count tolerates.
 class MoonCloudModule : public MoonModule {
 public:
-    /// A board without HTTPS gets its outbox at construction, so the relay's controls are declared with the rest.
-    explicit MoonCloudModule(bool relay = !platform::httpsAvailable())
-        : outbox_(relay ? static_cast<char*>(platform::alloc(kOutboxBytes)) : nullptr) {
+    /// How a request leaves: the board itself, the open page, or the board while a TLS session fits and the page otherwise.
+    enum class Route : uint8_t { Direct, Page, DirectOrPage };
+
+    /// This board's route: the page without an HTTPS client, the board itself where TLS sits in PSRAM, and either without PSRAM.
+    static Route boardRoute() {
+        if (!platform::httpsAvailable()) return Route::Page;
+        return platform::hasPsram ? Route::Direct : Route::DirectOrPage;
+    }
+
+    /// A board that may need the page gets its outbox at construction, so the relay's controls are declared with the rest.
+    explicit MoonCloudModule(Route route = boardRoute())
+        : route_(route),
+          outbox_(route != Route::Direct ? static_cast<char*>(platform::alloc(kOutboxBytes)) : nullptr) {
         if (!outbox_) return;
         outbox_[0] = '\0';
         setDynamicBytes(kOutboxBytes);   // the card's memory readout counts it
     }
-    /// Free the outbox, where there is one.
-    ~MoonCloudModule() override { platform::free(outbox_); }
+    /// Free the outbox, where there is one, and the replies held on the worker.
+    ~MoonCloudModule() override {
+        platform::free(outbox_);
+        JsonFetch::instance().release(this);
+    }
 
     /// Always runs: the children carry the real consent, so disabling the container is ambiguous.
     bool respectsEnabled() const MM_NONBLOCKING override { return false; }
 
-    /// How long an outbound call may take before it is abandoned.
-    static constexpr uint32_t kTimeoutMs = 4000;
-
     /// The relay's two hidden controls where there is an outbox, then the children's.
     void defineControls() override {
         controls_.clear();
@@ -73,31 +84,65 @@ class MoonCloudModule : public MoonModule {
     }
 
     /// Whether a post can leave this board at all: over HTTPS, or through the page.
-    bool canSend() const { return platform::httpsAvailable() || outbox_ != nullptr; }
-    /// Whether a post waits for the page rather than leaving at once.
-    bool relaysThroughBrowser() const { return outbox_ != nullptr; }
-
-    /// Whether a request still waits for the page to deliver it.
-    bool outboxWaiting() const { return outbox_ && outbox_[0]; }
-
-    /// The one outbound call, over HTTPS or into the outbox for the page (@xref{the-browser-relay-on-a-board-without-https}); false when it could not be handed off.
-    bool post(const char* path, const char* body) {
-        if (outbox_) {
-            if (outbox_[0]) return false;
-            pendingId_ = lastId_ < INT32_MAX ? lastId_ + 1 : 1;
-            lastId_ = pendingId_;
-            const int n = std::snprintf(outbox_, kOutboxBytes, "{\"id\":%ld,\"path\":\"%s\",\"body\":%s}",
-                                        static_cast<long>(pendingId_), path, body);
-            if (n < 0 || static_cast<size_t>(n) >= kOutboxBytes) { outbox_[0] = 0; return false; }
-            notifyValuesChanged();   // to the page on the next transport tick
-            return true;
-        }
+    bool canSend() const { return route_ != Route::Page || outbox_ != nullptr; }
+    /// Whether every post waits for the page, the board having no HTTPS client.
+    bool relaysThroughBrowser() const { return route_ == Route::Page; }
+    /// Whether the last post went to the page rather than out of the board.
+    bool lastViaPage() const { return lastViaPage_; }
+
+    /// Whether a request is on its way, to the page or out of the board.
+    bool waiting() MM_NONBLOCKING { settle(); return pending_ != 0; }
+    /// Whether the request behind `ticket` is still on its way, a ticket reading the same on either route.
+    bool waiting(uint32_t ticket) MM_NONBLOCKING { settle(); return ticket && ticket == pending_; }
+    /// Whether the request behind `ticket` arrived: the page delivered it, or the server answered 2xx. An older ticket's outcome is gone, and reads as not arrived.
+    bool delivered(uint32_t ticket) MM_NONBLOCKING { settle(); return ticket && ticket == settled_ && settledOk_; }
+
+    /// The one outbound call, over HTTPS or into the outbox for the page (@xref{the-browser-relay-on-a-board-without-https}). A ticket for its outcome; 0 when it could not go or one is on its way.
+    uint32_t post(const char* path, const char* body) {
+        if (waiting()) return 0;
         char url[192];
         std::snprintf(url, sizeof(url), "https://%s%s", kHost, path);
-        return platform::httpsPost(url, body, kTimeoutMs);
+        const bool direct = route_ == Route::Direct || (route_ == Route::DirectOrPage && platform::tlsRoom(url));
+        lastViaPage_ = !direct;
+        if (direct) reply_ = JsonFetch::instance().post(this, url, body);
+        if (direct ? !reply_ : !queueForPage(path, body)) return 0;
+        ticket_ = ticket_ + 1 ? ticket_ + 1 : 1;
+        pending_ = ticket_;
+        return pending_;
     }
 
 private:
+    /// Put the request in the outbox for the open page, numbered after the last one; false when there is no outbox or it does not fit.
+    bool queueForPage(const char* path, const char* body) {
+        if (!outbox_) return false;
+        pendingId_ = lastId_ < INT32_MAX ? lastId_ + 1 : 1;
+        lastId_ = pendingId_;
+        const int n = std::snprintf(outbox_, kOutboxBytes, "{\"id\":%ld,\"path\":\"%s\",\"body\":%s}",
+                                    static_cast<long>(pendingId_), path, body);
+        if (n < 0 || static_cast<size_t>(n) >= kOutboxBytes) { outbox_[0] = 0; return false; }
+        notifyValuesChanged();   // to the page on the next transport tick
+        return true;
+    }
+
+    /// Settle the request on its way once it is done, keeping its outcome for its ticket. A read of fields alone: the loop takes the answers in, and the reply stays held for the next post.
+    void settle() MM_NONBLOCKING {
+        if (!pending_) return;
+        if (lastViaPage_) {
+            if (outbox_ && outbox_[0]) return;
+            settledOk_ = true;   // the page empties the outbox once the server took it
+        } else {
+            const int status = JsonFetch::instance().outcome(this, reply_);
+            if (status < 0) return;
+            settledOk_ = status >= 200 && status < 300;
+        }
+        settled_ = pending_;
+        pending_ = 0;
+    }
+
+    /// How a request leaves this board.
+    Route route_ = Route::Direct;
+    /// Whether the last post went to the page.
+    bool lastViaPage_ = false;
     /// The stats host, compiled in rather than configurable, on this name because a custom domain's CA is absent.
     static constexpr const char* kHost = "mooncloud-stats.moonmodules.workers.dev";
     /// The outbox size for one request: a usage report is well under it, and a talk message is capped at 280 characters.
@@ -108,6 +153,11 @@ class MoonCloudModule : public MoonModule {
     int32_t acked_ = 0;
     int32_t pendingId_ = 0;    ///< the id of the request waiting in the outbox
     int32_t lastId_ = 0;       ///< the id given last
+    int      reply_ = 0;        ///< the reply to the last HTTPS post, which the JSON client's worker sends so the loop never waits for a handshake; 0 when it could not go
+    uint32_t ticket_ = 0;       ///< the last ticket given
+    uint32_t pending_ = 0;      ///< the ticket of the request on its way, 0 when none is
+    uint32_t settled_ = 0;      ///< the ticket of the last request that finished
+    bool     settledOk_ = false;   ///< and whether it arrived
 };
 
 
diff --git a/src/core/system/MoonStatsModule.h b/src/core/system/MoonStatsModule.h
index d9913cdec..283b7a82a 100644
--- a/src/core/system/MoonStatsModule.h
+++ b/src/core/system/MoonStatsModule.h
@@ -253,12 +253,10 @@ class MoonStatsModule : public MoonModule {
             return;
         }
         if (sendReport(MoonStatsEvent::Refresh)) {
-            setOwnStatus(cloudRelays() ? "Handed to this page, which sends it within a second."
-                                       : "Sent. The charts below now describe this device as it is now.",
+            setOwnStatus(lastViaPage() ? "Handed to this page, which sends it within a second." : "Sending...",
                          Severity::Status);
         } else {
-            setOwnStatus("Could not reach the server. Nothing was sent; press send update to try again.",
-                         Severity::Error);
+            setOwnStatus(kNotSent, Severity::Error);
         }
     }
 
@@ -326,13 +324,9 @@ class MoonStatsModule : public MoonModule {
     /// Send the automatic report once every guard below passes.
     void tick1s() MM_NONBLOCKING override {
         MoonModule::tick1s();
-        // A report handed to the page is marked once the outbox empties, and nothing else goes until then.
-        if (relayPending_) {
-            const auto* cloud = static_cast<const MoonCloudModule*>(parent());
-            if (!cloud || !cloud->outboxWaiting()) {
-                markReported();
-                relayPending_ = false;
-            }
+        // A report on its way, to the page or over HTTPS, is settled once it arrived, and nothing else goes until then.
+        if (pending_) {
+            settlePending();
             return;
         }
         if (!reportDue()) return;
@@ -355,6 +349,12 @@ class MoonStatsModule : public MoonModule {
         return cloud && cloud->relaysThroughBrowser();
     }
 
+    /// Whether the last report went to the open page rather than out of the board.
+    bool lastViaPage() const {
+        const auto* cloud = static_cast<const MoonCloudModule*>(parent());
+        return cloud && cloud->lastViaPage();
+    }
+
     /// Whether we serve our own access point, asked of the platform so no copy goes stale.
     bool inApMode() const { return platform::wifiApConnected(); }
 
@@ -384,21 +384,30 @@ class MoonStatsModule : public MoonModule {
                              static_cast<uint32_t>(platform::freeHeap()),
                              sched->fps());
 
-        // Through the container, which owns the address. Whether it was accepted is reported.
-        bool sent = false;
-        if (auto* cloud = static_cast<MoonCloudModule*>(parent())) {
-            sent = cloud->post("/api/report", body.data());
-        }
-        // Through the page, the report counts once the page has delivered it, so a reboot before then sends it again.
-        if (cloudRelays()) {
-            relayPending_ = sent;
-            return sent;
-        }
-        // The automatic report marks itself either way; a failed press must not.
-        if (kind != MoonStatsEvent::Refresh || sent) markReported();
+        // Through the container, which owns the address; the outcome is settled once it arrived.
+        auto* cloud = static_cast<MoonCloudModule*>(parent());
+        ticket_ = cloud ? cloud->post("/api/report", body.data()) : 0;
+        const bool sent = ticket_ != 0;
+        pending_ = sent;
+        pressed_ = kind == MoonStatsEvent::Refresh;
         return sent;
     }
 
+    /// What a press that did not reach the server says.
+    static constexpr const char* kNotSent = "Could not reach the server. Nothing was sent; press send update to try again.";
+
+    /// Settle a report once it left. A pressed one counts once it arrived, so a reboot before then sends it again; the automatic one counts either way, so an unreachable server is not asked every second.
+    void settlePending() {
+        auto* cloud = static_cast<MoonCloudModule*>(parent());
+        if (cloud && cloud->waiting(ticket_)) return;
+        pending_ = false;
+        const bool arrived = cloud && cloud->delivered(ticket_);
+        if (arrived || !pressed_) markReported();
+        if (pressed_ && !lastViaPage())
+            setOwnStatus(arrived ? "Sent. The charts below now describe this device as it is now." : kNotSent,
+                         arrived ? Severity::Status : Severity::Error);
+    }
+
     /// The verdict this module last set, or null, so the next press retracts exactly this one.
     const char* ownStatus_ = nullptr;
 
@@ -423,7 +432,9 @@ class MoonStatsModule : public MoonModule {
     /// Whether this install may report.
     /// @guide Nothing is sent and no identifier is computed while it is off.
     bool consent_ = false;
-    bool relayPending_ = false;        ///< a report waits in the container's outbox for the page
+    bool pending_ = false;             ///< a report is on its way, to the page or over HTTPS
+    bool pressed_ = false;             ///< and it was the send update button's
+    uint32_t ticket_ = 0;              ///< the report's ticket, so this module reads its own outcome
     /// The version that last reported.
     /// @guide It differs from the running version exactly when a report is due.
     char reportedVersion_[32] = {};
diff --git a/src/core/system/MoonTalkModule.h b/src/core/system/MoonTalkModule.h
index e23ad6a0a..835815bb2 100644
--- a/src/core/system/MoonTalkModule.h
+++ b/src/core/system/MoonTalkModule.h
@@ -65,10 +65,26 @@ class MoonTalkModule : public MoonModule {
         if (!consent_) return;           // never publish without consent
         if (message_[0] == 0) return;    // nothing typed
 
-        // Only on a successful hand-off, so an unreachable server keeps what somebody typed.
+        // Cleared only once the message arrived, so an unreachable server keeps what somebody typed.
         if (send()) {
+            sending_ = true;
+            setStatus("Sending...");
+        }
+    }
+
+    /// Clear the box once the message arrived, or say it did not.
+    void tick1s() MM_NONBLOCKING override {
+        MoonModule::tick1s();
+        if (!sending_) return;
+        auto* cloud = static_cast<MoonCloudModule*>(parent());
+        if (cloud && cloud->waiting(ticket_)) return;
+        sending_ = false;
+        if (cloud && cloud->delivered(ticket_)) {
             message_[0] = 0;
             markDirty();
+            refreshStatus();
+        } else {
+            setStatus("Could not reach the server. The message is kept; press send to try again.", Severity::Error);
         }
     }
 
@@ -128,7 +144,8 @@ class MoonTalkModule : public MoonModule {
 
         // Through the container, which owns the address.
         auto* cloud = static_cast<MoonCloudModule*>(parent());
-        return cloud && cloud->post("/api/talk", body.data());
+        ticket_ = cloud ? cloud->post("/api/talk", body.data()) : 0;
+        return ticket_ != 0;
     }
 
     /// Whether posting and reading are on.
@@ -139,6 +156,10 @@ class MoonTalkModule : public MoonModule {
     bool shareName_ = false;
     /// What to say; typing changes nothing on its own.
     char message_[281] = {};
+    /// A message is on its way, and the box keeps it until it arrived.
+    bool sending_ = false;
+    /// Its ticket, so this module reads its own outcome rather than a report's.
+    uint32_t ticket_ = 0;
 };
 
 }  // namespace mm
diff --git a/src/core/system/SystemModule.h b/src/core/system/SystemModule.h
index fecc8c5ba..e102e23dc 100644
--- a/src/core/system/SystemModule.h
+++ b/src/core/system/SystemModule.h
@@ -2,6 +2,7 @@
 
 #include "core/util/DeviceName.h"   // defaultDeviceName: shared with MoonBase
 #include "core/util/format.h"   // formatTo: nonblocking formatting into a fixed buffer
+#include "core/moonlive/MoonLiveMissing.h"   // the missing scripts an open page downloads
 #include "core/module/MoonModule.h"
 #include "core/module/Scheduler.h"
 #include "core/system/FilesystemModule.h"   // setDeviceModel() arms the debounced save (noteDirty)
@@ -138,6 +139,9 @@ class SystemModule : public MoonModule {
             }
         }
         controls_.addReadOnly("maxBlock", maxBlockStr_, sizeof(maxBlockStr_));
+        /// Shipped scripts a module names and the device lacks; an open page downloads them.
+        controls_.addReadOnly("missing scripts", moonlive::missingScripts(), moonlive::kMissingText);
+        controls_.setHidden(controls_.count() - 1, true);   // the module naming one says so on its own card
 
         // Firmware identity lives on the firmware card, and filesystem usage on the file manager.
         if (chipFlashVal_ > 0) {
diff --git a/src/core/system/TasksModule.h b/src/core/system/TasksModule.h
index 7a65dcc74..04f42d88e 100644
--- a/src/core/system/TasksModule.h
+++ b/src/core/system/TasksModule.h
@@ -80,7 +80,7 @@ class TasksModule : public MoonModule {
         }
         /// How many tasks the snapshot holds.
         uint8_t listRowCount() const override { return count_; }
-        /// Append one task's summary: its name, state, core, priority and stack.
+        /// Append one task's summary: its name, state, core, priority and stack, then its CPU share where the build measures it.
         void writeListRow(JsonSink& sink, uint8_t row) const override {
             if (row >= count_) { sink.append("{}"); return; }
             const platform::TaskInfo& t = rows_[row];
diff --git a/src/core/util/JsonFetch.cpp b/src/core/util/JsonFetch.cpp
new file mode 100644
index 000000000..18d901097
--- /dev/null
+++ b/src/core/util/JsonFetch.cpp
@@ -0,0 +1,357 @@
+/// The table, the worker and the two rings behind JsonFetch.h.
+
+#include "core/util/JsonFetch.h"
+
+#include "core/module/Scheduler.h"
+#include "core/util/JsonSink.h"
+
+#include <cstdio>
+#include <cstring>
+#include <new>
+
+namespace mm {
+
+namespace {
+
+/// A copy of `s` from the platform heap, which the worker frees with the same allocator.
+char* copyText(const char* s) {
+    if (!s) return nullptr;
+    const size_t n = std::strlen(s);
+    char* c = static_cast<char*>(platform::alloc(n + 1));
+    if (c) std::memcpy(c, s, n + 1);
+    return c;
+}
+
+/// Whether a target names this device: nothing at all.
+bool isSelf(const char* target) { return !target || !*target; }
+
+/// Where a push to `target` goes and with which method. A URL is any endpoint, which takes a POST; a bare host is a MoonLight, whose state takes it live as a PATCH. Null for a host too long for `buf`.
+const char* pushUrl(const char* target, char* buf, size_t cap, const char*& method) {
+    const bool url = std::strncmp(target, "http://", 7) == 0 || std::strncmp(target, "https://", 8) == 0;
+    method = url ? "POST" : "PATCH";
+    if (url) return target;
+    const int n = std::snprintf(buf, cap, "http://%s/api/state?live=1", target);
+    return n >= 0 && static_cast<size_t>(n) < cap ? buf : nullptr;
+}
+
+/// Whether two targets are the same, the empty and the null one both being this device.
+bool sameTarget(const char* a, const char* b) {
+    if (isSelf(a) || isSelf(b)) return isSelf(a) && isSelf(b);
+    return std::strcmp(a, b) == 0;
+}
+
+}  // namespace
+
+JsonFetch JsonFetch::instance_;
+
+void JsonFetch::poll() {
+    // With nothing started both steps return at once.
+    JsonFetch& f = instance();
+    f.takeAnswers();
+    f.retireIfUnused();
+}
+
+void JsonFetch::retireIfUnused() {
+    if (!started_ || busy_.load(std::memory_order_relaxed) != 0) return;
+    // A feed asks again on its own, so it keeps the worker; a held reply waits for the next push, which starts it again.
+    for (const Slot& s : slots_) if (s.kind == Kind::Feed) return;
+    // Nothing queued and nothing on its way, so the worker waits and the join is immediate.
+    generation_.fetch_add(1, std::memory_order_release);
+    platform::stopPinnedTask(task_);
+    started_ = false;
+}
+
+JsonFetch::~JsonFetch() {
+    if (started_) {
+        generation_.fetch_add(1, std::memory_order_release);
+        platform::stopPinnedTask(task_);
+    }
+    Job j;
+    while (jobs_.pop(&j, 1)) { platform::free(j.url); platform::free(j.body); }
+    Answer a;
+    while (answers_.pop(&a, 1)) delete a.doc;
+    for (Slot& s : slots_) if (s.kind != Kind::Free) freeSlot(s);
+}
+
+const JsonFetch::Slot* JsonFetch::slotFor(const void* owner, int handle) const MM_NONBLOCKING {
+    const int index = indexOf(handle);
+    if (index < 0) return nullptr;
+    const Slot& s = slots_[index];
+    // The epoch, so a handle kept past its document's release names nothing rather than the next one in its place.
+    return (s.kind != Kind::Free && s.owner == owner && s.epoch == static_cast<uint16_t>(handle >> 8)) ? &s : nullptr;
+}
+
+int JsonFetch::claim(const void* owner, Kind kind) {
+    for (int i = 0; i < kMaxDocs; i++) {
+        Slot& s = slots_[i];
+        if (s.kind != Kind::Free) continue;
+        const uint16_t epoch = s.epoch;
+        s = Slot{};
+        s.epoch = epoch;
+        s.kind = kind;
+        s.owner = owner;
+        return i;
+    }
+    return -1;
+}
+
+void JsonFetch::freeSlot(Slot& s) {
+    delete s.doc;
+    platform::free(s.target);
+    platform::free(s.waiting);
+    const uint16_t epoch = static_cast<uint16_t>(s.epoch + 1);   // an answer on its way finds the slot changed
+    s = Slot{};
+    s.epoch = epoch;
+}
+
+int JsonFetch::literal(const void* owner, const char* text) {
+    if (!text) return 0;
+    for (int i = 0; i < kMaxDocs; i++)
+        if (slots_[i].kind == Kind::Literal && slots_[i].owner == owner && slots_[i].key == text) return handleOf(i);
+    const int i = claim(owner, Kind::Literal);
+    if (i < 0) return 0;
+    Slot& s = slots_[i];
+    s.key = text;
+    s.doc = new (std::nothrow) json::JsonDoc;
+    if (!s.doc || !json::parse(text, *s.doc)) { freeSlot(s); return 0; }
+    s.generation = 1;
+    s.status = 200;
+    return handleOf(i);
+}
+
+int JsonFetch::fetch(const void* owner, const char* url, uint32_t periodMs) {
+    if (!url || !*url) return 0;
+    for (int i = 0; i < kMaxDocs; i++) {
+        Slot& s = slots_[i];
+        if (s.kind != Kind::Feed || s.owner != owner || std::strcmp(s.target, url) != 0) continue;
+        s.periodMs = periodMs;
+        refreshIfDue(i);
+        return handleOf(i);
+    }
+    const int i = claim(owner, Kind::Feed);
+    if (i < 0) return 0;
+    Slot& s = slots_[i];
+    s.target = copyText(url);
+    if (!s.target) { freeSlot(s); return 0; }
+    s.periodMs = periodMs;
+    s.dueAt = platform::millis();
+    refreshIfDue(i);
+    return handleOf(i);
+}
+
+int JsonFetch::replySlot(const void* owner, const char* target) {
+    for (int k = 0; k < kMaxDocs; k++)
+        if (slots_[k].kind == Kind::Reply && slots_[k].owner == owner && sameTarget(slots_[k].target, target)) return k;
+    const int i = claim(owner, Kind::Reply);
+    if (i < 0) return -1;
+    if (!isSelf(target)) {
+        slots_[i].target = copyText(target);
+        if (!slots_[i].target) { freeSlot(slots_[i]); return -1; }
+    }
+    return i;
+}
+
+void JsonFetch::hand(int index, char* body) {
+    Slot& reply = slots_[index];
+    if (reply.inFlight) {
+        // The newest waits for the answer to the one on its way.
+        platform::free(reply.waiting);
+        reply.waiting = body;
+        return;
+    }
+    dispatch(index, body);
+}
+
+int JsonFetch::push(const void* owner, const char* target, int handle) {
+    Slot* from = slotFor(owner, handle);
+    if (!from || !from->doc || !from->doc->valid()) return 0;
+    const int i = replySlot(owner, target);
+    if (i < 0) return 0;
+    JsonSink sink;
+    json::write(sink, *from->doc, from->doc->rootNode());
+    if (sink.overflowed()) { lost(i); return handleOf(i); }
+    hand(i, sink.detach());
+    return handleOf(i);
+}
+
+void JsonFetch::lost(int index) {
+    // Answered as a request that reached nothing, so `jsonChanged` and `jsonStatus` say it did not go.
+    slots_[index].status = 0;
+    slots_[index].generation++;
+}
+
+int JsonFetch::post(const void* owner, const char* url, const char* body) {
+    if (isSelf(url) || !body) return 0;
+    const int i = replySlot(owner, url);
+    if (i < 0) return 0;
+    slots_[i].keepAnswer = false;
+    char* copy = copyText(body);
+    if (!copy) return 0;
+    hand(i, copy);
+    return slots_[i].inFlight ? handleOf(i) : 0;
+}
+
+int JsonFetch::outcome(const void* owner, int handle) const MM_NONBLOCKING {
+    const Slot* s = slotFor(owner, handle);
+    if (!s) return 0;
+    return s->inFlight || s->waiting ? -1 : s->status;
+}
+
+void JsonFetch::dispatch(int index, char* body) {
+    Slot& reply = slots_[index];
+    if (isSelf(reply.target)) {
+        Scheduler* sched = Scheduler::instance();
+        const uintptr_t tag = (static_cast<uintptr_t>(index) << 16) | reply.epoch;
+        if (!sched || !sched->applyLive(body, &JsonFetch::applied, tag)) { platform::free(body); lost(index); return; }
+        reply.inFlight = true;
+        busy_.fetch_add(1, std::memory_order_relaxed);
+        return;
+    }
+    char stateUrl[96];
+    const char* method = nullptr;
+    const char* url = pushUrl(reply.target, stateUrl, sizeof(stateUrl), method);
+    if (!url || !send(index, method, url, body)) { platform::free(body); lost(index); }
+}
+
+bool JsonFetch::send(int index, const char* method, const char* url, char* body) {
+    Slot& s = slots_[index];
+    if (!started_) {
+        // One worker for every request, started by the first.
+        started_ = platform::spawnPinnedTask(task_, "jsonFetch", &JsonFetch::worker, this, kWorkerStack, 1, -1);
+        if (!started_) return false;
+    }
+    char* u = copyText(url);
+    if (!u) return false;
+    Job j{static_cast<uint8_t>(index), s.epoch, method, u, body, s.keepAnswer};
+    if (jobs_.push(&j, 1) != 1) { platform::free(u); return false; }
+    s.inFlight = true;
+    busy_.fetch_add(1, std::memory_order_relaxed);
+    platform::notifyTask(task_);
+    return true;
+}
+
+void JsonFetch::refreshIfDue(int index) {
+    Slot& s = slots_[index];
+    const uint32_t now = platform::millis();
+    if (s.inFlight || static_cast<int32_t>(now - s.dueAt) < 0) return;
+    // A request that could not go skips this round, as one that failed does, rather than retrying every tick.
+    send(index, "GET", s.target, nullptr);
+    s.dueAt = now + s.periodMs;
+}
+
+void JsonFetch::takeAnswers() {
+    Answer a;
+    while (answers_.pop(&a, 1)) {
+        busy_.fetch_sub(1, std::memory_order_relaxed);
+        deliver(a.slot, a.epoch, a.status, a.doc);
+    }
+}
+
+void JsonFetch::deliver(uint8_t index, uint16_t epoch, int status, json::JsonDoc* d) {
+    Slot& s = slots_[index];
+    if (s.kind == Kind::Free || s.epoch != epoch) { delete d; return; }   // released while on its way
+    s.inFlight = false;
+    s.status = status;
+    // A failed refresh keeps the last good document, as a cache serves stale while it revalidates.
+    if (d) {
+        delete s.doc;
+        s.doc = d;
+        s.generation++;
+    } else if (s.kind == Kind::Reply) {
+        s.generation++;   // a reply that is no JSON still answered
+    }
+    if (s.kind == Kind::Reply && s.waiting) {
+        char* next = s.waiting;
+        s.waiting = nullptr;
+        dispatch(index, next);
+    }
+}
+
+void JsonFetch::applied(uintptr_t tag, const StateDocumentResult& result) {
+    JsonFetch& f = instance();
+    f.busy_.fetch_sub(1, std::memory_order_relaxed);
+    const auto index = static_cast<uint8_t>(tag >> 16);
+    const auto epoch = static_cast<uint16_t>(tag & 0xFFFF);
+    if (index >= kMaxDocs) return;
+    // The answer PATCH /api/state gives, so a script reads a push to itself as it reads one to another device.
+    JsonSink sink;
+    writeStateResult(sink, result);
+    auto* d = new (std::nothrow) json::JsonDoc;
+    if (d && !json::parse(sink.data(), *d)) { delete d; d = nullptr; }
+    f.deliver(index, epoch, result.ok ? 200 : 400, d);
+}
+
+json::JsonDoc* JsonFetch::doc(const void* owner, int handle) {
+    takeAnswers();
+    Slot* s = slotFor(owner, handle);
+    if (!s) return nullptr;
+    if (s->kind == Kind::Feed) refreshIfDue(indexOf(handle));
+    return s->doc;
+}
+
+bool JsonFetch::changed(const void* owner, int handle) {
+    takeAnswers();
+    Slot* s = slotFor(owner, handle);
+    if (!s) return false;
+    if (s->kind == Kind::Feed) refreshIfDue(indexOf(handle));
+    const bool moved = s->generation != s->seen;
+    s->seen = s->generation;
+    return moved;
+}
+
+int JsonFetch::status(const void* owner, int handle) {
+    takeAnswers();
+    const Slot* s = slotFor(owner, handle);
+    return s ? s->status : 0;
+}
+
+void JsonFetch::release(const void* owner) {
+    takeAnswers();
+    for (Slot& s : slots_)
+        if (s.kind != Kind::Free && s.owner == owner) freeSlot(s);
+    retireIfUnused();
+}
+
+bool JsonFetch::settle(uint32_t timeoutMs) {
+    // Counted in waits rather than read from the clock, which a test may hold still.
+    for (uint32_t waited = 0;; waited++) {
+        takeAnswers();
+        if (busy_.load(std::memory_order_relaxed) == 0) return true;
+        if (waited >= timeoutMs) return false;
+        platform::delayMs(1);
+    }
+}
+
+JsonFetch::Answer JsonFetch::serve(const Job& j, char* answer) {
+    // A post's answer is not read, so its size cannot refuse it; a fetch with no buffer to read into fails.
+    const bool noBuffer = j.keep && !answer;
+    const int status = noBuffer ? 0 : platform::httpFetch(j.method, j.url, j.body, kTimeoutMs,
+                                                          j.keep ? answer : nullptr, j.keep ? kAnswerCap : 0);
+    json::JsonDoc* d = nullptr;
+    if (j.keep && status && answer[0]) {
+        d = new (std::nothrow) json::JsonDoc;
+        if (d && !json::parse(answer, *d)) { delete d; d = nullptr; }
+    }
+    platform::free(j.url);
+    platform::free(j.body);
+    return Answer{j.slot, j.epoch, status, d};
+}
+
+void JsonFetch::worker(void* self) {
+    auto& f = *static_cast<JsonFetch*>(self);
+    // One answer buffer for the task's life, in PSRAM where there is PSRAM.
+    char* answer = static_cast<char*>(platform::alloc(kAnswerCap));
+    // Started while the loop has a request out, so no stop comes before this read.
+    const uint32_t mine = f.generation_.load(std::memory_order_acquire);
+    auto current = [&f, mine] { return f.generation_.load(std::memory_order_acquire) == mine; };
+    while (current()) {
+        Job j;
+        if (!f.jobs_.pop(&j, 1)) { platform::waitNotify(f.task_, 1000); continue; }
+        const Answer a = serve(j, answer);
+        // The ring holds every request the loop can have out, so this only waits while it takes the last ones in.
+        while (f.answers_.push(&a, 1) != 1 && current()) platform::delayMs(5);
+    }
+    platform::free(answer);
+}
+
+}  // namespace mm
diff --git a/src/core/util/JsonFetch.h b/src/core/util/JsonFetch.h
new file mode 100644
index 000000000..8dc0fbd56
--- /dev/null
+++ b/src/core/util/JsonFetch.h
@@ -0,0 +1,122 @@
+#pragma once
+
+#include "core/module/StateDocument.h"   // what a push to this device answers
+#include "core/util/JsonUtil.h"
+#include "core/util/SpscRing.h"
+#include "platform/platform.h"
+
+#include <atomic>
+#include <cstdint>
+
+/// JSON documents held by handle: parsed from a script's own text, fetched from a URL and kept fresh, or answered by a push to this device or another.
+///
+/// What a script's `json` values are, and what a compiled module calls for the same reach.
+namespace mm {
+
+class JsonFetch {
+public:
+    /// How many documents the device holds at once, across every script.
+    static constexpr uint8_t kMaxDocs = 16;
+    /// The largest answer kept, refused beyond rather than cut: a weather or news answer is a few KB, and a scoreboard of hundreds is a mistake.
+    static constexpr size_t kAnswerCap = platform::hasPsram ? 16 * 1024 : 4 * 1024;
+    /// How long one request may take, connect and handshake included.
+    static constexpr uint32_t kTimeoutMs = 10000;
+    /// The worker's stack: the measured peak, a TLS handshake through a P-384 chain at about 4.4 KB, with room for what that run did not reach.
+    static constexpr size_t kWorkerStack = 6 * 1024;
+
+    /// The one table every script shares.
+    static JsonFetch& instance() MM_NONBLOCKING { return instance_; }
+
+    /// A document parsed from `text` while its program lives; the same text answers the same handle, so a script may ask every tick. Zero when it is not JSON or the table is full.
+    int literal(const void* owner, const char* text);
+    /// A document fetched from `url`, answered with the last good one and fetched again when read after `periodMs`, as an HTTP cache revalidates; 0 when the table is full.
+    int fetch(const void* owner, const char* url, uint32_t periodMs);
+    /// Send the document behind `handle` to `target` and answer a handle to the reply. Null or empty is this device, which applies it between frames; a bare host is another MoonLight's state, and a URL is any REST endpoint.
+    int push(const void* owner, const char* target, int handle);
+    /// POST `body` to `url`, keeping only the status, for a caller with nothing to read in the answer. A handle to the reply, or 0 when it could not go.
+    int post(const void* owner, const char* url, const char* body);
+    /// How the push or post behind `handle` went, as of the answers the loop last took in. It reads -1 while on its way, else the HTTP status, 0 when nothing was reached.
+    int outcome(const void* owner, int handle) const MM_NONBLOCKING;
+
+    /// The document behind a handle, or null while none has arrived.
+    json::JsonDoc* doc(const void* owner, int handle);
+    /// Whether a new document arrived since this was last asked.
+    bool changed(const void* owner, int handle);
+    /// The HTTP status of the last answer, 0 while none came.
+    int status(const void* owner, int handle);
+
+    /// Free every document `owner` holds, as its program goes.
+    void release(const void* owner);
+
+    /// Wait until every request is answered and taken in, for a test; false on timeout.
+    bool settle(uint32_t timeoutMs);
+
+    /// Once a second from the loop: take the answers in, and stop the worker when nothing uses it, so a device running no JSON script carries no stack for it.
+    static void poll();
+    /// Whether the worker task runs, for a test.
+    bool workerRunning() const { return started_; }
+
+    /// The worker stops and every document goes.
+    ~JsonFetch();
+
+private:
+    enum class Kind : uint8_t { Free, Literal, Feed, Reply };
+    struct Slot {
+        Kind kind = Kind::Free;
+        const void* owner = nullptr;
+        const char* key = nullptr;     ///< a literal's text, which the program owns
+        char* target = nullptr;        ///< a feed's URL or a reply's target, owned here
+        char* waiting = nullptr;       ///< the newest push to a busy target, sent when its answer comes
+        json::JsonDoc* doc = nullptr;
+        uint32_t periodMs = 0;
+        uint32_t dueAt = 0;
+        uint32_t generation = 0;       ///< documents arrived
+        uint32_t seen = 0;             ///< the generation `changed` last answered for
+        int status = 0;
+        uint16_t epoch = 0;            ///< bumped on release, so a late answer for a freed slot is dropped
+        bool inFlight = false;
+        bool keepAnswer = true;        ///< false for a post, whose caller reads the status alone
+    };
+    struct Job { uint8_t slot; uint16_t epoch; const char* method; char* url; char* body; bool keep; };
+    struct Answer { uint8_t slot; uint16_t epoch; int status; json::JsonDoc* doc; };
+
+    const Slot* slotFor(const void* owner, int handle) const MM_NONBLOCKING;
+    Slot* slotFor(const void* owner, int handle) {
+        return const_cast<Slot*>(static_cast<const JsonFetch*>(this)->slotFor(owner, handle));
+    }
+    /// A slot's handle, four bytes as a script slot is: its place plus one in the low byte, its generation above, so one kept past a release names nothing.
+    int handleOf(int index) const { return (static_cast<int>(slots_[index].epoch) << 8) | (index + 1); }
+    /// The place a handle names, or -1.
+    static int indexOf(int handle) MM_NONBLOCKING {
+        const int index = (handle & 0xFF) - 1;
+        return handle > 0 && index >= 0 && index < kMaxDocs ? index : -1;
+    }
+    int claim(const void* owner, Kind kind);
+    void freeSlot(Slot& s);
+    void refreshIfDue(int index);
+    bool send(int index, const char* method, const char* url, char* body);
+    void dispatch(int index, char* body);
+    void lost(int index);
+    int replySlot(const void* owner, const char* target);
+    /// Send a push, or let it wait while one to its target is on its way, replacing any that waited: the coalescing a UI does for its redraws.
+    void hand(int index, char* body);
+    /// Stop the worker once no feed is held and nothing is on its way; the stop is the loop's, made while the worker waits, so the join is immediate.
+    void retireIfUnused();
+    void takeAnswers();
+    void deliver(uint8_t index, uint16_t epoch, int status, json::JsonDoc* d);
+    static void applied(uintptr_t tag, const StateDocumentResult& result);
+    static Answer serve(const Job& j, char* answer);
+    /// The worker task, since a DNS lookup and a TLS handshake take seconds: requests come in through one ring and parsed answers go back through another.
+    static void worker(void* self);
+
+    static JsonFetch instance_;
+    Slot slots_[kMaxDocs];
+    SpscRing<Job, 8> jobs_;
+    SpscRing<Answer, 8> answers_;
+    platform::WorkerTask task_;
+    bool started_ = false;
+    std::atomic<uint32_t> generation_{0};   ///< bumped by each stop, so a worker a timed-out join left running ends rather than serving beside the next
+    std::atomic<uint32_t> busy_{0};   ///< requests sent whose answers the loop has still to take in
+};
+
+}  // namespace mm
diff --git a/src/core/util/JsonUtil.cpp b/src/core/util/JsonUtil.cpp
index 195a87ca5..62af2d265 100644
--- a/src/core/util/JsonUtil.cpp
+++ b/src/core/util/JsonUtil.cpp
@@ -4,10 +4,14 @@
 /// The rest of the header is deliberately header-only: small first-match readers whose callers benefit from inlining.
 /// `parseInt` is the exception: every integer setting is read through it, and out of line it measured 1.3 KB less flash on the classic ESP32.
 /// Every caller is off the hot path, so the call is free in practice.
+///
+/// The number reader, the JSON Pointer walk, the edits and the writer live here for that reason: each has a few callers, none on a hot path.
 
 #include "core/util/JsonUtil.h"
+#include "core/util/JsonSink.h"
 #include "core/util/parse.h"
 
+#include <climits>
 #include <cstring>
 
 namespace mm::json {
@@ -29,4 +33,463 @@ int parseInt(const char* json, const char* key) {
     return parseIntStr(v);
 }
 
+namespace {
+
+/// Whether `c` is a decimal digit, as JSON's grammar spells one.
+bool isDigit(char c) { return c >= '0' && c <= '9'; }
+
+/// Powers of ten a uint64_t holds, the scale every step of the number reader multiplies or divides by.
+constexpr uint64_t kPow10[20] = {
+    1ull, 10ull, 100ull, 1000ull, 10000ull, 100000ull, 1000000ull, 10000000ull, 100000000ull,
+    1000000000ull, 10000000000ull, 100000000000ull, 1000000000000ull, 10000000000000ull,
+    100000000000000ull, 1000000000000000ull, 10000000000000000ull, 100000000000000000ull,
+    1000000000000000000ull, 10000000000000000000ull};
+
+/// The mantissa's ceiling: 17 significant digits, past what a double carries, so a digit beyond it only moves the decimal point.
+constexpr uint64_t kMantissaCap = 10000000000000000ull;
+
+/// `m` times ten to `e`, truncated toward zero and saturated at the uint64_t range.
+uint64_t scaleWhole(uint64_t m, int e) {
+    if (e >= 0) {
+        for (; e > 0; e--) {
+            if (m > UINT64_MAX / 10) return UINT64_MAX;
+            m *= 10;
+        }
+        return m;
+    }
+    return -e > 19 ? 0 : m / kPow10[-e];
+}
+
+/// `m` times ten to `e` in Q16.16 magnitude, rounded to the nearest 1/65536 and saturated at INT32_MAX.
+uint32_t scaleFixed(uint64_t m, int e) {
+    if (e >= 0) {
+        const uint64_t whole = scaleWhole(m, e);
+        return whole > 0x7FFF ? INT32_MAX : static_cast<uint32_t>(whole << 16);
+    }
+    int k = -e;
+    if (k > 19) { m /= kPow10[k > 38 ? 19 : k - 19]; k = 19; }   // past 19 digits the fraction is far below 1/65536
+    const uint64_t whole = m / kPow10[k];
+    if (whole > 0x7FFF) return INT32_MAX;
+    uint64_t rem = m % kPow10[k], den = kPow10[k];
+    // Fourteen digits of fraction keep rem * 65536 inside 64 bits and still resolve 1/65536.
+    if (k > 14) { rem /= kPow10[k - 14]; den = kPow10[14]; }
+    const uint64_t frac = (rem * 65536u + den / 2) / den;
+    const uint64_t mag = (whole << 16) + frac;
+    return mag > INT32_MAX ? INT32_MAX : static_cast<uint32_t>(mag);
+}
+
+/// The digits at `s` into the mantissa, `e` counting how far the decimal point moves; the end of the digits.
+const char* readDigits(const char* s, uint64_t& m, int& e, bool fraction) {
+    for (; isDigit(*s); s++) {
+        if (m < kMantissaCap) {
+            m = m * 10 + static_cast<uint64_t>(*s - '0');
+            if (fraction) e--;
+        } else if (!fraction) {
+            e++;
+        }
+    }
+    return s;
+}
+
+/// An exponent at `s` added to `e`, and its end, or `s` itself where a bare 'e' has no digits and so is no part of the number.
+const char* readExponent(const char* s, int& e) {
+    if (*s != 'e' && *s != 'E') return s;
+    const char* d = s + 1;
+    const bool neg = *d == '-';
+    if (*d == '+' || *d == '-') d++;
+    if (!isDigit(*d)) return s;
+    int x = 0;
+    for (; isDigit(*d); d++)
+        if (x < 400) x = x * 10 + (*d - '0');
+    e += neg ? -x : x;
+    return d;
+}
+
+}  // namespace
+
+const char* parseNumber(const char* p, long& whole, int32_t& fixed, bool& decimal) {
+    const char* s = p;
+    const bool neg = *s == '-';
+    if (neg) s++;
+    if (!isDigit(*s)) return nullptr;
+    // The significant digits in one integer and the decimal point as a power of ten, so no step rounds.
+    uint64_t m = 0;
+    int e = 0;
+    s = readDigits(s, m, e, false);
+    decimal = *s == '.';
+    if (decimal) s = readDigits(s + 1, m, e, true);
+    const char* end = readExponent(s, e);
+    decimal = decimal || end != s;
+    s = end;
+    const uint64_t w = scaleWhole(m, e);
+    if (neg) whole = w > static_cast<uint64_t>(LONG_MAX) ? LONG_MIN : -static_cast<long>(w);
+    else     whole = w > static_cast<uint64_t>(LONG_MAX) ? LONG_MAX : static_cast<long>(w);
+    const uint32_t f = scaleFixed(m, e);
+    fixed = neg ? -static_cast<int32_t>(f) : static_cast<int32_t>(f);
+    return s;
+}
+
+namespace {
+
+/// The character a pointer token holds at `i`, "~1" being '/' and "~0" '~', with `i` moved past an escape.
+char tokenChar(const char* tok, size_t len, size_t& i) {
+    if (tok[i] == '~' && i + 1 < len && (tok[i + 1] == '0' || tok[i + 1] == '1')) return tok[++i] == '0' ? '~' : '/';
+    return tok[i];
+}
+
+/// Whether an object key equals a pointer token, decoding as it compares, so no token is copied.
+bool tokenIs(const char* key, const char* tok, size_t len) {
+    for (size_t i = 0; i < len; i++, key++)
+        if (*key != tokenChar(tok, len, i)) return false;
+    return *key == '\0';
+}
+
+/// The array index a token spells, digits with no leading zero as RFC 6901 writes it, or -1.
+long tokenIndex(const char* tok, size_t len) {
+    if (len == 0 || len > 9 || (len > 1 && tok[0] == '0')) return -1;
+    long v = 0;
+    for (size_t i = 0; i < len; i++) {
+        if (!isDigit(tok[i])) return -1;
+        v = v * 10 + (tok[i] - '0');
+    }
+    return v;
+}
+
+/// The member of object `n` a token names, or -1.
+int memberIndex(const JsonDoc& doc, const JsonNode& n, const char* tok, size_t len) {
+    for (int i = n.firstChild; i >= 0; i = doc.nodes[i].next)
+        if (doc.nodes[i].key && tokenIs(doc.nodes[i].key, tok, len)) return i;
+    return -1;
+}
+
+/// Element `want` of array `n`, or -1.
+int elementIndex(const JsonDoc& doc, const JsonNode& n, long want) {
+    for (int i = n.firstChild; i >= 0 && want >= 0; i = doc.nodes[i].next, want--)
+        if (want == 0) return i;
+    return -1;
+}
+
+/// The child of `parent` a token names, or -1.
+int childIndex(const JsonDoc& doc, int parent, const char* tok, size_t len) {
+    const JsonNode* n = doc.node(parent);
+    if (n && n->type == JsonType::Object) return memberIndex(doc, *n, tok, len);
+    if (n && n->type == JsonType::Array) return elementIndex(doc, *n, tokenIndex(tok, len));
+    return -1;
+}
+
+/// The token after the '/' at `ptr`, its length in `len`, with `ptr` moved to its end.
+const char* nextToken(const char*& ptr, size_t& len) {
+    const char* tok = ++ptr;
+    while (*ptr && *ptr != '/') ptr++;
+    len = static_cast<size_t>(ptr - tok);
+    return tok;
+}
+
+/// The index a pointer names, or -1; the walk is by index, so an edit growing the pool between two walks never dangles.
+int indexAt(const JsonDoc& doc, const char* ptr) {
+    if (!ptr || !doc.valid()) return -1;
+    int cur = doc.root;
+    if (*ptr && *ptr != '/') return -1;
+    while (*ptr == '/' && cur >= 0) {
+        size_t len = 0;
+        const char* tok = nextToken(ptr, len);
+        cur = childIndex(doc, cur, tok, len);
+    }
+    return cur;
+}
+
+/// A fresh node, a released one first, or -1 with the document marked out of memory.
+int newNode(JsonDoc& doc, JsonType type) {
+    int i = doc.freeNode;
+    if (i >= 0) {
+        doc.freeNode = doc.nodes[i].next;
+    } else {
+        if (!doc.ensureNode()) { doc.outOfMemory = true; return -1; }
+        i = doc.count++;
+    }
+    doc.nodes[i] = JsonNode{};
+    doc.nodes[i].type = type;
+    return i;
+}
+
+/// Link `child` as the last child of `parent`.
+void appendChild(JsonDoc& doc, int parent, int child) {
+    int* link = &doc.nodes[parent].firstChild;
+    while (*link >= 0) link = &doc.nodes[*link].next;
+    *link = child;
+}
+
+/// The decoded text of a pointer token, owned by the document, for a member an edit creates.
+const char* ownToken(JsonDoc& doc, const char* tok, size_t len) {
+    char key[64];
+    size_t n = 0;
+    for (size_t i = 0; i < len && n + 1 < sizeof(key); i++) key[n++] = tokenChar(tok, len, i);
+    return doc.own(key, n);
+}
+
+/// A new child of `parent` for a token it lacks: an object's member by the token's name, or an array's next element at "-"; -1 where none can be.
+int addChild(JsonDoc& doc, int parent, const char* tok, size_t len) {
+    const JsonType type = doc.nodes[parent].type;
+    const bool member = type == JsonType::Object;
+    if (!member && !(type == JsonType::Array && len == 1 && tok[0] == '-')) return -1;
+    const char* key = member ? ownToken(doc, tok, len) : nullptr;
+    if (member && !key) return -1;
+    const int child = newNode(doc, JsonType::Null);
+    if (child < 0) return -1;
+    doc.nodes[child].key = key;
+    appendChild(doc, parent, child);
+    return child;
+}
+
+/// The child of `parent` a token names, added where it has none; -1 where none can be.
+int childOrNew(JsonDoc& doc, int parent, const char* tok, size_t len) {
+    const int child = childIndex(doc, parent, tok, len);
+    return child >= 0 ? child : addChild(doc, parent, tok, len);
+}
+
+/// The index a pointer names, creating a missing object member and any object on the way; "-" appends to an array; -1 where the path cannot exist.
+int ensureIndex(JsonDoc& doc, const char* ptr) {
+    if (!ptr || (*ptr && *ptr != '/')) return -1;
+    if (!doc.valid()) doc.root = newNode(doc, JsonType::Object);
+    int cur = doc.root;
+    while (*ptr == '/' && cur >= 0) {
+        size_t len = 0;
+        const char* tok = nextToken(ptr, len);
+        const int child = childOrNew(doc, cur, tok, len);
+        if (child < 0) return -1;
+        // A step with more path after it is an object, so a set on a fresh path builds the folders it names.
+        if (*ptr == '/' && doc.nodes[child].type == JsonType::Null) doc.nodes[child].type = JsonType::Object;
+        cur = child;
+    }
+    return cur;
+}
+
+/// Release the nodes from `first` on, along their sibling chain, with everything under them and the text they own, for new nodes to reuse.
+void releaseNodes(JsonDoc& doc, int first) {
+    while (first >= 0) {
+        JsonNode& n = doc.nodes[first];
+        const int next = n.next;
+        releaseNodes(doc, n.firstChild);   // as deep as the document, which kMaxDepth bounds
+        doc.disown(n.key);
+        doc.disown(n.str);
+        n = JsonNode{};
+        n.next = doc.freeNode;
+        doc.freeNode = first;
+        first = next;
+    }
+}
+
+/// Give a node a new type, releasing what it held, its text and its children.
+JsonNode* resetNode(JsonDoc& doc, int i, JsonType type) {
+    releaseNodes(doc, doc.nodes[i].firstChild);
+    doc.disown(doc.nodes[i].str);
+    JsonNode& n = doc.nodes[i];
+    n.type = type;
+    n.firstChild = -1;
+    n.decimal = false;
+    n.numLen = 0;
+    n.str = nullptr;
+    return &n;
+}
+
+/// The text a string or a number carries, copied so it outlives the document it came from.
+bool copyText(JsonDoc& dst, int di, const JsonNode& s) {
+    const bool number = s.type == JsonType::Int && s.numLen;
+    if (s.type != JsonType::String && !number) return true;
+    const char* text = dst.own(s.str, number ? s.numLen : std::strlen(s.str));
+    if (!text) return false;
+    dst.nodes[di].str = text;
+    dst.nodes[di].numLen = number ? s.numLen : 0;
+    return true;
+}
+
+bool copyInto(JsonDoc& dst, int di, const JsonDoc& src, int si, int depth);
+
+/// A new last child of `di` holding a copy of `src`'s node `sc`, its member name included.
+bool copyChild(JsonDoc& dst, int di, const JsonDoc& src, int sc, int depth) {
+    const int dc = newNode(dst, JsonType::Null);
+    if (dc < 0) return false;
+    const char* key = src.nodes[sc].key;
+    if (key && !(key = dst.own(key, std::strlen(key)))) return false;
+    dst.nodes[dc].key = key;
+    appendChild(dst, di, dc);
+    return copyInto(dst, dc, src, sc, depth + 1);
+}
+
+/// Copy `src`'s node `si` and everything under it into `dst`'s node `di`, by index on both sides.
+bool copyInto(JsonDoc& dst, int di, const JsonDoc& src, int si, int depth) {
+    if (depth >= kMaxDepth) return false;
+    const JsonNode s = src.nodes[si];   // by value: `dst` growing never moves it
+    JsonNode* d = resetNode(dst, di, s.type);
+    d->decimal = s.decimal;
+    d->intValue = s.intValue;
+    if (!copyText(dst, di, s)) return false;
+    for (int sc = s.firstChild; sc >= 0; sc = src.nodes[sc].next)
+        if (!copyChild(dst, di, src, sc, depth)) return false;
+    return true;
+}
+
+}  // namespace
+
+const JsonNode* at(const JsonDoc& doc, const char* pointer) {
+    return doc.node(indexAt(doc, pointer));
+}
+
+int32_t readFixed(const JsonNode* n, int32_t fallback) {
+    if (!n) return fallback;
+    if (n->type == JsonType::Bool) return n->intValue ? 65536 : 0;
+    if (n->type != JsonType::Int) return fallback;
+    // A decimal is its text, read again here rather than kept per node, since only a script asks.
+    if (n->decimal && n->numLen) {
+        long whole = 0;
+        int32_t fixed = 0;
+        bool decimal = false;
+        if (parseNumber(n->str, whole, fixed, decimal)) return fixed;
+    }
+    const long v = n->intValue;
+    return v > 0x7FFF ? INT32_MAX : v < -0x8000 ? INT32_MIN : static_cast<int32_t>(v * 65536);
+}
+
+bool readNumber(const JsonNode* n, long& whole, int32_t& fixed) {
+    if (!n) return false;
+    if (n->type == JsonType::Int || n->type == JsonType::Bool) {
+        whole = n->intValue;
+        fixed = readFixed(n);
+        return true;
+    }
+    if (n->type != JsonType::String || !n->str) return false;
+    const char* s = n->str;
+    while (*s == ' ') s++;
+    if (*s == '+') s++;
+    bool decimal = false;
+    return parseNumber(s, whole, fixed, decimal) != nullptr;
+}
+
+bool appendText(JsonDoc& doc, const char* pointer, const char* text) {
+    if (!text) return false;
+    const int i = ensureIndex(doc, pointer);
+    if (i < 0) return false;
+    const JsonNode& n = doc.nodes[i];
+    const char* before = n.type == JsonType::String && n.str ? n.str : "";
+    const size_t a = std::strlen(before), b = std::strlen(text);
+    char* joined = static_cast<char*>(std::malloc(a + b + 1));
+    if (!joined) return false;
+    std::memcpy(joined, before, a);
+    std::memcpy(joined + a, text, b + 1);
+    const char* kept = doc.own(joined, a + b);
+    std::free(joined);
+    if (!kept) return false;
+    resetNode(doc, i, JsonType::String)->str = kept;
+    return true;
+}
+
+bool appendValue(JsonDoc& dst, const char* dstPointer, const JsonDoc& src, const char* srcPointer) {
+    const JsonNode* n = at(src, srcPointer);
+    if (!n) return false;
+    if (n->type == JsonType::String) return appendText(dst, dstPointer, n->str ? n->str : "");
+    JsonSink sink;
+    write(sink, src, n);
+    return !sink.overflowed() && appendText(dst, dstPointer, sink.data());
+}
+
+bool setInt(JsonDoc& doc, const char* pointer, long value) {
+    const int i = ensureIndex(doc, pointer);
+    if (i < 0) return false;
+    JsonNode* n = resetNode(doc, i, JsonType::Int);
+    n->intValue = value;
+    return true;
+}
+
+bool setFixed(JsonDoc& doc, const char* pointer, int32_t value) {
+    const int i = ensureIndex(doc, pointer);
+    if (i < 0) return false;
+    // Written as its text, four decimals resolving 1/65536 to within a rounding step, so a decimal is its text however it came.
+    const int64_t v = value;
+    const uint64_t mag = static_cast<uint64_t>(v < 0 ? -v : v);
+    uint64_t whole = mag >> 16, frac = ((mag & 0xFFFF) * 10000 + 32768) >> 16;
+    if (frac >= 10000) { whole++; frac -= 10000; }
+    char text[24];
+    const int len = frac ? std::snprintf(text, sizeof(text), "%s%lu.%04lu", v < 0 ? "-" : "",
+                                         static_cast<unsigned long>(whole), static_cast<unsigned long>(frac))
+                         : std::snprintf(text, sizeof(text), "%s%lu", v < 0 && whole ? "-" : "", static_cast<unsigned long>(whole));
+    const char* kept = doc.own(text, static_cast<size_t>(len));
+    if (!kept) return false;
+    JsonNode* n = resetNode(doc, i, JsonType::Int);
+    n->intValue = value / 65536;   // truncated toward zero, as a parsed decimal is
+    n->decimal = frac != 0;
+    n->str = kept;
+    n->numLen = static_cast<uint16_t>(len);
+    return true;
+}
+
+bool setString(JsonDoc& doc, const char* pointer, const char* value) {
+    if (!value) return false;
+    const int i = ensureIndex(doc, pointer);
+    if (i < 0) return false;
+    const char* text = doc.own(value, std::strlen(value));
+    if (!text) return false;
+    resetNode(doc, i, JsonType::String)->str = text;
+    return true;
+}
+
+bool copyValue(JsonDoc& dst, const char* dstPointer, const JsonDoc& src, const char* srcPointer) {
+    const int si = indexAt(src, srcPointer);
+    if (si < 0) return false;
+    // Within one document the source could be the destination's own parent, so the value goes through a copy first.
+    if (&dst == &src) {
+        JsonDoc tmp;
+        tmp.root = newNode(tmp, JsonType::Null);
+        if (tmp.root < 0 || !copyInto(tmp, tmp.root, src, si, 0)) return false;
+        return copyValue(dst, dstPointer, tmp, "");
+    }
+    const int di = ensureIndex(dst, dstPointer);
+    if (di < 0) return false;
+    return copyInto(dst, di, src, si, 0);
+}
+
+namespace {
+
+void writeNode(JsonSink& out, const JsonDoc& doc, const JsonNode* n, int depth);
+
+/// Write a value that holds no other, a parsed number repeated as written.
+void writeScalar(JsonSink& out, const JsonNode& n) {
+    switch (n.type) {
+        case JsonType::Bool:   out.writeBool(n.intValue != 0); return;
+        case JsonType::String: out.writeJsonString(n.str); return;
+        case JsonType::Int:
+            if (n.numLen) out.append(n.str, n.numLen);
+            else out.appendf("%ld", n.intValue);
+            return;
+        default: out.append("null");
+    }
+}
+
+/// Write an object or an array and everything under it.
+void writeContainer(JsonSink& out, const JsonDoc& doc, const JsonNode& n, int depth) {
+    const bool obj = n.type == JsonType::Object;
+    out.append(obj ? "{" : "[");
+    for (int i = n.firstChild; i >= 0; i = doc.nodes[i].next) {
+        if (i != n.firstChild) out.append(",");
+        if (obj) {
+            out.writeJsonString(doc.nodes[i].key);
+            out.append(":");
+        }
+        writeNode(out, doc, &doc.nodes[i], depth + 1);
+    }
+    out.append(obj ? "}" : "]");
+}
+
+/// Write one node at a depth, the bound an edit-built path also respects.
+void writeNode(JsonSink& out, const JsonDoc& doc, const JsonNode* n, int depth) {
+    if (!n || depth >= kMaxDepth) out.append("null");
+    else if (n->type == JsonType::Object || n->type == JsonType::Array) writeContainer(out, doc, *n, depth);
+    else writeScalar(out, *n);
+}
+
+}  // namespace
+
+void write(JsonSink& out, const JsonDoc& doc, const JsonNode* n) {
+    writeNode(out, doc, n, 0);
+}
+
 }  // namespace mm::json
diff --git a/src/core/util/JsonUtil.h b/src/core/util/JsonUtil.h
index cb75f1578..29fe25868 100644
--- a/src/core/util/JsonUtil.h
+++ b/src/core/util/JsonUtil.h
@@ -125,14 +125,17 @@ inline bool parseBool(const char* json, const char* key) {
 /// The recursion bound for a device task stack, far deeper than anything we emit yet a hard guard against a pathological input.
 inline constexpr int kMaxDepth = 64;
 
+/// Every JSON number is `Int`: whole numbers read as they are, and a decimal reads truncated as a whole and, from its text, exact to 1/65536 as fixed point.
 enum class JsonType : uint8_t { Null, Bool, Int, String, Object, Array };
 
 /// One value in the arena, its children linked by index so every node stays fixed-size with no per-node child array.
 struct JsonNode {
     JsonType type = JsonType::Null;   ///< which kind of value this node holds
+    bool decimal = false;         ///< a number with a fraction or an exponent, whose text is the value
+    uint16_t numLen = 0;          ///< a number's text length at `str`, which a writer repeats exactly
     const char* key = nullptr;    ///< the member name when this node is an object member
-    const char* str = nullptr;    // string value (points into doc buffer) when type == String
-    long intValue = 0;            ///< the numeric value, and a mirror for a boolean
+    const char* str = nullptr;    ///< the string value, or a number's text
+    long intValue = 0;            ///< the numeric value truncated toward zero, and a mirror for a boolean
     int firstChild = -1;          ///< the first child's index, or none
     int next = -1;                ///< the next sibling's index, or none
 };
@@ -146,11 +149,50 @@ struct JsonDoc {
     int       count = 0;         ///< used node slots
     int       root = -1;         ///< the top value's index, or none until a parse succeeds
     bool      outOfMemory = false;   ///< why a parse failed, when it was memory rather than the text
+    char**    owned = nullptr;   ///< text an edit added, a block each, since the parse buffer has no room for it
+    int       ownedCount = 0;    ///< used entries in `owned`
+    int       ownedCap = 0;      ///< allocated entries in `owned`
+    int       freeNode = -1;     ///< the first node an edit released, chained through `next`, which the next new node reuses
 
     /// An empty document, owning nothing until a parse fills it.
     JsonDoc() = default;
-    /// Frees both blocks.
-    ~JsonDoc() { std::free(buf); std::free(nodes); }
+    /// Frees every block.
+    ~JsonDoc() { dropOwned(); std::free(static_cast<void*>(owned)); std::free(buf); std::free(nodes); }
+
+    /// Free the text edits added, which a new parse or the destructor ends.
+    void dropOwned() {
+        for (int i = 0; i < ownedCount; i++) std::free(owned[i]);
+        ownedCount = 0;
+        freeNode = -1;
+    }
+
+    /// Free the text `s` when an edit added it, so an edit repeated forever holds one copy; text in the parse buffer stays.
+    void disown(const char* s) {
+        if (!s) return;
+        for (int i = 0; i < ownedCount; i++)
+            if (owned[i] == s) {
+                std::free(owned[i]);
+                owned[i] = owned[--ownedCount];
+                return;
+            }
+    }
+
+    /// A copy of `s` the document keeps until it is freed or parsed again, or null when memory ran out.
+    const char* own(const char* s, size_t len) {
+        if (ownedCount == ownedCap) {
+            const int grown = ownedCap ? ownedCap * 2 : 8;
+            auto* list = static_cast<char**>(std::realloc(static_cast<void*>(owned), static_cast<size_t>(grown) * sizeof(char*)));
+            if (!list) return nullptr;
+            owned = list;
+            ownedCap = grown;
+        }
+        char* copy = static_cast<char*>(std::malloc(len + 1));
+        if (!copy) return nullptr;
+        std::memcpy(copy, s, len);
+        copy[len] = '\0';
+        owned[ownedCount++] = copy;
+        return copy;
+    }
     /// Non-copyable: it owns two heap blocks.
     JsonDoc(const JsonDoc&) = delete;
     JsonDoc& operator=(const JsonDoc&) = delete;
@@ -174,6 +216,9 @@ struct JsonDoc {
     }
 };
 
+/// Read the JSON number at `p` (RFC 8259) in integer arithmetic, a double being emulated in software on the classic ESP32. The end of the number, or null when there is none.
+const char* parseNumber(const char* p, long& whole, int32_t& fixed, bool& decimal);
+
 namespace detail {
 
 /// The cursor over the document's own buffer, which doubles as scratch: un-escaping rewrites string bytes in place.
@@ -196,6 +241,59 @@ struct JsonParser {
         return i;
     }
 
+    /// Four hex digits at the cursor as a number, or -1 with the cursor left where it was.
+    long hex4() {
+        long v = 0;
+        for (int i = 0; i < 4; i++) {
+            const int d = hexDigit(p[i]);
+            if (d < 0) return -1;
+            v = v * 16 + d;
+        }
+        p += 4;
+        return v;
+    }
+
+    /// Write code point `cp` as UTF-8 at `out`, answering the write cursor.
+    static char* encodeUtf8(char* out, long cp) {
+        if (cp < 0x80) { *out++ = static_cast<char>(cp); return out; }
+        if (cp < 0x800) {
+            *out++ = static_cast<char>(0xC0 | (cp >> 6));
+        } else if (cp < 0x10000) {
+            *out++ = static_cast<char>(0xE0 | (cp >> 12));
+            *out++ = static_cast<char>(0x80 | ((cp >> 6) & 0x3F));
+        } else {
+            *out++ = static_cast<char>(0xF0 | (cp >> 18));
+            *out++ = static_cast<char>(0x80 | ((cp >> 12) & 0x3F));
+            *out++ = static_cast<char>(0x80 | ((cp >> 6) & 0x3F));
+        }
+        *out++ = static_cast<char>(0x80 | (cp & 0x3F));
+        return out;
+    }
+
+    /// The low half of a surrogate pair in the `\uXXXX` escape at the cursor, read past. Otherwise -1, the cursor kept so that escape decodes on its own.
+    long lowHalf() {
+        if (p[0] != '\\' || p[1] != 'u') return -1;
+        char* at = p;
+        p += 2;
+        const long low = hex4();
+        if (low >= 0xDC00 && low <= 0xDFFF) return low;
+        p = at;
+        return -1;
+    }
+
+    /// Decode a `\uXXXX` escape, the cursor past the `u`, as UTF-8 at `out` (RFC 8259), a surrogate pair as one character and a malformed one as '?'. Answers the write cursor, which an escape, longer than its bytes, keeps behind the read cursor.
+    char* decodeUnicode(char* out) {
+        long cp = hex4();
+        const bool high = cp >= 0xD800 && cp <= 0xDBFF;
+        if (high) {
+            const long low = lowHalf();
+            cp = low >= 0 ? 0x10000 + ((cp - 0xD800) << 10) + (low - 0xDC00) : '?';
+        } else if (cp < 0 || (cp >= 0xD800 && cp <= 0xDFFF)) {
+            cp = '?';   // malformed, or half a pair
+        }
+        return encodeUtf8(out, cp);
+    }
+
     /// Un-escape a string literal in place and terminate it, returning its first byte, or nothing when unterminated.
     char* parseStringLiteral() {
         p++;                       // opening quote
@@ -215,8 +313,9 @@ struct JsonParser {
                     case 't':  c = '\t'; break;
                     case 'b':  c = '\b'; break;
                     case 'f':  c = '\f'; break;
+                    case 'u':  out = decodeUnicode(out); continue;
                     case 0:    ok = false; return nullptr;  // trailing backslash, truncated
-                    default:   c = e;    break;             // unknown escape (incl. \u): keep byte
+                    default:   c = e;    break;             // an unknown escape keeps its byte
                 }
             }
             *out++ = c;
@@ -263,25 +362,16 @@ struct JsonParser {
                 return idx;
             }
             default: {
-                // An integer-only model: the sign and digits, then any fractional tail discarded, since we never persist a float.
-                if (*p != '-' && (*p < '0' || *p > '9')) { ok = false; return -1; }
-                char* endp = nullptr;
-                long v = std::strtol(p, &endp, 10);
-                if (endp == p) { ok = false; return -1; }
-                p = endp;
-                // Skipped precisely, so the scan stops at the number's real end rather than swallowing a following token.
-                auto digits = [&] { while (*p >= '0' && *p <= '9') p++; };
-                if (*p == '.') { p++; digits(); }
-                if (*p == 'e' || *p == 'E') {
-                    char* e = p++;
-                    if (*p == '+' || *p == '-') p++;
-                    if (*p >= '0' && *p <= '9') digits();
-                    else p = e;     // bare 'e' with no exponent digits: not part of the number
-                }
                 int idx = alloc();
                 if (idx < 0) return -1;
-                doc.nodes[idx].type = JsonType::Int;
-                doc.nodes[idx].intValue = v;
+                JsonNode& n = doc.nodes[idx];
+                int32_t fixed = 0;   // derived from the text when asked, so every node stays 24 bytes
+                const char* end = parseNumber(p, n.intValue, fixed, n.decimal);
+                if (!end) { ok = false; return -1; }
+                n.type = JsonType::Int;
+                n.str = p;   // the source text, which a writer repeats rather than re-rounding
+                n.numLen = static_cast<uint16_t>(end - p > 0xFFFF ? 0 : end - p);
+                p += end - p;
                 return idx;
             }
         }
@@ -348,6 +438,7 @@ inline bool parse(const char* json, JsonDoc& out) {
     out.count = 0;
     out.root = -1;
     out.outOfMemory = false;
+    out.dropOwned();
     if (!json) return false;
     size_t len = std::strlen(json);
     if (len == 0) return false;
@@ -431,6 +522,39 @@ inline bool readBool(const JsonNode* n, bool fallback = false) {
     return fallback;
 }
 
+/// Read a node as Q16.16 fixed point: a decimal keeps its fraction, a whole number and a bool scale up, and anything else is `fallback`.
+int32_t readFixed(const JsonNode* n, int32_t fallback = 0);
+
+/// Read a node as a number as JavaScript's parseFloat does: a number or a bool as it is, a string by its leading number, since services quote theirs (`"price":"252.11"`). False when there is none.
+bool readNumber(const JsonNode* n, long& whole, int32_t& fixed);
+
+// Addressing and editing by JSON Pointer (RFC 6901), the path JSON Patch speaks: "" is the whole document, "/a/0/b" a member of the first element of "a". A key spells "/" as "~1" and "~" as "~0".
+
+/// The node a JSON Pointer names, or null when the path leaves the document.
+const JsonNode* at(const JsonDoc& doc, const char* pointer);
+
+/// Set the number at `pointer`, creating the member and any object on the way, as `mkdir -p` makes folders. False when the path runs through a non-object or past an array's end.
+bool setInt(JsonDoc& doc, const char* pointer, long value);
+/// The same for a Q16.16 value, which a writer prints with four decimals.
+bool setFixed(JsonDoc& doc, const char* pointer, int32_t value);
+/// The same for a string, which the document copies.
+bool setString(JsonDoc& doc, const char* pointer, const char* value);
+/// Copy the value at `srcPointer` in `src`, a whole object or array included, to `dstPointer` in `dst`; false when the source has no such value.
+bool copyValue(JsonDoc& dst, const char* dstPointer, const JsonDoc& src, const char* srcPointer);
+/// Append text to the string at `pointer`, which becomes a string when it held something else.
+bool appendText(JsonDoc& doc, const char* pointer, const char* text);
+/// Append the value at `srcPointer` as text: a string as it reads, anything else as JSON writes it; false when the source has no such value.
+bool appendValue(JsonDoc& dst, const char* dstPointer, const JsonDoc& src, const char* srcPointer);
+
+}  // namespace mm::json
+
+namespace mm { class JsonSink; }
+
+namespace mm::json {
+
+/// Write a node and everything under it as JSON text, the whole document for its root; a parsed number is repeated as written.
+void write(JsonSink& out, const JsonDoc& doc, const JsonNode* n);
+
 /// Navigate to the array under a key, or nothing when the input names none: @xref{the-shared-document-is-a-function-local-static|why its own function}.
 inline const JsonNode* parseListArray(const char* json, const char* key, JsonDoc*& docOut) {
     static JsonDoc doc;
diff --git a/src/light/drivers/Correction.h b/src/light/drivers/Correction.h
index e0b444330..821f4a1d2 100644
--- a/src/light/drivers/Correction.h
+++ b/src/light/drivers/Correction.h
@@ -2,6 +2,7 @@
 
 #include <cmath>   // powf: the gamma presets, off the per-frame path; the soft start rebakes them each tick for five seconds
 #include "platform/nonblocking.h"   // MM_NONBLOCKING: the brightness table rebakes on the soft start's tick
+#include "platform_config.h"   // MM_RAMFUNC: the ring's refill interrupt corrects every light it encodes
 
 #include <cstdint>
 #include <initializer_list>   // anyPresent: the offsets a fixture may carry
@@ -77,6 +78,8 @@ struct Correction {
     uint8_t offPanFine = kAbsent, offTiltFine = kAbsent, offDimmerFine = kAbsent;
     /// Whether any color or dimmer channel is 16-bit, resolved at rebuild so an 8-bit profile pays one predictable branch per light.
     bool hasFine = false;
+    /// Whether the fixture carries red, green and blue alone, resolved at rebuild so a plain strip skips every optional role per light.
+    bool plainRgb = true;
     uint8_t outChannels = 3;        // bytes emitted per light (= channelsPerLight of the wiring)
     WhiteMode whiteMode = WhiteMode::Min;   // how white is synthesized from RGB (white lights only)
 
@@ -135,6 +138,7 @@ struct Correction {
         }
         hasMotion = anyPresent({offPan, offTilt, offZoom, offRotate, offGobo});
         hasFine = anyPresent({offRedFine, offGreenFine, offBlueFine, offWhiteFine, offWarmWhiteFine, offDimmerFine});
+        plainRgb = !hasMotion && !hasFine && offDimmer == kAbsent && !anyPresent({offWhite, offWarmWhite, offYellow, offUV});
         outChannels = nChannels;
         // After the offsets: whether the 16-bit table is filled depends on hasFine.
         rebuildBrightness(brightness);
@@ -148,7 +152,14 @@ struct Correction {
 
     /// The transform through a curve table of either width, so the 8-bit and 16-bit outputs share every line. A remap, not a copy: the layer's packed slots become the fixture's own offsets.
     template <typename T>
-    inline void applyThrough(const T* lut, const uint8_t* src, T* out, uint8_t srcChannels) const {
+    inline void MM_RAMFUNC applyThrough(const T* lut, const uint8_t* src, T* out, uint8_t srcChannels) const {
+        // A plain strip: the curve on each color and nothing optional, the drivers' commonest light.
+        if (plainRgb) {
+            if (offRed != kAbsent)   out[offRed] = lut[src[0]];
+            if (offGreen != kAbsent) out[offGreen] = lut[src[1]];
+            if (offBlue != kAbsent)  out[offBlue] = lut[src[2]];
+            return;
+        }
         constexpr T kFull = static_cast<T>(~T{0});   // 255 or 65535
         // Wide open, and written every frame, so a profile declaring one cannot be silently unlit.
         if (offDimmer != kAbsent) out[offDimmer] = kFull;
diff --git a/src/light/drivers/Drivers.h b/src/light/drivers/Drivers.h
index a4e4ac0e5..cdc5558ab 100644
--- a/src/light/drivers/Drivers.h
+++ b/src/light/drivers/Drivers.h
@@ -153,74 +153,71 @@ class Drivers : public MoonModule, public LightOutput {
 
     /// List every factory palette at its place in the catalog, held or not, then the user's own `.mlp` files, and publish them to the picker. The names live in member arrays, as the seam holds pointers.
     void refreshLivePalettes() {
-        livePalettesScanned_ = true;   // every scan counts, whichever caller ran it
-        liveCount_ = 0;
+        live_.scanned = true;   // every scan counts, whichever caller ran it
+        live_.count = 0;
         // The catalog first, in its own order, so a palette's number is the same on every device of one firmware and a slot or a desk can pick it.
-        for (size_t c = 0; c < moonlive::kPaletteCatalogCount && liveCount_ < LivePalettes::kMax; c++) {
+        for (size_t c = 0; c < moonlive::kPaletteCatalogCount && live_.count < LivePalettes::kMax; c++) {
             char path[96];
-            livePtrs_[liveCount_] = moonlive::kPaletteCatalog[c];
-            liveTags_[liveCount_] = moonlive::kPaletteCatalogTags[c];
-            livePresent_[liveCount_] = moonlive::resolveScript(moonlive::kPaletteCatalog[c], path, sizeof(path));
-            liveCount_++;
+            live_.ptrs[live_.count] = moonlive::kPaletteCatalog[c];
+            live_.tags[live_.count] = moonlive::kPaletteCatalogTags[c];
+            live_.present[live_.count] = moonlive::resolveScript(moonlive::kPaletteCatalog[c], path, sizeof(path));
+            live_.count++;
         }
-        const uint8_t own = liveCount_;
+        const uint8_t own = live_.count;
         // Then the user's own, from BOTH directories, user first, so an edited one appears once.
         const auto scan = [](const char* dir, void* ctx) {
             platform::fsList(dir, [](const char* name, bool isDir, uint32_t, void* c) {
                 auto* self = static_cast<Drivers*>(c);
-                if (isDir || self->liveCount_ >= LivePalettes::kMax) return;
+                if (isDir || self->live_.count >= LivePalettes::kMax) return;
                 const size_t n = std::strlen(name);
                 if (n < 5 || std::strcmp(name + n - 4, moonlive::kPaletteExt) != 0) return;
                 // A catalog palette, or one already listed, is not added twice.
-                for (uint8_t i = 0; i < self->liveCount_; i++)
-                    if (std::strcmp(self->livePtrs_[i], name) == 0) return;
+                for (uint8_t i = 0; i < self->live_.count; i++)
+                    if (std::strcmp(self->live_.ptrs[i], name) == 0) return;
                 // A bounded copy: a name longer than the slot truncates, which a picker wants.
-                char* slot = self->liveNames_[self->liveCount_];
-                const size_t cap = sizeof(self->liveNames_[0]) - 1;
+                char* slot = self->live_.names[self->live_.count];
+                const size_t cap = sizeof(self->live_.names[0]) - 1;
                 const size_t copy = n < cap ? n : cap;
                 std::memcpy(slot, name, copy);
                 slot[copy] = '\0';
-                self->livePtrs_[self->liveCount_] = slot;
-                self->liveTags_[self->liveCount_] = "";   // a script the catalog does not know is the user's own: no chips
-                self->livePresent_[self->liveCount_] = true;
-                self->liveCount_++;
+                self->live_.ptrs[self->live_.count] = slot;
+                self->live_.tags[self->live_.count] = "";   // a script the catalog does not know is the user's own: no chips
+                self->live_.present[self->live_.count] = true;
+                self->live_.count++;
             }, ctx);
         };
         scan(moonlive::kScriptDir, this);
         scan(moonlive::kFactoryScriptDir, this);
         // The user's own alphabetical among themselves, after the catalog.
-        for (uint8_t i = static_cast<uint8_t>(own + 1); i < liveCount_; i++)
-            for (uint8_t j = i; j > own && LivePalettes::cmpName(livePtrs_[j], livePtrs_[j - 1]) < 0; j--) {
-                std::swap(livePtrs_[j], livePtrs_[j - 1]);
-                std::swap(liveTags_[j], liveTags_[j - 1]);
-                std::swap(livePresent_[j], livePresent_[j - 1]);
+        for (uint8_t i = static_cast<uint8_t>(own + 1); i < live_.count; i++)
+            for (uint8_t j = i; j > own && LivePalettes::cmpName(live_.ptrs[j], live_.ptrs[j - 1]) < 0; j--) {
+                std::swap(live_.ptrs[j], live_.ptrs[j - 1]);
+                std::swap(live_.tags[j], live_.tags[j - 1]);
+                std::swap(live_.present[j], live_.present[j - 1]);
             }
     }
 
-    /// A palette script added, removed or restored joins the picker: any path in or above a script folder rescans them.
+    /// A palette script added, removed or restored joins the picker: any path in or above a script folder rescans them. The running one compiles again at once, an edit or a download landing with no control change.
     void onFileChanged(const char* path) override {
-        if (!touchesFolder(path, moonlive::kScriptDir) && !touchesFolder(path, moonlive::kFactoryScriptDir)) return;
+        if (!moonlive::touchesScripts(path)) return;
+        paletteScriptModule_.fileChanged(path);
+        if (paletteScript_[0]) paletteScriptModule_.prepare(*this);
         refreshLivePalettes();
-        LivePalettes::set(livePtrs_, liveTags_, liveCount_, livePresent_);
+        LivePalettes::set(live_.ptrs, live_.tags, live_.count, live_.present);
         rebuildControls();
     }
 
-    /// Whether `path` is in `dir`, is `dir`, or holds it.
-    static bool touchesFolder(const char* path, const char* dir) {
-        const size_t p = std::strlen(path), d = std::strlen(dir);
-        if (p >= d) return std::strncmp(path, dir, d) == 0 && (path[d] == '/' || path[d] == 0);
-        return std::strncmp(dir, path, p) == 0 && (dir[p] == '/' || path[p - 1] == '/');
-    }
-
-    /// The scripted palette names: static, so the one published list outlives any instance, a probe's included.
-    static inline char        liveNames_[LivePalettes::kMax][moonlive::kMaxScriptName + 1] = {};
-    static inline const char* livePtrs_[LivePalettes::kMax] = {};
-    static inline const char* liveTags_[LivePalettes::kMax] = {};
-    static inline bool        livePresent_[LivePalettes::kMax] = {};   ///< whether the device holds the file, which the UI downloads on a pick when it does not
-    /// How many scripted palettes the last scan found.
-    static inline uint8_t     liveCount_ = 0;
-    /// Whether the list was scanned, device-wide as the list is, so a probe reads it rather than rescanning it.
-    static inline bool livePalettesScanned_ = false;
+    /// The device's scripted palettes, as the last scan found them; static storage starts them zeroed.
+    struct LiveScan {
+        char        names[LivePalettes::kMax][moonlive::kMaxScriptName + 1];   ///< the user's own scripts' names, which `ptrs` points at
+        const char* ptrs[LivePalettes::kMax];   ///< each palette's name
+        const char* tags[LivePalettes::kMax];   ///< each palette's catalog chips, empty for the user's own
+        bool        present[LivePalettes::kMax];   ///< whether the device holds the file, which the UI downloads on a pick when it does not
+        uint8_t     count;     ///< how many the scan found
+        bool        scanned;   ///< so a probe reads the list rather than rescanning it
+    };
+    /// Static, so the one published list outlives any instance, a probe's included.
+    static inline LiveScan live_{};
     bool        softStarting_ = false;          ///< the lights are still rising after this boot
     bool        dark_ = false;                  ///< safe mode: every driver sends black, so no LED holds a bright frame
     bool        softStartBegun_ = false;        ///< the first lit frame has started the rise
@@ -276,12 +273,12 @@ class Drivers : public MoonModule, public LightOutput {
         controls_.setAdvanced(controls_.count() - 1);   // wiring an installer sets once
         controls_.addControl("brightness", brightness, 0, 255);
         // ONE picker for both kinds, so a `.mlp` is chosen exactly like a built-in; setup scans the folders and a file change rescans, never a brightness change.
-        if (!livePalettesScanned_) refreshLivePalettes();
+        if (!live_.scanned) refreshLivePalettes();
         // Published here too, so a saved palette name resolves when the file is applied, before setup.
-        LivePalettes::set(livePtrs_, liveTags_, liveCount_, livePresent_);
+        LivePalettes::set(live_.ptrs, live_.tags, live_.count, live_.present);
         // Sized from THIS instance's scan: defineControls also runs before prepare has published.
         controls_.addPalette("palette", palette, mm::paletteOptions,
-                             static_cast<uint8_t>(liveCount_ + mm::palettes::kCount));
+                             static_cast<uint8_t>(live_.count + mm::palettes::kCount));
         controls_.setPersistLabel(controls_.count() - 1);   // saved by name, which survives a script added before it
         // An EDITOR, not a second selector: `palette` owns the choice, so the two cannot disagree.
         controls_.addFilePath("paletteScript", paletteScript_, sizeof(paletteScript_),
@@ -479,7 +476,7 @@ class Drivers : public MoonModule, public LightOutput {
     void setup() override {
         // The filesystem module mounts first, so this scan is the one that sees every script; from here a file change rescans.
         refreshLivePalettes();
-        LivePalettes::set(livePtrs_, liveTags_, liveCount_, livePresent_);
+        LivePalettes::set(live_.ptrs, live_.tags, live_.count, live_.present);
         // The saved choice starts as picking it does, a script palette compiled, since at boot nothing reacts to the value.
         onControlChanged("palette");
         dark_ = MoonModule::safeMode();
@@ -497,11 +494,11 @@ class Drivers : public MoonModule, public LightOutput {
     /// Size the composition buffer, engage or drop the core-1 split, publish the summary.
     void prepare() override {
         // A rescan here picks up a script written since the last one.
-        const uint8_t hadLive = liveCount_;
+        const uint8_t hadLive = live_.count;
         refreshLivePalettes();
-        LivePalettes::set(livePtrs_, liveTags_, liveCount_, livePresent_);
+        LivePalettes::set(live_.ptrs, live_.tags, live_.count, live_.present);
         // A CHANGED count needs the control rebuilt: `palette`'s maximum is baked at define time.
-        if (liveCount_ != hadLive) rebuildControls();
+        if (live_.count != hadLive) rebuildControls();
         // The top-level Effects, found by type when nothing injected a source, so a tree built from a document needs no wiring.
         if (!effects_ && !layer_)
             if (Scheduler* s = Scheduler::instance()) effects_ = static_cast<Effects*>(s->topOfType("Effects"));
@@ -555,6 +552,12 @@ class Drivers : public MoonModule, public LightOutput {
         seat_.claim();         // first live Drivers wins (claim-if-empty; one exists in practice)
         outputSeat_.claim();   // and is the light output core reads
         passBufferToDrivers();
+        preparedShape_ = sourceShape();
+    }
+
+    /// Prepare again when a rebuild of one layer changed what this container sized from; a rebuild of the tree already did.
+    void onTreePrepared() override {
+        if (effectivelyEnabled() && sourceShape() != preparedShape_) applyState();
     }
 
     /// Composite the layers into the output buffer, then hand it to the drivers, on the encode core when the render is split.
@@ -583,17 +586,19 @@ class Drivers : public MoonModule, public LightOutput {
         }
     }
 
+    /// Blend one layer into the shared output: the bottom one overwrites, each above per its own mode and opacity, and an invisible one is skipped.
+    void blendLayer(const Layer& L, bool first) {
+        if (!first && !L.contributes()) return;
+        blendMap(L.buffer(), outputBuffer_, L.lut(), L.channelsPerLight(),
+                 first ? BlendOp::Overwrite : L.blendOp(), first ? uint8_t{255} : L.opacity, /*clearFirst=*/first);
+    }
+
     /// Fill the shared output from the layers: blended when several, a wiring-order frame as it is, else the one layer mapped. @xref{the-shared-output-buffer}
     void composite(Layer* srcLayer, EffectBase* wired) MM_NONBLOCKING {
         if (!outputBuffer_.data()) return;   // the drivers read the layer's buffer directly
         if (effects_ && effects_->enabledLayerCount() > 1) {
             // The bottom layer overwrites; each one above blends per its own mode and opacity.
-            effects_->forEachEnabledLayer([&](Layer* L, bool first) {
-                BlendOp op = first ? BlendOp::Overwrite : L->blendOp();
-                uint8_t op_opacity = first ? 255 : L->opacity;
-                blendMap(L->buffer(), outputBuffer_, L->lut(), L->channelsPerLight(),
-                         op, op_opacity, /*clearFirst=*/first);
-            });
+            effects_->forEachEnabledLayer([&](Layer* L, bool first) { blendLayer(*L, first); });
             return;
         }
         if (wired) {
@@ -698,8 +703,8 @@ class Drivers : public MoonModule, public LightOutput {
         if (!renderSplitActive_ || encodeTask_.impl) return;
         encodeStop_.store(false, std::memory_order_release);
         encodeDone_.store(true, std::memory_order_release);
-        // 8 KB: drivers own their DMA buffers, so the task stack stays light.
-        if (!platform::spawnPinnedTask(encodeTask_, "mmEncode", &encodeTrampoline, this, 8192, 5, 1))
+        // 5 KB: drivers own their DMA buffers and a network driver sends from its own task, so the encode loops stay light, measured at 1 to 1.4 KB.
+        if (!platform::spawnPinnedTask(encodeTask_, "mmEncode", &encodeTrampoline, this, 5120, 5, 1))
             renderSplitActive_ = false;   // couldn't create the task → inline path
     }
     /// Stop and join the core-1 task, draining its encode before any buffer it reads is freed.
@@ -709,6 +714,30 @@ class Drivers : public MoonModule, public LightOutput {
         platform::stopPinnedTask(encodeTask_);   // signals + wakes + joins (worker exits its loop)
     }
 
+    /// What prepare() decides the output buffer and the drivers' windows from: the first layer, how many layers composite, and that layer's size and mapping.
+    struct SourceShape {
+        const Layer* out = nullptr;
+        uint8_t layers = 0;
+        bool mapped = false;
+        nrOfLightsType lights = 0;
+        nrOfLightsType count = 0;
+        uint8_t channels = 0;
+        bool operator==(const SourceShape&) const = default;
+    };
+    SourceShape preparedShape_;
+    SourceShape sourceShape() const {
+        SourceShape s;
+        s.out = effects_ ? effects_->firstEnabledLayer() : layer_;
+        s.layers = effects_ ? effects_->enabledLayerCount() : (layer_ ? 1 : 0);
+        if (s.out) {
+            s.mapped = s.out->lut().hasLUT();
+            s.lights = s.out->physicalLightCount();
+            s.count = outputBuffer_.data() ? 0 : s.out->buffer().count();   // the drivers size from it only when they read it directly
+            s.channels = s.out->channelsPerLight();
+        }
+        return s;
+    }
+
     void passBufferToDrivers() {
         // Keyed off the buffer prepare() allocated, so ONE decision rather than two that disagree.
         Layer* const out = effects_ ? effects_->firstEnabledLayer() : layer_;
diff --git a/src/light/drivers/I80Peripheral.h b/src/light/drivers/I80Peripheral.h
index 74168ee28..51381c80b 100644
--- a/src/light/drivers/I80Peripheral.h
+++ b/src/light/drivers/I80Peripheral.h
@@ -23,13 +23,6 @@ namespace mm {
 /// Both silicon paths do whole-frame chained DMA. So the classic I2S path is WiFi-underrun-immune by construction, and needs none of the ISR-refilled ring the lineage requires.
 class I80Peripheral : public LedPeripheral {
 public:
-    // Unset until the user sets them; the S3 N16R8 bench is pins "1,2,4,5,6,7,8,9", rx 12.
-
-    /// The i80 bus's write strobe, the pixel clock the peripheral mandates; in shift mode it is also the '595's shift clock, so it is wired to the expander. See the driver page.
-    int8_t clockPin = platform::i2sLanes > 0 ? -1 : 10;
-    /// The i80 bus's data/command select; unused by WS2812 but mandated by the peripheral.
-    int8_t dcPin    = platform::i2sLanes > 0 ? 33 : 11;
-
     // --- LedPeripheral descriptors ---
 
     /// The number of i80 lanes this chip provides, 0 meaning no i80 bus here; the two backends are mutually exclusive per chip, so the sum picks whichever exists.
@@ -72,13 +65,13 @@ class I80Peripheral : public LedPeripheral {
 
     /// The GPIO spare lanes park on, overriding the interface default: the "ghost pin" WR, which is already driven and already wired.
     uint16_t clockPinForBus() const override {
-        return clockPin < 0 ? platform::kBusPinUnset : static_cast<uint16_t>(clockPin);
+        return owner_->clockPin < 0 ? platform::kBusPinUnset : static_cast<uint16_t>(owner_->clockPin);
     }
 
     /// Bind the sacrificial WR (clockPin) and DC pins the i80 peripheral mandates.
     void addBusControls(ControlList& controls) override {
-        controls.addPin("clockPin", clockPin);
-        controls.addPin("dcPin", dcPin);   // never unset: esp_lcd toggles DC in software every transfer, and that aborts on a bare pad
+        controls.addPin("clockPin", owner_->clockPin);
+        controls.addPin("dcPin", owner_->dcPin);   // never unset: esp_lcd toggles DC in software every transfer, and that aborts on a bare pad
     }
     /// Whether changing `name` needs the bus rebuilt: clockPin and dcPin do.
     bool busControlTriggersBuild(const char* name) const override {
@@ -88,29 +81,29 @@ class I80Peripheral : public LedPeripheral {
     /// Why the bus pins are fatally wrong, or null when they are usable. It is the error path, not validateBusPins' warnings, as a broken bus is not a warn-and-run.
     const char* validateBusFatal() const override {
         // An unguarded -1 becomes 65535 in busInit's cast and slips IDF's own `>= 0` test.
-        if (platform::i2sLanes == 0 && clockPin < 0)
+        if (platform::i2sLanes == 0 && owner_->clockPin < 0)
             return "clockPin (WR) is unset - the i80 bus needs a write-strobe GPIO on this chip";
-        if (dcPin < 0) return "dcPin (DC) is unset - the i80 bus toggles it every frame, so it needs a real GPIO";
-        if (clockPin >= 0 && clockPin == dcPin)
+        if (owner_->dcPin < 0) return "dcPin (DC) is unset - the i80 bus toggles it every frame, so it needs a real GPIO";
+        if (owner_->clockPin >= 0 && owner_->clockPin == owner_->dcPin)
             return "clockPin (WR) and dcPin (DC) are the same GPIO - they must differ";
         // The lane sweep misses WR and DC, so the pair is refused here, in the platform's words.
-        if (clockPin >= 0) {
-            if (const char* why = platform::gpioRefusal(static_cast<uint8_t>(clockPin))) {
+        if (owner_->clockPin >= 0) {
+            if (const char* why = platform::gpioRefusal(static_cast<uint8_t>(owner_->clockPin))) {
                 std::snprintf(refusal_, sizeof(refusal_), "clockPin (WR) %s - pick another pin", why);
                 return refusal_;
             }
         }
-        if (dcPin >= 0) {
-            if (const char* why = platform::gpioRefusal(static_cast<uint8_t>(dcPin))) {
+        if (owner_->dcPin >= 0) {
+            if (const char* why = platform::gpioRefusal(static_cast<uint8_t>(owner_->dcPin))) {
                 std::snprintf(refusal_, sizeof(refusal_), "dcPin (DC) %s - pick another pin", why);
                 return refusal_;
             }
         }
         // The latch is a BUS LANE and needs its own GPIO: sharing WR latches every shift cycle.
         if (owner_->pinExpanderMode() && owner_->latchPin >= 0) {
-            if (owner_->latchPin == clockPin)
+            if (owner_->latchPin == owner_->clockPin)
                 return "latchPin is on clockPin (WR) - the latch needs its own GPIO";
-            if (owner_->latchPin == dcPin)
+            if (owner_->latchPin == owner_->dcPin)
                 return "latchPin is on dcPin (DC) - the latch needs its own GPIO";
         }
         return nullptr;
@@ -120,9 +113,9 @@ class I80Peripheral : public LedPeripheral {
     const char* validateBusPins(const uint16_t* lanes, uint8_t n) const override {
         for (uint8_t i = 0; i < n; i++) {
             // clockPin/dcPin are int8_t (-1 = unset); only a real GPIO can collide.
-            if (clockPin >= 0 && lanes[i] == static_cast<uint16_t>(clockPin))
+            if (owner_->clockPin >= 0 && lanes[i] == static_cast<uint16_t>(owner_->clockPin))
                 return "a LED pin is on clockPin (WR): that lane carries the clock, not pixels";
-            if (dcPin >= 0 && lanes[i] == static_cast<uint16_t>(dcPin))
+            if (owner_->dcPin >= 0 && lanes[i] == static_cast<uint16_t>(owner_->dcPin))
                 return "a LED pin is on dcPin: that lane carries DC, not pixels";
         }
         return nullptr;
@@ -135,7 +128,7 @@ class I80Peripheral : public LedPeripheral {
     bool busInit(size_t frameBytes, bool wantSecondBuffer) override {
         return platform::i80Ws2812Init(i80_, owner_->busPinList(), owner_->busPinCount(),
                                        clockPinForBus(),
-                                       dcPin < 0 ? platform::kBusPinUnset : static_cast<uint16_t>(dcPin),
+                                       owner_->dcPin < 0 ? platform::kBusPinUnset : static_cast<uint16_t>(owner_->dcPin),
                                        frameBytes, wantSecondBuffer, owner_->busClockMultiplier());
     }
     /// DMA buffer `i` (0 or 1) the orchestrator encodes into; buffer 1 is null in single-buffer mode, and both are busCapacity bytes.
@@ -156,18 +149,18 @@ class I80Peripheral : public LedPeripheral {
                                             size_t dataBytes, uint8_t rowBits) override {
         // Built from the same pin list and pclk, so the test transmits what the render loop does.
         return platform::i80Ws2812Loopback(owner_->busPinList(), owner_->busPinCount(),
-                                           static_cast<uint16_t>(clockPin),
-                                           static_cast<uint16_t>(dcPin),
+                                           static_cast<uint16_t>(owner_->clockPin),
+                                           static_cast<uint16_t>(owner_->dcPin),
                                            static_cast<uint16_t>(owner_->loopbackRxPin),
                                            frame, frameBytes, dataBytes, rowBits,
                                            owner_->busClockMultiplier());
     }
 
     /// Store WR and DC alongside the data pins, so editing either rebuilds the bus.
-    void recordBusPins() override { lastClockPin_ = clockPin; lastDcPin_ = dcPin; }
+    void recordBusPins() override { lastClockPin_ = owner_->clockPin; lastDcPin_ = owner_->dcPin; }
     /// Whether the live bus's WR and DC pins still match the controls, so a rebuild can be skipped.
     bool extraBusPinsCurrent() const override {
-        return lastClockPin_ == clockPin && lastDcPin_ == dcPin;
+        return lastClockPin_ == owner_->clockPin && lastDcPin_ == owner_->dcPin;
     }
 
 private:
diff --git a/src/light/drivers/LedPeripheral.h b/src/light/drivers/LedPeripheral.h
index 4097eba69..e9054ca0a 100644
--- a/src/light/drivers/LedPeripheral.h
+++ b/src/light/drivers/LedPeripheral.h
@@ -73,16 +73,16 @@ class LedPeripheral {
     virtual bool busTransmitRing() { return false; }
     /// Is the live bus a streaming ring?
     virtual bool busIsRing() const MM_NONBLOCKING { return false; }
+    /// Can this backend stream a ring, so the driver shows the ring's settings? Default: no.
+    virtual bool supportsRing() const { return false; }
     /// Should reinit build a ring for the current config instead of the whole-frame path?
     virtual bool wantsRing() const { return false; }
     /// The ring's active-mode label for the status line, or nullptr for the whole-frame path.
     virtual const char* busRingMode() const { return nullptr; }
-    /// Append this peripheral's ring controls into the shared list. Default: none.
+    /// Append this peripheral's ring instrument into the shared list; the ring's settings are the driver's. Default: none.
     virtual void addRingControls(ControlList& /*controls*/) {}
     /// Refresh any peripheral-specific read-only KPIs (the ring diagnostic). Default: none.
     virtual void refreshBusKpi() {}
-    /// Is the core-0 fork-join snapshot helper up (dual-core prime)? Default: no helper.
-    virtual bool snapHelperReady() const { return false; }
 
     /// Append this peripheral's own bus-pin controls into the shared list.
     virtual void addBusControls(ControlList& /*controls*/) {}
diff --git a/src/light/drivers/MoonI80Peripheral.h b/src/light/drivers/MoonI80Peripheral.h
index faca5e092..a76740dfe 100644
--- a/src/light/drivers/MoonI80Peripheral.h
+++ b/src/light/drivers/MoonI80Peripheral.h
@@ -3,7 +3,6 @@
 #include "light/drivers/ParallelLedDriver.h"   // shared driver body + LedPeripheral
 #include "platform/platform.h"
 
-#include <atomic>   // the parallel-snapshot helper join flags
 
 namespace mm {
 
@@ -26,33 +25,11 @@ namespace mm {
 /// The whole-frame path runs free once armed; the ring carries a deadline. Its refill runs from the end-of-buffer interrupt and must beat the wire at 28.8 µs per light at 20 MHz, which is why `useRing` is a switch.
 ///
 /// @card MoonI80Peripheral.png
-class MoonI80Peripheral : public LedPeripheral {
+class MoonI80Peripheral : public LedPeripheral, public platform::InternalRamObject {   // the refill interrupt reads it, so internal RAM, as ParallelLedDriver
 public:
-    // Pins default to UNSET: they are user-soldered, so a default would be a guess.
-
-    /// WR, the pixel clock, needed only by a 74HCT595 expander and unrouted otherwise.
-    int8_t clockPin = 10;
-
-    /// Stream the frame as a ring of small internal buffers, or send it whole from one block.
-    bool useRing = true;
-
-    /// Derive the ring geometry and write it into the controls, so the user sees real numbers.
-    bool ringAuto = true;
-
-    /// Lights per DMA buffer: the ring's grain, and the RAM against interrupt-rate lever.
-    uint8_t ringRows = platform::kRingRowsDefault;
-
-    /// How many buffers the DMA circulates; more depth costs more internal DMA RAM.
-    uint8_t ringBufs = platform::kRingBufsDefault;
-
-    /// Inter-buffer zero-pad in µs, buying refill deadline at a linear frame-time cost.
-    uint8_t ringPadUs = 0;
-
-    /// Overclock the '595 shift clock from 20 MHz to 26.67 MHz, for short-wired rigs; turn it off if any panel scrambles.
-    bool shiftOverclock = false;
-
-    /// Backing store for the read-only `ringDbg` control, the ring's one-line instrument.
-    char ringDbgStr_[176] = "—";
+    /// The ring's live counters, once a second; `ab` counts lost frames, 0 on a healthy ring.
+    char ringDbgStr_[192] = "—";
+    bool shortOfLead_ = false;   ///< ringAuto stopped at the internal floor before the lead the ring needs
 
     // --- LedPeripheral descriptors ---
 
@@ -73,41 +50,41 @@ class MoonI80Peripheral : public LedPeripheral {
     bool supportsDoubleBuffer() const override { return false; }
 
     /// The GPIO the orchestrator pads spare bus lanes with, which only shift mode routes.
-    uint16_t clockPinForBus() const override { return static_cast<uint16_t>(clockPin); }
+    uint16_t clockPinForBus() const override { return static_cast<uint16_t>(owner_->clockPin); }
     /// A spare lane needs no pad: this backend routes only the GPIOs it is handed.
     bool spareLanesNeedPad() const override { return false; }
 
     /// Bind the bus controls; WR is bound always but shown only in expander mode.
     void addBusControls(ControlList& controls) override {
-        controls.addPin("clockPin", clockPin);
+        controls.addPin("clockPin", owner_->clockPin);
         controls.setHidden(controls.count() - 1, !owner_->pinExpanderMode());
     }
 
-    /// Bind the output path, the ring's geometry and its instrument, in a separate hook so clockPin and latchPin stay together as one wiring pair in the UI.
+    /// What ringAuto picks: rows per buffer, buffers, and whether the floor cut the lead short.
+    struct RingDepth { uint8_t rows; uint8_t bufs; bool shortOfLead; };
+    /// The depth the measured lead needs, no more than one buffer per slice, and never past the internal floor WiFi and HTTP need.
+    static RingDepth autoDepth(size_t rowBytes, uint32_t totalRows, size_t freeInternal) {
+        if (rowBytes == 0) rowBytes = 1;   // no row to size by: the depth falls to its limits rather than dividing by zero
+        const uint32_t maxRows = static_cast<uint32_t>(platform::kRingNodeMaxBytes / rowBytes);
+        const uint8_t rows = static_cast<uint8_t>(maxRows < platform::kRingAutoRows ? (maxRows ? maxRows : 1) : platform::kRingAutoRows);
+        const uint32_t slices = (totalRows + rows - 1u) / rows;
+        const size_t bufBytes = static_cast<size_t>(rows) * rowBytes;
+        // The lead counts only past the buffers the refill keeps clear and the slice it is writing.
+        uint32_t bufs = (platform::kRingLeadRows + rows - 1u) / rows + platform::kRingRefillGap + 1u;
+        if (bufs > slices + 1u) bufs = slices + 1u;   // a buffer per slice and one spare: nothing races the wire
+        if (bufs > platform::kRingBufsMax) bufs = platform::kRingBufsMax;
+        const size_t budget = freeInternal > platform::kInternalFreeFloor ? freeInternal - platform::kInternalFreeFloor : 0;
+        const uint32_t byRam = static_cast<uint32_t>(budget / bufBytes);
+        const bool shortOfLead = bufs > byRam;
+        if (shortOfLead) bufs = byRam;
+        return {rows, static_cast<uint8_t>(bufs >= platform::kRingBufsMin ? bufs : platform::kRingBufsMin), shortOfLead};
+    }
+
+    /// This backend streams the ring, so the driver shows the ring's settings.
+    bool supportsRing() const override { return true; }
+
+    /// Bind the ring's instrument below the driver's ring settings.
     void addRingControls(ControlList& controls) override {
-        // Placed below the wiring pair it belongs to; the fix for '595 corruption is OFF.
-        controls.addControl("shiftOverclock", shiftOverclock);
-        controls.setHidden(controls.count() - 1, !owner_->pinExpanderMode());
-        controls.setAdvanced(controls.count() - 1);   // a '595 clock tuning knob: expert only
-        // This picks the PATH; ringSnapshot tunes how the ring reads its source. They compose. Whole-frame stays as the A/B reference, not a fallback the ring degrades into.
-        controls.addControl("useRing", useRing);
-        controls.setHidden(controls.count() - 1, !owner_->pinExpanderMode());
-        // Lives on the orchestrator; the control binds it here through the reference accessor.
-        controls.addControl("ringSnapshot", owner_->ringSnapshotRef());
-        controls.setHidden(controls.count() - 1, !wantsRing());
-        // Gating on wantsRing() is safe: it reads plain members, so it resolves before boot wiring.
-        controls.addControl("ringAuto", ringAuto);
-        controls.setHidden(controls.count() - 1, !wantsRing());
-        // Dev tuning: ringAuto derives these for the end user, so the manual knobs are expert-only.
-        controls.addControl("ringRows", ringRows, 1, 64);
-        controls.setHidden(controls.count() - 1, !wantsRing());
-        controls.setAdvanced(controls.count() - 1);
-        controls.addControl("ringBufs", ringBufs, platform::kRingBufsMin, platform::kRingBufsMax);   // depth buys jitter absorption, so only the average refill must beat the slice deadline
-        controls.setHidden(controls.count() - 1, !wantsRing());
-        controls.setAdvanced(controls.count() - 1);
-        controls.addControl("ringPadUs", ringPadUs, 0, platform::kRingPadMaxUs);
-        controls.setHidden(controls.count() - 1, !wantsRing());
-        controls.setAdvanced(controls.count() - 1);
         // Diagnosable by polling /api/state, which is more reliable than scraping serial.
         controls.addReadOnly("ringDbg", ringDbgStr_, sizeof(ringDbgStr_));
         controls.setHidden(controls.count() - 1, !wantsRing());
@@ -132,7 +109,7 @@ class MoonI80Peripheral : public LedPeripheral {
             ? (platform::ptrIsPsram(snap) ? 'P' : 'I') : '-';
         const char liveWhere = (src && src->data())
             ? (platform::ptrIsPsram(src->data()) ? 'P' : 'I') : '-';
-        std::snprintf(ringDbgStr_, sizeof(ringDbgStr_), "sn%c lv%c sl%u/bf%u co%u cr%u ab%u dn%u ld%u lt%u tx%u ipb%u ci%u tn%d de%u enc%u ea%u sg%u se%u tw%u ts%u tp%u gap%u",
+        std::snprintf(ringDbgStr_, sizeof(ringDbgStr_), "sn%c lv%c sl%u/bf%u co%u cr%u ab%u dn%u ld%u lt%u tx%u ipb%u ci%u tn%d de%u enc%u ea%u sg%u se%u tw%u ts%u tp%u gap%u@%u ml%d c%u",
                       snapWhere, liveWhere,
                       static_cast<unsigned>(s.nSlices), static_cast<unsigned>(s.ringBufs),
                       static_cast<unsigned>(s.cacheOffDefers), static_cast<unsigned>(s.cacheOffMaxRun),
@@ -148,8 +125,9 @@ class MoonI80Peripheral : public LedPeripheral {
                       static_cast<unsigned>(ParallelLedDriver::dbgTickWaitUs),   // wire-wait µs
                       static_cast<unsigned>(ParallelLedDriver::dbgTickSnapUs),   // snapshot µs
                       static_cast<unsigned>(ParallelLedDriver::dbgTickPrimeUs),  // prime µs
-                      static_cast<unsigned>(s.maxIsrGapUs));
-                      // The field legend is on the drivers page; `lt` is the one to watch.
+                      static_cast<unsigned>(s.maxIsrGapUs), static_cast<unsigned>(s.maxGapAtSlice),
+                      static_cast<int>(s.minLead), static_cast<unsigned>(s.isrCore));
+                      // The field legend is on the LED drivers page.
     }
     /// Which controls need the bus rebuilt rather than re-encoded when they change.
     bool busControlTriggersBuild(const char* name) const override {
@@ -167,8 +145,8 @@ class MoonI80Peripheral : public LedPeripheral {
     const char* validateBusFatal() const override {
         if (owner_->pinExpanderMode()) {
             // Unset would route WR to GPIO 65535, so reject it before busInit reaches the pad.
-            if (clockPin < 0) return "the 74HCT595 expander needs a clockPin (its shift clock)";
-            if (owner_->latchPin >= 0 && owner_->latchPin == clockPin)
+            if (owner_->clockPin < 0) return "the 74HCT595 expander needs a clockPin (its shift clock)";
+            if (owner_->latchPin >= 0 && owner_->latchPin == owner_->clockPin)
                 return "latchPin is on clockPin (WR) — the latch needs its own GPIO";
         }
         return nullptr;
@@ -177,20 +155,20 @@ class MoonI80Peripheral : public LedPeripheral {
     const char* validateBusPins(const uint16_t* lanes, uint8_t n) const override {
         if (!owner_->pinExpanderMode()) return nullptr;
         for (uint8_t i = 0; i < n; i++)
-            if (lanes[i] == static_cast<uint16_t>(clockPin)) return "a data pin is on clockPin (WR)";
+            if (lanes[i] == static_cast<uint16_t>(owner_->clockPin)) return "a data pin is on clockPin (WR)";
         return nullptr;
     }
 
     /// Create the bus and its DMA buffers, scaling the pixel clock to the slot's shift width.
     bool busInit(size_t frameBytes, bool /*wantSecondBuffer*/) override {
-        platform::moonI80SetShiftClockDiv(shiftOverclock ? 3 : 4);   // ON = 26.67 MHz, OFF = 20 MHz
+        platform::moonI80SetShiftClockDiv(owner_->shiftOverclock ? 3 : 4);   // ON = 26.67 MHz, OFF = 20 MHz
         // Forced single-buffer here too, so a caller that forgets the gate cannot reach the race.
         return platform::moonI80Ws2812Init(bus_, owner_->busPinList(), owner_->busPinCount(),
-                                           static_cast<uint16_t>(clockPin), frameBytes,
+                                           static_cast<uint16_t>(owner_->clockPin), frameBytes,
                                            /*wantSecondBuffer=*/false, owner_->busClockMultiplier());
     }
-    /// Tear the bus down, stopping this backend's own snapshot helper before it goes away.
-    void busDeinit() override { stopSnapHelper(); platform::moonI80Ws2812Deinit(bus_); }
+    /// Tear the bus down.
+    void busDeinit() override { platform::moonI80Ws2812Deinit(bus_); }
     /// The DMA buffer the encoder writes slice `i` into.
     uint8_t* busBuffer(uint8_t i) override { return platform::moonI80Ws2812Buffer(bus_, i); }
     /// How many bytes one DMA buffer holds.
@@ -206,63 +184,42 @@ class MoonI80Peripheral : public LedPeripheral {
     platform::RmtLoopbackResult busLoopback(const uint8_t* frame, size_t frameBytes,
                                             size_t dataBytes, uint8_t rowBits) override {
         return platform::moonI80Ws2812Loopback(owner_->busPinList(), owner_->busPinCount(),
-                                               static_cast<uint16_t>(clockPin),
+                                               static_cast<uint16_t>(owner_->clockPin),
                                                static_cast<uint16_t>(owner_->loopbackRxPin),
                                                frame, frameBytes, dataBytes, rowBits,
                                                owner_->busClockMultiplier(),
-                                               ringRows, ringBufs, useRing);
+                                               owner_->ringRows, owner_->ringBufs, owner_->useRing);
     }
 
     /// Whether reinit should build a ring for this config rather than the whole-frame path. A silent fallback would hide the active path, so the switch says what runs.
     bool wantsRing() const override {
         if (!owner_->pinExpanderMode()) return false;   // direct mode never rings (drives PSRAM fine)
-        return useRing;
+        return owner_->useRing;
     }
 
     /// Bring the bus up as a streaming ring, so a frame too big for internal RAM never forms.
     bool busInitRing(size_t rowBytes, uint32_t totalRows) override {
-        // The RAM budget takes free internal MINUS a reserve, since WiFi and HTTP need their share.
-        if (ringAuto && rowBytes > 0) {
-            const uint32_t maxRows = static_cast<uint32_t>(platform::kRingNodeMaxBytes / rowBytes);
-            ringRows = static_cast<uint8_t>(maxRows > 64 ? 64 : (maxRows ? maxRows : 1));
-            const uint32_t slices = (totalRows + ringRows - 1u) / ringRows;
-            const size_t bufBytes = static_cast<size_t>(ringRows) * rowBytes;
-            const size_t freeInt = platform::freeInternalHeap();
-            constexpr size_t kReserve = 64 * 1024;   // leave WiFi/HTTP/stacks their internal share
-            // A deep pool is the whole win: each buffer removes one slice from the ISR's load.
-            const size_t budget = freeInt > kReserve ? (freeInt - kReserve) : 0;
-            const uint32_t byRam = bufBytes ? static_cast<uint32_t>(budget / bufBytes) : 0;
-            uint32_t bufs = slices + 1u;             // prime-only when it fits: the ideal
-            if (bufs > platform::kRingBufsMax) bufs = platform::kRingBufsMax;
-            if (bufs > byRam) bufs = byRam;
-            ringBufs = static_cast<uint8_t>(bufs >= platform::kRingBufsMin ? bufs : platform::kRingBufsMin);
+        shortOfLead_ = false;
+        if (owner_->ringAuto && rowBytes > 0) {
+            const RingDepth d = autoDepth(rowBytes, totalRows, platform::freeInternalHeap());
+            owner_->ringRows = d.rows;
+            owner_->ringBufs = d.bufs;
+            shortOfLead_ = d.shortOfLead;
         }
-        platform::moonI80SetShiftClockDiv(shiftOverclock ? 3 : 4);   // ON = 26.67 MHz, OFF = 20 MHz
+        platform::moonI80SetShiftClockDiv(owner_->shiftOverclock ? 3 : 4);   // ON = 26.67 MHz, OFF = 20 MHz
         const bool ok = platform::moonI80Ws2812InitRing(bus_, owner_->busPinList(), owner_->busPinCount(),
-                                               static_cast<uint16_t>(clockPin), rowBytes, totalRows,
-                                               ringRows, ringBufs, ringPadUs, owner_->busClockMultiplier(),
+                                               static_cast<uint16_t>(owner_->clockPin), rowBytes, totalRows,
+                                               owner_->ringRows, owner_->ringBufs, owner_->ringPadUs, owner_->busClockMultiplier(),
                                                &MoonI80Peripheral::ringEncodeTrampoline, this);
-        // Spawned here on the cold path, so kick and join only ever notify.
-        if (ok) ensureSnapHelper();
         return ok;
     }
-    /// Send one frame: prime the pool, fire the DMA, let the end-of-buffer ISR refill behind it. The ring buffers are independent, so the prime fork-joins across both cores when the split runs.
-    bool busTransmitRing() override {
-        if (snapHelperReady() && ringBufs >= 2) {
-            // Each prime waits out the previous wire end, so neither half repaints a draining buffer.
-            const uint8_t half = static_cast<uint8_t>(ringBufs / 2);
-            primeLo_ = 0; primeHi_ = half;
-            helperKick();                                             // core 0: buffers [0, half)
-            platform::moonI80Ws2812PrimeRange(bus_, half, ringBufs);   // this core: [half, ringBufs)
-            helperJoin();                                              // fence: every buffer primed
-            return platform::moonI80Ws2812ArmRing(bus_);
-        }
-        return platform::moonI80Ws2812TransmitRing(bus_);
-    }
+    /// Send one frame: prime the pool, fire the DMA, let the end-of-buffer ISR refill behind it. The prime runs on this core alone: a helper priming half on core 0 preempted the effects there and cost 12 fps.
+    bool busTransmitRing() override { return platform::moonI80Ws2812TransmitRing(bus_); }
     /// The ring's regime for the status suffix: primed before arming, or lapping behind the DMA.
     const char* busRingMode() const override {
         const platform::MoonI80RingStats s = platform::moonI80Ws2812RingStats(bus_);
         if (!s.isRing) return nullptr;
+        if (shortOfLead_) return "lapping, short of RAM: frames may glitch";
         return s.nSlices <= s.ringBufs ? "primed" : "lapping";
     }
     /// Whether the bus came up as a ring, reporting what the platform built rather than asked.
@@ -282,8 +239,8 @@ class MoonI80Peripheral : public LedPeripheral {
             return;
         }
         // A per-refill prefill was ~1/3 of the ISR cost, so it runs only when the constants are gone.
-        const bool prefill = owner->pinExpanderMode() && (needsPrefill || !owner->uniformLaneCounts());
-        if (owner->slotBytes() == 1) {
+        const bool prefill = owner->hot_.shift && (needsPrefill || !owner->uniformLaneCounts());
+        if (owner->hot_.slotBytes == 1) {
             if (prefill) owner->prefillShiftRows<uint8_t>(outCh, dst, first, count);
             owner->encodeRows<uint8_t>(outCh, dst, first, count, closeFrame);
         } else {
@@ -293,99 +250,11 @@ class MoonI80Peripheral : public LedPeripheral {
     }
 
     /// WR is part of the bus identity, so a change to it rebuilds the bus: not a data-pin edit.
-    void recordBusPins() override { lastClockPin_ = clockPin; }
+    void recordBusPins() override { lastClockPin_ = owner_->clockPin; }
     /// Whether the extra bus pins still match the live bus, WR being bus identity here.
-    bool extraBusPinsCurrent() const override { return lastClockPin_ == clockPin; }
-
-    // The SNAPSHOT is deliberately NOT forked: doing so saturated core 0 and hung the board.
-
-    /// Whether the fork-join should engage: the helper is up and this caller runs on core 1.
-    bool snapHelperReady() const override {
-        return snapHelper_.impl != nullptr && !snapHelperBroken_ && platform::currentCore() == 1;
-    }
-
-
-    /// Publish this frame's prime job and wake the helper; always paired with `helperJoin`.
-    void helperKick() {
-        if (!snapHelper_.impl) return;
-        // Strict ordering keeps the bounds race-free; this park-wait stops a lost or doubled notify.
-        const uint32_t t0 = platform::millis();
-        while (!snapHelperParked_.load(std::memory_order_acquire)) {
-            if (platform::millis() - t0 > kSnapJoinTimeoutMs) { snapHelperBroken_ = true; runHelperJob(); return; }
-            platform::yield();
-        }
-        snapHelperParked_.store(false, std::memory_order_release);   // consume the park; helper re-sets it
-        snapHelperDone_.store(false, std::memory_order_release);
-        platform::notifyTask(snapHelper_);
-    }
-
-    /// Block until the helper's half is primed; the fence that makes the fork-join safe. A timeout latches the helper broken and runs serially, so a wedged worker degrades.
-    void helperJoin() {
-        if (!snapHelper_.impl) return;
-        // A degraded kick already did the work serially, so there is nothing to wait for.
-        if (snapHelperBroken_) return;
-        // A real-time deadline, not a spin count: yield() may return instantly and burn hot.
-        const uint32_t t0 = platform::millis();
-        while (!snapHelperDone_.load(std::memory_order_acquire)) {
-            if (platform::millis() - t0 > kSnapJoinTimeoutMs) {
-                // Self-heal: the jobs are idempotent, so even a late helper write is identical.
-                runHelperJob();
-                snapHelperBroken_ = true;
-                return;
-            }
-            platform::yield();
-        }
-    }
-
-    /// Prime the buffer range the kick published, on the helper or serially as the fallback.
-    void runHelperJob() { platform::moonI80Ws2812PrimeRange(bus_, primeLo_, primeHi_); }
-
-    /// Bring the helper task up on core 0, the ring's tick having core 1 under the split.
-    void ensureSnapHelper() {
-        if (snapHelper_.impl) return;
-        snapHelperBroken_ = false;   // a rebuild gets a fresh chance
-        snapHelperStop_.store(false, std::memory_order_release);
-        // Seeded true, so the first kick does not wait on a park signal the task has yet to emit.
-        snapHelperParked_.store(true, std::memory_order_release);
-        snapHelperDone_.store(true, std::memory_order_release);
-        platform::spawnPinnedTask(snapHelper_, "mmSnap", &MoonI80Peripheral::snapHelperTramp, this,
-                                  4096, 5, /*core=*/0);
-    }
-    /// Tear the helper down, so the worker cannot outlive the bus it primes into.
-    void stopSnapHelper() {
-        if (!snapHelper_.impl) return;
-        snapHelperStop_.store(true, std::memory_order_release);
-        platform::stopPinnedTask(snapHelper_);
-    }
-
-    /// The worker's entry point: park, run the published job, mark done, repeat until stopped.
-    static void snapHelperTramp(void* user) {
-        auto* self = static_cast<MoonI80Peripheral*>(user);
-        while (!self->snapHelperStop_.load(std::memory_order_acquire)) {
-            // Announced BEFORE blocking, closing the window where done is set but the park is not.
-            self->snapHelperParked_.store(true, std::memory_order_release);
-            if (!platform::waitNotify(self->snapHelper_, 100)) continue;   // re-check stop on timeout
-            if (self->snapHelperStop_.load(std::memory_order_acquire)) break;
-            self->runHelperJob();                                           // this core-0 frame's half
-            self->snapHelperDone_.store(true, std::memory_order_release);
-        }
-    }
+    bool extraBusPinsCurrent() const override { return lastClockPin_ == owner_->clockPin; }
 
 private:
-    /// Join deadline for one prime half; at this point the helper is broken rather than slow.
-    static constexpr uint32_t kSnapJoinTimeoutMs = 100;
-    /// The core-0 worker that primes the bottom half of the ring pool.
-    platform::WorkerTask snapHelper_{};
-    /// Stored by the helper when its job is finished; starts true so the first join returns.
-    std::atomic<bool> snapHelperDone_{true};
-    /// Asks the helper to exit its wait loop; set once by `stopSnapHelper` at teardown.
-    std::atomic<bool> snapHelperStop_{false};
-    /// Whether the helper is parked, which the kick waits for before mutating the bounds.
-    std::atomic<bool> snapHelperParked_{true};
-    /// Self-heal latch: one timed-out join disables the helper and the prime runs serial.
-    bool snapHelperBroken_ = false;
-    /// The buffer range [lo, hi) the helper primes this frame: written only between join and kick.
-    uint8_t primeLo_ = 0, primeHi_ = 0;
 
     /// The platform-side bus handle; opaque here, so no LCD_CAM type escapes the platform layer.
     platform::MoonI80Ws2812Handle bus_;
diff --git a/src/light/drivers/NetworkSendDriver.h b/src/light/drivers/NetworkSendDriver.h
index 3ce221fbe..5d12442e1 100644
--- a/src/light/drivers/NetworkSendDriver.h
+++ b/src/light/drivers/NetworkSendDriver.h
@@ -150,6 +150,9 @@ class NetworkSendDriver : public DriverBase {
     /// A task still running would read a destroyed object, so the destructor stops it too.
     ~NetworkSendDriver() override { stopSendTask(); }
 
+    /// How many times the send task was started, so a test can tell a running stream from a restarted one.
+    uint32_t taskStartsForTest() const { return taskStarts_; }
+
     /// Stop the send task and close the socket on release, then chain to the base to clear any status this driver set.
     void release() override {
         stopSendTask();
@@ -166,20 +169,20 @@ class NetworkSendDriver : public DriverBase {
 
     /// Open the socket, resolve the destinations and their window slices, and size the buffer; all parsing happens here, so tick is a bare walk of two small arrays.
     void prepare() override {
-        stopSendTask();          // the task reads the destinations and the corrected buffer, both rebuilt below
         socket_.open();          // idempotent: no-op if already open
-        resizeCorrected();
+        resizeCorrected();       // which waits out a running task only when it reallocates
 
         // Published only once EVERYTHING validates: wrong output is worse than none at all.
         Host dest[kMaxDestinations] = {};
         uint8_t n = 0;
         if (mode() == Addressing::Unicast) {
             const char* err = parseHostList(hosts, dest, kMaxDestinations, n);
-            if (err) { nDest_ = 0; setStatus(err, Severity::Error); return; }
+            if (err) { stopSendTask(); nDest_ = 0; setStatus(err, Severity::Error); return; }
             for (uint8_t d = 0; d < n; d++)
                 if (dest[d].isName()) { HostResolver::ensureStarted(); break; }   // here, where allocating is allowed
             if (n == 0) {
                 // A Warning, not an Error: an unset host is unfinished, not faulty.
+                stopSendTask();
                 nDest_ = 0;
                 setStatus("set a host", Severity::Warning);
                 return;
@@ -194,15 +197,26 @@ class NetworkSendDriver : public DriverBase {
         nrOfLightsType counts[kMaxDestinations] = {};
         const char* warn = nullptr;
         const char* err = assignCounts(mode() == Addressing::Unicast ? lightsPerHost : "", n, winLen, counts, 0, &warn);
-        if (err) { nDest_ = 0; setStatus(err, Severity::Error); return; }
+        if (err) { stopSendTask(); nDest_ = 0; setStatus(err, Severity::Error); return; }
 
-        // Everything validated: publish as one unit.
+        publishDestinations(dest, counts, n);
+        prepareWarn_ = warn;
+        refreshHosts();
+        if (packetGap > 0) startSendTask();   // a no-op while it runs
+        else stopSendTask();
+    }
+
+    /// Publish validated destinations as one unit. The send task reads them, so it stops only when they differ, and a rebuild elsewhere leaves a running stream alone.
+    void publishDestinations(const Host* dest, const nrOfLightsType* counts, uint8_t n) {
+        // By the text and mode they came from, since the resolver fills in a name's address later.
+        if (n == nDest_ && mode() == preparedMode_ && std::strcmp(hosts, preparedHosts_) == 0
+            && std::memcmp(destCounts_, counts, sizeof(nrOfLightsType) * n) == 0) return;
+        stopSendTask();
         std::memcpy(dest_, dest, sizeof(Host) * n);
         std::memcpy(destCounts_, counts, sizeof(nrOfLightsType) * n);
         nDest_ = n;
-        prepareWarn_ = warn;
-        refreshHosts();
-        if (packetGap > 0) startSendTask();
+        preparedMode_ = mode();
+        std::snprintf(preparedHosts_, sizeof(preparedHosts_), "%s", hosts);
     }
 
     /// Re-size the corrected buffer when the fixture profile changes the output channel count.
@@ -349,6 +363,7 @@ class NetworkSendDriver : public DriverBase {
     /// Start the paced send task on core 1, beside the receive task; a board that cannot start it sends from the tick, unpaced.
     void startSendTask() {
         if (sendTask_.impl) return;
+        taskStarts_++;
         sendStop_.store(false, std::memory_order_release);
         frameState_.exchange(kFrameIdle, std::memory_order_acq_rel);
         platform::spawnPinnedTask(sendTask_, "mmSend", &sendTrampoline, this, 4096, 3, 1);
@@ -477,6 +492,9 @@ class NetworkSendDriver : public DriverBase {
         corrected_.allocate(n, ch);
         if (wasSending) startSendTask();
     }
+    uint32_t taskStarts_ = 0;   ///< send-task starts, for taskStartsForTest
+    char preparedHosts_[sizeof(hosts)] = {};      ///< the host text the running destinations came from
+    Addressing preparedMode_ = Addressing::Unicast;   ///< and the addressing
 };
 
 } // namespace mm
diff --git a/src/light/drivers/ParallelLedDriver.h b/src/light/drivers/ParallelLedDriver.h
index 2241f61a6..5d4f41a77 100644
--- a/src/light/drivers/ParallelLedDriver.h
+++ b/src/light/drivers/ParallelLedDriver.h
@@ -8,7 +8,6 @@
 #include "light/drivers/PinList.h"         // parsePinList / assignCounts (shared)
 #include "platform/platform.h"
 
-#include <numeric>  // std::gcd: the snapshot split's cache-line alignment
 
 namespace mm {
 
@@ -38,8 +37,13 @@ namespace mm {
 /// **Loopback:** in shift mode a data GPIO carries the serial stream, so the wire comes from a register output. No continuity check runs, so a mis-wired jumper shows as a bit failure. Intrusive OFF re-allocates the whole ring pool.
 ///
 /// **GPIO-DMA.** A timer ticks every 373 ns and one DMA channel writes the next slot into the GPIO port, widened to 32 bits by the platform. The next frame encodes meanwhile, so `doubleBuffer` has no effect there.
-class ParallelLedDriver : public DriverBase {
+class ParallelLedDriver : public DriverBase, public platform::InternalRamObject {   // the ring's refill interrupt reads it, so internal RAM, unlike other modules
 public:
+    /// Internal RAM, where MoonModule places other modules in PSRAM.
+    using platform::InternalRamObject::operator new;
+    /// Return the allocation above.
+    using platform::InternalRamObject::operator delete;
+
     /// Test-only: borrow a mock backend, dropping any existing one. The caller keeps ownership.
     void setPeripheralForTest(LedPeripheral* p) {
         if (peripheral_ && peripheralOwned_) { peripheral_->busDeinit(); delete peripheral_; }
@@ -99,8 +103,28 @@ class ParallelLedDriver : public DriverBase {
     /// Encode the next frame while this one clocks out, where supported.
     /// @guide Leave it on: a tick costs the longer of encode and wire, not their sum, for one extra DMA buffer and 8 to 20 ms of latency. A board without room falls back to one buffer.
     bool doubleBuffer = true;
-    /// Freeze the source each frame for the ring's off-thread refill.
+    // The peripheral's settings live on the driver, which binds them, so switching the peripheral away and back keeps them.
+
+    /// Copy each frame before the ring sends it, so a frame never mixes with the next.
     bool ringSnapshot = true;
+    /// Stream the frame as a ring of small internal buffers, or send it whole from one block.
+    bool useRing = true;
+
+    /// Size the ring by itself and show the numbers it picked in the controls below.
+    bool ringAuto = true;
+
+    /// Lights per DMA buffer: the ring's grain, and the RAM against interrupt-rate lever.
+    uint8_t ringRows = platform::kRingRowsDefault;
+
+    /// How many buffers the DMA circulates, each `ringRows` rows of internal RAM.
+    uint8_t ringBufs = platform::kRingBufsDefault;
+
+    /// Inter-buffer zero-pad in µs, buying refill deadline at a linear frame-time cost.
+    uint8_t ringPadUs = 0;
+
+    /// Shift the '595 at 26.67 MHz, not 20, for short wires; off if a panel scrambles.
+    bool shiftOverclock = false;
+
     /// TX to RX self-test: send a known pattern, bit-verify the capture.
     bool     loopbackTest = false;
     /// TX pin override for the test; unset uses lane 0.
@@ -118,6 +142,37 @@ class ParallelLedDriver : public DriverBase {
     bool     pinExpander = false;
     /// The 74HCT595 latch (RCLK) pin, needed with the expander.
     int8_t   latchPin = -1;
+    /// The i80 write strobe (WR): the pixel clock, and the expander's shift clock.
+    int8_t   clockPin = platform::i2sLanes > 0 ? -1 : 10;
+    /// The i80 bus's data/command select, which `LCD-IDF` mandates though WS2812 ignores it.
+    int8_t   dcPin    = platform::i2sLanes > 0 ? 33 : 11;
+
+    /// Bind the ring's settings whatever the peripheral, so a fresh driver reports their defaults and a switch keeps them; shown only where the peripheral streams a ring through the expander.
+    void addRingSettings() {
+        const bool canRing = peripheral_ && peripheral_->supportsRing() && pinExpanderMode();
+        const bool ring = peripheral_ && peripheral_->wantsRing();
+        // The fix for '595 corruption is OFF.
+        controls_.addControl("shiftOverclock", shiftOverclock);
+        controls_.setHidden(controls_.count() - 1, !canRing);
+        controls_.setAdvanced(controls_.count() - 1);   // a '595 clock tuning knob: expert only
+        // This picks the path; ringSnapshot tunes how the ring reads its source. Whole-frame stays as the A/B reference, not a fallback the ring degrades into.
+        controls_.addControl("useRing", useRing);
+        controls_.setHidden(controls_.count() - 1, !canRing);
+        controls_.addControl("ringSnapshot", ringSnapshot);
+        controls_.setHidden(controls_.count() - 1, !ring);
+        controls_.addControl("ringAuto", ringAuto);
+        controls_.setHidden(controls_.count() - 1, !ring);
+        // Dev tuning: ringAuto derives these for the end user, so the manual knobs are expert-only.
+        controls_.addControl("ringRows", ringRows, 1, 64);
+        controls_.setHidden(controls_.count() - 1, !ring);
+        controls_.setAdvanced(controls_.count() - 1);
+        controls_.addControl("ringBufs", ringBufs, platform::kRingBufsMin, platform::kRingBufsMax);   // depth buys jitter absorption, so only the average refill must beat the slice deadline
+        controls_.setHidden(controls_.count() - 1, !ring);
+        controls_.setAdvanced(controls_.count() - 1);
+        controls_.addControl("ringPadUs", ringPadUs, 0, platform::kRingPadMaxUs);
+        controls_.setHidden(controls_.count() - 1, !ring);
+        controls_.setAdvanced(controls_.count() - 1);
+    }
 
     /// Is the shift-register expander engaged, after the peripheral's own capability? Gated here rather than by mutating `pinExpander`, so the saved value survives a round trip.
     bool pinExpanderMode() const { return pinExpander && peripheral_ && peripheral_->supportsPinExpander(); }
@@ -145,7 +200,8 @@ class ParallelLedDriver : public DriverBase {
         controls_.setHidden(controls_.count() - 1, !(peripheral_ && peripheral_->supportsPinExpander()));
         controls_.addPin("latchPin", latchPin);
         controls_.setHidden(controls_.count() - 1, !pinExpanderMode());
-        // MoonI80 only, and gated on the expander, so it sits under the switch that governs it.
+        // Under the expander switch that governs them, then the peripheral's ring instrument.
+        addRingSettings();
         if (peripheral_) peripheral_->addRingControls(controls_);
         // A bring-up instrument rather than a casual setting, so the whole cluster is developer-only.
         controls_.addControl("loopbackTest", loopbackTest);
@@ -449,11 +505,19 @@ class ParallelLedDriver : public DriverBase {
         prefillShiftRows<Slot>(outCh, dst, 0, maxLaneLights_);
     }
 
+    /// The geometry the ring's refill interrupt reads, set with the lane geometry. The methods that compute it reach the peripheral's vtable, which sits in flash, and a flash save switches the cache off under the interrupt.
+    struct HotGeometry {
+        bool shift = false;         ///< the '595 expander is in use
+        uint8_t outPerPin = 1;      ///< strands per data pin
+        uint8_t slotBytes = 1;      ///< bytes per bus slot
+    };
+    HotGeometry hot_;   ///< read by the refill interrupt, written by parseConfig
+
     /// Prefill the shift constants for a row range, `rowCount == 0` meaning to the end; written dst-relative, so a ring slice gets the same constants the whole-frame buffer would.
     template <class Slot>
     void MM_RAMFUNC prefillShiftRows(uint8_t outCh, uint8_t* dst, nrOfLightsType firstRow, nrOfLightsType rowCount) {
         auto* out = reinterpret_cast<Slot*>(dst);
-        const size_t slotsPerRow = static_cast<size_t>(outCh) * 8 * 3 * outputsPerPin();
+        const size_t slotsPerRow = static_cast<size_t>(outCh) * 8 * 3 * hot_.outPerPin;
         const nrOfLightsType lastRow = (rowCount == 0 || firstRow + rowCount > maxLaneLights_)
                                            ? maxLaneLights_
                                            : static_cast<nrOfLightsType>(firstRow + rowCount);
@@ -473,7 +537,7 @@ class ParallelLedDriver : public DriverBase {
             if (runEnd <= row) runEnd = lastRow;   // no strand ends ahead in range: one run to lastRow
             const uint32_t rows = static_cast<uint32_t>(runEnd - row);
             // dst-relative: row `firstRow` is at out+0, so offset by (row - firstRow).
-            prefillWs2812ShiftConstants<Slot>(mask, physPins_, latchBit_, outputsPerPin(), outCh, rows,
+            prefillWs2812ShiftConstants<Slot>(mask, physPins_, latchBit_, hot_.outPerPin, outCh, rows,
                                               out + static_cast<size_t>(row - firstRow) * slotsPerRow);
             row = runEnd;
         }
@@ -489,13 +553,14 @@ class ParallelLedDriver : public DriverBase {
                                            : static_cast<nrOfLightsType>(firstRow + rowCount);
         // Correction runs HERE, fused into the gather: the snapshot is a raw copy, not pre-corrected.
         const uint8_t* src = encodeSrc_ ? encodeSrc_ : sourceBuffer_->data();
-        const uint8_t srcCh = sourceBuffer_->channelsPerLight();
+        // On the ring the stride comes from the snapshot, not the source Buffer: the refill interrupt reads nothing that lives in PSRAM, where a module's members do.
+        const uint8_t srcCh = encodeSrc_ ? snapCopyCh_ : sourceBuffer_->channelsPerLight();
         auto* out = reinterpret_cast<Slot*>(dst);
-        // This core's own scratch slice: the prime fork-join runs encodeRows on both cores at once.
+        // This core's own scratch slice: the refill interrupt and the prime encode on different cores.
         uint8_t* const wire = wire_ + static_cast<size_t>(platform::currentCore()) * kMaxStrands * outCh;
         std::memset(wire, 0, static_cast<size_t>(kMaxStrands) * outCh);
         const size_t stride = outCh;
-        const bool shift = pinExpanderMode();
+        const bool shift = hot_.shift;
         // Bench diagnostic: gather-and-mask against transpose-and-emit, via ringDbg's sg/se.
         uint32_t segT0 = platform::cycleCount();
         // 64-bit because the expander drives more strands than the bus is wide.
@@ -514,13 +579,13 @@ class ParallelLedDriver : public DriverBase {
             if (shift) {
                 // DATA WORDS ONLY: the pulse-start and tail are frame constants, prefilled once.
                 const uint32_t segT1 = platform::cycleCount();   // the instrument's split: gather above, transpose below
-                encodeWs2812ShiftData<Slot>(wire, mask, physPins_, latchBit_, outputsPerPin(), outCh, out);
+                encodeWs2812ShiftData<Slot>(wire, mask, physPins_, latchBit_, hot_.outPerPin, outCh, out);
                 const uint32_t segT2 = platform::cycleCount();
                 dbgSegGatherCy += segT1 - segT0;   // memset+mask+gather (since segT0 / previous row's end)
                 dbgSegEmitCy   += segT2 - segT1;   // the transpose+emit
                 dbgSegRows     += 1;
                 segT0 = segT2;                     // next row's gather starts here
-                out += static_cast<size_t>(outCh) * 8 * 3 * outputsPerPin();
+                out += static_cast<size_t>(outCh) * 8 * 3 * hot_.outPerPin;
             } else {
                 encodeWs2812ParallelSlots<Slot>(wire, static_cast<Slot>(mask), outCh, out);
                 out += static_cast<size_t>(outCh) * 8 * 3;   // 3 slots × 8 bits × channels, in Slot elements
@@ -532,8 +597,8 @@ class ParallelLedDriver : public DriverBase {
 
     /// Write only the frame-closing latch word, which presents the register's final slot.
     void MM_RAMFUNC encodeFrameClose(uint8_t* dst) {
-        if (!pinExpanderMode()) return;
-        if (slotBytes() == 1) encodeWs2812ShiftLatchPad<uint8_t>(latchBit_, reinterpret_cast<uint8_t*>(dst));
+        if (!hot_.shift) return;
+        if (hot_.slotBytes == 1) encodeWs2812ShiftLatchPad<uint8_t>(latchBit_, reinterpret_cast<uint8_t*>(dst));
         else                  encodeWs2812ShiftLatchPad<uint16_t>(latchBit_, reinterpret_cast<uint16_t*>(dst));
     }
 
@@ -603,8 +668,6 @@ class ParallelLedDriver : public DriverBase {
     const uint16_t* laneList() const { return laneList_; }
     /// The live output Correction, which a backend's encode and prefill helpers read through.
     const Correction& correction() const { return correction_; }
-    /// Mutable reference to the ring-snapshot knob, for a backend's addRingControls to bind: addControl binds by reference, so it needs the member's address.
-    bool& ringSnapshotRef() { return ringSnapshot; }
     /// The ring snapshot buffer, null off the ring path; a backend's KPI reads its residency.
     const uint8_t* snapshotBuf() const { return snapshotBuf_; }
     /// The wired source buffer (null before setSourceBuffer): same KPI-residency use as snapshotBuf().
@@ -756,11 +819,22 @@ class ParallelLedDriver : public DriverBase {
         const size_t dma = peripheral_ ? peripheral_->busHeapBytes() : 0;
         return DriverBase::driverHeapBytes() + snapshotCap_ + dma;
     }
-    /// The snapshot copy's source, set before copyRange: the snapshot is serial, only the ring prime still forks to the core-0 helper.
+    /// The snapshot copy's source, set before copyRange.
     const uint8_t* snapCopySrc_ = nullptr;
     uint8_t  snapCopyCh_ = 0;             ///< the snapshot copy's channel stride
     const uint8_t* encodeSrc_ = nullptr;  ///< when non-null, encodeRows reads this (bias-corrected) instead of sourceBuffer_
 
+    /// Why the ring cannot run, else null: its refill would read PSRAM. A flash save on the other core switches that cache off mid-refill, a panic, so the ring refuses instead.
+    const char* ringPsramRefusal() const {
+        if (platform::ptrIsPsram(wire_))
+            return "ring refused: its scratch fell back to PSRAM, which a flash save cuts off mid-refill; free internal RAM";
+        if (ringSnapshot && platform::ptrIsPsram(snapshotBuf_))
+            return "ring refused: its snapshot fell back to PSRAM, which a flash save cuts off mid-refill; free internal RAM";
+        if (!ringSnapshot && sourceBuffer_ && platform::ptrIsPsram(sourceBuffer_->data()))
+            return "ring refused: with ringSnapshot off it reads the frame from PSRAM, which a flash save cuts off mid-refill; turn ringSnapshot on";
+        return nullptr;
+    }
+
     /// Resize the ring snapshot to hold this driver's whole window; grow-only and off the hot path, so the render thread only ever memcpys into it.
     bool ensureSnapshotCap() {
         if (!sourceBuffer_) return true;   // sized on the first build that has a source; harmless if absent
@@ -768,7 +842,7 @@ class ParallelLedDriver : public DriverBase {
         const size_t srcCh = sourceBuffer_->channelsPerLight();
         const size_t bytes = static_cast<size_t>(winLen_) * (srcCh ? srcCh : correction_.outChannels);
         if (bytes == 0 || snapshotCap_ >= bytes) return true;
-        // INTERNAL RAM first: PSRAM latency costs ~10% of a refill, but slow beats dark.
+        // Internal RAM, which the refill interrupt needs; a PSRAM fallback is refused by ringPsramRefusal, which names the cause in the status.
         uint8_t* grown = static_cast<uint8_t*>(platform::allocInternal(bytes));
         if (!grown) grown = static_cast<uint8_t*>(platform::alloc(bytes));
         if (!grown) return false;
@@ -799,7 +873,6 @@ class ParallelLedDriver : public DriverBase {
         // The ISR refill reads a frozen frame while the render loop overwrites the live buffer.
         snapCopySrc_ = sourceBuffer_->data() + static_cast<size_t>(winStart_) * srcCh;
         snapCopyCh_ = static_cast<uint8_t>(srcCh);
-        // SERIAL always: forking the copy saturated core 0 and hung the board. The prime still forks.
         copyRange(0, winLights);
         // Raw source bytes, since correction runs later in encodeRows, uniformly.
         if (patternHoldStrand_ >= 0 && static_cast<uint8_t>(patternHoldStrand_) < laneCount_) {
@@ -821,7 +894,7 @@ class ParallelLedDriver : public DriverBase {
         return true;
     }
 
-    /// Copy lights [lo, hi) of the window into the snapshot: a raw memcpy at srcCh stride. MM_RAMFUNC because both cores run it, which keeps it out of the shared flash cache.
+    /// Copy lights [lo, hi) of the window into the snapshot: a raw memcpy at srcCh stride.
     void MM_RAMFUNC copyRange(nrOfLightsType lo, nrOfLightsType hi) {
         const size_t ch = snapCopyCh_;
         if (hi > lo)
@@ -830,16 +903,6 @@ class ParallelLedDriver : public DriverBase {
     }
 
 
-    /// Split the window near the middle, rounded so the second half starts on a cache line. Each half then owns whole cache lines, so the two cores never share one (false sharing).
-    static nrOfLightsType snapLineAlignedHalf(nrOfLightsType winLights, size_t chStride) {
-        if (chStride == 0) return winLights / 2;
-        // 64 / gcd(64, stride) lights: a plain 64/stride rounds down and misses the line boundary.
-        const auto lightsPerAlign = static_cast<nrOfLightsType>(64 / std::gcd(size_t{64}, chStride));
-        nrOfLightsType half = winLights / 2;
-        half -= half % lightsPerAlign;                                // round DOWN to a line boundary
-        if (half == 0) half = lightsPerAlign;                         // never give the helper nothing
-        return half < winLights ? half : winLights / 2;               // tiny window: plain (unaligned) halve
-    }
     /// Which strand carries the pinned pattern while a loopback runs, -1 for off.
     int16_t patternHoldStrand_ = -1;
     uint8_t kPatternRGB_[3] = {0xA5, 0x00, 0xFF};   ///< the bytes the bit-verify expects
@@ -887,11 +950,11 @@ class ParallelLedDriver : public DriverBase {
     /// The bus pin list a backend builds its bus from: data pins, then the latch in shift mode, then every spare lane parked on WR. Public because a backend reaches it through owner_.
     const uint16_t* busPinList() {
         const uint8_t width = busPinCount();
-        const uint16_t clockPin = peripheral_ ? peripheral_->clockPinForBus() : laneList_[0];
+        const uint16_t wr = peripheral_ ? peripheral_->clockPinForBus() : laneList_[0];
         for (uint8_t i = 0; i < width && i < kMaxLanes; i++) {
             if (i < physPins_)                        busPinBuf_[i] = laneList_[i];   // data
             else if (pinExpanderMode() && i == latchBit_)   busPinBuf_[i] = static_cast<uint16_t>(latchPin);
-            else                                      busPinBuf_[i] = clockPin;
+            else                                      busPinBuf_[i] = wr;
         }
         return busPinBuf_;
     }
@@ -972,6 +1035,7 @@ class ParallelLedDriver : public DriverBase {
             start = static_cast<nrOfLightsType>(start + laneCounts_[i]);
             if (laneCounts_[i] > maxLaneLights_) maxLaneLights_ = laneCounts_[i];
         }
+        hot_ = {pinExpanderMode(), outputsPerPin(), slotBytes()};
         const uint8_t outCh = correction_.outChannels;
         // slotBytes() now reflects the real BUS width: the x8 lands in the slot COUNT instead.
         frameBytes_ = frameBytesFor(maxLaneLights_, outCh, slotBytes(), outputsPerPin());
@@ -1012,6 +1076,13 @@ class ParallelLedDriver : public DriverBase {
             if (!ringSnapshot) freeSnapshot();
             if (peripheral_->busInitRing(rowBytes, static_cast<uint32_t>(maxLaneLights_))
                 && (!ringSnapshot || ensureSnapshotCap())) {
+                if (const char* why = ringPsramRefusal()) {
+                    peripheral_->busDeinit();   // directly: inited_ is false, so deinit would leak the built ring
+                    deinit();
+                    freeSnapshot();
+                    setStatus(why, Severity::Error);
+                    return;
+                }
                 inited_ = true;
                 dmaBuf_ = peripheral_->busBuffer(0);   // ring[0]: a real pointer, the "inited" sentinel
                 for (uint8_t i = 0; i < kMaxLanes; i++) busPins_[i] = laneList_[i];
diff --git a/src/light/drivers/ParallelSlots.h b/src/light/drivers/ParallelSlots.h
index 2ac4505e2..6e529df24 100644
--- a/src/light/drivers/ParallelSlots.h
+++ b/src/light/drivers/ParallelSlots.h
@@ -249,54 +249,55 @@ inline void MM_RAMFUNC prefillWs2812ShiftConstants(uint64_t activeMask, uint8_t
     }
 }
 
-/// The per-light data encode, writing ONLY the data word of each slot; the output is identical to the whole-slot encoder's, provided the prefill ran with the same mask.
+/// The per-light data encode, writing only each slot's data word as the whole-slot encoder would after the same prefill. At most 8 pins, each in the word's low byte.
 template <class Slot>
 inline void MM_RAMFUNC encodeWs2812ShiftData(const uint8_t* wire, uint64_t activeMask, uint8_t physPins,
                                   uint8_t latchBit, uint8_t outPerPin, uint8_t channels, Slot* out) {
-    constexpr uint8_t kLanes = sizeof(Slot) * 8;
-    if (outPerPin == 0 || outPerPin > kPinExpanderOutputs) return;
+    if (outPerPin == 0 || outPerPin > kPinExpanderOutputs || physPins > 8) return;
     const Slot latch = static_cast<Slot>(Slot(1) << latchBit);
     // Words per WS2812 bit: each bit is one 3-word slot per shift cycle.
     const size_t bitStride = static_cast<size_t>(3) * outPerPin;
-    // The mask is split into 32-bit halves once, so every strand test below is one Xtensa shift.
+    // Per shift cycle, the live pins in each byte of a transposed plane: a dead strand idles LOW at two ANDs per plane, not a test per lane.
     const uint32_t maskLo = static_cast<uint32_t>(activeMask);
     const uint32_t maskHi = static_cast<uint32_t>(activeMask >> 32);
+    uint32_t live[kPinExpanderOutputs];
+    for (uint8_t c = 0; c < outPerPin; c++) {
+        const uint8_t pos = static_cast<uint8_t>(outPerPin - 1 - c);
+        uint32_t pins = 0;
+        for (uint8_t p = 0; p < physPins; p++) {
+            const uint8_t v = static_cast<uint8_t>(p * outPerPin + pos);
+            pins |= ((v < 32 ? maskLo >> v : maskHi >> (v - 32)) & 1u) << p;   // 32-bit halves: a 64-bit shift is a library call on Xtensa
+        }
+        live[c] = pins * 0x01010101u;
+    }
+    // Lane p's byte sits p strands' worth of channels further on; lanes past physPins read zeros or a dead strand, which the live mask clears.
+    const size_t laneStep = static_cast<size_t>(outPerPin) * channels;
 
     // The transpose IS the emit: each plane is stored while still in registers, never staged.
     for (uint8_t ch = 0; ch < channels; ch++) {
         Slot* chBase = out + static_cast<size_t>(ch) * 8 * bitStride;
         for (uint8_t c = 0; c < outPerPin; c++) {
-            const uint8_t pos = static_cast<uint8_t>(outPerPin - 1 - c);
-            // Lane p is byte p of the 8x8 matrix, so it packs straight into the SWAR register pair.
-            uint32_t loA = 0, loB = 0, hiA = 0, hiB = 0;
-            for (uint8_t p = 0; p < physPins && p < kLanes; p++) {
-                const uint8_t v = static_cast<uint8_t>(p * outPerPin + pos);
-                // 32-bit half test: see the maskLo/maskHi split above.
-                const uint32_t live = (v < 32) ? (maskLo >> v) : (maskHi >> (v - 32));
-                if (!(live & 1u)) continue;   // exhausted strand: idle LOW
-                const uint32_t b = wire[static_cast<size_t>(v) * channels + ch];
-                if (p < 8) { if (p < 4) loA |= b << (8 * p); else loB |= b << (8 * (p - 4)); }
-                else       { const uint8_t q = static_cast<uint8_t>(p - 8);
-                             if (q < 4) hiA |= b << (8 * q); else hiB |= b << (8 * (q - 4)); }
-            }
+            const uint8_t* lane = wire + static_cast<size_t>(outPerPin - 1 - c) * channels + ch;
+            // Lane p is byte p of the 8x8 matrix, so the eight lanes pack straight into the SWAR register pair.
+            uint32_t loA = lane[0] | (uint32_t(lane[laneStep]) << 8) | (uint32_t(lane[2 * laneStep]) << 16)
+                         | (uint32_t(lane[3 * laneStep]) << 24);
+            uint32_t loB = lane[4 * laneStep] | (uint32_t(lane[5 * laneStep]) << 8)
+                         | (uint32_t(lane[6 * laneStep]) << 16) | (uint32_t(lane[7 * laneStep]) << 24);
             transposeBits8x8Pair(loA, loB);
-            if constexpr (sizeof(Slot) != 1) transposeBits8x8Pair(hiA, hiB);
+            loA &= live[c];
+            loB &= live[c];
 
             const Slot first = (c == 0) ? latch : Slot(0);   // RCLK rides word 0 of each slot
             Slot* dst = chBase + outPerPin + c;              // the DATA word of bit 7's slot, cycle c
-            for (int bit = 7; bit >= 0; bit--) {             // MSB-first per byte, as the wire contract
-                const uint8_t sh = static_cast<uint8_t>(8 * (bit & 3));
-                Slot data;
-                if constexpr (sizeof(Slot) == 1) {
-                    data = static_cast<Slot>(((bit < 4) ? loA : loB) >> sh);
-                } else {
-                    data = static_cast<Slot>((((bit < 4) ? loA : loB) >> sh) & 0xFF)
-                         | static_cast<Slot>(((((bit < 4) ? hiA : hiB) >> sh) & 0xFF) << 8);
-                }
-                // ONLY the data word: the slot's other two are the prefilled constants.
-                *dst = static_cast<Slot>(data | first);
-                dst += bitStride;
-            }
+            // Plane 7 down to 0, MSB first per the wire contract, unrolled so each shift is a constant; only the data word, the other two are prefilled.
+            dst[0]             = static_cast<Slot>(static_cast<Slot>(loB >> 24) | first);
+            dst[bitStride]     = static_cast<Slot>(static_cast<Slot>((loB >> 16) & 0xFF) | first);
+            dst[2 * bitStride] = static_cast<Slot>(static_cast<Slot>((loB >> 8) & 0xFF) | first);
+            dst[3 * bitStride] = static_cast<Slot>(static_cast<Slot>(loB & 0xFF) | first);
+            dst[4 * bitStride] = static_cast<Slot>(static_cast<Slot>(loA >> 24) | first);
+            dst[5 * bitStride] = static_cast<Slot>(static_cast<Slot>((loA >> 16) & 0xFF) | first);
+            dst[6 * bitStride] = static_cast<Slot>(static_cast<Slot>((loA >> 8) & 0xFF) | first);
+            dst[7 * bitStride] = static_cast<Slot>(static_cast<Slot>(loA & 0xFF) | first);
         }
     }
 }
diff --git a/src/light/layers/Effects.h b/src/light/layers/Effects.h
index b89da9b17..5d1bd63e7 100644
--- a/src/light/layers/Effects.h
+++ b/src/light/layers/Effects.h
@@ -49,10 +49,14 @@ class Effects : public MoonModule {
     void tick() MM_NONBLOCKING override {
         // First, so every layer this frame samples the same entries: Drivers ticks too late for it.
         MoonLivePalette::tickActive(platform::millis());
+        bool bottom = true;
         for (uint8_t i = 0; i < childCount(); i++) {
             MoonModule* c = child(i);
             if (!c || c->role() != ModuleRole::Layer) continue;
             if (c->respectsEnabled() && !c->enabled()) continue;
+            const bool skip = !bottom && !static_cast<Layer*>(c)->contributes();
+            bottom = false;
+            if (skip) continue;   // invisible above the bottom: nothing to render
             uint32_t start = platform::micros();
             c->tick();
             c->addAccumUs(platform::micros() - start);
diff --git a/src/light/layers/Layer.h b/src/light/layers/Layer.h
index 929d48365..07e950bea 100644
--- a/src/light/layers/Layer.h
+++ b/src/light/layers/Layer.h
@@ -61,6 +61,8 @@ class Layer : public MoonModule {
     uint8_t blendMode = kBlendAdditive;
     /// How strongly this layer shows, from invisible to full.
     uint8_t opacity = 255;
+    /// Whether this layer shows above the bottom one: at opacity 0 it neither renders nor blends, so a show switches looks by opacity at no cost. The bottom layer overwrites and ignores opacity.
+    bool contributes() const MM_NONBLOCKING { return opacity > 0; }
 
     /// Publish the two composition controls the `Drivers` container reads.
     void defineControls() override {
diff --git a/src/light/modifiers/ModifierBase.h b/src/light/modifiers/ModifierBase.h
index d12c28a1e..a1e68314e 100644
--- a/src/light/modifiers/ModifierBase.h
+++ b/src/light/modifiers/ModifierBase.h
@@ -33,6 +33,8 @@ class ModifierBase : public MoonModule {
 
     /// Whether a control change rebuilds the mapping, which every modifier control does.
     bool affectsPrepare(const char* /*controlName*/) const override { return true; }
+    /// The layer holding it: the mapping it shapes is that layer's alone, and Drivers re-prepares only if the layer's shape changed.
+    PrepareScope prepareScope() const override { return PrepareScope::Parent; }
 
     /// Which axes this modifier can transform, advisory only: unlike an effect's dimensions, the render path never reads it.
     virtual Dim dimensions() const { return Dim::D3; }
diff --git a/src/light/moonlive/MoonLiveEffect.h b/src/light/moonlive/MoonLiveEffect.h
index 4cb4766b8..a4f71e5d5 100644
--- a/src/light/moonlive/MoonLiveEffect.h
+++ b/src/light/moonlive/MoonLiveEffect.h
@@ -146,6 +146,9 @@ class MoonLiveEffect : public EffectBase {
         moonlive::setDrawCanvas({});
     }
 
+    /// A changed file may be this module's script, which the next prepare then reads again.
+    void onFileChanged(const char* path) override { script_.fileChanged(path); }
+
     /// Drop the compiled program, the trail planes and the particle pool.
     void release() override {
         particles_.release();      // zero the pool BEFORE the base frees its buffers, or it would
diff --git a/src/light/moonlive/MoonLiveLayout.h b/src/light/moonlive/MoonLiveLayout.h
index 62964fdba..e2bd4e390 100644
--- a/src/light/moonlive/MoonLiveLayout.h
+++ b/src/light/moonlive/MoonLiveLayout.h
@@ -100,6 +100,9 @@ class MoonLiveLayout : public LayoutBase {
         runScript(&addToSink, &e);
     }
 
+    /// A changed file may be this module's script, which the next prepare then reads again.
+    void onFileChanged(const char* path) override { script_.fileChanged(path); }
+
     /// Drop the compiled program and its memory.
     void release() override {
         script_.engine().free();
diff --git a/src/light/moonlive/MoonLiveModifier.h b/src/light/moonlive/MoonLiveModifier.h
index 3382e7e81..ce7864aca 100644
--- a/src/light/moonlive/MoonLiveModifier.h
+++ b/src/light/moonlive/MoonLiveModifier.h
@@ -134,6 +134,9 @@ class MoonLiveModifier : public ModifierBase {
         return true;
     }
 
+    /// A changed file may be this module's script, which the next prepare then reads again.
+    void onFileChanged(const char* path) override { script_.fileChanged(path); }
+
     /// Drop the compiled program and its memory.
     void release() override {
         script_.engine().free();
diff --git a/src/light/moonlive/MoonLivePalette.h b/src/light/moonlive/MoonLivePalette.h
index 19ee33c4e..0d84ddafd 100644
--- a/src/light/moonlive/MoonLivePalette.h
+++ b/src/light/moonlive/MoonLivePalette.h
@@ -54,9 +54,12 @@ class MoonLivePalette {
     /// The script file this palette runs.
     const char* scriptName() const { return script_.name(); }
 
-    /// Compile if the named file changed, reporting status and dynamic bytes through `owner`.
-    void prepare(MoonModule& owner) {
-        script_.sync(moonlive::effectSysVars(), owner, moonlive::lightBuiltins());
+    /// Note a changed file, so the next prepare reads the script again when the path may hold it.
+    void fileChanged(const char* path) { script_.fileChanged(path); }
+
+    /// Compile if the named file changed, reporting status and dynamic bytes through `owner`; true when a new program was installed.
+    bool prepare(MoonModule& owner) {
+        return script_.sync(moonlive::effectSysVars(), owner, moonlive::lightBuiltins());
     }
 
     /// Publish the script's controls, so a scripted palette is configurable without editing it.
diff --git a/src/main.cpp b/src/main.cpp
index 2fcc31fdf..3f612a179 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -114,6 +114,7 @@
 ///
 #include "module_types.h"
 
+#include "core/util/JsonFetch.h"   // poll(): the JSON worker stops once nothing uses it
 #include "core/module/Scheduler.h"
 #include "core/util/ModuleFactory.h"
 #include "light/layers/Effects.h"
@@ -321,6 +322,8 @@ void mm_main(volatile bool& keepRunning, uint16_t httpPort) {
         uint32_t now = mm::platform::millis();
         if (now - lastLog >= 1000) {
             lastLog = now;
+            // The JSON client stops its worker once nothing uses it, which only the loop can ask safely.
+            mm::JsonFetch::poll();
             // `goto`, not `continue`, because the loop's pacing lives at its TAIL: @xref{why-the-loop-pacing-uses-goto-and-a-sleep}.
             if (scheduler.tickTimeUs() == 0) goto paced; // no measurement yet
 
diff --git a/src/platform/desktop/platform_desktop.cpp b/src/platform/desktop/platform_desktop.cpp
index d30da0016..5abbba6c7 100644
--- a/src/platform/desktop/platform_desktop.cpp
+++ b/src/platform/desktop/platform_desktop.cpp
@@ -346,7 +346,19 @@ void* alloc(size_t bytes) {
     return trackedAlloc(bytes);
 }
 
-bool ptrIsPsram(const void* /*p*/) { return false; }   // desktop has no PSRAM
+static std::atomic<const void*> testPsramBegin{nullptr};
+static std::atomic<const void*> testPsramEnd{nullptr};
+void setTestPsramRange(const void* begin, const void* end) {
+    testPsramBegin.store(begin, std::memory_order_relaxed);
+    testPsramEnd.store(end, std::memory_order_relaxed);
+}
+
+bool ptrIsPsram(const void* p) {   // desktop has no PSRAM, unless a test marks a range as such
+    const auto* b = static_cast<const uint8_t*>(testPsramBegin.load(std::memory_order_relaxed));
+    const auto* e = static_cast<const uint8_t*>(testPsramEnd.load(std::memory_order_relaxed));
+    const auto* q = static_cast<const uint8_t*>(p);
+    return b && q && q >= b && q < e;
+}
 
 void* allocInternal(size_t bytes) {
     return trackedAlloc(bytes);   // desktop has one flat RAM: internal == ordinary
@@ -438,8 +450,11 @@ size_t freeHeap() {
     return 0; // Not meaningful on desktop (0 = unlimited)
 }
 
+static std::atomic<size_t> testFreeInternal{0};
+void setTestFreeInternalHeap(size_t bytes) { testFreeInternal.store(bytes, std::memory_order_relaxed); }
+
 size_t freeInternalHeap() {
-    return 0; // Not meaningful on desktop (0 = unlimited)
+    return testFreeInternal.load(std::memory_order_relaxed);   // 0 = not meaningful on desktop (unlimited), unless a test sets it
 }
 
 // Test-only cap on the reported largest free block, so a test can force the paged fallback without a fragmented heap.
@@ -617,20 +632,52 @@ bool httpsAvailable() MM_NONBLOCKING {
     // Windows needs no libcurl: WinHTTP ships with the OS, so the send path is always compiled in.
     return true;
 #else
-    return false;   // built without libcurl: httpsPost can never succeed
+    return false;   // built without libcurl: httpFetch can never succeed
 #endif
 }
 
-bool httpsPost(const char* url, const char* body, uint32_t timeoutMs) {
-#ifdef _WIN32
-    // The system's own transport here, for the same reason the others use theirs: the certificate store the platform already ships, with nothing vendored and one link entry.
-    if (!url || !*url) return false;
+namespace {
+std::atomic<HttpFetchFn> testHttpFetch{nullptr};
+
+/// Where an answer collects as it arrives, refusing what would not fit rather than truncating it.
+struct FetchSink {
+    char*  body;
+    size_t cap;
+    size_t len = 0;
+    bool   tooBig = false;
+    /// Take `n` more bytes, false once they would not fit with the terminator.
+    bool take(const char* data, size_t n) {
+        if (!body || cap == 0) return true;   // a caller that keeps no answer
+        if (len + n + 1 > cap) { tooBig = true; return false; }
+        std::memcpy(body + len, data, n);
+        len += n;
+        body[len] = '\0';
+        return true;
+    }
+};
+}  // namespace
+
+void setTestHttpFetch(HttpFetchFn fn) { testHttpFetch.store(fn, std::memory_order_relaxed); }
 
-    // This interface takes the pieces of a URL separately, so its own splitter does the work and nothing is parsed by hand.
+bool tlsRoom(const char* url) {
+    if (!url || std::strncmp(url, "https://", 8) != 0) return true;
+    // Zero is the desktop's "not measured", which only a test replaces with a board's figure.
+    const size_t internal = freeInternalHeap();
+    return internal == 0 || internal >= kInternalFreeFloor + kTlsSessionBytes;
+}
+
+namespace {
+
+#ifdef _WIN32
+/// One request over WinHTTP into `sink`; the status, or 0.
+int transportFetch(const char* method, const char* url, const char* reqBody, uint32_t timeoutMs, FetchSink& sink) {
+    // The system's own transport and certificate store, nothing vendored; the URL is split by WinHTTP's own splitter, never by hand.
     const int wideLen = MultiByteToWideChar(CP_UTF8, 0, url, -1, nullptr, 0);
-    if (wideLen <= 0) return false;
+    if (wideLen <= 0) return 0;
     std::wstring wideUrl(static_cast<size_t>(wideLen), L'\0');
     MultiByteToWideChar(CP_UTF8, 0, url, -1, wideUrl.data(), wideLen);
+    wchar_t wideMethod[16] = {};
+    MultiByteToWideChar(CP_UTF8, 0, method, -1, wideMethod, ARRAYSIZE(wideMethod) - 1);
 
     wchar_t host[256] = {};
     wchar_t path[1024] = {};
@@ -639,38 +686,37 @@ bool httpsPost(const char* url, const char* body, uint32_t timeoutMs) {
     parts.dwStructSize      = sizeof(parts);
     parts.lpszHostName      = host;   parts.dwHostNameLength      = ARRAYSIZE(host);
     parts.lpszUrlPath       = path;   parts.dwUrlPathLength       = ARRAYSIZE(path);
-    // The splitter separates the query from the path, so asking for it and re-joining keeps this general: a later caller's query would otherwise be dropped silently.
+    // The splitter separates the query from the path, so asking for it and re-joining keeps this general: a query would otherwise be dropped silently.
     parts.lpszExtraInfo     = query;  parts.dwExtraInfoLength     = ARRAYSIZE(query);
-    if (!WinHttpCrackUrl(wideUrl.c_str(), 0, 0, &parts)) return false;
-    // Anything but https is a caller error rather than something to downgrade into cleartext.
-    if (parts.nScheme != INTERNET_SCHEME_HTTPS) return false;
+    if (!WinHttpCrackUrl(wideUrl.c_str(), 0, 0, &parts)) return 0;
+    const bool secure = parts.nScheme == INTERNET_SCHEME_HTTPS;
     const std::wstring target = std::wstring(path) + query;
 
     HINTERNET session = WinHttpOpen(L"MoonLight", WINHTTP_ACCESS_TYPE_AUTOMATIC_PROXY,
                                     WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0);
-    if (!session) return false;
+    if (!session) return 0;
 
     // The caller's one timeout applied to every phase, since a hung handshake must bound the same way a hung read does.
     const int t = static_cast<int>(timeoutMs);
     WinHttpSetTimeouts(session, t, t, t, t);
 
-    bool ok = false;
+    int result = 0;
     if (HINTERNET connection = WinHttpConnect(session, host, parts.nPort, 0)) {
-        if (HINTERNET request = WinHttpOpenRequest(connection, L"POST", target.c_str(), nullptr,
+        if (HINTERNET request = WinHttpOpenRequest(connection, wideMethod, target.c_str(), nullptr,
                                                    WINHTTP_NO_REFERER,
                                                    WINHTTP_DEFAULT_ACCEPT_TYPES,
-                                                   WINHTTP_FLAG_SECURE)) {
-            // No redirect following: the endpoint is ours and answers directly, and following one would let a server move the body elsewhere.
+                                                   secure ? WINHTTP_FLAG_SECURE : 0)) {
+            // No redirect following: a server moving the request somewhere the caller never named is refused.
             DWORD noRedirects = WINHTTP_DISABLE_REDIRECTS;
             WinHttpSetOption(request, WINHTTP_OPTION_DISABLE_FEATURE,
                              &noRedirects, sizeof(noRedirects));
 
-            const char* payload = body ? body : "";
+            const char* payload = reqBody ? reqBody : "";
             const DWORD payloadLen = static_cast<DWORD>(std::strlen(payload));
-            // The body rides with the request, which is what lets a one-shot post skip a separate write.
+            // The body rides with the request, which is what lets a one-shot request skip a separate write.
             if (WinHttpSendRequest(request,
-                                   L"Content-Type: application/json\r\n",
-                                   static_cast<DWORD>(-1),
+                                   reqBody ? L"Content-Type: application/json\r\n" : WINHTTP_NO_ADDITIONAL_HEADERS,
+                                   reqBody ? static_cast<DWORD>(-1) : 0,
                                    const_cast<char*>(payload), payloadLen, payloadLen, 0)
                 && WinHttpReceiveResponse(request, nullptr)) {
                 DWORD status = 0, statusSize = sizeof(status);
@@ -678,7 +724,11 @@ bool httpsPost(const char* url, const char* body, uint32_t timeoutMs) {
                                         WINHTTP_QUERY_STATUS_CODE | WINHTTP_QUERY_FLAG_NUMBER,
                                         WINHTTP_HEADER_NAME_BY_INDEX, &status, &statusSize,
                                         WINHTTP_NO_HEADER_INDEX)) {
-                    ok = status >= 200 && status < 300;
+                    result = static_cast<int>(status);
+                    char chunk[1024];
+                    DWORD got = 0;
+                    while (WinHttpReadData(request, chunk, sizeof(chunk), &got) && got > 0)
+                        if (!sink.take(chunk, got)) break;
                 }
             }
             WinHttpCloseHandle(request);
@@ -686,36 +736,39 @@ bool httpsPost(const char* url, const char* body, uint32_t timeoutMs) {
         WinHttpCloseHandle(connection);
     }
     WinHttpCloseHandle(session);
-    // The response body is never read, matching the contract: the caller has nothing to do with it and the handles close either way.
-    return ok;
+    return sink.tooBig ? 0 : result;
+}
 #elif defined(MM_HAVE_CURL)
-    if (!url || !*url) return false;
-
+/// One request over libcurl into `sink`; the status, or 0.
+int transportFetch(const char* method, const char* url, const char* reqBody, uint32_t timeoutMs, FetchSink& sink) {
     // The library's global init is not thread-safe and must run once, so a function-local static does it: the first call initializes and every later one skips.
     static const bool inited = (curl_global_init(CURL_GLOBAL_DEFAULT) == CURLE_OK);
-    if (!inited) return false;
+    if (!inited) return 0;
 
     CURL* curl = curl_easy_init();
-    if (!curl) return false;
+    if (!curl) return 0;
 
     curl_easy_setopt(curl, CURLOPT_URL, url);
-    curl_easy_setopt(curl, CURLOPT_POST, 1L);
-    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, body ? body : "");
+    curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, method);
+    if (reqBody) curl_easy_setopt(curl, CURLOPT_POSTFIELDS, reqBody);
     curl_easy_setopt(curl, CURLOPT_TIMEOUT_MS, static_cast<long>(timeoutMs));
     curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT_MS, static_cast<long>(timeoutMs));
     // Both verifications are the defaults, set explicitly so a future edit cannot turn them off quietly: without them the transport proves nothing about who answered.
     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L);
-    // No redirect following: the endpoint is ours, and following one would let a server move the body somewhere the caller never named.
+    // No redirect following: a server moving the request somewhere the caller never named is refused.
     curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 0L);
     curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1L);   // no SIGALRM in a threaded process
 
-    struct curl_slist* headers = curl_slist_append(nullptr, "Content-Type: application/json");
-    curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
+    struct curl_slist* headers = reqBody ? curl_slist_append(nullptr, "Content-Type: application/json") : nullptr;
+    if (headers) curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
 
-    // Discard the body rather than buffer it, a callback returning the full size being how the library is told the data was consumed.
+    // A short count tells the library to stop, which is how an answer too big for the caller ends the transfer.
+    curl_easy_setopt(curl, CURLOPT_WRITEDATA, &sink);
     curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION,
-                     +[](char*, size_t size, size_t nmemb, void*) -> size_t { return size * nmemb; });
+                     +[](char* data, size_t size, size_t nmemb, void* user) -> size_t {
+                         return static_cast<FetchSink*>(user)->take(data, size * nmemb) ? size * nmemb : 0;
+                     });
 
     const CURLcode rc = curl_easy_perform(curl);
     long status = 0;
@@ -723,11 +776,25 @@ bool httpsPost(const char* url, const char* body, uint32_t timeoutMs) {
 
     curl_slist_free_all(headers);
     curl_easy_cleanup(curl);
-    return rc == CURLE_OK && status >= 200 && status < 300;
+    return rc == CURLE_OK && !sink.tooBig ? static_cast<int>(status) : 0;
+}
+#endif
+
+}  // namespace
+
+int httpFetch(const char* method, const char* url, const char* reqBody, uint32_t timeoutMs,
+              char* body, size_t bodyLen) {
+    if (body && bodyLen) body[0] = '\0';
+    if (!method || !url || !*url) return 0;
+    if (!tlsRoom(url)) return 0;
+    if (HttpFetchFn fn = testHttpFetch.load(std::memory_order_relaxed)) return fn(method, url, reqBody, body, bodyLen);
+    FetchSink sink{body, bodyLen};
+#if defined(_WIN32) || defined(MM_HAVE_CURL)
+    return transportFetch(method, url, reqBody, timeoutMs, sink);
 #else
     // Built without libcurl: the caller degrades visibly rather than pretending it sent something.
-    (void)url; (void)body; (void)timeoutMs;
-    return false;
+    (void)reqBody; (void)timeoutMs; (void)sink;
+    return 0;
 #endif
 }
 
@@ -2597,8 +2664,6 @@ bool moonI80Ws2812InitRing(MoonI80Ws2812Handle& /*h*/, const uint16_t* /*dataPin
 }
 bool moonI80Ws2812TransmitRing(MoonI80Ws2812Handle& /*h*/) { return false; }
 void moonI80SetShiftClockDiv(uint8_t /*div*/) {}
-void moonI80Ws2812PrimeRange(MoonI80Ws2812Handle& /*h*/, uint8_t /*bufLo*/, uint8_t /*bufHi*/) {}
-bool moonI80Ws2812ArmRing(MoonI80Ws2812Handle& /*h*/) { return false; }
 bool moonI80Ws2812IsRing(const MoonI80Ws2812Handle& /*h*/) { return false; }
 bool moonI80Ws2812InternalFits(size_t /*bytes*/) { return false; }
 uint8_t* moonI80Ws2812Buffer(const MoonI80Ws2812Handle& h, uint8_t buffer) {
diff --git a/src/platform/esp32/platform_esp32.cpp b/src/platform/esp32/platform_esp32.cpp
index c0524796f..ec24e8d9d 100644
--- a/src/platform/esp32/platform_esp32.cpp
+++ b/src/platform/esp32/platform_esp32.cpp
@@ -127,6 +127,7 @@
 
 #include <atomic>
 #include <cstdarg>
+#include <cstddef>   // std::max_align_t, the alignment allocInternal asks for
 #include <cstdlib>
 #include <cstdio>
 #include <algorithm>   // std::min
@@ -171,7 +172,8 @@ void* alloc(size_t bytes) {
 
 void* allocInternal(size_t bytes) {
     // Internal only, no PSRAM fallback here, the caller chose this seam because PSRAM latency breaks it (an ISR-read buffer); a silent PSRAM grant would hand back the exact problem. Caller falls back.
-    return heap_caps_malloc(bytes, MALLOC_CAP_INTERNAL | MALLOC_CAP_8BIT);
+    // Aligned as malloc promises, since InternalRamObject constructs objects here and the heap alone guarantees only a word.
+    return heap_caps_aligned_alloc(alignof(std::max_align_t), bytes, MALLOC_CAP_INTERNAL | MALLOC_CAP_8BIT);
 }
 
 bool ptrIsPsram(const void* p) {
@@ -335,7 +337,7 @@ const char* chipModel() {
 
 uint32_t IRAM_ATTR cycleCount() { return esp_cpu_get_cycle_count(); }
 
-uint8_t currentCore() { return static_cast<uint8_t>(xPortGetCoreID()); }
+uint8_t IRAM_ATTR currentCore() { return static_cast<uint8_t>(xPortGetCoreID()); }
 
 const char* cpuInfo() {
     // Frequency from the running clock (esp_rom_get_cpu_ticks_per_us == MHz), not the sdkconfig macro, so a config/hardware mismatch shows up. Cores from esp_chip_info, same source chipModel uses.
diff --git a/src/platform/esp32/platform_esp32_hub75.cpp b/src/platform/esp32/platform_esp32_hub75.cpp
index c5c488ec0..083925553 100644
--- a/src/platform/esp32/platform_esp32_hub75.cpp
+++ b/src/platform/esp32/platform_esp32_hub75.cpp
@@ -97,7 +97,7 @@ const char* g_lastError = nullptr;
 constexpr uint8_t kOeLane = Hub75Layout{}.oe;
 void invertOe(gpio_num_t oe, int signal) { esp_rom_gpio_connect_out_signal(oe, signal, true, false); }
 
-struct Hub75State {
+struct Hub75State : platform::InternalRamObject {
     Hub75Backend backend = Hub75Backend::LcdCam;
 #if MM_HUB75_LCDCAM
     esp_lcd_i80_bus_handle_t bus = nullptr;
diff --git a/src/platform/esp32/platform_esp32_i2s.cpp b/src/platform/esp32/platform_esp32_i2s.cpp
index bd1b73d86..27514dffd 100644
--- a/src/platform/esp32/platform_esp32_i2s.cpp
+++ b/src/platform/esp32/platform_esp32_i2s.cpp
@@ -14,10 +14,10 @@
 /// ## The transform scratch is allocated, not reserved
 ///
 /// As a plain array it was eight kilobytes of internal memory reserved from boot on every board.
-/// That is a few percent of the pool the network stack and every task stack share.
 /// That included the many boards with no microphone fitted, where nothing ever reads it, and a module that is not used should cost nothing.
-/// Now a board without audio pays only for the pointer, and one with audio allocates on its first analyzed frame and keeps it for the process.
-/// So nothing allocates per frame on the audio path.
+/// Now a board without audio pays only for the pointer, and one with audio allocates on its first analyzed frame and frees it with the microphone's channel.
+/// So nothing allocates per frame on the audio path, and a board that stops listening gets the memory back.
+/// The library's twiddle table is initialized at the block size: built in on the ESP32-S3, 4 KB elsewhere, where the library's maximum (4,096) allocated 16 KB.
 ///
 /// ## The gain from the alternate microphone is a conversion, not a boost
 ///
@@ -74,8 +74,8 @@ bool   g_fftReady = false;
 
 bool ensureFftInit() {
     if (g_fftReady) return true;
-    // dsps_fft2r_init_fc32(NULL, …) uses the library's built-in max-size twiddle table, no caller allocation, initialized once for the process.
-    if (dsps_fft2r_init_fc32(nullptr, CONFIG_DSP_MAX_FFT_SIZE) != ESP_OK) {
+    // On the ESP32-S3 the library takes its built-in twiddle table at this block size; elsewhere it allocates a 4 KB one. The microphone's release frees either.
+    if (dsps_fft2r_init_fc32(nullptr, kMaxFftN) != ESP_OK) {
         ESP_LOGE(I2S_TAG, "esp-dsp FFT init failed");
         return false;
     }
@@ -221,6 +221,13 @@ void audioMicDeinit(AudioMicHandle& h) {
     }
     delete st;
     h.impl = nullptr;
+    // The transform serves the microphone alone, so it goes with the channel: @xref{the-transform-scratch-is-allocated-not-reserved|why}.
+    if (g_fftReady) {
+        heap_caps_free(g_fftBuf);
+        g_fftBuf = nullptr;
+        dsps_fft2r_deinit_fc32();
+        g_fftReady = false;
+    }
 }
 
 void audioFft(const float* windowed, size_t n, float* outMag) {
diff --git a/src/platform/esp32/platform_esp32_i80.cpp b/src/platform/esp32/platform_esp32_i80.cpp
index 7dee01db1..5593c149f 100644
--- a/src/platform/esp32/platform_esp32_i80.cpp
+++ b/src/platform/esp32/platform_esp32_i80.cpp
@@ -117,7 +117,7 @@ constexpr uint32_t kShiftPclkHz = 26'666'666;   // prescale 3 of 80 MHz -> 300 n
 // The second is null when its allocation did not fit, and each has its own completion signal so a wait targets the right transfer.
 // Both can be in flight at once and the completion event carries no token, but transfers complete in order.
 // So a two-slot queue of started indices routes each signal to the buffer that finished.
-struct I80State {
+struct I80State : platform::InternalRamObject {
     esp_lcd_i80_bus_handle_t bus = nullptr;
     esp_lcd_panel_io_handle_t io = nullptr;
     SemaphoreHandle_t done[2] = {nullptr, nullptr};
diff --git a/src/platform/esp32/platform_esp32_improv.cpp b/src/platform/esp32/platform_esp32_improv.cpp
index ce5864947..acc8a2c85 100644
--- a/src/platform/esp32/platform_esp32_improv.cpp
+++ b/src/platform/esp32/platform_esp32_improv.cpp
@@ -478,8 +478,8 @@ bool improvProvisioningInit(const ImprovDeviceInfo& info,
     g_improv.opOutLen = opOutLen;
     g_improv.opReady = opReady;
 
-    // 6 KB stack: parser is small, scan response uses std::vector + std::string (some short-string-optimized, some heap). Priority 4, below OTA (5), above idle. Single task per device; not pinned to a core.
-    BaseType_t ok = xTaskCreate(&improvTask, "improv", 6144, nullptr, 4, nullptr);
+    // 4 KB stack: the deepest path, a scan answered network by network, measured at 1.5 KB on the classic, the strings and vectors being on the heap. Priority 4, below OTA (5), above idle. Single task per device; not pinned to a core.
+    BaseType_t ok = xTaskCreate(&improvTask, "improv", 4096, nullptr, 4, nullptr);
     if (ok != pdPASS) {
         improvSetStatus("error: task create failed");
         return false;
diff --git a/src/platform/esp32/platform_esp32_moon_i80.cpp b/src/platform/esp32/platform_esp32_moon_i80.cpp
index 9e83ff8eb..99e26726d 100644
--- a/src/platform/esp32/platform_esp32_moon_i80.cpp
+++ b/src/platform/esp32/platform_esp32_moon_i80.cpp
@@ -235,6 +235,7 @@
 #include "soc/gpio_sig_map.h"   // SIG_GPIO_OUT_IDX — detaches a matrix route (destroyState)
 #include "esp_rom_sys.h"     // esp_rom_delay_us — the DMA-to-FIFO settle before lcd_ll_start
 #include "esp_timer.h"       // esp_timer_get_time — ISR-safe wire-time stamp
+#include "esp_cpu.h"         // esp_cpu_get_core_id: which core the refill interrupt runs on
 #include "driver/gpio.h"
 #include "soc/io_mux_reg.h"  // PIN_FUNC_GPIO — the IO-MUX function the matrix routes through
 #include "freertos/FreeRTOS.h"
@@ -300,7 +301,7 @@ constexpr uint32_t kWireFreeTimeoutMs = 200;
 // Two buffers for the deferred-wait double buffer, the second null when its allocation did not fit, each with its own completion signal.
 // Transfers complete in start order and the event carries no token, so a two-slot queue of started indices routes each signal to the buffer that finished.
 // There is no transaction queue, so a transmit programs the chain directly and a second one in flight is a caller error, rejected rather than queued.
-struct MoonI80State {
+struct MoonI80State : platform::InternalRamObject {
     lcd_hal_context_t hal = {};
     gdma_channel_handle_t dma = nullptr;
     gdma_link_list_handle_t link = nullptr;
@@ -381,7 +382,10 @@ struct MoonI80State {
     volatile uint32_t dbgEncAvgUs = 0;   // LAST FRAME's average, latched at frame end — the readout target
                                          // (reading sum/count mid-frame races the per-frame reset: the 1 s KPI tick correlates with the frame cycle and kept landing in the freshly-reset window, reading a false 0)
     volatile uint32_t dbgMaxIsrGapUs = 0;
-    volatile int64_t  dbgLastEofUs = 0;
+    volatile int64_t  dbgLastEofUs = 0;     // the previous interrupt within this frame, the arm before the first
+    volatile int32_t  dbgMinLead = INT32_MAX;   // fewest slices the frontier led the drain by at an interrupt
+    volatile uint32_t dbgMaxGapAtSlice = 0;     // the drain position where the worst gap ended: frame start or anywhere
+    volatile uint8_t  dbgIsrCore = 0;           // the core the refill interrupt runs on
     // The scatter meter: slices written after their drain had begun, each stale on the wire. A clean soak reads zero, whether or not the eye catches it.
     volatile uint32_t dbgLate = 0;
 };
@@ -426,9 +430,13 @@ bool IRAM_ATTR moonI80EofCb(gdma_channel_handle_t, gdma_event_data_t*, void* use
         st->dbgCacheOffRun = 0;                          // a live firing ends the streak
         st->dbgEofTotal = st->dbgEofTotal + 1u;         // ISR INSTRUMENTATION (diagnostic)
         const int64_t eofNow = esp_timer_get_time();
+        st->dbgIsrCore = static_cast<uint8_t>(esp_cpu_get_core_id());
         if (st->dbgLastEofUs != 0) {
             const uint32_t gap = static_cast<uint32_t>(eofNow - st->dbgLastEofUs);
-            if (gap > st->dbgMaxIsrGapUs) st->dbgMaxIsrGapUs = gap;
+            if (gap > st->dbgMaxIsrGapUs) {
+                st->dbgMaxIsrGapUs = gap;
+                st->dbgMaxGapAtSlice = static_cast<uint32_t>(((eofNow - st->armUs) * 1000) / (st->sliceNs ? st->sliceNs : 1));
+            }
         }
         st->dbgLastEofUs = eofNow;
 
@@ -439,14 +447,16 @@ bool IRAM_ATTR moonI80EofCb(gdma_channel_handle_t, gdma_event_data_t*, void* use
                 ((eofNow - st->armUs) * 1000) / st->sliceNs);
             st->drainCount = drainPos;      // DIAGNOSTIC (dbgLastDrain mirrors the old counter's slot)
             st->dbgLastDrain = drainPos;
+            // How close the drain came to the frontier: the ring's margin, which a stall eats.
+            const int32_t lead = static_cast<int32_t>(st->lastWrittenSlice) - static_cast<int32_t>(drainPos);
+            if (lead < st->dbgMinLead) st->dbgMinLead = lead;
 
             // Batch refill toward the writable window: a slice's previous occupant is provably drained once the drain position has passed it, and a safety margin sets the edge.
             // Capped per firing to bound the handler's duration, and capped batches still converge since interrupts keep arriving.
             // The pool is the jitter buffer, so only the average encode must beat the deadline.
-            constexpr uint32_t kLead = 2;
             constexpr uint32_t kBatchMax = 4;
             // kTailBufs (file scope): one pure-zero flush slice past the frame-close slice, so a stop firing on the second-to-last EOF (oracle floor at a slice boundary) can only truncate zeros, never the frame-close latch (which streams a whole slice earlier).
-            const uint32_t windowEnd = drainPos + st->ringBufs - kLead;
+            const uint32_t windowEnd = drainPos + st->ringBufs - kRingRefillGap;
             // The frame's last writes are the frame-close slice (index nSlices: zeros + the closing latch word) and kTailBufs pure-zero flush slices. The frontier terminator then RESTS on the final node as the frame's hardware end, the DMA cannot pass a NULL, so nothing past the frame is ever re-read (no lap of zero-fill needed beyond it).
             const uint32_t lastSlice = st->nSlices + kTailBufs;
             for (uint32_t n = 0; n < kBatchMax; n++) {
@@ -480,6 +490,7 @@ bool IRAM_ATTR moonI80EofCb(gdma_channel_handle_t, gdma_event_data_t*, void* use
             // Fires exactly once per frame, the block being gated on the busy flag that the completion clears.
             if (st->lastWrittenSlice >= lastSlice) {
                 st->busy = false;
+                st->dbgLastEofUs = 0;   // the idle time before the next frame is no refill gap
                 // Latch this frame's encode average and reset the window, at frame END, when every refill has landed, so a readout never sees a half-filled (or just-reset) window.
                 st->dbgEncAvgUs = st->dbgEncCount ? st->dbgEncSumUs / st->dbgEncCount : 0;
                 st->dbgEncSumUs = 0;
@@ -847,7 +858,7 @@ void waitWireDrained(MoonI80State* st) {
     if (now < st->lastStopUs) esp_rom_delay_us(static_cast<uint32_t>(st->lastStopUs - now));
 }
 
-// Prime a range of buffers, each independent, so two cores can prime disjoint ranges concurrently. No latch pad, the reset coming from the stop; each caller takes the wire barrier itself, which is idempotent in parallel and keeps the barrier a per-call contract.
+// Prime a range of buffers. No latch pad, the reset coming from the stop; the wire barrier comes first.
 void primeRingRange(MoonI80State* st, uint8_t bufLo, uint8_t bufHi) {
     waitWireDrained(st);
     if (bufHi > st->ringBufs) bufHi = st->ringBufs;
@@ -855,7 +866,7 @@ void primeRingRange(MoonI80State* st, uint8_t bufLo, uint8_t bufHi) {
         fillSlice(st, primed, primed);   // first lap: buffer index IS the slice index
 }
 
-// Arm the primed ring: peripheral setup, the timed WS2812-reset guard, the oracle epoch, gdma_start. Every buffer must be primed (primeRingRange over the whole pool, serial or fork-joined) BEFORE this runs; the caller owns that ordering (the driver's join is the fence).
+// Arm the primed ring: peripheral setup, the timed WS2812-reset guard, the oracle epoch, gdma_start. Every buffer is primed before this runs.
 bool armRingTransfer(MoonI80State* st) {
     lcd_cam_dev_t* dev = st->hal.dev;
     st->drainCount = 0;
@@ -889,6 +900,7 @@ bool armRingTransfer(MoonI80State* st) {
 
     st->txStartUs[0] = esp_timer_get_time();
     st->armUs = st->txStartUs[0];   // the clock oracle's epoch: drain position = (now − armUs) / sliceNs
+    st->dbgLastEofUs = st->armUs;   // the frame's first refill gap is measured from the arm
     if (gdma_start(st->dma, gdma_link_get_head_addr(st->link)) != ESP_OK) {
         st->busy = false;
         return false;
@@ -898,7 +910,7 @@ bool armRingTransfer(MoonI80State* st) {
     return true;
 }
 
-// The serial combo (prime everything, then arm), the single-core path, and what the dual-core driver falls back to when its helper is unavailable.
+// Prime every buffer, then arm.
 bool startRingTransfer(MoonI80State* st) {
     primeRingRange(st, 0, st->ringBufs);
     return armRingTransfer(st);
@@ -955,6 +967,7 @@ bool initRingDma(MoonI80State* st) {
     gdma_tx_event_callbacks_t cbs = {};
     cbs.on_trans_eof = moonI80EofCb;
     cbs.on_descr_err = moonI80DescErrCb;   // B1-DISCRIMINATOR (diagnostic): catch the silent descriptor-fetch halt
+    // The refill interrupt runs on the core that registers it, core 0: on core 1 it faulted when a flash write on core 0 switched the cache off mid-refill.
     return gdma_register_tx_event_callbacks(st->dma, &cbs, st) == ESP_OK;
 }
 
@@ -1182,18 +1195,6 @@ void moonI80SetShiftClockDiv(uint8_t div) {
     g_shiftClockDiv = div;
 }
 
-void moonI80Ws2812PrimeRange(MoonI80Ws2812Handle& h, uint8_t bufLo, uint8_t bufHi) {
-    auto* st = static_cast<MoonI80State*>(h.impl);
-    if (!st || !st->isRing || st->busy) return;   // never prime under a live transfer
-    primeRingRange(st, bufLo, bufHi);
-}
-
-bool moonI80Ws2812ArmRing(MoonI80Ws2812Handle& h) {
-    auto* st = static_cast<MoonI80State*>(h.impl);
-    if (!st || !st->isRing || st->busy) return false;
-    return armRingTransfer(st);
-}
-
 bool moonI80Ws2812TransmitRing(MoonI80Ws2812Handle& h) {
     auto* st = static_cast<MoonI80State*>(h.impl);
     if (!st || !st->isRing) return false;
@@ -1305,6 +1306,12 @@ MoonI80RingStats moonI80Ws2812RingStats(const MoonI80Ws2812Handle& h) {
     s.maxEncodeUs   = st->dbgMaxEncodeUs;
     s.avgEncodeUs   = st->dbgEncAvgUs;
     s.maxIsrGapUs   = st->dbgMaxIsrGapUs;
+    s.minLead       = st->dbgMinLead == INT32_MAX ? -1 : st->dbgMinLead;
+    s.maxGapAtSlice = st->dbgMaxGapAtSlice;
+    s.isrCore       = st->dbgIsrCore;
+    // The gap and the lead are per reading, the window the once-a-second readout makes, so one stall at a rebuild does not hide the steady state.
+    st->dbgMaxIsrGapUs = 0;
+    st->dbgMinLead = INT32_MAX;
     s.itemsPerBuf   = st->itemsPerBuf;
     s.termNodeDiag  = st->termNode;
     s.late          = st->dbgLate;
@@ -1468,8 +1475,6 @@ bool moonI80Ws2812InitRing(MoonI80Ws2812Handle&, const uint16_t*, uint8_t, uint1
 }
 bool moonI80Ws2812TransmitRing(MoonI80Ws2812Handle&) { return false; }
 void moonI80SetShiftClockDiv(uint8_t) {}
-void moonI80Ws2812PrimeRange(MoonI80Ws2812Handle&, uint8_t, uint8_t) {}
-bool moonI80Ws2812ArmRing(MoonI80Ws2812Handle&) { return false; }
 bool moonI80Ws2812IsRing(const MoonI80Ws2812Handle&) { return false; }
 bool moonI80Ws2812InternalFits(size_t) { return false; }
 uint8_t* moonI80Ws2812Buffer(const MoonI80Ws2812Handle&, uint8_t) { return nullptr; }
diff --git a/src/platform/esp32/platform_esp32_ota.cpp b/src/platform/esp32/platform_esp32_ota.cpp
index 694f3dadc..1d84e6cf4 100644
--- a/src/platform/esp32/platform_esp32_ota.cpp
+++ b/src/platform/esp32/platform_esp32_ota.cpp
@@ -118,6 +118,7 @@
 #include <cstdarg>
 #include <cstdio>
 #include <cstring>
+#include <strings.h>     // strncasecmp: a host name compares without case
 #include <memory>        // unique_ptr — frees the upload buffer on every exit path
 #include <new>           // std::nothrow for the OtaTaskParams alloc below
 
@@ -656,26 +657,26 @@ bool otaHasMoonBase() {
     return moonBasePartition() != nullptr;
 }
 
-// Which recovery image this device carries: @xref{reporting-on-the-recovery-image|why it is read here rather than asked of it}.
-bool otaMoonBaseVersion(char* out, size_t len) {
+// MoonBase's app descriptor into `desc`, with `out` emptied for the caller to fill; false without a buffer, a MoonBase or a descriptor.
+static bool moonBaseDescription(char* out, size_t len, esp_app_desc_t& desc) {
     if (!out || len == 0) return false;
     out[0] = 0;
     const esp_partition_t* part = moonBasePartition();
-    if (!part) return false;
+    return part && esp_ota_get_partition_description(part, &desc) == ESP_OK;
+}
+
+// Which recovery image this device carries: @xref{reporting-on-the-recovery-image|why it is read here rather than asked of it}.
+bool otaMoonBaseVersion(char* out, size_t len) {
     esp_app_desc_t desc = {};
-    if (esp_ota_get_partition_description(part, &desc) != ESP_OK) return false;
+    if (!moonBaseDescription(out, len, desc)) return false;
     std::snprintf(out, len, "%.*s", static_cast<int>(sizeof(desc.version)), desc.version);
     return out[0] != 0;
 }
 
 // When MoonBase was built, from the same descriptor. The UI shows the app's build stamp beside its version, and shows the same pair for MoonBase, so this is the other half of that.
 bool otaMoonBaseBuild(char* out, size_t len) {
-    if (!out || len == 0) return false;
-    out[0] = 0;
-    const esp_partition_t* part = moonBasePartition();
-    if (!part) return false;
     esp_app_desc_t desc = {};
-    if (esp_ota_get_partition_description(part, &desc) != ESP_OK) return false;
+    if (!moonBaseDescription(out, len, desc)) return false;
     std::snprintf(out, len, "%.*s %.*s",
                   static_cast<int>(sizeof(desc.date)), desc.date,
                   static_cast<int>(sizeof(desc.time)), desc.time);
@@ -746,26 +747,114 @@ bool httpsAvailable() MM_NONBLOCKING {
     return true;   // the TLS stack is linked for OTA, so an ESP32 build can always try
 }
 
-bool httpsPost(const char* url, const char* body, uint32_t timeoutMs) {
-    if (!url || !*url) return false;
+bool tlsRoom(const char* url) {
+#ifdef CONFIG_MBEDTLS_EXTERNAL_MEM_ALLOC
+    (void)url;   // TLS buffers sit in PSRAM on this board, so a session takes no internal RAM
+    return true;
+#else
+    if (!url || std::strncmp(url, "https://", 8) != 0) return true;
+    return freeInternalHeap() >= kInternalFreeFloor + kTlsSessionBytes;
+#endif
+}
+
+namespace {
+
+/// `url` with a `.local` host replaced by its mDNS address into `out`, since the client resolves through DNS alone. False when it names none or the lookup failed.
+bool resolveLocal(const char* url, char* out, size_t cap) {
+    const char* host = std::strstr(url, "://");
+    if (!host) return false;
+    host += 3;
+    const char* end = host;
+    while (*end && *end != ':' && *end != '/') end++;
+    const size_t len = static_cast<size_t>(end - host);
+    if (len < 7 || len >= 64 || strncasecmp(end - 6, ".local", 6) != 0) return false;
+    char name[64];
+    std::memcpy(name, host, len);
+    name[len] = '\0';
+    uint8_t ip[4];
+    if (!resolveHost(name, ip)) return false;
+    const int n = std::snprintf(out, cap, "%.*s%u.%u.%u.%u%s", static_cast<int>(host - url), url,
+                                ip[0], ip[1], ip[2], ip[3], end);
+    return n > 0 && static_cast<size_t>(n) < cap;
+}
+
+esp_http_client_method_t methodOf(const char* method) {
+    if (std::strcmp(method, "POST") == 0) return HTTP_METHOD_POST;
+    if (std::strcmp(method, "PATCH") == 0) return HTTP_METHOD_PATCH;
+    if (std::strcmp(method, "PUT") == 0) return HTTP_METHOD_PUT;
+    if (std::strcmp(method, "DELETE") == 0) return HTTP_METHOD_DELETE;
+    return HTTP_METHOD_GET;
+}
+
+/// Read past the answer, for a caller that keeps none; false when it was cut off.
+bool drainAnswer(esp_http_client_handle_t client) {
+    char discard[64];
+    int got;
+    while ((got = esp_http_client_read(client, discard, sizeof(discard))) > 0) {}
+    return got == 0;
+}
+
+/// Read the answer to its end into `body`. False when it outgrows the buffer or is cut off: refused rather than handed back half.
+bool readAnswer(esp_http_client_handle_t client, char* body, size_t bodyLen) {
+    if (!body || !bodyLen) return drainAnswer(client);
+    size_t len = 0;
+    int got = 1;
+    while (got > 0 && len + 1 < bodyLen) {
+        got = esp_http_client_read(client, body + len, static_cast<int>(bodyLen - 1 - len));
+        if (got > 0) len += static_cast<size_t>(got);
+    }
+    // The end reached is whole; a full buffer with more behind it outgrew it, and a failed read was cut off.
+    char probe;
+    const bool whole = got == 0 || (got > 0 && esp_http_client_read(client, &probe, 1) == 0);
+    body[whole ? len : 0] = '\0';
+    return whole;
+}
+
+/// Whether the answer read was all of it. A declared length or a chunked body proves it; one the server ends by closing, as MoonLight's own state route answers, is whole once the reads end.
+bool answerComplete(esp_http_client_handle_t client) {
+    const bool framed = esp_http_client_is_chunked_response(client) || esp_http_client_get_content_length(client) >= 0;
+    return !framed || esp_http_client_is_complete_data_received(client);
+}
+
+/// Send the request with its body and read the answer; the status, or 0 when it failed, was cut short or outgrew the buffer.
+int exchange(esp_http_client_handle_t client, const char* reqBody, char* body, size_t bodyLen) {
+    const int reqLen = reqBody ? static_cast<int>(std::strlen(reqBody)) : 0;
+    if (reqBody) esp_http_client_set_header(client, "Content-Type", "application/json");
+    if (esp_http_client_open(client, reqLen) != ESP_OK) return 0;
+    int status = 0;
+    if (reqLen == 0 || esp_http_client_write(client, reqBody, reqLen) == reqLen) {
+        esp_http_client_fetch_headers(client);
+        status = esp_http_client_get_status_code(client);
+        if (!readAnswer(client, body, bodyLen) || !answerComplete(client)) status = 0;
+    }
+    esp_http_client_close(client);
+    return status;
+}
+
+}  // namespace
+
+int httpFetch(const char* method, const char* url, const char* reqBody, uint32_t timeoutMs,
+              char* body, size_t bodyLen) {
+    if (body && bodyLen) body[0] = '\0';
+    if (!method || !url || !*url) return 0;
+    if (!tlsRoom(url)) return 0;
+    char resolved[192];
+    if (resolveLocal(url, resolved, sizeof(resolved))) url = resolved;
 
     esp_http_client_config_t cfg = {};
     cfg.url = url;
-    cfg.method = HTTP_METHOD_POST;
     cfg.timeout_ms = static_cast<int>(timeoutMs);
     // The SAME trust-anchor bundle the OTA path uses: IDF's built-in root certificates, so this verifies a public server without us shipping or maintaining a CA store.
     cfg.crt_bundle_attach = esp_crt_bundle_attach;
+    cfg.method = methodOf(method);
+    // No redirect following: a server moving the request somewhere the caller never named is refused.
+    cfg.disable_auto_redirect = true;
 
     esp_http_client_handle_t client = esp_http_client_init(&cfg);
-    if (!client) return false;
-
-    esp_http_client_set_header(client, "Content-Type", "application/json");
-    esp_http_client_set_post_field(client, body ? body : "", body ? std::strlen(body) : 0);
-
-    const esp_err_t err = esp_http_client_perform(client);
-    const int status = (err == ESP_OK) ? esp_http_client_get_status_code(client) : 0;
+    if (!client) return 0;
+    const int status = exchange(client, reqBody, body, bodyLen);
     esp_http_client_cleanup(client);
-    return err == ESP_OK && status >= 200 && status < 300;
+    return status;
 }
 
 } // namespace mm::platform
diff --git a/src/platform/esp32/platform_esp32_parlio.cpp b/src/platform/esp32/platform_esp32_parlio.cpp
index d2ee217a4..93d87bda0 100644
--- a/src/platform/esp32/platform_esp32_parlio.cpp
+++ b/src/platform/esp32/platform_esp32_parlio.cpp
@@ -44,7 +44,6 @@
 
 #include <cstring>
 #include <functional>  // the transmit callback passed to the shared frame loopback
-#include <new>      // placement new (the state is built in heap_caps memory)
 
 namespace mm::platform {
 
@@ -59,7 +58,7 @@ constexpr size_t kMaxBusWidth = 16;   // both peripherals' physical ceiling
 constexpr uint32_t kPclkHz = 2'666'666;
 
 // Two frame buffers for the deferred-wait double buffer, the same shape the sibling backend uses, the second null when its allocation did not fit. Transfers complete in order and the event carries no token, so the same two-slot queue routes each signal to the buffer that finished.
-struct ParlioState {
+struct ParlioState : platform::InternalRamObject {
     parlio_tx_unit_handle_t unit = nullptr;
     SemaphoreHandle_t done[2] = {nullptr, nullptr};
     uint8_t* buf[2] = {nullptr, nullptr};
@@ -90,10 +89,6 @@ bool IRAM_ATTR parlioDoneCb(parlio_tx_unit_handle_t, const parlio_tx_done_event_
     return high == pdTRUE;
 }
 
-// The struct is placement-new'd into heap_caps_aligned_alloc'd memory using alignof(ParlioState), so any alignment it needs is honoured by construction. This pins the assumption that the value is a power of two the allocator accepts, a member needing more would otherwise fail silently.
-static_assert(alignof(ParlioState) <= 16 && (alignof(ParlioState) & (alignof(ParlioState) - 1)) == 0,
-              "ParlioState alignment must be a small power of two for heap_caps_aligned_alloc");
-
 void destroyState(ParlioState* st) {
     if (!st) return;
     if (st->unit) {
@@ -102,20 +97,14 @@ void destroyState(ParlioState* st) {
     }
     for (auto* b : st->buf) if (b) heap_caps_free(b);
     for (auto* s : st->done) if (s) vSemaphoreDelete(s);
-    st->~ParlioState();     // placement-new'd into heap_caps memory, so destroy and free by hand
-    heap_caps_free(st);
+    delete st;
 }
 
 // One TX unit + DMA buffer(s). pclkHz is the WS2812 slot rate (2.67 MHz). `wantSecond` allocates the async double-buffer's second frame buffer (best-effort); false → buffer 0 only.
 ParlioState* createState(const uint16_t* dataPins, uint8_t laneCount,
                          uint32_t pclkHz, size_t bufferBytes, bool wantSecond) {
-    // Internal memory rather than a plain allocation, since the default allocator may hand back external memory while the completion callback runs cache-safe and fires when that is unreachable.
-    // Every field it touches must therefore be internal, and construction is in place because the allocator gives raw memory.
-    // Aligned explicitly: the struct holds wide timestamps while the allocator promises only word alignment, which the assertion below pins.
-    void* mem = heap_caps_aligned_alloc(alignof(ParlioState), sizeof(ParlioState),
-                                        MALLOC_CAP_INTERNAL | MALLOC_CAP_8BIT);
-    if (!mem) return nullptr;
-    auto* st = new (mem) ParlioState();
+    auto* st = new (std::nothrow) ParlioState();
+    if (!st) return nullptr;
 
     parlio_tx_unit_config_t cfg = {};
     cfg.clk_src = PARLIO_CLK_SRC_DEFAULT;     // PLL_F160M → /60 = 2.67 MHz
diff --git a/src/platform/platform.h b/src/platform/platform.h
index e9c0951f7..e26c44778 100644
--- a/src/platform/platform.h
+++ b/src/platform/platform.h
@@ -3,6 +3,7 @@
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
+#include <new>      // std::nothrow_t, for InternalRamObject's allocation
 #include "platform_config.h"  // hasOta / hasPsram / …: flags this header's contract refers to
 #include "nonblocking.h"      // MM_NONBLOCKING, which every declaration below carries
 
@@ -62,9 +63,13 @@ void setTestNowMs(uint32_t ms);
 
 /// Make the next bind fail, so a test reaches that path; false restores. Hogging the port instead is not portable: Linux permits the overlapping bind under SO_REUSEADDR, and macOS lets a non-root process bind port 80.
 void setTestBindFails(bool fail);
-#ifndef ESP_PLATFORM   // a host-test seam, which no ESP32 code calls
+#ifndef ESP_PLATFORM   // host-test seams, which no ESP32 code calls
 /// Make the next multicast join fail, as on a network without multicast; false restores.
 void setTestJoinFails(bool fail);
+/// Report this much free internal RAM, as a board without PSRAM under load would; 0 restores the desktop's unreported figure.
+void setTestFreeInternalHeap(size_t bytes);
+/// Report addresses in [begin, end) as PSRAM, as a board with PSRAM places a buffer; null restores the desktop's none.
+void setTestPsramRange(const void* begin, const void* end);
 #endif
 
 /// Allocate, preferring PSRAM where the target has it.
@@ -75,6 +80,16 @@ void free(void* ptr);
 /// Allocate internal RAM only, for buffers a hot ISR reads per byte; free with `free`: @xref{internal-ram-for-what-an-interrupt-reads}.
 void* allocInternal(size_t bytes);
 
+/// A type a cache-safe interrupt reads inherits this, so `new` places it in internal RAM. PSRAM sits behind the flash cache, which a flash write on the other core can switch off mid-interrupt.
+struct InternalRamObject {
+    /// Internal RAM, or null when there is none to give.
+    static void* operator new(size_t bytes) noexcept { return allocInternal(bytes); }
+    /// The same, for `new (std::nothrow)`.
+    static void* operator new(size_t bytes, const std::nothrow_t&) noexcept { return allocInternal(bytes); }
+    /// Return the allocation above.
+    static void operator delete(void* ptr) noexcept { free(ptr); }
+};
+
 /// Bytes taken on purpose through alloc and allocInternal.
 size_t allocatedBytes();
 /// The high-water mark of allocatedBytes.
@@ -99,7 +114,7 @@ void  writeExec(void* dst, const void* src, size_t len);
 /// Give the scheduler a turn.
 void yield();
 
-/// Which core the caller runs on; a driver seeing core 1 knows the render/encode split is engaged.
+/// Which core the caller runs on, safe in an ISR; a driver seeing core 1 knows the render/encode split is engaged.
 uint8_t currentCore();
 /// Upper bound on cores running driver code at once, sizing per-CPU scratch; single-core targets leave slice 1 unused.
 inline constexpr uint8_t kMaxCores = 2;
@@ -218,6 +233,8 @@ size_t totalInternalHeap();
 
 /// Heap to keep free for stack, HTTP, WiFi and overhead; any allocator checks against this before committing.
 constexpr size_t HEAP_RESERVE = 32768;
+/// The internal RAM a board keeps free, which an allocator that takes what is left stops at: WiFi, HTTP and the UI need it.
+constexpr size_t kInternalFreeFloor = 100 * 1024;
 
 /// The device's MAC address.
 void getMacAddress(uint8_t mac[6]);
@@ -811,12 +828,25 @@ void moonbaseClearStagedUrl();
 int httpRequest(const char* method, const char* host, uint16_t port, const char* path,
                 const char* reqBody, uint32_t timeoutMs, char* body, size_t bodyLen);
 
-/// One HTTPS POST to a public server, answering the status or 0; `url` is a full URL, so a hostname resolves.
-bool httpsPost(const char* url, const char* body, uint32_t timeoutMs);
+/// One request to a full `http://` or `https://` URL: the method, an optional JSON body, and the answer into `body` when there is room. The HTTP status, or 0 when it failed or did not fit; it blocks, so only a background task calls it.
+int httpFetch(const char* method, const char* url, const char* reqBody, uint32_t timeoutMs,
+              char* body, size_t bodyLen);
 
 /// Whether this build can make an outbound HTTPS request at all.
 bool httpsAvailable() MM_NONBLOCKING;
 
+/// Internal RAM one TLS session holds while it lasts, on a board whose TLS buffers cannot go to PSRAM: two record buffers and the handshake.
+inline constexpr size_t kTlsSessionBytes = 45 * 1024;
+
+/// Whether a request to `url` may start now. HTTPS on a board whose TLS lives in internal RAM waits while that RAM is under the floor plus one session, which would starve WiFi and the web server.
+bool tlsRoom(const char* url);
+
+#ifndef ESP_PLATFORM   // a host-test seam, which no ESP32 code calls
+/// Answer `httpFetch` from a test instead of the network, by the same signature; null restores the network.
+using HttpFetchFn = int (*)(const char* method, const char* url, const char* reqBody, char* body, size_t bodyLen);
+void setTestHttpFetch(HttpFetchFn fn);
+#endif
+
 // Improv provisioning over UART0, sharing the channel with logging, which writes registers directly.
 
 /// What Improv tells the client about this device; the task copies the strings, so pass static storage.
@@ -1126,6 +1156,12 @@ constexpr uint8_t kRingBufsDefault = 16;
 constexpr uint8_t kRingPadMaxUs = 120;
 /// The most bytes one GDMA descriptor node carries.
 constexpr size_t kRingNodeMaxBytes = 4095;
+/// Buffers the refill keeps clear behind the drain, so it never writes one the DMA may still read.
+constexpr uint32_t kRingRefillGap = 2;
+/// The ring's lead over the wire, in rows, that ringAuto sizes to. On a 3,840-light expander rig 40 rows lost frames and 45 ran clean, so 45 plus a fifth.
+constexpr uint32_t kRingLeadRows = 54;
+/// Rows per buffer under ringAuto: finer slices waste less of the lead to the refill's whole-slice steps, and one-row slices interrupt faster than the refill keeps up.
+constexpr uint8_t kRingAutoRows = 3;
 /// The deepest ring pool, which keeps every slice encoded before arming even at 48 by 256.
 constexpr uint8_t kRingBufsMax = 64;
 /// The shallowest ring pool.
@@ -1141,10 +1177,6 @@ bool moonI80Ws2812InitRing(MoonI80Ws2812Handle& h, const uint16_t* dataPins, uin
 bool moonI80Ws2812TransmitRing(MoonI80Ws2812Handle& h);
 /// Set the '595 shift-clock prescale off the 80 MHz bus, taking effect on the next bus build.
 void moonI80SetShiftClockDiv(uint8_t div);
-/// Prime a sub-range of the pool, so two cores can prime disjoint ranges at once.
-void moonI80Ws2812PrimeRange(MoonI80Ws2812Handle& h, uint8_t bufLo, uint8_t bufHi);
-/// Arm the ring once everything is primed.
-bool moonI80Ws2812ArmRing(MoonI80Ws2812Handle& h);
 
 /// Whether this handle came up as a ring, which tells the driver which transmit to call.
 bool moonI80Ws2812IsRing(const MoonI80Ws2812Handle& h);
@@ -1177,7 +1209,10 @@ struct MoonI80RingStats {
     uint32_t descErr = 0;        ///< descriptor errors, where anything above 0 means the chain was corrupted
     uint32_t maxEncodeUs = 0;    ///< worst refill-encode time, the producer's jitter
     uint32_t avgEncodeUs = 0;    ///< average refill-encode time, which decides whether the ring keeps up
-    uint32_t maxIsrGapUs = 0;    ///< worst gap between interrupts, which is the drain deadline
+    uint32_t maxIsrGapUs = 0;    ///< worst gap between interrupts within a frame, which is the drain deadline
+    int32_t  minLead = -1;       ///< fewest slices the refill was ahead of the drain when an interrupt came, -1 before any
+    uint32_t maxGapAtSlice = 0;  ///< the drain position where the worst gap ended, telling a frame-start stall from a random one
+    uint8_t  isrCore = 0;        ///< the core the refill interrupt runs on
     uint32_t late = 0;           ///< slices refilled after their drain began, each one stale on the wire
     uint32_t itemsPerBuf = 0;    ///< descriptor nodes a ring buffer takes, 1 since the clamp
     int32_t  termNodeDiag = -1;  ///< the mount-time terminator node, -1 on a lapping chain
@@ -1185,7 +1220,7 @@ struct MoonI80RingStats {
     uint32_t cacheOffMaxRun = 0; ///< worst run of those, which is how many buffers drained un-refilled
     uint32_t stallAbandons = 0;  ///< frames the wait backstop finalized after the DMA self-terminated
 };
-/// Read the ring's counters.
+/// Read the ring's counters; the worst gap and the fewest lead cover the time since the previous read.
 MoonI80RingStats moonI80Ws2812RingStats(const MoonI80Ws2812Handle& h);
 
 /// Release the bus and its buffers.
diff --git a/src/platform/teensy/platform_teensy.cpp b/src/platform/teensy/platform_teensy.cpp
index 3d033cc7e..fdbd3fa2a 100644
--- a/src/platform/teensy/platform_teensy.cpp
+++ b/src/platform/teensy/platform_teensy.cpp
@@ -73,6 +73,8 @@ void free(void* ptr) {
 
 void* allocInternal(size_t bytes) { return alloc(bytes); }   // one RAM, no PSRAM to keep out of
 
+bool ptrIsPsram(const void* /*p*/) { return false; }   // alloc never reaches the optional PSRAM chip
+
 size_t allocatedBytes() { return g_allocatedBytes; }
 size_t allocatedPeak() { return g_allocatedPeak; }
 uint32_t allocatedCount() { return g_allocCount; }
@@ -538,7 +540,11 @@ int httpRequest(const char*, const char*, uint16_t, const char*, const char*, ui
     return 0;
 }
 bool httpsAvailable() MM_NONBLOCKING { return false; }
-bool httpsPost(const char*, const char*, uint32_t) { return false; }
+int httpFetch(const char*, const char*, const char*, uint32_t, char* body, size_t bodyLen) {
+    if (body && bodyLen) body[0] = '\0';
+    return 0;
+}
+bool tlsRoom(const char* url) { return !url || std::strncmp(url, "https://", 8) != 0; }   // only HTTPS waits, and this board has no TLS
 bool hlsSegment(const char*, const uint8_t**, size_t*) { return false; }
 void hlsSegmentRelease() {}
 
diff --git a/src/platform/teensy/platform_teensy_fs.cpp b/src/platform/teensy/platform_teensy_fs.cpp
index fd4876214..51d7e26cb 100644
--- a/src/platform/teensy/platform_teensy_fs.cpp
+++ b/src/platform/teensy/platform_teensy_fs.cpp
@@ -155,6 +155,12 @@ bool fsMkdir(const char* apiPath) {
     return fs->exists(path);
 }
 
+bool fsExists(const char* apiPath) {
+    const char* path = nullptr;
+    FS* fs = fsFor(apiPath, path);
+    return fs && fs->exists(path);
+}
+
 bool fsRemove(const char* apiPath) {
     const char* path = nullptr;
     FS* fs = fsFor(apiPath, path);
diff --git a/src/ui/app.js b/src/ui/app.js
index 6620f0108..a6ee9a205 100644
--- a/src/ui/app.js
+++ b/src/ui/app.js
@@ -221,6 +221,7 @@ function connectWs() {
                     updateValues();
                     walker?.update(state);
                     relayMoonCloudOutbox();
+                    downloadMissingScripts();
                     // A targetFps slider move arrives as a PATCH, and the preview controller aims
                     // at whatever it last heard: without this, the advertised detail/smoothness
                     // chooser only takes effect on the next reconnect.
@@ -235,6 +236,7 @@ function connectWs() {
             state = data;
             if (helpPending) loadHelp();
             relayMoonCloudOutbox();
+            downloadMissingScripts();
             // Defer the DOM rebuild while the user is mid-interaction: rebuilding under an open dropdown makes it unselectable. The state is stored above, so updateValues() still shows fresh values, and renderIfDeferred draws the structure once the edit ends.
             if (userIsEditing()) {
                 structuralRenderPending = true;
@@ -6119,7 +6121,7 @@ function updateStatusBar() {
         }
     }
 
-    // System stats: "uptime · 🧠 NNK · 🧱 NNKB"
+    // System stats: "uptime · 🧠 NNKB · 🧱 NNKB"
     // 🧠 = internal-RAM free (heap progress total−used); 🧱 = largest contiguous
     // internal-RAM block (the maxBlock control, already maxInternalAllocBlock).
     // Both matter: free can be ample while fragmentation leaves no single block
@@ -6141,7 +6143,7 @@ function updateStatusBar() {
         }
         if (heapCtrl && heapCtrl.value !== undefined && heapCtrl.total) {
             const freeKb = Math.round((heapCtrl.total - heapCtrl.value) / 1024);
-            parts.push("🧠 " + freeKb + "K");
+            parts.push("🧠 " + freeKb + "KB");
         }
         // Skip on desktop, where the platform stub reports "0KB" (no real
         // block measurement / unlimited heap): same reason heap free above
@@ -6462,16 +6464,37 @@ function mlGroupForExt(ext) {
          : ext === ".mlp" ? "palettes" : null;
 }
 
-/// The collection a catalog group files a script under, "" for one at the kind's root or not in the catalog.
-function mlSubOf(g, name) {
-    return (g.sub || [])[(g.names || []).indexOf(name)] || "";
+/// The folder a catalog group files a script under, such as `effects/basics`, or the group's own folder for a script the catalog does not list.
+function mlFolderOf(g, name, group) {
+    return (g.folder || [])[(g.names || []).indexOf(name)] || group;
 }
 
-/// Where a script lives in the repo: in its subfolder when the catalog names one, at the kind's root otherwise. The device keeps every script flat.
+/// Where a script lives in the repo: in the folder the catalog names, at its kind's folder when the catalog lacks it. The device keeps every script flat.
 function mlRepoPath(cat, group, name) {
     const g = (cat && cat[group]) || {};
-    const sub = mlSubOf(g, name);
-    return "moonlive/" + (g.folder || group) + "/" + (sub ? sub + "/" : "") + name;
+    return "moonlive/" + mlFolderOf(g, name, group) + "/" + name;
+}
+
+// A module naming a shipped script the device lacks lists it in System's hidden `missing scripts`; the open page downloads each through the picker's own path, and the device compiles it once it lands.
+// A name is tried once a minute at most, so a failing download is not repeated with every state patch, and one that worked has left the list by then.
+let mlMissingBusy = false;
+const mlMissingTried = new Map();   // name -> when its download was last started
+async function downloadMissingScripts() {
+    if (mlMissingBusy) return;
+    // Found by the control's own name, which no other module uses, so the page names no module type.
+    const raw = allModules().flatMap(m => m.controls || []).find(c => c.name === "missing scripts")?.value;
+    if (!raw) return;
+    mlMissingBusy = true;
+    try {
+        for (const name of raw.split("|").filter(Boolean)) {
+            const group = mlGroupForExt(name.slice(name.lastIndexOf(".")));
+            if (!group || Date.now() - (mlMissingTried.get(name) || 0) < 60000) continue;
+            mlMissingTried.set(name, Date.now());
+            await mlDownloadScript(name, group).catch(() => {});
+        }
+    } finally {
+        mlMissingBusy = false;
+    }
 }
 
 // Download one factory script and save it to the device.
@@ -6485,7 +6508,7 @@ function mlRepoPath(cat, group, name) {
 // engine that will run it rather than whatever main happens to hold.
 async function mlDownloadScript(name, group) {
     const cat = await mlFetchCatalog();
-    if (!(cat[group] || {}).folder) throw new Error("unknown script kind");
+    if (!cat[group]) throw new Error("unknown script kind");
     const url = "https://raw.githubusercontent.com/MoonModules/MoonLight/"
               + encodeURIComponent(cat.tag) + "/" + mlRepoPath(cat, group, name).split("/").map(encodeURIComponent).join("/");
     const res = await fetch(url);
@@ -8754,11 +8777,11 @@ function buildFilePathControl(row, label, key, moduleName, ctrl) {
             if (g.dim && DIM_EMOJI[g.dim[i]]) marks.push(DIM_EMOJI[g.dim[i]]);
             return marks.length ? marks.join("") + " " : "";
         };
-        // The collection a factory script belongs to upstream, its subfolder, after the name: one library still, with its groups named.
+        // The collection a factory script belongs to upstream, its folder's name, after the name: one library still, with its groups named.
         const from = (n) => {
             const g = cat && cat[group];
-            const sub = g ? mlSubOf(g, n) : "";
-            return sub ? " \u00b7 " + sub : "";
+            const folder = g ? mlFolderOf(g, n, group) : group;
+            return folder !== group ? " \u00b7 " + folder.split("/").pop() : "";
         };
         for (const n of names) {
             const o = document.createElement("option");
diff --git a/teensy/CMakeLists.txt b/teensy/CMakeLists.txt
index e0a60232a..0402be2ae 100644
--- a/teensy/CMakeLists.txt
+++ b/teensy/CMakeLists.txt
@@ -63,9 +63,8 @@ add_custom_command(
     DEPENDS ${UI_SOURCES} ${REPO}/src/ui/embed_ui.cmake
     COMMENT "Embedding UI files")
 add_custom_target(ui_embed DEPENDS ${REPO}/src/ui/ui_embedded.h)
-file(GLOB MOONLIVE_SCRIPTS CONFIGURE_DEPENDS
-     ${REPO}/moonlive/effects/*.mle ${REPO}/moonlive/layouts/*.mll ${REPO}/moonlive/modifiers/*.mlm
-     ${REPO}/moonlive/services/*.mls ${REPO}/moonlive/palettes/*.mlp)
+file(GLOB_RECURSE MOONLIVE_SCRIPTS CONFIGURE_DEPENDS
+     ${REPO}/moonlive/*.mle ${REPO}/moonlive/*.mll ${REPO}/moonlive/*.mlm ${REPO}/moonlive/*.mls ${REPO}/moonlive/*.mlp)
 set(MOONLIVE_CATALOG_STAMP ${CMAKE_BINARY_DIR}/moonlive_catalog.stamp)
 add_custom_command(
     OUTPUT ${MOONLIVE_CATALOG_STAMP}
@@ -99,6 +98,7 @@ add_executable(MoonLight.elf
     ${REPO}/src/module_types.cpp
     ${REPO}/src/core/module/Control.cpp
     ${REPO}/src/core/util/JsonUtil.cpp
+    ${REPO}/src/core/util/JsonFetch.cpp
     ${REPO}/src/core/util/parse.cpp
     ${REPO}/src/core/util/ScratchBuffer.cpp
     ${REPO}/src/core/system/HttpServerModule.cpp
diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
index d600973c2..bbec400d8 100644
--- a/test/CMakeLists.txt
+++ b/test/CMakeLists.txt
@@ -32,6 +32,7 @@ add_executable(mm_tests
     unit/core/unit_ButtonService.cpp
     unit/core/unit_GamepadService.cpp
     unit/core/unit_MoonLiveService.cpp
+    unit/core/unit_MoonLiveService_json.cpp
     unit/core/unit_InfraredService.cpp
     unit/core/unit_TcpConnect.cpp
     unit/core/unit_MqttPacket.cpp
@@ -67,6 +68,8 @@ add_executable(mm_tests
     unit/core/unit_ImprovOpReassembler.cpp
     unit/core/unit_JsonUtil_parse.cpp
     unit/core/unit_JsonUtil_parseint.cpp
+    unit/core/unit_JsonUtil_pointer.cpp
+    unit/core/unit_JsonFetch.cpp
     unit/core/unit_JsonSink_detach.cpp
     unit/core/unit_JsonSink_number.cpp
     unit/core/unit_JsonSink_overflow.cpp
@@ -97,10 +100,12 @@ add_executable(mm_tests
     unit/core/unit_sanitizeHostname.cpp
     unit/core/unit_platform_clock.cpp
     unit/core/unit_platform_worker.cpp
+    unit/core/unit_platform_httpfetch.cpp
     unit/core/unit_HostList.cpp
     unit/core/unit_Addressing.cpp
     unit/core/unit_HostResolver.cpp
     unit/core/unit_OscService.cpp
+    unit/core/unit_Scheduler_prepareScope.cpp
     unit/core/unit_Scheduler_unique_names.cpp
     unit/core/unit_MoonStatsModule.cpp
     unit/core/unit_MoonTalkModule.cpp
@@ -232,6 +237,7 @@ add_executable(mm_tests
     unit/light/unit_RandomMapModifier.cpp
     unit/light/unit_RotateModifier.cpp
     unit/light/unit_RegionModifier.cpp
+    unit/light/unit_RegionModifier_prepareScope.cpp
     unit/light/unit_PinwheelModifier.cpp
     unit/light/unit_ParticlesEffect.cpp
     unit/light/unit_PlasmaEffect.cpp
@@ -306,6 +312,8 @@ set_tests_properties(unit_tests PROPERTIES
 # firmware has: src/module_types.cpp carries the reason.
 add_executable(mm_scenarios scenario_runner.cpp ${CMAKE_SOURCE_DIR}/src/module_types.cpp)
 target_link_libraries(mm_scenarios PRIVATE mm_core mm_platform)
+# A write_file step's `from` names a file in the repository, such as a shipped script.
+target_compile_definitions(mm_scenarios PRIVATE MM_REPO_ROOT="${CMAKE_SOURCE_DIR}")
 
 # Kernel micro-bench: ns per call for the power-function kernels, on the host. A report, not a
 # test (no ctest registration): the numbers go into performance.md and gate a kernel swap.
diff --git a/test/js/ui-gallery.test.mjs b/test/js/ui-gallery.test.mjs
index 5ce11a62a..cb94981d6 100644
--- a/test/js/ui-gallery.test.mjs
+++ b/test/js/ui-gallery.test.mjs
@@ -190,10 +190,10 @@ test("a thumbnail path from the index stays inside the gallery repository", () =
     assert.equal(g.galleryPath(undefined), null);
 });
 
-test("a shipped script's repo path carries its subfolder, and a script the catalog lacks sits at its kind's root", () => {
-    const mlRepoPath = new Function(`${fnSource("mlSubOf")}\nreturn ${fnSource("mlRepoPath")}`)();
-    const cat = { effects: { folder: "effects", names: ["dot.mle", "fire.mle"], sub: ["basics", "hpwit"] } };
-    assert.equal(mlRepoPath(cat, "effects", "fire.mle"), "moonlive/effects/hpwit/fire.mle");
+test("a shipped script's repo path is its catalog folder, and a script the catalog lacks sits at its kind's folder", () => {
+    const mlRepoPath = new Function(`${fnSource("mlFolderOf")}\nreturn ${fnSource("mlRepoPath")}`)();
+    const cat = { effects: { names: ["dot.mle", "fire.mle"], folder: ["effects/basics", "projects/hpwit"] } };
+    assert.equal(mlRepoPath(cat, "effects", "fire.mle"), "moonlive/projects/hpwit/fire.mle");
     assert.equal(mlRepoPath(cat, "effects", "mine.mle"), "moonlive/effects/mine.mle");
     assert.equal(mlRepoPath(null, "effects", "mine.mle"), "moonlive/effects/mine.mle");
 });
diff --git a/test/js/ui-missing-scripts.test.mjs b/test/js/ui-missing-scripts.test.mjs
new file mode 100644
index 000000000..5a3eb9312
--- /dev/null
+++ b/test/js/ui-missing-scripts.test.mjs
@@ -0,0 +1,47 @@
+// A module naming a shipped script the device lacks lists it on System; the open page downloads it, the picker's own path.
+//
+// Run: `node --test test/js`.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { fnSource } from "./app-source.mjs";
+
+/// The page's download loop over a stand-in device: `missing` is System's hidden control, and each download is recorded.
+function page(missing, failing = []) {
+    const downloads = [];
+    const modules = [{ name: "Effects", controls: [] }, { name: "System", controls: [{ name: "missing scripts", value: missing }] }];
+    const run = new Function("allModules", "mlDownloadScript",
+        `let mlMissingBusy = false; const mlMissingTried = new Map();
+         ${fnSource("mlGroupForExt")} ${fnSource("downloadMissingScripts")} return downloadMissingScripts;`)(
+        () => modules,
+        async (name, group) => {
+            downloads.push([name, group]);
+            if (failing.includes(name)) throw new Error("download failed");
+        });
+    return { downloads, run, modules };
+}
+
+test("each missing script downloads into its own kind's folder", async () => {
+    const p = page("stadbeest-walk.mle|stadbeest-fire.mlp|jsondemo.mls");
+    await p.run();
+    assert.deepEqual(p.downloads, [["stadbeest-walk.mle", "effects"], ["stadbeest-fire.mlp", "palettes"], ["jsondemo.mls", "services"]]);
+});
+
+test("nothing missing downloads nothing", async () => {
+    const p = page("");
+    await p.run();
+    assert.deepEqual(p.downloads, []);
+});
+
+test("a name is tried once a minute at most, so every state patch does not repeat it", async () => {
+    const p = page("a.mle", ["a.mle"]);
+    await p.run();
+    await p.run();
+    assert.equal(p.downloads.length, 1);
+});
+
+test("a name that is not a script is left alone", async () => {
+    const p = page("notes.txt|x.mle");
+    await p.run();
+    assert.deepEqual(p.downloads, [["x.mle", "effects"]]);
+});
diff --git a/test/python/test_build_esp32_cache.py b/test/python/test_build_esp32_cache.py
index 27c4a6b0f..0429174b7 100644
--- a/test/python/test_build_esp32_cache.py
+++ b/test/python/test_build_esp32_cache.py
@@ -6,7 +6,9 @@
 ROOT = Path(__file__).resolve().parents[2]
 sys.path.insert(0, str(ROOT / "moondeck" / "build"))
 
-from build_esp32 import stale_feature_cache  # noqa: E402
+from build_esp32 import fragment_paths, stale_feature_cache  # noqa: E402
+import build_esp32  # noqa: E402
+import sdkconfig_fragments  # noqa: E402
 
 
 def test_a_plain_build_after_a_versioned_one_reconfigures(tmp_path):
@@ -16,3 +18,44 @@ def test_a_plain_build_after_a_versioned_one_reconfigures(tmp_path):
     assert "MM_VERSION" in (stale_feature_cache(tmp_path, [], "esp32") or "")
     cache.write_text("IDF_TARGET:STRING=esp32\n")
     assert stale_feature_cache(tmp_path, [], "esp32") is None
+
+
+def test_a_value_changed_inside_a_fragment_regenerates_the_sdkconfig(tmp_path, monkeypatch):
+    """IDF seeds sdkconfig from the fragments once, so a changed value inside one is caught by their content, not their list."""
+    monkeypatch.setattr(build_esp32, "ESP32_DIR", tmp_path)
+    (tmp_path / "sdkconfig.defaults").write_text("CONFIG_A=y\n")
+    (tmp_path / "sdkconfig.defaults.board").write_text("CONFIG_B=y\n")
+    paths = fragment_paths(["-DSDKCONFIG_DEFAULTS=sdkconfig.defaults;sdkconfig.defaults.board", "-DMM_FIRMWARE_NAME=\"x\""])
+    assert paths == [tmp_path / "sdkconfig.defaults", tmp_path / "sdkconfig.defaults.board"]
+    build = tmp_path / "build"
+    build.mkdir()
+    value = sdkconfig_fragments.digest(paths)
+    assert sdkconfig_fragments.changed(build, value)       # no record: nothing says what seeded it
+    sdkconfig_fragments.record(build, value)
+    assert not sdkconfig_fragments.changed(build, value)
+    (tmp_path / "sdkconfig.defaults").write_text("CONFIG_A=y\nCONFIG_C=y\n")
+    assert sdkconfig_fragments.changed(build, sdkconfig_fragments.digest(paths))
+
+
+def test_the_fragments_merge_order_is_part_of_what_they_say(tmp_path):
+    """The last fragment setting an option wins, so the same files in another order are another config."""
+    (tmp_path / "a").write_text("CONFIG_X=1\n")
+    (tmp_path / "b").write_text("CONFIG_X=2\n")
+    a, b = tmp_path / "a", tmp_path / "b"
+    assert sdkconfig_fragments.digest([a, b]) != sdkconfig_fragments.digest([b, a])
+
+
+def test_an_unchanged_dir_is_not_reconfigured(tmp_path, monkeypatch):
+    """refresh runs idf.py only when the record disagrees, so an ordinary build stays as fast as before."""
+    ran = []
+    monkeypatch.setattr(sdkconfig_fragments.subprocess, "run", lambda *a, **k: ran.append(a) or type("R", (), {"returncode": 0})())
+    frag = tmp_path / "sdkconfig.defaults"
+    frag.write_text("CONFIG_A=y\n")
+    build = tmp_path / "build"
+    build.mkdir()
+    (build / "sdkconfig").write_text("CONFIG_A=n\n")
+    value = sdkconfig_fragments.refresh(["idf.py"], build, [frag], tmp_path, {})
+    assert len(ran) == 1 and not (build / "sdkconfig").exists()   # changed: deleted and reconfigured
+    sdkconfig_fragments.record(build, value)
+    sdkconfig_fragments.refresh(["idf.py"], build, [frag], tmp_path, {})
+    assert len(ran) == 1
diff --git a/test/python/test_gen_help.py b/test/python/test_gen_help.py
index 5c60fef8f..fb7a0a9bc 100644
--- a/test/python/test_gen_help.py
+++ b/test/python/test_gen_help.py
@@ -281,6 +281,56 @@ def test_a_base_classs_template_method_and_its_helpers_publish_the_controls_a_dr
                                                                            "more": "Two drivers can share one buffer."}
 
 
+STRATEGY = """
+struct ControlList { void addControl(const char*, int&) {} };
+struct Driver;
+struct Peripheral {
+    Driver* owner_ = nullptr;
+    virtual void addBusControls(ControlList&) {}
+    virtual int speed() const { return 0; }
+};
+struct Driver {
+    ControlList controls_;
+    Peripheral* peripheral_ = nullptr;
+    /// The data pins.
+    int pins = 0;
+    /// The write strobe, the board's wiring.
+    int clockPin = 10;
+    /// Freeze each frame before it is sent.
+    int snapshot = 1;
+    int& snapshotRef() { return snapshot; }
+    void defineControls() {
+        controls_.addControl("pins", pins);
+        if (peripheral_) peripheral_->addBusControls(controls_);
+        if (peripheral_) peripheral_->speed();
+    }
+};
+struct FastBus : Peripheral {
+    /// Buffers the DMA circulates.
+    int bufs = 12;
+    void addBusControls(ControlList& c) override {
+        c.addControl("clockPin", owner_->clockPin);
+        c.addControl("bufs", bufs);
+        c.addControl("snapshot", owner_->snapshotRef());
+    }
+};
+struct PlainBus : Peripheral {
+    /// The data/command select.
+    int dcPin = 11;
+    void addBusControls(ControlList& c) override { c.addControl("clockPin", owner_->clockPin); c.addControl("dcPin", dcPin); }
+};
+"""
+
+
+def test_a_strategy_handed_the_control_list_publishes_its_controls_with_their_help(tmp_path):
+    """A driver's peripheral declares controls on the driver's card through a virtual call handed the control list; each implementation can run, so each one's controls take the help on their members, an accessor's member included."""
+    ci, tu = parsed(tmp_path / "Strategy.h", STRATEGY)
+    cls = {c.spelling: c for c in tu.cursor.walk_preorder() if c.kind == ci.CursorKind.STRUCT_DECL and c.is_definition()}
+    assert gen_help.controls_of(cls["Driver"]) == {"pins": "The data pins.", "clockPin": "The write strobe, the board's wiring.",
+                                                  "bufs": "Buffers the DMA circulates.", "snapshot": "Freeze each frame before it is sent.",
+                                                  "dcPin": "The data/command select."}
+
+
 def test_controls_defined_in_the_cpp_beside_the_header_and_through_a_local_add_lambda_count(tmp_path):
     """A class that only declares `defineControls` is read from its `.cpp`, and a lambda named `add…` publishes as a method does."""
     header = tmp_path / "Slot.h"
@@ -469,3 +519,10 @@ def test_the_docs_strip_the_same_role_nouns_the_app_does():
     js = (gen_help.ROOT / "src" / "ui" / "help.js").read_text()
     nouns = _re.search(r"const ROLE_NOUNS = \[([^\]]*)\]", js).group(1)
     assert tuple(_re.findall(r'"(\w+)"', nouns)) == gen_help._ROLE_NOUNS
+
+
+def test_a_cursor_kind_newer_than_the_bindings_reads_as_a_placeholder(tmp_path):
+    """The bindings lag the library they load, so a kind they lack, here the `flag_enum` attribute, reads as a placeholder rather than raising mid-walk."""
+    ci, tu = parsed(tmp_path / "Flags.h", "enum __attribute__((flag_enum)) Flags { A = 1, B = 2 };\n")
+    gen_help.know_every_cursor_kind(ci)
+    assert "ENUM_DECL" in [n.kind.name for n in tu.cursor.walk_preorder()]
diff --git a/test/python/test_live_scenario_runner.py b/test/python/test_live_scenario_runner.py
index 8631eddae..2ff488928 100644
--- a/test/python/test_live_scenario_runner.py
+++ b/test/python/test_live_scenario_runner.py
@@ -237,3 +237,29 @@ def test_a_fixture_naming_a_container_the_run_does_not_restore_is_refused():
     with pytest.raises(ValueError, match="System"):
         runner._fixture_canvas([{"op": "apply_state", "document": {"System": {"deviceName": "x"}}}])
 
+
+
+def _tasks_state(*stacks):
+    tasks = [{"name": n, "stack": s} for n, s in stacks]
+    return {"modules": [{"type": "SystemModule", "children": [
+        {"type": "TasksModule", "controls": [{"name": "tasks", "value": tasks}], "children": []}]}]}
+
+
+def test_the_tightest_stack_is_the_task_with_least_headroom_and_names_it():
+    assert runner._min_stack_free(_tasks_state(("main", 6436), ("improv", 2616), ("wifi", 4260))) == (2616, "improv")
+
+
+def test_a_board_without_a_tasks_card_reports_no_stack():
+    assert runner._min_stack_free({"modules": [{"type": "SystemModule", "children": []}]}) == (None, None)
+
+
+def test_a_floor_passes_at_or_above_and_fails_below_by_more_than_its_tolerance():
+    assert runner._floor_verdict("free_internal", 102400, 102400, 0)[0]
+    assert not runner._floor_verdict("free_internal", 102399, 102400, 0)[0]
+    assert runner._floor_verdict("free_heap", 95000, 100000, 10)[0]
+    assert not runner._floor_verdict("free_heap", 89000, 100000, 10)[0]
+
+
+def test_a_floor_against_a_value_the_device_does_not_report_fails():
+    ok, line = runner._floor_verdict("min_stack_free", None, 512, 0)
+    assert not ok and "reports none" in line
diff --git a/test/python/test_moonlive_catalog_scripts.py b/test/python/test_moonlive_catalog_scripts.py
index dd4b032fd..3e113eabc 100644
--- a/test/python/test_moonlive_catalog_scripts.py
+++ b/test/python/test_moonlive_catalog_scripts.py
@@ -108,27 +108,28 @@ def generate(tmp_path, rel_paths: list) -> tuple:
     return code, out.read_text(encoding="utf-8") if out.exists() else ""
 
 
-def test_a_script_in_a_subfolder_is_cataloged_with_it_for_the_download_url(tmp_path):
+def test_a_script_is_cataloged_with_its_folder_for_the_download_url(tmp_path):
     code, header = generate(tmp_path, ["effects/plain.mle", "effects/hpwit/fire.mle"])
     assert code == 0
-    assert 'kCatalogSubfolders[] = {\n    "",\n    "hpwit",\n};' in header
-    assert "kEffectCatalogSub[] = {\n    0,\n    1,\n};" in header   # in the listing's order, which the build sorts
+    assert 'kCatalogFolders[] = {\n    "effects",\n    "effects/hpwit",\n};' in header
+    assert "kEffectCatalogFolder[] = {\n    0,\n    1,\n};" in header   # in the listing's order, which the build sorts
 
 
-def test_a_subfolder_named_like_a_role_folder_is_still_a_subfolder(tmp_path):
-    code, header = generate(tmp_path, ["effects/effects/fire.mle"])
+def test_a_project_folder_holds_scripts_of_every_role(tmp_path):
+    code, header = generate(tmp_path, ["projects/show/glow.mle", "projects/show/play.mls"])
     assert code == 0
-    assert "kEffectCatalogSub[] = {\n    1,\n};" in header
-    assert '"effects",\n};' in header
+    assert 'kCatalogFolders[] = {\n    "projects/show",\n};' in header
+    assert "kEffectCatalogFolder[] = {\n    0,\n};" in header
+    assert "kServiceCatalogFolder[] = {\n    0,\n};" in header
 
 
-def test_two_scripts_of_one_name_in_different_subfolders_fail_the_build(tmp_path, capsys):
+def test_two_scripts_of_one_name_in_different_folders_fail_the_build(tmp_path, capsys):
     code, _ = generate(tmp_path, ["effects/a/fire.mle", "effects/b/fire.mle"])
     assert code == 1
     assert "duplicate script name fire.mle" in capsys.readouterr().err
 
 
-def test_more_subfolders_than_an_index_holds_fail_the_build(tmp_path, capsys):
-    code, _ = generate(tmp_path, [f"effects/c{i}/s{i}.mle" for i in range(256)])
+def test_more_folders_than_an_index_holds_fail_the_build(tmp_path, capsys):
+    code, _ = generate(tmp_path, [f"effects/c{i}/s{i}.mle" for i in range(257)])
     assert code == 1
-    assert "257th subfolder" in capsys.readouterr().err
+    assert "257th folder" in capsys.readouterr().err
diff --git a/test/python/test_scripts_are_cpp.py b/test/python/test_scripts_are_cpp.py
index 203629f62..ede27e633 100644
--- a/test/python/test_scripts_are_cpp.py
+++ b/test/python/test_scripts_are_cpp.py
@@ -63,6 +63,22 @@ def builtins():
     return sorted(widest.items())
 
 
+def json_builtins():
+    """The JSON builtins, typed: (name, return type, parameter types), from `addJsonBuiltins`.
+
+    Each registration carries which arguments are documents (`jsonArgs`) and which are quoted text (`byStr`), so the C++ signature follows from the table as the compiler's own checks do.
+    """
+    found = []
+    for path in BUILTINS:
+        text = path.read_text(encoding="utf-8")
+        for name, argc, jargs, sargs, jret in re.findall(
+                r'add\("(\w+)",\s*(\d+),\s*&\w+,\s*0x([0-9A-Fa-f]+),\s*0x([0-9A-Fa-f]+),\s*(true|false)', text):
+            j, st = int(jargs, 16), int(sargs, 16)
+            params = ["json" if j >> i & 1 else "string" if st >> i & 1 else "int" for i in range(int(argc))]
+            found.append((name, "json" if jret == "true" else "int", params))
+    return found
+
+
 def structs():
     """Every struct type the tables register: (name, field type, field names), from `addStruct`."""
     found = []
@@ -91,6 +107,8 @@ def prelude() -> str:
         "using byte = uint8_t;",
         "using fixed = int32_t;",
         "using string = const char*;",
+        # A document's handle, which a string literal converts into as the compiler parses one.
+        "struct json { json() = default; json(string) {} };",
     ]
     for v in SYSVARS:
         lines.append(f"inline int {v} = 0;")
@@ -104,6 +122,13 @@ def prelude() -> str:
     # int-only form cannot express a string, and emitting both makes the call ambiguous rather than
     # resolving it.
     byString = {"addControl", "addSelect", "setControl"}
+    typed = json_builtins()
+    assert typed, "no JSON builtins parsed: the addJsonBuiltins shape changed"
+    for name, ret, params in typed:
+        # `json(text)` is the type's own converting constructor in C++, which the struct above declares.
+        if name != "json":
+            lines.append(f"{ret} {name}({', '.join(params)});")
+    byString |= {name for name, _, _ in typed}
     for name, argc in builtins():
         if name in byString:
             continue
diff --git a/test/scenario_runner.cpp b/test/scenario_runner.cpp
index 998c8640a..3415620c7 100644
--- a/test/scenario_runner.cpp
+++ b/test/scenario_runner.cpp
@@ -24,7 +24,7 @@
 /// ## How a scenario value reaches a control
 ///
 /// A `set_control` step finds the module by id and the control by name, writes the typed value, then mirrors `HttpServerModule::handleSetControl`.
-/// That means calling `onControlChanged()` and, when `affectsPrepare()` returns true, triggering `Scheduler::prepareTree()` so the pipeline reconciles.
+/// That means calling `onControlChanged()` and, when `affectsPrepare()` returns true, rebuilding the scope `prepareScope()` names so the pipeline reconciles.
 /// The bridge runs JsonVal through raw JSON text into `mm::applyControlValue`, so this file hand-rolls none of the per-ControlType dispatch that Control.cpp owns.
 /// A tiny `{"v":VALUE}` wrapper built with JsonSink in heap-grow mode carries it, since writeNumber, writeBool and writeJsonString each produce JSON-correct text per JsonVal type.
 /// Re-serialize-then-parse costs nothing worth counting in test code, at most a hundred set_control ops per scenario.
@@ -167,6 +167,7 @@
 #include <cstring>
 #include <cstdlib>
 #include <fstream>
+#include <iterator>   // istreambuf_iterator: a write_file `from` read whole
 
 static void printModuleMemory(mm::MoonModule* mod, int indent) {
     if (!mod) return;
@@ -324,6 +325,18 @@ static JsonVal parseJson(const std::string& text) {
     return parser.parse();
 }
 
+// A file a scenario names by `from`: relative, with no `..` component, so a scenario reads only the repository; `a..b.txt` is a name, not a step up.
+static bool insideRepo(const std::string& rel) {
+    if (rel.empty() || rel[0] == '/' || rel[0] == '\\' || rel.find(':') != std::string::npos) return false;
+    for (size_t start = 0; start <= rel.size();) {
+        size_t end = rel.find_first_of("/\\", start);
+        if (end == std::string::npos) end = rel.size();
+        if (end - start == 2 && rel.compare(start, 2, "..") == 0) return false;
+        start = end + 1;
+    }
+    return true;
+}
+
 static std::string readFile(const char* path) {
     std::ifstream f(path);
     if (!f) return {};
@@ -378,7 +391,12 @@ static bool applySetControl(mm::Scheduler& scheduler,
         if (c.type == mm::ControlType::Select) target->rebuildControls();
         target->onControlChanged(controlName);
         if (target->affectsPrepare(controlName)) {
-            scheduler.prepareTree();
+            // Now rather than at the next frame, over the scope the module names, as the device rebuilds it.
+            mm::MoonModule* const scope = target->prepareScope() == mm::PrepareScope::Self   ? target
+                                        : target->prepareScope() == mm::PrepareScope::Parent ? target->parent()
+                                                                                             : nullptr;
+            if (scope) scheduler.prepareSubtree(scope);
+            else       scheduler.prepareTree();
         }
         return true;
     }
@@ -759,13 +777,28 @@ static int runScenario(const char* path) {
             result.check(holds, name);
         } else if (std::strcmp(op, "write_file") == 0) {
             // Stage a file the way the UI's editor does, a malformed step being a failed scenario: @xref{why-write-file-exists}.
-            if (!step.has("path") || !step.has("value")) {
-                std::printf("  WRITE %s: missing path/value\n", name);
+            if (!step.has("path") || (!step.has("value") && !step.has("from"))) {
+                std::printf("  WRITE %s: missing path, or value/from\n", name);
                 result.check(false, name);
                 continue;
             }
             const char* filePath = step["path"].c_str();
-            const std::string body = step["value"].str;
+            // `from` names a file of the repository instead, such as a shipped script, so its source keeps one home.
+            std::string body = step.has("value") ? step["value"].str : std::string();
+            if (step.has("from")) {
+                if (!insideRepo(step["from"].str)) {
+                    std::printf("  WRITE %s: %s is not a path inside the repository\n", name, step["from"].c_str());
+                    result.check(false, name);
+                    continue;
+                }
+                std::ifstream in(std::string(MM_REPO_ROOT) + "/" + step["from"].str, std::ios::binary);
+                if (!in) {
+                    std::printf("  WRITE %s: %s not found in the repository\n", name, step["from"].c_str());
+                    result.check(false, name);
+                    continue;
+                }
+                body.assign(std::istreambuf_iterator<char>(in), std::istreambuf_iterator<char>());
+            }
             // A FAILED write is a failed scenario rather than a printed note: @xref{why-write-file-exists}.
             const bool wrote = mm::platform::fsWriteAtomic(filePath, body.c_str(), body.size());
             if (wrote) {
diff --git a/test/scenarios/device/scenario_MoonLive_hpwit_effects.json b/test/scenarios/device/scenario_MoonLive_hpwit_effects.json
new file mode 100644
index 000000000..10da24780
--- /dev/null
+++ b/test/scenarios/device/scenario_MoonLive_hpwit_effects.json
@@ -0,0 +1,392 @@
+{
+  "name": "scenario_MoonLive_hpwit_effects",
+  "module": "MoonLiveEffect",
+  "also": [
+    "Layer",
+    "Effects"
+  ],
+  "mode": "mutate",
+  "live_only": true,
+  "description": "Each of hpwit's MoonLive effects alone in one layer over the board's own layout and drivers: its frame time, free internal RAM and largest block, read against the rig with no effect. Each waits 10 s, past the slower seconds that follow a change. The scripts are staged from the repository and removed afterwards, and only the effects are replaced.",
+  "top": [
+    "Effects"
+  ],
+  "steps": [
+    {
+      "name": "stage-edge-comets",
+      "op": "write_file",
+      "path": "/moonlive/edge-comets.mle",
+      "from": "moonlive/projects/hpwit/edge-comets.mle"
+    },
+    {
+      "name": "stage-fire",
+      "op": "write_file",
+      "path": "/moonlive/fire.mle",
+      "from": "moonlive/projects/hpwit/fire.mle"
+    },
+    {
+      "name": "stage-mandala",
+      "op": "write_file",
+      "path": "/moonlive/mandala.mle",
+      "from": "moonlive/projects/hpwit/mandala.mle"
+    },
+    {
+      "name": "stage-particle-fountain",
+      "op": "write_file",
+      "path": "/moonlive/particle-fountain.mle",
+      "from": "moonlive/projects/hpwit/particle-fountain.mle"
+    },
+    {
+      "name": "stage-plasma-ring",
+      "op": "write_file",
+      "path": "/moonlive/plasma-ring.mle",
+      "from": "moonlive/projects/hpwit/plasma-ring.mle"
+    },
+    {
+      "name": "stage-plasma-wander",
+      "op": "write_file",
+      "path": "/moonlive/plasma-wander.mle",
+      "from": "moonlive/projects/hpwit/plasma-wander.mle"
+    },
+    {
+      "name": "stage-ripple-rings",
+      "op": "write_file",
+      "path": "/moonlive/ripple-rings.mle",
+      "from": "moonlive/projects/hpwit/ripple-rings.mle"
+    },
+    {
+      "name": "stage-spinning-squares",
+      "op": "write_file",
+      "path": "/moonlive/spinning-squares.mle",
+      "from": "moonlive/projects/hpwit/spinning-squares.mle"
+    },
+    {
+      "name": "stage-twinkle-stars",
+      "op": "write_file",
+      "path": "/moonlive/twinkle-stars.mle",
+      "from": "moonlive/projects/hpwit/twinkle-stars.mle"
+    },
+    {
+      "name": "stage-voronoi",
+      "op": "write_file",
+      "path": "/moonlive/voronoi.mle",
+      "from": "moonlive/projects/hpwit/voronoi.mle"
+    },
+    {
+      "name": "effects-clear",
+      "op": "apply_state",
+      "document": {
+        "Effects": {
+          "$patch": "replace"
+        }
+      }
+    },
+    {
+      "name": "no-effect",
+      "description": "The rig with no effect: the baseline each script's cost is read against.",
+      "op": "measure",
+      "measure": true,
+      "settle": 10
+    },
+    {
+      "name": "edge-comets-clear",
+      "op": "apply_state",
+      "document": {
+        "Effects": {
+          "$patch": "replace"
+        }
+      }
+    },
+    {
+      "name": "edge-comets",
+      "description": "`edge-comets.mle` alone in one layer over the whole rig.",
+      "op": "apply_state",
+      "measure": true,
+      "document": {
+        "Effects": {
+          "Layer": {
+            "type": "Layer",
+            "FX": {
+              "type": "MoonLiveEffect",
+              "script": "edge-comets.mle"
+            }
+          }
+        }
+      },
+      "settle": 10,
+      "read": [
+        "FX.tick"
+      ]
+    },
+    {
+      "name": "fire-clear",
+      "op": "apply_state",
+      "document": {
+        "Effects": {
+          "$patch": "replace"
+        }
+      }
+    },
+    {
+      "name": "fire",
+      "description": "`fire.mle` alone in one layer over the whole rig.",
+      "op": "apply_state",
+      "measure": true,
+      "document": {
+        "Effects": {
+          "Layer": {
+            "type": "Layer",
+            "FX": {
+              "type": "MoonLiveEffect",
+              "script": "fire.mle"
+            }
+          }
+        }
+      },
+      "settle": 10,
+      "read": [
+        "FX.tick"
+      ]
+    },
+    {
+      "name": "mandala-clear",
+      "op": "apply_state",
+      "document": {
+        "Effects": {
+          "$patch": "replace"
+        }
+      }
+    },
+    {
+      "name": "mandala",
+      "description": "`mandala.mle` alone in one layer over the whole rig.",
+      "op": "apply_state",
+      "measure": true,
+      "document": {
+        "Effects": {
+          "Layer": {
+            "type": "Layer",
+            "FX": {
+              "type": "MoonLiveEffect",
+              "script": "mandala.mle"
+            }
+          }
+        }
+      },
+      "settle": 10,
+      "read": [
+        "FX.tick"
+      ]
+    },
+    {
+      "name": "particle-fountain-clear",
+      "op": "apply_state",
+      "document": {
+        "Effects": {
+          "$patch": "replace"
+        }
+      }
+    },
+    {
+      "name": "particle-fountain",
+      "description": "`particle-fountain.mle` alone in one layer over the whole rig.",
+      "op": "apply_state",
+      "measure": true,
+      "document": {
+        "Effects": {
+          "Layer": {
+            "type": "Layer",
+            "FX": {
+              "type": "MoonLiveEffect",
+              "script": "particle-fountain.mle"
+            }
+          }
+        }
+      },
+      "settle": 10,
+      "read": [
+        "FX.tick"
+      ]
+    },
+    {
+      "name": "plasma-ring-clear",
+      "op": "apply_state",
+      "document": {
+        "Effects": {
+          "$patch": "replace"
+        }
+      }
+    },
+    {
+      "name": "plasma-ring",
+      "description": "`plasma-ring.mle` alone in one layer over the whole rig.",
+      "op": "apply_state",
+      "measure": true,
+      "document": {
+        "Effects": {
+          "Layer": {
+            "type": "Layer",
+            "FX": {
+              "type": "MoonLiveEffect",
+              "script": "plasma-ring.mle"
+            }
+          }
+        }
+      },
+      "settle": 10,
+      "read": [
+        "FX.tick"
+      ]
+    },
+    {
+      "name": "plasma-wander-clear",
+      "op": "apply_state",
+      "document": {
+        "Effects": {
+          "$patch": "replace"
+        }
+      }
+    },
+    {
+      "name": "plasma-wander",
+      "description": "`plasma-wander.mle` alone in one layer over the whole rig.",
+      "op": "apply_state",
+      "measure": true,
+      "document": {
+        "Effects": {
+          "Layer": {
+            "type": "Layer",
+            "FX": {
+              "type": "MoonLiveEffect",
+              "script": "plasma-wander.mle"
+            }
+          }
+        }
+      },
+      "settle": 10,
+      "read": [
+        "FX.tick"
+      ]
+    },
+    {
+      "name": "ripple-rings-clear",
+      "op": "apply_state",
+      "document": {
+        "Effects": {
+          "$patch": "replace"
+        }
+      }
+    },
+    {
+      "name": "ripple-rings",
+      "description": "`ripple-rings.mle` alone in one layer over the whole rig.",
+      "op": "apply_state",
+      "measure": true,
+      "document": {
+        "Effects": {
+          "Layer": {
+            "type": "Layer",
+            "FX": {
+              "type": "MoonLiveEffect",
+              "script": "ripple-rings.mle"
+            }
+          }
+        }
+      },
+      "settle": 10,
+      "read": [
+        "FX.tick"
+      ]
+    },
+    {
+      "name": "spinning-squares-clear",
+      "op": "apply_state",
+      "document": {
+        "Effects": {
+          "$patch": "replace"
+        }
+      }
+    },
+    {
+      "name": "spinning-squares",
+      "description": "`spinning-squares.mle` alone in one layer over the whole rig.",
+      "op": "apply_state",
+      "measure": true,
+      "document": {
+        "Effects": {
+          "Layer": {
+            "type": "Layer",
+            "FX": {
+              "type": "MoonLiveEffect",
+              "script": "spinning-squares.mle"
+            }
+          }
+        }
+      },
+      "settle": 10,
+      "read": [
+        "FX.tick"
+      ]
+    },
+    {
+      "name": "twinkle-stars-clear",
+      "op": "apply_state",
+      "document": {
+        "Effects": {
+          "$patch": "replace"
+        }
+      }
+    },
+    {
+      "name": "twinkle-stars",
+      "description": "`twinkle-stars.mle` alone in one layer over the whole rig.",
+      "op": "apply_state",
+      "measure": true,
+      "document": {
+        "Effects": {
+          "Layer": {
+            "type": "Layer",
+            "FX": {
+              "type": "MoonLiveEffect",
+              "script": "twinkle-stars.mle"
+            }
+          }
+        }
+      },
+      "settle": 10,
+      "read": [
+        "FX.tick"
+      ]
+    },
+    {
+      "name": "voronoi-clear",
+      "op": "apply_state",
+      "document": {
+        "Effects": {
+          "$patch": "replace"
+        }
+      }
+    },
+    {
+      "name": "voronoi",
+      "description": "`voronoi.mle` alone in one layer over the whole rig.",
+      "op": "apply_state",
+      "measure": true,
+      "document": {
+        "Effects": {
+          "Layer": {
+            "type": "Layer",
+            "FX": {
+              "type": "MoonLiveEffect",
+              "script": "voronoi.mle"
+            }
+          }
+        }
+      },
+      "settle": 10,
+      "read": [
+        "FX.tick"
+      ]
+    }
+  ]
+}
diff --git a/test/scenarios/device/scenario_MoonLive_hpwit_show.json b/test/scenarios/device/scenario_MoonLive_hpwit_show.json
new file mode 100644
index 000000000..b109e9295
--- /dev/null
+++ b/test/scenarios/device/scenario_MoonLive_hpwit_show.json
@@ -0,0 +1,101 @@
+{
+  "name": "scenario_MoonLive_hpwit_show",
+  "module": "MoonLiveEffect",
+  "also": [
+    "Layer",
+    "RegionModifier",
+    "MoonLiveService",
+    "ControlModule",
+    "Effects"
+  ],
+  "mode": "mutate",
+  "live_only": true,
+  "description": "hpwit's effects as one show, played by the hpwit-show service, which builds its own six layers and the surface slots with one live push: the cheap effects over the whole rig, the per-pixel ones in Region windows the service moves, since a window costs its share of the rig. Effects, Services and Control are restored afterwards, and the scripts staged from the repository are removed.",
+  "top": [
+    "Effects",
+    "Services",
+    "Control"
+  ],
+  "steps": [
+    {
+      "name": "stage-twinkle-stars",
+      "op": "write_file",
+      "path": "/moonlive/twinkle-stars.mle",
+      "from": "moonlive/projects/hpwit/twinkle-stars.mle"
+    },
+    {
+      "name": "stage-ripple-rings",
+      "op": "write_file",
+      "path": "/moonlive/ripple-rings.mle",
+      "from": "moonlive/projects/hpwit/ripple-rings.mle"
+    },
+    {
+      "name": "stage-plasma-ring",
+      "op": "write_file",
+      "path": "/moonlive/plasma-ring.mle",
+      "from": "moonlive/projects/hpwit/plasma-ring.mle"
+    },
+    {
+      "name": "stage-voronoi",
+      "op": "write_file",
+      "path": "/moonlive/voronoi.mle",
+      "from": "moonlive/projects/hpwit/voronoi.mle"
+    },
+    {
+      "name": "stage-particle-fountain",
+      "op": "write_file",
+      "path": "/moonlive/particle-fountain.mle",
+      "from": "moonlive/projects/hpwit/particle-fountain.mle"
+    },
+    {
+      "name": "stage-mandala",
+      "op": "write_file",
+      "path": "/moonlive/mandala.mle",
+      "from": "moonlive/projects/hpwit/mandala.mle"
+    },
+    {
+      "name": "stage-show",
+      "op": "write_file",
+      "path": "/moonlive/hpwit-show.mls",
+      "from": "moonlive/projects/hpwit/hpwit-show.mls"
+    },
+    {
+      "name": "show",
+      "description": "The show service running, its windows moving every 20 ms.",
+      "op": "apply_state",
+      "measure": true,
+      "settle": 10,
+      "read": [
+        "Stars.tick",
+        "Ripples.tick",
+        "Waves.tick",
+        "Seeds.tick",
+        "Petals.tick",
+        "Sparks.tick"
+      ],
+      "document": {
+        "Services": {
+          "Show": {
+            "type": "MoonLiveService",
+            "script": "hpwit-show.mls"
+          }
+        }
+      }
+    },
+    {
+      "name": "show-next-scene",
+      "description": "Past the first scene change, a new palette and blends.",
+      "op": "measure",
+      "measure": true,
+      "settle": 15,
+      "read": [
+        "Stars.tick",
+        "Ripples.tick",
+        "Waves.tick",
+        "Seeds.tick",
+        "Petals.tick",
+        "Sparks.tick"
+      ]
+    }
+  ]
+}
diff --git a/test/scenarios/device/scenario_RAM_floor.json b/test/scenarios/device/scenario_RAM_floor.json
new file mode 100644
index 000000000..87c3620d5
--- /dev/null
+++ b/test/scenarios/device/scenario_RAM_floor.json
@@ -0,0 +1,324 @@
+{
+  "name": "scenario_RAM_floor",
+  "module": "SystemModule",
+  "also": [
+    "HttpServerModule",
+    "TasksModule",
+    "BouncingBallsEffect",
+    "Layer"
+  ],
+  "mode": "mutate",
+  "live_only": true,
+  "description": "Internal RAM, the largest free block and the tightest task stack, with the board's own layout and drivers and one fixed effect: idle, with the UI open in a real browser, after a refresh, and after it closes. A board with PSRAM keeps 100 KB of internal RAM free and a 50 KB block through all four, the floor WiFi, HTTP and the UI need; a board without PSRAM is recorded but holds no floor, since its network buffers share the same RAM. Only the effects are replaced, so a board's LED driver, the largest internal RAM user, stays as it runs.",
+  "top": [
+    "Effects"
+  ],
+  "steps": [
+    {
+      "name": "effects-clear",
+      "op": "apply_state",
+      "document": {
+        "Effects": {
+          "$patch": "replace"
+        }
+      }
+    },
+    {
+      "name": "fixed-effect",
+      "description": "BouncingBalls, the effect the internal RAM plan measured every A/B on.",
+      "op": "apply_state",
+      "document": {
+        "Effects": {
+          "Layer": {
+            "type": "Layer",
+            "BouncingBalls": {
+              "type": "BouncingBallsEffect"
+            }
+          }
+        }
+      }
+    },
+    {
+      "name": "idle",
+      "description": "No browser on the board.",
+      "op": "measure",
+      "contract": {
+        "esp32s3-n16r8": {
+          "free_internal": 102400,
+          "max_alloc_block": 51200,
+          "min_stack_free": 256,
+          "heap_tolerance_pct": 0,
+          "set_by": "2026-10-22",
+          "reason": "the internal RAM plan's floor: 100 KB free and a 50 KB block, and no task within 256 bytes of its stack's end, ESP-IDF's own ipc tasks running at about 500"
+        },
+        "esp32p4rev1-eth": {
+          "free_internal": 102400,
+          "max_alloc_block": 51200,
+          "min_stack_free": 256,
+          "heap_tolerance_pct": 0,
+          "set_by": "2026-10-22",
+          "reason": "the internal RAM plan's floor: 100 KB free and a 50 KB block, and no task within 256 bytes of its stack's end, ESP-IDF's own ipc tasks running at about 500"
+        }
+      },
+      "observed": {
+        "esp32s3-n16r8": {
+          "tick_us": {
+            "p50": 11732,
+            "p95": 12527,
+            "min": 10044,
+            "max": 12527,
+            "n": 3
+          },
+          "free_heap": {
+            "p50": 8298100,
+            "p95": 8299648,
+            "min": 8294016,
+            "max": 8299648,
+            "n": 3
+          },
+          "max_alloc_block": {
+            "p50": 108544,
+            "p95": 108544,
+            "min": 108544,
+            "max": 108544,
+            "n": 3
+          },
+          "last_updated": "2026-10-22"
+        },
+        "esp32p4rev1-eth": {
+          "tick_us": {
+            "p50": 2168,
+            "p95": 2168,
+            "min": 2168,
+            "max": 2168,
+            "n": 1
+          },
+          "free_heap": {
+            "p50": 33853787,
+            "p95": 33853787,
+            "min": 33853787,
+            "max": 33853787,
+            "n": 1
+          },
+          "max_alloc_block": {
+            "p50": 192512,
+            "p95": 192512,
+            "min": 192512,
+            "max": 192512,
+            "n": 1
+          },
+          "last_updated": "2026-10-22"
+        }
+      }
+    },
+    {
+      "name": "ui-open",
+      "description": "A browser loads the UI and keeps it open: its files, the state stream and the preview.",
+      "op": "browser",
+      "action": "open",
+      "settle": 8,
+      "measure": true,
+      "contract": {
+        "esp32s3-n16r8": {
+          "free_internal": 102400,
+          "max_alloc_block": 51200,
+          "min_stack_free": 256,
+          "heap_tolerance_pct": 0,
+          "set_by": "2026-10-22",
+          "reason": "the internal RAM plan's floor, with the UI open"
+        },
+        "esp32p4rev1-eth": {
+          "free_internal": 102400,
+          "max_alloc_block": 51200,
+          "min_stack_free": 256,
+          "heap_tolerance_pct": 0,
+          "set_by": "2026-10-22",
+          "reason": "the internal RAM plan's floor, with the UI open"
+        }
+      },
+      "observed": {
+        "esp32s3-n16r8": {
+          "tick_us": {
+            "p50": 11568,
+            "p95": 12460,
+            "min": 11199,
+            "max": 12460,
+            "n": 3
+          },
+          "free_heap": {
+            "p50": 8298480,
+            "p95": 8300344,
+            "min": 8295360,
+            "max": 8300344,
+            "n": 3
+          },
+          "max_alloc_block": {
+            "p50": 108544,
+            "p95": 108544,
+            "min": 108544,
+            "max": 108544,
+            "n": 3
+          },
+          "last_updated": "2026-10-22"
+        },
+        "esp32p4rev1-eth": {
+          "tick_us": {
+            "p50": 2077,
+            "p95": 2077,
+            "min": 2077,
+            "max": 2077,
+            "n": 1
+          },
+          "free_heap": {
+            "p50": 33859943,
+            "p95": 33859943,
+            "min": 33859943,
+            "max": 33859943,
+            "n": 1
+          },
+          "max_alloc_block": {
+            "p50": 192512,
+            "p95": 192512,
+            "min": 192512,
+            "max": 192512,
+            "n": 1
+          },
+          "last_updated": "2026-10-22"
+        }
+      }
+    },
+    {
+      "name": "ui-refresh",
+      "description": "The page reloads, so the browser opens its connections again while the old ones close.",
+      "op": "browser",
+      "action": "refresh",
+      "settle": 8,
+      "measure": true,
+      "contract": {
+        "esp32s3-n16r8": {
+          "free_internal": 102400,
+          "max_alloc_block": 51200,
+          "min_stack_free": 256,
+          "heap_tolerance_pct": 0,
+          "set_by": "2026-10-22",
+          "reason": "the internal RAM plan's floor, through a refresh"
+        },
+        "esp32p4rev1-eth": {
+          "free_internal": 102400,
+          "max_alloc_block": 51200,
+          "min_stack_free": 256,
+          "heap_tolerance_pct": 0,
+          "set_by": "2026-10-22",
+          "reason": "the internal RAM plan's floor, through a refresh"
+        }
+      },
+      "observed": {
+        "esp32s3-n16r8": {
+          "tick_us": {
+            "p50": 11507,
+            "p95": 13870,
+            "min": 11297,
+            "max": 13870,
+            "n": 3
+          },
+          "free_heap": {
+            "p50": 8301608,
+            "p95": 8301616,
+            "min": 8300356,
+            "max": 8301616,
+            "n": 3
+          },
+          "max_alloc_block": {
+            "p50": 108544,
+            "p95": 108544,
+            "min": 108544,
+            "max": 108544,
+            "n": 3
+          },
+          "last_updated": "2026-10-22"
+        },
+        "esp32p4rev1-eth": {
+          "tick_us": {
+            "p50": 2076,
+            "p95": 2076,
+            "min": 2076,
+            "max": 2076,
+            "n": 1
+          },
+          "free_heap": {
+            "p50": 33859951,
+            "p95": 33859951,
+            "min": 33859951,
+            "max": 33859951,
+            "n": 1
+          },
+          "max_alloc_block": {
+            "p50": 192512,
+            "p95": 192512,
+            "min": 192512,
+            "max": 192512,
+            "n": 1
+          },
+          "last_updated": "2026-10-22"
+        }
+      }
+    },
+    {
+      "name": "ui-closed",
+      "description": "The browser is gone: what a viewer took comes back.",
+      "op": "browser",
+      "action": "close",
+      "measure": true,
+      "observed": {
+        "esp32s3-n16r8": {
+          "tick_us": {
+            "p50": 9530,
+            "p95": 11758,
+            "min": 9475,
+            "max": 11758,
+            "n": 3
+          },
+          "free_heap": {
+            "p50": 8298332,
+            "p95": 8301948,
+            "min": 8297096,
+            "max": 8301948,
+            "n": 3
+          },
+          "max_alloc_block": {
+            "p50": 108544,
+            "p95": 108544,
+            "min": 108544,
+            "max": 108544,
+            "n": 3
+          },
+          "last_updated": "2026-10-22"
+        },
+        "esp32p4rev1-eth": {
+          "tick_us": {
+            "p50": 2070,
+            "p95": 2070,
+            "min": 2070,
+            "max": 2070,
+            "n": 1
+          },
+          "free_heap": {
+            "p50": 33860315,
+            "p95": 33860315,
+            "min": 33860315,
+            "max": 33860315,
+            "n": 1
+          },
+          "max_alloc_block": {
+            "p50": 192512,
+            "p95": 192512,
+            "min": 192512,
+            "max": 192512,
+            "n": 1
+          },
+          "last_updated": "2026-10-22"
+        }
+      }
+    }
+  ]
+}
diff --git a/test/unit/core/moonlive_device_codegen.inc b/test/unit/core/moonlive_device_codegen.inc
index e43a6552d..b02b4c66b 100644
--- a/test/unit/core/moonlive_device_codegen.inc
+++ b/test/unit/core/moonlive_device_codegen.inc
@@ -74,7 +74,7 @@ std::vector<uint8_t> emitBytes(const char* src, const mm::moonlive::SysVarTable&
     // A string pool, as the engine supplies one: a script with a literal (every `addControl` name)
     // interns into it, and the emitted code carries pointers there. Static so those pointers stay
     // valid for as long as a test might look at the bytes.
-    static char strings[mm::moonlive::CompileResult::kStringPool];
+    static char strings[mm::moonlive::CompileResult::kMaxStrings];
     auto r = mm::moonlive::compileSource(src, mm::moonlive::lightBuiltins(), sysvars,
                                          out.data(), out.size(), nullptr, MM_ISA_LOWER,
                                          strings, sizeof(strings));
@@ -208,7 +208,7 @@ TEST_CASE("structs, joined conditions and the arithmetic builtins compile for "
         "  }\n"
         "}\n";
     std::vector<uint8_t> out(mm::moonlive::codeCapFor(mm::moonlive::countTokens(src)));
-    static char strings[mm::moonlive::CompileResult::kStringPool];
+    static char strings[mm::moonlive::CompileResult::kMaxStrings];
     const auto r = mm::moonlive::compileSource(src, mm::moonlive::lightBuiltins(), mm::moonlive::effectSysVars(),
                                                out.data(), out.size(), nullptr, MM_ISA_LOWER, strings, sizeof(strings));
     INFO(std::string(r.error));
@@ -320,27 +320,26 @@ TEST_CASE("a returned value reaches the return register on " MM_ISA_NAME) {
 // that would silently stop being the ones under test.
 TEST_CASE("every shipped script compiles for " MM_ISA_NAME) {
     int checked = 0;
-    for (const char* sub : {"layouts", "effects", "modifiers", "drivers"}) {
+    {
         const std::filesystem::path dir =
-            std::filesystem::path(__FILE__).parent_path().parent_path().parent_path().parent_path()
-            / "moonlive" / sub;
-        if (!std::filesystem::exists(dir)) continue;
+            std::filesystem::path(__FILE__).parent_path().parent_path().parent_path().parent_path() / "moonlive";
         for (const auto& entry : std::filesystem::recursive_directory_iterator(dir)) {
             if (!entry.is_regular_file() || !mmIsScript(entry.path())) continue;
+            // The light roles, by extension, wherever they sit: a service or a palette compiles against another table.
+            const std::string ext = entry.path().extension().string();
+            if (ext != mm::moonlive::kEffectExt && ext != mm::moonlive::kLayoutExt && ext != mm::moonlive::kModifierExt) continue;
             std::ifstream f(entry.path());
             std::ostringstream ss;
             ss << f.rdbuf();
             const std::string src = ss.str();
-            // Named per role for readability; all three are the same table. Kept as a per-kind
-            // selection rather than one call so this still reads as "compile it the way its
-            // binding does" if the roles ever diverge again.
-            const std::string kind = sub;
-            const auto& sysvars = kind == "layouts"   ? mm::moonlive::layoutSysVars()
-                                : kind == "modifiers" ? mm::moonlive::modifierSysVars()
-                                                      : mm::moonlive::effectSysVars();
+            // Per role, by extension, so this reads as "compile it the way its binding does" if the
+            // roles' tables ever diverge again; all three are the same table.
+            const auto& sysvars = ext == mm::moonlive::kLayoutExt   ? mm::moonlive::layoutSysVars()
+                                : ext == mm::moonlive::kModifierExt ? mm::moonlive::modifierSysVars()
+                                                                    : mm::moonlive::effectSysVars();
             bool ok = false;
             const size_t n = emitLen(src.c_str(), sysvars, ok);
-            INFO("script: ", kind, "/", entry.path().filename().string(), " on " MM_ISA_NAME);
+            INFO("script: ", entry.path().filename().string(), " on " MM_ISA_NAME);
             CHECK(ok);
             CHECK(n > 0);
             // And it fits its own SIZING ESTIMATE with room to spare. codeCapFor allocates from a
diff --git a/test/unit/core/moonlive_script_file.h b/test/unit/core/moonlive_script_file.h
new file mode 100644
index 000000000..4890d0245
--- /dev/null
+++ b/test/unit/core/moonlive_script_file.h
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "doctest.h"
+#include "core/moonlive/MoonLiveScriptFile.h"
+#include "platform/platform.h"
+
+#include <cstdio>
+#include <cstring>
+
+/// Write a script where the UI saves one, through the platform fs: the desktop roots its filesystem where it chooses, so a host path is never where the loader looks.
+inline void writeScript(const char* name, const char* body) {
+    mm::platform::fsMkdir(mm::moonlive::kScriptDir);
+    char path[96];
+    std::snprintf(path, sizeof(path), "%s/%s", mm::moonlive::kScriptDir, name);
+    REQUIRE(mm::platform::fsWriteAtomic(path, body, std::strlen(body)));
+}
diff --git a/test/unit/core/unit_AudioService_sync.cpp b/test/unit/core/unit_AudioService_sync.cpp
index 4612ef954..4c0d6409b 100644
--- a/test/unit/core/unit_AudioService_sync.cpp
+++ b/test/unit/core/unit_AudioService_sync.cpp
@@ -137,6 +137,24 @@ TEST_CASE("AudioService Local+send: lazy-opens once and reports sending") {
     CHECK_FALSE(a.syncOpenForTest());
 }
 
+// A rebuild anywhere in the tree prepared the audio service too, which closed its socket and reopened its microphone every time.
+TEST_CASE("AudioService keeps its socket through a prepare that changed none of its settings") {
+    FrozenClock clk(1);
+    AudioService a;
+    a.mode = AudioService::kLocalMode;
+    a.send = true;
+    a.syncPort = kTestSyncPort;
+    a.applyState();
+    a.tick();
+    REQUIRE(a.syncOpenForTest());
+    a.applyState();                  // as a tree rebuild for another module does
+    CHECK(a.syncOpenForTest());
+    a.syncPort = static_cast<uint16_t>(kTestSyncPort + 1);
+    a.applyState();                  // a new port rebinds
+    CHECK_FALSE(a.syncOpenForTest());
+    a.release();
+}
+
 TEST_CASE("AudioService Local+send: broadcasts are throttled to ~kSyncSendIntervalMs") {
     FrozenClock clk(1);
     AudioService a;
diff --git a/test/unit/core/unit_ControlModule.cpp b/test/unit/core/unit_ControlModule.cpp
index 05f3e847a..3895097c1 100644
--- a/test/unit/core/unit_ControlModule.cpp
+++ b/test/unit/core/unit_ControlModule.cpp
@@ -1176,6 +1176,25 @@ TEST_CASE("a touched control is not driven on that surface, and resyncs when rel
     d.control->removeSurface(&s);
 }
 
+// A show's service drives slots 50 times a second, and a slot's target counted as configuration, so flash was written about once a second.
+TEST_CASE("a live slot write drives its target without marking either to be saved") {
+    Device d;
+    auto& cs = d.control->controls();
+    for (uint8_t i = 0; i < cs.count(); i++)
+        if (std::strcmp(cs[i].name, "fader2Target") == 0) {
+            std::snprintf(static_cast<char*>(cs[i].ptr), 40, "%s", "Drivers.palette");
+            d.control->onControlChanged("fader2Target");
+        }
+    d.control->clearDirty();
+    d.drivers->clearDirty();
+    REQUIRE(d.scheduler.setControl("Control", "fader2", "{\"value\":9}", /*live=*/true) == mm::Scheduler::SetControlResult::Ok);
+    int32_t palette = -1;
+    REQUIRE(d.scheduler.getControlWide("Drivers", "palette", palette));
+    CHECK(palette == 9);                    // the target moved
+    CHECK_FALSE(d.control->dirty());
+    CHECK_FALSE(d.drivers->dirty());
+}
+
 // The hand is on one desk, so every other surface, such as the OSC link to other devices, keeps following the fader as it moves.
 TEST_CASE("a control touched on one surface still reaches the others as it moves") {
     Device d;
diff --git a/test/unit/core/unit_DevicesModule_discovery.cpp b/test/unit/core/unit_DevicesModule_discovery.cpp
index 52e84ee73..aec583579 100644
--- a/test/unit/core/unit_DevicesModule_discovery.cpp
+++ b/test/unit/core/unit_DevicesModule_discovery.cpp
@@ -157,6 +157,25 @@ TEST_CASE("DevicesModule: a peer heard only over broadcast proves the network dr
     CHECK(cleared);
 }
 
+// The verdict lives in the status, which is not saved: flipping it once wrote the config file to flash on every flip.
+TEST_CASE("DevicesModule: the multicast verdict changing arms no save, a new device does") {
+    NetworkPath::multicastDropped = false;
+    DevicesModule dev;
+    injectCopy(dev, 62, /*broadcast=*/true);
+    const bool newRowSaves = dev.dirty();
+    dev.clearDirty();
+    for (int i = 0; i < 2; i++) injectCopy(dev, 62, /*broadcast=*/true);   // the third copy proves the drop
+    const bool proven = NetworkPath::multicastDropped;
+    const bool dirtyAfterProof = dev.dirty();
+    injectCopy(dev, 62, /*broadcast=*/false);                              // and a multicast copy clears it
+    const bool dirtyAfterClear = dev.dirty();
+    NetworkPath::multicastDropped = false;
+    CHECK(newRowSaves);
+    CHECK(proven);
+    CHECK_FALSE(dirtyAfterProof);
+    CHECK_FALSE(dirtyAfterClear);
+}
+
 TEST_CASE("DevicesModule: a peer heard both ways, or not at all, proves nothing") {
     NetworkPath::multicastDropped = false;
     DevicesModule other;
diff --git a/test/unit/core/unit_HttpServerModule_connections.cpp b/test/unit/core/unit_HttpServerModule_connections.cpp
index 0e372b07a..4363789f4 100644
--- a/test/unit/core/unit_HttpServerModule_connections.cpp
+++ b/test/unit/core/unit_HttpServerModule_connections.cpp
@@ -1,14 +1,18 @@
 /// @module HttpServerModule
 ///
 /// A connection whose request arrives late, as one whose first packet was lost and resent does, is parked and served rather than closed with no reply.
+/// An embedded UI file streams across ticks from a send slot, so a slow client never holds the render loop for the whole file.
 /// Driven over loopback against the real server on a test port, since a running desktop app holds 8080.
 
 #include "doctest.h"
 #include "core/system/HttpServerModule.h"
 #include "http_test_client.h"
 #include "platform/platform.h"
+#include "ui/ui_embedded.h"
 
+#include <cstdio>
 #include <cstring>
+#include <string>
 
 namespace {
 
@@ -63,3 +67,143 @@ TEST_CASE("HttpServer: a connection that never sends a request is closed once it
     client.close();
     http.release();
 }
+
+namespace {
+
+// The embedded app.js, the largest UI file, the one a slow link spends seconds on.
+const mm::ui::EmbeddedFile& embeddedAppJs() {
+    for (const auto& f : mm::ui::kFiles)
+        if (std::strcmp(f.name, "app.js") == 0) return f;
+    return mm::ui::kFiles[0];
+}
+
+// Request `path`, then tick and read until the server closes the connection; everything read.
+std::string getUntilClosed(mm::HttpServerModule& http, mm::platform::TcpConnection& client, const char* path) {
+    char req[96];
+    std::snprintf(req, sizeof(req), "GET %s HTTP/1.1\r\nHost: test\r\n\r\n", path);
+    if (!client.write(reinterpret_cast<const uint8_t*>(req), std::strlen(req))) return {};
+    std::string out;
+    char buf[4096];
+    for (int i = 0; i < 3000; i++) {
+        http.tick20ms();
+        const int n = client.read(reinterpret_cast<uint8_t*>(buf), sizeof(buf));
+        if (n > 0) out.append(buf, static_cast<size_t>(n));
+        else if (n == 0) break;   // the server closed: the body is complete
+        else mm::platform::delayMs(1);
+    }
+    return out;
+}
+
+}  // namespace
+
+TEST_CASE("HttpServer: an embedded UI file streams across ticks, arrives whole, and its connection then closes") {
+    mm::HttpServerModule http;
+    http.port = kTestPort;
+    http.setUiPath("/nonexistent-ui");   // no files on disk: the embedded copy is served, as on a device
+    http.setup();
+    mm::platform::TcpConnection client;
+    REQUIRE(connectAndAccept(http, client, kTestPort));
+
+    const auto& file = embeddedAppJs();
+    const std::string reply = getUntilClosed(http, client, "/app.js");
+    const auto bodyStart = reply.find("\r\n\r\n");
+    REQUIRE(bodyStart != std::string::npos);
+    CHECK(std::strncmp(reply.c_str(), "HTTP/1.1 200", 12) == 0);
+    REQUIRE(reply.size() - (bodyStart + 4) == file.len);
+    CHECK(std::memcmp(reply.data() + bodyStart + 4, file.data, file.len) == 0);
+
+    client.close();
+    http.release();
+}
+
+TEST_CASE("HttpServer: a page load past the send slots gets every file whole or a 503, never a write that holds the loop") {
+    mm::HttpServerModule http;
+    http.port = kTestPort;
+    http.setUiPath("/nonexistent-ui");
+    http.setup();
+    constexpr int kClients = 18;   // past the sixteen slots
+    mm::platform::TcpConnection clients[kClients];
+    // Each connects and sends its request at once, as a browser's burst does; a tick between them keeps the listen backlog from filling.
+    using CR = mm::platform::TcpConnection::ConnectResult;
+    const char* req = "GET /app.js HTTP/1.1\r\nHost: test\r\n\r\n";
+    for (auto& c : clients) {
+        REQUIRE(c.connectStart("127.0.0.1", kTestPort));
+        CR r = CR::Pending;
+        for (int i = 0; i < 500 && r == CR::Pending; i++) {
+            r = c.connectPoll();
+            if (r == CR::Pending) mm::platform::delayMs(1);
+        }
+        REQUIRE(r == CR::Connected);
+        REQUIRE(c.write(reinterpret_cast<const uint8_t*>(req), std::strlen(req)));
+        http.tick20ms();
+    }
+
+    const auto& file = embeddedAppJs();
+    std::string got[kClients];
+    bool closed[kClients] = {};
+    char buf[4096];
+    for (int i = 0; i < 5000; i++) {
+        http.tick20ms();
+        bool all = true;
+        for (int k = 0; k < kClients; k++) {
+            if (closed[k]) continue;
+            const int n = clients[k].read(reinterpret_cast<uint8_t*>(buf), sizeof(buf));
+            if (n > 0) got[k].append(buf, static_cast<size_t>(n));
+            else if (n == 0) closed[k] = true;
+            all = all && closed[k];
+        }
+        if (all) break;
+    }
+    int whole = 0;
+    for (int k = 0; k < kClients; k++) {
+        CAPTURE(k);
+        const auto bodyStart = got[k].find("\r\n\r\n");
+        REQUIRE(bodyStart != std::string::npos);
+        if (got[k].compare(0, 12, "HTTP/1.1 503") == 0) continue;   // every slot was busy when it asked
+        CHECK(got[k].size() - (bodyStart + 4) == file.len);
+        whole++;
+    }
+    CHECK(whole >= 16);   // every slot served
+    for (auto& c : clients) c.close();
+    http.release();
+}
+
+// A page load over a slow link queued 52 KB of unacknowledged segments on a board without PSRAM, taking it to 3.6 KB free: below the headroom the file waits rather than queues more.
+TEST_CASE("HttpServer: an embedded file waits while internal RAM is short, then arrives whole") {
+    struct Heap { ~Heap() { mm::platform::setTestFreeInternalHeap(0); } } heap;   // restored however the test ends
+    mm::HttpServerModule http;
+    http.port = kTestPort;
+    http.setUiPath("/nonexistent-ui");
+    http.setup();
+    mm::platform::TcpConnection client;
+    REQUIRE(connectAndAccept(http, client, kTestPort));
+
+    mm::platform::setTestFreeInternalHeap(mm::HttpServerModule::kSendHeadroom - 1);
+    const char* req = "GET /app.js HTTP/1.1\r\nHost: test\r\n\r\n";
+    REQUIRE(client.write(reinterpret_cast<const uint8_t*>(req), std::strlen(req)));
+    std::string held;
+    char buf[4096];
+    for (int i = 0; i < 50; i++) {
+        http.tick20ms();
+        const int n = client.read(reinterpret_cast<uint8_t*>(buf), sizeof(buf));
+        if (n > 0) held.append(buf, static_cast<size_t>(n));
+        else mm::platform::delayMs(1);
+    }
+    const auto headerEnd = held.find("\r\n\r\n");
+    REQUIRE(headerEnd != std::string::npos);
+    CHECK(held.size() == headerEnd + 4);   // the header went out, no body while short
+
+    mm::platform::setTestFreeInternalHeap(0);
+    std::string rest = held;
+    for (int i = 0; i < 3000; i++) {
+        http.tick20ms();
+        const int n = client.read(reinterpret_cast<uint8_t*>(buf), sizeof(buf));
+        if (n > 0) rest.append(buf, static_cast<size_t>(n));
+        else if (n == 0) break;
+        else mm::platform::delayMs(1);
+    }
+    CHECK(rest.size() - (headerEnd + 4) == embeddedAppJs().len);
+
+    client.close();
+    http.release();
+}
diff --git a/test/unit/core/unit_HttpServerModule_routes.cpp b/test/unit/core/unit_HttpServerModule_routes.cpp
index 27f15e54d..0b6d1ca14 100644
--- a/test/unit/core/unit_HttpServerModule_routes.cpp
+++ b/test/unit/core/unit_HttpServerModule_routes.cpp
@@ -36,6 +36,24 @@ std::string withBody(const char* head, const std::string& body) {
     return std::string(head) + " HTTP/1.1\r\nContent-Length: " + std::to_string(body.size()) + "\r\n\r\n" + body;
 }
 
+/// A scheduler holding one `Rack`, served on the test port.
+struct RackServer {
+    mm::Scheduler s;
+    Rack* rack = new Rack();
+    mm::HttpServerModule http;
+    RackServer() {
+        rack->setName("Rack");
+        s.addModule(rack);
+        http.port = kTestPort;
+        http.setScheduler(&s);
+        http.setup();
+    }
+    ~RackServer() {
+        http.release();
+        s.deleteTree(rack);
+    }
+};
+
 mm::MoonModule* childNamed(mm::MoonModule* parent, const char* name) {
     for (uint8_t i = 0; i < parent->childCount(); i++)
         if (parent->child(i) && std::strcmp(parent->child(i)->name(), name) == 0) return parent->child(i);
@@ -79,14 +97,8 @@ TEST_CASE("a firmware upload without a Content-Length is refused with 411, as ev
 
 // A name past what a module holds is refused on every route that names one, rather than cut short into a name that could match another module.
 TEST_CASE("a module route whose name does not fit is refused with 400 on move, replace, delete and read alike") {
-    mm::Scheduler s;
-    auto* rack = new Rack();
-    rack->setName("Rack");
-    s.addModule(rack);
-    mm::HttpServerModule http;
-    http.port = kTestPort;
-    http.setScheduler(&s);
-    http.setup();
+    RackServer server;
+    mm::HttpServerModule& http = server.http;
     const std::string longName(40, 'x');
     CHECK(request(http, withBody(("POST /api/modules/" + longName + "/move").c_str(), "{\"to\":0}")).rfind("HTTP/1.1 400", 0) == 0);
     CHECK(request(http, withBody(("POST /api/modules/" + longName + "/replace").c_str(), "{\"type\":\"RouteDial\"}")).rfind("HTTP/1.1 400", 0) == 0);
@@ -95,6 +107,24 @@ TEST_CASE("a module route whose name does not fit is refused with 400 on move, r
     CHECK(request(http, "GET /api/modules/" + pastAName + " HTTP/1.1\r\n\r\n").rfind("HTTP/1.1 400", 0) == 0);
     CHECK(request(http, "DELETE /api/modules/" + pastAName + " HTTP/1.1\r\n\r\n").rfind("HTTP/1.1 400", 0) == 0);
     CHECK(request(http, "GET /api/modules/Rack HTTP/1.1\r\n\r\n").rfind("HTTP/1.1 200", 0) == 0);
-    http.release();
-    s.deleteTree(rack);
+}
+
+// `?live=1` applies a document that marks nothing to save; it is read as a whole query parameter, so `xlive=1` and `live=10` are plain requests.
+TEST_CASE("PATCH /api/state?live=1 applies without marking the tree to save, and only that exact parameter does") {
+    static bool registered = false;
+    if (!registered) { mm::ModuleFactory::registerType<Dial>("LiveDial"); registered = true; }
+    RackServer server;
+    mm::HttpServerModule& http = server.http;
+    Rack* rack = server.rack;
+
+    const std::string doc = R"({"Rack":{"A":{"type":"LiveDial"}}})";
+    CHECK(request(http, withBody("PATCH /api/state?live=1", doc)).rfind("HTTP/1.1 200", 0) == 0);
+    CHECK(childNamed(rack, "A") != nullptr);
+    CHECK_FALSE(rack->dirty());
+    for (const char* path : {"PATCH /api/state?xlive=1", "PATCH /api/state?live=10"}) {
+        rack->clearDirty();
+        const std::string another = std::string(R"({"Rack":{"B)") + (path[17] == 'x' ? "x" : "y") + R"(":{"type":"LiveDial"}}})";
+        CHECK(request(http, withBody(path, another)).rfind("HTTP/1.1 200", 0) == 0);
+        CHECK(rack->dirty());   // an ordinary request: saved
+    }
 }
diff --git a/test/unit/core/unit_HttpServerModule_sdcard.cpp b/test/unit/core/unit_HttpServerModule_sdcard.cpp
index 79e87b8f9..272c6fc2b 100644
--- a/test/unit/core/unit_HttpServerModule_sdcard.cpp
+++ b/test/unit/core/unit_HttpServerModule_sdcard.cpp
@@ -50,6 +50,15 @@ std::string request(mm::HttpServerModule& http, mm::platform::TcpConnection& cli
     return reply;
 }
 
+// The status line of one request on a connection of its own.
+std::string statusOf(mm::HttpServerModule& http, const char* req) {
+    mm::platform::TcpConnection client;
+    REQUIRE(connectAndAccept(http, client, kTestPort));
+    const std::string reply = request(http, client, req);
+    client.close();
+    return reply.substr(0, 12);
+}
+
 
 // Ticks with a millisecond between them, since Linux loopback delivers a write at once and macOS a moment later; a tick with nothing new is harmless.
 void tickWhileDelivering(mm::HttpServerModule& http, int ticks = 5) {
@@ -360,24 +369,10 @@ TEST_CASE("DELETE /api/dir removes a file and a non-empty folder on the card, vi
     http.port = kTestPort;
     http.setup();
 
-    {
-        mm::platform::TcpConnection client;
-        REQUIRE(connectAndAccept(http, client, kTestPort));
-        const char* req = "DELETE /api/dir?path=/sd/lone.bin HTTP/1.1\r\n\r\n";
-        const std::string reply = request(http, client, req);
-        CHECK(std::strncmp(reply.c_str(), "HTTP/1.1 200", 12) == 0);
-        client.close();
-    }
+    CHECK(statusOf(http, "DELETE /api/dir?path=/sd/lone.bin HTTP/1.1\r\n\r\n") == "HTTP/1.1 200");
     CHECK(mm::platform::fsSize("/sd/lone.bin") < 0);
 
-    {
-        mm::platform::TcpConnection client;
-        REQUIRE(connectAndAccept(http, client, kTestPort));
-        const char* req = "DELETE /api/dir?path=/sd/tree HTTP/1.1\r\n\r\n";
-        const std::string reply = request(http, client, req);
-        CHECK(std::strncmp(reply.c_str(), "HTTP/1.1 200", 12) == 0);
-        client.close();
-    }
+    CHECK(statusOf(http, "DELETE /api/dir?path=/sd/tree HTTP/1.1\r\n\r\n") == "HTTP/1.1 200");
     CHECK(mm::platform::fsSize("/sd/tree/sub/leaf.txt") < 0);
     CHECK_FALSE(mm::platform::fsExists("/sd/tree"));
 
@@ -393,12 +388,7 @@ TEST_CASE("DELETE /api/dir on /sd itself is refused, leaving the card untouched"
     http.port = kTestPort;
     http.setup();
 
-    mm::platform::TcpConnection client;
-    REQUIRE(connectAndAccept(http, client, kTestPort));
-    const char* req = "DELETE /api/dir?path=/sd HTTP/1.1\r\n\r\n";
-    const std::string reply = request(http, client, req);
-    CHECK(std::strncmp(reply.c_str(), "HTTP/1.1 500", 12) == 0);
-    client.close();
+    CHECK(statusOf(http, "DELETE /api/dir?path=/sd HTTP/1.1\r\n\r\n") == "HTTP/1.1 500");
 
     CHECK(mm::platform::fsSize("/sd/keep.bin") >= 0);   // untouched, not even one level in
     http.release();
@@ -411,13 +401,8 @@ TEST_CASE("DELETE /api/dir on the card root spelled with extra slashes is refuse
     mm::HttpServerModule http;
     http.port = kTestPort;
     http.setup();
-    for (const char* req : {"DELETE /api/dir?path=/sd// HTTP/1.1\r\n\r\n", "DELETE /api/dir?path=//sd HTTP/1.1\r\n\r\n"}) {
-        mm::platform::TcpConnection client;
-        REQUIRE(connectAndAccept(http, client, kTestPort));
-        const std::string reply = request(http, client, req);
-        CHECK(std::strncmp(reply.c_str(), "HTTP/1.1 200", 12) != 0);
-        client.close();
-    }
+    for (const char* req : {"DELETE /api/dir?path=/sd// HTTP/1.1\r\n\r\n", "DELETE /api/dir?path=//sd HTTP/1.1\r\n\r\n"})
+        CHECK(statusOf(http, req) != "HTTP/1.1 200");
     CHECK(mm::platform::fsSize("/sd/keep.bin") >= 0);
     http.release();
 }
@@ -437,3 +422,15 @@ TEST_CASE("an upload to a relative sd/ path gets the card's size limit") {
     client.close();
     http.release();
 }
+
+// Deleting what is not there answered 500, the code for the device failing; it is the client's mistake, a 404.
+TEST_CASE("DELETE /api/dir on a path that names nothing answers 404") {
+    SdFixture fix;
+    mm::HttpServerModule http;
+    http.port = kTestPort;
+    http.setup();
+    for (const char* req : {"DELETE /api/dir?path=/sd/nothing.bin HTTP/1.1\r\n\r\n",
+                            "DELETE /api/dir?path=/moonlive/nothing.mle HTTP/1.1\r\n\r\n"})
+        CHECK(statusOf(http, req) == "HTTP/1.1 404");
+    http.release();
+}
diff --git a/test/unit/core/unit_HttpServerModule_subscribe.cpp b/test/unit/core/unit_HttpServerModule_subscribe.cpp
index 0731c2508..1961b036e 100644
--- a/test/unit/core/unit_HttpServerModule_subscribe.cpp
+++ b/test/unit/core/unit_HttpServerModule_subscribe.cpp
@@ -289,6 +289,22 @@ TEST_CASE("the full state streams as one fragmented message that reassembles to
     CHECK(message == whole(sv.http, &expected));
 }
 
+// An open UI over a slow link queued the state stream's segments on a board without PSRAM, taking free internal RAM to 12 KB: below the headroom the stream waits.
+TEST_CASE("the state stream waits while internal RAM is short, then arrives whole") {
+    struct Heap { ~Heap() { mm::platform::setTestFreeInternalHeap(0); } } heap;   // restored however the test ends
+    Served sv;
+    WsClient c{sv.http, {}, {}};
+    REQUIRE(c.open(kTestPort));
+    mm::platform::setTestFreeInternalHeap(mm::HttpServerModule::kSendHeadroom - 1);
+    REQUIRE(c.send("{\"subscribe\":[\"B\"]}"));
+    std::vector<uint8_t> opcodes;
+    CHECK(c.message(opcodes, 100).empty());   // nothing while short
+    mm::platform::setTestFreeInternalHeap(0);
+    const std::string message = c.message(opcodes);
+    const auto expected = subscribed("{\"subscribe\":[\"B\"]}");
+    CHECK(message == whole(sv.http, &expected));
+}
+
 TEST_CASE("a client that subscribes is sent a full state, and the client already there is not") {
     Served sv;
     WsClient first{sv.http, {}, {}}, second{sv.http, {}, {}};
diff --git a/test/unit/core/unit_JsonFetch.cpp b/test/unit/core/unit_JsonFetch.cpp
new file mode 100644
index 000000000..cea5ddd63
--- /dev/null
+++ b/test/unit/core/unit_JsonFetch.cpp
@@ -0,0 +1,258 @@
+/// @module JsonFetch
+/// @also Scheduler, platform
+
+/// Pins the documents a script holds by handle: its own text parsed once, a feed kept fresh in the background, and a push answered by a reply. The network is a stand-in, so every case runs without one.
+
+#include "doctest.h"
+#include "core/util/JsonFetch.h"
+#include "core/module/MoonModule.h"
+#include "core/module/Scheduler.h"
+#include "core/util/ModuleFactory.h"
+
+#include <cstring>
+#include <string>
+
+using namespace mm;
+
+namespace {
+
+/// What the stand-in network saw and what it answers.
+struct Net {
+    int calls = 0;
+    std::string method, url, body;
+    std::string answer = R"({"current":{"temperature_2m":12.5}})";
+    int status = 200;
+};
+Net net;
+
+int standIn(const char* method, const char* url, const char* reqBody, char* body, size_t bodyLen) {
+    net.calls++;
+    net.method = method;
+    net.url = url;
+    net.body = reqBody ? reqBody : "";
+    if (!net.status) return 0;
+    if (body && bodyLen) {
+        if (net.answer.size() + 1 > bodyLen) return 0;
+        std::strcpy(body, net.answer.c_str());
+    }
+    return net.status;
+}
+
+/// Installs the stand-in and a clock the test moves, and frees whatever the test's owner held.
+struct Fixture {
+    int owner = 0;   ///< any address names an owner, as a script's arena does
+    JsonFetch& f = JsonFetch::instance();
+    Fixture() {
+        net = Net{};
+        platform::setTestHttpFetch(&standIn);
+        platform::setTestNowMs(100000);
+    }
+    ~Fixture() {
+        f.settle(2000);
+        f.release(&owner);
+        platform::setTestHttpFetch(nullptr);
+        platform::setTestNowMs(0);
+    }
+};
+
+struct JfKnob : public MoonModule {
+    uint8_t value = 1;
+    void defineControls() override { controls_.addControl("value", value, 0, 100); }
+};
+struct JfBox : public MoonModule {
+    const char* acceptsChildRoles() const override { return "generic,effect"; }
+};
+
+}  // namespace
+
+TEST_CASE("a script's own text parses once, and asking again answers the same document") {
+    Fixture fx;
+    const char* text = R"({"a":{"b":3}})";
+    const int h = fx.f.literal(&fx.owner, text);
+    REQUIRE(h > 0);
+    CHECK(fx.f.literal(&fx.owner, text) == h);
+    CHECK(json::readInt(json::at(*fx.f.doc(&fx.owner, h), "/a/b")) == 3);
+    CHECK(fx.f.changed(&fx.owner, h));        // the first ask sees it arrive
+    CHECK_FALSE(fx.f.changed(&fx.owner, h));
+    CHECK(fx.f.literal(&fx.owner, "{not json") == 0);
+}
+
+TEST_CASE("a handle names nothing for another owner") {
+    Fixture fx;
+    int other = 0;
+    const int h = fx.f.literal(&fx.owner, R"({"x":1})");
+    REQUIRE(h > 0);
+    CHECK(fx.f.doc(&other, h) == nullptr);
+    CHECK(fx.f.doc(&fx.owner, 0) == nullptr);
+    CHECK(fx.f.doc(&fx.owner, 999) == nullptr);
+}
+
+TEST_CASE("a feed answers at once and fills when its answer arrives") {
+    Fixture fx;
+    const int h = fx.f.fetch(&fx.owner, "https://api.example/weather", 600000);
+    REQUIRE(h > 0);
+    REQUIRE(fx.f.settle(2000));
+    CHECK(net.method == "GET");
+    CHECK(net.url == "https://api.example/weather");
+    REQUIRE(fx.f.doc(&fx.owner, h) != nullptr);
+    CHECK(json::readFixed(json::at(*fx.f.doc(&fx.owner, h), "/current/temperature_2m")) == 12 * 65536 + 32768);
+    CHECK(fx.f.status(&fx.owner, h) == 200);
+    CHECK(fx.f.changed(&fx.owner, h));
+    // Asking every tick neither adds a feed nor fetches again inside the period.
+    CHECK(fx.f.fetch(&fx.owner, "https://api.example/weather", 600000) == h);
+    fx.f.settle(2000);
+    CHECK(net.calls == 1);
+}
+
+TEST_CASE("a feed refreshes once its period ran out, and a failed refresh keeps the last document") {
+    Fixture fx;
+    const int h = fx.f.fetch(&fx.owner, "https://api.example/news", 60000);
+    REQUIRE(fx.f.settle(2000));
+    CHECK(fx.f.changed(&fx.owner, h));
+    net.status = 0;   // the network goes away
+    platform::setTestNowMs(100000 + 60000);
+    fx.f.doc(&fx.owner, h);   // a read past the period asks again
+    REQUIRE(fx.f.settle(2000));
+    CHECK(net.calls == 2);
+    CHECK(fx.f.status(&fx.owner, h) == 0);
+    REQUIRE(fx.f.doc(&fx.owner, h) != nullptr);   // stale, and still there
+    CHECK_FALSE(fx.f.changed(&fx.owner, h));
+}
+
+TEST_CASE("an answer too big for the device is refused, not cut") {
+    Fixture fx;
+    net.answer = "[" + std::string(JsonFetch::kAnswerCap, '1') + "]";
+    const int h = fx.f.fetch(&fx.owner, "https://api.example/scores", 60000);
+    REQUIRE(fx.f.settle(2000));
+    CHECK(fx.f.doc(&fx.owner, h) == nullptr);
+    CHECK(fx.f.status(&fx.owner, h) == 0);
+}
+
+TEST_CASE("a push to another MoonLight patches its state live, and to a URL posts the document") {
+    Fixture fx;
+    const int d = fx.f.literal(&fx.owner, R"({"Effects":{"Layer":{"opacity":0}}})");
+    const int r = fx.f.push(&fx.owner, "stadbeest-eye-left.local", d);
+    REQUIRE(r > 0);
+    REQUIRE(fx.f.settle(2000));
+    CHECK(net.method == "PATCH");
+    CHECK(net.url == "http://stadbeest-eye-left.local/api/state?live=1");
+    CHECK(net.body == R"({"Effects":{"Layer":{"opacity":0}}})");
+    CHECK(fx.f.changed(&fx.owner, r));   // the reply arrived
+    CHECK(fx.f.push(&fx.owner, "https://hooks.example/in", d) > 0);
+    REQUIRE(fx.f.settle(2000));
+    CHECK(net.method == "POST");
+    CHECK(net.url == "https://hooks.example/in");
+}
+
+TEST_CASE("a push to this device builds the tree at the frame boundary and answers as the API does") {
+    Fixture fx;
+    ModuleFactory::registerType<JfKnob>("JfKnob");
+    Scheduler s;
+    auto* effects = new JfBox();
+    effects->setName("Effects");
+    s.addModule(effects);
+    s.setup();
+    const int d = fx.f.literal(&fx.owner, R"({"Effects":{"Knob":{"type":"JfKnob","value":33}}})");
+    const int r = fx.f.push(&fx.owner, nullptr, d);
+    REQUIRE(r > 0);
+    CHECK(fx.f.push(&fx.owner, "", d) == r);   // the first is on its way, so this one waits
+    CHECK(s.firstByName("Knob") == nullptr);
+    s.preparePending();
+    REQUIRE(s.firstByName("Knob") != nullptr);
+    CHECK(static_cast<JfKnob*>(s.firstByName("Knob"))->value == 33);
+    CHECK_FALSE(effects->dirty());   // live: nothing to save
+    CHECK(fx.f.changed(&fx.owner, r));
+    CHECK(fx.f.status(&fx.owner, r) == 200);
+    CHECK(json::readBool(json::at(*fx.f.doc(&fx.owner, r), "/ok")));
+    // The one that waited went when the first was answered, and applies at the next boundary.
+    static_cast<JfKnob*>(s.firstByName("Knob"))->value = 1;
+    s.preparePending();
+    CHECK(static_cast<JfKnob*>(s.firstByName("Knob"))->value == 33);
+    s.release();
+}
+
+TEST_CASE("pushes to a busy target coalesce: the newest waits, the ones it replaced never go") {
+    Fixture fx;
+    const int a = fx.f.literal(&fx.owner, R"({"v":1})");
+    const int b = fx.f.literal(&fx.owner, R"({"v":2})");
+    const int c = fx.f.literal(&fx.owner, R"({"v":3})");
+    fx.f.push(&fx.owner, "host-a", a);
+    fx.f.push(&fx.owner, "host-a", b);
+    fx.f.push(&fx.owner, "host-a", c);
+    REQUIRE(fx.f.settle(2000));
+    CHECK(net.calls == 2);
+    CHECK(net.body == R"({"v":3})");
+}
+
+TEST_CASE("releasing an owner frees its documents and drops an answer still on its way") {
+    Fixture fx;
+    const int h = fx.f.fetch(&fx.owner, "https://api.example/slow", 60000);
+    REQUIRE(h > 0);
+    fx.f.release(&fx.owner);
+    REQUIRE(fx.f.settle(2000));
+    CHECK(fx.f.doc(&fx.owner, h) == nullptr);
+    // The freed place serves a new document.
+    CHECK(fx.f.literal(&fx.owner, R"({"y":2})") > 0);
+}
+
+TEST_CASE("the worker starts with the first request and stops once nothing uses it") {
+    Fixture fx;
+    CHECK(fx.f.fetch(&fx.owner, "https://api.example/a", 60000) > 0);
+    CHECK(fx.f.workerRunning());
+    REQUIRE(fx.f.settle(2000));
+    JsonFetch::poll();
+    CHECK(fx.f.workerRunning());          // a document is held: it stays
+    fx.f.release(&fx.owner);
+    CHECK_FALSE(fx.f.workerRunning());    // nothing held, nothing on its way: gone
+    CHECK(fx.f.fetch(&fx.owner, "https://api.example/a", 60000) > 0);
+    CHECK(fx.f.workerRunning());          // and back for the next request
+}
+
+TEST_CASE("a post keeps the status and never reads the answer, so its size cannot refuse it") {
+    Fixture fx;
+    net.answer = "[" + std::string(JsonFetch::kAnswerCap * 2, '1') + "]";
+    const int r = fx.f.post(&fx.owner, "https://cloud.example/api/report", R"({"e":1})");
+    REQUIRE(r > 0);
+    REQUIRE(fx.f.settle(2000));
+    CHECK(fx.f.outcome(&fx.owner, r) == 200);
+    CHECK(net.method == "POST");
+    CHECK(net.body == R"({"e":1})");
+}
+
+// A json member keeps its handle across a recompile; the document behind it was freed, and the handle then named the next document in that place.
+TEST_CASE("a handle kept past its document's release names nothing, even once the place is taken again") {
+    Fixture fx;
+    const int old = fx.f.literal(&fx.owner, R"({"a":1})");
+    REQUIRE(old > 0);
+    fx.f.release(&fx.owner);
+    const int fresh = fx.f.literal(&fx.owner, R"({"b":2})");
+    REQUIRE(fresh > 0);
+    CHECK(fresh != old);
+    CHECK(fx.f.doc(&fx.owner, old) == nullptr);
+    CHECK(fx.f.doc(&fx.owner, fresh) != nullptr);
+}
+
+TEST_CASE("a push that could not go says so: status 0, and a change to read") {
+    Fixture fx;
+    // No scheduler to apply it: a push to this device reaches nothing.
+    const int d = fx.f.literal(&fx.owner, R"({"Effects":{}})");
+    const int r = fx.f.push(&fx.owner, nullptr, d);
+    REQUIRE(r > 0);
+    CHECK(fx.f.changed(&fx.owner, r));
+    CHECK(fx.f.status(&fx.owner, r) == 0);
+}
+
+TEST_CASE("a push still queued when the device stops is answered, so nothing waits for it forever") {
+    Fixture fx;
+    Scheduler s;
+    auto* effects = new JfBox();
+    effects->setName("Effects");
+    s.addModule(effects);
+    s.setup();
+    const int d = fx.f.literal(&fx.owner, R"({"Effects":{}})");
+    const int r = fx.f.push(&fx.owner, nullptr, d);
+    REQUIRE(fx.f.outcome(&fx.owner, r) == -1);   // on its way
+    s.release();                              // before the frame boundary applied it
+    CHECK(fx.f.outcome(&fx.owner, r) == 400);
+    CHECK(fx.f.settle(100));                  // nothing counted as on its way any more
+}
diff --git a/test/unit/core/unit_JsonUtil_pointer.cpp b/test/unit/core/unit_JsonUtil_pointer.cpp
new file mode 100644
index 000000000..965e652c8
--- /dev/null
+++ b/test/unit/core/unit_JsonUtil_pointer.cpp
@@ -0,0 +1,181 @@
+/// @module JsonUtil
+
+/// Pins what a script's `json` values stand on: addressing a document by JSON Pointer (RFC 6901), reading decimals as fixed point, editing in place and writing it back as text.
+
+#include "doctest.h"
+#include "core/util/JsonSink.h"
+#include "core/util/JsonUtil.h"
+
+#include <cstring>
+#include <string>
+
+using namespace mm;
+
+namespace {
+/// A node, or a document, written back as text.
+std::string text(const json::JsonDoc& doc, const json::JsonNode* n) {
+    JsonSink sink;
+    json::write(sink, doc, n);
+    return sink.data();
+}
+std::string text(const json::JsonDoc& doc) { return text(doc, doc.rootNode()); }
+}  // namespace
+
+TEST_CASE("a JSON Pointer finds every value of RFC 6901's own example") {
+    json::JsonDoc doc;
+    REQUIRE(json::parse(R"({"foo":["bar","baz"],"":0,"a/b":1,"c%d":2,"e^f":3,"g|h":4,"i\\j":5,"k\"l":6," ":7,"m~n":8})", doc));
+    CHECK(json::at(doc, "") == doc.rootNode());
+    CHECK(text(doc, json::at(doc, "/foo")) == R"(["bar","baz"])");
+    CHECK(text(doc, json::at(doc, "/foo/0")) == R"("bar")");
+    CHECK(json::readInt(json::at(doc, "/")) == 0);
+    CHECK(json::readInt(json::at(doc, "/a~1b")) == 1);
+    CHECK(json::readInt(json::at(doc, "/c%d")) == 2);
+    CHECK(json::readInt(json::at(doc, "/e^f")) == 3);
+    CHECK(json::readInt(json::at(doc, "/g|h")) == 4);
+    CHECK(json::readInt(json::at(doc, "/i\\j")) == 5);
+    CHECK(json::readInt(json::at(doc, "/k\"l")) == 6);
+    CHECK(json::readInt(json::at(doc, "/ ")) == 7);
+    CHECK(json::readInt(json::at(doc, "/m~0n")) == 8);
+}
+
+TEST_CASE("a pointer that leaves the document finds nothing") {
+    json::JsonDoc doc;
+    REQUIRE(json::parse(R"({"results":[{"title":"x"}]})", doc));
+    CHECK(json::at(doc, "/results/1") == nullptr);        // past the end
+    CHECK(json::at(doc, "/results/01") == nullptr);       // a leading zero is not an index
+    CHECK(json::at(doc, "/results/0/title/x") == nullptr); // into a string
+    CHECK(json::at(doc, "results") == nullptr);           // no leading slash
+    CHECK(json::at(doc, nullptr) == nullptr);
+    json::JsonDoc empty;
+    CHECK(json::at(empty, "") == nullptr);
+}
+
+TEST_CASE("a decimal reads as fixed point and truncated as a whole number") {
+    json::JsonDoc doc;
+    REQUIRE(json::parse(R"({"t":21.5,"n":-0.5,"k":1e3,"q":2.5e-1,"big":123456,"tiny":0.00001})", doc));
+    CHECK(json::readFixed(json::at(doc, "/t")) == 21 * 65536 + 32768);
+    CHECK(json::readInt(json::at(doc, "/t")) == 21);
+    CHECK(json::readFixed(json::at(doc, "/n")) == -32768);
+    CHECK(json::readInt(json::at(doc, "/n")) == 0);
+    CHECK(json::readInt(json::at(doc, "/k")) == 1000);   // the exponent counts
+    CHECK(json::readFixed(json::at(doc, "/q")) == 16384);
+    CHECK(json::readFixed(json::at(doc, "/big")) == INT32_MAX);   // past fixed point's range: saturated
+    CHECK(json::readInt(json::at(doc, "/big")) == 123456);
+    CHECK(json::readFixed(json::at(doc, "/tiny")) == 1);  // rounded to the nearest 1/65536
+    CHECK(json::readFixed(json::at(doc, "/missing"), -1) == -1);
+}
+
+TEST_CASE("a parsed document writes back exactly as it was written") {
+    const char* in = R"({"a":[1,2.50,-3e2],"b":"x\"y","c":null,"d":true,"e":{}})";
+    json::JsonDoc doc;
+    REQUIRE(json::parse(in, doc));
+    CHECK(text(doc) == in);
+}
+
+TEST_CASE("a set creates the members and objects its pointer names") {
+    json::JsonDoc doc;
+    REQUIRE(json::setInt(doc, "/Effects/Layer/opacity", 128));
+    REQUIRE(json::setString(doc, "/Effects/Layer/Text/text", "21.5 C"));
+    REQUIRE(json::setFixed(doc, "/temp", 21 * 65536 + 32768));
+    CHECK(text(doc) == R"({"Effects":{"Layer":{"opacity":128,"Text":{"text":"21.5 C"}}},"temp":21.5000})");
+    // A second set replaces rather than adding a twin.
+    REQUIRE(json::setInt(doc, "/Effects/Layer/opacity", 0));
+    CHECK(json::readInt(json::at(doc, "/Effects/Layer/opacity"), -1) == 0);
+    CHECK(text(doc, json::at(doc, "/Effects/Layer")) == R"({"opacity":0,"Text":{"text":"21.5 C"}})");
+}
+
+TEST_CASE("a set into an array replaces an element or appends at '-'") {
+    json::JsonDoc doc;
+    REQUIRE(json::parse(R"({"list":[1,2]})", doc));
+    CHECK(json::setInt(doc, "/list/1", 5));
+    CHECK(json::setInt(doc, "/list/-", 9));
+    CHECK_FALSE(json::setInt(doc, "/list/7", 1));        // past the end
+    CHECK_FALSE(json::setInt(doc, "/list/0/x", 1));      // through a number
+    CHECK(text(doc) == R"({"list":[1,5,9]})");
+}
+
+TEST_CASE("a value copies between documents, whole objects included") {
+    json::JsonDoc feed, show;
+    REQUIRE(json::parse(R"({"results":[{"title":"Rocket \"Lab\" launches","n":3.25}]})", feed));
+    REQUIRE(json::parse(R"({"Text":{"text":""}})", show));
+    CHECK(json::copyValue(show, "/Text/text", feed, "/results/0/title"));
+    CHECK(json::copyValue(show, "/item", feed, "/results/0"));
+    CHECK_FALSE(json::copyValue(show, "/x", feed, "/results/4"));
+    CHECK(text(show) == R"({"Text":{"text":"Rocket \"Lab\" launches"},"item":{"title":"Rocket \"Lab\" launches","n":3.25}})");
+}
+
+TEST_CASE("a value copies into its own subtree without looping") {
+    json::JsonDoc doc;
+    REQUIRE(json::parse(R"({"a":{"x":1}})", doc));
+    CHECK(json::copyValue(doc, "/a/b", doc, "/a"));
+    CHECK(text(doc) == R"({"a":{"x":1,"b":{"x":1}}})");
+}
+
+TEST_CASE("an edited copy outlives the document it came from") {
+    json::JsonDoc dst;
+    {
+        json::JsonDoc src;
+        REQUIRE(json::parse(R"({"s":"kept","n":1.75})", src));
+        REQUIRE(json::copyValue(dst, "/v", src, ""));
+    }
+    CHECK(text(dst) == R"({"v":{"s":"kept","n":1.75}})");
+}
+
+TEST_CASE("a \\u escape decodes to UTF-8, a surrogate pair to one character") {
+    json::JsonDoc doc;
+    REQUIRE(json::parse(R"({"t":"it’s é 🚀 A \ud800x"})", doc));
+    char s[64];
+    REQUIRE(json::readString(json::at(doc, "/t"), s, sizeof(s)));
+    CHECK(std::string(s) == "it\xE2\x80\x99s \xC3\xA9 \xF0\x9F\x9A\x80 A ?x");
+    // A high half followed by an escape that is not its low half: the half reads '?', and the escape after it still decodes.
+    REQUIRE(json::parse(R"({"t":"\ud83d\u0041\ud83d\ude80"})", doc));
+    REQUIRE(json::readString(json::at(doc, "/t"), s, sizeof(s)));
+    CHECK(std::string(s) == "?A\xF0\x9F\x9A\x80");
+}
+
+TEST_CASE("a quoted number reads as the number it starts with, as services quote theirs") {
+    json::JsonDoc doc;
+    REQUIRE(json::parse(R"({"price":"81201.915","pct":"0.2585%","score":"3","name":"Arsenal","n":7})", doc));
+    long w = 0; int32_t f = 0;
+    REQUIRE(json::readNumber(json::at(doc, "/price"), w, f));
+    CHECK(w == 81201);
+    REQUIRE(json::readNumber(json::at(doc, "/pct"), w, f));
+    CHECK(f == 16941);   // 0.2585 in Q16.16, rounded
+    REQUIRE(json::readNumber(json::at(doc, "/score"), w, f));
+    CHECK(w == 3);
+    REQUIRE(json::readNumber(json::at(doc, "/n"), w, f));
+    CHECK(w == 7);
+    CHECK_FALSE(json::readNumber(json::at(doc, "/name"), w, f));
+    CHECK_FALSE(json::readNumber(json::at(doc, "/missing"), w, f));
+}
+
+TEST_CASE("text joins onto a string, from the caller or from another document's value") {
+    json::JsonDoc feed, show;
+    REQUIRE(json::parse(R"({"data":{"amount":"81201.915"},"t":9.4,"ok":true})", feed));
+    REQUIRE(json::appendText(show, "/text", "BTC $"));
+    REQUIRE(json::appendValue(show, "/text", feed, "/data/amount"));
+    REQUIRE(json::appendText(show, "/text", " / "));
+    REQUIRE(json::appendValue(show, "/text", feed, "/t"));
+    REQUIRE(json::appendValue(show, "/text", feed, "/ok"));
+    CHECK_FALSE(json::appendValue(show, "/text", feed, "/nope"));
+    CHECK(text(show) == R"({"text":"BTC $81201.915 / 9.4true"})");
+}
+
+// The demo edits its bands whenever a feed changes. Replaced text and nodes were kept until the document went, so a device ran out of memory within days.
+TEST_CASE("an edit repeated forever holds the memory of one, its replaced text and nodes reused") {
+    json::JsonDoc feed, show;
+    REQUIRE(json::parse(R"({"item":{"title":"news","n":3.25,"tags":["a","b"]}})", feed));
+    REQUIRE(json::parse(R"({"Text":{"text":""}})", show));
+    int owned = 0, nodes = 0;
+    for (int round = 0; round < 1000; round++) {
+        REQUIRE(json::setString(show, "/Text/text", "BTC "));
+        REQUIRE(json::appendValue(show, "/Text/text", feed, "/item/n"));
+        REQUIRE(json::setFixed(show, "/Text/speed", 98304));
+        REQUIRE(json::copyValue(show, "/item", feed, "/item"));
+        if (round == 0) { owned = show.ownedCount; nodes = show.count; continue; }
+        if (show.ownedCount != owned || show.count != nodes) break;   // one report, not a thousand
+    }
+    CHECK(show.ownedCount == owned);   // every key and string the document holds, once
+    CHECK(show.count == nodes);
+    CHECK(text(show) == R"({"Text":{"text":"BTC 3.25","speed":1.5000},"item":{"title":"news","n":3.25,"tags":["a","b"]}})");
+}
diff --git a/test/unit/core/unit_MoonCloudModule.cpp b/test/unit/core/unit_MoonCloudModule.cpp
index 666d15df7..c79e26920 100644
--- a/test/unit/core/unit_MoonCloudModule.cpp
+++ b/test/unit/core/unit_MoonCloudModule.cpp
@@ -27,12 +27,12 @@ void acknowledge(mm::MoonModule& m, int32_t id) {
 }  // namespace
 
 TEST_CASE("the relay's controls exist only on a board that relays, hidden, the request itself never saved") {
-    mm::MoonCloudModule plain(false);
+    mm::MoonCloudModule plain(mm::MoonCloudModule::Route::Direct);
     plain.defineControls();
     CHECK(control(plain, "outbox") == nullptr);
     CHECK(control(plain, "outbox sent") == nullptr);
 
-    mm::MoonCloudModule relay(true);
+    mm::MoonCloudModule relay(mm::MoonCloudModule::Route::Page);
     relay.defineControls();
     const auto* box = control(relay, "outbox");
     REQUIRE(box != nullptr);
@@ -44,7 +44,7 @@ TEST_CASE("the relay's controls exist only on a board that relays, hidden, the r
 }
 
 TEST_CASE("a post waits in the outbox as its id, path and body, and the next is refused until the page empties it") {
-    mm::MoonCloudModule cloud(true);
+    mm::MoonCloudModule cloud(mm::MoonCloudModule::Route::Page);
     cloud.defineControls();
     cloud.setup();
     CHECK(cloud.canSend());
@@ -57,15 +57,15 @@ TEST_CASE("a post waits in the outbox as its id, path and body, and the next is
     CHECK_FALSE(cloud.post("/api/talk", "{\"text\":\"hi\"}"));   // one slot: the report still waits
     CHECK(outbox(cloud) == "{\"id\":1,\"path\":\"/api/report\",\"body\":{\"event\":\"install\"}}");
 
-    CHECK(cloud.outboxWaiting());
+    CHECK(cloud.waiting());
     acknowledge(cloud, 1);
     CHECK(outbox(cloud).empty());
-    CHECK_FALSE(cloud.outboxWaiting());
+    CHECK_FALSE(cloud.waiting());
     CHECK(cloud.post("/api/talk", "{\"text\":\"hi\"}"));
 }
 
 TEST_CASE("a request too large for the outbox is refused rather than truncated") {
-    mm::MoonCloudModule cloud(true);
+    mm::MoonCloudModule cloud(mm::MoonCloudModule::Route::Page);
     cloud.defineControls();
     const std::string body = "{\"text\":\"" + std::string(4096, 'x') + "\"}";
     CHECK_FALSE(cloud.post("/api/talk", body.c_str()));
@@ -74,26 +74,80 @@ TEST_CASE("a request too large for the outbox is refused rather than truncated")
 
 // A second open page can acknowledge a request after the first page already did and a newer one took its place: that acknowledgement must not drop the newer request unsent.
 TEST_CASE("a late acknowledgement of an earlier request leaves the newer one waiting") {
-    mm::MoonCloudModule cloud(true);
+    mm::MoonCloudModule cloud(mm::MoonCloudModule::Route::Page);
     cloud.defineControls();
     cloud.setup();
     REQUIRE(cloud.post("/api/report", "{}"));
     acknowledge(cloud, 1);
     REQUIRE(cloud.post("/api/talk", "{}"));          // id 2
     acknowledge(cloud, 1);                            // the other page, late
-    CHECK(cloud.outboxWaiting());
+    CHECK(cloud.waiting());
     acknowledge(cloud, 2);
-    CHECK_FALSE(cloud.outboxWaiting());
+    CHECK_FALSE(cloud.waiting());
 }
 
 // The acknowledgement is a saved value, so a boot restores it: the ids count on past it, or the restored value could match and empty a request no page delivered.
 TEST_CASE("after a reboot the ids count on from the last acknowledged one") {
-    mm::MoonCloudModule cloud(true);
+    mm::MoonCloudModule cloud(mm::MoonCloudModule::Route::Page);
     cloud.defineControls();
     *static_cast<int32_t*>(const_cast<void*>(control(cloud, "outbox sent")->ptr)) = 7;   // what the settings file restored
     cloud.setup();
     REQUIRE(cloud.post("/api/report", "{}"));
     CHECK(outbox(cloud).rfind("{\"id\":8,", 0) == 0);
     acknowledge(cloud, 7);
-    CHECK(cloud.outboxWaiting());
+    CHECK(cloud.waiting());
+}
+
+namespace {
+int g_direct = 0;
+int directStandIn(const char*, const char*, const char*, char*, size_t) { g_direct++; return 200; }
+}  // namespace
+
+/// A board without PSRAM sends itself while a TLS session fits, and hands the request to the open page when one does not, so its report still arrives.
+TEST_CASE("without PSRAM a post goes out of the board while TLS fits, and to the page while it does not") {
+    if (!mm::platform::httpsAvailable()) { MESSAGE("no HTTPS client in this build"); return; }
+    mm::platform::setTestHttpFetch(&directStandIn);
+    g_direct = 0;
+    mm::MoonCloudModule cloud(mm::MoonCloudModule::Route::DirectOrPage);
+    cloud.defineControls();
+    CHECK(control(cloud, "outbox") != nullptr);      // the page's way is there, hidden
+    CHECK_FALSE(cloud.relaysThroughBrowser());       // though the board has its own client
+
+    // Room for a session: out of the board, on the worker.
+    const uint32_t first = cloud.post("/api/report", "{}");
+    REQUIRE(first);
+    CHECK_FALSE(cloud.lastViaPage());
+    REQUIRE(mm::JsonFetch::instance().settle(2000));
+    CHECK_FALSE(cloud.waiting(first));
+    CHECK(cloud.delivered(first));
+    CHECK(g_direct == 1);
+
+    // Internal RAM under the floor plus a session: to the page instead.
+    mm::platform::setTestFreeInternalHeap(mm::platform::kInternalFreeFloor);
+    REQUIRE(cloud.post("/api/report", "{}"));
+    CHECK(cloud.lastViaPage());
+    CHECK(cloud.waiting());
+    CHECK(g_direct == 1);                            // nothing left the board
+    mm::platform::setTestFreeInternalHeap(0);
+    mm::platform::setTestHttpFetch(nullptr);
+}
+
+/// Two modules send through one MoonCloud, so each reads the outcome of its own ticket, never the other's.
+TEST_CASE("each sender reads its own request's outcome, and an older ticket's reads as not arrived") {
+    mm::MoonCloudModule cloud(mm::MoonCloudModule::Route::Page);
+    cloud.defineControls();
+    const uint32_t report = cloud.post("/api/report", "{}");
+    REQUIRE(report);
+    CHECK(cloud.waiting(report));
+    acknowledge(cloud, 1);
+    CHECK(cloud.delivered(report));
+    const uint32_t talk = cloud.post("/api/talk", "{}");
+    REQUIRE(talk);
+    CHECK(talk != report);
+    CHECK_FALSE(cloud.waiting(report));
+    CHECK(cloud.waiting(talk));
+    CHECK_FALSE(cloud.delivered(talk));
+    acknowledge(cloud, 2);
+    CHECK(cloud.delivered(talk));
+    CHECK_FALSE(cloud.delivered(report));   // its outcome was settled before, and is gone
 }
diff --git a/test/unit/core/unit_MoonLiveService.cpp b/test/unit/core/unit_MoonLiveService.cpp
index a5d83eeb6..2120586bd 100644
--- a/test/unit/core/unit_MoonLiveService.cpp
+++ b/test/unit/core/unit_MoonLiveService.cpp
@@ -7,6 +7,7 @@
 /// This is the test the plan's step 2 asks for: the script does in eight lines what ButtonService does as a module, and proving both drive the same control through the same primitive is what "compiled and scripted are interchangeable" means.
 
 #include "doctest.h"
+#include "moonlive_script_file.h"
 #include "core/services/MoonLiveService.h"
 #include "core/module/Scheduler.h"
 #include "core/module/MoonModule.h"
@@ -30,16 +31,6 @@ struct FakeControl : public MoonModule {
 
 constexpr uint8_t kPin = 4;
 
-/// Write a script into the device's script directory, the same place the UI saves one.
-///
-/// Through the PLATFORM fs, not std::ofstream: the desktop platform roots its filesystem somewhere of its own choosing, so writing to a host-relative "/moonlive" put the file where the loader would never look and every script silently failed to compile.
-void writeScript(const char* name, const char* body) {
-    platform::fsMkdir(moonlive::kScriptDir);
-    char path[96];
-    std::snprintf(path, sizeof(path), "%s/%s", moonlive::kScriptDir, name);
-    REQUIRE(platform::fsWriteAtomic(path, body, std::strlen(body)));
-}
-
 struct Rig {
     Scheduler scheduler;
     // The filesystem is what MOUNTS storage: a script is a file, so without this in the tree every write fails and the service has nothing to compile. Alone in a run the mount happened to survive from another test; in the full suite it does not, which is why this is explicit.
@@ -104,6 +95,46 @@ TEST_CASE("a scripted service reads a pin and drives the control surface") {
     CHECK(rig.control->switch1 == 0);
 }
 
+// A show's service writes its slots 50 times a second; saving them wrote the configuration to flash about once a second.
+TEST_CASE("a scripted service's writes drive the control surface without marking it to be saved") {
+    Rig rig;
+    writeScript("t_drive.mls",
+                "class Drive {\n"
+                "  void tick20ms() { setControl(\"switch1\", 1); }\n"
+                "}\n");
+    rig.svc->setScript("t_drive.mls");
+    rig.svc->prepare();
+    rig.control->clearDirty();
+    rig.svc->tick20ms();
+    CHECK(rig.control->switch1 == 1);         // the write landed
+    CHECK_FALSE(rig.control->dirty());        // and nothing asks for a save
+}
+
+// Every prepare read the script file to hash it, 30 to 70 ms a read under load on an ESP32-S3; now only an announced change does.
+TEST_CASE("a script file is read again only after a change to it is announced") {
+    Rig rig;
+    auto has = [&](const char* name) {
+        const auto& cs = rig.svc->controls();
+        for (uint8_t i = 0; i < cs.count(); i++) if (std::strcmp(cs[i].name, name) == 0) return true;
+        return false;
+    };
+    writeScript("t_v.mls", "class V {\n  int a = 1;\n  void defineControls() { addControl(\"a\", a, 0, 9); }\n}\n");
+    rig.svc->setScript("t_v.mls");
+    rig.svc->prepare();
+    REQUIRE(has("a"));
+
+    writeScript("t_v.mls", "class V {\n  int b = 1;\n  void defineControls() { addControl(\"b\", b, 0, 9); }\n}\n");
+    rig.svc->prepare();
+    CHECK(has("a"));          // nothing announced the edit, so the compiled program stands
+
+    char path[96];
+    std::snprintf(path, sizeof(path), "%s/t_v.mls", moonlive::kScriptDir);
+    rig.scheduler.notifyFileChanged(path);   // as a save through the file API does
+    rig.svc->prepare();
+    CHECK(has("b"));
+    CHECK_FALSE(has("a"));
+}
+
 TEST_CASE("a scripted service declares its own controls, which a user can set") {
     // `addControl` is what makes a script configurable without editing it: the declared member becomes a real control on the card, bound to the live arena slot the running code reads.
     Rig rig;
diff --git a/test/unit/core/unit_MoonLiveService_json.cpp b/test/unit/core/unit_MoonLiveService_json.cpp
new file mode 100644
index 000000000..f4c1df8e3
--- /dev/null
+++ b/test/unit/core/unit_MoonLiveService_json.cpp
@@ -0,0 +1,264 @@
+/// @module MoonLiveService
+/// @also JsonFetch, Scheduler
+
+/// Pins a service script's `json` values end to end. A feed from the internet drives the surface, a document the script writes builds this device's look, and copied text goes to a second device. The network is a stand-in.
+
+#include "doctest.h"
+#include "moonlive_script_file.h"
+#include "core/services/MoonLiveService.h"
+#include "core/module/Scheduler.h"
+#include "core/module/MoonModule.h"
+#include "core/system/FilesystemModule.h"
+#include "core/util/JsonFetch.h"
+#include "core/util/ModuleFactory.h"
+#include "platform/platform.h"
+
+#include <cstdio>
+#include <cstring>
+#include <filesystem>
+#include <string>
+
+using namespace mm;
+
+namespace {
+
+struct JmControl : public MoonModule {
+    uint8_t switch1 = 0;
+    void defineControls() override { controls_.addControl("switch1", switch1, 0, 1); }
+};
+struct JmKnob : public MoonModule {
+    uint8_t value = 1;
+    void defineControls() override { controls_.addControl("value", value, 0, 100); }
+};
+struct JmBox : public MoonModule {
+    const char* acceptsChildRoles() const override { return "generic,effect"; }
+};
+
+/// What the stand-in network saw last, and what it answers a GET with.
+struct Net {
+    std::string method, url, body;
+    std::string answer;
+};
+Net net;
+
+int standIn(const char* method, const char* url, const char* reqBody, char* body, size_t bodyLen) {
+    net.method = method;
+    net.url = url;
+    net.body = reqBody ? reqBody : "";
+    const std::string reply = std::strcmp(method, "GET") == 0 ? net.answer : R"({"ok":true,"changes":1})";
+    if (body && bodyLen) {
+        if (reply.size() + 1 > bodyLen) return 0;
+        std::strcpy(body, reply.c_str());
+    }
+    return 200;
+}
+
+struct Rig {
+    Scheduler scheduler;
+    FilesystemModule* fs = new FilesystemModule();
+    JmControl* control = new JmControl();
+    JmBox* effects = new JmBox();
+    MoonLiveService* svc = new MoonLiveService();
+    char root_[64];
+    Rig() {
+        static bool registered = false;
+        if (!registered) { ModuleFactory::registerType<JmKnob>("JmKnob"); registered = true; }
+        static unsigned seq = 0;
+        std::snprintf(root_, sizeof(root_), "/tmp/mm_mls_json_%u", ++seq);
+        std::filesystem::remove_all(root_);
+        platform::fsSetRoot(root_);
+        net = Net{};
+        platform::setTestHttpFetch(&standIn);
+        fs->setName("Filesystem");
+        control->setName("Control");
+        effects->setName("Effects");
+        svc->setName("Script");
+        scheduler.addModule(fs);
+        scheduler.addModule(control);
+        scheduler.addModule(effects);
+        scheduler.addModule(svc);
+        scheduler.setup();
+    }
+    ~Rig() {
+        JsonFetch::instance().settle(2000);
+        scheduler.release();
+        platform::setTestHttpFetch(nullptr);
+    }
+    void run(const char* name, const char* script) {
+        writeScript(name, script);
+        svc->setScript(name);
+        svc->prepare();
+    }
+    /// One tick of the service, then whatever it sent has its answer and the frame boundary has passed.
+    void tick() {
+        svc->tick20ms();
+        JsonFetch::instance().settle(2000);
+        scheduler.preparePending();
+    }
+    std::string status() const { return svc->status() ? svc->status() : ""; }
+};
+
+}  // namespace
+
+TEST_CASE("a script reads a number from a fetched document and drives the surface with it") {
+    Rig rig;
+    net.answer = R"({"current":{"on":1,"temperature_2m":21.5}})";
+    rig.run("t_weather.mls",
+            "class Weather {\n"
+            "  json w;\n"
+            "  void tick20ms() {\n"
+            "    w = getJson(\"https://api.example/weather\", 600);\n"
+            "    if (jsonChanged(w)) {\n"
+            "      fixed temp = jsonFixed(w, \"/current/temperature_2m\");\n"
+            "      if (temp > 20.0) { setControl(\"switch1\", jsonInt(w, \"/current/on\")); }\n"
+            "    }\n"
+            "  }\n"
+            "}\n");
+    INFO(rig.status());
+    rig.tick();   // asks
+    rig.tick();   // reads the answer
+    CHECK(net.url == "https://api.example/weather");
+    CHECK(rig.control->switch1 == 1);
+}
+
+TEST_CASE("a script builds a module on its own device with one push, which marks nothing to save") {
+    Rig rig;
+    rig.run("t_show.mls",
+            "class Show {\n"
+            "  bool built = false;\n"
+            "  void tick20ms() {\n"
+            "    if (!built) {\n"
+            "      pushJson(R\"({\"Effects\":{\"Knob\":{\"type\":\"JmKnob\",\"value\":42}}})\");\n"
+            "      built = true;\n"
+            "    }\n"
+            "  }\n"
+            "}\n");
+    INFO(rig.status());
+    rig.effects->clearDirty();
+    rig.tick();
+    MoonModule* knob = rig.scheduler.firstByName("Knob");
+    REQUIRE(knob != nullptr);
+    CHECK(static_cast<JmKnob*>(knob)->value == 42);
+    CHECK_FALSE(rig.effects->dirty());
+}
+
+TEST_CASE("a script copies text between documents and sends the result to another device") {
+    Rig rig;
+    net.answer = R"({"results":[{"title":"Rocket \"Lab\" launches"}],"n":4})";
+    rig.run("t_relay.mls",
+            "class Relay {\n"
+            "  json feed;\n"
+            "  json show;\n"
+            "  void tick20ms() {\n"
+            "    feed = getJson(\"https://api.example/news\", 600);\n"
+            "    if (jsonChanged(feed)) {\n"
+            "      show = R\"({\"Effects\":{\"Text\":{\"text\":\"\"}}})\";\n"
+            "      jsonCopy(show, \"/Effects/Text/text\", feed, \"/results/0/title\");\n"
+            "      jsonSetInt(show, \"/Effects/Text/speed\", jsonInt(feed, \"/n\") + 1);\n"
+            "      pushJsonTo(\"eye.local\", show);\n"
+            "    }\n"
+            "  }\n"
+            "}\n");
+    INFO(rig.status());
+    rig.tick();
+    rig.tick();
+    CHECK(net.method == "PATCH");
+    CHECK(net.url == "http://eye.local/api/state?live=1");
+    CHECK(net.body == R"({"Effects":{"Text":{"text":"Rocket \"Lab\" launches","speed":5}}})");
+}
+
+TEST_CASE("a json value takes no arithmetic and a number is no document, named at compile time") {
+    Rig rig;
+    rig.run("t_bad1.mls", "class B {\n  json d;\n  void tick20ms() { int x = d + 1; }\n}\n");
+    CHECK(rig.status().find("a json value is a document") != std::string::npos);
+    rig.run("t_bad2.mls", "class B {\n  void tick20ms() { int n = 5; pushJson(n); }\n}\n");
+    CHECK(rig.status().find("this is a json document") != std::string::npos);
+    rig.run("t_bad3.mls", "class B {\n  json d = 3;\n  void tick20ms() { }\n}\n");
+    CHECK(rig.status().find("a json member starts empty") != std::string::npos);
+    rig.run("t_bad4.mls", "class B {\n  json d;\n  void defineControls() { addControl(\"d\", d, 0, 1); }\n  void tick20ms() { }\n}\n");
+    CHECK(rig.status().find("a control binds") != std::string::npos);
+    rig.run("t_bad5.mls", "class B {\n  void tick20ms() { json d = R\"(unterminated; }\n}\n");
+    CHECK(rig.status().find("unterminated raw string") != std::string::npos);
+}
+
+TEST_CASE("a raw string keeps quotes and spans lines, and a long one costs only its own script") {
+    Rig rig;
+    std::string big = "class Big {\n  void tick20ms() {\n    json d = R\"({\n";
+    for (int i = 0; i < 100; i++) big += "      \"key" + std::to_string(i) + "\": \"a value with \\\"quotes\\\"\",\n";
+    big += "      \"end\": 1\n    })\";\n  }\n}\n";
+    rig.run("t_big.mls", big.c_str());
+    INFO(rig.status());
+    CHECK(rig.status().find(" B") != std::string::npos);  // compiled: the status names its size
+    CHECK(rig.status().find('@') == std::string::npos);   // and no error position
+    rig.tick();
+}
+
+TEST_CASE("an edited script starts with no documents, and a removed one leaves none behind") {
+    Rig rig;
+    net.answer = R"({"v":1})";
+    const char* script = "class F {\n  json w;\n  void tick20ms() { w = getJson(\"https://api.example/a\", 600); }\n}\n";
+    rig.run("t_life.mls", script);
+    rig.tick();
+    // A new program frees the old one's documents, so the table does not fill edit by edit.
+    for (int i = 0; i < JsonFetch::kMaxDocs + 2; i++) {
+        rig.svc->onFileChanged(moonlive::kScriptDir);
+        writeScript("t_life.mls", script);
+        rig.svc->prepare();
+        rig.tick();
+    }
+    CHECK(net.url == "https://api.example/a");
+    JsonFetch& f = JsonFetch::instance();
+    int dummy = 0;
+    CHECK(f.literal(&dummy, R"({"room":true})") > 0);   // the table still has room
+    f.release(&dummy);
+}
+
+TEST_CASE("a shipped script the device lacks is listed for an open page, and leaves the list when it lands") {
+    Rig rig;
+    moonlive::missingScripts()[0] = '\0';
+    rig.svc->setScript("stadbeest-autopilot.mls");
+    rig.svc->prepare();
+    CHECK(rig.status().find("script missing") != std::string::npos);
+    CHECK(std::string(moonlive::missingScripts()) == "stadbeest-autopilot.mls");
+    // A name the firmware does not ship is the user's mistake, which no page can fix.
+    rig.svc->setScript("t_nowhere.mls");
+    rig.svc->prepare();
+    CHECK(rig.status().find("script not found") != std::string::npos);
+    CHECK(std::string(moonlive::missingScripts()) == "stadbeest-autopilot.mls");
+    // The page writes the file, as its download does, and the next compile finds it.
+    writeScript("stadbeest-autopilot.mls", "class A {\n  void tick20ms() { }\n}\n");
+    rig.svc->setScript("stadbeest-autopilot.mls");
+    rig.svc->onFileChanged(moonlive::kScriptDir);
+    rig.svc->prepare();
+    CHECK(std::string(moonlive::missingScripts()).empty());
+}
+
+TEST_CASE("the missing list holds each name once and drops any one of them") {
+    moonlive::missingScripts()[0] = '\0';
+    moonlive::noteScriptMissing("a.mle");
+    moonlive::noteScriptMissing("b.mlp");
+    moonlive::noteScriptMissing("a.mle");
+    moonlive::noteScriptMissing("c.mls");
+    CHECK(std::string(moonlive::missingScripts()) == "a.mle|b.mlp|c.mls");
+    moonlive::noteScriptPresent("b.mlp");
+    CHECK(std::string(moonlive::missingScripts()) == "a.mle|c.mls");
+    moonlive::noteScriptPresent("c.mls");
+    CHECK(std::string(moonlive::missingScripts()) == "a.mle");
+    moonlive::noteScriptPresent("a.mle");
+    CHECK(std::string(moonlive::missingScripts()).empty());
+    // Past the room a name waits rather than cutting the list.
+    for (int i = 0; i < 40; i++) moonlive::noteScriptMissing(("long-script-name-" + std::to_string(i) + ".mle").c_str());
+    CHECK(std::strlen(moonlive::missingScripts()) < moonlive::kMissingText);
+    moonlive::missingScripts()[0] = '\0';
+}
+
+// Only a compile dropped a name, so one whose module went before its download landed was fetched again every minute.
+TEST_CASE("a missing script leaves the list when its file lands, whether or not anything compiles it") {
+    moonlive::missingScripts()[0] = '\0';
+    moonlive::noteScriptMissing("voronoi.mle");
+    moonlive::noteScriptMissing("fire.mlp");
+    moonlive::noteScriptLanded("/.moonlive/voronoi.mle");
+    CHECK(std::string(moonlive::missingScripts()) == "fire.mlp");
+    moonlive::noteScriptLanded("fire.mlp");
+    CHECK(std::string(moonlive::missingScripts()).empty());
+}
diff --git a/test/unit/core/unit_MoonStatsModule.cpp b/test/unit/core/unit_MoonStatsModule.cpp
index fafd4c872..bc60384d8 100644
--- a/test/unit/core/unit_MoonStatsModule.cpp
+++ b/test/unit/core/unit_MoonStatsModule.cpp
@@ -324,7 +324,7 @@ TEST_CASE("the consent explanation is a status that follows the answer") {
 /// So a reboot before any page opens sends it again rather than losing it.
 TEST_CASE("a report handed to the page counts as sent only once the page delivers it") {
     mm::Scheduler scheduler;
-    auto* cloud = new mm::MoonCloudModule(true);   // the relay a board without HTTPS gets
+    auto* cloud = new mm::MoonCloudModule(mm::MoonCloudModule::Route::Page);   // the relay a board without HTTPS gets
     cloud->setName("MoonCloud");
     auto* stats = new mm::MoonStatsModule();
     stats->setName("Stats");
@@ -336,11 +336,11 @@ TEST_CASE("a report handed to the page counts as sent only once the page deliver
     stats->setConsent(true);
     CHECK(stats->reportDue());
     stats->onControlChanged("send update");
-    REQUIRE(cloud->outboxWaiting());
+    REQUIRE(cloud->waiting());
 
     stats->tick1s();               // handed over but not delivered: still due, nothing else queued
     CHECK(stats->reportDue());
-    CHECK(cloud->outboxWaiting());
+    CHECK(cloud->waiting());
 
     // The page delivered it, and wrote the request's id back: the first request this boot is 1.
     for (uint8_t i = 0; i < cloud->controls().count(); i++)
@@ -349,3 +349,45 @@ TEST_CASE("a report handed to the page counts as sent only once the page deliver
     stats->tick1s();
     CHECK_FALSE(stats->reportDue());
 }
+
+namespace {
+int g_cloudStatus = 200;
+int g_cloudPosts = 0;
+int cloudStandIn(const char* method, const char*, const char*, char*, size_t) {
+    g_cloudPosts += std::strcmp(method, "POST") == 0;
+    return g_cloudStatus;
+}
+}  // namespace
+
+/// Over HTTPS the report goes out on the JSON client's worker, so the loop never waits for a handshake; a press says "Sending..." and then how it went.
+TEST_CASE("a pressed report goes out on the worker and says how it went once answered") {
+    if (!mm::platform::httpsAvailable()) { MESSAGE("no HTTPS client in this build"); return; }
+    mm::platform::setTestHttpFetch(&cloudStandIn);
+    for (const int status : {200, 0}) {
+        g_cloudStatus = status;
+        g_cloudPosts = 0;
+        mm::Scheduler scheduler;
+        auto* cloud = new mm::MoonCloudModule(mm::MoonCloudModule::Route::Direct);
+        cloud->setName("MoonCloud");
+        auto* stats = new mm::MoonStatsModule();
+        stats->setName("Stats");
+        cloud->addChild(stats);
+        scheduler.addModule(cloud);
+        scheduler.setup();
+        stats->setConsent(true);
+        stats->onControlChanged("send update");
+        CHECK(std::string(stats->status()) == "Sending...");
+        REQUIRE(mm::JsonFetch::instance().settle(2000));
+        stats->tick1s();
+        CHECK(g_cloudPosts == 1);
+        if (status == 200) {
+            CHECK(std::string(stats->status()).rfind("Sent.", 0) == 0);
+            CHECK_FALSE(stats->reportDue());
+        } else {
+            CHECK(std::string(stats->status()).rfind("Could not reach the server", 0) == 0);
+            CHECK(stats->reportDue());   // a failed press does not count
+        }
+        scheduler.release();
+    }
+    mm::platform::setTestHttpFetch(nullptr);
+}
diff --git a/test/unit/core/unit_MoonTalkModule.cpp b/test/unit/core/unit_MoonTalkModule.cpp
index e73b25606..3ade48d59 100644
--- a/test/unit/core/unit_MoonTalkModule.cpp
+++ b/test/unit/core/unit_MoonTalkModule.cpp
@@ -134,3 +134,34 @@ TEST_CASE("the talk consent explanation is a status that follows the answer") {
     talk.setConsentForTest(true);
     CHECK(talk.status() == nullptr);
 }
+
+namespace {
+int g_talkStatus = 200;
+int talkStandIn(const char*, const char*, const char*, char*, size_t) { return g_talkStatus; }
+}  // namespace
+
+/// The box keeps the message until the server took it, so an unreachable server never costs what somebody typed.
+TEST_CASE("a message leaves the box only once it arrived") {
+    if (!mm::platform::httpsAvailable()) { MESSAGE("no HTTPS client in this build"); return; }
+    mm::platform::setTestHttpFetch(&talkStandIn);
+    for (const int status : {0, 200}) {
+        g_talkStatus = status;
+        mm::Scheduler scheduler;
+        auto* cloud = new mm::MoonCloudModule(mm::MoonCloudModule::Route::Direct);
+        cloud->setName("MoonCloud");
+        auto* talk = new mm::MoonTalkModule();
+        talk->setName("Talk");
+        cloud->addChild(talk);
+        scheduler.addModule(cloud);
+        scheduler.setup();
+        talk->setConsentForTest(true);
+        talk->setMessageForTest("hello");
+        talk->onControlChanged("send");
+        CHECK(std::string(talk->message()) == "hello");   // on its way: still in the box
+        REQUIRE(mm::JsonFetch::instance().settle(2000));
+        talk->tick1s();
+        CHECK(std::string(talk->message()) == (status == 200 ? "" : "hello"));
+        scheduler.release();
+    }
+    mm::platform::setTestHttpFetch(nullptr);
+}
diff --git a/test/unit/core/unit_Scheduler_prepareScope.cpp b/test/unit/core/unit_Scheduler_prepareScope.cpp
new file mode 100644
index 000000000..00ce1e9b1
--- /dev/null
+++ b/test/unit/core/unit_Scheduler_prepareScope.cpp
@@ -0,0 +1,121 @@
+/// @module Scheduler
+
+#include "doctest.h"
+#include "core/module/Scheduler.h"
+#include "core/module/MoonModule.h"
+
+#include <cstdio>
+
+// Pins how far a reshaping control change reaches. A show moving a modifier 50 times a second re-prepared the whole tree each time.
+
+namespace {
+
+// Counts its prepares, and reshapes on its one control at the scope it is given.
+struct Node : public mm::MoonModule {
+    explicit Node(const char* n, mm::PrepareScope s = mm::PrepareScope::Tree) : scope(s) { setName(n); }
+    void defineControls() override { controls_.addControl("x", x); MoonModule::defineControls(); }
+    void prepare() override { prepares++; }
+    bool affectsPrepare(const char*) const override { return true; }
+    mm::PrepareScope prepareScope() const override { return scope; }
+    mm::PrepareScope scope;
+    uint8_t x = 0;
+    int prepares = 0;
+};
+
+// Containers under one top module, each holding a leaf that reshapes its container only.
+struct Tree {
+    static constexpr int kContainers = 5;   // one more than a frame holds as separate scopes
+    mm::Scheduler s;
+    Node top{"top"};
+    Node box[kContainers] = {Node{"c0"}, Node{"c1"}, Node{"c2"}, Node{"c3"}, Node{"c4"}};
+    Node leaf[kContainers] = {Node{"l0", mm::PrepareScope::Parent}, Node{"l1", mm::PrepareScope::Parent}, Node{"l2", mm::PrepareScope::Parent},
+                              Node{"l3", mm::PrepareScope::Parent}, Node{"l4", mm::PrepareScope::Parent}};
+    Tree() {
+        for (int i = 0; i < kContainers; i++) { box[i].addChild(&leaf[i]); top.addChild(&box[i]); }
+        s.addModule(&top);
+        top.defineControls();
+        s.setup();
+    }
+    void zero() { top.prepares = 0; for (int i = 0; i < kContainers; i++) box[i].prepares = leaf[i].prepares = 0; }
+    void move(int i, int v = 5) {
+        char name[4] = {'l', static_cast<char>('0' + i), 0, 0};
+        char json[24];
+        std::snprintf(json, sizeof(json), "{\"value\":%d}", v);
+        REQUIRE(s.setControl(name, "x", json) == mm::Scheduler::SetControlResult::Ok);
+    }
+};
+
+}  // namespace
+
+TEST_CASE("a control that reshapes its container prepares that container alone") {
+    Tree t;
+    t.zero();
+    t.move(0);
+    t.s.tick();
+    CHECK(t.box[0].prepares == 1);
+    CHECK(t.leaf[0].prepares == 1);
+    CHECK(t.box[1].prepares == 0);   // the sibling container is untouched
+    CHECK(t.top.prepares == 0);      // and so is the tree above it
+}
+
+TEST_CASE("the same container asked twice in one frame is prepared once") {
+    Tree t;
+    t.zero();
+    t.move(0, 5);
+    t.move(0, 6);
+    t.s.tick();
+    CHECK(t.box[0].prepares == 1);
+    CHECK(t.top.prepares == 0);
+}
+
+// hpwit's show moves two windows in two layers every frame.
+TEST_CASE("two containers asked in one frame are each prepared alone") {
+    Tree t;
+    t.zero();
+    t.move(0);
+    t.move(1);
+    t.s.tick();
+    CHECK(t.box[0].prepares == 1);
+    CHECK(t.box[1].prepares == 1);
+    CHECK(t.box[2].prepares == 0);
+    CHECK(t.top.prepares == 0);
+}
+
+TEST_CASE("more containers in one frame than the scheduler holds widen the rebuild to the tree") {
+    Tree t;
+    t.zero();
+    for (int i = 0; i < Tree::kContainers; i++) t.move(i);
+    t.s.tick();
+    CHECK(t.top.prepares == 1);
+    for (int i = 0; i < Tree::kContainers; i++) CHECK(t.box[i].prepares == 1);   // the tree, once each
+}
+
+TEST_CASE("a container removed before the frame is not touched, and the tree is rebuilt instead") {
+    Tree t;
+    t.zero();
+    t.move(1);
+    t.top.removeChild(&t.box[1]);   // gone before the frame boundary, as a delete through the API would be
+    t.s.tick();
+    CHECK(t.top.prepares == 1);
+    CHECK(t.box[1].prepares == 0);
+}
+
+TEST_CASE("a control whose module names the tree still rebuilds the tree") {
+    Tree t;
+    t.zero();
+    REQUIRE(t.s.setControl("c0", "x", "{\"value\":5}") == mm::Scheduler::SetControlResult::Ok);   // a container keeps the default scope
+    t.s.tick();
+    CHECK(t.top.prepares == 1);
+}
+
+// A service script drives its values rather than configuring them, so a show writing 50 times a second wrote the configuration to flash about once a second.
+TEST_CASE("a live write marks nothing dirty, and the same write from a person does") {
+    Tree t;
+    t.s.setControl("l0", "x", "{\"value\":7}", /*live=*/true);
+    CHECK_FALSE(t.leaf[0].dirty());
+    t.s.setControl("l0", "x", "{\"value\":8}");
+    CHECK(t.leaf[0].dirty());
+    t.leaf[1].clearDirty();
+    t.s.setControl("l1", "enabled", "{\"value\":false}", /*live=*/true);   // a switch a service flips
+    CHECK_FALSE(t.leaf[1].dirty());
+}
diff --git a/test/unit/core/unit_StateDocument.cpp b/test/unit/core/unit_StateDocument.cpp
index af59f8565..566f1faff 100644
--- a/test/unit/core/unit_StateDocument.cpp
+++ b/test/unit/core/unit_StateDocument.cpp
@@ -293,6 +293,21 @@ TEST_CASE("a control a script declares waits for the rebuild, and lands after it
     CHECK(static_cast<SdScript*>(t.find("Script"))->late == 42);
 }
 
+// A show pushes a script's controls with the script: replayed after the rebuild as a plain write, they were marked to save.
+TEST_CASE("a script's control a live document sets lands after the rebuild, still unsaved") {
+    Tree t;
+    static int saves = 0;
+    saves = 0;
+    t.s.setNoteDirtyHook([] { saves++; });
+    auto r = mm::applyStateDocument(t.s, R"({"Effects": {"Script": {"type": "SdScript", "source": "a", "late": 42}}})", mm::StateSource::Live);
+    REQUIRE(r.ok);
+    CHECK(r.deferred == 1);
+    t.s.prepareTree();
+    CHECK(static_cast<SdScript*>(t.find("Script"))->late == 42);
+    CHECK_FALSE(t.find("Script")->dirty());
+    CHECK(saves == 0);
+}
+
 TEST_CASE("a mistyped control on a script the document leaves as it is is named at once") {
     Tree t;
     REQUIRE(t.apply(R"({"Effects": {"Script": {"type": "SdScript", "source": "a"}}})").ok);
@@ -447,3 +462,57 @@ TEST_CASE("replacing a module's children keeps the unlisted ones where they are"
     CHECK(t.children(t.effects) == "A,Wired,B");
     CHECK(t.apply(R"({"Effects":{"$patch":"replace","A":{},"B":{}}})").changes == 0);
 }
+
+TEST_CASE("a live document applies as a request does and marks nothing to save") {
+    Tree t;
+    static int saves = 0;
+    saves = 0;
+    t.s.setNoteDirtyHook([] { saves++; });
+    auto r = mm::applyStateDocument(t.s, R"({"Effects": {"Knob": {"type": "SdKnob", "value": 42}}})", mm::StateSource::Live);
+    REQUIRE(r.ok);
+    CHECK(valueOf(t.find("Knob")) == 42);
+    CHECK(saves == 0);
+    CHECK_FALSE(t.effects->dirty());
+    CHECK_FALSE(t.find("Knob")->dirty());
+    // Checked whole as a request is: a mistake changes nothing.
+    auto bad = mm::applyStateDocument(t.s, R"({"Effects": {"Knob": {"value": 7}, "X": {"type": "Nope"}}})", mm::StateSource::Live);
+    CHECK_FALSE(bad.ok);
+    CHECK(valueOf(t.find("Knob")) == 42);
+}
+
+TEST_CASE("a live document queued from a tick applies at the frame boundary and reports back") {
+    Tree t;
+    static bool reported = false;
+    static uint16_t changes = 0;
+    reported = false;
+    const char* text = R"({"Effects": {"Knob": {"type": "SdKnob", "value": 9}}})";
+    char* copy = static_cast<char*>(mm::platform::alloc(std::strlen(text) + 1));
+    std::strcpy(copy, text);
+    REQUIRE(t.s.applyLive(copy, [](uintptr_t tag, const mm::StateDocumentResult& r) {
+        reported = tag == 7 && r.ok;
+        changes = r.changes;
+    }, 7));
+    CHECK(t.find("Knob") == nullptr);   // nothing until the boundary
+    t.s.preparePending();
+    REQUIRE(t.find("Knob") != nullptr);
+    CHECK(valueOf(t.find("Knob")) == 9);
+    CHECK(reported);
+    CHECK(changes == 2);
+}
+
+TEST_CASE("the live queue refuses a fifth document rather than growing") {
+    Tree t;
+    char* texts[5];
+    for (auto& p : texts) {
+        p = static_cast<char*>(mm::platform::alloc(3));
+        std::strcpy(p, "{}");
+    }
+    for (int i = 0; i < 4; i++) CHECK(t.s.applyLive(texts[i]));
+    CHECK_FALSE(t.s.applyLive(texts[4]));
+    mm::platform::free(texts[4]);   // refused, so still the caller's
+    t.s.preparePending();
+    // Applied, so there is room again.
+    char* again = static_cast<char*>(mm::platform::alloc(3));
+    std::strcpy(again, "{}");
+    CHECK(t.s.applyLive(again));
+}
diff --git a/test/unit/core/unit_TasksModule.cpp b/test/unit/core/unit_TasksModule.cpp
index 543963bcd..866a41071 100644
--- a/test/unit/core/unit_TasksModule.cpp
+++ b/test/unit/core/unit_TasksModule.cpp
@@ -69,7 +69,7 @@ TEST_CASE("TasksModule: the empty desktop snapshot is safe (no RTOS on host)") {
 }
 
 TEST_CASE("TasksModule: the tasks list renders the injected RTOS tasks with their fields") {
-    // Inject a canned snapshot (desktop test seam) → the `tasks` List serializes those rows with name/state/core/prio/stack, and the CPU% field appears only when it's a real measurement.
+    // Inject a canned snapshot (desktop test seam) → the `tasks` List serializes those rows with name/state/core/prio/stack, and the CPU% and heap fields appear only when they are real measurements.
     const platform::TaskInfo snap[] = {
         {"main",  platform::TaskState::Running, 0, 1, 2340, 479 /* 47.9% */},
         {"IDLE1", platform::TaskState::Ready,   1, 0, 1100, platform::kTaskCpuUnmeasured},
@@ -107,7 +107,7 @@ TEST_CASE("TasksModule: MoonLight tasks sort to the top, system tasks below, alp
     // Input order is scrambled (system, ours, system, ours, ...), exactly the kind of shuffle the RTOS snapshot produces frame to frame.
     const platform::TaskInfo snap[] = {
         {"Tmr Svc", platform::TaskState::Blocked, -1, 1, 900, platform::kTaskCpuUnmeasured},
-        {"mmSnap",  platform::TaskState::Blocked,  1, 5, 700, platform::kTaskCpuUnmeasured},
+        {"mmSend",  platform::TaskState::Blocked,  1, 5, 700, platform::kTaskCpuUnmeasured},
         {"IDLE0",   platform::TaskState::Ready,    0, 0, 500, platform::kTaskCpuUnmeasured},
         {"main",    platform::TaskState::Running,  0, 1, 2340, platform::kTaskCpuUnmeasured},
         {"esp_timer", platform::TaskState::Blocked, -1, 22, 800, platform::kTaskCpuUnmeasured},
@@ -135,10 +135,10 @@ TEST_CASE("TasksModule: MoonLight tasks sort to the top, system tasks below, alp
         return row.substr(p, row.find('"', p) - p);
     };
 
-    // Ours first (main, then mm* alphabetical: mmEncode < mmSnap), then system alphabetical (IDLE0 < Tmr Svc < esp_timer, uppercase sorts before lowercase).
+    // Ours first (main, then mm* alphabetical: mmEncode < mmSend), then system alphabetical (IDLE0 < Tmr Svc < esp_timer, uppercase sorts before lowercase).
     CHECK(rowName(0) == "main");
     CHECK(rowName(1) == "mmEncode");
-    CHECK(rowName(2) == "mmSnap");
+    CHECK(rowName(2) == "mmSend");
     CHECK(rowName(3) == "IDLE0");
     CHECK(rowName(4) == "Tmr Svc");
     CHECK(rowName(5) == "esp_timer");
diff --git a/test/unit/core/unit_moonlive_codegen_xtensa.cpp b/test/unit/core/unit_moonlive_codegen_xtensa.cpp
index 0463321ba..9a490c4dd 100644
--- a/test/unit/core/unit_moonlive_codegen_xtensa.cpp
+++ b/test/unit/core/unit_moonlive_codegen_xtensa.cpp
@@ -368,9 +368,8 @@ TEST_CASE("Xtensa: a fixed multiply emits mulsh beside mull") {
 // Every SHIPPED script compiles for the classic ESP32 at the buffer the device itself sizes (codeCapFor of its token count), read from moonlive/ on disk so there is one home for each script and a newly added one is under test the moment it exists. This is the contract behind the factory catalog: a user on a Dig-Next-2 or a Dig-Octa picks any of these and gets an effect. It is a COMPILER guardrail: a host has no heap ceiling, so it cannot see the allocation failures that were reported as "codegen failed" on 2026-09-09 (the on-device sweep is the test for those).
 TEST_CASE("Xtensa: every shipped script compiles at the device's own code budget") {
     const std::filesystem::path dir =
-        std::filesystem::path(__FILE__).parent_path().parent_path().parent_path().parent_path()
-        / "moonlive" / "effects";
-    REQUIRE(std::filesystem::exists(dir));
+        std::filesystem::path(__FILE__).parent_path().parent_path().parent_path().parent_path() / "moonlive";
+    REQUIRE(std::filesystem::exists(dir));   // every effect, by extension, wherever its folder
     int checked = 0;
     for (const auto& entry : std::filesystem::recursive_directory_iterator(dir)) {
         if (!entry.is_regular_file() || entry.path().extension() != ".mle") continue;
@@ -378,7 +377,7 @@ TEST_CASE("Xtensa: every shipped script compiles at the device's own code budget
         std::ostringstream ss; ss << f.rdbuf();
         const std::string src = ss.str();
         std::vector<uint8_t> out(mm::moonlive::codeCapFor(mm::moonlive::countTokens(src.c_str())));
-        static char strings[mm::moonlive::CompileResult::kStringPool];
+        static char strings[mm::moonlive::CompileResult::kMaxStrings];
         auto r = mm::moonlive::compileSource(src.c_str(), mm::moonlive::lightBuiltins(),
                                              mm::moonlive::effectSysVars(), out.data(), out.size(),
                                              nullptr, MM_ISA_LOWER, strings, sizeof(strings));
diff --git a/test/unit/core/unit_moonlive_compiler.cpp b/test/unit/core/unit_moonlive_compiler.cpp
index 4f8c571a6..0e09b4157 100644
--- a/test/unit/core/unit_moonlive_compiler.cpp
+++ b/test/unit/core/unit_moonlive_compiler.cpp
@@ -1436,7 +1436,7 @@ TEST_CASE("a function without a declared return type is refused") {
 TEST_CASE("void, int and string are the return types; a member type is not one") {
     uint8_t out[2048];
     // A string return INTERNS its literal, so this form needs the pool the engine always supplies. Without one the compile fails with "no room for this script's strings", which is the honest answer to a caller that offered nowhere to put it.
-    static char pool[moonlive::CompileResult::kStringPool];
+    static char pool[moonlive::CompileResult::kMaxStrings];
     for (const char* good : {"class T { void tick() { fill(1,2,3); } }",
                              "class T { int dimensions() { return 2; } void tick() { fill(1,2,3); } }",
                              "class T { string tags() { return \"x\"; } void tick() { fill(1,2,3); } }"}) {
@@ -1457,7 +1457,7 @@ TEST_CASE("void, int and string are the return types; a member type is not one")
 // A `return` must match what its function declared. Without this the declaration would be a label rather than a contract: `return "x";` in a void function compiles, and the host that calls it for its effect never looks at the register, so a script silently disagrees with its own signature.
 TEST_CASE("a return must match the type its function declared") {
     uint8_t out[2048];
-    static char pool[moonlive::CompileResult::kStringPool];
+    static char pool[moonlive::CompileResult::kMaxStrings];
     const auto compiles = [&](const char* src) {
         return moonlive::compileSource(src, kTable, kSys, out, sizeof(out), nullptr, nullptr,
                                        pool, sizeof(pool)).ok;
diff --git a/test/unit/core/unit_platform_httpfetch.cpp b/test/unit/core/unit_platform_httpfetch.cpp
new file mode 100644
index 000000000..e3562c32d
--- /dev/null
+++ b/test/unit/core/unit_platform_httpfetch.cpp
@@ -0,0 +1,85 @@
+/// @module platform
+
+/// Pins the one HTTP client every outbound request shares: a request goes out with its method and body, and its answer comes back. An answer too big for the caller is refused rather than cut. An HTTPS request waits while a board without PSRAM has no internal RAM for a TLS session.
+
+#include "doctest.h"
+#include "platform/platform.h"
+
+#include <cstring>
+#include <string>
+
+using namespace mm;
+
+namespace {
+/// What the stand-in saw last, so a test can say what went out.
+std::string lastMethod, lastUrl, lastBody;
+int calls = 0;
+
+/// A stand-in answering a canned document, as a weather service would.
+int standIn(const char* method, const char* url, const char* reqBody, char* body, size_t bodyLen) {
+    calls++;
+    lastMethod = method;
+    lastUrl = url;
+    lastBody = reqBody ? reqBody : "";
+    const char* answer = R"({"current":{"temperature_2m":12.3}})";
+    if (body && bodyLen) {
+        if (std::strlen(answer) + 1 > bodyLen) return 0;
+        std::strcpy(body, answer);
+    }
+    return 200;
+}
+
+/// Installs the stand-in for one test and restores the network and the heap figure after it.
+struct StandIn {
+    StandIn() { calls = 0; platform::setTestHttpFetch(&standIn); }
+    ~StandIn() { platform::setTestHttpFetch(nullptr); platform::setTestFreeInternalHeap(0); }
+};
+}  // namespace
+
+TEST_CASE("a fetch hands back the status and the answer's body") {
+    StandIn s;
+    char body[128];
+    CHECK(platform::httpFetch("GET", "https://api.example/v1?x=1", nullptr, 1000, body, sizeof(body)) == 200);
+    CHECK(std::string(body) == R"({"current":{"temperature_2m":12.3}})");
+    CHECK(lastMethod == "GET");
+    CHECK(lastUrl == "https://api.example/v1?x=1");
+}
+
+TEST_CASE("an answer too big for the caller fails rather than arriving cut") {
+    StandIn s;
+    char body[8];
+    CHECK(platform::httpFetch("GET", "https://api.example/v1", nullptr, 1000, body, sizeof(body)) == 0);
+    CHECK(body[0] == '\0');
+}
+
+TEST_CASE("a POST carries its body, and one that keeps no answer still answers its status") {
+    StandIn s;
+    CHECK(platform::httpFetch("POST", "https://cloud.example/event", R"({"e":1})", 1000, nullptr, 0) == 200);
+    CHECK(lastMethod == "POST");
+    CHECK(lastBody == R"({"e":1})");
+}
+
+TEST_CASE("an HTTPS request waits while internal RAM cannot hold a TLS session") {
+    StandIn s;
+    // A board without PSRAM under load: the floor plus one session is not there.
+    platform::setTestFreeInternalHeap(platform::kInternalFreeFloor + platform::kTlsSessionBytes - 1);
+    CHECK_FALSE(platform::tlsRoom("https://api.example/"));
+    CHECK(platform::httpFetch("GET", "https://api.example/", nullptr, 1000, nullptr, 0) == 0);
+    CHECK(platform::httpFetch("POST", "https://cloud.example/event", "{}", 1000, nullptr, 0) == 0);
+    CHECK(calls == 0);   // nothing went out
+    // Cleartext needs no TLS session, so a LAN request still goes.
+    CHECK(platform::tlsRoom("http://192.168.1.50/api/state"));
+    CHECK(platform::httpFetch("PATCH", "http://192.168.1.50/api/state", "{}", 1000, nullptr, 0) == 200);
+    // Room again: the next request goes.
+    platform::setTestFreeInternalHeap(platform::kInternalFreeFloor + platform::kTlsSessionBytes);
+    CHECK(platform::httpFetch("GET", "https://api.example/", nullptr, 1000, nullptr, 0) == 200);
+}
+
+TEST_CASE("a fetch with no method or URL fails cleanly") {
+    StandIn s;
+    char body[4] = "x";
+    CHECK(platform::httpFetch(nullptr, "https://a/", nullptr, 1000, body, sizeof(body)) == 0);
+    CHECK(platform::httpFetch("GET", "", nullptr, 1000, body, sizeof(body)) == 0);
+    CHECK(body[0] == '\0');
+    CHECK(calls == 0);
+}
diff --git a/test/unit/core/unit_platform_worker.cpp b/test/unit/core/unit_platform_worker.cpp
index 0e0a02bde..2eea6fe47 100644
--- a/test/unit/core/unit_platform_worker.cpp
+++ b/test/unit/core/unit_platform_worker.cpp
@@ -42,7 +42,8 @@ TEST_CASE("worker seam: each notify wakes the task exactly once") {
 
     for (int i = 0; i < 5; i++) {
         mm::platform::notifyTask(c.task);
-        std::this_thread::sleep_for(5ms);   // let the consumer drain this notify
+        // Until the consumer counted this notify: one still pending merges with the next, as FreeRTOS's take-and-clear does, so a fixed sleep fails under load.
+        for (int w = 0; w < 2000 && c.wakes.load() < i + 1; w++) std::this_thread::sleep_for(1ms);
     }
     // Exactly 5 wakes, no lost notify, no double-count.
     CHECK(c.wakes.load() == 5);
diff --git a/test/unit/light/moonlive_ir_golden.inc b/test/unit/light/moonlive_ir_golden.inc
index 575789a6d..c274de36a 100644
--- a/test/unit/light/moonlive_ir_golden.inc
+++ b/test/unit/light/moonlive_ir_golden.inc
@@ -1,14 +1,3 @@
-    {"layouts/backlight.mll", 0x8fb9b3dac83279edull},
-    {"layouts/diagonal.mll", 0x8d903da3498de21aull},
-    {"layouts/grid.mll", 0x19ba4f6c02fbec77ull},
-    {"layouts/lattice.mll", 0xbf932d2667cc1e2bull},
-    {"layouts/lightcrafter16.mll", 0x88b21fa19926d0baull},
-    {"layouts/reversed-row.mll", 0x785717443ed98909ull},
-    {"layouts/ring.mll", 0xff6ea124f4984df7ull},
-    {"layouts/rose.mll", 0xaaa163ddfd7f7582ull},
-    {"layouts/se16.mll", 0xb3d61a600c981e77ull},
-    {"layouts/sixteen-rings.mll", 0x2be3763b705091acull},
-    {"layouts/two-rows.mll", 0x87d0dc459e897bf6ull},
     {"effects/audio/glow.mle", 0xded139de73aad7efull},
     {"effects/audio/pulse.mle", 0xcfa5b1d85be98998ull},
     {"effects/audio/spectrum.mle", 0xba428f684216ecbeull},
@@ -20,16 +9,6 @@
     {"effects/basics/lines.mle", 0x61a519a99d69b4c6ull},
     {"effects/basics/random-pixel.mle", 0xf7fb12703b9df7e6ull},
     {"effects/basics/sparkle.mle", 0x6ea5f2562ef2cd4full},
-    {"effects/hpwit/edge-comets.mle", 0x770e1191690f4ee8ull},
-    {"effects/hpwit/fire.mle", 0x576e0d6abdf2ac07ull},
-    {"effects/hpwit/mandala.mle", 0x84a34ee7ca55565dull},
-    {"effects/hpwit/particle-fountain.mle", 0x12214c875f5cbc8dull},
-    {"effects/hpwit/plasma-ring.mle", 0x3e4ae542352cd91cull},
-    {"effects/hpwit/plasma-wander.mle", 0x4758ad600fd6eaaeull},
-    {"effects/hpwit/ripple-rings.mle", 0x76207732c0dc3e0cull},
-    {"effects/hpwit/spinning-squares.mle", 0x66aecdf09d7fd145ull},
-    {"effects/hpwit/twinkle-stars.mle", 0xe0fa607c57e84063ull},
-    {"effects/hpwit/voronoi.mle", 0x372b280bc5711cdeull},
     {"effects/moving-heads/mh-aim.mle", 0xa3b9705009ee6730ull},
     {"effects/moving-heads/mh-ambient.mle", 0xf5170dcf140e2204ull},
     {"effects/moving-heads/mh-sweep.mle", 0x9b60fb840efbcda6ull},
@@ -46,18 +25,22 @@
     {"effects/shaders/metal.mle", 0x74653c8d7f09b748ull},
     {"effects/shaders/nebula.mle", 0x6248d83646fad1f3ull},
     {"effects/shaders/trails.mle", 0x7df2e1c3f6a5eeb6ull},
-    {"effects/stadbeest/stadbeest-eye-orb.mle", 0xfd590905cb2a4e0eull},
-    {"effects/stadbeest/stadbeest-frog-eye.mle", 0x9e1e030206e1a49full},
-    {"effects/stadbeest/stadbeest-mouth.mle", 0x52e0471dda27a918ull},
-    {"effects/stadbeest/stadbeest-orb.mle", 0xc3cc0b0853ee7d42ull},
-    {"effects/stadbeest/stadbeest-sauron.mle", 0xd439b3dd89fa6dccull},
-    {"effects/stadbeest/stadbeest-thrusters.mle", 0x234a1e01f7efa8b7ull},
-    {"effects/stadbeest/stadbeest-walk.mle", 0x07253f910ca2b12aull},
     {"effects/waves/aurora.mle", 0x996cd3f22e4dc197ull},
     {"effects/waves/noise.mle", 0x59d7fc331c86f6b0ull},
     {"effects/waves/octopus.mle", 0x547abd2e1fc5e611ull},
     {"effects/waves/plasma.mle", 0xcf6d241a11a3f985ull},
     {"effects/waves/ripples.mle", 0x9b9f9be80e1e0c61ull},
+    {"layouts/backlight.mll", 0x8fb9b3dac83279edull},
+    {"layouts/diagonal.mll", 0x8d903da3498de21aull},
+    {"layouts/grid.mll", 0x19ba4f6c02fbec77ull},
+    {"layouts/lattice.mll", 0xbf932d2667cc1e2bull},
+    {"layouts/lightcrafter16.mll", 0x88b21fa19926d0baull},
+    {"layouts/reversed-row.mll", 0x785717443ed98909ull},
+    {"layouts/ring.mll", 0xff6ea124f4984df7ull},
+    {"layouts/rose.mll", 0xaaa163ddfd7f7582ull},
+    {"layouts/se16.mll", 0xb3d61a600c981e77ull},
+    {"layouts/sixteen-rings.mll", 0x2be3763b705091acull},
+    {"layouts/two-rows.mll", 0x87d0dc459e897bf6ull},
     {"modifiers/mirror.mlm", 0x72dcbfe7e1304111ull},
     {"modifiers/shift.mlm", 0xd8b0753f0d8df134ull},
     {"modifiers/transpose.mlm", 0x4c7cb92f54e87418ull},
@@ -65,10 +48,29 @@
     {"palettes/drift.mlp", 0x431d765e3fcc25abull},
     {"palettes/fire.mlp", 0x1acffb6bb6322e64ull},
     {"palettes/spectrum.mlp", 0x44d8cd5c43b0500eull},
-    {"palettes/stadbeest-fire.mlp", 0x2707ecda19a0abc5ull},
     {"palettes/temperature.mlp", 0x98bf482549960c5full},
+    {"projects/hpwit/edge-comets.mle", 0x770e1191690f4ee8ull},
+    {"projects/hpwit/fire.mle", 0x762be27986c8668aull},
+    {"projects/hpwit/hpwit-show.mls", 0xda9c200553fc3687ull},
+    {"projects/hpwit/mandala.mle", 0x2f9966d05801230eull},
+    {"projects/hpwit/particle-fountain.mle", 0x99ba29954a9ee1ecull},
+    {"projects/hpwit/plasma-ring.mle", 0x3e4ae542352cd91cull},
+    {"projects/hpwit/plasma-wander.mle", 0x6c42e11998417a82ull},
+    {"projects/hpwit/ripple-rings.mle", 0x76207732c0dc3e0cull},
+    {"projects/hpwit/spinning-squares.mle", 0x858b8669a04442b6ull},
+    {"projects/hpwit/twinkle-stars.mle", 0xce710a52c95fef72ull},
+    {"projects/hpwit/voronoi.mle", 0x7dda90571519a6fcull},
+    {"projects/stadbeest/stadbeest-autopilot.mls", 0xa4d068b9b849ab37ull},
+    {"projects/stadbeest/stadbeest-eye-orb.mle", 0xfd590905cb2a4e0eull},
+    {"projects/stadbeest/stadbeest-fire.mlp", 0x2707ecda19a0abc5ull},
+    {"projects/stadbeest/stadbeest-frog-eye.mle", 0x9e1e030206e1a49full},
+    {"projects/stadbeest/stadbeest-mouth.mle", 0x52e0471dda27a918ull},
+    {"projects/stadbeest/stadbeest-orb.mle", 0xc3cc0b0853ee7d42ull},
+    {"projects/stadbeest/stadbeest-sauron.mle", 0xd439b3dd89fa6dccull},
+    {"projects/stadbeest/stadbeest-thrusters.mle", 0x234a1e01f7efa8b7ull},
+    {"projects/stadbeest/stadbeest-walk.mle", 0x07253f910ca2b12aull},
     {"services/button.mls", 0x377a24ae1d49b9d1ull},
     {"services/chase.mls", 0x91984b68b9521c79ull},
+    {"services/jsondemo.mls", 0x324026cef13f6295ull},
     {"services/power.mls", 0x0656e0565392a427ull},
-    {"services/stadbeest-autopilot.mls", 0x8bf1685b0a5ada84ull},
     {"services/sweep.mls", 0xf22d60f9fdbec0ecull},
diff --git a/test/unit/light/unit_Correction.cpp b/test/unit/light/unit_Correction.cpp
index 202d2a61a..8d2533b79 100644
--- a/test/unit/light/unit_Correction.cpp
+++ b/test/unit/light/unit_Correction.cpp
@@ -52,6 +52,23 @@ TEST_CASE("Correction RGB preset: apply is identity at full brightness") {
 }
 
 // GRB preset swaps R and G in the output (G first, then R, then B), for WS2812-like drivers.
+// The fast path runs only for a strip of colors alone: any optional role sends the light through the full transform, which the preset tests below pin.
+TEST_CASE("Correction takes the plain-strip path for RGB orders only") {
+    Correction rgb, grb, rgbw;
+    mm::test::rebuildFromPreset(rgb, 255, mm::test::PresetOrder::RGB);
+    mm::test::rebuildFromPreset(grb, 128, mm::test::PresetOrder::GRB);
+    mm::test::rebuildFromPreset(rgbw, 255, mm::test::PresetOrder::RGBW);
+    CHECK(rgb.plainRgb);
+    CHECK(grb.plainRgb);
+    CHECK_FALSE(rgbw.plainRgb);
+    const uint8_t src[3] = {200, 100, 50};
+    uint8_t out[3] = {};
+    grb.apply(src, out, 3);
+    CHECK(out[0] == grb.briLut[100]);   // green first
+    CHECK(out[1] == grb.briLut[200]);
+    CHECK(out[2] == grb.briLut[50]);
+}
+
 TEST_CASE("Correction GRB preset: channels reordered, 3 output channels") {
     Correction c;
     c.curve = Correction::Curve::Linear;   // these pin roles and white math, not the curve
diff --git a/test/unit/light/unit_Drivers_container.cpp b/test/unit/light/unit_Drivers_container.cpp
index 18fd8d224..6819009ea 100644
--- a/test/unit/light/unit_Drivers_container.cpp
+++ b/test/unit/light/unit_Drivers_container.cpp
@@ -454,8 +454,8 @@ TEST_CASE("a brightness change does not rescan the palette scripts; a palette fi
 
     drivers.onFileChanged("/moonlive/mine.mlp");     // what a write through the API announces
     CHECK(paletteOptions(drivers) == before + 1);
-    CHECK(mm::Drivers::touchesFolder("/", "/moonlive"));             // a restore of everything
-    CHECK_FALSE(mm::Drivers::touchesFolder("/moonlivex/a.mlp", "/moonlive"));
+    CHECK(mm::moonlive::pathTouchesFolder("/", "/moonlive"));             // a restore of everything
+    CHECK_FALSE(mm::moonlive::pathTouchesFolder("/moonlivex/a.mlp", "/moonlive"));
     std::filesystem::remove_all(root);
 }
 
@@ -536,3 +536,26 @@ TEST_CASE("the lights rise to their brightness after a device boot, and a host p
     CHECK(dark.effectiveBrightness() == 100);
     layouts.removeChild(&grid);
 }
+
+// Regression: a palette script edited, or downloaded by an open page, stayed on its old program until a control changed.
+TEST_CASE("the running palette script compiles again when its file changes") {
+    mm::platform::fsMkdir(mm::moonlive::kScriptDir);
+    const char* good = "class P {\n  void tick() { setPalEntry(0, 1, 2, 3); }\n}\n";
+    REQUIRE(mm::platform::fsWriteAtomic("/moonlive/unit-live.mlp", good, std::strlen(good)));
+    mm::Drivers drivers;
+    drivers.defineControls();
+    const int i = mm::test::controlIndex(drivers, "paletteScript");
+    REQUIRE(i >= 0);
+    REQUIRE(mm::applyControlValue(drivers.controls()[static_cast<uint8_t>(i)], "{\"value\":\"unit-live.mlp\"}",
+                                  "value", mm::ApplyPolicy::Clamp) == mm::ApplyResult::Ok);
+    drivers.onControlChanged("paletteScript");
+    REQUIRE(drivers.status() != nullptr);
+    CHECK(drivers.severity() == mm::MoonModule::Severity::Status);   // compiled: a status, not an error
+    const char* broken = "class P {\n  void tick() { nosuch(); }\n}\n";
+    REQUIRE(mm::platform::fsWriteAtomic("/moonlive/unit-live.mlp", broken, std::strlen(broken)));
+    drivers.onFileChanged("/moonlive/unit-live.mlp");          // what a file write announces
+    REQUIRE(drivers.status() != nullptr);
+    CHECK(std::strstr(drivers.status(), "unknown function") != nullptr);
+    CHECK(drivers.severity() == mm::MoonModule::Severity::Error);
+    mm::platform::fsRemove("/moonlive/unit-live.mlp");
+}
diff --git a/test/unit/light/unit_Drivers_livePalettes.cpp b/test/unit/light/unit_Drivers_livePalettes.cpp
index 43fbe7e31..fa4d38f94 100644
--- a/test/unit/light/unit_Drivers_livePalettes.cpp
+++ b/test/unit/light/unit_Drivers_livePalettes.cpp
@@ -192,10 +192,10 @@ TEST_CASE("a factory palette keeps its number whether the device holds it or not
 }
 
 // The StadBeest autopilot picks its fire palette by number, so a palette added before it in the list must move this test and that script together.
-TEST_CASE("the StadBeest fire palette is number 64, the one its autopilot picks") {
+TEST_CASE("the StadBeest fire palette is number 65, the one its autopilot picks") {
     int index = -1;
     for (size_t c = 0; c < mm::moonlive::kPaletteCatalogCount; c++)
         if (std::strcmp(mm::moonlive::kPaletteCatalog[c], "stadbeest-fire.mlp") == 0) index = static_cast<int>(c);
     REQUIRE(index >= 0);
-    CHECK(mm::palettes::kCount + index == 64);   // moonlive/services/stadbeest-autopilot.mls: palette = 64
+    CHECK(mm::palettes::kCount + index == 65);   // moonlive/projects/stadbeest/stadbeest-autopilot.mls: palette = 65
 }
diff --git a/test/unit/light/unit_Effects_container.cpp b/test/unit/light/unit_Effects_container.cpp
index 866bb399f..809725c05 100644
--- a/test/unit/light/unit_Effects_container.cpp
+++ b/test/unit/light/unit_Effects_container.cpp
@@ -428,3 +428,37 @@ TEST_CASE("Disabling a parent Layer cascades release to its effects (effectively
     effects.applyState();
     CHECK(fire.dynamicBytes() == 0);
 }
+
+namespace {
+// Counts its renders.
+class CountingRender : public mm::EffectBase {
+public:
+    void tick() MM_NONBLOCKING override { renders++; }
+    int renders = 0;
+};
+}  // namespace
+
+// A show alternates two expensive effects by opacity, so an invisible layer must cost nothing; the bottom layer overwrites and ignores opacity, so it always renders.
+TEST_CASE("a layer at opacity 0 above the bottom is not rendered; the bottom layer always is") {
+    mm::Layouts layouts;
+    mm::GridLayout grid;
+    grid.width = 8; grid.height = 8; grid.depth = 1;
+    layouts.addChild(&grid);
+    mm::Effects effects;
+    mm::Layer bottom, top;
+    CountingRender fxBottom, fxTop;
+    bottom.addChild(&fxBottom);
+    top.addChild(&fxTop);
+    effects.addChild(&bottom);
+    effects.addChild(&top);
+    effects.setLayouts(&layouts);
+    effects.applyState();
+    bottom.opacity = 0;
+    top.opacity = 0;
+    effects.tick();
+    CHECK(fxBottom.renders == 1);
+    CHECK(fxTop.renders == 0);
+    top.opacity = 1;
+    effects.tick();
+    CHECK(fxTop.renders == 1);
+}
diff --git a/test/unit/light/unit_FixedPointEffect.cpp b/test/unit/light/unit_FixedPointEffect.cpp
index 147c26777..5751af726 100644
--- a/test/unit/light/unit_FixedPointEffect.cpp
+++ b/test/unit/light/unit_FixedPointEffect.cpp
@@ -60,6 +60,7 @@ TEST_CASE("every demo draws something on a panel") {
         Panel p;
         p.effect.demo = d;
         p.effect.fade = 255;               // no trail carried between frames: judge one frame alone
+        p.effect.zoom = 0;                 // the camera push-in runs on the process clock, and at its peak a figure leaves this small panel
         for (int i = 0; i < 30; i++) p.layer.tick();
         CAPTURE(std::string(mm::FixedPointEffect::kDemoNames[d]));
         CHECK(p.litCount() > 0);
diff --git a/test/unit/light/unit_MoonI80Peripheral.cpp b/test/unit/light/unit_MoonI80Peripheral.cpp
index 66c628431..f8db62884 100644
--- a/test/unit/light/unit_MoonI80Peripheral.cpp
+++ b/test/unit/light/unit_MoonI80Peripheral.cpp
@@ -7,7 +7,7 @@
 #include "correction_presets.h"
 #include "light/drivers/MoonI80Peripheral.h"
 #include "light/layers/Buffer.h"
-#include "unit/core/conditional_controls.h"  // controlIndex/setControlValue — clockPin now lives on the backend
+#include "unit/core/conditional_controls.h"  // controlIndex/setControlValue: clockPin is set through the control the backend declares
 
 #include <cstring>
 
@@ -62,7 +62,7 @@ TEST_CASE("MoonI80Peripheral direct mode: clockPin is unrouted, so it cannot col
     mm::ParallelLedDriver d;
     mm::Buffer src;
     mm::Correction corr;
-    std::strcpy(d.pins, "1,2,4,5,6,7,8,10");   // pin 10 IS the default clockPin (WR) — fine here
+    std::strcpy(d.pins, "1,2,4,5,6,7,8,10");   // pin 10 IS the default clockPin (WR), fine here
     wire(d, peripheral, src, corr, 8 * 16);
     CHECK(d.severity() != mm::ParallelLedDriver::Severity::Error);
     CHECK(d.laneCount() == 8);   // it drives all eight strands
@@ -83,7 +83,7 @@ TEST_CASE("MoonI80Peripheral shift mode: a data pin on clockPin (WR) is caught")
 
 // The '595 latch rides a DATA lane (the peripheral gives only one clock output, and WR is already the shift clock), so it must not land on WR, the latch would ride the shift clock itself and nothing would ever latch, which looks like a dead strip rather than a config error.
 //
-// clockPin now lives on the MoonI80Peripheral backend (not a MoonI80Peripheral member), so it is read/set through the control API defineDriverControls() binds, the same mechanism the UI and persistence use.
+// clockPin is the driver's wiring, which the backend declares as a control, so it is read and set through the control API defineDriverControls() binds, the same mechanism the UI and persistence use.
 TEST_CASE("MoonI80Peripheral rejects a latchPin on WR") {
     ExpanderMoonI80 peripheral;
     mm::ParallelLedDriver d;
@@ -134,3 +134,30 @@ TEST_CASE("MoonI80Peripheral drives a valid config like its sibling") {
     wire(d, peripheral, src, corr, 8 * 32);   // 8 lanes × 32 lights
     CHECK(d.laneCount() == 8);
 }
+
+// ringAuto once took every internal byte above a 64 KB reserve, 28 buffers on shiffy, leaving 66 KB free; the ring needs only its lead over the wire.
+TEST_CASE("MoonI80Peripheral ringAuto takes 3-row buffers for its lead, not the free RAM") {
+    // shiffy: 585 bytes per row, 259 rows per frame.
+    const auto d = mm::MoonI80Peripheral::autoDepth(585, 259, 200 * 1024);
+    CHECK(d.rows == 3);
+    CHECK(d.bufs == 21);   // 54 rows of lead over 3-row buffers, plus the 2 the refill keeps clear and the one it writes
+    CHECK_FALSE(d.shortOfLead);
+}
+
+TEST_CASE("MoonI80Peripheral ringAuto takes fewer rows per buffer when a row nearly fills a node") {
+    const auto d = mm::MoonI80Peripheral::autoDepth(1500, 259, 400 * 1024);   // 2 rows fill a 4 KB node
+    CHECK(d.rows == 2);
+}
+
+TEST_CASE("MoonI80Peripheral ringAuto never takes more than one buffer per slice and a spare") {
+    const auto d = mm::MoonI80Peripheral::autoDepth(585, 20, 200 * 1024);   // a small frame: 7 slices
+    CHECK(d.bufs == 8);
+    CHECK_FALSE(d.shortOfLead);
+}
+
+TEST_CASE("MoonI80Peripheral ringAuto stops at the internal floor and says the lead is short") {
+    const size_t freeInternal = mm::platform::kInternalFreeFloor + 6 * 3 * 585;   // room for 6 buffers above the floor
+    const auto d = mm::MoonI80Peripheral::autoDepth(585, 259, freeInternal);
+    CHECK(d.bufs == 6);
+    CHECK(d.shortOfLead);
+}
diff --git a/test/unit/light/unit_MoonLiveLayout.cpp b/test/unit/light/unit_MoonLiveLayout.cpp
index 55e84d0cc..7db01851e 100644
--- a/test/unit/light/unit_MoonLiveLayout.cpp
+++ b/test/unit/light/unit_MoonLiveLayout.cpp
@@ -628,6 +628,7 @@ TEST_CASE("editing a script's text recompiles it, without renaming the file") {
     const std::string edited = mmScriptAs("placeLights",
         "for (int i = 0; i < 7; i = i + 1) { addLight(i, 0, 0); }");
     REQUIRE(mm::platform::fsWriteAtomic(path, edited.c_str(), edited.size()));
+    l.onFileChanged(path);   // the file API announces every save to the tree
 
     l.prepare();
     CHECK(l.lightCount() == 7);
@@ -667,6 +668,7 @@ TEST_CASE("a broken script fixed in place compiles, without being renamed") {
     const std::string fixed = mmScriptAs("placeLights",
         "for (int i = 0; i < 5; i = i + 1) { addLight(i, 0, 0); }");
     REQUIRE(mm::platform::fsWriteAtomic(path, fixed.c_str(), fixed.size()));
+    l.onFileChanged(path);               // the file API announces every save to the tree
 
     CHECK(l.lightCount() == 5);          // the content moved, so the failure latch released
 }
diff --git a/test/unit/light/unit_MoonLiveScripts.cpp b/test/unit/light/unit_MoonLiveScripts.cpp
index b85f4a3c0..03120bac1 100644
--- a/test/unit/light/unit_MoonLiveScripts.cpp
+++ b/test/unit/light/unit_MoonLiveScripts.cpp
@@ -42,12 +42,12 @@ using namespace mm;
 
 namespace {
 
-std::vector<std::filesystem::path> scriptsIn(const char* sub) {
+// Every script under moonlive/, whatever folder holds it: a project folder mixes roles, so the role comes from the extension.
+std::vector<std::filesystem::path> allScripts() {
     std::vector<std::filesystem::path> out;
-    const std::filesystem::path dir = scriptRoot() / sub;
-    if (!std::filesystem::exists(dir)) return out;
-    for (const auto& e : std::filesystem::recursive_directory_iterator(dir))
+    for (const auto& e : std::filesystem::recursive_directory_iterator(scriptRoot()))
         if (e.is_regular_file() && mmIsScript(e.path())) out.push_back(e.path());
+    std::sort(out.begin(), out.end());
     return out;
 }
 
@@ -56,19 +56,20 @@ std::vector<std::filesystem::path> scriptsIn(const char* sub) {
 TEST_CASE("every script in moonlive/ compiles") {
     int checked = 0;
     // services included: it compiles against its own table, which the isService branch below picks.
-    for (const char* sub : {"layouts", "effects", "modifiers", "drivers", "palettes", "services"}) {
-        for (const auto& file : scriptsIn(sub)) {
+    {
+        for (const auto& file : allScripts()) {
             const std::string src = readText(file);
-            const std::string label = std::string(sub) + "/" + file.filename().string();
+            const std::string label = std::filesystem::relative(file, scriptRoot()).generic_string();
+            const std::string ext = file.extension().string();
 
             // Compile it exactly as it ships, against the system variables ITS OWN binding supplies, a layout gets the clock, an effect the grid, a modifier the grid plus a coordinate. Using one shared list here would let a script read a name its module never writes and still pass, which is the silent-zero this per-binding split exists to prevent.
-            const bool isService = std::string(sub) == "services";
+            const bool isService = ext == moonlive::kServiceExt;
             // A palette is a LIGHT-domain script: it fills the active palette, so it gets the light table (where setPalEntry lives) and the effect system variables.
             const moonlive::SysVarTable sys =
-                isService                       ? moonlive::serviceSysVars()  :
-                std::string(sub) == "layouts"   ? moonlive::layoutSysVars()   :
-                std::string(sub) == "modifiers" ? moonlive::modifierSysVars() :
-                                                  moonlive::effectSysVars();
+                isService                     ? moonlive::serviceSysVars()  :
+                ext == moonlive::kLayoutExt   ? moonlive::layoutSysVars()   :
+                ext == moonlive::kModifierExt ? moonlive::modifierSysVars() :
+                                                moonlive::effectSysVars();
             // A SERVICE compiles against its own table: it has gpioRead and setControl and no canvas, so compiling one against the light vocabulary would prove nothing about what the device will actually run, and would accept a script calling setRGB that fails on a real service.
             const moonlive::BuiltinTable builtins =
                 isService ? moonlive::serviceBuiltins() : moonlive::lightBuiltins();
@@ -94,12 +95,11 @@ TEST_CASE("every script in moonlive/ compiles") {
 // The catalog is what a DEVICE knows about: it carries these names and fetches a script's text the first time someone picks it. A script in the repo but not in the catalog is invisible on every device, and nothing else would notice, since the build succeeds and the file is right there.
 TEST_CASE("the shipped catalog names every script in moonlive/") {
     std::vector<std::string> onDisk;
-    for (const char* sub : {"layouts", "effects", "modifiers", "services", "palettes"})
-        for (const auto& f : scriptsIn(sub)) onDisk.push_back(f.filename().string());
+    for (const auto& f : allScripts()) onDisk.push_back(f.filename().string());
     std::sort(onDisk.begin(), onDisk.end());
     REQUIRE(!onDisk.empty());
 
-    // The catalog is one array per role: the folder a script lives in is implied by its role and the role by its extension, so neither is stored per entry.
+    // The catalog is one array per role, the role following from the extension.
     std::vector<std::string> inCatalog;
     for (size_t i = 0; i < moonlive::kEffectCatalogCount; i++)
         inCatalog.push_back(moonlive::kEffectCatalog[i]);
@@ -138,19 +138,19 @@ TEST_CASE("the shipped catalog names every script in moonlive/") {
     }
 }
 
-// The UI fetches a script from its role's folder plus the subfolder the catalog names, so a wrong subfolder index sends every device to a file that is not there.
-TEST_CASE("every catalog entry's subfolder is where its script lives in moonlive/") {
-    const auto at = [](const char* folder, const unsigned char* sub, const char* const* names, size_t count) {
+// The UI fetches a script from the folder the catalog names, so a wrong folder index sends every device to a file that is not there.
+TEST_CASE("every catalog entry's folder is where its script lives in moonlive/") {
+    const auto at = [](const unsigned char* folder, const char* const* names, size_t count) {
         for (size_t i = 0; i < count; i++) {
-            const auto p = scriptRoot() / folder / moonlive::kCatalogSubfolders[sub[i]] / names[i];
+            const auto p = scriptRoot() / moonlive::kCatalogFolders[folder[i]] / names[i];
             CHECK_MESSAGE(std::filesystem::is_regular_file(p), p.string());
         }
     };
-    at(moonlive::kEffectFolder, moonlive::kEffectCatalogSub, moonlive::kEffectCatalog, moonlive::kEffectCatalogCount);
-    at(moonlive::kLayoutFolder, moonlive::kLayoutCatalogSub, moonlive::kLayoutCatalog, moonlive::kLayoutCatalogCount);
-    at(moonlive::kModifierFolder, moonlive::kModifierCatalogSub, moonlive::kModifierCatalog, moonlive::kModifierCatalogCount);
-    at(moonlive::kServiceFolder, moonlive::kServiceCatalogSub, moonlive::kServiceCatalog, moonlive::kServiceCatalogCount);
-    at(moonlive::kPaletteFolder, moonlive::kPaletteCatalogSub, moonlive::kPaletteCatalog, moonlive::kPaletteCatalogCount);
+    at(moonlive::kEffectCatalogFolder, moonlive::kEffectCatalog, moonlive::kEffectCatalogCount);
+    at(moonlive::kLayoutCatalogFolder, moonlive::kLayoutCatalog, moonlive::kLayoutCatalogCount);
+    at(moonlive::kModifierCatalogFolder, moonlive::kModifierCatalog, moonlive::kModifierCatalogCount);
+    at(moonlive::kServiceCatalogFolder, moonlive::kServiceCatalog, moonlive::kServiceCatalogCount);
+    at(moonlive::kPaletteCatalogFolder, moonlive::kPaletteCatalog, moonlive::kPaletteCatalogCount);
 }
 
 // Comments are what makes a script in `moonlive/` readable, so the lexer has to treat a plain `//` line as whitespace, anywhere, including between the statements of a loop body.
@@ -457,8 +457,10 @@ TEST_CASE("every script example in the docs compiles") {
 
             INFO("block: ", block);
             moonlive::MoonLive eng;
-            // The EFFECT vocabulary for every block: the three role tables are aliases of one light vocabulary (pinned by "the three roles are handed the same table"), so which one is passed is documentation rather than a behavioral choice.
-            CHECK(eng.compile(block.c_str(), moonlive::lightBuiltins(), moonlive::effectSysVars()));
+            // A block with a service's moment compiles against the service vocabulary, every other against the EFFECT one, which the three role tables alias.
+            const bool service = block.find("tick20ms") != std::string::npos;
+            CHECK(eng.compile(block.c_str(), service ? moonlive::serviceBuiltins() : moonlive::lightBuiltins(),
+                              service ? moonlive::serviceSysVars() : moonlive::effectSysVars()));
             checked++;
         }
     }
diff --git a/test/unit/light/unit_MoonLiveScripts_ir_golden.cpp b/test/unit/light/unit_MoonLiveScripts_ir_golden.cpp
index b5ec45e64..73d71c84e 100644
--- a/test/unit/light/unit_MoonLiveScripts_ir_golden.cpp
+++ b/test/unit/light/unit_MoonLiveScripts_ir_golden.cpp
@@ -46,7 +46,7 @@ uint64_t builtinName(HostCallFn fn) {
 uint64_t pointerOffset(const void* p) {
     if (!p) return 0;
     const char* c = static_cast<const char*>(p);
-    if (g_strings && c >= g_strings && c < g_strings + CompileResult::kStringPool) return uint64_t(c - g_strings) + 1;
+    if (g_strings && c >= g_strings && c < g_strings + CompileResult::kMaxStrings) return uint64_t(c - g_strings) + 1;
     return 0xFFFF;
 }
 
@@ -77,23 +77,21 @@ TEST_CASE("every shipped script compiles to the IR it had before the compiler ch
     // MM_PRINT_IR_GOLDEN=1 prints the table instead of checking it, which is how it is captured.
     const bool print = std::getenv("MM_PRINT_IR_GOLDEN") != nullptr;
     int checked = 0;
-    for (const char* sub : {"layouts", "effects", "modifiers", "palettes", "services"}) {
-        const std::filesystem::path dir = scriptRoot() / sub;
-        if (!std::filesystem::exists(dir)) continue;
+    {
         std::map<std::string, std::filesystem::path> files;   // sorted, so the printed table is stable
-        // Keyed by the path under the role's folder, so a script in a subfolder is named with it.
-        for (const auto& e : std::filesystem::recursive_directory_iterator(dir))
-            if (e.is_regular_file() && isScriptExt(e.path().extension().string().c_str())) files[std::filesystem::relative(e.path(), dir).generic_string()] = e.path();
-        for (const auto& [name, path] : files) {
-            const std::string label = std::string(sub) + "/" + name;
+        // Keyed by the path under moonlive/, the role following from the extension, since a project folder mixes roles.
+        for (const auto& e : std::filesystem::recursive_directory_iterator(scriptRoot()))
+            if (e.is_regular_file() && isScriptExt(e.path().extension().string().c_str())) files[std::filesystem::relative(e.path(), scriptRoot()).generic_string()] = e.path();
+        for (const auto& [label, path] : files) {
             const std::string src = readText(path);
-            const bool isService = std::string(sub) == "services";
+            const std::string ext = path.extension().string();
+            const bool isService = ext == kServiceExt;
             const SysVarTable sys = isService ? serviceSysVars()
-                                  : std::string(sub) == "layouts" ? layoutSysVars()
-                                  : std::string(sub) == "modifiers" ? modifierSysVars()
+                                  : ext == kLayoutExt ? layoutSysVars()
+                                  : ext == kModifierExt ? modifierSysVars()
                                   : effectSysVars();
             const BuiltinTable table = isService ? serviceBuiltins() : lightBuiltins();
-            static char strings[CompileResult::kStringPool];
+            static char strings[CompileResult::kMaxStrings];
             g_table = &table;
             g_strings = strings;
             g_hash = 0;
diff --git a/test/unit/light/unit_NetworkSendDriver_no_alloc_in_loop.cpp b/test/unit/light/unit_NetworkSendDriver_no_alloc_in_loop.cpp
index 63bc7b60d..3cf3847f8 100644
--- a/test/unit/light/unit_NetworkSendDriver_no_alloc_in_loop.cpp
+++ b/test/unit/light/unit_NetworkSendDriver_no_alloc_in_loop.cpp
@@ -91,3 +91,26 @@ TEST_CASE("NetworkSendDriver onCorrectionChanged is a no-op when outChannels unc
     CHECK(driver.correctedBuffer().count() == 48);
     CHECK(driver.correctedBuffer().channelsPerLight() == 3);
 }
+
+// Every prepare restarted the send task, so a show re-preparing its layers kept an FPP from receiving a whole frame.
+TEST_CASE("NetworkSendDriver keeps its send task running through a prepare that changed nothing it sends") {
+    mm::Buffer source;
+    REQUIRE(source.allocate(64, 3));
+    mm::NetworkSendDriver driver;
+    driver.setSourceBuffer(&source);
+    std::snprintf(driver.hosts, sizeof(driver.hosts), "%s", "127.0.0.1");
+    driver.packetGap = 500;   // paced from its own task
+    driver.applyState();
+    REQUIRE(driver.taskStartsForTest() == 1);
+    driver.applyState();
+    CHECK(driver.taskStartsForTest() == 1);   // the stream runs on
+    std::snprintf(driver.hosts, sizeof(driver.hosts), "%s", "127.0.0.2");
+    driver.applyState();
+    CHECK(driver.taskStartsForTest() == 2);   // a new destination restarts it
+    std::snprintf(driver.hosts, sizeof(driver.hosts), "%s", "fpp.local");   // a name, whose address the resolver fills in
+    driver.applyState();
+    REQUIRE(driver.taskStartsForTest() == 3);
+    driver.applyState();
+    CHECK(driver.taskStartsForTest() == 3);
+    driver.release();
+}
diff --git a/test/unit/light/unit_ParallelLedDriver_pinexpander.cpp b/test/unit/light/unit_ParallelLedDriver_pinexpander.cpp
index 00c271d41..b53d480a5 100644
--- a/test/unit/light/unit_ParallelLedDriver_pinexpander.cpp
+++ b/test/unit/light/unit_ParallelLedDriver_pinexpander.cpp
@@ -555,7 +555,7 @@ TEST_CASE("pinExpander degrades to direct on a peripheral that can't host it, ke
 
 // Regression: the i80 clock/DC defaults were 10/11, free GPIOs on the ESP32-S3 they were chosen on and the FLASH bus (6-11) on a classic ESP32. On an ESP32-PICO-V3-02 (QuinLED Dig-Next-2) every pin list wedged the board the moment it was applied: a TG1WDT_SYS_RESET with both CPUs stuck at the same PC, no panic and no coredump, so nothing named the pin. The defaults are now chosen per chip off the same `i2sLanes > 0` discriminator dmaBudgetBytes() uses, and reinit() refuses any reserved bus pin outright rather than routing I/O onto flash.
 TEST_CASE("the i80 clock and DC defaults never land on a chip's flash pins") {
-    mm::I80Peripheral p;
+    mm::ParallelLedDriver p;   // the wiring is the driver's, whichever peripheral drives it
     // Classic ESP32 reserves 6-11 for flash; every other supported chip has 10/11 free. Whichever build this is, the defaults must sit outside that range on the classic path.
     if constexpr (mm::platform::i2sLanes > 0) {  // compiles out on every desktop build; flash pins are a classic-ESP32 property
         CHECK(p.clockPin != 10);
@@ -603,8 +603,8 @@ TEST_CASE("a full-width bus still refuses a WR or DC pin wired to flash") {
     mm::I80Peripheral peripheral;
     mm::Buffer src;
     mm::Correction corr;
-    peripheral.clockPin = 10;
-    peripheral.dcPin    = 11;                              // DC on the reserved pin
+    d.clockPin = 10;
+    d.dcPin    = 11;                              // DC on the reserved pin
     d.setPeripheralForTest(&peripheral);
     std::strcpy(d.pins, "10,20,21,22,23,24,25,26");        // full 8-wide bus: no spare lane for WR
     d.pinExpander = false;
@@ -621,8 +621,8 @@ TEST_CASE("a full-width bus still refuses a WR or DC pin wired to flash") {
     CHECK(std::strstr(d.status(), "dcPin") != nullptr);
     CHECK(std::strstr(d.status(), "flash") != nullptr);
 
-    peripheral.clockPin = 11;                              // and the same for WR
-    peripheral.dcPin    = 10;
+    d.clockPin = 11;                                       // and the same for WR
+    d.dcPin    = 10;
     d.applyState();
     REQUIRE(d.status() != nullptr);
     CHECK(std::strstr(d.status(), "clockPin") != nullptr);
diff --git a/test/unit/light/unit_ParallelLedDriver_ring.cpp b/test/unit/light/unit_ParallelLedDriver_ring.cpp
index 88e0bfa10..e58039ad3 100644
--- a/test/unit/light/unit_ParallelLedDriver_ring.cpp
+++ b/test/unit/light/unit_ParallelLedDriver_ring.cpp
@@ -40,7 +40,7 @@ namespace {
 
 using mm::nrOfLightsType;
 
-// The mock's own geometry, deliberately SMALL and independent of the platform's (which is a runtime control now, see MoonI80Peripheral::ringRows/ringBufs). A 4-buffer pool forces buffer REUSE at few slices (a 200-light frame = 13 slices reuses buffers 0..4), which is the path the recycled / short-last-slice tests exist to exercise. 16 rows/buffer keeps a slice MULTI-row on purpose: a 1-row slice cannot express a tiling bug (every buffer would hold exactly one light, so a stride error has nowhere to show).
+// The mock's own geometry, deliberately SMALL and independent of the platform's (a runtime control, see ParallelLedDriver::ringRows/ringBufs). A 4-buffer pool forces buffer REUSE at few slices (a 200-light frame = 13 slices reuses buffers 0..4), which is the path the recycled / short-last-slice tests exist to exercise. 16 rows/buffer keeps a slice MULTI-row on purpose: a 1-row slice cannot express a tiling bug (every buffer would hold exactly one light, so a stride error has nowhere to show).
 constexpr uint8_t kMockRingBufs = 4;
 constexpr uint32_t kMockRingRows = 16;
 
@@ -57,11 +57,8 @@ class MockRingPeripheral : public mm::LedPeripheral {
     mm::LedHwBlock hwBlock() const override { return mm::LedHwBlock::None; }   // mock drives no real block
 
     void addBusControls(mm::ControlList&) override {}
-    // A ring-capable backend adds its ring cluster here (the default addRingControls is a no-op for whole-frame-only backends). Mirror the real driver: the source-snapshot knob under the path, gated on wantsRing(), this mock's controllable wantRing_ drives the visibility the hide test checks.
-    void addRingControls(mm::ControlList& controls) override {
-        controls.addControl("ringSnapshot", owner_->ringSnapshotRef());
-        controls.setHidden(controls.count() - 1, !wantsRing());
-    }
+    // A ring-capable backend, as LCD-MM is: the driver then shows the ring's settings, and this mock's controllable wantRing_ drives the visibility the hide test checks.
+    bool supportsRing() const override { return true; }
     bool busControlTriggersBuild(const char*) const override { return false; }
     void recordBusPins() override {}
     bool extraBusPinsCurrent() const override { return true; }
@@ -323,8 +320,10 @@ class MockRingDriver : public mm::ParallelLedDriver {
     // After this, encodeRows reads the snapshot, so mutating the live source (a resize / repaint on the render thread) can't tear or UAF the in-flight frame.
     // Mirror production's reinit(): size the snapshot OFF the hot path (ensureSnapshotCap) THEN take the per-frame copy (snapshotSourceForRing, memcpy-only). tickRing does exactly this split on device.
     bool snapshotForTest() { this->ensureSnapshotCap(); return this->snapshotSourceForRing(); }
+    // Drop the source, as a refill that must not reach it: the source Buffer lives in a module, in PSRAM.
+    void dropSourceForTest() { this->sourceBuffer_ = nullptr; }
 
-    // Test hooks for the PARALLEL-snapshot split: expose the snapshot buffer + a manual range-copy so a test can prove copyRange(0,N) == copyRange(0,half)+copyRange(half,N) byte-for-byte (the fork-join's correctness oracle, the device runs the two halves on two cores; here one thread runs both ranges, which must land the identical bytes). setSnapCopyForTest mirrors what snapshotSourceForRing sets before splitting (the snapshot is now a raw memcpy at srcCh stride; correction fuses into encodeRows).
+    // Test hooks for the snapshot copy: expose the snapshot buffer and set what snapshotSourceForRing sets before it copies (a raw memcpy at the srcCh stride; correction fuses into encodeRows).
     uint8_t* snapshotBufForTest() { return this->snapshotBuf_; }
     void setSnapCopyForTest() {
         this->snapCopySrc_ = this->sourceBuffer_->data()
@@ -334,9 +333,6 @@ class MockRingDriver : public mm::ParallelLedDriver {
     void copyRangeForTest(mm::nrOfLightsType lo, mm::nrOfLightsType hi) { this->copyRange(lo, hi); }
     mm::nrOfLightsType winLenForTest() const { return this->winLen_; }
     size_t snapshotCapForTest() const { return this->snapshotCap_; }
-    static mm::nrOfLightsType snapHalfForTest(mm::nrOfLightsType n, size_t chStride) {
-        return snapLineAlignedHalf(n, chStride);
-    }
 };
 
 // Out-of-line: needs MockRingDriver's full definition (encodeSliceForTest), so it's defined after the class rather than inline in MockRingPeripheral.
@@ -367,6 +363,20 @@ void wireShift(MockRingDriver& d, MockRingPeripheral& peripheral, mm::Buffer& sr
     d.applyState();
 }
 
+// Wire 200 lights on pins 1 and 2 with a structured source, then bring the ring up sized to it, 24 bits a channel per row.
+bool wireRing(MockRingDriver& d, MockRingPeripheral& peripheral, mm::Buffer& src, mm::Correction& corr) {
+    wireShift(d, peripheral, src, corr, 200, "1,2");
+    uint8_t* s = src.data();
+    for (nrOfLightsType i = 0; i < src.count(); i++) {
+        s[i * 3 + 0] = static_cast<uint8_t>(i * 5 + 3);
+        s[i * 3 + 1] = static_cast<uint8_t>(i * 11);
+        s[i * 3 + 2] = static_cast<uint8_t>(i * 17 + 7);
+    }
+    peripheral.setWantRing(true);
+    const size_t rowBytes = static_cast<size_t>(corr.outChannels) * 24 * 1 * d.outputsPerPin();
+    return peripheral.busInitRing(rowBytes, static_cast<uint32_t>(d.maxLaneLights()));
+}
+
 } // namespace
 
 // 1.
@@ -434,18 +444,7 @@ TEST_CASE("MoonI80 ring: a recycled buffer produces the same bytes as a fresh on
     MockRingPeripheral peripheral;
     mm::Buffer src;
     mm::Correction corr;
-    wireShift(d, peripheral, src, corr, 200, "1,2");
-    uint8_t* s = src.data();
-    for (nrOfLightsType i = 0; i < src.count(); i++) {
-        s[i * 3 + 0] = static_cast<uint8_t>(i * 5 + 3);
-        s[i * 3 + 1] = static_cast<uint8_t>(i * 11);
-        s[i * 3 + 2] = static_cast<uint8_t>(i * 17 + 7);
-    }
-    const uint8_t outCh = corr.outChannels;
-
-    peripheral.setWantRing(true);
-    const size_t rowBytes = static_cast<size_t>(outCh) * 24 * 1 * d.outputsPerPin();
-    REQUIRE(peripheral.busInitRing(rowBytes, static_cast<uint32_t>(d.maxLaneLights())));
+    REQUIRE(wireRing(d, peripheral, src, corr));
 
     std::vector<uint8_t> first = peripheral.driveRingFrame();
     std::vector<uint8_t> second = peripheral.driveRingFrame();   // same buffers, recycled — not re-init'd
@@ -488,17 +487,7 @@ TEST_CASE("MoonI80 ring: the encode reads a per-frame snapshot, not the live sou
     MockRingPeripheral peripheral;
     mm::Buffer src;
     mm::Correction corr;
-    wireShift(d, peripheral, src, corr, 200, "1,2");
-    uint8_t* s = src.data();
-    for (nrOfLightsType i = 0; i < src.count(); i++) {
-        s[i * 3 + 0] = static_cast<uint8_t>(i * 5 + 3);
-        s[i * 3 + 1] = static_cast<uint8_t>(i * 11);
-        s[i * 3 + 2] = static_cast<uint8_t>(i * 17 + 7);
-    }
-    const uint8_t outCh = corr.outChannels;
-    peripheral.setWantRing(true);
-    const size_t rowBytes = static_cast<size_t>(outCh) * 24 * 1 * d.outputsPerPin();
-    REQUIRE(peripheral.busInitRing(rowBytes, static_cast<uint32_t>(d.maxLaneLights())));
+    REQUIRE(wireRing(d, peripheral, src, corr));
 
     // Freeze the source, then SCRIBBLE all over the live buffer as the render thread would between kick and wire-completion. The snapshot must shield the encode from it.
     REQUIRE(d.snapshotForTest());
@@ -516,6 +505,39 @@ TEST_CASE("MoonI80 ring: the encode reads a per-frame snapshot, not the live sou
     CHECK(std::memcmp(fromMutated.data(), fromSnapshot.data(), fromMutated.size()) != 0);
 }
 
+// The refill interrupt runs while a flash write on the other core can switch off the cache PSRAM sits behind, so on the snapshot it reads nothing of the source Buffer, a module's member in PSRAM, not even its channel count.
+TEST_CASE("MoonI80 ring: a refill from the snapshot reads nothing of the source buffer") {
+    MockRingDriver d;
+    MockRingPeripheral peripheral;
+    mm::Buffer src;
+    mm::Correction corr;
+    REQUIRE(wireRing(d, peripheral, src, corr));
+    REQUIRE(d.snapshotForTest());
+    const std::vector<uint8_t> withSource = peripheral.driveRingFrame();
+    d.dropSourceForTest();   // a read of the source Buffer now dereferences null
+    const std::vector<uint8_t> withoutSource = peripheral.driveRingFrame();
+    REQUIRE(withSource.size() == withoutSource.size());
+    CHECK(std::memcmp(withSource.data(), withoutSource.data(), withSource.size()) == 0);
+}
+
+// A flash save on the other core cuts PSRAM off mid-refill, so a ring whose refill would read PSRAM refuses to run, says why, and leaves no ring behind.
+TEST_CASE("MoonI80 ring: with the snapshot off and the frame in PSRAM, the ring refuses and leaves no ring behind") {
+    struct Psram { ~Psram() { mm::platform::setTestPsramRange(nullptr, nullptr); } } psram;   // restored however the test ends
+    MockRingDriver d;
+    MockRingPeripheral peripheral;
+    mm::Buffer src;
+    mm::Correction corr;
+    peripheral.setWantRing(true);
+    wireShift(d, peripheral, src, corr, 64, "1,2");
+    REQUIRE(peripheral.busIsRing());
+    mm::platform::setTestPsramRange(src.data(), src.data() + static_cast<size_t>(src.count()) * src.channelsPerLight());
+    d.ringSnapshot = false;
+    d.applyState();
+    CHECK_FALSE(peripheral.busIsRing());
+    REQUIRE(d.status() != nullptr);
+    CHECK(std::strstr(d.status(), "ring refused") != nullptr);
+}
+
 // 6.
 // WINDOWED SNAPSHOT, the snapshot copies only THIS DRIVER'S WINDOW (winLen_ × srcCh from winStart_), not the whole source, then biases encodeSrc_ by -winStart_ so the encode's index math is unchanged.
 // With a NON-ZERO window start the bias is load-bearing (a plain full-copy would read the wrong pixels), so this drives the same content two ways, once through a windowed snapshot at start=W, once by hand-offsetting a whole-buffer source so the live read lands on the same pixels, and asserts they match.
@@ -846,54 +868,6 @@ TEST_CASE("MoonI80 ring: a failed ring build tears the bus down (no leaked ring)
     CHECK_FALSE(peripheral.busIsRing());   // the ring is gone, not merely unreferenced
 }
 
-TEST_CASE("MoonI80 ring: the PARALLEL snapshot's range-split is byte-identical to the whole-range serial") {
-    // The fork-join correctness oracle.
-    // On device the two [lo,hi) halves run on two cores; the bytes must be identical to one serial pass.
-    // Here one thread runs both ranges, same requirement, since the ranges are disjoint and stateless: copyRange(0,half)+copyRange(half,N) == copyRange(0,N).
-    // The snapshot is now a raw memcpy at SOURCE channel stride (correction fuses into encodeRows downstream).
-    MockRingDriver d;
-    MockRingPeripheral peripheral;
-    mm::Buffer src;
-    mm::Correction corr;
-    wireShift(d, peripheral, src, corr, 200, "1,2");   // 16 strands × 200, a real window
-    // Distinctive per-light source so a mis-split (gap/overlap/wrong stride) can't accidentally match.
-    uint8_t* s = src.data();
-    for (mm::nrOfLightsType i = 0; i < src.count(); i++) {
-        s[i * 3 + 0] = static_cast<uint8_t>(i * 7 + 1);
-        s[i * 3 + 1] = static_cast<uint8_t>(i * 13 + 5);
-        s[i * 3 + 2] = static_cast<uint8_t>(i * 29 + 3);
-    }
-    const uint8_t outCh = corr.outChannels;
-    const uint8_t srcCh = static_cast<uint8_t>(src.channelsPerLight());
-    const size_t rowBytes = static_cast<size_t>(outCh) * 24 * 1 * d.outputsPerPin();
-    peripheral.setWantRing(true);
-    REQUIRE(peripheral.busInitRing(rowBytes, static_cast<uint32_t>(d.maxLaneLights())));
-    // snapshotForTest sizes snapshotBuf_ (ensureSnapshotCap) and runs one full serial snapshot, after it, the snapshot state (snapCopy*) is set and the buffer exists, so the manual re-runs below are safe.
-    REQUIRE(d.snapshotForTest());
-
-    const mm::nrOfLightsType N = d.winLenForTest();
-    REQUIRE(N > 4);
-    const size_t bufBytes = static_cast<size_t>(N) * srcCh;   // snapshot is srcCh-stride now
-
-    // Reference: one whole-range copy over the (now-allocated) snapshot buffer.
-    d.setSnapCopyForTest();
-    std::memset(d.snapshotBufForTest(), 0xEE, bufBytes);
-    d.copyRangeForTest(0, N);
-    std::vector<uint8_t> whole(d.snapshotBufForTest(), d.snapshotBufForTest() + bufBytes);
-
-    // Split at the cache-line-aligned midpoint, exactly as the production path picks it (srcCh stride).
-    const mm::nrOfLightsType half = MockRingDriver::snapHalfForTest(N, srcCh);
-    REQUIRE(half > 0);
-    REQUIRE(half < N);
-    std::memset(d.snapshotBufForTest(), 0xEE, bufBytes);
-    d.copyRangeForTest(0, half);        // "core 0" half
-    d.copyRangeForTest(half, N);        // "core 1" half
-    std::vector<uint8_t> split(d.snapshotBufForTest(), d.snapshotBufForTest() + bufBytes);
-
-    REQUIRE(split.size() == whole.size());
-    CHECK(std::memcmp(split.data(), whole.data(), bufBytes) == 0);
-}
-
 // The snapshot window clamp must key on the SOURCE stride (srcCh), not outCh, the buffer is a raw srcCh-strided memcpy.
 // With outCh > srcCh (an RGB source through an RGBW correction: srcCh=3, outCh=4) an outCh-based clamp would compute winLen*4 > winLen*3 and silently drop ~1/4 of the window, leaving its tail reading stale bytes.
 // This pins the full window survives.
diff --git a/test/unit/light/unit_ParallelLedDriver_swap.cpp b/test/unit/light/unit_ParallelLedDriver_swap.cpp
index b0d4093b3..367dd636b 100644
--- a/test/unit/light/unit_ParallelLedDriver_swap.cpp
+++ b/test/unit/light/unit_ParallelLedDriver_swap.cpp
@@ -44,7 +44,8 @@ struct SwapMock : mm::LedPeripheral {
     const char* initFailMsg() const override { return "mock init failed"; }
     mm::LedHwBlock hwBlock() const override { return block; }
 
-    void addBusControls(mm::ControlList&) override {}
+    void addBusControls(mm::ControlList& controls) override { controls.addPin("clockPin", owner_->clockPin); }   // as both LCD backends declare it
+    void addRingControls(mm::ControlList& controls) override { controls.addControl("ringBufs", owner_->ringBufs, 2, 64); }   // as LCD-MM declares it
     bool busControlTriggersBuild(const char*) const override { return false; }
     void recordBusPins() override {}
     bool extraBusPinsCurrent() const override { return true; }
@@ -98,6 +99,28 @@ void changePeripheralTo(mm::ParallelLedDriver& d, uint8_t index) {
     d.onControlChanged("peripheral");
 }
 
+// Wire a working driver on pins 1 and 2. A fresh driver seeds the first registered backend, swapA.
+void wireDriver(mm::ParallelLedDriver& d, mm::Buffer& src, mm::Correction& corr) {
+    std::strcpy(d.pins, "1,2");
+    REQUIRE(src.allocate(64, 3) == true);
+    mm::test::rebuildFromPreset(corr, 255, mm::test::PresetOrder::GRB);
+    d.defineControls();
+    d.setSourceBuffer(&src);
+    d.correctionForTest() = corr;
+    d.applyState();
+}
+
+// The `peripheral` Select's index for a backend's label, or -1: the board-filtered option list in registry order, which a test does not hardcode. A Select keeps its options in aux and their count in max.
+int peripheralIndex(mm::ParallelLedDriver& d, const char* label) {
+    const int sel = mm::test::controlIndex(d, "peripheral");
+    if (sel < 0) return -1;
+    const auto& c = d.controls()[static_cast<uint8_t>(sel)];
+    const char* const* opts = reinterpret_cast<const char* const*>(c.aux);
+    for (int k = 0; k < c.max; k++)
+        if (opts[k] && std::strcmp(opts[k], label) == 0) return k;
+    return -1;
+}
+
 } // namespace
 
 TEST_CASE("ParallelLedDriver: a peripheral swap does not double-free or dangle the control list") {
@@ -108,29 +131,13 @@ TEST_CASE("ParallelLedDriver: a peripheral swap does not double-free or dangle t
         mm::ParallelLedDriver d;
         mm::Buffer src;
         mm::Correction corr;
-        // Fresh driver seeds the first registered backend (swapA). Wire a working config.
-        std::strcpy(d.pins, "1,2");
-        REQUIRE(src.allocate(64, 3) == true);
-        mm::test::rebuildFromPreset(corr, 255, mm::test::PresetOrder::GRB);
-        d.defineControls();
-        d.setSourceBuffer(&src);
-        d.correctionForTest() = corr;
-        d.applyState();
+        wireDriver(d, src, corr);
 
         // Exactly ONE backend is live for a driver holding a single peripheral.
         CHECK(SwapMock::live == liveBefore + 1);
 
-        // Resolve labels → board-filtered indices via the driver's own option list (order is registry order, which the test does not hardcode). A Select stores its options in aux and its option COUNT in max (hi = max-1), the shape defineDriverControls uses for the peripheral Select.
-        int aIdx = -1, bIdx = -1;
-        const auto& cs = d.controls();
-        int selIdx = mm::test::controlIndex(d, "peripheral");
-        REQUIRE(selIdx >= 0);
-        const char* const* opts = reinterpret_cast<const char* const*>(cs[static_cast<uint8_t>(selIdx)].aux);
-        const int optCount = cs[static_cast<uint8_t>(selIdx)].max;   // addSelect stores optionCount in max
-        for (int k = 0; k < optCount; k++) {
-            if (opts[k] && std::strcmp(opts[k], "swapA") == 0) aIdx = k;
-            if (opts[k] && std::strcmp(opts[k], "swapB") == 0) bIdx = k;
-        }
+        const int aIdx = peripheralIndex(d, "swapA");
+        const int bIdx = peripheralIndex(d, "swapB");
         REQUIRE(aIdx >= 0);
         REQUIRE(bIdx >= 0);
 
@@ -173,21 +180,8 @@ TEST_CASE("ParallelLedDriver: a live peripheral swap quiesces the render worker
         mm::ParallelLedDriver d;
         mm::Buffer src;
         mm::Correction corr;
-        std::strcpy(d.pins, "1,2");
-        REQUIRE(src.allocate(64, 3) == true);
-        mm::test::rebuildFromPreset(corr, 255, mm::test::PresetOrder::GRB);
-        d.defineControls();
-        d.setSourceBuffer(&src);
-        d.correctionForTest() = corr;
-        d.applyState();
-
-        const auto& cs = d.controls();
-        int selIdx = mm::test::controlIndex(d, "peripheral");
-        REQUIRE(selIdx >= 0);
-        const char* const* opts = reinterpret_cast<const char* const*>(cs[static_cast<uint8_t>(selIdx)].aux);
-        const int optCount = cs[static_cast<uint8_t>(selIdx)].max;
-        int bIdx = -1;
-        for (int k = 0; k < optCount; k++) if (opts[k] && std::strcmp(opts[k], "swapB") == 0) bIdx = k;
+        wireDriver(d, src, corr);
+        const int bIdx = peripheralIndex(d, "swapB");
         REQUIRE(bIdx >= 0);
 
         // Reset the fire count to ZERO immediately before the swap so the dtor's "had the hook fired?" snapshot reflects ONLY this swap, not an earlier fire from applyState/rebuild. Otherwise any prior fire would make g_hookFiredBeforeLastDtor true even if THIS swap freed A before quiescing.
@@ -202,3 +196,44 @@ TEST_CASE("ParallelLedDriver: a live peripheral swap quiesces the render worker
 
     mm::MoonModule::setQuiesceRenderHook(nullptr);
 }
+
+// The wiring is the board's and the ring's settings the user's, so both survive the peripheral they are declared through. Each backend once held its own copy at a default, so a switch there and back put WR on a data pin and reset the ring.
+TEST_CASE("ParallelLedDriver: switching the peripheral and back keeps the clockPin and the ring's settings") {
+    RegistryScope registry;
+    mm::ParallelLedDriver d;
+    mm::Buffer src;
+    mm::Correction corr;
+    wireDriver(d, src, corr);
+    const int aIdx = peripheralIndex(d, "swapA");
+    const int bIdx = peripheralIndex(d, "swapB");
+    REQUIRE(aIdx >= 0);
+    REQUIRE(bIdx >= 0);
+    changePeripheralTo(d, static_cast<uint8_t>(aIdx));
+    mm::test::setControlValue<int8_t>(d, "clockPin", 3);
+    mm::test::setControlValue<uint8_t>(d, "ringBufs", 20);
+
+    changePeripheralTo(d, static_cast<uint8_t>(bIdx));
+    changePeripheralTo(d, static_cast<uint8_t>(aIdx));
+
+    const int idx = mm::test::controlIndex(d, "clockPin");
+    REQUIRE(idx >= 0);
+    CHECK(*static_cast<const int8_t*>(d.controls()[static_cast<uint8_t>(idx)].ptr) == 3);
+    CHECK(d.clockPin == 3);
+    const int ring = mm::test::controlIndex(d, "ringBufs");
+    REQUIRE(ring >= 0);
+    CHECK(*static_cast<const uint8_t*>(d.controls()[static_cast<uint8_t>(ring)].ptr) == 20);
+    CHECK(d.ringBufs == 20);
+}
+
+// The reset button's default comes from a fresh driver, which on an S3 starts on LCD-IDF: settings a ring-capable peripheral declared had none there.
+TEST_CASE("ParallelLedDriver: the ring's settings are declared, hidden, without a ring-capable peripheral, so their defaults are known") {
+    RegistryScope registry;
+    mm::ParallelLedDriver d;
+    d.defineControls();
+    for (const char* name : {"shiftOverclock", "useRing", "ringSnapshot", "ringAuto", "ringRows", "ringBufs", "ringPadUs"}) {
+        CAPTURE(name);
+        const int idx = mm::test::controlIndex(d, name);
+        REQUIRE(idx >= 0);
+        CHECK(d.controls()[static_cast<uint8_t>(idx)].hidden);
+    }
+}
diff --git a/test/unit/light/unit_ParallelSlots.cpp b/test/unit/light/unit_ParallelSlots.cpp
index 0bcf347dc..26a32c933 100644
--- a/test/unit/light/unit_ParallelSlots.cpp
+++ b/test/unit/light/unit_ParallelSlots.cpp
@@ -475,7 +475,7 @@ TEST_CASE("shift encoder: prefill + data-only == the whole-slot encode, byte for
     const uint64_t mask = 0xFFFFu;   // all 16 strands of 2 pins active
 
     // A dense, varied wire pattern per row, a zeroed buffer would hide a bug in either path.
-    uint8_t wire[16 * kCh];
+    uint8_t wire[64 * kCh];   // the encoder reads all 64 strands' bytes, as the driver's scratch holds them
     for (size_t i = 0; i < sizeof(wire); i++) wire[i] = static_cast<uint8_t>(i * 37 + 11);
 
     const size_t slotsPerLight = static_cast<size_t>(kCh) * 8 * 3 * kSh;
@@ -507,7 +507,7 @@ TEST_CASE("shift encoder: prefill + data-only agree on an exhausted strand") {
     const uint8_t latchBit = 4;
     const uint64_t mask = 0x1u;   // ONLY strand 0 of pin 0 — strands 1..7 are exhausted
 
-    uint8_t wire[8 * kCh];
+    uint8_t wire[64 * kCh];   // the encoder reads all 64 strands' bytes, as the driver's scratch holds them
     for (size_t i = 0; i < sizeof(wire); i++) wire[i] = 0xFF;   // every strand's wire is hot...
 
     const size_t slotsPerLight = static_cast<size_t>(kCh) * 8 * 3 * kSh;
diff --git a/test/unit/light/unit_RegionModifier_prepareScope.cpp b/test/unit/light/unit_RegionModifier_prepareScope.cpp
new file mode 100644
index 000000000..41f9894b3
--- /dev/null
+++ b/test/unit/light/unit_RegionModifier_prepareScope.cpp
@@ -0,0 +1,93 @@
+/// @module RegionModifier
+
+#include "doctest.h"
+#include "core/module/Scheduler.h"
+#include "light/modifiers/RegionModifier.h"
+#include "light/layouts/GridLayout.h"
+#include "light/layouts/Layouts.h"
+#include "light/layers/Effects.h"
+#include "light/layers/Layer.h"
+#include "light/drivers/Drivers.h"
+#include "light/effects/EffectBase.h"
+
+// A show moving a Region 50 times a second re-prepared the whole tree each time, 0.5 s a frame on an ESP32-S3.
+
+namespace {
+
+// Counts its prepares.
+class CountingEffect : public mm::EffectBase {
+public:
+    void tick() MM_NONBLOCKING override {}
+    void prepare() override { prepares++; }
+    int prepares = 0;
+};
+
+// Counts the structural rebuilds the output peripheral would take.
+class CountingDriver : public mm::DriverBase {
+public:
+    void setSourceBuffer(mm::Buffer*) override {}
+    void tick() MM_NONBLOCKING override {}
+    void defineDriverControls() override { defineCorrectionControls(); }
+    void prepare() override { prepares++; }
+    int prepares = 0;
+};
+
+// Two layers over one grid, a Region in the first, and a driver.
+struct Rig {
+    mm::Scheduler s;
+    mm::Layouts layouts;
+    mm::GridLayout grid;
+    mm::Effects effects;
+    mm::Layer layerA, layerB;
+    mm::RegionModifier region;
+    CountingEffect fxA, fxB;
+    mm::Drivers drivers;
+    CountingDriver drv;
+    Rig() {
+        grid.width = 16; grid.height = 16; grid.depth = 1;
+        layouts.addChild(&grid);
+        region.setName("Region");
+        region.endX = 50;
+        layerA.addChild(&region);
+        layerA.addChild(&fxA);
+        layerB.addChild(&fxB);
+        effects.addChild(&layerA);
+        effects.addChild(&layerB);
+        effects.setLayouts(&layouts);
+        drivers.setEffects(&effects);
+        drivers.addChild(&drv);
+        drivers.on = true;
+        s.addModule(&layouts);
+        s.addModule(&effects);
+        s.addModule(&drivers);
+        for (mm::MoonModule* m : {static_cast<mm::MoonModule*>(&layouts), static_cast<mm::MoonModule*>(&effects), static_cast<mm::MoonModule*>(&drivers)})
+            m->defineControls();
+        s.setup();
+    }
+    // The encode worker ticks `drv`, which goes before `drivers` does, so the worker stops first.
+    ~Rig() { drivers.release(); }
+    void zero() { fxA.prepares = fxB.prepares = drv.prepares = 0; }
+};
+
+}  // namespace
+
+TEST_CASE("a Region change prepares its own layer, not the other layer or the drivers") {
+    Rig r;
+    r.zero();
+    REQUIRE(r.s.setControl("Region", "endX", "{\"value\":60}") == mm::Scheduler::SetControlResult::Ok);
+    r.s.tick();
+    CHECK(r.fxA.prepares == 1);
+    CHECK(r.fxB.prepares == 0);
+    CHECK(r.drv.prepares == 0);   // two layers composite into Drivers' own buffer, whose shape a Region does not change
+    CHECK(r.layerA.width() == 10);   // the change did apply: 60 percent of 16, the window's end ceiling to an exclusive one
+}
+
+TEST_CASE("after a layer's rebuild, Drivers prepares again only when the layer's shape changed") {
+    Rig r;
+    r.zero();
+    r.s.prepareSubtree(&r.layerA);   // the shape it sized from is unchanged
+    CHECK(r.drv.prepares == 0);
+    r.layerA.setChannelsPerLight(4);   // as a white channel being added would
+    r.s.prepareSubtree(&r.layerA);
+    CHECK(r.drv.prepares == 1);
+}